U
@6^-+ @ sV d dl mZmZ d dlZd dlmZmZmZ ddddgdd d
iZG d d d eZ dS )
) IPAddress IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventZ PhishTank
_phishtanklistdomainz/http://data.phishtank.com/data/online-valid.csvz?\d+,\w+://(.*\.)?[^a-zA-Z0-9]?{0}.*,http://www.phishtank.com/.*)idtypechecksurlregexc @ st e Zd ZdZdddddZddddZd Ze fd
d Zd d
Z dd Z
dd Z dd Z dd Z
dd Zdd Zd S )
sfp_phishtankzmPhishTank:Investigate,Passive:Reputation Systems::Check if a host/domain is malicious according to PhishTank.T )r checkaffiliates checkcohosts cacheperiodzApply checks to affiliates?z?Apply checks to sites found to be co-hosted on the target's IP?z,Hours to cache list data before re-fetching.)r r r Nc C s4 || _ | | _t| D ]}|| | j|< q d S )N)sf tempStorageresultsr keysopts)selfsfcuserOptsopt r 8/var/www/spiderfoot.crq.systems/modules/sfp_phishtank.pysetup5 s
zsfp_phishtank.setupc C s
dddgS )N
INTERNET_NAMEAFFILIATE_INTERNET_NAMECO_HOSTED_SITEr r r r r
watchedEventsA s zsfp_phishtank.watchedEventsc C s
dddgS )NMALICIOUS_INTERNET_NAME!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_COHOSTr r# r r r producedEventsG s z sfp_phishtank.producedEventsc C s t |dkrB|D ]0}t||tjtjB r| jd| dS qt |dkr|D ]0}t||tjtjB rR| jd| dS qR| jd d S )Nr z#Found to be bad against bad regex: Tz$Found to be good againt good regex: Fz Neither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr debug)r content goodregexbadregexrxr r r contentMaliciousL s z sfp_phishtank.contentMaliciousc C s | j d| d | tt D ]}t| d }||kr$t| d dkr$tt| d }| j j||| jd | jd d }|d
d kr| j d || d d S |
|d
t| d
t| d r$|| S q$d S )Nz Querying z for maliciousness of r
r queryr
_fetchtimeout
_useragenttimeout useragentr/ Unable to fetch Fr0 r1 ) r r. r malchecksr strfetchUrlformatr errorr3 )r r
target
targetTypecheckcidr
resr r r
resourceQuery` s $
zsfp_phishtank.resourceQueryc C s d}|dkr | j || jd }tt D ]t}t| d }||kr,t| d dkr,t }t| d }| j d| | jd d
|d < |d d kr| j j || jd | jd
d}|d d kr| j
d| d d S | j d| |d |dkrNt } dt| krt| d dd}
t
|
t
j} | j d| d |
|d dD ].} t
| | }
t|
d
krR| |
d
qRn|d d} | D ]}t|dk s|drq| }z@t|t|kr| j |d | d | |W S W nB tk
rB } z"| j d t| W Y qW 5 d }~X Y nX q d S dt| kr|d dD ]P} | |ks|dkrj| |krj| j |d | d | d | S qjq,ztt| d |}tt| d |}|d dD ]b} |dkrt
|| t
js,t
|| t
jr| j |d | d | d | W S qW q, t k
r } z | j d t| W Y q,W 5 d }~X Y q,X q,d S )!N r
_internettldsr
r r r
sfmal_r r r/ r5 r6 r7 r: Fnetblockr z{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z:
#z found within netblock/subnet z in zError encountered parsing: /z
found in z list.z Error encountered parsing 2: ) r
hostDomainr r r; r dictcacheGetgetr= r? cachePutreplacer* compiler, r. splitfindallr) append
startswithstripr r Exceptionr< r> r+
BaseException)r r
r@ rA targetDomrB rC datar
iplistr2 patlinegrpiperxDomrxTgtr r r resourceListr s
zsfp_phishtank.resourceListc C s t t D ]}t| d }||kr |t| d kr | jd| d | d | t| d dkrv| ||| S t| d dkr | ||| S q d S ) Nr
r zChecking maliciousness of z (z) with: r r4 r )r r; r r r. rE rf )r
resourceIditemTyper@ rB rC r r r
lookupItem s zsfp_phishtank.lookupItemc C sv |j }|j}|j}| jd| d | || jkrL| jd| d d S d| j|< |dkrp| jddspd S |d kr| jd
dsd S tt
D ]}t | d }| j| r|d krd
}|dkrd}nd}|dkrd}d}|dkrd}|dkrd}|dkrd}|dkrd}| |||} | r2 d S | d k r|d | d d | d }
t
||
| j|} | | qd S ) NzReceived event, z, from z Skipping z, already checked.Tr" r FAFFILIATE_IPADDRr r
)
IP_ADDRESSrj rb rk MALICIOUS_IPADDRMALICIOUS_AFFILIATE_IPADDR) BGP_AS_OWNER
BGP_AS_MEMBERasn
MALICIOUS_ASN)r r" r! r r r% r! r& r' z [z]
zz) eventTypemoduler] r r. r r rQ r r; r ri checkForStopr __name__notifyListeners) r event eventName
srcModuleName eventDatarB rC typeIdevtTyper
textevtr r r handleEvent sR
zsfp_phishtank.handleEvent)ru
__module__ __qualname____doc__r optdescsr rO r r$ r( r3 rE rf ri r r r r r r s& Mr )
netaddrr r r* sflibr r r r; r r r r r
s