3
@6^- @ sX d dl mZmZ d dlZd dlmZmZmZ dddddgd d
d iZG d d
d
eZ dS ) ) IPAddress IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventzTOR Exist List _torexitslistipnetblockz+https://check.torproject.org/exit-addressesz^ExitAddress\s+{0}\s+)idtypechecksurlregexc @ sx e Zd ZdZddddddZddddd Zd
Ze fd d Zd
d Z dd Z
dd Z dd Z dd Z
dd Zdd Zd
S ) sfp_torexitszTOR Exit Nodes:Investigate,Passive:Secondary Networks::Check if an IP or netblock appears on the torproject.org exit node list.T )r checkaffiliates cacheperiodchecknetblocks checksubnetszApply checks to affiliates?z,Hours to cache list data before re-fetching.z=Report if any malicious IPs are found within owned netblocks?zJCheck if any malicious IPs are found within the same subnet of the target?)r r r r Nc C s> || _ | j | _d| _x"t|j D ]}|| | j|< q$W d S )Nztorproject.org)sf tempStorageresults__dataSource__r keysopts)selfsfcuserOptsopt r 7/var/www/spiderfoot.crq.systems/modules/sfp_torexits.pysetup7 s
zsfp_torexits.setupc C s ddddgS )N
IP_ADDRESSNETBLOCK_MEMBERAFFILIATE_IPADDRNETBLOCK_OWNERr )r r r r!
watchedEventsD s zsfp_torexits.watchedEventsc C s ddddgS )NMALICIOUS_IPADDRMALICIOUS_AFFILIATE_IPADDRMALICIOUS_SUBNETMALICIOUS_NETBLOCKr )r r r r! producedEventsK s zsfp_torexits.producedEventsc C s t |dkrDx6|D ].}tj||tjtjB r| jjd| dS qW t |dkrx6|D ].}tj||tjtjB rV| jjd| dS qVW | jjd d S )Nr z#Found to be bad against bad regex: Tz$Found to be good againt good regex: Fz Neither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr debug)r content goodregexbadregexrxr r r! contentMaliciousP s
z sfp_torexits.contentMaliciousc C s | j jd| d | xttj D ]}t| d }||kr&t| d dkr&tt| d }| j j|j|| jd | jd d }|d
d kr| j j d |j| d d S | j
|d
t| d
t| d r&|j|S q&W d S )Nz Querying z for maliciousness of r r queryr
_fetchtimeout
_useragent)timeout useragentr3 zUnable to fetch Fr4 r5 ) r r2 r malchecksr strfetchUrlformatr errorr7 )r r target
targetTypecheckcidr resr r r!
resourceQueryd s $
zsfp_torexits.resourceQueryc C s d}|dkr | j j|| jd }xjttj D ]X}t| d }||koXt| d dkr0t }t| d }| j jd| | jjd d
|d < |d d kr| j j || jd | jd
d}|d d kr| j j
d| d d S | j j d| |d |dkrFt } dt| krt| d j dd}
t
j|
t
j} | j jd| d |
xP|d jdD ].} t
j| | }
t|
d
krV| j|
d
qVW n|d jd} x| D ]}t|dk s|jdrq|j }y6t|t|kr| j j|d | d | |S W n< tk
r: } z | j jd t| wW Y d d }~X nX qW d S dt| krxZ|d jdD ]H} | |ks|dkrd| |krd| j j|d | d | d |S qdW q0ytt| d j|}tt| d j|}xj|d jdD ]X} |dkrt
j || t
js"t
j || t
jr| j j|d | d | d |S qW W q0 t k
r } z | j jd t| w0W Y d d }~X q0X q0W d S )!N domain
_internettldsr r r r sfmal_r r r3 r9 r: )r; r< zUnable to fetch Fr
r z{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z:
#z found within netblock/subnet z in zError encountered parsing: /z
found in z list.z Error encountered parsing 2: ) r
hostDomainr r r= r dictcacheGetgetr? rA cachePutreplacer. compiler0 r2 splitfindallr- append
startswithstripr r Exceptionr> r@ r/
BaseException)r r rB rC targetDomrD rE datar iplistr6 patlinegrpr erxDomrxTgtr r r! resourceListv sr
zsfp_torexits.resourceListc C s xt tj D ]}t| d }||kr|t| d kr| jjd| d | d | t| d dkrt| j|||S t| d dkr| j|||S qW d S ) Nr r
zChecking maliciousness of z (z) with: r r8 r )r r= r r r2 rG rg )r
resourceIditemTyperB rD rE r r r!
lookupItem s zsfp_torexits.lookupItemc C s |j }|j}|j}| jjd| d | || jkrL| jjd| d d S d| j|< |dkrr| jjdd rrd S |d kr| jjd
d rd S |d kr| jjd d rd S |d
kr| jjdd rd S xtt j
D ]}t | d }| j| r|d%krd}|dkrd}nd}|d&kr&d}d}|d'kr^d}|dkrBd}|dkrPd }|dkr^d }|d krpd }d }|d
krd }d }| j |||} | j rd S | d k r|d! | d" d# | d$ }
t
||
| j|} | j| qW d S )(NzReceived event, z, from z Skipping z, already checked.TCO_HOSTED_SITE checkcohostsFr% r r& r r$ r r r# r r( r) BGP_AS_OWNER
BGP_AS_MEMBERasn
MALICIOUS_ASN
INTERNET_NAMEAFFILIATE_INTERNET_NAMErI MALICIOUS_INTERNET_NAME!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_COHOSTr
r+ r* z [z]
zz)r# r% )rm rn )rq rk rr ) eventTypemoduler_ r r2 r r rS r r= r rj checkForStopr __name__notifyListeners) r event eventName
srcModuleName eventDatarD rE typeIdevtTyper textevtr r r! handleEvent sf
zsfp_torexits.handleEvent)ry
__module__ __qualname____doc__r optdescsr rQ r" r' r, r7 rG rg rj r r r r r! r s&
Mr )
netaddrr r r. sflibr r r r= r r r r r!
s