3
@6^                  @   sP   d dl Z d dlmZ d dlZd dlmZ d dlmZmZmZ G dd deZ	dS )    N)datetime)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc               @   sv   e Zd ZdZddddddddZdd	d
dddddZdZdZdZdZ	e
 fddZdd Zdd Zdd Zdd ZdS )sfp_threatminerzThreatMiner:Footprint,Investigate,Passive:Search Engines::Obtain information from ThreatMiner's database for passive DNS and threat intelligence.TF   d   Z   )verifynetblocklookupmaxnetblocksubnetlookup	maxsubnet	maxcohostage_limit_dayszCVerify that any hostnames found on the target domain still resolve?zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zbStop reporting co-hosted sites after this many are found, as it would likely indicate web hosting.z8Ignore records older than this many days. 0 = Unlimited.Nr   c             C   sR   || _ | j | _| j | _| j | _d| _x"t|j D ]}|| | j|< q8W d S )Nr   )	sftempStorageresultsreportedhosts
checkedipscohostcountlistkeysopts)selfsfcuserOptsopt r   :/var/www/spiderfoot.crq.systems/modules/sfp_threatminer.pysetup4   s    


zsfp_threatminer.setupc             C   s   ddddgS )N
IP_ADDRESSDOMAIN_NAMENETBLOCK_OWNERNETBLOCK_MEMBERr   )r   r   r   r    watchedEventsB   s    zsfp_threatminer.watchedEventsc             C   s   ddgS )NINTERNET_NAMECO_HOSTED_SITEr   )r   r   r   r    producedEventsG   s    zsfp_threatminer.producedEventsc       
      C   s   | j j|rd}nd}|dkr*d| d }|dkr>d| d }d}||j|jd	d
d }| j j|ddd}|d d kr| j jd|  d S t|d dkr| j jd|  d S ytj|d }W n. t	k
r }	 z| j j
dd d S d }	~	X nX |S )Nhostdomainsubsz/v2/z.php?q={0}&rt=5passivez.php?q={0}&rt=2zhttps://api.threatminer.orgzutf-8replace)errors
   r   )timeout	useragentcontentzNo ThreatMiner info found for r   z0Error processing JSON response from ThreatMiner.F)r   validIPformatencodefetchUrlinfolenjsonloads	Exceptionerror)
r   qry	querytypeZtgttypequeryurlZthreatminerurlurlresr8   er   r   r    queryJ   s,    zsfp_threatminer.queryc             C   s  |j }|j}|j}| jjd| d |  || jkrL| jjd| d  d S d| j|< |dkr| jd sld S t|j| jd k r| jjd	t	t|j d
 t	| jd   d S |dkr| jd sd S t|j| jd k r| jjd	t	t|j d
 t	| jd   d S t
 }|jdrPx.t|D ]"}|jt	| d| jt	|< q*W |dkrd|j| x|D ]}d}| j|d}	|	d kr| jjd|  d S d|	krqlt|	d dkrĐql| jjd |	d }
x8|
D ].}|jddkrqtj|jddd}ttj|j }ttj d| jd   }| jd dkrd||k rd| jjd q|d }||krzq| j j|ddr| jd r| jj|sqtd || j|}| j| d| j|< q| j| jd! k rt||| j|}| j| |  jd"7  _qW qlW |d#kr d }| j|d$}	|	d krN| jjd% d S t|	jdt
 dkrv| jjd% d S x|	jdD ]z}| jjd& || jkrqn
d| j|< | jd r| jj|s| jjd'| d(  qt||| j|}| j| qW d S ))NzReceived event, z, from z	Skipping z as already mapped.Tr$   r   r   z$Network size bigger than permitted: z > r%   r   r   	NETBLOCK_r"   r(   r-   zNo Passive DNS info for r   r   z(Found passive DNS results in ThreatMiner	last_seen z1970-01-01 00:00:00z%Y-%m-%d %H:%M:%SiQ r   z#Record found but too old, skipping.r+   )includeParentsr   r'   r      r#   r,   zNo hosts foundz!Found host results in ThreatMinerzCouldn't resolve z, so skipping.)	eventTypemoduledatar   debugr   r   r   	prefixlenstrr   
startswithappendrD   r8   r9   getr   strptimeinttimemktime	timetuple	getTargetmatchesresolveHostr   __name__notifyListenersr   r   )r   event	eventNamesrcModuleName	eventDataqrylistipaddrr>   evtTyperetrB   recrF   last_tsage_limit_tsr*   evtrC   r   r   r    handleEventj   s    















zsfp_threatminer.handleEvent)r[   
__module____qualname____doc__r   optdescsr   r   r   r   dictr!   r&   r)   rD   ri   r   r   r   r    r      s0    r   )
r:   r   rU   netaddrr   sflibr   r   r   r   r   r   r   r    <module>   s
   