3
@6^3                 @   sX   d dl Z d dlZd dlmZ d dlZd dlmZ d dlmZmZm	Z	 G dd deZ
dS )    N)datetime)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc            
   @   sz   e Zd ZdZdddddddddd	Zdd	d
ddddddd	ZdZdZdZe	 fddZ
dd Zdd Zdd Zdd ZdS )
sfp_xforcezjXForce Exchange:Investigate,Passive:Reputation Systems:apikey:Obtain information from IBM X-Force Exchange    T   d   )	xforce_api_keyxforce_api_key_passwordage_limit_daysnetblocklookupmaxnetblocksubnetlookup	maxsubnet	maxcohostcheckaffiliateszX-Force Exchange API Key.zX-Force Exchange API Password.z<Ignore any records older than this many days. 0 = unlimited.zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zKLook up all IPs on subnets which your target is a part of for blacklisting?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zbStop reporting co-hosted sites after this many are found, as it would likely indicate web hosting.zApply checks to affiliates?NFr   c             C   s>   || _ | j | _d| _x"t|j D ]}|| | j|< q$W d S )Nr   )sftempStorageresultscohostcountlistkeysopts)selfsfcuserOptsopt r    5/var/www/spiderfoot.crq.systems/modules/sfp_xforce.pysetup9   s
    
zsfp_xforce.setupc             C   s   dddddddgS )N
IP_ADDRESSAFFILIATE_IPADDRINTERNET_NAMECO_HOSTED_SITENETBLOCK_OWNERNETBLOCK_MEMBERAFFILIATE_INTERNET_NAMEr    )r   r    r    r!   watchedEventsE   s    zsfp_xforce.watchedEventsc             C   s   dddddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_COHOST!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDRMALICIOUS_NETBLOCKr&   r    )r   r    r    r!   producedEventsK   s    zsfp_xforce.producedEventsc             C   s<  d }|dkrd}d}| j d }t|tkr4|jd}| j d }t|tkrT|jd}tj|djd | }d	d
|jd d}|d | d | }	| jj|	| j d d|d}
|
d dkr| jj	dd d| _
d S |
d d k r| jjd|  d S ytj|
d }W n0 tk
r6 } z| jj	dd d S d }~X nX |S )Nipr/malwareipr/historyresolvezhttps://api.xforce.ibmcloud.comr   zutf-8r   :zapplication/jsonzBasic )AcceptAuthorization/_fetchtimeoutr   )timeout	useragentheaderscode400401402403z[XForce API key seems to have been rejected or you have exceeded usage limits for the month.FTcontentzNo XForce info found for z+Error processing JSON response from XForce.)r2   r3   r4   )r>   r?   r@   rA   )r   typestrencodebase64	b64encodedecoder   fetchUrlerror
errorStateinfojsonloads	Exception)r   qry	querytyperetZ
xforce_urlapi_keyZapi_key_passwordtokenr<   urlresrL   er    r    r!   queryQ   s8    



zsfp_xforce.queryc       *      C   s  |j }|j}|j}d}| jr d S | jjd| d |  | jd dksT| jd dkrl| jjdd d	| _d S || jkr| jjd
| d  d S d	| j|< |dkr| jd sd S t	|j
| jd k r| jjdtt	|j
 d t| jd   d S |dkrR| jd sd S t	|j
| jd k rR| jjdtt	|j
 d t| jd   d S |jdrt| jjdd rtd S t }|jdrx:t	|D ]"}|jt| d	| jt|< qW n
|j| |dkrd}| j| jd krd S | j|d}	|	d kr| jjd|  nd|	kr| jjd |	d d }
x|
D ]}|d d kr6|jd!d }|s^q6tj|d"}ttj|j }ttj d#| jd$   }|d% }| jd$ d&kr||k r| jjd' q6n(t||| j|}| j| |  jd(7  _q6W x|D ]}| j rd S |dks*|jdr.d)}|d*kr<d+}|d,krJd-}|d.krXd/}|dkrfd0}| j|d1}|d k	r|jd2t }t|d&kr| jjd3 x:|D ]0}|jd4d}|jd5d }|sԐqtj|d6}ttj|j }ttj d#| jd$   }| jd$ d&kr6||k r6| jjd' q|jd7d}|jd8d&}|jd9d }d}t|d:k r|| jjd; q|d k	rx|D ]}|| d< }qW || t| | | | | }t||| j|}| j| qW |dGkrq | j|d=}|d k	r |jd>t }t|d&kr | jjd? xj|D ]`}|jd@d} |jdAd}!|jdBd}"|jdCd}#|jdDd}$|jd!d}%|jdEd}&|jdFd }'d}(|'d k	rx|'D ]})|(|) d< }(qW |!| |( | |$ | |" | |# | |& | |% }|jd!d }|sq6tj|d6}ttj|j }ttj d#| jd$   }|d% }| jd$ d&kr|||k r|| jjd' q6nt||| j|}| j| q6W q W d S )HNz ; zReceived event, z, from r   r   r   z;You enabled sfp_xforce but did not set an API key/password!FTz	Skipping z as already mapped.r'   r   r   z$Network size bigger than permitted: z > r(   r   r   
AFFILIATE_r   	NETBLOCK_r#   r&   r   r4   zNo Passive DNS info for ZPassivez#Found passive DNS results in XforcerecordsZ
recordTypeAlastz%Y-%m-%dT%H:%M:%SZiQ r   valuer   z#Record found but too old, skipping.   r+   r$   r/   r%   r,   r)   r.   r-   zipr/historyhistoryzFound history results in XForcereasonDescriptioncreatedz%Y-%m-%dT%H:%M:%S.000Zreasonscorecats   z Non-malicious results, skipping. zipr/malwareZmalwarezFound malware results in XForcecountorigindomainurimd5firstfamily)r&   r%   r)   )	eventTypemoduledatarK   r   debugr   rJ   r   r   	prefixlenrD   
startswithgetr   appendr   rX   rL   r   strptimeinttimemktime	timetupler   __name__notifyListenerscheckForStoplen)*r   event	eventNamesrcModuleName	eventDataZinfield_sepqrylistipaddrevtTyperR   rV   recr]   last_dtlast_tsage_limit_tshostrW   addrrec_historyresultra   rb   
created_dt
created_tsrc   rd   re   Zcats_descriptioncatentryZrec_malwarerh   ri   rj   rk   rl   lastseenZ	firstseenrn   Zfamily_descriptionfr    r    r!   handleEventz   s   





















.zsfp_xforce.handleEvent)r|   
__module____qualname____doc__r   optdescsr   rK   r   dictr"   r*   r1   rX   r   r    r    r    r!   r      s6   )r   )rM   rF   r   ry   netaddrr   sflibr   r   r   r   r    r    r    r!   <module>   s   