mirror of https://github.com/MISP/misp-modules
87 lines
2.6 KiB
Python
Executable File
87 lines
2.6 KiB
Python
Executable File
import json
|
|
import base64
|
|
from pymisp import MISPEvent, MISPObject, MISPAttribute
|
|
from pyfaup.faup import Faup
|
|
|
|
misperrors = {'error': 'Error'}
|
|
userConfig = {
|
|
'include_scheme': {
|
|
'type': 'Boolean',
|
|
'message': 'Include scheme'
|
|
},
|
|
}
|
|
|
|
mispattributes = {
|
|
'inputSource': ['file', 'paste'],
|
|
'output': ['MISP Format'],
|
|
'format': 'misp_standard'
|
|
}
|
|
|
|
|
|
moduleinfo = {'version': '0.1', 'author': 'Sami Mokaddem',
|
|
'description': 'Generic blueprint to be copy-pasted to quickly boostrap creation of import module.',
|
|
'module-type': ['import']}
|
|
|
|
moduleconfig = []
|
|
|
|
fp = Faup()
|
|
|
|
def generateData(event, data, config):
|
|
for url in data.splitlines():
|
|
fp.decode(url)
|
|
parsed = fp.get()
|
|
obj = MISPObject('url')
|
|
obj.add_attribute('url', type='url', value=url)
|
|
if parsed['tld'] is not None:
|
|
obj.add_attribute('tld', type='text', value=parsed['tld'])
|
|
if parsed['subdomain'] is not None:
|
|
obj.add_attribute('subdomain', type='text', value=parsed['subdomain'])
|
|
if config['include_scheme'] is True:
|
|
obj.add_attribute('scheme', type='text', value=parsed['scheme'])
|
|
obj.add_attribute('resource_path', type='text', value=parsed['resource_path'])
|
|
obj.add_attribute('query_string', type='text', value=parsed['query_string'])
|
|
obj.add_attribute('port', type='port', value=parsed['port'])
|
|
obj.add_attribute('host', type='hostname', value=parsed['host'])
|
|
if parsed['fragment'] is not None:
|
|
obj.add_attribute('fragment', type='text', value=parsed['fragment'])
|
|
obj.add_attribute('domain_without_tld', type='text', value=parsed['domain_without_tld'])
|
|
obj.add_attribute('domain', type='domain', value=parsed['domain'])
|
|
event.objects.append(obj)
|
|
|
|
|
|
def handler(q=False):
|
|
if q is False:
|
|
return False
|
|
request = json.loads(q)
|
|
data = getUploadedData(request)
|
|
config = getPassedConfig(request)
|
|
event = MISPEvent()
|
|
generateData(event, data, config)
|
|
return {"results": json.loads(event.to_json())}
|
|
|
|
|
|
def getUploadedData(request):
|
|
return base64.b64decode(request['data']).decode('utf8')
|
|
|
|
|
|
def getPassedConfig(request):
|
|
for k, v in userConfig.items():
|
|
if v['type'] == 'Boolean':
|
|
request['config'][k] = True if request['config'][k] == '1' else False
|
|
return request['config']
|
|
|
|
|
|
def introspection():
|
|
modulesetup = mispattributes
|
|
try:
|
|
userConfig
|
|
modulesetup['userConfig'] = userConfig
|
|
except NameError:
|
|
pass
|
|
return modulesetup
|
|
|
|
|
|
def version():
|
|
moduleinfo['config'] = moduleconfig
|
|
return moduleinfo
|