def threatcrowd(plugin_name, project_id, resource_id, resource_type, target): result_status = PluginResultStatus.STARTED query_result = {} try: resource_type = ResourceType(resource_type) if resource_type == ResourceType.IPv4: query_result = threatcrowd_ip(target) elif resource_type == ResourceType.DOMAIN: query_result = threatcrowd_domain(target) elif resource_type == ResourceType.EMAIL: query_result = threatcrowd_email(target) elif resource_type == ResourceType.HASH: query_result = threatcrowd_hash(target) else: print("ThreatCrowd resource type does not found") result_status = PluginResultStatus.FAILED if not query_result: print("No results from ThreatCrowd plugin") result_status = PluginResultStatus.RETURN_NONE else: print(query_result) result_status = PluginResultStatus.COMPLETED PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def hunterio(plugin_name, project_id, resource_id, resource_type, target): try: query_result = None if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY else: result_status = PluginResultStatus.STARTED resource_type = ResourceType(resource_type) if resource_type == ResourceType.DOMAIN: query_result = hunterio_domain(target) elif resource_type == ResourceType.EMAIL: query_result = hunterio_email(target) else: print("Hunter.io resource type does not found") result_status = PluginResultStatus.RETURN_NONE if query_result: result_status = PluginResultStatus.COMPLETED PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def phishtank(plugin_name, project_id, resource_id, resource_type, url): result_status = PluginResultStatus.STARTED query_result = None try: API_KEY = KeyRing().get("phishtank") if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY else: resource_type = ResourceType(resource_type) if resource_type == ResourceType.URL: query_result = phishtank_check(url) result_status = PluginResultStatus.COMPLETED else: print("phishtank resource type does not found") result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def tacyt(plugin_name, project_id, resource_id, resource_type, apk_hash): application = None result_status = PluginResultStatus.STARTED try: APP_ID = KeyRing().get("tacyt-appid") SECRET_KEY = KeyRing().get("tacyt-secret") API_KEY_IN_DDBB = bool(APP_ID) & bool(SECRET_KEY) if not API_KEY_IN_DDBB: print("No App ID key...!") result_status = PluginResultStatus.NO_API_KEY else: api = tacytsdk.TacytApp(APP_ID, SECRET_KEY) search = api.search_apps(query=apk_hash, outfields=__OUT_FIELDS) if (search.data and search.data.get("data") and search.data.get("data").get("result") and search.data.get("data").get("result").get("numResults") == 1): application = (search.data.get("data").get("result").get( "applications")[0]) result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results(resource_id, plugin_name, project_id, application, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) application = None
def binaryedge(plugin_name, project_id, resource_id, resource_type, ip): try: API_KEY = KeyRing().get("binaryedge") if not API_KEY: print("No API key...!") return {} response = {} headers = {"X-Key": API_KEY} response = requests.get(URL.format(**{"ip": ip}), headers=headers) if response.status_code == 404: print("associated records not found!") elif not response.status_code == 200: print("API key error!") else: response = json.loads(response.content) print(response) PluginManager.set_plugin_results( resource_id, plugin_name, project_id, response, result_status ) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) return None
def threatminer_task(plugin_name, project_id, resource_id, resource_type, target): resource_type_miner = ResourceType(resource_type) try: query_result = {} result_status = PluginResultStatus.STARTED if resource_type_miner == ResourceType.DOMAIN: query_result = threatminer_domain(target) result_status = PluginResultStatus.COMPLETED elif resource_type_miner == ResourceType.IPv4: query_result = threatminer_ip(target) result_status = PluginResultStatus.COMPLETED elif resource_type_miner == ResourceType.HASH: query_result = threatminer_samples(target) result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.RETURN_NONE print("threatminer resource type does not found") PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def dns(plugin_name, project_id, resource_id, resource_type, domain): try: results = {} result_status = PluginResultStatus.STARTED for TYPE in LOOKUP: try: r = resolver.query(domain, TYPE) results[TYPE] = [str(i) for i in r] except: # Case when the query must be on canonical domain try: root_name = ".".join(domain.split(".")[-2:]) r = resolver.query(root_name, TYPE) results[TYPE] = [str(i) for i in r] result_status = PluginResultStatus.COMPLETED except: results[TYPE] = None if len(LOOKUP) == 0: result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results(resource_id, plugin_name, project_id, results, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def metagoofil(domain, plugin_name, project_id, resource_id, resource_type): try: result_status = PluginResultStatus.STARTED print("Analizing {} with metagoofil".format(domain)) response = _metagoofil._main(domain) files = [] for x in response: url = urlparse(x) filename = os.path.basename(url.path) extension = filename.split(".")[1] files.append({ "filename": filename, "extension": extension.lower(), "url": x }) if files: result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results(resource_id, plugin_name, project_id, response, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) return None
def diario(plugin_name, project_id, resource_id, resource_type, document_hash): result_status = PluginResultStatus.STARTED result = {"is_document": False} try: if not (APP_ID and SECRET_KEY): print("No App ID key...!") result_status = PluginResultStatus.NO_API_KEY else: diariosdk = Diario(APP_ID, SECRET_KEY) response = diariosdk.search(document_hash) if response.data: result = get_result(diariosdk, response.data) result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results(resource_id, plugin_name, project_id, result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) result = None
def geoip(plugin_name, project_id, resource_id, resource_type, ip): result_status = PluginResultStatus.STARTED result = None try: API_KEY = KeyRing().get("ipstack") if not API_KEY: print("No API key...!") return None URL = f"http://api.ipstack.com/{ip}?access_key={API_KEY}&format=1" response = urllib.request.urlopen(URL).read() result = json.loads(response) if "success" in result: if not result["success"]: if result["error"]["code"] in [101, 102, 103, 104, 105]: result_status = PluginResultStatus.NO_API_KEY elif result["error"]["code"] == 404: result_status = PluginResultStatus.RETURN_NONE else: result_status = PluginResultStatus.COMPLETED PluginManager.set_plugin_results(resource_id, plugin_name, project_id, result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) return None
def pastebin(plugin_name, project_id, resource_id, resource_type, target, search_engine): try: query_result = None API_KEY = KeyRing().get("pastebin") if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY else: # We use "googlesearch" subtask to gather results as pastebin.com does not # have a in-search engine query_result = restricted_googlesearch(search_engine, target) # Now, process google results and get the pastes and metadata if query_result: query_result = pastebin_get_results(query_result) result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def main(plugin_name, project_id, resource_id, resource_type, target): result_status = PluginResultStatus.STARTED try: if PLUGIN_NEEDS_API_KEY: API_KEY = KeyRing().get(PLUGIN_NAME) if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY query_result = None resource_type = ResourceType(resource_type) if resource_type == ResourceType.DOMAIN: query_result = auxiliary_function_1(target) elif resource_type == ResourceType.EMAIL: query_result = auxiliary_function_2(target) else: print(f"[{PLUGIN_NAME}]: Resource type does not found") PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def dinoflux(plugin_name, project_id, resource_id, resource_type, target): try: query_result = None API_KEY = KeyRing().get(PLUGIN_NAME) if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY else: result_status = PluginResultStatus.STARTED resource_type = ResourceType(resource_type) if resource_type: query_result = get_report(resource_type, target) else: print("No resource type") if query_result: result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def basic_ip(ip, plugin_name, project_id, resource_id, resource_type): result_status = PluginResultStatus.STARTED query_result = {} # PTR try: PTR_record = ptr(ip) if PTR_record: query_result["ptr"] = PTR_record ASN_NET_record = asn(ip) if "asn" in ASN_NET_record: query_result["asn"] = ASN_NET_record["asn"] if "network" in ASN_NET_record: query_result["network"] = ASN_NET_record["network"] result_status = PluginResultStatus.COMPLETED PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def sherlock(username, plugin_name, project_id, resource_id, resource_type): response = [] result_status = PluginResultStatus.STARTED try: site_data_all = None data_file_path = os.path.join( os.getcwd(), "tasks", "deps", "sherlock", "sherlock", "resources", "data.json", ) if site_data_all is None: # Check if the file exists otherwise exit. if not os.path.exists(data_file_path): print("JSON file at doesn't exist.") print( "If this is not a file but a website, make sure you have appended http:// or https://." ) return None else: raw = open(data_file_path, "r", encoding="utf-8") try: site_data_all = json.load(raw) except: print("Invalid JSON loaded from file.") result = _sherlock.sherlock(username, site_data_all, QueryNotifyPrint(),) for site, result in result.items(): temp_result = {} temp_result["sitename"] = site temp_result["url_user"] = result.get("url_user") temp_result["exists"] = ( "yes" if str(result["status"]) == "Claimed" else "no" ) response.append(temp_result) if response: result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results( resource_id, plugin_name, project_id, response, result_status ) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) return None
def shodan(plugin_name, project_id, resource_id, resource_type, ip): result_status = PluginResultStatus.STARTED response = {} try: API_KEY = KeyRing().get("shodan") if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY else: ipinfo = requests.get(URL.format(**{"ip": ip, "API_KEY": API_KEY})) if not ipinfo.status_code == 200: result_status = PluginResultStatus.RETURN_NONE else: ipinfo = json.loads(ipinfo.content) response["hostnames"] = (ipinfo["hostnames"] if "hostnames" in ipinfo else []) response["os"] = ipinfo["os"] if "os" in ipinfo else None response["org"] = ipinfo["org"] if "org" in ipinfo else None response["isp"] = ipinfo["isp"] if "isp" in ipinfo else None response["services"] = [] for data in ipinfo["data"]: service = {} service["port"] = data["port"] if "port" in data else None service["transport"] = (data["transport"] if "transport" in data else None) service["service"] = data[ "service"] if "service" in data else None service["data"] = data["data"] if "data" in data else None service["product"] = data[ "product"] if "product" in data else None service["banner"] = data[ "banner"] if "banner" in data else None service["devicetype"] = (data["devicetype"] if "devicetype" in data else None) service["timestamp"] = (data["timestamp"] if "timestamp" in data else None) service["hostnames"] = (data["hostnames"] if "hostnames" in data else []) response["services"].append(service) result_status = PluginResultStatus.COMPLETED PluginManager.set_plugin_results(resource_id, plugin_name, project_id, response, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) return None
def set_plugin_results( self, plugin_name, project_id, query_result, result_status=PluginResultStatus.COMPLETED, ): PluginManager.set_plugin_results( self.resource_id, plugin_name, project_id, query_result, result_status )
def urlscan(plugin_name, project_id, resource_id, resource_type, url): result_status = PluginResultStatus.STARTED response = {} try: API_KEY = KeyRing().get("urlscan") if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY else: headers = { "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0", "Content-Type": "application/json", "API-Key": API_KEY, } data = {"url": url, "public": "on", "tags": ["phishing", "malicious"]} url_submission_response = requests.post( SUBMISSION_URL, headers=headers, json=data ) if not url_submission_response.status_code == 200: print("API key error!") result_status = PluginResultStatus.RETURN_NONE else: uuid = json.loads(url_submission_response.content)["uuid"] SLEEP_LIMIT = 300 SLEEP_DELTA_INCREMENT = 2.5 SLEEP_FRAME = 2 # Número de reintentos cada 2 segundos while SLEEP_FRAME < SLEEP_LIMIT: response = result(uuid) if response is not None: break SLEEP_FRAME = round(SLEEP_FRAME * SLEEP_DELTA_INCREMENT) time.sleep(SLEEP_FRAME) if response: result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results( resource_id, plugin_name, project_id, response, result_status ) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) return None
def vt_domain(plugin_name, project_id, resource_id, resource_type, target): result_status = PluginResultStatus.STARTED response = None try: API_KEY = KeyRing().get("virustotal") if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY else: response = None url = None params = {"apikey": API_KEY} resource_type_for_vt = ResourceType(resource_type) if resource_type_for_vt == ResourceType.DOMAIN: url = url_for_domains params["domain"] = target elif resource_type_for_vt == ResourceType.URL: url = url_for_urls params["resource"] = target elif resource_type_for_vt == ResourceType.IPv4: url = url_for_ips params["ip"] = target elif resource_type_for_vt == ResourceType.HASH: url = url_for_hashes params["resource"] = target else: print("[VT]: Unknown resource type before querying service") result_status = PluginResultStatus.FAILED response = requests.get(url, params=params) if not response.status_code == 200: print(response) result_status = PluginResultStatus.RETURN_NONE else: response = json.loads(response.content) result_status = PluginResultStatus.COMPLETED print(response) PluginManager.set_plugin_results(resource_id, plugin_name, project_id, response, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) return None
def threatminer_task(plugin_name, project_id, resource_id, resource_type, domain): try: resource_type = ResourceType(resource_type) if resource_type == ResourceType.DOMAIN: query_result = threatminer_domain(domain, "1") else: print("threatminer resource type does not found") PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def launch_plugin(self, project_id, plugin_name, profile=None): try: return PluginManager(self, project_id).launch(plugin_name) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def launch_plugins(self, project_id, profile=None): try: PluginManager(self, project_id).launch_all() except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def get_apikeys(user): try: if not user.get("is_admin"): return jsonify({"error_message": "User is not admin"}), 400 results = DB("apikeys").collection.find({}, {"_id": False}) plugins = PluginManager.get_all() plugins = [plugin for plugin in list(plugins) if plugin.get("needs_apikey")] list_results = list(results) for plugin in plugins: apikey_names = plugin.get("apikey_names") apikeys = [] for apikey_name in apikey_names: apikey = {} apikey_value = [ value["apikey"] for value in list_results if value["name"] == apikey_name ] apikey["name"] = apikey_name apikey["value"] = apikey_value[0] if len(apikey_value) > 0 else None apikeys.append(apikey) plugin["apikeys"] = apikeys return dumps(plugins) except Exception as e: print(e) return jsonify({"error_message": "Error getting API keys"}), 400
def get_all_plugins(user): try: plugin_names = PluginManager.get_plugin_names() return json.dumps(plugin_names) except Exception as e: print(f"[get_all_plugins]: {e}") return jsonify({"error_message": "Error gettings plugins"}), 400
def to_JSON(self, timestamp_index=0): """ Get the doc from DB and returns a JSON without the ObjectId Client must JSON.parse() it in browser before passing it to Vuex """ # Doc is this resource json itself doc = self.resource # Needed because FE expect it to be there doc["plugins"] = [] # We need how many plugins can deal with this current resource type plugins_names = PluginManager.get_plugins_names_for_resource( self.get_type_value()) # Scan for results in all plugins resource type related for plugin_name in plugins_names: result_cursor = (DB(plugin_name).collection.find({ "resource_id": self.resource_id, "results": { "$exists": True }, }).sort([("timestamp", pymongo.DESCENDING)])) result_cursor = list(result_cursor) if not len(result_cursor) == 0: # Test timestamp index if timestamp_index < 0 or timestamp_index > len( result_cursor) - 1: result = result_cursor[0] else: result = result_cursor[timestamp_index] # Add name of the plugin, because we do not store it in database result["name"] = plugin_name # If this plugin results is a list of external references (case pastebin), load it: _load_external_results(result) # Load all timemachine timestamps timemachine = [] # Add the last LIMIT_OF_TIMEMACHINE_RESULTS timestamps to timemachine for ts in result_cursor: timemachine.append({ "timestamp": ts["timestamp"], "result_status": ts["result_status"], }) # Plug timemachine results in our plugin results result["timemachine"] = timemachine # Plug this plugin results to doc doc["plugins"].append(result) return json.loads(json.dumps(doc, default=str))
def haveibeenpwned(plugin_name, project_id, resource_id, resource_type, email): try: API_KEY = KeyRing().get("haveibeenpwned") if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY else: response = [] headers = { "user-agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0", "hibp-api-key": API_KEY, } hibp = requests.get( URL.format(**{ "service": "breachedaccount", "account": email }), headers=headers, ) if not hibp.status_code == 200: print("HIBP Request error!") result_status = PluginResultStatus.RETURN_NONE else: hibp = json.loads(hibp.content) response = hibp result_status = PluginResultStatus.COMPLETED details = breach_detail_filler(response) if not len(details) == len(response): print( "[HIBP] An update should be needed in breaches.json file") result_status = PluginResultStatus.FAILED PluginManager.set_plugin_results(resource_id, plugin_name, project_id, response, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) return None
def maltiverse(plugin_name, project_id, resource_id, resource_type, target): try: MALTIVERSE_EMAIL = KeyRing().get("maltiverse_email") MALTIVERSE_PASS = KeyRing().get("maltiverse_pass") API_KEY = bool(MALTIVERSE_EMAIL) & bool(MALTIVERSE_PASS) query_result = None if not API_KEY: print(["[maltiverse]: No API Keys..."]) result_status = PluginResultStatus.NO_API_KEY else: result_status = PluginResultStatus.STARTED resource_type = ResourceType(resource_type) if resource_type == ResourceType.IPv4: query_result = maltiverse_ip(target) elif resource_type == ResourceType.DOMAIN: query_result = maltiverse_domain(target) elif resource_type == ResourceType.URL: query_result = maltiverse_url(target) elif resource_type == ResourceType.HASH: query_result = maltiverse_hash(target) else: print("Maltiverse resource type does not found") result_status = PluginResultStatus.RETURN_NONE if not query_result: result_status = PluginResultStatus.FAILED if query_result.get("message"): result_status = PluginResultStatus.RETURN_NONE else: result_status = PluginResultStatus.COMPLETED print(query_result) PluginManager.set_plugin_results(resource_id, plugin_name, project_id, query_result, result_status) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def onyphe(plugin_name, project_id, resource_id, resource_type, resource): result_status = PluginResultStatus.STARTED query_result = None try: API_KEY = KeyRing().get("onyphe") if not API_KEY: print("No API key...!") result_status = PluginResultStatus.NO_API_KEY else: url = "" headers = { "Authorization": f"apikey {API_KEY}", "Content-Type": "application/json", } if resource_type == "domain": url = f"https://www.onyphe.io/api/v2/summary/domain/{resource}" elif resource_type == "ip": url = f"https://www.onyphe.io/api/v2/summary/ip/{resource}" query_result = requests.get(url, headers=headers) if query_result.status_code == 200: json_results = query_result.json() if json_results["results"] == []: result_status = PluginResultStatus.RETURN_NONE else: query_result = json_results["results"] result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.FAILED PluginManager.set_plugin_results( resource_id, plugin_name, project_id, query_result, result_status ) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format()))
def get_related_plugins(user): try: resource_type_as_string = request.json["resource_type"] plugin_list = PluginManager.get_plugins_for_resource( resource_type_as_string) return json.dumps(plugin_list, default=str) except Exception as e: print(f"[get_related_plugins]: {e}") return jsonify({"error_message": "Error getting related plugins"}), 400
def metagoofil(domain, plugin_name, project_id, resource_id, resource_type): try: result_status = PluginResultStatus.STARTED print("Analizing {} with metagoofil".format(domain)) response = _metagoofil._main(domain) if response: result_status = PluginResultStatus.COMPLETED else: result_status = PluginResultStatus.RETURN_NONE PluginManager.set_plugin_results( resource_id, plugin_name, project_id, response, result_status ) except Exception as e: tb1 = traceback.TracebackException.from_exception(e) print("".join(tb1.format())) return None