dorothy2 1.2.0 → 2.0.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (47) hide show
  1. checksums.yaml +8 -8
  2. data/CHANGELOG +39 -14
  3. data/README.md +80 -62
  4. data/UPDATE +6 -14
  5. data/bin/dorothy2 +472 -0
  6. data/dorothy2.gemspec +22 -16
  7. data/etc/ddl/dorothive.ddl +619 -373
  8. data/etc/sources.yml.example +27 -2
  9. data/lib/doroGUI.rb +232 -0
  10. data/lib/doroParser.rb +34 -78
  11. data/lib/dorothy2.rb +288 -248
  12. data/lib/dorothy2/BFM.rb +114 -61
  13. data/lib/dorothy2/DEM.rb +3 -1
  14. data/lib/dorothy2/NAM.rb +2 -2
  15. data/lib/dorothy2/Settings.rb +2 -1
  16. data/lib/dorothy2/VSM.rb +2 -1
  17. data/lib/dorothy2/deep_symbolize.rb +2 -7
  18. data/lib/dorothy2/do-init.rb +286 -19
  19. data/lib/dorothy2/do-logger.rb +1 -1
  20. data/lib/dorothy2/do-utils.rb +382 -33
  21. data/lib/dorothy2/version.rb +1 -1
  22. data/lib/dorothy2/vtotal.rb +30 -20
  23. data/lib/mu/xtractr.rb +11 -11
  24. data/lib/mu/xtractr/stream.rb +1 -1
  25. data/lib/www/public/reset.css +153 -0
  26. data/lib/www/public/style.css +65 -0
  27. data/lib/www/views/analyses.erb +28 -0
  28. data/lib/www/views/email.erb +63 -0
  29. data/lib/www/views/flows.erb +30 -0
  30. data/lib/www/views/layout.erb +27 -0
  31. data/lib/www/views/profile.erb +49 -0
  32. data/lib/www/views/queue.erb +28 -0
  33. data/lib/www/views/resume.erb +135 -0
  34. data/lib/www/views/resume.erb~ +88 -0
  35. data/lib/www/views/samples.erb +20 -0
  36. data/lib/www/views/upload.erb +154 -0
  37. data/share/img/The_big_picture.pdf +0 -0
  38. data/test/tc_dorothy_full.rb +3 -0
  39. metadata +169 -70
  40. data/TODO +0 -27
  41. data/bin/dorothy_start +0 -225
  42. data/bin/dorothy_stop +0 -28
  43. data/bin/dparser_start +0 -94
  44. data/bin/dparser_stop +0 -31
  45. data/etc/dorothy copy.yml.example +0 -39
  46. data/etc/extensions.yml +0 -41
  47. data/share/update-dorothive.sql +0 -19
data/test/tc_dorothy_full.rb CHANGED
@@ -4,6 +4,9 @@ require 'dorothy2' #comment for testing/developmnet
4
4
 
5
5
  #load '../lib/dorothy2.rb'
6
6
 
7
+
8
+ #Those tests have not been ported to the latest version of dorothy2. They wont work. #TODO: fix this
9
+
7
10
  include Dorothy
8
11
 
9
12
  LOGGER = DoroLogger.new(STDOUT, "weekly")
metadata CHANGED
@@ -1,85 +1,85 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: dorothy2
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.2.0
4
+ version: 2.0.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - marco riccardi
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2013-12-01 00:00:00.000000000 Z
11
+ date: 2014-10-26 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: net-scp
15
15
  requirement: !ruby/object:Gem::Requirement
16
16
  requirements:
17
- - - ! '>='
17
+ - - ~>
18
18
  - !ruby/object:Gem::Version
19
- version: 1.0.4
19
+ version: 1.1.2
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
- - - ! '>='
24
+ - - ~>
25
25
  - !ruby/object:Gem::Version
26
- version: 1.0.4
26
+ version: 1.1.2
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: net-ssh
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
- - - ! '>='
31
+ - - ~>
32
32
  - !ruby/object:Gem::Version
33
- version: 2.2.1
33
+ version: 2.7.0
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
- - - ! '>='
38
+ - - ~>
39
39
  - !ruby/object:Gem::Version
40
- version: 2.2.1
40
+ version: 2.7.0
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: trollop
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
- - - ! '>='
45
+ - - ~>
46
46
  - !ruby/object:Gem::Version
47
- version: 1.16.2
47
+ version: '2.0'
48
48
  type: :runtime
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
- - - ! '>='
52
+ - - ~>
53
53
  - !ruby/object:Gem::Version
54
- version: 1.16.2
54
+ version: '2.0'
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: rest-client
57
57
  requirement: !ruby/object:Gem::Requirement
58
58
  requirements:
59
- - - ! '>='
59
+ - - ~>
60
60
  - !ruby/object:Gem::Version
61
- version: 1.6.1
61
+ version: 1.6.7
62
62
  type: :runtime
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
- - - ! '>='
66
+ - - ~>
67
67
  - !ruby/object:Gem::Version
68
- version: 1.6.1
68
+ version: 1.6.7
69
69
  - !ruby/object:Gem::Dependency
70
- name: mime-types
70
+ name: mail
71
71
  requirement: !ruby/object:Gem::Requirement
72
72
  requirements:
73
- - - ! '>='
73
+ - - ~>
74
74
  - !ruby/object:Gem::Version
75
- version: '1.16'
75
+ version: 2.5.4
76
76
  type: :runtime
77
77
  prerelease: false
78
78
  version_requirements: !ruby/object:Gem::Requirement
79
79
  requirements:
80
- - - ! '>='
80
+ - - ~>
81
81
  - !ruby/object:Gem::Version
82
- version: '1.16'
82
+ version: 2.5.4
83
83
  - !ruby/object:Gem::Dependency
84
84
  name: colored
85
85
  requirement: !ruby/object:Gem::Requirement
@@ -95,125 +95,220 @@ dependencies:
95
95
  - !ruby/object:Gem::Version
96
96
  version: '1.2'
97
97
  - !ruby/object:Gem::Dependency
98
- name: ruby-pg
98
+ name: pg
99
99
  requirement: !ruby/object:Gem::Requirement
100
100
  requirements:
101
101
  - - ! '>='
102
102
  - !ruby/object:Gem::Version
103
- version: 0.7.9.2008.01.28
103
+ version: 0.8.0
104
104
  type: :runtime
105
105
  prerelease: false
106
106
  version_requirements: !ruby/object:Gem::Requirement
107
107
  requirements:
108
108
  - - ! '>='
109
109
  - !ruby/object:Gem::Version
110
- version: 0.7.9.2008.01.28
110
+ version: 0.8.0
111
111
  - !ruby/object:Gem::Dependency
112
- name: virustotal
112
+ name: nokogiri
113
113
  requirement: !ruby/object:Gem::Requirement
114
114
  requirements:
115
- - - ! '>='
115
+ - - ~>
116
116
  - !ruby/object:Gem::Version
117
- version: 2.0.0
117
+ version: 1.5.11
118
118
  type: :runtime
119
119
  prerelease: false
120
120
  version_requirements: !ruby/object:Gem::Requirement
121
121
  requirements:
122
- - - ! '>='
122
+ - - ~>
123
123
  - !ruby/object:Gem::Version
124
- version: 2.0.0
124
+ version: 1.5.11
125
125
  - !ruby/object:Gem::Dependency
126
- name: nokogiri
126
+ name: uirusu
127
127
  requirement: !ruby/object:Gem::Requirement
128
128
  requirements:
129
129
  - - ~>
130
130
  - !ruby/object:Gem::Version
131
- version: 1.5.10
131
+ version: 0.0.6
132
132
  type: :runtime
133
133
  prerelease: false
134
134
  version_requirements: !ruby/object:Gem::Requirement
135
135
  requirements:
136
136
  - - ~>
137
137
  - !ruby/object:Gem::Version
138
- version: 1.5.10
138
+ version: 0.0.6
139
139
  - !ruby/object:Gem::Dependency
140
140
  name: rbvmomi
141
141
  requirement: !ruby/object:Gem::Requirement
142
142
  requirements:
143
- - - ! '>='
143
+ - - ~>
144
+ - !ruby/object:Gem::Version
145
+ version: 1.6.0
146
+ type: :runtime
147
+ prerelease: false
148
+ version_requirements: !ruby/object:Gem::Requirement
149
+ requirements:
150
+ - - ~>
151
+ - !ruby/object:Gem::Version
152
+ version: 1.6.0
153
+ - !ruby/object:Gem::Dependency
154
+ name: ruby-filemagic
155
+ requirement: !ruby/object:Gem::Requirement
156
+ requirements:
157
+ - - ~>
158
+ - !ruby/object:Gem::Version
159
+ version: 0.5.0
160
+ type: :runtime
161
+ prerelease: false
162
+ version_requirements: !ruby/object:Gem::Requirement
163
+ requirements:
164
+ - - ~>
165
+ - !ruby/object:Gem::Version
166
+ version: 0.5.0
167
+ - !ruby/object:Gem::Dependency
168
+ name: activesupport
169
+ requirement: !ruby/object:Gem::Requirement
170
+ requirements:
171
+ - - ~>
172
+ - !ruby/object:Gem::Version
173
+ version: 4.1.6
174
+ type: :runtime
175
+ prerelease: false
176
+ version_requirements: !ruby/object:Gem::Requirement
177
+ requirements:
178
+ - - ~>
179
+ - !ruby/object:Gem::Version
180
+ version: 4.1.6
181
+ - !ruby/object:Gem::Dependency
182
+ name: activemodel
183
+ requirement: !ruby/object:Gem::Requirement
184
+ requirements:
185
+ - - ~>
186
+ - !ruby/object:Gem::Version
187
+ version: 4.1.6
188
+ type: :runtime
189
+ prerelease: false
190
+ version_requirements: !ruby/object:Gem::Requirement
191
+ requirements:
192
+ - - ~>
193
+ - !ruby/object:Gem::Version
194
+ version: 4.1.6
195
+ - !ruby/object:Gem::Dependency
196
+ name: activerecord
197
+ requirement: !ruby/object:Gem::Requirement
198
+ requirements:
199
+ - - ~>
200
+ - !ruby/object:Gem::Version
201
+ version: 4.1.0.beta1
202
+ type: :runtime
203
+ prerelease: false
204
+ version_requirements: !ruby/object:Gem::Requirement
205
+ requirements:
206
+ - - ~>
207
+ - !ruby/object:Gem::Version
208
+ version: 4.1.0.beta1
209
+ - !ruby/object:Gem::Dependency
210
+ name: sinatra
211
+ requirement: !ruby/object:Gem::Requirement
212
+ requirements:
213
+ - - ~>
214
+ - !ruby/object:Gem::Version
215
+ version: 1.4.4
216
+ type: :runtime
217
+ prerelease: false
218
+ version_requirements: !ruby/object:Gem::Requirement
219
+ requirements:
220
+ - - ~>
221
+ - !ruby/object:Gem::Version
222
+ version: 1.4.4
223
+ - !ruby/object:Gem::Dependency
224
+ name: sinatra-activerecord
225
+ requirement: !ruby/object:Gem::Requirement
226
+ requirements:
227
+ - - ~>
144
228
  - !ruby/object:Gem::Version
145
229
  version: 1.3.0
146
230
  type: :runtime
147
231
  prerelease: false
148
232
  version_requirements: !ruby/object:Gem::Requirement
149
233
  requirements:
150
- - - ! '>='
234
+ - - ~>
151
235
  - !ruby/object:Gem::Version
152
236
  version: 1.3.0
153
237
  - !ruby/object:Gem::Dependency
154
- name: ruby-filemagic
238
+ name: sinatra-contrib
155
239
  requirement: !ruby/object:Gem::Requirement
156
240
  requirements:
157
- - - ! '>='
241
+ - - ~>
158
242
  - !ruby/object:Gem::Version
159
- version: 0.4.2
243
+ version: 1.4.2
160
244
  type: :runtime
161
245
  prerelease: false
162
246
  version_requirements: !ruby/object:Gem::Requirement
163
247
  requirements:
164
- - - ! '>='
248
+ - - ~>
249
+ - !ruby/object:Gem::Version
250
+ version: 1.4.2
251
+ - !ruby/object:Gem::Dependency
252
+ name: namespace
253
+ requirement: !ruby/object:Gem::Requirement
254
+ requirements:
255
+ - - ~>
256
+ - !ruby/object:Gem::Version
257
+ version: '1.2'
258
+ type: :runtime
259
+ prerelease: false
260
+ version_requirements: !ruby/object:Gem::Requirement
261
+ requirements:
262
+ - - ~>
165
263
  - !ruby/object:Gem::Version
166
- version: 0.4.2
264
+ version: '1.2'
167
265
  - !ruby/object:Gem::Dependency
168
266
  name: net-dns
169
267
  requirement: !ruby/object:Gem::Requirement
170
268
  requirements:
171
- - - ! '>='
269
+ - - ~>
172
270
  - !ruby/object:Gem::Version
173
271
  version: 0.8.0
174
272
  type: :runtime
175
273
  prerelease: false
176
274
  version_requirements: !ruby/object:Gem::Requirement
177
275
  requirements:
178
- - - ! '>='
276
+ - - ~>
179
277
  - !ruby/object:Gem::Version
180
278
  version: 0.8.0
181
279
  - !ruby/object:Gem::Dependency
182
280
  name: geoip
183
281
  requirement: !ruby/object:Gem::Requirement
184
282
  requirements:
185
- - - ! '>='
283
+ - - ~>
186
284
  - !ruby/object:Gem::Version
187
- version: 1.2.1
285
+ version: 1.3.5
188
286
  type: :runtime
189
287
  prerelease: false
190
288
  version_requirements: !ruby/object:Gem::Requirement
191
289
  requirements:
192
- - - ! '>='
290
+ - - ~>
193
291
  - !ruby/object:Gem::Version
194
- version: 1.2.1
292
+ version: 1.3.5
195
293
  - !ruby/object:Gem::Dependency
196
- name: tmail
294
+ name: whois
197
295
  requirement: !ruby/object:Gem::Requirement
198
296
  requirements:
199
- - - ! '>='
297
+ - - ~>
200
298
  - !ruby/object:Gem::Version
201
- version: 1.2.7.1
299
+ version: 3.5.3
202
300
  type: :runtime
203
301
  prerelease: false
204
302
  version_requirements: !ruby/object:Gem::Requirement
205
303
  requirements:
206
- - - ! '>='
304
+ - - ~>
207
305
  - !ruby/object:Gem::Version
208
- version: 1.2.7.1
306
+ version: 3.5.3
209
307
  description: A malware/botnet analysis framework written in Ruby.
210
308
  email:
211
309
  - marco.riccardi@honeynet.it
212
310
  executables:
213
- - dorothy_start
214
- - dorothy_stop
215
- - dparser_start
216
- - dparser_stop
311
+ - dorothy2
217
312
  extensions: []
218
313
  extra_rdoc_files:
219
314
  - README.md
@@ -224,18 +319,13 @@ files:
224
319
  - LICENSE
225
320
  - README.md
226
321
  - Rakefile
227
- - TODO
228
322
  - UPDATE
229
- - bin/dorothy_start
230
- - bin/dorothy_stop
231
- - bin/dparser_start
232
- - bin/dparser_stop
323
+ - bin/dorothy2
233
324
  - dorothy2.gemspec
234
325
  - etc/ddl/dorothive.ddl
235
- - etc/dorothy copy.yml.example
236
- - etc/extensions.yml
237
326
  - etc/sandboxes.yml.example
238
327
  - etc/sources.yml.example
328
+ - lib/doroGUI.rb
239
329
  - lib/doroParser.rb
240
330
  - lib/dorothy2.rb
241
331
  - lib/dorothy2/BFM.rb
@@ -276,23 +366,33 @@ files:
276
366
  - lib/mu/xtractr/test/tc_xtractr.rb
277
367
  - lib/mu/xtractr/test/test.rb
278
368
  - lib/mu/xtractr/views.rb
369
+ - lib/www/public/reset.css
370
+ - lib/www/public/style.css
371
+ - lib/www/views/analyses.erb
372
+ - lib/www/views/email.erb
373
+ - lib/www/views/flows.erb
374
+ - lib/www/views/layout.erb
375
+ - lib/www/views/profile.erb
376
+ - lib/www/views/queue.erb
377
+ - lib/www/views/resume.erb
378
+ - lib/www/views/resume.erb~
379
+ - lib/www/views/samples.erb
380
+ - lib/www/views/upload.erb
279
381
  - share/img/Dorothy-Basic.pdf
280
382
  - share/img/Setup-Advanced.pdf
281
383
  - share/img/The_big_picture.pdf
282
- - share/update-dorothive.sql
283
384
  - test/tc_dorothy_full.rb
284
- - var/log/parser.log
285
385
  homepage: https://github.com/m4rco-/dorothy2
286
386
  licenses: []
287
387
  metadata: {}
288
- post_install_message: ! '\n WARING: If you are upgrating from a previous version,
289
- read the UPDATE file!\n'
388
+ post_install_message: ! '\n\n\n \t\t WARING: If you are upgrating from a previous
389
+ version, read the UPDATE file! \t\t\n\n\n'
290
390
  rdoc_options: []
291
391
  require_paths:
292
392
  - lib
293
393
  required_ruby_version: !ruby/object:Gem::Requirement
294
394
  requirements:
295
- - - ! '>='
395
+ - - ~>
296
396
  - !ruby/object:Gem::Version
297
397
  version: 1.9.3
298
398
  required_rubygems_version: !ruby/object:Gem::Requirement
@@ -302,10 +402,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
302
402
  version: '0'
303
403
  requirements: []
304
404
  rubyforge_project:
305
- rubygems_version: 2.1.10
405
+ rubygems_version: 2.2.2
306
406
  signing_key:
307
407
  specification_version: 4
308
408
  summary: More info at http://www.honeynet.it
309
409
  test_files:
310
410
  - test/tc_dorothy_full.rb
311
- has_rdoc:
data/TODO DELETED
@@ -1,27 +0,0 @@
1
- ##############
2
- #DOROTHY-TODO#
3
- ##############
4
-
5
- -PORT TO Ruby 2.0
6
- -WGUI
7
-
8
- #IMPROVE INSTALLATION PROCESS
9
- -Include pcapr-local installation 80%
10
-
11
- -ADD args from command line for recreating the baseline
12
-
13
-
14
- -BINARY STATIC ANALYSIS
15
- -ANALYZE SYSTEM CHANGES 50%
16
- -ListFileInGuest -> Create Files/Folder Baseline.
17
-
18
- -MANAGE SIG-INT WHILE MULTITHREAD
19
- -INTERACTIVE CONSOLE 90%
20
- -ADD VNC CLIENT SPAWN IN MANUAL MODE
21
-
22
- -REVIEW DOROTHIVE (binary fullpath?)
23
-
24
- -ADD EMAIL AS SOURCETYPE (use ruby mail gem for retrieving the emails, and parse them)
25
-
26
- -REPORT PLUGIN
27
- -REPORT - MAEC