3
@6^
'                 @   s@   d dl Z d dlZd dlZd dlmZmZmZ G dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventc               @   s   e Zd ZdZddddddddZd	d
ddddddZdZdZdZe	 fddZ
dd Zdd Zd$ddZd%ddZd&ddZd'ddZd(d d!Zd"d# ZdS ))sfp_spyonwebzSpyOnWeb:Footprint,Investigate,Passive:Passive DNS:apikey:Search SpyOnWeb for hosts sharing the same IP address, Google Analytics code, or Google Adsense code. d      iG  TF)api_keylimittimeoutmaxageverifycohostsamedomain	maxcohostzSpyOnWeb API key.z#Maximum number of results to fetch.zQuery timeout, in seconds.zOThe maximum age of the data returned, in days, in order to be considered valid.zMVerify co-hosts are valid by checking if they still resolve to the shared IP.z>Treat co-hosted sites on the same target domain as co-hosting?zbStop reporting co-hosted sites after this many are found, as it would likely indicate web hosting.r   Nc             C   sD   || _ d| _| j | _d| _x"t|j D ]}|| | j|< q*W d S )NZSpyOnWebr   )sf__dataSource__tempStorageresultscohostcountlistkeysopts)selfsfcuserOptsopt r   7/var/www/spiderfoot.crq.systems/modules/sfp_spyonweb.pysetup0   s    
zsfp_spyonweb.setupc             C   s   ddddgS )N
IP_ADDRESSINTERNET_NAMEDOMAIN_NAMEWEB_ANALYTICS_IDr   )r   r   r   r   watchedEvents:   s    zsfp_spyonweb.watchedEventsc             C   s   ddddddgS )NCO_HOSTED_SITEr    AFFILIATE_INTERNET_NAMEr"   r!   AFFILIATE_DOMAIN_NAMEr   )r   r   r   r   producedEvents>   s    zsfp_spyonweb.producedEventsc             C   sj  d| d | }|dt | 7 }|d| jd  7 }| jj|| jd | jd d}|d	 d krp| jjd
|  d S ytj|d	 }W n, tk
r } z| jjd d S d }~X nX |jd}|dks| jjd
|  d S |jd}	|	 s| jjd
|  d S |	j|}
|
s| jjd
|  d S |
j|}|sB| jjd
|  d S |jd}|sf| jjd
|  d S |S )Nzhttps://api.spyonweb.com/v1//z?limit=z&access_token=r	   r   
_useragent)r   	useragentcontentzNo results found for zError processing JSON response.statusfoundresultitems)	strr   r   fetchUrldebugjsonloads	Exceptionget)r   endpointqryr
   urlresdataer,   Z
api_resultZendpoint_resultr   r/   r   r   r   queryD   sB    




zsfp_spyonweb.queryc             C   sF   | j d||}|s&| jjd|  d S | jjdtt| d  |S )N	analyticszNo results found for z
Retrieved z results)r=   r   r2   infor0   len)r   r8   r
   r/   r   r   r   queryGoogleAnalyticsv   s    z!sfp_spyonweb.queryGoogleAnalyticsc             C   sF   | j d||}|s&| jjd|  d S | jjdtt| d  |S )NadsensezNo results found for z
Retrieved z results)r=   r   r2   r?   r0   r@   )r   r8   r
   r/   r   r   r   queryGoogleAdsense   s    zsfp_spyonweb.queryGoogleAdsensec             C   sF   | j d||}|s&| jjd|  d S | jjdtt| d  |S )NipzNo results found for z
Retrieved z results)r=   r   r2   r?   r0   r@   )r   r8   r
   r/   r   r   r   queryIP   s    zsfp_spyonweb.queryIPc             C   sF   | j d||}|s&| jjd|  d S | jjdtt| d  |S )NsummaryzNo results found for z
Retrieved z results)r=   r   r2   r?   r0   r@   )r   r8   r
   r/   r   r   r   querySummary   s    zsfp_spyonweb.querySummaryc             C   sD  |j }|j}|j}| jrd S || jkr*d S d| j|< | jjd| d |  | jd dkrr| jjdd d| _d S t	t
j
 d d	| jd
   }|d+krT| j|| jd d}|d kr| jjd|  d S |jd}|rx2t|j D ]"}tdd| | j|}	| j|	 qW |jd}
|
rTx4t|
j D ]$}tdd| | j|}	| j|	 q,W |d,kry |jdd }|jdd }W nD tk
r } z&| jjd| d t| d d d S d }~X nX t }|dkr| j|| jd d}n$|dkr
| j|| jd d}nd S |d kr,| jjd|  d S xt|j D ]}t	tjj|| djdd }||k rx| jjd q:td || j|}	| j|	 | jj|| jd! r:td"|| j|}	| j|	 q:W |d-kr@| j|| jd d}|d kr| jjd|  d S d}x4t|j D ]"}t	tjj|| djdd }||k rX| jjd q| jd$ r| jj|| r| jjd%| d& |  q| jd' s | j j |dd(r td|| j|}	| j|	 | jj|| jd! rtd|| j|}	| j|	 q| j!| jd) k rtd*|| j|}	| j|	 |  j!d7  _!qW d S ).NTzReceived event, z, from r	   r   z4You enabled sfp_spyonweb but did not set an API key!Fi  i \&r   r    r!   r
   )r
   zNo data found for rB   r"   zGoogle AdSense: r>   zGoogle Analytics: z: r      z"Unable to parse WEB_ANALYTICS_ID: z ()zGoogle AdSensezGoogle Analyticsz%Y-%m-%dz%szRecord found too old, skipping.r%   _internettldsr&   r   r   zHost z no longer resolves to r   )includeParentsr   r$   )r    r!   )r"   )r   )"	eventTypemoduler;   
errorStater   r   r2   r   errorinttimerG   r?   r6   r   r   r   __name__notifyListenerssplitBaseExceptionr0   dictrC   rA   datetimestrptimestrftimeisDomainrE   
validateIP	getTargetmatchesr   )r   event	eventNamesrcModuleName	eventDataagelimitr;   Zgoogle_adsenserevtZgoogle_analyticsnetworkanalytics_idr<   	last_seenr   cor   r   r   handleEvent   s    








 



 



zsfp_spyonweb.handleEvent)r   )r   )r   )r   )r   )rR   
__module____qualname____doc__r   optdescsr   r   rN   rV   r   r#   r'   r=   rA   rC   rE   rG   ri   r   r   r   r   r      s6   

2



r   )rW   r3   rQ   sflibr   r   r   r   r   r   r   r   <module>   s   