mirror of https://github.com/MISP/MISP
230 lines
263 KiB
Python
230 lines
263 KiB
Python
|
#!/usr/bin/env python
|
||
|
|
|
||
|
|
import httplib2
|
||
|
|
import urllib
|
||
|
|
|
||
|
|
api_key = 'ADD6qRRO95hkh6Rfoe5cmEcdcDCXkHWUkz0KqSzA'
|
||
|
|
base_url = 'http://localhost:8888'
|
||
|
|
|
||
|
|
http = httplib2.Http()
|
||
|
|
|
||
|
|
xml_body_add1 = '''<Event>
|
||
|
|
<date>2012-05-06</date>
|
||
|
|
<risk>Undefined</risk>
|
||
|
|
<info>TEST REST</info>
|
||
|
|
<published>0</published>
|
||
|
|
<private>0</private>
|
||
|
|
<attribute/>
|
||
|
|
</Event>'''
|
||
|
|
|
||
|
|
xml_body_add2= '''<Event>
|
||
|
|
<date>2080-04-01</date>
|
||
|
|
<risk>Undefined</risk>
|
||
|
|
<info>TEST REST IMPORT dropzone requests</info>
|
||
|
|
<published>1</published>
|
||
|
|
<private>0</private>
|
||
|
|
<uuid>4f97a63e-e1b0-482a-9526-c059ff32448e</uuid>
|
||
|
|
<Attribute>
|
||
|
|
<category>Network activity</category>
|
||
|
|
<type>url</type>
|
||
|
|
<value>/gameover.php</value>
|
||
|
|
<to_ids>1</to_ids>
|
||
|
|
<private>0</private>
|
||
|
|
</Attribute>
|
||
|
|
<Attribute>
|
||
|
|
<category>Network activity</category>
|
||
|
|
<type>url</type>
|
||
|
|
<value>/gameover2.php</value>
|
||
|
|
<to_ids>1</to_ids>
|
||
|
|
<private>0</private>
|
||
|
|
</Attribute>
|
||
|
|
<Attribute>
|
||
|
|
<category>Network activity</category>
|
||
|
|
<type>url</type>
|
||
|
|
<value>/gameover3.php</value>
|
||
|
|
<to_ids>1</to_ids>
|
||
|
|
<private>1</private>
|
||
|
|
</Attribute>
|
||
|
|
<Attribute>
|
||
|
|
<category>Other</category>
|
||
|
|
<type>other</type>
|
||
|
|
<value>https://www.abuse.ch/?p=3499</value>
|
||
|
|
<to_ids>0</to_ids>
|
||
|
|
<private>0</private>
|
||
|
|
</Attribute>
|
||
|
|
</Event>'''
|
||
|
|
|
||
|
|
xml_body_add3 = '''<Event>
|
||
|
|
<id>1</id>
|
||
|
|
<date>2020-02-20</date>
|
||
|
|
<risk>High</risk>
|
||
|
|
<info>Backdoor.Sogu (extended) Windows named pipe patterns used</info>
|
||
|
|
<published>1</published>
|
||
|
|
<uuid>4f75a819-7a9c-4d59-84a0-49b30a000b01</uuid>
|
||
|
|
<private>0</private>
|
||
|
|
<Attribute>
|
||
|
|
<id>1</id>
|
||
|
|
<event_id>1</event_id>
|
||
|
|
<category/>
|
||
|
|
<type>other</type>
|
||
|
|
<to_ids>0</to_ids>
|
||
|
|
<uuid>4f75a819-11d4-416d-9226-49b30a000b01</uuid>
|
||
|
|
<revision>2</revision>
|
||
|
|
<private>0</private>
|
||
|
|
<value>\\\\.\\PIPE\\RUN_AT_SESSION(%d)
|
||
|
|
\\\\.\\pipe\\a%d
|
||
|
|
\\\\.\\pipe\\b%d</value>
|
||
|
|
</Attribute>
|
||
|
|
</Event>'''
|
||
|
|
|
||
|
|
xml_body_add4= '''<Event>
|
||
|
|
<id>230</id>
|
||
|
|
<date>2012-04-25</date>
|
||
|
|
<risk>Undefined</risk>
|
||
|
|
<info>TEST 3</info>
|
||
|
|
<published>0</published>
|
||
|
|
<uuid>4f97aa33-98ac-49ae-9ed8-c0a5ff32448e</uuid>
|
||
|
|
<private>0</private>
|
||
|
|
<Attribute>
|
||
|
|
<id>9678</id>
|
||
|
|
<event_id>230</event_id>
|
||
|
|
<category>Internal reference</category>
|
||
|
|
<type>filename</type>
|
||
|
|
<to_ids>1</to_ids>
|
||
|
|
<uuid>4fa39328-fba4-41fe-a152-1dfeff32448e</uuid>
|
||
|
|
<revision>1</revision>
|
||
|
|
<private>0</private>
|
||
|
|
<value>toto</value>
|
||
|
|
</Attribute>
|
||
|
|
<Attribute>
|
||
|
|
<id>9617</id>
|
||
|
|
<event_id>230</event_id>
|
||
|
|
<category>Internal reference</category>
|
||
|
|
<type>filename</type>
|
||
|
|
<to_ids>1</to_ids>
|
||
|
|
<uuid>4f97aa39-011c-4a58-bb1c-c0a5ff32448e</uuid>
|
||
|
|
<revision>1</revision>
|
||
|
|
<private>0</private>
|
||
|
|
<value>201203 Meeting Minutes.pdf</value>
|
||
|
|
</Attribute>
|
||
|
|
</Event>'''
|
||
|
|
|
||
|
|
xml_body_add5= '''<Event>
|
||
|
|
<id>230</id>
|
||
|
|
<date>2022-04-25</date>
|
||
|
|
<risk>Undefined</risk>
|
||
|
|
<info>TEST 4</info>
|
||
|
|
<published>0</published>
|
||
|
|
<uuid>4f97aa32-98ac-49ae-9ed8-c0a5ff32448e</uuid>
|
||
|
|
<private>0</private>
|
||
|
|
<Attribute/>
|
||
|
|
</Event>'''
|
||
|
|
|
||
|
|
xml_body_add_attachment= '''<Event>
|
||
|
|
<id>2</id>
|
||
|
|
<date>2012-05-04</date>
|
||
|
|
<risk>Low</risk>
|
||
|
|
<info>TEST attachment REST</info>
|
||
|
|
<published>1</published>
|
||
|
|
<uuid>1fb36341-6858-47e8-a986-673fff32448e</uuid>
|
||
|
|
<private>0</private>
|
||
|
|
<Attribute>
|
||
|
|
<id>4</id>
|
||
|
|
<event_id>2</event_id>
|
||
|
|
<category>Internal reference</category>
|
||
|
|
<type>md5</type>
|
||
|
|
<to_ids>1</to_ids>
|
||
|
|
<uuid>1fb36355-94b0-43db-897b-673eff32448e</uuid>
|
||
|
|
<revision>1</revision>
|
||
|
|
<private>0</private>
|
||
|
|
<value>abfab0da6f4ebc23cb15e04ff500ed54</value>
|
||
|
|
</Attribute>
|
||
|
|
<Attribute>
|
||
|
|
<id>18</id>
|
||
|
|
<event_id>2</event_id>
|
||
|
|
<category>Payload delivery</category>
|
||
|
|
<type>filename|md5</type>
|
||
|
|
<to_ids>1</to_ids>
|
||
|
|
<uuid>1fba26eb-788c-498e-8a5d-9decff32448e</uuid>
|
||
|
|
<revision>1</revision>
|
||
|
|
<private>0</private>
|
||
|
|
<value>knooppunter.pdf|c7ef0575e26f0b4969887943d17aea6f</value>
|
||
|
|
</Attribute>
|
||
|
|
<Attribute>
|
||
|
|
<id>90</id>
|
||
|
|
<event_id>2</event_id>
|
||
|
|
<category>Payload delivery</category>
|
||
|
|
<type>malware-sample</type>
|
||
|
|
<to_ids>0</to_ids>
|
||
|
|
<uuid>1fb3634f-eccc-41a8-b9f9-673eff32448e</uuid>
|
||
|
|
<revision>1</revision>
|
||
|
|
<private>0</private>
|
||
|
|
<value>knooppunter.pdf|c7ef0575e26f0b4969887943d17aea6f</value>
|
||
|
|
<data>UEsDBBQACQAIAI9SsEA8O6h65AMDAH03BAAPABwAa25vb3BwdW50ZXIucGRmVVQJAANOY7NPT2OzT3V4CwABBPUBAAAEFAAAAI8aIo4o0TUnEijvDv2qs2xwZegF5rivfjfmLe1dH9mmRUpQGEfCXrwd+8OKzyQlVtXI1GQXHKzj+H98jSG9TOquyBlDpLkcLhC5HZhzBe8I0b3uuiNe2MHnD5NSh5jQQfYfUBo2DGek2dOUTABk0xY8t9+vb/2HLVmD3qlwCauKuvWZVnJGGT2URGyGDL9A9rU7MpsJFPV1uSR8FrC2+4EdRsOguNthFT6B3nPtpaSh0rXegz/4u1AZ04/IBkD/FqNtHiVPAx9iFn/vO2UDGilwONHXMSnCPoCJpT40OjTM5muDVIe2ooEFFPKfDnDuxGfvsZzen0EVGVCOZyHX+opgnaMVrJGPuSUvRDfIJoMZT2A3z5eYY7FuKbTt1SQvtIU/T6MXqev71Wq2TYGT+thFnNi7d77S81jrT6oZPcjaLWX16xUrVyK4msR3hwei/SxCmwOxv/yhRFViNjVmY1QhOx0gHW5s3E4r5lBOHUFSDuZs26uxEDrbeB0bRW4K7LMAIBrMvKCZDOqi+mPBabG6Ho1vA7ckXg5DrmdCfxXJMQ5OWGI5NwJyc0QL1H9QRY9TOUMnRnuosj7lP8Ll1Y9DxlzxBul93kZ4jVovfr2vJanz/W5znitpS3HuaWzSFgcUzgSVNf+J9EqE4TjNLqQ9Nf4Z5ZUPC62XMhbPklaMwKqGKQOuGoxC0UgdH1lus3ld/0uXztN2exz3/t7Pm4vvdLndOeRM230RtxU8QeHuRL35UZR50pv7UjUADmNfqkNmhbw2M10j8rnnVVf1PTIDa9ufGAP68lINzD9mIP7O2hSaR6OoFdBwZ+inuAM9F4LfS8uVy2gOq9Lc9D01g3mvnC2mvBVFJDknpMLi2gYA6aZ5GgFAx03nKtkuTYVwJ4/Pc4tD6UkkBDloryzIASv0wo3fIsUoHdqF8rYRYFj7dUOJWX5xHKnUPyCSMtwSOOXML4Yd0Q5km4BpsERKvulfqoRcHoQYfHLr871oNZfKJV4oPuONRraBNmNmihQPW2C9KK8p2eoNO4ael0KLQB9dpBwM/NargUnSYATFDGkMazpEG0FoOOR/RTyXDaFOb0xzR/pHQmUwmWK8bL3VSaw5BZeQvi5omv8XZR2oMsYrMvu84K44dRnpejnqiw3QwjXApeEYJZydOXxSVW6A//mIEzdWR/w1xYvTlPedCX5BcqFu7kTjDMUPohgvWu49Qq+A1erkTA4F9CmEzedfRK1fk+iu8QTBh4sJFplhJlHm6RVvXLXjF7Tq3dRjLbOmcoymX/WasAv+OLzSRmDuC9Q3ycdzK3MLHh3OTvUnuRJG3WEW82dOjoLNsMsSa6oc8KkR9uzZ9yj6/yyaojbwgQ7pg7smLsh9XzA0ic4idOzReGbvY4rdzdHbO6WDWzb9q3exEBqUePmAehRdWJFCiZy5ptjlIgmLuOrXOgcUOzhYDWEJa+c4G6F+CtQOm0jW9Ru/j9mSwYrODkEraGN7lTAcPCv2V/EkuqECaoS6S3mhxkVBPKbX4m9YfrOVczhqTnzJnCrmAKOxSsA8vVsKELjzWEC1wekuffd9sMRuHCwkGx6Vl+huC0kO/ay3tyAez7aohfbA3J9xySYEDZeOjI84lWoqapBZ+y4w/iPNYeYJGBmBkpAD9xlFisElhyreGLgqTWCbpTWk8ypHEcyNP4y7JNd/k26kq0yaNL76w8CTqtKHRVHX2SIsdJm//GTEpZofyfA529k9RiJM+IFn+buuCiHKFWg3qkYZT2TTaQKNao7SAzp4TAWT8OMVaxVZDgqNYylIRoVRNhss6m2FMTs0NCzQZu78e+djJGccG/iJmIMuUmmxhTIZA32b1qvnFb4AFZAxPcMQc4/eZelYJuzkhY8MfSEYXvrynpR+z1OVJu8R6GrOCn4QwXIHp+H7lZxHwB3gyFpaND0J7afW91i7TcRuGIP6SCcqMbcWMRMlxwhKkH6LKUfOsVu5ec9S9R+dGhr6cULM70UiPLGFi4+DjD38yT91xeKjhbrd+IQK4CfU1EhpxRE1cXOmfrF1s4+TdpnH58/ol/plN1jrUtGZkXELp3aK9QcKb2H2CdqeYhqY1N3ij82fSzrCtJL/m8quTQZH63W/GGnwn7IDSb7GP6bBciqF1OC70DcnhVm4uzWivftwzfzxWVSsLceW7Ul8mYp0Gnd2uR7of/EY0KNdy8brTiFUnNecsJsidIusEKcMuPg9qkTPIWMFJ8qoUg4p74PWL6KjSYPl/msownT7MIqCnzKVD7ctISH41DshEn4jByAYdfWKAXsqrNgDurbNrc0HSHjsVc7IqWusyiz/kGfboeQN/0F15U/KpUWlyd508/+rUi0Ei6rpC+QQYNBsOUyMHd7U+7S8tyJRjV5Ej2NRrF+1uoZFmokbij0TD5WKtne1HkkHD9gB3YrL+JuxL/n3cCXrnBLvFBH20MoDKLv64QK6OWYByjr4Nfhk5IHmXeTf0wzqtymtgl1y02kOAvjjIRWqXDjVkfXlRQRJSw/UKslNtWZM+WzjgBE1kHZNL5/1KBODIrZZgWgcsUvqztqecQcsZ0k+Lk8gOXXwI9g9OxKZjG8H3HzuhnKwzlSJaK44uh1Wrj98FZlrhxuPYHczeUerL3RdxgSFJj1K2gj5sDYKteXoBh+JVAuJg02XJJw7NlwcOBuMx+QoDO8lqC4suywMIeSVxUW05HLuJBAyUrZtnqCIAGLUr+eKdC6vhTZcMmfwpJy+ATzstfpAqDhH+VaKnX6sQOcU1cCRMu7uWgRdTju7CyxdzmbFB7UJDqZQDzO4AmrUny1ePKo0Up2zcFK9mb6DkG60Tsq5kfLyG0Ewy00j/ccTbUaBBcSDPnplwxLNwMRVqsKRkcUkIhnaOnQXQQL1GfO0FWUTlmOIu8G9Ob/T9srHAXERXneza2AsgdwmiWFP5uz2LPRAz39HDSPD8UuPuKKpB3+7RomLokrIWq/XxNAnZU81kGdxjdTyU6qMfEuCppW86fzzjNbFfwNax4Mx/N1A0eoWKcq0N694ia7eMx5D/DpB9FtbBU7O7LEIJYCYhi9Sb9N8muCOcUCa2htCbhnsIvCN7tn515S+dMJTwWdZjfDjO3a4nBUlGPTq+I+B++oJ0Nt/08Z7VdHTGuxbFiXpEuCooy1uTn9h8z93d9pZ6eBTrXeuDZBYD1f3l5vEJJtuDgf8e3lET14YF+ZFP4PYHDv4JDkfabgyUH41//XTovJ1VFGYnRDFaJqM5GIO3hLs0vyJxdqeRiK3H50GVEtlxEu/KqtdJGNgKngatwEIeActKD+DMO915/JgoEF92VZtrRH8TB7TfnprjozdgvZdeax5Z3AW7cYQIKOELuDh0D80LfTwDcGOL+Kqi21bEtxHyV3thv9gV/NBl77rFXEvP6bHmnGIbs6oXBoz+d3/Lk4YcPcHOZuoEDxWAnyJI2USmBwvEUZHW8E8BwcSpominf9FsRM4NvtFPaI5WFAKhxq+uqxqoqaQkGLXPzqsBAFdTC2LfSfruQ3/30gocAkT4rI8TKBdxQDbUkwOR2mRmI71I1qSn8Bj8IMsRciqzGhJsZYnSuF/r9frpWD3bkMQEn4FMxsRGeYggGG+Y+l6bcQQsEhr7YHVmGVtZO+qcw02Uh9N1h6GOG7HME3D1hHvGz6Mya3+5HuJBV1dCrlM97vvgg77fZSr8Mmpyvk64to6mUzyzZtvYqJruxgxOoLz/XIkYlq4MGjG6+kXXqH8faDKPHfZLnK+JBy9mHfFY9zEIpYpHgcmSvWNfWJZrHymTnjVR1e+D03pGarLKcQEMm+5aNH5MmVktrThHXRCXES9amngDPvwMZ/APNb6SDvaeVdvY+SVa9xysqLjRykbyl2PkxY6Ypp1q3j1YmC78oAXUmg3XB8lCLOqVlkD61lilwsNtL59C57Wdi2xxmeXImvCGcTCF8lgDoBoQPzy+kxUFILXkB3JsjWbCdbSqvblEXs
|
||
|
|
</Attribute>
|
||
|
|
</Event>'''
|
||
|
|
|
||
|
|
# Get the list of the model
|
||
|
|
def index(model) :
|
||
|
|
url = base_url + '/'+model+'s/index'
|
||
|
|
h = httplib2.Http()
|
||
|
|
h.disable_ssl_certificate_validation=True
|
||
|
|
response, content = h.request(url,
|
||
|
|
'GET',
|
||
|
|
headers={
|
||
|
|
'Accept': 'application/xml',
|
||
|
|
'Authorization' : api_key
|
||
|
|
}
|
||
|
|
)
|
||
|
|
return response, content
|
||
|
|
|
||
|
|
# Get the content of a specific model entry
|
||
|
|
def view(model, entry_id) :
|
||
|
|
url = base_url + '/'+model+'s/view/'+str(entry_id)
|
||
|
|
h = httplib2.Http()
|
||
|
|
h.disable_ssl_certificate_validation=True
|
||
|
|
response, content = h.request(url,
|
||
|
|
'GET',
|
||
|
|
headers={
|
||
|
|
'Accept': 'application/xml',
|
||
|
|
'Authorization' : api_key
|
||
|
|
}
|
||
|
|
)
|
||
|
|
return response, content
|
||
|
|
|
||
|
|
# Get the content of a specific model entry
|
||
|
|
def add(model, xml_body) :
|
||
|
|
url = base_url + '/'+model+'s/'
|
||
|
|
h = httplib2.Http()
|
||
|
|
h.disable_ssl_certificate_validation=True
|
||
|
|
response, content = h.request(url,
|
||
|
|
'POST',
|
||
|
|
body=xml_body,
|
||
|
|
headers={
|
||
|
|
'Accept': 'application/xml',
|
||
|
|
'Authorization' : api_key,
|
||
|
|
'Content-type': 'application/xml'
|
||
|
|
}
|
||
|
|
)
|
||
|
|
return response, content
|
||
|
|
|
||
|
|
|
||
|
|
#url = base_url + '/events/index'
|
||
|
|
#response, content = http.request(url, 'GET',
|
||
|
|
# headers={#'Content-type': 'application/x-www-form-urlencoded'
|
||
|
|
# 'Accept': 'application/xml',
|
||
|
|
# 'Authorization' : api_key
|
||
|
|
# }
|
||
|
|
#)
|
||
|
|
|
||
|
|
|
||
|
|
#response, content = index('event')
|
||
|
|
response, content = view('event', 82)
|
||
|
|
#response, content = add('event', xml_body_add_attachment)
|
||
|
|
# get last EventID
|
||
|
|
#response, content = index('events/index/sort:id/direction:desc/limit:1')
|
||
|
|
|
||
|
|
print response
|
||
|
|
print content
|
||
|
|
|