[feat] adding analyse from URL

Author: evilcel3ri

bazaar/core/api_view.py

@@ -1,4 +1,6 @@
 import logging
+import hashlib
+import requests
 
 from django.conf import settings
 from django.core.files.storage import default_storage
@@ -15,6 +17,9 @@
 from bazaar.core.utils import get_sha256_of_file
 from bazaar.front.utils import transform_hl_results
 
+from androguard.core.androconf import is_android
+from tempfile import NamedTemporaryFile
+
 
 @api_view(['GET', 'POST'])
 @authentication_classes([TokenAuthentication])
@@ -37,6 +42,38 @@ def apk_upload(request):
         return Response({"file_sha256": sha256})
 
 
+@api_view(['GET'])
+@authentication_classes([TokenAuthentication])
+@permission_classes([IsAuthenticated])
+def url_download(request):
+    if not request.user.is_authenticated:
+        return Response({"user": "is_authenticated"})
+    else:
+        res = requests.get(request.data['url'])
+
+        if res.status_code not in [200, 301, 302]:
+            return Response({"url": "URL is not available."})
+
+        sha256_hash = hashlib.sha256()
+        with NamedTemporaryFile() as tmp:
+            for chunk in res.iter_content(chunk_size=16 * 1024):
+                tmp.write(chunk)
+                sha256_hash.update(chunk)
+
+            sha256 = str(sha256_hash.hexdigest()).lower()
+            if is_android(tmp.name) != 'APK':
+                return Response({"apk": "not a valid APK"})
+
+            sha256 = get_sha256_of_file(tmp)
+            if default_storage.exists(sha256):
+                # analyze(sha256, force=True)
+                return Response({"file_sha256": sha256})
+            else:
+                default_storage.save(sha256, tmp)
+                analyze(sha256)
+                return Response({"file_sha256": sha256})
+
+
 @api_view(['GET'])
 @authentication_classes([TokenAuthentication])
 @permission_classes([IsAuthenticated])

bazaar/front/forms.py

@@ -104,6 +104,10 @@ class BasicUploadForm(forms.Form):
     apk = forms.FileField()
 
 
+class BasicUrlDownloadForm(forms.Form):
+    url = forms.URLField()
+
+
 class YaraCreateForm(ModelForm):
     class Meta:
         model = Yara

bazaar/front/urls.py

@@ -2,7 +2,7 @@
 
 from bazaar.front.view import HomeView, ReportView, basic_upload_view, similarity_search_view, export_report_view, \
     download_sample_view, my_rules_view, my_rule_edit_view, my_rule_create_view, my_rule_delete_view, og_card_view, \
-    my_retrohunt_view, get_andgrocfg_code, get_genom
+    my_retrohunt_view, get_andgrocfg_code, get_genom, basic_url_download_view
 
 app_name = "front"
 urlpatterns = [
@@ -11,6 +11,7 @@
     path("report/<str:sha256>/json", view=export_report_view, name="export_report"),
     path("report/<str:sha256>/card", view=og_card_view, name="og_card"),
     path("apk/", view=basic_upload_view, name="basic_upload"),
+    path("url/", view=basic_url_download_view, name="basic_url_download"),
     path("apk/<str:sha256>", view=download_sample_view, name="download_sample"),
     path("similar/", view=similarity_search_view, name="similarity_search"),
     path("similar/<str:sha256>", view=similarity_search_view, name="similarity_search"),

bazaar/front/view.py

@@ -1,5 +1,7 @@
 import logging
 from tempfile import NamedTemporaryFile
+import requests
+import hashlib
 
 from androguard.core.androconf import is_android
 from django.conf import settings
@@ -28,7 +30,7 @@
 from bazaar.core.models import Yara
 from bazaar.core.tasks import analyze, retrohunt
 from bazaar.core.utils import get_sha256_of_file, get_matching_items_by_dexofuzzy
-from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm
+from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm
 from bazaar.front.og import generate_og_card
 from bazaar.front.utils import transform_results, get_similarity_matrix, compute_status, generate_world_map, \
     transform_hl_results, get_sample_timeline, get_andro_cfg_storage_path
@@ -150,6 +152,37 @@ def get(self, request, *args, **kwargs):
             return redirect(reverse_lazy('front:home'))
 
 
+def basic_url_download_view(request):
+    if request.method == 'POST':
+        form = BasicUrlDownloadForm(request.POST)
+        if form.is_valid():
+            url = form.cleaned_data.get('url')
+            res = requests.get(url, stream=True)
+
+            if res.status_code not in [200, 301, 302]:
+                messages.warning(request, 'URL is not available.')
+                return redirect(reverse_lazy('front:home'))
+
+            sha256_hash = hashlib.sha256()
+            with NamedTemporaryFile() as tmp:
+                for chunk in res.iter_content(chunk_size=16 * 1024):
+                    tmp.write(chunk)
+                    sha256_hash.update(chunk)
+
+                sha256 = str(sha256_hash.hexdigest()).lower()
+                if is_android(tmp.name) != 'APK':
+                    messages.warning(request, 'Submitted file is not a valid APK.')
+
+                if default_storage.exists(sha256):
+                    return redirect(reverse_lazy('front:report', [sha256]))
+                else:
+                    default_storage.save(sha256, tmp)
+                    analyze(sha256)
+                    return redirect(reverse_lazy('front:report', [sha256]))
+
+    return redirect(reverse_lazy('front:home'))
+
+
 def basic_upload_view(request):
     if request.method == 'POST':
         form = BasicUploadForm(request.POST, request.FILES)
@@ -414,15 +447,14 @@ def get_andgrocfg_code(request, sha256, foo):
     out = default_storage.open(f'{storage_path}/{foo}').read()
 
     if f'{storage_path}/{foo}'.endswith('.raw'):
-        out_formatted = highlight(out,JavaLexer(), HtmlFormatter(style=U39bStyle, noclasses=True))
+        out_formatted = highlight(out, JavaLexer(), HtmlFormatter(style=U39bStyle, noclasses=True))
         return HttpResponse(out_formatted, content_type="text/html")
     elif f'{storage_path}/{foo}'.endswith('.png'):
         return HttpResponse(out, content_type='image/bmp')
     else:
         return HttpResponse(out, content_type="image/bmp")
 
 
-
 def get_genom(request):
     es = Elasticsearch(settings.ELASTICSEARCH_HOSTS)
     entire_genom = []
@@ -436,7 +468,8 @@ def get_genom(request):
         threat = 'unknown'
         try:
             genom = report.get('_source').get('andro_cfg').get('genom')
-            threat = report.get('_source').get('vt_report').get('attributes').get('popular_threat_classification').get('suggested_threat_label')
+            threat = report.get('_source').get('vt_report').get('attributes').get(
+                'popular_threat_classification').get('suggested_threat_label')
         except Exception:
             pass
         if genom:

bazaar/templates/front/index.html

@@ -17,7 +17,7 @@ <h3 class=" text-white">Mobile threat intelligence for the masses</h3>
 
       {# Search form #}
       <div class="row justify-content-center mt-2">
-        <div class="col-md-6 mt-2 mb-2">
+        <div class="col-md-12 mt-2 mb-2">
           <form class="form-horizontal text-center" method="get">
             <div class="input-group">
               {% if q %}
@@ -39,6 +39,8 @@ <h3 class=" text-white">Mobile threat intelligence for the masses</h3>
             </div>
           </form>
         </div>
+      </div>
+      <div class="row justify-content-center mt-2">
         <div class="col-md-6 mt-2 mb-2">
           <form class="form-horizontal text-center" method="post" action="{% url "front:basic_upload" %}"
                 enctype="multipart/form-data">{% csrf_token %}
@@ -59,6 +61,25 @@ <h3 class=" text-white">Mobile threat intelligence for the masses</h3>
             </div>
           </form>
         </div>
+        <div class="row justify-content-center mt-2">
+          <div class="col-md-6 mt-2 mb-2">
+            <form class="form-horizontal text-center" method="post" action="{% url "front:basic_url_download" %}" 
+                  enctype="multipart/form-data">{% csrf_token %}
+              <div class="custom-url">
+                <input type="text"  id="url" name="url">
+                <label for="url">URL to the APK</label>
+              </div>
+              <div class="control-group mt-1">
+                <div class="controls">
+                  <button type="submit" class="btn btn-primary">
+                    Analyze
+                  </button>
+                </div>
+              </div>
+            </form>
+          </div>
+        
+        </div>
       </div>