U
    @6^                      @   s8   d dl Z d dlZd dlmZmZmZ G dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventc                   @   s~   e Zd ZdZddddZddddZd	Zd
Ze fddZ	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zdd Zd	S )sfp_apilityzxApility:Footprint,Investigate,Passive:Reputation Systems:apikey:Search Apility API for IP address and domain reputation.    T)api_keydelaymalicious_freemailzApility API key.z#Delay between requests, in seconds.z+Consider free mail servers to be malicious.NFc                 C   s:   || _ |  | _d| _t| D ]}|| | j|< q"d S )NF)sftempStorageresults
errorStatelistkeysopts)selfsfcuserOptsopt r   6/var/www/spiderfoot.crq.systems/modules/sfp_apility.pysetup'   s
    
zsfp_apility.setupc                 C   s   ddgS )N
IP_ADDRESSINTERNET_NAMEr   r   r   r   r   watchedEvents0   s    zsfp_apility.watchedEventsc                 C   s   ddddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEr   PROVIDER_MAILPROVIDER_DNSRAW_RIR_DATAr   r   r   r   r   producedEvents4   s       zsfp_apility.producedEventsc                 C   sH   d| j d d}| jjd| |d| j d d}t| j d  | |S )	Napplication/jsonr   AcceptzX-Auth-Tokenz"https://api.apility.net/baddomain/   
_useragentheaderstimeout	useragentr	   r   r   fetchUrltimesleepparseApiResponser   qryr)   resr   r   r   queryBadDomain:   s    zsfp_apility.queryBadDomainc                 C   sH   d| j d d}| jjd| |d| j d d}t| j d  | |S )	Nr#   r   r$   zhttps://api.apility.net/badip/r&   r'   r(   r	   r,   r1   r   r   r   
queryBadIpJ   s    zsfp_apility.queryBadIpc                 C   sH   d| j d d}| jjd| |d| j d d}t| j d  | |S )	Nr#   r   r$   z https://api.apility.net/v2.0/ip/r&   r'   r(   r	   r,   r1   r   r   r   queryIp\   s    zsfp_apility.queryIpc                 C   sH   d| j d d}| jjd| |d| j d d}t| j d  | |S )	Nr#   r   r$   z#https://api.apility.net/v2.0/as/ip/r&   r'   r(   r	   r,   r1   r   r   r   	queryAsIpm   s    zsfp_apility.queryAsIpc              
   C   s   |d dkr$| j dd d| _d S |d dkr4d S |d d krDd S |d dkrh| j d	d d| _d S zt|d }W n4 tk
r } z| j d
 W Y d S d }~X Y nX |S )Ncode429z&You are being rate-limited by apility FT404contentUnauthorizedzAuthentication failedzError processing JSON response.)r   errorr   jsonloads	Exceptiondebug)r   r3   dataer   r   r   r0   |   s$    zsfp_apility.parseApiResponsec                 C   s  |j }|j}|j}| jrd S || jkr*d S | jd dkrP| jdd d| _d S d| j|< | jd| d |  |dkr| 	|}|d kr| jd	|  d S |
d
}|s| jd	|  d S |D ]>}|dkr| jd sqtd|d | d | j|}| | q|dkr| |}|d kr:| jd	|  d S |
d
}|s^| jd	|  d S tdt|| j|}| | |
dr|
d
d}	|	r| j|	rtd|	| j|}| | |
d}
|
s| jd	|  d S |

drH|

dD ]F}|dkr| jd sq td|d | d | j|}| | q |

dr|

dD ].}|dkrpq^td|| j|}| | q^|

dr|

dD ].}|dkrqtd|| j|}| | qd S )Nr   r   z3You enabled sfp_apility but did not set an API key!FTzReceived event, z, from r   zNo matches found for responseZFREEMAILr
   r   z []r   r!   ipaddressdomain	blacklistr   mx.r   nsr    )	eventTypemodulerB   r   r   r   r   r=   rA   r5   getr   __name__notifyListenersr4   strvalidIP)r   event	eventNamesrcModuleName	eventDatarB   r3   mevt
ip_addressrH   rJ   rL   r   r   r   handleEvent   s    













zsfp_apility.handleEvent)rP   
__module____qualname____doc__r   optdescsr   r   dictr   r   r"   r4   r5   r6   r7   r0   r[   r   r   r   r   r      s(   	r   )r>   r.   sflibr   r   r   r   r   r   r   r   <module>   s   