Sesebelisoa sa ho hlalosa JavaScript se etsa eng?
JavaScript Obfuscator e etselitsoe ho nka khoutu e hloekileng, e baloang ke batho le ho e fetola ntho e sa baleheng habonolo, e leng se etsang hore ho be thata ho e utloisisa kapa ho e fetola morao. Lisebelisoa tsena li reha mabitso a mefuta-futa le mesebetsi, li tlosa sebaka se sesoeu, li batalatsa meaho ea khoutu, 'me li sebelisa mekhoa e kang ho arola khoele, ho kenya khoutu ea hexadecimal, kapa ho batalatsa phallo ea taolo. Le hoja sepheo hangata e le ho sireletsa thepa ea kelello kapa ho fokotsa boholo ba faele, ho rarahana ho hlahang ho boetse ho fana ka tšireletso e ntle bakeng sa malware ea JavaScript. Ke ka lebaka leo lihlopha tse ngata tsa ts'ireletso li retelehelang ho lisebelisoa tsa deobfuscator tsa JavaScript ho sekaseka khoutu e fetotsoeng le ho senola boitšoaro bo patiloeng.
Mohlala, ntho e bonolo joaloka:
function greet(name) { return `Hello, ${name}`; } Might become: function _0x1a2b(_0x3c4d){return'Hello, '+_0x3c4d;} Bakeng sa logic ea lehlakoreng la bareki ba thepa ba nts'etsapeleng thepa (nahana ka SaaS e thehiloeng ho sebatli), sesebelisoa sa JavaScript obfuscator ke karolo ea letoto la lisebelisoa. Empa phetoho ena e tšoanang e etsa hore e be sekoahelo se phethahetseng bakeng sa malware ea JavaScript.
Kamoo Bahlaseli ba Sebelisang Tšebeliso e Mpe ea ho Sireletsa ho Pata Malware ea JavaScript
Bahlaseli ba sebelisa lisebelisoa tsa JavaScript obfuscator hampe ho pata malware e kentsweng lilaebraring tsa mohloli o bulehileng, liphutheloana tsa npm, kapa ka ho toba ho dingolwa tsa sebatli. Mokhoa o tlwaelehileng ke ho pata meputso ka hare ho mesebetsi e patilweng e qalang nakong ya tshebetso tlasa maemo a itseng.
Nahana ka sephutheloana sa npm se senyehileng. Ha u sheba ka lekhetlo la pele, ntho e 'ngoe le e 'ngoe e shebahala e nepahetse. Empa ha u sheba ka botebo u senola JavaScript e patiloeng e buang ka likhoele tse kentsoeng, li-URL tse hole, kapa tse matla. eval() mehala:
(function(_0xa1b2c){var _0xd3e4=['/(function(_0xa1b2c){var _0xd3e4=['\x2fapi/(function(_0xa1b2c){var _0xd3e4=['\x2fapi\x2fsteal','...']; ...eval(atob(_0xd3e4[0]));})(this); Hona ha se kgatello. Ke sekoahelo. Malware a JavaScript a ipata mona, a emetse ho ntsha di-tokens, ho kenya diforomo tsa phishing, kapa ho eketsa ditumello ka hare ho di-app.
Likotsi tsa 'Nete ho AppSec le Chain ea Phepelo
Software ea sejoale-joale pipelines li hahiloe holim'a khoutu ea mokha oa boraro. JavaScript malware e kentsoeng ka li-script tse patiloeng ha se feela lesoba la tšireletso; ke tlōlo ea ketane ea phepelo. Hang ha malware e patiloeng e oela laeboraring e arolelanoang, ea ata:
- Ho kena ka har'a meaho ea CI ka sejana.json
- Ho kena liphuthelong tse ka pele ka Webpack/Rollup
- Ho hlahisoa ka li-CDN kapa li-injection tsa script
Mohlala, ketsahalo e pharalletseng ketsahalo e bontšitse kamoo bahlaseli ba sebelisitseng ho patoa ho kenya meputso ka har'a liphutheloana tse sebelisoang haholo. Bahlahisi ha ba hlahlobe khoutu e patiloeng ka botebo, e leng se etsang hore e be sebaka se phethahetseng sa ho ipata.
Kotsi ha se khopolo-taba. E se e ntse e le khoutung ea hau haeba lintho tseo u itšetlehileng ka tsona li sa skenoa.
Ho Fumana Khoutu e Sirelelitsoeng ka Lisebelisoa tsa JavaScript Deobfuscator
Ho tshwara ditshoso tse patilweng, dihlopha di sebedisa disebediswa tsa deobfuscator tsa JavaScript. Tsena di sekaseka dipaterone tsa khoutu tse patilweng, di hlalosa dikgwele, mme di senola difolaga tse kgubedu tse kang dynamic eval(), li-loop tse patehileng, le ho rarahana ho sa hlokahaleng.
Li-deobfuscators tse thusang ha li fetole khoutu feela; li tšoaea:
- Ts'ebeliso ea mosebetsi, eval, 'me setTimeout ka moroalo o kentsoeng ka khoutu
- Tatellano e telele ea likhoele tsa Base64 kapa hexadecimal
- Ho kenya phallo ea taolo kapa ho kenya khoutu e shoeleng
Lisebelisoa tse iketsang tse kang li-static analyzer kapa li-AST parser li thusa ho bona mekhoa ena. Ke tsona tse ka sehloohong tse thusang ha ho hlahlojoa mekhoa e itšetlehileng ka eona kapa ho netefatsoa lintlafatso tsa sephutheloana.
Mohlala: kopanya ho skena ha deobfuscation litekong tsa pele ho kopanyo ho qoba ho kopanya litšokelo tse patiloeng.
Ho Kopanya Temoho ho CI/CD Pipelines
Ho lemoha ha se mosebetsi oa kamora ho kenngoa tšebetsong. Ho hlahloba ka mokhoa o sa hlakang e lokela ho ba karolo ea CI/CD pipeline. Sebelisa Liketso tsa GitHub, GitLab CI, kapa Jenkins ho qala ho skena ha ho sututsoa kapa ho kopanngoa ho hong le ho hong.
tloaelehileng pipeline phallo:
jobs: security-check: steps: - uses: actions/checkout@v2 - name: Scan for Obfuscation run: node scripts/deobfuscate-scan.jsKa ho kenya tshebetsong leano, o ka thibela meaho e nang le khoutu e patilweng e kotsi. Kopanya sena le SCA lithulusi tsa ho li-signature tse tsebahalang tsa malware tse amanang le litšupiso tse fapaneng liphuthelong tsa npm.
Se ke oa emela lintho tse makatsang tsa nako ea ho sebetsa. Etsa hore e be ntho e lahliloeng ka nako ea ho haha.
Litšenyehelo tse Patehileng tsa ho Sireletsa: Ho Loantša Malware ea JavaScript ka Li-Deobfuscators
Lisebelisoa tsa JavaScript obfuscator li na le ts'ebeliso e nepahetseng. Empa bahlaseli ba itšetleha ka tsona ho pata malware ea JavaScript le ho sebelisa hampe ts'epo tikolohong ea mohloli o bulehileng. Kotsi ea 'nete ho AppSec ha se feela ho seo u se ngolang, empa le ho seo u se kenyang. Ka ho kenya di-scan tsa deobfuscator tsa JavaScript le tlhahlobo e sa fetoheng ho CI/CD pipelines, lihlopha tsa nts'etsopele li ka bona litšokelo esale pele. Tšoara khoutu e patiloeng ka ho belaella ho latela litšehetso, haholo-holo ha ho sa lebelloa.
Lisebelisoa tse joalo Xygeni li hahiloe ho thusa lihlopha tsa DevSecOps ho bona likotsi tsa ho patoa le tsa ketane ea phepelo ho pholletsa le tikoloho ea JavaScript. Li sebelise ho ntlafatsa pipeline 'me u lemohe se ipatileng khoutung ea hau pele e fihla tlhahisong.
Xygeni E feta ho skena ha motheo ka ho sekaseka mekhoa ea ho se utloisise JavaScript, ho tšoaea malware a ka bang teng a JavaScript, le ho latela mekhoa e kotsi liphuthelong ho pholletsa le ketane ea hau ea phepelo ea software. E hokahana ka mokhoa o se nang mathata le CI/CD pipelines, ho nolofalletsa puso e iketsahallang hodima boleng ba khoutu le tshireletso.
Lula u tšohile. Sekaseka ntho e 'ngoe le e 'ngoe. 'Me u hopole: haeba e shebahala e le leshano, mohlomong e tšoaneloa ke ho e sheba hape.
