mihari 3.6.0 → 3.6.1

data/lib/mihari/mixins/disallowed_data_value.rb

@@ -17,7 +17,7 @@ module Mihari
 
         # if a value is surrounded by slashes, take it as a regexp
         value_without_slashes = value[1..-2]
-        Regexp.compile value_without_slashes
+        Regexp.compile value_without_slashes.to_s
       end
 
       memoize :normalize_disallowed_data_value

data/lib/mihari/structs/onyphe.rb

@@ -6,7 +6,7 @@ module Mihari
     module Onyphe
       class Result < Dry::Struct
         attribute :asn, Types::String
-        attribute :country_code, Types::String
+        attribute :country_code, Types::String.optional
         attribute :ip, Types::String
 
         def self.from_dynamic!(d)
@@ -15,7 +15,7 @@ module Mihari
             asn: d.fetch("asn"),
             ip: d.fetch("ip"),
             # Onyphe's country = 2-letter country code
-            country_code: d.fetch("country")
+            country_code: d["country"]
           )
         end
       end

data/lib/mihari/type_checker.rb

@@ -18,12 +18,12 @@ module Mihari
       raise ArgumentError if data.is_a?(Hash)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def hash?
       md5? || sha1? || sha256? || sha512?
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def ip?
       IPAddr.new data
       true
@@ -31,7 +31,7 @@ module Mihari
       false
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def domain?
       uri = Addressable::URI.parse("http://#{data}")
       uri.host == data && PublicSuffix.valid?(uri.host)
@@ -39,7 +39,7 @@ module Mihari
       false
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def url?
       uri = Addressable::URI.parse(data)
       uri.scheme && uri.host && uri.path && PublicSuffix.valid?(uri.host)
@@ -47,7 +47,7 @@ module Mihari
       false
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def mail?
       EmailAddress.valid? data, host_validation: :syntax
     end
@@ -83,22 +83,22 @@ module Mihari
 
     private
 
-    # @return [true, false]
+    # @return [Boolean]
     def md5?
       data.match?(/^[A-Fa-f0-9]{32}$/)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def sha1?
       data.match?(/^[A-Fa-f0-9]{40}$/)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def sha256?
       data.match?(/^[A-Fa-f0-9]{64}$/)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def sha512?
       data.match?(/^[A-Fa-f0-9]{128}$/)
     end

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "3.6.0"
+  VERSION = "3.6.1"
 end

data/mihari.gemspec

@@ -37,6 +37,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rerun", "~> 0.13"
   spec.add_development_dependency "rspec", "~> 3.10"
   spec.add_development_dependency "standard", "~> 1.2"
+  spec.add_development_dependency "steep", "~> 0.45"
   spec.add_development_dependency "timecop", "~> 0.9"
   spec.add_development_dependency "vcr", "~> 6.0"
   spec.add_development_dependency "webmock", "~> 3.14"

data/sig/lib/mihari/analyzers/base.rbs

@@ -0,0 +1,99 @@
+module Mihari
+  module Analyzers
+    class Base
+      # extend Dry::Initializer
+
+      include Mixins::Configurable
+
+      include Mixins::Retriable
+
+      attr_accessor ignore_old_artifacts: bool
+
+      attr_accessor ignore_threshold: Integer
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      # @return [Array<String>, Array<Mihari::Artifact>]
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      # @return [String]
+      def title: () -> String
+
+      # @return [String]
+      def description: () -> String
+
+      # @return [String]
+      def source: () -> String
+
+      # @return [Array<String>]
+      def tags: () -> ::Array[String]
+
+      #
+      # Set artifacts & run emitters in parallel
+      #
+      # @return [nil]
+      #
+      def run: () -> void
+
+      #
+      # Run emitter
+      #
+      # @param [Mihari::Emitters::Base] emitter
+      #
+      # @return [nil]
+      #
+      def run_emitter: (untyped emitter) -> void
+
+      def self.inherited: (untyped child) -> untyped
+
+      #
+      # Normalize artifacts
+      # - Uniquefy artifacts by native #uniq
+      # - Convert data (string) into an artifact
+      # - Reject an invalid artifact
+      #
+      # @return [Array<Mihari::Artifact>]
+      #
+      def normalized_artifacts: () -> Array[Mihari::Artifact]
+
+      private
+
+      #
+      # Uniquefy artifacts
+      #
+      # @return [Array<Mihari::Artifact>]
+      #
+      def unique_artifacts: () -> Array[Mihari::Artifact]
+
+      #
+      # Enriched artifacts
+      #
+      # @return [Array<Mihari::Artifact>]
+      #
+      def enriched_artifacts: () -> Array[Mihari::Artifact]
+
+      #
+      # Set enriched artifacts
+      #
+      # @return [nil]
+      #
+      def set_enriched_artifacts: () -> void
+
+      #
+      # Select valid emitters
+      #
+      # @return [Array<Mihari::Emitters::Base>]
+      #
+      def valid_emitters: () -> Array[Mihari::Emitters::Base]
+
+      #
+      # Normalize ASN value
+      #
+      # @param [String, Integer] asn
+      #
+      # @return [Integer]
+      #
+      def normalize_asn: (String asn) -> Integer
+    end
+  end
+end

data/sig/lib/mihari/analyzers/basic.rbs

@@ -0,0 +1,17 @@
+module Mihari
+  module Analyzers
+    class Basic < Base
+      attr_reader title: String
+
+      attr_reader description: String
+
+      attr_reader artifacts: (Array[String] | Array[Mihari::Artifact])
+
+      attr_reader source: String
+
+      attr_reader tags: Array[String]?
+
+      def initialize: (title: String title, description: String description, artifacts: (Array[String] | Array[Mihari::Artifact]) artifacts, source: String source, ?tags: Array[String] tags) -> void
+    end
+  end
+end

data/sig/lib/mihari/analyzers/binaryedge.rbs

@@ -0,0 +1,25 @@
+module Mihari
+  module Analyzers
+    class BinaryEdge < Base
+
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      PAGE_SIZE: ::Integer
+
+      def search_with_page: (String query, ?page: ::Integer page) -> Hash[(String | Symbol), untyped]
+
+      def search: () -> Array[Hash[(String | Symbol), untyped]]
+
+      def configuration_keys: () -> ::Array["binaryedge_api_key"]
+
+      def api: () -> untyped
+    end
+  end
+end

data/sig/lib/mihari/analyzers/censys.rbs

@@ -0,0 +1,38 @@
+module Mihari
+  module Analyzers
+    class Censys < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def search: () -> Array[String]
+
+      #
+      # Extract IPv4s from Censys search API response
+      #
+      # @param [Structs::Censys::Response] response
+      #
+      # @return [Array<String>]
+      #
+      def response_to_artifacts: (Mihari::Structs::Censys::Response response) -> Array[String]
+
+      #
+      # Build an artifact from a Shodan search API response
+      #
+      # @param [Structs::Censys::Hit] hit
+      #
+      # @return [Artifact]
+      #
+      def build_artifact: (Mihari::Structs::Censys::Hit hit) -> Mihari::Artifact
+
+      def configuration_keys: () -> ::Array["censys_id" | "censys_secret"]
+
+      def api: () -> untyped
+    end
+  end
+end

data/sig/lib/mihari/analyzers/circl.rbs

@@ -0,0 +1,29 @@
+module Mihari
+  module Analyzers
+    class CIRCL < Base
+      include Mixins::Refang
+
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def configuration_keys: () -> ::Array["circl_passive_password" | "circl_passive_username"]
+
+      def api: () -> untyped
+
+      def search: () -> Array[String]
+
+      def passive_dns_search: () -> Array[String]
+
+      def passive_ssl_search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/crtsh.rbs

@@ -0,0 +1,19 @@
+module Mihari
+  module Analyzers
+    class Crtsh < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader exclude_expired: bool
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def api: () -> untyped
+
+      def search: () -> Array[Hash[(String | Symbol), untyped]]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/dnpedia.rbs

@@ -0,0 +1,18 @@
+module Mihari
+  module Analyzers
+    class DNPedia < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def api: () -> untyped
+
+      def search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/dnstwister.rbs

@@ -0,0 +1,27 @@
+module Mihari
+  module Analyzers
+    class DNSTwister < Base
+      include Mixins::Refang
+
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def valid_type?: () -> bool
+
+      def api: () -> untyped
+
+      def resolvable?: (String domain) -> bool
+
+      def search: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/analyzers/onyphe.rbs

@@ -0,0 +1,33 @@
+module Mihari
+  module Analyzers
+    class Onyphe < Base
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      PAGE_SIZE: ::Integer
+
+      def configuration_keys: () -> ::Array["onyphe_api_key"]
+
+      def api: () -> untyped
+
+      def search_with_page: (String query, ?page: ::Integer page) -> Mihari::Structs::Onyphe::Response
+
+      def search: () -> Array[Mihari::Structs::Onyphe::Response]
+
+      #
+      # Build an artifact from an Onyphe search API result
+      #
+      # @param [Structs::Onyphe::Result] result
+      #
+      # @return [Artifact]
+      #
+      def build_artifact: (Mihari::Structs::Onyphe::Result result) -> Mihari::Artifact
+    end
+  end
+end

data/sig/lib/mihari/analyzers/otx.rbs

@@ -0,0 +1,33 @@
+module Mihari
+  module Analyzers
+    class OTX < Base
+      include Mixins::Refang
+
+      attr_reader query: String
+      attr_reader title: String
+      attr_reader description: String
+      attr_reader tags: Array[String]
+      attr_reader type: String
+
+      def initialize: (*untyped args, **untyped kwargs) -> void
+
+      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
+
+      private
+
+      def configuration_keys: () -> ::Array["otx_api_key"]
+
+      def domain_client: () -> untyped
+
+      def ip_client: () -> untyped
+
+      def valid_type?: () -> bool
+
+      def search: () -> Array[String]
+
+      def domain_search: () -> Array[String]
+
+      def ip_search: () -> Array[String]
+    end
+  end
+end