U
    @6^
'                     @   s@   d dl Z d dlZd dlZd dlmZmZmZ G dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventc                   @   s   e Zd ZdZddddddddZd	d
ddddddZdZdZdZe	 fddZ
dd Zdd Zd$ddZd%ddZd&ddZd'ddZd(d d!Zd"d# ZdS ))sfp_spyonwebzSpyOnWeb:Footprint,Investigate,Passive:Passive DNS:apikey:Search SpyOnWeb for hosts sharing the same IP address, Google Analytics code, or Google Adsense code. d      iG  TF)api_keylimittimeoutmaxageverifycohostsamedomain	maxcohostzSpyOnWeb API key.z#Maximum number of results to fetch.zQuery timeout, in seconds.zOThe maximum age of the data returned, in days, in order to be considered valid.zMVerify co-hosts are valid by checking if they still resolve to the shared IP.z>Treat co-hosted sites on the same target domain as co-hosting?zbStop reporting co-hosted sites after this many are found, as it would likely indicate web hosting.r   Nc                 C   s@   || _ d| _|  | _d| _t| D ]}|| | j|< q(d S )NZSpyOnWebr   )sf__dataSource__tempStorageresultscohostcountlistkeysopts)selfsfcuserOptsopt r   7/var/www/spiderfoot.crq.systems/modules/sfp_spyonweb.pysetup0   s    
zsfp_spyonweb.setupc                 C   s   ddddgS )N
IP_ADDRESSINTERNET_NAMEDOMAIN_NAMEWEB_ANALYTICS_IDr   r   r   r   r   watchedEvents:   s    zsfp_spyonweb.watchedEventsc                 C   s   ddddddgS )NCO_HOSTED_SITEr    AFFILIATE_INTERNET_NAMEr"   r!   AFFILIATE_DOMAIN_NAMEr   r#   r   r   r   producedEvents>   s
      zsfp_spyonweb.producedEventsc              
   C   sr  d| d | }|dt | 7 }|d| jd  7 }| jj|| jd | jd d}|d	 d krp| jd
|  d S zt|d	 }W n4 tk
r } z| jd W Y d S d }~X Y nX |d}|dks| jd
|  d S |d}	|	s| jd
|  d S |	|}
|
s&| jd
|  d S |
|}|sJ| jd
|  d S |d}|sn| jd
|  d S |S )Nzhttps://api.spyonweb.com/v1//z?limit=z&access_token=r	   r   
_useragent)r   	useragentcontentNo results found for zError processing JSON response.statusfoundresultitems)	strr   r   fetchUrldebugjsonloads	Exceptionget)r   endpointqryr
   urlresdataer.   Z
api_resultZendpoint_resultr   r1   r   r   r   queryD   sB    




zsfp_spyonweb.queryc                 C   sF   |  d||}|s&| jd|  d S | jdtt| d  |S )N	analyticsr-   
Retrieved  resultsr?   r   r4   infor2   lenr   r:   r
   r1   r   r   r   queryGoogleAnalyticsv   s    z!sfp_spyonweb.queryGoogleAnalyticsc                 C   sF   |  d||}|s&| jd|  d S | jdtt| d  |S )Nadsenser-   rA   rB   rC   rF   r   r   r   queryGoogleAdsense   s    zsfp_spyonweb.queryGoogleAdsensec                 C   sF   |  d||}|s&| jd|  d S | jdtt| d  |S )Nipr-   rA   rB   rC   rF   r   r   r   queryIP   s    zsfp_spyonweb.queryIPc                 C   sF   |  d||}|s&| jd|  d S | jdtt| d  |S )Nsummaryr-   rA   rB   rC   rF   r   r   r   querySummary   s    zsfp_spyonweb.querySummaryc              
   C   s8  |j }|j}|j}| jrd S || jkr*d S d| j|< | jd| d |  | jd dkrr| jdd d| _d S t	t

 d d	| jd
   }|dkrL| j|| jd d}|d kr| jd|  d S |d}|r
t| D ]"}tdd| | j|}	| |	 q|d}
|
rLt|
 D ]$}tdd| | j|}	| |	 q&|dkrz |dd }|dd }W nL tk
r } z,| jd| d t| d d W Y d S d }~X Y nX t }|dkr| j|| jd d}n$|dkr
| j|| jd d}nd S |d kr,| jd|  d S t| D ]}t	tj|| ddd }||k rv| jd q8td || j|}	| |	 | j|| jd! r8td"|| j|}	| |	 q8|d#kr4| j|| jd d}|d kr | jd|  d S d}t| D ] }t	tj|| ddd }||k rP| jd q| jd$ r| j||s| jd%| d& |  q| jd' s|  j |dd(rtd)|| j|}	| |	 | j|| jd! rtd*|| j|}	| |	 q| j!| jd+ k rtd,|| j|}	| |	 |  j!d7  _!qd S )-NTzReceived event, z, from r	   r   z4You enabled sfp_spyonweb but did not set an API key!Fi  i \&r   )r    r!   r
   )r
   zNo data found for rH   r"   zGoogle AdSense: r@   zGoogle Analytics: )r"   z: r      z"Unable to parse WEB_ANALYTICS_ID: z ()zGoogle AdSensezGoogle Analyticsz%Y-%m-%dz%szRecord found too old, skipping.r&   _internettldsr'   )r   r   zHost z no longer resolves to r   )includeParentsr    r!   r   r%   )"	eventTypemoduler=   
errorStater   r   r4   r   errorinttimerM   rD   r8   r   r   r   __name__notifyListenerssplitBaseExceptionr2   dictrI   rG   datetimestrptimestrftimeisDomainrK   
validateIP	getTargetmatchesr   )r   event	eventNamesrcModuleName	eventDataagelimitr=   Zgoogle_adsenserevtZgoogle_analyticsnetworkanalytics_idr>   	last_seenr   cor   r   r   handleEvent   s    








 



 



zsfp_spyonweb.handleEvent)r   )r   )r   )r   )r   )rX   
__module____qualname____doc__r   optdescsr   r   rT   r\   r   r$   r(   r?   rG   rI   rK   rM   ro   r   r   r   r   r      s:   


2



r   )r]   r5   rW   sflibr   r   r   r   r   r   r   r   <module>   s   