43 lines
1.7 KiB
Python
43 lines
1.7 KiB
Python
import unittest
|
|
|
|
from netscaler_triage.indicators import defang, extract_indicators
|
|
|
|
|
|
class IndicatorTests(unittest.TestCase):
|
|
def test_interleaved_url_and_path_spans(self) -> None:
|
|
rows = extract_indicators(
|
|
"/before http://example.test/a /between https://example.test/b?q=/internal /after"
|
|
)
|
|
self.assertEqual(
|
|
{r["value"] for r in rows if r["type"] == "path"}, {"/before", "/between", "/after"}
|
|
)
|
|
|
|
def test_addresses_and_domains(self) -> None:
|
|
rows = extract_indicators(
|
|
"src=192.0.2.1 invalid=999.1.1.1 peer=2001:db8::1 Host: example.test ordinary.txt"
|
|
)
|
|
values = {r["value"] for r in rows}
|
|
self.assertIn("192.0.2.1", values)
|
|
self.assertIn("2001:db8::1", values)
|
|
self.assertIn("example.test", values)
|
|
self.assertNotIn("999.1.1.1", values)
|
|
self.assertNotIn("ordinary.txt", values)
|
|
|
|
def test_original_and_reversible_defang(self) -> None:
|
|
url = "https://example.test:8443/a.php?q=1"
|
|
rows = extract_indicators(url + " /tmp/file " + "a" * 64)
|
|
self.assertIn(url, [r["value"] for r in rows])
|
|
self.assertIn("sha256", [r["type"] for r in rows])
|
|
encoded = defang(url, "url")
|
|
self.assertNotIn("https://", encoded)
|
|
restored = encoded.replace("[.]", ".").replace("[:]", ":").replace("hxxps:", "https:")
|
|
self.assertEqual(restored, url)
|
|
|
|
def test_boundaries(self) -> None:
|
|
self.assertEqual(extract_indicators("x192.0.2.1suffix"), [])
|
|
self.assertFalse(any(r["type"] == "domain" for r in extract_indicators("http://[broken")))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|