HTML files
You can submit a web page that arrived as a file: an .html or .htm attachment, an application page (.hta) or a vector image (.svg). livewells reads the file as text, lists what it holds and flags what looks risky.
Send an HTML file
Send the file on the Upload a file tab, or through the API. livewells also reads an HTML page inside another item of the same case, such as an email body or an archive member.
What you see
- Links. Every web address in the page: links, pictures, frames, scripts, forms and redirects. Each address appears defanged, and you can send it to a disposable browser with one click.
- Forms. The method, where the form sends what you type, and the kinds of field. A password field raises a flag.
- Frames. Frames that load another page. Hidden frames raise a flag.
- Redirects. A meta refresh and a script that sends you to another page.
- Scripts. livewells reads the script text and matches it against known patterns. It decodes strings written as escapes, percent codes, base64 or character codes, up to three layers, to find the addresses and files that the script builds.
- Hidden files. A block of base64 data of 1,000 characters or more, and a
data:address that holds a page or file, become separate items in the case. Each shows its SHA-256. - Application pages. The system calls that the page names, such as object creation, shell, program start, web request and file write.
- Vector images. A script inside an SVG file, and the pictures and parts that the file loads from other sites.
- File shares. An address that points to a file share on another computer, with that computer as an indicator.
Every address, host, IP address and email address in the report is defanged. For example, hxxps[://]login[.]example[.]com/a stands for a web address.
Open the page in the browser
For an HTML file that you uploaded as the case file, the case page has an Open the page section. Choose Open in a disposable browser. The disposable browser opens your stored file, and you drive the session as you do for a link.
- The file stays in livewells. It goes to the disposable browser and nowhere else.
- Each browser run from a file uses one submission.
- A page that arrived inside another file has no stored original. Open its links in the browser instead.
- Application pages and vector images are read as text. Open their links in the browser instead.
Limits
| Limit | Value |
|---|---|
| Bytes read | 5 MiB. livewells reads the first 5 MiB and the case shows a flag. |
| Parts read | 100,000 (50,000 tags) |
| Nesting depth | 512 |
| Attributes in one tag | 256 |
| Web address length | 8,192 characters (data addresses up to 8 MiB) |
| Links listed | 500 |
| Hidden files taken out | 20 hidden files, 8 MiB each |
| Time | 30 seconds |
When a limit trips, livewells cuts the page at that point and reads everything before it in full. The report says so.
Flags
| Flag | Level | What it means |
|---|---|---|
html-credential-form | high | This page asks for a password. |
html-form-external | high | A form on this page sends what you type to another site. |
html-form-mailto | medium | A form on this page sends what you type to an email address. |
html-file-input | low | This page asks you to choose a file from your computer. |
html-meta-refresh | medium | This page sends you to another page as soon as it opens. |
html-script-redirect | medium | A script on this page sends you to another page. |
html-script-external | low | This page loads a script from another site. |
html-script-network | low | A script on this page sends or fetches data. |
html-dynamic-code | medium | A script builds new code from text and runs it. |
html-obfuscated-script | medium | A script hides its text with encoding. |
html-packed-script | medium | A script is packed so that its text cannot be read. |
html-sandbox-evasion | medium | A script checks who is looking at the page before it shows its content. |
html-smuggling | high | The page builds a file inside the browser and offers to save it. |
html-embedded-payload | high | The page holds a large block of hidden data that is a file. |
html-data-url | medium | An address on this page holds a whole page or file inside it. |
html-hidden-frame | medium | This page hides a frame that loads another page. |
html-file-link | high | This page points to a file share on another computer. |
html-link-mismatch | high | A link shows one address and opens a different one. |
html-link-userinfo | medium | A link hides the real site behind a name and an at sign. |
html-link-ip | low | A link goes to a number address instead of a site name. |
html-link-punycode | low | A link uses a look-alike spelling of a site name. |
html-javascript-link | medium | A link runs a script when you click it. |
html-base-external | medium | This page changes where its short links go. |
html-remote-content | low | This page loads pictures or styles from another site. |
html-clipboard-write | high | The page copies text to your clipboard. Do not paste it into a terminal. |
html-hta | high | This file is an application page that can start programs. |
html-hta-commands | high | The application page lists commands that start programs or fetch files. |
html-svg-script | medium | This image file contains a script. |
html-bidi-text | medium | The page uses hidden text direction marks to change how text looks. |
html-truncated | medium | The page is larger than the checker reads. It read the first part only. |
html-limit | medium | The page has more parts than the checker reads. |
html-time-limit | medium | The checker ran out of time. The result is partial. |
html-unreadable | medium | The checker could not read this page. Treat the file as hostile. |
html-xml-entities | medium | This image file defines its own text entities. The checker did not read it. |