12

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running.

Are there any equivalent test sites for trying out McAfee SiteAdvisor, Kaspersky URL Advisor, Norton Safe Web, Google Safe Browsing, and others?

Or can anyone share any running sites, which they use to test out whether their reputation services are working?

5 Answers 5

5

Unfortunately Google Safe Browsing doesn't recognize "malware.wicar.org" of http://wicar.org/ as a malicious site. Instead you can use http://www.ianfette.org/ which is, I guess, the Google Safe Browsing test site.

Just in case you are wondering, Ian Fette is a software engineer at Google.

5
  • Strange - accessed the ianfette link via the latest version of Chrome from two different MacBooks. Got the safe browsing warning on one but not the other. Commented Dec 3, 2015 at 23:08
  • @CraigS.Anderson Maybe it was disabled? Under "Privacy," verify if the box "Protect you and your device from dangerous sites." is checked.
    – ForguesR
    Commented Dec 4, 2015 at 16:33
  • I checked, and the box is checked on both machines. Thanks for the suggestion. Commented Dec 7, 2015 at 19:52
  • Not correct for me, as of now. ianfette.org just says "pageok". wicar.org on the other hand was correctly flagged in Safari and Chrome. (OpenDNS malware detection alas, did not.)
    – Orangutech
    Commented Nov 13, 2018 at 5:07
  • Just checked ianfette.org at Google’s Safe Browsing site ("No unsafe content found"). Checked ianfette.org at VirusTotal (using minimal interface since no longer works with full interface) and only two checkers flagged it as malicious, Webroot and CyRadar), Norton Safe Web gave a warning as Malicious Sources/Malnets. Really have to SERPs with "-site:targeturl" for reputation also (find Ian is at MANTL now). Commented May 1 at 15:54
4

http://wicar.org/

"The wicar.org website was designed to test the correct operation your anti-virus / anti-malware software."

"The wicar.org website contains actual browser exploits, therefore, regardless of search engine, web browser, filtering appliance or desktop anti-virus product you use, it should be marked as malicious."

(No connection, just used it myself).

2

Tests are typically done by finding a known malicious site and browsing to it while in a sandboxed environment. NSS labs used that technique for its recent tests this year, testing IE, Chrome, and Firefox. One of the sources of malicious URLs that NSS used was MalwareDomainList.com, which might serve as a something you could use in the same way, as long as you protect yourself.

I'm not sure how a fake malicious site would provide value, a la EICAR. I use EICAR to test AV avoidance and unique protection configurations, but the file is under your control and is readable. In that case, using Metasploit or SET might be a better way to test for browser protection because it is under your control and you know what it is doing, although you won't be able to test reputation services in the same way.

1
  • 1
    The value I think they would add is to do a sanity test that browser-plugin based or proxy server based malicious site blockers are working, without the risk of going to an actually known malicious site. Commented Sep 2, 2013 at 22:13
1

To my knowledge no such site exists.

You could maybe host a static webpage via github.io or something similar, and include some Javascript that's very similar to a known exploit kit's payload, just with the final eval replaced or removed. That would probably be the simplest way you could test.

2
  • 1
    The problem with that is it might get blocked by the hoster. Hosting your own site gives you more control but you risk never being rated by a reputation service.
    – schroeder
    Commented Jun 13, 2013 at 21:38
  • Ah, interesting, so your 'faux' malicious site will inevitably get crawled by a reputation service which will likely mark it as risky. And if your ISP or your co-lo gets wind, they will try to take you down. I suppose that is what should happen but it will make these "Reputation Service test sites" short lived or put YOU at risk of criminal intent. Commented Sep 2, 2013 at 22:17
1

This website contains (supposedly) safe links to test for google safe search. I verified it using boomerang SOAP and REST client.

https://testsafebrowsing.appspot.com/

I didn't find or make this myself, Here is the original stack overflow page I found it on :) https://stackoverflow.com/a/67541445

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .