import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 import re def check_for_phishing_indicators(html_content): # Check for common phishing indicators using regular expressions indicators = { "login_forms": bool(re.search(r']*type=["\']?password["\']?', html_content, re.IGNORECASE)), "suspicious_links": bool(re.search(r'href=["\'](.*?(login|signin|account).*?)["\']', html_content, re.IGNORECASE)), "pop-up_forms": bool( re.search(r']*type=["\']?text["\']?.*?name=["\'](.*?(username|email).*?)["\']?', html_content, re.IGNORECASE) ), # noqa: E501 # Additional checks "meta_tags_phishing_keywords": bool( re.search( r']*name=["\']?(keywords|description)["\']?[^>]*content=["\']?(phishing|login|password)["\']?', html_content, re.IGNORECASE, ) ), "javascript_phishing_code": bool( re.search(r"]*>\s*function.*?(submit|login|password).*?", html_content, re.DOTALL | re.IGNORECASE) ), "suspicious_iframes": bool(re.search(r']*src=["\']?(https?|ftp):', html_content, re.IGNORECASE)), # You can add more checks for additional indicators here "payment_form_elements": bool( re.search( r']*type=["\']?(text|password)["\']?.*?name=["\'](.*?(credit|card|cvv|exp|security|cardNumber).*?)["\']?', html_content, re.IGNORECASE, ) ), "suspicious_js_functions": bool( re.search(r"]*>\s*(submit|validate|sendData).*?", html_content, re.DOTALL | re.IGNORECASE) ), "hidden_fields": bool( re.search( r']*type=["\']?hidden["\']?.*?name=["\'](.*?(credit|card|bank|account|payment).*?)["\']?', html_content, re.IGNORECASE, ) ), "payment_keywords": bool( re.search(r"(credit|card|debit|bank|account|payment|paypal|bitcoin|crypto)", html_content, re.IGNORECASE) ), } return indicators def check_html_for_phishing(html_content): phishing_indicators = check_for_phishing_indicators(html_content) return phishing_indicators def format_html_response(indicators): html_output = "" # Add a header row with "Validation" and "Passed/Failed" headers html_output += "" html_output += "" # noqa: E501 html_output += "" # noqa: E501 html_output += "" for key, value in indicators.items(): html_output += f"" # noqa: E501 html_output += "

Validation	Found
{key.replace('_', ' ').capitalize()}	{'✅' if value else '❌' }

" return html_output def main(): try: demisto_context = demisto.context() html_content = demisto.get(demisto_context, "HttpRequest.Response.Body") if not html_content: temp = demisto.get(demisto_context, "HttpRequest.Response") html_content_root = None if isinstance(temp, list): html_content_root = temp[0] if not html_content_root: return_results("No HTML content provided.") else: html_content = html_content_root.get("Body") else: phishing_indicators = check_html_for_phishing(html_content) html_response = format_html_response(phishing_indicators) demisto.results( { "ContentsFormat": formats["html"], "Type": entryTypes["note"], "Contents": html_response, } ) except Exception as e: return_error(f"Error: {str(e)}") if __name__ in ("__main__", "__builtin__", "builtins"): main()