misp-modules/misp_modules/modules/import_mod/url_import.py

87 lines
2.6 KiB
Python
Executable File

import json
import base64
from pymisp import MISPEvent, MISPObject, MISPAttribute
from pyfaup.faup import Faup
misperrors = {'error': 'Error'}
userConfig = {
'include_scheme': {
'type': 'Boolean',
'message': 'Include scheme'
},
}
mispattributes = {
'inputSource': ['file', 'paste'],
'output': ['MISP Format'],
'format': 'misp_standard'
}
moduleinfo = {'version': '0.1', 'author': 'Sami Mokaddem',
'description': 'Generic blueprint to be copy-pasted to quickly boostrap creation of import module.',
'module-type': ['import']}
moduleconfig = []
fp = Faup()
def generateData(event, data, config):
for url in data.splitlines():
fp.decode(url)
parsed = fp.get()
obj = MISPObject('url')
obj.add_attribute('url', type='url', value=url)
if parsed['tld'] is not None:
obj.add_attribute('tld', type='text', value=parsed['tld'])
if parsed['subdomain'] is not None:
obj.add_attribute('subdomain', type='text', value=parsed['subdomain'])
if config['include_scheme'] is True:
obj.add_attribute('scheme', type='text', value=parsed['scheme'])
obj.add_attribute('resource_path', type='text', value=parsed['resource_path'])
obj.add_attribute('query_string', type='text', value=parsed['query_string'])
obj.add_attribute('port', type='port', value=parsed['port'])
obj.add_attribute('host', type='hostname', value=parsed['host'])
if parsed['fragment'] is not None:
obj.add_attribute('fragment', type='text', value=parsed['fragment'])
obj.add_attribute('domain_without_tld', type='text', value=parsed['domain_without_tld'])
obj.add_attribute('domain', type='domain', value=parsed['domain'])
event.objects.append(obj)
def handler(q=False):
if q is False:
return False
request = json.loads(q)
data = getUploadedData(request)
config = getPassedConfig(request)
event = MISPEvent()
generateData(event, data, config)
return {"results": json.loads(event.to_json())}
def getUploadedData(request):
return base64.b64decode(request['data']).decode('utf8')
def getPassedConfig(request):
for k, v in userConfig.items():
if v['type'] == 'Boolean':
request['config'][k] = True if request['config'][k] == '1' else False
return request['config']
def introspection():
modulesetup = mispattributes
try:
userConfig
modulesetup['userConfig'] = userConfig
except NameError:
pass
return modulesetup
def version():
moduleinfo['config'] = moduleconfig
return moduleinfo