mihari 5.6.2 → 5.7.1

data/lib/mihari/clients/circl.rb

@@ -4,6 +4,9 @@ require "base64"
 
 module Mihari
   module Clients
+    #
+    # CIRCL passive DNS/SSL API client
+    #
     class CIRCL < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/crtsh.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # crt.sh API client
+    #
     class Crtsh < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/dnstwister.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # DNSTwister API client
+    #
     class DNSTwister < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/fofa.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "base64"
+
+module Mihari
+  module Clients
+    #
+    # Fofa API client
+    #
+    class Fofa < Base
+      PAGE_SIZE = 10_000
+
+      # @return [String]
+      attr_reader :api_key
+
+      # @return [String]
+      attr_reader :email
+
+      #
+      # @param [String] base_url
+      # @param [String, nil] api_key
+      # @param [String, nil] email
+      # @param [Hash] headers
+      # @param [Integer] pagination_interval
+      # @param [Integer, nil] timeout
+      #
+      # @param [Object] email
+      def initialize(
+        base_url = "https://fofa.info/",
+        api_key:,
+        email:,
+        headers: {},
+        pagination_interval: Mihari.config.pagination_interval,
+        timeout: nil
+      )
+        raise(ArgumentError, "api_key is required") unless api_key
+        raise(ArgumentError, "email is required") unless email
+
+        @api_key = api_key
+        @email = email
+
+        super(base_url, headers: headers, pagination_interval: pagination_interval, timeout: timeout)
+      end
+
+      #
+      # @param [String] query
+      # @param [Integer] size
+      # @param [Integer] page
+      #
+      # @return [Mihari::Structs::Fofa::Response]
+      #
+      def search(query, page:, size: PAGE_SIZE)
+        qbase64 = Base64.urlsafe_encode64(query)
+        params = { qbase64: qbase64, size: size, page: page, email: email, key: api_key }.compact
+        res = get("/api/v1/search/all", params: params)
+        Structs::Fofa::Response.from_dynamic! JSON.parse(res.body.to_s)
+      end
+
+      #
+      # @param [String] query
+      # @param [Integer] size
+      # @param [Integer] pagination_limit
+      #
+      # @return [Enumerable<Mihari::Structs::Fofa::Response>]
+      #
+      def search_with_pagination(query, size: PAGE_SIZE, pagination_limit: Mihari.config.pagination_limit)
+        Enumerator.new do |y|
+          (1..pagination_limit).each do |page|
+            res = search(query, page: page, size: size)
+
+            y.yield res
+
+            break if res.error
+
+            break if (res.results || []).length < size
+
+            sleep_pagination_interval
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mihari/clients/greynoise.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # GreyNoise API client
+    #
     class GreyNoise < Base
       PAGE_SIZE = 10_000
 
@@ -32,7 +35,7 @@ module Mihari
       # @param [Integer] size Maximum amount of results to grab
       # @param [Integer, nil] scroll Scroll token to paginate through results
       #
-      # @return [Hash]
+      # @return [Mihari::Structs::GreyNoise::Response]
       #
       def gnql_search(query, size: PAGE_SIZE, scroll: nil)
         params = { query: query, size: size, scroll: scroll }.compact
@@ -45,7 +48,7 @@ module Mihari
       # @param [Integer] size
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::GreyNoise::Response>]
+      # @return [Enumerable<Mihari::Structs::GreyNoise::Response>]
       #
       def gnql_search_with_pagination(query, size: PAGE_SIZE, pagination_limit: Mihari.config.pagination_limit)
         scroll = nil

data/lib/mihari/clients/hunterhow.rb

@@ -4,6 +4,9 @@ require "base64"
 
 module Mihari
   module Clients
+    #
+    # hunter.how API client
+    #
     class HunterHow < Base
       PAGE_SIZE = 100
 
@@ -38,7 +41,7 @@ module Mihari
       # @param [String] start_time
       # @param [String] end_time
       #
-      # @return [Structs::HunterHow::Response]
+      # @return [Mihari::Structs::HunterHow::Response]
       #
       def search(query, start_time:, end_time:, page: 1, page_size: PAGE_SIZE)
         params = {
@@ -60,7 +63,7 @@ module Mihari
       # @param [String] start_time
       # @param [String] end_time
       #
-      # @return [Enumerable<Structs::HunterHow::Response>]
+      # @return [Enumerable<Mihari::Structs::HunterHow::Response>]
       #
       def search_with_pagination(
         query,

data/lib/mihari/clients/misp.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # MISP API client
+    #
     class MISP < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/onyphe.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # Onyphe API client
+    #
     class Onyphe < Base
       PAGE_SIZE = 10
 
@@ -33,7 +36,7 @@ module Mihari
       # @param [String] query
       # @param [Integer] page
       #
-      # @return [Structs::Onyphe::Response]
+      # @return [Mihari::Structs::Onyphe::Response]
       #
       def datascan(query, page: 1)
         params = { page: page, apikey: api_key }
@@ -45,7 +48,7 @@ module Mihari
       # @param [String] query
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Onyphe::Response>]
+      # @return [Enumerable<Mihari::Structs::Onyphe::Response>]
       #
       def datascan_with_pagination(query, pagination_limit: Mihari.config.pagination_limit)
         Enumerator.new do |y|

data/lib/mihari/clients/otx.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # OTX API client
+    #
     class OTX < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/passivetotal.rb

@@ -4,6 +4,9 @@ require "base64"
 
 module Mihari
   module Clients
+    #
+    # PassiveTotal API client
+    #
     class PassiveTotal < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/publsedive.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # PulseDive API client
+    #
     class PulseDive < Base
       # @return [String]
       attr_reader :api_key
@@ -21,7 +24,7 @@ module Mihari
       end
 
       #
-      # @param [String] indicator_id
+      # @param [String] ip_or_domain
       #
       # @return [Hash]
       #

data/lib/mihari/clients/securitytrails.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # SecurityTrails API client
+    #
     class SecurityTrails < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/shodan.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # Shodan API client
+    #
     class Shodan < Base
       PAGE_SIZE = 100
 
@@ -34,7 +37,7 @@ module Mihari
       # @param [Integer] page
       # @param [Boolean] minify
       #
-      # @return [Structs::Shodan::Result]
+      # @return [Mihari::Structs::Shodan::Result]
       #
       def search(query, page: 1, minify: true)
         params = {
@@ -52,7 +55,7 @@ module Mihari
       # @param [Boolean] minify
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Shodan::Response>]
+      # @return [Enumerable<Mihari::Structs::Shodan::Response>]
       #
       def search_with_pagination(query, minify: true, pagination_limit: Mihari.config.pagination_limit)
         Enumerator.new do |y|

data/lib/mihari/clients/the_hive.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # TheHive API client
+    #
     class TheHive < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/urlscan.rb

@@ -2,12 +2,15 @@
 
 module Mihari
   module Clients
-    class UrlScan < Base
+    #
+    # urlscan.io API client
+    #
+    class Urlscan < Base
       #
       # @param [String] base_url
       # @param [String, nil] api_key
       # @param [Hash] headers
-      # @param [Integer, nil] interval
+      # @param [Integer, nil] pagination_interval
       # @param [Integer, nil] timeout
       #
       def initialize(
@@ -29,7 +32,7 @@ module Mihari
       # @param [Integer, nil] size
       # @param [String, nil] search_after
       #
-      # @return [Structs::Urlscan::Response]
+      # @return [Mihari::Structs::Urlscan::Response]
       #
       def search(q, size: nil, search_after: nil)
         params = { q: q, size: size, search_after: search_after }.compact
@@ -42,7 +45,7 @@ module Mihari
       # @param [Integer, nil] size
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Urlscan::Response>]
+      # @return [Enumerable<Mihari::Structs::Urlscan::Response>]
       #
       def search_with_pagination(q, size: nil, pagination_limit: Mihari.config.pagination_limit)
         search_after = nil

data/lib/mihari/clients/virustotal.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # VirusTotal API client
+    #
     class VirusTotal < Base
       #
       # @param [String] base_url
@@ -46,7 +49,7 @@ module Mihari
       # @param [String] query
       # @param [String, nil] cursor
       #
-      # @return [Structs::VirusTotalIntelligence::Response]
+      # @return [Mihari::Structs::VirusTotalIntelligence::Response]
       #
       def intel_search(query, cursor: nil)
         params = { query: query, cursor: cursor }.compact
@@ -58,7 +61,7 @@ module Mihari
       # @param [String] query
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::VirusTotalIntelligence::Response>]
+      # @return [Enumerable<Mihari::Structs::VirusTotalIntelligence::Response>]
       #
       def intel_search_with_pagination(query, pagination_limit: Mihari.config.pagination_limit)
         cursor = nil

data/lib/mihari/clients/zoomeye.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # ZoomEye API client
+    #
     class ZoomEye < Base
       PAGE_SIZE = 10
 

data/lib/mihari/commands/alert.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Alert sub-commands
+    #
     module Alert
       class << self
         def included(thor)
@@ -14,28 +17,18 @@ module Mihari
             #
             def add(path)
               Mihari::Database.with_db_connection do
-                builder = Services::AlertBuilder.new(path)
-
-                run_proxy_l = ->(proxy) { run_proxy proxy }
-                result = builder.result.bind(run_proxy_l)
+                result = Dry::Monads::Try[StandardError] do
+                  # @type [Mihari::Services::AlertProxy]
+                  proxy = Mihari::Services::AlertBuilder.call(path)
+                  Mihari::Services::AlertRunner.call(proxy)
+                end.to_result
 
+                # @type [Mihari::Models::Alert]
                 alert = result.value!
                 data = Entities::Alert.represent(alert)
                 puts JSON.pretty_generate(data.as_json)
               end
             end
-
-            no_commands do
-              #
-              # @param [Mihari::Services::AlertProxy] proxy
-              #
-              def run_proxy(proxy)
-                Dry::Monads::Try[StandardError] do
-                  runner = Services::AlertRunner.new(proxy)
-                  runner.run
-                end.to_result
-              end
-            end
           end
         end
       end

data/lib/mihari/commands/database.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Database sub-commands
+    #
     module Database
       class << self
         def included(thor)

data/lib/mihari/commands/rule.rb

@@ -4,6 +4,9 @@ require "pathname"
 
 module Mihari
   module Commands
+    #
+    # Rule sub-commands
+    #
     module Rule
       class << self
         def included(thor)
@@ -48,7 +51,13 @@ module Mihari
               # @return [nil]
               #
               def initialize_rule(path, files = Dry::Files.new)
-                rule = Mihari::Rule.from_yaml File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
+                rule = Mihari::Rule.new(
+                  id: SecureRandom.uuid,
+                  title: "Title goes here",
+                  description: "Description goes here",
+                  created_on: Date.today,
+                  queries: []
+                )
                 files.write(path, rule.yaml)
               end
             end

data/lib/mihari/commands/search.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Search sub-commands
+    #
     module Search
       class << self
         def included(thor)
@@ -17,43 +20,24 @@ module Mihari
             #
             def search(path_or_id)
               Mihari::Database.with_db_connection do
-                builder = Services::RuleBuilder.new(path_or_id)
+                result = Dry::Monads::Try[StandardError] do
+                  # @type [Mihari::Rule]
+                  rule = Services::RuleBuilder.call(path_or_id)
 
-                check_diff_l = ->(rule) { check_diff rule }
-                update_and_run_l = ->(runner) { update_and_run runner }
+                  force_overwrite = options["force_overwrite"] || false
+                  message = "There is a diff in the rule. Are you sure you want to overwrite the rule? (y/n)"
+                  exit 0 if rule.diff? && !force_overwrite && !yes?(message)
 
-                result = builder.result.bind(check_diff_l).bind(update_and_run_l)
+                  rule.update_or_create
+                  rule.call
+                end.to_result
 
+                # @type [Mihari::Models::Alert]
                 alert = result.value!
                 data = Entities::Alert.represent(alert)
                 puts JSON.pretty_generate(data.as_json)
               end
             end
-
-            no_commands do
-              #
-              # @param [Mihari::Services::RuleRunner] rule
-              #
-              def check_diff(rule)
-                force_overwrite = options["force_overwrite"] || false
-                message = "There is a diff in the rule. Are you sure you want to overwrite the rule? (y/n)"
-                runner = Services::RuleRunner.new(rule)
-
-                exit 0 if runner.diff? && !force_overwrite && !yes?(message)
-
-                Success runner
-              end
-
-              #
-              # @param [Mihari::Services::RuleRunner] runner
-              #
-              def update_and_run(runner)
-                Dry::Monads::Try[StandardError] do
-                  runner.update_or_create
-                  runner.run
-                end.to_result
-              end
-            end
           end
         end
       end

data/lib/mihari/commands/version.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Version sub-commands
+    #
     module Version
       class << self
         def included(thor)

data/lib/mihari/commands/web.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Web sub-commands
+    #
     module Web
       class << self
         def included(thor)
@@ -20,7 +23,7 @@ module Mihari
               Mihari.config.hide_config_values = options["hide_config_values"]
               # set rack env as production
               ENV["RACK_ENV"] ||= options["rack_env"]
-              Mihari::App.run!(
+              Mihari::Web::App.run!(
                 port: options["port"],
                 host: options["host"],
                 threads: options["threads"],