Project

General

Profile

ThreatScript Web Client » History » Version 1

Luke Murphey, 05/19/2010 11:45 PM

1 1 Luke Murphey
h1. ThreatScript Web Client
2 1 Luke Murphey
3 1 Luke Murphey
ThreatScript definitions can actively access and gather information from websites using one of the HTTP request classes. The following classes are available (each corresponding to the associated HTTP verb):
4 1 Luke Murphey
5 1 Luke Murphey
* GetRequest
6 1 Luke Murphey
* PostRequest
7 1 Luke Murphey
* DeleteRequest
8 1 Luke Murphey
* PutRequest
9 1 Luke Murphey
* TraceRequest
10 1 Luke Murphey
* HeadRequest
11 1 Luke Murphey
* OptionsRequest
12 1 Luke Murphey
13 1 Luke Murphey
<pre>
14 1 Luke Murphey
<code class="Javascript">
15 1 Luke Murphey
/*
16 1 Luke Murphey
 * Name: Example.Test.WebRequest
17 1 Luke Murphey
 * ID: 1200001
18 1 Luke Murphey
 * Version: 1
19 1 Luke Murphey
 * Message: Get the first 24 characters on a web-page
20 1 Luke Murphey
 * Severity: Low
21 1 Luke Murphey
 */
22 1 Luke Murphey
 
23 1 Luke Murphey
importPackage(Packages.ThreatScript);
24 1 Luke Murphey
importPackage(Packages.HTTP);
25 1 Luke Murphey
26 1 Luke Murphey
function analyze( httpResponse, variables, environment ){
27 1 Luke Murphey
    var get = new GetRequest(httpResponse.getLocation());
28 1 Luke Murphey
    var httpResponse = get.run();
29 1 Luke Murphey
    var s = httpResponse.getResponseBodyAsString();
30 1 Luke Murphey
31 1 Luke Murphey
    if( s == null ){
32 1 Luke Murphey
        return new Result( true, "null");
33 1 Luke Murphey
    }
34 1 Luke Murphey
35 1 Luke Murphey
    return new Result( true, "First 24 characters of page is: " + s.substring(0,24));
36 1 Luke Murphey
}
37 1 Luke Murphey
</code>
38 1 Luke Murphey
</pre>