U
    @6^                     @   s4   d dl mZ d dlmZmZmZ G dd deZdS )    )	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc                   @   s   e Zd ZdZdddddddddZd	d
dddddddZdZdZddddddddddddZe	 fddZ
d d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ ZdS ),sfp_honeypotzrHoneypot Checker:Investigate,Passive:Reputation Systems:apikey:Query the projecthoneypot.org database for entries. Fr      T   )api_keysearchenginethreatscore	timelimitnetblocklookupmaxnetblocksubnetlookup	maxsubnetzProjecthoneypot.org API key.z*Include entries considered search engines?zMThreat score minimum, 0 being everything and 255 being only the most serious.zQMaximum days old an entry can be. 255 is the maximum, 0 means you'll get nothing.zvLook up all IPs on netblocks deemed to be owned by your target for possible hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)NzSearch EngineZ
SuspiciousZ	HarvesterzSuspicious & HarvesterzComment SpammerzSuspicious & Comment SpammerzHarvester & Comment Spammerz(Suspicious & Harvester & Comment SpammerzUnknown (8)zUnknown (9)zUnknown (10))012345678910c                 C   s4   || _ |  | _t| D ]}|| | j|< qd S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r'   7/var/www/spiderfoot.crq.systems/modules/sfp_honeypot.pysetupA   s    
zsfp_honeypot.setupc                 C   s   ddddgS )N
IP_ADDRESSAFFILIATE_IPADDRNETBLOCK_OWNERNETBLOCK_MEMBERr'   r#   r'   r'   r(   watchedEventsI   s    zsfp_honeypot.watchedEventsc                 C   s   ddddgS )NBLACKLISTED_IPADDRBLACKLISTED_AFFILIATE_IPADDRBLACKLISTED_SUBNETBLACKLISTED_NETBLOCKr'   r.   r'   r'   r(   producedEventsP   s     zsfp_honeypot.producedEventsc                 C   s   d t|dS )N.)joinreversedsplit)r#   ipaddrr'   r'   r(   reverseAddrU   s    zsfp_honeypot.reverseAddrc                 C   s   | d}t|d | jd kr$d S t|d | jd k r>d S t|d dkr\| jd r\d S d	| j|d   d
 |d  d d |d  }|S )Nr5      r      r      r   r   zHoneypotproject ({0}): z
Last Activity: z	 days agoz
Threat Level: )r8   intr"   statuses)r#   addrbitstextr'   r'   r(   reportIPY   s&    
zsfp_honeypot.reportIPc           
   
   C   s.  |j }z| jd d | | d }| jd|  | j|}|sJW d S | jdt|  d }|D ]}| |}|d krqfqf qqf|d k	r|dkrd}|dkrd	}|d
krd}|dkrd}t||	|| j
|}	| |	 W nH tk
r( } z(| jd| d | d t|  W 5 d }~X Y nX d S )Nr
   r5   z.dnsbl.httpbl.orgzChecking Honeypot: zAddresses returned: r+   r1   r*   r0   r,   r3   r-   r2   zUnable to resolve z / z: )	eventTyper"   r:   r   debugresolveHoststrrC   r   format__name__notifyListenersBaseException)
r#   qaddrparentEvent	eventNamelookupaddrsrB   r@   eevtr'   r'   r(   	queryAddri   s@    
6zsfp_honeypot.queryAddrc                 C   s  |j }|j}|j}|}t }| jr&d S | jd| d |  | jd dkrd| jdd d| _d S || j	krrd S d| j	|< |dkr| jd	 sd S t
|j| jd
 k r| jdtt
|j d t| jd
   d S |dkr4| jd sd S t
|j| jd k r4| jdtt
|j d t| jd   d S |drrt
|D ]&}|  r\ d S | t|| qHn| || d S )NzReceived event, z, from r
   r   z4You enabled sfp_honeypot but did not set an API key!FTr,   r   r   z$Network size bigger than permitted: z > r-   r   r   	NETBLOCK_)rD   moduledatar    
errorStater   rE   r"   errorr   r   	prefixlenrG   
startswithcheckForStoprS   )r#   eventrN   srcModuleName	eventDatarM   addrlistr@   r'   r'   r(   handleEvent   sZ    





zsfp_honeypot.handleEvent)rI   
__module____qualname____doc__r"   optdescsr   rW   r?   dictr)   r/   r4   r:   rC   rS   r`   r'   r'   r'   r(   r      sP   'r   N)netaddrr   sflibr   r   r   r   r'   r'   r'   r(   <module>   s   