mihari 5.3.2 → 5.4.1

data/frontend/package.json

@@ -19,7 +19,7 @@
     "@fortawesome/vue-fontawesome": "^3.0.3",
     "@vueuse/core": "^10.3.0",
     "@vueuse/router": "^10.3.0",
-    "ace-builds": "^1.23.4",
+    "ace-builds": "^1.24.0",
     "axios": "^1.4.0",
     "bulma": "^0.9.4",
     "bulma-helpers": "^0.4.3",
@@ -37,14 +37,14 @@
     "vue3-ace-editor": "^2.2.3"
   },
   "devDependencies": {
-    "@redocly/cli": "1.0.0",
-    "@rushstack/eslint-patch": "^1.3.2",
+    "@redocly/cli": "1.0.2",
+    "@rushstack/eslint-patch": "^1.3.3",
     "@tsconfig/node20": "^20.1.1",
     "@types/jsdom": "^21.1.1",
-    "@types/node": "^20.4.8",
+    "@types/node": "^20.4.9",
     "@types/url-parse": "^1.4.8",
-    "@typescript-eslint/eslint-plugin": "^6.2.1",
-    "@typescript-eslint/parser": "^6.2.1",
+    "@typescript-eslint/eslint-plugin": "^6.3.0",
+    "@typescript-eslint/parser": "^6.3.0",
     "@vitejs/plugin-vue": "^4.2.3",
     "@vue/eslint-config-prettier": "^8.0.0",
     "@vue/eslint-config-typescript": "^11.0.3",
@@ -54,7 +54,7 @@
     "eslint-config-prettier": "^9.0.0",
     "eslint-plugin-prettier": "^5.0.0",
     "eslint-plugin-simple-import-sort": "^10.0.0",
-    "eslint-plugin-vue": "^9.16.1",
+    "eslint-plugin-vue": "^9.17.0",
     "husky": "^8.0.3",
     "jsdom": "^22.1.0",
     "npm-run-all": "^4.1.5",

data/lib/mihari/analyzers/base.rb

@@ -25,21 +25,28 @@ module Mihari
       # @return [Integer, nil]
       #
       def interval
-        @interval = options[:interval]
+        @interval ||= options[:interval]
       end
 
       #
       # @return [Integer]
       #
       def retry_interval
-        @retry_interval ||= options[:retry_interval] || DEFAULT_RETRY_INTERVAL
+        @retry_interval ||= options[:retry_interval] || Mihari.config.retry_interval
       end
 
       #
       # @return [Integer]
       #
       def retry_times
-        @retry_times ||= options[:retry_times] || DEFAULT_RETRY_TIMES
+        @retry_times ||= options[:retry_times] || Mihari.config.retry_times
+      end
+
+      #
+      # @return [Integer]
+      #
+      def pagination_limit
+        @pagination_limit ||= options[:pagination_limit] || Mihari.config.pagination_limit
       end
 
       # @return [Array<String>, Array<Mihari::Artifact>]

data/lib/mihari/analyzers/binaryedge.rb

@@ -30,6 +30,10 @@ module Mihari
         end.flatten
       end
 
+      def configuration_keys
+        %w[binaryedge_api_key]
+      end
+
       private
 
       PAGE_SIZE = 20
@@ -56,7 +60,7 @@ module Mihari
       #
       def search
         responses = []
-        (1..500).each do |page|
+        (1..pagination_limit).each do |page|
           res = search_with_page(page: page)
           total = res["total"].to_i
 
@@ -69,10 +73,6 @@ module Mihari
         responses
       end
 
-      def configuration_keys
-        %w[binaryedge_api_key]
-      end
-
       #
       #
       # @return [Mihari::Clients::BinaryEdge]

data/lib/mihari/analyzers/censys.rb

@@ -30,7 +30,7 @@ module Mihari
         artifacts = []
 
         cursor = nil
-        loop do
+        pagination_limit.times do
           response = client.search(query, cursor: cursor)
           artifacts << response.result.to_artifacts
           cursor = response.result.links.next
@@ -55,8 +55,6 @@ module Mihari
         configuration_keys? || (id? && secret?)
       end
 
-      private
-
       #
       # @return [Array<String>]
       #
@@ -64,6 +62,8 @@ module Mihari
         %w[censys_id censys_secret]
       end
 
+      private
+
       #
       # @return [Mihari::Clients::Censys]
       #

data/lib/mihari/analyzers/circl.rb

@@ -44,12 +44,12 @@ module Mihari
         configuration_keys? || (username? && password?)
       end
 
-      private
-
       def configuration_keys
         %w[circl_passive_password circl_passive_username]
       end
 
+      private
+
       def client
         @client ||= Clients::CIRCL.new(username: username, password: password)
       end

data/lib/mihari/analyzers/greynoise.rb

@@ -23,12 +23,12 @@ module Mihari
         client.gnql_search(query, size: PAGE_SIZE).to_artifacts
       end
 
-      private
-
       def configuration_keys
         %w[greynoise_api_key]
       end
 
+      private
+
       def client
         @client ||= Clients::GreyNoise.new(api_key: api_key)
       end

data/lib/mihari/analyzers/hunterhow.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Analyzers
+    class HunterHow < Base
+      # @return [String, nil]
+      attr_reader :api_key
+
+      # @return [Date]
+      attr_reader :start_time
+
+      # @return [Date]
+      attr_reader :end_time
+
+      #
+      # @param [String] query
+      # @param [Hash, nil] options
+      # @param [String, nil] api_key
+      #
+      def initialize(query, start_time:, end_time:, options: nil, api_key: nil)
+        super(query, options: options)
+
+        @api_key = api_key || Mihari.config.hunterhow_api_key
+
+        @start_time = start_time
+        @end_time = end_time
+      end
+
+      #
+      # @return [Array<Mihari::Artifact>]
+      #
+      def artifacts
+        artifacts = []
+
+        (1..pagination_limit).each do |page|
+          res = client.search(
+            query,
+            page: page,
+            page_size: PAGE_SIZE,
+            start_time: start_time.strftime("%Y-%m-%d"),
+            end_time: end_time.strftime("%Y-%m-%d")
+          )
+
+          artifacts << res.data.artifacts
+
+          break if res.data.list.length < PAGE_SIZE
+
+          sleep_interval
+        end
+
+        artifacts.flatten
+      end
+
+      def configuration_keys
+        %w[hunterhow_api_key]
+      end
+
+      private
+
+      # @return [Integer]
+      PAGE_SIZE = 100
+
+      def client
+        @client ||= Clients::HunterHow.new(api_key: api_key)
+      end
+    end
+  end
+end

data/lib/mihari/analyzers/onyphe.rb

@@ -26,14 +26,14 @@ module Mihari
         responses.map(&:to_artifacts).flatten
       end
 
-      private
-
-      PAGE_SIZE = 10
-
       def configuration_keys
         %w[onyphe_api_key]
       end
 
+      private
+
+      PAGE_SIZE = 10
+
       def client
         @client ||= Clients::Onyphe.new(api_key: api_key)
       end
@@ -57,7 +57,7 @@ module Mihari
       #
       def search
         responses = []
-        (1..Float::INFINITY).each do |page|
+        (1..pagination_limit).each do |page|
           res = search_with_page(query, page: page)
           responses << res
 

data/lib/mihari/analyzers/otx.rb

@@ -35,12 +35,12 @@ module Mihari
         end
       end
 
-      private
-
       def configuration_keys
         %w[otx_api_key]
       end
 
+      private
+
       def client
         @client ||= Mihari::Clients::OTX.new(api_key: api_key)
       end

data/lib/mihari/analyzers/passivetotal.rb

@@ -46,12 +46,12 @@ module Mihari
         configuration_keys? || (username? && api_key?)
       end
 
-      private
-
       def configuration_keys
         %w[passivetotal_username passivetotal_api_key]
       end
 
+      private
+
       def client
         @client ||= Clients::PassiveTotal.new(username: username, api_key: api_key)
       end

data/lib/mihari/analyzers/pulsedive.rb

@@ -40,12 +40,12 @@ module Mihari
         end
       end
 
-      private
-
       def configuration_keys
         %w[pulsedive_api_key]
       end
 
+      private
+
       def client
         @client ||= Clients::PulseDive.new(api_key: api_key)
       end

data/lib/mihari/analyzers/rule.rb

@@ -10,6 +10,7 @@ module Mihari
       "dnstwister" => DNSTwister,
       "feed" => Feed,
       "greynoise" => GreyNoise,
+      "hunterhow" => HunterHow,
       "onyphe" => Onyphe,
       "otx" => OTX,
       "passivetotal" => PassiveTotal,
@@ -54,12 +55,15 @@ module Mihari
       end
 
       #
-      # Returns a list of artifacts matched with queries/analyzers
+      # Returns a list of artifacts matched with queries/analyzers (with the rule ID)
       #
       # @return [Array<Mihari::Artifact>]
       #
       def artifacts
-        analyzers.flat_map(&:normalized_artifacts)
+        analyzers.flat_map(&:normalized_artifacts).map do |artifact|
+          artifact.rule_id = rule.id
+          artifact
+        end
       end
 
       #
@@ -72,14 +76,9 @@ module Mihari
       # @return [Array<Mihari::Artifact>]
       #
       def normalized_artifacts
-        @normalized_artifacts ||= artifacts.uniq(&:data).select(&:valid?).select do |artifact|
-          rule.data_types.include? artifact.data_type
-        end.reject do |artifact|
-          falsepositive? artifact.data
-        end.map do |artifact|
-          artifact.rule_id = rule.id
-          artifact
-        end
+        valid_artifacts = artifacts.uniq(&:data).select(&:valid?)
+        date_type_allowed_artifacts = valid_artifacts.select { |artifact| rule.data_types.include? artifact.data_type }
+        date_type_allowed_artifacts.reject { |artifact| falsepositive? artifact.data }
       end
 
       #
@@ -88,7 +87,7 @@ module Mihari
       # @return [Array<Mihari::Artifact>]
       #
       def unique_artifacts
-        @unique_artifacts ||= normalized_artifacts.select do |artifact|
+        normalized_artifacts.select do |artifact|
           artifact.unique?(base_time: base_time, artifact_lifetime: rule.artifact_lifetime)
         end
       end
@@ -216,7 +215,10 @@ module Mihari
       #
       def validate_analyzer_configurations
         analyzers.map do |analyzer|
-          raise ConfigurationError, "#{analyzer.source} is not configured correctly" unless analyzer.configured?
+          next if analyzer.configured?
+
+          message = "#{analyzer.source} is not configured correctly. #{analyzer.configuration_keys.join(", ")} is/are missing."
+          raise ConfigurationError, message
         end
       end
     end

data/lib/mihari/analyzers/securitytrails.rb

@@ -40,12 +40,12 @@ module Mihari
         end
       end
 
-      private
-
       def configuration_keys
         %w[securitytrails_api_key]
       end
 
+      private
+
       def client
         @client ||= Clients::SecurityTrails.new(api_key: api_key)
       end

data/lib/mihari/analyzers/shodan.rb

@@ -24,14 +24,14 @@ module Mihari
         results.map(&:to_artifacts).flatten.uniq(&:data)
       end
 
-      private
-
-      PAGE_SIZE = 100
-
       def configuration_keys
         %w[shodan_api_key]
       end
 
+      private
+
+      PAGE_SIZE = 100
+
       def client
         @client ||= Clients::Shodan.new(api_key: api_key)
       end
@@ -54,7 +54,7 @@ module Mihari
       #
       def search
         responses = []
-        (1..Float::INFINITY).each do |page|
+        (1..pagination_limit).each do |page|
           res = search_with_page(page: page)
           responses << res
           break if res.total <= page * PAGE_SIZE

data/lib/mihari/analyzers/urlscan.rb

@@ -39,12 +39,12 @@ module Mihari
         end
       end
 
-      private
-
       def configuration_keys
         %w[urlscan_api_key]
       end
 
+      private
+
       def client
         @client ||= Clients::UrlScan.new(api_key: api_key)
       end
@@ -68,7 +68,7 @@ module Mihari
         responses = []
 
         search_after = nil
-        loop do
+        pagination_limit.times do
           res = search_with_search_after(search_after: search_after)
           responses << res
 

data/lib/mihari/analyzers/virustotal.rb

@@ -35,12 +35,12 @@ module Mihari
         end
       end
 
-      private
-
       def configuration_keys
         %w[virustotal_api_key]
       end
 
+      private
+
       def client
         @client = Clients::VirusTotal.new(api_key: api_key)
       end

data/lib/mihari/analyzers/virustotal_intelligence.rb

@@ -21,12 +21,12 @@ module Mihari
         search_with_cursor.map(&:to_artifacts).flatten
       end
 
-      private
-
       def configuration_keys
         %w[virustotal_api_key]
       end
 
+      private
+
       #
       # VT API
       #
@@ -45,7 +45,7 @@ module Mihari
         cursor = nil
         responses = []
 
-        loop do
+        pagination_limit.times do
           response = Structs::VirusTotalIntelligence::Response.from_dynamic!(client.intel_search(query,
             cursor: cursor))
           responses << response

data/lib/mihari/analyzers/zoomeye.rb

@@ -33,6 +33,10 @@ module Mihari
         end
       end
 
+      def configuration_keys
+        %w[zoomeye_api_key]
+      end
+
       private
 
       PAGE_SIZE = 10
@@ -46,10 +50,6 @@ module Mihari
         %w[host web].include? type
       end
 
-      def configuration_keys
-        %w[zoomeye_api_key]
-      end
-
       def client
         @client ||= Clients::ZoomEye.new(api_key: api_key)
       end
@@ -95,7 +95,7 @@ module Mihari
       #
       def host_search
         responses = []
-        (1..Float::INFINITY).each do |page|
+        (1..pagination_limit).each do |page|
           res = _host_search(query, page: page)
           break unless res
 
@@ -128,7 +128,7 @@ module Mihari
       #
       def web_search
         responses = []
-        (1..Float::INFINITY).each do |page|
+        (1..pagination_limit).each do |page|
           res = _web_search(query, page: page)
           break unless res
 

data/lib/mihari/clients/hunterhow.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "base64"
+
+module Mihari
+  module Clients
+    class HunterHow < Base
+      # @return [String]
+      attr_reader :api_key
+
+      #
+      # @param [String] base_url
+      # @param [String, nil] api_key
+      # @param [Hash] headers
+      #
+      def initialize(base_url = "https://api.hunter.how/", api_key:, headers: {})
+        raise(ArgumentError, "'api_key' argument is required") unless api_key
+
+        super(base_url, headers: headers)
+
+        @api_key = api_key
+      end
+
+      #
+      # @param [String] query String used to query our data
+      # @param [Integer] page Default 1, Maximum: 500
+      # @param [Integer] page_size Default 100, Maximum: 100
+      # @param [String] start_time
+      # @param [String] end_time
+      #
+      # @return [Structs::HunterHow::Response]
+      #
+      def search(query, start_time:, end_time:, page: 1, page_size: 10)
+        params = {
+          query: Base64.urlsafe_encode64(query),
+          page: page,
+          page_size: page_size,
+          start_time: start_time,
+          end_time: end_time,
+          "api-key": api_key
+        }.compact
+        res = get("/search", params: params)
+        Structs::HunterHow::Response.from_dynamic! JSON.parse(res.body.to_s)
+      end
+    end
+  end
+end