U
@6^/ @ sh d dl mZmZ d dlZd dlmZmZmZ ddddgdd d
d dd gd
d d
dZG dd deZ dS ) ) IPAddress IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventcoiniplistipnetblockzBhttps://zerodot1.gitlab.io/CoinBlockerLists/MiningServerIPList.txtz^{0}$)idtypechecksurlregexcoindomdomainz4https://zerodot1.gitlab.io/CoinBlockerLists/list.txt)zCoinBlocker IP ListzCoinBlocker Domain Listc @ s e Zd ZdZddddddddZddddd d
d dZd Ze fd
dZdd Z dd Z
dd Z dd Z dd Z
dd Zdd Zd S ) sfp_coinblockerztCoinBlocker Lists:Investigate,Passive:Reputation Systems::Check if a host/domain or IP appears on CoinBlocker lists.T )r r checkaffiliates checkcohosts cacheperiodchecknetblocks checksubnetsz Enable CoinBlocker IP check?z!Enable CoinBlocker Domains check?zApply checks to affiliates?z?Apply checks to sites found to be co-hosted on the target's IP?z,Hours to cache list data before re-fetching.z=Report if any malicious IPs are found within owned netblocks?zJCheck if any malicious IPs are found within the same subnet of the target?Nc C s4 || _ | | _t| D ]}|| | j|< q d S )N)sf tempStorageresultsr keysopts)selfsfcuserOptsopt r" :/var/www/spiderfoot.crq.systems/modules/sfp_coinblocker.pysetupB s
zsfp_coinblocker.setupc C s dddddddgS )N
INTERNET_NAME
IP_ADDRESSNETBLOCK_MEMBERAFFILIATE_INTERNET_NAMEAFFILIATE_IPADDRCO_HOSTED_SITENETBLOCK_OWNERr" r r" r" r#
watchedEventsN s z sfp_coinblocker.watchedEventsc C s dddddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDR!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_SUBNETMALICIOUS_COHOSTMALICIOUS_NETBLOCKr" r, r" r" r# producedEventsV s z sfp_coinblocker.producedEventsc C s t |dkrB|D ]0}t||tjtjB r| jd| dS qt |dkr|D ]0}t||tjtjB rR| jd| dS qR| jd d S )Nr z#Found to be bad against bad regex: Tz$Found to be good againt good regex: Fz Neither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr debug)r content goodregexbadregexrxr" r" r# contentMalicious\ s z sfp_coinblocker.contentMaliciousc C s | j d| d | tt D ]}t| d }||kr$t| d dkr$tt| d }| j j||| jd | jd d }|d
d kr| j d || d d S |
|d
t| d
t| d r$|| S q$d S )Nz Querying z for maliciousness of r r queryr
_fetchtimeout
_useragenttimeout useragentr< Unable to fetch Fr= r> ) r r; r malchecksr strfetchUrlformatr errorr@ )r r target
targetTypecheckcidr resr" r" r#
resourceQueryp s $
z sfp_coinblocker.resourceQueryc C s d}|dkr | j || jd }tt D ]t}t| d }||kr,t| d dkr,t }t| d }| j d| | jd d
|d < |d d kr| j j || jd | jd
d}|d d kr| j
d| d d S | j d| |d |dkrNt } dt| krt| d dd}
t
|
t
j} | j d| d |
|d dD ].} t
| | }
t|
d
krR| |
d
qRn|d d} | D ]}t|dk s|drq| }z@t|t|kr| j |d | d | |W S W nB tk
rB } z"| j d t| W Y qW 5 d }~X Y nX q d S dt| kr|d dD ]P} | |ks|dkrj| |krj| j |d | d | d | S qjq,ztt| d |}tt| d |}|d dD ]b} |dkrt
|| t
js,t
|| t
jr| j |d | d | d | W S qW q, t k
r } z | j d t| W Y q,W 5 d }~X Y q,X q,d S )!N r
_internettldsr r r r sfmal_r r r< rB rC rD rG Fr
r z{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z:
#z found within netblock/subnet z in zError encountered parsing: /z
found in z list.z Error encountered parsing 2: ) r
hostDomainr r rH r dictcacheGetgetrJ rL cachePutreplacer7 compiler9 r; splitfindallr6 append
startswithstripr r ExceptionrI rK r8
BaseException)r r rM rN targetDomrO rP datar iplistr? patlinegrpr erxDomrxTgtr" r" r# resourceList s
z sfp_coinblocker.resourceListc C s t t D ]}t| d }||kr |t| d kr | jd| d | d | t| d dkrv| ||| S t| d dkr | ||| S q d S ) Nr r
zChecking maliciousness of z (z) with: r rA r )r rH r r r; rR rq )r
resourceIditemTyperM rO rP r" r" r#
lookupItem s zsfp_coinblocker.lookupItemc C s |j }|j}|j}| jd| d | || jkrL| jd| d d S d| j|< |dkrp| jddspd S |d kr| jd
dsd S |d kr| jd dsd S |d
kr| jddsd S tt
D ]}t | d }| j| r|dkrd}|dkrd}nd}|dkr>d}|dkr"d}|dkr0d}|dkr>d}|d krPd }d }|d
krbd }d }| |||} | r d S | d k r|d | d d! | d" }
t
||
| j|} | | qd S )#NzReceived event, z, from z Skipping z, already checked.Tr* r Fr) r r+ r r' r r )r& r) r r& r. r0 )r% r* r( r r% r/ r( r1 r3 r
r4 r2 z [z]
zz) eventTypemoduleri r r; r r r] r rH r rt checkForStopr __name__notifyListeners) r event eventName
srcModuleName eventDatarO rP typeIdevtTyper textevtr" r" r# handleEvent s`
zsfp_coinblocker.handleEvent)rx
__module__ __qualname____doc__r optdescsr r[ r$ r- r5 r@ rR rq rt r r" r" r" r# r # s4
Mr )
netaddrr r r7 sflibr r r rH r r" r" r" r#
s