3
@6^"                 @   sZ   d dl Z d dlZd dlmZmZmZ dddgddddd	gd
ddZG dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventZabuseipdbipqueryipz9https://www.abuseipdb.com/check/{0}/json?key={1}&days={2})idtypechecksurlZabuseipdbnetblocknetblockzGhttps://www.abuseipdb.com/check-block/json?network={0}&key={1}&days={2})zAbuseIPDB Single IPzAbuseIPDB Netblockc               @   sr   e Zd ZdZddddddZdddd	d
dZdZe fddZdd Z	dd Z
dd Zdd Zdd Zdd ZdS )sfp_abuseipdbzzAbuseIPDB:Investigate,Passive:Reputation Systems:apikey:Check if a netblock or IP is malicious according to AbuseIPDB.com.    T)api_keydaysbackcheckaffiliateschecknetblockschecksubnetszAbuseIPDB.com API key.zHow far back to query, in days?zApply checks to affiliates?z=Report if any malicious IPs are found within owned netblocks?zJCheck if any malicious IPs are found within the same subnet of the target?Nc             C   s8   || _ | j | _x"t|j D ]}|| | j|< qW d S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   8/var/www/spiderfoot.crq.systems/modules/sfp_abuseipdb.pysetup;   s    
zsfp_abuseipdb.setupc             C   s   ddddgS )N
IP_ADDRESSAFFILIATE_IPADDRNETBLOCK_OWNERNETBLOCK_MEMBERr   )r   r   r   r   watchedEventsG   s    zsfp_abuseipdb.watchedEventsc             C   s   ddddgS )NMALICIOUS_IPADDRMALICIOUS_AFFILIATE_IPADDRMALICIOUS_SUBNETMALICIOUS_NETBLOCKr   )r   r   r   r   producedEventsM   s    zsfp_abuseipdb.producedEventsc             C   s   t |dkrDx6|D ].}tj||tjtjB r| jjd|  dS qW t |dkrx6|D ].}tj||tjtjB rV| jjd|  dS qVW | jjd d S )Nr   z#Found to be bad against bad regex: Tz$Found to be good againt good regex: FzNeither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr   debug)r   content	goodregexbadregexrxr   r   r   contentMaliciousR   s    

zsfp_abuseipdb.contentMaliciousc             C   sF  | j d }| j d }| jjd| d |  xttj D ] }t| d }||kodt| d dkr<tt| d }| jj|j|||| j d	 | j d
 d}	|	d d kr| jj	d|j|d| d d S y2d|	d krd S t
j|	d }
t|
dkrd S W n8 tk
r4 } z| jj	dt| d d S d }~X nX d| S q<W d S )Nr   r   z	Querying z for maliciousness of r   r   r   r
   _fetchtimeout
_useragent)timeout	useragentr1   zUnable to fetch ZmaskedFz
rate limitr   zMalformatted JSON response: z https://www.abuseipdb.com/check/)r   r   r0   r   	malchecksr   strfetchUrlformaterrorjsonloadsr+   BaseException)r   r   target
targetTypeapikeyr   checkcidr
   resjer   r   r   resourceQueryf   s0    

zsfp_abuseipdb.resourceQueryc             C   s|   xvt tj D ]f}t| d }||kr|t| d kr| jjd| d | d |  t| d dkr| j|||S qW d S )Nr   r	   zChecking maliciousness of z (z) with: r   r   )r   r:   r   r   r0   rJ   )r   
resourceIditemTyperB   rE   rF   r   r   r   
lookupItem   s    zsfp_abuseipdb.lookupItemc             C   sj  |j }|j}|j}| jjd| d |  || jkrL| jjd| d  d S d| j|< |dkrr| jjdd rrd S |d	kr| jjd
d rd S |dkr| jjdd rd S xtt	j
 D ]}t	| d }|dkrd}|dkrd}nd}|d	krd}d}|dkrd}d}| j|||}	| j r$d S |	d k	r|d | d d |	 d }
t||
| j|}| j| qW d S )NzReceived event, z, from z	Skipping z, already checked.Tr"   r   Fr#   r   r$   r   r   r!   r   r&   r'   r   r)   r(   z [z]
z<SFURL>z</SFURL>)r!   r"   )	eventTypemoduledatar   r0   r   r   getr   r:   r   rM   checkForStopr   __name__notifyListeners)r   event	eventNamesrcModuleName	eventDatarE   rF   typeIdevtTyper
   textevtr   r   r   handleEvent   sH    



zsfp_abuseipdb.handleEvent)rS   
__module____qualname____doc__r   optdescsr   dictr    r%   r*   r5   rJ   rM   r]   r   r   r   r   r   !   s&   r   )r,   r?   sflibr   r   r   r:   r   r   r   r   r   <module>   s   