|
|
|
@ -18,6 +18,13 @@ class TestExpansions(unittest.TestCase): |
|
|
|
|
def misp_modules_post(self, query): |
|
|
|
|
return requests.post(urljoin(self.url, "query"), json=query) |
|
|
|
|
|
|
|
|
|
def get_errors(self, reponse): |
|
|
|
|
data = response.json() |
|
|
|
|
if not isinstance(data, dict): |
|
|
|
|
print(json.dumps(data, indent=2)) |
|
|
|
|
return data |
|
|
|
|
return data['error'] |
|
|
|
|
|
|
|
|
|
def get_values(self, response): |
|
|
|
|
data = response.json() |
|
|
|
|
if not isinstance(data, dict): |
|
|
|
@ -43,7 +50,12 @@ class TestExpansions(unittest.TestCase): |
|
|
|
|
def test_countrycode(self): |
|
|
|
|
query = {"module": "countrycode", "domain": "www.circl.lu"} |
|
|
|
|
response = self.misp_modules_post(query) |
|
|
|
|
self.assertEqual(self.get_values(response), ['Luxembourg']) |
|
|
|
|
try: |
|
|
|
|
self.assertEqual(self.get_values(response), ['Luxembourg']) |
|
|
|
|
except Exception: |
|
|
|
|
results = ('http://www.geognos.com/api/en/countries/info/all.json not reachable', 'Unknown', |
|
|
|
|
'Not able to get the countrycode references from http://www.geognos.com/api/en/countries/info/all.json') |
|
|
|
|
self.assertIn(self.get_values(response), results) |
|
|
|
|
|
|
|
|
|
def test_cve(self): |
|
|
|
|
query = {"module": "cve", "vulnerability": "CVE-2010-3333", "config": {"custom_API": "https://cve.circl.lu/api/cve/"}} |
|
|
|
@ -53,7 +65,13 @@ class TestExpansions(unittest.TestCase): |
|
|
|
|
def test_dbl_spamhaus(self): |
|
|
|
|
query = {"module": "dbl_spamhaus", "domain": "totalmateria.net"} |
|
|
|
|
response = self.misp_modules_post(query) |
|
|
|
|
self.assertTrue(self.get_values(response).startswith('None of DNS query names exist: totalmateria.net.dbl.spamhaus.org.')) |
|
|
|
|
try: |
|
|
|
|
self.assertEqual(self.get_values(response), 'totalmateria.net - spam domain') |
|
|
|
|
except Exception: |
|
|
|
|
try: |
|
|
|
|
self.assertTrue(self.get_values(response).startswith('None of DNS query names exist:')) |
|
|
|
|
except Exception: |
|
|
|
|
self.assertEqual(self.get_errors(response), 'Not able to reach dbl.spamhaus.org or something went wrong') |
|
|
|
|
|
|
|
|
|
def test_dns(self): |
|
|
|
|
query = {"module": "dns", "hostname": "www.circl.lu", "config": {"nameserver": "8.8.8.8"}} |
|
|
|
@ -88,7 +106,10 @@ class TestExpansions(unittest.TestCase): |
|
|
|
|
def test_rbl(self): |
|
|
|
|
query = {"module": "rbl", "ip-src": "8.8.8.8"} |
|
|
|
|
response = self.misp_modules_post(query) |
|
|
|
|
self.assertTrue(self.get_values(response).startswith('8.8.8.8.query.senderbase.org: "0-0=1|1=GOOGLE')) |
|
|
|
|
try: |
|
|
|
|
self.assertTrue(self.get_values(response).startswith('8.8.8.8.query.senderbase.org: "0-0=1|1=GOOGLE')) |
|
|
|
|
except Exception: |
|
|
|
|
self.assertEqual(self.get_errors(response), "No data found by querying known RBLs") |
|
|
|
|
|
|
|
|
|
def test_reversedns(self): |
|
|
|
|
query = {"module": "reversedns", "ip-src": "8.8.8.8"} |
|
|
|
@ -113,7 +134,10 @@ class TestExpansions(unittest.TestCase): |
|
|
|
|
def test_wikidata(self): |
|
|
|
|
query = {"module": "wiki", "text": "Google"} |
|
|
|
|
response = self.misp_modules_post(query) |
|
|
|
|
self.assertEqual(self.get_values(response), 'http://www.wikidata.org/entity/Q95') |
|
|
|
|
try: |
|
|
|
|
self.assertEqual(self.get_values(response), 'http://www.wikidata.org/entity/Q95') |
|
|
|
|
except Exception: |
|
|
|
|
self.assertEqual(self.get_values(response), 'No additional data found on Wikidata') |
|
|
|
|
|
|
|
|
|
def test_yara_query(self): |
|
|
|
|
query = {"module": "yara_query", "md5": "b2a5abfeef9e36964281a31e17b57c97"} |
|
|
|
|