U
    @6^t+                     @   s\   d dl mZmZ d dlZd dlmZmZmZ dddddgd	d
gg diZG dd deZ	dS )    )	IPAddress	IPNetworkN)
SpiderFootSpiderFootPluginSpiderFootEventzTotalHash.com Database
_totalhashqueryipdomainz<https://totalhash.cymru.com/search/?dnsrr:*{0}%20or%20ip:{0}z.*<a href="/analysis.*)idtypechecksurlbadregex	goodregexc                   @   sp   e Zd ZdZddddZdddZdZe fdd	Zd
d Z	dd Z
dd Zdd Zdd Zdd Zdd ZdS )sfp_totalhashz{TotalHash.com:Investigate,Passive:Reputation Systems::Check if a host/domain or IP is malicious according to TotalHash.com.T)r   checkaffiliatescheckcohostszApply checks to affiliates?z?Apply checks to sites found to be co-hosted on the target's IP?)r   r   Nc                 C   s4   || _ |  | _t| D ]}|| | j|< qd S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   8/var/www/spiderfoot.crq.systems/modules/sfp_totalhash.pysetup4   s    
zsfp_totalhash.setupc                 C   s   dddddgS )NINTERNET_NAME
IP_ADDRESSAFFILIATE_INTERNET_NAMEAFFILIATE_IPADDRCO_HOSTED_SITEr   r   r   r   r   watchedEvents@   s
     zsfp_totalhash.watchedEventsc                 C   s   dddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDR!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_COHOSTr   r&   r   r   r   producedEventsH   s
     zsfp_totalhash.producedEventsc                 C   s   t |dkrB|D ]0}t||tjtjB r| jd|   dS qt |dkr|D ]0}t||tjtjB rR| jd|   dS qR| jd d S )Nr   z#Found to be bad against bad regex: Tz$Found to be good againt good regex: FzNeither good nor bad, unknown.)lenrematch
IGNORECASEDOTALLr   debug)r   contentr   r   rxr   r   r   contentMaliciousN   s    zsfp_totalhash.contentMaliciousc                 C   s   | j d| d |  tt D ]}t| d }||kr$t| d dkr$tt| d }| j j||| jd | jd d	}|d
 d kr| j 	d|| d  d S | 
|d
 t| d t| d r$||  S q$d S )Nz	Querying z for maliciousness of r   r   r   r   _fetchtimeout
_useragenttimeout	useragentr4   Unable to fetch Fr   r   )r   r3   r   	malchecksr   strfetchUrlformatr   errorr6   )r   r   target
targetTypecheckcidr   resr   r   r   resourceQueryb   s    $


zsfp_totalhash.resourceQueryc                 C   s  d}|dkr | j || jd }tt D ]t}t| d }||kr,t| d dkr,t }t| d }| j d| | jd	d
|d< |d d kr| j j	|| jd | jd d}|d d kr| j 
d| d  d S | j d| |d  |dkrNt }	dt| krt| d dd}
t|
tj}| j d| d |
  |d dD ].}t||}t|d
krR|	|d
  qRn|d d}	|	D ]}t|dk s|drq| }z@t|t|kr| j |d | d |  |W     S W nB tk
rB } z"| j dt|  W Y qW 5 d }~X Y nX q d S dt| kr|d dD ]P}||ks|dkrj||krj| j |d | d | d  |    S qjq,ztt| d |}tt| d |}|d dD ]b}|dkrt||tjs,t||tjr| j |d | d | d  |  W   S qW q, tk
r } z | j d t|  W Y q,W 5 d }~X Y q,X q,d S )!N r
   _internettldsr   r   r   r   sfmal_cacheperiodr   r4   r7   r8   r9   r<   Fnetblockregexz{0}z(\d+\.\d+\.\d+\.\d+)zNew regex for z: 
   #z found within netblock/subnet z in zError encountered parsing: /z
 found in z list.zError encountered parsing 2: )r   
hostDomainr   r   r=   r   dictcacheGetgetr?   rA   cachePutreplacer/   compiler1   r3   splitfindallr.   append
startswithstripr   r   	Exceptionr>   r@   r0   BaseException)r   r   rB   rC   	targetDomrD   rE   datar   iplistr5   patlinegrpr	   erxDomrxTgtr   r   r   resourceListt   s     
   zsfp_totalhash.resourceListc                 C   s   t t D ]}t| d }||kr|t| d kr| jd| d | d |  t| d dkrv| |||  S t| d dkr| |||  S qd S )	Nr   r   zChecking maliciousness of z (z) with: r   r   r   )r   r=   r   r   r3   rG   ri   )r   
resourceIditemTyperB   rD   rE   r   r   r   
lookupItem   s    zsfp_totalhash.lookupItemc                 C   sv  |j }|j}|j}| jd| d |  || jkrL| jd| d  d S d| j|< |dkrp| jddspd S |d	kr| jd
dsd S tt	
 D ]}t	| d }| j| r|dkrd}|dkrd}nd}|dkrd}d}|dkrd}|dkrd}|dkrd}|dkrd}| |||}	|  r2 d S |	d k	r|d | d d |	 d }
t||
| j|}| | qd S )NzReceived event, z, from z	Skipping z, already checked.Tr%   r   Fr$   r   r   )r"   r$   r	   r"   r(   r*   )BGP_AS_OWNERBGP_AS_MEMBERasnMALICIOUS_ASN)r!   r%   r#   r
   r!   r)   r#   r+   r,   z [z]
z<SFURL>z</SFURL>)	eventTypemodulera   r   r3   r   r   rU   r   r=   r   rl   checkForStopr   __name__notifyListeners)r   event	eventNamesrcModuleName	eventDatarD   rE   typeIdevtTyper   textevtr   r   r   handleEvent   sR    






zsfp_totalhash.handleEvent)rt   
__module____qualname____doc__r   optdescsr   rS   r    r'   r-   r6   rG   ri   rl   r~   r   r   r   r   r      s"   Mr   )
netaddrr   r   r/   sflibr   r   r   r=   r   r   r   r   r   <module>   s   