-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathtac.sh
83 lines (83 loc) · 4.94 KB
/
tac.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
#!/bin/bash
FILES=$1/*
echo "LET'S GREP"
echo "========================================================"
echo "external domain script inclusion: <script src="
echo "========================================================"
for f in $FILES
do
IFS=’/_’ read -ra SPLIT <<< "$f"
domain=${SPLIT[2]}
counter=$(echo $domain | tr -cd '.' | wc -c)
if [ $counter -eq '1' ]
then
domaintop=$domain
else
domaintop=$(echo "$domain" | sed 's/^[^\.]*\.//')
fi
result1=`grep -a "<script src=\"http://" $f | grep -v "<script src=\"http://$domain" | grep -v "<script src=\"http://.*$domaintop/" | grep -vE "oss\.maxcdn\.com|apis\.google\.com\/js|html5shiv\.googlecode\.com\/svn|html5shim\.googlecode\.com\/svn|ajax\.googleapis\.com\/ajax|code\.jquery\.com\/jquery|maps\.googleapis\.com\/maps\/api\/|maps\.google\.com\/maps\/api|www\.google\.com\/recaptcha\/api\.js|use\.typekit\.net|cdnjs\.cloudflare\.com\/ajax|www\.google\-analytics\.com\/urchin\.js|vjs\.zencdn\.net\/c\/video\.js|www\.flickr\.com\/badge_code_v2\.gne|maps\.google\.com\/maps|maxcdn\.bootstrapcdn\.com|www\.clocklink\.com\/embed\.js|austria\.mid\.ru|static1\.squarespace\.com\/static\/|stats\.wordpress\.com\/e\-201707\.js|weatherandtime\.net\/swfobject\.js|assets\.publishing\.service\.gov\.uk|googlecode\.com\/svn"`
result2=`grep -a "<script src=\"https://" $f | grep -v "<script src=\"https://$domain" | grep -v "<script src=\"https://.*$domaintop/" | grep -vE "oss\.maxcdn\.com|apis\.google\.com\/js|html5shiv\.googlecode\.com\/svn|html5shim\.googlecode\.com\/svn|ajax\.googleapis\.com\/ajax|code\.jquery\.com\/jquery|maps\.googleapis\.com\/maps\/api\/|maps\.google\.com\/maps\/api|www\.google\.com\/recaptcha\/api\.js|use\.typekit\.net|cdnjs\.cloudflare\.com\/ajax|www\.google\-analytics\.com\/urchin\.js|vjs\.zencdn\.net\/c\/video\.js|www\.flickr\.com\/badge_code_v2\.gne|maps\.google\.com\/maps|maxcdn\.bootstrapcdn\.com|www\.clocklink\.com\/embed\.js|austria\.mid\.ru|static1\.squarespace\.com\/static\/|stats\.wordpress\.com\/e\-201707\.js|weatherandtime\.net\/swfobject\.js|assets\.publishing\.service\.gov\.uk|googlecode\.com\/svn"`
[ ! -z "$result1" ] && echo -e "HTTP Hit(s) on $domain :\n$result1\n__________________________________"
[ ! -z "$result2" ] && echo -e "HTTPS Hit(s) on $domain :\n$result2\n__________________________________"
done
echo "========================================================"
echo "hidden iframe"
echo "========================================================"
for f in $FILES
do
IFS=’/_’ read -ra SPLIT <<< "$f"
domain=${SPLIT[2]}
result=`grep -oE "<iframe.*(display: none|visibility: hidden)" $f`
[ ! -z "$result" ] && echo -e "Hit(s) on $domain :\n$result\n__________________________________"
done
echo "========================================================"
echo "clickfraud JS injection"
echo "========================================================"
for f in $FILES
do
IFS=’/_’ read -ra SPLIT <<< "$f"
domain=${SPLIT[2]}
result=`grep -E "window.a[0-9]{10}|this.a[0-9]{10}" $f`
[ ! -z "$result" ] && echo -e "Hit(s) on $domain :\n$result\n__________________________________"
done
echo "========================================================"
echo "Joomla qadars injection"
echo "https://malwarebreakdown.com/2017/02/12/thousands-of-compromised-websites-leading-to-fake-flash-player-update-sites-payload-is-qadars-banking-trojan/"
echo "========================================================"
for f in $FILES
do
IFS=’/_’ read -ra SPLIT <<< "$f"
domain=${SPLIT[2]}
result=`grep -E "<script language=JavaScript src=/media/system/js/stat[0-9]{3}\.php" $f`
[ ! -z "$result" ] && echo -e "Hit(s) on $domain :\n$result\n__________________________________"
done
echo "========================================================"
echo "strange external domain script inclusion attempt: \$('script\[src="
echo "========================================================"
for f in $FILES
do
IFS=’/_’ read -ra SPLIT <<< "$f"
domain=${SPLIT[2]}
result=`grep "('script\[src=" $f`
[ ! -z "$result" ] && echo -e "Hit(s) on $domain :\n$result\n__________________________________"
done
echo "========================================================"
echo "CLICKY"
echo "========================================================"
for f in $FILES
do
IFS=’/_’ read -ra SPLIT <<< "$f"
domain=${SPLIT[2]}
result=`grep -B 1 -A 9 "clicky_site_ids.push" $f`
[ ! -z "$result" ] && echo -e "Hit(s) on $domain :\n$result\n__________________________________"
done
echo "========================================================"
echo "shortener URLs"
echo "========================================================"
for f in $FILES
do
IFS=’/_’ read -ra SPLIT <<< "$f"
domain=${SPLIT[2]}
result=`grep -oE ".{7}bit\.ly\/.{7}|http.{0,1}:\/\/goo\.gl\/.{6}|.{7}bitly\.com\/.{7}" $f | grep -v "http://goo.gl/maps/"`
[ ! -z "$result" ] && echo -e "Hit(s) on $domain :\n$result\n__________________________________"
done