mirror of https://github.com/MISP/misp-modules
Sascha Rommelfangen
4 years ago
committed by
GitHub
commit
c222a5dd76
2 changed files with 186 additions and 1 deletions
@ -1,3 +1,3 @@ |
||||
from . import _vmray |
||||
|
||||
__all__ = ['vmray_submit', 'asn_history', 'circl_passivedns', 'circl_passivessl', 'countrycode', 'cve', 'dns', 'btc', 'domaintools', 'eupi', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache', 'virustotal', 'whois', 'shodan', 'reversedns', 'geoip_country', 'wiki', 'iprep', 'threatminer', 'otx', 'threatcrowd', 'vulndb', 'crowdstrike_falcon', 'yara_syntax_validator', 'hashdd', 'onyphe', 'onyphe_full', 'rbl', 'xforceexchange', 'sigma_syntax_validator', 'stix2_pattern_syntax_validator', 'sigma_queries', 'dbl_spamhaus', 'vulners', 'yara_query'] |
||||
__all__ = ['vmray_submit', 'asn_history', 'circl_passivedns', 'circl_passivessl', 'countrycode', 'cve', 'dns', 'btc', 'btc_steroids', 'domaintools', 'eupi', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache', 'virustotal', 'whois', 'shodan', 'reversedns', 'geoip_country', 'wiki', 'iprep', 'threatminer', 'otx', 'threatcrowd', 'vulndb', 'crowdstrike_falcon', 'yara_syntax_validator', 'hashdd', 'onyphe', 'onyphe_full', 'rbl', 'xforceexchange', 'sigma_syntax_validator', 'stix2_pattern_syntax_validator', 'sigma_queries', 'dbl_spamhaus', 'vulners', 'yara_query'] |
||||
|
||||
@ -0,0 +1,185 @@ |
||||
import sys |
||||
import json |
||||
import requests |
||||
import time |
||||
|
||||
misperrors = {'error': 'Error'} |
||||
mispattributes = {'input': ['btc'], 'output': ['text']} |
||||
moduleinfo = {'version': '0.1', 'author': 'Sascha Rommelfangen', |
||||
'description': 'BTC expansion service to \ |
||||
get quick information from MISP attributes', |
||||
'module-type': ['hover']} |
||||
|
||||
moduleconfig = [] |
||||
|
||||
blockchain_firstseen='https://blockchain.info/q/addressfirstseen/' |
||||
blockchain_balance='https://blockchain.info/q/addressbalance/' |
||||
blockchain_totalreceived='https://blockchain.info/q/getreceivedbyaddress/' |
||||
blockchain_all='https://blockchain.info/rawaddr/' |
||||
converter = 'https://min-api.cryptocompare.com/data/pricehistorical?fsym=BTC&tsyms=USD,EUR&ts=' |
||||
converter_rls = 'https://min-api.cryptocompare.com/stats/rate/limit' |
||||
result_text = "" |
||||
g_rate_limit = 300 |
||||
start_time = 0 |
||||
conversion_rates = {} |
||||
|
||||
def get_consumption(output=False): |
||||
req = requests.get(converter_rls) |
||||
jreq = req.json() |
||||
minute = str(jreq['Minute']['CallsLeft']['Histo']) |
||||
hour = str(jreq['Hour']['CallsLeft']['Histo']) |
||||
# Debug out for the console |
||||
print("Calls left this minute / hour: " + minute + " / " + hour) |
||||
return minute, hour |
||||
|
||||
|
||||
def convert(btc, timestamp): |
||||
global g_rate_limit |
||||
global start_time |
||||
global now |
||||
global conversion_rates |
||||
date = time.strftime('%Y-%m-%d', time.localtime(timestamp)) |
||||
# Lookup conversion rates in the cache: |
||||
if date in conversion_rates: |
||||
(usd, eur) = conversion_rates[date] |
||||
else: |
||||
# If not cached, we have to get the converion rates |
||||
# We have to be careful with rate limiting on the server side |
||||
if g_rate_limit == 300: |
||||
minute, hour = get_consumption() |
||||
g_rate_limit -= 1 |
||||
now = time.time() |
||||
delta = now - start_time |
||||
#print(g_rate_limit) |
||||
if g_rate_limit <= 10: |
||||
minute, hour = get_consumption(output=True) |
||||
if int(minute) <= 10: |
||||
#print(minute) |
||||
#get_consumption(output=True) |
||||
time.sleep(3) |
||||
else: |
||||
mprint(minute) |
||||
start_time = time.time() |
||||
g_rate_limit = int(minute) |
||||
try: |
||||
req = requests.get(converter+str(timestamp)) |
||||
jreq = req.json() |
||||
usd = jreq['BTC']['USD'] |
||||
eur = jreq['BTC']['EUR'] |
||||
# Since we have the rates, store them in the cache |
||||
conversion_rates[date] = (usd, eur) |
||||
except Exception as ex: |
||||
mprint(ex) |
||||
get_consumption(output=True) |
||||
# Actually convert and return the values |
||||
u = usd * btc |
||||
e = eur * btc |
||||
return u,e |
||||
|
||||
|
||||
def mprint(input): |
||||
# Prepare the final print |
||||
global result_text |
||||
result_text = result_text + "\n" + str(input) |
||||
|
||||
|
||||
def handler(q=False): |
||||
global result_text |
||||
global conversion_rates |
||||
start_time = time.time() |
||||
now = time.time() |
||||
if q is False: |
||||
return False |
||||
request = json.loads(q) |
||||
click = False |
||||
# This means the magnifying glass has been clicked |
||||
if request.get('persistent') == 1: |
||||
click = True |
||||
# Otherwise the attribute was only hovered over |
||||
if request.get('btc'): |
||||
btc = request['btc'] |
||||
else: |
||||
return False |
||||
|
||||
mprint("\nAddress:\t" + btc) |
||||
try: |
||||
req = requests.get(blockchain_all+btc+"?limit=50&filter=5") |
||||
jreq = req.json() |
||||
except Exception as e: |
||||
#print(e) |
||||
mprint(req.text) |
||||
sys.exit(1) |
||||
|
||||
n_tx = jreq['n_tx'] |
||||
balance = float(jreq['final_balance'] / 100000000) |
||||
rcvd = float(jreq['total_received'] / 100000000) |
||||
sent = float(jreq['total_sent'] / 100000000) |
||||
output = 'Balance:\t{0:.10f} BTC (+{1:.10f} BTC / -{2:.10f} BTC)' |
||||
mprint(output.format(balance, rcvd, sent)) |
||||
if click is False: |
||||
mprint("Transactions:\t" + str(n_tx) + "\t (previewing up to 5 most recent)") |
||||
else: |
||||
mprint("Transactions:\t" + str(n_tx)) |
||||
mprint("======================================================================================") |
||||
i = 0 |
||||
while i < n_tx: |
||||
if click is False: |
||||
req = requests.get(blockchain_all+btc+"?limit=5&offset="+str(i)+"&filter=5") |
||||
if n_tx > 5: |
||||
n_tx = 5 |
||||
else: |
||||
req = requests.get(blockchain_all+btc+"?limit=50&offset="+str(i)+"&filter=5") |
||||
jreq = req.json() |
||||
if jreq['txs']: |
||||
for transactions in jreq['txs']: |
||||
sum = 0 |
||||
sum_counter = 0 |
||||
for tx in transactions['inputs']: |
||||
script_old = tx['script'] |
||||
if tx['prev_out']['value'] != 0 and tx['prev_out']['addr'] == btc: |
||||
datetime = time.strftime("%d %b %Y %H:%M:%S %Z", time.localtime(int(transactions['time']))) |
||||
value = float(tx['prev_out']['value'] / 100000000 ) |
||||
u,e = convert(value, transactions['time']) |
||||
mprint("#" + str(n_tx - i) + "\t" + str(datetime) + "\t-{0:10.8f} BTC {1:10.2f} USD\t{2:10.2f} EUR".format(value, u, e).rstrip('0')) |
||||
if script_old != tx['script']: |
||||
i += 1 |
||||
else: |
||||
sum_counter += 1 |
||||
sum += value |
||||
if sum_counter > 1: |
||||
u,e = convert(sum, transactions['time']) |
||||
mprint("\t\t\t\t\t----------------------------------------------") |
||||
mprint("#" + str(n_tx - i) + "\t\t\t\t Sum:\t-{0:10.8f} BTC {1:10.2f} USD\t{2:10.2f} EUR\n".format(sum, u, e).rstrip('0')) |
||||
for tx in transactions['out']: |
||||
if tx['value'] != 0 and tx['addr'] == btc: |
||||
datetime = time.strftime("%d %b %Y %H:%M:%S %Z", time.localtime(int(transactions['time']))) |
||||
value = float(tx['value'] / 100000000 ) |
||||
u,e = convert(value, transactions['time']) |
||||
mprint("#" + str(n_tx - i) + "\t" + str(datetime) + "\t {0:10.8f} BTC {1:10.2f} USD\t{2:10.2f} EUR".format(value, u, e).rstrip('0')) |
||||
#i += 1 |
||||
i += 1 |
||||
|
||||
r = { |
||||
'results': [ |
||||
{ |
||||
'types': ['text'], |
||||
'values':[ |
||||
str(result_text) |
||||
] |
||||
} |
||||
] |
||||
} |
||||
# Debug output on the console |
||||
print(result_text) |
||||
# Unset the result for the next request |
||||
result_text = "" |
||||
return r |
||||
|
||||
|
||||
def introspection(): |
||||
return mispattributes |
||||
|
||||
|
||||
def version(): |
||||
moduleinfo['config'] = moduleconfig |
||||
return moduleinfo |
||||
Loading…
Reference in new issue