3
@6^/ @ sh d dl mZmZ d dlZd dlmZmZmZ ddddgdd d
d dd gd
d d
dZG dd deZ dS ) ) IPAddress IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventcoiniplistipnetblockzBhttps://zerodot1.gitlab.io/CoinBlockerLists/MiningServerIPList.txtz^{0}$)idtypechecksurlregexcoindomdomainz4https://zerodot1.gitlab.io/CoinBlockerLists/list.txt)zCoinBlocker IP ListzCoinBlocker Domain Listc @ s e Zd ZdZddddddddZddddd d
d dZd Ze fd
dZdd Z dd Z
dd Z dd Z dd Z
dd Zdd Zd S ) sfp_coinblockerztCoinBlocker Lists:Investigate,Passive:Reputation Systems::Check if a host/domain or IP appears on CoinBlocker lists.T )r r checkaffiliates checkcohosts cacheperiodchecknetblocks checksubnetsz Enable CoinBlocker IP check?z!Enable CoinBlocker Domains check?zApply checks to affiliates?z?Apply checks to sites found to be co-hosted on the target's IP?z,Hours to cache list data before re-fetching.z=Report if any malicious IPs are found within owned netblocks?zJCheck if any malicious IPs are found within the same subnet of the target?Nc C s8 || _ | j | _x"t|j D ]}|| | j|< q W d S )N)sf tempStorageresultsr keysopts)selfsfcuserOptsopt r" :/var/www/spiderfoot.crq.systems/modules/sfp_coinblocker.pysetupB s
zsfp_coinblocker.setupc C s dddddddgS )N
INTERNET_NAME
IP_ADDRESSNETBLOCK_MEMBERAFFILIATE_INTERNET_NAMEAFFILIATE_IPADDRCO_HOSTED_SITENETBLOCK_OWNERr" )r r" r" r#
watchedEventsN s z sfp_coinblocker.watchedEventsc C s dddddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDR!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_SUBNETMALICIOUS_COHOSTMALICIOUS_NETBLOCKr" )r r" r" r# producedEventsV s z sfp_coinblocker.producedEventsc C s t |dkrDx6|D ].}tj||tjtjB r| jjd| dS qW t |dkrx6|D ].}tj||tjtjB rV| jjd| dS qVW | jjd d S )Nr z#Found to be bad against bad regex: Tz$Found to be good againt good regex: Fz Neither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr debug)r content goodregexbadregexrxr" r" r# contentMalicious\ s
z sfp_coinblocker.contentMaliciousc C s | j jd| d | xttj D ]}t| d }||kr&t| d dkr&tt| d }| j j|j|| jd | jd d }|d
d kr| j j d |j| d d S | j
|d
t| d
t| d r&|j|S q&W d S )Nz Querying z for maliciousness of r r queryr
_fetchtimeout
_useragent)timeout useragentr; zUnable to fetch Fr< r= ) r r: r malchecksr strfetchUrlformatr errorr? )r r target
targetTypecheckcidr resr" r" r#
resourceQueryp s $
z sfp_coinblocker.resourceQueryc C s d}|dkr | j j|| jd }xjttj D ]X}t| d }||koXt| d dkr0t }t| d }| j jd| | jjd d
|d < |d d kr| j j || jd | jd
d}|d d kr| j j
d| d d S | j j d| |d |dkrFt } dt| krt| d j dd}
t
j|
t
j} | j jd| d |
xP|d jdD ].} t
j| | }
t|
d
krV| j|
d
qVW n|d jd} x| D ]}t|dk s|jdrq|j }y6t|t|kr| j j|d | d | |S W n< tk
r: } z | j jd t| wW Y d d }~X nX qW d S dt| krxZ|d jdD ]H} | |ks|dkrd| |krd| j j|d | d | d |S qdW q0ytt| d j|}tt| d j|}xj|d jdD ]X} |dkrt
j || t
js"t
j || t
jr| j j|d | d | d |S qW W q0 t k
r } z | j jd t| w0W Y d d }~X q0X q0W d S )!N r
_internettldsr r r r sfmal_r r r; rA rB )rC rD zUnable to fetch Fr
r z{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z:
#z found within netblock/subnet z in zError encountered parsing: /z
found in z list.z Error encountered parsing 2: ) r
hostDomainr r rE r dictcacheGetgetrG rI cachePutreplacer6 compiler8 r: splitfindallr5 append
startswithstripr r ExceptionrF rH r7
BaseException)r r rJ rK targetDomrL rM datar iplistr> patlinegrpr erxDomrxTgtr" r" r# resourceList sr
z sfp_coinblocker.resourceListc C s xt tj D ]}t| d }||kr|t| d kr| jjd| d | d | t| d dkrt| j|||S t| d dkr| j|||S qW d S ) Nr r
zChecking maliciousness of z (z) with: r r@ r )r rE r r r: rO rn )r
resourceIditemTyperJ rL rM r" r" r#
lookupItem s zsfp_coinblocker.lookupItemc C s |j }|j}|j}| jjd| d | || jkrL| jjd| d d S d| j|< |dkrr| jjdd rrd S |d kr| jjd
d rd S |d kr| jjd d rd S |d
kr| jjdd rd S xtt j
D ]}t | d }| j| r|d!krd}|dkrd}nd}|d"krLd}|dkr0d}|dkr>d}|dkrLd}|d kr^d}d}|d
krpd}d }| j |||} | j rd S | d k r|d | d d | d }
t
||
| j|} | j| qW d S )#NzReceived event, z, from z Skipping z, already checked.Tr* r Fr) r r+ r r' r r r& r r- r/ r% r( r r. r0 r2 r
r3 r1 z [z]
zz)r& r) )r% r* r( ) eventTypemodulerf r r: r r rZ r rE r rq checkForStopr __name__notifyListeners) r event eventName
srcModuleName eventDatarL rM typeIdevtTyper textevtr" r" r# handleEvent s`
zsfp_coinblocker.handleEvent)ru
__module__ __qualname____doc__r optdescsr rX r$ r, r4 r? rO rn rq r r" r" r" r# r # s0 Mr )
netaddrr r r6 sflibr r r rE r r" r" r" r#
s