Comments (6)
Looking at STACS it actually looks great! But that's password/hash-related things only it seems. I guess the main focus of CRASS/semgrep is different, to also look for other vulnerable looking things. You might be right that semgrep is a little too focused on source code. Now I'm thinking maybe CRASS isn't the worst fit. Here's why I think it might be worth:
- In unpacked firmware there is sometimes a little source code for scripting languages (PHP, perl, python, JSP, JavaScript, other CGI etc.) or indirectly such as .NET binaries that are easily decompiled. I think they have a high potential for issues because they are a) sometimes called from binaries (system calls etc.) which creates a trust boundary and b) the scripting language is often not the embedded developers main language to code in. It's also very easy to analyse them because they are ASCII.
- I've found iOS source code in a appliance ISO and PHP-server-side code in an Android app before. Developers do strange things.
- Finding Cloud API keys/credentials can be a goldmine
- For me tools are also about guiding the user on what he should target during the manual analysis time. So if the tool provides a priority rated list by keyword (e.g. CRASS creates one file which includes all files that reference "SHA1")
I'll try to see if I can provide some more concrete examples next time I use EMBA.
Ultimately you can have a look from https://github.com/floyd-fuh/crass/blob/f2da104b073f530fbadeda7578c39a377ebd296b/grep-it.sh#L311 on to see what could be worth doing.
I guess it's not about what STACS or shellcheck are missing, but more what else can be done.
from emba.
Hi @floyd-fuh, a first module using your grep-it rules is now included as s99 in this PR: #251
Give it a try ...
from emba.
Hi @floyd-fuh, thank you for pointing this again. We already talked on it ... probably on twitter? It is on our internal todo list but currently we are working on different other areas.
Regarding the password hash search we are currently using two approaches:
- EMBA is using STACS which gives quite good results - https://github.com/e-m-b-a/emba/blob/master/modules/S108_stacs_password_search.sh
- EMBA internal - https://github.com/e-m-b-a/emba/blob/master/modules/S107_deep_password_search.sh -> this module has different disadvantages but in case STACS is failing there is a backup in place
Have you found something that these approaches are missing? If yes, which firmware and which tool have you used for identification of the hash automatically? Probably we can tweak our current modules.
from emba.
I wonder if it could also provide some alternatives to shellcheck.
from emba.
As far as I can see there are not a lot of *sh rules available: https://github.com/returntocorp/semgrep-rules/tree/develop/bash
from emba.
grepit module merged.
from emba.
Related Issues (20)
- NVD CVE database missing HOT 3
- f10 + p99 csv files question HOT 3
- Specify file system instead of firmware HOT 4
- Internet connection - not OK HOT 6
- Improve "ISC DHCP" detection and CVE search HOT 13
- installer.sh failing with non-english locale HOT 10
- module_blacklist.txt gets ignored with default-scan.emba profile HOT 2
- Are we able to get the file system in the firmware? HOT 7
- The s110 module cannot be executed normally HOT 4
- New Kali Linux 2024-2 available HOT 8
- docker image question HOT 9
- emba install error << when i start build the emba in docker with this command "sudo docker-compose build emba " the install stop in 7/9 step << please help me HOT 6
- unsupported manifest format HOT 5
- installer issue HOT 3
- running issue HOT 9
- cannot finish the installation HOT 7
- "./installer.sh -d " failed HOT 3
- Report generation after a (default) scan HOT 8
- Run sudo ./installer.sh in a gitpod.io instance and receive an error HOT 8
- Installation stopped HOT 10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from emba.