U
    @6^=                     @   sD   d dl Z d dlZd dlmZ d dlmZmZmZ G dd deZdS )    N)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc                   @   s   e Zd ZdZddddddddddd	d
ZddddddddddddZdZdZdZdZ	dZ
e fddZdd Zdd Zd$d d!Zd"d# ZdS )%sfp_binaryedgezBinaryEdge:Footprint,Investigate,Passive:Search Engines:apikey:Obtain information from BinaryEdge.io's Internet scanning systems about breaches, vulerabilities, torrents and passive DNS.    Z   
   TF   d   )binaryedge_api_keytorrent_age_limit_dayscve_age_limit_daysport_age_limit_daysmaxpagesverifynetblocklookupmaxnetblocksubnetlookup	maxsubnet	maxcohostzBinaryEdge.io API Key.zDIgnore any torrent records older than this many days. 0 = unlimited.zJIgnore any vulnerability records older than this many days. 0 = unlimited.zRIgnore any discovered open ports/banners older than this many days. 0 = unlimited.zCVerify that any hostnames found on the target domain still resolve?zMaximum number of pages to iterate through, to avoid exceeding BinaryEdge API usage limits. APIv2 has a maximum of 500 pages (10,000 results).zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zbStop reporting co-hosted sites after this many are found, as it would likely indicate web hosting.)r   r   r   r   r   r   r   r   r   r   r   Nr   c                 C   sT   || _ |  | _|  | _|  | _d| _d| _t| D ]}|| | j	|< q<d S )Nr   F)
sftempStorageresultsreportedhosts
checkedipscohostcount
errorStatelistkeysopts)selfsfcuserOptsopt r&   9/var/www/spiderfoot.crq.systems/modules/sfp_binaryedge.pysetup=   s    


zsfp_binaryedge.setupc                 C   s   dddddgS )N
IP_ADDRESSDOMAIN_NAME	EMAILADDRNETBLOCK_OWNERNETBLOCK_MEMBERr&   r"   r&   r&   r'   watchedEventsL   s     zsfp_binaryedge.watchedEventsc              
   C   s   ddddddddd	d
g
S )NINTERNET_NAMEVULNERABILITYTCP_PORT_OPENTCP_PORT_OPEN_BANNEREMAILADDR_COMPROMISEDUDP_PORT_OPENUDP_PORT_OPEN_INFOr*   CO_HOSTED_SITEMALICIOUS_IPADDRr&   r.   r&   r&   r'   producedEventsQ   s        zsfp_binaryedge.producedEvents   c              
   C   s  d }t  }| jrd S |dkr d}|dkr,d}|dkr8d}|dkrDd}|d	krPd
}|dkr\d}d}d| jd i}|||jddd| }	| jj|	| jd d|d}
|
d dkr| jdd d| _d S |
d d kr| jd|  d S t	|
d dkr| jd|  d S zt
|
d }W n8 tk
rV } z| jdd W Y d S d }~X Y nX |dr|d  |d!d"|dd kr|d d# }|| jd$ kr| jd%d |gS || | |||}|r|| n
|| |S )&Nemailz&/v2/query/dataleaks/email/{0}?page={1}portsz/v2/query/ip/{0}?page={1}torrentz)/v2/query/torrent/historical/{0}?page={1}vulnz/v2/query/cve/ip/{0}?page={1}subsz(/v2/query/domains/subdomain/{0}?page={1}passivez!/v2/query/domains/ip/{0}?page={1}zhttps://api.binaryedge.iozX-Keyr   zutf-8replace)errors_fetchtimeoutr   )timeout	useragentheaderscode)429500zbBinaryEdge.io API key seems to have been rejected or you have exceeded usage limits for the month.FTcontentz No BinaryEdge.io info found for r   z2Error processing JSON response from BinaryEdge.io.pagetotalpagesizer   r:   r   z Maximum number of pages reached.)r   r   r!   formatencoder   fetchUrlerrorinfolenjsonloads	Exceptiongetappendqueryextend)r"   qry	querytyperK   retZretarrZqueryurlZbinaryedgeurlrF   urlresrR   er&   r&   r'   rY   W   sf      .

zsfp_binaryedge.queryc                 C   s  |j }|j}|j}| jrd S | jd| d |  | jd dkrZ| jdd d| _d S || jkr|| jd| d	  d S d| j|< |d
kr| jd sd S t	|j
| jd k r| jdtt	|j
 d t| jd   d S |dkr>| jd sd S t	|j
| jd k r>| jdtt	|j
 d t| jd   d S t }|dr~t	|D ]"}|t| d| jt|< qXn
|| |dkrd}| |d}|d kr| jd|  d S |D ]}	d|	krؐq| jd |	d }
|
D ]}	|	d }||kr
q|  j|ddr| jd r<| j|s<qtd|| j|}| | | j|| jd rtd|| j|}| | d| j|< q| j| jd k rt||| j|}| | |  jd 7  _qq|d!krnd"}| |d#}|d kr| jd$|  d S |D ]Z}	d|	kr$q| jd% |	d }
|
D ],}	t||d& |	 d' | j|}| | q<q|dkrHd}| |d(}|d kr| jd)|  d S |D ]}	d|	krq| jd* |	d }
|
D ]n}	|	| jkrqn
d| j|	< | jd r&| j|	s&| jd+|	 d,  qt||	| j|}| | qԐq|D ],}|  rb d S || jkrrqLd-}| |d.}|d kr| jd/|   d S |D ]}	d|	krq| jd0 |	d }
|
D ]}	|	d1 d2d3 }tt d4| jd5   }| jd5 d6kr*||k r*| jd7 qd8|	d.d9d: d; |	d.d<d9 }t||| j|}| | qАqqL|D ]*}|  r d S || jkrqd=}| |d>}|d kr| jd?|   d S |D ]}	d|	krqd@|	d krq| jdA |	d d@ }
|
D ]}	|	d2d3 }tt d4| jdB   }| jdB d6krp||k rp| jd7 q|	dC D ](}|dD }t||| j|}| | qxqqڐq|D ]}|  r d S || jkrؐq| |dE}|d kr| jdF|   d S |D ]}	d|	krq| jdG |	d }t }|D ]j}
|
d@ D ]X}|d1 d2d3 }tt d4| jdH   }| jdH d6kr||k r| jd7 qH|dI dJ dK t|dI dL  }dM}dN}|dI dO dPkrdQ}dR}|dK t|dI dL  |kr<t||| j|}| | ||dK t|dI dL   z2|dS dT dU dV }t||| j|}| | W n0 tk
r } z| jdW W 5 d }~X Y nX qHq:qq|D ]}d| j|< qd S )XNzReceived event, z, from r   r   z6You enabled sfp_binaryedge but did not set an API key!FTz	Skipping z as already mapped.r,   r   r   z$Network size bigger than permitted: z > r-   r   r   	NETBLOCK_r)   r7   r@   zNo Passive DNS info for eventsz*Found passive DNS results in BinaryEdge.iodomain)includeParentsr   r0   _internettldsr*   r   r:   r+   r4   r;   zNo leak info for z2Found compromised account results in BinaryEdge.ioz []r?   zNo hosts found for z#Found host results in BinaryEdge.iozCouldn't resolve z, so skipping.r8   r=   zNo torrent info for z&Found torrent results in BinaryEdge.ioorigintsi  iQ r   r   z#Record found but too old, skipping.z	Torrent: z???namez @ sourcer1   r>   zNo vulnerability info for r   z,Found vulnerability results in BinaryEdge.ior   Zcvescver<   zNo port/banner info for z*Found port/banner results in BinaryEdge.ior   targetip:portr2   r3   protocoludpr5   r6   resultdataservicebannerzNo banner information found.) 	eventTypemodulers   r   r   debugr!   rQ   r   r   	prefixlenstrr   
startswithrX   rY   rR   	getTargetmatchesresolveHostr   __name__notifyListenersisDomainr   r   checkForStopr   rW   inttimeBaseException)r"   event	eventNamesrcModuleName	eventDataqrylistipaddrevtTyper]   recr_   hostevtr`   addr
created_tsage_limit_tsdatcrk   Zallresr<   precentityZevttypeZevtbtypeevru   r&   r&   r'   handleEvent   s   

























,









 
.zsfp_binaryedge.handleEvent)r:   )r   
__module____qualname____doc__r!   optdescsr   r   r   r   r   dictr(   r/   r9   rY   r   r&   r&   r&   r'   r      sF   
>r   )	rT   r   netaddrr   sflibr   r   r   r   r&   r&   r&   r'   <module>   s   