arbor-atlas 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. data.tar.gz.sig +0 -0
  2. data/README.rdoc +81 -1
  3. data/VERSION +1 -1
  4. data/arbor-atlas.gemspec +72 -0
  5. data/lib/arbor-atlas/arbor-atlas.rb +7 -0
  6. data/test/test_arbor-atlas.rb +20 -6
  7. metadata +4 -3
  8. metadata.gz.sig +0 -0
data.tar.gz.sig CHANGED
Binary file
data/README.rdoc CHANGED
@@ -1,6 +1,86 @@
1
1
  = arbor-atlas
2
2
 
3
- Description goes here.
3
+ The arbor-atlas gem provides a very thin wrapper around Arbor Atlas' web interface, https://atlas.arbor.net/.
4
+
5
+ == Installation
6
+
7
+ sudo gem install arbor-atlas
8
+
9
+ == Usage
10
+
11
+ require 'rubygems'
12
+ require 'arbor-atlas'
13
+ username = "your atlas username"
14
+ password = "your atlas password"
15
+ arbor = Arbor::Atlas.new(username, password)
16
+ ip_rec = arbor.lookup("1.2.3.4")
17
+ net_rec = arbor.lookup("1.2.3.0/24")
18
+ asn_rec = arbor.lookup("AS701")
19
+ cc_rec = arbor.lookup("US")
20
+ cve_rec = arbor.lookup("CVE-2006-4139")
21
+
22
+ # all the records are simply hashes like the following
23
+
24
+ pp ip_rec # =>
25
+ {"report"=>
26
+ {"title"=>"ATLAS Host Report: Global 1.2.3.4",
27
+ "scans"=>
28
+ {"sources"=>
29
+ {"country"=>
30
+ {"entity"=>{"name"=>"Other", "percent"=>"0.0%", "bytes_avg"=>"0"}},
31
+ "asn"=>
32
+ {"entity"=>{"name"=>"Other", "percent"=>"0.0%", "bytes_avg"=>"0"}},
33
+ "host"=>
34
+ {"entity"=>{"name"=>"Other", "percent"=>"0.0%", "bytes_avg"=>"0"}}},
35
+ "services"=>
36
+ {"service"=>
37
+ {"entity"=>{"name"=>"Other", "percent"=>"0.0%", "bytes_avg"=>"0"}}}},
38
+ "background"=>
39
+ {"country"=>"AU",
40
+ "asn"=>nil,
41
+ "blacklist"=>
42
+ {"dnsbl"=>
43
+ [{"server"=>"dnsbl.ahbl.org", "status"=>"OK"},
44
+ {"server"=>"bl.spamcop.net", "status"=>"OK"},
45
+ {"server"=>"dnsbl.njabl.org", "status"=>"OK"},
46
+ {"server"=>"sbl-xbl.spamhaus.org", "status"=>"OK"},
47
+ {"server"=>"multi.surbl.org", "status"=>"OK"},
48
+ {"server"=>"dnsbl.sorbs.net", "status"=>"OK"},
49
+ {"server"=>"virbl.dnsbl.bit.nl", "status"=>"OK"},
50
+ {"server"=>"dnsbl.dronebl.org", "status"=>"OK"}]}},
51
+ "attacks"=>
52
+ {"attack_changes"=>
53
+ {"attacks"=>"0.00",
54
+ "change"=>{"absolute"=>"0.0", "percent"=>"0.0"},
55
+ "cve"=>nil,
56
+ "description"=>"Other"},
57
+ "sources"=>
58
+ {"country"=>
59
+ {"entity"=>
60
+ {"name"=>"Other", "percent"=>"0.0%", "attacks_avg"=>"0.00"}},
61
+ "asn"=>
62
+ {"entity"=>
63
+ {"name"=>"Other", "percent"=>"0.0%", "attacks_avg"=>"0.00"}},
64
+ "host"=>
65
+ {"entity"=>
66
+ {"name"=>"Other", "percent"=>"0.0%", "attacks_avg"=>"0.00"}}}},
67
+ "servers"=>
68
+ {"phishing"=>
69
+ {"brands"=>nil,
70
+ "servers"=>
71
+ {"country"=>
72
+ {"entity"=>{"name"=>"Other", "urls"=>"0", "percent"=>"0.0%"}},
73
+ "asn"=>{"entity"=>{"name"=>"Other", "urls"=>"0", "percent"=>"0.0%"}},
74
+ "host"=>
75
+ {"entity"=>{"name"=>"Other", "urls"=>"0", "percent"=>"0.0%"}}}},
76
+ "botnets"=>
77
+ {"country"=>
78
+ {"entity"=>{"name"=>"Other", "controllers"=>"0", "percent"=>"0.0%"}},
79
+ "asn"=>
80
+ {"entity"=>{"name"=>"Other", "controllers"=>"0", "percent"=>"0.0%"}},
81
+ "host"=>
82
+ {"entity"=>
83
+ {"name"=>"Other", "controllers"=>"0", "percent"=>"0.0%"}}}}}}
4
84
 
5
85
  == Contributing to arbor-atlas
6
86
 
data/VERSION CHANGED
@@ -1 +1 @@
1
- 0.1.0
1
+ 0.1.1
data/arbor-atlas.gemspec ADDED
@@ -0,0 +1,72 @@
1
+ # Generated by jeweler
2
+ # DO NOT EDIT THIS FILE DIRECTLY
3
+ # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
4
+ # -*- encoding: utf-8 -*-
5
+
6
+ Gem::Specification.new do |s|
7
+ s.name = %q{arbor-atlas}
8
+ s.version = "0.1.1"
9
+
10
+ s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
11
+ s.authors = ["Chris Lee"]
12
+ s.cert_chain = ["/Users/chris/Documents/projects/rubygems/arbor-atlas/../gem-public_cert.pem"]
13
+ s.date = %q{2011-05-07}
14
+ s.description = %q{https://atlas.arbor.net}
15
+ s.email = %q{rubygems@chrislee.dhs.org}
16
+ s.extra_rdoc_files = [
17
+ "LICENSE.txt",
18
+ "README.rdoc"
19
+ ]
20
+ s.files = [
21
+ ".document",
22
+ "Gemfile",
23
+ "Gemfile.lock",
24
+ "LICENSE.txt",
25
+ "README.rdoc",
26
+ "Rakefile",
27
+ "VERSION",
28
+ "arbor-atlas.gemspec",
29
+ "lib/arbor-atlas.rb",
30
+ "lib/arbor-atlas/arbor-atlas.rb",
31
+ "test/helper.rb",
32
+ "test/test_arbor-atlas.rb"
33
+ ]
34
+ s.homepage = %q{http://github.com/chrislee35/arbor-atlas}
35
+ s.licenses = ["MIT"]
36
+ s.require_paths = ["lib"]
37
+ s.rubygems_version = %q{1.7.2}
38
+ s.signing_key = %q{/Users/chris/Documents/projects/rubygems/arbor-atlas/../gem-private_key.pem}
39
+ s.summary = %q{A very thin wrapper around Arbor Atlas' web interface}
40
+ s.test_files = [
41
+ "test/helper.rb",
42
+ "test/test_arbor-atlas.rb"
43
+ ]
44
+
45
+ if s.respond_to? :specification_version then
46
+ s.specification_version = 3
47
+
48
+ if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
49
+ s.add_runtime_dependency(%q<crack>, [">= 0.1.8"])
50
+ s.add_development_dependency(%q<shoulda>, [">= 0"])
51
+ s.add_development_dependency(%q<bundler>, ["~> 1.0.0"])
52
+ s.add_development_dependency(%q<jeweler>, ["~> 1.5.2"])
53
+ s.add_development_dependency(%q<rcov>, [">= 0"])
54
+ s.add_runtime_dependency(%q<crack>, [">= 0.1.8"])
55
+ else
56
+ s.add_dependency(%q<crack>, [">= 0.1.8"])
57
+ s.add_dependency(%q<shoulda>, [">= 0"])
58
+ s.add_dependency(%q<bundler>, ["~> 1.0.0"])
59
+ s.add_dependency(%q<jeweler>, ["~> 1.5.2"])
60
+ s.add_dependency(%q<rcov>, [">= 0"])
61
+ s.add_dependency(%q<crack>, [">= 0.1.8"])
62
+ end
63
+ else
64
+ s.add_dependency(%q<crack>, [">= 0.1.8"])
65
+ s.add_dependency(%q<shoulda>, [">= 0"])
66
+ s.add_dependency(%q<bundler>, ["~> 1.0.0"])
67
+ s.add_dependency(%q<jeweler>, ["~> 1.5.2"])
68
+ s.add_dependency(%q<rcov>, [">= 0"])
69
+ s.add_dependency(%q<crack>, [">= 0.1.8"])
70
+ end
71
+ end
72
+
data/lib/arbor-atlas/arbor-atlas.rb CHANGED
@@ -80,6 +80,11 @@ module Arbor
80
80
  lookup_ip(cidr)
81
81
  end
82
82
 
83
+ def lookup_service(port)
84
+ doc = _get("service/#{port.downcase}",{'out'=>'xml'})
85
+ Crack::XML.parse(doc)
86
+ end
87
+
83
88
  def lookup(item)
84
89
  if item =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\/\d{1,2})?$/
85
90
  lookup_ip(item)
@@ -89,6 +94,8 @@ module Arbor
89
94
  lookup_cve(item)
90
95
  elsif item =~ /^\w{2}$/i
91
96
  lookup_cc(item)
97
+ elsif item =~ /^(UDP|TCP)\/\d{1,5}$/i
98
+ lookup_service(item)
92
99
  else
93
100
  raise ArgumentError, "unknown query type for item: #{item}"
94
101
  end
data/test/test_arbor-atlas.rb CHANGED
@@ -20,7 +20,7 @@ class TestArborAtlas < Test::Unit::TestCase
20
20
  assert_not_nil(ipinfo['report']['attacks'])
21
21
  assert_not_nil(ipinfo['report']['servers'])
22
22
  end
23
-
23
+
24
24
  should "return network report on 1.2.3.0/24" do
25
25
  raise "You must set ARBORUSER and ARBORPASS in your environment before running tests" unless ENV['ARBORUSER'] and ENV['ARBORPASS']
26
26
  a = Arbor::Atlas.new(ENV['ARBORUSER'], ENV['ARBORPASS'])
@@ -40,7 +40,7 @@ class TestArborAtlas < Test::Unit::TestCase
40
40
  assert_not_nil(ipinfo['report']['attacks'])
41
41
  assert_not_nil(ipinfo['report']['servers'])
42
42
  end
43
-
43
+
44
44
  should "return network as report for AS701" do
45
45
  raise "You must set ARBORUSER and ARBORPASS in your environment before running tests" unless ENV['ARBORUSER'] and ENV['ARBORPASS']
46
46
  a = Arbor::Atlas.new(ENV['ARBORUSER'], ENV['ARBORPASS'])
@@ -59,7 +59,7 @@ class TestArborAtlas < Test::Unit::TestCase
59
59
  assert_not_nil(ipinfo['report']['servers'])
60
60
  assert_not_nil(ipinfo['report']['dos_attacks'])
61
61
  end
62
-
62
+
63
63
  should "return vulnerability report for CVE-2006-4139" do
64
64
  raise "You must set ARBORUSER and ARBORPASS in your environment before running tests" unless ENV['ARBORUSER'] and ENV['ARBORPASS']
65
65
  a = Arbor::Atlas.new(ENV['ARBORUSER'], ENV['ARBORPASS'])
@@ -75,8 +75,8 @@ class TestArborAtlas < Test::Unit::TestCase
75
75
  assert_equal("Race condition in Sun Solaris 10 allows attackers to cause a denial of service (system panic) via unspecified vectors related to ifconfig and either netstat or SNMP queries.", ipinfo['report']['background']['description'])
76
76
  assert_not_nil(ipinfo['report']['attacks'])
77
77
  end
78
-
79
- should "return country report report for US" do
78
+
79
+ should "return country report for US" do
80
80
  raise "You must set ARBORUSER and ARBORPASS in your environment before running tests" unless ENV['ARBORUSER'] and ENV['ARBORPASS']
81
81
  a = Arbor::Atlas.new(ENV['ARBORUSER'], ENV['ARBORPASS'])
82
82
  assert_not_nil(a.cookie)
@@ -89,7 +89,21 @@ class TestArborAtlas < Test::Unit::TestCase
89
89
  assert_not_nil(ipinfo['report']['dos_attacks'])
90
90
  assert_not_nil(ipinfo['report']['servers'])
91
91
  end
92
-
92
+
93
+ should "return service report for tcp/445" do
94
+ raise "You must set ARBORUSER and ARBORPASS in your environment before running tests" unless ENV['ARBORUSER'] and ENV['ARBORPASS']
95
+ a = Arbor::Atlas.new(ENV['ARBORUSER'], ENV['ARBORPASS'])
96
+ assert_not_nil(a.cookie)
97
+ ipinfo = a.lookup("tcp/445")
98
+ assert_not_nil(ipinfo['report'])
99
+ assert_not_nil(ipinfo['report']['title'])
100
+ assert_equal("ATLAS Service Report: Global TCP/445 (microsoft-ds)", ipinfo['report']['title'])
101
+ assert_not_nil(ipinfo['report']['scans'])
102
+ assert_not_nil(ipinfo['report']['background'])
103
+ assert_not_nil(ipinfo['report']['attacks'])
104
+ assert_not_nil(ipinfo['report']['vulnerabilities'])
105
+ end
106
+
93
107
  should "raise exception on unknown query type" do
94
108
  raise "You must set ARBORUSER and ARBORPASS in your environment before running tests" unless ENV['ARBORUSER'] and ENV['ARBORPASS']
95
109
  a = Arbor::Atlas.new(ENV['ARBORUSER'], ENV['ARBORPASS'])
metadata CHANGED
@@ -1,13 +1,13 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: arbor-atlas
3
3
  version: !ruby/object:Gem::Version
4
- hash: 27
4
+ hash: 25
5
5
  prerelease:
6
6
  segments:
7
7
  - 0
8
8
  - 1
9
- - 0
10
- version: 0.1.0
9
+ - 1
10
+ version: 0.1.1
11
11
  platform: ruby
12
12
  authors:
13
13
  - Chris Lee
@@ -148,6 +148,7 @@ files:
148
148
  - README.rdoc
149
149
  - Rakefile
150
150
  - VERSION
151
+ - arbor-atlas.gemspec
151
152
  - lib/arbor-atlas.rb
152
153
  - lib/arbor-atlas/arbor-atlas.rb
153
154
  - test/helper.rb
metadata.gz.sig CHANGED
Binary file