3
@6^=                 @   sD   d dl Z d dlZd dlmZ d dlmZmZmZ G dd deZdS )    N)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc               @   s   e Zd ZdZddddddddddd	d
ZddddddddddddZdZdZdZdZ	dZ
e fddZdd Zdd Zd$d d!Zd"d# ZdS )%sfp_binaryedgezBinaryEdge:Footprint,Investigate,Passive:Search Engines:apikey:Obtain information from BinaryEdge.io's Internet scanning systems about breaches, vulerabilities, torrents and passive DNS.    Z   
   TF   d   )binaryedge_api_keytorrent_age_limit_dayscve_age_limit_daysport_age_limit_daysmaxpagesverifynetblocklookupmaxnetblocksubnetlookup	maxsubnet	maxcohostzBinaryEdge.io API Key.zDIgnore any torrent records older than this many days. 0 = unlimited.zJIgnore any vulnerability records older than this many days. 0 = unlimited.zRIgnore any discovered open ports/banners older than this many days. 0 = unlimited.zCVerify that any hostnames found on the target domain still resolve?zMaximum number of pages to iterate through, to avoid exceeding BinaryEdge API usage limits. APIv2 has a maximum of 500 pages (10,000 results).zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zbStop reporting co-hosted sites after this many are found, as it would likely indicate web hosting.)r   r   r   r   r   r   r   r   r   r   r   Nr   c             C   sX   || _ | j | _| j | _| j | _d| _d| _x"t|j D ]}|| | j	|< q>W d S )Nr   F)
sftempStorageresultsreportedhosts
checkedipscohostcount
errorStatelistkeysopts)selfsfcuserOptsopt r&   9/var/www/spiderfoot.crq.systems/modules/sfp_binaryedge.pysetup=   s    


zsfp_binaryedge.setupc             C   s   dddddgS )N
IP_ADDRESSDOMAIN_NAME	EMAILADDRNETBLOCK_OWNERNETBLOCK_MEMBERr&   )r"   r&   r&   r'   watchedEventsL   s    zsfp_binaryedge.watchedEventsc          
   C   s   ddddddddd	d
g
S )NINTERNET_NAMEVULNERABILITYTCP_PORT_OPENTCP_PORT_OPEN_BANNEREMAILADDR_COMPROMISEDUDP_PORT_OPENUDP_PORT_OPEN_INFOr*   CO_HOSTED_SITEMALICIOUS_IPADDRr&   )r"   r&   r&   r'   producedEventsQ   s    zsfp_binaryedge.producedEvents   c             C   s  d }t  }| jrd S |dkr d}|dkr,d}|dkr8d}|dkrDd}|d	krPd
}|dkr\d}d}d| jd i}||j|jddd| }	| jj|	| jd d|d}
|
d d'kr| jjdd d| _d S |
d d kr| jjd|  d S t	|
d dkr| jjd|  d S yt
j|
d }W n0 tk
rN } z| jjdd d S d }~X nX |jd r|d! |jd"d#|jd d kr|d  d$ }|| jd% kr| jjd&d |gS |j| | j|||}|r|j| n
|j| |S )(Nemailz&/v2/query/dataleaks/email/{0}?page={1}portsz/v2/query/ip/{0}?page={1}torrentz)/v2/query/torrent/historical/{0}?page={1}vulnz/v2/query/cve/ip/{0}?page={1}subsz(/v2/query/domains/subdomain/{0}?page={1}passivez!/v2/query/domains/ip/{0}?page={1}zhttps://api.binaryedge.iozX-Keyr   zutf-8replace)errors_fetchtimeoutr   )timeout	useragentheaderscode429500zbBinaryEdge.io API key seems to have been rejected or you have exceeded usage limits for the month.FTcontentz No BinaryEdge.io info found for r   z2Error processing JSON response from BinaryEdge.io.pagetotalpagesizer   r9   r   z Maximum number of pages reached.)rG   rH   )r   r   r!   formatencoder   fetchUrlerrorinfolenjsonloads	Exceptiongetappendqueryextend)r"   qry	querytyperJ   retZretarrZqueryurlZbinaryedgeurlrE   urlresrQ   er&   r&   r'   rX   W   s^    
.

zsfp_binaryedge.queryc             C   s	  |j }|j}|j}| jrd S | jjd| d |  | jd dkrZ| jjdd d| _d S || jkr|| jjd| d	  d S d| j|< |d
kr| jd sd S t	|j
| jd k r| jjdtt	|j
 d t| jd   d S |dkr@| jd  sd S t	|j
| jd k r@| jjdtt	|j
 d t| jd   d S t }|jdrx:t	|D ]"}|jt| d| jt|< q\W n
|j| |dkrd}| j|d}|d kr| jjd|  d S x|D ]}	d|	krq| jjd |	d }
x|
D ]}	|	d }||krq| j j|ddr| jd rH| jj|sHqtd|| j|}| j| | jj|| jd rtd|| j|}| j| d| j|< q| j| jd k rt||| j|}| j| |  jd 7  _qW qW |d!krd"}| j|d#}|d kr| jjd$|  d S xf|D ]^}	d|	kr6q$| jjd% |	d }
x4|
D ],}	t||d& |	 d' | j|}| j| qPW q$W |dkrhd}| j|d(}|d kr| jjd)|  d S x|D ]}	d|	kr֐q| jjd* |	d }
xv|
D ]n}	|	| jkrqn
d| j|	< | jd rB| jj|	sB| jjd+|	 d,  qt||	| j|}| j| qW qW x:|D ]0}| j rd S || jkrqpd-}| j|d.}|d kr| jjd/|  d S x|D ]}	d|	krڐq| jjd0 |	d }
x|
D ]}	|	d1 jd2d3 }ttj d4| jd5   }| jd5 d6krN||k rN| jjd7 qd8|	jd.d9jd: d; |	jd.jd<d9 }t||| j|}| j| qW qW qpW x<|D ]2}| j rd S || jkrҐqd=}| j|d>}|d kr | jjd?|  d S x|D ]}	d|	krqd@|	d kr*q| jjdA |	d d@ }
x|
D ]}	|	jd2d3 }ttj d4| jdB   }| jdB d6kr||k r| jjd7 qHx4|	dC D ](}|dD }t||| j|}| j| qW qHW qW qW x|D ]}| j rd S || jkrq| j|dE}|d kr<| jjdF|  d S x|D ]}	d|	krXqD| jjdG |	d }t }xz|D ]p}
xf|
d@ D ]X}|d1 jd2d3 }ttj d4| jdH   }| jdH d6kr||k r| jjd7 q|dI dJ dK t|dI dL  }dM}dN}|dI dO dPkr*dQ}dR}|dK t|dI dL  |krt||| j|}| j| |j|dK t|dI dL   y2|dS dT dU dV }t||| j|}| j| W n0 tk
r } z| jjdW W Y d d }~X nX qW qzW qDW qW x|D ]}d| j|< 	qW d S )XNzReceived event, z, from r   r   z6You enabled sfp_binaryedge but did not set an API key!FTz	Skipping z as already mapped.r,   r   r   z$Network size bigger than permitted: z > r-   r   r   	NETBLOCK_r)   r6   r?   zNo Passive DNS info for eventsz*Found passive DNS results in BinaryEdge.iodomain)includeParentsr   r/   _internettldsr*   r   r9   r+   r3   r:   zNo leak info for z2Found compromised account results in BinaryEdge.ioz []r>   zNo hosts found for z#Found host results in BinaryEdge.iozCouldn't resolve z, so skipping.r7   r<   zNo torrent info for z&Found torrent results in BinaryEdge.ioorigintsi  iQ r   r   z#Record found but too old, skipping.z	Torrent: z???namez @ sourcer0   r=   zNo vulnerability info for r   z,Found vulnerability results in BinaryEdge.ior   Zcvescver;   zNo port/banner info for z*Found port/banner results in BinaryEdge.ior   targetip:portr1   r2   protocoludpr4   r5   resultdataservicebannerzNo banner information found.) 	eventTypemodulerr   r   r   debugr!   rP   r   r   	prefixlenstrr   
startswithrW   rX   rQ   	getTargetmatchesresolveHostr   __name__notifyListenersisDomainr   r   checkForStopr   rV   inttimeBaseException)r"   event	eventNamesrcModuleName	eventDataqrylistipaddrevtTyper\   recr^   hostevtr_   addr
created_tsage_limit_tsdatcrj   Zallresr;   precentityZevttypeZevtbtypeevrt   r&   r&   r'   handleEvent   s   





























,




"


 
6
zsfp_binaryedge.handleEvent)r9   )r~   
__module____qualname____doc__r!   optdescsr   r   r   r   r   dictr(   r.   r8   rX   r   r&   r&   r&   r'   r      sB   
>r   )	rS   r   netaddrr   sflibr   r   r   r   r&   r&   r&   r'   <module>   s   