3
@6^                 @   s4   d dl mZ d dlmZmZmZ G dd deZdS )    )	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc               @   s   e Zd ZdZdddddddddZd	d
dddddddZdZdZddddddddddddZe	 fddZ
d d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ ZdS ),sfp_honeypotzrHoneypot Checker:Investigate,Passive:Reputation Systems:apikey:Query the projecthoneypot.org database for entries. Fr      T   )api_keysearchenginethreatscore	timelimitnetblocklookupmaxnetblocksubnetlookup	maxsubnetzProjecthoneypot.org API key.z*Include entries considered search engines?zMThreat score minimum, 0 being everything and 255 being only the most serious.zQMaximum days old an entry can be. 255 is the maximum, 0 means you'll get nothing.zvLook up all IPs on netblocks deemed to be owned by your target for possible hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)NzSearch EngineZ
SuspiciousZ	HarvesterzSuspicious & HarvesterzComment SpammerzSuspicious & Comment SpammerzHarvester & Comment Spammerz(Suspicious & Harvester & Comment SpammerzUnknown (8)zUnknown (9)zUnknown (10))012345678910c             C   s8   || _ | j | _x"t|j D ]}|| | j|< qW d S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r'   7/var/www/spiderfoot.crq.systems/modules/sfp_honeypot.pysetupA   s    
zsfp_honeypot.setupc             C   s   ddddgS )N
IP_ADDRESSAFFILIATE_IPADDRNETBLOCK_OWNERNETBLOCK_MEMBERr'   )r#   r'   r'   r(   watchedEventsI   s    zsfp_honeypot.watchedEventsc             C   s   ddddgS )NBLACKLISTED_IPADDRBLACKLISTED_AFFILIATE_IPADDRBLACKLISTED_SUBNETBLACKLISTED_NETBLOCKr'   )r#   r'   r'   r(   producedEventsP   s    zsfp_honeypot.producedEventsc             C   s   dj t|jdS )N.)joinreversedsplit)r#   ipaddrr'   r'   r(   reverseAddrU   s    zsfp_honeypot.reverseAddrc             C   s   |j d}t|d | jd kr$d S t|d | jd k r>d S t|d dkr\| jd r\d S d	| j|d   d
 |d  d d |d  }|S )Nr4      r      r      r   r   zHoneypotproject ({0}): z
Last Activity: z	 days agoz
Threat Level: )r7   intr"   statuses)r#   addrbitstextr'   r'   r(   reportIPY   s    
.zsfp_honeypot.reportIPc       
      C   s.  |j }y| jd d | j| d }| jjd|  | jj|}|sHd S | jjdt|  d }x$|D ]}| j|}|d krqfqfP qfW |d k	r|dkrd}|dkrd	}|d
krd}|dkrd}t||j	|| j
|}	| j|	 W nH tk
r( } z*| jjd| d | d t|  W Y d d }~X nX d S )Nr
   r4   z.dnsbl.httpbl.orgzChecking Honeypot: zAddresses returned: r+   r0   r*   r/   r,   r2   r-   r1   zUnable to resolve z / z: )	eventTyper"   r9   r   debugresolveHoststrrB   r   format__name__notifyListenersBaseException)
r#   qaddrparentEvent	eventNamelookupaddrsrA   r?   eevtr'   r'   r(   	queryAddri   s8    

6zsfp_honeypot.queryAddrc             C   s  |j }|j}|j}|}t }| jr&d S | jjd| d |  | jd dkrd| jjdd d| _d S || j	krrd S d| j	|< |dkr| jd	 sd S t
|j| jd
 k r| jjdtt
|j d t| jd
   d S |dkr4| jd sd S t
|j| jd k r4| jjdtt
|j d t| jd   d S |jdrtx>t
|D ]$}| j r\d S | jt|| qJW n| j|| d S )NzReceived event, z, from r
   r   z4You enabled sfp_honeypot but did not set an API key!FTr,   r   r   z$Network size bigger than permitted: z > r-   r   r   	NETBLOCK_)rC   moduledatar    
errorStater   rD   r"   errorr   r   	prefixlenrF   
startswithcheckForStoprR   )r#   eventrM   srcModuleName	eventDatarL   addrlistr?   r'   r'   r(   handleEvent   sJ    





zsfp_honeypot.handleEvent)rH   
__module____qualname____doc__r"   optdescsr   rV   r>   dictr)   r.   r3   r9   rB   rR   r_   r'   r'   r'   r(   r      sJ   'r   N)netaddrr   sflibr   r   r   r   r'   r'   r'   r(   <module>   s   