├── process.py
├── README.md
├── Malicious-Proxy-Scanner.py
└── LICENSE
/process.py:
--------------------------------------------------------------------------------
1 | #!/bin/python
2 | #This program will automatically go through a file called 'output.txt' searching for injected javascript code.
3 | #For any injected javascript code, it will print out the line containing injected javascript and IP address and
4 | #port for the proxy that injected said javascript.
5 | malicious = []
6 | ip = []
7 | with open('output.txt') as f:
8 | input = f.readlines()
9 | for line in input:
10 | line = line.rstrip('\n')
11 | #lastIP = ""
12 | for line in input:
13 | lineT = line.lower()
14 | if "[-]" in line:
15 | lastIP = line
16 | if "+" in line and (("javascript" in line) or ("js" in line)):
17 | ip.append(lastIP)
18 | malicious.append(line)
19 | for index, line in enumerate(malicious):
20 | print ip[index]
21 | print line
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | #Scanning for Malicious Proxies
2 |
3 | In the past few years, there has been a lot of press about HTTP proxies that transparently modify traffic to inject javascript for malicious purposes. There have been multiple presentations at DEFCON and blackhat about this topic and a variety of ways of exploiting it including: DDOS, credential theft, and even a distributed method of storage.
4 |
5 | Due to this, I decided to write a script to automatically scan proxies for malicious behavior such as: injecting javascript, modifying forms, and editing HTML.
6 |
7 | The first step was to get a list of proxies that are currently up and freely accessible. For this, I used a modified version of Dan McInerney’s Elite Proxy Finder. Originally, this script allowed for automated speed testing and discovery of elite proxies. I modified this script so as to:
8 |
9 | Output all types of proxies, not just elite proxies (since anonymity is not an issue).
10 | Output proxies that support only http. This was done because proxies are not able to modify resources transmitted over SSL, so support for a protocol that I will not be testing is not needed.
11 | Export a list of proxies and their ports
12 | From there, I had a list of approximately 1000 active free proxies. While this is a relatively small number, I decided to move on with the experiment to see if there was any malicious behavior to be observed even in this small sample size. So on to the results!
13 |
14 | In all 1500 proxies, there was no malicious traffic. What I mean by this is that no proxies transparently edited the traffic without making it very clear that one was not reaching the requested website. There was no injection of javascript. There was no modification of forms. Absolutely no interesting modifications.
15 |
16 | Thus the next step is going to be to use masscan to scan the ipv4 address space to look for free proxies, then once again search for malicious behavior.
17 |
18 | The code used for this post will be posted here once I clean it up a little bit.
19 |
20 | Update: I updated the script slightly so as to increase the number of proxies it discovered. With the addition of the updated script, I have discovered a number of malicious proxies that are currently active.
21 |
22 | Here is a list of all proxies detected with errant behavior and a description of their errant behavior.
23 |
24 | =======
25 |
26 | The proxy server at
27 |
28 | 221.183.16.219:00080
29 |
30 | modifies HTML sent over HTTP to add the following code to every webpage
31 |
32 |
33 |
34 | Sadly, the adfocus.com.cn domain is not currently accessible, so I cannot view the injected javascript. Based off of the URL of the injected javascript, two conclusions can be made.
35 |
36 | It is javascript used to automatically inject ads into websites accessed over HTTP. This seems to be the most obvious solution since the domain is “adfocus.com.cn” and the javascript file is stored in the “adscript” folder and is called “adfocus.js”. This would make sense since it is a free proxy, the owners of the proxy are likely trying to monetize the business.
37 | However, it seems like this might be what we are supposed to think. I say this because the javascript is hosted on the adfocus.com.cn domain, very similar to the legitimate adfocus.com. It might be that the administrators of this proxy are attempting to capture the reputation of adfocus.com so as to prove the legitimate nature of the injected code. This makes me wonder whether this code serves a more malicious purpose. The injected javascript could do anything from exploit the computer to be part of a botnet to be part of a distributed filesystem.
38 |
39 | =======
40 |
41 | The proxy server at
42 |
43 | 115.239.210.199:80
44 |
45 | automatically strips all HTML comments from the transmitted data. While this does not have any obvious negative effect, it still modifies the transmitted HTML which is an inherently bad thing for any proxy server.
46 |
47 | =======
48 |
49 | The proxy server at
50 |
51 | 60.194.40.198:8118
52 |
53 | modifies HTML sent over HTTP to add the following code to every webpage
54 |
55 |
56 |
57 | =======
58 |
59 | The proxy server at
60 |
61 | 122.225.106.35:80
62 |
63 | modifies HTML sent over HTTP to add the following code to every webpage
64 |
65 |
66 |
67 | This code does a number of interesting things. First of all, it adds a new CSS style sheet. While the style sheet does not do anything malicious (instead choosing to allow the page to appear normally) it is clearly malicious in its purpose, the stylesheet is not the key to the malicious code.The interesting part is here. As my knowledge of javascript is quite limited, I’m going to stop my analysis here. But based off of a quick read through of the code, it seems to be malicious in nature considering the injection of a flash object attempting to download an exe.
68 |
69 | =======
70 |
71 | So far, I have only analyzed a few select malicious proxies. A full data dump from running this script is available in the Github repo here if anyone wants to give an automated analysis a shot (6500+ lines).
72 |
--------------------------------------------------------------------------------
/Malicious-Proxy-Scanner.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python2
2 | #See output.txt for an example output file
3 |
4 | '''Finds hundreds of HTTP proxies by scraping a number of different lists of proxies then tests them all in parallel to check for malicious behavior.'''
5 |
6 | from gevent import monkey
7 | monkey.patch_all()
8 | import difflib
9 | import hashlib
10 | import requests
11 | import ast
12 | import gevent
13 | import sys, re,
14 | from BeautifulSoup import BeautifulSoup
15 |
16 | class bcolors:
17 | HEADER = '\033[95m'
18 | OKBLUE = '\033[94m'
19 | OKGREEN = '\033[92m'
20 | WARNING = '\033[93m'
21 | FAIL = '\033[91m'
22 | ENDC = '\033[0m'
23 | BOLD = '\033[1m'
24 | UNDERLINE = '\033[4m'
25 |
26 | class find_http_proxy():
27 | ''' Will only gather L1 (elite anonymity) proxies
28 | which should not give out your IP or advertise
29 | that you are using a proxy at all '''
30 |
31 | def __init__(self):
32 | self.proxy_list = []
33 | self.headers = {'User-Agent':'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36'}
34 | self.errors = []
35 | self.print_counter = 0
36 | self.externalip = self.external_ip()
37 |
38 | def external_ip(self):
39 | req = requests.get('http://myip.dnsdynamic.org/', headers=self.headers)
40 | ip = req.text
41 | return ip
42 |
43 | def run(self):
44 | ''' Gets raw high anonymity (L1) proxy data then calls make_proxy_list()
45 | Currently parses data from gatherproxy.com and letushide.com '''
46 |
47 | print '[*] Your accurate external IP: %s' % self.externalip
48 |
49 | letushide_list = self.letushide_req()
50 | print '[*] letushide.com: %s proxies' % str(len(letushide_list))
51 |
52 | # Has a login now :(
53 | gatherproxy_list = self.gatherproxy_req()
54 | print '[*] gatherproxy.com: %s proxies' % str(len(gatherproxy_list))
55 |
56 | checkerproxy_list = self.checkerproxy_req()
57 | print '[*] checkerproxy.net: %s proxies' % str(len(checkerproxy_list))
58 |
59 | self.proxy_list.append(letushide_list)
60 | self.proxy_list.append(gatherproxy_list)
61 | self.proxy_list.append(checkerproxy_list)
62 |
63 | # Flatten list of lists (1 master list containing 1 list of ips per proxy website)
64 | self.proxy_list = [ips for proxy_site in self.proxy_list for ips in proxy_site]
65 | self.proxy_list = list(set(self.proxy_list)) # Remove duplicates
66 |
67 | print '[*] %d unique high anonymity proxies found' % len(self.proxy_list)
68 | self.proxy_checker()
69 |
70 | def checkerproxy_req(self):
71 | ''' Make the request to checkerproxy and create a master list from that site '''
72 | cp_ips = []
73 | try:
74 | url = 'http://checkerproxy.net/all_proxy'
75 | r = requests.get(url, headers=self.headers)
76 | html = r.text
77 | except Exception:
78 | print '[!] Failed to get reply from %s' % url
79 | checkerproxy_list = []
80 | return checkerproxy_list
81 |
82 | checkerproxy_list = self.parse_checkerproxy(html)
83 | return checkerproxy_list
84 |
85 | def parse_checkerproxy(self, html):
86 | ''' Only get elite proxies from checkerproxy '''
87 | ips = []
88 | soup = BeautifulSoup(html)
89 | for tr in soup.findAll('tr'):
90 | if len(tr) == 19:
91 | ip_found = False
92 | elite = False
93 | ip_port = None
94 | tds = tr.findAll('td')
95 | for td in tds:
96 | if ':' in td.text:
97 | ip_found = True
98 | ip_port_re = re.match('(\d{1,3}\.){3}\d{1,3}:\d{1,5}', td.text)
99 | if ip_port_re:
100 | ip_port = ip_port_re.group()
101 | if not ip_port:
102 | ip_found = False
103 | if ip_found == True:
104 | ips.append(str(ip_port))
105 | break
106 | return ips
107 |
108 | def letushide_req(self):
109 | ''' Make the request to the proxy site and create a master list from that site '''
110 | letushide_ips = []
111 | for i in xrange(1,20): # can search maximum of 20 pages
112 | try:
113 | url = 'http://letushide.com/filter/http,hap,all/%s/list_of_free_HTTP_High_Anonymity_proxy_servers' % str(i)
114 | r = requests.get(url, headers=self.headers)
115 | html = r.text
116 | ips = self.parse_letushide(html)
117 |
118 | # Check html for a link to the next page
119 | if '/filter/http,hap,all/%s/list_of_free_HTTP_High_Anonymity_proxy_servers' % str(i+1) in html:
120 | pass
121 | else:
122 | letushide_ips.append(ips)
123 | break
124 | letushide_ips.append(ips)
125 | except:
126 | print '[!] Failed get reply from %s' % url
127 | break
128 |
129 | # Flatten list of lists (1 list containing 1 list of ips for each page)
130 | letushide_list = [item for sublist in letushide_ips for item in sublist]
131 | return letushide_list
132 |
133 | def parse_letushide(self, html):
134 | ''' Parse out list of IP:port strings from the html '''
135 | # \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} - matches IP addresses
136 | #
