bqm 1.0.2 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 348a96aed509a774a1848651efa6a17d52aac51e47b2e229daeba4fb933771a6
-  data.tar.gz: b2262ae4e6b24773b97cd4e19e2f4ba4bcf9e1f2dc8d4af6da2653d30b02e56a
+  metadata.gz: 28bbff6c42f4653702f6e091868d7b54e83b461c3501a5eeffd5d423a04445e2
+  data.tar.gz: dc65921e523353a6ab7ae6be055e901c9cb8d83c4fb1f2c7483e8029d2408903
 SHA512:
-  metadata.gz: 9dc21de90441bfc6add73d79b01c52ce5e530b28c94c62560913dea39805cb2615139a41da329ebba966d8aa964262ff6aaefc352b3c8246c43a2f9dc43465e5
-  data.tar.gz: ca1d114fdb1d024d4565d061ef669ecedaf89ecfe89be730658c8823b739a40ce2d9cadce380a47c6ed9079587b302c5b7ebb2773e9f7a2208e3040790a3866a
+  metadata.gz: 2fe4cc56dd34eed52c1d817867bad75399a4df798a66f87d897141441fee53418e3d1e3d33818efb97c49c928156db66ff0874215977ec6c1972d43b4d2e6a9e
+  data.tar.gz: 57b22d6b6724487fb7316b746c3fb6c3d0236de816a057cfafefb09e7321a80b27d5df77cd51b0f474a525ed62830486c7e1e478acaf7c5fdc4fd394478aecff

data/bin/bqm

@@ -15,9 +15,9 @@ def find_dataset
 end
 
 def merge(source)
-  src = JSON.load_file(source)
+  sets = get_datasets(source)
   queries = []
-  src['sets'].each do |s|
+  sets.each do |s|
     customqueries = Net::HTTP.get(URI(s))
     data = JSON.parse(customqueries)
     queries += data['queries']
@@ -46,10 +46,29 @@ def deduplicate(data)
   data.map { |x| BQMquery.new(x) }.uniq
 end
 
+# Transform a list of raw github links to pretty github links
+# from https://raw.githubusercontent.com/namespace/project/branch/file.ext
+# to https://github.com/namespace/project/blob/branch/file.ext
+def pretty_link(lst)
+  output = []
+  lst.each do |link|
+    _protocol, _void, _host, namespace, project, branch, *path = link.split('/')
+    output << "    https://github.com/#{namespace}/#{project}/blob/#{branch}/#{path.join('/')}"
+  end
+  output
+end
+
+def get_datasets(source)
+  begin # ruby 3.0+
+    src = JSON.load_file(source)
+  rescue NoMethodError # ruby 2.7 retro-compatibility
+    src = JSON.parse(File.read(source))
+  end
+  src['sets']
+end
+
 if __FILE__ == $PROGRAM_NAME
   source = find_dataset
-  data = merge(source)
-  queries = deduplicate(data).map(&:data)
 
   require 'optparse'
   options = {}
@@ -57,16 +76,29 @@ if __FILE__ == $PROGRAM_NAME
     parser.banner = 'Usage: bqm [options]'
 
     parser.on('-o', '--output-path PATH', 'Path where to store the query file')
+    parser.on('-l', '--list', 'List available datasets')
     parser.separator ''
     parser.separator 'Example: bqm -o ~/.config/bloodhound/customqueries.json'
   end.parse!(into: options)
 
   out = options[:'output-path']
-  if out
+  list = options[:list]
+  if list
+    puts '[+] Available datasets:'
+    pretty_link(get_datasets(source)).each do |l|
+      puts l
+    end
+  elsif out
+    puts '[+] Fetching and merging datasets'
+    data = merge(source)
+    puts '[+] Removing duplicates'
+    queries = deduplicate(data).map(&:data)
+
     File.open(out, 'w') do |file|
       json = JSON.pretty_generate({ 'queries' => queries })
       file.write(json)
     end
+    puts "[+] All queries have been merged in #{out}"
   else
     puts 'Help: bqm -h'
   end

data/data/query-sets.json

@@ -1,11 +1,16 @@
 {
   "sets": [
     "https://raw.githubusercontent.com/ly4k/Certipy/main/customqueries.json",
-    "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/customqueries.json",
+    "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/BloodHound_Custom_Queries/customqueries.json",
     "https://raw.githubusercontent.com/hausec/Bloodhound-Custom-Queries/master/customqueries.json",
     "https://raw.githubusercontent.com/awsmhacks/awsmBloodhoundCustomQueries/master/customqueries.json",
     "https://raw.githubusercontent.com/porterhau5/BloodHound-Owned/master/customqueries.json",
     "https://raw.githubusercontent.com/ZephrFish/Bloodhound-CustomQueries/main/customqueries.json",
-    "https://raw.githubusercontent.com/Scoubi/BloodhoundAD-Queries/master/customqueries.json"
+    "https://raw.githubusercontent.com/Scoubi/BloodhoundAD-Queries/master/customqueries.json",
+    "https://raw.githubusercontent.com/InfamousSYN/bloodhound-queries/main/customqueries.json",
+    "https://raw.githubusercontent.com/zeronetworks/BloodHound-Tools/main/CustomQueries/customqueries.json",
+    "https://raw.githubusercontent.com/egypt/customqueries/master/customqueries.json",
+    "https://raw.githubusercontent.com/trustedsec/CrackHound/main/customqueries.json",
+    "https://raw.githubusercontent.com/aress31/bloodhound-utils/main/customqueries.json"
   ]
-}
+}

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bqm
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.2.0
 platform: ruby
 authors:
 - Alexandre ZANNI
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-11-04 00:00:00.000000000 Z
+date: 2023-01-26 00:00:00.000000000 Z
 dependencies: []
 description: Deduplicate custom BloudHound queries from different datasets and merge
   them in one customqueries.json file.
@@ -40,14 +40,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 2.6.0
   - - "<"
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.4.1
 signing_key:
 specification_version: 4
 summary: Download BloudHound query lists, deduplicate entries and merge them in one