mihari 5.2.0 → 5.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.rubocop.yml +2 -0
- data/lib/mihari/analyzers/base.rb +20 -115
- data/lib/mihari/analyzers/censys.rb +20 -2
- data/lib/mihari/analyzers/onyphe.rb +1 -1
- data/lib/mihari/analyzers/rule.rb +116 -60
- data/lib/mihari/analyzers/shodan.rb +1 -1
- data/lib/mihari/analyzers/urlscan.rb +6 -9
- data/lib/mihari/analyzers/virustotal_intelligence.rb +1 -5
- data/lib/mihari/cli/main.rb +2 -2
- data/lib/mihari/commands/search.rb +69 -0
- data/lib/mihari/commands/web.rb +9 -2
- data/lib/mihari/mixins/error_notification.rb +0 -2
- data/lib/mihari/models/artifact.rb +1 -1
- data/lib/mihari/schemas/rule.rb +2 -17
- data/lib/mihari/structs/censys.rb +167 -11
- data/lib/mihari/structs/config.rb +28 -0
- data/lib/mihari/structs/google_public_dns.rb +39 -1
- data/lib/mihari/structs/greynoise.rb +93 -6
- data/lib/mihari/structs/ipinfo.rb +40 -0
- data/lib/mihari/structs/onyphe.rb +88 -6
- data/lib/mihari/structs/rule.rb +4 -2
- data/lib/mihari/structs/shodan.rb +138 -4
- data/lib/mihari/structs/urlscan.rb +98 -1
- data/lib/mihari/structs/virustotal_intelligence.rb +96 -1
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/app.rb +2 -2
- data/lib/mihari/web/public/assets/index-cbe1734c.js +50 -0
- data/lib/mihari/web/public/assets/index-eed1bcd8.css +5 -0
- data/lib/mihari/web/public/index.html +2 -2
- data/lib/mihari.rb +1 -0
- data/mihari.gemspec +13 -12
- metadata +41 -42
- data/.github/ISSUE_TEMPLATE/bug_report.md +0 -43
- data/.github/ISSUE_TEMPLATE/feature_request.md +0 -15
- data/.github/workflows/test.yml +0 -90
- data/config/pre_commit.yml +0 -3
- data/docker/Dockerfile +0 -14
- data/examples/ipinfo_hosted_domains.rb +0 -45
- data/images/Tines-Full_Logo-Tines_Black.png +0 -0
- data/images/alert.png +0 -0
- data/images/logo.png +0 -0
- data/images/misp.png +0 -0
- data/images/overview.jpg +0 -0
- data/images/slack.png +0 -0
- data/images/tines.png +0 -0
- data/images/web_alerts.png +0 -0
- data/images/web_config.png +0 -0
- data/lib/mihari/commands/searcher.rb +0 -61
- data/lib/mihari/web/public/assets/index-9948ee35.js +0 -50
- data/lib/mihari/web/public/assets/index-d88cc3f1.css +0 -5
|
@@ -6,8 +6,8 @@
|
|
|
6
6
|
<meta name="viewport" content="width=device-width,initial-scale=1.0" />
|
|
7
7
|
<link rel="icon" href="/favicon.ico" />
|
|
8
8
|
<title>Mihari</title>
|
|
9
|
-
<script type="module" crossorigin src="/assets/index-
|
|
10
|
-
<link rel="stylesheet" href="/assets/index-
|
|
9
|
+
<script type="module" crossorigin src="/assets/index-cbe1734c.js"></script>
|
|
10
|
+
<link rel="stylesheet" href="/assets/index-eed1bcd8.css">
|
|
11
11
|
</head>
|
|
12
12
|
<body>
|
|
13
13
|
<noscript>
|
data/lib/mihari.rb
CHANGED
data/mihari.gemspec
CHANGED
|
@@ -26,7 +26,7 @@ Gem::Specification.new do |spec|
|
|
|
26
26
|
# Specify which files should be added to the gem when it is released.
|
|
27
27
|
# The `git ls-files -z` loads the files in the RubyGem that have been added into git.
|
|
28
28
|
spec.files = Dir.chdir(File.expand_path(__dir__)) do
|
|
29
|
-
`git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
|
|
29
|
+
`git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features|images|docker|.github)/}) }
|
|
30
30
|
end
|
|
31
31
|
spec.bindir = "exe"
|
|
32
32
|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
|
@@ -37,33 +37,34 @@ Gem::Specification.new do |spec|
|
|
|
37
37
|
spec.add_development_dependency "fakefs", "~> 2.4"
|
|
38
38
|
spec.add_development_dependency "fuubar", "~> 2.5"
|
|
39
39
|
spec.add_development_dependency "mysql2", "~> 0.5"
|
|
40
|
-
spec.add_development_dependency "pg", "~> 1.
|
|
40
|
+
spec.add_development_dependency "pg", "~> 1.5"
|
|
41
41
|
spec.add_development_dependency "rack-test", "~> 2.1"
|
|
42
42
|
spec.add_development_dependency "rake", "~> 13.0"
|
|
43
43
|
spec.add_development_dependency "rb-fsevent", "~> 0.11"
|
|
44
44
|
spec.add_development_dependency "rerun", "~> 0.14"
|
|
45
45
|
spec.add_development_dependency "rspec", "~> 3.12"
|
|
46
46
|
spec.add_development_dependency "simplecov-lcov", "~> 0.8.0"
|
|
47
|
-
spec.add_development_dependency "standard", "~> 1.
|
|
47
|
+
spec.add_development_dependency "standard", "~> 1.28"
|
|
48
48
|
spec.add_development_dependency "timecop", "~> 0.9"
|
|
49
49
|
spec.add_development_dependency "vcr", "~> 6.1"
|
|
50
50
|
spec.add_development_dependency "webmock", "~> 3.18"
|
|
51
51
|
|
|
52
52
|
unless ci_env?
|
|
53
53
|
spec.add_development_dependency "overcommit", "~> 0.60"
|
|
54
|
-
spec.add_development_dependency "ruby-lsp", "~> 0.
|
|
55
|
-
spec.add_development_dependency "
|
|
54
|
+
spec.add_development_dependency "ruby-lsp", "~> 0.5"
|
|
55
|
+
spec.add_development_dependency "solargraph", "~> 0.49"
|
|
56
|
+
spec.add_development_dependency "steep", "~> 1.4"
|
|
56
57
|
end
|
|
57
58
|
|
|
58
59
|
spec.add_dependency "activerecord", "7.0.4.3"
|
|
59
|
-
spec.add_dependency "addressable", "2.8.
|
|
60
|
+
spec.add_dependency "addressable", "2.8.4"
|
|
60
61
|
spec.add_dependency "awrence", "2.0.1"
|
|
61
62
|
spec.add_dependency "dotenv", "2.8.1"
|
|
62
63
|
spec.add_dependency "dry-configurable", "1.0.1"
|
|
63
64
|
spec.add_dependency "dry-container", "0.11.0"
|
|
64
65
|
spec.add_dependency "dry-files", "1.0.1"
|
|
65
66
|
spec.add_dependency "dry-initializer", "3.1.1"
|
|
66
|
-
spec.add_dependency "dry-schema", "1.13.
|
|
67
|
+
spec.add_dependency "dry-schema", "1.13.1"
|
|
67
68
|
spec.add_dependency "dry-struct", "1.6.0"
|
|
68
69
|
spec.add_dependency "dry-validation", "1.10.0"
|
|
69
70
|
spec.add_dependency "email_address", "0.2.4"
|
|
@@ -77,18 +78,18 @@ Gem::Specification.new do |spec|
|
|
|
77
78
|
spec.add_dependency "memist", "2.0.2"
|
|
78
79
|
spec.add_dependency "net-ping", "2.0.8"
|
|
79
80
|
spec.add_dependency "normalize_country", "0.3.2"
|
|
80
|
-
spec.add_dependency "parallel", "1.
|
|
81
|
+
spec.add_dependency "parallel", "1.23.0"
|
|
81
82
|
spec.add_dependency "plissken", "2.0.1"
|
|
82
83
|
spec.add_dependency "public_suffix", "5.0.1"
|
|
83
|
-
spec.add_dependency "puma", "6.
|
|
84
|
+
spec.add_dependency "puma", "6.2.2"
|
|
84
85
|
spec.add_dependency "rack", "3.0.7"
|
|
85
86
|
spec.add_dependency "rack-cors", "2.0.1"
|
|
86
87
|
spec.add_dependency "rackup", "2.1.0"
|
|
87
88
|
spec.add_dependency "semantic_logger", "4.13.0"
|
|
88
|
-
spec.add_dependency "sentry-ruby", "5.
|
|
89
|
+
spec.add_dependency "sentry-ruby", "5.9.0"
|
|
89
90
|
spec.add_dependency "slack-notifier", "2.4.0"
|
|
90
|
-
spec.add_dependency "sqlite3", "1.6.
|
|
91
|
-
spec.add_dependency "thor", "1.2.
|
|
91
|
+
spec.add_dependency "sqlite3", "1.6.3"
|
|
92
|
+
spec.add_dependency "thor", "1.2.2"
|
|
92
93
|
spec.add_dependency "uuidtools", "2.2.0"
|
|
93
94
|
spec.add_dependency "whois", "5.1.0"
|
|
94
95
|
spec.add_dependency "whois-parser", "2.0.0"
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: mihari
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 5.2.
|
|
4
|
+
version: 5.2.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Manabu Niseki
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2023-
|
|
11
|
+
date: 2023-05-20 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: bundler
|
|
@@ -86,14 +86,14 @@ dependencies:
|
|
|
86
86
|
requirements:
|
|
87
87
|
- - "~>"
|
|
88
88
|
- !ruby/object:Gem::Version
|
|
89
|
-
version: '1.
|
|
89
|
+
version: '1.5'
|
|
90
90
|
type: :development
|
|
91
91
|
prerelease: false
|
|
92
92
|
version_requirements: !ruby/object:Gem::Requirement
|
|
93
93
|
requirements:
|
|
94
94
|
- - "~>"
|
|
95
95
|
- !ruby/object:Gem::Version
|
|
96
|
-
version: '1.
|
|
96
|
+
version: '1.5'
|
|
97
97
|
- !ruby/object:Gem::Dependency
|
|
98
98
|
name: rack-test
|
|
99
99
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -184,14 +184,14 @@ dependencies:
|
|
|
184
184
|
requirements:
|
|
185
185
|
- - "~>"
|
|
186
186
|
- !ruby/object:Gem::Version
|
|
187
|
-
version: '1.
|
|
187
|
+
version: '1.28'
|
|
188
188
|
type: :development
|
|
189
189
|
prerelease: false
|
|
190
190
|
version_requirements: !ruby/object:Gem::Requirement
|
|
191
191
|
requirements:
|
|
192
192
|
- - "~>"
|
|
193
193
|
- !ruby/object:Gem::Version
|
|
194
|
-
version: '1.
|
|
194
|
+
version: '1.28'
|
|
195
195
|
- !ruby/object:Gem::Dependency
|
|
196
196
|
name: timecop
|
|
197
197
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -254,28 +254,42 @@ dependencies:
|
|
|
254
254
|
requirements:
|
|
255
255
|
- - "~>"
|
|
256
256
|
- !ruby/object:Gem::Version
|
|
257
|
-
version: '0.
|
|
257
|
+
version: '0.5'
|
|
258
258
|
type: :development
|
|
259
259
|
prerelease: false
|
|
260
260
|
version_requirements: !ruby/object:Gem::Requirement
|
|
261
261
|
requirements:
|
|
262
262
|
- - "~>"
|
|
263
263
|
- !ruby/object:Gem::Version
|
|
264
|
-
version: '0.
|
|
264
|
+
version: '0.5'
|
|
265
|
+
- !ruby/object:Gem::Dependency
|
|
266
|
+
name: solargraph
|
|
267
|
+
requirement: !ruby/object:Gem::Requirement
|
|
268
|
+
requirements:
|
|
269
|
+
- - "~>"
|
|
270
|
+
- !ruby/object:Gem::Version
|
|
271
|
+
version: '0.49'
|
|
272
|
+
type: :development
|
|
273
|
+
prerelease: false
|
|
274
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
275
|
+
requirements:
|
|
276
|
+
- - "~>"
|
|
277
|
+
- !ruby/object:Gem::Version
|
|
278
|
+
version: '0.49'
|
|
265
279
|
- !ruby/object:Gem::Dependency
|
|
266
280
|
name: steep
|
|
267
281
|
requirement: !ruby/object:Gem::Requirement
|
|
268
282
|
requirements:
|
|
269
283
|
- - "~>"
|
|
270
284
|
- !ruby/object:Gem::Version
|
|
271
|
-
version: '1.
|
|
285
|
+
version: '1.4'
|
|
272
286
|
type: :development
|
|
273
287
|
prerelease: false
|
|
274
288
|
version_requirements: !ruby/object:Gem::Requirement
|
|
275
289
|
requirements:
|
|
276
290
|
- - "~>"
|
|
277
291
|
- !ruby/object:Gem::Version
|
|
278
|
-
version: '1.
|
|
292
|
+
version: '1.4'
|
|
279
293
|
- !ruby/object:Gem::Dependency
|
|
280
294
|
name: activerecord
|
|
281
295
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -296,14 +310,14 @@ dependencies:
|
|
|
296
310
|
requirements:
|
|
297
311
|
- - '='
|
|
298
312
|
- !ruby/object:Gem::Version
|
|
299
|
-
version: 2.8.
|
|
313
|
+
version: 2.8.4
|
|
300
314
|
type: :runtime
|
|
301
315
|
prerelease: false
|
|
302
316
|
version_requirements: !ruby/object:Gem::Requirement
|
|
303
317
|
requirements:
|
|
304
318
|
- - '='
|
|
305
319
|
- !ruby/object:Gem::Version
|
|
306
|
-
version: 2.8.
|
|
320
|
+
version: 2.8.4
|
|
307
321
|
- !ruby/object:Gem::Dependency
|
|
308
322
|
name: awrence
|
|
309
323
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -394,14 +408,14 @@ dependencies:
|
|
|
394
408
|
requirements:
|
|
395
409
|
- - '='
|
|
396
410
|
- !ruby/object:Gem::Version
|
|
397
|
-
version: 1.13.
|
|
411
|
+
version: 1.13.1
|
|
398
412
|
type: :runtime
|
|
399
413
|
prerelease: false
|
|
400
414
|
version_requirements: !ruby/object:Gem::Requirement
|
|
401
415
|
requirements:
|
|
402
416
|
- - '='
|
|
403
417
|
- !ruby/object:Gem::Version
|
|
404
|
-
version: 1.13.
|
|
418
|
+
version: 1.13.1
|
|
405
419
|
- !ruby/object:Gem::Dependency
|
|
406
420
|
name: dry-struct
|
|
407
421
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -590,14 +604,14 @@ dependencies:
|
|
|
590
604
|
requirements:
|
|
591
605
|
- - '='
|
|
592
606
|
- !ruby/object:Gem::Version
|
|
593
|
-
version: 1.
|
|
607
|
+
version: 1.23.0
|
|
594
608
|
type: :runtime
|
|
595
609
|
prerelease: false
|
|
596
610
|
version_requirements: !ruby/object:Gem::Requirement
|
|
597
611
|
requirements:
|
|
598
612
|
- - '='
|
|
599
613
|
- !ruby/object:Gem::Version
|
|
600
|
-
version: 1.
|
|
614
|
+
version: 1.23.0
|
|
601
615
|
- !ruby/object:Gem::Dependency
|
|
602
616
|
name: plissken
|
|
603
617
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -632,14 +646,14 @@ dependencies:
|
|
|
632
646
|
requirements:
|
|
633
647
|
- - '='
|
|
634
648
|
- !ruby/object:Gem::Version
|
|
635
|
-
version: 6.
|
|
649
|
+
version: 6.2.2
|
|
636
650
|
type: :runtime
|
|
637
651
|
prerelease: false
|
|
638
652
|
version_requirements: !ruby/object:Gem::Requirement
|
|
639
653
|
requirements:
|
|
640
654
|
- - '='
|
|
641
655
|
- !ruby/object:Gem::Version
|
|
642
|
-
version: 6.
|
|
656
|
+
version: 6.2.2
|
|
643
657
|
- !ruby/object:Gem::Dependency
|
|
644
658
|
name: rack
|
|
645
659
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -702,14 +716,14 @@ dependencies:
|
|
|
702
716
|
requirements:
|
|
703
717
|
- - '='
|
|
704
718
|
- !ruby/object:Gem::Version
|
|
705
|
-
version: 5.
|
|
719
|
+
version: 5.9.0
|
|
706
720
|
type: :runtime
|
|
707
721
|
prerelease: false
|
|
708
722
|
version_requirements: !ruby/object:Gem::Requirement
|
|
709
723
|
requirements:
|
|
710
724
|
- - '='
|
|
711
725
|
- !ruby/object:Gem::Version
|
|
712
|
-
version: 5.
|
|
726
|
+
version: 5.9.0
|
|
713
727
|
- !ruby/object:Gem::Dependency
|
|
714
728
|
name: slack-notifier
|
|
715
729
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -730,28 +744,28 @@ dependencies:
|
|
|
730
744
|
requirements:
|
|
731
745
|
- - '='
|
|
732
746
|
- !ruby/object:Gem::Version
|
|
733
|
-
version: 1.6.
|
|
747
|
+
version: 1.6.3
|
|
734
748
|
type: :runtime
|
|
735
749
|
prerelease: false
|
|
736
750
|
version_requirements: !ruby/object:Gem::Requirement
|
|
737
751
|
requirements:
|
|
738
752
|
- - '='
|
|
739
753
|
- !ruby/object:Gem::Version
|
|
740
|
-
version: 1.6.
|
|
754
|
+
version: 1.6.3
|
|
741
755
|
- !ruby/object:Gem::Dependency
|
|
742
756
|
name: thor
|
|
743
757
|
requirement: !ruby/object:Gem::Requirement
|
|
744
758
|
requirements:
|
|
745
759
|
- - '='
|
|
746
760
|
- !ruby/object:Gem::Version
|
|
747
|
-
version: 1.2.
|
|
761
|
+
version: 1.2.2
|
|
748
762
|
type: :runtime
|
|
749
763
|
prerelease: false
|
|
750
764
|
version_requirements: !ruby/object:Gem::Requirement
|
|
751
765
|
requirements:
|
|
752
766
|
- - '='
|
|
753
767
|
- !ruby/object:Gem::Version
|
|
754
|
-
version: 1.2.
|
|
768
|
+
version: 1.2.2
|
|
755
769
|
- !ruby/object:Gem::Dependency
|
|
756
770
|
name: uuidtools
|
|
757
771
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -802,9 +816,6 @@ executables:
|
|
|
802
816
|
extensions: []
|
|
803
817
|
extra_rdoc_files: []
|
|
804
818
|
files:
|
|
805
|
-
- ".github/ISSUE_TEMPLATE/bug_report.md"
|
|
806
|
-
- ".github/ISSUE_TEMPLATE/feature_request.md"
|
|
807
|
-
- ".github/workflows/test.yml"
|
|
808
819
|
- ".gitignore"
|
|
809
820
|
- ".gitmodules"
|
|
810
821
|
- ".overcommit.yml"
|
|
@@ -820,19 +831,7 @@ files:
|
|
|
820
831
|
- bin/setup
|
|
821
832
|
- build_frontend.sh
|
|
822
833
|
- config.ru
|
|
823
|
-
- config/pre_commit.yml
|
|
824
|
-
- docker/Dockerfile
|
|
825
|
-
- examples/ipinfo_hosted_domains.rb
|
|
826
834
|
- exe/mihari
|
|
827
|
-
- images/Tines-Full_Logo-Tines_Black.png
|
|
828
|
-
- images/alert.png
|
|
829
|
-
- images/logo.png
|
|
830
|
-
- images/misp.png
|
|
831
|
-
- images/overview.jpg
|
|
832
|
-
- images/slack.png
|
|
833
|
-
- images/tines.png
|
|
834
|
-
- images/web_alerts.png
|
|
835
|
-
- images/web_config.png
|
|
836
835
|
- lib/mihari.rb
|
|
837
836
|
- lib/mihari/analyzers/base.rb
|
|
838
837
|
- lib/mihari/analyzers/binaryedge.rb
|
|
@@ -877,7 +876,7 @@ files:
|
|
|
877
876
|
- lib/mihari/clients/zoomeye.rb
|
|
878
877
|
- lib/mihari/commands/database.rb
|
|
879
878
|
- lib/mihari/commands/rule.rb
|
|
880
|
-
- lib/mihari/commands/
|
|
879
|
+
- lib/mihari/commands/search.rb
|
|
881
880
|
- lib/mihari/commands/version.rb
|
|
882
881
|
- lib/mihari/commands/web.rb
|
|
883
882
|
- lib/mihari/constants.rb
|
|
@@ -967,8 +966,8 @@ files:
|
|
|
967
966
|
- lib/mihari/web/public/assets/fa-solid-900-7152a693.woff2
|
|
968
967
|
- lib/mihari/web/public/assets/fa-v4compatibility-0515a423.ttf
|
|
969
968
|
- lib/mihari/web/public/assets/fa-v4compatibility-694a17c3.woff2
|
|
970
|
-
- lib/mihari/web/public/assets/index-
|
|
971
|
-
- lib/mihari/web/public/assets/index-
|
|
969
|
+
- lib/mihari/web/public/assets/index-cbe1734c.js
|
|
970
|
+
- lib/mihari/web/public/assets/index-eed1bcd8.css
|
|
972
971
|
- lib/mihari/web/public/favicon.ico
|
|
973
972
|
- lib/mihari/web/public/index.html
|
|
974
973
|
- lib/mihari/web/public/redoc-static.html
|
|
@@ -1,43 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: Bug report
|
|
3
|
-
about: Create a bug report to help us improve
|
|
4
|
-
title: "[BUG]"
|
|
5
|
-
labels: bug
|
|
6
|
-
assignees: ''
|
|
7
|
-
|
|
8
|
-
---
|
|
9
|
-
|
|
10
|
-
<!--
|
|
11
|
-
Thank you for taking the time to report a bug.
|
|
12
|
-
Please make sure there is no existing issue about this kind of bug.
|
|
13
|
-
-->
|
|
14
|
-
|
|
15
|
-
### **Describe the bug**
|
|
16
|
-
|
|
17
|
-
A clear and concise description of what the bug is.
|
|
18
|
-
|
|
19
|
-
### **Steps to reproduce**
|
|
20
|
-
|
|
21
|
-
- ...
|
|
22
|
-
|
|
23
|
-
### **Expected behavior**
|
|
24
|
-
|
|
25
|
-
A clear and concise description of what you expected to happen.
|
|
26
|
-
|
|
27
|
-
### **Actual behavior**
|
|
28
|
-
|
|
29
|
-
A clear and concise description of what actually happened.
|
|
30
|
-
|
|
31
|
-
### **Screenshots**
|
|
32
|
-
|
|
33
|
-
Add screenshots to help explain your problem.
|
|
34
|
-
|
|
35
|
-
### **System Information:**
|
|
36
|
-
|
|
37
|
-
- OS: [e.g. Windows10]
|
|
38
|
-
- Ruby version: [e.g. 3.0]
|
|
39
|
-
- Mihari version: [e.g. 2.0.0]
|
|
40
|
-
|
|
41
|
-
### **Additional context**
|
|
42
|
-
|
|
43
|
-
Add any other context about the problem here.
|
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: Feature request
|
|
3
|
-
about: Suggest a new Feature for Mihari
|
|
4
|
-
title: "[Feature Request]"
|
|
5
|
-
labels: enhancement
|
|
6
|
-
assignees: ''
|
|
7
|
-
|
|
8
|
-
---
|
|
9
|
-
<!--
|
|
10
|
-
|
|
11
|
-
1. Make sure your requested feature makes sense for Mihari.
|
|
12
|
-
|
|
13
|
-
2. If you want to suggest a new integration of a service, please provide detailed information of it. (e.g. API docs)
|
|
14
|
-
|
|
15
|
-
-->
|
data/.github/workflows/test.yml
DELETED
|
@@ -1,90 +0,0 @@
|
|
|
1
|
-
name: Ruby CI
|
|
2
|
-
|
|
3
|
-
on:
|
|
4
|
-
push:
|
|
5
|
-
branches: [master]
|
|
6
|
-
pull_request:
|
|
7
|
-
branches: [master]
|
|
8
|
-
|
|
9
|
-
jobs:
|
|
10
|
-
test:
|
|
11
|
-
runs-on: ubuntu-latest
|
|
12
|
-
|
|
13
|
-
services:
|
|
14
|
-
postgres:
|
|
15
|
-
image: postgres:12
|
|
16
|
-
env:
|
|
17
|
-
POSTGRES_USER: postgres
|
|
18
|
-
POSTGRES_PASSWORD: postgres
|
|
19
|
-
POSTGRES_DB: test
|
|
20
|
-
options: >-
|
|
21
|
-
--health-cmd pg_isready
|
|
22
|
-
--health-interval 10s
|
|
23
|
-
--health-timeout 5s
|
|
24
|
-
--health-retries 5
|
|
25
|
-
ports:
|
|
26
|
-
- 5432:5432
|
|
27
|
-
|
|
28
|
-
mysql:
|
|
29
|
-
image: mysql:8.0
|
|
30
|
-
env:
|
|
31
|
-
MYSQL_USER: mysql
|
|
32
|
-
MYSQL_PASSWORD: mysql
|
|
33
|
-
MYSQL_DATABASE: test
|
|
34
|
-
MYSQL_ROOT_PASSWORD: rootpassword
|
|
35
|
-
ports:
|
|
36
|
-
- 3306:3306
|
|
37
|
-
options: >-
|
|
38
|
-
--health-cmd="mysqladmin ping"
|
|
39
|
-
--health-interval=10s
|
|
40
|
-
--health-timeout=5s
|
|
41
|
-
--health-retries=3
|
|
42
|
-
|
|
43
|
-
strategy:
|
|
44
|
-
fail-fast: false
|
|
45
|
-
matrix:
|
|
46
|
-
ruby: [2.7, "3.0", 3.1, 3.2]
|
|
47
|
-
|
|
48
|
-
steps:
|
|
49
|
-
- uses: actions/checkout@v3
|
|
50
|
-
|
|
51
|
-
- name: Install dependencies
|
|
52
|
-
run: |
|
|
53
|
-
sudo apt-get -yqq install libpq-dev libmysqlclient-dev
|
|
54
|
-
|
|
55
|
-
- name: Set up Ruby
|
|
56
|
-
uses: ruby/setup-ruby@v1
|
|
57
|
-
with:
|
|
58
|
-
ruby-version: ${{ matrix.ruby }}
|
|
59
|
-
bundler: latest
|
|
60
|
-
bundler-cache: true
|
|
61
|
-
|
|
62
|
-
- name: Test with PostgreSQL
|
|
63
|
-
env:
|
|
64
|
-
DATABASE: postgresql://postgres:postgres@localhost:5432/test
|
|
65
|
-
run: |
|
|
66
|
-
bundle exec rake
|
|
67
|
-
|
|
68
|
-
- name: Test with MySQL
|
|
69
|
-
env:
|
|
70
|
-
DATABASE: mysql2://mysql:mysql@127.0.0.1:3306/test
|
|
71
|
-
run: |
|
|
72
|
-
bundle exec rake
|
|
73
|
-
|
|
74
|
-
- name: Coveralls Parallel
|
|
75
|
-
uses: coverallsapp/github-action@master
|
|
76
|
-
with:
|
|
77
|
-
github-token: ${{ secrets.github_token }}
|
|
78
|
-
flag-name: run-${{ matrix.ruby-version }}
|
|
79
|
-
parallel: true
|
|
80
|
-
|
|
81
|
-
coverage:
|
|
82
|
-
name: Coverage
|
|
83
|
-
needs: test
|
|
84
|
-
runs-on: ubuntu-latest
|
|
85
|
-
steps:
|
|
86
|
-
- name: Coveralls Finished
|
|
87
|
-
uses: coverallsapp/github-action@master
|
|
88
|
-
with:
|
|
89
|
-
github-token: ${{ secrets.github_token }}
|
|
90
|
-
parallel-finished: true
|
data/config/pre_commit.yml
DELETED
data/docker/Dockerfile
DELETED
|
@@ -1,14 +0,0 @@
|
|
|
1
|
-
FROM ruby:3.1.3-alpine3.17
|
|
2
|
-
|
|
3
|
-
RUN apk --no-cache add git build-base ruby-dev sqlite-dev postgresql-dev mysql-client mysql-dev && \
|
|
4
|
-
gem install pg mysql2
|
|
5
|
-
|
|
6
|
-
ARG MIHARI_VERSION=5.1.0
|
|
7
|
-
|
|
8
|
-
RUN gem install mihari -v ${MIHARI_VERSION}
|
|
9
|
-
|
|
10
|
-
RUN apk del --purge git build-base ruby-dev
|
|
11
|
-
|
|
12
|
-
ENTRYPOINT ["mihari"]
|
|
13
|
-
|
|
14
|
-
CMD ["--help"]
|
|
@@ -1,45 +0,0 @@
|
|
|
1
|
-
# frozen_string_literal: true
|
|
2
|
-
|
|
3
|
-
$LOAD_PATH.unshift("#{__dir__}/../lib")
|
|
4
|
-
|
|
5
|
-
require "json"
|
|
6
|
-
require "mihari"
|
|
7
|
-
require "open-uri"
|
|
8
|
-
|
|
9
|
-
module Mihari
|
|
10
|
-
module Analyzers
|
|
11
|
-
class HostedDomains < Base
|
|
12
|
-
attr_reader :ip
|
|
13
|
-
|
|
14
|
-
IPINFO_API_ENDPOINT = "https://ipinfo.io"
|
|
15
|
-
|
|
16
|
-
def initialize(ip, token: nil)
|
|
17
|
-
@ip = ip
|
|
18
|
-
@token = token
|
|
19
|
-
end
|
|
20
|
-
|
|
21
|
-
def title
|
|
22
|
-
"IPinfo hosted domains"
|
|
23
|
-
end
|
|
24
|
-
|
|
25
|
-
def description
|
|
26
|
-
"IP info hosted domains: #{ip}"
|
|
27
|
-
end
|
|
28
|
-
|
|
29
|
-
def token
|
|
30
|
-
ENV["IPINFO_TOKEN"] || @token
|
|
31
|
-
end
|
|
32
|
-
|
|
33
|
-
def artifacts
|
|
34
|
-
uri = URI("#{IPINFO_API_ENDPOINT}/domains/#{ip}?token=#{token}")
|
|
35
|
-
res = uri.read
|
|
36
|
-
json = JSON.parse(res)
|
|
37
|
-
json["domains"] || []
|
|
38
|
-
end
|
|
39
|
-
end
|
|
40
|
-
end
|
|
41
|
-
end
|
|
42
|
-
|
|
43
|
-
ip = "TARGET_IP"
|
|
44
|
-
analyzer = Mihari::Analyzers::HostedDomains.new(ip)
|
|
45
|
-
analyzer.run
|
|
Binary file
|
data/images/alert.png
DELETED
|
Binary file
|
data/images/logo.png
DELETED
|
Binary file
|
data/images/misp.png
DELETED
|
Binary file
|
data/images/overview.jpg
DELETED
|
Binary file
|
data/images/slack.png
DELETED
|
Binary file
|
data/images/tines.png
DELETED
|
Binary file
|
data/images/web_alerts.png
DELETED
|
Binary file
|
data/images/web_config.png
DELETED
|
Binary file
|
|
@@ -1,61 +0,0 @@
|
|
|
1
|
-
# frozen_string_literal: true
|
|
2
|
-
|
|
3
|
-
module Mihari
|
|
4
|
-
module Commands
|
|
5
|
-
module Searcher
|
|
6
|
-
include Mixins::ErrorNotification
|
|
7
|
-
|
|
8
|
-
def self.included(thor)
|
|
9
|
-
thor.class_eval do
|
|
10
|
-
desc "search [PATH]", "Search by a rule"
|
|
11
|
-
method_option :force_overwrite, type: :boolean, aliases: "-f", desc: "Force an overwrite the rule"
|
|
12
|
-
#
|
|
13
|
-
# Search by a rule
|
|
14
|
-
#
|
|
15
|
-
# @param [String] path_or_id
|
|
16
|
-
#
|
|
17
|
-
def search(path_or_id)
|
|
18
|
-
Mihari::Database.with_db_connection do
|
|
19
|
-
rule = Structs::Rule.from_path_or_id path_or_id
|
|
20
|
-
|
|
21
|
-
# validate
|
|
22
|
-
begin
|
|
23
|
-
rule.validate!
|
|
24
|
-
rescue RuleValidationError
|
|
25
|
-
return
|
|
26
|
-
end
|
|
27
|
-
|
|
28
|
-
force_overwrite = options["force_overwrite"] || false
|
|
29
|
-
|
|
30
|
-
begin
|
|
31
|
-
rule_model = Mihari::Rule.find(rule.id)
|
|
32
|
-
has_change = rule_model.data != rule.data.deep_stringify_keys
|
|
33
|
-
has_change_and_not_force_overwrite = has_change & !force_overwrite
|
|
34
|
-
|
|
35
|
-
if has_change_and_not_force_overwrite && !yes?("This operation will overwrite the rule in the database (Rule ID: #{rule.id}). Are you sure you want to update the rule? (y/n)")
|
|
36
|
-
return
|
|
37
|
-
end
|
|
38
|
-
|
|
39
|
-
# update the rule
|
|
40
|
-
rule.model.save
|
|
41
|
-
rescue ActiveRecord::RecordNotFound
|
|
42
|
-
# create a new rule
|
|
43
|
-
rule.model.save
|
|
44
|
-
end
|
|
45
|
-
|
|
46
|
-
with_error_notification do
|
|
47
|
-
alert = rule.analyzer.run
|
|
48
|
-
if alert
|
|
49
|
-
data = Mihari::Entities::Alert.represent(alert)
|
|
50
|
-
puts JSON.pretty_generate(data.as_json)
|
|
51
|
-
else
|
|
52
|
-
Mihari.logger.info "There is no new alert created in the database"
|
|
53
|
-
end
|
|
54
|
-
end
|
|
55
|
-
end
|
|
56
|
-
end
|
|
57
|
-
end
|
|
58
|
-
end
|
|
59
|
-
end
|
|
60
|
-
end
|
|
61
|
-
end
|