U
    @6^"                     @   sZ   d dl Z d dlZd dlmZmZmZ dddgddddd	gd
ddZG dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventZabuseipdbipqueryipz9https://www.abuseipdb.com/check/{0}/json?key={1}&days={2})idtypechecksurlZabuseipdbnetblocknetblockzGhttps://www.abuseipdb.com/check-block/json?network={0}&key={1}&days={2})zAbuseIPDB Single IPzAbuseIPDB Netblockc                   @   sr   e Zd ZdZddddddZdddd	d
dZdZe fddZdd Z	dd Z
dd Zdd Zdd Zdd ZdS )sfp_abuseipdbzzAbuseIPDB:Investigate,Passive:Reputation Systems:apikey:Check if a netblock or IP is malicious according to AbuseIPDB.com.    T)api_keydaysbackcheckaffiliateschecknetblockschecksubnetszAbuseIPDB.com API key.zHow far back to query, in days?zApply checks to affiliates?z=Report if any malicious IPs are found within owned netblocks?zJCheck if any malicious IPs are found within the same subnet of the target?Nc                 C   s4   || _ |  | _t| D ]}|| | j|< qd S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   8/var/www/spiderfoot.crq.systems/modules/sfp_abuseipdb.pysetup;   s    
zsfp_abuseipdb.setupc                 C   s   ddddgS )N
IP_ADDRESSAFFILIATE_IPADDRNETBLOCK_OWNERNETBLOCK_MEMBERr   r   r   r   r   watchedEventsG   s    zsfp_abuseipdb.watchedEventsc                 C   s   ddddgS )NMALICIOUS_IPADDRMALICIOUS_AFFILIATE_IPADDRMALICIOUS_SUBNETMALICIOUS_NETBLOCKr   r%   r   r   r   producedEventsM   s     zsfp_abuseipdb.producedEventsc                 C   s   t |dkrB|D ]0}t||tjtjB r| jd|   dS qt |dkr|D ]0}t||tjtjB rR| jd|   dS qR| jd d S )Nr   z#Found to be bad against bad regex: Tz$Found to be good againt good regex: FzNeither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr   debug)r   content	goodregexbadregexrxr   r   r   contentMaliciousR   s    zsfp_abuseipdb.contentMaliciousc                 C   sZ  | j d }| j d }| jd| d |  tt D ]}t| d }||kr8t| d dkr8tt| d }| jj||||| j d	 | j d
 d}	|	d d kr| j	d||d| d  d S z<d|	d krW  d S t
|	d }
t|
dkrW  d S W nB tk
rF } z"| j	dt| d W Y  d S d }~X Y nX d|   S q8d S )Nr   r   z	Querying z for maliciousness of r   r   r   r
   _fetchtimeout
_useragent)timeout	useragentr2   zUnable to fetch ZmaskedFz
rate limitr   zMalformatted JSON response: z https://www.abuseipdb.com/check/)r   r   r1   r   	malchecksr   strfetchUrlformaterrorjsonloadsr,   BaseException)r   r   target
targetTypeapikeyr   checkcidr
   resjer   r   r   resourceQueryf   s2    

zsfp_abuseipdb.resourceQueryc                 C   s|   t t D ]j}t| d }||kr|t| d kr| jd| d | d |  t| d dkr| |||  S qd S )Nr   r	   zChecking maliciousness of z (z) with: r   r   )r   r;   r   r   r1   rK   )r   
resourceIditemTyperC   rF   rG   r   r   r   
lookupItem   s    zsfp_abuseipdb.lookupItemc                 C   sb  |j }|j}|j}| jd| d |  || jkrL| jd| d  d S d| j|< |dkrp| jddspd S |d	kr| jd
dsd S |dkr| jddsd S tt	
 D ]}t	| d }|dkrd}|dkrd}nd}|d	krd}d}|dkr d}d}| |||}	|  r d S |	d k	r|d | d d |	 d }
t||
| j|}| | qd S )NzReceived event, z, from z	Skipping z, already checked.Tr"   r   Fr#   r   r$   r   r   )r!   r"   r   r!   r'   r(   r   r*   r)   z [z]
z<SFURL>z</SFURL>)	eventTypemoduledatar   r1   r   r   getr   r;   r   rN   checkForStopr   __name__notifyListeners)r   event	eventNamesrcModuleName	eventDatarF   rG   typeIdevtTyper
   textevtr   r   r   handleEvent   sJ    



zsfp_abuseipdb.handleEvent)rT   
__module____qualname____doc__r   optdescsr   dictr    r&   r+   r6   rK   rN   r^   r   r   r   r   r   !   s*   
r   )r-   r@   sflibr   r   r   r;   r   r   r   r   r   <module>   s   