U
    @6^3                     @   sX   d dl Z d dlZd dlmZ d dlZd dlmZ d dlmZmZm	Z	 G dd deZ
dS )    N)datetime)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc                
   @   sz   e Zd ZdZdddddddddd	Zdd	d
ddddddd	ZdZdZdZe	 fddZ
dd Zdd Zdd Zdd ZdS )
sfp_xforcezjXForce Exchange:Investigate,Passive:Reputation Systems:apikey:Obtain information from IBM X-Force Exchange    T   d   )	xforce_api_keyxforce_api_key_passwordage_limit_daysnetblocklookupmaxnetblocksubnetlookup	maxsubnet	maxcohostcheckaffiliateszX-Force Exchange API Key.zX-Force Exchange API Password.z<Ignore any records older than this many days. 0 = unlimited.zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zKLook up all IPs on subnets which your target is a part of for blacklisting?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zbStop reporting co-hosted sites after this many are found, as it would likely indicate web hosting.zApply checks to affiliates?NFr   c                 C   s:   || _ |  | _d| _t| D ]}|| | j|< q"d S )Nr   )sftempStorageresultscohostcountlistkeysopts)selfsfcuserOptsopt r    5/var/www/spiderfoot.crq.systems/modules/sfp_xforce.pysetup9   s
    
zsfp_xforce.setupc                 C   s   dddddddgS )N
IP_ADDRESSAFFILIATE_IPADDRINTERNET_NAMECO_HOSTED_SITENETBLOCK_OWNERNETBLOCK_MEMBERAFFILIATE_INTERNET_NAMEr    r   r    r    r!   watchedEventsE   s      zsfp_xforce.watchedEventsc                 C   s   dddddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_COHOST!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDRMALICIOUS_NETBLOCKr&   r    r*   r    r    r!   producedEventsK   s      zsfp_xforce.producedEventsc              
   C   sB  d }|dkrd}d}| j d }t|tkr4|d}| j d }t|tkrT|d}t|dd | }dd	|d d
}|d | d | }	| jj|	| j d d|d}
|
d dkr| j	dd d| _
d S |
d d kr| jd|  d S zt|
d }W n8 tk
r< } z| j	dd W Y d S d }~X Y nX |S )N)ipr/malwareipr/historyresolver3   zhttps://api.xforce.ibmcloud.comr   zutf-8r   :zapplication/jsonzBasic )AcceptAuthorization/_fetchtimeoutr   )timeout	useragentheaderscode)400Z401Z402403z[XForce API key seems to have been rejected or you have exceeded usage limits for the month.FTcontentzNo XForce info found for z+Error processing JSON response from XForce.)r   typestrencodebase64	b64encodedecoder   fetchUrlerror
errorStateinfojsonloads	Exception)r   qry	querytyperetZ
xforce_urlapi_keyZapi_key_passwordtokenr=   urlresrK   er    r    r!   queryQ   s:    



zsfp_xforce.queryc           *      C   s  |j }|j}|j}d}| jr d S | jd| d |  | jd dksT| jd dkrl| jdd d	| _d S || jkr| jd
| d  d S d	| j|< |dkr| jd sd S t	|j
| jd k r| jdtt	|j
 d t| jd   d S |dkrR| jd sd S t	|j
| jd k rR| jdtt	|j
 d t| jd   d S |drr| jddsrd S t }|drt	|D ]"}|t| d	| jt|< qn
|| |dkrd}| j| jd krd S | |d}	|	d kr| jd|  nd|	kr| jd |	d d }
|
D ]}|d d kr.|d!d }|sVq.t|d"}tt| }tt d#| jd$   }|d% }| jd$ d&kr||k r| jd' q.n(t||| j|}| | |  jd(7  _q.|D ]}|  r d S |dks|dr"d)}|d*kr0d+}|d,kr>d-}|d.krLd/}|dkrZd0}| |d1}|d k	r|d2t }t|d&kr| jd3 |D ],}|d4d}|d5d }|sĐqt|d6}tt| }tt d#| jd$   }| jd$ d&kr&||k r&| jd' q|d7d}|d8d&}|d9d }d}t|d:k rl| jd; q|d k	r|D ]}|| d< }qz|| t| | | | | }t||| j|}| | q|d=krڐq| |d>}|d k	r|d?t }t|d&kr| jd@ |D ]\}|dAd} |dBd}!|dCd}"|dDd}#|dEd}$|d!d}%|dFd}&|dGd }'d}(|'d k	r|'D ]})|(|) d< }(q|!| |( | |$ | |" | |# | |& | |% }|d!d }|sqt|d6}tt| }tt d#| jd$   }|d% }| jd$ d&kr^||k r^| jd' qnt||| j|}| | qqd S )HNz ; zReceived event, z, from r   r   r   z;You enabled sfp_xforce but did not set an API key/password!FTz	Skipping z as already mapped.r'   r   r   z$Network size bigger than permitted: z > r(   r   r   
AFFILIATE_r   	NETBLOCK_r#   r&   r   r5   zNo Passive DNS info for ZPassivez#Found passive DNS results in XforcerecordsZ
recordTypeAlastz%Y-%m-%dT%H:%M:%SZiQ r   valuer   z#Record found but too old, skipping.   r,   r$   r0   r%   r-   r)   r/   r.   r4   historyzFound history results in XForcereasonDescriptioncreatedz%Y-%m-%dT%H:%M:%S.000Zreasonscorecats   z Non-malicious results, skipping. )r&   r%   r)   r3   ZmalwarezFound malware results in XForcecountorigindomainurimd5firstfamily)	eventTypemoduledatarJ   r   debugr   rI   r   r   	prefixlenrC   
startswithgetr   appendr   rW   rK   r   strptimeinttimemktime	timetupler   __name__notifyListenerscheckForStoplen)*r   event	eventNamesrcModuleName	eventDataZinfield_sepqrylistipaddrevtTyperQ   rU   recr\   last_dtlast_tsage_limit_tshostrV   addrrec_historyresultr`   ra   
created_dt
created_tsrb   rc   rd   Zcats_descriptioncatentryZrec_malwarerg   rh   ri   rj   rk   lastseenZ	firstseenrm   Zfamily_descriptionfr    r    r!   handleEventz   sf   





















zsfp_xforce.handleEvent)r{   
__module____qualname____doc__r   optdescsr   rJ   r   dictr"   r+   r2   rW   r   r    r    r    r!   r      s:   )r   )rL   rE   r   rx   netaddrr   sflibr   r   r   r   r    r    r    r!   <module>   s   