Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/groupon/selenium-grid-extras
NOTICE - Looking for people to maintain this project. I (@smccarthy) does not have the time for now. If interested please contact me via an open issue or #selenium on the freenode network (or Slack). Thank you!
Selenium Grid Extras is a project that helps you set up and manage your local Selenium Grid. Typical instances of the Grid consists of the HUB and Nodes. The HUB is responsible for managing test sessions and assigning new session idle nodes.
Setup of Grid Extras is made to be simple, just run the packaged JAR file and point the node at the HUB location, Grid Extras will take care of the rest for you. Here are the features you get by using Selenium Grid Extras vs Selenium Grid alone:
Setup is simple, just download the Grid Extras Jar to get started from here: Download Latest
java -jar Selenium-Grid-Extras-Jar.jar
You will be prompted with several questions, first one will ask you if you want to set this computer as a HUB, Node, or both. Answer 2 for HUB
Leave the Host name for Grid Hub as default 127.0.0.1
Set port to be used by Selenium Grid Hub, default is 4444
You will be asked if you wish to auto update Selenium. If you answer yes, then every time Selenium Grid Extras is started it will check fo the latest version of Selenium Stand Alone Server, IEDriver, and ChromeDriver. If you choose to not auto update, you will be asked what versions of each driver to lock into.
java -jar Selenium-Grid-Extras-Jar.jar
You will be asked if you wish to use this computer as HUB or Node, select 1 for Node
You will be asked for the host name of the HUB computer, type in the IP or hostname of the HUB computer
When prompted for the port used by the HUB, enter that value
Selenium Grid Extras will attempt to guess the Operating System of the current computer, if it's wrong please enter the correct value
You will be asked what Browsers this Node will host, choose the ones that apply
You will be asked how often to restart your whole computer. By default after 10 tests Selenium Grid Extras will attempt to restart the Node, provided the node is idle. Choose 0 if you do not wish to have the computer automatically restart.
You will be asked if Selenium Grid Extras should automatically check for updates of IEDriver, ChromeDriver and Selenium Stand Alone Server. If you answer no, you will be asked what version to lock into.
Finally, you will be asked if you wish to store all of the Node configs on the HUB. If you answer yes, Selenium Grid Extras will attempt to push Node's configs to the HUB. If it is successful, Selenium Grid Extras will attempt to download all of the configs from the HUB before it starts. This way all of the Node configs can be controlled directly from the HUB.
There are 2 options available for un-attended upgrades
Starting with release 1.3.0 the nodes have an option of automatically restarting after a certain amount of builds have been executed and the node is currently not busy. This helps to keep the nodes in pristine state for longer periods of time, and clears up and browser crashes, which may have occurred. Some setup will be needed to make this feature work as intended.
shutdown -r -t 1 -f
$USER ALL=(ALL) NOPASSWD: /sbin/shutdown
$USER ALL=(ALL) NOPASSWD: /sbin/shutdown
Note: Make sure to run Grid Extras at least once prior to setting it up as a service, so it can ask you the first run questions.
There are two major ways to make windows automatically start the Grid Extras binary
There are a lot of security issues with setting up a cron job as a “build user” and letting that user run in the normal display desktop (DISPLAY=:0 aka the one you see when it is connected to the computer monitor). There is a work around to allow the service to run in DISPLAY=:0 but that’s not recommended.
Instead, it is a much better practice to set up a XVNC server on a Linux computer, with a light desktop manager (FluxBox seems to be a good lightweight choice http://fluxbox.org/). Once VNC server and desktop managers are installed, run the following command to start a virtual DISPLAY:
vncserver :1 -geometry 1024x768
This will start an XVNC server on DISPLAY=:1 with screen resolution of 1024x768. You can tweak these parameters as needed. Note: You might need to add a cron job to restart vncserver in similar fashion, since vncserver will not automatically start after reboot
After you have the virtual display running, add run this command to edit the cron list for current user (vi is the editor used)
crontab -e
Add following lines to the cron list:
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
*/5 * * * * bash -i -c 'cd WORKING_DIRECTORY; export DISPLAY=:1 java -jar SELENIUM_GRID_EXTRAS.jar' >> WORKING_DIRECTORY/log/log.out 2>&1
Where the WORKING_DIRECTORY needs to be replaced with the location where grid extras jar was downloaded, and SELENIUM_GRID_EXTRAS represents the name given to the grid extras jar. This cron will run every 5 minutes.
Download the SeleniumGridExtras.plist to your computer, open it in editor of choice.
Update the XML file replacing WORKING_DIRECTORY with the location of the selenium grid extras working directory Update the XML file replacing SELENIUM_GRID_EXTRAS.jar with the name Selenium Grid Extras was saved as
Move the com.groupon.SeleniumGridExtras.plist to ~/Library/LaunchAgents/
run
launchctl load ~/Library/LaunchAgents/com.groupon.SeleniumGridExtras.plist
For This project, add functionality, make sure all tests pass, send pull request.
Note: This product exposes your machine to the whole network, anyone on the network will be able to perform OS level task by simply hitting an HTTP url. There are no security measures at the moment, and at the moment no plans to add any security. You have been warned!
This project uses jWMI.java which was taken from www.henryranch.net
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.