Merge pull request #406 from JakubOnderka/ip-port

new: [passivedns, passivessl] Add support for ip-src|port and ip-dst|port
pull/407/head
Alexandre Dulaunoy 2020-06-03 12:57:11 +02:00 committed by GitHub
commit ddf51d482a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 8 deletions

View File

@ -2,7 +2,7 @@ import json
import pypdns import pypdns
from pymisp import MISPAttribute, MISPEvent, MISPObject from pymisp import MISPAttribute, MISPEvent, MISPObject
mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst'], 'format': 'misp_standard'} mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst', 'ip-src|port', 'ip-dst|port'], 'format': 'misp_standard'}
moduleinfo = {'version': '0.2', 'author': 'Alexandre Dulaunoy', moduleinfo = {'version': '0.2', 'author': 'Alexandre Dulaunoy',
'description': 'Module to access CIRCL Passive DNS', 'description': 'Module to access CIRCL Passive DNS',
'module-type': ['expansion', 'hover']} 'module-type': ['expansion', 'hover']}
@ -24,9 +24,11 @@ class PassiveDNSParser():
results = {key: event[key] for key in ('Attribute', 'Object')} results = {key: event[key] for key in ('Attribute', 'Object')}
return {'results': results} return {'results': results}
def parse(self, value): def parse(self):
value = self.attribute.value.split('|')[0] if '|' in self.attribute.type else self.attribute.value
try: try:
results = self.pdns.query(self.attribute.value) results = self.pdns.query(value)
except Exception: except Exception:
self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'} self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'}
return return
@ -62,7 +64,7 @@ def handler(q=False):
if not any(input_type == attribute['type'] for input_type in mispattributes['input']): if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
return {'error': 'Unsupported attributes type'} return {'error': 'Unsupported attributes type'}
pdns_parser = PassiveDNSParser(attribute, authentication) pdns_parser = PassiveDNSParser(attribute, authentication)
pdns_parser.parse(attribute['value']) pdns_parser.parse()
return pdns_parser.get_results() return pdns_parser.get_results()

View File

@ -2,7 +2,7 @@ import json
import pypssl import pypssl
from pymisp import MISPAttribute, MISPEvent, MISPObject from pymisp import MISPAttribute, MISPEvent, MISPObject
mispattributes = {'input': ['ip-src', 'ip-dst'], 'format': 'misp_standard'} mispattributes = {'input': ['ip-src', 'ip-dst', 'ip-src|port', 'ip-dst|port'], 'format': 'misp_standard'}
moduleinfo = {'version': '0.2', 'author': 'Raphaël Vinot', moduleinfo = {'version': '0.2', 'author': 'Raphaël Vinot',
'description': 'Module to access CIRCL Passive SSL', 'description': 'Module to access CIRCL Passive SSL',
'module-type': ['expansion', 'hover']} 'module-type': ['expansion', 'hover']}
@ -31,9 +31,11 @@ class PassiveSSLParser():
results = {key: event[key] for key in ('Attribute', 'Object')} results = {key: event[key] for key in ('Attribute', 'Object')}
return {'results': results} return {'results': results}
def parse(self, value): def parse(self):
value = self.attribute.value.split('|')[0] if '|' in self.attribute.type else self.attribute.value
try: try:
results = self.pssl.query(self.attribute.value) results = self.pssl.query(value)
except Exception: except Exception:
self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'} self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'}
return return
@ -83,7 +85,7 @@ def handler(q=False):
if not any(input_type == attribute['type'] for input_type in mispattributes['input']): if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
return {'error': 'Unsupported attributes type'} return {'error': 'Unsupported attributes type'}
pssl_parser = PassiveSSLParser(attribute, authentication) pssl_parser = PassiveSSLParser(attribute, authentication)
pssl_parser.parse(attribute['value']) pssl_parser.parse()
return pssl_parser.get_results() return pssl_parser.get_results()