dorothy2 1.2.0 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. checksums.yaml +8 -8
  2. data/CHANGELOG +39 -14
  3. data/README.md +80 -62
  4. data/UPDATE +6 -14
  5. data/bin/dorothy2 +472 -0
  6. data/dorothy2.gemspec +22 -16
  7. data/etc/ddl/dorothive.ddl +619 -373
  8. data/etc/sources.yml.example +27 -2
  9. data/lib/doroGUI.rb +232 -0
  10. data/lib/doroParser.rb +34 -78
  11. data/lib/dorothy2.rb +288 -248
  12. data/lib/dorothy2/BFM.rb +114 -61
  13. data/lib/dorothy2/DEM.rb +3 -1
  14. data/lib/dorothy2/NAM.rb +2 -2
  15. data/lib/dorothy2/Settings.rb +2 -1
  16. data/lib/dorothy2/VSM.rb +2 -1
  17. data/lib/dorothy2/deep_symbolize.rb +2 -7
  18. data/lib/dorothy2/do-init.rb +286 -19
  19. data/lib/dorothy2/do-logger.rb +1 -1
  20. data/lib/dorothy2/do-utils.rb +382 -33
  21. data/lib/dorothy2/version.rb +1 -1
  22. data/lib/dorothy2/vtotal.rb +30 -20
  23. data/lib/mu/xtractr.rb +11 -11
  24. data/lib/mu/xtractr/stream.rb +1 -1
  25. data/lib/www/public/reset.css +153 -0
  26. data/lib/www/public/style.css +65 -0
  27. data/lib/www/views/analyses.erb +28 -0
  28. data/lib/www/views/email.erb +63 -0
  29. data/lib/www/views/flows.erb +30 -0
  30. data/lib/www/views/layout.erb +27 -0
  31. data/lib/www/views/profile.erb +49 -0
  32. data/lib/www/views/queue.erb +28 -0
  33. data/lib/www/views/resume.erb +135 -0
  34. data/lib/www/views/resume.erb~ +88 -0
  35. data/lib/www/views/samples.erb +20 -0
  36. data/lib/www/views/upload.erb +154 -0
  37. data/share/img/The_big_picture.pdf +0 -0
  38. data/test/tc_dorothy_full.rb +3 -0
  39. metadata +169 -70
  40. data/TODO +0 -27
  41. data/bin/dorothy_start +0 -225
  42. data/bin/dorothy_stop +0 -28
  43. data/bin/dparser_start +0 -94
  44. data/bin/dparser_stop +0 -31
  45. data/etc/dorothy copy.yml.example +0 -39
  46. data/etc/extensions.yml +0 -41
  47. data/share/update-dorothive.sql +0 -19
data/test/tc_dorothy_full.rb CHANGED
@@ -4,6 +4,9 @@ require 'dorothy2' #comment for testing/developmnet
4
4
 
5
5
  #load '../lib/dorothy2.rb'
6
6
 
7
+
8
+ #Those tests have not been ported to the latest version of dorothy2. They wont work. #TODO: fix this
9
+
7
10
  include Dorothy
8
11
 
9
12
  LOGGER = DoroLogger.new(STDOUT, "weekly")
metadata CHANGED
@@ -1,85 +1,85 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: dorothy2
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.2.0
4
+ version: 2.0.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - marco riccardi
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2013-12-01 00:00:00.000000000 Z
11
+ date: 2014-10-26 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: net-scp
15
15
  requirement: !ruby/object:Gem::Requirement
16
16
  requirements:
17
- - - ! '>='
17
+ - - ~>
18
18
  - !ruby/object:Gem::Version
19
- version: 1.0.4
19
+ version: 1.1.2
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
- - - ! '>='
24
+ - - ~>
25
25
  - !ruby/object:Gem::Version
26
- version: 1.0.4
26
+ version: 1.1.2
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: net-ssh
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
- - - ! '>='
31
+ - - ~>
32
32
  - !ruby/object:Gem::Version
33
- version: 2.2.1
33
+ version: 2.7.0
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
- - - ! '>='
38
+ - - ~>
39
39
  - !ruby/object:Gem::Version
40
- version: 2.2.1
40
+ version: 2.7.0
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: trollop
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
- - - ! '>='
45
+ - - ~>
46
46
  - !ruby/object:Gem::Version
47
- version: 1.16.2
47
+ version: '2.0'
48
48
  type: :runtime
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
- - - ! '>='
52
+ - - ~>
53
53
  - !ruby/object:Gem::Version
54
- version: 1.16.2
54
+ version: '2.0'
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: rest-client
57
57
  requirement: !ruby/object:Gem::Requirement
58
58
  requirements:
59
- - - ! '>='
59
+ - - ~>
60
60
  - !ruby/object:Gem::Version
61
- version: 1.6.1
61
+ version: 1.6.7
62
62
  type: :runtime
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
- - - ! '>='
66
+ - - ~>
67
67
  - !ruby/object:Gem::Version
68
- version: 1.6.1
68
+ version: 1.6.7
69
69
  - !ruby/object:Gem::Dependency
70
- name: mime-types
70
+ name: mail
71
71
  requirement: !ruby/object:Gem::Requirement
72
72
  requirements:
73
- - - ! '>='
73
+ - - ~>
74
74
  - !ruby/object:Gem::Version
75
- version: '1.16'
75
+ version: 2.5.4
76
76
  type: :runtime
77
77
  prerelease: false
78
78
  version_requirements: !ruby/object:Gem::Requirement
79
79
  requirements:
80
- - - ! '>='
80
+ - - ~>
81
81
  - !ruby/object:Gem::Version
82
- version: '1.16'
82
+ version: 2.5.4
83
83
  - !ruby/object:Gem::Dependency
84
84
  name: colored
85
85
  requirement: !ruby/object:Gem::Requirement
@@ -95,125 +95,220 @@ dependencies:
95
95
  - !ruby/object:Gem::Version
96
96
  version: '1.2'
97
97
  - !ruby/object:Gem::Dependency
98
- name: ruby-pg
98
+ name: pg
99
99
  requirement: !ruby/object:Gem::Requirement
100
100
  requirements:
101
101
  - - ! '>='
102
102
  - !ruby/object:Gem::Version
103
- version: 0.7.9.2008.01.28
103
+ version: 0.8.0
104
104
  type: :runtime
105
105
  prerelease: false
106
106
  version_requirements: !ruby/object:Gem::Requirement
107
107
  requirements:
108
108
  - - ! '>='
109
109
  - !ruby/object:Gem::Version
110
- version: 0.7.9.2008.01.28
110
+ version: 0.8.0
111
111
  - !ruby/object:Gem::Dependency
112
- name: virustotal
112
+ name: nokogiri
113
113
  requirement: !ruby/object:Gem::Requirement
114
114
  requirements:
115
- - - ! '>='
115
+ - - ~>
116
116
  - !ruby/object:Gem::Version
117
- version: 2.0.0
117
+ version: 1.5.11
118
118
  type: :runtime
119
119
  prerelease: false
120
120
  version_requirements: !ruby/object:Gem::Requirement
121
121
  requirements:
122
- - - ! '>='
122
+ - - ~>
123
123
  - !ruby/object:Gem::Version
124
- version: 2.0.0
124
+ version: 1.5.11
125
125
  - !ruby/object:Gem::Dependency
126
- name: nokogiri
126
+ name: uirusu
127
127
  requirement: !ruby/object:Gem::Requirement
128
128
  requirements:
129
129
  - - ~>
130
130
  - !ruby/object:Gem::Version
131
- version: 1.5.10
131
+ version: 0.0.6
132
132
  type: :runtime
133
133
  prerelease: false
134
134
  version_requirements: !ruby/object:Gem::Requirement
135
135
  requirements:
136
136
  - - ~>
137
137
  - !ruby/object:Gem::Version
138
- version: 1.5.10
138
+ version: 0.0.6
139
139
  - !ruby/object:Gem::Dependency
140
140
  name: rbvmomi
141
141
  requirement: !ruby/object:Gem::Requirement
142
142
  requirements:
143
- - - ! '>='
143
+ - - ~>
144
+ - !ruby/object:Gem::Version
145
+ version: 1.6.0
146
+ type: :runtime
147
+ prerelease: false
148
+ version_requirements: !ruby/object:Gem::Requirement
149
+ requirements:
150
+ - - ~>
151
+ - !ruby/object:Gem::Version
152
+ version: 1.6.0
153
+ - !ruby/object:Gem::Dependency
154
+ name: ruby-filemagic
155
+ requirement: !ruby/object:Gem::Requirement
156
+ requirements:
157
+ - - ~>
158
+ - !ruby/object:Gem::Version
159
+ version: 0.5.0
160
+ type: :runtime
161
+ prerelease: false
162
+ version_requirements: !ruby/object:Gem::Requirement
163
+ requirements:
164
+ - - ~>
165
+ - !ruby/object:Gem::Version
166
+ version: 0.5.0
167
+ - !ruby/object:Gem::Dependency
168
+ name: activesupport
169
+ requirement: !ruby/object:Gem::Requirement
170
+ requirements:
171
+ - - ~>
172
+ - !ruby/object:Gem::Version
173
+ version: 4.1.6
174
+ type: :runtime
175
+ prerelease: false
176
+ version_requirements: !ruby/object:Gem::Requirement
177
+ requirements:
178
+ - - ~>
179
+ - !ruby/object:Gem::Version
180
+ version: 4.1.6
181
+ - !ruby/object:Gem::Dependency
182
+ name: activemodel
183
+ requirement: !ruby/object:Gem::Requirement
184
+ requirements:
185
+ - - ~>
186
+ - !ruby/object:Gem::Version
187
+ version: 4.1.6
188
+ type: :runtime
189
+ prerelease: false
190
+ version_requirements: !ruby/object:Gem::Requirement
191
+ requirements:
192
+ - - ~>
193
+ - !ruby/object:Gem::Version
194
+ version: 4.1.6
195
+ - !ruby/object:Gem::Dependency
196
+ name: activerecord
197
+ requirement: !ruby/object:Gem::Requirement
198
+ requirements:
199
+ - - ~>
200
+ - !ruby/object:Gem::Version
201
+ version: 4.1.0.beta1
202
+ type: :runtime
203
+ prerelease: false
204
+ version_requirements: !ruby/object:Gem::Requirement
205
+ requirements:
206
+ - - ~>
207
+ - !ruby/object:Gem::Version
208
+ version: 4.1.0.beta1
209
+ - !ruby/object:Gem::Dependency
210
+ name: sinatra
211
+ requirement: !ruby/object:Gem::Requirement
212
+ requirements:
213
+ - - ~>
214
+ - !ruby/object:Gem::Version
215
+ version: 1.4.4
216
+ type: :runtime
217
+ prerelease: false
218
+ version_requirements: !ruby/object:Gem::Requirement
219
+ requirements:
220
+ - - ~>
221
+ - !ruby/object:Gem::Version
222
+ version: 1.4.4
223
+ - !ruby/object:Gem::Dependency
224
+ name: sinatra-activerecord
225
+ requirement: !ruby/object:Gem::Requirement
226
+ requirements:
227
+ - - ~>
144
228
  - !ruby/object:Gem::Version
145
229
  version: 1.3.0
146
230
  type: :runtime
147
231
  prerelease: false
148
232
  version_requirements: !ruby/object:Gem::Requirement
149
233
  requirements:
150
- - - ! '>='
234
+ - - ~>
151
235
  - !ruby/object:Gem::Version
152
236
  version: 1.3.0
153
237
  - !ruby/object:Gem::Dependency
154
- name: ruby-filemagic
238
+ name: sinatra-contrib
155
239
  requirement: !ruby/object:Gem::Requirement
156
240
  requirements:
157
- - - ! '>='
241
+ - - ~>
158
242
  - !ruby/object:Gem::Version
159
- version: 0.4.2
243
+ version: 1.4.2
160
244
  type: :runtime
161
245
  prerelease: false
162
246
  version_requirements: !ruby/object:Gem::Requirement
163
247
  requirements:
164
- - - ! '>='
248
+ - - ~>
249
+ - !ruby/object:Gem::Version
250
+ version: 1.4.2
251
+ - !ruby/object:Gem::Dependency
252
+ name: namespace
253
+ requirement: !ruby/object:Gem::Requirement
254
+ requirements:
255
+ - - ~>
256
+ - !ruby/object:Gem::Version
257
+ version: '1.2'
258
+ type: :runtime
259
+ prerelease: false
260
+ version_requirements: !ruby/object:Gem::Requirement
261
+ requirements:
262
+ - - ~>
165
263
  - !ruby/object:Gem::Version
166
- version: 0.4.2
264
+ version: '1.2'
167
265
  - !ruby/object:Gem::Dependency
168
266
  name: net-dns
169
267
  requirement: !ruby/object:Gem::Requirement
170
268
  requirements:
171
- - - ! '>='
269
+ - - ~>
172
270
  - !ruby/object:Gem::Version
173
271
  version: 0.8.0
174
272
  type: :runtime
175
273
  prerelease: false
176
274
  version_requirements: !ruby/object:Gem::Requirement
177
275
  requirements:
178
- - - ! '>='
276
+ - - ~>
179
277
  - !ruby/object:Gem::Version
180
278
  version: 0.8.0
181
279
  - !ruby/object:Gem::Dependency
182
280
  name: geoip
183
281
  requirement: !ruby/object:Gem::Requirement
184
282
  requirements:
185
- - - ! '>='
283
+ - - ~>
186
284
  - !ruby/object:Gem::Version
187
- version: 1.2.1
285
+ version: 1.3.5
188
286
  type: :runtime
189
287
  prerelease: false
190
288
  version_requirements: !ruby/object:Gem::Requirement
191
289
  requirements:
192
- - - ! '>='
290
+ - - ~>
193
291
  - !ruby/object:Gem::Version
194
- version: 1.2.1
292
+ version: 1.3.5
195
293
  - !ruby/object:Gem::Dependency
196
- name: tmail
294
+ name: whois
197
295
  requirement: !ruby/object:Gem::Requirement
198
296
  requirements:
199
- - - ! '>='
297
+ - - ~>
200
298
  - !ruby/object:Gem::Version
201
- version: 1.2.7.1
299
+ version: 3.5.3
202
300
  type: :runtime
203
301
  prerelease: false
204
302
  version_requirements: !ruby/object:Gem::Requirement
205
303
  requirements:
206
- - - ! '>='
304
+ - - ~>
207
305
  - !ruby/object:Gem::Version
208
- version: 1.2.7.1
306
+ version: 3.5.3
209
307
  description: A malware/botnet analysis framework written in Ruby.
210
308
  email:
211
309
  - marco.riccardi@honeynet.it
212
310
  executables:
213
- - dorothy_start
214
- - dorothy_stop
215
- - dparser_start
216
- - dparser_stop
311
+ - dorothy2
217
312
  extensions: []
218
313
  extra_rdoc_files:
219
314
  - README.md
@@ -224,18 +319,13 @@ files:
224
319
  - LICENSE
225
320
  - README.md
226
321
  - Rakefile
227
- - TODO
228
322
  - UPDATE
229
- - bin/dorothy_start
230
- - bin/dorothy_stop
231
- - bin/dparser_start
232
- - bin/dparser_stop
323
+ - bin/dorothy2
233
324
  - dorothy2.gemspec
234
325
  - etc/ddl/dorothive.ddl
235
- - etc/dorothy copy.yml.example
236
- - etc/extensions.yml
237
326
  - etc/sandboxes.yml.example
238
327
  - etc/sources.yml.example
328
+ - lib/doroGUI.rb
239
329
  - lib/doroParser.rb
240
330
  - lib/dorothy2.rb
241
331
  - lib/dorothy2/BFM.rb
@@ -276,23 +366,33 @@ files:
276
366
  - lib/mu/xtractr/test/tc_xtractr.rb
277
367
  - lib/mu/xtractr/test/test.rb
278
368
  - lib/mu/xtractr/views.rb
369
+ - lib/www/public/reset.css
370
+ - lib/www/public/style.css
371
+ - lib/www/views/analyses.erb
372
+ - lib/www/views/email.erb
373
+ - lib/www/views/flows.erb
374
+ - lib/www/views/layout.erb
375
+ - lib/www/views/profile.erb
376
+ - lib/www/views/queue.erb
377
+ - lib/www/views/resume.erb
378
+ - lib/www/views/resume.erb~
379
+ - lib/www/views/samples.erb
380
+ - lib/www/views/upload.erb
279
381
  - share/img/Dorothy-Basic.pdf
280
382
  - share/img/Setup-Advanced.pdf
281
383
  - share/img/The_big_picture.pdf
282
- - share/update-dorothive.sql
283
384
  - test/tc_dorothy_full.rb
284
- - var/log/parser.log
285
385
  homepage: https://github.com/m4rco-/dorothy2
286
386
  licenses: []
287
387
  metadata: {}
288
- post_install_message: ! '\n WARING: If you are upgrating from a previous version,
289
- read the UPDATE file!\n'
388
+ post_install_message: ! '\n\n\n \t\t WARING: If you are upgrating from a previous
389
+ version, read the UPDATE file! \t\t\n\n\n'
290
390
  rdoc_options: []
291
391
  require_paths:
292
392
  - lib
293
393
  required_ruby_version: !ruby/object:Gem::Requirement
294
394
  requirements:
295
- - - ! '>='
395
+ - - ~>
296
396
  - !ruby/object:Gem::Version
297
397
  version: 1.9.3
298
398
  required_rubygems_version: !ruby/object:Gem::Requirement
@@ -302,10 +402,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
302
402
  version: '0'
303
403
  requirements: []
304
404
  rubyforge_project:
305
- rubygems_version: 2.1.10
405
+ rubygems_version: 2.2.2
306
406
  signing_key:
307
407
  specification_version: 4
308
408
  summary: More info at http://www.honeynet.it
309
409
  test_files:
310
410
  - test/tc_dorothy_full.rb
311
- has_rdoc:
data/TODO DELETED
@@ -1,27 +0,0 @@
1
- ##############
2
- #DOROTHY-TODO#
3
- ##############
4
-
5
- -PORT TO Ruby 2.0
6
- -WGUI
7
-
8
- #IMPROVE INSTALLATION PROCESS
9
- -Include pcapr-local installation 80%
10
-
11
- -ADD args from command line for recreating the baseline
12
-
13
-
14
- -BINARY STATIC ANALYSIS
15
- -ANALYZE SYSTEM CHANGES 50%
16
- -ListFileInGuest -> Create Files/Folder Baseline.
17
-
18
- -MANAGE SIG-INT WHILE MULTITHREAD
19
- -INTERACTIVE CONSOLE 90%
20
- -ADD VNC CLIENT SPAWN IN MANUAL MODE
21
-
22
- -REVIEW DOROTHIVE (binary fullpath?)
23
-
24
- -ADD EMAIL AS SOURCETYPE (use ruby mail gem for retrieving the emails, and parse them)
25
-
26
- -REPORT PLUGIN
27
- -REPORT - MAEC