link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

CustomRules.cs

using System ;

using Fiddler ;

using System . Text ;

using System . Windows . Forms ;

using System . Collections ;

using System . Collections . Generic ;

using System . IO ;

using System . Text . RegularExpressions ;

using System . Diagnostics ;

using System . Net ;

using System . Threading ;

using Microsoft . Win32 ;

using System . Net . Sockets ;

// EKFiddle

// This is a modified version of the default CustomRules.cs file.

// Its purpose is to provide a framework to analyze exploit kits,

// malvertising, and malicious traffic in general.

// For more information and to get the latest version:

// https://github.com/malwareinfosec/EKFiddle

// INTRODUCTION

// This is the FiddlerScript Rules file, which creates some of the menu commands and

// other features of Fiddler. You can edit this file to modify or add new commands.

// NOTE: This is the C# version of the script, which can be used on Windows and Mono,

// unlike the JScript.NET script, which can be used only on Windows. In order to use

// a JScript.NET script on Mono, you must rewrite it in C#.

// The original version of this file is named SampleRules.cs and it is in the

// \Fiddler\ app folder. When Fiddler first starts, it creates a copy named

// CustomRules.cs inside your \Documents\Fiddler2\Scripts folder. If you make a

// mistake in editing this file, simply delete the CustomRules.cs file and restart

// Fiddler. A fresh copy of the default rules will be created from the original

// sample rules file.

namespace Fiddler

{

public static class Handlers

{

// The following snippet demonstrates a custom-bound column for the Web Sessions list.

// See http://fiddler2.com/r/?fiddlercolumns for more info

[BindUIColumn("Method", 60)]

public static string FillMethodColumn(Session oS)

{

return oS.RequestMethod;

}

// The following snippet demonstrates how to create a custom tab that shows simple text

[BindUITab("Flags")]

public static string FlagsReport(Session[] arrSess)

{

StringBuilder oSB = new StringBuilder();

for (int i = 0; i < arrSess.Length; i++)

{

oSB.AppendLine("SESSION FLAGS");

oSB.AppendFormat("{0}: {1}\n", arrSess[i].id, arrSess[i].fullUrl);

foreach(DictionaryEntry sFlag in arrSess[i].oFlags)

{

oSB.AppendFormat("\t{0}:\t\t{1}\n", sFlag.Key, sFlag.Value);

}

return oSB.ToString();

}

[ QuickLinkMenu ( " EKFiddle " ) ]

[ QuickLinkItem ( " 1- QuickExec commands " , " ekfiddle " ) ]

[ QuickLinkItem ( " 2- GitHub " , " https://github.com/malwareinfosec/EKFiddle " ) ]

[ QuickLinkItem ( " 3- Twitter " , " https://www.twitter.com/EKFiddle " ) ]

public static void DoLinksMenu ( string sText , string sAction )

{

if ( sAction == " ekfiddle " )

{

MessageBox . Show ( " The following commands can be typed in the QuickExec bar: " + " \n " + " \n "

+ " -> save: Save current traffic " + " \n "

+ " -> ui: Change UI mode between standard, and advanced " + " \n "

+ " -> vpn: Load a custom .opvn file " + " \n "

+ " -> proxy: Chain Fiddler to upstream proxy " + " \n "

+ " -> import: Import a SAZ or PCAP " + " \n "

+ " -> regexes: View MasterRegexes and CustomRegexes " + " \n "

+ " -> run: Run regexes against current traffic " + " \n "

+ " -> reset: Clear current comments and colors "

, " EKFiddle: QuickExec commands " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

} else {

Utilities . LaunchHyperlink ( sAction ) ;

}

// EKFiddle realtime monitoring

[ RulesOption ( " EKFiddle Real-Time Monitoring " ) ]

public static bool m_EKFiddleRealTime = true ;

// EKFiddle realtime inspection of images

[ RulesOption ( " EKFiddle Inspect Images (slow) " ) ]

public static bool m_EKFiddleInspectImages = false ;

[ RulesOption ( " Hide 304s " ) ]

[ BindPref ( " fiddlerscript.rules.Hide304s " ) ]

public static bool m_Hide304s = false ;

// Automatic Authentication

[ RulesOption ( " &Automatically Authenticate " ) ]

[ BindPref ( " fiddlerscript.rules.AutoAuth " ) ]

public static bool m_AutoAuth = false ;

// Force the user of CORS

[ RulesOption ( " &Force CORS " ) ]

public static bool m_ForceCORS = false ;

// Cause Fiddler to delay HTTP traffic to simulate typical 56k modem conditions

[ RulesOption ( " Simulate &Modem Speeds " , " Per&formance " ) ]

public static bool m_SimulateModem = false ;

// Removes HTTP-caching related headers and specifies "no-cache" on requests and responses

[ RulesOption ( " &Disable Caching " , " Per&formance " ) ]

public static bool m_DisableCaching = false ;

[ RulesOption ( " Cache Always &Fresh " , " Per&formance " ) ]

public static bool m_AlwaysFresh = false ;

// Cause Fiddler to override the Accept-Language header with one of the defined values

// Inspired by http://tobint.com/blog/fiddler-script-for-accept-language-testing/

[ RulesString ( " &Accept-Languages " , true ) ]

[ BindPref ( " fiddlerscript.ephemeral.AcceptLanguage " ) ]

[ RulesStringValue ( 0 , " &Custom... " , " %CUSTOM% " ) ]

[ RulesStringValue ( 1 , " English (US) " , " en-US " ) ]

[ RulesStringValue ( 2 , " English (UK) " , " en-GB " ) ]

[ RulesStringValue ( 3 , " English (Canada) " , " en-CA " ) ]

[ RulesStringValue ( 4 , " English (Australia) " , " en-CA " ) ]

[ RulesStringValue ( 5 , " French " , " fr " ) ]

[ RulesStringValue ( 6 , " Spanish " , " es " ) ]

[ RulesStringValue ( 7 , " Italian " , " it-IT " ) ]

[ RulesStringValue ( 8 , " Portuguese (Brazil) " , " pt-BR " ) ]

[ RulesStringValue ( 9 , " German " , " de " ) ]

[ RulesStringValue ( 10 , " Japanese " , " ja " ) ]

[ RulesStringValue ( 11 , " Korean " , " ko " ) ]

[ RulesStringValue ( 12 , " Chinese (PRC) " , " zh-CN " ) ]

[ RulesStringValue ( 13 , " Chinese (Taiwan) " , " zh-TW " ) ]

[ RulesStringValue ( 14 , " Russian " , " ru " ) ]

public static string sAL = null ;

// Cause Fiddler to override the User-Agent header with one of the defined values

[ RulesString ( " &User-Agents " , true ) ]

[ BindPref ( " fiddlerscript.ephemeral.UserAgentString " ) ]

[ RulesStringValue ( 0 , " &Custom... " , " %CUSTOM% " ) ]

[ RulesStringValue ( 1 , " Internet Explorer " , " Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko " ) ]

[ RulesStringValue ( 2 , " -> IE &8 (Win7) " , " Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) " ) ]

[ RulesStringValue ( 3 , " -> IE 9 (Win7) " , " Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) " ) ]

[ RulesStringValue ( 4 , " -> IE 10 (Win7) " , " Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0) " ) ]

[ RulesStringValue ( 5 , " -> IE 11 (Win7) " , " Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko " ) ]

[ RulesStringValue ( 6 , " Chrome " , " Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 " ) ]

[ RulesStringValue ( 7 , " -> Chrome (Win7) " , " Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 " ) ]

[ RulesStringValue ( 8 , " -> Chrome (Win10) " , " Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 " ) ]

[ RulesStringValue ( 9 , " -> Chrome (Android) " , " Mozilla/5.0 (Linux; Android 5.1.1; Nexus 5 Build/LMY48B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.78 Mobile Safari/537.36 " ) ]

[ RulesStringValue ( 10 , " -> Chrome (iPhone) " , " Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) CriOS/60.0.3112.89 Mobile/15A5370a Safari/602.1 " ) ]

[ RulesStringValue ( 11 , " -> ChromeBook " , " Mozilla/5.0 (X11; CrOS x86_64 6680.52.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.74 Safari/537.36 " ) ]

[ RulesStringValue ( 12 , " Edge (Win10) " , " Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299 " ) ]

[ RulesStringValue ( 13 , " &Opera " , " Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 OPR/46.0.2597.57 " ) ]

[ RulesStringValue ( 14 , " -> &Opera 46 (Win7) " , " Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 OPR/46.0.2597.57 " ) ]

[ RulesStringValue ( 15 , " -> &Opera 49 (Win10) " , " Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3188.4 Safari/537.36 OPR/49.0.2705.0 (Edition developer) " ) ]

[ RulesStringValue ( 16 , " &Firefox " , " Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0 " ) ]

[ RulesStringValue ( 17 , " -> &Firefox 3.6 (Win7) " , " Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.7) Gecko/20100625 Firefox/3.6.7 " ) ]

[ RulesStringValue ( 18 , " -> &Firefox 58 (Win7) " , " Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0 " ) ]

[ RulesStringValue ( 19 , " -> &Firefox 58 (Win10) " , " Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0 " ) ]

[ RulesStringValue ( 20 , " -> &Firefox (Mac) " , " Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0 " ) ]

[ RulesStringValue ( 21 , " Safari " , " Mozilla/5.0 (Macintosh; Intel Mac OS X 11.0) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/11.0 Safari/602.1.50 " ) ]

[ RulesStringValue ( 22 , " -> Mac (Safari 11) " , " Mozilla/5.0 (Macintosh; Intel Mac OS X 11.0) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/11.0 Safari/602.1.50 " ) ]

[ RulesStringValue ( 23 , " -> iPhone (Safari 11) " , " Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A356 Safari/604.1 " ) ]

[ RulesStringValue ( 24 , " -> iPad (Safari 11) " , " Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.25 (KHTML, like Gecko) Version/11.0 Mobile/15A5304j Safari/604.1 " ) ]

[ RulesStringValue ( 25 , " GoogleBot Crawler " , " Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) " ) ]

public static string sUA = null ;

// VPN

[ ToolsAction ( " VPN " ) ]

public static void DoVPN ( )

{

DoEKFiddleVPN ( ) ;

}

// Proxy

[ ToolsAction ( " Proxy " ) ]

public static void DoProxy ( )

{

DoEKFiddleProxy ( ) ;

}

// Import traffic capture

[ ToolsAction ( " Import SAZ/PCAP " ) ]

public static void DoCallImportCapture ( )

{

DoImportCapture ( ) ;

}

// Update/View Regexes

[ ToolsAction ( " Update/View Regexes " , " &Regexes " ) ]

public static void DoCallOpenRegexes ( )

{

DoOpenRegexes ( ) ;

}

// Run Regexes

[ ToolsAction ( " Run Regexes " , " &Regexes " ) ]

public static void DoCallEKFiddleRunRegexes ( )

{

DoEKFiddleRunRegexes ( ) ;

}

// Crawler

[ ToolsAction ( " Start crawler " , " &Crawler " ) ]

public static void DoCallEKFiddleStartCrawler ( )

{

EKFiddleStartCrawler ( false , " none " , " none " , 0 , 0 , 0 ) ;

}

[ ToolsAction ( " Stop crawler " , " &Crawler " ) ]

public static void DoCallEKFiddleStopCrawler ( )

{

FiddlerApplication . Prefs . SetBoolPref ( " fiddler.ekfiddleCrawl " , false ) ;

}

// Misc. tasks

[ ToolsAction ( " Keep unique hostnames only " , " Misc. " ) ]

public static void doUniqHostnames ( )

{

// Loop through each session

FiddlerObject . UI . actSelectAll ( ) ;

var arrSessions = FiddlerApplication . UI . GetSelectedSessions ( ) ;

// Create new list

List < string > HostnameList = new List < string > ( ) ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

var currentHostname = arrSessions [ x ] . hostname ;

if ( HostnameList . Contains ( currentHostname ) )

{

// item already exists

arrSessions [ x ] . oFlags [ " ui-comments " ] = " deleteme " ;

} else {

// item is new

HostnameList . Add ( currentHostname ) ;

}

FiddlerApplication . UI . SelectSessionsMatchingCriteria (

delegate ( Session oS )

{

return ( " deleteme " == oS . oFlags [ " ui-comments " ] ) ;

}

) ;

FiddlerApplication . UI . actRemoveSelectedSessions ( ) ;

}

[ ToolsAction ( " Keep unique hostname AND unique hash " , " Misc. " ) ]

public static void doUniqHostnameHash ( )

{

// Loop through each session

FiddlerObject . UI . actSelectAll ( ) ;

var arrSessions = FiddlerApplication . UI . GetSelectedSessions ( ) ;

// Create new list

List < string > HostHashList = new List < string > ( ) ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

var currentHostname = arrSessions [ x ] . hostname ;

var hash = arrSessions [ x ] . GetResponseBodyHash ( " sha256 " ) . Replace ( " - " , " " ) . ToLower ( ) ;

if ( HostHashList . Contains ( currentHostname + hash ) )

{

// item already exists

arrSessions [ x ] . oFlags [ " ui-comments " ] = " deleteme " ;

} else {

// item is new

HostHashList . Add ( currentHostname + hash ) ;

}

FiddlerApplication . UI . SelectSessionsMatchingCriteria (

delegate ( Session oS )

{

return ( " deleteme " == oS . oFlags [ " ui-comments " ] ) ;

}

) ;

FiddlerApplication . UI . actRemoveSelectedSessions ( ) ;

}

[ ToolsAction ( " Flag referers " , " Misc. " ) ]

public static void doRefererCheck ( )

{

// Loop through each session

FiddlerObject . UI . actSelectAll ( ) ;

var arrSessions = FiddlerApplication . UI . GetSelectedSessions ( ) ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

var currentHostname = arrSessions [ x ] . hostname ;

var currentReferer = arrSessions [ x ] . oRequest [ " Referer " ] ;

if ( currentReferer . Contains ( currentHostname ) || currentReferer == " " )

{

arrSessions [ x ] . oFlags [ " ui-comments " ] = " NOREFERER " ;

arrSessions [ x ] . RefreshUI ( ) ;

} else {

arrSessions [ x ] . oFlags [ " ui-comments " ] = " HASREFERER " ;

arrSessions [ x ] . RefreshUI ( ) ;

}

[ ToolsAction ( " View Filterset " , " Advanced Filterset " ) ]

public static void doViewFilterset ( )

{

viewFilters ( ) ;

}

[ ToolsAction ( " Run Filterset " , " Advanced Filterset " ) ]

public static void dorunFilters ( )

{

runFilters ( ) ;

}

// Themes

[ ToolsAction ( " EKFiddle " , " Themes " ) ]

public static void DoThemesEKFiddle ( )

{

DoFiddlerTheme ( " EKFiddle.ico " , " EKFiddle_saz.ico " ) ;

}

[ ToolsAction ( " Fiddler 2003 " , " Themes " ) ]

public static void DoThemesFiddler2003 ( )

{

DoFiddlerTheme ( " 2003.ico " , " SAZ2008.ico " ) ;

}

[ ToolsAction ( " Fiddler 2008 " , " Themes " ) ]

public static void DoThemesFiddler2008 ( )

{

DoFiddlerTheme ( " 2008.ico " , " SAZ2008.ico " ) ;

}

[ ToolsAction ( " Fiddler 2012 " , " Themes " ) ]

public static void DoThemesFiddler2012 ( )

{

DoFiddlerTheme ( " 2012.ico " , " SAZ2008.ico " ) ;

}

[ ToolsAction ( " Restore default " , " Themes " ) ]

public static void DoThemesFiddlerDefault ( )

{

DoFiddlerTheme ( " App.ico " , " saz.ico " ) ;

}

[ ToolsAction ( " UI mode " ) ]

public static void DoUIMode ( )

{

DoEKFiddleAdvancedUI ( ) ;

}

// Force a manual reload of the script file. Resets all

// RulesOption variables to their defaults.

[ ToolsAction ( " Reset Script " ) ]

public static void DoManualReload ( )

{

FiddlerObject . ReloadScript ( ) ;

}

// Connect the dots

[ ContextAction ( " Connect-the-dots " ) ]

public static void DoConnectTheDots ( Session [ ] arrSessions )

{

// Check how many sessions are selected (we only allow 1)

if ( arrSessions . Length > 1 )

{

MessageBox . Show ( " Please select only 1 session. " , " EKFiddle " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

else if ( arrSessions . Length > 0 )

{

List < int > maliciousSessionsList = new List < int > ( ) ;

connectDots ( arrSessions [ 0 ] . id , arrSessions [ 0 ] . hostname , arrSessions [ 0 ] . fullUrl , maliciousSessionsList ) ;

}

// Add/Edit tags

[ ContextAction ( " Add/Edit Tags " ) ]

public static void DoAddTags ( Session [ ] arrSessions )

{

if ( arrSessions . Length > 0 )

{

string tags = FiddlerObject . prompt ( " Please enter tags below: " , arrSessions [ 0 ] [ " ui-tags " ] , " EKFiddle: Add/Edit Tags " ) ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

arrSessions [ x ] [ " ui-tags " ] = tags ;

arrSessions [ x ] . RefreshUI ( ) ;

}

// Advanced Filters

[ ContextAction ( " View Filterset " , " Advanced Filterset " ) ]

public static void DoViewFilters ( Session [ ] arrSessions )

{

viewFilters ( ) ;

}

[ ContextAction ( " Run Filterset " , " Advanced Filterset " ) ]

public static void DoRunFilters ( Session [ ] arrSessions )

{

runFilters ( ) ;

}

// Add hostname to local filters

[ ContextAction ( " Hide Hostname(s) " , " Advanced Filterset " ) ]

public static void DoFilterHostname ( Session [ ] arrSessions )

{

// Show dialog

DialogResult dialogEKFiddleFilters = MessageBox . Show ( " Would you like to add the selected hostname(s) to the filters? " , " EKFiddle Filters " , MessageBoxButtons . YesNo , MessageBoxIcon . Information ) ;

if ( dialogEKFiddleFilters == DialogResult . Yes )

{

using ( StreamWriter sw = File . AppendText ( @EKFiddleMiscPath + " Filters.txt " ) )

{

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

sw . WriteLine ( " hostname, " + arrSessions [ x ] . hostname ) ;

}

sw . Close ( ) ;

}

dorunFilters ( ) ;

}

// Add IP address to local filters

[ ContextAction ( " Hide IP Address(es) " , " Advanced Filterset " ) ]

public static void DoFilterIPAddress ( Session [ ] arrSessions )

{

// Show dialog

DialogResult dialogEKFiddleFilters = MessageBox . Show ( " Would you like to add the selected IP address(es) to the filters? " , " EKFiddle Filters " , MessageBoxButtons . YesNo , MessageBoxIcon . Information ) ;

if ( dialogEKFiddleFilters == DialogResult . Yes )

{

using ( StreamWriter sw = File . AppendText ( @EKFiddleMiscPath + " Filters.txt " ) )

{

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

sw . WriteLine ( " ipaddress, " + arrSessions [ x ] . oFlags [ " x-hostIP " ] ) ;

}

sw . Close ( ) ;

}

dorunFilters ( ) ;

}

// Add full URI to local filters

[ ContextAction ( " Hide Full URI(s) " , " Advanced Filterset " ) ]

public static void DoFilterURI ( Session [ ] arrSessions )

{

// Show dialog

DialogResult dialogEKFiddleFilters = MessageBox . Show ( " Would you like to add the selected URI(s) to the filters? " , " EKFiddle Filters " , MessageBoxButtons . YesNo , MessageBoxIcon . Information ) ;

if ( dialogEKFiddleFilters == DialogResult . Yes )

{

using ( StreamWriter sw = File . AppendText ( @EKFiddleMiscPath + " Filters.txt " ) )

{

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

sw . WriteLine ( " uri, " + arrSessions [ x ] . fullUrl ) ;

}

sw . Close ( ) ;

}

dorunFilters ( ) ;

}

// Add Response Body Hash to local filters

[ ContextAction ( " Hide Response Body Hash(es) " , " Advanced Filterset " ) ]

public static void DoFilterHash ( Session [ ] arrSessions )

{

// Show dialog

DialogResult dialogEKFiddleFilters = MessageBox . Show ( " Would you like to add the selected session(s) Response Body Hash(es) to the Filters? " , " EKFiddle Filters " , MessageBoxButtons . YesNo , MessageBoxIcon . Information ) ;

if ( dialogEKFiddleFilters == DialogResult . Yes )

{

using ( StreamWriter sw = File . AppendText ( @EKFiddleMiscPath + " Filters.txt " ) )

{

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

sw . WriteLine ( " body_sha-256, " + arrSessions [ x ] . GetResponseBodyHash ( " sha256 " ) . Replace ( " - " , " " ) . ToLower ( ) ) ;

}

sw . Close ( ) ;

}

dorunFilters ( ) ;

}

// Extract Hostname

[ ContextAction ( " Hostname(s) " , " Metadata " ) ]

public static void DoExtractHostname ( Session [ ] arrSessions )

{

List < string > hostnameList = new List < string > ( ) ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

hostnameList . Add ( arrSessions [ x ] . hostname ) ;

}

// Remove duplicate items

hostnameList . Sort ( ) ;

Int32 index = 0 ;

while ( index < hostnameList . Count - 1 )

{

if ( hostnameList [ index ] == hostnameList [ index + 1 ] ) {

hostnameList . RemoveAt ( index ) ;

} else {

index ++ ;

}

// Convert to Array

var hostnameArray = string . Join ( Environment . NewLine , hostnameList . ToArray ( ) ) ;

Utilities . CopyToClipboard ( hostnameArray ) ;

MessageBox . Show ( hostnameArray , " EKFiddle: Hostname(s) " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

// Check WHOIS

[ ContextAction ( " WHOIS " , " Metadata " ) ]

public static void DoCheckWhois ( Session [ ] arrSessions )

{

// Check how many sessions are selected (we only allow 1)

if ( arrSessions . Length > 1 )

{

MessageBox . Show ( " Please select only 1 session to query the WHOIS information for. " , " EKFiddle: Whois " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

else

{

// Look for the appropriate WHOIS server

string whoisServer = " whois.iana.org " ;

string domainName = arrSessions [ 0 ] . hostname . Replace ( " www. " , " " ) ;

// Lookup whoisserver

string [ ] resultWhoisLookup = DoWhoisLookup ( whoisServer , domainName ) . Split ( " \r \n " . ToCharArray ( ) , StringSplitOptions . RemoveEmptyEntries ) ;

foreach ( String item in resultWhoisLookup )

{

if ( item . StartsWith ( " whois: " ) )

{

whoisServer = Regex . Replace ( item , " whois: * " , " " ) ;

}

// Query that WHOIS server (if it's not empty)

if ( whoisServer != " " && null != whoisServer )

{

string whoisResults = DoWhoisLookup ( whoisServer , domainName ) ;

Utilities . CopyToClipboard ( whoisResults ) ;

MessageBox . Show ( whoisResults , " EKFiddle: WHOIS results " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

// Check Alexa rank

[ ContextAction ( " Alexa Rank " , " Metadata " ) ]

public static void DoCheckDomainAlexa ( Session [ ] arrSessions )

{

new Thread ( ( ) =>

{

// Initialize a new list

List < string > alexaRankList = new List < string > ( ) ;

Thread . CurrentThread . IsBackground = true ;

try

{

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

var AlexaRank = " " ;

int Num ;

bool popUrl = false ;

string hostname = arrSessions [ x ] . hostname ;

int totalSessions = arrSessions . Length ;

// Progress status

FiddlerApplication . UI . SetStatusText ( " Checking Alexa Rank " + ( x + 1 ) + " / " + totalSessions + " Sessions ( " + arrSessions [ x ] . hostname + " ) ... " ) ;

WebRequest request = WebRequest . Create ( " https://data.alexa.com/data?cli=10&dat=snbamz&url= " + hostname ) ;

WebResponse response = request . GetResponse ( ) ;

StreamReader sr = new StreamReader ( response . GetResponseStream ( ) ) ;

string line = " " ;

while ( ( line = sr . ReadLine ( ) ) != null )

{

if ( line . Contains ( " POPULARITY URL " ) )

{

popUrl = true ;

AlexaRank = Regex . Replace ( Regex . Replace ( line , " ^.*TEXT= \" " , " " ) , " \" .* " , " " ) ;

// Check the result is an integer

bool isNum = int . TryParse ( AlexaRank . ToString ( ) , out Num ) ;

if ( isNum )

{

alexaRankList . Add ( arrSessions [ x ] . host + " , " + AlexaRank ) ;

}

else

{

alexaRankList . Add ( arrSessions [ x ] . host + " , " + " N/A " ) ;

}

// Did not find the line "popularity url"

if ( ! popUrl )

{

alexaRankList . Add ( arrSessions [ x ] . host + " , " + " N/A " ) ;

}

sr . Close ( ) ;

// Sleep for 2 seconds if there is more than 1 host to lookup

if ( arrSessions . Length > 1 && x < arrSessions . Length - 1 )

{

Thread . Sleep ( 2000 ) ;

}

catch

{

FiddlerApplication . UI . SetStatusText ( " EKFiddle: an error occured trying to get Alexa Rank " ) ;

}

// Clean up Alexa sessions

FiddlerObject . uiInvoke ( EKFiddleTrimAlexaSessions ) ;

// Update status

var alexaRank = string . Join ( Environment . NewLine , alexaRankList . ToArray ( ) ) ;

MessageBox . Show ( alexaRank , " EKFiddle: Alexa Rank " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

} ) . Start ( ) ;

}

// Extract IP address

[ ContextAction ( " IP Address(es) " , " Metadata " ) ]

public static void DoExtractIP ( Session [ ] arrSessions )

{

List < string > IPList = new List < string > ( ) ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

IPList . Add ( arrSessions [ x ] . oFlags [ " x-hostIP " ] ) ;

}

// Remove duplicate items

IPList . Sort ( ) ;

Int32 index = 0 ;

while ( index < IPList . Count - 1 )

{

if ( IPList [ index ] == IPList [ index + 1 ] ) {

IPList . RemoveAt ( index ) ;

} else {

index ++ ;

}

// Convert to Array

var IPArray = string . Join ( Environment . NewLine , IPList . ToArray ( ) ) ;

Utilities . CopyToClipboard ( IPArray ) ;

MessageBox . Show ( IPArray , " EKFiddle: IP address(es) " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

[ ContextAction ( " Referer(s) " , " Metadata " ) ]

public static void doReferers ( Session [ ] arrSessions ) {

// Initialize a new list

List < string > referersList = new List < string > ( ) ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

if ( arrSessions [ x ] . oRequest . headers . Exists ( " Referer " ) ) {

referersList . Add ( arrSessions [ x ] . oRequest [ " Referer " ] ) ;

}

// Dup check

if ( referersList . Count != 0 )

{

// Remove duplicate items

referersList . Sort ( ) ;

Int32 index = 0 ;

while ( index < referersList . Count - 1 )

{

if ( referersList [ index ] == referersList [ index + 1 ] )

referersList . RemoveAt ( index ) ;

else

index ++ ;

}

// Convert to Array

var referersJoined = string . Join ( Environment . NewLine , referersList . ToArray ( ) ) ;

Utilities . CopyToClipboard ( referersJoined ) ;

MessageBox . Show ( referersJoined , " EKFiddle: Referers " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

} else {

MessageBox . Show ( " No referer was found! " , " EKFiddle: Referers " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

// Extract MD5 hash

[ ContextAction ( " MD5 Hash(es) " , " Metadata " ) ]

public static void doMD5Hash ( Session [ ] arrSessions ) {

// Initialize a new list

List < string > MD5HashList = new List < string > ( ) ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

if ( arrSessions [ x ] . bHasResponse ) {

MD5HashList . Add ( arrSessions [ x ] . GetResponseBodyHash ( " md5 " ) . Replace ( " - " , " " ) . ToLower ( ) ) ;

}

// Remove duplicate items

MD5HashList . Sort ( ) ;

Int32 index = 0 ;

while ( index < MD5HashList . Count - 1 )

{

if ( MD5HashList [ index ] == MD5HashList [ index + 1 ] ) {

MD5HashList . RemoveAt ( index ) ;

} else {

index ++ ;

}

// Convert to Array

var HashJoined = string . Join ( Environment . NewLine , MD5HashList . ToArray ( ) ) ;

Utilities . CopyToClipboard ( HashJoined ) ;

MessageBox . Show ( HashJoined , " EKFiddle: MD5 hash(es) " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

// Extract SHA256 hash

[ ContextAction ( " SHA-256 Hash(es) " , " Metadata " ) ]

public static void doSHA256Hash ( Session [ ] arrSessions ) {

// Initialize a new list

List < string > SHA256HashList = new List < string > ( ) ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

if ( arrSessions [ x ] . bHasResponse ) {

SHA256HashList . Add ( arrSessions [ x ] . GetResponseBodyHash ( " sha256 " ) . Replace ( " - " , " " ) . ToLower ( ) ) ;

}

// Remove duplicate items

SHA256HashList . Sort ( ) ;

Int32 index = 0 ;

while ( index < SHA256HashList . Count - 1 )

{

if ( SHA256HashList [ index ] == SHA256HashList [ index + 1 ] ) {

SHA256HashList . RemoveAt ( index ) ;

} else {

index ++ ;

}

// Convert to Array

var HashJoined = string . Join ( Environment . NewLine , SHA256HashList . ToArray ( ) ) ;

Utilities . CopyToClipboard ( HashJoined ) ;

MessageBox . Show ( HashJoined , " EKFiddle: SHA-256 Hash(es) " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

// Google Analytics Tracking ID extraction

[ ContextAction ( " Google Analytics Tracking ID(s) " , " Metadata " ) ]

public static void DoExtractGA ( Session [ ] arrSessions )

{

// Create new list

List < string > GAList = new List < string > ( ) ;

// Initialize empty variable

var sourceCode = " " ;

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

// Store source code into variable

try

{

arrSessions [ x ] . utilDecodeResponse ( true ) ;

sourceCode = arrSessions [ x ] . GetResponseBodyAsString ( ) . Replace ( ' \0 ' , ' \uFFFD ' ) ;

}

catch

{

}

var match = Regex . Match ( sourceCode , @"', 'UA-([^']*)" ) . Groups [ 1 ] . Value ;

if ( match != " " && arrSessions [ x ] . fullUrl != " https://raw.githubusercontent.com/malwareinfosec/EKFiddle/master/CustomRules.cs " )

{

GAList . Add ( arrSessions [ x ] . host + " , " + " UA- " + match ) ;

}

if ( GAList . Count != 0 )

{

// Remove duplicate items

GAList . Sort ( ) ;

Int32 index = 0 ;

while ( index < GAList . Count - 1 )

{

if ( GAList [ index ] == GAList [ index + 1 ] )

GAList . RemoveAt ( index ) ;

else

index ++ ;

}

// Convert to Array

var siteKeys = string . Join ( Environment . NewLine , GAList . ToArray ( ) ) ;

Utilities . CopyToClipboard ( siteKeys ) ;

MessageBox . Show ( siteKeys , " EKFiddle: Google Analytics Tracking ID extraction " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

} else {

MessageBox . Show ( " No Google Analytics Tracking ID was found! " , " EKFiddle: Google Analytics Tracking ID Extraction " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

// Phone number extraction

[ ContextAction ( " Phone Number(s) " , " Metadata " ) ]

public static void DoExtractPhone ( Session [ ] arrSessions )

{

// Load phone number regexes

List < string > extractionPhoneNumbersList = setLoadPhoneNumbersExtractionRules ( ) ;

// Create a new list

List < string > phoneNumbersList = new List < string > ( ) ;

// Initialize empty variable

var sourceCode = " " ;

// Loop through selected sessions

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

// Store source code into variable

try

{

arrSessions [ x ] . utilDecodeResponse ( true ) ;

sourceCode = arrSessions [ x ] . GetResponseBodyAsString ( ) . Replace ( ' \0 ' , ' \uFFFD ' ) ;

}

catch

{

}

// Loop through regexes for source code

foreach ( string item in extractionPhoneNumbersList )

{

// Read from our regexes

var phoneNumber = item . Split ( ' \t ' ) [ 1 ] ;

var match = Regex . Match ( sourceCode , " ( " + phoneNumber + " ) " ) . Groups [ 1 ] . Value ;

// Add to list (if match was found)

if ( match != " " )

{

phoneNumbersList . Add ( arrSessions [ x ] . host + " , " + match ) ;

}

// Loop through regexes for URL

foreach ( string item in extractionPhoneNumbersList )

{

// Read from our regexes

var phoneNumber = item . Split ( ' \t ' ) [ 1 ] ;

var match = Regex . Match ( arrSessions [ x ] . fullUrl , " ( " + phoneNumber + " ) " ) . Groups [ 1 ] . Value ;

// Add to list (if match was found)

if ( match != " " )

{

phoneNumbersList . Add ( arrSessions [ x ] . host + " , " + match ) ;

}

if ( phoneNumbersList . Count != 0 )

{

// Remove duplicate items

phoneNumbersList . Sort ( ) ;

Int32 index = 0 ;

while ( index < phoneNumbersList . Count - 1 )

{

if ( phoneNumbersList [ index ] == phoneNumbersList [ index + 1 ] )

phoneNumbersList . RemoveAt ( index ) ;

else

index ++ ;

}

// Convert to Array

var phoneNumbers = string . Join ( Environment . NewLine , phoneNumbersList . ToArray ( ) ) ;

Utilities . CopyToClipboard ( phoneNumbers ) ;

MessageBox . Show ( phoneNumbers , " EKFiddle: Phone Number(s) Extraction " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

} else {

MessageBox . Show ( " No Phone Number was found! " , " EKFiddle: Phone Number(s) Extraction " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

}

// Skimmer gate extraction

[ ContextAction ( " Web Skimmer Domain(s) " , " Metadata " ) ]

public static void DoExtractSkimmer ( Session [ ] arrSessions )

{

// Load skimmer regexes

List < string > extractionSkimmersList = setLoadSkimmersExtractionsRules ( ) ;

// Create a new list

List < string > skimmerGateList = new List < string > ( ) ;

// Initialize empty variable

var sourceCode = " " ;

// Loop through selected sessions

for ( int x = 0 ; x < arrSessions . Length ; x ++ )

{

// Store source code into variable

try

{

arrSessions [ x ] . utilDecodeResponse ( true ) ;

sourceCode = arrSessions [ x ] . GetResponseBodyAsString ( ) . Replace ( ' \0 ' , ' \uFFFD ' ) ;

}

catch

{

}

// Re-initilize variables

var match = " " ;

bool skimmerFound = false ;

// Loop through regexes

foreach ( string item in extractionSkimmersList )

{

// Read from our regexes between the 2 anchors

string beginsWith = item . Split ( ' \t ' ) [ 1 ] ;

string endsWith = item . Split ( ' \t ' ) [ 2 ] ;

match = Regex . Match ( sourceCode , " " + beginsWith + " (.*?) " + endsWith + " " ) . Groups [ 1 ] . Value ;

// Match found

if ( match != " " )

{

// Check if match is base64 encoded

try

{

if ( System . Text . RegularExpressions . Regex . IsMatch ( match , @"^[-A-Za-z0-9+=]{1,50}|=[^=]|={3,}$" ) == true )

{

// Decode

byte [ ] data = Convert . FromBase64String ( match ) ;

match = System . Text . ASCIIEncoding . ASCII . GetString ( data ) ;

}

catch

{

// Not a base64 encoded string

}

// Check if match is hex encoded

try

{

if ( System . Text . RegularExpressions . Regex . IsMatch ( match , @"(\\x([a-zA-Z0-9]){2}){2}" ) == true )

{

// Decode

string hexValue = match . Replace ( " \\ x " , " " ) ;

match = hexToString ( hexValue ) ;

}

catch

{

// Not a hex encoded string

}

// Check if match is base64 encoded (2nd stage)

try

{

if ( System . Text . RegularExpressions . Regex . IsMatch ( match , @"^[-A-Za-z0-9+=]{1,50}|=[^=]|={3,}$" ) == true )

{

// Decode

byte [ ] data = Convert . FromBase64String ( match ) ;

match = System . Text . ASCIIEncoding . ASCII . GetString ( data ) ;

}

catch

{

// Not a base64 encoded string

}

// Check if match is Unicode encoded (decoded from hex by previous check)

try

{

// Get list of unicode values into a string array

string [ ] stringArray = match . Split ( ',' ) ;

List < int > items = new List < int > ( ) ;

// Add them to the list

foreach ( string s in stringArray )

{

items . Add ( int . Parse ( s ) ) ;

}

// Convert them into an integer array

int [ ] array = items . ToArray ( ) ;

string str = " " ;

System . Text . ASCIIEncoding convertor = new System . Text . ASCIIEncoding ( ) ;

// Decode each unicode item into a character

foreach ( int i in array )

{

char output = convertor . GetChars ( new byte [ ] { ( byte ) i } ) [ 0 ] ;

str += output . ToString ( ) ;

}

match = str ;

}

catch

{

// Not a Unicode encoded string

}

// Add to list (if match was found)

if ( match != " " )

{

// Cleanup invalid characters

match = match . Replace ( " = " , " " ) . Replace ( " \n " , " " ) ;

if ( match . StartsWith ( " // " ) )

{

match = match . Replace ( " // " , " " ) ;

}

// Add to list (unless it is not correctly formatted)

if ( ! match . StartsWith ( " \\ x " ) && ! match . Contains ( " | " ) )

{

skimmerGateList . Add ( arrSessions [ x ] . host + " , " + match ) ;

skimmerFound = true ;

} else

{

skimmerFound = false ;

}

// Add info if no skimmer was found

if ( ! skimmerFound )

{

skimmerGateList . Add ( arrSessions [ x ] . host + " , " + " Not found " ) ;

}

} // End of loop through Sessions

if ( skimmerGateList . Count != 0 )

{

// Remove duplicate items

skimmerGateList . Sort ( ) ;

Int32 index = 0 ;

while ( index < skimmerGateList . Count - 1 )

{

if ( skimmerGateList [ index ] == skimmerGateList [ index + 1 ] )

skimmerGateList . RemoveAt ( index ) ;

else

index ++ ;

}

// Convert to Array

var skimmerArray = string . Join ( Environment . NewLine , skimmerGateList . ToArray ( ) ) ;

Utilities . CopyToClipboard ( skimmerArray ) ;

MessageBox . Show ( skimmerArray , " EKFiddle: Skimmer domain(s) " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

} else

{

MessageBox . Show ( " No web skimmer domain was found " , " EKFiddle: Web Skimmers " , MessageBoxButtons . OK , MessageBoxIcon . Information ) ;

View remainder of file in raw view

CustomRules.cs

Latest commit

History

CustomRules.cs

File metadata and controls