U
@6^5 @ s d dl mZmZ d dlZd dlmZmZmZ dddgddd dd
d gd dd
dd
d gddddd
d gddddddgddddddgddddZG dd deZ dS ) ) IPAddress IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventabusezeusdomainlistdomainz>https://zeustracker.abuse.ch/blocklist.php?download=baddomains)idtypechecksurl abusezeusipipnetblockz:https://zeustracker.abuse.ch/blocklist.php?download=badips abusefeodoipz7https://feodotracker.abuse.ch/downloads/ipblocklist.txt abusesslblipz3https://sslbl.abuse.ch/blacklist/sslipblacklist.csvz{0},.*)r
r r r
regex abuseurlhausz'https://urlhaus.abuse.ch/downloads/csv/z
.*//{0}/.*abuseransomdomz9https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txtz^{0}$)z abuse.ch Zeus Tracker (Domain)zabuse.ch Zeus Tracker (IP)zabuse.ch Feodo Tracker (IP)zabuse.ch SSL Blacklist (IP)zabuse.ch URLhaus (Domain)z&abuse.ch Ransomware Blocklist (Domain)c
@ s e Zd ZdZddddddddddddd Zddddd d
d d d
dddd ZdZe fddZdd Z dd Z
dd Z dd Z d d Z
d d Zd d! ZdS )" sfp_abusechz{abuse.ch:Investigate,Passive:Reputation Systems::Check if a host/domain, IP or netblock is malicious according to abuse.ch.T ) r r Zabusefeododomainr r r r checkaffiliates checkcohosts cacheperiodchecknetblocks checksubnetsz"Enable abuse.ch Zeus domain check?z Enable abuse.ch Zeus IP check?z#Enable abuse.ch Feodo domain check?z Enable abuse.ch Feodo IP check?z&Enable abuse.ch SSL Backlist IP check?z Enable abuse.ch URLhaus check?z%Enable abuse.ch Ransom Domains check?zApply checks to affiliates?z?Apply checks to sites found to be co-hosted on the target's IP?z,Hours to cache list data before re-fetching.z=Report if any malicious IPs are found within owned netblocks?zJCheck if any malicious IPs are found within the same subnet of the target?Nc C s4 || _ | | _t| D ]}|| | j|< q d S )N)sf tempStorageresultsr keysopts)selfsfcuserOptsopt r& 6/var/www/spiderfoot.crq.systems/modules/sfp_abusech.pysetupe s
zsfp_abusech.setupc C s dddddddgS )N
INTERNET_NAME
IP_ADDRESSNETBLOCK_MEMBERAFFILIATE_INTERNET_NAMEAFFILIATE_IPADDRCO_HOSTED_SITENETBLOCK_OWNERr& r" r& r& r'
watchedEventsq s zsfp_abusech.watchedEventsc C s dddddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDR!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_SUBNETMALICIOUS_COHOSTMALICIOUS_NETBLOCKr& r0 r& r& r' producedEventsy s zsfp_abusech.producedEventsc C s t |dkrB|D ]0}t||tjtjB r| jd| dS qt |dkr|D ]0}t||tjtjB rR| jd| dS qR| jd d S )Nr z#Found to be bad against bad regex: Tz$Found to be good againt good regex: Fz Neither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr debug)r" content goodregexbadregexrxr& r& r' contentMalicious s z sfp_abusech.contentMaliciousc C s | j d| d | tt D ]}t| d }||kr$t| d dkr$tt| d }| j j||| jd | jd d }|d
d kr| j d || d d S |
|d
t| d
t| d r$|| S q$d S )Nz Querying z for maliciousness of r
r queryr
_fetchtimeout
_useragenttimeout useragentr@ Unable to fetch FrA rB ) r r? r malchecksr strfetchUrlformatr! errorrD )r" r
target
targetTypecheckcidr
resr& r& r'
resourceQuery s $
zsfp_abusech.resourceQueryc C s d}|dkr | j || jd }tt D ]t}t| d }||kr,t| d dkr,t }t| d }| j d| | jd d
|d < |d d kr| j j || jd | jd
d}|d d kr| j
d| d d S | j d| |d |dkrNt } dt| krt| d dd}
t
|
t
j} | j d| d |
|d dD ].} t
| | }
t|
d
krR| |
d
qRn|d d} | D ]}t|dk s|drq| }z@t|t|kr| j |d | d | |W S W nB tk
rB } z"| j d t| W Y qW 5 d }~X Y nX q d S dt| kr|d dD ]P} | |ks|dkrj| |krj| j |d | d | d | S qjq,ztt| d |}tt| d |}|d dD ]b} |dkrt
|| t
js,t
|| t
jr| j |d | d | d | W S qW q, t k
r } z | j d t| W Y q,W 5 d }~X Y q,X q,d S )!N r
_internettldsr
r r r
sfmal_r r r@ rF rG rH rK Fr r z{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z:
#z found within netblock/subnet z in zError encountered parsing: /z
found in z list.z Error encountered parsing 2: ) r
hostDomainr! r rL r dictcacheGetgetrN rP cachePutreplacer; compiler= r? splitfindallr: append
startswithstripr r ExceptionrM rO r<
BaseException)r" r
rQ rR targetDomrS rT datar
iplistrC patlinegrpr erxDomrxTgtr& r& r' resourceList s
zsfp_abusech.resourceListc C s t t D ]}t| d }||kr |t| d kr | jd| d | d | t| d dkrv| ||| S t| d dkr | ||| S q d S ) Nr
r zChecking maliciousness of z (z) with: r rE r )r rL r r r? rV ru )r"
resourceIditemTyperQ rS rT r& r& r'
lookupItem s zsfp_abusech.lookupItemc C s |j }|j}|j}| jd| d | || jkrL| jd| d d S d| j|< |dkrp| jddspd S |d kr| jd
dsd S |d kr| jd dsd S |d
kr| jddsd S tt
D ]}t | d }| j| r|dkrd}|dkrd}nd}|dkrd}d}|dkrRd}|dkr6d}|d krDd }|dkrRd }|d krdd }d }|d
krvd }d!}| |||} | r d S | d k r|d" | d# d$ | d% }
t
||
| j|} | | qd S )&NzReceived event, z, from z Skipping z, already checked.Tr. r Fr- r r/ r r+ r r
)r* r- r r* r2 r4 ) BGP_AS_OWNER
BGP_AS_MEMBERasn
MALICIOUS_ASN)r) r. r, r r) r3 r, r5 r7 r r8 r6 z [z]
zz) eventTypemodulerm r r? r r! ra r rL r rx checkForStopr __name__notifyListeners) r" event eventName
srcModuleName eventDatarS rT typeIdevtTyper
textevtr& r& r' handleEvent sf
zsfp_abusech.handleEvent)r
__module__ __qualname____doc__r! optdescsr r_ r( r1 r9 rD rV ru rx r r& r& r& r' r < sH Mr )
netaddrr r r; sflibr r r rL r r& r& r& r'
sJ *