3
@6^:                 @   sD   d dl Z d dlZd dlmZ d dlmZmZmZ G dd deZdS )    N)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc               @   sz   e Zd ZdZdddddZddddd	Zd
Zd
Zd
Ze	 fddZ
dd Zdd Zdd Zdd ZdddZdddZd
S )sfp_dnsresolvez|DNS Resolver:Footprint,Investigate,Passive:DNS::Resolves Hosts and IP Addresses identified, also extracted from raw content.T   )validatereverseskipcommononwildcardnetblocklookupmaxnetblockzqIf wildcard DNS is detected, only attempt to look up the first common sub-domain from the common sub-domain list.zyValidate that reverse-resolved hostnames still resolve back to that IP before considering them as aliases of your target.zvLook up all IPs on netblocks deemed to be owned by your target for possible hosts on the same target subdomain/domain?z\Maximum owned netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.))r	   r   r
   r   Nc             C   sR   || _ | j | _| j | _| j | _d| _x"t|j D ]}|| | j|< q8W d S )NDNS)	sftempStorageevents
domresultshostresults__dataSource__listkeysopts)selfsfcuserOptsopt r   9/var/www/spiderfoot.crq.systems/modules/sfp_dnsresolve.pysetup+   s    


zsfp_dnsresolve.setupc             C   s   t  }| jjd | jj|| jd }|s.|S xz|D ]r}| jjd|  | jj|rb|j|d q4| jj|r||j|d q4|j|d |j	d}||kr4|j|d q4W | jjdt
|j   |S )	Nz+Identifying aliases for specified target(s)r   zFound an alias: 
IP_ADDRESSIPV6_ADDRESSINTERNET_NAMEidnazAliases identified: )r   r   inforesolveTargetsr   debugvalidIPsetAliasvalidIP6encodestr
getAliases)r   targetrethostZidnahostr   r   r   enrichTarget5   s"    

	zsfp_dnsresolve.enrichTargetc             C   s4   ddddddddd	d
ddddddddddddddgS )NCO_HOSTED_SITEAFFILIATE_INTERNET_NAMENETBLOCK_OWNERr   r   r   AFFILIATE_IPADDRTARGET_WEB_CONTENTBASE64_DATAAFFILIATE_DOMAIN_WHOISCO_HOSTED_SITE_DOMAIN_WHOISDOMAN_WHOISNETBLOCK_WHOISLEAKSITE_CONTENTRAW_DNS_RECORDSRAW_FILE_META_DATARAW_RIR_DATASEARCH_ENGINE_WEB_CONTENTSIMILARDOMAIN_WHOISSSL_CERTIFICATE_RAWSSL_CERTIFICATE_ISSUEDTCP_PORT_OPEN_BANNERWEBSERVER_BANNERWEBSERVER_HTTPHEADERSr   )r   r   r   r   watchedEventsU   s    zsfp_dnsresolve.watchedEventsc          
   C   s   ddddddddd	d
g
S )Nr   r   r/   r1   DOMAIN_NAMEr   DOMAIN_NAME_PARENTCO_HOSTED_SITE_DOMAINAFFILIATE_DOMAIN_NAMEINTERNET_NAME_UNRESOLVEDr   )r   r   r   r   producedEventsf   s    zsfp_dnsresolve.producedEventsc             C   s~  |j }|j}|j}| jj|}d }|}|d&kr:d|kr:d S | jjd| d |  || jkrl| jjd d S d| j|< |d'k rd	|krd
}nd}| jj|| jd rt	||| j
|}	| j|	 | jj|| jd }
|
|krd S t	||
| j
|}	| j|	 d S |d(krtjj|j }xj| j j D ]X}| j r<d S |j|}|dk rTq(|dkrj|t|7 }tjd| d tjtjB }x|dkr~|j||}|dk rP ||d |t| d  }yhtj||}|r,xP|D ]H}|jdr|dd  }n|}d|krtjj|}| j||d qW W n> tk
rl } z | jjdt| d d W Y d d }~X nX |t|7 }qW q(W d S |dkr| jd sd S t |j!| jd k r| jjdtt |j! d t| jd   d S d|krd S | jjd |  xt |D ]}t|}d|kr,q|j"dd! d)krDqd"|j"dkrXq| j rfd S | jj#|}|r| jjd$| d% t| d  x*|D ]"}| j rd S | j||d qW qW d S |d*krzd|kr| jj$|}n| jj#|}|sd S xr|D ]j}| j rd S | j j%|r>| j||d n6| jj&|rfd	|krf| j||d n| j||d qW d S )+Nr   Z_NAMEzReceived event, z, from zSkipping duplicate event.Tr.   r/   
AFFILIATE_rG   rF   _internettldsr0   r   r   r   r1   r   z![^a-z0-9\-\.\%]([a-z0-9\-\.\%]*\.)      .%FzError applying regex to data (r
   r   z$Network size bigger than permitted: z > z::z"Looking up IPs in owned netblock:    2550zFound a reversed hostname from z ()r   )r.   r/   )r.   r/   r0   r   r   r   r1   )rR   rS   )r   r   r   r1   r/   )'	eventTypemoduledatar   
hashstringr#   r   isDomainr   r   __name__notifyListeners
hostDomainurllibparseunquotelower	getTargetgetNamescheckForStopfindlenrecompileDOTALL	MULTILINEfindall
startswithprocessHost	Exceptionerrorr(   r   	prefixlensplit	resolveIPresolveHostmatchesr$   )r   event	eventNamesrcModuleName	eventDataeventDataHashaddrsparentEventevevtdomrV   nameoffsetpatZ	chunkhostrr   matchmeipipaddraddrr   r   r   handleEventn   s    




 






,








zsfp_dnsresolve.handleEventc             C   sj  | j j|j}|| jkr&|g| j|< nF|| j| ks>|j|krV| j jd| d  d S | j| |g | j|< | j jd|  |d krd}| j j|rd}| j j|s| j j|}|rx$|D ]}| j j|rd}qW n|}|r| j j|rd}nd}n,| j j|rd}n| j j	|r d	}nd
}|j
d
rv| j j|}	|d
krl|	 rltd|| j|}
| j|
 d S |	svd S ||jkr||jkrt||| j|}
| j|
 n|}
|d
kr| j j|| jd }| j||
 | j j|}|rx(|D ] }td	|| j|
}| j| qW |dkrf| j j|| jd }||krX| j j|| jd  rX|
S | j||
d |
S )NzSkipping host, z, already processed.zFound host: TFr1   r/   r   r   r   rH   rK   )r   rW   rV   r   r#   r`   rr   r$   rq   r&   endswithr   rY   rZ   rT   r[   r   processDomainresolveHost6rX   )r   r,   ry   	affiliate
parentHashaffilhostipshostiphtyperesolvedr{   r|   Zip6sip6Zevt6r   r   r   rk     sn    







"zsfp_dnsresolve.processHostFc             C   s   || j krd| j |< n| jjd| d  d S |rPtd|| j|}| j| d S | j j|rztd|| j|}| j| ntd|| j|}| j| d S d S )NTzSkipping domain, z, already processed.rG   rD   rE   )r   r   r#   r   rY   rZ   r`   rr   )r   Z
domainNamery   r   Zdomevtr   r   r   r   [  s"    





zsfp_dnsresolve.processDomain)N)F)rY   
__module____qualname____doc__r   optdescsr   r   r   dictr   r-   rC   rI   r   rk   r   r   r   r   r   r      s(   
  
Pr   )	re   r\   netaddrr   sflibr   r   r   r   r   r   r   r   <module>   s   