3
@6^ 4 @ sD d dl Z d dlZd dlmZ d dlmZmZmZ G dd deZdS ) N) IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc @ s e Zd ZdZdddddddddZddd d
d d d
ddZdZdZe fddZ dd Z
dd Z dd Z dd Z
dd Zd d Zd d Zd!d" ZdS )#sfp_hackertargetzrHackerTarget.com:Footprint,Investigate,Passive:Passive DNS::Search HackerTarget.com for hosts sharing the same IP.FT d )cohostsamedomainverifynetblocklookup maxnetblock maxcohost http_headers tcp_portscan udp_portscanz>Treat co-hosted sites on the same target domain as co-hosting?zMVerify co-hosts are valid by checking if they still resolve to the shared IP.zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zbStop reporting co-hosted sites after this many are found, as it would likely indicate web hosting.z/Retrieve IP HTTP headers using HackerTarget.comzIScan IP for commonly open TCP ports using HackerTarget.com TCP port scan.zIScan IP for commonly open UDP ports using HackerTarget.com UDP port scan.Nr c C s> || _ | j | _d| _x"t|j D ]}|| | j|< q$W d S )Nr )sf tempStorageresults cohostcountlistkeysopts)selfsfcuserOptsopt r ;/var/www/spiderfoot.crq.systems/modules/sfp_hackertarget.pysetup5 s
zsfp_hackertarget.setupc C s
dddgS )N
IP_ADDRESSNETBLOCK_OWNERDOMAIN_NAME_PARENTr )r r r r
watchedEvents> s z sfp_hackertarget.watchedEventsc C s ddddddddd d
d d g S )
NCO_HOSTED_SITE
UDP_PORT_OPEN
TCP_PORT_OPENr WEBSERVER_HTTPHEADERSRAW_DNS_RECORDS
INTERNET_NAMEINTERNET_NAME_UNRESOLVED DOMAIN_NAMEAFFILIATE_DOMAIN_NAMEAFFILIATE_INTERNET_NAME"AFFILIATE_INTERNET_NAME_UNRESOLVEDr )r r r r producedEventsD s
z sfp_hackertarget.producedEventsc C s | j jd| jd | jd d| d d}|d d kr8d S tjd|d tjtjB }|sj| j jd | d S tjd
|d }|s| j jd | d S | j jd tt | d
| |S )Nz'https://hackertarget.com/udp-port-scan/
_fetchtimeout
_useragentz theinput=zJ&thetest=udpscan&name_of_nonce_field=&_wp_http_referer=%2Fudp-port-scan%2F)timeout useragentpostDatacontentz"(.*?)
zFound no open UDP ports on z(\d+)/udp\s+open\s+r zFound z open UDP ports on )
r fetchUrlr refindall MULTILINEDOTALLdebugstrlen)r ipres html_data
open_portsr r r portScanUDPL s z sfp_hackertarget.portScanUDPc C s | j jd| jd | jd d| d d}|d d kr8d S tjd|d tjtjB }|sj| j jd | d S tjd
|d }|s| j jd | d S | j jd tt | d
| |S )Nz'https://hackertarget.com/tcp-port-scan/r/ r0 z theinput=zJ&thetest=tcpscan&name_of_nonce_field=&_wp_http_referer=%2Ftcp-port-scan%2F)r1 r2 r3 r4 z"(.*?)
zFound no open TCP ports on z(\d+)/tcp\s+open\s+r zFound z open TCP ports on )
r r5 r r6 r7 r8 r9 r: r; r< )r r= r> r? r@ r r r portScanTCPe s z sfp_hackertarget.portScanTCPc C s | j jd| | jd | jd d}|d d krH| j jd| d d d S |d jd sj| j jd
| d S t }xP|d j D ]@}d |krq~|jd d j }d j
|jd d
d }|||< q~W |S )Nz,https://api.hackertarget.com/httpheaders/?q=r0 r/ )r2 r1 r4 z!Unable to fetch HTTP headers for z from HackerTarget.com.FzHTTP/zFound no HTTP headers for z: r ) r r5 r error
startswithr: dict
splitlinessplitlowerjoin)r r= r> headersheaderkvr r r httpHeaders~ s" z sfp_hackertarget.httpHeadersc C s | j jd| | jd | jd d}|d d krH| j jd| d d d S t }x@|d j D ]0}|j jd rpq\|j d
kr~q\|j|j q\W |S ) Nz-https://api.hackertarget.com/zonetransfer/?q=r0 r/ )r2 r1 r4 z Unable to fetch DNS zone for z from HackerTarget.com.F; ) r r5 r rD r rG striprE append)r r= r> recordsrecordr r r zoneTransfer s z sfp_hackertarget.zoneTransferc C s | j jd| | jd | jd d}|d d kr@| j jdd d S d|d krPd S |d jd }| j jd
tt| d | |S ) Nz0https://api.hackertarget.com/reverseiplookup/?q=r0 r/ )r2 r1 r4 z)Unable to fetch hackertarget.com content.Fz
No records
zFound z on )r r5 r rD rH r: r; r< )r r= r> hostsr r r reverseIpLookup s z sfp_hackertarget.reverseIpLookupc C s^ |j }|j}|j}|| _| jjd| d | |dkrX|dkrX| jjd| d d S || jkrz| jjd| d d S |d kr| jd
sd S t|j | jd k r| jjd t
t|j d
t
| jd d S |dkr| j |}|sd S t ddj
|| j|}| j| xx|D ]n}tjdtjtjB }tj||} t| dkrPqt }
xP| D ]H} | jjd| | jdr|
j| d d2 n|
j| d | q\W xt|
D ]} | j j| dddrd}
nd}
| jd r| jj | r| jjd| d |
d 7 }
t |
| | j|}| j| | jj | | jd r|
j d rft d | | j|}| j| nt d!| | j|}| j| qW qW d S t }|j d"rxTt|D ]2}t
|| jkr|jt
| d| jt
|< qW n|j| d| j|< t }xX|D ]N}| j rd S | j |}
xD|
D ]:}d#|kr@q,| jj!d$| | jd% s| j j|dd&r| jjd| d' q,||kr,||kr,| jd r| jj"|| r| jjd| d( | q,| j#| jd) k r,|d kr,t d|| j|}| j| t d*|j$ | j|}| j| n t d*|j$ | j|}| j| |j|j$ | j#d7 _#q,W | jj%d+dr| j&|}|d k rt d,t'j(|| j|}| j| | jj%d-dr| j)|}|rx0|D ](}t d.|d/ | | j|}| j| qW | jj%d0dr| j*|}|rx0|D ](}t d1|d/ | | j|}| j| q(W qW d S )3NzReceived event, z, from r r z Ignoring z , from self.z Skipping z as already mapped.r r r z$Network size bigger than permitted: z > r! r' rW z ^(\S+)\.?\s+\d+\s+IN\s+[AC].*r z Matched: .rC T)includeChildrenincludeParentsr( r, r
zHost z could not be resolved _UNRESOLVED
_internettlds AFFILIATEr+ r* NETBLOCK_ z Found something on same IP: r )r\ z" because it is on the same domain.z no longer resolves to r
r# r r& r r$ :r r% )+ eventTypemoduledatacurrentEventSrcr r: r r r prefixlenr; rV r rJ __name__notifyListenersr6 compile
IGNORECASEr9 r7 r< r endswithrS set getTargetmatches resolveHostisDomainrE checkForStoprY info
validateIPr rI getrO jsondumpsrA rB )r event eventName
srcModuleName eventDatarT evtrowpatgrpsrX strdatahostevt_typeqrylistipaddrmyresr= hiper eZ udp_portsportZ tcp_portsr r r handleEvent s
z sfp_hackertarget.handleEvent)ri
__module__ __qualname____doc__r optdescsr r rF r r" r. rA rB rO rV rY r r r r r r s8 r ) r6 rw netaddrr sflibr r r r r r r r s