mihari 4.7.0 → 4.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '091892853042ab3f1010c89b943eb2a885370da2d619016f3f3cd9dcb59e80cf'
-  data.tar.gz: 119ccbb407a49c741a4bf6c7cfafc7cd99855c3af950af9d0f1dc3735fc24672
+  metadata.gz: 38f68ec091b2469095f321f104c1e238599c56afa7f55763920cfeef0df03ca0
+  data.tar.gz: 625bbd99f92e4af768b76db15ab72cd53dba6a04150acc3ddfe7feb7d1a82bf7
 SHA512:
-  metadata.gz: 5364837634a6cde1b370db5613e745f05b40bf7321a5b7fcc4a2c7d32b1d395fa45e4472ef2a5f9f28d664f0b45e31d0554acec7bb641a21ce179ebf70bf9317
-  data.tar.gz: 57ca2f920db2da9e8c9a10f59aa81984dff0a81f0073ba839c351f3fe5e7979358ce44d87f48adcffd7df1bf7268bab178fec82731f72d62c24aa9ce04eed026
+  metadata.gz: fe847e37658ede26d1910e8c73ee1726e2b32335571e03c97c891b2d799380397ed1d32de7e4ed31ae57c861b4a6aa74433454d4871e38e2137100ce342894a1
+  data.tar.gz: 688c3adcf6ebb754d02b0fecde033602b47fe23ae11fffaff329ce53b93c268ab274319fdb630c819163856ce9708f2658bfe6fe7790e54ab1488e8d2af90245

data/lib/mihari/analyzers/clients/otx.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Analyzers
+    module Clients
+      class OTX
+        attr_reader :api_key
+
+        def initialize(api_key)
+          @api_key = api_key
+        end
+
+        def query_by_ip(ip)
+          get "https://otx.alienvault.com/api/v1/indicators/IPv4/#{ip}/passive_dns"
+        end
+
+        def query_by_domain(domain)
+          get "https://otx.alienvault.com/api/v1/indicators/domain/#{domain}/passive_dns"
+        end
+
+        private
+
+        def headers
+          { "x-otx-api-key": api_key }
+        end
+
+        def get(url)
+          res = HTTP.get(url, headers: headers)
+          JSON.parse(res.body.to_s)
+        rescue HTTPError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/mihari/analyzers/otx.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "otx_ruby"
+require "mihari/analyzers/clients/otx"
 
 module Mihari
   module Analyzers
@@ -34,12 +34,8 @@ module Mihari
         %w[otx_api_key]
       end
 
-      def domain_client
-        @domain_client ||= ::OTX::Domain.new(api_key)
-      end
-
-      def ip_client
-        @ip_client ||= ::OTX::IP.new(api_key)
+      def client
+        @client ||= Mihari::Analyzers::Clients::OTX.new(api_key)
       end
 
       #
@@ -73,9 +69,15 @@ module Mihari
       # @return [Array<String>]
       #
       def domain_search
-        records = domain_client.get_passive_dns(query)
+        res = client.query_by_domain(query)
+        return [] if res.nil?
+
+        records = res["passive_dns"] || []
         records.filter_map do |record|
-          record.address if record.record_type == "A"
+          record_type = record["record_type"]
+          address = record["address"]
+
+          address if record_type == "A"
         end.uniq
       end
 
@@ -85,9 +87,15 @@ module Mihari
       # @return [Array<String>]
       #
       def ip_search
-        records = ip_client.get_passive_dns(query)
+        res = client.query_by_ip(query)
+        return [] if res.nil?
+
+        records = res["passive_dns"] || []
         records.filter_map do |record|
-          record.hostname if record.record_type == "A"
+          record_type = record["record_type"]
+          hostname = record["hostname"]
+
+          hostname if record_type == "A"
         end.uniq
       end
     end

data/lib/mihari/structs/rule.rb

@@ -169,6 +169,7 @@ module Mihari
           #
           def from_model(model)
             data = model.data.deep_symbolize_keys
+            # set ID if YAML data do not have ID
             data[:id] = model.id unless data.key?(:id)
 
             Structs::Rule::Rule.new(data, model.yaml)
@@ -178,9 +179,13 @@ module Mihari
           # @param [String] yaml
           #
           # @return [Mihari::Structs::Rule::Rule]
+          # @param [String, nil] id
           #
-          def from_yaml(yaml)
+          def from_yaml(yaml, id: nil)
             data = load_erb_yaml(yaml)
+            # set ID if id is given & YAML data do not have ID
+            data[:id] = id if !id.nil? && !data.key?(:id)
+
             Structs::Rule::Rule.new(data, yaml)
           end
         end

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "4.7.0"
+  VERSION = "4.7.1"
 end

data/lib/mihari/web/endpoints/rules.rb

@@ -144,8 +144,7 @@ module Mihari
             error!({ message: "ID:#{id} is not found" }, 404)
           end
 
-          rule = Structs::Rule::Rule.from_yaml(yaml)
-          rule.id = id
+          rule = Structs::Rule::Rule.from_yaml(yaml, id: id)
 
           begin
             rule.validate!

data/mihari.gemspec

@@ -76,7 +76,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency "net-ping", "2.0.8"
   spec.add_dependency "normalize_country", "0.3.2"
   spec.add_dependency "onyphe", "2.0.0"
-  spec.add_dependency "otx_ruby", "0.9.9"
   spec.add_dependency "parallel", "1.22.1"
   spec.add_dependency "passive_circl", "0.1.0"
   spec.add_dependency "passivetotalx", "0.1.1"
@@ -93,7 +92,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "shodanx", "0.2.1"
   spec.add_dependency "slack-notifier", "2.4.0"
   spec.add_dependency "spysex", "0.2.0"
-  spec.add_dependency "sqlite3", "1.4.2"
+  spec.add_dependency "sqlite3", "1.4.4"
   spec.add_dependency "thor", "1.2.1"
   spec.add_dependency "urlscan", "0.8.0"
   spec.add_dependency "uuidtools", "2.2.0"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mihari
 version: !ruby/object:Gem::Version
-  version: 4.7.0
+  version: 4.7.1
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-06-05 00:00:00.000000000 Z
+date: 2022-06-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -682,20 +682,6 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 2.0.0
-- !ruby/object:Gem::Dependency
-  name: otx_ruby
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.9.9
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.9.9
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -926,14 +912,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.4.2
+        version: 1.4.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.4.2
+        version: 1.4.4
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
@@ -1074,6 +1060,7 @@ files:
 - lib/mihari/analyzers/binaryedge.rb
 - lib/mihari/analyzers/censys.rb
 - lib/mihari/analyzers/circl.rb
+- lib/mihari/analyzers/clients/otx.rb
 - lib/mihari/analyzers/crtsh.rb
 - lib/mihari/analyzers/dnpedia.rb
 - lib/mihari/analyzers/dnstwister.rb