diff --git a/spec/functional_test/fixtures/file_based/base64.txt b/spec/functional_test/fixtures/file_based/base64.txt new file mode 100644 index 00000000..e61b972a --- /dev/null +++ b/spec/functional_test/fixtures/file_based/base64.txt @@ -0,0 +1 @@ +aHR0cHM6Ly93d3cuaGFod3VsLmNvbS90YWcvY3J5c3RhbC8= \ No newline at end of file diff --git a/src/analyzer/analyzers/file_analyzers/base64.cr b/src/analyzer/analyzers/file_analyzers/base64.cr new file mode 100644 index 00000000..c38563d0 --- /dev/null +++ b/src/analyzer/analyzers/file_analyzers/base64.cr @@ -0,0 +1,29 @@ +require "base64" +require "../../../models/analyzer" +require "../../../models/endpoint" + +FileAnalyzer.add_hook(->(path : String, url : String) : Array(Endpoint) { + results = [] of Endpoint + + begin + File.open(path, "r", encoding: "utf-8", invalid: :skip) do |file| + file.each_line do |line| + # Check base64 encoded strings + base64_match = line.match(/([A-Za-z0-9+\/]{20,}={0,2})/) + if base64_match + decoded = Base64.decode_string(base64_match[1]) + url_match = decoded.match(/\b(https?:\/\/[^\s]+)/) + if url_match + parsed_url = URI.parse(url_match[1]) + if parsed_url.to_s.includes? url + results << Endpoint.new(parsed_url.path, "GET") + end + end + end + end + end + rescue + end + + results +})