Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
github.com/yhy0/FuckFingerprint
Web指纹采取在线获取的方式,这样就可以不用更新程序即可使用最新的指纹,可以很方便的集成进扫描器中。
默认会使用在线的指纹,当在线获取失败时才会使用内置的指纹。
在线指纹依托于 raw.githubusercontent.com ,对于国内不友好可以通过指定代理获取(注:指定代理后,指纹识别也会走代理)
在线指纹地址可以在 pkg/config/config.go
中修改为原项目中的地址
const EHoleFingerDataOnline = "https://raw.githubusercontent.com/veo/vscan/main/pkg/fingerprint/dicts/eHoleFinger.json"
const LocalFingerDataOnline = "https://raw.githubusercontent.com/veo/vscan/main/pkg/fingerprint/dicts/localFinger.json"
const AfrogFingerDataOnline = "https://raw.githubusercontent.com/zan8in/afrog/main/pkg/fingerprint/web_fingerprint_v3.json"
默认使用本项目地址
const EHoleFingerDataOnline = "https://raw.githubusercontent.com/yhy0/FuckFingerprint/main/fingerPrints/eHoleFinger.json"
const LocalFingerDataOnline = "https://raw.githubusercontent.com/yhy0/FuckFingerprint/main/fingerPrints/localFinger.json"
const AfrogFingerDataOnline = "https://raw.githubusercontent.com/yhy0/FuckFingerprint/main/fingerPrints/web_fingerprint_v3.json"
指纹直接提取缝合了以下两个扫描器:
感谢大佬无私奉献
本工具仅面向合法授权的企业安全建设行为,在使用本工具进行检测时,您应确保该行为符合当地的法律法规,并且已经取得了足够的授权。
如您在使用本工具的过程中存在任何非法行为,您需自行承担相应后果,作者将不承担任何法律及连带责任。
在使用本工具前,请您务必审慎阅读、充分理解各条款内容,限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。 除非您已充分阅读、完全理解并接受本协议所有条款,否则,请您不要使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的,即视为您已阅读并同意本协议的约束。
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.