mihari 5.6.1 → 5.7.0

data/lib/mihari/analyzers/virustotal.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Analyzers
+    #
+    # VirusTotal analyzer
+    #
     class VirusTotal < Base
       include Mixins::Refang
 
@@ -43,7 +46,7 @@ module Mihari
         #
         # @return [Array<String>, nil]
         #
-        def key_aliases
+        def class_key_aliases
           ["vt"]
         end
       end
@@ -51,7 +54,7 @@ module Mihari
       private
 
       def client
-        @client = Clients::VirusTotal.new(api_key: api_key)
+        Clients::VirusTotal.new(api_key: api_key)
       end
 
       #
@@ -66,7 +69,7 @@ module Mihari
       #
       # Domain search
       #
-      # @return [Array<Mihari::Artifact>]
+      # @return [Array<Mihari::Models::Artifact>]
       #
       def domain_search
         res = client.domain_search(query)
@@ -74,14 +77,14 @@ module Mihari
         data = res["data"] || []
         data.filter_map do |item|
           data = item.dig("attributes", "ip_address")
-          data.nil? ? nil : Artifact.new(data: data, metadata: item)
+          data.nil? ? nil : Models::Artifact.new(data: data, metadata: item)
         end
       end
 
       #
       # IP search
       #
-      # @return [Array<Mihari::Artifact>]
+      # @return [Array<Mihari::Models::Artifact>]
       #
       def ip_search
         res = client.ip_search(query)
@@ -89,7 +92,7 @@ module Mihari
         data = res["data"] || []
         data.filter_map do |item|
           data = item.dig("attributes", "host_name")
-          Artifact.new(data: data, metadata: item)
+          Models::Artifact.new(data: data, metadata: item)
         end.uniq
       end
     end

data/lib/mihari/analyzers/virustotal_intelligence.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Analyzers
+    #
+    # VirusTotal Intelligence analyzer
+    #
     class VirusTotalIntelligence < Base
       # @return [String, nil]
       attr_reader :api_key
@@ -49,7 +52,7 @@ module Mihari
       # @return [::VirusTotal::API]
       #
       def client
-        @client = Clients::VirusTotal.new(
+        Clients::VirusTotal.new(
           api_key: api_key,
           pagination_interval: pagination_interval,
           timeout: timeout

data/lib/mihari/analyzers/zoomeye.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Analyzers
+    #
+    # ZoomEye analyzer
+    #
     class ZoomEye < Base
       # @return [String, nil]
       attr_reader :api_key
@@ -53,7 +56,7 @@ module Mihari
       end
 
       def client
-        @client ||= Clients::ZoomEye.new(
+        Clients::ZoomEye.new(
           api_key: api_key,
           pagination_interval: pagination_interval,
           timeout: timeout
@@ -63,9 +66,9 @@ module Mihari
       #
       # Convert responses into an array of String
       #
-      # @param [Hash] response
+      # @param [Hash] res
       #
-      # @return [Array<Mihari::Artifact>]
+      # @return [Array<Mihari::Models::Artifact>]
       #
       def convert(res)
         matches = res["matches"] || []
@@ -73,9 +76,9 @@ module Mihari
           data = match["ip"]
 
           if data.is_a?(Array)
-            data.map { |d| Artifact.new(data: d, metadata: match) }
+            data.map { |d| Models::Artifact.new(data: d, metadata: match) }
           else
-            Artifact.new(data: data, metadata: match)
+            Models::Artifact.new(data: data, metadata: match)
           end
         end.flatten
       end

data/lib/mihari/cli/alert.rb

@@ -4,6 +4,9 @@ require "mihari/commands/alert"
 
 module Mihari
   module CLI
+    #
+    # Alert CLI class (mihari alert ...)
+    #
     class Alert < Base
       include Mihari::Commands::Alert
     end

data/lib/mihari/cli/base.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module CLI
+    #
+    # Base class for Thor classes
+    #
     class Base < Thor
       class << self
         def exit_on_failure?

data/lib/mihari/cli/database.rb

@@ -4,6 +4,9 @@ require "mihari/commands/database"
 
 module Mihari
   module CLI
+    #
+    # Database CLI class (mihari db ...)
+    #
     class Database < Base
       include Mihari::Commands::Database
     end

data/lib/mihari/cli/main.rb

@@ -19,6 +19,9 @@ require "mihari/cli/rule"
 
 module Mihari
   module CLI
+    #
+    # Main CLI class
+    #
     class Main < Base
       class_option :debug, desc: "Sets up debug mode", aliases: ["-d"], type: :boolean
       class_around :safe_execute

data/lib/mihari/cli/rule.rb

@@ -4,6 +4,9 @@ require "mihari/commands/rule"
 
 module Mihari
   module CLI
+    #
+    # Rule CLI class (mihari rule ...)
+    #
     class Rule < Base
       include Mihari::Commands::Rule
     end

data/lib/mihari/clients/base.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # Base class for API clients
+    #
     class Base
       # @return [String]
       attr_reader :base_url

data/lib/mihari/clients/binaryedge.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # BinaryEdge API client
+    #
     class BinaryEdge < Base
       #
       # @param [String] base_url
@@ -27,7 +30,7 @@ module Mihari
       # @param [Integer] page Default 1, Maximum: 500
       # @param [Integer, nil] only_ips If selected, only output IP addresses, ports and protocols.
       #
-      # @return [Structs::BinaryEdge::Response]
+      # @return [Mihari::Structs::BinaryEdge::Response]
       #
       def search(query, page: 1, only_ips: nil)
         params = {
@@ -45,7 +48,7 @@ module Mihari
       # @param [Integer, nil] only_ips
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::BinaryEdge::Response.>]
+      # @return [Enumerable<Mihari::Structs::BinaryEdge::Response>]
       #
       def search_with_pagination(query, only_ips: nil, pagination_limit: Mihari.config.pagination_limit)
         Enumerator.new do |y|

data/lib/mihari/clients/censys.rb

@@ -4,6 +4,9 @@ require "base64"
 
 module Mihari
   module Clients
+    #
+    # Censys API client
+    #
     class Censys < Base
       #
       # @param [String] base_url
@@ -36,10 +39,10 @@ module Mihari
       # For more details, see our documentation: https://search.censys.io/api/v2/docs
       #
       # @param [String] query the query to be executed.
-      # @params [Integer, nil] per_page the number of results to be returned for each page.
-      # @params [Integer, nil] cursor the cursor of the desired result set.
+      # @param [Integer, nil] per_page the number of results to be returned for each page.
+      # @param [Integer, nil] cursor the cursor of the desired result set.
       #
-      # @return [Structs::Censys::Response]
+      # @return [Mihari::Structs::Censys::Response]
       #
       def search(query, per_page: nil, cursor: nil)
         params = { q: query, per_page: per_page, cursor: cursor }.compact
@@ -52,7 +55,7 @@ module Mihari
       # @param [Integer, nil] per_page
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Censys::Response>]
+      # @return [Enumerable<Mihari::Structs::Censys::Response>]
       #
       def search_with_pagination(query, per_page: nil, pagination_limit: Mihari.config.pagination_limit)
         cursor = nil

data/lib/mihari/clients/circl.rb

@@ -4,6 +4,9 @@ require "base64"
 
 module Mihari
   module Clients
+    #
+    # CIRCL passive DNS/SSL API client
+    #
     class CIRCL < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/crtsh.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # crt.sh API client
+    #
     class Crtsh < Base
       #
       # @param [String] base_url
@@ -19,7 +22,7 @@ module Mihari
       # @param [String, nil] match "=", "ILIKE", "LIKE", "single", "any" or nil
       # @param [String, nil] exclude "expired" or nil
       #
-      # @return [Array<Mihari::Artifact>]
+      # @return [Array<Mihari::Models::Artifact>]
       #
       def search(identity, match: nil, exclude: nil)
         params = { identity: identity, match: match, exclude: exclude, output: "json" }.compact
@@ -29,7 +32,7 @@ module Mihari
 
         parsed.map do |result|
           values = result["name_value"].to_s.lines.map(&:chomp)
-          values.map { |value| Artifact.new(data: value, metadata: result) }
+          values.map { |value| Models::Artifact.new(data: value, metadata: result) }
         end.flatten
       end
     end

data/lib/mihari/clients/dnstwister.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # DNSTwister API client
+    #
     class DNSTwister < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/fofa.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "base64"
+
+module Mihari
+  module Clients
+    #
+    # Fofa API client
+    #
+    class Fofa < Base
+      PAGE_SIZE = 10_000
+
+      # @return [String]
+      attr_reader :api_key
+
+      # @return [String]
+      attr_reader :email
+
+      #
+      # @param [String] base_url
+      # @param [String, nil] api_key
+      # @param [String, nil] email
+      # @param [Hash] headers
+      # @param [Integer] pagination_interval
+      # @param [Integer, nil] timeout
+      #
+      # @param [Object] email
+      def initialize(
+        base_url = "https://fofa.info/",
+        api_key:,
+        email:,
+        headers: {},
+        pagination_interval: Mihari.config.pagination_interval,
+        timeout: nil
+      )
+        raise(ArgumentError, "api_key is required") unless api_key
+        raise(ArgumentError, "email is required") unless email
+
+        @api_key = api_key
+        @email = email
+
+        super(base_url, headers: headers, pagination_interval: pagination_interval, timeout: timeout)
+      end
+
+      #
+      # @param [String] query
+      # @param [Integer] size
+      # @param [Integer] page
+      #
+      # @return [Mihari::Structs::Fofa::Response]
+      #
+      def search(query, page:, size: PAGE_SIZE)
+        qbase64 = Base64.urlsafe_encode64(query)
+        params = { qbase64: qbase64, size: size, page: page, email: email, key: api_key }.compact
+        res = get("/api/v1/search/all", params: params)
+        Structs::Fofa::Response.from_dynamic! JSON.parse(res.body.to_s)
+      end
+
+      #
+      # @param [String] query
+      # @param [Integer] size
+      # @param [Integer] pagination_limit
+      #
+      # @return [Enumerable<Mihari::Structs::Fofa::Response>]
+      #
+      def search_with_pagination(query, size: PAGE_SIZE, pagination_limit: Mihari.config.pagination_limit)
+        Enumerator.new do |y|
+          (1..pagination_limit).each do |page|
+            res = search(query, page: page, size: size)
+
+            y.yield res
+
+            break if res.error
+
+            break if (res.results || []).length < size
+
+            sleep_pagination_interval
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mihari/clients/greynoise.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # GreyNoise API client
+    #
     class GreyNoise < Base
       PAGE_SIZE = 10_000
 
@@ -32,7 +35,7 @@ module Mihari
       # @param [Integer] size Maximum amount of results to grab
       # @param [Integer, nil] scroll Scroll token to paginate through results
       #
-      # @return [Hash]
+      # @return [Mihari::Structs::GreyNoise::Response]
       #
       def gnql_search(query, size: PAGE_SIZE, scroll: nil)
         params = { query: query, size: size, scroll: scroll }.compact
@@ -45,7 +48,7 @@ module Mihari
       # @param [Integer] size
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::GreyNoise::Response>]
+      # @return [Enumerable<Mihari::Structs::GreyNoise::Response>]
       #
       def gnql_search_with_pagination(query, size: PAGE_SIZE, pagination_limit: Mihari.config.pagination_limit)
         scroll = nil

data/lib/mihari/clients/hunterhow.rb

@@ -4,6 +4,9 @@ require "base64"
 
 module Mihari
   module Clients
+    #
+    # hunter.how API client
+    #
     class HunterHow < Base
       PAGE_SIZE = 100
 
@@ -38,7 +41,7 @@ module Mihari
       # @param [String] start_time
       # @param [String] end_time
       #
-      # @return [Structs::HunterHow::Response]
+      # @return [Mihari::Structs::HunterHow::Response]
       #
       def search(query, start_time:, end_time:, page: 1, page_size: PAGE_SIZE)
         params = {
@@ -60,7 +63,7 @@ module Mihari
       # @param [String] start_time
       # @param [String] end_time
       #
-      # @return [Enumerable<Structs::HunterHow::Response>]
+      # @return [Enumerable<Mihari::Structs::HunterHow::Response>]
       #
       def search_with_pagination(
         query,

data/lib/mihari/clients/misp.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # MISP API client
+    #
     class MISP < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/onyphe.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # Onyphe API client
+    #
     class Onyphe < Base
       PAGE_SIZE = 10
 
@@ -33,7 +36,7 @@ module Mihari
       # @param [String] query
       # @param [Integer] page
       #
-      # @return [Structs::Onyphe::Response]
+      # @return [Mihari::Structs::Onyphe::Response]
       #
       def datascan(query, page: 1)
         params = { page: page, apikey: api_key }
@@ -45,7 +48,7 @@ module Mihari
       # @param [String] query
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Onyphe::Response>]
+      # @return [Enumerable<Mihari::Structs::Onyphe::Response>]
       #
       def datascan_with_pagination(query, pagination_limit: Mihari.config.pagination_limit)
         Enumerator.new do |y|

data/lib/mihari/clients/otx.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # OTX API client
+    #
     class OTX < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/passivetotal.rb

@@ -4,6 +4,9 @@ require "base64"
 
 module Mihari
   module Clients
+    #
+    # PassiveTotal API client
+    #
     class PassiveTotal < Base
       #
       # @param [String] base_url
@@ -39,7 +42,7 @@ module Mihari
       #
       # @param [String] query
       #
-      # @return [Array<Mihari::Artifact>]
+      # @return [Array<Mihari::Models::Artifact>]
       #
       def reverse_whois_search(query)
         params = {
@@ -50,7 +53,7 @@ module Mihari
         results = res["results"] || []
         results.map do |result|
           data = result["domain"]
-          Artifact.new(data: data, metadata: result)
+          Models::Artifact.new(data: data, metadata: result)
         end.flatten
       end
 
@@ -59,7 +62,7 @@ module Mihari
       #
       # @param [String] query
       #
-      # @return [Array<Mihari::Artifact>]
+      # @return [Array<Mihari::Models::Artifact>]
       #
       def ssl_search(query)
         params = { query: query }
@@ -67,7 +70,7 @@ module Mihari
         results = res["results"] || []
         results.map do |result|
           data = result["ipAddresses"]
-          data.map { |d| Artifact.new(data: d, metadata: result) }
+          data.map { |d| Models::Artifact.new(data: d, metadata: result) }
         end.flatten
       end
 

data/lib/mihari/clients/publsedive.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # PulseDive API client
+    #
     class PulseDive < Base
       # @return [String]
       attr_reader :api_key
@@ -21,7 +24,7 @@ module Mihari
       end
 
       #
-      # @param [String] indicator_id
+      # @param [String] ip_or_domain
       #
       # @return [Hash]
       #

data/lib/mihari/clients/securitytrails.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # SecurityTrails API client
+    #
     class SecurityTrails < Base
       #
       # @param [String] base_url
@@ -36,13 +39,13 @@ module Mihari
       #
       # @param [String] query
       #
-      # @return [Array<Mihari::Artifact>]
+      # @return [Array<Mihari::Models::Artifact>]
       #
       def ip_search(query)
         records = search_by_ip(query)
         records.filter_map do |record|
           data = record["hostname"]
-          Artifact.new(data: data, metadata: record)
+          Models::Artifact.new(data: data, metadata: record)
         end
       end
 
@@ -57,7 +60,7 @@ module Mihari
         records = search_by_mail(query)
         records.filter_map do |record|
           data = record["hostname"]
-          Artifact.new(data: data, metadata: record)
+          Models::Artifact.new(data: data, metadata: record)
         end
       end
 

data/lib/mihari/clients/shodan.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # Shodan API client
+    #
     class Shodan < Base
       PAGE_SIZE = 100
 
@@ -34,7 +37,7 @@ module Mihari
       # @param [Integer] page
       # @param [Boolean] minify
       #
-      # @return [Structs::Shodan::Result]
+      # @return [Mihari::Structs::Shodan::Result]
       #
       def search(query, page: 1, minify: true)
         params = {
@@ -52,7 +55,7 @@ module Mihari
       # @param [Boolean] minify
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Shodan::Response>]
+      # @return [Enumerable<Mihari::Structs::Shodan::Response>]
       #
       def search_with_pagination(query, minify: true, pagination_limit: Mihari.config.pagination_limit)
         Enumerator.new do |y|

data/lib/mihari/clients/the_hive.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # TheHive API client
+    #
     class TheHive < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/urlscan.rb

@@ -2,12 +2,15 @@
 
 module Mihari
   module Clients
-    class UrlScan < Base
+    #
+    # urlscan.io API client
+    #
+    class Urlscan < Base
       #
       # @param [String] base_url
       # @param [String, nil] api_key
       # @param [Hash] headers
-      # @param [Integer, nil] interval
+      # @param [Integer, nil] pagination_interval
       # @param [Integer, nil] timeout
       #
       def initialize(
@@ -29,7 +32,7 @@ module Mihari
       # @param [Integer, nil] size
       # @param [String, nil] search_after
       #
-      # @return [Structs::Urlscan::Response]
+      # @return [Mihari::Structs::Urlscan::Response]
       #
       def search(q, size: nil, search_after: nil)
         params = { q: q, size: size, search_after: search_after }.compact
@@ -42,7 +45,7 @@ module Mihari
       # @param [Integer, nil] size
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Urlscan::Response>]
+      # @return [Enumerable<Mihari::Structs::Urlscan::Response>]
       #
       def search_with_pagination(q, size: nil, pagination_limit: Mihari.config.pagination_limit)
         search_after = nil