Verify SSL Certificates for Requests.

main

.github/workflows/snorkell-auto-documentation.yml

@@ -0,0 +1,19 @@
+# This workflow will improvise current file with AI genereated documentation and Create new PR
+
+name: Snorkell.ai - Revolutionizing Documentation on GitHub
+
+on:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+
+jobs:
+  Documentation:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Snorkell DocGen Client
+      uses: SingularityX-ai/snorkell-documentation-client@v1.0.0
+      with:
+        client_id: ${{ secrets.SNORKELL_CLIENT_ID }}
+        api_key: ${{ secrets.SNORKELL_API_KEY }}
+        branch_name: "main"

README.md

@@ -8,11 +8,11 @@ TinyCheck allows you to easily capture network communications from a smartphone
 
 The idea of TinyCheck emerged in a meeting about stalkerware with a [French women's shelter](https://www.centre-hubertine-auclert.fr). During this meeting we talked about how to easily detect [stalkerware](https://stopstalkerware.org/) without installing very technical apps nor doing forensic analysis on the victim's smartphone. The initial concept was to develop a tiny kiosk device based on Raspberry Pi which can be used by non-tech people to test their smartphones against malicious communications issued by stalkerware or any spyware.
 
-Of course, TinyCheck can also be used to spot any malicious communications from cybercrime to state-sponsored implants. It allows the end-user to push his own extended Indicators of Compromise via a backend in order to detect some ghosts over the wire.
+Of course, TinyCheck can also be used to spot any malicious communications from cybercrime to state-sponsored implants. It allows the end-user to push their own extended Indicators of Compromise via a backend in order to detect some ghosts over the wire.
 
 <p align="center"><strong>If you need more documentation on how to install it, use it and the internals, don't hesitate to take a look at the <a href="https://github.com/KasperskyLab/TinyCheck/wiki">TinyCheck Wiki</a>.</strong></p>
 
-<p align="center">If you have any question about the projet, want to contribute or just send your feedback, <br />don't hesitate to contact us at tinycheck[@]kaspersky[.]com.</p>
+<p align="center">If you have any question about the project, want to contribute or just send your feedback, <br />don't hesitate to contact us at tinycheck[@]kaspersky[.]com.</p>
 
 ### Use cases
 
@@ -24,17 +24,17 @@ TinyCheck can be used in several ways by individuals and entities:
 
 ### Installation
 
-Please check the few steps in the [Wiki's Installation Page](https://github.com/KasperskyLab/TinyCheck/wiki/TinyCheck-installation). 
+Please check the few steps in the [Wiki's Installation Page](https://github.com/KasperskyLab/TinyCheck/wiki/TinyCheck-installation).
 
 ### Meet the frontend
 
-The frontend - which can be accessed from `http://tinycheck.local` is a kind of tunnel which help the user throughout the process of network capture and reporting. It allows the user to setup a Wi-Fi connection to an existing Wi-Fi network, create an ephemeral Wi-Fi network, capture the communications and show a report to the user... in less than one minute, 5 clicks and without any technical knowledge. 
+The frontend - which can be accessed from `http://tinycheck.local` is a kind of tunnel which help the user throughout the process of network capture and reporting. It allows the user to setup a Wi-Fi connection to an existing Wi-Fi network, create an ephemeral Wi-Fi network, capture the communications and show a report to the user... in less than one minute, 5 clicks and without any technical knowledge.
 
 ![Frontend](/assets/frontend.png)
 
 ### Meet the backend
 
-Once installed, you can connect yourself to the TinyCheck backend by browsing the URL `https://tinycheck.local` and accepting the SSL self-signed certificate. 
+Once installed, you can connect yourself to the TinyCheck backend by browsing the URL `https://tinycheck.local` and accepting the SSL self-signed certificate.
 
 ![Backend](/assets/backend.png)
 
@@ -42,9 +42,11 @@ The backend allows you to edit the configuration of TinyCheck, add extended IOCs
 
 ### Special thanks
 
-**Guys who provided some IOCs**
+**Felix Aime**, for his idea and passion while developing and testing this project. Felix is a main contributor and we really appreciate his work on TinyCheck.
+
+**People who provided some IOCs**
 - [Cian Heasley](https://twitter.com/nscrutables) for his android stalkerwares IOC repo, available here: https://github.com/diskurse/android-stalkerware
-- [Te-k](https://twitter.com/tenacioustek) for his stalkerwares awesome IOCs repo, available here: https://github.com/Te-k/stalkerware-indicators
+- [Echap](https://github.com/AssoEchap) for their stalkerwares awesome IOCs repo, available here: https://github.com/AssoEchap/stalkerware-indicators
 - [Emilien](https://twitter.com/__Emilien__) for his Stratum rules, available here: https://github.com/kwouffe/cryptonote-hunt
 - [Costin Raiu](https://twitter.com/craiu) for his geo-tracker domains, available here: https://github.com/craiu/mobiletrackers/blob/master/list.txt
 

analysis/analysis.py

@@ -16,60 +16,82 @@ import os
     containing a capture.pcap file.
 """
 
-if __name__ == "__main__":
-    if len(sys.argv) == 2:
-        capture_directory = sys.argv[1]
-        if os.path.isdir(capture_directory):
 
-            manager = Manager()
-            alerts = manager.dict()
+def analyze(capture_directory,frontend=False):
+    if os.path.isdir(capture_directory):
 
-            def zeekengine(alerts):
-                zeek = ZeekEngine(capture_directory)
-                zeek.start_zeek()
-                alerts["zeek"] = zeek.retrieve_alerts()
+        manager = Manager()
+        alerts = manager.dict()
 
-                # whitelist.json writing.
-                with open(os.path.join(capture_directory, "assets/whitelist.json"), "w") as f:
-                    f.write(json.dumps(zeek.retrieve_whitelist(),
-                                       indent=4, separators=(',', ': ')))
+        def zeekengine(alerts):
+            zeek = ZeekEngine(capture_directory)
+            zeek.start_zeek()
+            alerts["zeek"] = zeek.retrieve_alerts()
 
-                # conns.json writing.
-                with open(os.path.join(capture_directory, "assets/conns.json"), "w") as f:
-                    f.write(json.dumps(zeek.retrieve_conns(),
-                                       indent=4, separators=(',', ': ')))
+            if not os.path.isdir(os.path.join(capture_directory, "assets")):
+                os.mkdir(os.path.join(capture_directory, "assets"))
+            # whitelist.json writing.
+            with open(os.path.join(capture_directory, "assets/whitelist.json"), "w") as f:
+                f.write(json.dumps(zeek.retrieve_whitelist(),
+                                   indent=4, separators=(',', ': ')))
 
-            def snortengine(alerts):
-                suricata = SuricataEngine(capture_directory)
-                suricata.start_suricata()
-                alerts["suricata"] = suricata.get_alerts()
+            # conns.json writing.
+            with open(os.path.join(capture_directory, "assets/conns.json"), "w") as f:
+                f.write(json.dumps(zeek.retrieve_conns(),
+                                   indent=4, separators=(',', ': ')))
 
-            # Start the engines.
-            p1 = Process(target=zeekengine, args=(alerts,))
-            p2 = Process(target=snortengine, args=(alerts,))
-            p1.start()
-            p2.start()
+        def snortengine(alerts):
+            suricata = SuricataEngine(capture_directory)
+            suricata.start_suricata()
+            alerts["suricata"] = suricata.get_alerts()
 
-            # Wait to their end.
-            p1.join()
-            p2.join()
+        # Start the engines.
+        p1 = Process(target=zeekengine, args=(alerts,))
+        p2 = Process(target=snortengine, args=(alerts,))
+        p1.start()
+        p2.start()
 
-            # Some formating and alerts.json writing.
-            with open(os.path.join(capture_directory, "assets/alerts.json"), "w") as f:
-                report = {"high": [], "moderate": [], "low": []}
-                for alert in (alerts["zeek"] + alerts["suricata"]):
-                    if alert["level"] == "High":
-                        report["high"].append(alert)
-                    if alert["level"] == "Moderate":
-                        report["moderate"].append(alert)
-                    if alert["level"] == "Low":
-                        report["low"].append(alert)
-                f.write(json.dumps(report, indent=4, separators=(',', ': ')))
+        # Wait to their end.
+        p1.join()
+        p2.join()
+
+        # Some formating and alerts.json writing.
+        with open(os.path.join(capture_directory, "assets/alerts.json"), "w") as f:
+            report = {"high": [], "moderate": [], "low": []}
+            for alert in (alerts["zeek"] + alerts["suricata"]):
+                if alert["level"] == "High":
+                    report["high"].append(alert)
+                if alert["level"] == "Moderate":
+                    report["moderate"].append(alert)
+                if alert["level"] == "Low":
+                    report["low"].append(alert)
+            f.write(json.dumps(report, indent=4, separators=(',', ': ')))
+
+        # Generate the report
+        report = Report(capture_directory,frontend)
+        report.generate_report()
 
-            # Generate the report
-            report = Report(capture_directory)
-            report.generate_report()
-        else:
-            print("The directory doesn't exist.")
     else:
-        print("Please specify a capture directory in argument.")
+        print("The directory doesn't exist.")
+
+
+def usage():
+    print("""Usage: python analysis.py [capture_directory]
+     where [capture_directory] is a directory containing a capture.pcap file
+     analysis.py -f starts the analysis in frontend mode intended to be called by the TinyCheck frontend.""")
+
+
+if __name__ == "__main__":
+    if len(sys.argv) == 2: #called manually without frontend
+        analyze(sys.argv[1], False)
+    elif len(sys.argv) == 3:
+        if(sys.argv[1]) == "-f": #frontend mode
+            analyze(sys.argv[2], True)
+        else:
+            usage()
+
+    else:
+        usage()
+
+
+

analysis/classes/report.py

@@ -13,7 +13,7 @@ from utils import get_config
 
 class Report(object):
 
-    def __init__(self, capture_directory):
+    def __init__(self, capture_directory, frontend):
         self.capture_directory = capture_directory
         self.alerts = self.read_json(os.path.join(
             capture_directory, "assets/alerts.json"))
@@ -21,10 +21,13 @@ class Report(object):
             capture_directory, "assets/whitelist.json"))
         self.conns = self.read_json(os.path.join(
             capture_directory, "assets/conns.json"))
-        self.device = self.read_json(os.path.join(
-            capture_directory, "assets/device.json"))
-        self.capinfos = self.read_json(os.path.join(
-            capture_directory, "assets/capinfos.json"))
+        self.device = None
+        self.capinfos = None
+        if frontend:
+            self.device = self.read_json(os.path.join(
+                capture_directory, "assets/device.json"))
+            self.capinfos = self.read_json(os.path.join(
+                capture_directory, "assets/capinfos.json"))
         try:
             with open(os.path.join(self.capture_directory, "capture.pcap"), "rb") as f:
                 self.capture_sha1 = hashlib.sha1(f.read()).hexdigest()
@@ -204,16 +207,18 @@ class Report(object):
         """
         header = "<div class=\"header\">"
         header += "<div class=\"logo\"></div>"
-        header += "<p><br /><strong>{}: {}</strong><br />".format(self.template["device_name"],
+        if self.device is not None:
+            header += "<p><br /><strong>{}: {}</strong><br />".format(self.template["device_name"],
                                                                   self.device["name"])
-        header += "{}: {}<br />".format(self.template["device_mac"],
+            header += "{}: {}<br />".format(self.template["device_mac"],
                                         self.device["mac_address"])
         header += "{} {}<br />".format(self.template["report_generated_on"],
                                        datetime.now().strftime("%d/%m/%Y - %H:%M:%S"))
-        header += "{}: {}s<br />".format(self.template["capture_duration"],
-                                         self.capinfos["Capture duration"])
-        header += "{}: {}<br />".format(self.template["packets_number"],
-                                        self.capinfos["Number of packets"])
+        if self.capinfos is not None:
+            header += "{}: {}s<br />".format(self.template["capture_duration"],
+                                             self.capinfos["Capture duration"])
+            header += "{}: {}<br />".format(self.template["packets_number"],
+                                            self.capinfos["Number of packets"])
         header += "{}: {}<br />".format(
             self.template["capture_sha1"], self.capture_sha1)
         header += "</p>"

analysis/classes/zeekengine.py

@@ -34,6 +34,22 @@ class ZeekEngine(object):
         self.active_analysis = get_config(("analysis", "active"))
         self.userlang = get_config(("frontend", "user_lang"))
 
+        # Retreive IOCs.
+        if self.iocs_analysis:
+            self.bl_cidrs = [[IPNetwork(cidr[0]), cidr[1]]
+                             for cidr in get_iocs("cidr")]
+            self.bl_hosts = get_iocs("ip4addr") + get_iocs("ip6addr")
+            self.bl_domains = get_iocs("domain")
+            self.bl_freedns = get_iocs("freedns")
+            self.bl_nameservers = get_iocs("ns")
+            self.bl_tlds = get_iocs("tld")
+
+        # Retreive whitelisted items.
+        if self.whitelist_analysis:
+            self.wl_cidrs = [IPNetwork(cidr) for cidr in get_whitelist("cidr")]
+            self.wl_hosts = get_whitelist("ip4addr") + get_whitelist("ip6addr")
+            self.wl_domains = get_whitelist("domain")
+
         # Load template language
         if not re.match("^[a-z]{2,3}$", self.userlang):
             self.userlang = "en"
@@ -84,21 +100,17 @@ class ZeekEngine(object):
         # Check for whitelisted assets, if any, delete the record.
         if self.whitelist_analysis:
 
-            wl_cidrs = [IPNetwork(cidr) for cidr in get_whitelist("cidr")]
-            wl_hosts = get_whitelist("ip4addr") + get_whitelist("ip6addr")
-            wl_domains = get_whitelist("domain")
-
             for i, c in enumerate(self.conns):
-                if c["ip_dst"] in [ip for ip in wl_hosts]:
+                if c["ip_dst"] in [ip for ip in self.wl_hosts]:
                     self.whitelist.append(self.conns[i])
                     self.conns[i] = False
-                elif c["resolution"] in wl_domains:
+                elif c["resolution"] in self.wl_domains:
                     self.whitelist.append(self.conns[i])
                     self.conns[i] = False
-                elif True in [c["resolution"].endswith("." + dom) for dom in wl_domains]:
+                elif True in [c["resolution"].endswith("." + dom) for dom in self.wl_domains]:
                     self.whitelist.append(self.conns[i])
                     self.conns[i] = False
-                elif True in [IPAddress(c["ip_dst"]) in cidr for cidr in wl_cidrs]:
+                elif True in [IPAddress(c["ip_dst"]) in cidr for cidr in self.wl_cidrs]:
                     self.whitelist.append(self.conns[i])
                     self.conns[i] = False
 
@@ -151,17 +163,9 @@ class ZeekEngine(object):
 
         if self.iocs_analysis:
 
-            bl_cidrs = [[IPNetwork(cidr[0]), cidr[1]]
-                        for cidr in get_iocs("cidr")]
-            bl_hosts = get_iocs("ip4addr") + get_iocs("ip6addr")
-            bl_domains = get_iocs("domain")
-            bl_freedns = get_iocs("freedns")
-            bl_nameservers = get_iocs("ns")
-            bl_tlds = get_iocs("tld")
-
             for c in self.conns:
                 # Check for blacklisted IP address.
-                for host in bl_hosts:
+                for host in self.bl_hosts:
                     if c["ip_dst"] == host[0]:
                         c["alert_tiggered"] = True
                         self.alerts.append({"title": self.template["IOC-01"]["title"].format(c["resolution"], c["ip_dst"], host[1].upper()),
@@ -171,7 +175,7 @@ class ZeekEngine(object):
                                             "id": "IOC-01"})
                         break
                 # Check for blacklisted CIDR.
-                for cidr in bl_cidrs:
+                for cidr in self.bl_cidrs:
                     if IPAddress(c["ip_dst"]) in cidr[0]:
                         c["alert_tiggered"] = True
                         self.alerts.append({"title": self.template["IOC-02"]["title"].format(c["resolution"], cidr[0], cidr[1].upper()),
@@ -180,7 +184,7 @@ class ZeekEngine(object):
                                             "level": "Moderate",
                                             "id": "IOC-02"})
                 # Check for blacklisted domain.
-                for domain in bl_domains:
+                for domain in self.bl_domains:
                     if c["resolution"].endswith(domain[0]):
                         if domain[1] != "tracker":
                             c["alert_tiggered"] = True
@@ -197,7 +201,7 @@ class ZeekEngine(object):
                                                 "level": "Moderate",
                                                 "id": "IOC-04"})
                 # Check for blacklisted FreeDNS.
-                for domain in bl_freedns:
+                for domain in self.bl_freedns:
                     if c["resolution"].endswith("." + domain[0]):
                         c["alert_tiggered"] = True
                         self.alerts.append({"title": self.template["IOC-05"]["title"].format(c["resolution"]),
@@ -207,7 +211,7 @@ class ZeekEngine(object):
                                             "id": "IOC-05"})
 
                 # Check for suspect tlds.
-                for tld in bl_tlds:
+                for tld in self.bl_tlds:
                     if c["resolution"].endswith(tld[0]):
                         c["alert_tiggered"] = True
                         self.alerts.append({"title": self.template["IOC-06"]["title"].format(c["resolution"]),
@@ -220,7 +224,7 @@ class ZeekEngine(object):
                 try:  # Domain nameservers check.
                     name_servers = pydig.query(c["resolution"], "NS")
                     if len(name_servers):
-                        for ns in bl_nameservers:
+                        for ns in self.bl_nameservers:
                             if name_servers[0].endswith(".{}.".format(ns[0])):
                                 c["alert_tiggered"] = True
                                 self.alerts.append({"title": self.template["ACT-01"]["title"].format(c["resolution"], name_servers[0]),
@@ -232,6 +236,7 @@ class ZeekEngine(object):
                     pass
 
                 try:  # Domain history check.
+
                     whois_record = whois.whois(c["resolution"])
                     creation_date = whois_record.creation_date if type(
                         whois_record.creation_date) is not list else whois_record.creation_date[0]
@@ -243,6 +248,7 @@ class ZeekEngine(object):
                                             "host": c["resolution"],
                                             "level": "Moderate",
                                             "id": "ACT-02"})
+
                 except:
                     pass
 
@@ -263,31 +269,79 @@ class ZeekEngine(object):
             for record in ParseZeekLogs(os.path.join(dir, "files.log"), output_format="json", safe_headers=False):
                 if record is not None:
                     f = {"filename": record["filename"],
-                         "ip_src": record["tx_hosts"],
-                         "ip_dst": record["rx_hosts"],
+                         "ip_src": record["id.orig_h"],
+                         "ip_dst": record["id.resp_h"],
                          "mime_type": record["mime_type"],
                          "sha1": record["sha1"]}
                     if f not in self.files:
                         self.files.append(f)
 
         for f in self.files:
-            if f["mime_type"] == "application/x-x509-ca-cert":
+            if f["mime_type"] == "application/x-x509-user-cert":
                 for cert in bl_certs:  # Check for blacklisted certificate.
                     if f["sha1"] == cert[0]:
-                        host = self.resolve(f["ip_dst"])
-                        c["alert_tiggered"] = True
+                        host = self.resolve(f["ip_src"])
                         self.alerts.append({"title": self.template["IOC-07"]["title"].format(cert[1].upper(), host),
                                             "description": self.template["IOC-07"]["description"].format(f["sha1"], host),
                                             "host": host,
                                             "level": "High",
                                             "id": "IOC-07"})
 
+    def http_check(self, dir):
+        """
+            Check on the http.log:
+                * Blacklisted domain/tld from the Host header field.
+            Can be used when no DNS query have been done during the session (already cached by the device.)
+            :return: nothing - all stuff appended to self.alerts
+        """
+
+        if os.path.isfile(os.path.join(dir, "http.log")):
+            for record in ParseZeekLogs(os.path.join(dir, "http.log"), output_format="json", safe_headers=False):
+                if record is not None:
+                    c = {"host": record['host']}
+                    if c not in self.http:
+                        self.http.append(c)
+
+        if self.iocs_analysis:
+            for c in self.http:
+
+                # If we already know the host form DNS, let's continue.
+                if c["host"] in [r["domain"] for r in self.dns]:
+                    continue
+
+                # Check for blacklisted domain.
+                for h in self.bl_domains:
+                    if h[1] != "tracker":
+                        if c["host"].endswith(h[0]):
+                            self.alerts.append({"title": self.template["IOC-08"]["title"].format(c["host"], h[1].upper()),
+                                                "description": self.template["IOC-08"]["description"].format(c["host"]),
+                                                "host": c["host"],
+                                                "level": "High",
+                                                "id": "IOC-08"})
+                # Check for freedns.
+                for h in self.bl_freedns:
+                    if c["host"].endswith(h[0]):
+                        self.alerts.append({"title": self.template["IOC-09"]["title"].format(c["host"]),
+                                            "description": self.template["IOC-09"]["description"].format(c["host"]),
+                                            "host": c["host"],
+                                            "level": "Moderate",
+                                            "id": "IOC-09"})
+                # Check for fancy TLD.
+                for h in self.bl_tlds:
+                    if c["host"].endswith(h[0]):
+                        self.alerts.append({"title": self.template["IOC-10"]["title"].format(c["host"]),
+                                            "description": self.template["IOC-10"]["description"].format(c["host"], h[0]),
+                                            "host": c["host"],
+                                            "level": "Low",
+                                            "id": "IOC-10"})
+
     def ssl_check(self, dir):
         """
             Check on the ssl.log:
                 * SSL connections which doesn't use the 443.
                 * "Free" certificate issuer (taken from the config).
                 * Self-signed certificates.
+                * Blacklisted domain in the CN
             :return: nothing - all stuff appended to self.alerts
         """
         ssl_default_ports = get_config(("analysis", "ssl_default_ports"))
@@ -298,8 +352,9 @@ class ZeekEngine(object):
                 if record is not None:
                     c = {"host": record['id.resp_h'],
                          "port": record['id.resp_p'],
-                         "issuer": record["issuer"],
-                         "validation_status": record["validation_status"]}
+                         "issuer": record["issuer"] if "issuer" in record else "",
+                         "validation_status": record["validation_status"],
+                         "cn": record["server_name"] if "server_name" in record else ""}
                     if c not in self.ssl:
                         self.ssl.append(c)
 
@@ -335,6 +390,24 @@ class ZeekEngine(object):
                                                 "level": "Moderate",
                                                 "id": "SSL-03"})
 
+        if self.iocs_analysis:
+            for cert in self.ssl:
+                # Check if the domain in the certificate haven't been blacklisted
+                # This check can be good if the domain has already been cached by
+                # the device so it wont appear in self.dns.
+
+                if any([cert["cn"].endswith(r["domain"]) for r in self.dns]):
+                    continue
+
+                for domain in self.bl_domains:
+                    if domain[1] != "tracker":
+                        if cert["cn"].endswith(domain[0]):
+                            self.alerts.append({"title": self.template["SSL-04"]["title"].format(domain[0], domain[1].upper()),
+                                                "description": self.template["SSL-04"]["description"].format(domain[0]),
+                                                "host": domain[0],
+                                                "level": "High",
+                                                "id": "SSL-04"})
+
     def alerts_check(self):
         """
             Leverage an advice to the user based on the trigered hosts
@@ -376,10 +449,10 @@ class ZeekEngine(object):
             self.working_dir), shell=True).wait()
         sp.Popen("cd {} && mv *.log assets/".format(self.working_dir),
                  shell=True).wait()
-
         self.fill_dns(self.working_dir + "/assets/")
         self.netflow_check(self.working_dir + "/assets/")
         self.ssl_check(self.working_dir + "/assets/")
+        self.http_check(self.working_dir + "/assets/")
         self.files_check(self.working_dir + "/assets/")
         self.alerts_check()
 

analysis/locales/cat.json

@@ -48,6 +48,18 @@
             "title": "Un certificat associat a activitats {} ha estat identificat en una comunicació cap a {}.",
             "description": "El certificat ({}) associat a {} ha estat explícitament etiquetat com a maliciós. Això indica que el seu dispositiu està probablement compromès i necessita ser analitzat en profunditat per un especialista forense."
         },
+        "IOC-08": {
+            "title": "S'ha fet una petició HTTP a {} que està etiquetada com {}.",
+            "description": "El domini {} identificat en la captura ha estat explícitament etiquetat com a maliciós. Això indica que el dispositiu està probablement compromès i ha de ser investigat en profunditat."
+        },
+        "IOC-09": {
+            "title": "S'ha fet una petició HTTP a el domini {} que és un DNS gratuït.",
+            "description": "El domini {} està utilitzant un servei DNS gratuït. Aquest tipus de serveis és utilitzat per cibercriminals i altres actors d'amenaces de manera comú. És força sospitós que una aplicació en segon pla utilitzi aquest tipus de serveis.Per favor investigui. "
+        },
+        "IOC-10": {
+            "title": "S'ha fet una petició HTTP a el domini {} que conté un TLD sospitós.",
+            "description": "El domini {} està utilitzant un domini de primer nivell -TLD- ({}). Encara que no sigui maliciós, aquest TLP no-genèric és usat per cibercriminals i altres actors d'amenaces amb regularitat. Comproveu aquest domini mitjançant la seva cerca a Internet. Si hi ha altres alertes relacionades amb aquest host, considereu-lo com a molt sospitós. "
+        },
         "ACT-01": {
             "title": "El domini {} està utilitzant un servidor de noms sospitós ({}).",
             "description": "El nom de domini {} utilitza un servidor de noms que ha estat explícitament etiquetat i associat a activitat maliciosa. Molts ciberdelinqüents i altres actors d'amenaces utilitzen aquest tipus de registradors ja que accepten criptomonedes i pagaments anònims. Es recomana investigar aquest domini i l'aplicació en execució associada mitjançant un anàlisi forense de el dispositiu. "
@@ -68,6 +80,10 @@
             "title": "El certificat associat a {} és autosignat.",
             "description": "L'ús de certificats autosignats és un element comú en infrastructures utilitzades per atacants. Recomanem comprovar el host {} que està associat a aquest certificat, especialment el seu nom de domini (en cas d'existir), el seu registre WHOIS, la seva data de creació i verificant la seva reputació a Internet. "
         },
+        "SSL-04": {
+            "title": "Un certificat conté el nom de domini {}, classificat com a {}",
+            "description": "Un dels certificats intercanviats conté el nom de domini {}. Aquest nom de domini s’ha classificat explícitament com a maliciós. El vostre dispositiu està compromès i hauria de ser investigat amb més detall per un equip professional."
+        },
         "ADV-01": {
             "title": "Comprovi les alertes per {}",
             "description": "Si us plau, verifiqui la reputació del sistema {}, ja que sembla ser maliciós per aparèixer en {} alertes durant la sessió."

analysis/locales/cn.json

@@ -0,0 +1,128 @@
+{
+    "alerts": {
+        "PROTO-01": {
+            "title": "{} 协议被主机 {} 用于连接外部网络。",
+            "description": "{} 协议一般只用于本地网络。请检查主机 {} ，结合其他警报确认是否存在威胁。"
+        },
+        "PROTO-02": {
+            "title": "存在 {} 个前往 {} 的连接使用了大于或等于 {} 的端口号.",
+            "description": "共有 {} 个目的地主机为 {} 的连接，使用了端口号  {} 。恶意流量时常使用非标准端口号。我们推荐对该主机地址的声誉进行检查，请参考其他警报并在互联网上搜索该地址。"
+        },
+        "PROTO-03": {
+            "title": "前往主机 {} 的HTTP连接",
+            "description": "您的设备向主机 {} 发起了未加密的HTTP连接。虽然此行为本身未必来自恶意软件，但大部分智能手机后台运行的软件不会发起未加密的HTTP连接。请在互联网上搜索该地址以检查该主机的声誉。"
+        },
+        "PROTO-04": {
+            "title": "前往主机 {} 的HTTP连接，使用了非标准端口 ({}).",
+            "description": "您的设备向主机 {} 发起了未加密的HTTP连接，并使用了非标准端口号 {} 。此行为相当异常。请在互联网上搜索该地址以检查该主机的声誉。"
+        },
+        "PROTO-05": {
+            "title": "本次分析期间，主机地址 {} 在DNS解析请求中并未出现过。",
+            "description": "这说明没有任何域名指向地址 {} ，或者被分析的设备缓存了之前的DNS解析结果。如果该地址出现在其他警报当中，请仔细检查。"
+        },
+        "IOC-01": {
+            "title": "存在前往 {} ({}) 的连接，该地址被标记为 {} 。",
+            "description": "主机 {} 由于恶意行为已被加入了黑明单。您的设备很可能已被感染，需要由IT安全人员进行深度分析。"
+        },
+        "IOC-02": {
+            "title": "前往 {} 的连接目的地处于 {} 网段，该网段已被标记为 {} 。",
+            "description": "服务器 {} 所处的网段存在大量已知的恶意活动。虽然该行为本身未必来自恶意软件，您仍然需要检查其他警告是否包含该地址。如果您有所怀疑，请在互联网上搜索该地址，以检查其是否恶意。"
+        },
+        "IOC-03": {
+            "title": "向域名 {} 发起的DNS请求已被标记为 {} 。",
+            "description": "在截获流量中出现的域名 {} 已被明确标记为恶意。您的设备很可能已被感染，需要由IT安全人员进一步进行深度分析。"
+        },
+        "IOC-04": {
+            "title": "向域名 {} 发起的DNS请求已被标记为 {} 。",
+            "description": "在截获流量中出现的域名 {} 已被明确标记为追踪器。您的设备上某个活动的应用正在追踪您的地理位置。"
+        },
+        "IOC-05": {
+            "title": "向 {} 发起的DNS请求是一个免费DNS服务商。",
+            "description": "在截获流量中出现的域名 {} 使用了免费的DNS服务。这类服务经常被网络犯罪份子或国家资助的黑客在行动中使用。后台运行的应用使用这类服务非常可疑，请仔细调查。"
+        },
+        "IOC-06": {
+            "title": "向域名 {} 发起的DNS请求使用了可疑的顶级域名。",
+            "description": "域名 {} 使用了可疑的顶级域名 ({}). 虽然这并不能确认域名被用于恶意用途，但这个不常见的顶级域名经常被网络犯罪份子或国家资助的黑客在行动中使用。请用搜索引擎在互联网上搜索该域名。如果存在其他警报指向该主机，则非常可疑。"
+        },
+        "IOC-07": {
+            "title": "曾被用于 {} 活动的数字证书被用于与 {} 通信.",
+            "description": "该数字证书 ({}) 与地址 {} 关联，已被明确标记为恶意。您的设备已被感染，需要对其进行取证分析。"
+        },
+        "IOC-08": {
+            "title": "向 {} 发起的HTTP请求，已被标记为 {} 。",
+            "description": "在截获流量中出现的域名 {} 已被明确标记为恶意。您的设备很可能已被感染，需要由IT安全人员进一步进行深度分析。"
+        },
+        "IOC-09": {
+            "title": "向 {} 发起的HTTP请求，域名使用了一个免费DNS服务商。",
+            "description": "域名 {} 使用了免费的DNS服务。这类服务经常被网络犯罪份子或国家资助的黑客在行动中使用。后台运行的应用使用这类服务非常可疑，请仔细调查。"
+        },
+        "IOC-10": {
+            "title": "向 {} 发起的HTTP请求使用了可疑的顶级域名。",
+            "description": "域名 {} 使用了可疑的顶级域名 ({}). 虽然这并不能确认域名被用于恶意用途，但这个不常见的顶级域名经常被网络犯罪份子或国家资助的黑客在行动中使用。请用搜索引擎在互联网上搜索该域名。如果存在其他警报指向该主机，则非常可疑。"
+        },
+        "ACT-01": {
+            "title": "域名 {} 使用了可疑的域名解析服务器 ({}).",
+            "description": "域名 {} 使用了可疑的域名解析服务器，该解析器已被明确标记为与恶意活动相关联。网络犯罪份子或国家资助的黑客经常使用此类服务，因为他们允许使用加密货币或匿名支付方式。建议对设备进行取证分析，以便该域名和与其相关的正在运行的应用程序进行深入调查。"
+        },
+        "ACT-02": {
+            "title": "域名 {} 最近刚刚被注册 ({} 天前)。",
+            "description": "域名 {} 非常新。虽然这本身不说明恶意行为，但黑客攻击者经常在每次攻击中使用新的设施，因此会使用刚刚注册的域名."
+        },
+        "SSL-01": {
+            "title": "在非标准端口 ({}) 上发起SSL连接至 {}",
+            "description": "在智能手机上，前往非标准端口的SSL连接非常罕见。虽然这可能来自非常正常的应用程序，但我们推荐检查域名 {} 的声誉。请检查该域名的WHOIS记录，对应的AS（Autonomous System, 自治领），域名注册日期，以及在互联网上搜索该域名。"
+        },
+        "SSL-02": {
+            "title": "前往 {} 的SSL连接使用了免费证书。",
+            "description": "免费SSL证书提供商 (例如 Let's Encrypt) 常被用于与恶意软件和钓鱼网页有关的后端远程控制服务器。我们建议仔细分析该证书对应的主机，检查其域名，注册日期，以及在互联网上的声誉。"
+        },
+        "SSL-03": {
+            "title": "与 {} 关联的自签名证书",
+            "description": "黑客攻击设施经常使用自签名证书。我们建议仔细分析该证书对应的主机 {} ，检查其域名 (如有) WHOIS记录，注册日期，以及在互联网上的声誉。"
+        },
+        "SSL-04": {
+            "title": "数字证书包含域名 {} ，已被归类为 {}",
+            "description": "一份被交换的证书中包括了域名 {} 。该域名已被明确标记为恶意。您的设备已确定被感染，需要交给专业团队进行进一步调查。"
+        },
+        "ADV-01": {
+            "title": "请检查 {} 的其他警报",
+            "description": "请检查主机 {} 的声誉，该地址可能存在恶意活动，在本次分析中已经触发了 {} 个警报。"
+        },
+        "SNORT-01": {
+            "title": "Suricata 入侵检测规则被触发: {}",
+            "description": "网络入侵检测规则被触发。您的设备很可能已经被入侵，或存在其他可疑行为。"
+        }
+    },
+    "report": {
+        "numbers": [
+            "一",
+            "二",
+            "三",
+            "四",
+            "五",
+            "六",
+            "七",
+            "八",
+            "九"
+        ],
+        "suspect_title": "可疑通信",
+        "uncat_title": "未分类通信",
+        "whitelist_title": "白名单通信",
+        "protocol": "协议",
+        "domain": "域名",
+        "dst_ip": "目的地IP地址",
+        "dst_port": "目的地端口号",
+        "device_name": "设备名称",
+        "device_mac": "设备 MAC 地址",
+        "report_generated_on": "报告生成于",
+        "capture_duration": "流量捕获时长",
+        "packets_number": "数据包数量",
+        "capture_sha1": "捕获的 SHA1 哈希",
+        "report_for_the_capture": "捕获报告",
+        "report_footer": "此报告由 Tinycheck 设备自动生成。如有任何疑问，错误报告或意见反馈，请联系 tinycheck@kaspersky.com 。",
+        "high_msg": "您的设备很可能已被入侵，存在 {} 条高级警报.",
+        "moderate_msg": "您有 {} 条中级警报，您的设备存在被入侵的可能性。请仔细检查这些警报。",
+        "low_msg": "您只有 {} 条低级警报。请检查。",
+        "none_msg": "情况正常，没有警报。如果存在未分类通信，请检查。"
+    }
+}

analysis/locales/de.json

@@ -48,6 +48,18 @@
             "title": "Ein Zertifikat, das mit {} Aktivitäten verknüpft ist, wurde in der Kommunikationsverbindung zu {} gefunden.",
             "description": "Das Zertifikat ({}), das mit {} verknüpft ist, wurde explizit als bösartig gekennzeichnet. Dies weist darauf hin, dass Ihr Gerät wahrscheinlich kompromittiert ist und eine forensische Analyse benötigt."
         },
+        "IOC-08": {
+            "title": "Es wurde eine HTTP-Abfrage zu {} ausgeführt, was als {} gekennzeichnet ist.",
+            "description": "Der in der Aufnahme vorkommende Domain-Name {} wurde explizit als bösartig gekennzeichnet. Dies weist darauf hin, dass Ihr Gerät wahrscheinlich kompromittiert ist und eingehend untersucht werden muss."
+        },
+        "IOC-09": {
+            "title": "Es wurde eine HTTP-Abfrage zur Domain {} ausgeführt, die einen Free-DNS-Dienst nutzt.",
+            "description": "Der Domain-Name {} nutzt einen Free-DNS-Dienst. Dienste dieser Art werden häufig von Cyberkriminellen oder staatlich unterstützten Angreifern bei ihren Operationen genutzt. Es ist sehr verdächtig, dass eine im Hintergrund laufende Anwendung einen solchen Dienst verwendet. Bitte untersuchen Sie das näher."
+        },
+        "IOC-10": {
+            "title": "Es wurde eine HTTP-Abfrage zur Domain {} ausgeführt, die eine verdächtige TLD enthält.",
+            "description": "Der Domain-Name {} nutzt eine verdächtige Top-Level-Domain ({}). Diese nicht-generische TLD ist zwar selbst nicht bösartig, wird aber häufig von Cyberkriminellen und bei staatlich unterstützten Operationen verwendet. Bitte überprüfen Sie diese Domain anhand einer Internetsuche. Wenn dieser Host in anderen Warnungen erwähnt wird, können Sie ihn als sehr verdächtig betrachten."
+        },
         "ACT-01": {
             "title": "Die Domain {} nutzt einen verdächtigen Nameserver ({}).",
             "description": "Der Domain-Name {} nutzt einen Nameserver, der explizit mit bösartigen Aktivitäten in Verbindung gebracht wird. Viele Cyberkriminelle und staatlich unterstützte Angreifer nutzen Registrare dieser Art, weil sie Kryptowährungen und anonyme Zahlungen zulassen. Es wird empfohlen, diese Domain und die damit verknüpfte laufende Anwendung mithilfe einer forensischen Analyse des Telefons näher zu untersuchen."
@@ -68,6 +80,10 @@
             "title": "Das mit {} verknüpfte Zertifikat ist selbstsigniert.",
             "description": "Die Verwendung von selbstsignierten Zertifikaten ist in der Infrastruktur von Angreifern weit verbreitet. Wir empfehlen, den mit diesem Zertifikat verknüpften Host {} zu überprüfen. Sehen Sie sich dazu seinen Domain-Namen (falls vorhanden), den WHOIS-Eintrag und das Erstellungsdatum an und überprüfen Sie die Reputation des Hosts im Internet."
         },
+        "SSL-04": {
+            "title": "Ein Zertifikat enthält den Domainnamen {}, der als {} kategorisiert ist",
+            "description": "Eines der ausgetauschten Zertifikate enthält den Domainnamen {}. Dieser Domainname wurde explizit als bösartig eingestuft. Ihr Gerät ist sicherlich kompromittiert und sollte von einem professionellen Team genauer untersucht werden."
+        },
         "ADV-01": {
             "title": "Überprüfen Sie die Warnungen für {}",
             "description": "Bitte überprüfen Sie die Reputation des Hosts {}. Dieser scheint bösartig zu sein, da er während der Sitzung {} Warnungen verursacht hat."

analysis/locales/en.json

@@ -48,6 +48,18 @@
             "title": "A certificate associated to {} activities have been found in the communication to {}.",
             "description": "The certificate ({}) associated to {} has been explicitly tagged as malicious. This indicates that your device is likely compromised and need a forensic analysis."
         },
+        "IOC-08": {
+            "title": "An HTTP request have been done to {} which is tagged as {}.",
+            "description": "The domain name {} seen in the capture has been explicitly tagged as malicious. This indicates that your device is likely compromised and needs to be investigated deeply."
+        },
+        "IOC-09": {
+            "title": "An HTTP request have been done to the domain {} which is a Free DNS.",
+            "description": "The domain name {} is using a Free DNS service. This kind of service is commonly used by cybercriminals or state-sponsored threat actors during their operations. It is very suspicious that an application running in background use this kind of service, please investigate."
+        },
+        "IOC-10": {
+            "title": "An HTTP request have been done to the domain {} which contains a suspect TLD.",
+            "description": "The domain name {} is using a suspect Top Level Domain ({}). Even not malicious, this non-generic TLD is used regularly by cybercrime or state-sponsored operations. Please check this domain by searching it on an internet search engine. If other alerts are related to this host, please consider it as very suspicious."
+        },
         "ACT-01": {
             "title": "The domain {} is using a suspect nameserver ({}).",
             "description": "The domain name {} is using a nameserver that has been explicitly tagged to be associated to malicious activities. Many cybercriminals and state-sponsored threat actors are using this kind of registrars because they allow cryptocurrencies and anonymous payments. It is adviced to investigate on this domain and the associated running application by doing a forensic analysis of the phone."
@@ -68,6 +80,10 @@
             "title": "The certificate associated to {} is self-signed.",
             "description": "The use of self-signed certificates is a common thing for attacker infrastructure. We recommend to check the host {} which is associated to this certificate, by looking at the domain name (if any), its WHOIS record, its creation date, and by checking its reputation on the internet."
         },
+        "SSL-04": {
+            "title": "A certificate contains the domain name {}, categorized as {}",
+            "description": "One of the certificates exchanged contains the domain name {}. This domain name has been explicitly classified as malicious. Your device is definitely compromised and should be investigated further by a professional team."
+        },
         "ADV-01": {
             "title": "Check the alerts for {}",
             "description": "Please, check the reputation of the host {}, this one seems to be malicious as it leveraged {} alerts during the session."

analysis/locales/es.json

@@ -48,6 +48,18 @@
             "title": "Un certificado asociado a actividades {} ha sido identificado en una comunicación hacia {}.",
             "description": "El certificado ({}) asociado a {} ha sido explícitamente etiquetado como malicioso. Esto indica que su dispositivo está probablemente comprometido y necesita ser analizado en profundidad por un especialista forense."
         },
+        "IOC-08": {
+            "title": "Se ha realizado una petición HTTP a {} que está etiquetada como {}.",
+            "description": "El dominio {} identificado en la captura ha sido explícitamente etiquetado como malicioso. Esto indica que su dispositivo está probablemente comprometido y debe ser investigado en profundidad."
+        },
+        "IOC-09": {
+            "title": "Se ha realizado una petición HTTP al dominio {} que es un DNS gratuito.",
+            "description": "El dominio {} está usando un servicio DNS gratuito. Este tipo de servicios es comúnmente utilizado por cibercriminales y otros actores de amenazas. Es altamente sospechoso que una aplicación ejecutándose en segundo plano use este tipo de servicios. Por favor investigue."
+        },
+        "IOC-10": {
+            "title": "Se ha realizado una petición HTTP al dominio {} que contiene un TLD sospechoso.",
+            "description": "El dominio {} está usando un dominio de primero nivel -TLD- ({}). Aunque no sea malicioso, este TLP no-genérico es usado por cibercriminales y otros actores de amenazas con regularidad. Verifique este dominio mediante su búsqueda en Internet. Si hay otras alertas relacionadas con este host, por favor considérelo como muy sospechoso."
+        },
         "ACT-01": {
             "title": "El dominio {} está usando un servidor de nombres sospechoso ({}).",
             "description": "El nombre de dominio {} usa un servidor de nombres que ha sido explícitamente etiquetado como asociado a actividad maliciosa. Muchos ciberdelincuentes y otros actores de amenazas utilizan este tipo de registradores ya que aceptan criptomonedas y pagos anónimos. Se recomienda investigar este dominio y la aplicación en ejecución asociada mediante un análisis forense del dispositivo."
@@ -68,6 +80,10 @@
             "title": "El certificado asociado a {} es autofirmado.",
             "description": "El uso de certificados autofirmados es un elemento común en infraestructuras utilizadas por atacantes. Recomendamos comprobar el host {} que está asociado a este certificado, especialmente su nombre de dominio (en caso de existir), su registro WHOIS, su fecha de creación y verificando su reputación en Internet."
         },
+        "SSL-04": {
+            "title": "Un certificado contiene el nombre de dominio {}, categorizado como {}",
+            "description": "Uno de los certificados intercambiados contiene el nombre de dominio {}. Este nombre de dominio se ha clasificado explícitamente como malicioso. Su dispositivo está definitivamente comprometido y debe ser investigado más a fondo por un equipo profesional."
+        },
         "ADV-01": {
             "title": "Compruebe las alertas para {}",
             "description": "Por favor, verifique la reputación del host {}, ya que parece ser malicioso por aparecer en {} alertas durante la sesión."

analysis/locales/fr.json

@@ -48,6 +48,18 @@
             "title": "Un certificat associé à des activités de {} a été vu lors de communications vers {}.",
             "description": "Le certificat ({}) associé au serveur {} a été explicitement catégorisé comme malveillant. Votre appareil est sûrement compromis et doit être investigué plus en détails par une équipe professionnelle."
         },
+        "IOC-08": {
+            "title": "Requête HTTP vers le domaine {} qui est tagué en tant que {}.",
+            "description": "Le serveur {} vers lequel communique votre appareil a été explicitement catégorisé en tant que malveillant. Votre appareil est sûrement compromis et doit être investigué plus en détails par une équipe professionnelle."
+        },
+        "IOC-09": {
+            "title": "Requête HTTP vers le domaine {} qui est un domaine gratuit.",
+            "description": "Le nom de domaine {} utilise un service de noms de domaine gratuits. Ce type de service est couramment utilisé par les cybercriminels ou des acteurs associés à des États au cours de leurs opérations d'espionnage. Il est très suspect qu'une application exécutée en arrière-plan utilise ce type de service, veuillez enquêter."
+        },
+        "IOC-10": {
+            "title": "Requête HTTP vers le domaine {} contenant une extension suspecte.",
+            "description": "Le nom de domaine {} utilise une extension suspecte ({}). Même si cela n'est pas malveillant en-soi, l'utilisation d'une extension non générique est l'apanage d'acteurs cybercriminels et étatiques durant leurs opérations. Veuillez vérifier la pertinance de ce domaine en le recherchant sur un moteur de recherche Internet. Si d'autres alertes sont liées à ce dernier, veuillez le considérer comme très suspect."
+        },
         "ACT-01": {
             "title": "Le domaine {} utilise un serveur de noms suspect ({}).",
             "description": "Le nom de domaine {} utilise un serveur de noms qui a été explicitement catégorisé comme associé à des activités malveillantes. Plusieurs cybercriminels et acteurs étatiques utilisent ce type de serveurs de noms car ils autorisent les paiements anonymes grâce aux cryptomonnaies. Il est conseillé d'investiguer sur ce domaine et l'application s'y connectant en réalisant une analyse post-mortem de l'appareil analysé."
@@ -68,6 +80,10 @@
             "title": "Le certificat associé à {} est auto-signé.",
             "description": "L'utilisation de certificats auto-signés est une chose courante pour des infrastructures d'attaque associées à des activités malveillantes. Nous vous recommandons de vérifier le serveur {} qui est associé à ce certificat, en regardant le nom de domaine (le cas échéant), son enregistrement WHOIS, sa date de création, et en vérifiant sa réputation sur Internet."
         },
+        "SSL-04": {
+            "title": "Un certificat contient le nom de domaine {}, catégorisé en tant que {}",
+            "description": "Un des certificats échangés contient le nom de domaine {}. Ce nom de domaine a été explicitement catégorisé en tant que malveillant. Votre appareil est sûrement compromis et doit être investigué plus en détails par une équipe professionnelle."
+        },
         "ADV-01": {
             "title": "Vérifiez les alertes liées au serveur {}",
             "description": "Merci de vérifier la réputation et les alertes liées au serveur {}, ce dernier semble malveillant, ayant engendré {} alertes durant la session de capture."

analysis/locales/it.json

@@ -48,6 +48,18 @@
             "title": "Nella comunicazione a {} è stato rilevato un certificato associato ad attività {}.",
             "description": "Il certificato ({}) associato a {} è stato esplicitamente contrassegnato come dannoso. Questo indica che il dispositivo è potenzialmente compromesso e necessita di un'analisi forense."
         },
+        "IOC-08": {
+            "title": "È stata effettuata una richiesta HTTP a {} con contrassegno {}.",
+            "description": "Il nome di dominio {} visualizzato nell'acquisizione è stato esplicitamente contrassegnato come dannoso. Questo indica che il dispositivo è potenzialmente compromesso e deve essere esaminato a fondo."
+        },
+        "IOC-09": {
+            "title": "È stata effettuata una richiesta HTTP al dominio {} che è un servizio Free DNS.",
+            "description": "Il nome di dominio {} utilizza un servizio Free DNS. Questo tipo di servizio è comunemente utilizzato durante le operazioni di criminali informatici o autori di attacchi commissionati da stati esteri. L'utilizzo di questo tipo di servizio da parte di un'applicazione in esecuzione in background è molto sospetto e richiede ulteriori indagini."
+        },
+        "IOC-10": {
+            "title": "È stata effettuata una richiesta HTTP al dominio {} contenente un dominio di primo livello sospetto.",
+            "description": "Il nome di dominio {} utilizza un dominio di primo livello sospetto ({}). Anche se non dannoso, questo dominio di primo livello non generico viene utilizzato regolarmente durante le operazioni di criminali informatici o autori di attacchi commissionati da stati esteri. Controllare questo dominio effettuando una ricerca tramite un motore di ricerca Internet. Se altri avvisi sono correlati all'host, è necessario considerare questo elemento molto sospetto."
+        },
         "ACT-01": {
             "title": "Il dominio {} utilizza un server dei nomi sospetto ({}).",
             "description": "Il nome di dominio {} utilizza un server dei nomi che è stato esplicitamente contrassegnato come associato ad attività dannose. Molti criminali informatici e autori di attacchi commissionati da stati esteri utilizzano questo tipo di registrar poiché sono ammessi criptovalute e pagamenti anonimi. È consigliabile indagare su questo dominio e sull'applicazione in esecuzione associata eseguendo un'analisi forense del telefono."
@@ -68,6 +80,10 @@
             "title": "Il certificato associato a {} è autofirmato.",
             "description": "L'utilizzo di certificati autofirmati è una consuetudine per l'infrastruttura degli autori degli attacchi. È consigliabile controllare l'host {} associato a questo certificato, prestando attenzione all'eventuale nome di dominio, al record WHOIS e alla data di creazione, nonché verificandone la reputazione in Internet."
         },
+        "SSL-04": {
+            "title": "Un certificato contiene il nome di dominio {}, classificato come {}",
+            "description": "Uno dei certificati scambiati contiene il nome di dominio {}. Questo nome di dominio è stato esplicitamente classificato come dannoso. Il tuo dispositivo è decisamente compromesso e dovrebbe essere esaminato ulteriormente da un team di professionisti."
+        },
         "ADV-01": {
             "title": "Controllare gli avvisi per {}",
             "description": "Controllare la reputazione dell'host {}, che sembra di natura dannosa poiché ha sfruttato {} avvisi durante la sessione."

analysis/locales/pt.json

@@ -48,6 +48,18 @@
             "title": "Um certificado associado a atividades de {} foi encontrado na comunicação para {}.",
             "description": "O certificado ({}) associado a {} foi explicitamente marcado como malicioso. Isso indica que o dispositivo provavelmente foi comprometido e precisa de uma análise forense."
         },
+        "IOC-08": {
+            "title": "Uma solicitação de HTTP foi feita para {}, marcado como {}.",
+            "description": "O nome de domínio {} visto na captura foi explicitamente marcado como malicioso. Isso indica que o dispositivo provavelmente foi comprometido e precisa ser analisado com cuidado."
+        },
+        "IOC-09": {
+            "title": "Uma solicitação de HTTP foi feita para o domínio {}, que é um DNS gratuito.",
+            "description": "O nome de domínio {} está usando um serviço de DNS gratuito. Esse tipo de serviço é comumente usado por cibercriminosos ou agências de inteligência estatais no exercício de suas funções. É muito suspeito que aplicativos em execução em segundo plano usem esse tipo de serviço e isso deve ser analisado com cuidado."
+        },
+        "IOC-10": {
+            "title": "Uma solicitação de HTTP foi feita para o domínio {}, que contém um TLD (domínio de nível superior) suspeito.",
+            "description": "O nome de domínio {} está usando um TLD suspeito ({}). Mesmo não sendo malicioso, esse TLD não genérico é frequentemente usado por cibercriminosos ou agências de inteligência estatais. Analise a reputação do domínio pesquisando-o na internet. Se outros alertas forem observados, considere esse host como muito suspeito."
+        },
         "ACT-01": {
             "title": "O domínio {} está usando um servidor de nomes suspeito ({}).",
             "description": "O nome de domínio {} está usando um servidor de nomes explicitamente marcado como associado a atividades maliciosas. Muitos cibercriminosos e agentes de inteligência estatais usam esse tipo de registradores porque isso permite pagamentos com criptomoedas e anônimos. É recomendável investigar esse domínio e o aplicativo em execução por meio de uma análise forense do telefone."
@@ -68,6 +80,10 @@
             "title": "O certificado associado a {} é autoassinado.",
             "description": "O uso de certificados autoassinados é comum na infraestrutura de invasores. É recomendável analisar o host {} que está associado a esse certificado verificando o nome e o registro de domínio (se houver), a data de criação e sua reputação na internet."
         },
+        "SSL-04": {
+            "title": "Um certificado contém o nome de domínio {}, categorizado como {}",
+            "description": "Um dos certificados trocados contém o nome de domínio {}. Este nome de domínio foi explicitamente classificado como malicioso. Seu dispositivo está definitivamente comprometido e deve ser investigado por uma equipe profissional."
+        },
         "ADV-01": {
             "title": "Verifique os alertas para {}",
             "description": "Verifique a reputação do host {}, este parece ser malicioso, pois acionou alertas para {} durante a sessão."

analysis/locales/ru.json

@@ -48,6 +48,18 @@
             "title": "Сертификат, связанный с действиями {}, был обнаружен при взаимодействии с {}.",
             "description": "Сертификат ({}), связанный с {}, явно отмечен как вредоносный. Это указывает на то, что ваше устройство, вероятно, взломано и требуется провести экспертный анализ."
         },
+        "IOC-08": {
+            "title": "Выполнен HTTP-запрос к {}, отмеченному как {}.",
+            "description": "Доменное имя {}, обнаруженное при сборе данных, явно отмечено как вредоносное. Это указывает на то, что ваше устройство, вероятно, взломано и требуется тщательное расследование."
+        },
+        "IOC-09": {
+            "title": "Выполнен HTTP-запрос к домену {}, использующему бесплатную службу DNS.",
+            "description": "Доменное имя {} использует бесплатную службу DNS. Такие службы обычно используются киберпреступниками или спонсируемыми государством злоумышленниками для атак. Очень подозрительно, что приложение, работающее в фоновом режиме, использует такую службу. Требуется расследование."
+        },
+        "IOC-10": {
+            "title": "Выполнен HTTP-запрос к домену {}, содержащему подозрительный домен верхнего уровня.",
+            "description": "Доменное имя {} использует подозрительный домен верхнего уровня ({}). Даже не являясь вредоносным, этот не универсальный домен верхнего уровня регулярно используется киберпреступниками или спонсируемыми государством злоумышленниками. Проверьте этот домен, выполнив поиск в интернете. Если с этим устройством связаны другие предупреждения, это очень подозрительно."
+        },
         "ACT-01": {
             "title": "Домен {} использует подозрительный сервер имен ({}).",
             "description": "Доменное имя {} использует сервер имен, который явно отмечен как связанный с вредоносными действиями. Многие киберпреступники и спонсируемые государством злоумышленники пользуются такими регистраторами, поскольку они позволяют использовать криптовалюту и анонимные платежи. Рекомендуется исследовать этот домен и связанные с ним работающие приложения, выполнив экспертный анализ телефона."
@@ -68,6 +80,10 @@
             "title": "Сертификат, связанный с {}, является самоподписанным.",
             "description": "Использование самоподписанных сертификатов типично для инфраструктуры злоумышленников. Рекомендуется проверить устройство {}, связанное с этим сертификатом, изучив его доменное имя (если имеется), запись WHOIS, дату создания и репутацию в интернете."
         },
+        "SSL-04": {
+            "title": "Сертификат содержит доменное имя {}, относящееся к категории {}",
+            "description": "Один из обмениваемых сертификатов содержит доменное имя {}. Это доменное имя явно классифицировано как вредоносное. Ваше устройство определенно взломано и должно быть исследовано профессиональной группой."
+        },
         "ADV-01": {
             "title": "Проверьте предупреждения для {}",
             "description": "Проверьте репутацию устройства {}. Оно кажется вредоносным, поскольку для него сработало {} предупрежд. во время сеанса."

analysis/locales/sk.json

@@ -0,0 +1,128 @@
+{
+    "alerts": {
+        "PROTO-01": {
+            "title": "{} komunikácia smeruje mimo lokálnej siete do {}.",
+            "description": "Protokol {} sa bežne používa v interných sieťach. Skontrolujte, či hostiteľ {} nevygeneroval iné upozornenia, ktoré môžu naznačovať škodlivé správanie."
+        },
+        "PROTO-02": {
+            "title": "{} pripojenie k {} cez port väčší alebo rovný {}.",
+            "description": "Zistili sa {} pripojenia k {} na porte {}. Použitie neštandardného portu je niekedy vodítkom pre škodlivú aktivitu. Odporúčame vám skontrolovať reputáciu tohto hostiteľa pomocou vyhľadania na internete."
+        },
+        "PROTO-03": {
+            "title": "Komunikácia HTTP bola uskutočnená s hostiteľom {}",
+            "description": "Vaše zariadenie komunikovalo s hostiteľom {} pomocou nešifrovaného protokolu HTTP. Aj keď toto správanie nie je samo o sebe škodlivé, nie je bežné, aby aplikácie smartfónu spustené na pozadí vytvárali komunikáciu HTTP. Skontrolujte reputáciu hostiteľa pomocou vyhľadania na internete."
+        },
+        "PROTO-04": {
+            "title": "S hostiteľom {} sa komunikovalo cez HTTP cez neštandardný port ({}).",
+            "description": "Vaše zariadenie komunikovalo s hostiteľom {} cez port {} pomocou nešifrovaného protokolu HTTP. Toto správanie je dosť nezvyčajné. Overte si reputáciu hostiteľa pomocou vyhľadania na internete."
+        },
+        "PROTO-05": {
+            "title": "Server {} nebol vyriešený v požiadavke DNS počas relácie.",
+            "description": "To znamená, že server {} pravdepodobne nie je riešený žiadnym názvom domény alebo toto rozlíšenie už zariadenie uložilo do vyrovnávacej pamäte. Ak sa hostiteľ zobrazuje v iných upozorneniach, skontrolujte ho."
+        },
+        "IOC-01": {
+            "title": "Bolo vytvorené pripojenie k {} ({}), ktoré je označené ako {}.",
+            "description": "Hostiteľ {} bol explicitne zaradený na čiernu listinu kvôli škodlivej aktivite. Vaše zariadenie je pravdepodobne napadnuté a vyžaduje ďalšie preskúmanie odborníkmi na bezpečnosť IT."
+        },
+        "IOC-02": {
+            "title": "Komunikácia s {} v rámci CIDR {}, ktorý je označený ako {}.",
+            "description": "Server {} je hosťovaný v sieti známej škodlivou aktivitou. Aj keď toto správanie nie je vo svojej podstate škodlivé, mali by ste skontrolovať, či sa o tomto hostiteľovi nezmieňujú iné upozornenia. Ak máte pochybnosti, vyhľadajte tohto hostiteľa na internete, aby ste zistili, či je legitímny."
+        },
+        "IOC-03": {
+            "title": "DNS požiadavka bola vytvorená pre {}, ktorý je označený ako {}.",
+            "description": "Názov domény {} v zázname bol výslovne označený ako škodlivý. To znamená, že vaše zariadenie je pravdepodobne napadnuté a je potrebné ho ďalej preskúmať."
+        },
+        "IOC-04": {
+            "title": "DNS požiadavka bola vytvorená pre {}, ktorý je označený ako {}.",
+            "description": "Názov domény {} zobrazený v zázname bol explicitne označený ako tracker. Znamená to, že jedna z aktívnych aplikácií geograficky sleduje Vašu polohu."
+        },
+        "IOC-05": {
+            "title": "DNS požiadavka bola vytvorená pre doménu {} pomocou bezplatnej služby DNS.",
+            "description": "Názov domény {} používa bezplatnú službu DNS. Služby tohto typu často využívajú pri svojich operáciách počítačoví zločinci alebo útočníci podporovaní vládou. Je veľmi podozrivé, že aplikácia spustená na pozadí používa takúto službu. Preskúmajte to podrobnejšie."
+        },
+        "IOC-06": {
+            "title": "Bola vykonaná DNS požiadavka pre doménu {} obsahujúca podozrivú TLD.",
+            "description": "Názov domény {} používa podozrivú doménu najvyššej úrovne ({}). Aj keď nie je sama o sebe škodlivá, túto negenerickú TLD bežne používajú kyberzločinci a vládami sponzorované operácie. Overte túto doménu pomocou vyhľadania na internete. Ak je tento hostiteľ spomenutý v iných upozorneniach, považujte to za veľmi podozrivé."
+        },
+        "IOC-07": {
+            "title": "Certifikát priradený k {} aktivitám sa našiel v komunikácii s {}.",
+            "description": "Certifikát ({}) priradený k {} bol explicitne označený ako škodlivý. Znamená to, že vaše zariadenie je pravdepodobne napadnuté a potrebuje forenznú analýzu."
+        },
+        "IOC-08": {
+            "title": "Na {} bola odoslaná požiadavka HTTP, ktorá je označená ako {}.",
+            "description": "Názov domény {} zobrazený v zázname bol výslovne označený ako škodlivý. To znamená, že Vaše zariadenie je pravdepodobne napadnuté a vyžaduje si dôkladnú analýzu."
+        },
+        "IOC-09": {
+            "title": "Do domény {} bola uskutočnená požiadavka HTTP pomocou bezplatnej služby DNS.",
+            "description": "Názov domény {} používa bezplatnú službu DNS. Služby tohto typu často využívajú pri svojich operáciách počítačoví zločinci alebo útočníci podporovaní vládou. Je veľmi podozrivé, že aplikácia spustená na pozadí používa takúto službu. Preskúmajte to podrobnejšie."
+        },
+        "IOC-10": {
+            "title": "Do domény {}, ktorá obsahuje podozrivú TLD, bola odoslaná požiadavka HTTP.",
+            "description": "Názov domény {} používa podozrivú doménu najvyššej úrovne ({}). Túto negenerickú TLD, hoci sama o sebe nie je škodlivá, bežne používajú počítačoví zločinci a pri operáciách sponzorovaných vládou. Overte túto doménu pomocou vyhľadania na internete. Ak je tento hostiteľ uvedený v iných upozorneniach, považujte to za veľmi podozrivé."
+        },
+        "ACT-01": {
+            "title": "Doména {} používa podozrivý názvový server ({}).",
+            "description": "Názov domény {} používa názvový server, ktorý je explicitne spojený so škodlivou aktivitou. Mnoho kyberzločincov a štátom podporovaných útočníkov používa registrátorov tohto typu, pretože umožňujú použiť kryptomeny a anonymné platby. Odporúča sa ďalej skúmať túto doménu a súvisiacu spustenú aplikáciu pomocou forenznej analýzy telefónu."
+        },
+        "ACT-02": {
+            "title": "Doména {} bola vytvorená nedávno (pred {} dňami).",
+            "description": "Názov domény {} je nový. Aj keď to nie je vo svojej podstate škodlivé, útočníci často vytvoria novú infraštruktúru pre každú kampaň, čo môže viesť k použitiu novo registrovaných doménových mien."
+        },
+        "SSL-01": {
+            "title": "SSL pripojenie na neštandardnom porte ({}) k {}",
+            "description": "Je nezvyčajné, aby smartfóny vytvárali pripojenia SSL cez neštandardný port. Môže to byť legitímne, ale aj tak odporúčame skontrolovať reputáciu {}. Pozrite sa na jeho záznam WHOIS, súvisiaci autonómny systém, dátum jeho vytvorenia a vyhľadajte ho na internete."
+        },
+        "SSL-02": {
+            "title": "SSL pripojenie k {} používa bezplatný certifikát.",
+            "description": "Bezplatné certifikáty – ako napr Let's Encrypt – sú bežne používané príkazovými a riadiacimi servermi spojenými so škodlivými implantátmi a phishingovými webovými stránkami. Odporúčame overiť hostiteľa spojeného s týmto certifikátom. Pozrite sa na názov domény a dátum vytvorenia alebo si overte reputáciu hostiteľa na internete."
+        },
+        "SSL-03": {
+            "title": "Certifikát priradený k {} je podpísaný sám sebou.",
+            "description": "Používanie certifikátov s vlastným podpisom je v infraštruktúre útočníka rozšírené. Odporúčame skontrolovať hostiteľa {} priradeného k tomuto certifikátu. Ak to chcete urobiť, pozrite sa na názov jeho domény (ak ho má), záznam WHOIS, dátum vytvorenia a skontrolujte reputáciu hostiteľa na internete."
+        },
+        "SSL-04": {
+            "title": "Certifikát obsahuje názov domény {}, kategorizovaný ako {}",
+            "description": "Jeden z vymenených certifikátov obsahuje názov domény {}. Tento názov domény bol výslovne klasifikovaný ako škodlivý. Vaše zariadenie je určite napadnuté a malo by byť ďalej zanalyzované profesionálnym tímom."
+        },
+        "ADV-01": {
+            "title": "Skontrolujte upozornenia pre {}",
+            "description": "Skontrolujte prosím reputáciu hostiteľa {}, Zdá sa, že je to škodlivé, pretože to počas relácie vygenerovalo {} upozornení."
+        },
+        "SNORT-01": {
+            "title": "Spustilo sa pravidlo Suricata: {}",
+            "description": "Spustilo sa pravidlo zisťovania siete. Je pravdepodobné, že Vaše zariadenie bolo ohrozené alebo vykazuje podozrivé správanie."
+        }
+    },
+    "report": {
+        "numbers": [
+            "jednu",
+            "dva",
+            "tri",
+            "štyri",
+            "päť",
+            "šesť",
+            "sedem",
+            "osem",
+            "deväť"
+        ],
+        "suspect_title": "Podozrivá komunikácia",
+        "uncat_title": "Nekategorizovaná komunikácia",
+        "whitelist_title": "Komunikácia na bielej listine",
+        "protocol": "Protokol",
+        "domain": "Doména",
+        "dst_ip": "Dst IP adresa",
+        "dst_port": "Dst číslo portu",
+        "device_name": "Názov zariadenia",
+        "device_mac": "MAC adresa zariadenia",
+        "report_generated_on": "Report vygenerovaný",
+        "capture_duration": "Trvanie záznamu",
+        "packets_number": "Počet paketov",
+        "capture_sha1": "Záznam SHA1",
+        "report_for_the_capture": "Report pre záznam",
+        "report_footer": "Tento prehľad bol automaticky vygenerovaný zariadením Tinycheck. V prípade akýchkoľvek otázok, hlásení chýb alebo spätnej väzby nás kontaktujte na tinycheck@kaspersky.com.",
+        "high_msg": "Vaše zariadenie je napadnuté a máte {} kritické/ú výstrahy/u.",
+        "moderate_msg": "Máte {} mierne/u výstrahy/u, Vaše zariadenie môže byť napadnuté. Pozrite si ich pozorne.",
+        "low_msg": "Máte iba {} nízke/u výstrahy/u, neváhajte ich skontrolovať.",
+        "none_msg": "Všetko vyzerá dobre, žiadne upozornenia. Neváhajte a skontrolujte nekategorizovanú komunikáciu, ak existuje."
+    }
+}

analysis/utils.py

@@ -10,7 +10,7 @@ import os
 from functools import reduce
 
 # I'm not going to use an ORM for that.
-parent = "/".join(sys.path[0].split("/")[:-1])
+parent = os.path.split(os.path.dirname(os.path.abspath(sys.argv[0])))[0]
 conn = sqlite3.connect(os.path.join(parent, "tinycheck.sqlite3"))
 cursor = conn.cursor()
 

app/backend/package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "tinycheck-backend",
+  "name": "@kaspersky/tinycheck-backend",
   "version": "0.1.0",
   "lockfileVersion": 1,
   "requires": true,

app/backend/package.json

@@ -1,7 +1,6 @@
 {
-  "name": "tinycheck-backend",
+  "name": "@kaspersky/tinycheck-backend",
   "version": "0.1.0",
-  "private": true,
   "scripts": {
     "serve": "vue-cli-service serve --copy --port=4201",
     "build": "vue-cli-service build",

app/backend/src/App.vue

@@ -25,9 +25,6 @@
                 <li class="menu-item">
                   <span @click="$router.push('/device/db')">Manage database</span>
                 </li>
-                <!-- <li class="menu-item">
-                  <span @click="$router.push('/device/user')">User configuration</a>
-                </li> -->
               </ul>
             </div>
           </div>
@@ -42,6 +39,9 @@
                 <li class="menu-item">
                   <span @click="$router.push('/iocs/search')">Search IOCs</span>
                 </li>
+                <li class="menu-item">
+                  <span @click="$router.push('/iocs/misp')">MISP Instances</span>
+                </li>
               </ul>
             </div>
           </div>
@@ -95,4 +95,4 @@
   .fade-leave-active {
     opacity: 0
   }
-</style>
+</style>

app/backend/src/assets/custom.css

@@ -650,4 +650,128 @@ h4, h5 {
 
 .upper {
 	text-transform: uppercase;
+}
+
+/*** MISP CSS ***/
+
+.misp-form {
+	/* Using CSS Grid to lay out the elements in two-dimensions: */
+	display: grid;
+	/* specifying a 0.2em gutter/gap between adjacent elements: */
+	gap: 0.4em;
+	overflow:auto;
+	grid-template-columns: 10em 0.5em 1fr;
+	width: 100%;
+	border-radius:.1rem;
+	margin-bottom: .8rem;
+}
+
+.misp-label {
+	/* placing all <label> elements in the grid column 1 (the first): */
+	grid-column: 1;
+	text-align: left;
+	padding-top: .3em;
+}
+
+.misp-offline {
+	background-color: #e85600;
+	color: #FFF;
+	font-size: 11px;
+	border-radius: 3px;
+	padding:3px 6px 3px 6px;
+	cursor: help;
+}
+
+.misp-online {
+	background-color: #64c800;
+	color: #FFF;
+	font-size: 11px;
+	border-radius: 3px;
+	padding:3px 6px 3px 6px;
+	cursor: help;
+}
+.misp-name {
+	font-size: 1rem;
+	font-family: "Roboto-Bold";
+	color: #484848;
+}
+
+.misp-name:disabled {
+	border-style: none;
+	color:inherit;
+	background-color: inherit;
+	padding: unset;
+}
+
+.misp-input {
+	grid-column: 3;
+	align-self: center;
+}
+
+.misp-input:disabled {
+	border-style: none;
+	color:inherit;
+	background-color: inherit;
+	padding: unset;
+}
+
+.misp-button {
+	/* positioning the <button> element in the grid-area identified
+	   by the name of 'submit': */
+	grid-area: submit;
+}
+
+.loading {
+	margin-bottom: 12px;
+	display: block;
+}
+
+.loading::after {
+    animation: loading .5s infinite linear;
+    background: 0 0;
+    border: .1rem solid #66758c;
+    border-radius: 50%;
+    border-right-color: transparent;
+    border-top-color: transparent;
+    content: "";
+    display: block;
+    height: .8rem;
+    left: 50%;
+    margin-left: -.4rem;
+    margin-top: -.4rem;
+    opacity: 1;
+    padding: 0;
+    position: absolute;
+    top: 50%;
+    width: .8rem;
+    z-index: 1;
+}
+
+.loading.loading-lg::after {
+    height: 1.6rem;
+    margin-left: -.8rem;
+    margin-top: -.8rem;
+    width: 1.6rem;
+}
+
+.tooltip::after{
+	background:rgba(48,55,66,.95);
+	border-radius:3px;
+	bottom:100%;
+	color:#fff;
+	content:attr(data-tooltip);
+	display:block;
+	font-size: 11px;
+	left:50%;
+	max-width:320px;
+	opacity:0;
+	overflow:hidden;
+	padding:3px 6px 3px 6px;
+	pointer-events:none;
+	position:absolute;
+	text-overflow:ellipsis;
+	transform:translate(-50%,.4rem);
+	transition:opacity .2s,transform .2s;
+	white-space:pre;
+	z-index:300
 }

app/backend/src/router/index.js

@@ -34,6 +34,12 @@ const routes = [
     component: () => import('../views/iocs-manage.vue'),
     props: true
   },
+  {
+    path: '/iocs/misp',
+    name: 'iocs-manage',
+    component: () => import('../views/iocs-misp.vue'),
+    props: true
+  },
   {
     path: '/iocs/search',
     name: 'iocs-search',

app/backend/src/views/edit-configuration.vue

@@ -35,6 +35,10 @@
                     <input type="checkbox" @change="switch_config('frontend', 'virtual_keyboard')" v-model="config.frontend.virtual_keyboard">
                     <i class="form-icon"></i> Use virtual keyboard (for touch screen)
                 </label>
+                <label class="form-switch">
+                    <input type="checkbox" @change="switch_config('frontend', 'choose_net')" v-model="config.frontend.choose_net">
+                    <i class="form-icon"></i> Allow the end-user to choose the network even if connected.
+                </label>
                 <label class="form-switch">
                     <input type="checkbox" @change="switch_config('frontend', 'reboot_option')" v-model="config.frontend.reboot_option">
                     <i class="form-icon"></i> Allow the end-user to reboot the device from the interface.

app/backend/src/views/iocs-misp.vue

@@ -0,0 +1,175 @@
+<template>
+    <div class="backend-content" id="content">
+        <div class="column col-8 col-xs-12">
+            <h3 class="s-title">Manage MISP instances</h3>
+            <ul class="tab tab-block">
+                <li class="tab-item">
+                    <a href="#" v-on:click="switch_tab('addmisp')" v-bind:class="{ active: tabs.addmisp }">Add instance</a>
+                </li>
+                <li class="tab-item">
+                    <a href="#" v-on:click="switch_tab('instances')" v-bind:class="{ active: tabs.instances }">Existing instances</a>
+                </li>
+            </ul>
+            <div v-if="tabs.addmisp">
+                <div class="misp-form">
+                    <label class="misp-label">Instance name</label><span></span>
+                    <input class="form-input" type="text" ref="misp_name" placeholder="CYBERACME MISP" v-model="mispinst.name" required>
+                    <label class="misp-label">Instance URL</label><span></span>
+                    <input class="form-input" type="text" ref="misp_url" placeholder="https://misp.cyberacme.com" v-model="mispinst.url" required>
+                    <label class="misp-label">Authentication key</label><span></span>
+                    <input class="form-input" type="text" ref="misp_key" placeholder="OqHSMyAuth3ntic4t10nK3y0MyAuth3ntic4t10nK3y3iiH" v-model="mispinst.key" required>
+                    <label class="misp-label" v-if="mispinst.url.startsWith('https://')">Verify certificate? </label><span  v-if="mispinst.url.startsWith('https://')"></span>
+                    <div style="flex:50%" v-if="mispinst.url.startsWith('https://')"><label class="form-switch">
+                    <input type="checkbox" v-model="mispinst.ssl">
+                    <i class="form-icon"></i>
+                    </label></div>
+                </div>
+                <button class="btn-primary btn col-12" v-on:click="add_instance()">Add MISP instance</button>
+                <div class="form-group" v-if="added">
+                    <div class="toast toast-success">
+                        ✓ MISP instance added successfully. Redirecting to instances in 2 seconds. 
+                    </div>
+                </div>
+                <div class="form-group" v-if="error">
+                    <div class="toast toast-error">
+                        ✗ MISP instance not added. {{error}}
+                    </div>
+                </div>
+            </div>
+            <div class="form-group" v-if="tabs.instances">
+                <div v-if="instances.length">
+                    <table class="table table-striped table-hover">
+                        <thead>
+                            <tr>
+                                <th>Name</th>
+                                <th>Server</th>
+                                <th>Authkey</th>
+                                <th>Status</th>
+                                <th>Action</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            <tr v-for="i in instances" v-bind:key="i.id">
+                                <td>{{ i.name }}</td>
+                                <td>{{ i.url.replace('https://', '') .replace('http://', '') }}</td>
+                                <td>{{ i.apikey.slice(0,5) }} [...] {{ i.apikey.slice(35,40) }}</td>
+                                <td>
+                                    <span v-if="i.connected" class="misp-online tooltip" :data-tooltip="i.lastsync">✓ ONLINE</span>
+                                    <span v-else class="misp-offline tooltip" :data-tooltip="i.lastsync">⚠ OFFLINE</span>
+                                </td>
+                                <td><button class="btn btn-sm" v-on:click="delete_instance(i)">Delete</button></td>
+                            </tr>
+                        </tbody>
+                    </table>
+                </div>
+                <div v-else>
+                    <div class="empty">
+                        <div v-if="loading">
+                            <p class="empty-title h5">
+                                <span class="loading loading-lg"></span>
+                            </p>
+                            <p class="empty-subtitle">Testing and loading your MISP instances.</p>
+                        </div>
+                        <div v-else>
+                            <p class="empty-title h5">No MISP instance found.</p>
+                            <p class="empty-subtitle">Do not hesitate to add a MISP instance.</p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
+<script>
+
+import axios from 'axios'
+
+export default {
+    name: 'managemisp',   
+    data() {
+        return { 
+            error:false,
+            loading:false,
+            added:false,
+            mispinst:{ name:'', url:'',key:'', ssl:false },
+            instances:[],
+            tabs: { "addmisp" : true, "instances" : false },
+            jwt:""
+        }
+    },
+    props: { },
+    methods: {
+        add_instance: function()
+        {  
+            this.added = false;
+            this.error = false;
+            if (this.mispinst.name && this.mispinst.url && this.mispinst.key)
+            {
+                axios.post(`/api/misp/add`, { data: { instance: this.mispinst } }, { headers: {'X-Token': this.jwt} }).then(response => {
+                    if(response.data.status){
+                        this.added = true;
+                        setTimeout(function (){ 
+                            this.switch_tab('instances')
+                            this.mispinst = { name:'', url:'',key:'', ssl:false } 
+                            this.added = false
+                        }.bind(this), 2000);
+                    } else {
+                        this.error = response.data.message;
+                    }
+                })
+                .catch(err => (console.log(err)))
+            }
+        },
+        delete_instance(elem)
+        {
+            axios.get(`/api/misp/delete/${elem.id}`, { timeout: 10000, headers: {'X-Token': this.jwt} })
+            .then(response => {
+                if(response.data.status){
+                    this.instances = this.instances.filter(function(el) { return el != elem; }); 
+                }
+            })
+            .catch(err => (console.log(err)))
+        },
+        get_misp_instances()
+        {
+            this.loading = true;
+            this.instances = []
+            axios.get(`/api/misp/get_all`, { timeout: 10000, headers: {'X-Token': this.jwt} })
+            .then(response => {
+                if(response.data.results){
+                    this.instances = response.data.results;
+                    this.instances.forEach(e => { 
+                        var lastsync = parseInt((Date.now()/1000 - e.lastsync) / 86400)
+                        e.lastsync = (!lastsync)? "Synchronized today" : `Synchronized ${lastsync} day(s) ago`
+                        } )
+                }
+                this.loading = false
+            })
+            .catch(err => (console.log(err)))
+        },
+        switch_tab: function(tab) {
+
+            Object.keys(this.tabs).forEach(key => {
+                if( key == tab ){
+                    this.tabs[key] = true
+                    if (key == "instances") this.get_misp_instances();
+                } else {
+                    this.tabs[key] = false
+                }
+            });
+        },
+        get_jwt(){
+            axios.get(`/api/get-token`, { timeout: 10000 })
+                .then(response => {
+                    if(response.data.token){
+                        this.jwt = response.data.token
+                    }
+                })
+            .catch(err => (console.log(err)))
+        }
+    },
+    created: function() {
+        this.get_jwt();
+    }
+}
+</script>

app/backend/src/views/iocs-search.vue

@@ -13,27 +13,37 @@
                     <thead>
                         <tr>
                             <th>Indicator</th>
-                            <th>Type</th>
                             <th>Tag</th>
                             <th>TLP</th>
-                            <th> </th>
+                            <th>Source</th>
+                            <th>Action</th>
                         </tr>
                     </thead>
                     <tbody>
                         <tr v-for="r in results" :key="r.tlp">
                             <td>{{ r.value }}</td>
-                            <td class="capi">{{ r.type }}</td>
                             <td class="upper">{{ r.tag }}</td>
                             <td><label :class="['tlp-' + r.tlp]">{{ r.tlp }}</label></td>
+                            <td class="capi">{{ r.source }}</td>
                             <td><button class="btn btn-sm" v-on:click="remove(r)">Delete</button></td>
                         </tr>
                     </tbody>
                 </table>
             </div>
             <div v-else-if="first_search==false">
-                <div class="empty">
-                    <p class="empty-title h5">IOC<span v-if="this.iocs.match(/[^\r\n]+/g).length>1">s</span> not found.</p>
-                    <p class="empty-subtitle">Try wildcard search to expend your search.</p>
+                <div v-if="loading">
+                    <div class="empty">
+                        <p class="empty-title h5">
+                            <span class="loading loading-lg"></span>
+                        </p>
+                        <p class="empty-subtitle">Finding your IOC(s)...</p>
+                    </div>
+                </div>
+                <div v-else>
+                    <div class="empty">
+                        <p class="empty-title h5">IOC<span v-if="this.iocs.match(/[^\r\n]+/g).length>1">s</span> not found.</p>
+                        <p class="empty-subtitle">Try wildcard search to expend your search.</p>
+                    </div>
                 </div>
             </div>
         </div>
@@ -49,7 +59,8 @@ export default {
         return { 
             results: [],
             first_search: true,
-            jwt:""
+            jwt:"",
+            loading:false
         }
     },
     props: { },
@@ -57,6 +68,7 @@ export default {
         search_iocs: function() {
             this.results = []
             this.first_search = false
+            this.loading = true;
             this.iocs.match(/[^\r\n]+/g).forEach(ioc => {
                 ioc = ioc.trim()
                 if("alert " != ioc.slice(0,6)) {
@@ -72,6 +84,7 @@ export default {
                     if(response.data.results.length>0){
                         this.results = [].concat(this.results, response.data.results);
                     }
+                    this.loading = false;
                 })
                 .catch(err => (console.log(err)))
             });

app/frontend/package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "tinycheck-new",
+  "name": "@kaspersky/tinycheck-new",
   "version": "0.1.0",
   "lockfileVersion": 1,
   "requires": true,

app/frontend/package.json

@@ -1,7 +1,6 @@
 {
-  "name": "tinycheck-new",
+  "name": "@kaspersky/tinycheck-new",
   "version": "0.1.0",
-  "private": true,
   "scripts": {
     "serve": "vue-cli-service serve --copy --port=4202",
     "build": "vue-cli-service build",

app/frontend/src/assets/custom.css

@@ -128,8 +128,8 @@
     }
 
     .report-wrapper {
-        width:90%;
         margin:auto;
+        padding-bottom:1px;
     }
 
     .device-ctx {
@@ -212,10 +212,11 @@
     .report-wrapper {
         width:60%;
         margin:auto;
+        padding-bottom: 1px;
     }
 
     .device-ctx {
-        padding:15px;
+        padding:15px 0px 15px 0px;
         margin:auto;
     }
 
@@ -303,6 +304,17 @@ footer {
     padding-left:40px;
 }
 
+    
+.device-ctx-legend {
+    font-size: 14px;
+    color: #a6a6a6;
+    margin-top: 10px;
+    padding-top: 10px;
+    background-color: #fbfbfb;
+    padding: 10px;
+    border-radius: 5px;
+}
+
 .group-title {
     text-transform: uppercase;
     color : #999;

app/frontend/src/assets/icon_plug_usb.svg

@@ -1,4 +1 @@
-<svg width="112" height="195" viewBox="0 0 112 195" fill="none" xmlns="http://www.w3.org/2000/svg">
-<line x1="3.5" y1="3.5" x2="3.50001" y2="191.5" stroke="black" stroke-width="7" stroke-linecap="round" stroke-linejoin="round"/>
-<rect x="7" width="105" height="195" fill="#F7F8F9"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="112" height="195" fill="none" viewBox="0 0 112 195"><line x1="3.5" x2="3.5" y1="3.5" y2="191.5" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width="7"/><rect width="105" height="195" x="7" fill="#F7F8F9"/></svg>

app/frontend/src/assets/icon_spinner.svg

@@ -1,16 +1 @@
-<svg version="1.1" id="loader-1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-   width="40px" height="40px" viewBox="0 0 40 40" enable-background="new 0 0 40 40" xml:space="preserve">
-  <path opacity="0.2" fill="#000" d="M20.201,5.169c-8.254,0-14.946,6.692-14.946,14.946c0,8.255,6.692,14.946,14.946,14.946
-    s14.946-6.691,14.946-14.946C35.146,11.861,28.455,5.169,20.201,5.169z M20.201,31.749c-6.425,0-11.634-5.208-11.634-11.634
-    c0-6.425,5.209-11.634,11.634-11.634c6.425,0,11.633,5.209,11.633,11.634C31.834,26.541,26.626,31.749,20.201,31.749z"/>
-  <path fill="#f7f8f9" d="M26.013,10.047l1.654-2.866c-2.198-1.272-4.743-2.012-7.466-2.012h0v3.312h0
-    C22.32,8.481,24.301,9.057,26.013,10.047z">
-    <animateTransform attributeType="xml"
-      attributeName="transform"
-      type="rotate"
-      from="0 20 20"
-      to="360 20 20"
-      dur="0.5s"
-      repeatCount="indefinite"/>
-    </path>
-  </svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="loader-1" width="40" height="40" x="0" y="0" enable-background="new 0 0 40 40" version="1.1" viewBox="0 0 40 40" xml:space="preserve"><path fill="#000" d="M20.201,5.169c-8.254,0-14.946,6.692-14.946,14.946c0,8.255,6.692,14.946,14.946,14.946 s14.946-6.691,14.946-14.946C35.146,11.861,28.455,5.169,20.201,5.169z M20.201,31.749c-6.425,0-11.634-5.208-11.634-11.634 c0-6.425,5.209-11.634,11.634-11.634c6.425,0,11.633,5.209,11.633,11.634C31.834,26.541,26.626,31.749,20.201,31.749z" opacity=".2"/><path fill="#f7f8f9" d="M26.013,10.047l1.654-2.866c-2.198-1.272-4.743-2.012-7.466-2.012h0v3.312h0 C22.32,8.481,24.301,9.057,26.013,10.047z"><animateTransform attributeName="transform" attributeType="xml" dur="0.5s" from="0 20 20" repeatCount="indefinite" to="360 20 20" type="rotate"/></path></svg>

app/frontend/src/assets/icon_success.svg

@@ -1,5 +1 @@
-<svg width="106" height="106" viewBox="0 0 106 106" fill="none" xmlns="http://www.w3.org/2000/svg">
-<circle cx="53" cy="53" r="53" fill="#40D8A1"/>
-<path d="M29 52.5L47.5 70.5" stroke="white" stroke-width="10" stroke-linecap="round" stroke-linejoin="round"/>
-<line x1="79" y1="40.0711" x2="48.0711" y2="71" stroke="white" stroke-width="10" stroke-linecap="round"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="106" height="106" fill="none" viewBox="0 0 106 106"><circle cx="53" cy="53" r="53" fill="#40D8A1"/><path stroke="#fff" stroke-linecap="round" stroke-linejoin="round" stroke-width="10" d="M29 52.5L47.5 70.5"/><line x1="79" x2="48.071" y1="40.071" y2="71" stroke="#fff" stroke-linecap="round" stroke-width="10"/></svg>

app/frontend/src/assets/icon_usb.svg

@@ -1,6 +1 @@
-<svg width="548" height="199" viewBox="0 0 548 199" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect x="403" y="27" width="142" height="145" rx="8" fill="white" stroke="black" stroke-width="6" stroke-linecap="round" stroke-linejoin="round"/>
-<path d="M0 30C0 13.4315 13.4315 0 30 0H428C432.418 0 436 3.58172 436 8V191C436 195.418 432.418 199 428 199H30C13.4315 199 0 185.569 0 169V30Z" fill="black"/>
-<rect x="477" y="55" width="26" height="26" fill="white" stroke="black" stroke-width="6"/>
-<rect x="477" y="117" width="26" height="26" fill="white" stroke="black" stroke-width="6"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="548" height="199" fill="none" viewBox="0 0 548 199"><rect width="142" height="145" x="403" y="27" fill="#fff" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width="6" rx="8"/><path fill="#000" d="M0 30C0 13.4315 13.4315 0 30 0H428C432.418 0 436 3.58172 436 8V191C436 195.418 432.418 199 428 199H30C13.4315 199 0 185.569 0 169V30Z"/><rect width="26" height="26" x="477" y="55" fill="#fff" stroke="#000" stroke-width="6"/><rect width="26" height="26" x="477" y="117" fill="#fff" stroke="#000" stroke-width="6"/></svg>

app/frontend/src/assets/loading.svg

@@ -1,11 +1 @@
-<?xml version="1.0" encoding="utf-8"?>
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" style="margin: auto; background: none; display: block; shape-rendering: auto;" width="200px" height="200px" viewBox="0 0 100 100" preserveAspectRatio="xMidYMid">
-<circle cx="50" cy="50" r="0" fill="none" stroke="#f3f3f3" stroke-width="2">
-  <animate attributeName="r" repeatCount="indefinite" dur="1.4925373134328357s" values="0;30" keyTimes="0;1" keySplines="0 0.2 0.8 1" calcMode="spline" begin="-0.7462686567164178s"></animate>
-  <animate attributeName="opacity" repeatCount="indefinite" dur="1.4925373134328357s" values="1;0" keyTimes="0;1" keySplines="0.2 0 0.8 1" calcMode="spline" begin="-0.7462686567164178s"></animate>
-</circle>
-<circle cx="50" cy="50" r="0" fill="none" stroke="#d8dddf" stroke-width="2">
-  <animate attributeName="r" repeatCount="indefinite" dur="1.4925373134328357s" values="0;30" keyTimes="0;1" keySplines="0 0.2 0.8 1" calcMode="spline"></animate>
-  <animate attributeName="opacity" repeatCount="indefinite" dur="1.4925373134328357s" values="1;0" keyTimes="0;1" keySplines="0.2 0 0.8 1" calcMode="spline"></animate>
-</circle>
-<!-- [ldio] generated by https://loading.io/ --></svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" style="margin:auto;background:0 0;display:block;shape-rendering:auto" width="200" height="200" preserveAspectRatio="xMidYMid" viewBox="0 0 100 100"><circle cx="50" cy="50" r="0" fill="none" stroke="#f3f3f3" stroke-width="2"><animate attributeName="r" begin="-0.7462686567164178s" calcMode="spline" dur="1.4925373134328357s" keySplines="0 0.2 0.8 1" keyTimes="0;1" repeatCount="indefinite" values="0;30"/><animate attributeName="opacity" begin="-0.7462686567164178s" calcMode="spline" dur="1.4925373134328357s" keySplines="0.2 0 0.8 1" keyTimes="0;1" repeatCount="indefinite" values="1;0"/></circle><circle cx="50" cy="50" r="0" fill="none" stroke="#d8dddf" stroke-width="2"><animate attributeName="r" calcMode="spline" dur="1.4925373134328357s" keySplines="0 0.2 0.8 1" keyTimes="0;1" repeatCount="indefinite" values="0;30"/><animate attributeName="opacity" calcMode="spline" dur="1.4925373134328357s" keySplines="0.2 0 0.8 1" keyTimes="0;1" repeatCount="indefinite" values="1;0"/></circle></svg>

app/frontend/src/components/Controls.vue

@@ -53,7 +53,7 @@ export default {
         load_config: function() {
             axios.get(`/api/misc/config`, { timeout: 60000 })
             .then(response => {
-                this.quit_available = response.data.quit_option
+                this.quit_available = (response.data.quit_option && (["localhost", "127.0.0.1"].some(h => window.location.host.includes(h) )))
                 this.off_available = response.data.shutdown_option
             })
             .catch(error => { console.log(error) });
@@ -73,4 +73,4 @@ export default {
         this.check_update();
     }
 }
-</script>
+</script>

app/frontend/src/locales/cat.json

@@ -50,8 +50,11 @@
         "low_msg": "Només teniu {nb} alertes baixes, <br /> Si us plau comproveu-les.",
         "save_report": "Desa l'informe",
         "report_of": "Informe de",
-        "ip_address": "Adreça IP",
-        "mac_address": "Adreça MAC",
+        "ip_address": "Adreça IP:",
+        "mac_address": "Adreça MAC:",
+        "pcap_sha1": "SHA1:",
+        "capture_started": "La captura va començar a:",
+        "capture_ended": "La captura va acabar el:",
         "high": "alt",
         "moderat": "moderat",
         "low": "baix"

app/frontend/src/locales/cn.json

@@ -0,0 +1,92 @@
+{
+  "home": {
+    "welcome_msg": "欢迎使用 TinyCheck.",
+    "help_msg": "我们将帮助您检查您的设备。",
+    "start_btn": "开始！"
+  },
+  "analysis": {
+    "question": "您是否希望对被捕获的通信进行分析？",
+    "no_btn": "不，只保存数据",
+    "yes_btn": "好的！",
+    "please_wait_msg": "请耐心等待分析结果...",
+    "some_time_msg": "是的，这需要花点时间..."
+  },
+  "capture": {
+    "intercept_coms_msg": "正在截获通信： ",
+    "stop_btn": "停止捕获"
+  },
+  "generate-ap": {
+    "network_name": "网络名称",
+    "network_password": "网络密码",
+    "tap_msg": "点击白色帧，创建新网络",
+    "generate_ap_msg": "我们刚刚为您创建了新的临时网络。",
+    "error_msg1": "很不幸的是，我们在 <br /> 创建网络AP的过程中遇到了问题。",
+    "error_msg2": "请确认您的设备上有两个Wi-FI网卡， <br /> 并重启设备以重试。",
+    "restart_btn": "重启设备"
+  },
+  "report": {
+    "show_full_report": "显示完整报告",
+    "start_new_capture": "开始新的捕获",
+    "save_capture": "保存捕获",
+    "numbers": [
+      "零",
+      "一",
+      "二",
+      "三",
+      "四",
+      "五",
+      "六",
+      "七",
+      "八",
+      "九",
+      "十",
+      "十一"
+    ],
+    "stalkerware_msg": "您的设备已被跟踪软件 <br /> 入侵，请检查完整报告.",
+    "location_msg": "一个应用程序正在将您的<br /> 实时地理位置信息分享给第三方。",
+    "fine_msg": "一切正常，没有警报。",
+    "high_msg": "您有 {nb} 条高级警报，<br /> 看起来您的设备已被入侵。",
+    "moderate_msg": "您有 {nb} 条中级警报， <br /> 您的设备有可能已被入侵。",
+    "low_msg": "您只有 {nb} 条低级警报，<br /> 请检查它们。",
+    "save_report": "保存报告",
+    "report_of": "报告设备名：",
+    "ip_address": "IP 地址：",
+    "mac_address": "MAC 地址：",
+    "pcap_sha1": "SHA1 ：",
+    "capture_started": "捕获开始时间：",
+    "capture_ended": "捕获结束时间：",
+    "high": "高",
+    "moderate": "中",
+    "low": "低"
+  },
+  "wifi-select": {
+    "already_connected_question": "您似乎已经连接了一个Wi-Fi网络。<br /> 您希望使用当前的连接吗？",
+    "no_btn": "不，使用其他连接",
+    "yes_btn": "是的，使用此连接。",
+    "wifi_name": "Wi-Fi 名称",
+    "refresh_btn": "刷新网络列表",
+    "not_connected": "您似乎没有连接至互联网。",
+    "please_config": "请配置 Wi-Fi 连接。",
+    "lets_do_btn": "好的，开始配置",
+    "no_internet": "离线使用",
+    "wifi_connected": "Wi-Fi 已连接",
+    "wifi_not_connected": "Wi-Fi 未连接，请重试。",
+    "tap_keyboard": "点击虚拟键盘开始",
+    "wifi_password": "Wi-Fi 密码",
+    "connect_to_it": "连接此网络"
+  },
+  "save-capture": {
+    "please_connect": "请连接U盘以保存捕获。",
+    "we_are_saving": "我们正在保存您的捕获。",
+    "tap_msg": "您可以点击U盘以开始新的捕获。",
+    "capture_download": "即将开始保存捕获数据...",
+    "start_capture_btn": "开始进行新的捕获"
+  },
+  "update": {
+    "tinycheck_needs": "TinyCheck 需要更新到新版本",
+    "please_click": "请点击此按钮进行更新。",
+    "the_process": "此过程需要花几分钟，请耐心等待...",
+    "update_finished": "更新已完成，需要刷新界面...",
+    "update_it": "现在更新"
+  }
+}

app/frontend/src/locales/de.json

@@ -50,8 +50,11 @@
     "low_msg": "Sie haben nur {nb} Warnungen der Stufe \"Niedrig\":<br> Überprüfen Sie sie gerne.",
     "save_report": "Bericht speichern",
     "report_of": "Bericht zu",
-    "ip_address": "IP-Adresse",
-    "mac_address": "MAC-Adresse",
+    "ip_address": "IP-Adresse:",
+    "mac_address": "MAC-Adresse:",
+    "pcap_sha1": "SHA1:",
+    "capture_started": "Capture begann mit:",
+    "capture_ended": "Capture endete an:",
     "high": "Hoch",
     "moderate": "Mittel",
     "low": "Niedrig"
@@ -86,4 +89,4 @@
     "update_finished": "Update abgeschlossen, Sie werden weitergeleitet ...",
     "update_it": "Aktualisieren Sie TinyCheck"
   }
-}
+}

app/frontend/src/locales/en.json

@@ -50,8 +50,11 @@
     "low_msg": "You have only {nb} low alerts,<br /> don't hesitate to check them.",
     "save_report": "Save the report",
     "report_of": "Report of",
-    "ip_address": "IP address",
-    "mac_address": "MAC address",
+    "ip_address": "IP address:",
+    "mac_address": "MAC address:",
+    "pcap_sha1": "SHA1:",
+    "capture_started": "Capture started on:",
+    "capture_ended": "Capture ended on:",
     "high": "high",
     "moderate": "moderate",
     "low": "low"

app/frontend/src/locales/es.json

@@ -50,8 +50,11 @@
         "low_msg": "Solo tiene {nb} alertas bajas, <br /> por favor revíselas",
         "save_report": "Guardar el informe",
         "report_of": "Informe de",
-        "ip_address": "dirección IP",
-        "mac_address": "dirección MAC",
+        "ip_address": "Dirección IP:",
+        "mac_address": "Dirección MAC:",
+        "pcap_sha1": "SHA1:",
+        "capture_started": "Captura comenzó a:",
+        "capture_ended": "Captura terminó a:",
         "high": "alta",
         "moderate": "moderada",
         "low": "bajo"
@@ -86,4 +89,4 @@
         "update_finished": "Actualización finalizada, actualizando la interfaz...",
         "update_it": "Actualizar ahora"
     }
-}
+}

app/frontend/src/locales/fr.json

@@ -52,6 +52,9 @@
     "report_of": "Rapport de",
     "ip_address": "Adresse IP :",
     "mac_address": "Adresse MAC :",
+    "pcap_sha1": "SHA1 :",
+    "capture_started": "Capture débutée le :",
+    "capture_ended": "Capture finie le :",
     "high": "elevee",
     "moderate": "moyenne",
     "low": "basse"

app/frontend/src/locales/it.json

@@ -50,8 +50,11 @@
     "low_msg": "Sono presenti solo {nb} avvisi con priorità bassa<br /> da controllare.",
     "save_report": "Salva il rapporto",
     "report_of": "Rapporto di",
-    "ip_address": "Indirizzo IP",
-    "mac_address": "Indirizzo MAC",
+    "ip_address": "Indirizzo IP:",
+    "mac_address": "Indirizzo MAC:",
+    "pcap_sha1": "SHA1:",
+    "capture_started": "Cattura è iniziata su:",
+    "capture_ended": "Cattura terminata su:",
     "high": "elevata",
     "moderate": "moderata",
     "low": "bassa"
@@ -86,4 +89,4 @@
     "update_finished": "Aggiornamento completato, verrai reindirizzato ...",
     "update_it": "Aggiorna TinyCheck"
   }
-}
+}

app/frontend/src/locales/pt.json

@@ -50,8 +50,11 @@
     "low_msg": "Você tem apenas {nb} alertas leves,<br /> não deixe de verificá-los.",
     "save_report": "Salvar o relatório",
     "report_of": "Relatório de",
-    "ip_address": "Endereço IP",
-    "mac_address": "Endereço MAC",
+    "ip_address": "Endereço IP:",
+    "mac_address": "Endereço MAC:",
+    "pcap_sha1": "SHA1:",
+    "capture_started": "Captura iniciada em:",
+    "capture_ended": "Captura terminou em:",
     "high": "crítico",
     "moderate": "moderado",
     "low": "leve"
@@ -86,4 +89,4 @@
     "update_finished": "Atualização concluída, você será redirecionado ...",
     "update_it": "Atualizar TinyCheck"
   }
-}
+}

app/frontend/src/locales/ru.json

@@ -50,8 +50,11 @@
     "low_msg": "У вас {nb} предупреждение низкого уровня<br />, проверьте их.",
     "save_report": "Сохранить отчет",
     "report_of": "Отчет",
-    "ip_address": "IP-адрес",
-    "mac_address": "MAC-адрес",
+    "ip_address": "IP-адрес:",
+    "mac_address": "MAC-адрес:",
+    "pcap_sha1": " SHA1:",
+    "capture_started": "Захват начался:",
+    "capture_ended": "захват закончился:",
     "high": "высокий",
     "moderate": "средний",
     "low": "низкий"
@@ -86,4 +89,4 @@
     "update_finished": "Обновление завершено, вы будете перенаправлены...",
     "update_it": "Обновить TinyCheck"
   }
-}
+}

app/frontend/src/locales/sk.json

@@ -0,0 +1,92 @@
+{
+  "home": {
+    "welcome_msg": "Vitajte v TinyCheck.",
+    "help_msg": "Pomôžeme Vám skontrolovať Vaše zariadenie.",
+    "start_btn": "Poďme nato!"
+  },
+  "analysis": {
+    "question": "Chcete analyzovať zachytenú komunikáciu?",
+    "no_btn": "Nie, iba ju uložiť",
+    "yes_btn": "Áno, poďme na to",
+    "please_wait_msg": "Počkajte prosím, prebieha analýza...",
+    "some_time_msg": "Áno, môže to chvíľu trvať..."
+  },
+  "capture": {
+    "intercept_coms_msg": "Zaznamenávanie komunikácie z/zo ",
+    "stop_btn": "Zastaviť záznam"
+  },
+  "generate-ap": {
+    "network_name": "Názov siete",
+    "network_password": "Sieťové heslo",
+    "tap_msg": "Ťuknutím na biely rám vytvoríte novú sieť.",
+    "generate_ap_msg": "Generujeme pre Vás pominuteľnú sieť.",
+    "error_msg1": "Bohužiaľ, máme nejaké problémy <br />počas tvorby AP.",
+    "error_msg2": "Overte si, či máte v zariadení dve rozhrania WiFi<br /> a skúste to znova reštartovať",
+    "restart_btn": "Reštart zariadenia"
+  },
+  "report": {
+    "show_full_report": "Zobraziť celú správu",
+    "start_new_capture": "Spustiť nový záznam",
+    "save_capture": "Uložiť záznam",
+    "numbers": [
+      "nula",
+      "jednu",
+      "dva",
+      "tri",
+      "štyri",
+      "päť",
+      "šesť",
+      "sedem",
+      "osem",
+      "deväť",
+      "desať",
+      "jedenásť"
+    ],
+    "stalkerware_msg": "Vaše zariadenie je ohrozené<br /> stalkerwarom. Prosím, skontrolujte správu.",
+    "location_msg": "Aplikácia zdieľa Vašu<br /> súčasnú polohu s treťou stranou.",
+    "fine_msg": "Všetko vyzerá dobre, žiadne výstrahy.",
+    "high_msg": "Máte {nb} kritické/ú výstrahy/u.<br />Zdá sa, že Vaše zariadenie je ohrozené.",
+    "moderate_msg": "Máte {nb} mierne/u výstrahy/u,<br />Vaše zariadenie môže byť ohrozené.",
+    "low_msg": "Máte iba {nb} nízke/u výstrahy/u,<br /> neváhajte ich skontrolovať.",
+    "save_report": "Uložiť report",
+    "report_of": "Report z/zo",
+    "ip_address": "IP adresa:",
+    "mac_address": "MAC adresa:",
+    "pcap_sha1": "SHA1:",
+    "capture_started": "Záznam začal:",
+    "capture_ended": "Záznam skončil:",
+    "high": "vysoký",
+    "moderate": "mierny",
+    "low": "nízky"
+  },
+  "wifi-select": {
+    "already_connected_question": "Zdá sa, že ste už pripojený k sieti.<br />Chcete použiť aktuálne pripojenie?",
+    "no_btn": "Nie, použi inú",
+    "yes_btn": "Áno, použite ju.",
+    "wifi_name": "Názov Wi-Fi",
+    "refresh_btn": "Obnoviť zoznam sieti",
+    "not_connected": "Zdá sa, že nie ste pripojený na internet.",
+    "please_config": "Prosím nakonfigurujte Wi-Fi pripojenie.",
+    "lets_do_btn": "Ok, poďme na to.",
+    "no_internet": "Použiť offline",
+    "wifi_connected": "Wi-Fi pripojená",
+    "wifi_not_connected": "Wi-Fi nie je pripojené. Prosím, zopakujte to znova.",
+    "tap_keyboard": "Ťuknutím na virtuálnu klávesnicu môžete začať",
+    "wifi_password": "Heslo Wi-Fi",
+    "connect_to_it": "Pripojiť"
+  },
+  "save-capture": {
+    "please_connect": "Prosím pripojte USB kľúč, aby ste si uložili záznam.",
+    "we_are_saving": "Ukladáme záznam.",
+    "tap_msg": "Môžete ťuknúť na USB kľúč, ak chcete spustiť nový záznam.",
+    "capture_download": "Sťahovanie záznamu sa spúšťa...",
+    "start_capture_btn": "Spustiť ďalší záznam"
+  },
+  "update": {
+    "tinycheck_needs": "TinyCheck je potrebné aktualizovať na ďalšiu verziu",
+    "please_click": "Kliknite na tlačidlo nižšie a aktualizujte ho.",
+    "the_process": "Proces môže trvať niekoľko minút, prosím čakajte...",
+    "update_finished": "Aktualizácia dokončená, poďme obnoviť rozhranie...",
+    "update_it": "Aktualizovať teraz"
+  }
+}

app/frontend/src/plugins/i18n.js

@@ -14,6 +14,7 @@ export const i18n = new VueI18n({
     'ru': require('@/locales/ru.json'),
     'pt': require('@/locales/pt.json'),
     'it': require('@/locales/it.json'),
-    'de': require('@/locales/de.json')
+    'de': require('@/locales/de.json'),
+    'sk': require('@/locales/sk.json')
   }
 })

app/frontend/src/views/analysis.vue

@@ -54,7 +54,8 @@ export default {
                         this.running = false;
                         router.replace({ name: 'report', 
                                          params: { alerts : response.data.alerts, 
-                                                   device : response.data.device,  
+                                                   device : response.data.device, 
+                                                   pcap : response.data.pcap,  
                                                    capture_token : this.capture_token } });
                     }
                 })

app/frontend/src/views/home.vue

@@ -24,6 +24,8 @@ export default {
             var internet = this.internet
             if (window.config.iface_out.charAt(0) == 'e'){
                 router.push({ name: 'generate-ap' });
+            } else if (!window.config.choose_net && this.internet){
+                router.push({ name: 'generate-ap' });
             } else {
                 router.push({ name: 'wifi-select', 
                               params: { saved_ssid: saved_ssid, 

app/frontend/src/views/report.vue

@@ -46,8 +46,14 @@
         </div>
         <div v-else-if="show_report" class="report-wrapper">
             <div class="device-ctx">
-                <h3 style="margin: 0;">{{ $t("report.report_of") }} {{device.name}}</h3>
-                {{ $t("report.ip_address") }} {{device.ip_address}}<br />{{ $t("report.mac_address") }} {{device.mac_address}}
+                <h3 style="margin: 0; padding-left:10px;">{{ $t("report.report_of") }} {{device.name}}</h3>
+                <div class="device-ctx-legend">
+                    {{ $t("report.pcap_sha1") }} {{ pcap.SHA1 }}<br />
+                    {{ $t("report.capture_started") }} {{ pcap["First packet time"].split(",")[0] }}<br />
+                    {{ $t("report.capture_ended") }} {{ pcap["Last packet time"].split(",")[0] }}<br />
+                    <!-- {{ $t("report.ip_address") }} {{device.ip_address}}<br /> -->
+                    {{ $t("report.mac_address") }} {{device.mac_address}}
+                </div>
             </div>
             <ul class="alerts">
                 <li class="alert" v-for="alert in alerts.high" :key="alert.message">
@@ -94,6 +100,7 @@
 
 <script>
 import router from '../router'
+import axios from 'axios'
 
 export default {
     name: 'report',   
@@ -104,6 +111,7 @@ export default {
     },
     props: {
         device: Object,
+        pcap: Object,
         alerts: Array,
         capture_token: String
     },
@@ -113,7 +121,11 @@ export default {
             router.replace({ name: 'save-capture', params: { capture_token: capture_token } });
         },
         new_capture: function() {
-            router.push({ name: 'generate-ap' })
+            axios.get('/api/misc/delete-captures', { timeout: 30000 })
+            .then(() => { 
+                router.push({ name: 'generate-ap' })
+                })
+            .catch(err => (console.log(err)))
         },
         grep_keyword: function(kw, level){
             try {

app/frontend/src/views/splash-screen.vue

@@ -39,6 +39,10 @@
                      })
                     .catch(err => (console.log(err)))
             },
+            delete_captures: function() {
+                axios.get('/api/misc/delete-captures', { timeout: 30000 })
+                    .catch(err => (console.log(err)))
+            }, 
             goto_home: function() {
                 var list_ssids = this.list_ssids
                 var internet   = this.internet
@@ -46,6 +50,7 @@
             }
         },
         created: function() {
+            this.delete_captures();
             setTimeout(function () { this.internet_check(); }.bind(this), 5000);
         }
     }

assets/requirements.txt

@@ -1,17 +1,17 @@
-ipwhois
-M2Crypto
-pyOpenSSL
-pydig
-netaddr
-pyyaml
-flask
-flask_httpauth
-pyjwt
-sqlalchemy
-psutil
-pyudev
-wifi
-qrcode
-netifaces
-weasyprint
-python-whois
+pymisp==2.4.165.1
+sqlalchemy==1.4.48
+ipwhois==1.2.0
+netaddr==0.8.0
+flask==2.2.5
+flask_httpauth==4.8.0
+pyjwt==2.4.0
+psutil==5.8.0
+pydig==0.4.0
+pyudev==0.24.0
+pyyaml==5.3.1
+wifi==0.3.8
+qrcode==7.3.1
+netifaces==0.11.0
+weasyprint==59.0
+python-whois==0.8.0
+six==1.16.0

assets/scheme.sql

@@ -1,19 +1,30 @@
 CREATE TABLE "iocs" (
 	"id"	INTEGER UNIQUE,
-	"value"	TEXT NOT NULL,
-	"type"	TEXT NOT NULL,
-	"tlp"	TEXT NOT NULL,
-	"tag"	TEXT NOT NULL,
-	"source"	TEXT NOT NULL,
-	"added_on"	NUMERIC NOT NULL,
+	"value"	   TEXT NOT NULL,
+	"type"	   TEXT NOT NULL,
+	"tlp"	   TEXT NOT NULL,
+	"tag"	   TEXT NOT NULL,
+	"source"   TEXT NOT NULL,
+	"added_on" TEXT NOT NULL,
 	PRIMARY KEY("id" AUTOINCREMENT)
 );
 
 CREATE TABLE "whitelist" (
 	"id"	INTEGER UNIQUE,
-	"element"	TEXT NOT NULL UNIQUE,
-	"type"	TEXT NOT NULL,
-	"source"	TEXT NOT NULL,
-	"added_on"	INTEGER NOT NULL,
+	"element"  TEXT NOT NULL UNIQUE,
+	"type"	   TEXT NOT NULL,
+	"source"   TEXT NOT NULL,
+	"added_on" TEXT NOT NULL,
+	PRIMARY KEY("id" AUTOINCREMENT)
+);
+
+CREATE TABLE "misp" (
+	"id" 	 INTEGER UNIQUE,
+	"name" 	     TEXT,
+	"url"	     TEXT NOT NULL,
+	"apikey"     TEXT NOT NULL,
+	"verifycert" INTEGER NOT NULL DEFAULT 0,
+	"added_on"   TEXT NOT NULL,
+	"last_sync"  TEXT NOT NULL DEFAULT 0,
 	PRIMARY KEY("id" AUTOINCREMENT)
 );

config.yaml

@@ -51,7 +51,9 @@ frontend:
   virtual_keyboard: true
   user_lang: userlang
   update: updateoption
-  
+  choose_net: false
+  http_port: 80
+
 # NETWORK -
 # Some elements related to the network configuration, such as
 # the interfaces (updated during the install), the list of SSIDs
@@ -59,7 +61,7 @@ frontend:
 #
 network:
   in: iface_in
-  internet_check: http://example.com
+  internet_check: https://8.8.8.8
   out: iface_out
   ssids:
   - wireless
@@ -76,6 +78,6 @@ network:
 watchers:
   iocs:
   - https://raw.githubusercontent.com/KasperskyLab/TinyCheck/main/assets/iocs.json
-  - https://raw.githubusercontent.com/Te-k/stalkerware-indicators/master/indicators-for-tinycheck.json
+  - https://raw.githubusercontent.com/AssoEchap/stalkerware-indicators/master/generated/indicators-for-tinycheck.json
   whitelists:
   - https://raw.githubusercontent.com/KasperskyLab/TinyCheck/main/assets/whitelist.json

install.sh

@@ -3,7 +3,7 @@
 CURRENT_USER="${SUDO_USER}"
 SCRIPT_PATH="$( cd "$(dirname "$0")" ; pwd -P )"
 HOST="$( hostname )"
-IFACES="$( ifconfig -a | grep -Eo '[a-z0-9]{4,14}\: ' | grep -oE [a-z0-9]+ )"
+IFACES="$( ip a s | grep -Eo '[a-z0-9]{4,15}\: ' | grep -oE [a-z0-9]+ )"
 IFACE_OUT=""
 IFACE_IN=""
 LOCALES=(en fr cat es ru pt de it)
@@ -29,7 +29,7 @@ check_operating_system() {
    error="\e[91m    [✘] Need to be run on a Debian-like operating system, exiting.\e[39m"
 
    if [[ -f "/etc/os-release" ]]; then
-       if [[ $(cat /etc/os-release | grep "ID_LIKE=debian") ]]; then
+       if [[ $(cat /etc/os-release | grep -e "ID_LIKE=\"\?debian" -e "ID=debian") ]]; then
            echo -e "\e[92m    [✔] Debian-like operating system\e[39m"
        else
            echo -e "$error"
@@ -69,7 +69,7 @@ set_credentials() {
     read -s password2
     echo ""
 
-    if [ $password1 = $password2 ]; then
+    if [ "$password1" == "$password2" ]; then
         password=$(echo -n "$password1" | sha256sum | cut -d" " -f1)
         sed -i "s/userlogin/$login/g" /usr/share/tinycheck/config.yaml
         sed -i "s/userpassword/$password/g" /usr/share/tinycheck/config.yaml
@@ -264,12 +264,16 @@ change_hostname() {
 
 install_package() {
    # Install associated packages by using aptitude.
-   if [[ $1 == "dnsmasq" || $1 == "hostapd" || $1 == "tshark" || $1 == "sqlite3" || $1 == "suricata"  || $1 == "unclutter" ]]; then
+   if [[ $1 == "dnsmasq" || $1 == "hostapd" || $1 == "tshark" || $1 == "sqlite3" || $1 == "unclutter" || $1 == "swig" || $1 == "curl" ]]; then
+
        apt-get install $1 -y
+   elif [[ $1 == "suricata" ]];then 
+       add-apt-repository ppa:oisf/suricata-stable
+       apt-get install suricata -y
    elif [[ $1 == "zeek" ]]; then
        distrib=$(cat /etc/os-release | grep -E "^ID=" | cut -d"=" -f2)
        version=$(cat /etc/os-release | grep "VERSION_ID" | cut -d"\"" -f2)
-       if [[ $distrib == "debian" || $distrib == "ubuntu" ]]; then
+       if [[ $distrib == "debian" ]]; then
          echo "deb http://download.opensuse.org/repositories/security:/zeek/Debian_$version/ /" > /etc/apt/sources.list.d/security:zeek.list
          wget -nv "https://download.opensuse.org/repositories/security:zeek/Debian_$version/Release.key" -O Release.key
        elif [[ $distrib == "ubuntu" ]]; then
@@ -283,20 +287,36 @@ install_package() {
        rm Release.key && sudo apt-get update
        apt-get install zeek -y
     elif [[ $1 == "node" ]]; then
-       curl -sL https://deb.nodesource.com/setup_14.x | bash
+       curl -sL https://deb.nodesource.com/setup_14.x | bash -
        apt-get install -y nodejs
     elif [[ $1 == "dig" ]]; then
        apt-get install -y dnsutils
     elif [[ $1 == "pip" ]]; then
        apt-get install -y python3-pip
+    elif [[ $1 == "dhcpcd" ]]; then
+       apt-get install -y dhcpcd5
+   fi
+}
+
+check_dnsmasq() {
+   readlink /etc/resolv.conf
+   status=$?
+   if [[ $status -eq 0 && -f "/usr/sbin/dnsmasq" ]]; then
+      systemctl disable systemd-resolved
+      systemctl stop systemd-resolved
+      unlink /etc/resolv.conf
+      echo "nameserver 8.8.8.8" | tee /etc/resolv.conf
+      install_package dnsmasq
+   else
+      install_package dnsmasq
    fi
 }
 
 check_dependencies() {
    # Check binary dependencies associated to the project.
    # If not installed, call install_package with the package name.
+   check_dnsmasq
    bins=("/usr/sbin/hostapd"
-         "/usr/sbin/dnsmasq"
          "/opt/zeek/bin/zeek"
          "/usr/bin/tshark"
          "/usr/bin/dig"
@@ -304,7 +324,9 @@ check_dependencies() {
          "/usr/bin/unclutter"
          "/usr/bin/sqlite3"
          "/usr/bin/pip"
-         "/usr/bin/node")
+      	 "/usr/bin/swig"
+	       "/usr/sbin/dhcpcd"
+	       "/usr/bin/curl")
 
    echo -e "\e[39m[+] Checking dependencies...\e[39m"
    for bin in "${bins[@]}"
@@ -316,6 +338,7 @@ check_dependencies() {
            install_package ${bin##*/}
       fi
    done
+   install_package node
    echo -e "\e[39m[+] Install Python packages...\e[39m"
    python3 -m pip install -r "$SCRIPT_PATH/assets/requirements.txt"
 }
@@ -338,7 +361,7 @@ create_desktop() {
 Version=1.0
 Type=Application
 Terminal=false
-Exec=chromium-browser http://localhost
+Exec=bash /usr/share/tinycheck/kiosk.sh
 Name=TinyCheck
 Comment=Launcher for the TinyCheck frontend
 Icon=/usr/share/tinycheck/app/frontend/src/assets/icon.png
@@ -364,7 +387,7 @@ cleaning() {
 check_interfaces(){
 
     # Get the current connected interface name.
-    ciface="$(route | grep default | head -1 | grep -Eo '[a-z0-9]+$')"
+    ciface="$(ip r l default |grep -Po '(?<=(dev ))(\S+)')"
 
     # Setup of iface_out which can be any interface,
     # but needs to be connected now or in the future.
@@ -379,7 +402,7 @@ check_interfaces(){
         IFACES=( "${IFACES[@]/$ciface}" )
         for iface in $IFACES;
         do
-            config="$(ifconfig $iface)"
+            config="$(ip a s $iface)"
             echo -n "[?] Do you want to use $iface as a bridge to Internet (network/out) ? [Y/n] "
             read answer
             if [[ "$answer" =~ ^([yY][eE][sS]|[yY])$ ]]
@@ -396,8 +419,9 @@ check_interfaces(){
     # Wi-Fi interface with AP mode available.
     for iface in $IFACES;
     do
-        if echo "$iface" | grep -Eq "(wlan[0-9]|wl[a-z0-9]{20})"; then
-            config="$(ifconfig $iface)"                             # Get the iface logic configuration
+        if echo "$iface" | grep -Eq "(wlan[0-9]|wl[a-z0-9]{,20})"; then
+            config="$(ip a s $iface)"                             # Get the iface logic configuration
+
             if echo "$config" | grep -qv "inet "; then              # Test if not currently connected
                 hw="$(iw $iface info | grep wiphy | cut -d" " -f2)" # Get the iface hardware id.
                 info="$(iw phy$hw info)"                            # Get the iface hardware infos.
@@ -441,13 +465,19 @@ change_configs() {
 
 feeding_iocs() {
     echo -e "\e[39m[+] Feeding your TinyCheck instance with fresh IOCs and whitelist, please wait."
-    python3 /usr/share/tinycheck/server/backend/watchers.py
+    python3 /usr/share/tinycheck/server/backend/watchers.py 2>/dev/null
 }
 
 reboot_box() {
-    echo -e "\e[92m[+] The system is going to reboot\e[39m"
-    sleep 5
-    reboot
+    echo -e "\e[92m[+] The system is going to reboot, OK ?\e[39m"
+    read answer
+    if [[ "$answer" =~ ^([yY][eE][sS]|[yY])$ ]]
+    then
+	sleep 5
+	reboot
+    else
+	exit
+    fi
 }
 
 if [[ $EUID -ne 0 ]]; then

server/backend/app/blueprints/ioc.py

@@ -1,11 +1,12 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 
-from flask import Blueprint, jsonify, Response
+from flask import Blueprint, jsonify, Response, request
 from app.decorators import require_header_token, require_get_token
 from app.classes.iocs import IOCs
 
 import json
+from urllib.parse import unquote
 
 ioc_bp = Blueprint("ioc", __name__)
 ioc = IOCs()
@@ -19,10 +20,26 @@ def add(ioc_type, ioc_tag, ioc_tlp, ioc_value):
         :return: status of the operation in JSON
     """
     source = "backend"
+    if ioc_type == "snort":
+        ioc_value = unquote("/".join(request.full_path.split("/")[7:]))
     res = IOCs.add(ioc_type, ioc_tag, ioc_tlp, ioc_value, source)
     return jsonify(res)
 
 
+@ioc_bp.route('/add_post', methods=['POST'])
+@require_header_token
+def add_post():
+    """
+        Parse and add an IOC to the database using the post method.
+        :return: status of the operation in JSON
+    """
+
+    data = json.loads(request.data)
+    ioc = data["data"]["ioc"]
+    res = IOCs.add(ioc["ioc_type"], ioc["ioc_tag"], ioc["ioc_tlp"], ioc["ioc_value"], ioc["ioc_source"])
+    return jsonify(res)
+
+
 @ioc_bp.route('/delete/<ioc_id>', methods=['GET'])
 @require_header_token
 def delete(ioc_id):

server/backend/app/blueprints/misp.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+from flask import Blueprint, jsonify, Response, request
+from app.decorators import require_header_token, require_get_token
+from app.classes.misp import MISP
+
+import json
+
+misp_bp = Blueprint("misp", __name__)
+misp = MISP()
+
+
+@misp_bp.route('/add', methods=['POST'])
+@require_header_token
+def add_instance():
+    """
+        Parse and add a MISP instance to the database.
+        :return: status of the operation in JSON
+    """
+    data = json.loads(request.data)
+    res = misp.add_instance(data["data"]["instance"])
+    return jsonify(res)
+
+@misp_bp.route('/delete/<misp_id>', methods=['GET'])
+@require_header_token
+def delete_instance(misp_id):
+    """
+        Delete a MISP instance by its id to the database.
+        :return: status of the operation in JSON
+    """
+    res = misp.delete_instance(misp_id)
+    return jsonify(res)
+
+
+@misp_bp.route('/get_all', methods=['GET'])
+@require_header_token
+def get_all():
+    """
+        Retreive a list of all MISP instances.
+        :return: list of MISP instances in JSON.
+    """
+    res = misp.get_instances()
+    return jsonify({"results": [i for i in res]})

server/backend/app/classes/iocs.py

@@ -56,7 +56,12 @@ class IOCs(object):
                 db.session.commit()
                 return {"status": True,
                         "message": "IOC added",
-                        "ioc": escape(ioc_value)}
+                        "ioc": escape(ioc_value),
+                        "type": escape(ioc_type),
+                        "tlp": escape(ioc_tlp),
+                        "tag": escape(ioc_tag),
+                        "source": escape(source),
+                        "added_on": escape(added_on)}
             else:
                 return {"status": False,
                         "message": "Wrong IOC format",
@@ -111,7 +116,8 @@ class IOCs(object):
                    "type": ioc["type"],
                    "tag": ioc["tag"],
                    "tlp": ioc["tlp"],
-                   "value": ioc["value"]}
+                   "value": ioc["value"],
+                   "source": ioc["source"]}
 
     @staticmethod
     def get_types():

server/backend/app/classes/misp.py

@@ -0,0 +1,159 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+from app import db
+from app.db.models import MISPInst
+from app.definitions import definitions as defs
+
+from sqlalchemy.sql import exists
+from urllib.parse import unquote
+from flask import escape
+from pymisp import PyMISP
+import re
+import time
+import sys
+
+
+class MISP(object):
+    def __init__(self):
+        return None
+
+    def add_instance(self, instance):
+        """
+            Parse and add a MISP instance to the database.
+            :return: status of the operation in JSON
+        """
+
+        url = instance["url"]
+        name = instance["name"]
+        apikey = instance["key"]
+        verify = instance["ssl"]
+        last_sync = int(time.time()-31536000)  # One year
+
+        sameinstances = db.session.query(MISPInst).filter(
+            MISPInst.url == url, MISPInst.apikey == apikey)
+        if sameinstances.count():
+            return {"status": False,
+                    "message": "This MISP instance already exists"}
+        if name:
+            if self.test_instance(url, apikey, verify):
+                added_on = int(time.time())
+                db.session.add(MISPInst(name, escape(
+                    url), apikey, verify, added_on, last_sync))
+                db.session.commit()
+                return {"status": True,
+                        "message": "MISP instance added"}
+            else:
+                return {"status": False,
+                        "message": "Please verify the connection to the MISP instance"}
+        else:
+            return {"status": False,
+                    "message": "Please provide a name for your instance"}
+
+    @staticmethod
+    def delete_instance(misp_id):
+        """
+            Delete a MISP instance by its id in the database.
+            :return: status of the operation in JSON
+        """
+        if db.session.query(exists().where(MISPInst.id == misp_id)).scalar():
+            db.session.query(MISPInst).filter_by(id=misp_id).delete()
+            db.session.commit()
+            return {"status": True,
+                    "message": "MISP instance deleted"}
+        else:
+            return {"status": False,
+                    "message": "MISP instance not found"}
+
+    def get_instances(self):
+        """
+            Get MISP instances from the database
+            :return: generator of the records.
+        """
+        for misp in db.session.query(MISPInst).all():
+            misp = misp.__dict__
+            yield {"id": misp["id"],
+                   "name": misp["name"],
+                   "url": misp["url"],
+                   "apikey": misp["apikey"],
+                   "verifycert": True if misp["verifycert"] else False,
+                   "connected": self.test_instance(misp["url"], misp["apikey"], misp["verifycert"]),
+                   "lastsync": misp["last_sync"]}
+
+    @staticmethod
+    def test_instance(url, apikey, verify):
+        """
+            Test the connection of the MISP instance.
+            :return: generator of the records.
+        """
+        try:
+            PyMISP(url, apikey, verify)
+            return True
+        except:
+            return False
+
+    @staticmethod
+    def update_sync(misp_id):
+        """
+            Update the last synchronization date by the actual date.
+            :return: bool, True if updated.
+        """
+        try:
+            misp = MISPInst.query.get(int(misp_id))
+            misp.last_sync = int(time.time())
+            db.session.commit()
+            return True
+        except:
+            return False
+
+    @staticmethod
+    def get_iocs(misp_id):
+        """
+            Get all IOCs from specific MISP instance
+            :return: generator containing the IOCs.
+        """
+        misp = MISPInst.query.get(int(misp_id))
+        if misp is not None:
+            if misp.url and misp.apikey:
+                try:
+                    # Connect to MISP instance and get network activity attributes.
+                    m = PyMISP(misp.url, misp.apikey, misp.verifycert)
+                    r = m.search("attributes", category="Network activity", date_from=int(misp.last_sync))
+                except:
+                    print("Unable to connect to the MISP instance ({}/{}).".format(misp.url, misp.apikey))
+                    return []
+
+                for attr in r["Attribute"]:
+                    if attr["type"] in ["ip-dst", "domain", "snort", "x509-fingerprint-sha1"]:
+
+                        ioc = {"value": attr["value"],
+                               "type": None,
+                               "tag": "suspect",
+                               "tlp": "white"}
+
+                        # Deduce the IOC type.
+                        if re.match(defs["iocs_types"][0]["regex"], attr["value"]):
+                            ioc["type"] = "ip4addr"
+                        elif re.match(defs["iocs_types"][1]["regex"], attr["value"]):
+                            ioc["type"] = "ip6addr"
+                        elif re.match(defs["iocs_types"][2]["regex"], attr["value"]):
+                            ioc["type"] = "cidr"
+                        elif re.match(defs["iocs_types"][3]["regex"], attr["value"]):
+                            ioc["type"] = "domain"
+                        elif re.match(defs["iocs_types"][4]["regex"], attr["value"]):
+                            ioc["type"] = "sha1cert"
+                        elif "alert " in attr["value"][0:6]:
+                            ioc["type"] = "snort"
+                        else:
+                            continue
+
+                        if "Tag" in attr:
+                            for tag in attr["Tag"]:
+                                # Add a TLP to the IOC if defined in tags.
+                                tlp = re.search(r"^(?:tlp:)(red|green|amber|white)", tag['name'].lower())
+                                if tlp: ioc["tlp"] = tlp.group(1)
+
+                                # Add possible tag (need to match TinyCheck tags)
+                                if tag["name"].lower() in [t["tag"] for t in defs["iocs_tags"]]:
+                                    ioc["tag"] = tag["name"].lower()
+                        yield ioc

server/backend/app/db/models.py

@@ -1,5 +1,6 @@
 from app import db
 
+
 class Ioc(db.Model):
     def __init__(self, value, type, tlp, tag, source, added_on):
         self.value = value
@@ -9,6 +10,7 @@ class Ioc(db.Model):
         self.source = source
         self.added_on = added_on
 
+
 class Whitelist(db.Model):
     def __init__(self, element, type, source, added_on):
         self.element = element
@@ -16,5 +18,17 @@ class Whitelist(db.Model):
         self.source = source
         self.added_on = added_on
 
+
+class MISPInst(db.Model):
+    def __init__(self, name, url, key, ssl, added_on, last_sync):
+        self.name = name
+        self.url = url
+        self.apikey = key
+        self.verifycert = ssl
+        self.added_on = added_on
+        self.last_sync = last_sync
+
+
 db.mapper(Whitelist, db.Table('whitelist', db.metadata, autoload=True))
 db.mapper(Ioc, db.Table('iocs', db.metadata, autoload=True))
+db.mapper(MISPInst, db.Table('misp', db.metadata, autoload=True))

server/backend/diagnostics.py

@@ -0,0 +1,191 @@
+#!/usr/bin/python
+import os
+import subprocess
+import platform
+import socket
+import pkg_resources
+import psutil
+
+__author__ = 'Eugeny N Ablesov'
+__version__ = '1.0.17'
+
+def collect_accounts_info():
+    """ This call collects generic information about
+        user accounts presented on system running TinyCheck.
+
+        No personal information collected or provided by this call.
+    """
+    accs = { }
+    users = psutil.users()
+    for user in users:
+        accs[user.name + '@' + user.host] = {
+            'started': user.started,
+            'term': user.terminal
+    }
+    alt_user = os.getenv('SUDO_USER', os.getenv('USER'))
+    usr = 'root' if os.path.expanduser('~') == '/root' else alt_user
+    pid = psutil.Process().pid
+    term = psutil.Process().terminal() if 'Linux' in platform.system() else 'win'
+    accs[usr + '@' + term] = { 'pid': pid }
+    return accs
+
+def collect_os_info():
+    """ This call collects generic information about 
+        operating system running TinyCheck.
+
+        No personal information collected or provided by this call.
+    """
+    os_info = { }
+    os_info['system'] = platform.system()
+    os_info['release'] = platform.release()
+    os_info['version'] = platform.version()
+    os_info['platform'] = platform.platform(aliased=True)
+    if 'Windows' in os_info['system']:
+        os_info['dist'] = platform.win32_ver()
+    if 'Linux' in os_info['system']:
+        os_info['dist'] = platform.libc_ver()
+    return os_info
+
+def collect_hardware_info():
+    """ This call collects information about hardware running TinyCheck.
+
+        No personal information collected or provided by this call.
+    """
+    hw_info = { }
+    hw_info['arch'] = platform.architecture()
+    hw_info['machine'] = platform.machine()
+    hw_info['cpus'] = psutil.cpu_count(logical=False)
+    hw_info['cores'] = psutil.cpu_count()
+    hw_info['load'] = psutil.getloadavg()
+    disk_info = psutil.disk_usage('/')
+    hw_info['disk'] = {
+        'total': disk_info.total,
+        'used': disk_info.used,
+        'free': disk_info.free
+    }
+    return hw_info
+
+def collect_network_info():
+    """ This call collects information about 
+        network configuration and state running TinyCheck.
+
+        No personal information collected or provided by this call.
+    """
+    net_info = { }
+    net_info['namei'] = socket.if_nameindex()
+    addrs = psutil.net_if_addrs()
+    state = psutil.net_io_counters(pernic=True)
+    for interface in addrs.keys():
+        net_info[interface] = { }
+        int_info = state[interface]
+        props = [p for p in dir(int_info)
+            if  not p.startswith("_")
+                and not p == "index"
+                and not p == "count"]
+        for prop in props:
+            net_info[interface][prop] = getattr(int_info, prop)
+    return net_info
+
+def collect_dependency_info(package_list):
+    """ This call collects information about
+        python packages required to run TinyCheck.
+    
+        No personal information collected or provided by this call.
+    """
+    dependencies = { }
+    installed_packages = list(pkg_resources.working_set)
+    installed_packages_list = sorted(["%s==%s"
+        % (installed.key, installed.version)
+        for installed in installed_packages])
+    for pkg in installed_packages_list:
+        [package_name, package_version] = pkg.split('==')
+        if package_name in package_list:
+            dependencies[package_name] = package_version
+    return dependencies
+
+def collect_db_tables_records_count(db_path, tables):
+    result = { }
+    for table in tables:
+        query = 'SELECT COUNT(*) FROM %s' % (table)
+        sqlite_call = subprocess.Popen(['sqlite3', db_path, query], stdout = subprocess.PIPE)
+        stout, sterr = sqlite_call.communicate()
+        val = stout.decode("utf-8")
+        recs = int(val) if val else 0
+        result[table] = recs
+    return result
+
+def collect_internal_state(db_path, tables, to_check):
+    """ This call collects information about
+        installed TinyCheck instance and its internal state.
+    
+        No personal information collected or provided by this call.
+    """
+    state_ = { }
+    available = os.path.isfile(db_path)
+    dbsize = 0
+    state_['db'] = {
+        'available': available,
+        'size': dbsize
+    }
+    state_['db']['records'] = { }
+    if available:
+        state_['db']['size'] = os.stat(db_path).st_size
+        state_['db']['records'] = collect_db_tables_records_count(db_path, tables)
+
+    services_ = { }
+    for alias in to_check:
+        status = subprocess.call(['systemctl', 'is-active', '--quiet', '%s' % (to_check[alias])])
+        state = ''
+        if status != 0:
+            sysctl_call = subprocess.Popen(
+                ["systemctl", "status", "%s" % (to_check[alias]),
+                r"|",
+                "grep",
+                r"''"],
+                stdout = subprocess.PIPE,
+                stderr = subprocess.PIPE)
+            stout, sterr = sysctl_call.communicate()
+            state = stout.decode("utf-8")
+            errs = sterr.decode("utf-8")
+            if "could not be found" in errs:
+                state = 'Service not found'
+        services_[alias] = {
+            'running': status == 0,
+            'status': status,
+            'state': state
+        }
+    state_['svc'] = services_
+    return state_
+
+def main():
+    print("TinyCheck diagnostics script.\nVersion: %s" % (__version__))
+    print("")
+
+    db_path = '/usr/share/tinycheck/tinycheck.sqlite3'
+    tables = ['iocs', 'whitelist', 'misp']
+    services = { }
+    services['frontend'] = 'tinycheck-frontend.service'
+    services['backend'] = 'tinycheck-backend.service'
+    services['kiosk'] = 'tinycheck-kiosk.service'
+    services['watchers'] = 'tinycheck-watchers.service'
+
+    deps = [
+        'pymisp', 'sqlalchemy', 'ipwhois',
+        'netaddr', 'flask', 'flask_httpauth',
+        'pyjwt', 'psutil', 'pydig', 'pyudev',
+        'pyyaml', 'wifi', 'qrcode', 'netifaces',
+        'weasyprint', 'python-whois', 'six' ]
+
+    diagnostics = { }
+    diagnostics['acc'] = collect_accounts_info()
+    diagnostics['os'] = collect_os_info()
+    diagnostics['hw'] = collect_hardware_info()
+    diagnostics['net'] = collect_network_info()
+    diagnostics['deps'] = collect_dependency_info(deps)
+    diagnostics['state'] = collect_internal_state(db_path, tables, services)
+    report = { 'diagnostics': diagnostics }
+    print(report)
+    print("")
+
+if __name__ == '__main__':
+    main()

server/backend/main.py

@@ -6,10 +6,10 @@ from app.decorators import auth
 from app.blueprints.ioc import ioc_bp
 from app.blueprints.whitelist import whitelist_bp
 from app.blueprints.config import config_bp
+from app.blueprints.misp import misp_bp
 import datetime
 import secrets
 import jwt
-from OpenSSL import SSL
 from app.utils import read_config
 from sys import path
 
@@ -56,13 +56,13 @@ def page_not_found(e):
 app.register_blueprint(ioc_bp, url_prefix='/api/ioc')
 app.register_blueprint(whitelist_bp, url_prefix='/api/whitelist')
 app.register_blueprint(config_bp, url_prefix='/api/config')
+app.register_blueprint(misp_bp, url_prefix='/api/misp')
 
 if __name__ == '__main__':
     ssl_cert = "{}/{}".format(path[0], 'cert.pem')
     ssl_key = "{}/{}".format(path[0], 'key.pem')
 
     if read_config(("backend", "remote_access")):
-        app.run(host="0.0.0.0", port=443,
-                ssl_context=(ssl_cert, ssl_key))
+        app.run(host="0.0.0.0", port=443, ssl_context=(ssl_cert, ssl_key))
     else:
-        app.run(port=443, ssl_context=(ssl_cert, ssl_key))
+        app.run(port=443)

server/backend/watchers.py

@@ -1,127 +1,149 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
-from app.utils import read_config
-from app.classes.iocs import IOCs
-from app.classes.whitelist import WhiteList
-
-import requests
-import json
-import urllib3
-import time
-from multiprocessing import Process
-
-"""
-    This file is parsing the watchers present
-    in the configuration file. This in order to get
-    automatically new iocs / elements from remote
-    sources without user interaction.
-
-    As of today the default export JSON format from
-    the backend and unauthenticated HTTP requests
-    are accepted. The code is little awkward, it'll
-    be better in a next version ;)
-"""
-
-urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
-
-
-def watch_iocs():
-    """
-        Retrieve IOCs from the remote URLs defined in config/watchers.
-        For each (new ?) IOC, add it to the DB.
-    """
-
-    # Retrieve the URLs from the configuration
-    urls = read_config(("watchers", "iocs"))
-    watchers = [{"url": url, "status": False} for url in urls]
-
-    while True:
-        for w in watchers:
-            if w["status"] == False:
-                iocs = IOCs()
-                iocs_list = []
-                try:
-                    res = requests.get(w["url"], verify=False)
-                    if res.status_code == 200:
-                        content = json.loads(res.content)
-                        iocs_list = content["iocs"] if "iocs" in content else []
-                        to_delete = content["to_delete"] if "to_delete" in content else []
-                    else:
-                        w["status"] = False
-                except:
-                    w["status"] = False
-
-                for ioc in iocs_list:
-                    try:
-                        iocs.add(ioc["type"], ioc["tag"],
-                                 ioc["tlp"], ioc["value"], "watcher")
-                        w["status"] = True
-                    except:
-                        continue
-
-                for ioc in to_delete:
-                    try:
-                        iocs.delete_by_value(ioc["value"])
-                        w["status"] = True
-                    except:
-                        continue
-
-        # If at least one URL haven't be parsed, let's retry in 1min.
-        if False in [w["status"] for w in watchers]:
-            time.sleep(60)
-        else:
-            break
-
-
-def watch_whitelists():
-    """
-        Retrieve whitelist elements from the remote URLs
-        defined in config/watchers. For each (new ?) element,
-        add it to the DB.
-    """
-
-    urls = read_config(("watchers", "whitelists"))
-    watchers = [{"url": url, "status": False} for url in urls]
-
-    while True:
-        for w in watchers:
-            if w["status"] == False:
-                whitelist = WhiteList()
-                elements = []
-                try:
-                    res = requests.get(w["url"], verify=False)
-                    if res.status_code == 200:
-                        content = json.loads(res.content)
-                        elements = content["elements"] if "elements" in content else []
-                        to_delete = content["to_delete"] if "to_delete" in content else []
-                    else:
-                        w["status"] = False
-                except:
-                    w["status"] = False
-
-                for elem in elements:
-                    try:
-                        whitelist.add(elem["type"], elem["element"], "watcher")
-                        w["status"] = True
-                    except:
-                        continue
-
-                for elem in to_delete:
-                    try:
-                        whitelist.delete_by_value(elem["element"])
-                        w["status"] = True
-                    except:
-                        continue
-
-        if False in [w["status"] for w in watchers]:
-            time.sleep(60)
-        else:
-            break
-
-
-p1 = Process(target=watch_iocs)
-p2 = Process(target=watch_whitelists)
-
-p1.start()
-p2.start()
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+from app.utils import read_config
+from app.classes.iocs import IOCs
+from app.classes.whitelist import WhiteList
+from app.classes.misp import MISP
+
+import requests
+import json
+import urllib3
+import time
+from multiprocessing import Process
+
+"""
+    This file is parsing the watchers present
+    in the configuration file. This in order to get
+    automatically new iocs / elements from remote
+    sources without user interaction.
+"""
+
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+
+def watch_iocs():
+    """
+        Retrieve IOCs from the remote URLs defined in config/watchers.
+        For each IOC, add it to the DB.
+    """
+
+    # Retrieve the URLs from the configuration
+    urls = read_config(("watchers", "iocs"))
+    watchers = [{"url": url, "status": False} for url in urls]
+
+    while True:
+        for w in watchers:
+            if w["status"] == False:
+                iocs = IOCs()
+                iocs_list = []
+                to_delete = []
+                try:
+                    res = requests.get(w["url"], verify=True)
+                    if res.status_code == 200:
+                        content = json.loads(res.content)
+                        iocs_list = content["iocs"] if "iocs" in content else []
+                        to_delete = content["to_delete"] if "to_delete" in content else []
+                    else:
+                        w["status"] = False
+                except:
+                    w["status"] = False
+
+                for ioc in iocs_list:
+                    try:
+                        iocs.add(ioc["type"], ioc["tag"],
+                                 ioc["tlp"], ioc["value"], "watcher")
+                        w["status"] = True
+                    except:
+                        continue
+
+                for ioc in to_delete:
+                    try:
+                        iocs.delete_by_value(ioc["value"])
+                        w["status"] = True
+                    except:
+                        continue
+
+        # If at least one URL haven't be parsed, let's retry in 1min.
+        if False in [w["status"] for w in watchers]:
+            time.sleep(60)
+        else:
+            break
+
+
+def watch_whitelists():
+    """
+        Retrieve whitelist elements from the remote URLs
+        defined in config/watchers. For each (new ?) element,
+        add it to the DB.
+    """
+
+    urls = read_config(("watchers", "whitelists"))
+    watchers = [{"url": url, "status": False} for url in urls]
+
+    while True:
+        for w in watchers:
+            if w["status"] == False:
+                whitelist = WhiteList()
+                elements = []
+                to_delete = []
+                try:
+                    res = requests.get(w["url"], verify=True)
+                    if res.status_code == 200:
+                        content = json.loads(res.content)
+                        elements = content["elements"] if "elements" in content else []
+                        to_delete = content["to_delete"] if "to_delete" in content else []
+                    else:
+                        w["status"] = False
+                except:
+                    w["status"] = False
+
+                for elem in elements:
+                    try:
+                        whitelist.add(elem["type"], elem["element"], "watcher")
+                        w["status"] = True
+                    except:
+                        continue
+
+                for elem in to_delete:
+                    try:
+                        whitelist.delete_by_value(elem["element"])
+                        w["status"] = True
+                    except:
+                        continue
+
+        if False in [w["status"] for w in watchers]:
+            time.sleep(60)
+        else:
+            break
+
+
+def watch_misp():
+    """
+        Retrieve IOCs from misp instances. Each new element is
+        tested and then added to the database.
+    """
+    iocs, misp = IOCs(), MISP()
+    instances = [i for i in misp.get_instances()]
+
+    while instances:
+        for i, ist in enumerate(instances):
+            status = misp.test_instance(ist["url"],
+                                        ist["apikey"],
+                                        ist["verifycert"])
+            if status:
+                for ioc in misp.get_iocs(ist["id"]):
+                    iocs.add(ioc["type"], ioc["tag"], ioc["tlp"],
+                             ioc["value"], "misp-{}".format(ist["id"]))
+                misp.update_sync(ist["id"])
+                instances.pop(i)
+        if instances: time.sleep(60)
+
+
+p1 = Process(target=watch_iocs)
+p2 = Process(target=watch_whitelists)
+p3 = Process(target=watch_misp)
+
+p1.start()
+p2.start()
+p3.start()

server/frontend/app/assets/hostapd.conf

@@ -2,11 +2,11 @@ country_code=GB
 interface={IFACE}
 ssid={SSID}
 hw_mode=g
-channel=7
+channel={CHAN}
 auth_algs=1
 wpa=2
 wpa_passphrase={PASS}
 wpa_key_mgmt=WPA-PSK
 wpa_pairwise=TKIP
 rsn_pairwise=CCMP
-disassoc_low_ack=0
+disassoc_low_ack=0

server/frontend/app/blueprints/misc.py

@@ -3,7 +3,7 @@
 
 import subprocess as sp
 from flask import Blueprint, jsonify
-from app.utils import read_config
+from app.utils import read_config, delete_captures
 import re
 import sys
 import os
@@ -11,6 +11,17 @@ import os
 misc_bp = Blueprint("misc", __name__)
 
 
+@misc_bp.route("/delete-captures", methods=["GET"])
+def api_delete_captures():
+    """
+        Delete the zombies capture folders (if any)
+    """
+    if delete_captures():
+        return jsonify({"message": "Captures deleted", "status": True})
+    else:
+        return jsonify({"message": "Issue while removing captures", "status": False})
+
+
 @misc_bp.route("/reboot", methods=["GET"])
 def api_reboot():
     """
@@ -61,5 +72,6 @@ def get_config():
         "shutdown_option": read_config(("frontend", "shutdown_option")),
         "reboot_option": read_config(("frontend", "reboot_option")),
         "iface_out": read_config(("network", "out")),
-        "user_lang": read_config(("frontend", "user_lang"))
+        "user_lang": read_config(("frontend", "user_lang")),
+        "choose_net": read_config(("frontend", "choose_net"))
     })

server/frontend/app/classes/analysis.py

@@ -24,7 +24,7 @@ class Analysis(object):
         if self.token is not None:
             parent = "/".join(sys.path[0].split("/")[:-2])
             sp.Popen(
-                [sys.executable, "{}/analysis/analysis.py".format(parent), "/tmp/{}".format(self.token)])
+                [sys.executable, "{}/analysis/analysis.py".format(parent), "-f", "/tmp/{}".format(self.token)])
             return {"status": True,
                     "message": "Analysis started",
                     "token": self.token}
@@ -41,13 +41,18 @@ class Analysis(object):
             :return: dict containing the report or error message.
         """
 
-        device, alerts = {}, {}
+        device, alerts, pcap = {}, {}, {}
 
         # Getting device configuration.
         if os.path.isfile("/tmp/{}/assets/device.json".format(self.token)):
             with open("/tmp/{}/assets/device.json".format(self.token), "r") as f:
                 device = json.load(f)
 
+        # Getting pcap infos.
+        if os.path.isfile("/tmp/{}/assets/capinfos.json".format(self.token)):
+            with open("/tmp/{}/assets/capinfos.json".format(self.token), "r") as f:
+                pcap = json.load(f)
+
         # Getting alerts configuration.
         if os.path.isfile("/tmp/{}/assets/alerts.json".format(self.token)):
             with open("/tmp/{}/assets/alerts.json".format(self.token), "r") as f:
@@ -55,6 +60,7 @@ class Analysis(object):
 
         if device != {} and alerts != {}:
             return {"alerts": alerts,
-                    "device": device}
+                    "device": device,
+                    "pcap": pcap}
         else:
             return {"message": "No report yet"}

server/frontend/app/classes/network.py

@@ -1,337 +1,369 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-
-import subprocess as sp
-import netifaces as ni
-import requests as rq
-import sys
-import time
-import qrcode
-import base64
-import random
-import requests
-
-from wifi import Cell
-from os import path, remove
-from io import BytesIO
-from app.utils import terminate_process, read_config
-
-
-class Network(object):
-
-    def __init__(self):
-        self.AP_SSID = False
-        self.AP_PASS = False
-        self.iface_in = read_config(("network", "in"))
-        self.iface_out = read_config(("network", "out"))
-        self.enable_interface(self.iface_in)
-        self.enable_interface(self.iface_out)
-        self.enable_forwarding()
-        self.reset_dnsmasq_leases()
-        self.random_choice_alphabet = "abcdef1234567890"
-
-    def check_status(self):
-        """
-            The method check_status check the IP addressing of each interface 
-            and return their associated IP.
-
-            :return: dict containing each interface status.
-        """
-
-        ctx = {"interfaces": {
-            self.iface_in: False,
-            self.iface_out: False,
-            "eth0": False},
-            "internet": self.check_internet()}
-
-        for iface in ctx["interfaces"].keys():
-            try:
-                ip = ni.ifaddresses(iface)[ni.AF_INET][0]["addr"]
-                if not ip.startswith("127") or not ip.startswith("169.254"):
-                    ctx["interfaces"][iface] = ip
-            except:
-                ctx["interfaces"][iface] = "Interface not connected or present."
-        return ctx
-
-    def wifi_list_networks(self):
-        """
-            The method wifi_list_networks list the available WiFi networks
-            by using wifi python package.
-            :return: dict - containing the list of Wi-Fi networks.
-        """
-        networks = []
-        try:
-            for n in Cell.all(self.iface_out):
-                if n.ssid not in [n["ssid"] for n in networks] and n.ssid and n.encrypted:
-                    networks.append(
-                        {"ssid": n.ssid, "type": n.encryption_type})
-            return {"networks": networks}
-        except:
-            return {"networks": []}
-
-    @staticmethod
-    def wifi_setup(ssid, password):
-        """
-            Edit the wpa_supplicant file with provided credentials.
-            If the ssid already exists, just update the password. Otherwise
-            create a new entry in the file.
-
-            :return: dict containing the status of the operation
-        """
-        if len(password) >= 8 and len(ssid):
-            found = False
-            networks = []
-            header, content = "", ""
-
-            with open("/etc/wpa_supplicant/wpa_supplicant.conf") as f:
-                content = f.read()
-                blocks = content.split("network={")
-                header = blocks[0]
-
-                for block in blocks[1:]:
-                    net = {}
-                    for line in block.splitlines():
-                        if line and line != "}":
-                            if "priority=10" not in line.strip():
-                                key, val = line.strip().split("=")
-                            if key != "disabled":
-                                net[key] = val.replace("\"", "")
-                    networks.append(net)
-
-                for net in networks:
-                    if net["ssid"] == ssid:
-                        net["psk"] = password.replace('"', '\\"')
-                        net["priority"] = "10"
-                        found = True
-
-                if not found:
-                    networks.append({
-                        "ssid": ssid,
-                        "psk": password.replace('"', '\\"'),
-                        "key_mgmt": "WPA-PSK",
-                        "priority": "10"
-                    })
-
-            with open("/etc/wpa_supplicant/wpa_supplicant.conf", "w+") as f:
-                content = header
-                for network in networks:
-                    net = "network={\n"
-                    for k, v in network.items():
-                        if k in ["ssid", "psk"]:
-                            net += "    {}=\"{}\"\n".format(k, v)
-                        else:
-                            net += "    {}={}\n".format(k, v)
-                    net += "}\n\n"
-                    content += net
-                if f.write(content):
-                    return {"status": True,
-                            "message": "Configuration saved"}
-                else:
-                    return {"status": False,
-                            "message": "Error while writing wpa_supplicant configuration file."}
-        else:
-            return {"status": False,
-                    "message": "Empty SSID or/and password length less than 8 chars."}
-
-    def wifi_connect(self):
-        """
-            Connect to one of the WiFi networks present in the wpa_supplicant.conf.
-            :return: dict containing the TinyCheck <-> AP status.
-        """
-
-        # Kill wpa_supplicant instances, if any.
-        terminate_process("wpa_supplicant")
-        # Launch a new instance of wpa_supplicant.
-        sp.Popen(["wpa_supplicant", "-B", "-i", self.iface_out, "-c",
-                  "/etc/wpa_supplicant/wpa_supplicant.conf"]).wait()
-        # Check internet status
-        for _ in range(1, 40):
-            if self.check_internet():
-                return {"status": True,
-                        "message": "Wifi connected"}
-            time.sleep(1)
-
-        return {"status": False,
-                "message": "Wifi not connected"}
-
-    def start_ap(self):
-        """
-            The start_ap method generates an Access Point by using HostApd
-            and provide to the GUI the associated ssid, password and qrcode.
-
-            :return: dict containing the status of the AP
-        """
-
-        # Re-ask to enable interface, sometimes it just go away.
-        if not self.enable_interface(self.iface_out):
-            return {"status": False,
-                    "message": "Interface not present."}
-
-        # Generate the hostapd configuration
-        if read_config(("network", "tokenized_ssids")):
-            token = "".join([random.choice(self.random_choice_alphabet)
-                             for i in range(4)])
-            self.AP_SSID = random.choice(read_config(
-                ("network", "ssids"))) + "-" + token
-        else:
-            self.AP_SSID = random.choice(read_config(("network", "ssids")))
-        self.AP_PASS = "".join(
-            [random.choice(self.random_choice_alphabet) for i in range(8)])
-
-        # Launch hostapd
-        if self.write_hostapd_config():
-            if self.lauch_hostapd() and self.reset_dnsmasq_leases():
-                return {"status": True,
-                        "message": "AP started",
-                        "ssid": self.AP_SSID,
-                        "password": self.AP_PASS,
-                        "qrcode": self.generate_qr_code()}
-            else:
-                return {"status": False,
-                        "message": "Error while creating AP."}
-        else:
-            return {"status": False,
-                    "message": "Error while writing hostapd configuration file."}
-
-    def generate_qr_code(self):
-        """
-            The method generate_qr_code returns a QRCode based on 
-            the SSID and the password.
-
-            :return: - string containing the PNG of the QRCode.
-        """
-        qrc = qrcode.make("WIFI:S:{};T:WPA;P:{};;".format(
-            self.AP_SSID, self.AP_PASS))
-        buffered = BytesIO()
-        qrc.save(buffered, format="PNG")
-        return "data:image/png;base64,{}".format(base64.b64encode(buffered.getvalue()).decode("utf8"))
-
-    def write_hostapd_config(self):
-        """
-            The method write_hostapd_config write the hostapd configuration 
-            under a temporary location defined in the config file.
-
-            :return: bool - if hostapd configuration file created
-        """
-        try:
-            with open("{}/app/assets/hostapd.conf".format(sys.path[0]), "r") as f:
-                conf = f.read()
-                conf = conf.replace("{IFACE}", self.iface_in)
-                conf = conf.replace("{SSID}", self.AP_SSID)
-                conf = conf.replace("{PASS}", self.AP_PASS)
-                with open("/tmp/hostapd.conf", "w") as c:
-                    c.write(conf)
-            return True
-        except:
-            return False
-
-    def lauch_hostapd(self):
-        """
-            The method lauch_hostapd kill old instance of hostapd and launch a
-            new one as a background process.
-
-            :return: bool - if hostapd sucessfully launched.
-        """
-
-        # Kill potential zombies of hostapd
-        terminate_process("hostapd")
-
-        sp.Popen(["ifconfig", self.iface_in, "up"]).wait()
-        sp.Popen(
-            "/usr/sbin/hostapd /tmp/hostapd.conf > /tmp/hostapd.log", shell=True)
-
-        while True:
-            if path.isfile("/tmp/hostapd.log"):
-                with open("/tmp/hostapd.log", "r") as f:
-                    log = f.read()
-                    err = ["Could not configure driver mode",
-                           "driver initialization failed"]
-                    if not any(e in log for e in err):
-                        if "AP-ENABLED" in log:
-                            return True
-                    else:
-                        return False
-            time.sleep(1)
-
-    def stop_hostapd(self):
-        """
-            Stop hostapd instance.
-
-            :return: dict - a little message for debug.
-        """
-        if terminate_process("hostapd"):
-            return {"status": True,
-                    "message": "AP stopped"}
-        else:
-            return {"status": False,
-                    "message": "No AP running"}
-
-    def reset_dnsmasq_leases(self):
-        """
-            This method reset the DNSMasq leases and logs to get the new
-            connected device name & new DNS entries.
-
-            :return: bool if everything goes well
-        """
-        try:
-            sp.Popen("service dnsmasq stop", shell=True).wait()
-            sp.Popen("cp /dev/null /var/lib/misc/dnsmasq.leases",
-                     shell=True).wait()
-            sp.Popen("cp /dev/null /var/log/messages.log", shell=True).wait()
-            sp.Popen("service dnsmasq start", shell=True).wait()
-            return True
-        except:
-            return False
-
-    def enable_forwarding(self):
-        """
-            This enable forwarding to get internet working on the connected device. 
-            Method tiggered during the Network class intialization.
-
-            :return: bool if everything goes well
-        """
-        try:
-            sp.Popen("echo 1 > /proc/sys/net/ipv4/ip_forward",
-                     shell=True).wait()
-
-            # Enable forwarding.
-            sp.Popen(["iptables", "-A", "POSTROUTING", "-t", "nat", "-o",
-                      self.iface_out, "-j", "MASQUERADE"]).wait()
-
-            # Prevent the device to reach the 80 and 443 of TinyCheck.
-            sp.Popen(["iptables", "-A", "INPUT", "-i", self.iface_in, "-d",
-                      "192.168.100.1", "-p", "tcp", "--match", "multiport", "--dports", "80,443", "-j" "DROP"]).wait()
-
-            return True
-        except:
-            return False
-
-    def enable_interface(self, iface):
-        """
-            This enable interfaces, with a simple check. 
-            :return: bool if everything goes well 
-        """
-        sh = sp.Popen(["ifconfig", iface],
-                      stdout=sp.PIPE, stderr=sp.PIPE)
-        sh = sh.communicate()
-        if b"<UP," in sh[0]:
-            return True  # The interface is up.
-        elif sh[1]:
-            return False  # The interface doesn't exists (most of the cases).
-        else:
-            sp.Popen(["ifconfig", iface, "up"]).wait()
-            return True
-
-    def check_internet(self):
-        """
-            Check the internet link just with a small http request
-            to an URL present in the configuration
-
-            :return: bool - if the request succeed or not.
-        """
-        try:
-            url = read_config(("network", "internet_check"))
-            requests.get(url, timeout=10)
-            return True
-        except:
-            return False
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import subprocess as sp
+import netifaces as ni
+import requests as rq
+import re
+import sys
+import time
+import qrcode
+import base64
+import random
+import requests
+
+from wifi import Cell
+from os import path, remove
+from io import BytesIO
+from app.utils import terminate_process, read_config
+
+
+class Network(object):
+
+    def __init__(self):
+        self.AP_SSID = False
+        self.AP_PASS = False
+        self.iface_in = read_config(("network", "in"))
+        self.iface_out = read_config(("network", "out"))
+        self.enable_interface(self.iface_in)
+        self.enable_interface(self.iface_out)
+        self.enable_forwarding()
+        self.reset_dnsmasq_leases()
+        self.random_choice_alphabet = "abcdef1234567890"
+
+    def check_status(self):
+        """
+            The method check_status check the IP addressing of each interface 
+            and return their associated IP.
+
+            :return: dict containing each interface status.
+        """
+
+        ctx = {"interfaces": {
+            self.iface_in: False,
+            self.iface_out: False,
+            "eth0": False},
+            "internet": self.check_internet()}
+
+        for iface in ctx["interfaces"].keys():
+            try:
+                ip = ni.ifaddresses(iface)[ni.AF_INET][0]["addr"]
+                if not ip.startswith("127") or not ip.startswith("169.254"):
+                    ctx["interfaces"][iface] = ip
+            except:
+                ctx["interfaces"][iface] = "Interface not connected or present."
+        return ctx
+
+    def wifi_list_networks(self):
+        """
+            The method wifi_list_networks list the available WiFi networks
+            by using wifi python package.
+            :return: dict - containing the list of Wi-Fi networks.
+        """
+        networks = []
+        try:
+            for n in Cell.all(self.iface_out):
+                if n.ssid not in [n["ssid"] for n in networks] and n.ssid and n.encrypted:
+                    networks.append(
+                        {"ssid": n.ssid, "type": n.encryption_type})
+            return {"networks": networks}
+        except:
+            return {"networks": []}
+
+    @staticmethod
+    def wifi_setup(ssid, password):
+        """
+            Edit the wpa_supplicant file with provided credentials.
+            If the ssid already exists, just update the password. Otherwise
+            create a new entry in the file.
+
+            :return: dict containing the status of the operation
+        """
+        if len(password) >= 8 and len(ssid):
+            found = False
+            networks = []
+            header, content = "", ""
+
+            with open("/etc/wpa_supplicant/wpa_supplicant.conf") as f:
+                content = f.read()
+                blocks = content.split("network={")
+                header = blocks[0]
+
+                for block in blocks[1:]:
+                    net = {}
+                    for line in block.splitlines():
+                        if line and line != "}":
+                            if "priority=10" not in line.strip():
+                                key, val = line.strip().split("=")
+                            if key != "disabled":
+                                net[key] = val.replace("\"", "")
+                    networks.append(net)
+
+                for net in networks:
+                    if net["ssid"] == ssid:
+                        net["psk"] = password.replace('"', '\\"')
+                        net["priority"] = "10"
+                        found = True
+
+                if not found:
+                    networks.append({
+                        "ssid": ssid,
+                        "psk": password.replace('"', '\\"'),
+                        "key_mgmt": "WPA-PSK",
+                        "priority": "10"
+                    })
+
+            with open("/etc/wpa_supplicant/wpa_supplicant.conf", "w+") as f:
+                content = header
+                for network in networks:
+                    net = "network={\n"
+                    for k, v in network.items():
+                        if k in ["ssid", "psk"]:
+                            net += "    {}=\"{}\"\n".format(k, v)
+                        else:
+                            net += "    {}={}\n".format(k, v)
+                    net += "}\n\n"
+                    content += net
+                if f.write(content):
+                    return {"status": True,
+                            "message": "Configuration saved"}
+                else:
+                    return {"status": False,
+                            "message": "Error while writing wpa_supplicant configuration file."}
+        else:
+            return {"status": False,
+                    "message": "Empty SSID or/and password length less than 8 chars."}
+
+    def wifi_connect(self):
+        """
+            Connect to one of the WiFi networks present in the wpa_supplicant.conf.
+            :return: dict containing the TinyCheck <-> AP status.
+        """
+
+        # Kill wpa_supplicant instances, if any.
+        terminate_process("wpa_supplicant")
+        # Launch a new instance of wpa_supplicant.
+        sp.Popen(["wpa_supplicant", "-B", "-i", self.iface_out, "-c",
+                  "/etc/wpa_supplicant/wpa_supplicant.conf"]).wait()
+        # Check internet status
+        for _ in range(1, 40):
+            if self.check_internet():
+                return {"status": True,
+                        "message": "Wifi connected"}
+            time.sleep(1)
+
+        return {"status": False,
+                "message": "Wifi not connected"}
+
+    def start_ap(self):
+        """
+            The start_ap method generates an Access Point by using HostApd
+            and provide to the GUI the associated ssid, password and qrcode.
+
+            :return: dict containing the status of the AP
+        """
+
+        # Re-ask to enable interface, sometimes it just go away.
+        if not self.enable_interface(self.iface_out):
+            return {"status": False,
+                    "message": "Interface not present."}
+
+        # Generate the hostapd configuration
+        if read_config(("network", "tokenized_ssids")):
+            token = "".join([random.choice(self.random_choice_alphabet)
+                             for i in range(4)])
+            self.AP_SSID = random.choice(read_config(
+                ("network", "ssids"))) + "-" + token
+        else:
+            self.AP_SSID = random.choice(read_config(("network", "ssids")))
+        self.AP_PASS = "".join(
+            [random.choice(self.random_choice_alphabet) for i in range(8)])
+
+        # Launch hostapd
+        if self.write_hostapd_config():
+            if self.lauch_hostapd() and self.reset_dnsmasq_leases():
+                return {"status": True,
+                        "message": "AP started",
+                        "ssid": self.AP_SSID,
+                        "password": self.AP_PASS,
+                        "qrcode": self.generate_qr_code()}
+            else:
+                return {"status": False,
+                        "message": "Error while creating AP."}
+        else:
+            return {"status": False,
+                    "message": "Error while writing hostapd configuration file."}
+
+    def generate_qr_code(self):
+        """
+            The method generate_qr_code returns a QRCode based on 
+            the SSID and the password.
+
+            :return: - string containing the PNG of the QRCode.
+        """
+        qrc = qrcode.make("WIFI:S:{};T:WPA;P:{};;".format(
+            self.AP_SSID, self.AP_PASS))
+        buffered = BytesIO()
+        qrc.save(buffered, format="PNG")
+        return "data:image/png;base64,{}".format(base64.b64encode(buffered.getvalue()).decode("utf8"))
+
+    def write_hostapd_config(self):
+        """
+            The method write_hostapd_config write the hostapd configuration 
+            under a temporary location defined in the config file.
+
+            :return: bool - if hostapd configuration file created
+        """
+        try:
+            chan = self.set_ap_channel()
+            with open("{}/app/assets/hostapd.conf".format(sys.path[0]), "r") as f:
+                conf = f.read()
+                conf = conf.replace("{IFACE}", self.iface_in)
+                conf = conf.replace("{SSID}", self.AP_SSID)
+                conf = conf.replace("{PASS}", self.AP_PASS)
+                conf = conf.replace("{CHAN}", chan)
+                with open("/tmp/hostapd.conf", "w") as c:
+                    c.write(conf)
+            return True
+        except:
+            return False
+
+    def lauch_hostapd(self):
+        """
+            The method lauch_hostapd kill old instance of hostapd and launch a
+            new one as a background process.
+
+            :return: bool - if hostapd sucessfully launched.
+        """
+
+        # Kill potential zombies of hostapd
+        terminate_process("hostapd")
+
+        sp.Popen(["ip","link","set", self.iface_in, "up"]).wait()
+        sp.Popen(
+            "/usr/sbin/hostapd /tmp/hostapd.conf > /tmp/hostapd.log", shell=True)
+
+        while True:
+            if path.isfile("/tmp/hostapd.log"):
+                with open("/tmp/hostapd.log", "r") as f:
+                    log = f.read()
+                    err = ["Could not configure driver mode",
+                           "driver initialization failed"]
+                    if not any(e in log for e in err):
+                        if "AP-ENABLED" in log:
+                            return True
+                    else:
+                        return False
+            time.sleep(1)
+
+    def stop_hostapd(self):
+        """
+            Stop hostapd instance.
+
+            :return: dict - a little message for debug.
+        """
+        if terminate_process("hostapd"):
+            return {"status": True,
+                    "message": "AP stopped"}
+        else:
+            return {"status": False,
+                    "message": "No AP running"}
+
+    def reset_dnsmasq_leases(self):
+        """
+            This method reset the DNSMasq leases and logs to get the new
+            connected device name & new DNS entries.
+
+            :return: bool if everything goes well
+        """
+        try:
+            sp.Popen("service dnsmasq stop", shell=True).wait()
+            sp.Popen("cp /dev/null /var/lib/misc/dnsmasq.leases",
+                     shell=True).wait()
+            sp.Popen("cp /dev/null /var/log/messages.log", shell=True).wait()
+            sp.Popen("service dnsmasq start", shell=True).wait()
+            return True
+        except:
+            return False
+
+    def enable_forwarding(self):
+        """
+            This enable forwarding to get internet working on the connected device. 
+            Method tiggered during the Network class intialization.
+
+            :return: bool if everything goes well
+        """
+        try:
+            sp.Popen("echo 1 > /proc/sys/net/ipv4/ip_forward",
+                     shell=True).wait()
+
+            # Enable forwarding.
+            
+            sp.Popen("nft add table nat",shell=True).wait()
+            sp.Popen("nft 'add chain nat prerouting { type nat hook prerouting priority 100; }'",shell=True).wait()
+            sp.Popen("nft 'add chain nat postrouting { type nat hook postrouting priority 100; }'",shell=True).wait()
+            sp.Popen("nft add table ip filter",shell=True).wait()
+            sp.Popen("nft 'add chain ip filter INPUT { type filter hook input priority 0; }'",shell=True).wait()
+            
+            
+            sp.Popen(["nft","add","rule","ip","nat","postrouting","oifname",
+                       self.iface_out,"counter","masquerade"]).wait()
+
+            # Prevent the device to reach the 80 and 443 of TinyCheck.
+            sp.Popen(["nft","add","rule","ip","filter","INPUT","iifname",self.iface_in,"ip",
+                      "protocol","tcp","ip","daddr","192.168.100.1","tcp","dport","{ 80,443}","counter","drop"]).wait()
+            
+            
+            return True
+        except:
+            return False
+
+    def enable_interface(self, iface):
+        """
+            This enable interfaces, with a simple check. 
+            :return: bool if everything goes well 
+        """
+        sh = sp.Popen(["ip" ,"a","s", iface],
+                      stdout=sp.PIPE, stderr=sp.PIPE)
+        sh = sh.communicate()
+        if b",UP" in sh[0]:
+            return True  # The interface is up.
+        elif sh[1]:
+            return False  # The interface doesn't exists (most of the cases).
+        else:
+            sp.Popen(["ip","link","set", iface, "up"]).wait()
+            return True
+
+    def check_internet(self):
+        """
+            Check the internet link just with a small http request
+            to an URL present in the configuration
+
+            :return: bool - if the request succeed or not.
+        """
+        try:
+            url = read_config(("network", "internet_check"))
+            requests.get(url, timeout=10)
+            return True
+        except:
+            return False
+
+    def set_ap_channel(self):
+        """
+            Deduce the channel to have for the AP in order to prevent
+            kind of jamming between the two wifi interfaces.
+        """
+        try:
+            if self.iface_out[0] == "w":
+                # Get the channel of the connected interface
+                sh = sp.Popen(["iw", self.iface_out, "info"],
+                              stdout=sp.PIPE, stderr=sp.PIPE).communicate()
+                res = re.search("channel ([0-9]{1,2})", sh[0].decode('utf8'))
+                chn = res.group(1)
+
+                # Return a good candidate.
+                return "11" if int(chn) < 7 else "1"
+            else:
+                return "1"
+        except:
+            return "1"

server/frontend/app/utils.py

@@ -7,6 +7,8 @@ import yaml
 import sys
 import os
 from functools import reduce
+import shutil
+import re
 
 
 def terminate_process(process):
@@ -33,3 +35,16 @@ def read_config(path):
     config = yaml.load(open(os.path.join(dir, "config.yaml"), "r"),
                        Loader=yaml.SafeLoader)
     return reduce(dict.get, path, config)
+
+
+def delete_captures():
+    """
+        Delete potential zombies capture directories
+    """
+    try:
+        for d in os.listdir("/tmp/"):
+            if re.match("[A-F0-9]{8}", d):
+                shutil.rmtree(os.path.join("/tmp/", d))
+        return True
+    except:
+        return False

server/frontend/main.py

@@ -46,7 +46,12 @@ app.register_blueprint(misc_bp, url_prefix='/api/misc')
 app.register_blueprint(update_bp, url_prefix='/api/update')
 
 if __name__ == '__main__':
+    port = ""
+    try:
+        port = int(read_config(("frontend", "http_port")))
+    except:
+        port = 80
     if read_config(("frontend", "remote_access")):
-        app.run(host="0.0.0.0", port=80)
+        app.run(host="0.0.0.0", port=port)
     else:
-        app.run(port=80)
+        app.run(port=port)

update.sh

@@ -37,16 +37,20 @@ elif [ $PWD = "/tmp/tinycheck" ]; then
     python3 -m pip install -r assets/requirements.txt
 
     echo "[+] Building new interfaces..."
-    cd /usr/share/tinycheck/app/frontend/ && npm install && npm run build
-    cd /usr/share/tinycheck/app/backend/ && npm install && npm run build
+    cd /usr/share/tinycheck/app/frontend/ && npm install && npm audit fix && npm run build
+    cd /usr/share/tinycheck/app/backend/ && npm install && npm audit fix && npm run build
+
+    echo "[+] Updating the database scheme..."
+    cd /usr/share/tinycheck/
+    sqlite3 tinycheck.sqlite3 < /tmp/tinycheck/assets/scheme.sql 2>/dev/null
 
     echo "[+] Updating current configuration with new values."
     if ! grep -q reboot_option /usr/share/tinycheck/config.yaml; then
         sed -i 's/frontend:/frontend:\n  reboot_option: true/g' /usr/share/tinycheck/config.yaml
     fi
 
-    if ! grep -q user_lang /usr/share/tinycheck/config.yaml; then
-        sed -i 's/frontend:/frontend:\n  user_lang: en/g' /usr/share/tinycheck/config.yaml
+    if ! grep -q choose_net /usr/share/tinycheck/config.yaml; then
+        sed -i 's/frontend:/frontend:\n  choose_net: false/g' /usr/share/tinycheck/config.yaml
     fi
 
     if ! grep -q shutdown_option /usr/share/tinycheck/config.yaml; then
@@ -65,6 +69,10 @@ elif [ $PWD = "/tmp/tinycheck" ]; then
         sed -i 's/frontend:/frontend:\n  update: true/g' /usr/share/tinycheck/config.yaml
     fi
 
+    if ! grep -q user_lang /usr/share/tinycheck/config.yaml; then
+        sed -i 's/frontend:/frontend:\n  user_lang: en/g' /usr/share/tinycheck/config.yaml
+    fi
+
     if ! grep -q "CN=R3,O=Let's Encrypt,C=US" /usr/share/tinycheck/config.yaml; then
         sed -i "s/free_issuers:/free_issuers:\n  - CN=R3,O=Let's Encrypt,C=US/g" /usr/share/tinycheck/config.yaml
     fi
@@ -78,4 +86,4 @@ elif [ $PWD = "/tmp/tinycheck" ]; then
     cd /tmp/tinycheck && git tag | tail -n 1 | xargs echo -n > /usr/share/tinycheck/VERSION
 
     echo "[+] TinyCheck updated!"
-fi
+fi