Package: masc
mascA malware (web) scanner developed duringCyperCampHackathon 2017AbouthomepagePyPIFeaturesAt the moment, there are some features avaiable for any type of website (custom or CMS) and some of them only available for specific
platforms:Scan any website for malware using OWASP WebMalwareScanner checksum, YARA rules databases and ClamAV engine (if available)Perform some cleaning operations to improve website protectionMonitor the website for changes. Details are written in a log fileScan your site to know if it has been infected with some malwareList your local backupsLogging supportBackup your siteRestore websiteScan for suspect files and compare with a clean installation (for Wordpress and Drupal)Clean up your site to avoid giving extra information to attackers (only available for Wordpress)InstallationTo installmascon your computer, simply type 'pip install masc'RequirementsFirst of all, notice that this tool is developed under Linux and Mac OSX environments and, at the moment, it has been tested only under these Operating SystemsPython >= 3Some Python librariespython-magicyara-pythonwatchdogtermcolorprogresspyclamdClamAV to integrate with its engine (optional but recommended)Notice for Debian users/developersIn my notebook, after upgrading to Debian testing, masc became to show an error related to YaraOSError:/usr/lib/libyara.so:cannotopensharedobjectfile:NosuchfileordirectoryAfter trying a lot of solutions I found in the Internet, I realized that this file was located in my computer in/usr/local/lib/python3.5/dist-packages/usr/lib, so I created a symbolic link from the previous path to/usr/libsanti@zenbook:$ln-s/usr/local/lib/python3.5/dist-packages/usr/lib/libyara.so/usr/lib/libyara.soAnd now, masc and Yara library are running with no problems.Notice for MacOS users/developersmascis developed under Linux but it has been tested under Mac OSX. Anyway, it should run without problems under any Unix-friendly OS.In particular, in Mac OSX I have noticed it's neccesary to installHomebrewto use python-magic library properly aslibmagic. Check first the previous link to thebrewhomepage and then
you will be able to install as I show below:santi@zenbook:$brewinstalllibmagicAlso, in my computer I had to change the first line of themasc.pyscript. Python3 is installed in/usr/local/binand it's not
allowed to create symlinks from/usr/binChange the first line inmasc.py#!/usr/bin/python3for this line#!/usr/local/bin/python3Anyway, you always can runmascusing the Python interpreter instead running the script directly:santi@zenbook:$python3masc.pyUsagemasc0.3(http://github.com/sfaci/masc)usage:masc.py[-h][-afFILENAME][--awSTRING][-cc][-c][-l][-b][-m][-nNAME][-pPATH][-r][-s][-t{wordpress,drupal,custom}]optionalarguments:-h,--helpshowthishelpmessageandexit-afFILENAME,--add-fileFILENAMEAddasuspectfiletothedictionary-awSTRING--add-wordSTRINGAddasuspectcontenttothedictionary-cc,--clean-cacheCleanmasccache(cacheandlogsfiles,NObackups)-c,--clean-siteCleanupthesite(andapplysomeextraactionstohideinformationtoattackers)-l,--list-backupsListlocalbackups-b,--make-backupCreatealocalbackupofthecurrentinstallation-m,--monitorMonitorsitetodetectchanges-nNAME,--nameNAMENameassignedtothescannedinstallation-pPATH,--pathPATHWebsiteinstallationpath-r,--rollbackRestorealocalbackup-s,--scanScanwebsiteformalware-t{wordpress,drupal,custom},--site-type{wordpress,drupal,custom}whichtypeofwebyouwanttoscan::wordpress,joomla,drupalormagentoThe actions you can perform over a web installation are:-s, --scan (with or without the option --clean-site)-r, --rollback (with its options)-m, --monitor (with its options)-b, --make-backup (with its options)-l, --list-backupsAnd you have to consider that if you want to perform some actions over some kind of web installation, it's mandatory to
specify the type (-t or --type) and path (-p or --path).For instance, if you have a WordPress installation in /var/www/html and you want to scan it entirely:santi@zenbook:$ ./masc.py --scan --site-type wordpress --path /var/www/htmlAnd if you want to perform clean up actions (to remove some malware, for instance):santi@zenbook:$ ./masc.py --scan --site-type wordpress --path /var/www/html --clean-siteTestsThere are two samples of hacked websites in the samples zip file:drupal: clean Drupal installation with some malware scripts. You can use it to make
your test during developmentwordpress: clean WodPress installation with some malware to test. There is also some security holes such as
emtpy directories and some permissions wrong to test the extra features implemented to this kind of CMSIn addition, there is a repository in the Docker Hub to perform testsmasc-wordpressDocumentationYou can find a tutorial about how to usemascat thewikiHow to contributeIf you want to contribute to this project, take a look at thewiki.
There is a section aboutHow to contribute to this projectThanksThanks toOWASP WebMalwareScannerfor some ideas
and the signatures databases with checksums and YARA
rules (and how to load it to work with).AuthorSantiago Facisanti@arkabytes.comContributorsIago Alonso (@ibLeDy)Israel Saeta (@dukebody)Isaac (@isaacvv)Tekiroz (@Tekiroz)Yagueteiro (@Yagueteiro)