3
@6^ @ s< d dl Z d dlmZ d dlmZmZmZ G dd deZdS ) N) IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc @ sj e Zd ZdZdddddddZddddd d
dZd Zd Ze fd
dZ dd Z
dd Z dd Z dd Z
d S )sfp_threatcrowdzThreatCrowd:Investigate,Passive:Reputation Systems::Obtain information from ThreatCrowd about identified IP addresses, domains and e-mail addresses.T ) checkcohostscheckaffiliatesnetblocklookup maxnetblock subnetlookup maxsubnetzCheck co-hosted sites?zCheck affiliates?zvLook up all IPs on netblocks deemed to be owned by your target for possible hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)NFc C s> || _ | j | _d| _x"t|j D ]}|| | j|< q$W d S )NF)sf tempStorageresults
errorStatelistkeysopts)selfsfcuserOptsopt r :/var/www/spiderfoot.crq.systems/modules/sfp_threatcrowd.pysetup0 s
zsfp_threatcrowd.setupc C s ddddddddgS ) N
IP_ADDRESSAFFILIATE_IPADDR
INTERNET_NAMECO_HOSTED_SITENETBLOCK_OWNER EMAILADDRNETBLOCK_MEMBERAFFILIATE_INTERNET_NAMEr )r r r r
watchedEvents< s z sfp_threatcrowd.watchedEventsc C s ddddddddgS ) NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_COHOST!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDRMALICIOUS_NETBLOCKMALICIOUS_SUBNETMALICIOUS_EMAILADDRr )r r r r producedEventsB s z sfp_threatcrowd.producedEventsc C s d }d }| j j|r d| }d|kr,d| }|s8d| }| j j|| jd dd}|d d krp| j jd | d S ytj|d }W n4 tk
r } z| j jd
d d | _ d S d }~X nX |S )
Nz7https://www.threatcrowd.org/searchApi/v2/ip/report/?ip=@z=https://www.threatcrowd.org/searchApi/v2/email/report/?email=z?https://www.threatcrowd.org/searchApi/v2/domain/report/?domain=
_fetchtimeoutr )timeout useragentcontentz No ThreatCrowd info found for z0Error processing JSON response from ThreatCrowd.FT)
r validIPfetchUrlr infojsonloads Exceptionerrorr )r qryreturlreser r r queryH s& zsfp_threatcrowd.queryc C s |j }|j}|j}| jr d S | jjd| d | || jkrV| jjd| d d S d| j|< |jdrz| jd rzd S |dkr| jd rd S |d
kr| jd sd S t |j
| jd k r| jjd
t t |j
d t | jd d S |dkrL| jd sd S t |j
| jd k rL| jjd
t t |j
d t | jd d S t }|jdrx:t |D ]"}|j
t | d| jt |< qhW n
|j
| x|D ]}| j rd S | j|}|d krʐq|jdddk r| jjd| |d&ks|jdrd} |dkrd} |dkr"d} |d kr0d } |dkr>d } |d krLd } d!|jd" d# }
t| d$| d% |
| j|} | j| qW d S )'NzReceived event, z, from z Skipping z as already mapped.TZ AFFILIATEr r r r r
r z$Network size bigger than permitted: z > r" r r
NETBLOCK_votesr z Found ThreatCrowd URL data for r r% r r) r r& r# r( r' r! r, zZ permalinkzz
ThreatCrowd [z]
)r ) eventTypemoduledatar r debugr
startswithr r prefixlenstrr append checkForStopr? getr5 r __name__notifyListeners) r event eventName
srcModuleName eventDataqrylistipaddraddrr5 evtZinfourlr> r r r handleEvente sx
zsfp_threatcrowd.handleEvent)rL
__module__ __qualname____doc__r optdescsr r dictr r$ r- r? rV r r r r r s( r )r6 netaddrr sflibr r r r r r r r
s