Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
phantomjs-node-helper
Advanced tools
Wrapper under phantomjs-node library with additional functions set
This is wrapper under phantomjs-node.
var utils = require('mservice-utils');
var ph = new Phantom(cfg, function()) {
ph.createPage(function(page) {
page.open('...');
});
}
Config parameter | Description | Default value |
---|---|---|
useragent | browser version and agent sent in headers to site | random |
referer | first referer sent in headers to site for each page | https://www.facebook.com |
viewport | display width and height in '{ width: XXX, height: YYY }' | random |
cfg.arg | parameters for phantom.js | --ssl-protocol=tlsv1, --ignore-ssl-errors=yes |
proxy | proxy which should be used for requests | none |
Name | Parameters | Description |
---|---|---|
ready | function() | fired on class init if no callback set |
*.urlChanged | function(url) | fired on url change |
*.loadFinished | function() | fired then page finish loading |
** * *** = namespace returned from .createPage
Create page instance ready for use. This function take namespace (used in events) and callack with err
and page
parameters.
Page instance has few extra methods:
Emulate click with sendEvent('click')
on the random place on the element specified with querySelector
Emulate click with Javascript MouseEvent
on the random place on the element specified with querySelector
Emulate user behaviour (focusing, typing) with text field specified with querySelector
Find and extract content from image specified with querySelector and call callback(error, imageContent)
Process form like a human. Requiring formObj as a hashmap with keys as a selectors and values which should be passed to the selected input. Also requiring submitSelector - selector for the submit button which will be pressed after form filled. Example:
page.processForm({
'#form input[name=FirstName]': 'Ivan',
'#form input[name=LastName]': 'Ivanov',
'#form input[name=Email]': 'ivan.ivanov@hotmail.com',
'#form input[name=Password]': 'qwe123',
'#form input[name=Password2]': 'qwe123'
}, '#form button[role=submit]', function (e) {
if (e) {
throw e;
}
console.log('Form submited!');
});
processForm
can be also called without some arguments, for example:
.processForm(formObj, next) - fill form
.processForm(formObj, 'selector', next) - fill form and click the button
.processForm('selector', next) - simply click the button
.processForm(formObj, 'selector', { delay: 200 }, next) - fill form with 200ms switch between selectors and click the button
Note: this method requires legacy user-agent setted in Phantom constructor. Use https://github.com/arkcore/legacy-random-ua module for this. Get base64 of the image from legacy ReCaptcha. Requires
iframeSelector
- parameter for query selector to pick ReCaptcha iframe (in most cases it will be.g-recaptcha iframe
). Callback will be called with error or base64 string of the image in second argument.
Paste ReCaptcha solution and verify.
FAQs
Wrapper under phantomjs-node library with additional functions set
The npm package phantomjs-node-helper receives a total of 1 weekly downloads. As such, phantomjs-node-helper popularity was classified as not popular.
We found that phantomjs-node-helper demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.