misp-modules/misp_modules/modules/expansion/extract_url_components.py

74 lines
2.6 KiB
Python
Raw Normal View History

import json
from pymisp import MISPEvent, MISPObject
from . import check_input_attribute, standard_error_message
from pyfaup.faup import Faup
misperrors = {'error': 'Error'}
mispattributes = {'input': ['url'], 'format': 'misp_standard'}
moduleinfo = {'version': '1', 'author': 'MISP Team',
'description': "Extract URL components",
'module-type': ['expansion', 'hover']}
moduleconfig = []
def createObjectFromURL(url):
f = Faup()
f.decode(url)
parsed = f.get()
obj = MISPObject('url')
obj.add_attribute('url', type='url', value=url)
if parsed['tld'] is not None:
obj.add_attribute('tld', type='text', value=parsed['tld'])
if parsed['subdomain'] is not None:
obj.add_attribute('subdomain', type='text', value=parsed['subdomain'])
obj.add_attribute('scheme', type='text', value=parsed['scheme'])
if parsed['resource_path'] is not None:
obj.add_attribute('resource_path', type='text', value=parsed['resource_path'])
if parsed['query_string'] is not None:
obj.add_attribute('query_string', type='text', value=parsed['query_string'])
if parsed['port'] is not None:
obj.add_attribute('port', type='port', value=parsed['port'])
obj.add_attribute('host', type='hostname', value=parsed['host'])
if parsed['fragment'] is not None:
obj.add_attribute('fragment', type='text', value=parsed['fragment'])
obj.add_attribute('domain_without_tld', type='text', value=parsed['domain_without_tld'])
obj.add_attribute('domain', type='domain', value=parsed['domain'])
return obj
def createEvent(urlObject, attributeUUID, urlAttribute):
mispEvent = MISPEvent()
mispEvent.add_attribute(**urlAttribute)
urlObject.add_reference(attributeUUID, 'generated-from')
mispEvent.add_object(urlObject)
return mispEvent
def handler(q=False):
if q is False:
return False
request = json.loads(q)
if not request.get('attribute') or not check_input_attribute(request['attribute']):
return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
attribute = request['attribute']
if attribute['type'] not in mispattributes['input']:
return {'error': 'Bad attribute type'}
url = attribute['value']
urlObject = createObjectFromURL(url)
event = createEvent(urlObject, attribute['uuid'], attribute)
event = json.loads(event.to_json())
result = {'results': {'Object': event['Object']}}
return result
def introspection():
return mispattributes
def version():
moduleinfo['config'] = moduleconfig
return moduleinfo