public void DetectHexWithDash()
{
var encodedWithDash = BitConverter.ToString(Encoding.Default.GetBytes(decoded));
var tool = new DefoggerTool();
tool.AnalyzeFile("DetectHexTest", encodedWithDash);
Assert.AreEqual(1, tool.Findings.Count);
Assert.IsTrue(tool.Findings.Any(x => x.EncodedText == encodedWithDash && x.DecodedText == decoded));
}
public void DetectBase64()
{
var base64 = Convert.ToBase64String(Encoding.Default.GetBytes(decoded));
var tool = new DefoggerTool();
tool.AnalyzeFile("DetectBase64Test", base64);
Assert.AreEqual(1, tool.Findings.Count);
Assert.IsTrue(tool.Findings.Any(x => x.EncodedText == base64 && x.DecodedText == decoded));
}
public void DetectNested()
{
var nested = Convert.ToHexString(Encoding.Default.GetBytes(Convert.ToBase64String(Encoding.Default.GetBytes(decoded))));
var tool = new DefoggerTool();
tool.AnalyzeFile("DetectNestedTest", nested);
Assert.AreEqual(3, tool.Findings.Count);
Assert.AreEqual(2, tool.Findings.Count(x => x.Type == DefoggerTool.EncodedStringType.Base64));
Assert.AreEqual(1, tool.Findings.Count(x => x.Type == DefoggerTool.EncodedStringType.Hex));
Assert.IsTrue(tool.Findings.Any(x => x.DecodedText == decoded));
}
public void DetectBinaryTest()
{
var bin = new FileStream(Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location) ?? string.Empty, "TestData", "oss-defog.dll"), FileMode.Open);
var ms = new MemoryStream();
bin.CopyTo(ms);
var base64 = Convert.ToBase64String(ms.ToArray());
var tool = new DefoggerTool();
tool.AnalyzeFile("DetectBinaryTest", base64);
Assert.AreEqual(1, tool.BinaryFindings.Count);
}
public void DetectNestedZip()
{
var zip = new FileStream(Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location) ?? string.Empty, "TestData", "Base64Zip.zip"), FileMode.Open);
var ms = new MemoryStream();
zip.CopyTo(ms);
var nested = Convert.ToHexString(Encoding.Default.GetBytes(Convert.ToBase64String(ms.ToArray())));
var tool = new DefoggerTool();
tool.AnalyzeFile("DetectNestedZipTest", nested);
Assert.AreEqual(5, tool.Findings.Count);
Assert.AreEqual(3, tool.Findings.Count(x => x.Type == DefoggerTool.EncodedStringType.Base64));
Assert.AreEqual(2, tool.Findings.Count(x => x.Type == DefoggerTool.EncodedStringType.Hex));
Assert.AreEqual(1, tool.ArchiveFindings.Count);
Assert.AreEqual(1, tool.BinaryFindings.Count);
Assert.IsTrue(tool.Findings.Any(x => x.DecodedText == decoded));
zip.Close();
}
