U
@6^& @ sD d dl Z d dlZd dlmZ d dlmZmZmZ G dd deZdS ) N) IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc
@ sv e Zd ZdZdddddddddd Zdddd d
d d d
dd ZdZdZe fddZ dd Z
dd Z dd Z dd Z
dS ) sfp_virustotalzzVirusTotal:Investigate,Passive:Reputation Systems:apikey:Obtain information from VirusTotal about identified IP addresses. T ) api_keyverify publicapi checkcohostscheckaffiliatesnetblocklookup maxnetblock subnetlookup maxsubnetzVirusTotal API Key.z~Are you using a public key? If so SpiderFoot will pause for 15 seconds after each query to avoid VirusTotal dropping requests.zCheck co-hosted sites?zCheck affiliates?zvLook up all IPs on netblocks deemed to be owned by your target for possible hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z:Look up all IPs on subnets which your target is a part of?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zCVerify that any hostnames found on the target domain still resolve?) r r r r
r r r r r
NFc C s4 || _ | | _t| D ]}|| | j|< q d S )N)sf tempStorageresultslistkeysopts)selfsfcuserOptsopt r 9/var/www/spiderfoot.crq.systems/modules/sfp_virustotal.pysetup7 s
zsfp_virustotal.setupc C s ddddddgS )N
IP_ADDRESSAFFILIATE_IPADDR
INTERNET_NAMECO_HOSTED_SITENETBLOCK_OWNERNETBLOCK_MEMBERr r r r r
watchedEventsB s
z sfp_virustotal.watchedEventsc C s ddddddddd d
d g S ) NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_COHOST!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDRMALICIOUS_NETBLOCKMALICIOUS_SUBNETr! AFFILIATE_INTERNET_NAMEINTERNET_NAME_UNRESOLVED DOMAIN_NAMEr r% r r r producedEventsH s z sfp_virustotal.producedEventsc
C s d }| j |rd| }nd| }| j j|d | jd | jd dd}| jd r\td |d
d kr|| j d | d S zt|d
}W n< t k
r } z | j
d d
d| _ W Y d S d }~X Y nX |S )Nz9https://www.virustotal.com/vtapi/v2/ip-address/report?ip=z9https://www.virustotal.com/vtapi/v2/domain/report?domain=z&apikey=r
_fetchtimeoutr )timeout useragentr contentz No VirusTotal info found for z/Error processing JSON response from VirusTotal.FT) r validIPfetchUrlr timesleepinfojsonloads Exceptionerror
errorState)r qryreturlreser r r queryO s(
zsfp_virustotal.queryc C sT |j }|j}|j}| jr d S | jd| d | | jd dkrZ| jdd d| _d S || jkr|| jd| d d S d| j|< | d
r| jd sd S |d kr| jd
sd S |dkr| jd sd S t
|j | jd k r| jdt t
|j d t | jd d S |dkrr| jd s,d S t
|j | jd k rr| jdt t
|j d t | jd d S t
}| drt
|D ]"}|t | d| jt |< qn
|| |D ]}| r d S | |}|d krqt|dg dkr| jd| |dks*| dr2d} d }
|d krDd } d }
|d krVd } d!}
|d"krhd#} d!}
|d krzd$} d!}
d%|
d& | d' } t| d(| d) | | j|} | | d*|kr|d+kr|d* D ]}
| |
rr|
| jkr| jd, r@| j|
s&td-|
| j|} | | ntd |
| j|} | | | j|
| jd. rtd/|
| j|} | | n&|
| jkrtd"|
| j|} | | qd0|kr|d kr|d0 D ]}|| jkr| jd, r| j|std-|| j|} | | ntd || j|} | | | j|| jd. rtd/|| j|} | | qqd S )1NzReceived event, z, from r r z6You enabled sfp_virustotal but did not set an API key!FTz Skipping z as already mapped. AFFILIATEr
r" r r# r r z$Network size bigger than permitted: z > r$ r r NETBLOCK_Z
detected_urlsr z Found VirusTotal URL data for )r r' z
ip-addressr r+ r! r( domainr. r* r) z%https://www.virustotal.com/en//z/information/z VirusTotal [z]
Zdomain_siblings)r r! r
r/
_internettldsr0 Z
subdomains) eventTypemoduledatar@ r debugr r? r
startswithr prefixlenstrr append checkForStoprF lengetr; r __name__notifyListeners getTargetmatches resolveHostisDomain)r event eventName
srcModuleName eventDataqrylistipaddraddrr; evtZinfotypeinfourlrE snr r r handleEventl s
zsfp_virustotal.handleEvent)rW
__module__ __qualname____doc__r optdescsr r@ dictr r& r1 rF rh r r r r r s8 r ) r< r9 netaddrr sflibr r r r r r r r
s