passivetotal 1.0.5 → 1.0.6

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
- SHA1:
3
- metadata.gz: fa2776debe34c25637dff2619260a795d86e2d62
4
- data.tar.gz: 14edadd4376e1158207ee42ce516a306f9ec03e8
2
+ SHA256:
3
+ metadata.gz: a83e6b94b558fcf2e524fd272d2a0238b325aae63689871c8c8f52ff1e211f29
4
+ data.tar.gz: 335f3ec0c83e2987619932c71470a109afab17581158cccdbb9e0dfb5541574c
5
5
  SHA512:
6
- metadata.gz: daf2a6b7739ae245d6d5026dde2960901a77a24585da8d00b9f7c06bb77f4ceaa828f80bc4e8965e05c682ee7c7d893173ced8a02d347660b3c59cc3278d5b1e
7
- data.tar.gz: 2bee8c1a55b35f07fd9fe4153c2837417b9b75a21ba16e06691a58a5288ec979458dd9004436dca0118835170e3f38395795852989c54c4432cfeec32921a518
6
+ metadata.gz: 856745401361b82a1096c387eb6d1d0db9937507ee3e390ca41effb5853c80e8d604c9f4ec9990a25e13aa72ff20a3383d0800ddac7bf8036078850751b83e8d
7
+ data.tar.gz: c0cf41003118d3cffaebc7aba2b7a78b4eb39806587bf7538c7c34f51284aea6fe98dff5f79fc33e54842c99ad1e94e6074fc763e50f25b99a9fd17ad6fe008e
@@ -7,23 +7,23 @@ require 'passivetotal/version'
7
7
  # DESCRIPTION: rubygem for querying PassiveTotal.org's web API
8
8
 
9
9
  module PassiveTotal # :nodoc:
10
-
10
+
11
11
  class InvalidAPIKeyError < ArgumentError; end
12
12
  class APIUsageError < StandardError; end
13
13
  class ExceededQuotaError < StandardError; end
14
-
14
+
15
15
  class Transaction < Struct.new(:query, :response, :response_time); end
16
16
  class Query < Struct.new(:api, :query, :set, :url, :parameters); end
17
17
  class Response < Struct.new(:json, :success, :results); end
18
-
18
+
19
19
  # The API class wraps the PassiveTotal.org web API for all the verbs that it supports
20
20
  # See https://api.passivetotal.org/api/docs/ for the API documentation.
21
21
  class API
22
22
  # The TLDS array helps the interface detect valid domains.
23
23
  # This list was generated by parsing the NS records from a zone transfer of the root
24
24
  # The same list could have been downloaded from http://data.iana.org/TLD/tlds-alpha-by-domain.txt
25
- TLDS = "abb,abbott,abogado,ac,academy,accenture,accountant,accountants,active,actor,ad,ads,adult,ae,aeg,aero,af,afl,ag,agency,ai,aig,airforce,al,allfinanz,alsace,am,amsterdam,an,android,ao,apartments,aq,aquarelle,ar,archi,army,arpa,as,asia,associates,at,attorney,au,auction,audio,auto,autos,aw,ax,axa,az,azure,ba,band,bank,bar,barclaycard,barclays,bargains,bauhaus,bayern,bb,bbc,bbva,bd,be,beer,berlin,best,bf,bg,bh,bharti,bi,bible,bid,bike,bing,bingo,bio,biz,bj,black,blackfriday,bloomberg,blue,bm,bmw,bn,bnl,bnpparibas,bo,boats,bond,boo,boutique,br,bradesco,bridgestone,broker,brother,brussels,bs,bt,budapest,build,builders,business,buzz,bv,bw,by,bz,bzh,ca,cab,cafe,cal,camera,camp,cancerresearch,canon,capetown,capital,caravan,cards,care,career,careers,cars,cartier,casa,cash,casino,cat,catering,cba,cbn,cc,cd,center,ceo,cern,cf,cfa,cfd,cg,ch,channel,chat,cheap,chloe,christmas,chrome,church,ci,cisco,citic,city,ck,cl,claims,cleaning,click,clinic,clothing,cloud,club,cm,cn,co,coach,codes,coffee,college,cologne,com,commbank,community,company,computer,condos,construction,consulting,contractors,cooking,cool,coop,corsica,country,coupons,courses,cr,credit,creditcard,cricket,crown,crs,cruises,cu,cuisinella,cv,cw,cx,cy,cymru,cyou,cz,dabur,dad,dance,date,dating,datsun,day,dclk,de,deals,degree,delivery,democrat,dental,dentist,desi,design,dev,diamonds,diet,digital,direct,directory,discount,dj,dk,dm,dnp,do,docs,dog,doha,domains,doosan,download,drive,durban,dvag,dz,earth,eat,ec,edu,education,ee,eg,email,emerck,energy,engineer,engineering,enterprises,epson,equipment,er,erni,es,esq,estate,et,eu,eurovision,eus,events,everbank,exchange,expert,exposed,express,fail,faith,fan,fans,farm,fashion,feedback,fi,film,finance,financial,firmdale,fish,fishing,fit,fitness,fj,fk,flights,florist,flowers,flsmidth,fly,fm,fo,foo,football,forex,forsale,foundation,fr,frl,frogans,fund,furniture,futbol,fyi,ga,gal,gallery,garden,gb,gbiz,gd,gdn,ge,gent,genting,gf,gg,ggee,gh,gi,gift,gifts,gives,gl,glass,gle,global,globo,gm,gmail,gmo,gmx,gn,gold,goldpoint,golf,goo,goog,google,gop,gov,gp,gq,gr,graphics,gratis,green,gripe,gs,gt,gu,guge,guide,guitars,guru,gw,gy,hamburg,hangout,haus,healthcare,help,here,hermes,hiphop,hitachi,hiv,hk,hm,hn,hockey,holdings,holiday,homedepot,homes,honda,horse,host,hosting,hoteles,hotmail,house,how,hr,ht,hu,ibm,icbc,icu,id,ie,ifm,il,im,immo,immobilien,in,industries,infiniti,info,ing,ink,institute,insure,int,international,investments,io,iq,ir,irish,is,it,iwc,java,jcb,je,jetzt,jewelry,jlc,jll,jm,jo,jobs,joburg,jp,juegos,kaufen,kddi,ke,kg,kh,ki,kim,kitchen,kiwi,km,kn,koeln,komatsu,kp,kr,krd,kred,kw,ky,kyoto,kz,la,lacaixa,land,lasalle,lat,latrobe,law,lawyer,lb,lc,lds,lease,leclerc,legal,lgbt,li,liaison,lidl,life,lighting,limited,limo,link,lk,loan,loans,lol,london,lotte,lotto,love,lr,ls,lt,ltda,lu,lupin,luxe,luxury,lv,ly,ma,madrid,maif,maison,management,mango,market,marketing,markets,marriott,mba,mc,md,me,media,meet,melbourne,meme,memorial,men,menu,mg,mh,miami,microsoft,mil,mini,mk,ml,mm,mma,mn,mo,mobi,moda,moe,monash,money,montblanc,mormon,mortgage,moscow,motorcycles,mov,movie,movistar,mp,mq,mr,ms,mt,mtn,mtpc,mu,museum,mv,mw,mx,my,mz,na,nadex,nagoya,name,navy,nc,ne,nec,net,netbank,network,neustar,new,news,nexus,nf,ng,ngo,nhk,ni,nico,ninja,nissan,nl,no,np,nr,nra,nrw,ntt,nu,nyc,nz,office,okinawa,om,omega,one,ong,onl,online,ooo,oracle,org,organic,osaka,otsuka,ovh,pa,page,panerai,paris,partners,parts,party,pe,pf,pg,ph,pharmacy,philips,photo,photography,photos,physio,piaget,pics,pictet,pictures,pink,pizza,pk,pl,place,play,plumbing,plus,pm,pn,pohl,poker,porn,post,pr,praxi,press,pro,prod,productions,prof,properties,property,ps,pt,pub,pw,py,qa,qpon,quebec,racing,re,realtor,recipes,red,redstone,rehab,reise,reisen,reit,ren,rent,rentals,repair,report,republican,rest,restaurant,review,reviews,rich,ricoh,rio,rip,ro,rocks,rodeo,rs,rsvp,ru,ruhr,run,rw,ryukyu,sa,saarland,sale,samsung,sandvik,sandvikcoromant,sap,sarl,saxo,sb,sc,sca,scb,schmidt,scholarships,school,schule,schwarz,science,scor,scot,sd,se,seat,sener,services,sew,sex,sexy,sg,sh,shiksha,shoes,show,shriram,si,singles,site,sj,sk,ski,sky,skype,sl,sm,sn,sncf,so,soccer,social,software,sohu,solar,solutions,sony,soy,space,spiegel,spreadbetting,sr,st,starhub,statoil,study,style,su,sucks,supplies,supply,support,surf,surgery,suzuki,sv,swatch,swiss,sx,sy,sydney,systems,sz,taipei,tatar,tattoo,tax,taxi,tc,td,team,tech,technology,tel,telefonica,temasek,tennis,tf,tg,th,thd,theater,tickets,tienda,tips,tires,tirol,tj,tk,tl,tm,tn,to,today,tokyo,tools,top,toray,toshiba,tours,town,toys,tr,trade,trading,training,travel,trust,tt,tui,tv,tw,tz,ua,ug,uk,university,uno,uol,us,uy,uz,va,vacations,vc,ve,vegas,ventures,versicherung,vet,vg,vi,viajes,video,villas,vision,vista,vistaprint,vlaanderen,vn,vodka,vote,voting,voto,voyage,vu,wales,walter,wang,watch,webcam,website,wed,wedding,weir,wf,whoswho,wien,wiki,williamhill,win,windows,wme,work,works,world,ws,wtc,wtf,xbox,xerox,xin,xn--1qqw23a,xn--30rr7y,xn--3bst00m,xn--3ds443g,xn--3e0b707e,xn--45brj9c,xn--45q11c,xn--4gbrim,xn--55qw42g,xn--55qx5d,xn--6frz82g,xn--6qq986b3xl,xn--80adxhks,xn--80ao21a,xn--80asehdb,xn--80aswg,xn--90a3ac,xn--90ais,xn--9et52u,xn--b4w605ferd,xn--c1avg,xn--cg4bki,xn--clchc0ea0b2g2a9gcd,xn--czr694b,xn--czrs0t,xn--czru2d,xn--d1acj3b,xn--d1alf,xn--estv75g,xn--fiq228c5hs,xn--fiq64b,xn--fiqs8s,xn--fiqz9s,xn--fjq720a,xn--flw351e,xn--fpcrj9c3d,xn--fzc2c9e2c,xn--gecrj9c,xn--h2brj9c,xn--hxt814e,xn--i1b6b1a6a2e,xn--imr513n,xn--io0a7i,xn--j1amh,xn--j6w193g,xn--kcrx77d1x4a,xn--kprw13d,xn--kpry57d,xn--kput3i,xn--l1acc,xn--lgbbat1ad8j,xn--mgb9awbf,xn--mgba3a4f16a,xn--mgbaam7a8h,xn--mgbab2bd,xn--mgbayh7gpa,xn--mgbbh1a71e,xn--mgbc0a9azcg,xn--mgberp4a5d4ar,xn--mgbpl2fh,xn--mgbx4cd0ab,xn--mxtq1m,xn--ngbc5azd,xn--node,xn--nqv7f,xn--nqv7fs00ema,xn--nyqy26a,xn--o3cw4h,xn--ogbpf8fl,xn--p1acf,xn--p1ai,xn--pgbs0dh,xn--q9jyb4c,xn--qcka1pmc,xn--rhqv96g,xn--s9brj9c,xn--ses554g,xn--unup4y,xn--vermgensberater-ctb,xn--vermgensberatung-pwb,xn--vhquv,xn--vuq861b,xn--wgbh1c,xn--wgbl6a,xn--xhq521b,xn--xkc2al3hye2a,xn--xkc2dl3a5ee0h,xn--y9a3aq,xn--yfro4i67o,xn--ygbi2ammx,xn--zfr164b,xxx,xyz,yachts,yandex,ye,yodobashi,yoga,yokohama,youtube,yt,za,zip,zm,zone,zuerich,zw".split(/,/)
26
-
25
+ TLDS = "aaa,aarp,abarth,abb,abbott,abbvie,abc,able,abogado,abudhabi,ac,academy,accenture,accountant,accountants,aco,actor,ad,adac,ads,adult,ae,aeg,aero,aetna,af,afamilycompany,afl,africa,ag,agakhan,agency,ai,aig,airbus,airforce,airtel,akdn,al,alfaromeo,alibaba,alipay,allfinanz,allstate,ally,alsace,alstom,am,amazon,americanexpress,americanfamily,amex,amfam,amica,amsterdam,analytics,android,anquan,anz,ao,aol,apartments,app,apple,aq,aquarelle,ar,arab,aramco,archi,army,arpa,art,arte,as,asda,asia,associates,at,athleta,attorney,au,auction,audi,audible,audio,auspost,author,auto,autos,avianca,aw,aws,ax,axa,az,azure,ba,baby,baidu,banamex,bananarepublic,band,bank,bar,barcelona,barclaycard,barclays,barefoot,bargains,baseball,basketball,bauhaus,bayern,bb,bbc,bbt,bbva,bcg,bcn,bd,be,beats,beauty,beer,bentley,berlin,best,bestbuy,bet,bf,bg,bh,bharti,bi,bible,bid,bike,bing,bingo,bio,biz,bj,black,blackfriday,blockbuster,blog,bloomberg,blue,bm,bms,bmw,bn,bnpparibas,bo,boats,boehringer,bofa,bom,bond,boo,book,booking,bosch,bostik,boston,bot,boutique,box,br,bradesco,bridgestone,broadway,broker,brother,brussels,bs,bt,budapest,bugatti,build,builders,business,buy,buzz,bv,bw,by,bz,bzh,ca,cab,cafe,cal,call,calvinklein,cam,camera,camp,cancerresearch,canon,capetown,capital,capitalone,car,caravan,cards,care,career,careers,cars,casa,case,cash,casino,cat,catering,catholic,cba,cbn,cbre,cbs,cc,cd,center,ceo,cern,cf,cfa,cfd,cg,ch,chanel,channel,charity,chase,chat,cheap,chintai,christmas,chrome,church,ci,cipriani,circle,cisco,citadel,citi,citic,city,cityeats,ck,cl,claims,cleaning,click,clinic,clinique,clothing,cloud,club,clubmed,cm,cn,co,coach,codes,coffee,college,cologne,com,comcast,commbank,community,company,compare,computer,comsec,condos,construction,consulting,contact,contractors,cooking,cookingchannel,cool,coop,corsica,country,coupon,coupons,courses,cpa,cr,credit,creditcard,creditunion,cricket,crown,crs,cruise,cruises,csc,cu,cuisinella,cv,cw,cx,cy,cymru,cyou,cz,dabur,dad,dance,data,date,dating,datsun,day,dclk,dds,de,deal,dealer,deals,degree,delivery,dell,deloitte,delta,democrat,dental,dentist,desi,design,dev,dhl,diamonds,diet,digital,direct,directory,discount,discover,dish,diy,dj,dk,dm,dnp,do,docs,doctor,dog,domains,dot,download,drive,dtv,dubai,duck,dunlop,dupont,durban,dvag,dvr,dz,earth,eat,ec,eco,edeka,edu,education,ee,eg,email,emerck,energy,engineer,engineering,enterprises,epson,equipment,er,ericsson,erni,es,esq,estate,et,etisalat,eu,eurovision,eus,events,exchange,expert,exposed,express,extraspace,fage,fail,fairwinds,faith,family,fan,fans,farm,farmers,fashion,fast,fedex,feedback,ferrari,ferrero,fi,fiat,fidelity,fido,film,final,finance,financial,fire,firestone,firmdale,fish,fishing,fit,fitness,fj,fk,flickr,flights,flir,florist,flowers,fly,fm,fo,foo,food,foodnetwork,football,ford,forex,forsale,forum,foundation,fox,fr,free,fresenius,frl,frogans,frontdoor,frontier,ftr,fujitsu,fun,fund,furniture,futbol,fyi,ga,gal,gallery,gallo,gallup,game,games,gap,garden,gay,gb,gbiz,gd,gdn,ge,gea,gent,genting,george,gf,gg,ggee,gh,gi,gift,gifts,gives,giving,gl,glade,glass,gle,global,globo,gm,gmail,gmbh,gmo,gmx,gn,godaddy,gold,goldpoint,golf,goo,goodyear,goog,google,gop,got,gov,gp,gq,gr,grainger,graphics,gratis,green,gripe,grocery,group,gs,gt,gu,guardian,gucci,guge,guide,guitars,guru,gw,gy,hair,hamburg,hangout,haus,hbo,hdfc,hdfcbank,health,healthcare,help,helsinki,here,hermes,hgtv,hiphop,hisamitsu,hitachi,hiv,hk,hkt,hm,hn,hockey,holdings,holiday,homedepot,homegoods,homes,homesense,honda,horse,hospital,host,hosting,hot,hoteles,hotels,hotmail,house,how,hr,hsbc,ht,hu,hughes,hyatt,hyundai,ibm,icbc,ice,icu,id,ie,ieee,ifm,ikano,il,im,imamat,imdb,immo,immobilien,in,inc,industries,infiniti,info,ing,ink,institute,insurance,insure,int,international,intuit,investments,io,ipiranga,iq,ir,irish,is,ismaili,ist,istanbul,it,itau,itv,jaguar,java,jcb,je,jeep,jetzt,jewelry,jio,jll,jm,jmp,jnj,jo,jobs,joburg,jot,joy,jp,jpmorgan,jprs,juegos,juniper,kaufen,kddi,ke,kerryhotels,kerrylogistics,kerryproperties,kfh,kg,kh,ki,kia,kim,kinder,kindle,kitchen,kiwi,km,kn,koeln,komatsu,kosher,kp,kpmg,kpn,kr,krd,kred,kuokgroup,kw,ky,kyoto,kz,la,lacaixa,lamborghini,lamer,lancaster,lancia,land,landrover,lanxess,lasalle,lat,latino,latrobe,law,lawyer,lb,lc,lds,lease,leclerc,lefrak,legal,lego,lexus,lgbt,li,lidl,life,lifeinsurance,lifestyle,lighting,like,lilly,limited,limo,lincoln,linde,link,lipsy,live,living,lixil,lk,llc,llp,loan,loans,locker,locus,loft,lol,london,lotte,lotto,love,lpl,lplfinancial,lr,ls,lt,ltd,ltda,lu,lundbeck,luxe,luxury,lv,ly,ma,macys,madrid,maif,maison,makeup,man,management,mango,map,market,marketing,markets,marriott,marshalls,maserati,mattel,mba,mc,mckinsey,md,me,med,media,meet,melbourne,meme,memorial,men,menu,merckmsd,mg,mh,miami,microsoft,mil,mini,mint,mit,mitsubishi,mk,ml,mlb,mls,mm,mma,mn,mo,mobi,mobile,moda,moe,moi,mom,monash,money,monster,mormon,mortgage,moscow,moto,motorcycles,mov,movie,mp,mq,mr,ms,msd,mt,mtn,mtr,mu,museum,music,mutual,mv,mw,mx,my,mz,na,nab,nagoya,name,natura,navy,nba,nc,ne,nec,net,netbank,netflix,network,neustar,new,news,next,nextdirect,nexus,nf,nfl,ng,ngo,nhk,ni,nico,nike,nikon,ninja,nissan,nissay,nl,no,nokia,northwesternmutual,norton,now,nowruz,nowtv,np,nr,nra,nrw,ntt,nu,nyc,nz,obi,observer,off,office,okinawa,olayan,olayangroup,oldnavy,ollo,om,omega,one,ong,onl,online,ooo,open,oracle,orange,org,organic,origins,osaka,otsuka,ott,ovh,pa,page,panasonic,paris,pars,partners,parts,party,passagens,pay,pccw,pe,pet,pf,pfizer,pg,ph,pharmacy,phd,philips,phone,photo,photography,photos,physio,pics,pictet,pictures,pid,pin,ping,pink,pioneer,pizza,pk,pl,place,play,playstation,plumbing,plus,pm,pn,pnc,pohl,poker,politie,porn,post,pr,pramerica,praxi,press,prime,pro,prod,productions,prof,progressive,promo,properties,property,protection,pru,prudential,ps,pt,pub,pw,pwc,py,qa,qpon,quebec,quest,racing,radio,raid,re,read,realestate,realtor,realty,recipes,red,redstone,redumbrella,rehab,reise,reisen,reit,reliance,ren,rent,rentals,repair,report,republican,rest,restaurant,review,reviews,rexroth,rich,richardli,ricoh,ril,rio,rip,ro,rocher,rocks,rodeo,rogers,room,rs,rsvp,ru,rugby,ruhr,run,rw,rwe,ryukyu,sa,saarland,safe,safety,sakura,sale,salon,samsclub,samsung,sandvik,sandvikcoromant,sanofi,sap,sarl,sas,save,saxo,sb,sbi,sbs,sc,sca,scb,schaeffler,schmidt,scholarships,school,schule,schwarz,science,scjohnson,scot,sd,se,search,seat,secure,security,seek,select,sener,services,ses,seven,sew,sex,sexy,sfr,sg,sh,shangrila,sharp,shaw,shell,shia,shiksha,shoes,shop,shopping,shouji,show,showtime,si,silk,sina,singles,site,sj,sk,ski,skin,sky,skype,sl,sling,sm,smart,smile,sn,sncf,so,soccer,social,softbank,software,sohu,solar,solutions,song,sony,soy,spa,space,sport,spot,sr,srl,ss,st,stada,staples,star,statebank,statefarm,stc,stcgroup,stockholm,storage,store,stream,studio,study,style,su,sucks,supplies,supply,support,surf,surgery,suzuki,sv,swatch,swiss,sx,sy,sydney,systems,sz,tab,taipei,talk,taobao,target,tatamotors,tatar,tattoo,tax,taxi,tc,tci,td,tdk,team,tech,technology,tel,temasek,tennis,teva,tf,tg,th,thd,theater,theatre,tiaa,tickets,tienda,tiffany,tips,tires,tirol,tj,tjmaxx,tjx,tk,tkmaxx,tl,tm,tmall,tn,to,today,tokyo,tools,top,toray,toshiba,total,tours,town,toyota,toys,tr,trade,trading,training,travel,travelchannel,travelers,travelersinsurance,trust,trv,tt,tube,tui,tunes,tushu,tv,tvs,tw,tz,ua,ubank,ubs,ug,uk,unicom,university,uno,uol,ups,us,uy,uz,va,vacations,vana,vanguard,vc,ve,vegas,ventures,verisign,versicherung,vet,vg,vi,viajes,video,vig,viking,villas,vin,vip,virgin,visa,vision,viva,vivo,vlaanderen,vn,vodka,volkswagen,volvo,vote,voting,voto,voyage,vu,vuelos,wales,walmart,walter,wang,wanggou,watch,watches,weather,weatherchannel,webcam,weber,website,wed,wedding,weibo,weir,wf,whoswho,wien,wiki,williamhill,win,windows,wine,winners,wme,wolterskluwer,woodside,work,works,world,wow,ws,wtc,wtf,xbox,xerox,xfinity,xihuan,xin,कॉम,セール,佛山,ಭಾರತ,慈善,集团,在线,한국,ଭାରତ,点看,คอม,ভাৰত,ভারত,八卦,ישראל,موقع,বাংলা,公益,公司,香格里拉,网站,移动,我爱你,москва,қаз,католик,онлайн,сайт,联通,срб,бг,бел,קום,时尚,微博,淡马锡,ファッション,орг,नेट,ストア,アマゾン,삼성,சிங்கப்பூர்,商标,商店,商城,дети,мкд,ею,ポイント,新闻,家電,كوم,中文网,中信,中国,中國,娱乐,谷歌,భారత్,ලංකා,電訊盈科,购物,クラウド,ભારત,通販,भारतम्,भारत,भारोत,网店,संगठन,餐厅,网络,ком,укр,香港,亚马逊,诺基亚,食品,飞利浦,台湾,台灣,手机,мон,الجزائر,عمان,ارامكو,ایران,العليان,اتصالات,امارات,بازار,موريتانيا,پاکستان,الاردن,بارت,بھارت,المغرب,ابوظبي,البحرين,السعودية,ڀارت,كاثوليك,سودان,همراه,عراق,مليسيا,澳門,닷컴,政府,شبكة,بيتك,عرب,გე,机构,组织机构,健康,ไทย,سورية,招聘,рус,рф,تونس,大拿,ລາວ,みんな,グーグル,ευ,ελ,世界,書籍,ഭാരതം,ਭਾਰਤ,网址,닷넷,コム,天主教,游戏,vermögensberater,vermögensberatung,企业,信息,嘉里大酒店,嘉里,مصر,قطر,广东,இலங்கை,இந்தியா,հայ,新加坡,فلسطين,政务,xxx,xyz,yachts,yahoo,yamaxun,yandex,ye,yodobashi,yoga,yokohama,you,youtube,yt,yun,za,zappos,zara,zero,zip,zm,zone,zuerich,zw".split(/,/)
26
+
27
27
  # initialize a new PassiveTotal::API object
28
28
  # username: the email address associated with your PassiveTotal API key.
29
29
  # apikey: is 64-hexcharacter string
@@ -36,44 +36,44 @@ module PassiveTotal # :nodoc:
36
36
  @apikey = apikey
37
37
  @endpoint = endpoint
38
38
  end
39
-
39
+
40
40
  # Account : Get account details your account.
41
41
  def account
42
42
  get('account')
43
43
  end
44
-
44
+
45
45
  # Account History : Get history associated with your account.
46
46
  def account_history
47
47
  get('account/history')
48
48
  end
49
-
49
+
50
50
  # history is an alias for account_history
51
51
  alias_method :history, :account_history
52
-
52
+
53
53
  # Account organization : Get details about the organization your account is associated with.
54
54
  def account_organization
55
55
  get('account/organization')
56
56
  end
57
-
57
+
58
58
  # organization is an alias for account_organization
59
59
  alias_method :organization, :account_organization
60
-
60
+
61
61
  # Account organization teamstream : Get the teamstream for the organization your account is associated with.
62
62
  def account_organization_teamstream
63
63
  get('account/organization/teamstream')
64
64
  end
65
-
65
+
66
66
  # teamstream is an alias for account_organization_teamstream
67
67
  alias_method :teamstream, :account_organization_teamstream
68
-
68
+
69
69
  # Account sources : Get source details for a specific source.
70
70
  def account_sources(source)
71
71
  get('account/sources', {'source' => source})
72
72
  end
73
-
73
+
74
74
  # sources is an alias for account_sources
75
75
  alias_method :sources, :account_sources
76
-
76
+
77
77
 
78
78
  # Passive provides a complete passive DNS picture for a domain or IP address including first/last seen values, deconflicted values, sources used, unique counts and enrichment for all values.
79
79
  # query: A domain or IP address to query
@@ -94,10 +94,10 @@ module PassiveTotal # :nodoc:
94
94
  end
95
95
  get('dns/passive/unique', {'query' => query})
96
96
  end
97
-
97
+
98
98
  # unique is an alias for passive_unique
99
99
  alias_method :unique, :passive_unique
100
-
100
+
101
101
  # Enrichment : Enrich the given query with metadata
102
102
  # query: A domain or IP address to query
103
103
  def enrichment(query)
@@ -107,10 +107,10 @@ module PassiveTotal # :nodoc:
107
107
  end
108
108
  get('enrichment', {'query' => query})
109
109
  end
110
-
110
+
111
111
  # metadata is an alias for enrichment
112
112
  alias_method :metadata, :enrichment
113
-
113
+
114
114
  # Enrichment bulk : Enrich each of the given queries with metadata
115
115
  # query: An array of domains or IP addresses to query
116
116
  def bulk_enrichment(query)
@@ -136,7 +136,7 @@ module PassiveTotal # :nodoc:
136
136
  end
137
137
  get('enrichment/osint', {'query' => query})
138
138
  end
139
-
139
+
140
140
  # osint bulk : Enrich each of the given queries with metadata
141
141
  # query: An array of domains or IP addresses to query
142
142
  def bulk_osint(query)
@@ -158,7 +158,7 @@ module PassiveTotal # :nodoc:
158
158
  def subdomains(query)
159
159
  get('enrichment/subdomains', {'query' => query})
160
160
  end
161
-
161
+
162
162
  # whois: Get WHOIS data for a domain or IP address
163
163
  # query: ipv4, domain, or, if you specify a field, any value for that field
164
164
  # field: field name to query if not the default ip/domain field
@@ -175,7 +175,17 @@ module PassiveTotal # :nodoc:
175
175
  get('whois', {'query' => query, 'compact_record' => 'false'})
176
176
  end
177
177
  end
178
-
178
+
179
+ # whois: Get reputation data for a domain or IP address
180
+ # query: A domain or IP address to query
181
+ def reputation(query)
182
+ is_valid_with_error(__method__, [:ipv4, :domain], query)
183
+ if domain?(query)
184
+ query = normalize_domain(query)
185
+ end
186
+ get('reputation', {'query' => query})
187
+ end
188
+
179
189
  # Add a user-tag to an IP or domain
180
190
  # query: A domain or IP address to tag
181
191
  # tag: Value used to tag query value. Should only consist of alphanumeric, underscores and hyphen values
@@ -184,7 +194,7 @@ module PassiveTotal # :nodoc:
184
194
  is_valid_with_error(__method__, [:tag], tag)
185
195
  post('actions/tags', { 'query' => query, 'tags' => [tag] })
186
196
  end
187
-
197
+
188
198
  # Remove a user-tag to an IP or domain
189
199
  # query: A domain or IP address to remove a tag from
190
200
  # tag: Value used to tag query value. Should only consist of alphanumeric, underscores and hyphen values
@@ -193,7 +203,7 @@ module PassiveTotal # :nodoc:
193
203
  is_valid_with_error(__method__, [:tag], tag)
194
204
  delete('actions/tags', { 'query' => query, 'tags' => [tag] })
195
205
  end
196
-
206
+
197
207
  # PassiveTotal uses the notion of classifications to highlight table rows a certain color based on how they have been rated.
198
208
  # PassiveTotal::API#classification() queries if only one argument is given, and sets if both are given
199
209
  # query: A domain or IP address to query
@@ -209,7 +219,7 @@ module PassiveTotal # :nodoc:
209
219
  post('actions/classification', { 'query' => query, 'classification' => set })
210
220
  end
211
221
  end
212
-
222
+
213
223
  # Get the classification for a query in bulk
214
224
  # query: An array of domains or IP address to query
215
225
  def bulk_classification(query)
@@ -225,7 +235,7 @@ module PassiveTotal # :nodoc:
225
235
  end
226
236
  get_with_data('actions/bulk/classification', { 'query' => query })
227
237
  end
228
-
238
+
229
239
  # PassiveTotal allows users to notate if a domain or IP address have ever been compromised. These values aid in letting users know that a site may be benign, but it was used in an attack at some point in time.
230
240
  # PassiveTotal::API#ever_compromised() queries if only one argument is given, and sets if both are given
231
241
  # query: A domain or IP address to query
@@ -242,9 +252,9 @@ module PassiveTotal # :nodoc:
242
252
  post('actions/ever-compromised', { 'query' => query, 'status' => set })
243
253
  end
244
254
  end
245
-
255
+
246
256
  alias_method :compromised, :ever_compromised
247
-
257
+
248
258
  # PassiveTotal allows users to notate if a domain is associated with a dynamic DNS provider.
249
259
  # PassiveTotal::API#dynamic() queries if only one argument is given, and sets if both are given
250
260
  # query: A domain to query
@@ -259,7 +269,7 @@ module PassiveTotal # :nodoc:
259
269
  post('actions/dynamic-dns', { 'query' => query, 'status' => set })
260
270
  end
261
271
  end
262
-
272
+
263
273
  # PassiveTotal allows users to notate if an ip or domain is "monitored".
264
274
  # PassiveTotal::API#monitor() queries if only one argument is given, and sets if both are given
265
275
  # query: A domain to query
@@ -276,7 +286,7 @@ module PassiveTotal # :nodoc:
276
286
  post('actions/monitor', { 'query' => query, 'status' => set })
277
287
  end
278
288
  end
279
-
289
+
280
290
  # monitoring is an alias for monitor
281
291
  alias_method :monitoring, :monitor
282
292
  alias_method :watching, :monitor
@@ -294,7 +304,7 @@ module PassiveTotal # :nodoc:
294
304
  post('actions/sinkhole', { 'query' => query, 'status' => set })
295
305
  end
296
306
  end
297
-
307
+
298
308
 
299
309
  # PassiveTotal uses three types of tags (user, global, and temporal) in order to provide context back to the user.
300
310
  # query: A domain or IP address to query
@@ -311,7 +321,7 @@ module PassiveTotal # :nodoc:
311
321
  post('actions/tag', { 'query' => query, 'tags' => [set] })
312
322
  end
313
323
  end
314
-
324
+
315
325
  # Search Tags : Search for items based on tag value
316
326
  # PassiveTotal uses three types of tags (user, global, and temporal) in order to provide context back to the user.
317
327
  # query: A domain or IP address to query
@@ -343,7 +353,7 @@ module PassiveTotal # :nodoc:
343
353
  get_params('ssl-certificate/search', { 'query' => query, 'field' => field })
344
354
  end
345
355
  end
346
-
356
+
347
357
  # PassiveTotal tracks some interesting metadata about a host
348
358
  # query: a hostname or ip address
349
359
  def components(query)
@@ -353,7 +363,7 @@ module PassiveTotal # :nodoc:
353
363
  end
354
364
  get('host-attributes/components', {'query' => query})
355
365
  end
356
-
366
+
357
367
  # trackers: Get all tracking codes for a domain or IP address.
358
368
  # query: ip or domain, or, if type is supplied, a valid tracker ID
359
369
  # type: A valid tracker type to search:
@@ -370,7 +380,7 @@ module PassiveTotal # :nodoc:
370
380
  get('trackers/search', {'query' => query, 'type' => type})
371
381
  end
372
382
  end
373
-
383
+
374
384
  # malware: get sample information based from domain
375
385
  # query: ip or domain
376
386
  def malware(query)
@@ -380,7 +390,7 @@ module PassiveTotal # :nodoc:
380
390
  end
381
391
  get('enrichment/malware', {'query' => query})
382
392
  end
383
-
393
+
384
394
  # malware bulk: get sample information based from domains
385
395
  # query: An array of domains or IP addresses to query
386
396
  def bulk_malware(query)
@@ -396,10 +406,10 @@ module PassiveTotal # :nodoc:
396
406
  end
397
407
  get_with_data('enrichment/bulk/malware', { 'query' => query })
398
408
  end
399
-
400
-
409
+
410
+
401
411
  private
402
-
412
+
403
413
  # returns true if the given string is a dotted quad IPv4 address
404
414
  def ipv4?(ip)
405
415
  if ip =~ /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/
@@ -407,14 +417,14 @@ module PassiveTotal # :nodoc:
407
417
  end
408
418
  false
409
419
  end
410
-
420
+
411
421
  # returns true if the given string looks like a domain and ends with a known top-level domain (TLD)
412
422
  def domain?(domain)
413
423
  return false if domain.nil?
414
424
  domain = normalize_domain(domain)
415
425
  domain =~ /^[a-zA-Z0-9\-\.]{3,255}$/ and TLDS.index(domain.split(/\./).last)
416
426
  end
417
-
427
+
418
428
  # returns true if the given string looks like a SHA-1 hash, i.e., 40 character hex string
419
429
  def hash?(hash)
420
430
  return false if hash.nil?
@@ -423,17 +433,17 @@ module PassiveTotal # :nodoc:
423
433
  end
424
434
  false
425
435
  end
426
-
436
+
427
437
  # returns true if the given string matches a valid classification
428
438
  def classification?(c)
429
439
  not ["malicious", "non-malicious", "suspicious", "unknown"].index(c).nil?
430
440
  end
431
-
441
+
432
442
  # returns true is the given object matches true or false
433
443
  def bool?(b)
434
444
  not ['true', 'false'].index(b.to_s).nil?
435
445
  end
436
-
446
+
437
447
  # returns true if the given string looks like a valid tag
438
448
  def tag?(t)
439
449
  return false if t.nil?
@@ -442,27 +452,27 @@ module PassiveTotal # :nodoc:
442
452
  end
443
453
  false
444
454
  end
445
-
455
+
446
456
  def ssl_field?(f)
447
457
  return false if f.nil?
448
- not ["issuerSurname", "subjectOrganizationName", "issuerCountry", "issuerOrganizationUnitName",
449
- "fingerprint", "subjectOrganizationUnitName", "serialNumber", "subjectEmailAddress", "subjectCountry",
450
- "issuerGivenName", "subjectCommonName", "issuerCommonName", "issuerStateOrProvinceName", "issuerProvince",
451
- "subjectStateOrProvinceName", "sha1", "sslVersion", "subjectStreetAddress", "subjectSerialNumber",
452
- "issuerOrganizationName", "subjectSurname", "subjectLocalityName", "issuerStreetAddress",
458
+ not ["issuerSurname", "subjectOrganizationName", "issuerCountry", "issuerOrganizationUnitName",
459
+ "fingerprint", "subjectOrganizationUnitName", "serialNumber", "subjectEmailAddress", "subjectCountry",
460
+ "issuerGivenName", "subjectCommonName", "issuerCommonName", "issuerStateOrProvinceName", "issuerProvince",
461
+ "subjectStateOrProvinceName", "sha1", "sslVersion", "subjectStreetAddress", "subjectSerialNumber",
462
+ "issuerOrganizationName", "subjectSurname", "subjectLocalityName", "issuerStreetAddress",
453
463
  "issuerLocalityName", "subjectGivenName", "subjectProvince", "issuerSerialNumber", "issuerEmailAddress"].index(f).nil?
454
464
  end
455
-
465
+
456
466
  def whois_field?(f)
457
467
  return false if f.nil?
458
468
  not ["domain", "email", "name", "organization", "address", "phone", "nameserver"].index(f).nil?
459
469
  end
460
-
470
+
461
471
  def tracker_type?(t)
462
472
  return false if t.nil?
463
473
  not ["YandexMetricaCounterId", "ClickyId", "GoogleAnalyticsAccountNumber", "NewRelicId", "MixpanelId", "GoogleAnalyticsTrackingId"].index(t).nil?
464
474
  end
465
-
475
+
466
476
  # lowercases and removes a trailing period (if one exists) from a domain name
467
477
  def normalize_domain(domain)
468
478
  return domain.downcase.gsub(/\.$/,'')
@@ -472,26 +482,26 @@ module PassiveTotal # :nodoc:
472
482
  def get(api, params={})
473
483
  url2json(:GET, "#{@endpoint}#{api}", params)
474
484
  end
475
-
485
+
476
486
  # helper function to perform an HTTP GET against the web API
477
487
  def get_params(api, params)
478
488
  url2json(:GET, "#{@endpoint}#{api}", params)
479
489
  end
480
-
490
+
481
491
  def get_with_data(api, params={})
482
492
  url2json(:GET_DATA, "#{@endpoint}#{api}", params)
483
493
  end
484
-
494
+
485
495
  # helper function to perform an HTTP POST against the web API
486
496
  def post(api, params)
487
497
  url2json(:POST, "#{@endpoint}#{api}", params)
488
498
  end
489
-
499
+
490
500
  # helper function to perform an HTTP DELETE against the web API
491
501
  def delete(api, params)
492
502
  url2json(:DELETE, "#{@endpoint}#{api}", params)
493
503
  end
494
-
504
+
495
505
  # main helper function to perform HTTP interactions with the web API.
496
506
  def url2json(method, url, params)
497
507
  if method == :GET
@@ -533,13 +543,13 @@ module PassiveTotal # :nodoc:
533
543
  response = http.request(request)
534
544
  delta = (Time.now - t1).to_f
535
545
  data = JSON.parse(response.body)
536
-
546
+
537
547
  obj = Transaction.new(
538
548
  Query.new(method, params['query'], params[method] || params['tag'], url, params),
539
549
  Response.new(response.body, response.code == '200', data),
540
550
  delta
541
551
  )
542
-
552
+
543
553
  if data['error']
544
554
  message = data['error']['message']
545
555
  case message
@@ -554,7 +564,7 @@ module PassiveTotal # :nodoc:
554
564
 
555
565
  return obj
556
566
  end
557
-
567
+
558
568
  # tests an item to see if it matches a valid type
559
569
  def is_valid?(types, item)
560
570
  types.each do |type|
@@ -580,7 +590,7 @@ module PassiveTotal # :nodoc:
580
590
  end
581
591
  return false
582
592
  end
583
-
593
+
584
594
  # tests an item to see if it matches a valid type and raises an ArgumentError if invalid
585
595
  def is_valid_with_error(methname, types, item)
586
596
  valid = is_valid?(types, item)
@@ -591,4 +601,4 @@ module PassiveTotal # :nodoc:
591
601
  end
592
602
 
593
603
  end
594
- end
604
+ end
@@ -1,3 +1,3 @@
1
1
  module PassiveTotal
2
- VERSION = "1.0.5"
2
+ VERSION = "1.0.6"
3
3
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: passivetotal
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.0.5
4
+ version: 1.0.6
5
5
  platform: ruby
6
6
  authors:
7
7
  - chrislee35
8
- autorequire:
8
+ autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2018-02-09 00:00:00.000000000 Z
11
+ date: 2021-12-01 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: json
@@ -30,42 +30,42 @@ dependencies:
30
30
  requirements:
31
31
  - - "~>"
32
32
  - !ruby/object:Gem::Version
33
- version: '1.10'
33
+ version: 2.2.10
34
34
  type: :development
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - "~>"
39
39
  - !ruby/object:Gem::Version
40
- version: '1.10'
40
+ version: 2.2.10
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: rake
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
45
  - - "~>"
46
46
  - !ruby/object:Gem::Version
47
- version: '12.0'
47
+ version: '13.0'
48
48
  type: :development
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - "~>"
53
53
  - !ruby/object:Gem::Version
54
- version: '12.0'
54
+ version: '13.0'
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: minitest
57
57
  requirement: !ruby/object:Gem::Requirement
58
58
  requirements:
59
- - - ">="
59
+ - - "~>"
60
60
  - !ruby/object:Gem::Version
61
- version: '0'
61
+ version: '5.14'
62
62
  type: :development
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
- - - ">="
66
+ - - "~>"
67
67
  - !ruby/object:Gem::Version
68
- version: '0'
68
+ version: '5.14'
69
69
  description: PassiveTotal offers an extensive API for users of the platform that maps
70
70
  most major actions available in the web application to a corresponding call. There
71
71
  are two flavors of the API available for use, stable and current. In order to use
@@ -79,25 +79,18 @@ executables:
79
79
  extensions: []
80
80
  extra_rdoc_files: []
81
81
  files:
82
- - ".gitignore"
83
- - ".travis.yml"
84
- - Gemfile
85
- - LICENSE.txt
86
- - README.md
87
- - Rakefile
88
82
  - bin/passivetotal
89
83
  - lib/passivetotal.rb
90
84
  - lib/passivetotal/api.rb
91
85
  - lib/passivetotal/cli.rb
92
86
  - lib/passivetotal/version.rb
93
- - passivetotal.gemspec
94
87
  - utils/console
95
88
  - utils/setup
96
89
  homepage: https://github.com/chrislee35/passivetotal
97
90
  licenses:
98
91
  - MIT
99
92
  metadata: {}
100
- post_install_message:
93
+ post_install_message:
101
94
  rdoc_options: []
102
95
  require_paths:
103
96
  - lib
@@ -112,9 +105,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
112
105
  - !ruby/object:Gem::Version
113
106
  version: '0'
114
107
  requirements: []
115
- rubyforge_project:
116
- rubygems_version: 2.6.14
117
- signing_key:
108
+ rubygems_version: 3.1.2
109
+ signing_key:
118
110
  specification_version: 4
119
- summary: Wrapper library for PassiveTotal.org's W eb API
111
+ summary: Wrapper library for PassiveTotal.org's Web API
120
112
  test_files: []
data/.gitignore DELETED
@@ -1,11 +0,0 @@
1
- /.bundle/
2
- /.yardoc
3
- /Gemfile.lock
4
- /_yardoc/
5
- /coverage/
6
- /doc/
7
- /pkg/
8
- /spec/reports/
9
- /tmp/
10
- .DS_Store
11
- rdoc
data/.travis.yml DELETED
@@ -1,4 +0,0 @@
1
- language: ruby
2
- rvm:
3
- - 2.2.1
4
- before_install: gem install bundler -v 1.10.5
data/Gemfile DELETED
@@ -1,4 +0,0 @@
1
- source 'https://rubygems.org'
2
-
3
- # Specify your gem's dependencies in passivetotal.gemspec
4
- gemspec
data/LICENSE.txt DELETED
@@ -1,21 +0,0 @@
1
- The MIT License (MIT)
2
-
3
- Copyright (c) 2015 chrislee35
4
-
5
- Permission is hereby granted, free of charge, to any person obtaining a copy
6
- of this software and associated documentation files (the "Software"), to deal
7
- in the Software without restriction, including without limitation the rights
8
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
- copies of the Software, and to permit persons to whom the Software is
10
- furnished to do so, subject to the following conditions:
11
-
12
- The above copyright notice and this permission notice shall be included in
13
- all copies or substantial portions of the Software.
14
-
15
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
21
- THE SOFTWARE.
data/README.md DELETED
@@ -1,163 +0,0 @@
1
- # PassiveTotal
2
-
3
- The PassiveTotal gem is (currently) a thin wrapper around PassiveTotal.org's Web-based API.
4
-
5
- ## Installation
6
-
7
- Add this line to your application's Gemfile:
8
-
9
- ```ruby
10
- gem 'passivetotal'
11
- ```
12
-
13
- And then execute:
14
-
15
- $ bundle
16
-
17
- Or install it yourself as:
18
-
19
- $ gem install passivetotal
20
-
21
- ## Command Line Tool
22
-
23
- Included in the gem is a command-line tool, passivetotal, with the following usage:
24
-
25
- Usage: bin/passivetotal [-v] [-u <username>] [-k <apikey>] <action flag> <query> [-i <value>]
26
- -h Help
27
- -v Verbose output
28
- -u <username> Sets the Username, defaults to the environment variable PASSIVETOTAL_USERNAME
29
- -k <apikey> Sets the APIKEY, defaults to the environment variable PASSIVETOTAL_APIKEY
30
- ACTIONS (You have to select one, last one wins) -m <ip or dom> Queries metadata for given IP or domain
31
- -p <ip or dom> Queries passive DNS data for given IP or domain
32
- -c <ip or dom> Queries (or sets) the classification for a given IP or domain
33
- -t <ip or dom> Queries (adds or removes) the tags associated with a given IP or domain
34
- * To remove a tag, prepend a dash, '-' to the tag name when using the -i option
35
- -e <ip or dom> Queries (or sets) the ever compromised flag on a given IP or domain
36
- -w <ip or dom> Queries (or sets) the watched flag on a given IP or domain
37
- -s <dom> Queries the subdomains for a given domain
38
- -d <dom> Queries (or sets) if a domain is a dynamic DNS domain
39
- -x <ip> Queries (or sets) if a given IP is a sinkhole
40
- -l <hash> Queries for SSL certificates/IP addresses associated with a given SHA-1 hash
41
- -H <ip or hash> Queries for SSL certificate history associated with a given IP or SHA-1 hash
42
- -T <ip or dom> Queries for Tracker information associated with a given IP or domain
43
- -o <ip or dom> Queries for OSINT on a given IP or domain
44
- -M <ip or dom> Queries for Malware sample records for a given IP or domain
45
- SETTING VALUES -i <value> Sets the value, used in conjuntion with -c, -t, -e, -w, -d, or -x
46
- Valid values for -i depend on what it's used with:
47
- -c : malicious, non-malicious, suspicious, unknown
48
- -t : <a tag name consisting of characters: [a-zA-Z_]>
49
- -e, -w, -d, -x: true, false
50
-
51
- ## Usage
52
-
53
- # Initialize the API wrapper with an apikey (using the default endpoint URL of https://api.passivetotal.org/v2/)
54
- pt = PassiveTotal::API.new(user, apikey)
55
- # Create an array to shove results into
56
- res = Array.new
57
-
58
- # ACCOUNT API
59
- # Get account details your account.
60
- res << @pt.account
61
- # Get history associated with your account.
62
- res << @pt.history
63
- # Get notifications that have been posted to your account.
64
- res << @pt.notifications
65
- # Get details about the organization your account is associated with.
66
- res << @pt.organization
67
- # Get the teamstream for the organization your account is associated with.
68
- res << @pt.teamstream
69
- # Get source details for a specific source.
70
- res << @pt.sources('riskiq')
71
-
72
- # DNS API
73
- # query passive DNS results for the domain, www.passivetotal.org
74
- res << @pt.passive('www.passivetotal.org')
75
- # query passive DNS results for the ipv4 address, 107.170.89.121
76
- res << @pt.passive('107.170.89.121')
77
- # query for unique IPv4 resolutions of passivetotal.org
78
- res << @pt.unique('passivetotal.org')
79
-
80
- # ENRICHMENT API
81
- # query enrichment for the domain, www.passivetotal.org
82
- res << @pt.enrichment('www.passivetotal.org')
83
- # query enrichment for the ipv4 address, 107.170.89.121
84
- res << @pt.enrichment('107.170.89.121')
85
- # Get malware data
86
- res << @pt.malware('noorno.com')
87
- # query for malware sample records by the ip addres 98.124.243.47
88
- res << @pt.malware("98.124.243.47")
89
- # Get opensource intelligence data
90
- res << @pt.osint("xxxmobiletubez.com")
91
- # query for subdomains of passivetotal.org
92
- res << @pt.subdomains('*.passivetotal.org')
93
-
94
- # WHOIS API
95
- # Get WHOIS data for a domain or IP address
96
- res << @pt.whois("passivetotal.org")
97
- # Get WHOIS records based on field matching queries.
98
- res << @pt.whois("proxy4655031@1and1-private-registration.com", "email")
99
-
100
- # ACTIONS API
101
- # query for the tags associated with www.chrisleephd.us
102
- res << @pt.tags('www.chrisleephd.us')
103
- # add the "cool" tag to www.chrisleephd.us
104
- res << @pt.add_tag('www.chrisleephd.us', 'cool')
105
- # remove the "cool" tag from www.chrisleephd.us (aww, I was cool for a few milliseconds :( )
106
- res << @pt.remove_tag('www.chrisleephd.us', 'cool')
107
- # query for the classification of www.passivetotal.org
108
- res << @pt.classification('www.passivetotal.org')
109
- # set the classification of www.passivetotal.org as benign
110
- res << @pt.classification('www.passivetotal.org', 'non-malicious')
111
- # query if www.passivetotal.org has ever been listed as compromised
112
- res << @pt.ever_compromised('www.passivetotal.org')
113
- # set the ever_compromised flag for www.passivetotal.org to false to indicate that it was never compromised or that it is in sole control of a malicious actor.
114
- res << @pt.ever_compromised('www.passivetotal.org', false)
115
- # check if www.passivetotal.org is a dynamic dns domain/host
116
- res << @pt.dynamic('www.passivetotal.org')
117
- # flag www.passivetotal.org as not a dynamic dns domain/host
118
- res << @pt.dynamic('www.passivetotal.org', false)
119
- # check if www.passivetotal.org is being watched
120
- res << @pt.monitor('www.passivetotal.org')
121
- # unwatch www.passivetotal.org
122
- res << @pt.monitor('www.passivetotal.org', false)
123
- # query if 107.170.89.121 is a sinkhole
124
- res << @pt.sinkhole('107.170.89.121')
125
- # set 107.170.89.121 as not a sinkhole
126
- res << @pt.sinkhole('107.170.89.121', false)
127
-
128
- # HOST API
129
- # Get detailed information about a host
130
- res << @pt.components('passivetotal.org')
131
- # Get all tracking codes for a domain or IP address.
132
- res << @pt.trackers('passivetotal.org')
133
- # Get hosts matching a specific tracker ID
134
- res << @pt.trackers('UA-49901229', 'GoogleAnalyticsAccountNumber')
135
-
136
- # SSL API
137
- # list sites associated with SSL certificates with SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
138
- res << @pt.ssl_certificate('e9a6647d6aba52dc47b3838c920c9ee59bad7034')
139
- # list sites associated with SSL certificates with SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
140
- res << @pt.ssl_certificate('2317683628587350290823564500811277499', 'serialNumber')
141
- # retrieve certificate history based on SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
142
- res << @pt.ssl_certificate_history('e9a6647d6aba52dc47b3838c920c9ee59bad7034')
143
- # retrieve certificate history from IPv4 address of 52.8.228.23
144
- res << @pt.ssl_certificate_history('52.8.228.23')
145
-
146
- # dump all this glorious information to feast your eyes upon
147
- pp res
148
-
149
- ## Development
150
-
151
- After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
152
-
153
- To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
154
-
155
- ## Contributing
156
-
157
- Bug reports and pull requests are welcome on GitHub at https://github.com/chrislee35/passivetotal.
158
-
159
-
160
- ## License
161
-
162
- The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
163
-
data/Rakefile DELETED
@@ -1,10 +0,0 @@
1
- require "bundler/gem_tasks"
2
- require "rake/testtask"
3
-
4
- Rake::TestTask.new(:test) do |t|
5
- t.libs << "test"
6
- t.libs << "lib"
7
- t.test_files = FileList['test/**/*_test.rb']
8
- end
9
-
10
- task :default => :test
data/passivetotal.gemspec DELETED
@@ -1,26 +0,0 @@
1
- # coding: utf-8
2
- lib = File.expand_path('../lib', __FILE__)
3
- $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
4
- require 'passivetotal/version'
5
-
6
- Gem::Specification.new do |spec|
7
- spec.name = "passivetotal"
8
- spec.version = PassiveTotal::VERSION
9
- spec.authors = ["chrislee35"]
10
- spec.email = ["rubygems@chrislee.dhs.org"]
11
-
12
- spec.summary = %q{Wrapper library for PassiveTotal.org's W eb API}
13
- spec.description = %q{PassiveTotal offers an extensive API for users of the platform that maps most major actions available in the web application to a corresponding call. There are two flavors of the API available for use, stable and current. In order to use the stable API, add the version indicator (vX) into the URL as documented below. If you would rather use the current API which includes new changes and experiments, replace the version indicator with "current".}
14
- spec.homepage = "https://github.com/chrislee35/passivetotal"
15
- spec.license = "MIT"
16
-
17
- spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
18
- spec.bindir = "bin"
19
- spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
20
- spec.require_paths = ["lib"]
21
-
22
- spec.add_runtime_dependency "json", "~> 2.0"
23
- spec.add_development_dependency "bundler", "~> 1.10"
24
- spec.add_development_dependency "rake", "~> 12.0"
25
- spec.add_development_dependency "minitest"
26
- end