3
@6^                 @   sX   d dl Z d dlZd dlmZ d dlZd dlmZ d dlmZmZm	Z	 G dd deZ
dS )    N)datetime)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc               @   sf   e Zd ZdZddddddZddd	d
ddZdZdZe fddZ	dd Z
dd Zdd Zdd ZdS )sfp_fraudguardzeFraudguard:Investigate,Passive:Reputation Systems:apikey:Obtain threat information from Fraudguard.io Z   T   )fraudguard_api_key_accountfraudguard_api_key_passwordage_limit_daysnetblocklookupmaxnetblockzFraudguard.io API username.zFraudguard.io API password.z<Ignore any records older than this many days. 0 = unlimited.zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)NFc             C   s8   || _ | j | _x"t|j D ]}|| | j|< qW d S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   9/var/www/spiderfoot.crq.systems/modules/sfp_fraudguard.pysetup0   s    
zsfp_fraudguard.setupc             C   s   ddgS )N
IP_ADDRESSNETBLOCK_OWNERr   )r   r   r   r   watchedEvents;   s    zsfp_fraudguard.watchedEventsc             C   s
   dddgS )NGEOINFOMALICIOUS_IPADDRMALICIOUS_NETBLOCKr   )r   r   r   r   producedEvents?   s    zsfp_fraudguard.producedEventsc       
      C   s  d| }| j d }t|tkr(|jd}| j d }t|tkrH|jd}tj|djd | }dd|jd i}| jj|| j d d	|d
}|d dkr| jj	dd d| _
d S |d d kr| jjd|  d S ytj|d }W n0 tk
r }	 z| jj	dd d S d }	~	X nX |S )Nzhttps://api.fraudguard.io/ip/r   zutf-8r   :AuthorizationzBasic _fetchtimeoutr   )timeout	useragentheaderscode400429500403zbFraudguard.io API key seems to have been rejected or you have exceeded usage limits for the month.FTcontentz No Fraudguard.io info found for z2Error processing JSON response from Fraudguard.io.)r+   r,   r-   r.   )r   typestrencodebase64	b64encodedecoder   fetchUrlerror
errorStateinfojsonloads	Exception)
r   qryZfraudguard_urlZapi_key_accountapi_key_passwordtokenr)   resr9   er   r   r   queryB   s0    




zsfp_fraudguard.queryc             C   s  |j }|j}|j}| jrd S | jjd| d |  | jd dksP| jd dkrh| jjdd d| _d S || jkr| jjd	| d
  d S d| j|< |dkr| jd sd S t	|j
| jd k r| jjdtt	|j
 d t| jd   d S t }d}|jdr:d}x>t	|D ]"}|jt| d| jt|< qW nd}|j| xJ|D ]@}| j rdd S | j|}	|	d k	rP| jjd tj|	jdd}
ttj|
j }ttj d| jd   }| jd dkr||k r| jjd qPd|	d |	d |	d gkrB|	d d |	d  d |	d  }td|| j|}| j| |	jd dkrP|	d  d! |	d"  d# | d$ }td%| || j|}| j| qPW d S )&NzReceived event, z, from r   r   r   zDYou enabled sfp_fraudguard but did not set an API username/password!FTz	Skipping z as already mapped.r   r   r   z$Network size bigger than permitted: z > 	NETBLOCK_ZNETBLOCKZIPADDRzFound results in Fraudguard.ioZdiscover_datez%Y-%m-%d %H:%M:%SiQ r   r   z#Record found but too old, skipping.unknowncountrystatecityz, r    Zthreatz (risk level: Z
risk_levelz) []
MALICIOUS_)	eventTypemoduledatar8   r   debugr   r7   r   r   	prefixlenr1   r   
startswithappendcheckForStoprB   r   strptimegetinttimemktime	timetupler   __name__notifyListeners)r   event	eventNamesrcModuleName	eventDataqrylistrtypeipaddraddrrec
created_dt
created_tsage_limit_tsdatrA   r   r   r   handleEventf   sf    






 
 zsfp_fraudguard.handleEvent)rX   
__module____qualname____doc__r   optdescsr   r8   dictr   r   r#   rB   rg   r   r   r   r   r      s$   $r   )r:   r3   r   rU   netaddrr   sflibr   r   r   r   r   r   r   r   <module>   s   