U
    @†6^ä:  ã                   @   sD   d dl Z d dlZd dlmZ d dlmZmZmZ G dd„ deƒZdS )é    N)Ú	IPNetwork)Ú
SpiderFootÚSpiderFootPluginÚSpiderFootEventc                   @   sz   e Zd ZdZdddddœZddddd	œZd
Zd
Zd
Ze	ƒ fdd„Z
dd„ Zdd„ Zdd„ Zdd„ Zddd„Zddd„Zd
S )Úsfp_dnsresolvez|DNS Resolver:Footprint,Investigate,Passive:DNS::Resolves Hosts and IP Addresses identified, also extracted from raw content.Té   )ÚvalidatereverseÚskipcommononwildcardÚnetblocklookupÚmaxnetblockzqIf wildcard DNS is detected, only attempt to look up the first common sub-domain from the common sub-domain list.zyValidate that reverse-resolved hostnames still resolve back to that IP before considering them as aliases of your target.zvLook up all IPs on netblocks deemed to be owned by your target for possible hosts on the same target subdomain/domain?z\Maximum owned netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.))r	   r   r
   r   Nc                 C   sN   || _ |  ¡ | _|  ¡ | _|  ¡ | _d| _t| ¡ ƒD ]}|| | j|< q6d S )NÚDNS)	ÚsfÚtempStorageÚeventsÚ
domresultsÚhostresultsÚ__dataSource__ÚlistÚkeysÚopts)ÚselfÚsfcÚuserOptsÚopt© r   ú9/var/www/spiderfoot.crq.systems/modules/sfp_dnsresolve.pyÚsetup+   s    


zsfp_dnsresolve.setupc                 C   sÂ   t ƒ }| j d¡ | j || jd ¡}|s.|S |D ]r}| j d| ¡ | j |¡r`| |d¡ q2| j |¡rz| |d¡ q2| |d¡ | 	d¡}||kr2| |d¡ q2| j dt
| ¡ ƒ ¡ |S )	Nz+Identifying aliases for specified target(s)r   zFound an alias: Ú
IP_ADDRESSÚIPV6_ADDRESSÚINTERNET_NAMEÚidnazAliases identified: )r   r   ÚinfoÚresolveTargetsr   ÚdebugÚvalidIPÚsetAliasÚvalidIP6ÚencodeÚstrÚ
getAliases)r   ÚtargetÚretÚhostZidnahostr   r   r   ÚenrichTarget5   s"    
	zsfp_dnsresolve.enrichTargetc                 C   s4   ddddddddd	d
ddddddddddddddgS )NÚCO_HOSTED_SITEÚAFFILIATE_INTERNET_NAMEÚNETBLOCK_OWNERr   r   r   ÚAFFILIATE_IPADDRÚTARGET_WEB_CONTENTÚBASE64_DATAÚAFFILIATE_DOMAIN_WHOISÚCO_HOSTED_SITE_DOMAIN_WHOISÚDOMAN_WHOISÚNETBLOCK_WHOISÚLEAKSITE_CONTENTÚRAW_DNS_RECORDSÚRAW_FILE_META_DATAÚRAW_RIR_DATAÚSEARCH_ENGINE_WEB_CONTENTÚSIMILARDOMAIN_WHOISÚSSL_CERTIFICATE_RAWÚSSL_CERTIFICATE_ISSUEDÚTCP_PORT_OPEN_BANNERÚWEBSERVER_BANNERÚWEBSERVER_HTTPHEADERSr   ©r   r   r   r   ÚwatchedEventsU   s2                    özsfp_dnsresolve.watchedEventsc              
   C   s   ddddddddd	d
g
S )Nr   r   r/   r1   ÚDOMAIN_NAMEr   ÚDOMAIN_NAME_PARENTÚCO_HOSTED_SITE_DOMAINÚAFFILIATE_DOMAIN_NAMEÚINTERNET_NAME_UNRESOLVEDr   rC   r   r   r   ÚproducedEventsf   s        ýzsfp_dnsresolve.producedEventsc                 C   sn  |j }|j}|j}| j |¡}d }|}|dkr:d|kr:d S | j d| d | ¡ || jkrl| j d¡ d S d| j|< |dkrüd|krŒd	}nd
}| j || jd ¡r¾t	||| j
|ƒ}	|  |	¡ | j || jd ¡}
|
|krÞd S t	||
| j
|ƒ}	|  |	¡ d S |dkr~tj |¡ ¡ }|  ¡  ¡ D ]T}|  ¡ r8 d S | |¡}|dk rPq"|dkrf|t|ƒ7 }t d| d tjtjB ¡}|dkr"| ||¡}|dk r¦q"||d |t|ƒ d … }zdt ||¡}|r$|D ]H}| d¡rø|dd … }n|}d|krtj |¡}|  ||d¡ qÚW n> tk
rd } z| j dt|ƒ d d¡ W 5 d }~X Y nX |t|ƒ7 }q‚q"d S |dkrÀ| jd s˜d S t |ƒj!| jd k rÞ| j dtt |ƒj!ƒ d t| jd ƒ ¡ d S d|krìd S | j d| ¡ t |ƒD ]¶}t|ƒ}d|krq| "d¡d dkr6qd| "d¡krJq|  ¡ rZ d S | j #|¡}|r| j d | d! t|ƒ d ¡ |D ]&}|  ¡ r¦  d S |  ||d¡ qqd S |d"krjd|krâ| j $|¡}n| j #|¡}|sød S |D ]l}|  ¡ r d S |  ¡  %|¡r0|  ||d¡ n6| j &|¡rXd|krX|  ||d¡ n|  ||d¡ qüd S )#N)r   Z_NAMEzReceived event, z, from zSkipping duplicate event.T)r.   r/   Ú
AFFILIATE_rH   rG   Ú_internettlds)r.   r/   r0   r   r   r   r1   r   z![^a-z0-9\-\.\%]([a-z0-9\-\.\%]*\.ú)éÈ   é   Ú.ú%FzError applying regex to data (r0   r
   r   z$Network size bigger than permitted: z > z::z"Looking up IPs in owned netblock: é   )Ú255Ú0rS   zFound a reversed hostname from z ()r   r   r   r1   r/   )'Ú	eventTypeÚmoduleÚdatar   Ú
hashstringr#   r   ÚisDomainr   r   Ú__name__ÚnotifyListenersÚ
hostDomainÚurllibÚparseÚunquoteÚlowerÚ	getTargetÚgetNamesÚcheckForStopÚfindÚlenÚreÚcompileÚDOTALLÚ	MULTILINEÚfindallÚ
startswithÚprocessHostÚ	ExceptionÚerrorr(   r   Ú	prefixlenÚsplitÚ	resolveIPÚresolveHostÚmatchesr$   )r   ÚeventÚ	eventNameÚsrcModuleNameÚ	eventDataÚeventDataHashÚaddrsÚparentEventÚevÚevtÚdomrW   ÚnameÚoffsetÚpatZ	chunkhostrs   ÚmatchÚmÚeÚipÚipaddrÚaddrr   r   r   ÚhandleEventn   sÚ    











,
ÿÿþ


ÿÿÿ



zsfp_dnsresolve.handleEventc                 C   s^  | j  |j¡}|| jkr&|g| j|< nF|| j| ks>|j|krV| j  d| d ¡ d S | j| |g | j|< | j  d| ¡ |d krÔd}|  ¡  |¡ršd}| j  |¡sØ| j  |¡}|rØ|D ]}|  ¡  |¡rºd}qºn|}|rô| j  |¡rîd}nd}n,| j  |¡rd}n| j  	|¡rd	}nd
}| 
d
¡rp| j  |¡}	|d
krf|	sftd|| j|ƒ}
|  |
¡ d S |	spd S ||jkr¤||jkr¤t||| j|ƒ}
|  |
¡ n|}
|d
kr
| j  || jd ¡}|  ||
¡ | j  |¡}|r
|D ] }td	|| j|
ƒ}|  |¡ qè|dkrZ| j  || jd ¡}||krL| j  || jd ¡sL|
S |  ||
d¡ |
S )NzSkipping host, ú, already processed.zFound host: TFr1   r/   r   r   r   rI   rL   )r   rX   rW   r   r#   ra   rs   r$   rr   r&   Úendswithr   rZ   r[   rU   r\   r   ÚprocessDomainÚresolveHost6rY   )r   r,   rz   Ú	affiliateÚ
parentHashÚaffilÚhostipsÚhostipÚhtypeÚresolvedr|   r}   Zip6sÚip6Zevt6r   r   r   rl     sr    
 ÿ


 zsfp_dnsresolve.processHostFc                 C   sœ   || j krd| j |< n| j d| d ¡ d S |rPtd|| j|ƒ}|  |¡ d S |  ¡  |¡rztd|| j|ƒ}|  |¡ ntd|| j|ƒ}|  |¡ d S d S )NTzSkipping domain, rˆ   rH   rE   rF   )r   r   r#   r   rZ   r[   ra   rs   )r   Z
domainNamerz   rŽ   Zdomevtr   r   r   rŠ   [  s.    
 ÿ
 ÿ ÿ
zsfp_dnsresolve.processDomain)N)F)rZ   Ú
__module__Ú__qualname__Ú__doc__r   Úoptdescsr   r   r   Údictr   r-   rD   rJ   r‡   rl   rŠ   r   r   r   r   r      s,   ü	ü
  
Pr   )	rf   r]   Únetaddrr   Úsflibr   r   r   r   r   r   r   r   Ú<module>   s   