U
@6^- @ sX d dl mZmZ d dlZd dlmZmZmZ dddddgd d
d iZG d d
d
eZ dS ) ) IPAddress IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventzTOR Exist List _torexitslistipnetblockz+https://check.torproject.org/exit-addressesz^ExitAddress\s+{0}\s+)idtypechecksurlregexc @ sx e Zd ZdZddddddZddddd Zd
Ze fd d Zd
d Z dd Z
dd Z dd Z dd Z
dd Zdd Zd
S ) sfp_torexitszTOR Exit Nodes:Investigate,Passive:Secondary Networks::Check if an IP or netblock appears on the torproject.org exit node list.T )r checkaffiliates cacheperiodchecknetblocks checksubnetszApply checks to affiliates?z,Hours to cache list data before re-fetching.z=Report if any malicious IPs are found within owned netblocks?zJCheck if any malicious IPs are found within the same subnet of the target?)r r r r Nc C s: || _ | | _d| _t| D ]}|| | j|< q"d S )Nztorproject.org)sf tempStorageresults__dataSource__r keysopts)selfsfcuserOptsopt r 7/var/www/spiderfoot.crq.systems/modules/sfp_torexits.pysetup7 s
zsfp_torexits.setupc C s ddddgS )N
IP_ADDRESSNETBLOCK_MEMBERAFFILIATE_IPADDRNETBLOCK_OWNERr r r r r!
watchedEventsD s zsfp_torexits.watchedEventsc C s ddddgS )NMALICIOUS_IPADDRMALICIOUS_AFFILIATE_IPADDRMALICIOUS_SUBNETMALICIOUS_NETBLOCKr r' r r r! producedEventsK s zsfp_torexits.producedEventsc C s t |dkrB|D ]0}t||tjtjB r| jd| dS qt |dkr|D ]0}t||tjtjB rR| jd| dS qR| jd d S )Nr z#Found to be bad against bad regex: Tz$Found to be good againt good regex: Fz Neither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr debug)r content goodregexbadregexrxr r r! contentMaliciousP s z sfp_torexits.contentMaliciousc C s | j d| d | tt D ]}t| d }||kr$t| d dkr$tt| d }| j j||| jd | jd d }|d
d kr| j d || d d S |
|d
t| d
t| d r$|| S q$d S )Nz Querying z for maliciousness of r r queryr
_fetchtimeout
_useragenttimeout useragentr4 Unable to fetch Fr5 r6 ) r r3 r malchecksr strfetchUrlformatr errorr8 )r r target
targetTypecheckcidr resr r r!
resourceQueryd s $
zsfp_torexits.resourceQueryc C s d}|dkr | j || jd }tt D ]t}t| d }||kr,t| d dkr,t }t| d }| j d| | jd d
|d < |d d kr| j j || jd | jd
d}|d d kr| j
d| d d S | j d| |d |dkrNt } dt| krt| d dd}
t
|
t
j} | j d| d |
|d dD ].} t
| | }
t|
d
krR| |
d
qRn|d d} | D ]}t|dk s|drq| }z@t|t|kr| j |d | d | |W S W nB tk
rB } z"| j d t| W Y qW 5 d }~X Y nX q d S dt| kr|d dD ]P} | |ks|dkrj| |krj| j |d | d | d | S qjq,ztt| d |}tt| d |}|d dD ]b} |dkrt
|| t
js,t
|| t
jr| j |d | d | d | W S qW q, t k
r } z | j d t| W Y q,W 5 d }~X Y q,X q,d S )!N domain
_internettldsr r r r sfmal_r r r4 r: r; r< r? Fr
r z{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z:
#z found within netblock/subnet z in zError encountered parsing: /z
found in z list.z Error encountered parsing 2: ) r
hostDomainr r r@ r dictcacheGetgetrB rD cachePutreplacer/ compiler1 r3 splitfindallr. append
startswithstripr r ExceptionrA rC r0
BaseException)r r rE rF targetDomrG rH datar iplistr7 patlinegrpr erxDomrxTgtr r r! resourceListv s
zsfp_torexits.resourceListc C s t t D ]}t| d }||kr |t| d kr | jd| d | d | t| d dkrv| ||| S t| d dkr | ||| S q d S ) Nr r
zChecking maliciousness of z (z) with: r r9 r )r r@ r r r3 rJ rj )r
resourceIditemTyperE rG rH r r r!
lookupItem s zsfp_torexits.lookupItemc C s |j }|j}|j}| jd| d | || jkrL| jd| d d S d| j|< |dkrp| jddspd S |d kr| jd
dsd S |d kr| jd dsd S |d
kr| jddsd S tt
D ]}t | d }| j| r|dkrd}|dkrd}nd}|dkrd}d}|dkrRd}|dkr6d}|d krDd }|dkrRd }|d krdd }d }|d
krvd }d!}| |||} | r d S | d k r|d" | d# d$ | d% }
t
||
| j|} | | qd S )&NzReceived event, z, from z Skipping z, already checked.TCO_HOSTED_SITE checkcohostsFr% r r& r r$ r r )r# r% r r# r) r* ) BGP_AS_OWNER
BGP_AS_MEMBERasn
MALICIOUS_ASN)
INTERNET_NAMErn AFFILIATE_INTERNET_NAMErL rt MALICIOUS_INTERNET_NAMEru !MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_COHOSTr
r, r+ z [z]
zz) eventTypemodulerb r r3 r r rV r r@ r rm checkForStopr __name__notifyListeners) r event eventName
srcModuleName eventDatarG rH typeIdevtTyper textevtr r r! handleEvent sf
zsfp_torexits.handleEvent)r|
__module__ __qualname____doc__r optdescsr rT r" r( r- r8 rJ rj rm r r r r r! r s*
Mr )
netaddrr r r/ sflibr r r r@ r r r r r!
s