Yobi
Yara Based Detection for web browsers
System Requirements
Yobi requires python3 and and right now supports only firefox and other Gecko-based browsers.
Installation
Automatic Installation (Linux Only)
git clone https://github.com/imp0rtp3/Yobi/
cd Yobi/
chmod +x install.sh
./install.sh
Manual Installation
- Run:
git clone https://github.com/imp0rtp3/Yobi/
cd Yobi/
pip install -r requirements.txt
# Create certificate and key used for the WSS communicaitons
openssl req -x509 -batch -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
python3 setup_cert.py
- Open Firefox and type in the address bar
https://127.0.0.1:8392. Click "Advanced"-> "Accept the Risk and Continue" - open https://addons.mozilla.org/firefox/downloads/file/3831405/yobi-0.0.1-fx.xpi to install the Yobi add-on signed by mozilla.
Running
- run
python3 main.py
YARA rules
YARA rules are fetched from a repository of JS rules I created: js-yara-rules. The repo consists of free JS rules I found on the internet and some I wrote myself. Feel free to create pull requests for additional rellevant rules. The repository can be changed in config.py
Additionally, you can add your own rules by setting USE_CUSTOM_RULES=True and CUSTOM_RULES_PATH to a path containing your yara rules in config.py.
Yobi's Inner Workings
Yobi is separated into two components - a browser extension and a python script. They communicate through WSS protocol. Self-signed certificates need to be created in order for the protocol to function. The alternative of using the unencrypted websocket protocol would allow anyone intercepting loopback traffic to intercept decrypted https content of the browsetr.
Why not run everything in the browser?
I am not aware of any maintained Yara engine able to run in the browser, through webassembly or JS.
Continuing Development
This version is still very basic and should serve as a prototype only. Please open issues and pull request for new features or bugs you encounter.
Contact and Feedback
Contact me via twitter - @imp0rtp3
Screenshots
2.8k Dec 29, 2022
2 Jun 4, 2021
12 Dec 2, 2022
12 Nov 22, 2022
1 Dec 28, 2021
165 Dec 21, 2022
3 Dec 16, 2022
1 Nov 12, 2021
5 Feb 2, 2022
171 Nov 28, 2022
2 Jul 20, 2022
104 Nov 09, 2022
14 Dec 23, 2022
32 Dec 25, 2022
7 Jan 07, 2022
11 Dec 07, 2022
14 Aug 17, 2022
9.4k Jan 04, 2023
34 Nov 15, 2022
2.1k Jan 08, 2023
2 Feb 14, 2022
3 Aug 10, 2022
![Risky [ Zero Tow ]](https://avatars.githubusercontent.com/u/76860656?v=4&s=60)
7 Dec 25, 2022
108 Jan 07, 2023
2 Jan 11, 2022
45 Dec 28, 2022
0 Dec 20, 2021
30 Nov 19, 2022