MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

correct out of bound returns

pull/208/head
Sebdraven 2018-07-12 14:32:56 +02:00
parent 9063da88cd
commit 844b25b4cd
1 changed files with 21 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
misp_modules/modules/expansion/securitytrails.py
View File

@ -266,7 +266,7 @@ def expand_whois(api, domain):
r.append( r.append(
{ {
'types': ['whois-registrant-email'], 'types': ['whois-registrant-email'],
'values': [item_registrant['email']], 'values': [item_registrant[0]['email']],
'categories': ['Attribution'], 'categories': ['Attribution'],
'comment': 'Whois information of %s by securitytrails' 'comment': 'Whois information of %s by securitytrails'
% domain % domain
@ -277,7 +277,7 @@ def expand_whois(api, domain):
r.append( r.append(
{ {
'types': ['whois-registrant-phone'], 'types': ['whois-registrant-phone'],
'values': [item_registrant['telephone']], 'values': [item_registrant[0]['telephone']],
'categories': ['Attribution'], 'categories': ['Attribution'],
'comment': 'Whois information of %s by securitytrails' 'comment': 'Whois information of %s by securitytrails'
% domain % domain
@ -288,7 +288,7 @@ def expand_whois(api, domain):
r.append( r.append(
{ {
'types': ['whois-registrant-name'], 'types': ['whois-registrant-name'],
'values': [item_registrant['name']], 'values': [item_registrant[0]['name']],
'categories': ['Attribution'], 'categories': ['Attribution'],
'comment': 'Whois information of %s by securitytrails' 'comment': 'Whois information of %s by securitytrails'
% domain % domain
@ -299,7 +299,7 @@ def expand_whois(api, domain):
r.append( r.append(
{ {
'types': ['whois-registrar'], 'types': ['whois-registrar'],
'values': [item_registrant['registrarName']], 'values': [item_registrant[0]['registrarName']],
'categories': ['Attribution'], 'categories': ['Attribution'],
'comment': 'Whois information of %s by securitytrails' 'comment': 'Whois information of %s by securitytrails'
% domain % domain
@ -310,7 +310,7 @@ def expand_whois(api, domain):
r.append( r.append(
{ {
'types': ['whois-creation-date'], 'types': ['whois-creation-date'],
'values': [item_registrant['createdDate']], 'values': [item_registrant[0]['createdDate']],
'categories': ['Attribution'], 'categories': ['Attribution'],
'comment': 'Whois information of %s by securitytrails' 'comment': 'Whois information of %s by securitytrails'
% domain % domain
@ -394,23 +394,24 @@ def expand_history_whois(api, domain):
if 'items' in results['result']: if 'items' in results['result']:
for item in results['result']['items']: for item in results['result']['items']:
item_registrant = __select_registrant_item(item) item_registrant = __select_registrant_item(item)
if item_registrant: r.extend(
r.extend( {
{ 'type': ['domain'],
'type': ['domain'], 'values': item['nameServers'],
'values': item['nameServers'], 'categories': ['Network activity'],
'categories': ['Network activity'], 'comment': 'Whois history Name Servers of %s '
'comment': 'Whois history Name Servers of %s ' 'Status: %s ' % (
'Status: %s ' % (
domain, item['status']) domain, item['status'])
} }
) )
if 'email' in item_registrant: if item_registrant:
if 'email' in item_registrant[0]:
r.append( r.append(
{ {
'types': ['whois-registrant-email'], 'types': ['whois-registrant-email'],
'values': [item_registrant['email']], 'values': [item_registrant[0]['email']],
'categories': ['Attribution'], 'categories': ['Attribution'],
'comment': 'Whois history registrant email of %s' 'comment': 'Whois history registrant email of %s'
'Status: %s' % ( 'Status: %s' % (
@ -422,7 +423,7 @@ def expand_history_whois(api, domain):
r.append( r.append(
{ {
'types': ['whois-registrant-phone'], 'types': ['whois-registrant-phone'],
'values': [item_registrant['telephone']], 'values': [item_registrant[0]['telephone']],
'categories': ['Attribution'], 'categories': ['Attribution'],
'comment': 'Whois history registrant phone of %s' 'comment': 'Whois history registrant phone of %s'
'Status: %s' % ( 'Status: %s' % (
@ -430,9 +431,6 @@ def expand_history_whois(api, domain):
} }
) )
except APIError as e: except APIError as e:
misperrors['error'] = e misperrors['error'] = e
return [], False return [], False
@ -506,8 +504,8 @@ def __select_registrant_item(entry):
if 'contacts' in entry: if 'contacts' in entry:
return list(filter(lambda x: x['type'] == 'registrant', return list(filter(lambda x: x['type'] == 'registrant',
entry['contacts']))[0] entry['contacts']))
if 'contact' in entry: if 'contact' in entry:
return list(filter(lambda x: x['type'] == 'registrant', return list(filter(lambda x: x['type'] == 'registrant',
entry['contact']))[0] entry['contact']))