U
@6^ @ s< d dl Z d dlmZ d dlmZmZmZ G dd deZdS ) N) IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc @ sj e Zd ZdZdddddddZddddd d
dZd Zd Ze fd
dZ dd Z
dd Z dd Z dd Z
d S )sfp_threatcrowdzThreatCrowd:Investigate,Passive:Reputation Systems::Obtain information from ThreatCrowd about identified IP addresses, domains and e-mail addresses.T ) checkcohostscheckaffiliatesnetblocklookup maxnetblock subnetlookup maxsubnetzCheck co-hosted sites?zCheck affiliates?zvLook up all IPs on netblocks deemed to be owned by your target for possible hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)NFc C s: || _ | | _d| _t| D ]}|| | j|< q"d S )NF)sf tempStorageresults
errorStatelistkeysopts)selfsfcuserOptsopt r :/var/www/spiderfoot.crq.systems/modules/sfp_threatcrowd.pysetup0 s
zsfp_threatcrowd.setupc C s ddddddddgS ) N
IP_ADDRESSAFFILIATE_IPADDR
INTERNET_NAMECO_HOSTED_SITENETBLOCK_OWNER EMAILADDRNETBLOCK_MEMBERAFFILIATE_INTERNET_NAMEr r r r r
watchedEvents< s z sfp_threatcrowd.watchedEventsc C s ddddddddgS ) NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_COHOST!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDRMALICIOUS_NETBLOCKMALICIOUS_SUBNETMALICIOUS_EMAILADDRr r$ r r r producedEventsB s z sfp_threatcrowd.producedEventsc
C s d }d }| j |r d| }d|kr,d| }|s8d| }| j j|| jd dd}|d d krp| j d | d S zt|d }W n< tk
r } z | j d
d d | _ W Y d S d }~X Y nX |S )
Nz7https://www.threatcrowd.org/searchApi/v2/ip/report/?ip=@z=https://www.threatcrowd.org/searchApi/v2/email/report/?email=z?https://www.threatcrowd.org/searchApi/v2/domain/report/?domain=
_fetchtimeoutr )timeout useragentcontentz No ThreatCrowd info found for z0Error processing JSON response from ThreatCrowd.FT)
r validIPfetchUrlr infojsonloads Exceptionerrorr )r qryreturlreser r r queryH s& zsfp_threatcrowd.queryc C s |j }|j}|j}| jr d S | jd| d | || jkrV| jd| d d S d| j|< |drx| jd sxd S |dkr| jd sd S |d
kr| jd sd S t |j
| jd k r| jd
t t |j
d t | jd d S |dkrH| jd sd S t |j
| jd k rH| jd
t t |j
d t | jd d S t }|drt |D ]"}|
t | d| jt |< qbn
|
| |D ]}| r d S | |}|d krq|dddk r| jd| |dks|drd} |dkr d} |dkrd} |d kr(d } |dkr6d } |d krDd } d!|d" d# }
t| d$| d% |
| j|} | | qd S )&NzReceived event, z, from z Skipping z as already mapped.TZ AFFILIATEr r r r r
r z$Network size bigger than permitted: z > r" r r
NETBLOCK_votesr z Found ThreatCrowd URL data for )r r& r r* r r' r# r) r( r! r- zZ permalinkzz
ThreatCrowd [z]
) eventTypemoduledatar r debugr
startswithr r prefixlenstrr append checkForStopr@ getr6 r __name__notifyListeners) r event eventName
srcModuleName eventDataqrylistipaddraddrr6 evtZinfourlr? r r r handleEvente s
zsfp_threatcrowd.handleEvent)rM
__module__ __qualname____doc__r optdescsr r dictr r% r. r@ rW r r r r r s, r )r7 netaddrr sflibr r r r r r r r
s