mihari 2.4.0 → 3.2.0

data/.rubocop.yml

@@ -1,161 +0,0 @@
-# Relaxed.Ruby.Style
-## Version 2.5
-
-require:
-  - rubocop-performance
-
-AllCops:
-  NewCops: enable
-
-Style/Alias:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylealias
-
-Style/AsciiComments:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styleasciicomments
-
-Style/BeginBlock:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylebeginblock
-
-Style/BlockDelimiters:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styleblockdelimiters
-
-Style/CommentAnnotation:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylecommentannotation
-
-Style/Documentation:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styledocumentation
-
-Layout/DotPosition:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#layoutdotposition
-
-Style/DoubleNegation:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styledoublenegation
-
-Style/EndBlock:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styleendblock
-
-Style/FormatString:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styleformatstring
-
-Style/IfUnlessModifier:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styleifunlessmodifier
-
-Style/Lambda:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylelambda
-
-Style/ModuleFunction:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylemodulefunction
-
-Style/MultilineBlockChain:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylemultilineblockchain
-
-Style/NegatedIf:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylenegatedif
-
-Style/NegatedWhile:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylenegatedwhile
-
-Style/NumericPredicate:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylenumericpredicate
-
-Style/ParallelAssignment:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styleparallelassignment
-
-Style/PercentLiteralDelimiters:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylepercentliteraldelimiters
-
-Style/PerlBackrefs:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styleperlbackrefs
-
-Style/Semicolon:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylesemicolon
-
-Style/SignalException:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylesignalexception
-
-Style/SingleLineBlockParams:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylesinglelineblockparams
-
-Style/SingleLineMethods:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylesinglelinemethods
-
-Layout/SpaceBeforeBlockBraces:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#layoutspacebeforeblockbraces
-
-Layout/SpaceInsideParens:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#layoutspaceinsideparens
-
-Style/SpecialGlobalVars:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylespecialglobalvars
-
-Style/StringLiterals:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylestringliterals
-
-Style/TrailingCommaInArguments:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styletrailingcommainarguments
-
-Style/TrailingCommaInArrayLiteral:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styletrailingcommainarrayliteral
-
-Style/TrailingCommaInHashLiteral:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#styletrailingcommainhashliteral
-
-Style/SymbolArray:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylesymbolarray
-
-Style/WhileUntilModifier:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylewhileuntilmodifier
-
-Style/WordArray:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#stylewordarray
-
-Lint/AmbiguousRegexpLiteral:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#lintambiguousregexpliteral
-
-Lint/AssignmentInCondition:
-  Enabled: false
-  StyleGuide: https://relaxed.ruby.style/#lintassignmentincondition
-
-Layout/LineLength:
-  Enabled: false
-
-Style/StringLiteralsInInterpolation:
-  Enabled: false
-
-Metrics:
-  Enabled: false

data/lib/mihari/analyzers/free_text.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-require "parallel"
-
-module Mihari
-  module Analyzers
-    class FreeText < Base
-      attr_reader :query, :title, :description, :tags
-
-      ANALYZERS = [
-        Mihari::Analyzers::BinaryEdge,
-        Mihari::Analyzers::Censys
-      ].freeze
-
-      def initialize(query, title: nil, description: nil, tags: [])
-        super()
-
-        @query = query
-
-        @title = title || "Free text cross search"
-        @description = description || "query = #{query}"
-        @tags = tags
-      end
-
-      def artifacts
-        Parallel.map(analyzers) do |analyzer|
-          run_analyzer analyzer
-        end.flatten
-      end
-
-      private
-
-      def analyzers
-        ANALYZERS.map do |klass|
-          klass.new(query)
-        end
-      end
-
-      def run_analyzer(analyzer)
-        analyzer.artifacts
-      rescue ArgumentError, InvalidInputError => _e
-        nil
-      rescue ::BinaryEdge::Error, ::Censys::Error => _e
-        nil
-      end
-    end
-  end
-end

data/lib/mihari/analyzers/http_hash.rb

@@ -1,100 +0,0 @@
-# frozen_string_literal: true
-
-require "parallel"
-
-module Mihari
-  module Analyzers
-    class HTTPHash < Base
-      attr_reader :md5, :sha256, :mmh3, :html, :title, :description, :tags
-
-      def initialize(_query, md5: nil, sha256: nil, mmh3: nil, html: nil, title: nil, description: nil, tags: [])
-        super()
-
-        @md5 = md5
-        @sha256 = sha256
-        @mmh3 = mmh3
-
-        @html = html
-        load_from_html
-
-        @title = title || "HTTP hash cross search"
-        @description = description || "query = #{query}"
-        @tags = tags
-      end
-
-      def artifacts
-        Parallel.map(analyzers) do |analyzer|
-          run_analyzer analyzer
-        end.flatten
-      end
-
-      private
-
-      def valid_query?
-        [md5, sha256, mmh3].compact.any?
-      end
-
-      def load_from_html
-        return unless html
-
-        html_file = HTML.new(html)
-        return unless html_file.exists?
-
-        @md5 = html_file.md5
-        @sha256 = html_file.sha256
-        @mmh3 = html_file.mmh3
-      end
-
-      def query
-        [
-          md5 ? "md5:#{md5}" : nil,
-          sha256 ? "sha256:#{sha256}" : nil,
-          mmh3 ? "mmh3:#{mmh3}" : nil
-        ].compact.join(",")
-      end
-
-      def binary_edge
-        return nil unless sha256
-
-        BinaryEdge.new sha256
-      end
-
-      def censys
-        return nil unless sha256
-
-        Censys.new sha256
-      end
-
-      def onyphe
-        return nil unless md5
-
-        Onyphe.new "app.http.bodymd5:#{md5}"
-      end
-
-      def shodan
-        return nil unless mmh3
-
-        Shodan.new "http.html_hash:#{mmh3}"
-      end
-
-      def analyzers
-        raise InvalidInputError, "No hashes are given." unless valid_query?
-
-        [
-          binary_edge,
-          censys,
-          onyphe,
-          shodan
-        ].compact
-      end
-
-      def run_analyzer(analyzer)
-        analyzer.artifacts
-      rescue ArgumentError, InvalidInputError => _e
-        nil
-      rescue ::BinaryEdge::Error, ::Censys::ResponseError, ::Onyphe::Error, ::Shodan::Error => _e
-        nil
-      end
-    end
-  end
-end

data/lib/mihari/analyzers/passive_dns.rb

@@ -1,59 +0,0 @@
-# frozen_string_literal: true
-
-require "parallel"
-
-module Mihari
-  module Analyzers
-    class PassiveDNS < Base
-      attr_reader :query, :type, :title, :description, :tags
-
-      ANALYZERS = [
-        Mihari::Analyzers::CIRCL,
-        Mihari::Analyzers::OTX,
-        Mihari::Analyzers::PassiveTotal,
-        Mihari::Analyzers::Pulsedive,
-        Mihari::Analyzers::SecurityTrails,
-        Mihari::Analyzers::VirusTotal
-      ].freeze
-
-      def initialize(query, title: nil, description: nil, tags: [])
-        super()
-
-        @query = query
-        @type = TypeChecker.type(query)
-
-        @title = title || "PassiveDNS cross search"
-        @description = description || "query = #{query}"
-        @tags = tags
-      end
-
-      def artifacts
-        Parallel.map(analyzers) do |analyzer|
-          run_analyzer analyzer
-        end.flatten
-      end
-
-      private
-
-      def valid_type?
-        %w[ip domain].include? type
-      end
-
-      def analyzers
-        raise InvalidInputError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type?
-
-        ANALYZERS.map do |klass|
-          klass.new(query)
-        end
-      end
-
-      def run_analyzer(analyzer)
-        analyzer.artifacts
-      rescue ArgumentError, InvalidInputError => _e
-        nil
-      rescue Faraday::Error, ::PassiveCIRCL::Error, ::PassiveTotal::Error, ::Pulsedive::ResponseError, ::SecurityTrails::Error, ::VirusTotal::Error => _e
-        nil
-      end
-    end
-  end
-end

data/lib/mihari/analyzers/passive_ssl.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-
-require "parallel"
-
-module Mihari
-  module Analyzers
-    class PassiveSSL < Base
-      attr_reader :query, :type, :title, :description, :tags
-
-      ANALYZERS = [
-        Mihari::Analyzers::CIRCL,
-        Mihari::Analyzers::PassiveTotal
-      ].freeze
-
-      def initialize(query, title: nil, description: nil, tags: [])
-        super()
-
-        @query = query
-        @type = TypeChecker.detailed_type(query)
-
-        @title = title || "PassiveSSL cross search"
-        @description = description || "query = #{query}"
-        @tags = tags
-      end
-
-      def artifacts
-        Parallel.map(analyzers) do |analyzer|
-          run_analyzer analyzer
-        end.flatten
-      end
-
-      private
-
-      def valid_type?
-        %w[sha1].include? type
-      end
-
-      def analyzers
-        raise InvalidInputError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type?
-
-        ANALYZERS.map do |klass|
-          klass.new(query)
-        end
-      end
-
-      def run_analyzer(analyzer)
-        analyzer.artifacts
-      rescue ArgumentError, InvalidInputError => _e
-        nil
-      rescue ::PassiveCIRCL::Error, ::PassiveTotal::Error => _e
-        nil
-      end
-    end
-  end
-end

data/lib/mihari/analyzers/reverse_whois.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-
-require "parallel"
-
-module Mihari
-  module Analyzers
-    class ReveseWhois < Base
-      attr_reader :query, :type, :title, :description, :tags
-
-      ANALYZERS = [
-        Mihari::Analyzers::PassiveTotal,
-        Mihari::Analyzers::SecurityTrails
-      ].freeze
-
-      def initialize(query, title: nil, description: nil, tags: [])
-        super()
-
-        @query = query
-        @type = TypeChecker.type(query)
-
-        @title = title || "ReveseWhois cross search"
-        @description = description || "query = #{query}"
-        @tags = tags
-      end
-
-      def artifacts
-        Parallel.map(analyzers) do |analyzer|
-          run_analyzer analyzer
-        end.flatten
-      end
-
-      private
-
-      def valid_type?
-        %w[mail].include? type
-      end
-
-      def analyzers
-        raise InvalidInputError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type?
-
-        ANALYZERS.map do |klass|
-          klass.new(query)
-        end
-      end
-
-      def run_analyzer(analyzer)
-        analyzer.artifacts
-      rescue ArgumentError, InvalidInputError => _e
-        nil
-      rescue ::PassiveTotal::Error, ::SecurityTrails::Error => _e
-        nil
-      end
-    end
-  end
-end