U
    @6^                     @   s@   d dl Z d dlZd dlZd dlmZmZmZ G dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventc                
   @   sv   e Zd ZdZdddddddddd	Zdd	d
ddddddd	ZdZdZe fddZ	dd Z
dd Zdd Zdd ZdS )
sfp_intelxzIntelligenceX:Investigate,Passive:Search Engines:apikey:Obtain information from IntelligenceX about identified IP addresses, domains, e-mail addresses and phone numbers.z$9df61df0-84f7-4dc7-b34c-8ccfb8646acezpublic.intelx.ioF   Z   )	api_keybase_urlcheckcohostscheckaffiliatesnetblocklookupmaxnetblocksubnetlookup	maxsubnetmaxagezIntelligenceX API key.z<API URL, as provided in your IntelligenceX account settings.zCheck co-hosted sites?zCheck affiliates?zvLook up all IPs on netblocks deemed to be owned by your target for possible hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z8Maximum age (in days) of results to be considered valid.Nc                 C   s:   || _ |  | _d| _t| D ]}|| | j|< q"d S )NF)sftempStorageresults
errorStatelistkeysopts)selfsfcuserOptsopt r   5/var/www/spiderfoot.crq.systems/modules/sfp_intelx.pysetup7   s
    
zsfp_intelx.setupc                 C   s   dddddddgS )N
IP_ADDRESSAFFILIATE_IPADDRINTERNET_NAME	EMAILADDRCO_HOSTED_SITEPHONE_NUMBERBITCOIN_ADDRESSr   r   r   r   r   watchedEventsC   s
      zsfp_intelx.watchedEventsc                 C   s   ddgS )NLEAKSITE_URLDARKNET_MENTION_URLr   r&   r   r   r   producedEventsH   s    zsfp_intelx.producedEventsc                 C   s  d }d| j d d}|g dddddddg d
}d	| j d
  d }| jj|t||| j d d}|d d kr| jd|  d S zt|d }W n< tk
r } z| jdd d| _	W Y d S d }~X Y nX |
dddkr|dt|d   }d}	d}
d}|dkr|
|	k r|  r$d S | jj||d}|d d krV| jd|  d S zt|d }W n8 tk
r } z| jdd W Y d S d }~X Y nX |d }|
d7 }
|dkr| jd |S td q| jd d S )Nr   r   )z
User-Agentzx-keyr   d       )
termZbucketsZlookuplevelZ
maxresultstimeoutZdatefromZdatetosortmedia	terminatezhttps://r	   z/intelligent/search_fetchtimeout)postDataheadersr/   contentz No IntelligenceX info found for z2Error processing JSON response from IntelligenceX.FTstatusz/result?id=%sid      )r5   z-No IntelligenceX info found for results from    )r   r<   zResults found, returningzNo results found.)r   r   fetchUrljsondumpsinfoloads	Exceptionerrorr   getstrcheckForStopdebugtimesleep)r   qryretr5   payloadurlreseZ	resulturllimitcountr7   r   r   r   queryK   sl     

zsfp_intelx.queryc                 C   s@  |j }|j}|j}| jrd S | jd dks8| jd dkrP| jdd d| _d S | jd| d |  || jkr| jd	| d
  d S d| j|< |	dr| jd sd S |dkr| jd sd S | 
|}|d krd S | jd|  tt d d| jd   }|dt D ]$}zttj|d dd ddd }||k rb| jd W qd }	d }
|d dkrd}
|d d d }	|d 	drd }
|d! }	|	r|
s| jd"t|d d#   W qW nD tk
r } z$| jd$t| d W Y qW 5 d }~X Y nX t|
|	| j|}| | qd S )%Nr   r,   r	   zBYou enabled sfp_intelx but did not set an API key and/or base URL!FTzReceived event, z, from z	Skipping z as already mapped.	AFFILIATEr   r#   r
   z!Found IntelligenceX URL data for i  i \&r   recordsadded.r   z%Y-%m-%dT%H:%M:%Sz%sz#Record found but too old, skipping.bucketZpastesr(   Z	keyvaluesvaluezdarknet.r)   namezUnexpected record, skipping ()z&Error processing content from IntelX: )	eventTypemoduledatar   r   r   rC   rG   r   
startswithrR   r@   intrH   rD   dictdatetimestrptimesplitstrftimerE   BaseExceptionr   __name__notifyListeners)r   event	eventNamesrcModuleName	eventDatar@   agelimitrec	last_seenvalevtrO   r   r   r   handleEvent   sZ    


*

zsfp_intelx.handleEvent)rf   
__module____qualname____doc__r   optdescsr   r   r`   r   r'   r*   rR   rq   r   r   r   r   r      s8   Gr   )r>   rH   ra   sflibr   r   r   r   r   r   r   r   <module>   s   