U
@6^) @ sZ d dl mZmZ d dlZd dlmZmZmZ ddddgdd gg d
iZG d d d eZ dS )
) IPAddress IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventzInternet Storm Center_iscqueryipz https://isc.sans.edu/api/ip/{0}z.*\d+.*)idtypechecksurlbadregex goodregexc @ sl e Zd ZdZdddZddiZdZe fddZd d
Z d d Z
d
d Z dd Z dd Z
dd Zdd ZdS )sfp_isczpInternet Storm Center:Investigate,Passive:Reputation Systems::Check if an IP is malicious according to SANS ISC.T)r checkaffiliatesr zApply checks to affiliates?Nc C s4 || _ | | _t| D ]}|| | j|< q d S )N)sf tempStorageresultslistkeysopts)selfsfcuserOptsopt r 2/var/www/spiderfoot.crq.systems/modules/sfp_isc.pysetup2 s
z
sfp_isc.setupc C s ddgS )N
IP_ADDRESSAFFILIATE_IPADDRr r r r r
watchedEvents> s zsfp_isc.watchedEventsc C s ddgS )NMALICIOUS_IPADDRMALICIOUS_AFFILIATE_IPADDRr r! r r r producedEventsD s zsfp_isc.producedEventsc C s t |dkrB|D ]0}t||tjtjB r| jd| dS qt |dkr|D ]0}t||tjtjB rR| jd| dS qR| jd d S )Nr z#Found to be bad against bad regex: Tz$Found to be good againt good regex: Fz Neither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr debug)r contentr r rxr r r contentMaliciousH s zsfp_isc.contentMaliciousc C s | j d| d | tt D ]}t| d }||kr$t| d dkr$tt| d }| j j||d| jd d }|d
d kr| j d || d d S |
|d
t| d
t| d r$|| S q$d S )Nz Querying z for maliciousness of r
r r r
_useragenttimeout useragentr, Unable to fetch Fr r ) r r+ r malchecksr strfetchUrlformatr errorr. )r r
target
targetTypecheckcidr
resr r r
resourceQuery\ s
zsfp_isc.resourceQueryc C s d}|dkr | j || jd }tt D ]n}t| d }||kr,t| d dkr,t }t| d }| j d| | jd d
|d < |d d kr| j j |d | jd
d}|d d kr| j
d| d d S | j d| |d |dkrHt } dt| kr~t| d dd}
t
|
t
j} | j d| d |
|d dD ].} t
| | }
t|
d
krL| |
d
qLn|d d} | D ]}t|dk s|drq| }z@t|t|kr| j |d | d | |W S W nB tk
r< } z"| j d t| W Y qW 5 d }~X Y nX q d S dt| kr|d dD ]P} | |ks|dkrd| |krd| j |d | d | d | S qdq,ztt| d |}tt| d |}|d dD ]b} |dkrt
|| t
js&t
|| t
jr| j |d | d | d | W S qW q, t k
r } z | j d t| W Y q,W 5 d }~X Y q,X q,d S )!N domain
_internettldsr
r r r
sfmal_ cacheperiodr r, r/ r0 r1 r4 Fnetblockregexz{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z:
#z found within netblock/subnet z in zError encountered parsing: /z
found in z list.z Error encountered parsing 2: ) r
hostDomainr r r5 r dictcacheGetgetr7 r9 cachePutreplacer' compiler) r+ splitfindallr& append
startswithstripr r Exceptionr6 r8 r(
BaseException)r r
r: r; targetDomr< r= datar
iplistr- patlinegrpr erxDomrxTgtr r r resourceListn s
zsfp_isc.resourceListc C s t t D ]}t| d }||kr |t| d kr | jd| d | d | t| d dkrv| ||| S t| d dkr | ||| S q d S ) Nr
r zChecking maliciousness of z (z) with: r r r )r r5 r r r+ r? rb )r
resourceIditemTyper: r< r= r r r
lookupItem s zsfp_isc.lookupItemc C sv |j }|j}|j}| jd| d | || jkrL| jd| d d S d| j|< |dkrp| jddspd S |d kr| jd
dsd S tt
D ]}t | d }| j| r|d krd
}|dkrd}nd}|dkrd}d}|dkrd}|dkrd}|dkrd}|dkrd}| |||} | r2 d S | d k r|d | d d | d }
t
||
| j|} | | qd S ) NzReceived event, z, from z Skipping z, already checked.TCO_HOSTED_SITE checkcohostsFr r r
)r r r r r# r$ ) BGP_AS_OWNER
BGP_AS_MEMBERasn
MALICIOUS_ASN)
INTERNET_NAMErf AFFILIATE_INTERNET_NAMErA rl MALICIOUS_INTERNET_NAMErm !MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_COHOSTz [z]
zz) eventTypemodulerZ r r+ r r rN r r5 r re checkForStopr __name__notifyListeners) r event eventName
srcModuleName eventDatar< r= typeIdevtTyper
textevtr r r handleEvent sR
zsfp_isc.handleEvent)rt
__module__ __qualname____doc__r optdescsr rL r r" r% r. r? rb re r~ r r r r r s Mr )
netaddrr r r' sflibr r r r5 r r r r r
s