mihari 3.4.1 → 3.7.0

data/lib/mihari/schemas/configuration.rb

@@ -13,6 +13,7 @@ module Mihari
       optional(:censys_secret).value(:string)
       optional(:circl_passive_password).value(:string)
       optional(:circl_passive_username).value(:string)
+      optional(:ipinfo_api_key).value(:string)
       optional(:misp_api_endpoint).value(:string)
       optional(:misp_api_key).value(:string)
       optional(:onyphe_api_key).value(:string)

data/lib/mihari/schemas/rule.rb

@@ -2,26 +2,13 @@
 
 require "dry/schema"
 require "dry/validation"
-require "dry/types"
 
 require "mihari/schemas/macros"
 
 module Mihari
-  module Types
-    include Dry.Types()
-  end
-
-  DataTypes = Types::String.enum(*ALLOWED_DATA_TYPES)
-
-  AnalyzerTypes = Types::String.enum(
-    "binaryedge", "censys", "circl", "dnpedia", "dnstwister",
-    "onyphe", "otx", "passivetotal", "pulsedive", "securitytrails",
-    "shodan", "virustotal"
-  )
-
   module Schemas
     Analyzer = Dry::Schema.Params do
-      required(:analyzer).value(AnalyzerTypes)
+      required(:analyzer).value(Types::AnalyzerTypes)
       required(:query).value(:string)
     end
 
@@ -62,7 +49,7 @@ module Mihari
 
       required(:queries).value(:array).each { Analyzer | Spyse | ZoomEye | Urlscan | Crtsh }
 
-      optional(:allowed_data_types).value(array[DataTypes]).default(ALLOWED_DATA_TYPES)
+      optional(:allowed_data_types).value(array[Types::DataTypes]).default(ALLOWED_DATA_TYPES)
       optional(:disallowed_data_values).value(array[:string]).default([])
 
       optional(:ignore_old_artifacts).value(:bool).default(false)

data/lib/mihari/serializers/alert.rb

@@ -3,10 +3,12 @@
 require "active_model_serializers"
 
 module Mihari
-  class AlertSerializer < ActiveModel::Serializer
-    attributes :id, :title, :description, :source, :created_at
+  module Serializers
+    class AlertSerializer < ActiveModel::Serializer
+      attributes :id, :title, :description, :source, :created_at
 
-    has_many :artifacts
-    has_many :tags, through: :taggings
+      has_many :artifacts, serializer: ArtifactSerializer
+      has_many :tags, through: :taggings, serializer: TagSerializer
+    end
   end
 end

data/lib/mihari/serializers/artifact.rb

@@ -3,7 +3,16 @@
 require "active_model_serializers"
 
 module Mihari
-  class ArtifactSerializer < ActiveModel::Serializer
-    attributes :id, :data, :data_type, :source
+  module Serializers
+    class ArtifactSerializer < ActiveModel::Serializer
+      attributes :id, :data, :data_type, :source
+
+      has_one :autonomous_system, serializer: AutonomousSystemSerializer
+      has_one :geolocation, serializer: GeolocationSerializer
+      has_one :whois_record, serializer: WhoisRecordSerializer
+
+      has_many :dns_records, serializer: DnsRecordSerializer
+      has_many :reverse_dns_names, serializer: ReverseDnsNameSerializer
+    end
   end
 end

data/lib/mihari/serializers/autonomous_system.rb

@@ -0,0 +1,9 @@
+require "active_model_serializers"
+
+module Mihari
+  module Serializers
+    class AutonomousSystemSerializer < ActiveModel::Serializer
+      attributes :asn
+    end
+  end
+end

data/lib/mihari/serializers/dns.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require "active_model_serializers"
+
+module Mihari
+  module Serializers
+    class DnsRecordSerializer < ActiveModel::Serializer
+      attributes :resource, :value
+    end
+  end
+end

data/lib/mihari/serializers/geolocation.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require "active_model_serializers"
+
+module Mihari
+  module Serializers
+    class GeolocationSerializer < ActiveModel::Serializer
+      attributes :country, :country_code
+    end
+  end
+end

data/lib/mihari/serializers/reverse_dns.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require "active_model_serializers"
+
+module Mihari
+  module Serializers
+    class ReverseDnsNameSerializer < ActiveModel::Serializer
+      attributes :name
+    end
+  end
+end

data/lib/mihari/serializers/tag.rb

@@ -3,7 +3,9 @@
 require "active_model_serializers"
 
 module Mihari
-  class TagSerializer < ActiveModel::Serializer
-    attributes :id, :name
+  module Serializers
+    class TagSerializer < ActiveModel::Serializer
+      attributes :id, :name
+    end
   end
 end

data/lib/mihari/serializers/whois.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require "active_model_serializers"
+
+module Mihari
+  module Serializers
+    class WhoisRecordSerializer < ActiveModel::Serializer
+      attributes :domain, :created_on, :updated_on, :expires_on, :registrar, :contacts
+    end
+  end
+end

data/lib/mihari/structs/censys.rb

@@ -0,0 +1,92 @@
+require "json"
+require "dry/struct"
+
+module Mihari
+  module Structs
+    module Censys
+      class AutonomousSystem < Dry::Struct
+        attribute :asn, Types::Int
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            asn: d.fetch("asn")
+          )
+        end
+      end
+
+      class Location < Dry::Struct
+        attribute :country, Types::String.optional
+        attribute :country_code, Types::String.optional
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            country: d["country"],
+            country_code: d["country_code"]
+          )
+        end
+      end
+
+      class Hit < Dry::Struct
+        attribute :ip, Types::String
+        attribute :location, Location
+        attribute :autonomous_system, AutonomousSystem
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            ip: d.fetch("ip"),
+            location: Location.from_dynamic!(d.fetch("location")),
+            autonomous_system: AutonomousSystem.from_dynamic!(d.fetch("autonomous_system"))
+          )
+        end
+      end
+
+      class Links < Dry::Struct
+        attribute :next, Types::String
+        attribute :prev, Types::String
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            next: d.fetch("next"),
+            prev: d.fetch("prev")
+          )
+        end
+      end
+
+      class Result < Dry::Struct
+        attribute :query, Types::String
+        attribute :total, Types::Int
+        attribute :hits, Types.Array(Hit)
+        attribute :links, Links
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            query: d.fetch("query"),
+            total: d.fetch("total"),
+            hits: d.fetch("hits", []).map { |x| Hit.from_dynamic!(x) },
+            links: Links.from_dynamic!(d.fetch("links"))
+          )
+        end
+      end
+
+      class Response < Dry::Struct
+        attribute :code, Types::Int
+        attribute :status, Types::String
+        attribute :result, Result
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            code: d.fetch("code"),
+            status: d.fetch("status"),
+            result: Result.from_dynamic!(d.fetch("result"))
+          )
+        end
+      end
+    end
+  end
+end

data/lib/mihari/structs/ipinfo.rb

@@ -0,0 +1,36 @@
+require "json"
+require "dry/struct"
+
+module Mihari
+  module Structs
+    module IPInfo
+      class Response < Dry::Struct
+        attribute :ip, Types::String
+        attribute :hostname, Types::String.optional
+        attribute :loc, Types::String
+        attribute :country_code, Types::String
+        attribute :asn, Types::Integer
+
+        class << self
+          include Mixins::AutonomousSystem
+
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+
+            org = d.fetch("org")
+            asn = org.split.first
+            asn = normalize_asn(asn)
+
+            new(
+              ip: d.fetch("ip"),
+              loc: d.fetch("loc"),
+              hostname: d["hostname"],
+              country_code: d.fetch("country"),
+              asn: asn
+            )
+          end
+      end
+      end
+    end
+  end
+end

data/lib/mihari/structs/onyphe.rb

@@ -0,0 +1,47 @@
+require "json"
+require "dry/struct"
+
+module Mihari
+  module Structs
+    module Onyphe
+      class Result < Dry::Struct
+        attribute :asn, Types::String
+        attribute :country_code, Types::String.optional
+        attribute :ip, Types::String
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            asn: d.fetch("asn"),
+            ip: d.fetch("ip"),
+            # Onyphe's country = 2-letter country code
+            country_code: d["country"]
+          )
+        end
+      end
+
+      class Response < Dry::Struct
+        attribute :count, Types::Int
+        attribute :error, Types::Int
+        attribute :max_page, Types::Int
+        attribute :page, Types::String
+        attribute :results, Types.Array(Result)
+        attribute :status, Types::String
+        attribute :total, Types::Int
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            count: d.fetch("count"),
+            error: d.fetch("error"),
+            max_page: d.fetch("max_page"),
+            page: d.fetch("page"),
+            results: d.fetch("results").map { |x| Result.from_dynamic!(x) },
+            status: d.fetch("status"),
+            total: d.fetch("total")
+          )
+        end
+      end
+    end
+  end
+end

data/lib/mihari/structs/shodan.rb

@@ -0,0 +1,53 @@
+require "json"
+require "dry/struct"
+
+module Mihari
+  module Structs
+    module Shodan
+      class Location < Dry::Struct
+        attribute :country_code, Types::String
+        attribute :country_name, Types::String
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            country_code: d.fetch("country_code"),
+            country_name: d.fetch("country_name")
+          )
+        end
+      end
+
+      class Match < Dry::Struct
+        attribute :asn, Types::String
+        attribute :hostnames, Types.Array(Types::String)
+        attribute :location, Location
+        attribute :domains, Types.Array(Types::String)
+        attribute :ip_str, Types::String
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            asn: d.fetch("asn"),
+            hostnames: d.fetch("hostnames"),
+            location: Location.from_dynamic!(d.fetch("location")),
+            domains: d.fetch("domains"),
+            ip_str: d.fetch("ip_str")
+          )
+        end
+      end
+
+      class Result < Dry::Struct
+        attribute :matches, Types.Array(Match)
+        attribute :total, Types::Int
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            matches: d.fetch("matches", []).map { |x| Match.from_dynamic!(x) },
+            total: d.fetch("total")
+          )
+        end
+      end
+    end
+  end
+end

data/lib/mihari/type_checker.rb

@@ -18,12 +18,12 @@ module Mihari
       raise ArgumentError if data.is_a?(Hash)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def hash?
       md5? || sha1? || sha256? || sha512?
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def ip?
       IPAddr.new data
       true
@@ -31,7 +31,7 @@ module Mihari
       false
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def domain?
       uri = Addressable::URI.parse("http://#{data}")
       uri.host == data && PublicSuffix.valid?(uri.host)
@@ -39,7 +39,7 @@ module Mihari
       false
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def url?
       uri = Addressable::URI.parse(data)
       uri.scheme && uri.host && uri.path && PublicSuffix.valid?(uri.host)
@@ -47,7 +47,7 @@ module Mihari
       false
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def mail?
       EmailAddress.valid? data, host_validation: :syntax
     end
@@ -83,22 +83,22 @@ module Mihari
 
     private
 
-    # @return [true, false]
+    # @return [Boolean]
     def md5?
       data.match?(/^[A-Fa-f0-9]{32}$/)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def sha1?
       data.match?(/^[A-Fa-f0-9]{40}$/)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def sha256?
       data.match?(/^[A-Fa-f0-9]{64}$/)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def sha512?
       data.match?(/^[A-Fa-f0-9]{128}$/)
     end