passivetotal 1.0.2 → 1.0.6
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/lib/passivetotal/api.rb +144 -68
- data/lib/passivetotal/version.rb +1 -1
- metadata +17 -25
- data/.gitignore +0 -11
- data/.travis.yml +0 -4
- data/Gemfile +0 -4
- data/LICENSE.txt +0 -21
- data/README.md +0 -163
- data/Rakefile +0 -10
- data/passivetotal.gemspec +0 -26
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
|
-
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
2
|
+
SHA256:
|
3
|
+
metadata.gz: a83e6b94b558fcf2e524fd272d2a0238b325aae63689871c8c8f52ff1e211f29
|
4
|
+
data.tar.gz: 335f3ec0c83e2987619932c71470a109afab17581158cccdbb9e0dfb5541574c
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 856745401361b82a1096c387eb6d1d0db9937507ee3e390ca41effb5853c80e8d604c9f4ec9990a25e13aa72ff20a3383d0800ddac7bf8036078850751b83e8d
|
7
|
+
data.tar.gz: c0cf41003118d3cffaebc7aba2b7a78b4eb39806587bf7538c7c34f51284aea6fe98dff5f79fc33e54842c99ad1e94e6074fc763e50f25b99a9fd17ad6fe008e
|
data/lib/passivetotal/api.rb
CHANGED
@@ -7,23 +7,23 @@ require 'passivetotal/version'
|
|
7
7
|
# DESCRIPTION: rubygem for querying PassiveTotal.org's web API
|
8
8
|
|
9
9
|
module PassiveTotal # :nodoc:
|
10
|
-
|
10
|
+
|
11
11
|
class InvalidAPIKeyError < ArgumentError; end
|
12
12
|
class APIUsageError < StandardError; end
|
13
13
|
class ExceededQuotaError < StandardError; end
|
14
|
-
|
14
|
+
|
15
15
|
class Transaction < Struct.new(:query, :response, :response_time); end
|
16
16
|
class Query < Struct.new(:api, :query, :set, :url, :parameters); end
|
17
17
|
class Response < Struct.new(:json, :success, :results); end
|
18
|
-
|
18
|
+
|
19
19
|
# The API class wraps the PassiveTotal.org web API for all the verbs that it supports
|
20
|
-
# See https://
|
20
|
+
# See https://api.passivetotal.org/api/docs/ for the API documentation.
|
21
21
|
class API
|
22
22
|
# The TLDS array helps the interface detect valid domains.
|
23
23
|
# This list was generated by parsing the NS records from a zone transfer of the root
|
24
24
|
# The same list could have been downloaded from http://data.iana.org/TLD/tlds-alpha-by-domain.txt
|
25
|
-
TLDS = "abb,abbott,abogado,ac,academy,accenture,accountant,accountants,
|
26
|
-
|
25
|
+
TLDS = "aaa,aarp,abarth,abb,abbott,abbvie,abc,able,abogado,abudhabi,ac,academy,accenture,accountant,accountants,aco,actor,ad,adac,ads,adult,ae,aeg,aero,aetna,af,afamilycompany,afl,africa,ag,agakhan,agency,ai,aig,airbus,airforce,airtel,akdn,al,alfaromeo,alibaba,alipay,allfinanz,allstate,ally,alsace,alstom,am,amazon,americanexpress,americanfamily,amex,amfam,amica,amsterdam,analytics,android,anquan,anz,ao,aol,apartments,app,apple,aq,aquarelle,ar,arab,aramco,archi,army,arpa,art,arte,as,asda,asia,associates,at,athleta,attorney,au,auction,audi,audible,audio,auspost,author,auto,autos,avianca,aw,aws,ax,axa,az,azure,ba,baby,baidu,banamex,bananarepublic,band,bank,bar,barcelona,barclaycard,barclays,barefoot,bargains,baseball,basketball,bauhaus,bayern,bb,bbc,bbt,bbva,bcg,bcn,bd,be,beats,beauty,beer,bentley,berlin,best,bestbuy,bet,bf,bg,bh,bharti,bi,bible,bid,bike,bing,bingo,bio,biz,bj,black,blackfriday,blockbuster,blog,bloomberg,blue,bm,bms,bmw,bn,bnpparibas,bo,boats,boehringer,bofa,bom,bond,boo,book,booking,bosch,bostik,boston,bot,boutique,box,br,bradesco,bridgestone,broadway,broker,brother,brussels,bs,bt,budapest,bugatti,build,builders,business,buy,buzz,bv,bw,by,bz,bzh,ca,cab,cafe,cal,call,calvinklein,cam,camera,camp,cancerresearch,canon,capetown,capital,capitalone,car,caravan,cards,care,career,careers,cars,casa,case,cash,casino,cat,catering,catholic,cba,cbn,cbre,cbs,cc,cd,center,ceo,cern,cf,cfa,cfd,cg,ch,chanel,channel,charity,chase,chat,cheap,chintai,christmas,chrome,church,ci,cipriani,circle,cisco,citadel,citi,citic,city,cityeats,ck,cl,claims,cleaning,click,clinic,clinique,clothing,cloud,club,clubmed,cm,cn,co,coach,codes,coffee,college,cologne,com,comcast,commbank,community,company,compare,computer,comsec,condos,construction,consulting,contact,contractors,cooking,cookingchannel,cool,coop,corsica,country,coupon,coupons,courses,cpa,cr,credit,creditcard,creditunion,cricket,crown,crs,cruise,cruises,csc,cu,cuisinella,cv,cw,cx,cy,cymru,cyou,cz,dabur,dad,dance,data,date,dating,datsun,day,dclk,dds,de,deal,dealer,deals,degree,delivery,dell,deloitte,delta,democrat,dental,dentist,desi,design,dev,dhl,diamonds,diet,digital,direct,directory,discount,discover,dish,diy,dj,dk,dm,dnp,do,docs,doctor,dog,domains,dot,download,drive,dtv,dubai,duck,dunlop,dupont,durban,dvag,dvr,dz,earth,eat,ec,eco,edeka,edu,education,ee,eg,email,emerck,energy,engineer,engineering,enterprises,epson,equipment,er,ericsson,erni,es,esq,estate,et,etisalat,eu,eurovision,eus,events,exchange,expert,exposed,express,extraspace,fage,fail,fairwinds,faith,family,fan,fans,farm,farmers,fashion,fast,fedex,feedback,ferrari,ferrero,fi,fiat,fidelity,fido,film,final,finance,financial,fire,firestone,firmdale,fish,fishing,fit,fitness,fj,fk,flickr,flights,flir,florist,flowers,fly,fm,fo,foo,food,foodnetwork,football,ford,forex,forsale,forum,foundation,fox,fr,free,fresenius,frl,frogans,frontdoor,frontier,ftr,fujitsu,fun,fund,furniture,futbol,fyi,ga,gal,gallery,gallo,gallup,game,games,gap,garden,gay,gb,gbiz,gd,gdn,ge,gea,gent,genting,george,gf,gg,ggee,gh,gi,gift,gifts,gives,giving,gl,glade,glass,gle,global,globo,gm,gmail,gmbh,gmo,gmx,gn,godaddy,gold,goldpoint,golf,goo,goodyear,goog,google,gop,got,gov,gp,gq,gr,grainger,graphics,gratis,green,gripe,grocery,group,gs,gt,gu,guardian,gucci,guge,guide,guitars,guru,gw,gy,hair,hamburg,hangout,haus,hbo,hdfc,hdfcbank,health,healthcare,help,helsinki,here,hermes,hgtv,hiphop,hisamitsu,hitachi,hiv,hk,hkt,hm,hn,hockey,holdings,holiday,homedepot,homegoods,homes,homesense,honda,horse,hospital,host,hosting,hot,hoteles,hotels,hotmail,house,how,hr,hsbc,ht,hu,hughes,hyatt,hyundai,ibm,icbc,ice,icu,id,ie,ieee,ifm,ikano,il,im,imamat,imdb,immo,immobilien,in,inc,industries,infiniti,info,ing,ink,institute,insurance,insure,int,international,intuit,investments,io,ipiranga,iq,ir,irish,is,ismaili,ist,istanbul,it,itau,itv,jaguar,java,jcb,je,jeep,jetzt,jewelry,jio,jll,jm,jmp,jnj,jo,jobs,joburg,jot,joy,jp,jpmorgan,jprs,juegos,juniper,kaufen,kddi,ke,kerryhotels,kerrylogistics,kerryproperties,kfh,kg,kh,ki,kia,kim,kinder,kindle,kitchen,kiwi,km,kn,koeln,komatsu,kosher,kp,kpmg,kpn,kr,krd,kred,kuokgroup,kw,ky,kyoto,kz,la,lacaixa,lamborghini,lamer,lancaster,lancia,land,landrover,lanxess,lasalle,lat,latino,latrobe,law,lawyer,lb,lc,lds,lease,leclerc,lefrak,legal,lego,lexus,lgbt,li,lidl,life,lifeinsurance,lifestyle,lighting,like,lilly,limited,limo,lincoln,linde,link,lipsy,live,living,lixil,lk,llc,llp,loan,loans,locker,locus,loft,lol,london,lotte,lotto,love,lpl,lplfinancial,lr,ls,lt,ltd,ltda,lu,lundbeck,luxe,luxury,lv,ly,ma,macys,madrid,maif,maison,makeup,man,management,mango,map,market,marketing,markets,marriott,marshalls,maserati,mattel,mba,mc,mckinsey,md,me,med,media,meet,melbourne,meme,memorial,men,menu,merckmsd,mg,mh,miami,microsoft,mil,mini,mint,mit,mitsubishi,mk,ml,mlb,mls,mm,mma,mn,mo,mobi,mobile,moda,moe,moi,mom,monash,money,monster,mormon,mortgage,moscow,moto,motorcycles,mov,movie,mp,mq,mr,ms,msd,mt,mtn,mtr,mu,museum,music,mutual,mv,mw,mx,my,mz,na,nab,nagoya,name,natura,navy,nba,nc,ne,nec,net,netbank,netflix,network,neustar,new,news,next,nextdirect,nexus,nf,nfl,ng,ngo,nhk,ni,nico,nike,nikon,ninja,nissan,nissay,nl,no,nokia,northwesternmutual,norton,now,nowruz,nowtv,np,nr,nra,nrw,ntt,nu,nyc,nz,obi,observer,off,office,okinawa,olayan,olayangroup,oldnavy,ollo,om,omega,one,ong,onl,online,ooo,open,oracle,orange,org,organic,origins,osaka,otsuka,ott,ovh,pa,page,panasonic,paris,pars,partners,parts,party,passagens,pay,pccw,pe,pet,pf,pfizer,pg,ph,pharmacy,phd,philips,phone,photo,photography,photos,physio,pics,pictet,pictures,pid,pin,ping,pink,pioneer,pizza,pk,pl,place,play,playstation,plumbing,plus,pm,pn,pnc,pohl,poker,politie,porn,post,pr,pramerica,praxi,press,prime,pro,prod,productions,prof,progressive,promo,properties,property,protection,pru,prudential,ps,pt,pub,pw,pwc,py,qa,qpon,quebec,quest,racing,radio,raid,re,read,realestate,realtor,realty,recipes,red,redstone,redumbrella,rehab,reise,reisen,reit,reliance,ren,rent,rentals,repair,report,republican,rest,restaurant,review,reviews,rexroth,rich,richardli,ricoh,ril,rio,rip,ro,rocher,rocks,rodeo,rogers,room,rs,rsvp,ru,rugby,ruhr,run,rw,rwe,ryukyu,sa,saarland,safe,safety,sakura,sale,salon,samsclub,samsung,sandvik,sandvikcoromant,sanofi,sap,sarl,sas,save,saxo,sb,sbi,sbs,sc,sca,scb,schaeffler,schmidt,scholarships,school,schule,schwarz,science,scjohnson,scot,sd,se,search,seat,secure,security,seek,select,sener,services,ses,seven,sew,sex,sexy,sfr,sg,sh,shangrila,sharp,shaw,shell,shia,shiksha,shoes,shop,shopping,shouji,show,showtime,si,silk,sina,singles,site,sj,sk,ski,skin,sky,skype,sl,sling,sm,smart,smile,sn,sncf,so,soccer,social,softbank,software,sohu,solar,solutions,song,sony,soy,spa,space,sport,spot,sr,srl,ss,st,stada,staples,star,statebank,statefarm,stc,stcgroup,stockholm,storage,store,stream,studio,study,style,su,sucks,supplies,supply,support,surf,surgery,suzuki,sv,swatch,swiss,sx,sy,sydney,systems,sz,tab,taipei,talk,taobao,target,tatamotors,tatar,tattoo,tax,taxi,tc,tci,td,tdk,team,tech,technology,tel,temasek,tennis,teva,tf,tg,th,thd,theater,theatre,tiaa,tickets,tienda,tiffany,tips,tires,tirol,tj,tjmaxx,tjx,tk,tkmaxx,tl,tm,tmall,tn,to,today,tokyo,tools,top,toray,toshiba,total,tours,town,toyota,toys,tr,trade,trading,training,travel,travelchannel,travelers,travelersinsurance,trust,trv,tt,tube,tui,tunes,tushu,tv,tvs,tw,tz,ua,ubank,ubs,ug,uk,unicom,university,uno,uol,ups,us,uy,uz,va,vacations,vana,vanguard,vc,ve,vegas,ventures,verisign,versicherung,vet,vg,vi,viajes,video,vig,viking,villas,vin,vip,virgin,visa,vision,viva,vivo,vlaanderen,vn,vodka,volkswagen,volvo,vote,voting,voto,voyage,vu,vuelos,wales,walmart,walter,wang,wanggou,watch,watches,weather,weatherchannel,webcam,weber,website,wed,wedding,weibo,weir,wf,whoswho,wien,wiki,williamhill,win,windows,wine,winners,wme,wolterskluwer,woodside,work,works,world,wow,ws,wtc,wtf,xbox,xerox,xfinity,xihuan,xin,कॉम,セール,佛山,ಭಾರತ,慈善,集团,在线,한국,ଭାରତ,点看,คอม,ভাৰত,ভারত,八卦,ישראל,موقع,বাংলা,公益,公司,香格里拉,网站,移动,我爱你,москва,қаз,католик,онлайн,сайт,联通,срб,бг,бел,קום,时尚,微博,淡马锡,ファッション,орг,नेट,ストア,アマゾン,삼성,சிங்கப்பூர்,商标,商店,商城,дети,мкд,ею,ポイント,新闻,家電,كوم,中文网,中信,中国,中國,娱乐,谷歌,భారత్,ලංකා,電訊盈科,购物,クラウド,ભારત,通販,भारतम्,भारत,भारोत,网店,संगठन,餐厅,网络,ком,укр,香港,亚马逊,诺基亚,食品,飞利浦,台湾,台灣,手机,мон,الجزائر,عمان,ارامكو,ایران,العليان,اتصالات,امارات,بازار,موريتانيا,پاکستان,الاردن,بارت,بھارت,المغرب,ابوظبي,البحرين,السعودية,ڀارت,كاثوليك,سودان,همراه,عراق,مليسيا,澳門,닷컴,政府,شبكة,بيتك,عرب,გე,机构,组织机构,健康,ไทย,سورية,招聘,рус,рф,تونس,大拿,ລາວ,みんな,グーグル,ευ,ελ,世界,書籍,ഭാരതം,ਭਾਰਤ,网址,닷넷,コム,天主教,游戏,vermögensberater,vermögensberatung,企业,信息,嘉里大酒店,嘉里,مصر,قطر,广东,இலங்கை,இந்தியா,հայ,新加坡,فلسطين,政务,xxx,xyz,yachts,yahoo,yamaxun,yandex,ye,yodobashi,yoga,yokohama,you,youtube,yt,yun,za,zappos,zara,zero,zip,zm,zone,zuerich,zw".split(/,/)
|
26
|
+
|
27
27
|
# initialize a new PassiveTotal::API object
|
28
28
|
# username: the email address associated with your PassiveTotal API key.
|
29
29
|
# apikey: is 64-hexcharacter string
|
@@ -36,52 +36,44 @@ module PassiveTotal # :nodoc:
|
|
36
36
|
@apikey = apikey
|
37
37
|
@endpoint = endpoint
|
38
38
|
end
|
39
|
-
|
39
|
+
|
40
40
|
# Account : Get account details your account.
|
41
41
|
def account
|
42
42
|
get('account')
|
43
43
|
end
|
44
|
-
|
44
|
+
|
45
45
|
# Account History : Get history associated with your account.
|
46
46
|
def account_history
|
47
47
|
get('account/history')
|
48
48
|
end
|
49
|
-
|
49
|
+
|
50
50
|
# history is an alias for account_history
|
51
51
|
alias_method :history, :account_history
|
52
|
-
|
53
|
-
# Account notifications : Get notifications that have been posted to your account.
|
54
|
-
def account_notifications
|
55
|
-
get('account/notifications')
|
56
|
-
end
|
57
|
-
|
58
|
-
# notifications is an alias for account_notifications
|
59
|
-
alias_method :notifications, :account_notifications
|
60
|
-
|
52
|
+
|
61
53
|
# Account organization : Get details about the organization your account is associated with.
|
62
54
|
def account_organization
|
63
55
|
get('account/organization')
|
64
56
|
end
|
65
|
-
|
57
|
+
|
66
58
|
# organization is an alias for account_organization
|
67
59
|
alias_method :organization, :account_organization
|
68
|
-
|
60
|
+
|
69
61
|
# Account organization teamstream : Get the teamstream for the organization your account is associated with.
|
70
62
|
def account_organization_teamstream
|
71
63
|
get('account/organization/teamstream')
|
72
64
|
end
|
73
|
-
|
65
|
+
|
74
66
|
# teamstream is an alias for account_organization_teamstream
|
75
67
|
alias_method :teamstream, :account_organization_teamstream
|
76
|
-
|
68
|
+
|
77
69
|
# Account sources : Get source details for a specific source.
|
78
70
|
def account_sources(source)
|
79
71
|
get('account/sources', {'source' => source})
|
80
72
|
end
|
81
|
-
|
73
|
+
|
82
74
|
# sources is an alias for account_sources
|
83
75
|
alias_method :sources, :account_sources
|
84
|
-
|
76
|
+
|
85
77
|
|
86
78
|
# Passive provides a complete passive DNS picture for a domain or IP address including first/last seen values, deconflicted values, sources used, unique counts and enrichment for all values.
|
87
79
|
# query: A domain or IP address to query
|
@@ -102,10 +94,10 @@ module PassiveTotal # :nodoc:
|
|
102
94
|
end
|
103
95
|
get('dns/passive/unique', {'query' => query})
|
104
96
|
end
|
105
|
-
|
97
|
+
|
106
98
|
# unique is an alias for passive_unique
|
107
99
|
alias_method :unique, :passive_unique
|
108
|
-
|
100
|
+
|
109
101
|
# Enrichment : Enrich the given query with metadata
|
110
102
|
# query: A domain or IP address to query
|
111
103
|
def enrichment(query)
|
@@ -115,10 +107,26 @@ module PassiveTotal # :nodoc:
|
|
115
107
|
end
|
116
108
|
get('enrichment', {'query' => query})
|
117
109
|
end
|
118
|
-
|
110
|
+
|
119
111
|
# metadata is an alias for enrichment
|
120
112
|
alias_method :metadata, :enrichment
|
121
|
-
|
113
|
+
|
114
|
+
# Enrichment bulk : Enrich each of the given queries with metadata
|
115
|
+
# query: An array of domains or IP addresses to query
|
116
|
+
def bulk_enrichment(query)
|
117
|
+
if query.class != Array
|
118
|
+
query = [query]
|
119
|
+
end
|
120
|
+
query.map do |q|
|
121
|
+
is_valid_with_error(__method__, [:ipv4, :domain], q)
|
122
|
+
if domain?(q)
|
123
|
+
q = normalize_domain(q)
|
124
|
+
end
|
125
|
+
q
|
126
|
+
end
|
127
|
+
get_with_data('enrichment/bulk', { 'query' => query })
|
128
|
+
end
|
129
|
+
|
122
130
|
# osint: Get opensource intelligence data
|
123
131
|
# query: A domain or IP address to query
|
124
132
|
def osint(query)
|
@@ -128,13 +136,29 @@ module PassiveTotal # :nodoc:
|
|
128
136
|
end
|
129
137
|
get('enrichment/osint', {'query' => query})
|
130
138
|
end
|
131
|
-
|
139
|
+
|
140
|
+
# osint bulk : Enrich each of the given queries with metadata
|
141
|
+
# query: An array of domains or IP addresses to query
|
142
|
+
def bulk_osint(query)
|
143
|
+
if query.class != Array
|
144
|
+
query = [query]
|
145
|
+
end
|
146
|
+
query.map do |q|
|
147
|
+
is_valid_with_error(__method__, [:ipv4, :domain], q)
|
148
|
+
if domain?(q)
|
149
|
+
q = normalize_domain(q)
|
150
|
+
end
|
151
|
+
q
|
152
|
+
end
|
153
|
+
get_with_data('enrichment/bulk/osint', { 'query' => query })
|
154
|
+
end
|
155
|
+
|
132
156
|
# subdomains: Get subdomains using a wildcard query
|
133
157
|
# query: A domain with wildcard, e.g., *.passivetotal.org
|
134
158
|
def subdomains(query)
|
135
159
|
get('enrichment/subdomains', {'query' => query})
|
136
160
|
end
|
137
|
-
|
161
|
+
|
138
162
|
# whois: Get WHOIS data for a domain or IP address
|
139
163
|
# query: ipv4, domain, or, if you specify a field, any value for that field
|
140
164
|
# field: field name to query if not the default ip/domain field
|
@@ -151,7 +175,17 @@ module PassiveTotal # :nodoc:
|
|
151
175
|
get('whois', {'query' => query, 'compact_record' => 'false'})
|
152
176
|
end
|
153
177
|
end
|
154
|
-
|
178
|
+
|
179
|
+
# whois: Get reputation data for a domain or IP address
|
180
|
+
# query: A domain or IP address to query
|
181
|
+
def reputation(query)
|
182
|
+
is_valid_with_error(__method__, [:ipv4, :domain], query)
|
183
|
+
if domain?(query)
|
184
|
+
query = normalize_domain(query)
|
185
|
+
end
|
186
|
+
get('reputation', {'query' => query})
|
187
|
+
end
|
188
|
+
|
155
189
|
# Add a user-tag to an IP or domain
|
156
190
|
# query: A domain or IP address to tag
|
157
191
|
# tag: Value used to tag query value. Should only consist of alphanumeric, underscores and hyphen values
|
@@ -160,7 +194,7 @@ module PassiveTotal # :nodoc:
|
|
160
194
|
is_valid_with_error(__method__, [:tag], tag)
|
161
195
|
post('actions/tags', { 'query' => query, 'tags' => [tag] })
|
162
196
|
end
|
163
|
-
|
197
|
+
|
164
198
|
# Remove a user-tag to an IP or domain
|
165
199
|
# query: A domain or IP address to remove a tag from
|
166
200
|
# tag: Value used to tag query value. Should only consist of alphanumeric, underscores and hyphen values
|
@@ -169,7 +203,7 @@ module PassiveTotal # :nodoc:
|
|
169
203
|
is_valid_with_error(__method__, [:tag], tag)
|
170
204
|
delete('actions/tags', { 'query' => query, 'tags' => [tag] })
|
171
205
|
end
|
172
|
-
|
206
|
+
|
173
207
|
# PassiveTotal uses the notion of classifications to highlight table rows a certain color based on how they have been rated.
|
174
208
|
# PassiveTotal::API#classification() queries if only one argument is given, and sets if both are given
|
175
209
|
# query: A domain or IP address to query
|
@@ -185,7 +219,23 @@ module PassiveTotal # :nodoc:
|
|
185
219
|
post('actions/classification', { 'query' => query, 'classification' => set })
|
186
220
|
end
|
187
221
|
end
|
188
|
-
|
222
|
+
|
223
|
+
# Get the classification for a query in bulk
|
224
|
+
# query: An array of domains or IP address to query
|
225
|
+
def bulk_classification(query)
|
226
|
+
if query.class != Array
|
227
|
+
query = [query]
|
228
|
+
end
|
229
|
+
query.map do |q|
|
230
|
+
is_valid_with_error(__method__, [:ipv4, :domain], q)
|
231
|
+
if domain?(q)
|
232
|
+
q = normalize_domain(q)
|
233
|
+
end
|
234
|
+
q
|
235
|
+
end
|
236
|
+
get_with_data('actions/bulk/classification', { 'query' => query })
|
237
|
+
end
|
238
|
+
|
189
239
|
# PassiveTotal allows users to notate if a domain or IP address have ever been compromised. These values aid in letting users know that a site may be benign, but it was used in an attack at some point in time.
|
190
240
|
# PassiveTotal::API#ever_compromised() queries if only one argument is given, and sets if both are given
|
191
241
|
# query: A domain or IP address to query
|
@@ -202,9 +252,9 @@ module PassiveTotal # :nodoc:
|
|
202
252
|
post('actions/ever-compromised', { 'query' => query, 'status' => set })
|
203
253
|
end
|
204
254
|
end
|
205
|
-
|
255
|
+
|
206
256
|
alias_method :compromised, :ever_compromised
|
207
|
-
|
257
|
+
|
208
258
|
# PassiveTotal allows users to notate if a domain is associated with a dynamic DNS provider.
|
209
259
|
# PassiveTotal::API#dynamic() queries if only one argument is given, and sets if both are given
|
210
260
|
# query: A domain to query
|
@@ -219,7 +269,7 @@ module PassiveTotal # :nodoc:
|
|
219
269
|
post('actions/dynamic-dns', { 'query' => query, 'status' => set })
|
220
270
|
end
|
221
271
|
end
|
222
|
-
|
272
|
+
|
223
273
|
# PassiveTotal allows users to notate if an ip or domain is "monitored".
|
224
274
|
# PassiveTotal::API#monitor() queries if only one argument is given, and sets if both are given
|
225
275
|
# query: A domain to query
|
@@ -236,7 +286,7 @@ module PassiveTotal # :nodoc:
|
|
236
286
|
post('actions/monitor', { 'query' => query, 'status' => set })
|
237
287
|
end
|
238
288
|
end
|
239
|
-
|
289
|
+
|
240
290
|
# monitoring is an alias for monitor
|
241
291
|
alias_method :monitoring, :monitor
|
242
292
|
alias_method :watching, :monitor
|
@@ -254,7 +304,7 @@ module PassiveTotal # :nodoc:
|
|
254
304
|
post('actions/sinkhole', { 'query' => query, 'status' => set })
|
255
305
|
end
|
256
306
|
end
|
257
|
-
|
307
|
+
|
258
308
|
|
259
309
|
# PassiveTotal uses three types of tags (user, global, and temporal) in order to provide context back to the user.
|
260
310
|
# query: A domain or IP address to query
|
@@ -271,7 +321,7 @@ module PassiveTotal # :nodoc:
|
|
271
321
|
post('actions/tag', { 'query' => query, 'tags' => [set] })
|
272
322
|
end
|
273
323
|
end
|
274
|
-
|
324
|
+
|
275
325
|
# Search Tags : Search for items based on tag value
|
276
326
|
# PassiveTotal uses three types of tags (user, global, and temporal) in order to provide context back to the user.
|
277
327
|
# query: A domain or IP address to query
|
@@ -303,7 +353,7 @@ module PassiveTotal # :nodoc:
|
|
303
353
|
get_params('ssl-certificate/search', { 'query' => query, 'field' => field })
|
304
354
|
end
|
305
355
|
end
|
306
|
-
|
356
|
+
|
307
357
|
# PassiveTotal tracks some interesting metadata about a host
|
308
358
|
# query: a hostname or ip address
|
309
359
|
def components(query)
|
@@ -313,7 +363,7 @@ module PassiveTotal # :nodoc:
|
|
313
363
|
end
|
314
364
|
get('host-attributes/components', {'query' => query})
|
315
365
|
end
|
316
|
-
|
366
|
+
|
317
367
|
# trackers: Get all tracking codes for a domain or IP address.
|
318
368
|
# query: ip or domain, or, if type is supplied, a valid tracker ID
|
319
369
|
# type: A valid tracker type to search:
|
@@ -330,7 +380,7 @@ module PassiveTotal # :nodoc:
|
|
330
380
|
get('trackers/search', {'query' => query, 'type' => type})
|
331
381
|
end
|
332
382
|
end
|
333
|
-
|
383
|
+
|
334
384
|
# malware: get sample information based from domain
|
335
385
|
# query: ip or domain
|
336
386
|
def malware(query)
|
@@ -340,9 +390,26 @@ module PassiveTotal # :nodoc:
|
|
340
390
|
end
|
341
391
|
get('enrichment/malware', {'query' => query})
|
342
392
|
end
|
343
|
-
|
393
|
+
|
394
|
+
# malware bulk: get sample information based from domains
|
395
|
+
# query: An array of domains or IP addresses to query
|
396
|
+
def bulk_malware(query)
|
397
|
+
if query.class != Array
|
398
|
+
query = [query]
|
399
|
+
end
|
400
|
+
query.map do |q|
|
401
|
+
is_valid_with_error(__method__, [:ipv4, :domain], q)
|
402
|
+
if domain?(q)
|
403
|
+
q = normalize_domain(q)
|
404
|
+
end
|
405
|
+
q
|
406
|
+
end
|
407
|
+
get_with_data('enrichment/bulk/malware', { 'query' => query })
|
408
|
+
end
|
409
|
+
|
410
|
+
|
344
411
|
private
|
345
|
-
|
412
|
+
|
346
413
|
# returns true if the given string is a dotted quad IPv4 address
|
347
414
|
def ipv4?(ip)
|
348
415
|
if ip =~ /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/
|
@@ -350,14 +417,14 @@ module PassiveTotal # :nodoc:
|
|
350
417
|
end
|
351
418
|
false
|
352
419
|
end
|
353
|
-
|
420
|
+
|
354
421
|
# returns true if the given string looks like a domain and ends with a known top-level domain (TLD)
|
355
422
|
def domain?(domain)
|
356
423
|
return false if domain.nil?
|
357
424
|
domain = normalize_domain(domain)
|
358
425
|
domain =~ /^[a-zA-Z0-9\-\.]{3,255}$/ and TLDS.index(domain.split(/\./).last)
|
359
426
|
end
|
360
|
-
|
427
|
+
|
361
428
|
# returns true if the given string looks like a SHA-1 hash, i.e., 40 character hex string
|
362
429
|
def hash?(hash)
|
363
430
|
return false if hash.nil?
|
@@ -366,17 +433,17 @@ module PassiveTotal # :nodoc:
|
|
366
433
|
end
|
367
434
|
false
|
368
435
|
end
|
369
|
-
|
436
|
+
|
370
437
|
# returns true if the given string matches a valid classification
|
371
438
|
def classification?(c)
|
372
439
|
not ["malicious", "non-malicious", "suspicious", "unknown"].index(c).nil?
|
373
440
|
end
|
374
|
-
|
441
|
+
|
375
442
|
# returns true is the given object matches true or false
|
376
443
|
def bool?(b)
|
377
444
|
not ['true', 'false'].index(b.to_s).nil?
|
378
445
|
end
|
379
|
-
|
446
|
+
|
380
447
|
# returns true if the given string looks like a valid tag
|
381
448
|
def tag?(t)
|
382
449
|
return false if t.nil?
|
@@ -385,27 +452,27 @@ module PassiveTotal # :nodoc:
|
|
385
452
|
end
|
386
453
|
false
|
387
454
|
end
|
388
|
-
|
455
|
+
|
389
456
|
def ssl_field?(f)
|
390
457
|
return false if f.nil?
|
391
|
-
not ["issuerSurname", "subjectOrganizationName", "issuerCountry", "issuerOrganizationUnitName",
|
392
|
-
"fingerprint", "subjectOrganizationUnitName", "serialNumber", "subjectEmailAddress", "subjectCountry",
|
393
|
-
"issuerGivenName", "subjectCommonName", "issuerCommonName", "issuerStateOrProvinceName", "issuerProvince",
|
394
|
-
"subjectStateOrProvinceName", "sha1", "sslVersion", "subjectStreetAddress", "subjectSerialNumber",
|
395
|
-
"issuerOrganizationName", "subjectSurname", "subjectLocalityName", "issuerStreetAddress",
|
458
|
+
not ["issuerSurname", "subjectOrganizationName", "issuerCountry", "issuerOrganizationUnitName",
|
459
|
+
"fingerprint", "subjectOrganizationUnitName", "serialNumber", "subjectEmailAddress", "subjectCountry",
|
460
|
+
"issuerGivenName", "subjectCommonName", "issuerCommonName", "issuerStateOrProvinceName", "issuerProvince",
|
461
|
+
"subjectStateOrProvinceName", "sha1", "sslVersion", "subjectStreetAddress", "subjectSerialNumber",
|
462
|
+
"issuerOrganizationName", "subjectSurname", "subjectLocalityName", "issuerStreetAddress",
|
396
463
|
"issuerLocalityName", "subjectGivenName", "subjectProvince", "issuerSerialNumber", "issuerEmailAddress"].index(f).nil?
|
397
464
|
end
|
398
|
-
|
465
|
+
|
399
466
|
def whois_field?(f)
|
400
467
|
return false if f.nil?
|
401
468
|
not ["domain", "email", "name", "organization", "address", "phone", "nameserver"].index(f).nil?
|
402
469
|
end
|
403
|
-
|
470
|
+
|
404
471
|
def tracker_type?(t)
|
405
472
|
return false if t.nil?
|
406
473
|
not ["YandexMetricaCounterId", "ClickyId", "GoogleAnalyticsAccountNumber", "NewRelicId", "MixpanelId", "GoogleAnalyticsTrackingId"].index(t).nil?
|
407
474
|
end
|
408
|
-
|
475
|
+
|
409
476
|
# lowercases and removes a trailing period (if one exists) from a domain name
|
410
477
|
def normalize_domain(domain)
|
411
478
|
return domain.downcase.gsub(/\.$/,'')
|
@@ -415,22 +482,26 @@ module PassiveTotal # :nodoc:
|
|
415
482
|
def get(api, params={})
|
416
483
|
url2json(:GET, "#{@endpoint}#{api}", params)
|
417
484
|
end
|
418
|
-
|
485
|
+
|
419
486
|
# helper function to perform an HTTP GET against the web API
|
420
487
|
def get_params(api, params)
|
421
488
|
url2json(:GET, "#{@endpoint}#{api}", params)
|
422
489
|
end
|
423
|
-
|
490
|
+
|
491
|
+
def get_with_data(api, params={})
|
492
|
+
url2json(:GET_DATA, "#{@endpoint}#{api}", params)
|
493
|
+
end
|
494
|
+
|
424
495
|
# helper function to perform an HTTP POST against the web API
|
425
496
|
def post(api, params)
|
426
497
|
url2json(:POST, "#{@endpoint}#{api}", params)
|
427
498
|
end
|
428
|
-
|
499
|
+
|
429
500
|
# helper function to perform an HTTP DELETE against the web API
|
430
501
|
def delete(api, params)
|
431
502
|
url2json(:DELETE, "#{@endpoint}#{api}", params)
|
432
503
|
end
|
433
|
-
|
504
|
+
|
434
505
|
# main helper function to perform HTTP interactions with the web API.
|
435
506
|
def url2json(method, url, params)
|
436
507
|
if method == :GET
|
@@ -444,6 +515,11 @@ module PassiveTotal # :nodoc:
|
|
444
515
|
request = nil
|
445
516
|
if method == :GET
|
446
517
|
request = Net::HTTP::Get.new(url.request_uri)
|
518
|
+
elsif method == :GET_DATA
|
519
|
+
request = Net::HTTP::Get.new(url.request_uri)
|
520
|
+
form_data = params.to_json
|
521
|
+
request.content_type = 'application/json'
|
522
|
+
request.body = form_data
|
447
523
|
elsif method == :POST
|
448
524
|
request = Net::HTTP::Post.new(url.request_uri)
|
449
525
|
form_data = params.to_json
|
@@ -467,13 +543,13 @@ module PassiveTotal # :nodoc:
|
|
467
543
|
response = http.request(request)
|
468
544
|
delta = (Time.now - t1).to_f
|
469
545
|
data = JSON.parse(response.body)
|
470
|
-
|
546
|
+
|
471
547
|
obj = Transaction.new(
|
472
548
|
Query.new(method, params['query'], params[method] || params['tag'], url, params),
|
473
549
|
Response.new(response.body, response.code == '200', data),
|
474
550
|
delta
|
475
551
|
)
|
476
|
-
|
552
|
+
|
477
553
|
if data['error']
|
478
554
|
message = data['error']['message']
|
479
555
|
case message
|
@@ -488,7 +564,7 @@ module PassiveTotal # :nodoc:
|
|
488
564
|
|
489
565
|
return obj
|
490
566
|
end
|
491
|
-
|
567
|
+
|
492
568
|
# tests an item to see if it matches a valid type
|
493
569
|
def is_valid?(types, item)
|
494
570
|
types.each do |type|
|
@@ -514,7 +590,7 @@ module PassiveTotal # :nodoc:
|
|
514
590
|
end
|
515
591
|
return false
|
516
592
|
end
|
517
|
-
|
593
|
+
|
518
594
|
# tests an item to see if it matches a valid type and raises an ArgumentError if invalid
|
519
595
|
def is_valid_with_error(methname, types, item)
|
520
596
|
valid = is_valid?(types, item)
|
@@ -525,4 +601,4 @@ module PassiveTotal # :nodoc:
|
|
525
601
|
end
|
526
602
|
|
527
603
|
end
|
528
|
-
end
|
604
|
+
end
|
data/lib/passivetotal/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: passivetotal
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.0.
|
4
|
+
version: 1.0.6
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- chrislee35
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2021-12-01 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: json
|
@@ -16,56 +16,56 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - "~>"
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: '
|
19
|
+
version: '2.0'
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - "~>"
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: '
|
26
|
+
version: '2.0'
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: bundler
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
30
30
|
requirements:
|
31
31
|
- - "~>"
|
32
32
|
- !ruby/object:Gem::Version
|
33
|
-
version:
|
33
|
+
version: 2.2.10
|
34
34
|
type: :development
|
35
35
|
prerelease: false
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
38
|
- - "~>"
|
39
39
|
- !ruby/object:Gem::Version
|
40
|
-
version:
|
40
|
+
version: 2.2.10
|
41
41
|
- !ruby/object:Gem::Dependency
|
42
42
|
name: rake
|
43
43
|
requirement: !ruby/object:Gem::Requirement
|
44
44
|
requirements:
|
45
45
|
- - "~>"
|
46
46
|
- !ruby/object:Gem::Version
|
47
|
-
version: '
|
47
|
+
version: '13.0'
|
48
48
|
type: :development
|
49
49
|
prerelease: false
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
51
51
|
requirements:
|
52
52
|
- - "~>"
|
53
53
|
- !ruby/object:Gem::Version
|
54
|
-
version: '
|
54
|
+
version: '13.0'
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
56
|
name: minitest
|
57
57
|
requirement: !ruby/object:Gem::Requirement
|
58
58
|
requirements:
|
59
|
-
- - "
|
59
|
+
- - "~>"
|
60
60
|
- !ruby/object:Gem::Version
|
61
|
-
version: '
|
61
|
+
version: '5.14'
|
62
62
|
type: :development
|
63
63
|
prerelease: false
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
|
-
- - "
|
66
|
+
- - "~>"
|
67
67
|
- !ruby/object:Gem::Version
|
68
|
-
version: '
|
68
|
+
version: '5.14'
|
69
69
|
description: PassiveTotal offers an extensive API for users of the platform that maps
|
70
70
|
most major actions available in the web application to a corresponding call. There
|
71
71
|
are two flavors of the API available for use, stable and current. In order to use
|
@@ -79,25 +79,18 @@ executables:
|
|
79
79
|
extensions: []
|
80
80
|
extra_rdoc_files: []
|
81
81
|
files:
|
82
|
-
- ".gitignore"
|
83
|
-
- ".travis.yml"
|
84
|
-
- Gemfile
|
85
|
-
- LICENSE.txt
|
86
|
-
- README.md
|
87
|
-
- Rakefile
|
88
82
|
- bin/passivetotal
|
89
83
|
- lib/passivetotal.rb
|
90
84
|
- lib/passivetotal/api.rb
|
91
85
|
- lib/passivetotal/cli.rb
|
92
86
|
- lib/passivetotal/version.rb
|
93
|
-
- passivetotal.gemspec
|
94
87
|
- utils/console
|
95
88
|
- utils/setup
|
96
89
|
homepage: https://github.com/chrislee35/passivetotal
|
97
90
|
licenses:
|
98
91
|
- MIT
|
99
92
|
metadata: {}
|
100
|
-
post_install_message:
|
93
|
+
post_install_message:
|
101
94
|
rdoc_options: []
|
102
95
|
require_paths:
|
103
96
|
- lib
|
@@ -112,9 +105,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
112
105
|
- !ruby/object:Gem::Version
|
113
106
|
version: '0'
|
114
107
|
requirements: []
|
115
|
-
|
116
|
-
|
117
|
-
signing_key:
|
108
|
+
rubygems_version: 3.1.2
|
109
|
+
signing_key:
|
118
110
|
specification_version: 4
|
119
|
-
summary: Wrapper library for PassiveTotal.org's
|
111
|
+
summary: Wrapper library for PassiveTotal.org's Web API
|
120
112
|
test_files: []
|
data/.gitignore
DELETED
data/.travis.yml
DELETED
data/Gemfile
DELETED
data/LICENSE.txt
DELETED
@@ -1,21 +0,0 @@
|
|
1
|
-
The MIT License (MIT)
|
2
|
-
|
3
|
-
Copyright (c) 2015 chrislee35
|
4
|
-
|
5
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
6
|
-
of this software and associated documentation files (the "Software"), to deal
|
7
|
-
in the Software without restriction, including without limitation the rights
|
8
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
9
|
-
copies of the Software, and to permit persons to whom the Software is
|
10
|
-
furnished to do so, subject to the following conditions:
|
11
|
-
|
12
|
-
The above copyright notice and this permission notice shall be included in
|
13
|
-
all copies or substantial portions of the Software.
|
14
|
-
|
15
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
16
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
17
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
18
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
19
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
20
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
21
|
-
THE SOFTWARE.
|
data/README.md
DELETED
@@ -1,163 +0,0 @@
|
|
1
|
-
# PassiveTotal
|
2
|
-
|
3
|
-
The PassiveTotal gem is (currently) a thin wrapper around PassiveTotal.org's Web-based API.
|
4
|
-
|
5
|
-
## Installation
|
6
|
-
|
7
|
-
Add this line to your application's Gemfile:
|
8
|
-
|
9
|
-
```ruby
|
10
|
-
gem 'passivetotal'
|
11
|
-
```
|
12
|
-
|
13
|
-
And then execute:
|
14
|
-
|
15
|
-
$ bundle
|
16
|
-
|
17
|
-
Or install it yourself as:
|
18
|
-
|
19
|
-
$ gem install passivetotal
|
20
|
-
|
21
|
-
## Command Line Tool
|
22
|
-
|
23
|
-
Included in the gem is a command-line tool, passivetotal, with the following usage:
|
24
|
-
|
25
|
-
Usage: bin/passivetotal [-v] [-u <username>] [-k <apikey>] <action flag> <query> [-i <value>]
|
26
|
-
-h Help
|
27
|
-
-v Verbose output
|
28
|
-
-u <username> Sets the Username, defaults to the environment variable PASSIVETOTAL_USERNAME
|
29
|
-
-k <apikey> Sets the APIKEY, defaults to the environment variable PASSIVETOTAL_APIKEY
|
30
|
-
ACTIONS (You have to select one, last one wins) -m <ip or dom> Queries metadata for given IP or domain
|
31
|
-
-p <ip or dom> Queries passive DNS data for given IP or domain
|
32
|
-
-c <ip or dom> Queries (or sets) the classification for a given IP or domain
|
33
|
-
-t <ip or dom> Queries (adds or removes) the tags associated with a given IP or domain
|
34
|
-
* To remove a tag, prepend a dash, '-' to the tag name when using the -i option
|
35
|
-
-e <ip or dom> Queries (or sets) the ever compromised flag on a given IP or domain
|
36
|
-
-w <ip or dom> Queries (or sets) the watched flag on a given IP or domain
|
37
|
-
-s <dom> Queries the subdomains for a given domain
|
38
|
-
-d <dom> Queries (or sets) if a domain is a dynamic DNS domain
|
39
|
-
-x <ip> Queries (or sets) if a given IP is a sinkhole
|
40
|
-
-l <hash> Queries for SSL certificates/IP addresses associated with a given SHA-1 hash
|
41
|
-
-H <ip or hash> Queries for SSL certificate history associated with a given IP or SHA-1 hash
|
42
|
-
-T <ip or dom> Queries for Tracker information associated with a given IP or domain
|
43
|
-
-o <ip or dom> Queries for OSINT on a given IP or domain
|
44
|
-
-M <ip or dom> Queries for Malware sample records for a given IP or domain
|
45
|
-
SETTING VALUES -i <value> Sets the value, used in conjuntion with -c, -t, -e, -w, -d, or -x
|
46
|
-
Valid values for -i depend on what it's used with:
|
47
|
-
-c : malicious, non-malicious, suspicious, unknown
|
48
|
-
-t : <a tag name consisting of characters: [a-zA-Z_]>
|
49
|
-
-e, -w, -d, -x: true, false
|
50
|
-
|
51
|
-
## Usage
|
52
|
-
|
53
|
-
# Initialize the API wrapper with an apikey (using the default endpoint URL of https://api.passivetotal.org/v2/)
|
54
|
-
pt = PassiveTotal::API.new(user, apikey)
|
55
|
-
# Create an array to shove results into
|
56
|
-
res = Array.new
|
57
|
-
|
58
|
-
# ACCOUNT API
|
59
|
-
# Get account details your account.
|
60
|
-
res << @pt.account
|
61
|
-
# Get history associated with your account.
|
62
|
-
res << @pt.history
|
63
|
-
# Get notifications that have been posted to your account.
|
64
|
-
res << @pt.notifications
|
65
|
-
# Get details about the organization your account is associated with.
|
66
|
-
res << @pt.organization
|
67
|
-
# Get the teamstream for the organization your account is associated with.
|
68
|
-
res << @pt.teamstream
|
69
|
-
# Get source details for a specific source.
|
70
|
-
res << @pt.sources('riskiq')
|
71
|
-
|
72
|
-
# DNS API
|
73
|
-
# query passive DNS results for the domain, www.passivetotal.org
|
74
|
-
res << @pt.passive('www.passivetotal.org')
|
75
|
-
# query passive DNS results for the ipv4 address, 107.170.89.121
|
76
|
-
res << @pt.passive('107.170.89.121')
|
77
|
-
# query for unique IPv4 resolutions of passivetotal.org
|
78
|
-
res << @pt.unique('passivetotal.org')
|
79
|
-
|
80
|
-
# ENRICHMENT API
|
81
|
-
# query enrichment for the domain, www.passivetotal.org
|
82
|
-
res << @pt.enrichment('www.passivetotal.org')
|
83
|
-
# query enrichment for the ipv4 address, 107.170.89.121
|
84
|
-
res << @pt.enrichment('107.170.89.121')
|
85
|
-
# Get malware data
|
86
|
-
res << @pt.malware('noorno.com')
|
87
|
-
# query for malware sample records by the ip addres 98.124.243.47
|
88
|
-
res << @pt.malware("98.124.243.47")
|
89
|
-
# Get opensource intelligence data
|
90
|
-
res << @pt.osint("xxxmobiletubez.com")
|
91
|
-
# query for subdomains of passivetotal.org
|
92
|
-
res << @pt.subdomains('*.passivetotal.org')
|
93
|
-
|
94
|
-
# WHOIS API
|
95
|
-
# Get WHOIS data for a domain or IP address
|
96
|
-
res << @pt.whois("passivetotal.org")
|
97
|
-
# Get WHOIS records based on field matching queries.
|
98
|
-
res << @pt.whois("proxy4655031@1and1-private-registration.com", "email")
|
99
|
-
|
100
|
-
# ACTIONS API
|
101
|
-
# query for the tags associated with www.chrisleephd.us
|
102
|
-
res << @pt.tags('www.chrisleephd.us')
|
103
|
-
# add the "cool" tag to www.chrisleephd.us
|
104
|
-
res << @pt.add_tag('www.chrisleephd.us', 'cool')
|
105
|
-
# remove the "cool" tag from www.chrisleephd.us (aww, I was cool for a few milliseconds :( )
|
106
|
-
res << @pt.remove_tag('www.chrisleephd.us', 'cool')
|
107
|
-
# query for the classification of www.passivetotal.org
|
108
|
-
res << @pt.classification('www.passivetotal.org')
|
109
|
-
# set the classification of www.passivetotal.org as benign
|
110
|
-
res << @pt.classification('www.passivetotal.org', 'non-malicious')
|
111
|
-
# query if www.passivetotal.org has ever been listed as compromised
|
112
|
-
res << @pt.ever_compromised('www.passivetotal.org')
|
113
|
-
# set the ever_compromised flag for www.passivetotal.org to false to indicate that it was never compromised or that it is in sole control of a malicious actor.
|
114
|
-
res << @pt.ever_compromised('www.passivetotal.org', false)
|
115
|
-
# check if www.passivetotal.org is a dynamic dns domain/host
|
116
|
-
res << @pt.dynamic('www.passivetotal.org')
|
117
|
-
# flag www.passivetotal.org as not a dynamic dns domain/host
|
118
|
-
res << @pt.dynamic('www.passivetotal.org', false)
|
119
|
-
# check if www.passivetotal.org is being watched
|
120
|
-
res << @pt.monitor('www.passivetotal.org')
|
121
|
-
# unwatch www.passivetotal.org
|
122
|
-
res << @pt.monitor('www.passivetotal.org', false)
|
123
|
-
# query if 107.170.89.121 is a sinkhole
|
124
|
-
res << @pt.sinkhole('107.170.89.121')
|
125
|
-
# set 107.170.89.121 as not a sinkhole
|
126
|
-
res << @pt.sinkhole('107.170.89.121', false)
|
127
|
-
|
128
|
-
# HOST API
|
129
|
-
# Get detailed information about a host
|
130
|
-
res << @pt.components('passivetotal.org')
|
131
|
-
# Get all tracking codes for a domain or IP address.
|
132
|
-
res << @pt.trackers('passivetotal.org')
|
133
|
-
# Get hosts matching a specific tracker ID
|
134
|
-
res << @pt.trackers('UA-49901229', 'GoogleAnalyticsAccountNumber')
|
135
|
-
|
136
|
-
# SSL API
|
137
|
-
# list sites associated with SSL certificates with SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
|
138
|
-
res << @pt.ssl_certificate('e9a6647d6aba52dc47b3838c920c9ee59bad7034')
|
139
|
-
# list sites associated with SSL certificates with SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
|
140
|
-
res << @pt.ssl_certificate('2317683628587350290823564500811277499', 'serialNumber')
|
141
|
-
# retrieve certificate history based on SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
|
142
|
-
res << @pt.ssl_certificate_history('e9a6647d6aba52dc47b3838c920c9ee59bad7034')
|
143
|
-
# retrieve certificate history from IPv4 address of 52.8.228.23
|
144
|
-
res << @pt.ssl_certificate_history('52.8.228.23')
|
145
|
-
|
146
|
-
# dump all this glorious information to feast your eyes upon
|
147
|
-
pp res
|
148
|
-
|
149
|
-
## Development
|
150
|
-
|
151
|
-
After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
|
152
|
-
|
153
|
-
To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
|
154
|
-
|
155
|
-
## Contributing
|
156
|
-
|
157
|
-
Bug reports and pull requests are welcome on GitHub at https://github.com/chrislee35/passivetotal.
|
158
|
-
|
159
|
-
|
160
|
-
## License
|
161
|
-
|
162
|
-
The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
|
163
|
-
|
data/Rakefile
DELETED
data/passivetotal.gemspec
DELETED
@@ -1,26 +0,0 @@
|
|
1
|
-
# coding: utf-8
|
2
|
-
lib = File.expand_path('../lib', __FILE__)
|
3
|
-
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
4
|
-
require 'passivetotal/version'
|
5
|
-
|
6
|
-
Gem::Specification.new do |spec|
|
7
|
-
spec.name = "passivetotal"
|
8
|
-
spec.version = PassiveTotal::VERSION
|
9
|
-
spec.authors = ["chrislee35"]
|
10
|
-
spec.email = ["rubygems@chrislee.dhs.org"]
|
11
|
-
|
12
|
-
spec.summary = %q{Wrapper library for PassiveTotal.org's W eb API}
|
13
|
-
spec.description = %q{PassiveTotal offers an extensive API for users of the platform that maps most major actions available in the web application to a corresponding call. There are two flavors of the API available for use, stable and current. In order to use the stable API, add the version indicator (vX) into the URL as documented below. If you would rather use the current API which includes new changes and experiments, replace the version indicator with "current".}
|
14
|
-
spec.homepage = "https://github.com/chrislee35/passivetotal"
|
15
|
-
spec.license = "MIT"
|
16
|
-
|
17
|
-
spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
|
18
|
-
spec.bindir = "bin"
|
19
|
-
spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
|
20
|
-
spec.require_paths = ["lib"]
|
21
|
-
|
22
|
-
spec.add_runtime_dependency "json", "~> 1.8"
|
23
|
-
spec.add_development_dependency "bundler", "~> 1.10"
|
24
|
-
spec.add_development_dependency "rake", "~> 10.0"
|
25
|
-
spec.add_development_dependency "minitest"
|
26
|
-
end
|