3
@6^&                 @   sD   d dl Z d dlZd dlmZ d dlmZmZmZ G dd deZdS )    N)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc            
   @   sv   e Zd ZdZdddddddddd	Zdddd	d
ddddd	ZdZdZe fddZ	dd Z
dd Zdd Zdd ZdS )sfp_virustotalzzVirusTotal:Investigate,Passive:Reputation Systems:apikey:Obtain information from VirusTotal about identified IP addresses. T   )	api_keyverify	publicapicheckcohostscheckaffiliatesnetblocklookupmaxnetblocksubnetlookup	maxsubnetzVirusTotal API Key.z~Are you using a public key? If so SpiderFoot will pause for 15 seconds after each query to avoid VirusTotal dropping requests.zCheck co-hosted sites?zCheck affiliates?zvLook up all IPs on netblocks deemed to be owned by your target for possible hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zCVerify that any hostnames found on the target domain still resolve?)	r	   r   r   r   r   r   r   r   r
   NFc             C   s8   || _ | j | _x"t|j D ]}|| | j|< qW d S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   9/var/www/spiderfoot.crq.systems/modules/sfp_virustotal.pysetup7   s    
zsfp_virustotal.setupc             C   s   ddddddgS )N
IP_ADDRESSAFFILIATE_IPADDRINTERNET_NAMECO_HOSTED_SITENETBLOCK_OWNERNETBLOCK_MEMBERr   )r   r   r   r   watchedEventsB   s    zsfp_virustotal.watchedEventsc             C   s   ddddddddd	d
dgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_COHOST!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDRMALICIOUS_NETBLOCKMALICIOUS_SUBNETr!   AFFILIATE_INTERNET_NAMEINTERNET_NAME_UNRESOLVEDDOMAIN_NAMEr   )r   r   r   r   producedEventsH   s
    zsfp_virustotal.producedEventsc             C   s   d }| j j|rd| }nd| }| j j|d | jd  | jd dd}| jd r\tjd	 |d
 d kr|| j jd|  d S ytj|d
 }W n4 t	k
r } z| j j
dd d| _d S d }~X nX |S )Nz9https://www.virustotal.com/vtapi/v2/ip-address/report?ip=z9https://www.virustotal.com/vtapi/v2/domain/report?domain=z&apikey=r	   _fetchtimeoutr   )timeout	useragentr      contentzNo VirusTotal info found for z/Error processing JSON response from VirusTotal.FT)r   validIPfetchUrlr   timesleepinfojsonloads	Exceptionerror
errorState)r   qryreturlreser   r   r   queryO   s$    


zsfp_virustotal.queryc             C   sh  |j }|j}|j}| jrd S | jjd| d |  | jd dkrZ| jjdd d| _d S || jkr|| jjd| d	  d S d| j|< |j	d
r| jd  rd S |dkr| jd  rd S |dkr| jd sd S t
|j| jd k r| jjdtt
|j d t| jd   d S |dkrv| jd s0d S t
|j| jd k rv| jjdtt
|j d t| jd   d S t }|j	drx:t
|D ]"}|jt| d| jt|< qW n
|j| x|D ]}| j rd S | j|}|d krqt|jdg dkr| jjd|  |d0ks4|j	dr<d}	d}
|dkrNd}	d}
|dkr`d }	d!}
|d"krrd#}	d!}
|dkrd$}	d!}
d%|
 d& | d' }t|	d(| d) | | j|}| j| d*|kr|d1krx|d* D ]}| j j|r~|| jkr| jd+ rL| jj|s2td,|| j|}| j| ntd|| j|}| j| | jj|| jd- rtd.|| j|}| j| n&|| jkrtd"|| j|}| j| qW d/|kr|dkrx|d/ D ]}|| jkr| jd+ r| jj|s(td,|| j|}| j| ntd|| j|}| j| | jj|| jd- rtd.|| j|}| j| qW qW d S )2NzReceived event, z, from r	   r   z6You enabled sfp_virustotal but did not set an API key!FTz	Skipping z as already mapped.	AFFILIATEr   r"   r   r#   r   r   z$Network size bigger than permitted: z > r$   r   r   	NETBLOCK_Zdetected_urlsr   zFound VirusTotal URL data for r   r&   z
ip-addressr    r*   r!   r'   domainr-   r)   r(   z%<SFURL>https://www.virustotal.com/en//z/information/</SFURL>zVirusTotal [z]
Zdomain_siblingsr
   r.   _internettldsr/   Z
subdomains)r   )r   r!   )	eventTypemoduledatar?   r   debugr   r>   r   
startswithr   	prefixlenstrr   appendcheckForStoprE   lengetr:   r   __name__notifyListeners	getTargetmatchesresolveHostisDomain)r   event	eventNamesrcModuleName	eventDataqrylistipaddraddrr:   evtZinfotypeinfourlrD   snr   r   r   handleEventl   s    

















zsfp_virustotal.handleEvent)rV   
__module____qualname____doc__r   optdescsr   r?   dictr   r%   r0   rE   rg   r   r   r   r   r      s4   r   )	r;   r8   netaddrr   sflibr   r   r   r   r   r   r   r   <module>   s   