mihari 3.4.1 → 3.7.0

data/sig/lib/mihari/analyzers/dnpedia.rbs

@@ -0,0 +1,18 @@
+module Mihari
+  module Analyzers
+    class DNPedia < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def api: () -> untyped
+
+      def search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/dnstwister.rbs

@@ -0,0 +1,27 @@
+module Mihari
+  module Analyzers
+    class DNSTwister < Base
+      include Mixins::Refang
+
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def valid_type?: () -> bool
+
+      def api: () -> untyped
+
+      def resolvable?: (String domain) -> bool
+
+      def search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/onyphe.rbs

@@ -0,0 +1,33 @@
+module Mihari
+  module Analyzers
+    class Onyphe < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      PAGE_SIZE: ::Integer
+
+      def configuration_keys: () -> ::Array["onyphe_api_key"]
+
+      def api: () -> untyped
+
+      def search_with_page: (String query, ?page: ::Integer page) -> Mihari::Structs::Onyphe::Response
+
+      def search: () -> Array[Mihari::Structs::Onyphe::Response]
+
+      #
+      # Build an artifact from an Onyphe search API result
+      #
+      # @param [Structs::Onyphe::Result] result
+      #
+      # @return [Artifact]
+      #
+      def build_artifact: (Mihari::Structs::Onyphe::Result result) -> Mihari::Artifact
+    end
+  end
+end

data/sig/lib/mihari/analyzers/otx.rbs

@@ -0,0 +1,33 @@
+module Mihari
+  module Analyzers
+    class OTX < Base
+      include Mixins::Refang
+
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def configuration_keys: () -> ::Array["otx_api_key"]
+
+      def domain_client: () -> untyped
+
+      def ip_client: () -> untyped
+
+      def valid_type?: () -> bool
+
+      def search: () -> Array[String]
+
+      def domain_search: () -> Array[String]
+
+      def ip_search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/passivetotal.rbs

@@ -0,0 +1,33 @@
+module Mihari
+  module Analyzers
+    class PassiveTotal < Base
+      include Mixins::Refang
+
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def configuration_keys: () -> ::Array["passivetotal_username" | "passivetotal_api_key"]
+
+      def api: () -> untyped
+
+      def valid_type?: () -> bool
+
+      def search: () -> Array[String]
+
+      def passive_dns_search: () -> Array[String]
+
+      def reverse_whois_search: () -> Array[String]
+
+      def ssl_search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/pulsedive.rbs

@@ -0,0 +1,27 @@
+module Mihari
+  module Analyzers
+    class Pulsedive < Base
+      include Mixins::Refang
+
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def configuration_keys: () -> ::Array["pulsedive_api_key"]
+
+      def api: () -> untyped
+
+      def valid_type?: () -> bool
+
+      def search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/rule.rbs

@@ -0,0 +1,68 @@
+module Mihari
+  module Analyzers
+    class Rule < Base
+      include Mihari::Mixins::DisallowedDataValue
+
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader queries: Hash[(String | Symbol), untyped]
+      attr_reader tags: Array[String]
+      attr_reader allowed_data_types: Array[String]
+      attr_reader disallowed_data_values: Array[String]
+      attr_reader source: String
+      attr_reader id: String?
+
+      def initialize: (**untyped kwargs) -> void
+
+      ANALYZER_TO_CLASS: Hash[String, singleton(Mihari::Analyzers::Base)]
+
+      #
+      # Returns a list of artifacts matched with queries
+      #
+      # @return [Array<Mihari::Artifact>]
+      #
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      #
+      # Normalize artifacts
+      # - Uniquefy artifacts by #uniq(&:data)
+      # - Reject an invalid artifact (for just in case)
+      # - Select artifacts with allowed data types
+      # - Reject artifacts with disallowed data values
+      #
+      # @return [Array<Mihari::Artifact>]
+      #
+      def normalized_artifacts: () -> untyped
+
+      #
+      # Normalized disallowed data values
+      #
+      # @return [Array<Regexp, String>]
+      #
+      def normalized_disallowed_data_values: () -> untyped
+
+      #
+      # Check whether a value is a disallowed data value or not
+      #
+      # @return [Boolean]
+      #
+      def disallowed_data_value?: (untyped value) -> untyped
+
+      private
+
+      #
+      # Get analyzer class
+      #
+      # @param [String] analyzer_name
+      #
+      # @return [Class<Mihari::Analyzers::Base>] analyzer class
+      #
+      def get_analyzer_class: (untyped analyzer_name) -> untyped
+
+      #
+      # Validate configuration of analyzers
+      #
+      def validate_analyzer_configurations: () -> untyped
+    end
+  end
+end

data/sig/lib/mihari/analyzers/securitytrails.rbs

@@ -0,0 +1,33 @@
+module Mihari
+  module Analyzers
+    class SecurityTrails < Base
+      include Mixins::Refang
+
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def configuration_keys: () -> ::Array["securitytrails_api_key"]
+
+      def api: () -> untyped
+
+      def valid_type?: () -> bool
+
+      def search: () -> Array[String]
+
+      def domain_search: () -> Array[String]
+
+      def ip_search: () -> Array[String]
+
+      def mail_search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/shodan.rbs

@@ -0,0 +1,33 @@
+module Mihari
+  module Analyzers
+    class Shodan < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      PAGE_SIZE: ::Integer
+
+      def configuration_keys: () -> ::Array["shodan_api_key"]
+
+      def api: () -> untyped
+
+      def search_with_page: (String query, ?page: ::Integer page) -> Hash[(String | Symbol), untyped]
+
+      def search: () -> Array[Hash[(String | Symbol), untyped]]
+
+      #
+      # Build an artifact from a Shodan search API response
+      #
+      # @param [Structs::Shodan::Match] match
+      #
+      # @return [Artifact]
+      #
+      def build_artifact: (Mihari::Structs::Shodan::Match match) -> Mihari::Artifact
+    end
+  end
+end

data/sig/lib/mihari/analyzers/spyse.rbs

@@ -0,0 +1,29 @@
+module Mihari
+  module Analyzers
+    class Spyse < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def search_params: () -> Hash[(String | Symbol), untyped]
+
+      def configuration_keys: () -> ::Array["spyse_api_key"]
+
+      def api: () -> untyped
+
+      def valid_type?: () -> bool
+
+      def domain_search: () -> Array[String]
+
+      def ip_search: () -> Array[String]
+
+      def search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/urlscan.rbs

@@ -0,0 +1,28 @@
+SUPPORTED_DATA_TYPES: untyped
+
+module Mihari
+  module Analyzers
+    class Urlscan < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader allowed_data_types: Array[String]
+      attr_reader use_similarity: bool
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def configuration_keys: () -> ::Array["urlscan_api_key"]
+
+      def api: () -> untyped
+
+      def search: () -> Array[Hash[(String | Symbol), untyped]]
+
+      def valid_alllowed_data_types?: () -> bool
+    end
+  end
+end

data/sig/lib/mihari/analyzers/virustotal.rbs

@@ -0,0 +1,31 @@
+module Mihari
+  module Analyzers
+    class VirusTotal < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      include Mixins::Refang
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def configuration_keys: () -> ::Array["virustotal_api_key"]
+
+      def api: () -> untyped
+
+      def valid_type?: () -> bool
+
+      def search: () -> Array[String]
+
+      def domain_search: () -> Array[String]
+
+      def ip_search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/zoomeye.rbs

@@ -0,0 +1,33 @@
+module Mihari
+  module Analyzers
+    class ZoomEye < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      PAGE_SIZE: ::Integer
+
+      def valid_type?: () -> bool
+
+      def configuration_keys: () -> ::Array["zoomeye_api_key"]
+
+      def api: () -> untyped
+
+      def convert_responses: (Array[Hash[(String | Symbol), untyped]] responses) -> Array[String]
+
+      def _host_search: (String query, ?page: ::Integer page) -> (Hash[(String | Symbol), untyped] | nil)
+
+      def host_search: () -> Array[String]
+
+      def _web_search: (String query, ?page: ::Integer page) -> (Hash[(String | Symbol), untyped] | nil)
+
+      def web_search: () -> Array[String]
+    end
+  end
+end