passivetotal 1.0.2 → 1.0.6

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
- SHA1:
3
- metadata.gz: 85bce6ee916bb8a5e96cc67480e16d83c66f0cca
4
- data.tar.gz: ebd30157e8c383b021470901978b00409555c181
2
+ SHA256:
3
+ metadata.gz: a83e6b94b558fcf2e524fd272d2a0238b325aae63689871c8c8f52ff1e211f29
4
+ data.tar.gz: 335f3ec0c83e2987619932c71470a109afab17581158cccdbb9e0dfb5541574c
5
5
  SHA512:
6
- metadata.gz: d471517e4c76f369bae5db3a817ff6fd186da54bc579dbda3d6e0b468d66bea6316e827d794e7782ecda1138c4fa733e655e8e6f9ca4d6d774f3155053e1fcb3
7
- data.tar.gz: c2dfa0a1e729101bc703ad7bbe7ae9586041a2fcbf2945bf54e8d2e9125adfd6e089ee8b4ff735d61542e03acb815f265fae15de32416f8cbcac78643dd45c4a
6
+ metadata.gz: 856745401361b82a1096c387eb6d1d0db9937507ee3e390ca41effb5853c80e8d604c9f4ec9990a25e13aa72ff20a3383d0800ddac7bf8036078850751b83e8d
7
+ data.tar.gz: c0cf41003118d3cffaebc7aba2b7a78b4eb39806587bf7538c7c34f51284aea6fe98dff5f79fc33e54842c99ad1e94e6074fc763e50f25b99a9fd17ad6fe008e
@@ -7,23 +7,23 @@ require 'passivetotal/version'
7
7
  # DESCRIPTION: rubygem for querying PassiveTotal.org's web API
8
8
 
9
9
  module PassiveTotal # :nodoc:
10
-
10
+
11
11
  class InvalidAPIKeyError < ArgumentError; end
12
12
  class APIUsageError < StandardError; end
13
13
  class ExceededQuotaError < StandardError; end
14
-
14
+
15
15
  class Transaction < Struct.new(:query, :response, :response_time); end
16
16
  class Query < Struct.new(:api, :query, :set, :url, :parameters); end
17
17
  class Response < Struct.new(:json, :success, :results); end
18
-
18
+
19
19
  # The API class wraps the PassiveTotal.org web API for all the verbs that it supports
20
- # See https://www.passivetotal.org/api/docs for the API documentation.
20
+ # See https://api.passivetotal.org/api/docs/ for the API documentation.
21
21
  class API
22
22
  # The TLDS array helps the interface detect valid domains.
23
23
  # This list was generated by parsing the NS records from a zone transfer of the root
24
24
  # The same list could have been downloaded from http://data.iana.org/TLD/tlds-alpha-by-domain.txt
25
- TLDS = "abb,abbott,abogado,ac,academy,accenture,accountant,accountants,active,actor,ad,ads,adult,ae,aeg,aero,af,afl,ag,agency,ai,aig,airforce,al,allfinanz,alsace,am,amsterdam,an,android,ao,apartments,aq,aquarelle,ar,archi,army,arpa,as,asia,associates,at,attorney,au,auction,audio,auto,autos,aw,ax,axa,az,azure,ba,band,bank,bar,barclaycard,barclays,bargains,bauhaus,bayern,bb,bbc,bbva,bd,be,beer,berlin,best,bf,bg,bh,bharti,bi,bible,bid,bike,bing,bingo,bio,biz,bj,black,blackfriday,bloomberg,blue,bm,bmw,bn,bnl,bnpparibas,bo,boats,bond,boo,boutique,br,bradesco,bridgestone,broker,brother,brussels,bs,bt,budapest,build,builders,business,buzz,bv,bw,by,bz,bzh,ca,cab,cafe,cal,camera,camp,cancerresearch,canon,capetown,capital,caravan,cards,care,career,careers,cars,cartier,casa,cash,casino,cat,catering,cba,cbn,cc,cd,center,ceo,cern,cf,cfa,cfd,cg,ch,channel,chat,cheap,chloe,christmas,chrome,church,ci,cisco,citic,city,ck,cl,claims,cleaning,click,clinic,clothing,cloud,club,cm,cn,co,coach,codes,coffee,college,cologne,com,commbank,community,company,computer,condos,construction,consulting,contractors,cooking,cool,coop,corsica,country,coupons,courses,cr,credit,creditcard,cricket,crown,crs,cruises,cu,cuisinella,cv,cw,cx,cy,cymru,cyou,cz,dabur,dad,dance,date,dating,datsun,day,dclk,de,deals,degree,delivery,democrat,dental,dentist,desi,design,dev,diamonds,diet,digital,direct,directory,discount,dj,dk,dm,dnp,do,docs,dog,doha,domains,doosan,download,drive,durban,dvag,dz,earth,eat,ec,edu,education,ee,eg,email,emerck,energy,engineer,engineering,enterprises,epson,equipment,er,erni,es,esq,estate,et,eu,eurovision,eus,events,everbank,exchange,expert,exposed,express,fail,faith,fan,fans,farm,fashion,feedback,fi,film,finance,financial,firmdale,fish,fishing,fit,fitness,fj,fk,flights,florist,flowers,flsmidth,fly,fm,fo,foo,football,forex,forsale,foundation,fr,frl,frogans,fund,furniture,futbol,fyi,ga,gal,gallery,garden,gb,gbiz,gd,gdn,ge,gent,genting,gf,gg,ggee,gh,gi,gift,gifts,gives,gl,glass,gle,global,globo,gm,gmail,gmo,gmx,gn,gold,goldpoint,golf,goo,goog,google,gop,gov,gp,gq,gr,graphics,gratis,green,gripe,gs,gt,gu,guge,guide,guitars,guru,gw,gy,hamburg,hangout,haus,healthcare,help,here,hermes,hiphop,hitachi,hiv,hk,hm,hn,hockey,holdings,holiday,homedepot,homes,honda,horse,host,hosting,hoteles,hotmail,house,how,hr,ht,hu,ibm,icbc,icu,id,ie,ifm,il,im,immo,immobilien,in,industries,infiniti,info,ing,ink,institute,insure,int,international,investments,io,iq,ir,irish,is,it,iwc,java,jcb,je,jetzt,jewelry,jlc,jll,jm,jo,jobs,joburg,jp,juegos,kaufen,kddi,ke,kg,kh,ki,kim,kitchen,kiwi,km,kn,koeln,komatsu,kp,kr,krd,kred,kw,ky,kyoto,kz,la,lacaixa,land,lasalle,lat,latrobe,law,lawyer,lb,lc,lds,lease,leclerc,legal,lgbt,li,liaison,lidl,life,lighting,limited,limo,link,lk,loan,loans,lol,london,lotte,lotto,love,lr,ls,lt,ltda,lu,lupin,luxe,luxury,lv,ly,ma,madrid,maif,maison,management,mango,market,marketing,markets,marriott,mba,mc,md,me,media,meet,melbourne,meme,memorial,men,menu,mg,mh,miami,microsoft,mil,mini,mk,ml,mm,mma,mn,mo,mobi,moda,moe,monash,money,montblanc,mormon,mortgage,moscow,motorcycles,mov,movie,movistar,mp,mq,mr,ms,mt,mtn,mtpc,mu,museum,mv,mw,mx,my,mz,na,nadex,nagoya,name,navy,nc,ne,nec,net,netbank,network,neustar,new,news,nexus,nf,ng,ngo,nhk,ni,nico,ninja,nissan,nl,no,np,nr,nra,nrw,ntt,nu,nyc,nz,office,okinawa,om,omega,one,ong,onl,online,ooo,oracle,org,organic,osaka,otsuka,ovh,pa,page,panerai,paris,partners,parts,party,pe,pf,pg,ph,pharmacy,philips,photo,photography,photos,physio,piaget,pics,pictet,pictures,pink,pizza,pk,pl,place,play,plumbing,plus,pm,pn,pohl,poker,porn,post,pr,praxi,press,pro,prod,productions,prof,properties,property,ps,pt,pub,pw,py,qa,qpon,quebec,racing,re,realtor,recipes,red,redstone,rehab,reise,reisen,reit,ren,rent,rentals,repair,report,republican,rest,restaurant,review,reviews,rich,ricoh,rio,rip,ro,rocks,rodeo,rs,rsvp,ru,ruhr,run,rw,ryukyu,sa,saarland,sale,samsung,sandvik,sandvikcoromant,sap,sarl,saxo,sb,sc,sca,scb,schmidt,scholarships,school,schule,schwarz,science,scor,scot,sd,se,seat,sener,services,sew,sex,sexy,sg,sh,shiksha,shoes,show,shriram,si,singles,site,sj,sk,ski,sky,skype,sl,sm,sn,sncf,so,soccer,social,software,sohu,solar,solutions,sony,soy,space,spiegel,spreadbetting,sr,st,starhub,statoil,study,style,su,sucks,supplies,supply,support,surf,surgery,suzuki,sv,swatch,swiss,sx,sy,sydney,systems,sz,taipei,tatar,tattoo,tax,taxi,tc,td,team,tech,technology,tel,telefonica,temasek,tennis,tf,tg,th,thd,theater,tickets,tienda,tips,tires,tirol,tj,tk,tl,tm,tn,to,today,tokyo,tools,top,toray,toshiba,tours,town,toys,tr,trade,trading,training,travel,trust,tt,tui,tv,tw,tz,ua,ug,uk,university,uno,uol,us,uy,uz,va,vacations,vc,ve,vegas,ventures,versicherung,vet,vg,vi,viajes,video,villas,vision,vista,vistaprint,vlaanderen,vn,vodka,vote,voting,voto,voyage,vu,wales,walter,wang,watch,webcam,website,wed,wedding,weir,wf,whoswho,wien,wiki,williamhill,win,windows,wme,work,works,world,ws,wtc,wtf,xbox,xerox,xin,xn--1qqw23a,xn--30rr7y,xn--3bst00m,xn--3ds443g,xn--3e0b707e,xn--45brj9c,xn--45q11c,xn--4gbrim,xn--55qw42g,xn--55qx5d,xn--6frz82g,xn--6qq986b3xl,xn--80adxhks,xn--80ao21a,xn--80asehdb,xn--80aswg,xn--90a3ac,xn--90ais,xn--9et52u,xn--b4w605ferd,xn--c1avg,xn--cg4bki,xn--clchc0ea0b2g2a9gcd,xn--czr694b,xn--czrs0t,xn--czru2d,xn--d1acj3b,xn--d1alf,xn--estv75g,xn--fiq228c5hs,xn--fiq64b,xn--fiqs8s,xn--fiqz9s,xn--fjq720a,xn--flw351e,xn--fpcrj9c3d,xn--fzc2c9e2c,xn--gecrj9c,xn--h2brj9c,xn--hxt814e,xn--i1b6b1a6a2e,xn--imr513n,xn--io0a7i,xn--j1amh,xn--j6w193g,xn--kcrx77d1x4a,xn--kprw13d,xn--kpry57d,xn--kput3i,xn--l1acc,xn--lgbbat1ad8j,xn--mgb9awbf,xn--mgba3a4f16a,xn--mgbaam7a8h,xn--mgbab2bd,xn--mgbayh7gpa,xn--mgbbh1a71e,xn--mgbc0a9azcg,xn--mgberp4a5d4ar,xn--mgbpl2fh,xn--mgbx4cd0ab,xn--mxtq1m,xn--ngbc5azd,xn--node,xn--nqv7f,xn--nqv7fs00ema,xn--nyqy26a,xn--o3cw4h,xn--ogbpf8fl,xn--p1acf,xn--p1ai,xn--pgbs0dh,xn--q9jyb4c,xn--qcka1pmc,xn--rhqv96g,xn--s9brj9c,xn--ses554g,xn--unup4y,xn--vermgensberater-ctb,xn--vermgensberatung-pwb,xn--vhquv,xn--vuq861b,xn--wgbh1c,xn--wgbl6a,xn--xhq521b,xn--xkc2al3hye2a,xn--xkc2dl3a5ee0h,xn--y9a3aq,xn--yfro4i67o,xn--ygbi2ammx,xn--zfr164b,xxx,xyz,yachts,yandex,ye,yodobashi,yoga,yokohama,youtube,yt,za,zip,zm,zone,zuerich,zw".split(/,/)
26
-
25
+ TLDS = "aaa,aarp,abarth,abb,abbott,abbvie,abc,able,abogado,abudhabi,ac,academy,accenture,accountant,accountants,aco,actor,ad,adac,ads,adult,ae,aeg,aero,aetna,af,afamilycompany,afl,africa,ag,agakhan,agency,ai,aig,airbus,airforce,airtel,akdn,al,alfaromeo,alibaba,alipay,allfinanz,allstate,ally,alsace,alstom,am,amazon,americanexpress,americanfamily,amex,amfam,amica,amsterdam,analytics,android,anquan,anz,ao,aol,apartments,app,apple,aq,aquarelle,ar,arab,aramco,archi,army,arpa,art,arte,as,asda,asia,associates,at,athleta,attorney,au,auction,audi,audible,audio,auspost,author,auto,autos,avianca,aw,aws,ax,axa,az,azure,ba,baby,baidu,banamex,bananarepublic,band,bank,bar,barcelona,barclaycard,barclays,barefoot,bargains,baseball,basketball,bauhaus,bayern,bb,bbc,bbt,bbva,bcg,bcn,bd,be,beats,beauty,beer,bentley,berlin,best,bestbuy,bet,bf,bg,bh,bharti,bi,bible,bid,bike,bing,bingo,bio,biz,bj,black,blackfriday,blockbuster,blog,bloomberg,blue,bm,bms,bmw,bn,bnpparibas,bo,boats,boehringer,bofa,bom,bond,boo,book,booking,bosch,bostik,boston,bot,boutique,box,br,bradesco,bridgestone,broadway,broker,brother,brussels,bs,bt,budapest,bugatti,build,builders,business,buy,buzz,bv,bw,by,bz,bzh,ca,cab,cafe,cal,call,calvinklein,cam,camera,camp,cancerresearch,canon,capetown,capital,capitalone,car,caravan,cards,care,career,careers,cars,casa,case,cash,casino,cat,catering,catholic,cba,cbn,cbre,cbs,cc,cd,center,ceo,cern,cf,cfa,cfd,cg,ch,chanel,channel,charity,chase,chat,cheap,chintai,christmas,chrome,church,ci,cipriani,circle,cisco,citadel,citi,citic,city,cityeats,ck,cl,claims,cleaning,click,clinic,clinique,clothing,cloud,club,clubmed,cm,cn,co,coach,codes,coffee,college,cologne,com,comcast,commbank,community,company,compare,computer,comsec,condos,construction,consulting,contact,contractors,cooking,cookingchannel,cool,coop,corsica,country,coupon,coupons,courses,cpa,cr,credit,creditcard,creditunion,cricket,crown,crs,cruise,cruises,csc,cu,cuisinella,cv,cw,cx,cy,cymru,cyou,cz,dabur,dad,dance,data,date,dating,datsun,day,dclk,dds,de,deal,dealer,deals,degree,delivery,dell,deloitte,delta,democrat,dental,dentist,desi,design,dev,dhl,diamonds,diet,digital,direct,directory,discount,discover,dish,diy,dj,dk,dm,dnp,do,docs,doctor,dog,domains,dot,download,drive,dtv,dubai,duck,dunlop,dupont,durban,dvag,dvr,dz,earth,eat,ec,eco,edeka,edu,education,ee,eg,email,emerck,energy,engineer,engineering,enterprises,epson,equipment,er,ericsson,erni,es,esq,estate,et,etisalat,eu,eurovision,eus,events,exchange,expert,exposed,express,extraspace,fage,fail,fairwinds,faith,family,fan,fans,farm,farmers,fashion,fast,fedex,feedback,ferrari,ferrero,fi,fiat,fidelity,fido,film,final,finance,financial,fire,firestone,firmdale,fish,fishing,fit,fitness,fj,fk,flickr,flights,flir,florist,flowers,fly,fm,fo,foo,food,foodnetwork,football,ford,forex,forsale,forum,foundation,fox,fr,free,fresenius,frl,frogans,frontdoor,frontier,ftr,fujitsu,fun,fund,furniture,futbol,fyi,ga,gal,gallery,gallo,gallup,game,games,gap,garden,gay,gb,gbiz,gd,gdn,ge,gea,gent,genting,george,gf,gg,ggee,gh,gi,gift,gifts,gives,giving,gl,glade,glass,gle,global,globo,gm,gmail,gmbh,gmo,gmx,gn,godaddy,gold,goldpoint,golf,goo,goodyear,goog,google,gop,got,gov,gp,gq,gr,grainger,graphics,gratis,green,gripe,grocery,group,gs,gt,gu,guardian,gucci,guge,guide,guitars,guru,gw,gy,hair,hamburg,hangout,haus,hbo,hdfc,hdfcbank,health,healthcare,help,helsinki,here,hermes,hgtv,hiphop,hisamitsu,hitachi,hiv,hk,hkt,hm,hn,hockey,holdings,holiday,homedepot,homegoods,homes,homesense,honda,horse,hospital,host,hosting,hot,hoteles,hotels,hotmail,house,how,hr,hsbc,ht,hu,hughes,hyatt,hyundai,ibm,icbc,ice,icu,id,ie,ieee,ifm,ikano,il,im,imamat,imdb,immo,immobilien,in,inc,industries,infiniti,info,ing,ink,institute,insurance,insure,int,international,intuit,investments,io,ipiranga,iq,ir,irish,is,ismaili,ist,istanbul,it,itau,itv,jaguar,java,jcb,je,jeep,jetzt,jewelry,jio,jll,jm,jmp,jnj,jo,jobs,joburg,jot,joy,jp,jpmorgan,jprs,juegos,juniper,kaufen,kddi,ke,kerryhotels,kerrylogistics,kerryproperties,kfh,kg,kh,ki,kia,kim,kinder,kindle,kitchen,kiwi,km,kn,koeln,komatsu,kosher,kp,kpmg,kpn,kr,krd,kred,kuokgroup,kw,ky,kyoto,kz,la,lacaixa,lamborghini,lamer,lancaster,lancia,land,landrover,lanxess,lasalle,lat,latino,latrobe,law,lawyer,lb,lc,lds,lease,leclerc,lefrak,legal,lego,lexus,lgbt,li,lidl,life,lifeinsurance,lifestyle,lighting,like,lilly,limited,limo,lincoln,linde,link,lipsy,live,living,lixil,lk,llc,llp,loan,loans,locker,locus,loft,lol,london,lotte,lotto,love,lpl,lplfinancial,lr,ls,lt,ltd,ltda,lu,lundbeck,luxe,luxury,lv,ly,ma,macys,madrid,maif,maison,makeup,man,management,mango,map,market,marketing,markets,marriott,marshalls,maserati,mattel,mba,mc,mckinsey,md,me,med,media,meet,melbourne,meme,memorial,men,menu,merckmsd,mg,mh,miami,microsoft,mil,mini,mint,mit,mitsubishi,mk,ml,mlb,mls,mm,mma,mn,mo,mobi,mobile,moda,moe,moi,mom,monash,money,monster,mormon,mortgage,moscow,moto,motorcycles,mov,movie,mp,mq,mr,ms,msd,mt,mtn,mtr,mu,museum,music,mutual,mv,mw,mx,my,mz,na,nab,nagoya,name,natura,navy,nba,nc,ne,nec,net,netbank,netflix,network,neustar,new,news,next,nextdirect,nexus,nf,nfl,ng,ngo,nhk,ni,nico,nike,nikon,ninja,nissan,nissay,nl,no,nokia,northwesternmutual,norton,now,nowruz,nowtv,np,nr,nra,nrw,ntt,nu,nyc,nz,obi,observer,off,office,okinawa,olayan,olayangroup,oldnavy,ollo,om,omega,one,ong,onl,online,ooo,open,oracle,orange,org,organic,origins,osaka,otsuka,ott,ovh,pa,page,panasonic,paris,pars,partners,parts,party,passagens,pay,pccw,pe,pet,pf,pfizer,pg,ph,pharmacy,phd,philips,phone,photo,photography,photos,physio,pics,pictet,pictures,pid,pin,ping,pink,pioneer,pizza,pk,pl,place,play,playstation,plumbing,plus,pm,pn,pnc,pohl,poker,politie,porn,post,pr,pramerica,praxi,press,prime,pro,prod,productions,prof,progressive,promo,properties,property,protection,pru,prudential,ps,pt,pub,pw,pwc,py,qa,qpon,quebec,quest,racing,radio,raid,re,read,realestate,realtor,realty,recipes,red,redstone,redumbrella,rehab,reise,reisen,reit,reliance,ren,rent,rentals,repair,report,republican,rest,restaurant,review,reviews,rexroth,rich,richardli,ricoh,ril,rio,rip,ro,rocher,rocks,rodeo,rogers,room,rs,rsvp,ru,rugby,ruhr,run,rw,rwe,ryukyu,sa,saarland,safe,safety,sakura,sale,salon,samsclub,samsung,sandvik,sandvikcoromant,sanofi,sap,sarl,sas,save,saxo,sb,sbi,sbs,sc,sca,scb,schaeffler,schmidt,scholarships,school,schule,schwarz,science,scjohnson,scot,sd,se,search,seat,secure,security,seek,select,sener,services,ses,seven,sew,sex,sexy,sfr,sg,sh,shangrila,sharp,shaw,shell,shia,shiksha,shoes,shop,shopping,shouji,show,showtime,si,silk,sina,singles,site,sj,sk,ski,skin,sky,skype,sl,sling,sm,smart,smile,sn,sncf,so,soccer,social,softbank,software,sohu,solar,solutions,song,sony,soy,spa,space,sport,spot,sr,srl,ss,st,stada,staples,star,statebank,statefarm,stc,stcgroup,stockholm,storage,store,stream,studio,study,style,su,sucks,supplies,supply,support,surf,surgery,suzuki,sv,swatch,swiss,sx,sy,sydney,systems,sz,tab,taipei,talk,taobao,target,tatamotors,tatar,tattoo,tax,taxi,tc,tci,td,tdk,team,tech,technology,tel,temasek,tennis,teva,tf,tg,th,thd,theater,theatre,tiaa,tickets,tienda,tiffany,tips,tires,tirol,tj,tjmaxx,tjx,tk,tkmaxx,tl,tm,tmall,tn,to,today,tokyo,tools,top,toray,toshiba,total,tours,town,toyota,toys,tr,trade,trading,training,travel,travelchannel,travelers,travelersinsurance,trust,trv,tt,tube,tui,tunes,tushu,tv,tvs,tw,tz,ua,ubank,ubs,ug,uk,unicom,university,uno,uol,ups,us,uy,uz,va,vacations,vana,vanguard,vc,ve,vegas,ventures,verisign,versicherung,vet,vg,vi,viajes,video,vig,viking,villas,vin,vip,virgin,visa,vision,viva,vivo,vlaanderen,vn,vodka,volkswagen,volvo,vote,voting,voto,voyage,vu,vuelos,wales,walmart,walter,wang,wanggou,watch,watches,weather,weatherchannel,webcam,weber,website,wed,wedding,weibo,weir,wf,whoswho,wien,wiki,williamhill,win,windows,wine,winners,wme,wolterskluwer,woodside,work,works,world,wow,ws,wtc,wtf,xbox,xerox,xfinity,xihuan,xin,कॉम,セール,佛山,ಭಾರತ,慈善,集团,在线,한국,ଭାରତ,点看,คอม,ভাৰত,ভারত,八卦,ישראל,موقع,বাংলা,公益,公司,香格里拉,网站,移动,我爱你,москва,қаз,католик,онлайн,сайт,联通,срб,бг,бел,קום,时尚,微博,淡马锡,ファッション,орг,नेट,ストア,アマゾン,삼성,சிங்கப்பூர்,商标,商店,商城,дети,мкд,ею,ポイント,新闻,家電,كوم,中文网,中信,中国,中國,娱乐,谷歌,భారత్,ලංකා,電訊盈科,购物,クラウド,ભારત,通販,भारतम्,भारत,भारोत,网店,संगठन,餐厅,网络,ком,укр,香港,亚马逊,诺基亚,食品,飞利浦,台湾,台灣,手机,мон,الجزائر,عمان,ارامكو,ایران,العليان,اتصالات,امارات,بازار,موريتانيا,پاکستان,الاردن,بارت,بھارت,المغرب,ابوظبي,البحرين,السعودية,ڀارت,كاثوليك,سودان,همراه,عراق,مليسيا,澳門,닷컴,政府,شبكة,بيتك,عرب,გე,机构,组织机构,健康,ไทย,سورية,招聘,рус,рф,تونس,大拿,ລາວ,みんな,グーグル,ευ,ελ,世界,書籍,ഭാരതം,ਭਾਰਤ,网址,닷넷,コム,天主教,游戏,vermögensberater,vermögensberatung,企业,信息,嘉里大酒店,嘉里,مصر,قطر,广东,இலங்கை,இந்தியா,հայ,新加坡,فلسطين,政务,xxx,xyz,yachts,yahoo,yamaxun,yandex,ye,yodobashi,yoga,yokohama,you,youtube,yt,yun,za,zappos,zara,zero,zip,zm,zone,zuerich,zw".split(/,/)
26
+
27
27
  # initialize a new PassiveTotal::API object
28
28
  # username: the email address associated with your PassiveTotal API key.
29
29
  # apikey: is 64-hexcharacter string
@@ -36,52 +36,44 @@ module PassiveTotal # :nodoc:
36
36
  @apikey = apikey
37
37
  @endpoint = endpoint
38
38
  end
39
-
39
+
40
40
  # Account : Get account details your account.
41
41
  def account
42
42
  get('account')
43
43
  end
44
-
44
+
45
45
  # Account History : Get history associated with your account.
46
46
  def account_history
47
47
  get('account/history')
48
48
  end
49
-
49
+
50
50
  # history is an alias for account_history
51
51
  alias_method :history, :account_history
52
-
53
- # Account notifications : Get notifications that have been posted to your account.
54
- def account_notifications
55
- get('account/notifications')
56
- end
57
-
58
- # notifications is an alias for account_notifications
59
- alias_method :notifications, :account_notifications
60
-
52
+
61
53
  # Account organization : Get details about the organization your account is associated with.
62
54
  def account_organization
63
55
  get('account/organization')
64
56
  end
65
-
57
+
66
58
  # organization is an alias for account_organization
67
59
  alias_method :organization, :account_organization
68
-
60
+
69
61
  # Account organization teamstream : Get the teamstream for the organization your account is associated with.
70
62
  def account_organization_teamstream
71
63
  get('account/organization/teamstream')
72
64
  end
73
-
65
+
74
66
  # teamstream is an alias for account_organization_teamstream
75
67
  alias_method :teamstream, :account_organization_teamstream
76
-
68
+
77
69
  # Account sources : Get source details for a specific source.
78
70
  def account_sources(source)
79
71
  get('account/sources', {'source' => source})
80
72
  end
81
-
73
+
82
74
  # sources is an alias for account_sources
83
75
  alias_method :sources, :account_sources
84
-
76
+
85
77
 
86
78
  # Passive provides a complete passive DNS picture for a domain or IP address including first/last seen values, deconflicted values, sources used, unique counts and enrichment for all values.
87
79
  # query: A domain or IP address to query
@@ -102,10 +94,10 @@ module PassiveTotal # :nodoc:
102
94
  end
103
95
  get('dns/passive/unique', {'query' => query})
104
96
  end
105
-
97
+
106
98
  # unique is an alias for passive_unique
107
99
  alias_method :unique, :passive_unique
108
-
100
+
109
101
  # Enrichment : Enrich the given query with metadata
110
102
  # query: A domain or IP address to query
111
103
  def enrichment(query)
@@ -115,10 +107,26 @@ module PassiveTotal # :nodoc:
115
107
  end
116
108
  get('enrichment', {'query' => query})
117
109
  end
118
-
110
+
119
111
  # metadata is an alias for enrichment
120
112
  alias_method :metadata, :enrichment
121
-
113
+
114
+ # Enrichment bulk : Enrich each of the given queries with metadata
115
+ # query: An array of domains or IP addresses to query
116
+ def bulk_enrichment(query)
117
+ if query.class != Array
118
+ query = [query]
119
+ end
120
+ query.map do |q|
121
+ is_valid_with_error(__method__, [:ipv4, :domain], q)
122
+ if domain?(q)
123
+ q = normalize_domain(q)
124
+ end
125
+ q
126
+ end
127
+ get_with_data('enrichment/bulk', { 'query' => query })
128
+ end
129
+
122
130
  # osint: Get opensource intelligence data
123
131
  # query: A domain or IP address to query
124
132
  def osint(query)
@@ -128,13 +136,29 @@ module PassiveTotal # :nodoc:
128
136
  end
129
137
  get('enrichment/osint', {'query' => query})
130
138
  end
131
-
139
+
140
+ # osint bulk : Enrich each of the given queries with metadata
141
+ # query: An array of domains or IP addresses to query
142
+ def bulk_osint(query)
143
+ if query.class != Array
144
+ query = [query]
145
+ end
146
+ query.map do |q|
147
+ is_valid_with_error(__method__, [:ipv4, :domain], q)
148
+ if domain?(q)
149
+ q = normalize_domain(q)
150
+ end
151
+ q
152
+ end
153
+ get_with_data('enrichment/bulk/osint', { 'query' => query })
154
+ end
155
+
132
156
  # subdomains: Get subdomains using a wildcard query
133
157
  # query: A domain with wildcard, e.g., *.passivetotal.org
134
158
  def subdomains(query)
135
159
  get('enrichment/subdomains', {'query' => query})
136
160
  end
137
-
161
+
138
162
  # whois: Get WHOIS data for a domain or IP address
139
163
  # query: ipv4, domain, or, if you specify a field, any value for that field
140
164
  # field: field name to query if not the default ip/domain field
@@ -151,7 +175,17 @@ module PassiveTotal # :nodoc:
151
175
  get('whois', {'query' => query, 'compact_record' => 'false'})
152
176
  end
153
177
  end
154
-
178
+
179
+ # whois: Get reputation data for a domain or IP address
180
+ # query: A domain or IP address to query
181
+ def reputation(query)
182
+ is_valid_with_error(__method__, [:ipv4, :domain], query)
183
+ if domain?(query)
184
+ query = normalize_domain(query)
185
+ end
186
+ get('reputation', {'query' => query})
187
+ end
188
+
155
189
  # Add a user-tag to an IP or domain
156
190
  # query: A domain or IP address to tag
157
191
  # tag: Value used to tag query value. Should only consist of alphanumeric, underscores and hyphen values
@@ -160,7 +194,7 @@ module PassiveTotal # :nodoc:
160
194
  is_valid_with_error(__method__, [:tag], tag)
161
195
  post('actions/tags', { 'query' => query, 'tags' => [tag] })
162
196
  end
163
-
197
+
164
198
  # Remove a user-tag to an IP or domain
165
199
  # query: A domain or IP address to remove a tag from
166
200
  # tag: Value used to tag query value. Should only consist of alphanumeric, underscores and hyphen values
@@ -169,7 +203,7 @@ module PassiveTotal # :nodoc:
169
203
  is_valid_with_error(__method__, [:tag], tag)
170
204
  delete('actions/tags', { 'query' => query, 'tags' => [tag] })
171
205
  end
172
-
206
+
173
207
  # PassiveTotal uses the notion of classifications to highlight table rows a certain color based on how they have been rated.
174
208
  # PassiveTotal::API#classification() queries if only one argument is given, and sets if both are given
175
209
  # query: A domain or IP address to query
@@ -185,7 +219,23 @@ module PassiveTotal # :nodoc:
185
219
  post('actions/classification', { 'query' => query, 'classification' => set })
186
220
  end
187
221
  end
188
-
222
+
223
+ # Get the classification for a query in bulk
224
+ # query: An array of domains or IP address to query
225
+ def bulk_classification(query)
226
+ if query.class != Array
227
+ query = [query]
228
+ end
229
+ query.map do |q|
230
+ is_valid_with_error(__method__, [:ipv4, :domain], q)
231
+ if domain?(q)
232
+ q = normalize_domain(q)
233
+ end
234
+ q
235
+ end
236
+ get_with_data('actions/bulk/classification', { 'query' => query })
237
+ end
238
+
189
239
  # PassiveTotal allows users to notate if a domain or IP address have ever been compromised. These values aid in letting users know that a site may be benign, but it was used in an attack at some point in time.
190
240
  # PassiveTotal::API#ever_compromised() queries if only one argument is given, and sets if both are given
191
241
  # query: A domain or IP address to query
@@ -202,9 +252,9 @@ module PassiveTotal # :nodoc:
202
252
  post('actions/ever-compromised', { 'query' => query, 'status' => set })
203
253
  end
204
254
  end
205
-
255
+
206
256
  alias_method :compromised, :ever_compromised
207
-
257
+
208
258
  # PassiveTotal allows users to notate if a domain is associated with a dynamic DNS provider.
209
259
  # PassiveTotal::API#dynamic() queries if only one argument is given, and sets if both are given
210
260
  # query: A domain to query
@@ -219,7 +269,7 @@ module PassiveTotal # :nodoc:
219
269
  post('actions/dynamic-dns', { 'query' => query, 'status' => set })
220
270
  end
221
271
  end
222
-
272
+
223
273
  # PassiveTotal allows users to notate if an ip or domain is "monitored".
224
274
  # PassiveTotal::API#monitor() queries if only one argument is given, and sets if both are given
225
275
  # query: A domain to query
@@ -236,7 +286,7 @@ module PassiveTotal # :nodoc:
236
286
  post('actions/monitor', { 'query' => query, 'status' => set })
237
287
  end
238
288
  end
239
-
289
+
240
290
  # monitoring is an alias for monitor
241
291
  alias_method :monitoring, :monitor
242
292
  alias_method :watching, :monitor
@@ -254,7 +304,7 @@ module PassiveTotal # :nodoc:
254
304
  post('actions/sinkhole', { 'query' => query, 'status' => set })
255
305
  end
256
306
  end
257
-
307
+
258
308
 
259
309
  # PassiveTotal uses three types of tags (user, global, and temporal) in order to provide context back to the user.
260
310
  # query: A domain or IP address to query
@@ -271,7 +321,7 @@ module PassiveTotal # :nodoc:
271
321
  post('actions/tag', { 'query' => query, 'tags' => [set] })
272
322
  end
273
323
  end
274
-
324
+
275
325
  # Search Tags : Search for items based on tag value
276
326
  # PassiveTotal uses three types of tags (user, global, and temporal) in order to provide context back to the user.
277
327
  # query: A domain or IP address to query
@@ -303,7 +353,7 @@ module PassiveTotal # :nodoc:
303
353
  get_params('ssl-certificate/search', { 'query' => query, 'field' => field })
304
354
  end
305
355
  end
306
-
356
+
307
357
  # PassiveTotal tracks some interesting metadata about a host
308
358
  # query: a hostname or ip address
309
359
  def components(query)
@@ -313,7 +363,7 @@ module PassiveTotal # :nodoc:
313
363
  end
314
364
  get('host-attributes/components', {'query' => query})
315
365
  end
316
-
366
+
317
367
  # trackers: Get all tracking codes for a domain or IP address.
318
368
  # query: ip or domain, or, if type is supplied, a valid tracker ID
319
369
  # type: A valid tracker type to search:
@@ -330,7 +380,7 @@ module PassiveTotal # :nodoc:
330
380
  get('trackers/search', {'query' => query, 'type' => type})
331
381
  end
332
382
  end
333
-
383
+
334
384
  # malware: get sample information based from domain
335
385
  # query: ip or domain
336
386
  def malware(query)
@@ -340,9 +390,26 @@ module PassiveTotal # :nodoc:
340
390
  end
341
391
  get('enrichment/malware', {'query' => query})
342
392
  end
343
-
393
+
394
+ # malware bulk: get sample information based from domains
395
+ # query: An array of domains or IP addresses to query
396
+ def bulk_malware(query)
397
+ if query.class != Array
398
+ query = [query]
399
+ end
400
+ query.map do |q|
401
+ is_valid_with_error(__method__, [:ipv4, :domain], q)
402
+ if domain?(q)
403
+ q = normalize_domain(q)
404
+ end
405
+ q
406
+ end
407
+ get_with_data('enrichment/bulk/malware', { 'query' => query })
408
+ end
409
+
410
+
344
411
  private
345
-
412
+
346
413
  # returns true if the given string is a dotted quad IPv4 address
347
414
  def ipv4?(ip)
348
415
  if ip =~ /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/
@@ -350,14 +417,14 @@ module PassiveTotal # :nodoc:
350
417
  end
351
418
  false
352
419
  end
353
-
420
+
354
421
  # returns true if the given string looks like a domain and ends with a known top-level domain (TLD)
355
422
  def domain?(domain)
356
423
  return false if domain.nil?
357
424
  domain = normalize_domain(domain)
358
425
  domain =~ /^[a-zA-Z0-9\-\.]{3,255}$/ and TLDS.index(domain.split(/\./).last)
359
426
  end
360
-
427
+
361
428
  # returns true if the given string looks like a SHA-1 hash, i.e., 40 character hex string
362
429
  def hash?(hash)
363
430
  return false if hash.nil?
@@ -366,17 +433,17 @@ module PassiveTotal # :nodoc:
366
433
  end
367
434
  false
368
435
  end
369
-
436
+
370
437
  # returns true if the given string matches a valid classification
371
438
  def classification?(c)
372
439
  not ["malicious", "non-malicious", "suspicious", "unknown"].index(c).nil?
373
440
  end
374
-
441
+
375
442
  # returns true is the given object matches true or false
376
443
  def bool?(b)
377
444
  not ['true', 'false'].index(b.to_s).nil?
378
445
  end
379
-
446
+
380
447
  # returns true if the given string looks like a valid tag
381
448
  def tag?(t)
382
449
  return false if t.nil?
@@ -385,27 +452,27 @@ module PassiveTotal # :nodoc:
385
452
  end
386
453
  false
387
454
  end
388
-
455
+
389
456
  def ssl_field?(f)
390
457
  return false if f.nil?
391
- not ["issuerSurname", "subjectOrganizationName", "issuerCountry", "issuerOrganizationUnitName",
392
- "fingerprint", "subjectOrganizationUnitName", "serialNumber", "subjectEmailAddress", "subjectCountry",
393
- "issuerGivenName", "subjectCommonName", "issuerCommonName", "issuerStateOrProvinceName", "issuerProvince",
394
- "subjectStateOrProvinceName", "sha1", "sslVersion", "subjectStreetAddress", "subjectSerialNumber",
395
- "issuerOrganizationName", "subjectSurname", "subjectLocalityName", "issuerStreetAddress",
458
+ not ["issuerSurname", "subjectOrganizationName", "issuerCountry", "issuerOrganizationUnitName",
459
+ "fingerprint", "subjectOrganizationUnitName", "serialNumber", "subjectEmailAddress", "subjectCountry",
460
+ "issuerGivenName", "subjectCommonName", "issuerCommonName", "issuerStateOrProvinceName", "issuerProvince",
461
+ "subjectStateOrProvinceName", "sha1", "sslVersion", "subjectStreetAddress", "subjectSerialNumber",
462
+ "issuerOrganizationName", "subjectSurname", "subjectLocalityName", "issuerStreetAddress",
396
463
  "issuerLocalityName", "subjectGivenName", "subjectProvince", "issuerSerialNumber", "issuerEmailAddress"].index(f).nil?
397
464
  end
398
-
465
+
399
466
  def whois_field?(f)
400
467
  return false if f.nil?
401
468
  not ["domain", "email", "name", "organization", "address", "phone", "nameserver"].index(f).nil?
402
469
  end
403
-
470
+
404
471
  def tracker_type?(t)
405
472
  return false if t.nil?
406
473
  not ["YandexMetricaCounterId", "ClickyId", "GoogleAnalyticsAccountNumber", "NewRelicId", "MixpanelId", "GoogleAnalyticsTrackingId"].index(t).nil?
407
474
  end
408
-
475
+
409
476
  # lowercases and removes a trailing period (if one exists) from a domain name
410
477
  def normalize_domain(domain)
411
478
  return domain.downcase.gsub(/\.$/,'')
@@ -415,22 +482,26 @@ module PassiveTotal # :nodoc:
415
482
  def get(api, params={})
416
483
  url2json(:GET, "#{@endpoint}#{api}", params)
417
484
  end
418
-
485
+
419
486
  # helper function to perform an HTTP GET against the web API
420
487
  def get_params(api, params)
421
488
  url2json(:GET, "#{@endpoint}#{api}", params)
422
489
  end
423
-
490
+
491
+ def get_with_data(api, params={})
492
+ url2json(:GET_DATA, "#{@endpoint}#{api}", params)
493
+ end
494
+
424
495
  # helper function to perform an HTTP POST against the web API
425
496
  def post(api, params)
426
497
  url2json(:POST, "#{@endpoint}#{api}", params)
427
498
  end
428
-
499
+
429
500
  # helper function to perform an HTTP DELETE against the web API
430
501
  def delete(api, params)
431
502
  url2json(:DELETE, "#{@endpoint}#{api}", params)
432
503
  end
433
-
504
+
434
505
  # main helper function to perform HTTP interactions with the web API.
435
506
  def url2json(method, url, params)
436
507
  if method == :GET
@@ -444,6 +515,11 @@ module PassiveTotal # :nodoc:
444
515
  request = nil
445
516
  if method == :GET
446
517
  request = Net::HTTP::Get.new(url.request_uri)
518
+ elsif method == :GET_DATA
519
+ request = Net::HTTP::Get.new(url.request_uri)
520
+ form_data = params.to_json
521
+ request.content_type = 'application/json'
522
+ request.body = form_data
447
523
  elsif method == :POST
448
524
  request = Net::HTTP::Post.new(url.request_uri)
449
525
  form_data = params.to_json
@@ -467,13 +543,13 @@ module PassiveTotal # :nodoc:
467
543
  response = http.request(request)
468
544
  delta = (Time.now - t1).to_f
469
545
  data = JSON.parse(response.body)
470
-
546
+
471
547
  obj = Transaction.new(
472
548
  Query.new(method, params['query'], params[method] || params['tag'], url, params),
473
549
  Response.new(response.body, response.code == '200', data),
474
550
  delta
475
551
  )
476
-
552
+
477
553
  if data['error']
478
554
  message = data['error']['message']
479
555
  case message
@@ -488,7 +564,7 @@ module PassiveTotal # :nodoc:
488
564
 
489
565
  return obj
490
566
  end
491
-
567
+
492
568
  # tests an item to see if it matches a valid type
493
569
  def is_valid?(types, item)
494
570
  types.each do |type|
@@ -514,7 +590,7 @@ module PassiveTotal # :nodoc:
514
590
  end
515
591
  return false
516
592
  end
517
-
593
+
518
594
  # tests an item to see if it matches a valid type and raises an ArgumentError if invalid
519
595
  def is_valid_with_error(methname, types, item)
520
596
  valid = is_valid?(types, item)
@@ -525,4 +601,4 @@ module PassiveTotal # :nodoc:
525
601
  end
526
602
 
527
603
  end
528
- end
604
+ end
@@ -1,3 +1,3 @@
1
1
  module PassiveTotal
2
- VERSION = "1.0.2"
2
+ VERSION = "1.0.6"
3
3
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: passivetotal
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.0.2
4
+ version: 1.0.6
5
5
  platform: ruby
6
6
  authors:
7
7
  - chrislee35
8
- autorequire:
8
+ autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2016-02-20 00:00:00.000000000 Z
11
+ date: 2021-12-01 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: json
@@ -16,56 +16,56 @@ dependencies:
16
16
  requirements:
17
17
  - - "~>"
18
18
  - !ruby/object:Gem::Version
19
- version: '1.8'
19
+ version: '2.0'
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - "~>"
25
25
  - !ruby/object:Gem::Version
26
- version: '1.8'
26
+ version: '2.0'
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: bundler
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
31
  - - "~>"
32
32
  - !ruby/object:Gem::Version
33
- version: '1.10'
33
+ version: 2.2.10
34
34
  type: :development
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - "~>"
39
39
  - !ruby/object:Gem::Version
40
- version: '1.10'
40
+ version: 2.2.10
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: rake
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
45
  - - "~>"
46
46
  - !ruby/object:Gem::Version
47
- version: '10.0'
47
+ version: '13.0'
48
48
  type: :development
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - "~>"
53
53
  - !ruby/object:Gem::Version
54
- version: '10.0'
54
+ version: '13.0'
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: minitest
57
57
  requirement: !ruby/object:Gem::Requirement
58
58
  requirements:
59
- - - ">="
59
+ - - "~>"
60
60
  - !ruby/object:Gem::Version
61
- version: '0'
61
+ version: '5.14'
62
62
  type: :development
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
- - - ">="
66
+ - - "~>"
67
67
  - !ruby/object:Gem::Version
68
- version: '0'
68
+ version: '5.14'
69
69
  description: PassiveTotal offers an extensive API for users of the platform that maps
70
70
  most major actions available in the web application to a corresponding call. There
71
71
  are two flavors of the API available for use, stable and current. In order to use
@@ -79,25 +79,18 @@ executables:
79
79
  extensions: []
80
80
  extra_rdoc_files: []
81
81
  files:
82
- - ".gitignore"
83
- - ".travis.yml"
84
- - Gemfile
85
- - LICENSE.txt
86
- - README.md
87
- - Rakefile
88
82
  - bin/passivetotal
89
83
  - lib/passivetotal.rb
90
84
  - lib/passivetotal/api.rb
91
85
  - lib/passivetotal/cli.rb
92
86
  - lib/passivetotal/version.rb
93
- - passivetotal.gemspec
94
87
  - utils/console
95
88
  - utils/setup
96
89
  homepage: https://github.com/chrislee35/passivetotal
97
90
  licenses:
98
91
  - MIT
99
92
  metadata: {}
100
- post_install_message:
93
+ post_install_message:
101
94
  rdoc_options: []
102
95
  require_paths:
103
96
  - lib
@@ -112,9 +105,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
112
105
  - !ruby/object:Gem::Version
113
106
  version: '0'
114
107
  requirements: []
115
- rubyforge_project:
116
- rubygems_version: 2.4.6
117
- signing_key:
108
+ rubygems_version: 3.1.2
109
+ signing_key:
118
110
  specification_version: 4
119
- summary: Wrapper library for PassiveTotal.org's W eb API
111
+ summary: Wrapper library for PassiveTotal.org's Web API
120
112
  test_files: []
data/.gitignore DELETED
@@ -1,11 +0,0 @@
1
- /.bundle/
2
- /.yardoc
3
- /Gemfile.lock
4
- /_yardoc/
5
- /coverage/
6
- /doc/
7
- /pkg/
8
- /spec/reports/
9
- /tmp/
10
- .DS_Store
11
- rdoc
data/.travis.yml DELETED
@@ -1,4 +0,0 @@
1
- language: ruby
2
- rvm:
3
- - 2.2.1
4
- before_install: gem install bundler -v 1.10.5
data/Gemfile DELETED
@@ -1,4 +0,0 @@
1
- source 'https://rubygems.org'
2
-
3
- # Specify your gem's dependencies in passivetotal.gemspec
4
- gemspec
data/LICENSE.txt DELETED
@@ -1,21 +0,0 @@
1
- The MIT License (MIT)
2
-
3
- Copyright (c) 2015 chrislee35
4
-
5
- Permission is hereby granted, free of charge, to any person obtaining a copy
6
- of this software and associated documentation files (the "Software"), to deal
7
- in the Software without restriction, including without limitation the rights
8
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
- copies of the Software, and to permit persons to whom the Software is
10
- furnished to do so, subject to the following conditions:
11
-
12
- The above copyright notice and this permission notice shall be included in
13
- all copies or substantial portions of the Software.
14
-
15
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
21
- THE SOFTWARE.
data/README.md DELETED
@@ -1,163 +0,0 @@
1
- # PassiveTotal
2
-
3
- The PassiveTotal gem is (currently) a thin wrapper around PassiveTotal.org's Web-based API.
4
-
5
- ## Installation
6
-
7
- Add this line to your application's Gemfile:
8
-
9
- ```ruby
10
- gem 'passivetotal'
11
- ```
12
-
13
- And then execute:
14
-
15
- $ bundle
16
-
17
- Or install it yourself as:
18
-
19
- $ gem install passivetotal
20
-
21
- ## Command Line Tool
22
-
23
- Included in the gem is a command-line tool, passivetotal, with the following usage:
24
-
25
- Usage: bin/passivetotal [-v] [-u <username>] [-k <apikey>] <action flag> <query> [-i <value>]
26
- -h Help
27
- -v Verbose output
28
- -u <username> Sets the Username, defaults to the environment variable PASSIVETOTAL_USERNAME
29
- -k <apikey> Sets the APIKEY, defaults to the environment variable PASSIVETOTAL_APIKEY
30
- ACTIONS (You have to select one, last one wins) -m <ip or dom> Queries metadata for given IP or domain
31
- -p <ip or dom> Queries passive DNS data for given IP or domain
32
- -c <ip or dom> Queries (or sets) the classification for a given IP or domain
33
- -t <ip or dom> Queries (adds or removes) the tags associated with a given IP or domain
34
- * To remove a tag, prepend a dash, '-' to the tag name when using the -i option
35
- -e <ip or dom> Queries (or sets) the ever compromised flag on a given IP or domain
36
- -w <ip or dom> Queries (or sets) the watched flag on a given IP or domain
37
- -s <dom> Queries the subdomains for a given domain
38
- -d <dom> Queries (or sets) if a domain is a dynamic DNS domain
39
- -x <ip> Queries (or sets) if a given IP is a sinkhole
40
- -l <hash> Queries for SSL certificates/IP addresses associated with a given SHA-1 hash
41
- -H <ip or hash> Queries for SSL certificate history associated with a given IP or SHA-1 hash
42
- -T <ip or dom> Queries for Tracker information associated with a given IP or domain
43
- -o <ip or dom> Queries for OSINT on a given IP or domain
44
- -M <ip or dom> Queries for Malware sample records for a given IP or domain
45
- SETTING VALUES -i <value> Sets the value, used in conjuntion with -c, -t, -e, -w, -d, or -x
46
- Valid values for -i depend on what it's used with:
47
- -c : malicious, non-malicious, suspicious, unknown
48
- -t : <a tag name consisting of characters: [a-zA-Z_]>
49
- -e, -w, -d, -x: true, false
50
-
51
- ## Usage
52
-
53
- # Initialize the API wrapper with an apikey (using the default endpoint URL of https://api.passivetotal.org/v2/)
54
- pt = PassiveTotal::API.new(user, apikey)
55
- # Create an array to shove results into
56
- res = Array.new
57
-
58
- # ACCOUNT API
59
- # Get account details your account.
60
- res << @pt.account
61
- # Get history associated with your account.
62
- res << @pt.history
63
- # Get notifications that have been posted to your account.
64
- res << @pt.notifications
65
- # Get details about the organization your account is associated with.
66
- res << @pt.organization
67
- # Get the teamstream for the organization your account is associated with.
68
- res << @pt.teamstream
69
- # Get source details for a specific source.
70
- res << @pt.sources('riskiq')
71
-
72
- # DNS API
73
- # query passive DNS results for the domain, www.passivetotal.org
74
- res << @pt.passive('www.passivetotal.org')
75
- # query passive DNS results for the ipv4 address, 107.170.89.121
76
- res << @pt.passive('107.170.89.121')
77
- # query for unique IPv4 resolutions of passivetotal.org
78
- res << @pt.unique('passivetotal.org')
79
-
80
- # ENRICHMENT API
81
- # query enrichment for the domain, www.passivetotal.org
82
- res << @pt.enrichment('www.passivetotal.org')
83
- # query enrichment for the ipv4 address, 107.170.89.121
84
- res << @pt.enrichment('107.170.89.121')
85
- # Get malware data
86
- res << @pt.malware('noorno.com')
87
- # query for malware sample records by the ip addres 98.124.243.47
88
- res << @pt.malware("98.124.243.47")
89
- # Get opensource intelligence data
90
- res << @pt.osint("xxxmobiletubez.com")
91
- # query for subdomains of passivetotal.org
92
- res << @pt.subdomains('*.passivetotal.org')
93
-
94
- # WHOIS API
95
- # Get WHOIS data for a domain or IP address
96
- res << @pt.whois("passivetotal.org")
97
- # Get WHOIS records based on field matching queries.
98
- res << @pt.whois("proxy4655031@1and1-private-registration.com", "email")
99
-
100
- # ACTIONS API
101
- # query for the tags associated with www.chrisleephd.us
102
- res << @pt.tags('www.chrisleephd.us')
103
- # add the "cool" tag to www.chrisleephd.us
104
- res << @pt.add_tag('www.chrisleephd.us', 'cool')
105
- # remove the "cool" tag from www.chrisleephd.us (aww, I was cool for a few milliseconds :( )
106
- res << @pt.remove_tag('www.chrisleephd.us', 'cool')
107
- # query for the classification of www.passivetotal.org
108
- res << @pt.classification('www.passivetotal.org')
109
- # set the classification of www.passivetotal.org as benign
110
- res << @pt.classification('www.passivetotal.org', 'non-malicious')
111
- # query if www.passivetotal.org has ever been listed as compromised
112
- res << @pt.ever_compromised('www.passivetotal.org')
113
- # set the ever_compromised flag for www.passivetotal.org to false to indicate that it was never compromised or that it is in sole control of a malicious actor.
114
- res << @pt.ever_compromised('www.passivetotal.org', false)
115
- # check if www.passivetotal.org is a dynamic dns domain/host
116
- res << @pt.dynamic('www.passivetotal.org')
117
- # flag www.passivetotal.org as not a dynamic dns domain/host
118
- res << @pt.dynamic('www.passivetotal.org', false)
119
- # check if www.passivetotal.org is being watched
120
- res << @pt.monitor('www.passivetotal.org')
121
- # unwatch www.passivetotal.org
122
- res << @pt.monitor('www.passivetotal.org', false)
123
- # query if 107.170.89.121 is a sinkhole
124
- res << @pt.sinkhole('107.170.89.121')
125
- # set 107.170.89.121 as not a sinkhole
126
- res << @pt.sinkhole('107.170.89.121', false)
127
-
128
- # HOST API
129
- # Get detailed information about a host
130
- res << @pt.components('passivetotal.org')
131
- # Get all tracking codes for a domain or IP address.
132
- res << @pt.trackers('passivetotal.org')
133
- # Get hosts matching a specific tracker ID
134
- res << @pt.trackers('UA-49901229', 'GoogleAnalyticsAccountNumber')
135
-
136
- # SSL API
137
- # list sites associated with SSL certificates with SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
138
- res << @pt.ssl_certificate('e9a6647d6aba52dc47b3838c920c9ee59bad7034')
139
- # list sites associated with SSL certificates with SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
140
- res << @pt.ssl_certificate('2317683628587350290823564500811277499', 'serialNumber')
141
- # retrieve certificate history based on SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
142
- res << @pt.ssl_certificate_history('e9a6647d6aba52dc47b3838c920c9ee59bad7034')
143
- # retrieve certificate history from IPv4 address of 52.8.228.23
144
- res << @pt.ssl_certificate_history('52.8.228.23')
145
-
146
- # dump all this glorious information to feast your eyes upon
147
- pp res
148
-
149
- ## Development
150
-
151
- After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
152
-
153
- To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
154
-
155
- ## Contributing
156
-
157
- Bug reports and pull requests are welcome on GitHub at https://github.com/chrislee35/passivetotal.
158
-
159
-
160
- ## License
161
-
162
- The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
163
-
data/Rakefile DELETED
@@ -1,10 +0,0 @@
1
- require "bundler/gem_tasks"
2
- require "rake/testtask"
3
-
4
- Rake::TestTask.new(:test) do |t|
5
- t.libs << "test"
6
- t.libs << "lib"
7
- t.test_files = FileList['test/**/*_test.rb']
8
- end
9
-
10
- task :default => :test
data/passivetotal.gemspec DELETED
@@ -1,26 +0,0 @@
1
- # coding: utf-8
2
- lib = File.expand_path('../lib', __FILE__)
3
- $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
4
- require 'passivetotal/version'
5
-
6
- Gem::Specification.new do |spec|
7
- spec.name = "passivetotal"
8
- spec.version = PassiveTotal::VERSION
9
- spec.authors = ["chrislee35"]
10
- spec.email = ["rubygems@chrislee.dhs.org"]
11
-
12
- spec.summary = %q{Wrapper library for PassiveTotal.org's W eb API}
13
- spec.description = %q{PassiveTotal offers an extensive API for users of the platform that maps most major actions available in the web application to a corresponding call. There are two flavors of the API available for use, stable and current. In order to use the stable API, add the version indicator (vX) into the URL as documented below. If you would rather use the current API which includes new changes and experiments, replace the version indicator with "current".}
14
- spec.homepage = "https://github.com/chrislee35/passivetotal"
15
- spec.license = "MIT"
16
-
17
- spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
18
- spec.bindir = "bin"
19
- spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
20
- spec.require_paths = ["lib"]
21
-
22
- spec.add_runtime_dependency "json", "~> 1.8"
23
- spec.add_development_dependency "bundler", "~> 1.10"
24
- spec.add_development_dependency "rake", "~> 10.0"
25
- spec.add_development_dependency "minitest"
26
- end