3
@6^5 @ s d dl mZmZ d dlZd dlmZmZmZ dddgddd dd
d gd dd
dd
d gddddd
d gddddddgddddddgddddZG dd deZ dS ) ) IPAddress IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventabusezeusdomainlistdomainz>https://zeustracker.abuse.ch/blocklist.php?download=baddomains)idtypechecksurl abusezeusipipnetblockz:https://zeustracker.abuse.ch/blocklist.php?download=badips abusefeodoipz7https://feodotracker.abuse.ch/downloads/ipblocklist.txt abusesslblipz3https://sslbl.abuse.ch/blacklist/sslipblacklist.csvz{0},.*)r
r r r
regex abuseurlhausz'https://urlhaus.abuse.ch/downloads/csv/z
.*//{0}/.*abuseransomdomz9https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txtz^{0}$)z abuse.ch Zeus Tracker (Domain)zabuse.ch Zeus Tracker (IP)zabuse.ch Feodo Tracker (IP)zabuse.ch SSL Blacklist (IP)zabuse.ch URLhaus (Domain)z&abuse.ch Ransomware Blocklist (Domain)c
@ s e Zd ZdZddddddddddddd Zddddd d
d d d
dddd ZdZe fddZdd Z dd Z
dd Z dd Z d d Z
d d Zd d! ZdS )" sfp_abusechz{abuse.ch:Investigate,Passive:Reputation Systems::Check if a host/domain, IP or netblock is malicious according to abuse.ch.T ) r r Zabusefeododomainr r r r checkaffiliates checkcohosts cacheperiodchecknetblocks checksubnetsz"Enable abuse.ch Zeus domain check?z Enable abuse.ch Zeus IP check?z#Enable abuse.ch Feodo domain check?z Enable abuse.ch Feodo IP check?z&Enable abuse.ch SSL Backlist IP check?z Enable abuse.ch URLhaus check?z%Enable abuse.ch Ransom Domains check?zApply checks to affiliates?z?Apply checks to sites found to be co-hosted on the target's IP?z,Hours to cache list data before re-fetching.z=Report if any malicious IPs are found within owned netblocks?zJCheck if any malicious IPs are found within the same subnet of the target?Nc C s8 || _ | j | _x"t|j D ]}|| | j|< q W d S )N)sf tempStorageresultsr keysopts)selfsfcuserOptsopt r& 6/var/www/spiderfoot.crq.systems/modules/sfp_abusech.pysetupe s
zsfp_abusech.setupc C s dddddddgS )N
INTERNET_NAME
IP_ADDRESSNETBLOCK_MEMBERAFFILIATE_INTERNET_NAMEAFFILIATE_IPADDRCO_HOSTED_SITENETBLOCK_OWNERr& )r" r& r& r'
watchedEventsq s zsfp_abusech.watchedEventsc C s dddddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDR!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_SUBNETMALICIOUS_COHOSTMALICIOUS_NETBLOCKr& )r" r& r& r' producedEventsy s zsfp_abusech.producedEventsc C s t |dkrDx6|D ].}tj||tjtjB r| jjd| dS qW t |dkrx6|D ].}tj||tjtjB rV| jjd| dS qVW | jjd d S )Nr z#Found to be bad against bad regex: Tz$Found to be good againt good regex: Fz Neither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr debug)r" content goodregexbadregexrxr& r& r' contentMalicious s
z sfp_abusech.contentMaliciousc C s | j jd| d | xttj D ]}t| d }||kr&t| d dkr&tt| d }| j j|j|| jd | jd d }|d
d kr| j j d |j| d d S | j
|d
t| d
t| d r&|j|S q&W d S )Nz Querying z for maliciousness of r
r queryr
_fetchtimeout
_useragent)timeout useragentr? zUnable to fetch Fr@ rA ) r r> r malchecksr strfetchUrlformatr! errorrC )r" r
target
targetTypecheckcidr
resr& r& r'
resourceQuery s $
zsfp_abusech.resourceQueryc C s d}|dkr | j j|| jd }xjttj D ]X}t| d }||koXt| d dkr0t }t| d }| j jd| | jjd d
|d < |d d kr| j j || jd | jd
d}|d d kr| j j
d| d d S | j j d| |d |dkrFt } dt| krt| d j dd}
t
j|
t
j} | j jd| d |
xP|d jdD ].} t
j| | }
t|
d
krV| j|
d
qVW n|d jd} x| D ]}t|dk s|jdrq|j }y6t|t|kr| j j|d | d | |S W n< tk
r: } z | j jd t| wW Y d d }~X nX qW d S dt| krxZ|d jdD ]H} | |ks|dkrd| |krd| j j|d | d | d |S qdW q0ytt| d j|}tt| d j|}xj|d jdD ]X} |dkrt
j || t
js"t
j || t
jr| j j|d | d | d |S qW W q0 t k
r } z | j jd t| w0W Y d d }~X q0X q0W d S )!N r
_internettldsr
r r r
sfmal_r r r? rE rF )rG rH zUnable to fetch Fr r z{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z:
#z found within netblock/subnet z in zError encountered parsing: /z
found in z list.z Error encountered parsing 2: ) r
hostDomainr! r rI r dictcacheGetgetrK rM cachePutreplacer: compiler< r> splitfindallr9 append
startswithstripr r ExceptionrJ rL r;
BaseException)r" r
rN rO targetDomrP rQ datar
iplistrB patlinegrpr erxDomrxTgtr& r& r' resourceList sr
zsfp_abusech.resourceListc C s xt tj D ]}t| d }||kr|t| d kr| jjd| d | d | t| d dkrt| j|||S t| d dkr| j|||S qW d S ) Nr
r zChecking maliciousness of z (z) with: r rD r )r rI r r r> rS rr )r"
resourceIditemTyperN rP rQ r& r& r'
lookupItem s zsfp_abusech.lookupItemc C s |j }|j}|j}| jjd| d | || jkrL| jjd| d d S d| j|< |dkrr| jjdd rrd S |d kr| jjd
d rd S |d kr| jjd d rd S |d
kr| jjdd rd S xtt j
D ]}t | d }| j| r|d%krd}|dkrd}nd}|d&kr&d}d}|d'kr^d}|dkrBd}|dkrPd }|dkr^d }|d krpd }d }|d
krd }d }| j |||} | j rd S | d k r|d! | d" d# | d$ }
t
||
| j|} | j| qW d S )(NzReceived event, z, from z Skipping z, already checked.Tr. r Fr- r r/ r r+ r r
r* r r1 r3 BGP_AS_OWNER
BGP_AS_MEMBERasn
MALICIOUS_ASNr) r, r r2 r4 r6 r r7 r5 z [z]
zz)r* r- )rv rw )r) r. r, ) eventTypemodulerj r r> r r! r^ r rI r ru checkForStopr __name__notifyListeners) r" event eventName
srcModuleName eventDatarP rQ typeIdevtTyper
textevtr& r& r' handleEvent sf
zsfp_abusech.handleEvent)r}
__module__ __qualname____doc__r! optdescsr r\ r( r0 r8 rC rS rr ru r r& r& r& r' r < sD Mr )
netaddrr r r: sflibr r r rI r r& r& r& r'
s<