mirror of https://github.com/MISP/misp-modules
Merge pull request #247 from SteveClement/btc
new: [module] Added very simple BitCoin expansion/hover modulepull/248/head
commit
55a1cc1b38
|
@ -21,8 +21,10 @@ domaintools_api
|
||||||
pygeoip
|
pygeoip
|
||||||
bs4
|
bs4
|
||||||
oauth2
|
oauth2
|
||||||
yara
|
yara-python
|
||||||
sigmatools
|
sigmatools
|
||||||
stix2-patterns
|
stix2-patterns
|
||||||
maclookup
|
maclookup
|
||||||
vulners
|
vulners
|
||||||
|
psutil
|
||||||
|
blockchain
|
||||||
|
|
|
@ -29,6 +29,7 @@ import fnmatch
|
||||||
import argparse
|
import argparse
|
||||||
import re
|
import re
|
||||||
import datetime
|
import datetime
|
||||||
|
import psutil
|
||||||
|
|
||||||
import tornado.web
|
import tornado.web
|
||||||
import tornado.process
|
import tornado.process
|
||||||
|
@ -241,7 +242,23 @@ def main():
|
||||||
service = [(r'/modules', ListModules), (r'/query', QueryModule)]
|
service = [(r'/modules', ListModules), (r'/query', QueryModule)]
|
||||||
|
|
||||||
application = tornado.web.Application(service)
|
application = tornado.web.Application(service)
|
||||||
application.listen(port, address=listen)
|
try:
|
||||||
|
application.listen(port, address=listen)
|
||||||
|
except Exception as e:
|
||||||
|
if e.errno == 98:
|
||||||
|
pids = psutil.pids()
|
||||||
|
for pid in pids:
|
||||||
|
p = psutil.Process(pid)
|
||||||
|
if p.name() == "misp-modules":
|
||||||
|
print("\n\n\n")
|
||||||
|
print(e)
|
||||||
|
print("\nmisp-modules is still running as PID: {}\n".format(pid))
|
||||||
|
print("Please kill accordingly:")
|
||||||
|
print("sudo kill {}".format(pid))
|
||||||
|
sys.exit(-1)
|
||||||
|
print(e)
|
||||||
|
print("misp-modules might still be running.")
|
||||||
|
|
||||||
log.info('MISP modules server started on {0} port {1}'.format(listen, port))
|
log.info('MISP modules server started on {0} port {1}'.format(listen, port))
|
||||||
if args.t:
|
if args.t:
|
||||||
log.info('MISP modules started in test-mode, quitting immediately.')
|
log.info('MISP modules started in test-mode, quitting immediately.')
|
||||||
|
|
|
@ -1,3 +1,3 @@
|
||||||
from . import _vmray
|
from . import _vmray
|
||||||
|
|
||||||
__all__ = ['vmray_submit', 'asn_history', 'circl_passivedns', 'circl_passivessl', 'countrycode', 'cve', 'dns', 'domaintools', 'eupi', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache', 'virustotal', 'whois', 'shodan', 'reversedns', 'geoip_country', 'wiki', 'iprep', 'threatminer', 'otx', 'threatcrowd', 'vulndb', 'crowdstrike_falcon', 'yara_syntax_validator', 'hashdd', 'onyphe', 'onyphe_full', 'rbl', 'xforceexchange', 'sigma_syntax_validator', 'stix2_pattern_syntax_validator', 'sigma_queries', 'dbl_spamhaus', 'vulners', 'yara_query']
|
__all__ = ['vmray_submit', 'asn_history', 'circl_passivedns', 'circl_passivessl', 'countrycode', 'cve', 'dns', 'btc', 'domaintools', 'eupi', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache', 'virustotal', 'whois', 'shodan', 'reversedns', 'geoip_country', 'wiki', 'iprep', 'threatminer', 'otx', 'threatcrowd', 'vulndb', 'crowdstrike_falcon', 'yara_syntax_validator', 'hashdd', 'onyphe', 'onyphe_full', 'rbl', 'xforceexchange', 'sigma_syntax_validator', 'stix2_pattern_syntax_validator', 'sigma_queries', 'dbl_spamhaus', 'vulners', 'yara_query']
|
||||||
|
|
|
@ -0,0 +1,50 @@
|
||||||
|
import json
|
||||||
|
import blockchain
|
||||||
|
|
||||||
|
misperrors = {'error': 'Error'}
|
||||||
|
mispattributes = {'input': ['btc'], 'output': ['text']}
|
||||||
|
moduleinfo = {'version': '0.1', 'author': 'Steve Clement',
|
||||||
|
'description': 'Simple BTC expansion service to \
|
||||||
|
get quick information from MISP attributes',
|
||||||
|
'module-type': ['expansion', 'hover']}
|
||||||
|
|
||||||
|
moduleconfig = []
|
||||||
|
|
||||||
|
|
||||||
|
def handler(q=False):
|
||||||
|
if q is False:
|
||||||
|
return False
|
||||||
|
request = json.loads(q)
|
||||||
|
if request.get('btc'):
|
||||||
|
toquery = request['btc']
|
||||||
|
else:
|
||||||
|
return False
|
||||||
|
|
||||||
|
try:
|
||||||
|
address = blockchain.blockexplorer.get_address(toquery)
|
||||||
|
except Exception as e:
|
||||||
|
misperrors['error'] = e
|
||||||
|
return misperrors
|
||||||
|
finalBalance = address.final_balance*(1/100000000)
|
||||||
|
totalRX = address.total_received*(1/100000000)
|
||||||
|
totalTX = address.total_sent*(1/100000000)
|
||||||
|
totalTransactions = address.n_tx
|
||||||
|
|
||||||
|
answer = 'Current balance: \
|
||||||
|
{} - \
|
||||||
|
{} total received - \
|
||||||
|
{} total sent - \
|
||||||
|
{} transactions.\
|
||||||
|
'.format(finalBalance, totalRX, totalTX, totalTransactions)
|
||||||
|
r = {'results': [{'types': mispattributes['output'],
|
||||||
|
'values':[str(answer)]}]}
|
||||||
|
return r
|
||||||
|
|
||||||
|
|
||||||
|
def introspection():
|
||||||
|
return mispattributes
|
||||||
|
|
||||||
|
|
||||||
|
def version():
|
||||||
|
moduleinfo['config'] = moduleconfig
|
||||||
|
return moduleinfo
|
Loading…
Reference in New Issue