U
    @6^                     @   sX   d dl Z d dlZd dlmZ d dlZd dlmZ d dlmZmZm	Z	 G dd deZ
dS )    N)datetime)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc                   @   sf   e Zd ZdZddddddZddd	d
ddZdZdZe fddZ	dd Z
dd Zdd Zdd ZdS )sfp_fraudguardzeFraudguard:Investigate,Passive:Reputation Systems:apikey:Obtain threat information from Fraudguard.io Z   T   )fraudguard_api_key_accountfraudguard_api_key_passwordage_limit_daysnetblocklookupmaxnetblockzFraudguard.io API username.zFraudguard.io API password.z<Ignore any records older than this many days. 0 = unlimited.zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)NFc                 C   s4   || _ |  | _t| D ]}|| | j|< qd S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   9/var/www/spiderfoot.crq.systems/modules/sfp_fraudguard.pysetup0   s    
zsfp_fraudguard.setupc                 C   s   ddgS )N
IP_ADDRESSNETBLOCK_OWNERr   r   r   r   r   watchedEvents;   s    zsfp_fraudguard.watchedEventsc                 C   s
   dddgS )NGEOINFOMALICIOUS_IPADDRMALICIOUS_NETBLOCKr   r   r   r   r   producedEvents?   s    zsfp_fraudguard.producedEventsc           
   
   C   s   d| }| j d }t|tkr(|d}| j d }t|tkrH|d}t|dd | }dd|d i}| jj|| j d d	|d
}|d dkr| j	dd d| _
d S |d d kr| jd|  d S zt|d }W n8 tk
r }	 z| j	dd W Y d S d }	~	X Y nX |S )Nzhttps://api.fraudguard.io/ip/r   zutf-8r   :AuthorizationzBasic _fetchtimeoutr   )timeout	useragentheaderscode)400429500403zbFraudguard.io API key seems to have been rejected or you have exceeded usage limits for the month.FTcontentz No Fraudguard.io info found for z2Error processing JSON response from Fraudguard.io.)r   typestrencodebase64	b64encodedecoder   fetchUrlerror
errorStateinfojsonloads	Exception)
r   qryZfraudguard_urlZapi_key_accountapi_key_passwordtokenr*   resr:   er   r   r   queryB   s8    



  zsfp_fraudguard.queryc                 C   s  |j }|j}|j}| jrd S | jd| d |  | jd dksP| jd dkrh| jdd d| _d S || jkr| jd	| d
  d S d| j|< |dkr| jd sd S t	|j
| jd k r| jdtt	|j
 d t| jd   d S t }d}|dr6d}t	|D ]"}|t| d| jt|< qnd}|| |D ]B}|  r^ d S | |}	|	d k	rH| jd t|	dd}
tt|
 }tt d| jd   }| jd dkr||k r| jd qHd|	d |	d |	d fkr<|	d d |	d  d |	d  }td|| j|}| | |	d dkrH|	d  d! |	d"  d# | d$ }td%| || j|}| | qHd S )&NzReceived event, z, from r   r   r   zDYou enabled sfp_fraudguard but did not set an API username/password!FTz	Skipping z as already mapped.r   r   r   z$Network size bigger than permitted: z > 	NETBLOCK_ZNETBLOCKZIPADDRzFound results in Fraudguard.ioZdiscover_datez%Y-%m-%d %H:%M:%SiQ r   r   z#Record found but too old, skipping.unknowncountrystatecityz, r!   Zthreatz (risk level: Z
risk_levelz) []
MALICIOUS_)	eventTypemoduledatar9   r   debugr   r8   r   r   	prefixlenr2   r   
startswithappendcheckForStoprC   r   strptimegetinttimemktime	timetupler   __name__notifyListeners)r   event	eventNamesrcModuleName	eventDataqrylistZrtypeipaddraddrrec
created_dt
created_tsage_limit_tsdatrB   r   r   r   handleEventf   sn    







 
 zsfp_fraudguard.handleEvent)rY   
__module____qualname____doc__r   optdescsr   r9   dictr   r    r$   rC   rg   r   r   r   r   r      s(   
$r   )r;   r4   r   rV   netaddrr   sflibr   r   r   r   r   r   r   r   <module>   s   