U @6^ @s8ddlZddlZddlmZmZmZGdddeZdS)N) SpiderFootSpiderFootPluginSpiderFootEventc@sheZdZdZdddddZddd d dZd ZdZd Ze fd dZ ddZ ddZ dddZ ddZd S)sfp_securitytrailszuSecurityTrails:Investigate,Passive:Search Engines:apikey:Obtain Passive DNS and other information from SecurityTrailsTFd)api_keyverifycohostsamedomain maxcohostzSecurityTrails API key.zMVerify co-hosts are valid by checking if they still resolve to the shared IP.z>Treat co-hosted sites on the same target domain as co-hosting?zbStop reporting co-hosted sites after this many are found, as it would likely indicate web hosting.NrcCs:||_||_d|_t|D]}|||j|<q"dS)Nr)sf tempStorageresults cohostcountlistkeysopts)selfsfcuserOptsoptr=/var/www/spiderfoot.crq.systems/modules/sfp_securitytrails.pysetup+s  zsfp_securitytrails.setupcCsdddddgS)N IP_ADDRESS IPV6_ADDRESS DOMAIN_NAME EMAILADDRNETBLOCK_OWNERrrrrr watchedEvents7sz sfp_securitytrails.watchedEventscCsddddddgS)NCO_HOSTED_SITErAFFILIATE_DOMAIN_NAME INTERNET_NAMEAFFILIATE_INTERNET_NAMEPROVIDER_HOSTINGrrrrrproducedEvents<sz!sfp_securitytrails.producedEventsc Csd}d|jdi}|dkr,d|d}d}n(dt|}d|d|d }d |d <|jj||jd d ||d} | ddkr|jddd|_dS| ddkr|jd|dSzt| d}|dkr| ddWS| dddkr^t | dgdkrDt d|r$| | dn | d}||||d|WS| | dg|WSn| dgWSWn@tk r} z |jdt| dWYdSd} ~ XYnXdS)NZAPIKEYrdomainz)https://api.securitytrails.com/v1/domain/z /subdomainsz4https://api.securitytrails.com/v1/search/list/?page=z{"filter": { "z": "z" } }zapplication/jsonz Content-Type _fetchtimeoutr)timeout useragentheaderspostDatacode)400429500403zcSecurityTrails API key seems to have been rejected or you have exceeded usage limits for the month.FTcontentz!No SecurityTrails info found for subdomainsZ record_countrrrecordsr'z4Error processing JSON response from SecurityTrails: )rstrr fetchUrlerror errorStateinfojsonloadsgetlentimesleepextendquery Exception) rqry querytypepageaccumr:r,urlrequestreserrrrBCsN      zsfp_securitytrails.querycCs|j}|j}|j}|jrdS|jd|d||jddkrZ|jddd|_dS||jkr||jd|d dSd|j|<|d kr|}| |d }t }t }|dk r|D] } d | kr| d D]2} | |krqt d | |j |} | | || qd| kr|j|jdkr"q| d} |jds`|j| ddr`|jd| dq| |kr| |kr|jdr|j| |s|jd| dq|| t d| |j |} | | |jd7_q|dkr|} | | d}t }|dk r|D]} d| kr | ds(q | d} | |kr || nq t d| |j |} | | |j| |jdr t d| |j |}| |q |dkr|}| |d}t }|dk r|D]J} | |kr|| nqt d| d ||j |} | | qdS)!NzReceived event, z, from rrzAYou enabled sfp_securitytrails but did not set an API uid/secret!FTz Skipping z as already mapped.)rrNETLBLOCK_OWNERipv4Z host_providerr%hostnamer r )includeParentsz" because it is on the same domain.r zHost z no longer resolves to our IP.r!r')rZ whois_emailr$ _internettldsr")rr(r#.) eventTypemoduledatar9r debugrr8rrBrr__name__notifyListenersappendr getTargetmatches validateIPlowerisDomain)revent eventName srcModuleName eventDataiprecmyresZhostersrdatrKhemailevtr(rrr handleEventws                     zsfp_securitytrails.handleEvent)r'N)rV __module__ __qualname____doc__roptdescsrr9rdictrr r&rBrjrrrrrs&    4r)r;r?sflibrrrrrrrr s