Splint3r7

# this command will return instances where the child_process module is loaded.  
# that module is generally a good signal that the application is shelling out
egrep -r --exclude-dir "node_modules" --include "*.js" --exclude "*.min.*" -e "require(\s*)\((\s*)'child_process'(\s*))" .

# this command will return instances where code is dynamically executed.  
egrep -r --exclude-dir "node_modules" --include "*.js" --exclude "*.min.*" -e "eval(\s*)\(" .

# this command will check common dangerous functions and report when strings are arguments
egrep -r --exclude-dir "node_modules" --include "*.js" --exclude "*.min.*" -e "(setInterval|setTimeout|new(\s*)Function)(\s*)\((\s*)\".*\"" .

Splint3r7

domain
123rf.com
1stdibs.com
2u.com
ba.com
babylist.com
bananatag.com
baylor.edu
bbcgoodfood.com
bcm.edu

Splint3r7

Command Injection Vulnerability in Rising 1.0.2

Command injection vulnerability was identified in NPM package rising version 1.0.2

Resources:

• Project's NPM Package: https://www.npmjs.com/package/rising
• Project's NPM JS registery: https://registry.npmjs.org/rising

Code Analysis Background

Splint3r7

[
        "express", 
        "afnan"
]

Splint3r7

#!/bin/bash
filename=$1
output_str="("

while read -r line; do
  output_str+="ip.src eq $line) or ("
done < "$filename"

output_str=${output_str% or (*}

Splint3r7

import requests
import sys
import json
import concurrent.futures

output_file = open("emails_res.txt", "w")

def Emails(package):

	req = requests.get("https://api.npms.io/v2/package/{}".format(package))

Splint3r7

a
a--
A-
a0
a0-tzmigration-ruby
a1
a11n
A_123
a1330ks_bmi
a13g

Splint3r7

.aaa
.aarp
.abarth
.abb
.abbott
.abbvie
.abc
.able
.abogado
.abudhabi

Splint3r7

# Coded by Geekink

#!/usr/bin/env python3

import urllib.request
import sqlite3
import os.path
import re
import math

Splint3r7

<?php   
/* Plugin Name: Damn Vulnerable WordPress Plugin
 * Description: Intentionally vulnerable plugin for plugin author education
 * Version: 0.1
 * Plugin URI: http://make.wordpress.org/plugins/2013/04/09/intentionally-vulnerable-plugin/
 * Author: Jon Cave
 * Author URI: http://joncave.co.uk
 * License: GPLv2+
 *              
 * DO NOT RUN THIS PLUGIN ON AN INTERNET ACCESSIBLE SITE