U
    @6^+                     @   sX   d dl mZmZ d dlZd dlmZmZmZ dddddd	gd
diZG dd deZ	dS )    )	IPAddress	IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventzCustom Threat Data_customfeedipnetblockasndomainz^{0}$)idchecksregexc                   @   st   e Zd ZdZddddddZdddd	d
ZdZdZe fddZ	dd Z
dd Zdd Zdd Zdd Zdd ZdS )sfp_customfeedzCustom Threat Feed:Investigate,Passive:Reputation Systems::Check if a host/domain, netblock, ASN or IP is malicious according to your custom feed.T r   )r   checkaffiliatescheckcohostsurlcacheperiodzThe URL where the feed can be found. Exact matching is performed so the format must be a single line per host, ASN, domain, IP or netblock.zApply checks to affiliates?z?Apply checks to sites found to be co-hosted on the target's IP?zIMaximum age of data in hours before re-downloading. 0 to always download.)r   r   r   r   NFc                 C   s:   || _ |  | _d| _t| D ]}|| | j|< q"d S )NF)sftempStorageresults
errorStatelistkeysopts)selfsfcuserOptsopt r    9/var/www/spiderfoot.crq.systems/modules/sfp_customfeed.pysetup5   s
    
zsfp_customfeed.setupc                 C   s   dddddgS )NINTERNET_NAME
IP_ADDRESSAFFILIATE_INTERNET_NAMEAFFILIATE_IPADDRCO_HOSTED_SITEr    r   r    r    r!   watchedEventsB   s     zsfp_customfeed.watchedEventsc                 C   s   dddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDR!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_COHOSTr    r(   r    r    r!   producedEventsI   s
     zsfp_customfeed.producedEventsc                 C   s   t |dkrB|D ]0}t||tjtjB r| jd|   dS qt |dkr|D ]0}t||tjtjB rR| jd|   dS qR| jd d S )Nr   z#Found to be bad against bad regex: Tz$Found to be good againt good regex: FzNeither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr   debug)r   content	goodregexbadregexrxr    r    r!   contentMaliciousO   s    zsfp_customfeed.contentMaliciousc                 C   s  d}|dkr | j || jd }tt D ]b}t| d }| jd }||kr,t }| j d| | jdd|d	< |d	 d kr| j j	|| jd
 | jd d}|d	 d kr| j 
d| d  d S | j d| |d	  |dkr<t }	dt| krrt| d dd}
t|
tj}| j d| d |
  |d	 dD ].}t||}t|dkr@|	|d  q@n|d	 d}	|	D ]}t|dk s|drq| }z@t|t|kr| j |d | d |  |W     S W nB tk
r0 } z"| j dt|  W Y qW 5 d }~X Y nX q d S dt| kr|d	 dD ]P}||ksz|dkrX||krX| j |d | d | d  |    S qXq,ztt| d |}tt| d |}|d	 dD ]b}|dkrt||tjst||tjr| j |d | d | d  |  W   S qW q, tk
r } z | j dt|  W Y q,W 5 d }~X Y q,X q,d S )Nr   r   _internettldsr   r   sfmal_r   r   r6   _fetchtimeout
_useragent)timeout	useragentzUnable to fetch Fr	   r   z{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z: 
   #z found within netblock/subnet z in zError encountered parsing: /z
 found in z list.zError encountered parsing 2: )r   
hostDomainr   r   	malchecksr   dictcacheGetgetfetchUrlerrorcachePutreplacer1   compiler3   r5   splitfindallr0   append
startswithstripr   r   	Exceptionstrformatr2   BaseException)r   r   target
targetType	targetDomcheckcidr   dataiplistr9   patlinegrpr   erxDomrxTgtr    r    r!   resourceListc   s    
 
   zsfp_customfeed.resourceListc                 C   sl   t t D ]Z}t| d }||kr|t| d kr| jd| d | d |  | |||  S qd S )Nr   r   zChecking maliciousness of z (z) with: )r   rF   r   r   r5   re   )r   
resourceIditemTyperX   r[   r\   r    r    r!   
lookupItem   s    zsfp_customfeed.lookupItemc                 C   s  |j }|j}|j}| jd| d |  | jr4d S | jd dkrZ| jdd d| _d S || jkr|| jd| d	  d S d| j|< |d
kr| j	ddsd S |dkr| j	ddsd S |dkr| j	ddsd S |dkr| j	ddsd S t
t D ]}t| d }| j| r|dkr8d}|dkr4d}nd}|dkrJd}d}|dkrd}|dkrfd}|dkrtd }|d
krd!}|dkrd"}d#}|dkrd"}d$}| |||}	|  r d S |	d k	r|d% | d& d' |	 d( }
t||
| j|}| | qd S ))NzReceived event, z, from r   r   z:You enabled sfp_customfeed but defined no custom feed URL!FTz	Skipping z, already checked.r'   r   r&   r   NETBLOCK_OWNERchecknetblocksNETBLOCK_MEMBERchecksubnetsr   )r$   r&   r   r$   r*   r,   )BGP_AS_OWNERBGP_AS_MEMBERr
   MALICIOUS_ASN)r#   r'   r%   r   r#   r+   r%   r-   r.   r	   MALICIOUS_NETBLOCKMALICIOUS_SUBNETz [z]
z<SFURL>z</SFURL>)	eventTypemoduler]   r   r5   r   r   rK   r   rI   r   rF   r   rh   checkForStopr   __name__notifyListeners)r   event	eventNamesrcModuleName	eventDatar[   r\   typeIdevtTyper   textevtr    r    r!   handleEvent   sr    












zsfp_customfeed.handleEvent)ru   
__module____qualname____doc__r   optdescsr   r   rG   r"   r)   r/   r:   re   rh   r   r    r    r    r!   r      s*   

Mr   )
netaddrr   r   r1   sflibr   r   r   rF   r   r    r    r    r!   <module>   s   
