Project Neto: A Toolkit for Analysing Browser Plugins =====================================================

Overview

---

Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to extract these features from relevant resources in a extension like manifest.json, localization folders or Javascript and HTML source files.

Installation

---

To install the package, the user can choose pip3.

pip3 install -e . --user

Optionally, it can also be installed with administrator privileges using sudo:

sudo pip3 install -e .

A successfull installation can be checked using:

python3 -c "import neto; print(neto.version)"

Quick Start

---

To perform the analysis of an extension, the analyst can type the following:

neto analysis -u https://yoururl.com/extension-name.xpi

The extension will be automatically downloaded and unzipped by default in the system's temporal folder.

However, the analyst can also launch de analysis towards a locally stored extension:

neto analysis -e ./my-extension-name.xpi

After the static analysis is performed, it will generate a Json file that is stored by default in a newly created folder named output.

If you use Python, you can also import the package as a library in your own Python modules:

>>> from neto.lib.extensions import Extension >>> my_extension = Extension ("./sample.xpi") >>> my_extension.filename 'adblockforfirefox-3.8.0-an+fx.xpi' >>> my_extension.digest '849ec142a8203da194a73e773bda287fe0e830e4ea59b501002ee05121b85a2b'

Apart from accesing to the elements found in the extension using properties, the analyst can always have access to it as a dictionary:

>>> my_extension.dict {'analyserversion': '0.0.1', '_digest': '849ec142a8203da194a73e773bda287fe0e830e4ea59b501002ee05121b85a2b'…

If you are not using Python, you can use the JSON RPC daemon:

$ neto daemon

_                                               |   \    ()   | |   | \ | | | |          | |) | '/  \| |/  \/ | |  |  \| |/  \ / _ \          |  /| | | () | |  / (| |   | |\  |  / || (_) |         ||   ||  \// |\|\|\|  || \|\|\\_/                       |__/
Developed by @ElevenPaths                                     Version: 0.5.0b
* Running on http://localhost:14041/ (Press CTRL+C to quit)

You can then run commands using your preferred JSON RPC library to write a client (we have written a short demo in the bin folder) or even curl:

curl --data-binary '{"id":0, "method":"remote", "params":["https://example.com/myextension.xpi"], "jsonrpc": "2.0"}'  -H 'content-type:text/json;' http://localhost:14041

Features

---

The following is a non-exhaustive list of the features included in this package are the following:

• Manifest analysis.
• Internal file hashing.
• Entities extraction using regular expressions: IPv4, email, cryptocurrency addresses, URL, etc.
• Comments extraction from HTML, CSS and JS files.
• Cryptojacking detection engine based on known mining domains and expressions.
• Suspicious Javascript code detection such as eval().
• Certificate analysis if provided.
• Batch analysis of previously downloaded extensions.