mirror of
https://github.com/cuckoosandbox/cuckoo.git
synced 2026-10-12 02:12:40 +00:00
Test travis and tests fix
This commit is contained in:
Ricardo van Zutphen
+8
-1
@@ -68,7 +68,7 @@ install:
|
||||
- pip install -U pip setuptools
|
||||
- python setup.py sdist
|
||||
- pip install -e .
|
||||
- pip install pytest pytest-cov codecov coveralls distorm3 pycrypto
|
||||
- pip install pytest==4.1.1 pytest-cov codecov coveralls distorm3 pycrypto
|
||||
- pip install flask-testing mock pytest-django pytest-pythonpath responses
|
||||
|
||||
# Install Volatility.
|
||||
@@ -97,3 +97,10 @@ script:
|
||||
after_success:
|
||||
- coveralls
|
||||
- codecov
|
||||
|
||||
addons:
|
||||
apt:
|
||||
packages:
|
||||
- sqlite3
|
||||
sources:
|
||||
- travis-ci/sqlite3
|
||||
|
||||
@@ -3,7 +3,6 @@
|
||||
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
|
||||
# See the file 'docs/LICENSE' for copying permission.
|
||||
|
||||
import pkg_resources
|
||||
import base64
|
||||
import bs4
|
||||
import chardet
|
||||
@@ -240,6 +239,8 @@ def exception_message():
|
||||
else:
|
||||
return "Unknown"
|
||||
|
||||
import pkg_resources
|
||||
|
||||
msg = (
|
||||
"Oops! Cuckoo failed in an unhandled exception!\nSometimes bugs are "
|
||||
"already fixed in the development release, it is therefore "
|
||||
|
||||
@@ -41,10 +41,12 @@ class MISP(Report):
|
||||
|
||||
def domain_ipaddr(self, results, event):
|
||||
whitelist = [
|
||||
"www.msftncsi.com", "dns.msftncsi.com", "teredo.ipv6.microsoft.com", "time.windows.com",
|
||||
"www.msftconnecttest.com", "v10.vortex-win.data.microsoft.com","settings-win.data.microsoft.com",
|
||||
"win10.ipv6.microsoft.com", "sls.update.microsoft.com", "13.74.179.117", "40.81.120.221",
|
||||
"40.77.226.249", "8.8.8.8", "fs.microsoft.com", "ctldl.windowsupdate.com"
|
||||
"www.msftncsi.com", "dns.msftncsi.com", "8.8.8.8", "40.77.226.249",
|
||||
"teredo.ipv6.microsoft.com", "time.windows.com",
|
||||
"www.msftconnecttest.com", "v10.vortex-win.data.microsoft.com",
|
||||
"settings-win.data.microsoft.com", "win10.ipv6.microsoft.com",
|
||||
"sls.update.microsoft.com", "13.74.179.117", "40.81.120.221",
|
||||
"fs.microsoft.com", "ctldl.windowsupdate.com"
|
||||
]
|
||||
|
||||
domains, ips = {}, set()
|
||||
@@ -55,7 +57,7 @@ class MISP(Report):
|
||||
|
||||
ipaddrs = set()
|
||||
for ipaddr in results.get("network", {}).get("hosts", []):
|
||||
if ipaddr not in ips:
|
||||
if ipaddr not in whitelist and ipaddr not in ips:
|
||||
ipaddrs.add(ipaddr)
|
||||
|
||||
self.misp.add_domains_ips(event, domains)
|
||||
@@ -69,7 +71,7 @@ class MISP(Report):
|
||||
for cnc in config.get("cnc", []):
|
||||
self.misp.add_url(event, cnc)
|
||||
for url in config.get("url", []):
|
||||
self.misp.add_url(event, cnc)
|
||||
self.misp.add_url(event, url)
|
||||
for mutex in config.get("mutex", []):
|
||||
self.misp.add_mutex(event, mutex)
|
||||
for user_agent in config.get("user_agent", []):
|
||||
@@ -84,7 +86,9 @@ class MISP(Report):
|
||||
log.warning("Description for %s is not found" % (att))
|
||||
continue
|
||||
|
||||
self.misp.add_internal_comment(event, "TTP: %s, short: %s" % (att, description["short"]))
|
||||
self.misp.add_internal_comment(
|
||||
event, "TTP: %s, short: %s" % (att, description["short"])
|
||||
)
|
||||
|
||||
def run(self, results):
|
||||
"""Submits results to MISP.
|
||||
|
||||
+72
-24
@@ -129,12 +129,12 @@ def test_empty_misp():
|
||||
|
||||
with responses.RequestsMock(assert_all_requests_are_fired=True) as rsps:
|
||||
rsps.add(
|
||||
responses.GET, "https://misphost/servers/getVersion.json",
|
||||
responses.GET, "https://misphost/servers/getPyMISPVersion.json",
|
||||
json={
|
||||
"version": "2.4.56",
|
||||
"perm_sync": True,
|
||||
},
|
||||
"version": "2.4.103"
|
||||
}
|
||||
)
|
||||
|
||||
rsps.add(
|
||||
responses.GET, "https://misphost/attributes/describeTypes.json",
|
||||
json={
|
||||
@@ -177,31 +177,30 @@ def test_misp_sample_hashes():
|
||||
comment="File submitted to Cuckoo"
|
||||
)
|
||||
|
||||
def test_misp_maldoc():
|
||||
def test_misp_signatures():
|
||||
r = MISP()
|
||||
r.misp = mock.MagicMock()
|
||||
r.misp.add_url.return_value = None
|
||||
r.misp.add_internal_comment.return_value = None
|
||||
|
||||
r.maldoc_network({
|
||||
"signatures": [
|
||||
{
|
||||
"name": "foobar",
|
||||
},
|
||||
{
|
||||
"name": "malicious_document_urls",
|
||||
"marks": [
|
||||
{
|
||||
"category": "file",
|
||||
},
|
||||
{
|
||||
"category": "url",
|
||||
"ioc": "url_ioc",
|
||||
r.signature({
|
||||
"signatures": [
|
||||
{
|
||||
"description": "Very signature",
|
||||
"ttp": {
|
||||
"T1045": {
|
||||
"short": "Short description",
|
||||
"long": "A longer description"
|
||||
}
|
||||
}
|
||||
],
|
||||
},
|
||||
],
|
||||
}
|
||||
]
|
||||
}, "event")
|
||||
r.misp.add_url.assert_called_once_with("event", ["url_ioc"])
|
||||
|
||||
assert r.misp.add_internal_comment.call_count == 2
|
||||
r.misp.add_internal_comment.assert_has_calls([
|
||||
mock.call("event", "Very signature - (T1045)"),
|
||||
mock.call("event", "TTP: T1045, short: Short description")
|
||||
])
|
||||
|
||||
def test_misp_all_urls():
|
||||
r = MISP()
|
||||
@@ -252,10 +251,15 @@ def test_misp_domain_ipaddr():
|
||||
"domain": "time.windows.com",
|
||||
"ip": "1.2.3.4",
|
||||
},
|
||||
{
|
||||
"domain": "www.msftncsi.com",
|
||||
"ip": "95.101.2.42"
|
||||
}
|
||||
],
|
||||
"hosts": [
|
||||
"2.3.4.5",
|
||||
"3.4.5.6",
|
||||
"8.8.8.8"
|
||||
],
|
||||
},
|
||||
}, "event")
|
||||
@@ -268,6 +272,50 @@ def test_misp_domain_ipaddr():
|
||||
"event", ["2.3.4.5", "3.4.5.6"],
|
||||
)
|
||||
|
||||
def test_misp_family():
|
||||
r = MISP()
|
||||
r.misp = mock.MagicMock()
|
||||
r.misp.add_detection_name.return_value = None
|
||||
r.misp.add_url.return_value = None
|
||||
r.misp.add_mutex.return_value = None
|
||||
r.misp.add_useragent.return_value = None
|
||||
|
||||
r.family({
|
||||
"metadata": {
|
||||
"cfgextr": [
|
||||
{
|
||||
"family": "3x4mpl3",
|
||||
"cnc": ["example.com/gate.php"]
|
||||
},
|
||||
{
|
||||
"family": "3x4mpl3_2",
|
||||
"url": ["http://example.org"]
|
||||
},
|
||||
{
|
||||
"family": "3x4mpl3_3",
|
||||
"mutex": ["@@@@@@"],
|
||||
"user_agent": ["M3mebr0wz0r V42"]
|
||||
}
|
||||
]
|
||||
}
|
||||
}, "event")
|
||||
|
||||
assert r.misp.add_detection_name.call_count == 3
|
||||
r.misp.add_detection_name.assert_has_calls([
|
||||
mock.call("event", "3x4mpl3", "Sandbox detection"),
|
||||
mock.call("event", "3x4mpl3_2", "Sandbox detection"),
|
||||
mock.call("event", "3x4mpl3_3", "Sandbox detection")
|
||||
])
|
||||
|
||||
assert r.misp.add_url.call_count == 2
|
||||
r.misp.add_url.assert_has_calls([
|
||||
mock.call("event", "example.com/gate.php"),
|
||||
mock.call("event", "http://example.org")
|
||||
])
|
||||
|
||||
r.misp.add_mutex.assert_called_once_with("event", "@@@@@@")
|
||||
r.misp.add_useragent.assert_called_once_with("event", "M3mebr0wz0r V42")
|
||||
|
||||
@mock.patch("cuckoo.reporting.mongodb.mongo")
|
||||
def test_mongodb_init_once_new(p):
|
||||
p.init.return_value = True
|
||||
|
||||
Reference in New Issue
Block a user