Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding in ScanJNLP #454

Merged
merged 2 commits into from
Apr 19, 2024
Merged

Adding in ScanJNLP #454

merged 2 commits into from
Apr 19, 2024

Conversation

skalupa
Copy link
Collaborator

@skalupa skalupa commented Apr 18, 2024

Describe the change
Originally developed by Ryan Borre and Paul Hutelmyer, ScanJnlp analyzes Java Network Launch Protocol (JNLP) files. From the documentation:

JNLP files, used by Java Web Start technology, can launch Java applications from a web browser. While facilitating
legitimate applications, they can also be abused for malicious purposes such as distributing malware or executing
phishing attacks.

This PR ports the ScanJnlp scanner as well as tests with relevant fixtures to open source Strelka while also updating the scanner table with relevant information on this scanner.

Describe testing procedures
This scanner has been running internally for some time, though after porting the scanner, the scanner was tested with a local build of the application.

Sample output
Results of the scanner runnin appears as follows:

"jnlp":{2 items
"elapsed":float0.000278
"resource":string"https://example.com/uplib.jar"
}

Checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review of and tested my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings

@phutelmyer
Copy link
Contributor

Works well. Thought for a second we were missing the JNLP File taste in yara, but it looks like its been in there for quite some time. This makes that functional.

Thank you!

@phutelmyer phutelmyer merged commit c621fe8 into master Apr 19, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants