From 01fdf3e52b63d0ab1d8d9b8af12234a71fc4f635 Mon Sep 17 00:00:00 2001
From: kx499 <rubix399@protonmail.com>
Date: Fri, 3 Mar 2017 15:55:52 -0500
Subject: [PATCH] Initial commit of IPRep module

---
 misp_modules/modules/expansion/iprep.py | 85 +++++++++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100755 misp_modules/modules/expansion/iprep.py

diff --git a/misp_modules/modules/expansion/iprep.py b/misp_modules/modules/expansion/iprep.py
new file mode 100755
index 0000000..1dc6460
--- /dev/null
+++ b/misp_modules/modules/expansion/iprep.py
@@ -0,0 +1,85 @@
+# -*- coding: utf-8 -*-
+
+import json
+import requests
+
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-dst'], 'output': ['freetext']}
+moduleinfo = {'version': '1.0', 'author': 'Keith Faber',
+              'description': 'Query IPRep Data for IP Address',
+              'module-type': ['expansion']}
+
+moduleconfig = ['apikey']
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if request.get('ip-src'):
+        toquery = request['ip-src']
+    elif request.get('ip-dst'):
+        toquery = request['ip-dst']
+    else:
+        misperrors['error'] = "Unsupported attributes type"
+        return misperrors
+
+    if not request.get('config') and not request['config'].get('apikey'):
+        misperrors['error'] = 'IPRep api key is missing'
+        return misperrors
+
+    err, rep = parse_iprep(toquery, request['config'].get('apikey'))
+    if len(err) > 0:
+        misperrors['error'] = ','.join(err)
+        return misperrors
+    return rep
+
+
+def parse_iprep(ip, api):
+    meta_fields = ['origin', 'Query_Time', 'created_on', 'IP_Lookup_History', 'IPs_in_collection', '_id', 'disclaimer',
+                   'MaxMind_Free_GeoIP', 'Unique_Lookups', 'query_result']
+    rep = []
+    err = []
+    url = 'https://www.packetmail.net/iprep.php/%s' % ip
+    try:
+        data = requests.get(url, params={'apikey': api}).json()
+    except:
+        return ['Error pulling data'], rep
+    # print '%s' % data
+    for name, val in data.iteritems():
+        if name not in meta_fields:
+            try:
+                context = val['context']
+                if type(context) is list:
+                    if context[0].get('alert'):
+                        context = ','.join([hit['alert']['signature'] for hit in context])
+                    elif context[0].get('signature'):
+                        context = ','.join([hit['signature'] for hit in context])
+                    elif context[0].get('target_port') and context[0].get('protocol'):
+                        context = ','.join(
+                            ['Port Attacked: %s %s' % (hit['target_port'], hit['protocol']) for hit in context])
+                    elif context[0].get('phishing_kit') and context[0].get('url'):
+                        context = ','.join(['%s (%s)' % (hit['phishing_kit'], hit['url']) for hit in context])
+                    else:
+                        context = ';'.join(['%s: %s' % (k, v) for k, v in context[0].iteritems()])
+
+                if val.get('special_note'):
+                    context += '; ' + val['special_note']
+
+                misp_val = context
+                misp_comment = 'IPRep Source %s: %s' % (name, val['last_seen'])
+                rep.append({'types': mispattributes['output'], 'values': misp_val, 'comment': misp_comment})
+            except:
+                err.append('Error parsing source: %s' % name)
+
+    return err, rep
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo