AL4-WebCrack/service_manifest.yml at main · boredchilada/AL4-WebCrack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
name: webcrack
version: 4.7.0.5
description: >
  JavaScript deobfuscation and analysis service using webcrack to deobfuscate,
  unminify, and unpack JavaScript files. Extracts embedded WebAssembly binaries
  and tags URLs/domains/IPs found in deobfuscated output.

accepts: code/javascript|code/html|code/jscript|code/wsf|image/svg
rejects: empty|metadata/.*

stage: CORE
category: Static Analysis

file_required: true
timeout: 120
disable_cache: false

enabled: true
is_external: false

config:
  max_deobfuscated_size: 10485760

heuristics:
  - heur_id: 1
    name: Obfuscated JavaScript Deobfuscated
    description: >
      JavaScript code was successfully deobfuscated by webcrack, indicating
      the original code was intentionally obfuscated to hide its true purpose.
    filetype: "code/.*"
    score: 100
    attack_id:
      - T1027

  - heur_id: 2
    name: Known Obfuscator Detected
    description: >
      A known JavaScript obfuscator tool was detected (e.g. obfuscator.io).
      This is commonly used in phishing kits and malicious scripts.
    filetype: "code/.*"
    score: 500
    attack_id:
      - T1027.013

  - heur_id: 3
    name: JavaScript Bundle Detected
    description: Code appears to be a webpack or browserify bundle that was unpacked.
    filetype: "code/.*"
    score: 50

  - heur_id: 4
    name: Embedded WebAssembly Detected
    description: >
      JavaScript code contains an embedded WebAssembly binary encoded as base64.
      WASM is commonly used in phishing kits to hide cryptomining, credential
      harvesting, or obfuscated logic from text-based scanners.
    filetype: "code/.*"
    score: 500
    attack_id:
      - T1027.009

submission_params:
  - name: deobfuscate_code
    type: bool
    default: true
    value: true
    description: Attempt to deobfuscate JavaScript code

  - name: unminify_code
    type: bool
    default: true
    value: true
    description: Attempt to unminify JavaScript code

  - name: unpack_bundles
    type: bool
    default: true
    value: true
    description: Attempt to unpack webpack/browserify bundles

docker_config:
  allow_internet_access: false
  image: ghcr.io/boredchilada/al4-webcrack:4.7.0.5
  cpu_cores: 1.0
  ram_mb: 4096