3
@6^                  @   s8   d dl Z d dlZd dlmZmZmZ G dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventc               @   s~   e Zd ZdZddddZddddZd	Zd
Ze fddZ	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zdd Zd	S )sfp_apilityzxApility:Footprint,Investigate,Passive:Reputation Systems:apikey:Search Apility API for IP address and domain reputation.    T)api_keydelaymalicious_freemailzApility API key.z#Delay between requests, in seconds.z+Consider free mail servers to be malicious.NFc             C   s>   || _ | j | _d| _x"t|j D ]}|| | j|< q$W d S )NF)sftempStorageresults
errorStatelistkeysopts)selfsfcuserOptsopt r   6/var/www/spiderfoot.crq.systems/modules/sfp_apility.pysetup'   s
    
zsfp_apility.setupc             C   s   ddgS )N
IP_ADDRESSINTERNET_NAMEr   )r   r   r   r   watchedEvents0   s    zsfp_apility.watchedEventsc             C   s   ddddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEr   PROVIDER_MAILPROVIDER_DNSRAW_RIR_DATAr   )r   r   r   r   producedEvents4   s    zsfp_apility.producedEventsc             C   sH   d| j d d}| jjd| |d| j d d}tj| j d  | j|S )	Nzapplication/jsonr   )AcceptzX-Auth-Tokenz"https://api.apility.net/baddomain/   
_useragent)headerstimeout	useragentr	   )r   r   fetchUrltimesleepparseApiResponse)r   qryr%   resr   r   r   queryBadDomain:   s    zsfp_apility.queryBadDomainc             C   sH   d| j d d}| jjd| |d| j d d}tj| j d  | j|S )	Nzapplication/jsonr   )r"   zX-Auth-Tokenzhttps://api.apility.net/badip/r#   r$   )r%   r&   r'   r	   )r   r   r(   r)   r*   r+   )r   r,   r%   r-   r   r   r   
queryBadIpJ   s    zsfp_apility.queryBadIpc             C   sH   d| j d d}| jjd| |d| j d d}tj| j d  | j|S )	Nzapplication/jsonr   )r"   zX-Auth-Tokenz https://api.apility.net/v2.0/ip/r#   r$   )r%   r&   r'   r	   )r   r   r(   r)   r*   r+   )r   r,   r%   r-   r   r   r   queryIp\   s    zsfp_apility.queryIpc             C   sH   d| j d d}| jjd| |d| j d d}tj| j d  | j|S )	Nzapplication/jsonr   )r"   zX-Auth-Tokenz#https://api.apility.net/v2.0/as/ip/r#   r$   )r%   r&   r'   r	   )r   r   r(   r)   r*   r+   )r   r,   r%   r-   r   r   r   	queryAsIpm   s    zsfp_apility.queryAsIpc             C   s   |d dkr$| j jdd d| _d S |d dkr4d S |d d krDd S |d dkrh| j jd	d d| _d S ytj|d }W n, tk
r } z| j jd
 d S d }~X nX |S )Ncode429z&You are being rate-limited by apility FT404contentUnauthorizedzAuthentication failedzError processing JSON response.)r   errorr   jsonloads	Exceptiondebug)r   r-   dataer   r   r   r+   |   s$    zsfp_apility.parseApiResponsec             C   s  |j }|j}|j}| jrd S || jkr*d S | jd dkrP| jjdd d| _d S d| j|< | jjd| d |  |dkr| j	|}|d kr| jjd	|  d S |j
d
}|s| jjd	|  d S xH|D ]@}|dkr| jd  rqtd|d | d | j|}| j| qW |dkr| j|}|d kr@| jjd	|  d S |j
d
}|sd| jjd	|  d S tdt|| j|}| j| |j
dr|j
dj
d}	|	r| jj|	rtd|	| j|}| j| |j
d}
|
s| jjd	|  d S |
j
drTxV|
j
dD ]H}|dkr(| jd  r(qtd|d | d | j|}| j| qW |
j
drx<|
j
dD ].}|dkr~qltd|| j|}| j| qlW |
j
drx<|
j
dD ].}|dkrȐqtd|| j|}| j| qW d S )Nr   r   z3You enabled sfp_apility but did not set an API key!FTzReceived event, z, from r   zNo matches found for responseZFREEMAILr
   r   z []r   r    ipaddressdomain	blacklistr   mx.r   nsr   )	eventTypemoduler<   r   r   r   r   r7   r;   r/   getr   __name__notifyListenersr.   strvalidIP)r   event	eventNamesrcModuleName	eventDatar<   r-   mevt
ip_addressrB   rD   rF   r   r   r   handleEvent   s    














zsfp_apility.handleEvent)rJ   
__module____qualname____doc__r   optdescsr   r   dictr   r   r!   r.   r/   r0   r1   r+   rU   r   r   r   r   r      s$   	r   )r8   r)   sflibr   r   r   r   r   r   r   r   <module>   s   