SHARE
TWEET

Untitled

a guest Nov 14th, 2019 133 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. import pymongo
  2. import json
  3.  
  4.  
  5. def init_database():
  6.     myclient = pymongo.MongoClient("mongodb://localhost:27017/")
  7.     mydb = myclient["ChromeExtensions"]
  8.     mycol = mydb["API"]
  9.     return mycol
  10.  
  11.  
  12. mycol = init_database()
  13.  
  14. # get behavior form file api.json define
  15. # Return json behavior
  16. def GetBehaviorMalicious(behavior):
  17.     with open("api.json") as f:
  18.         _behavior = json.load(f)
  19.     return _behavior[behavior]
  20.  
  21. def GetApiCalledByExtension(idx):
  22.     list_api_from_database = mycol.find({"extensionId": idx})
  23.     return list_api_from_database
  24.  
  25. def UninstallBehaviorTracking(api_of_extension):
  26.     _behavior_info = GetBehaviorMalicious("uninstall_other_extension")
  27.     for api_of_behavior in (_behavior_info):
  28.         if "behavior" in api_of_behavior:
  29.             list_api_behavior = api_of_behavior["behavior"]
  30.     return list_api_behavior
  31.  
  32.  
  33. def AnalyzerOnlyOneExtension(idx):
  34.     total_call = 0
  35.     count_api = {}
  36.  
  37.     # Get api called of chrome extension from mongodb with id
  38.     # Count total api called
  39.     # Save element of info to report
  40.  
  41.     list_api_from_database = GetApiCalledByExtension(idx)
  42.     for api_call in list_api_from_database:
  43.         total_call += 1
  44.         if(api_call["apiCall"] in count_api.keys()):
  45.             count_api[api_call["apiCall"]] += 1
  46.         else:
  47.             count_api[api_call["apiCall"]] = 1
  48.  
  49.     beauty_report = {"id": idx, "api_called": total_call, "apis": {}}
  50.  
  51.     print(beauty_report)
  52.     exit()
  53.     for i in count_api:
  54.         testing = {}
  55.         count = 0
  56.         for obj in (mycol.find({"extensionId": idx, "apiCall": i})):
  57.             count +=1
  58.             beauty_report["apis"][str(count)] = {}
  59.             testing["time"] = obj["time"]
  60.             testing["args"] = obj["args"]
  61.             testing["activityType"] = obj["activityType"]
  62.             if("argUrl" in obj.keys()):
  63.                 testing["argUrl"] = obj["argUrl"]
  64.             beauty_report["apis"][str(count)] = testing
  65.         print(json.dumps(beauty_report,indent=4))
  66.         exit()
  67.     print("==========================================")
  68.    
  69.     # Get malicious, suspicious api form api.json
  70.     patterns = GetBehaviorMalicious("api.json")
  71.     malicious_api = []
  72.     test_api = []
  73.     for i in patterns.items():
  74.         if(i[1]["risk"] == "Malicious"):
  75.             malicious_api.append(i[0])
  76.         if(i[1]["risk"] == "Test"):
  77.             test_api.append(i[0])
  78.  
  79.     print("[+] Total API called: %d" % (total_call))
  80.     print(json.dumps(count_api, indent=4))
  81.  
  82.     # Get name api from object count_api
  83.     # Checking api of extension call with malicious and suspicious list api
  84.     # Print api info
  85.     for i in count_api:
  86.         if(i in malicious_api):
  87.             print("[!] Malicious API called: %s (%d times)" %
  88.                   (i, count_api[i]))
  89.             for obj in (mycol.find({"extensionId": idx, "apiCall": i})):
  90.                 print("[+] Time call : %s\n==> Args: %s\n" %
  91.                       (obj["time"], obj["args"]))
  92.         if(i in test_api):
  93.             print("Test API called: %s (%d times)" % (i, count_api[i]))
  94.             for obj in (mycol.find({"extensionId": idx, "apiCall": i})):
  95.                 print("[+] Time call : %s\n==> Args: %s\n" %
  96.                       (obj["time"], obj["args"]))
  97.  
  98.     return list_api_from_database
  99.  
  100.  
  101. if __name__ == "__main__":
  102.     #list_api = AnalyzerOnlyOneExtension("aklmaophoojkakkcijlkcfegdcgifgch")
  103.     list_api = GetApiCalledByExtension("gdjoennjdfomkmhgejbipfcohcaejahm")
  104.     uninstall_other_extension=[]
  105.     for api in list_api:
  106.         if (api["apiCall"] in UninstallBehaviorTracking(list_api)):
  107.             uninstall_other_extension.append(api)
  108.     print(uninstall_other_extension)
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top