miteru 0.10.2 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6057e12be663bcbdee3bb8f2f2b67b1d9934ef2b5f2f80a884c1cb8f23eeda1f
-  data.tar.gz: e59d63425074d6164d84135866856319bcf341a9c0efa78848550b43dc898e83
+  metadata.gz: d868b4b59c518eafe81396a1b99749b4eae3902064b04a793bfebd430ff1f439
+  data.tar.gz: 168da4c83289e570e5c52d8d9177af13459d6598900c8396d7276c472c014a3d
 SHA512:
-  metadata.gz: 6a952617edc210c6819d46e0ab21537d94f208263b03fab8f715ee6972e16ffe18832f34e5dab8827fd549610507a780f7f1c10a535407497e3afb99c0c00ab6
-  data.tar.gz: '08c53d7fb2320426fc0f8635c08a140ea7ada3d917d264b35767605a324760654e81eb9e590d13429197d44367cef2eaca839cccafe68716cb7e2da54d91c88f'
+  metadata.gz: c38d39f868a469b6ef62949f4905e8ae038c833ec1745446cf6ef06a3c206e2996d49b48b8b991ab2a63f7ec0a3c224e435d8cd36dc3232194e45eb0997abc7d
+  data.tar.gz: 0c019fc0ba2e3037522cb5fb0f262e830e169f9bef6d522812c66ec16cffa770c2b1c81b7cdd3543bb2bfb8f4b406f5d4470dc191429522fa8b61e1b7dadb081

data/README.md

@@ -13,6 +13,7 @@ Miteru is an experimental phishing kit detection tool.
   - [urlscan.io certstream-suspicious feed](https://urlscan.io/search/#certstream-suspicious)
   - [OpenPhish feed via urlscan.io](https://urlscan.io/search/#OpenPhish)
   - [PhishTank feed via urlscan.io](https://urlscan.io/search/#PhishTank)
+  - [Ayashige feed](https://github.com/ninoseki/ayashige)
 - It checks a suspicious URL whether it enables directory listing and contains a phishing kit (compressed file) or not.
   - Note: compressed file = `*.zip`, `*.rar`, `*.7z`, `*.tar` and `*.gz`.
 
@@ -67,6 +68,17 @@ https://dummy3.com: it doesn't contain a phishing kit.
 https://dummy4.com: it might contain a phishing kit (dummy.zip).
 ```
 
+## Using Docker (alternative if you don't install Ruby)
+
+```sh
+$ git clone https://github.com/ninoseki/miteru.git
+$ cd miteru/docker
+$ docker build -t miteru .
+$ docker run miteru
+# ex. auto-download detected phishing kit(s) into host machines's /tmp directory
+$ docker run -v /tmp:/tmp miteru execute --auto-download
+```
+
 ## Aasciinema cast
 
 [![asciicast](https://asciinema.org/a/ga6ZbwuK1HOLOyELb23QrSvJP.svg)](https://asciinema.org/a/ga6ZbwuK1HOLOyELb23QrSvJP)

data/docker/Dockerfile

@@ -0,0 +1,7 @@
+FROM ruby:2.5
+
+RUN gem install miteru
+
+ENTRYPOINT ["miteru"]
+
+CMD ["--help"]

data/lib/miteru/feeds.rb

@@ -1,21 +1,27 @@
 # frozen_string_literal: true
 
 require_relative "./feeds/feed"
+require_relative "./feeds/ayashige"
 require_relative "./feeds/urlscan"
 
 module Miteru
   class Feeds
-    attr_reader :openphish, :phishtank, :urlscan
     attr_reader :directory_traveling
 
     def initialize(urlscan_size = 100, directory_traveling: false)
-      @urlscan = UrlScan.new(urlscan_size)
+      @feeds = [
+        Ayashige.new,
+        UrlScan.new(urlscan_size)
+      ]
       @directory_traveling = directory_traveling
     end
 
     def suspicious_urls
       @suspicious_urls ||= [].tap do |arr|
-        urls = urlscan.urls.select { |url| url.start_with?("http://", "https://") }
+        urls = @feeds.map do |feed|
+          feed.urls.select { |url| url.start_with?("http://", "https://") }
+        end.flatten
+
         urls.map { |url| breakdown(url) }.flatten.uniq.sort.each { |url| arr << url }
       end
     end

data/lib/miteru/feeds/ayashige.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+
+module Miteru
+  class Feeds
+    class Ayashige < Feed
+      HOST = "ayashige.herokuapp.com"
+      URL = "https://#{HOST}/"
+
+      def urls
+        url = url_for("/feed")
+        res = JSON.parse(get(url))
+
+        domains = res.map { |item| item["domain"]}
+        domains.map do |domain|
+          [
+            "https://#{domain}",
+            "http://#{domain}"
+          ]
+        end.flatten
+      rescue HTTPResponseError => e
+        puts "Failed to load ayashige feed (#{e})"
+        []
+      end
+
+      private
+
+      def url_for(path)
+        URI(URL + path)
+      end
+    end
+  end
+end

data/lib/miteru/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Miteru
-  VERSION = "0.10.2"
+  VERSION = "0.11.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: miteru
 version: !ruby/object:Gem::Version
-  version: 0.10.2
+  version: 0.11.0
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-11-18 00:00:00.000000000 Z
+date: 2018-12-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -209,6 +209,7 @@ files:
 - Rakefile
 - bin/console
 - bin/setup
+- docker/Dockerfile
 - exe/miteru
 - lib/miteru.rb
 - lib/miteru/cli.rb
@@ -216,6 +217,7 @@ files:
 - lib/miteru/downloader.rb
 - lib/miteru/error.rb
 - lib/miteru/feeds.rb
+- lib/miteru/feeds/ayashige.rb
 - lib/miteru/feeds/feed.rb
 - lib/miteru/feeds/urlscan.rb
 - lib/miteru/http_client.rb