diff --git a/.snapshots/TestInputFromURLScan-be1f3938-ec14-4c0e-8f0a-45fb1ea423b3 b/.snapshots/TestInputFromURLScan-be1f3938-ec14-4c0e-8f0a-45fb1ea423b3 index dd06e97f..276210b8 100644 --- a/.snapshots/TestInputFromURLScan-be1f3938-ec14-4c0e-8f0a-45fb1ea423b3 +++ b/.snapshots/TestInputFromURLScan-be1f3938-ec14-4c0e-8f0a-45fb1ea423b3 @@ -1,16 +1,23 @@ (iok.Input) { - Title: (string) (len=32) "Attention Required! | Cloudflare", + Title: ([]string) (len=2) { + (string) (len=32) "Attention Required! | Cloudflare", + (string) (len=32) "Attention Required! | Cloudflare" + }, Hostname: (string) (len=20) "www.bdswissasias.com", DOM: (string) (len=4176) "\nAttention Required! | Cloudflare\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n
Please enable cookies.
\n
\n
\n

Sorry, you have been blocked

\n

You are unable to access bdswissasias.com

\n
\n\n
\n
\n
\n \n \n \n
\n
\n
\n\n
\n
\n
\n

Why have I been blocked?

\n\n

This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

\n
\n\n
\n

What can I do to resolve this?

\n\n

You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

\n
\n
\n
\n\n
\n

\n Cloudflare Ray ID: 7e8b4af3d80bb7ef\n •\n \n Your IP:\n \n 2a00:1630:2:608::9\n •\n \n Performance & security by Cloudflare\n \n

\n \n
\n\n\n
\n
\n\n \n\n\n\n", HTML: (string) (len=4524) "\n\n\n\n \n\nAttention Required! | Cloudflare\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n
Please enable cookies.
\n
\n
\n

Sorry, you have been blocked

\n

You are unable to access bdswissasias.com

\n
\n\n
\n
\n
\n \n \n \n
\n
\n
\n\n
\n
\n
\n

Why have I been blocked?

\n\n

This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

\n
\n\n
\n

What can I do to resolve this?

\n\n

You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

\n
\n
\n
\n\n
\n

\n Cloudflare Ray ID: 7e8b4af3d80bb7ef\n •\n \n Performance & security by Cloudflare\n \n

\n \n
\n\n\n
\n
\n\n \n\n\n\n", - JS: ([]string) (len=3) { + JS: ([]string) (len=6) { + (string) (len=210) "\n if (!navigator.cookieEnabled) {\n window.addEventListener('DOMContentLoaded', function () {\n var cookieEl = document.getElementById('cookie-alert');\n cookieEl.style.display = 'block';\n })\n }\n", (string) (len=210) "\n if (!navigator.cookieEnabled) {\n window.addEventListener('DOMContentLoaded', function () {\n var cookieEl = document.getElementById('cookie-alert');\n cookieEl.style.display = 'block';\n })\n }\n", + (string) (len=38) "\n window._cf_translation = {};\n \n \n", + (string) (len=38) "\n window._cf_translation = {};\n \n \n", (string) (len=375) "(function(){function d(){var b=a.getElementById(\"cf-footer-item-ip\"),c=a.getElementById(\"cf-footer-ip-reveal\");b&&\"classList\"in b&&(b.classList.remove(\"hidden\"),c.addEventListener(\"click\",function(){c.classList.add(\"hidden\");a.getElementById(\"cf-footer-ip\").classList.remove(\"hidden\")}))}var a=document;document.addEventListener&&a.addEventListener(\"DOMContentLoaded\",d)})();", - (string) (len=38) "\n window._cf_translation = {};\n \n \n" + (string) (len=375) "(function(){function d(){var b=a.getElementById(\"cf-footer-item-ip\"),c=a.getElementById(\"cf-footer-ip-reveal\");b&&\"classList\"in b&&(b.classList.remove(\"hidden\"),c.addEventListener(\"click\",function(){c.classList.add(\"hidden\");a.getElementById(\"cf-footer-ip\").classList.remove(\"hidden\")}))}var a=document;document.addEventListener&&a.addEventListener(\"DOMContentLoaded\",d)})();" }, - CSS: ([]string) (len=2) { + CSS: ([]string) (len=3) { + (string) (len=24132) "#cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapper del,#cf-wrapper details,#cf-wrapper dfn,#cf-wrapper div,#cf-wrapper dl,#cf-wrapper dt,#cf-wrapper em,#cf-wrapper embed,#cf-wrapper fieldset,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper form,#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper html,#cf-wrapper i,#cf-wrapper iframe,#cf-wrapper img,#cf-wrapper label,#cf-wrapper legend,#cf-wrapper li,#cf-wrapper mark,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper object,#cf-wrapper ol,#cf-wrapper output,#cf-wrapper p,#cf-wrapper pre,#cf-wrapper s,#cf-wrapper samp,#cf-wrapper section,#cf-wrapper small,#cf-wrapper span,#cf-wrapper strike,#cf-wrapper strong,#cf-wrapper sub,#cf-wrapper summary,#cf-wrapper sup,#cf-wrapper table,#cf-wrapper tbody,#cf-wrapper td,#cf-wrapper tfoot,#cf-wrapper th,#cf-wrapper thead,#cf-wrapper tr,#cf-wrapper tt,#cf-wrapper u,#cf-wrapper ul{margin:0;padding:0;border:0;font:inherit;font-size:100%;text-decoration:none;vertical-align:baseline}#cf-wrapper a img{border:none}#cf-wrapper article,#cf-wrapper aside,#cf-wrapper details,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper section,#cf-wrapper summary{display:block}#cf-wrapper .cf-columns:after,#cf-wrapper .cf-columns:before,#cf-wrapper .cf-section:after,#cf-wrapper .cf-section:before,#cf-wrapper .cf-wrapper:after,#cf-wrapper .cf-wrapper:before,#cf-wrapper .clearfix:after,#cf-wrapper .clearfix:before,#cf-wrapper section:after,#cf-wrapper section:before{content:\" \";display:table}#cf-wrapper .cf-columns:after,#cf-wrapper .cf-section:after,#cf-wrapper .cf-wrapper:after,#cf-wrapper .clearfix:after,#cf-wrapper section:after{clear:both}#cf-wrapper{display:block;margin:0;padding:0;position:relative;text-align:left;width:100%;z-index:999999999;color:#404040!important;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Helvetica Neue,Arial,sans-serif!important;font-size:15px!important;line-height:1.5!important;text-decoration:none!important;letter-spacing:normal;-webkit-tap-highlight-color:rgba(246,139,31,.3);-webkit-font-smoothing:antialiased}#cf-wrapper .cf-section,#cf-wrapper section{background:0 0;display:block;margin-bottom:2em;margin-top:2em}#cf-wrapper .cf-wrapper{margin-left:auto;margin-right:auto;width:90%}#cf-wrapper .cf-columns{display:block;list-style:none;padding:0;width:100%}#cf-wrapper .cf-columns img,#cf-wrapper .cf-columns input,#cf-wrapper .cf-columns object,#cf-wrapper .cf-columns select,#cf-wrapper .cf-columns textarea{max-width:100%}#cf-wrapper .cf-columns>.cf-column{float:left;padding-bottom:45px;width:100%;box-sizing:border-box}@media screen and (min-width:49.2em){#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(n+4),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.four>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.three>.cf-column:nth-child(n+4),#cf-wrapper .cf-columns.two>.cf-column:nth-child(n+3){padding-top:67.5px}#cf-wrapper .cf-columns>.cf-column{padding-bottom:0}#cf-wrapper .cf-columns.cols-2>.cf-column,#cf-wrapper .cf-columns.cols-4>.cf-column,#cf-wrapper .cf-columns.four>.cf-column,#cf-wrapper .cf-columns.two>.cf-column{padding-left:0;padding-right:22.5px;width:50%}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.four>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.two>.cf-column:nth-child(2n){padding-left:22.5px;padding-right:0}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.two>.cf-column:nth-child(odd){clear:left}#cf-wrapper .cf-columns.cols-3>.cf-column,#cf-wrapper .cf-columns.three>.cf-column{padding-left:30px;width:33.3333333333333%}#cf-wrapper .cf-columns.cols-3>.cf-column:first-child,#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(3n+1),#cf-wrapper .cf-columns.three>.cf-column:first-child,#cf-wrapper .cf-columns.three>.cf-column:nth-child(3n+1){clear:left;padding-left:0;padding-right:30px}#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(3n+2),#cf-wrapper .cf-columns.three>.cf-column:nth-child(3n+2){padding-left:15px;padding-right:15px}#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(-n+3),#cf-wrapper .cf-columns.three>.cf-column:nth-child(-n+3){padding-top:0}}@media screen and (min-width:66em){#cf-wrapper .cf-columns>.cf-column{padding-bottom:0}#cf-wrapper .cf-columns.cols-4>.cf-column,#cf-wrapper .cf-columns.four>.cf-column{padding-left:33.75px;width:25%}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd){clear:none}#cf-wrapper .cf-columns.cols-4>.cf-column:first-child,#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+1),#cf-wrapper .cf-columns.four>.cf-column:first-child,#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+1){clear:left;padding-left:0;padding-right:33.75px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+2),#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+2){padding-left:11.25px;padding-right:22.5px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+3),#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+3){padding-left:22.5px;padding-right:11.25px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(n+5),#cf-wrapper .cf-columns.four>.cf-column:nth-child(n+5){padding-top:67.5px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(-n+4),#cf-wrapper .cf-columns.four>.cf-column:nth-child(-n+4){padding-top:0}}#cf-wrapper a{background:0 0;border:0;color:#0051c3;outline:0;text-decoration:none;-webkit-transition:all .15s ease;transition:all .15s ease}#cf-wrapper a:hover{background:0 0;border:0;color:#f68b1f}#cf-wrapper a:focus{background:0 0;border:0;color:#62a1d8;outline:0}#cf-wrapper a:active{background:0 0;border:0;color:#c16508;outline:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper p{color:#404040;margin:0;padding:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3{font-weight:400}#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper strong{font-weight:600}#cf-wrapper h1{font-size:36px;line-height:1.2}#cf-wrapper h2{font-size:30px;line-height:1.3}#cf-wrapper h3{font-size:25px;line-height:1.3}#cf-wrapper h4{font-size:20px;line-height:1.3}#cf-wrapper h5{font-size:15px}#cf-wrapper h6{font-size:13px}#cf-wrapper ol,#cf-wrapper ul{list-style:none;margin-left:3em}#cf-wrapper ul{list-style-type:disc}#cf-wrapper ol{list-style-type:decimal}#cf-wrapper em{font-style:italic}#cf-wrapper .cf-subheadline{color:#595959;font-weight:300}#cf-wrapper .cf-text-error{color:#bd2426}#cf-wrapper .cf-text-success{color:#9bca3e}#cf-wrapper ol+h2,#cf-wrapper ol+h3,#cf-wrapper ol+h4,#cf-wrapper ol+h5,#cf-wrapper ol+h6,#cf-wrapper ol+p,#cf-wrapper p+dl,#cf-wrapper p+ol,#cf-wrapper p+p,#cf-wrapper p+table,#cf-wrapper p+ul,#cf-wrapper ul+h2,#cf-wrapper ul+h3,#cf-wrapper ul+h4,#cf-wrapper ul+h5,#cf-wrapper ul+h6,#cf-wrapper ul+p{margin-top:1.5em}#cf-wrapper h1+p,#cf-wrapper p+h1,#cf-wrapper p+h2,#cf-wrapper p+h3,#cf-wrapper p+h4,#cf-wrapper p+h5,#cf-wrapper p+h6{margin-top:1.25em}#cf-wrapper h1+h2,#cf-wrapper h1+h3,#cf-wrapper h2+h3,#cf-wrapper h3+h4,#cf-wrapper h4+h5{margin-top:.25em}#cf-wrapper h2+p{margin-top:1em}#cf-wrapper h1+h4,#cf-wrapper h1+h5,#cf-wrapper h1+h6,#cf-wrapper h2+h4,#cf-wrapper h2+h5,#cf-wrapper h2+h6,#cf-wrapper h3+h5,#cf-wrapper h3+h6,#cf-wrapper h3+p,#cf-wrapper h4+p,#cf-wrapper h5+ol,#cf-wrapper h5+p,#cf-wrapper h5+ul{margin-top:.5em}#cf-wrapper .cf-btn{background-color:transparent;border:1px solid #999;color:#404040;font-size:14px;font-weight:400;line-height:1.2;margin:0;padding:.6em 1.33333em .53333em;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1;border-radius:2px;box-sizing:border-box;-webkit-transition:all .2s ease;transition:all .2s ease}#cf-wrapper .cf-btn:hover{background-color:#bfbfbf;border:1px solid #737373;color:#fff}#cf-wrapper .cf-btn:focus{color:inherit;outline:0;box-shadow:inset 0 0 4px rgba(0,0,0,.3)}#cf-wrapper .cf-btn.active,#cf-wrapper .cf-btn:active{background-color:#bfbfbf;border:1px solid #404040;color:#272727}#cf-wrapper .cf-btn::-moz-focus-inner{padding:0;border:0}#cf-wrapper .cf-btn .cf-caret{border-top-color:currentColor;margin-left:.25em;margin-top:.18333em}#cf-wrapper .cf-btn-primary{background-color:#2f7bbf;border:1px solid transparent;color:#fff}#cf-wrapper .cf-btn-primary:hover{background-color:#62a1d8;border:1px solid #2f7bbf;color:#fff}#cf-wrapper .cf-btn-primary.active,#cf-wrapper .cf-btn-primary:active,#cf-wrapper .cf-btn-primary:focus{background-color:#62a1d8;border:1px solid #163959;color:#fff}#cf-wrapper .cf-btn-danger,#cf-wrapper .cf-btn-error,#cf-wrapper .cf-btn-important{background-color:#bd2426;border-color:transparent;color:#fff}#cf-wrapper .cf-btn-danger:hover,#cf-wrapper .cf-btn-error:hover,#cf-wrapper .cf-btn-important:hover{background-color:#de5052;border-color:#bd2426;color:#fff}#cf-wrapper .cf-btn-danger.active,#cf-wrapper .cf-btn-danger:active,#cf-wrapper .cf-btn-danger:focus,#cf-wrapper .cf-btn-error.active,#cf-wrapper .cf-btn-error:active,#cf-wrapper .cf-btn-error:focus,#cf-wrapper .cf-btn-important.active,#cf-wrapper .cf-btn-important:active,#cf-wrapper .cf-btn-important:focus{background-color:#de5052;border-color:#521010;color:#fff}#cf-wrapper .cf-btn-accept,#cf-wrapper .cf-btn-success{background-color:#9bca3e;border:1px solid transparent;color:#fff}#cf-wrapper .cf-btn-accept:hover,#cf-wrapper .cf-btn-success:hover{background-color:#bada7a;border:1px solid #9bca3e;color:#fff}#cf-wrapper .active.cf-btn-accept,#cf-wrapper .cf-btn-accept:active,#cf-wrapper .cf-btn-accept:focus,#cf-wrapper .cf-btn-success.active,#cf-wrapper .cf-btn-success:active,#cf-wrapper .cf-btn-success:focus{background-color:#bada7a;border:1px solid #516b1d;color:#fff}#cf-wrapper .cf-btn-accept{color:transparent;font-size:0;height:36.38px;overflow:hidden;position:relative;text-indent:0;width:36.38px;white-space:nowrap}#cf-wrapper input,#cf-wrapper select,#cf-wrapper textarea{background:#fff!important;border:1px solid #999!important;color:#404040!important;font-size:.86667em!important;line-height:1.24!important;margin:0 0 1em!important;max-width:100%!important;outline:0!important;padding:.45em .75em!important;vertical-align:middle!important;display:-moz-inline-stack;display:inline-block;zoom:1;box-sizing:border-box;-webkit-transition:all .2s ease;transition:all .2s ease;border-radius:2px}#cf-wrapper input:hover,#cf-wrapper select:hover,#cf-wrapper textarea:hover{border-color:gray}#cf-wrapper input:focus,#cf-wrapper select:focus,#cf-wrapper textarea:focus{border-color:#2f7bbf;outline:0;box-shadow:0 0 8px rgba(47,123,191,.5)}#cf-wrapper fieldset{width:100%}#cf-wrapper label{display:block;font-size:13px;margin-bottom:.38333em}#cf-wrapper .cf-form-stacked .select2-container,#cf-wrapper .cf-form-stacked input,#cf-wrapper .cf-form-stacked select,#cf-wrapper .cf-form-stacked textarea{display:block;width:100%}#cf-wrapper .cf-form-stacked input[type=button],#cf-wrapper .cf-form-stacked input[type=checkbox],#cf-wrapper .cf-form-stacked input[type=submit]{display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1;width:auto}#cf-wrapper .cf-form-actions{text-align:right}#cf-wrapper .cf-alert{background-color:#f9b169;border:1px solid #904b06;color:#404040;font-size:13px;padding:7.5px 15px;position:relative;vertical-align:middle;border-radius:2px}#cf-wrapper .cf-alert:empty{display:none}#cf-wrapper .cf-alert .cf-close{border:1px solid transparent;color:inherit;font-size:18.75px;line-height:1;padding:0;position:relative;right:-18.75px;top:0}#cf-wrapper .cf-alert .cf-close:hover{background-color:transparent;border-color:currentColor;color:inherit}#cf-wrapper .cf-alert-danger,#cf-wrapper .cf-alert-error{background-color:#de5052;border-color:#521010;color:#fff}#cf-wrapper .cf-alert-success{background-color:#bada7a;border-color:#516b1d;color:#516b1d}#cf-wrapper .cf-alert-warning{background-color:#f9b169;border-color:#904b06;color:#404040}#cf-wrapper .cf-alert-info{background-color:#62a1d8;border-color:#163959;color:#163959}#cf-wrapper .cf-alert-nonessential{background-color:#ebebeb;border-color:#999;color:#404040}#cf-wrapper .cf-icon-exclamation-sign{background:url(/cdn-cgi/images/icon-exclamation.png?1376755637) 50% no-repeat;height:54px;width:54px;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}#cf-wrapper h1 .cf-icon-exclamation-sign{margin-top:-10px}#cf-wrapper #cf-error-banner{background-color:#fff;border-bottom:3px solid #f68b1f;padding:15px 15px 20px;position:relative;z-index:999999999;box-shadow:0 2px 8px rgba(0,0,0,.2)}#cf-wrapper #cf-error-banner h4,#cf-wrapper #cf-error-banner p{display:-moz-inline-stack;display:inline-block;vertical-align:bottom;zoom:1}#cf-wrapper #cf-error-banner h4{color:#2f7bbf;font-weight:400;font-size:20px;line-height:1;vertical-align:baseline}#cf-wrapper #cf-error-banner .cf-error-actions{margin-bottom:10px;text-align:center;width:100%}#cf-wrapper #cf-error-banner .cf-error-actions a{display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}#cf-wrapper #cf-error-banner .cf-error-actions a+a{margin-left:10px}#cf-wrapper #cf-error-banner .cf-error-actions .cf-btn-accept,#cf-wrapper #cf-error-banner .cf-error-actions .cf-btn-success{color:#fff}#cf-wrapper #cf-error-banner .error-header-desc{text-align:left}#cf-wrapper #cf-error-banner .cf-close{color:#999;cursor:pointer;display:inline-block;font-size:34.5px;float:none;font-weight:700;height:22.5px;line-height:.6;overflow:hidden;position:absolute;right:20px;top:25px;text-indent:200%;width:22.5px}#cf-wrapper #cf-error-banner .cf-close:hover{color:gray}#cf-wrapper #cf-error-banner .cf-close:before{content:\"\\00D7\";left:0;height:100%;position:absolute;text-align:center;text-indent:0;top:0;width:100%}#cf-inline-error-wrapper{box-shadow:0 2px 10px rgba(0,0,0,.5)}#cf-wrapper #cf-error-details{background:#fff}#cf-wrapper #cf-error-details .cf-error-overview{padding:25px 0 0}#cf-wrapper #cf-error-details .cf-error-overview h1,#cf-wrapper #cf-error-details .cf-error-overview h2{font-weight:300}#cf-wrapper #cf-error-details .cf-error-overview h2{margin-top:0}#cf-wrapper #cf-error-details .cf-highlight{background:#ebebeb;overflow-x:hidden;padding:30px 0;background-image:-webkit-gradient(linear,left top, left bottom,from(#dedede),color-stop(3%, #ebebeb),color-stop(97%, #ebebeb),to(#dedede));background-image:linear-gradient(top,#dedede,#ebebeb 3%,#ebebeb 97%,#dedede)}#cf-wrapper #cf-error-details .cf-highlight h3{color:#999;font-weight:300}#cf-wrapper #cf-error-details .cf-highlight .cf-column:last-child{padding-bottom:0}#cf-wrapper #cf-error-details .cf-highlight .cf-highlight-inverse{background-color:#fff;padding:15px;border-radius:2px}#cf-wrapper #cf-error-details .cf-status-display h3{margin-top:.5em}#cf-wrapper #cf-error-details .cf-status-label{color:#9bca3e;font-size:1.46667em}#cf-wrapper #cf-error-details .cf-status-label,#cf-wrapper #cf-error-details .cf-status-name{display:inline}#cf-wrapper #cf-error-details .cf-status-item{display:block;position:relative;text-align:left}#cf-wrapper #cf-error-details .cf-status-item,#cf-wrapper #cf-error-details .cf-status-item.cf-column{padding-bottom:1.5em}#cf-wrapper #cf-error-details .cf-status-item.cf-error-source{display:block;text-align:center}#cf-wrapper #cf-error-details .cf-status-item.cf-error-source:after{bottom:-60px;content:\"\";display:none;border-bottom:18px solid #fff;border-left:20px solid transparent;border-right:20px solid transparent;height:0;left:50%;margin-left:-9px;position:absolute;right:50%;width:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item{border-top:1px solid #dedede;padding-top:1.5em}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background:url(/cdn-cgi/images/cf-icon-horizontal-arrow.png) no-repeat;content:\"\";display:block;left:0;position:absolute;top:25.67px}#cf-wrapper #cf-error-details .cf-error-source .cf-icon-error-container{height:85px;margin-bottom:2.5em}#cf-wrapper #cf-error-details .cf-error-source .cf-status-label{color:#bd2426}#cf-wrapper #cf-error-details .cf-error-source .cf-icon{display:block}#cf-wrapper #cf-error-details .cf-error-source .cf-icon-status{bottom:-10px;left:50%;top:auto;right:auto}#cf-wrapper #cf-error-details .cf-error-source .cf-status-label,#cf-wrapper #cf-error-details .cf-error-source .cf-status-name{display:block}#cf-wrapper #cf-error-details .cf-icon-error-container{height:auto;position:relative}#cf-wrapper #cf-error-details .cf-icon-status{display:block;margin-left:-24px;position:absolute;top:0;right:0}#cf-wrapper #cf-error-details .cf-icon{display:none;margin:0 auto}#cf-wrapper #cf-error-details .cf-status-desc{display:block;height:22.5px;overflow:hidden;text-overflow:ellipsis;width:100%;white-space:nowrap}#cf-wrapper #cf-error-details .cf-status-desc:empty{display:none}#cf-wrapper #cf-error-details .cf-error-footer{padding:1.33333em 0;border-top:1px solid #ebebeb;text-align:center}#cf-wrapper #cf-error-details .cf-error-footer p{font-size:13px}#cf-wrapper #cf-error-details .cf-error-footer select{margin:0!important}#cf-wrapper #cf-error-details .cf-footer-item{display:block;margin-bottom:5px;text-align:left}#cf-wrapper #cf-error-details .cf-footer-separator{display:none}#cf-wrapper #cf-error-details .cf-captcha-info{margin-bottom:10px;position:relative;text-align:center}#cf-wrapper #cf-error-details .cf-captcha-image{height:57px;width:300px}#cf-wrapper #cf-error-details .cf-captcha-actions{margin-top:15px}#cf-wrapper #cf-error-details .cf-captcha-actions a{font-size:0;height:36.38px;overflow:hidden;padding-left:1.2em;padding-right:1.2em;position:relative;text-indent:-9999px;width:36.38px;white-space:nowrap}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-refresh span{background-position:0 -787px}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-announce span{background-position:0 -767px}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-question span{background-position:0 -827px}#cf-wrapper #cf-error-details .cf-screenshot-container{background:url(/cdn-cgi/images/browser-bar.png?1376755637) no-repeat #fff;max-height:400px;max-width:100%;overflow:hidden;padding-top:53px;width:960px;border-radius:5px 5px 0 0}#cf-wrapper #cf-error-details .cf-screenshot-container .cf-no-screenshot{background:url(/cdn-cgi/images/cf-no-screenshot-warn.png) no-repeat;display:block;height:158px;left:25%;margin-top:-79px;overflow:hidden;position:relative;top:50%;width:178px}#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container,#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container img,#recaptcha-widget .cf-alert,#recaptcha-widget .recaptcha_only_if_audio,.cf-cookie-error{display:none}#cf-wrapper #cf-error-details .cf-screenshot-container .cf-no-screenshot.error{background:url(/cdn-cgi/images/cf-no-screenshot-error.png) no-repeat;height:175px}#cf-wrapper #cf-error-details .cf-screenshot-container.cf-screenshot-full .cf-no-screenshot{left:50%;margin-left:-89px}.cf-captcha-info iframe{max-width:100%}#cf-wrapper .cf-icon-ok{background:url(/cdn-cgi/images/cf-icon-ok.png) no-repeat;height:48px;width:48px}#cf-wrapper .cf-icon-error{background:url(/cdn-cgi/images/cf-icon-error.png) no-repeat;height:48px;width:48px}#cf-wrapper .cf-icon-browser{background:url(/cdn-cgi/images/cf-icon-browser.png) no-repeat;height:80px;width:100px}#cf-wrapper .cf-icon-cloud{background:url(/cdn-cgi/images/cf-icon-cloud.png) no-repeat;height:77px;width:151px}#cf-wrapper .cf-icon-server{background:url(/cdn-cgi/images/cf-icon-server.png) no-repeat;height:75px;width:95px}#cf-wrapper .cf-icon-railgun{background-position:0 -848px;height:81px;width:95px}#cf-wrapper .cf-caret{border:.33333em solid transparent;border-top-color:inherit;content:\"\";height:0;width:0;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}@media screen and (min-width:49.2em){#cf-wrapper #cf-error-details .cf-status-desc:empty,#cf-wrapper #cf-error-details .cf-status-item.cf-error-source:after,#cf-wrapper #cf-error-details .cf-status-item .cf-icon,#cf-wrapper #cf-error-details .cf-status-label,#cf-wrapper #cf-error-details .cf-status-name{display:block}#cf-wrapper .cf-wrapper{width:708px}#cf-wrapper #cf-error-banner{padding:20px 20px 25px}#cf-wrapper #cf-error-banner .cf-error-actions{margin-bottom:15px}#cf-wrapper #cf-error-banner .cf-error-header-desc h4{margin-right:.5em}#cf-wrapper #cf-error-details h1{font-size:4em}#cf-wrapper #cf-error-details .cf-error-overview{padding-top:2.33333em}#cf-wrapper #cf-error-details .cf-highlight{padding:4em 0}#cf-wrapper #cf-error-details .cf-status-item{text-align:center}#cf-wrapper #cf-error-details .cf-status-item,#cf-wrapper #cf-error-details .cf-status-item.cf-column{padding-bottom:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item{border:0;padding-top:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background-position:0 -544px;height:24.75px;margin-left:-37.5px;width:75px;background-size:131.25px auto}#cf-wrapper #cf-error-details .cf-icon-error-container{height:85px;margin-bottom:2.5em}#cf-wrapper #cf-error-details .cf-icon-status{bottom:-10px;left:50%;top:auto;right:auto}#cf-wrapper #cf-error-details .cf-error-footer{padding:2.66667em 0}#cf-wrapper #cf-error-details .cf-footer-item,#cf-wrapper #cf-error-details .cf-footer-separator{display:-moz-inline-stack;display:inline-block;vertical-align:baseline;zoom:1}#cf-wrapper #cf-error-details .cf-footer-separator{padding:0 .25em}#cf-wrapper #cf-error-details .cf-status-item.cloudflare-status:before{margin-left:-50px}#cf-wrapper #cf-error-details .cf-status-item.cloudflare-status+.status-item:before{margin-left:-25px}#cf-wrapper #cf-error-details .cf-screenshot-container{height:400px;margin-bottom:-4em;max-width:none}#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container,#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container img{display:block}}@media screen and (min-width:66em){#cf-wrapper .cf-wrapper{width:960px}#cf-wrapper #cf-error-banner .cf-close{position:relative;right:auto;top:auto}#cf-wrapper #cf-error-banner .cf-details{white-space:nowrap}#cf-wrapper #cf-error-banner .cf-details-link{padding-right:.5em}#cf-wrapper #cf-error-banner .cf-error-actions{float:right;margin-bottom:0;text-align:left;width:auto}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background-position:0 -734px;height:33px;margin-left:-50px;width:100px;background-size:auto}#cf-wrapper #cf-error-details .cf-status-item.cf-cloudflare-status:before{margin-left:-66.67px}#cf-wrapper #cf-error-details .cf-status-item.cf-cloudflare-status+.cf-status-item:before{margin-left:-37.5px}#cf-wrapper #cf-error-details .cf-captcha-image{float:left}#cf-wrapper #cf-error-details .cf-captcha-actions{position:absolute;top:0;right:0}}.no-js #cf-wrapper .js-only{display:none}#cf-wrapper #cf-error-details .heading-ray-id{font-family:monaco,courier,monospace;font-size:15px;white-space:nowrap} #cf-wrapper #cf-error-details .cf-footer-item.hidden,.cf-error-footer .hidden{display:none} .cf-error-footer .cf-footer-ip-reveal-btn{-webkit-appearance:button;-moz-appearance:button;appearance:button;text-decoration:none;background:none;color:inherit;border:none;padding:0;font:inherit;cursor:pointer;color:#0051c3;-webkit-transition:color .15s ease;transition:color .15s ease}.cf-error-footer .cf-footer-ip-reveal-btn:hover{color:#ee730a}\n", (string) (len=24) "body{margin:0;padding:0}", - (string) (len=24132) "#cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapper del,#cf-wrapper details,#cf-wrapper dfn,#cf-wrapper div,#cf-wrapper dl,#cf-wrapper dt,#cf-wrapper em,#cf-wrapper embed,#cf-wrapper fieldset,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper form,#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper html,#cf-wrapper i,#cf-wrapper iframe,#cf-wrapper img,#cf-wrapper label,#cf-wrapper legend,#cf-wrapper li,#cf-wrapper mark,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper object,#cf-wrapper ol,#cf-wrapper output,#cf-wrapper p,#cf-wrapper pre,#cf-wrapper s,#cf-wrapper samp,#cf-wrapper section,#cf-wrapper small,#cf-wrapper span,#cf-wrapper strike,#cf-wrapper strong,#cf-wrapper sub,#cf-wrapper summary,#cf-wrapper sup,#cf-wrapper table,#cf-wrapper tbody,#cf-wrapper td,#cf-wrapper tfoot,#cf-wrapper th,#cf-wrapper thead,#cf-wrapper tr,#cf-wrapper tt,#cf-wrapper u,#cf-wrapper ul{margin:0;padding:0;border:0;font:inherit;font-size:100%;text-decoration:none;vertical-align:baseline}#cf-wrapper a img{border:none}#cf-wrapper article,#cf-wrapper aside,#cf-wrapper details,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper section,#cf-wrapper summary{display:block}#cf-wrapper .cf-columns:after,#cf-wrapper .cf-columns:before,#cf-wrapper .cf-section:after,#cf-wrapper .cf-section:before,#cf-wrapper .cf-wrapper:after,#cf-wrapper .cf-wrapper:before,#cf-wrapper .clearfix:after,#cf-wrapper .clearfix:before,#cf-wrapper section:after,#cf-wrapper section:before{content:\" \";display:table}#cf-wrapper .cf-columns:after,#cf-wrapper .cf-section:after,#cf-wrapper .cf-wrapper:after,#cf-wrapper .clearfix:after,#cf-wrapper section:after{clear:both}#cf-wrapper{display:block;margin:0;padding:0;position:relative;text-align:left;width:100%;z-index:999999999;color:#404040!important;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Helvetica Neue,Arial,sans-serif!important;font-size:15px!important;line-height:1.5!important;text-decoration:none!important;letter-spacing:normal;-webkit-tap-highlight-color:rgba(246,139,31,.3);-webkit-font-smoothing:antialiased}#cf-wrapper .cf-section,#cf-wrapper section{background:0 0;display:block;margin-bottom:2em;margin-top:2em}#cf-wrapper .cf-wrapper{margin-left:auto;margin-right:auto;width:90%}#cf-wrapper .cf-columns{display:block;list-style:none;padding:0;width:100%}#cf-wrapper .cf-columns img,#cf-wrapper .cf-columns input,#cf-wrapper .cf-columns object,#cf-wrapper .cf-columns select,#cf-wrapper .cf-columns textarea{max-width:100%}#cf-wrapper .cf-columns>.cf-column{float:left;padding-bottom:45px;width:100%;box-sizing:border-box}@media screen and (min-width:49.2em){#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(n+4),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.four>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.three>.cf-column:nth-child(n+4),#cf-wrapper .cf-columns.two>.cf-column:nth-child(n+3){padding-top:67.5px}#cf-wrapper .cf-columns>.cf-column{padding-bottom:0}#cf-wrapper .cf-columns.cols-2>.cf-column,#cf-wrapper .cf-columns.cols-4>.cf-column,#cf-wrapper .cf-columns.four>.cf-column,#cf-wrapper .cf-columns.two>.cf-column{padding-left:0;padding-right:22.5px;width:50%}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.four>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.two>.cf-column:nth-child(2n){padding-left:22.5px;padding-right:0}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.two>.cf-column:nth-child(odd){clear:left}#cf-wrapper .cf-columns.cols-3>.cf-column,#cf-wrapper .cf-columns.three>.cf-column{padding-left:30px;width:33.3333333333333%}#cf-wrapper .cf-columns.cols-3>.cf-column:first-child,#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(3n+1),#cf-wrapper .cf-columns.three>.cf-column:first-child,#cf-wrapper .cf-columns.three>.cf-column:nth-child(3n+1){clear:left;padding-left:0;padding-right:30px}#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(3n+2),#cf-wrapper .cf-columns.three>.cf-column:nth-child(3n+2){padding-left:15px;padding-right:15px}#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(-n+3),#cf-wrapper .cf-columns.three>.cf-column:nth-child(-n+3){padding-top:0}}@media screen and (min-width:66em){#cf-wrapper .cf-columns>.cf-column{padding-bottom:0}#cf-wrapper .cf-columns.cols-4>.cf-column,#cf-wrapper .cf-columns.four>.cf-column{padding-left:33.75px;width:25%}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd){clear:none}#cf-wrapper .cf-columns.cols-4>.cf-column:first-child,#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+1),#cf-wrapper .cf-columns.four>.cf-column:first-child,#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+1){clear:left;padding-left:0;padding-right:33.75px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+2),#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+2){padding-left:11.25px;padding-right:22.5px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+3),#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+3){padding-left:22.5px;padding-right:11.25px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(n+5),#cf-wrapper .cf-columns.four>.cf-column:nth-child(n+5){padding-top:67.5px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(-n+4),#cf-wrapper .cf-columns.four>.cf-column:nth-child(-n+4){padding-top:0}}#cf-wrapper a{background:0 0;border:0;color:#0051c3;outline:0;text-decoration:none;-webkit-transition:all .15s ease;transition:all .15s ease}#cf-wrapper a:hover{background:0 0;border:0;color:#f68b1f}#cf-wrapper a:focus{background:0 0;border:0;color:#62a1d8;outline:0}#cf-wrapper a:active{background:0 0;border:0;color:#c16508;outline:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper p{color:#404040;margin:0;padding:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3{font-weight:400}#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper strong{font-weight:600}#cf-wrapper h1{font-size:36px;line-height:1.2}#cf-wrapper h2{font-size:30px;line-height:1.3}#cf-wrapper h3{font-size:25px;line-height:1.3}#cf-wrapper h4{font-size:20px;line-height:1.3}#cf-wrapper h5{font-size:15px}#cf-wrapper h6{font-size:13px}#cf-wrapper ol,#cf-wrapper ul{list-style:none;margin-left:3em}#cf-wrapper ul{list-style-type:disc}#cf-wrapper ol{list-style-type:decimal}#cf-wrapper em{font-style:italic}#cf-wrapper .cf-subheadline{color:#595959;font-weight:300}#cf-wrapper .cf-text-error{color:#bd2426}#cf-wrapper .cf-text-success{color:#9bca3e}#cf-wrapper ol+h2,#cf-wrapper ol+h3,#cf-wrapper ol+h4,#cf-wrapper ol+h5,#cf-wrapper ol+h6,#cf-wrapper ol+p,#cf-wrapper p+dl,#cf-wrapper p+ol,#cf-wrapper p+p,#cf-wrapper p+table,#cf-wrapper p+ul,#cf-wrapper ul+h2,#cf-wrapper ul+h3,#cf-wrapper ul+h4,#cf-wrapper ul+h5,#cf-wrapper ul+h6,#cf-wrapper ul+p{margin-top:1.5em}#cf-wrapper h1+p,#cf-wrapper p+h1,#cf-wrapper p+h2,#cf-wrapper p+h3,#cf-wrapper p+h4,#cf-wrapper p+h5,#cf-wrapper p+h6{margin-top:1.25em}#cf-wrapper h1+h2,#cf-wrapper h1+h3,#cf-wrapper h2+h3,#cf-wrapper h3+h4,#cf-wrapper h4+h5{margin-top:.25em}#cf-wrapper h2+p{margin-top:1em}#cf-wrapper h1+h4,#cf-wrapper h1+h5,#cf-wrapper h1+h6,#cf-wrapper h2+h4,#cf-wrapper h2+h5,#cf-wrapper h2+h6,#cf-wrapper h3+h5,#cf-wrapper h3+h6,#cf-wrapper h3+p,#cf-wrapper h4+p,#cf-wrapper h5+ol,#cf-wrapper h5+p,#cf-wrapper h5+ul{margin-top:.5em}#cf-wrapper .cf-btn{background-color:transparent;border:1px solid #999;color:#404040;font-size:14px;font-weight:400;line-height:1.2;margin:0;padding:.6em 1.33333em .53333em;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1;border-radius:2px;box-sizing:border-box;-webkit-transition:all .2s ease;transition:all .2s ease}#cf-wrapper .cf-btn:hover{background-color:#bfbfbf;border:1px solid #737373;color:#fff}#cf-wrapper .cf-btn:focus{color:inherit;outline:0;box-shadow:inset 0 0 4px rgba(0,0,0,.3)}#cf-wrapper .cf-btn.active,#cf-wrapper .cf-btn:active{background-color:#bfbfbf;border:1px solid #404040;color:#272727}#cf-wrapper .cf-btn::-moz-focus-inner{padding:0;border:0}#cf-wrapper .cf-btn .cf-caret{border-top-color:currentColor;margin-left:.25em;margin-top:.18333em}#cf-wrapper .cf-btn-primary{background-color:#2f7bbf;border:1px solid transparent;color:#fff}#cf-wrapper .cf-btn-primary:hover{background-color:#62a1d8;border:1px solid #2f7bbf;color:#fff}#cf-wrapper .cf-btn-primary.active,#cf-wrapper .cf-btn-primary:active,#cf-wrapper .cf-btn-primary:focus{background-color:#62a1d8;border:1px solid #163959;color:#fff}#cf-wrapper .cf-btn-danger,#cf-wrapper .cf-btn-error,#cf-wrapper .cf-btn-important{background-color:#bd2426;border-color:transparent;color:#fff}#cf-wrapper .cf-btn-danger:hover,#cf-wrapper .cf-btn-error:hover,#cf-wrapper .cf-btn-important:hover{background-color:#de5052;border-color:#bd2426;color:#fff}#cf-wrapper .cf-btn-danger.active,#cf-wrapper .cf-btn-danger:active,#cf-wrapper .cf-btn-danger:focus,#cf-wrapper .cf-btn-error.active,#cf-wrapper .cf-btn-error:active,#cf-wrapper .cf-btn-error:focus,#cf-wrapper .cf-btn-important.active,#cf-wrapper .cf-btn-important:active,#cf-wrapper .cf-btn-important:focus{background-color:#de5052;border-color:#521010;color:#fff}#cf-wrapper .cf-btn-accept,#cf-wrapper .cf-btn-success{background-color:#9bca3e;border:1px solid transparent;color:#fff}#cf-wrapper .cf-btn-accept:hover,#cf-wrapper .cf-btn-success:hover{background-color:#bada7a;border:1px solid #9bca3e;color:#fff}#cf-wrapper .active.cf-btn-accept,#cf-wrapper .cf-btn-accept:active,#cf-wrapper .cf-btn-accept:focus,#cf-wrapper .cf-btn-success.active,#cf-wrapper .cf-btn-success:active,#cf-wrapper .cf-btn-success:focus{background-color:#bada7a;border:1px solid #516b1d;color:#fff}#cf-wrapper .cf-btn-accept{color:transparent;font-size:0;height:36.38px;overflow:hidden;position:relative;text-indent:0;width:36.38px;white-space:nowrap}#cf-wrapper input,#cf-wrapper select,#cf-wrapper textarea{background:#fff!important;border:1px solid #999!important;color:#404040!important;font-size:.86667em!important;line-height:1.24!important;margin:0 0 1em!important;max-width:100%!important;outline:0!important;padding:.45em .75em!important;vertical-align:middle!important;display:-moz-inline-stack;display:inline-block;zoom:1;box-sizing:border-box;-webkit-transition:all .2s ease;transition:all .2s ease;border-radius:2px}#cf-wrapper input:hover,#cf-wrapper select:hover,#cf-wrapper textarea:hover{border-color:gray}#cf-wrapper input:focus,#cf-wrapper select:focus,#cf-wrapper textarea:focus{border-color:#2f7bbf;outline:0;box-shadow:0 0 8px rgba(47,123,191,.5)}#cf-wrapper fieldset{width:100%}#cf-wrapper label{display:block;font-size:13px;margin-bottom:.38333em}#cf-wrapper .cf-form-stacked .select2-container,#cf-wrapper .cf-form-stacked input,#cf-wrapper .cf-form-stacked select,#cf-wrapper .cf-form-stacked textarea{display:block;width:100%}#cf-wrapper .cf-form-stacked input[type=button],#cf-wrapper .cf-form-stacked input[type=checkbox],#cf-wrapper .cf-form-stacked input[type=submit]{display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1;width:auto}#cf-wrapper .cf-form-actions{text-align:right}#cf-wrapper .cf-alert{background-color:#f9b169;border:1px solid #904b06;color:#404040;font-size:13px;padding:7.5px 15px;position:relative;vertical-align:middle;border-radius:2px}#cf-wrapper .cf-alert:empty{display:none}#cf-wrapper .cf-alert .cf-close{border:1px solid transparent;color:inherit;font-size:18.75px;line-height:1;padding:0;position:relative;right:-18.75px;top:0}#cf-wrapper .cf-alert .cf-close:hover{background-color:transparent;border-color:currentColor;color:inherit}#cf-wrapper .cf-alert-danger,#cf-wrapper .cf-alert-error{background-color:#de5052;border-color:#521010;color:#fff}#cf-wrapper .cf-alert-success{background-color:#bada7a;border-color:#516b1d;color:#516b1d}#cf-wrapper .cf-alert-warning{background-color:#f9b169;border-color:#904b06;color:#404040}#cf-wrapper .cf-alert-info{background-color:#62a1d8;border-color:#163959;color:#163959}#cf-wrapper .cf-alert-nonessential{background-color:#ebebeb;border-color:#999;color:#404040}#cf-wrapper .cf-icon-exclamation-sign{background:url(/cdn-cgi/images/icon-exclamation.png?1376755637) 50% no-repeat;height:54px;width:54px;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}#cf-wrapper h1 .cf-icon-exclamation-sign{margin-top:-10px}#cf-wrapper #cf-error-banner{background-color:#fff;border-bottom:3px solid #f68b1f;padding:15px 15px 20px;position:relative;z-index:999999999;box-shadow:0 2px 8px rgba(0,0,0,.2)}#cf-wrapper #cf-error-banner h4,#cf-wrapper #cf-error-banner p{display:-moz-inline-stack;display:inline-block;vertical-align:bottom;zoom:1}#cf-wrapper #cf-error-banner h4{color:#2f7bbf;font-weight:400;font-size:20px;line-height:1;vertical-align:baseline}#cf-wrapper #cf-error-banner .cf-error-actions{margin-bottom:10px;text-align:center;width:100%}#cf-wrapper #cf-error-banner .cf-error-actions a{display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}#cf-wrapper #cf-error-banner .cf-error-actions a+a{margin-left:10px}#cf-wrapper #cf-error-banner .cf-error-actions .cf-btn-accept,#cf-wrapper #cf-error-banner .cf-error-actions .cf-btn-success{color:#fff}#cf-wrapper #cf-error-banner .error-header-desc{text-align:left}#cf-wrapper #cf-error-banner .cf-close{color:#999;cursor:pointer;display:inline-block;font-size:34.5px;float:none;font-weight:700;height:22.5px;line-height:.6;overflow:hidden;position:absolute;right:20px;top:25px;text-indent:200%;width:22.5px}#cf-wrapper #cf-error-banner .cf-close:hover{color:gray}#cf-wrapper #cf-error-banner .cf-close:before{content:\"\\00D7\";left:0;height:100%;position:absolute;text-align:center;text-indent:0;top:0;width:100%}#cf-inline-error-wrapper{box-shadow:0 2px 10px rgba(0,0,0,.5)}#cf-wrapper #cf-error-details{background:#fff}#cf-wrapper #cf-error-details .cf-error-overview{padding:25px 0 0}#cf-wrapper #cf-error-details .cf-error-overview h1,#cf-wrapper #cf-error-details .cf-error-overview h2{font-weight:300}#cf-wrapper #cf-error-details .cf-error-overview h2{margin-top:0}#cf-wrapper #cf-error-details .cf-highlight{background:#ebebeb;overflow-x:hidden;padding:30px 0;background-image:-webkit-gradient(linear,left top, left bottom,from(#dedede),color-stop(3%, #ebebeb),color-stop(97%, #ebebeb),to(#dedede));background-image:linear-gradient(top,#dedede,#ebebeb 3%,#ebebeb 97%,#dedede)}#cf-wrapper #cf-error-details .cf-highlight h3{color:#999;font-weight:300}#cf-wrapper #cf-error-details .cf-highlight .cf-column:last-child{padding-bottom:0}#cf-wrapper #cf-error-details .cf-highlight .cf-highlight-inverse{background-color:#fff;padding:15px;border-radius:2px}#cf-wrapper #cf-error-details .cf-status-display h3{margin-top:.5em}#cf-wrapper #cf-error-details .cf-status-label{color:#9bca3e;font-size:1.46667em}#cf-wrapper #cf-error-details .cf-status-label,#cf-wrapper #cf-error-details .cf-status-name{display:inline}#cf-wrapper #cf-error-details .cf-status-item{display:block;position:relative;text-align:left}#cf-wrapper #cf-error-details .cf-status-item,#cf-wrapper #cf-error-details .cf-status-item.cf-column{padding-bottom:1.5em}#cf-wrapper #cf-error-details .cf-status-item.cf-error-source{display:block;text-align:center}#cf-wrapper #cf-error-details .cf-status-item.cf-error-source:after{bottom:-60px;content:\"\";display:none;border-bottom:18px solid #fff;border-left:20px solid transparent;border-right:20px solid transparent;height:0;left:50%;margin-left:-9px;position:absolute;right:50%;width:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item{border-top:1px solid #dedede;padding-top:1.5em}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background:url(/cdn-cgi/images/cf-icon-horizontal-arrow.png) no-repeat;content:\"\";display:block;left:0;position:absolute;top:25.67px}#cf-wrapper #cf-error-details .cf-error-source .cf-icon-error-container{height:85px;margin-bottom:2.5em}#cf-wrapper #cf-error-details .cf-error-source .cf-status-label{color:#bd2426}#cf-wrapper #cf-error-details .cf-error-source .cf-icon{display:block}#cf-wrapper #cf-error-details .cf-error-source .cf-icon-status{bottom:-10px;left:50%;top:auto;right:auto}#cf-wrapper #cf-error-details .cf-error-source .cf-status-label,#cf-wrapper #cf-error-details .cf-error-source .cf-status-name{display:block}#cf-wrapper #cf-error-details .cf-icon-error-container{height:auto;position:relative}#cf-wrapper #cf-error-details .cf-icon-status{display:block;margin-left:-24px;position:absolute;top:0;right:0}#cf-wrapper #cf-error-details .cf-icon{display:none;margin:0 auto}#cf-wrapper #cf-error-details .cf-status-desc{display:block;height:22.5px;overflow:hidden;text-overflow:ellipsis;width:100%;white-space:nowrap}#cf-wrapper #cf-error-details .cf-status-desc:empty{display:none}#cf-wrapper #cf-error-details .cf-error-footer{padding:1.33333em 0;border-top:1px solid #ebebeb;text-align:center}#cf-wrapper #cf-error-details .cf-error-footer p{font-size:13px}#cf-wrapper #cf-error-details .cf-error-footer select{margin:0!important}#cf-wrapper #cf-error-details .cf-footer-item{display:block;margin-bottom:5px;text-align:left}#cf-wrapper #cf-error-details .cf-footer-separator{display:none}#cf-wrapper #cf-error-details .cf-captcha-info{margin-bottom:10px;position:relative;text-align:center}#cf-wrapper #cf-error-details .cf-captcha-image{height:57px;width:300px}#cf-wrapper #cf-error-details .cf-captcha-actions{margin-top:15px}#cf-wrapper #cf-error-details .cf-captcha-actions a{font-size:0;height:36.38px;overflow:hidden;padding-left:1.2em;padding-right:1.2em;position:relative;text-indent:-9999px;width:36.38px;white-space:nowrap}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-refresh span{background-position:0 -787px}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-announce span{background-position:0 -767px}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-question span{background-position:0 -827px}#cf-wrapper #cf-error-details .cf-screenshot-container{background:url(/cdn-cgi/images/browser-bar.png?1376755637) no-repeat #fff;max-height:400px;max-width:100%;overflow:hidden;padding-top:53px;width:960px;border-radius:5px 5px 0 0}#cf-wrapper #cf-error-details .cf-screenshot-container .cf-no-screenshot{background:url(/cdn-cgi/images/cf-no-screenshot-warn.png) no-repeat;display:block;height:158px;left:25%;margin-top:-79px;overflow:hidden;position:relative;top:50%;width:178px}#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container,#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container img,#recaptcha-widget .cf-alert,#recaptcha-widget .recaptcha_only_if_audio,.cf-cookie-error{display:none}#cf-wrapper #cf-error-details .cf-screenshot-container .cf-no-screenshot.error{background:url(/cdn-cgi/images/cf-no-screenshot-error.png) no-repeat;height:175px}#cf-wrapper #cf-error-details .cf-screenshot-container.cf-screenshot-full .cf-no-screenshot{left:50%;margin-left:-89px}.cf-captcha-info iframe{max-width:100%}#cf-wrapper .cf-icon-ok{background:url(/cdn-cgi/images/cf-icon-ok.png) no-repeat;height:48px;width:48px}#cf-wrapper .cf-icon-error{background:url(/cdn-cgi/images/cf-icon-error.png) no-repeat;height:48px;width:48px}#cf-wrapper .cf-icon-browser{background:url(/cdn-cgi/images/cf-icon-browser.png) no-repeat;height:80px;width:100px}#cf-wrapper .cf-icon-cloud{background:url(/cdn-cgi/images/cf-icon-cloud.png) no-repeat;height:77px;width:151px}#cf-wrapper .cf-icon-server{background:url(/cdn-cgi/images/cf-icon-server.png) no-repeat;height:75px;width:95px}#cf-wrapper .cf-icon-railgun{background-position:0 -848px;height:81px;width:95px}#cf-wrapper .cf-caret{border:.33333em solid transparent;border-top-color:inherit;content:\"\";height:0;width:0;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}@media screen and (min-width:49.2em){#cf-wrapper #cf-error-details .cf-status-desc:empty,#cf-wrapper #cf-error-details .cf-status-item.cf-error-source:after,#cf-wrapper #cf-error-details .cf-status-item .cf-icon,#cf-wrapper #cf-error-details .cf-status-label,#cf-wrapper #cf-error-details .cf-status-name{display:block}#cf-wrapper .cf-wrapper{width:708px}#cf-wrapper #cf-error-banner{padding:20px 20px 25px}#cf-wrapper #cf-error-banner .cf-error-actions{margin-bottom:15px}#cf-wrapper #cf-error-banner .cf-error-header-desc h4{margin-right:.5em}#cf-wrapper #cf-error-details h1{font-size:4em}#cf-wrapper #cf-error-details .cf-error-overview{padding-top:2.33333em}#cf-wrapper #cf-error-details .cf-highlight{padding:4em 0}#cf-wrapper #cf-error-details .cf-status-item{text-align:center}#cf-wrapper #cf-error-details .cf-status-item,#cf-wrapper #cf-error-details .cf-status-item.cf-column{padding-bottom:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item{border:0;padding-top:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background-position:0 -544px;height:24.75px;margin-left:-37.5px;width:75px;background-size:131.25px auto}#cf-wrapper #cf-error-details .cf-icon-error-container{height:85px;margin-bottom:2.5em}#cf-wrapper #cf-error-details .cf-icon-status{bottom:-10px;left:50%;top:auto;right:auto}#cf-wrapper #cf-error-details .cf-error-footer{padding:2.66667em 0}#cf-wrapper #cf-error-details .cf-footer-item,#cf-wrapper #cf-error-details .cf-footer-separator{display:-moz-inline-stack;display:inline-block;vertical-align:baseline;zoom:1}#cf-wrapper #cf-error-details .cf-footer-separator{padding:0 .25em}#cf-wrapper #cf-error-details .cf-status-item.cloudflare-status:before{margin-left:-50px}#cf-wrapper #cf-error-details .cf-status-item.cloudflare-status+.status-item:before{margin-left:-25px}#cf-wrapper #cf-error-details .cf-screenshot-container{height:400px;margin-bottom:-4em;max-width:none}#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container,#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container img{display:block}}@media screen and (min-width:66em){#cf-wrapper .cf-wrapper{width:960px}#cf-wrapper #cf-error-banner .cf-close{position:relative;right:auto;top:auto}#cf-wrapper #cf-error-banner .cf-details{white-space:nowrap}#cf-wrapper #cf-error-banner .cf-details-link{padding-right:.5em}#cf-wrapper #cf-error-banner .cf-error-actions{float:right;margin-bottom:0;text-align:left;width:auto}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background-position:0 -734px;height:33px;margin-left:-50px;width:100px;background-size:auto}#cf-wrapper #cf-error-details .cf-status-item.cf-cloudflare-status:before{margin-left:-66.67px}#cf-wrapper #cf-error-details .cf-status-item.cf-cloudflare-status+.cf-status-item:before{margin-left:-37.5px}#cf-wrapper #cf-error-details .cf-captcha-image{float:left}#cf-wrapper #cf-error-details .cf-captcha-actions{position:absolute;top:0;right:0}}.no-js #cf-wrapper .js-only{display:none}#cf-wrapper #cf-error-details .heading-ray-id{font-family:monaco,courier,monospace;font-size:15px;white-space:nowrap} #cf-wrapper #cf-error-details .cf-footer-item.hidden,.cf-error-footer .hidden{display:none} .cf-error-footer .cf-footer-ip-reveal-btn{-webkit-appearance:button;-moz-appearance:button;appearance:button;text-decoration:none;background:none;color:inherit;border:none;padding:0;font:inherit;cursor:pointer;color:#0051c3;-webkit-transition:color .15s ease;transition:color .15s ease}.cf-error-footer .cf-footer-ip-reveal-btn:hover{color:#ee730a}\n" + (string) (len=24) "body{margin:0;padding:0}" }, Cookies: ([]string) , Headers: ([]string) (len=14) { @@ -31,8 +38,8 @@ }, Requests: ([]string) (len=4) { (string) (len=28) "http://www.bdswissasias.com/", - (string) (len=56) "http://www.bdswissasias.com/cdn-cgi/styles/cf.errors.css", (string) (len=69) "http://www.bdswissasias.com/cdn-cgi/images/browser-bar.png?1376755637", - (string) (len=69) "http://www.bdswissasias.com/cdn-cgi/images/cf-no-screenshot-error.png" + (string) (len=69) "http://www.bdswissasias.com/cdn-cgi/images/cf-no-screenshot-error.png", + (string) (len=56) "http://www.bdswissasias.com/cdn-cgi/styles/cf.errors.css" } } diff --git a/README.md b/README.md index aceb4f0c..4a0367c0 100644 --- a/README.md +++ b/README.md @@ -36,17 +36,17 @@ align="right" IOK indicators are written using [Sigma](https://github.com/SigmaHQ/sigma) -| Field name | Type | Description | -|:----------:|:--------:|------------------------------------------------------------------------------------------------------| -| title | string | The title of the site as shown in a browser | -| hostname | string | The hostname of the site | -| html | string | The contents of the page HTML (as returned by the server) | -| dom | string | The contents of the page HTML after loading (e.g. after javascript has executed) | -| js | []string | Contents of JavaScript from the page (includes inline scripts as well as scripts loaded externally) | -| css | []string | Contents of CSS from the page (includes inline stylesheets as well as externally loaded stylesheets) | -| cookies | []string | Cookies from the page. Each is in the form `cookieName=value` | -| headers | []string | Headers sent by the server. Each is in the form `Header-Name: value` | -| requests | []string | URLs of requests made by the page (and assets loaded by the page) | +| Field name | Type | Description | +|:----------:|:--------:|-----------------------------------------------------------------------------------------------------------------------| +| title | []string | The title of the site as shown in a browser. If multiple titles are set (e.g. by JavaScript), this contains each one. | +| hostname | string | The hostname of the site | +| html | string | The contents of the page HTML (as returned by the server) | +| dom | string | The contents of the page HTML after loading (e.g. after javascript has executed) | +| js | []string | Contents of JavaScript from the page (includes inline scripts as well as scripts loaded externally) | +| css | []string | Contents of CSS from the page (includes inline stylesheets as well as externally loaded stylesheets) | +| cookies | []string | Cookies from the page. Each is in the form `cookieName=value` | +| headers | []string | Headers sent by the server. Each is in the form `Header-Name: value` | +| requests | []string | URLs of requests made by the page (and assets loaded by the page) | We are always looking for contributions: there's far more phishing kits and techniques than a single team can analyse! diff --git a/go.mod b/go.mod index 1d3d2107..1b33b8a8 100644 --- a/go.mod +++ b/go.mod @@ -4,8 +4,10 @@ go 1.17 require ( github.com/bradleyjkemp/cupaloy/v2 v2.6.0 - github.com/bradleyjkemp/sigma-go v0.6.1 + github.com/bradleyjkemp/sigma-go v0.6.4 golang.org/x/net v0.7.0 + golang.org/x/sync v0.3.0 + phish.report/urlscanio-go v0.0.0-20230915155435-2677d74fc8a2 ) require ( diff --git a/go.sum b/go.sum index ef254990..1356163d 100644 --- a/go.sum +++ b/go.sum @@ -8,8 +8,8 @@ github.com/alecthomas/participle v0.7.1/go.mod h1:HfdmEuwvr12HXQN44HPWXR0lHmVolV github.com/alecthomas/repr v0.0.0-20181024024818-d37bc2a10ba1/go.mod h1:xTS7Pm1pD1mvyM075QCDSRqH6qRLXylzS24ZTpRiSzQ= github.com/bradleyjkemp/cupaloy/v2 v2.6.0 h1:knToPYa2xtfg42U3I6punFEjaGFKWQRXJwj0JTv4mTs= github.com/bradleyjkemp/cupaloy/v2 v2.6.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0= -github.com/bradleyjkemp/sigma-go v0.6.1 h1:Pcorn3yOSACgcD8U7f8mss+ZIBgeVpi+09pB0jz3zHA= -github.com/bradleyjkemp/sigma-go v0.6.1/go.mod h1:E0zOiUWS9/tvbSj6hsA9PXtplKygYTJ7hxgvWUcjJmE= +github.com/bradleyjkemp/sigma-go v0.6.4 h1:J6Sqwbgv7wsEuP7xbsG8dvTrTc9lhkf5BvYF+gO9vzc= +github.com/bradleyjkemp/sigma-go v0.6.4/go.mod h1:fHCN8y8cC1l5CYY7oOhPIznHmj/yeGxUvU+vAV7alr4= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -33,6 +33,8 @@ golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E= +golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= @@ -56,3 +58,7 @@ gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +phish.report/urlscanio-go v0.0.0-20230905142413-ecc6ecfca602 h1:cpBOU2BjQ1amcY5yALjLfsd4ODpA6ckcSwJKH75Ou9A= +phish.report/urlscanio-go v0.0.0-20230905142413-ecc6ecfca602/go.mod h1:pJPFc89ctVOCv3nhtbb8cPOOjcVDJmCRz7R2O1Z8cQY= +phish.report/urlscanio-go v0.0.0-20230915155435-2677d74fc8a2 h1:Pf9Z3H+o20DiHIB3n94vXQBttBzDclmujSbTI9Zj6TA= +phish.report/urlscanio-go v0.0.0-20230915155435-2677d74fc8a2/go.mod h1:pJPFc89ctVOCv3nhtbb8cPOOjcVDJmCRz7R2O1Z8cQY= diff --git a/indicators/ETC-e623c655.yml b/indicators/ETC-e623c655.yml new file mode 100644 index 00000000..db22aadd --- /dev/null +++ b/indicators/ETC-e623c655.yml @@ -0,0 +1,20 @@ +title: ETC Phishing Kit e623c655 +description: | + Detects an ETC phishing targeting Japanese users.(etc-meisai.jp) + +references: + - https://urlscan.io/result/e623c655-a8f4-470d-9e83-be7bd8c201c6 + - https://urlscan.io/result/e33beca0-d6d7-4bfd-8a57-3818d079d504 + - https://urlscan.io/result/516e7e00-2ddb-4036-b44c-33456e3e195a + +detection: + ETCTitle: + title: 'ＥＴＣ利用照会サービス' + pagePHP: + requests|contains: 'funccode.php' + + condition: ETCTitle and pagePHP + +tags: + - target.etc_meisai + - target_country.japan diff --git a/indicators/saison-b85570be.yml b/indicators/saison-b85570be.yml new file mode 100644 index 00000000..6950f077 --- /dev/null +++ b/indicators/saison-b85570be.yml @@ -0,0 +1,23 @@ +title: SAISON Card Phishing Kit b85570be +description: | + Detects a SAISON Card phishing kit targeting Japanese users. +references: + - https://urlscan.io/result/b85570be-adc3-45f8-83ee-9a4a46737f89 + - https://urlscan.io/result/4332baf6-7b01-49e9-9d88-b7dcb9ad5a33 + - https://urlscan.io/result/7ddc9c4a-2a7d-403d-9743-82cb62f0eb02 + +detection: + FormContains: + html|contains: + - 'name="loginForm" id="loginForm" method="post" action="USA0201UIP01SCR.do.php"' + TokenContains: + html|contains: + - 'type="hidden" name="_csrf" value="a9410f4f-e742-47a4-bcb4-78b655267747"' + pagePHP: + requests|contains: 'auth.php' + + condition: FormContains and TokenContains and pagePHP + +tags: + - target.saison_card + - target_country.japan \ No newline at end of file diff --git a/indicators/smbc-acab82b5.yml b/indicators/smbc-acab82b5.yml new file mode 100644 index 00000000..faa2633c --- /dev/null +++ b/indicators/smbc-acab82b5.yml @@ -0,0 +1,24 @@ +title: SMBC Phishing Kit acab82b5 +description: | + Detects a SMBC phishing kit targeting Japanese users. + +references: + - https://urlscan.io/result/acab82b5-6182-4cab-96b1-7e2af19b668b + - https://urlscan.io/result/a8a41bab-97ed-43d8-85d8-d760161ab317 + - https://urlscan.io/result/607f6acb-1301-4ca5-9e33-0e0ca5b7c359 + - https://urlscan.io/result/6c29c34f-1dac-433c-b2d9-005bd8db3ee1 + +detection: + FormContains: + html|contains: + - 'method="post" id="tijiao" action="1.php"' + + iframeContains: + html|contains: + - 'id="aMpc0Wu2zFxeefIt" style="display: none;"' + + condition: FormContains and iframeContains + +tags: + - target.smbc + - target_country.japan \ No newline at end of file diff --git a/iok.go b/iok.go index 5e7ddd83..67f07fb2 100644 --- a/iok.go +++ b/iok.go @@ -21,7 +21,7 @@ var config []byte var evaluators []*evaluator.RuleEvaluator type Input struct { - Title string // Title is the title of the page as it would be shown in a browser + Title []string // Title is the title of the page as it would be shown in a browser. If multiple titles are set (e.g. by JavaScript), this contains each one. Hostname string // Hostname is the hostname that the page was served from DOM string // DOM contains the HTML contents of the primary page *after* it has loaded HTML string // HTML contains the HTML response of the primary page @@ -54,7 +54,7 @@ func GetMatchesForRules(input Input, rules []*evaluator.RuleEvaluator) ([]sigma. func convertInput(input Input) evaluator.Event { return map[string]interface{}{ - "title": input.Title, + "title": toInterfaceSlice(input.Title), "hostname": input.Hostname, "dom": input.DOM, "html": input.HTML, @@ -90,7 +90,7 @@ func ParseRule(path string, contents []byte) (*evaluator.RuleEvaluator, error) { rule.ID, _, _ = strings.Cut(filepath.Base(path), ".") } - return evaluator.ForRule(rule, evaluator.WithConfig(config)), nil + return evaluator.ForRule(rule, evaluator.WithConfig(config), evaluator.CaseSensitive), nil } func init() { diff --git a/logsource.yml b/logsource.yml index 7af1dca0..d9c657f0 100644 --- a/logsource.yml +++ b/logsource.yml @@ -3,6 +3,7 @@ backends: - github.com/bradleyjkemp/sigma-go fieldmappings: + title: $.title[*] js: $.js[*] css: $.css[*] cookies: $.cookies[*] diff --git a/urlscanio.go b/urlscanio.go index b3b9bd1f..7c9793c5 100644 --- a/urlscanio.go +++ b/urlscanio.go @@ -3,445 +3,17 @@ package iok import ( "bytes" "context" - "encoding/json" "fmt" + "golang.org/x/net/html" + "golang.org/x/sync/errgroup" "io" "net/http" "net/url" + "phish.report/urlscanio-go" "sort" - "time" - - "golang.org/x/net/html" + "sync" ) -type urlscanResult struct { - DOM []byte - Data struct { - Requests []struct { - Request struct { - RequestId string `json:"requestId"` - LoaderId string `json:"loaderId"` - DocumentURL string `json:"documentURL"` - Request struct { - Url string `json:"url"` - Method string `json:"method"` - Headers struct { - UpgradeInsecureRequests string `json:"Upgrade-Insecure-Requests,omitempty"` - UserAgent string `json:"User-Agent"` - AcceptLanguage string `json:"accept-language"` - Referer string `json:"Referer,omitempty"` - Origin string `json:"Origin,omitempty"` - } `json:"headers"` - MixedContentType string `json:"mixedContentType"` - InitialPriority string `json:"initialPriority"` - ReferrerPolicy string `json:"referrerPolicy"` - IsSameSite bool `json:"isSameSite"` - IsLinkPreload bool `json:"isLinkPreload,omitempty"` - } `json:"request"` - Timestamp float64 `json:"timestamp"` - WallTime float64 `json:"wallTime"` - Initiator struct { - Type string `json:"type"` - Url string `json:"url,omitempty"` - LineNumber int `json:"lineNumber,omitempty"` - ColumnNumber int `json:"columnNumber,omitempty"` - Stack struct { - CallFrames []struct { - FunctionName string `json:"functionName"` - ScriptId string `json:"scriptId"` - Url string `json:"url"` - LineNumber int `json:"lineNumber"` - ColumnNumber int `json:"columnNumber"` - } `json:"callFrames"` - } `json:"stack,omitempty"` - } `json:"initiator"` - RedirectHasExtraInfo bool `json:"redirectHasExtraInfo"` - Type string `json:"type"` - FrameId string `json:"frameId"` - HasUserGesture bool `json:"hasUserGesture"` - PrimaryRequest bool `json:"primaryRequest,omitempty"` - } `json:"request"` - Response struct { - EncodedDataLength int `json:"encodedDataLength"` - DataLength int `json:"dataLength"` - RequestId string `json:"requestId"` - Type string `json:"type"` - Response struct { - Url string `json:"url"` - Status int `json:"status"` - StatusText string `json:"statusText"` - Headers map[string]string `json:"headers"` - MimeType string `json:"mimeType"` - RemoteIPAddress string `json:"remoteIPAddress"` - RemotePort int `json:"remotePort"` - EncodedDataLength int `json:"encodedDataLength"` - Timing struct { - RequestTime float64 `json:"requestTime"` - ProxyStart int `json:"proxyStart"` - ProxyEnd int `json:"proxyEnd"` - DnsStart float64 `json:"dnsStart"` - DnsEnd float64 `json:"dnsEnd"` - ConnectStart float64 `json:"connectStart"` - ConnectEnd float64 `json:"connectEnd"` - SslStart float64 `json:"sslStart"` - SslEnd float64 `json:"sslEnd"` - WorkerStart int `json:"workerStart"` - WorkerReady int `json:"workerReady"` - WorkerFetchStart int `json:"workerFetchStart"` - WorkerRespondWithSettled int `json:"workerRespondWithSettled"` - SendStart float64 `json:"sendStart"` - SendEnd float64 `json:"sendEnd"` - PushStart int `json:"pushStart"` - PushEnd int `json:"pushEnd"` - ReceiveHeadersEnd float64 `json:"receiveHeadersEnd"` - } `json:"timing"` - ResponseTime float64 `json:"responseTime"` - Protocol string `json:"protocol"` - SecurityState string `json:"securityState"` - SecurityDetails struct { - Protocol string `json:"protocol"` - KeyExchange string `json:"keyExchange"` - KeyExchangeGroup string `json:"keyExchangeGroup"` - Cipher string `json:"cipher"` - CertificateId int `json:"certificateId"` - SubjectName string `json:"subjectName"` - SanList []string `json:"sanList"` - Issuer string `json:"issuer"` - ValidFrom int `json:"validFrom"` - ValidTo int `json:"validTo"` - SignedCertificateTimestampList []interface{} `json:"signedCertificateTimestampList"` - CertificateTransparencyCompliance string `json:"certificateTransparencyCompliance"` - } `json:"securityDetails"` - SecurityHeaders []struct { - Name string `json:"name"` - Value string `json:"value"` - } `json:"securityHeaders,omitempty"` - } `json:"response"` - HasExtraInfo bool `json:"hasExtraInfo"` - Hash string `json:"hash"` - Size int `json:"size"` - Asn struct { - Ip string `json:"ip"` - Asn string `json:"asn"` - Country string `json:"country"` - Registrar string `json:"registrar"` - Date string `json:"date"` - Description string `json:"description"` - Route string `json:"route"` - Name string `json:"name"` - } `json:"asn"` - Geoip struct { - Country string `json:"country"` - Region string `json:"region"` - Timezone string `json:"timezone"` - City string `json:"city"` - Ll []float64 `json:"ll"` - CountryName string `json:"country_name"` - Metro int `json:"metro"` - } `json:"geoip"` - Rdns struct { - Ip string `json:"ip"` - Ptr string `json:"ptr"` - } `json:"rdns,omitempty"` - } `json:"response"` - InitiatorInfo struct { - Url string `json:"url"` - Host string `json:"host"` - Type string `json:"type"` - } `json:"initiatorInfo,omitempty"` - } `json:"requests"` - Cookies []struct { - Name string `json:"name"` - Value string `json:"value"` - Domain string `json:"domain"` - Path string `json:"path"` - Expires float64 `json:"expires"` - Size int `json:"size"` - HttpOnly bool `json:"httpOnly"` - Secure bool `json:"secure"` - Session bool `json:"session"` - Priority string `json:"priority"` - SameParty bool `json:"sameParty"` - SourceScheme string `json:"sourceScheme"` - SourcePort int `json:"sourcePort"` - } `json:"cookies"` - Console []struct { - Message struct { - Source string `json:"source"` - Level string `json:"level"` - Text string `json:"text"` - Timestamp float64 `json:"timestamp"` - Url string `json:"url"` - Line interface{} `json:"line"` - } `json:"message"` - } `json:"console"` - Links []struct { - Href string `json:"href"` - Text string `json:"text"` - } `json:"links"` - Timing struct { - BeginNavigation time.Time `json:"beginNavigation"` - FrameStartedLoading time.Time `json:"frameStartedLoading"` - FrameNavigated time.Time `json:"frameNavigated"` - DomContentEventFired time.Time `json:"domContentEventFired"` - FrameStoppedLoading time.Time `json:"frameStoppedLoading"` - } `json:"timing"` - Globals []struct { - Prop string `json:"prop"` - Type string `json:"type"` - } `json:"globals"` - } `json:"data"` - Stats struct { - ResourceStats []struct { - Count int `json:"count"` - Size int `json:"size"` - EncodedSize int `json:"encodedSize"` - Latency int `json:"latency"` - Countries []string `json:"countries"` - Ips []string `json:"ips"` - Type string `json:"type"` - Compression string `json:"compression"` - Percentage int `json:"percentage"` - } `json:"resourceStats"` - ProtocolStats []struct { - Count int `json:"count"` - Size int `json:"size"` - EncodedSize int `json:"encodedSize"` - Ips []string `json:"ips"` - Countries []string `json:"countries"` - SecurityState struct { - } `json:"securityState"` - Protocol string `json:"protocol"` - } `json:"protocolStats"` - TlsStats []struct { - Count int `json:"count"` - Size int `json:"size"` - EncodedSize int `json:"encodedSize"` - Ips []string `json:"ips"` - Countries []string `json:"countries"` - Protocols struct { - TLS13AES128GCM int `json:"TLS 1.3 / / AES_128_GCM"` - } `json:"protocols"` - SecurityState string `json:"securityState"` - } `json:"tlsStats"` - ServerStats []struct { - Count int `json:"count"` - Size int `json:"size"` - EncodedSize int `json:"encodedSize"` - Ips []string `json:"ips"` - Countries []string `json:"countries"` - Server string `json:"server"` - } `json:"serverStats"` - DomainStats []struct { - Count int `json:"count"` - Ips []string `json:"ips"` - Domain string `json:"domain"` - Size int `json:"size"` - EncodedSize int `json:"encodedSize"` - Countries []string `json:"countries"` - Index int `json:"index"` - Initiators []string `json:"initiators"` - Redirects int `json:"redirects"` - } `json:"domainStats"` - RegDomainStats []struct { - Count int `json:"count"` - Ips []string `json:"ips"` - RegDomain string `json:"regDomain"` - Size int `json:"size"` - EncodedSize int `json:"encodedSize"` - Countries []interface{} `json:"countries"` - Index int `json:"index"` - SubDomains []struct { - Domain string `json:"domain"` - Country string `json:"country"` - } `json:"subDomains"` - Redirects int `json:"redirects"` - } `json:"regDomainStats"` - SecureRequests int `json:"secureRequests"` - SecurePercentage int `json:"securePercentage"` - IPv6Percentage int `json:"IPv6Percentage"` - UniqCountries int `json:"uniqCountries"` - TotalLinks int `json:"totalLinks"` - Malicious int `json:"malicious"` - AdBlocked int `json:"adBlocked"` - IpStats []struct { - Requests int `json:"requests"` - Domains []string `json:"domains"` - Ip string `json:"ip"` - Asn struct { - Ip string `json:"ip"` - Asn string `json:"asn"` - Country string `json:"country"` - Registrar string `json:"registrar"` - Date string `json:"date"` - Description string `json:"description"` - Route string `json:"route"` - Name string `json:"name"` - } `json:"asn"` - Dns struct { - } `json:"dns"` - Geoip struct { - Country string `json:"country"` - Region string `json:"region"` - Timezone string `json:"timezone"` - City string `json:"city"` - Ll []float64 `json:"ll"` - CountryName string `json:"country_name"` - Metro int `json:"metro"` - } `json:"geoip"` - Size int `json:"size"` - EncodedSize int `json:"encodedSize"` - Countries []string `json:"countries"` - Index int `json:"index"` - Ipv6 bool `json:"ipv6"` - Redirects int `json:"redirects"` - Count interface{} `json:"count"` - Rdns struct { - Ip string `json:"ip"` - Ptr string `json:"ptr"` - } `json:"rdns,omitempty"` - } `json:"ipStats"` - } `json:"stats"` - Meta struct { - Processors struct { - Umbrella struct { - Data []struct { - Hostname string `json:"hostname"` - Rank int `json:"rank"` - } `json:"data"` - } `json:"umbrella"` - Geoip struct { - Data []struct { - Ip string `json:"ip"` - Geoip struct { - Country string `json:"country"` - Region string `json:"region"` - Timezone string `json:"timezone"` - City string `json:"city"` - Ll []float64 `json:"ll"` - CountryName string `json:"country_name"` - Metro int `json:"metro"` - } `json:"geoip"` - } `json:"data"` - } `json:"geoip"` - Rdns struct { - Data []struct { - Ip string `json:"ip"` - Ptr string `json:"ptr"` - } `json:"data"` - } `json:"rdns"` - Asn struct { - Data []struct { - Ip string `json:"ip"` - Asn string `json:"asn"` - Country string `json:"country"` - Registrar string `json:"registrar"` - Date string `json:"date"` - Description string `json:"description"` - Route string `json:"route"` - Name string `json:"name"` - } `json:"data"` - } `json:"asn"` - Wappa struct { - Data []struct { - Confidence []struct { - Confidence int `json:"confidence"` - Pattern string `json:"pattern"` - } `json:"confidence"` - ConfidenceTotal int `json:"confidenceTotal"` - App string `json:"app"` - Icon string `json:"icon"` - Website string `json:"website"` - Categories []struct { - Name string `json:"name"` - Priority int `json:"priority"` - } `json:"categories"` - } `json:"data"` - } `json:"wappa"` - } `json:"processors"` - } `json:"meta"` - Task struct { - Uuid string `json:"uuid"` - Time time.Time `json:"time"` - Url string `json:"url"` - Visibility string `json:"visibility"` - Method string `json:"method"` - Source string `json:"source"` - Tags []interface{} `json:"tags"` - ReportURL string `json:"reportURL"` - ScreenshotURL string `json:"screenshotURL"` - DomURL string `json:"domURL"` - } `json:"task"` - Page struct { - Url string `json:"url"` - Domain string `json:"domain"` - Country string `json:"country"` - City string `json:"city"` - Server string `json:"server"` - Ip string `json:"ip"` - Asn string `json:"asn"` - Asnname string `json:"asnname"` - } `json:"page"` - Lists struct { - Ips []string `json:"ips"` - Countries []string `json:"countries"` - Asns []string `json:"asns"` - Domains []string `json:"domains"` - Servers []string `json:"servers"` - Urls []string `json:"urls"` - LinkDomains []string `json:"linkDomains"` - Certificates []struct { - SubjectName string `json:"subjectName"` - Issuer string `json:"issuer"` - ValidFrom int `json:"validFrom"` - ValidTo int `json:"validTo"` - } `json:"certificates"` - Hashes []string `json:"hashes"` - } `json:"lists"` - Verdicts struct { - Overall struct { - Score int `json:"score"` - Categories []interface{} `json:"categories"` - Brands []interface{} `json:"brands"` - Tags []interface{} `json:"tags"` - Malicious bool `json:"malicious"` - HasVerdicts bool `json:"hasVerdicts"` - } `json:"overall"` - Urlscan struct { - Score int `json:"score"` - Categories []interface{} `json:"categories"` - Brands []interface{} `json:"brands"` - Tags []interface{} `json:"tags"` - Malicious bool `json:"malicious"` - HasVerdicts bool `json:"hasVerdicts"` - } `json:"urlscan"` - Engines struct { - Score int `json:"score"` - Categories []interface{} `json:"categories"` - EnginesTotal int `json:"enginesTotal"` - MaliciousTotal int `json:"maliciousTotal"` - BenignTotal int `json:"benignTotal"` - MaliciousVerdicts []interface{} `json:"maliciousVerdicts"` - BenignVerdicts []interface{} `json:"benignVerdicts"` - Malicious bool `json:"malicious"` - HasVerdicts bool `json:"hasVerdicts"` - } `json:"engines"` - Community struct { - Score int `json:"score"` - Categories []interface{} `json:"categories"` - Brands []interface{} `json:"brands"` - VotesTotal int `json:"votesTotal"` - VotesMalicious int `json:"votesMalicious"` - VotesBenign int `json:"votesBenign"` - Malicious bool `json:"malicious"` - HasVerdicts bool `json:"hasVerdicts"` - } `json:"community"` - } `json:"verdicts"` - Submitter struct { - Country string `json:"country"` - } `json:"submitter"` -} - type httpClient interface { Do(req *http.Request) (*http.Response, error) } @@ -449,16 +21,10 @@ type httpClient interface { // InputFromURLScan takes a urlscan.io result ID and returns an Input suitable for calling GetMatches with. // The provided http.Client should inject your API key if you have one. func InputFromURLScan(ctx context.Context, urlscanUUID string, client httpClient) (Input, error) { - req, _ := http.NewRequestWithContext(ctx, http.MethodGet, "https://urlscan.io/api/v1/result/"+urlscanUUID, nil) - resp, err := client.Do(req) + urlscanClient := urlscanio.NewClient(urlscanio.HTTPClient(client)) + result, err := urlscanClient.RetrieveResult(ctx, urlscanUUID) if err != nil { - return Input{}, fmt.Errorf("failed to get search result: %w", err) - } - defer resp.Body.Close() - - result := urlscanResult{} - if err := json.NewDecoder(resp.Body).Decode(&result); err != nil { - return Input{}, fmt.Errorf("failed to decode search result: %w", err) + return Input{}, err } input := Input{} @@ -468,59 +34,83 @@ func InputFromURLScan(ctx context.Context, urlscanUUID string, client httpClient } input.Hostname = u.Hostname() - domReq, _ := http.NewRequestWithContext(ctx, http.MethodGet, "https://urlscan.io/dom/"+result.Task.Uuid, nil) - domResp, err := client.Do(domReq) - if err != nil { - return Input{}, fmt.Errorf("failed to get result html: %w", err) - } - defer domResp.Body.Close() - - resultHTML, _ := io.ReadAll(domResp.Body) - input.DOM = string(resultHTML) - - // parse any JS/CSS from the dom - node, err := html.Parse(bytes.NewReader(resultHTML)) - if err == nil { - extractEmbedded(node, &input) - extractTitle(node, &input) - } + // Some sites have many resources (100+) so fetching each one sequentially takes too long. + // This fetches up to 5 resources in parallel + g, ctx := errgroup.WithContext(ctx) + g.SetLimit(5) + mu := sync.Mutex{} + + g.Go(func() error { + domReq, _ := http.NewRequestWithContext(ctx, http.MethodGet, "https://urlscan.io/dom/"+result.Task.Uuid, nil) + domResp, err := client.Do(domReq) + if err != nil { + return fmt.Errorf("failed to get result dom: %w", err) + } + defer domResp.Body.Close() + + mu.Lock() + defer mu.Unlock() + resultHTML, _ := io.ReadAll(domResp.Body) + input.DOM = string(resultHTML) + + // parse any JS/CSS from the dom + node, err := html.Parse(bytes.NewReader(resultHTML)) + if err == nil { + extractEmbedded(node, &input) + extractTitle(node, &input) + } + return nil + }) for _, cookie := range result.Data.Cookies { input.Cookies = append(input.Cookies, cookie.Name+"="+cookie.Value) } foundHTML := false + for _, request := range result.Data.Requests { - input.Requests = append(input.Requests, request.Request.Request.Url) + request := request + g.Go(func() error { + mu.Lock() + input.Requests = append(input.Requests, request.Request.Request.Url) + + // TODO: how does this check behave in the case of redirects? + if request.Request.PrimaryRequest { + // this is the "primary" page load, so we need to extract the response headers + for headerKey, headerValue := range request.Response.Response.Headers { + input.Headers = append(input.Headers, http.CanonicalHeaderKey(headerKey)+": "+headerValue) + } + sort.Slice(input.Headers, func(i, j int) bool { + return input.Headers[i] < input.Headers[j] + }) + } + mu.Unlock() - // TODO: how does this check behave in the case of redirects? - if request.Request.PrimaryRequest { - // this is the "primary" page load, so we need to extract the response headers - for headerKey, headerValue := range request.Response.Response.Headers { - input.Headers = append(input.Headers, http.CanonicalHeaderKey(headerKey)+": "+headerValue) + if request.Response.Hash == "" { + // this isn't a response we can fetch + return nil } - sort.Slice(input.Headers, func(i, j int) bool { - return input.Headers[i] < input.Headers[j] - }) - } - if request.Response.Hash == "" { - // this isn't a response we can fetch - continue - } + switch request.Request.Type { + default: + return nil + case "Stylesheet", "Script", "Document": + } - switch request.Request.Type { - case "Stylesheet", "Script", "Document": + // Fetch the response in parallel with other threads, only lock the mutex once we're modifying the Input{} resourceReq, _ := http.NewRequestWithContext(ctx, http.MethodGet, "https://urlscan.io/responses/"+request.Response.Hash, nil) resp, err := client.Do(resourceReq) if err != nil { - return Input{}, fmt.Errorf("failed to fetch resource %s %s: %w", request.Request.RequestId, request.Response.Hash, err) + return fmt.Errorf("failed to fetch resource %s %s: %w", request.Request.RequestId, request.Response.Hash, err) } resource, _ := io.ReadAll(resp.Body) // always read the body to completion to ensure proper connection re-use + caching resp.Body.Close() if resp.StatusCode/100 != 2 { // not all resources are saved by urlscan.io e.g. stylesheets are frequently missing - continue + return nil } + + mu.Lock() + defer mu.Unlock() switch request.Request.Type { case "Stylesheet": input.CSS = append(input.CSS, string(resource)) @@ -534,9 +124,22 @@ func InputFromURLScan(ctx context.Context, urlscanUUID string, client httpClient } // this is the initial page load input.HTML = string(resource) + + // parse any JS/CSS from the html + // This does result in duplicate values (for sites that don't have any dynamically inserted JS/CSS), + // but that doesn't affect correctness + node, err := html.Parse(bytes.NewReader(resource)) + if err == nil { + extractEmbedded(node, &input) + extractTitle(node, &input) + } } } - } + return nil + }) + } + if err := g.Wait(); err != nil { + return input, err } if !foundHTML { @@ -559,12 +162,8 @@ func extractEmbedded(node *html.Node, input *Input) { } func extractTitle(node *html.Node, input *Input) { - if input.Title != "" { - return - } - if node.Type == html.ElementNode && node.Data == "title" && node.FirstChild != nil { - input.Title = node.FirstChild.Data + input.Title = append(input.Title, node.FirstChild.Data) return } diff --git a/urlscanio_test.go b/urlscanio_test.go index c3303043..3915d120 100644 --- a/urlscanio_test.go +++ b/urlscanio_test.go @@ -4,6 +4,7 @@ import ( "context" "github.com/bradleyjkemp/cupaloy/v2" "net/http" + "sort" "testing" ) @@ -17,7 +18,22 @@ func TestInputFromURLScan(t *testing.T) { if err != nil { t.Fatal(err) } + + // because resources are fetched in parallel the output is non-deterministic, so we need to sort each field + sortField(input.Title) + sortField(input.JS) + sortField(input.CSS) + sortField(input.Cookies) + sortField(input.Headers) + sortField(input.Requests) + cupaloy.SnapshotT(t, input) }) } } + +func sortField(f []string) { + sort.Slice(f, func(i, j int) bool { + return f[i] < f[j] + }) +}