mirror of https://github.com/MISP/misp-modules
46 lines
1.5 KiB
Python
Executable File
46 lines
1.5 KiB
Python
Executable File
import json
|
|
from url_archiver import url_archiver
|
|
|
|
misperrors = {'error': 'Error'}
|
|
mispattributes = {'input': ['link', 'url'], 'output': ['attachment', 'malware-sample']}
|
|
moduleinfo = {'version': '0.1', 'author': 'Alexandre Dulaunoy', 'description': 'Module to cache web pages of analysis reports, OSINT sources. The module returns a link of the cached page.', 'module-type': ['expansion']}
|
|
moduleconfig = ['archivepath']
|
|
|
|
|
|
def handler(q=False):
|
|
if q is False:
|
|
return False
|
|
request = json.loads(q)
|
|
if (request.get('config')):
|
|
archive_path = request['config']['archivepath']
|
|
else:
|
|
archive_path = '/tmp/'
|
|
if request.get('link'):
|
|
tocache = request['link']
|
|
data = __archiveLink(archive_path, tocache)
|
|
mispattributes['output'] = ['attachment']
|
|
elif request.get('url'):
|
|
tocache = request['url']
|
|
data = __archiveLink(archive_path, tocache)
|
|
mispattributes['output'] = ['malware-sample']
|
|
else:
|
|
misperrors['error'] = "Link is missing"
|
|
return misperrors
|
|
enc_data = data.decode('ascii')
|
|
r = {'results': [{'types': mispattributes['output'], 'values': tocache, 'data': enc_data}]}
|
|
return r
|
|
|
|
|
|
def __archiveLink(archive_path, tocache):
|
|
archiver = url_archiver.Archive(archive_path=archive_path)
|
|
return archiver.fetch(url=tocache, armor=True)
|
|
|
|
|
|
def introspection():
|
|
return mispattributes
|
|
|
|
|
|
def version():
|
|
moduleinfo['config'] = moduleconfig
|
|
return moduleinfo
|