mihari 6.2.0 → 7.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d49d8a079c765cb4b7ad7a08825a9d0bd4e9e21fbaf2c0f185c4f27e8f2f2ca6
-  data.tar.gz: aa693115eb1dacc09d13ca0942d859e24566c09a4cd6d702840ec9df6c3cc87a
+  metadata.gz: c3f4b3b5ca761f5ca5e6f3697593f8253b1e6aa03f21924726ad5dc78ac3f011
+  data.tar.gz: f673dd7775f31c2fa134102c8cf9707e0d6fc74467f496c86202de43db7b3c5a
 SHA512:
-  metadata.gz: e50a254b0c5565c3691cc34df0413258a1903f8864f0ced141fab63cb673f02998451723036917f2adf21f759ec3f0086b772e98a02ee0436869dd5846bf3427
-  data.tar.gz: 63738367f8edd23331518eb839c188dde8fb67257b83b5cd6a11e79dc725aa89b151753e7429515ff1b2f7c689da77adf4eac998241b7bfd04f88302aa52c923
+  metadata.gz: 0f139c2a0795bd6e741ce93681f8be47cb75fcb5b707d187d1fd2c758bfe2877388d0d5a25fe5920ec2e7565532c142b585b0029816899664426becea2f0776c
+  data.tar.gz: 6dad7972edcba2090bfa12170539efcd51a20dc1ba94757383546ae630002d374e33dcdbc99675cc719801a80b92a11d2eff308a553d627050f8596d6a877c9a

data/.gitignore

@@ -52,20 +52,14 @@ Gemfile.lock
 # rspec
 .rspec_status
 
-# solargraph
-.solargraph.yml
-
 # SQLite
 *.db
 *.db-shm
 *.db-wal
 
-# Config
-mihari.yml
-
-# Rule
-rule.yml
-!lib/mihari/templates/rule.yml
-
 # Frontend assets
 lib/mihari/web/public/
+
+# Rules & Alerts
+rules/
+alerts/

data/.rubocop.yml

@@ -18,5 +18,7 @@ RSpec/MultipleMemoizedHelpers:
 RSpec/ExampleLength:
   Max: 20
 require:
+  - rubocop-factory_bot
+  - rubocop-rake
   - rubocop-rspec
   - rubocop-yard

data/Dockerfile

@@ -0,0 +1,13 @@
+FROM ruby:3.2.2-alpine3.19
+
+ARG MIHARI_VERSION=0.0.0
+
+RUN apk --no-cache add git build-base ruby-dev postgresql-dev && \
+  gem install pg && \
+  gem install mihari -v ${MIHARI_VERSION} && \
+  apk del --purge git build-base ruby-dev && \
+  rm -rf /usr/local/bundle/cache/*
+
+ENTRYPOINT ["mihari"]
+
+CMD ["--help"]

data/config.ru

@@ -1,8 +1,10 @@
-require "./lib/mihari"
+$LOAD_PATH.unshift("#{__dir__}/../lib")
+
+require "mihari"
+require "mihari/web/application"
 
 require "better_errors"
 
-# set rack env as development
-ENV["RACK_ENV"] ||= "development"
+ENV["APP_ENV"] ||= "development"
 
 run Mihari::Web::App.instance

data/docker-compose.yml

@@ -0,0 +1,62 @@
+version: "3"
+services:
+  database:
+    image: postgres:16
+    volumes:
+      - postgresql:/var/lib/postgresql/data
+    ports:
+      - ${POSTGRES_PORT:-5432}:5432
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER:-user}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-password}
+      - POSTGRES_DB=${POSTGRES_DB:-mihari}
+    restart: always
+
+  redis:
+    image: "redis/redis-stack:6.2.6-v10"
+    restart: always
+    ports:
+      - ${REDIS_PORT:-6379}:6379
+      - ${REDIS_INSIGHT_PORT:-8001}:8001
+    volumes:
+      - redis:/data
+
+  mihari-init:
+    image: ghcr.io/ninoseki/mihari:latest
+    environment:
+      - DATABASE_URL=${DATABASE_URL:-postgresql://${POSTGRES_USER:-user}:${POSTGRES_PASSWORD:-password}@database:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-mihari}}
+    entrypoint: ["mihari", "db", "migrate"]
+    depends_on:
+      - database
+
+  mihari:
+    image: ghcr.io/ninoseki/mihari:latest
+    ports:
+      - ${MIHARI_PORT:-9292}:9292
+    environment:
+      - DATABASE_URL=${DATABASE_URL:-postgresql://${POSTGRES_USER:-user}:${POSTGRES_PASSWORD:-password}@database:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-mihari}}
+      - REDIS_URL=${REDIS_URL:-redis://redis:${REDIS_PORT:-6379}}
+    env_file:
+      - .env
+    entrypoint: ["mihari", "web", "--host", "0.0.0.0"]
+    restart: always
+    depends_on:
+      - mihari-init
+
+  sidekiq:
+    image: ghcr.io/ninoseki/mihari:latest
+    environment:
+      - DATABASE_URL=${DATABASE_URL:-postgresql://${POSTGRES_USER:-user}:${POSTGRES_PASSWORD:-password}@database:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-mihari}}
+      - REDIS_URL=${REDIS_URL:-redis://redis:${REDIS_PORT:-6379}}
+      - USE_SIDEKIQ=true
+    env_file:
+      - .env
+    entrypoint: ["mihari", "sidekiq"]
+    restart: always
+    depends_on:
+      - mihari-init
+      - redis
+
+volumes:
+  postgresql:
+  redis:

data/exe/mihari

@@ -4,5 +4,6 @@
 $LOAD_PATH.unshift("#{__dir__}/../lib")
 
 require "mihari"
+require "mihari/cli/application"
 
-Mihari::CLI::Main.start
+Mihari::CLI::App.start

data/lefthook.yml

@@ -10,3 +10,11 @@ pre-commit:
       glob: "*.{js,ts,vue}"
       run: npx eslint --fix {staged_files}
       stage_fixed: true
+    prettier:
+      root: "frontend/"
+      glob: "*.{js,ts,vue}"
+      run: npx prettier --write {staged_files}
+      stage_fixed: true
+    actionlint:
+      glob: ".github/workflows/*.yaml"
+      run: actionlint

data/lib/mihari/actor.rb

@@ -7,8 +7,8 @@ module Mihari
   class Actor
     include Dry::Monads[:result, :try]
 
-    include Mixins::Configurable
-    include Mixins::Retriable
+    include Concerns::Configurable
+    include Concerns::Retriable
 
     # @return [Hash]
     attr_reader :options
@@ -53,8 +53,8 @@ module Mihari
     def validate_configuration!
       return if configured?
 
-      joined = configuration_keys.join(", ")
-      be = (configuration_keys.length > 1) ? "are" : "is"
+      joined = self.class.configuration_keys.join(", ")
+      be = (self.class.configuration_keys.length > 1) ? "are" : "is"
       message = "#{self.class.class_key} is not configured correctly. #{joined} #{be} missing."
       raise ConfigurationError, message
     end

data/lib/mihari/analyzers/base.rb

@@ -79,6 +79,22 @@ module Mihari
         normalized_artifacts
       end
 
+      def result(...)
+        res = Try[StandardError] do
+          retry_on_error(
+            times: retry_times,
+            interval: retry_interval,
+            exponential_backoff: retry_exponential_backoff
+          ) do
+            call(...)
+          end
+        end
+
+        return res.recover { [] } if ignore_error?
+
+        res.to_result
+      end
+
       class << self
         #
         # Initialize an analyzer by query params

data/lib/mihari/analyzers/binaryedge.rb

@@ -24,8 +24,10 @@ module Mihari
         client.search_with_pagination(query, pagination_limit: pagination_limit).map(&:artifacts).flatten
       end
 
-      def configuration_keys
-        %w[binaryedge_api_key]
+      class << self
+        def configuration_keys
+          %w[binaryedge_api_key]
+        end
       end
 
       private

data/lib/mihari/analyzers/censys.rb

@@ -41,11 +41,13 @@ module Mihari
         configuration_keys? || (id? && secret?)
       end
 
-      #
-      # @return [Array<String>]
-      #
-      def configuration_keys
-        %w[censys_id censys_secret]
+      class << self
+        #
+        # @return [Array<String>]
+        #
+        def configuration_keys
+          %w[censys_id censys_secret]
+        end
       end
 
       private

data/lib/mihari/analyzers/circl.rb

@@ -6,7 +6,7 @@ module Mihari
     # CIRCL passive DNS/SSL analyzer
     #
     class CIRCL < Base
-      include Mixins::Refang
+      include Concerns::Refangable
 
       # @return [String, nil]
       attr_reader :type
@@ -47,8 +47,10 @@ module Mihari
         configuration_keys? || (username? && password?)
       end
 
-      def configuration_keys
-        %w[circl_passive_password circl_passive_username]
+      class << self
+        def configuration_keys
+          %w[circl_passive_password circl_passive_username]
+        end
       end
 
       private

data/lib/mihari/analyzers/crtsh.rb

@@ -22,7 +22,10 @@ module Mihari
 
       def artifacts
         exclude = exclude_expired ? "expired" : nil
-        client.search(query, exclude: exclude)
+        client.search(query, exclude: exclude).map do |result|
+          values = result["name_value"].to_s.lines.map(&:chomp).reject { |value| value.starts_with?("*.") }
+          values.map { |value| Models::Artifact.new(data: value, metadata: result) }
+        end.flatten
       end
 
       private

data/lib/mihari/analyzers/dnstwister.rb

@@ -6,7 +6,7 @@ module Mihari
     # DNSTwister analyzer
     #
     class DNSTwister < Base
-      include Mixins::Refang
+      include Concerns::Refangable
 
       # @return [String]
       attr_reader :type

data/lib/mihari/analyzers/feed.rb

@@ -1,8 +1,5 @@
 # frozen_string_literal: true
 
-require "mihari/feed/reader"
-require "mihari/feed/parser"
-
 module Mihari
   module Analyzers
     #
@@ -10,7 +7,7 @@ module Mihari
     #
     class Feed < Base
       # @return [Hash, nil]
-      attr_reader :data
+      attr_reader :form
 
       # @return [Hash, nil]
       attr_reader :json
@@ -37,37 +34,32 @@ module Mihari
       # @param [Hash, nil] headers
       # @param [Hash, nil] params
       # @param [Hash, nil] json
-      # @param [Hash, nil] data
+      # @param [form, nil] form
       # @param [String] selector
       #
-      def initialize(query, options: nil, method: "GET", headers: nil, params: nil, json: nil, data: nil, selector: "")
-        super(query, options: options)
+      # @param [Object] url
+      def initialize(url, options: nil, method: "GET", headers: nil, params: nil, json: nil, form: nil, selector: "")
+        super(url, options: options)
 
         @method = method
         @headers = headers || {}
         @params = params
         @json = json
-        @data = data
+        @form = form
         @selector = selector
       end
 
       def artifacts
-        Mihari::Feed::Parser.new(results).parse selector
+        data = Services::FeedReader.call(
+          url, headers: headers, method: method, params: params, json: json, form: form, timeout: timeout
+        )
+        Services::FeedParser.call(data, selector)
       end
 
       private
 
-      def results
-        reader = Mihari::Feed::Reader.new(
-          query,
-          method: method,
-          headers: headers,
-          timeout: timeout,
-          params: params,
-          json: json,
-          data: data
-        )
-        reader.read
+      def url
+        query
       end
     end
   end

data/lib/mihari/analyzers/fofa.rb

@@ -31,20 +31,18 @@ module Mihari
         end.flatten.compact
       end
 
-      def configuration_keys
-        %w[fofa_api_key fofa_email]
-      end
-
       def configured?
         api_key? && email?
       end
 
-      private
-
-      def api_key?
-        !api_key.nil?
+      class << self
+        def configuration_keys
+          %w[fofa_api_key fofa_email]
+        end
       end
 
+      private
+
       def email?
         !email.nil?
       end

data/lib/mihari/analyzers/greynoise.rb

@@ -27,8 +27,10 @@ module Mihari
         ).map(&:artifacts).flatten
       end
 
-      def configuration_keys
-        %w[greynoise_api_key]
+      class << self
+        def configuration_keys
+          %w[greynoise_api_key]
+        end
       end
 
       private

data/lib/mihari/analyzers/hunterhow.rb

@@ -44,8 +44,10 @@ module Mihari
         end.flatten
       end
 
-      def configuration_keys
-        %w[hunterhow_api_key]
+      class << self
+        def configuration_keys
+          %w[hunterhow_api_key]
+        end
       end
 
       private

data/lib/mihari/analyzers/onyphe.rb

@@ -29,8 +29,10 @@ module Mihari
         ).map(&:artifacts).flatten
       end
 
-      def configuration_keys
-        %w[onyphe_api_key]
+      class << self
+        def configuration_keys
+          %w[onyphe_api_key]
+        end
       end
 
       private

data/lib/mihari/analyzers/otx.rb

@@ -6,7 +6,7 @@ module Mihari
     # OTX analyzer
     #
     class OTX < Base
-      include Mixins::Refang
+      include Concerns::Refangable
 
       # @return [String, nil]
       attr_reader :type
@@ -38,8 +38,10 @@ module Mihari
         end
       end
 
-      def configuration_keys
-        %w[otx_api_key]
+      class << self
+        def configuration_keys
+          %w[otx_api_key]
+        end
       end
 
       private

data/lib/mihari/analyzers/passivetotal.rb

@@ -6,7 +6,7 @@ module Mihari
     # PassiveTotal analyzer
     #
     class PassiveTotal < Base
-      include Mixins::Refang
+      include Concerns::Refangable
 
       # @return [String, nil]
       attr_reader :type
@@ -35,11 +35,11 @@ module Mihari
       def artifacts
         case type
         when "domain", "ip"
-          client.passive_dns_search query
+          passive_dns_search
         when "mail"
-          client.reverse_whois_search query
+          reverse_whois_search
         when "hash"
-          client.ssl_search query
+          ssl_search
         else
           raise ValueError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type?
         end
@@ -49,11 +49,11 @@ module Mihari
         configuration_keys? || (username? && api_key?)
       end
 
-      def configuration_keys
-        %w[passivetotal_username passivetotal_api_key]
-      end
-
       class << self
+        def configuration_keys
+          %w[passivetotal_username passivetotal_api_key]
+        end
+
         #
         # @return [Array<String>, nil]
         #
@@ -64,6 +64,27 @@ module Mihari
 
       private
 
+      def passive_dns_search
+        res = client.passive_dns_search(query)
+        res["results"] || []
+      end
+
+      def reverse_whois_search
+        res = client.reverse_whois_search(query)
+        (res["results"] || []).map do |result|
+          data = result["domain"]
+          Models::Artifact.new(data: data, metadata: result)
+        end
+      end
+
+      def ssl_search
+        res = client.ssl_search(query)
+        (res["results"] || []).map do |result|
+          data = result["ipAddresses"]
+          data.map { |d| Models::Artifact.new(data: d, metadata: result) }
+        end.flatten
+      end
+
       def client
         Clients::PassiveTotal.new(username: username, api_key: api_key, timeout: timeout)
       end
@@ -80,10 +101,6 @@ module Mihari
       def username?
         !username.nil?
       end
-
-      def api_key?
-        !api_key.nil?
-      end
     end
   end
 end

data/lib/mihari/analyzers/pulsedive.rb

@@ -6,7 +6,7 @@ module Mihari
     # Pulsedive analyzer
     #
     class Pulsedive < Base
-      include Mixins::Refang
+      include Concerns::Refangable
 
       # @return [String, nil]
       attr_reader :type
@@ -43,8 +43,10 @@ module Mihari
         end
       end
 
-      def configuration_keys
-        %w[pulsedive_api_key]
+      class << self
+        def configuration_keys
+          %w[pulsedive_api_key]
+        end
       end
 
       private

data/lib/mihari/analyzers/securitytrails.rb

@@ -6,7 +6,7 @@ module Mihari
     # SecurityTrails
     #
     class SecurityTrails < Base
-      include Mixins::Refang
+      include Concerns::Refangable
 
       # @return [String, nil]
       attr_reader :type
@@ -33,21 +33,21 @@ module Mihari
       def artifacts
         case type
         when "domain"
-          client.domain_search query
+          domain_search
         when "ip"
-          client.ip_search query
+          ip_search
         when "mail"
-          client.mail_search query
+          mail_search
         else
           raise ValueError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type?
         end
       end
 
-      def configuration_keys
-        %w[securitytrails_api_key]
-      end
-
       class << self
+        def configuration_keys
+          %w[securitytrails_api_key]
+        end
+
         #
         # @return [Array<String>, nil]
         #
@@ -58,6 +58,30 @@ module Mihari
 
       private
 
+      def domain_search
+        client.get_all_dns_history(query, type: "a").map do |res|
+          (res["records"] || []).map do |record|
+            (record["values"] || []).map { |value| value["ip"] }
+          end.flatten.compact.uniq
+        end.flatten
+      end
+
+      def ip_search
+        res = client.ip_search(query)
+        (res["records"] || []).filter_map do |record|
+          data = record["hostname"]
+          Models::Artifact.new(data: data, metadata: record)
+        end
+      end
+
+      def mail_search
+        res = client.mail_search(query)
+        (res["records"] || []).filter_map do |record|
+          data = record["hostname"]
+          Models::Artifact.new(data: data, metadata: record)
+        end
+      end
+
       def client
         Clients::SecurityTrails.new(api_key: api_key, timeout: timeout)
       end

data/lib/mihari/analyzers/shodan.rb

@@ -27,8 +27,10 @@ module Mihari
         ).map(&:artifacts).flatten.uniq(&:data)
       end
 
-      def configuration_keys
-        %w[shodan_api_key]
+      class << self
+        def configuration_keys
+          %w[shodan_api_key]
+        end
       end
 
       private

data/lib/mihari/analyzers/urlscan.rb

@@ -37,8 +37,10 @@ module Mihari
         artifacts.select { |artifact| allowed_data_types.include? artifact.data_type }
       end
 
-      def configuration_keys
-        %w[urlscan_api_key]
+      class << self
+        def configuration_keys
+          %w[urlscan_api_key]
+        end
       end
 
       private

data/lib/mihari/analyzers/virustotal.rb

@@ -6,7 +6,7 @@ module Mihari
     # VirusTotal analyzer
     #
     class VirusTotal < Base
-      include Mixins::Refang
+      include Concerns::Refangable
 
       # @return [String]
       attr_reader :type
@@ -38,11 +38,11 @@ module Mihari
         end
       end
 
-      def configuration_keys
-        %w[virustotal_api_key]
-      end
-
       class << self
+        def configuration_keys
+          %w[virustotal_api_key]
+        end
+
         #
         # @return [Array<String>, nil]
         #

data/lib/mihari/analyzers/virustotal_intelligence.rb

@@ -24,8 +24,10 @@ module Mihari
         client.intel_search_with_pagination(query, pagination_limit: pagination_limit).map(&:artifacts).flatten
       end
 
-      def configuration_keys
-        %w[virustotal_api_key]
+      class << self
+        def configuration_keys
+          %w[virustotal_api_key]
+        end
       end
 
       class << self