mirror of https://github.com/MISP/misp-modules
parent
3b8717f3bf
commit
985f9de800
2 changed files with 65 additions and 1 deletions
@ -1,2 +1,2 @@ |
||||
__all__ = ['asn_history', 'circl_passivedns', 'circl_passivessl', 'countrycode', 'cve', 'dns', |
||||
'eupi', 'ipasn', 'passivetotal', 'sourcecache', 'virustotal', 'whois', 'shodan'] |
||||
'eupi', 'ipasn', 'passivetotal', 'sourcecache', 'virustotal', 'whois', 'shodan', 'reversedns'] |
||||
|
@ -0,0 +1,64 @@ |
||||
import json |
||||
import dns.reversename, dns.resolver |
||||
|
||||
misperrors = {'error': 'Error'} |
||||
mispattributes = {'input': ['ip-src', 'ip-dst', 'domain|ip'], 'output': ['hostname']} |
||||
|
||||
# possible module-types: 'expansion', 'hover' or both |
||||
moduleinfo = {'version': '0.1', 'author': 'Andreas Muehlemann', |
||||
'description': 'Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes', |
||||
'module-type': ['expansion', 'hover']} |
||||
|
||||
# config fields that your code expects from the site admin |
||||
moduleconfig = ['nameserver'] |
||||
|
||||
def handler(q=False): |
||||
if q is False: |
||||
return False |
||||
request = json.loads(q) |
||||
if request.get('ip-dst'): |
||||
toquery = request['ip-dst'] |
||||
elif request.get('ip-src'): |
||||
toquery = request['ip-src'] |
||||
elif request.get('domain|ip'): |
||||
toquery = request['domain|ip'].split('|')[1] |
||||
else: |
||||
return False |
||||
|
||||
# reverse lookup for ip |
||||
revname = dns.reversename.from_address(toquery) |
||||
|
||||
r = dns.resolver.Resolver() |
||||
r.timeout = 2 |
||||
r.lifetime = 2 |
||||
|
||||
if request.get('config'): |
||||
if request['config'].get('nameserver'): |
||||
nameservers = [] |
||||
nameservers.append(request['config'].get('nameserver')) |
||||
r.nameservers = nameservers |
||||
else: |
||||
r.nameservers = ['8.8.8.8'] |
||||
|
||||
try: |
||||
answer = r.query(revname, 'PTR') |
||||
except dns.resolver.NXDOMAIN: |
||||
misperrors['error'] = "NXDOMAIN" |
||||
return misperrors |
||||
except dns.exception.Timeout: |
||||
misperrors['error'] = "Timeout" |
||||
return misperrors |
||||
except: |
||||
misperrors['error'] = "DNS resolving error" |
||||
return misperrors |
||||
|
||||
r = {'results': [{'types': mispattributes['output'], |
||||
'values':[str(answer[0])]}]} |
||||
return r |
||||
|
||||
def introspection(): |
||||
return mispattributes |
||||
|
||||
def version(): |
||||
moduleinfo['config'] = moduleconfig |
||||
return moduleinfo |
Loading…
Reference in new issue