mihari 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 487e9fb5b564d2f9edfdd225c5188dd8505e282a106ffd6434c159f1a05bf6b5
-  data.tar.gz: 2149a69537d25d65cd7a036190351d0d89e8bf5a6fe99f79076f8328445f21b1
+  metadata.gz: 288de64c354401afb06966aeff20d8cbf16ad7c2fa7ba16fe3caffc473885a48
+  data.tar.gz: 70416695adc834d0cb3b52410fa9665a163708d2be6e3544dde41f821e37e88b
 SHA512:
-  metadata.gz: 437dc50a254afd8a0f444224665a47fab6bd0314ad403df2f83f2bca719ac5172064348306146e97647e41b7bb87502845e4459480660500763f8fe63126c4ed
-  data.tar.gz: 704c26e0a0a62e7481bb185a6e0af2823dcf528bb49224ab6620215b66f7bec082d8fa52aa1d0d093470fb5b1e0a2afe6f81c25e181071eb73fede734b144106
+  metadata.gz: a6042c43edc0817d926683694ed98decc52d35b3177b312bd36d2573b818a99add3a3a8317ae08f5a7172249422335f266595382828428fde7e5ea7017205407
+  data.tar.gz: 51135d5070b5f1697e0a51495de13b2e34c4e1eea2f91989ea2ae5301e65d851f52e7a963edaa7d5480f83ef720f893de404ee32ee30c458353fa9a9b1ef392b

data/README.md

@@ -39,15 +39,17 @@ mihari supports Censys, Shodan, Onyphe, urlscan and VirusTotal by default.
 ```bash
 $ mihari
 Commands:
-  mihari alerts                  # Show the alerts on TheHive
-  mihari censys [QUERY]          # Censys IPv4 lookup by a given query
-  mihari help [COMMAND]          # Describe available commands or one specific command
-  mihari import_from_json        # Give a JSON input via STDIN
-  mihari onyphe [QUERY]          # Onyphe datascan lookup by a given query
-  mihari shodan [QUERY]          # Shodan host lookup by a given query
-  mihari status                  # Show the current configuration status
-  mihari urlscan [QUERY]         # urlscan lookup by a given query
-  mihari virustotal [IP|DOMAIN]  # VirusTotal resolutions lookup by a given ip or domain
+  mihari alerts                      # Show the alerts on TheHive
+  mihari censys [QUERY]              # Censys IPv4 lookup by a given query
+  mihari crtsh [QUERY]               # crt.sh lookup by a given query
+  mihari help [COMMAND]              # Describe available commands or one specific command
+  mihari import_from_json            # Give a JSON input via STDIN
+  mihari onyphe [QUERY]              # Onyphe datascan lookup by a given query
+  mihari securitytrails [IP|DOMAIN]  # SecurityTrails resolutions lookup by a given ip or domain
+  mihari shodan [QUERY]              # Shodan host lookup by a given query
+  mihari status                      # Show the current configuration status
+  mihari urlscan [QUERY]             # urlscan lookup by a given query
+  mihari virustotal [IP|DOMAIN]      # VirusTotal resolutions lookup by a given ip or domain
 
 ```
 
@@ -79,17 +81,18 @@ The input is a JSON data should have `title`, `description` and `artifacts` key.
 
 All configuration is done via ENV variables.
 
-| Key                  | Desc.              | Required or optional           |
-|----------------------|--------------------|--------------------------------|
-| THEHIVE_API_ENDPOINT | TheHive URL        | Required                       |
-| THEHIVE_API_KEY      | TheHive API key    | Required                       |
-| SLACK_WEBHOOK_URL    | Slack Webhook URL  | Optional                       |
-| SLACK_CHANNEL        | Slack channel name | Optional (default: `#general`) |
-| CENSYS_ID            | Censys API ID      | Optional                       |
-| CENSYS_SECRET        | Censys secret      | Optional                       |
-| SHODAN_API_KEY       | Shodan API key     | Optional                       |
-| ONYPHE_API_KEY       | Onyphe API key     | Optional                       |
-| VIRUSTOTAL_API_KEY   | VirusTotal API key | Optional                       |
+| Key                    | Desc.                  | Required or optional           |
+|------------------------|------------------------|--------------------------------|
+| THEHIVE_API_ENDPOINT   | TheHive URL            | Required                       |
+| THEHIVE_API_KEY        | TheHive API key        | Required                       |
+| SLACK_WEBHOOK_URL      | Slack Webhook URL      | Optional                       |
+| SLACK_CHANNEL          | Slack channel name     | Optional (default: `#general`) |
+| CENSYS_ID              | Censys API ID          | Optional                       |
+| CENSYS_SECRET          | Censys secret          | Optional                       |
+| ONYPHE_API_KEY         | Onyphe API key         | Optional                       |
+| SECURITYTRAILS_API_KEY | SecurityTrails API key | Optional                       |
+| SHODAN_API_KEY         | Shodan API key         | Optional                       |
+| VIRUSTOTAL_API_KEY     | VirusTotal API key     | Optional                       |
 
 ## How to create a custom analyzer
 

data/lib/mihari.rb

@@ -28,7 +28,9 @@ require "mihari/the_hive"
 require "mihari/analyzers/base"
 require "mihari/analyzers/basic"
 require "mihari/analyzers/censys"
+require "mihari/analyzers/crtsh"
 require "mihari/analyzers/onyphe"
+require "mihari/analyzers/securitytrails"
 require "mihari/analyzers/shodan"
 require "mihari/analyzers/urlscan"
 require "mihari/analyzers/virustotal"

data/lib/mihari/analyzers/crtsh.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "crtsh"
+
+module Mihari
+  module Analyzers
+    class Crtsh < Base
+      attr_reader :api
+      attr_reader :title
+      attr_reader :description
+      attr_reader :query
+      attr_reader :tags
+
+      def initialize(query, title: nil, description: nil, tags: [])
+        super()
+
+        @api = ::Crtsh::API.new
+        @query = query
+        @title = title || "crt.sh lookup"
+        @description = description || "query = #{query}"
+        @tags = tags
+      end
+
+      def artifacts
+        results = search
+        results.map { |result| result.dig("name_value") }.compact.uniq
+      end
+
+      private
+
+      def search
+        api.search(query)
+      rescue ::Crtsh::Error => _e
+        []
+      end
+    end
+  end
+end

data/lib/mihari/analyzers/securitytrails.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "securitytrails"
+
+module Mihari
+  module Analyzers
+    class SecurityTrails < Base
+      attr_reader :api
+      attr_reader :indicator
+      attr_reader :type
+
+      attr_reader :title
+      attr_reader :description
+      attr_reader :tags
+
+      def initialize(indicator, title: nil, description: nil, tags: [])
+        super()
+
+        @api = ::SecurityTrails::API.new
+        @indicator = indicator
+        @type = TypeChecker.type(indicator)
+
+        @title = title || "SecurityTrails lookup"
+        @description = description || "indicator = #{indicator}"
+        @tags = tags
+      end
+
+      def artifacts
+        lookup || []
+      end
+
+      private
+
+      def valid_type?
+        %w(ip domain).include? type
+      end
+
+      def lookup
+        case type
+        when "domain"
+          domain_lookup
+        when "ip"
+          ip_lookup
+        else
+          raise ArgumentError, "#{indicator}(type: #{type || 'unknown'}) is not supported." unless valid_type?
+        end
+      rescue ::SecurityTrails::Error => _e
+        nil
+      end
+
+      def domain_lookup
+        result = api.history.get_all_dns_history(indicator, "a").to_h
+        records = result.dig(:records) || []
+        records.map do |record|
+          values = record.dig(:values) || []
+          values.map { |value| value.dig(:ip) }
+        end.compact.flatten.uniq
+      end
+
+      def ip_lookup
+        result = api.domains.search( filter: { ipv4: indicator }).to_h
+        records = result.dig(:records) || []
+        records.map do |record|
+          record.dig(:hostname)
+        end.compact.uniq
+      end
+    end
+  end
+end

data/lib/mihari/cli.rb

@@ -56,6 +56,26 @@ module Mihari
       end
     end
 
+    desc "securitytrails [IP|DOMAIN]", "SecurityTrails resolutions lookup by a given ip or domain"
+    method_option :title, type: :string, desc: "title"
+    method_option :description, type: :string, desc: "description"
+    method_option :tags, type: :array, desc: "tags"
+    def securitytrails(indiactor)
+      with_error_handling do
+        run_analyzer Analyzers::SecurityTrails, query: indiactor, options: options
+      end
+    end
+
+    desc "crtsh [QUERY]", "crt.sh lookup by a given query"
+    method_option :title, type: :string, desc: "title"
+    method_option :description, type: :string, desc: "description"
+    method_option :tags, type: :array, desc: "tags"
+    def crtsh(query)
+      with_error_handling do
+        run_analyzer Analyzers::Crtsh, query: query, options: options
+      end
+    end
+
     desc "import_from_json", "Give a JSON input via STDIN"
     def import_from_json(input = nil)
       with_error_handling do

data/lib/mihari/status.rb

@@ -4,12 +4,13 @@ module Mihari
   class Status
     def check
       {
-        shodan: { status: shodan?, message: shodan },
-        slack: { status: slack?, message: slack },
         censys: { status: censys?, message: censys },
-        virustotal: { status: virustotal?, message: virustotal },
         onyphe: { status: onyphe?, message: onyphe },
+        securitytrails: { status: securitytrails?, message: securitytrails },
+        shodan: { status: shodan?, message: shodan },
+        slack: { status: slack?, message: slack },
         the_hive: { status: the_hive?, message: the_hive },
+        virustotal: { status: virustotal?, message: virustotal },
       }.map do |key, value|
         [key, convert(value)]
       end.to_h
@@ -28,6 +29,14 @@ module Mihari
       }
     end
 
+    def securitytrails?
+      ENV.key? "SECURITYTRAILS_API_KEY"
+    end
+
+    def securitytrails
+      securitytrails? ? "SECURITYTRAILS_API_KEY is found" : "SECURITYTRAILS_API_KEY is missing"
+    end
+
     def virustotal?
       ENV.key?("VIRUSTOTAL_API_KEY")
     end

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "0.6.0"
+  VERSION = "0.7.0"
 end

data/mihari.gemspec

@@ -33,12 +33,14 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "addressable", "~> 2.7"
   spec.add_dependency "censu", "~> 0.2"
+  spec.add_dependency "crtsh-rb", "~> 0.1"
   spec.add_dependency "email_address", "~> 0.1"
   spec.add_dependency "hachi", "~> 0.2"
   spec.add_dependency "mem", "~> 0.1"
   spec.add_dependency "net-ping", "~> 2.0"
   spec.add_dependency "onyphe", "~> 0.2"
   spec.add_dependency "public_suffix", "~> 3.1"
+  spec.add_dependency "securitytrails", "~> 0.2"
   spec.add_dependency "shodanx", "~> 0.1"
   spec.add_dependency "slack-notifier", "~> 2.3"
   spec.add_dependency "thor", "~> 0.20"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mihari
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-09-01 00:00:00.000000000 Z
+date: 2019-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -122,6 +122,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.2'
+- !ruby/object:Gem::Dependency
+  name: crtsh-rb
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
 - !ruby/object:Gem::Dependency
   name: email_address
   requirement: !ruby/object:Gem::Requirement
@@ -206,6 +220,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.1'
+- !ruby/object:Gem::Dependency
+  name: securitytrails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: shodanx
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +329,9 @@ files:
 - lib/mihari/analyzers/base.rb
 - lib/mihari/analyzers/basic.rb
 - lib/mihari/analyzers/censys.rb
+- lib/mihari/analyzers/crtsh.rb
 - lib/mihari/analyzers/onyphe.rb
+- lib/mihari/analyzers/securitytrails.rb
 - lib/mihari/analyzers/shodan.rb
 - lib/mihari/analyzers/urlscan.rb
 - lib/mihari/analyzers/virustotal.rb