passivetotal 1.0.5 → 1.0.6
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/lib/passivetotal/api.rb +73 -63
- data/lib/passivetotal/version.rb +1 -1
- metadata +15 -23
- data/.gitignore +0 -11
- data/.travis.yml +0 -4
- data/Gemfile +0 -4
- data/LICENSE.txt +0 -21
- data/README.md +0 -163
- data/Rakefile +0 -10
- data/passivetotal.gemspec +0 -26
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
|
-
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
2
|
+
SHA256:
|
3
|
+
metadata.gz: a83e6b94b558fcf2e524fd272d2a0238b325aae63689871c8c8f52ff1e211f29
|
4
|
+
data.tar.gz: 335f3ec0c83e2987619932c71470a109afab17581158cccdbb9e0dfb5541574c
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 856745401361b82a1096c387eb6d1d0db9937507ee3e390ca41effb5853c80e8d604c9f4ec9990a25e13aa72ff20a3383d0800ddac7bf8036078850751b83e8d
|
7
|
+
data.tar.gz: c0cf41003118d3cffaebc7aba2b7a78b4eb39806587bf7538c7c34f51284aea6fe98dff5f79fc33e54842c99ad1e94e6074fc763e50f25b99a9fd17ad6fe008e
|
data/lib/passivetotal/api.rb
CHANGED
@@ -7,23 +7,23 @@ require 'passivetotal/version'
|
|
7
7
|
# DESCRIPTION: rubygem for querying PassiveTotal.org's web API
|
8
8
|
|
9
9
|
module PassiveTotal # :nodoc:
|
10
|
-
|
10
|
+
|
11
11
|
class InvalidAPIKeyError < ArgumentError; end
|
12
12
|
class APIUsageError < StandardError; end
|
13
13
|
class ExceededQuotaError < StandardError; end
|
14
|
-
|
14
|
+
|
15
15
|
class Transaction < Struct.new(:query, :response, :response_time); end
|
16
16
|
class Query < Struct.new(:api, :query, :set, :url, :parameters); end
|
17
17
|
class Response < Struct.new(:json, :success, :results); end
|
18
|
-
|
18
|
+
|
19
19
|
# The API class wraps the PassiveTotal.org web API for all the verbs that it supports
|
20
20
|
# See https://api.passivetotal.org/api/docs/ for the API documentation.
|
21
21
|
class API
|
22
22
|
# The TLDS array helps the interface detect valid domains.
|
23
23
|
# This list was generated by parsing the NS records from a zone transfer of the root
|
24
24
|
# The same list could have been downloaded from http://data.iana.org/TLD/tlds-alpha-by-domain.txt
|
25
|
-
TLDS = "abb,abbott,abogado,ac,academy,accenture,accountant,accountants,
|
26
|
-
|
25
|
+
TLDS = "aaa,aarp,abarth,abb,abbott,abbvie,abc,able,abogado,abudhabi,ac,academy,accenture,accountant,accountants,aco,actor,ad,adac,ads,adult,ae,aeg,aero,aetna,af,afamilycompany,afl,africa,ag,agakhan,agency,ai,aig,airbus,airforce,airtel,akdn,al,alfaromeo,alibaba,alipay,allfinanz,allstate,ally,alsace,alstom,am,amazon,americanexpress,americanfamily,amex,amfam,amica,amsterdam,analytics,android,anquan,anz,ao,aol,apartments,app,apple,aq,aquarelle,ar,arab,aramco,archi,army,arpa,art,arte,as,asda,asia,associates,at,athleta,attorney,au,auction,audi,audible,audio,auspost,author,auto,autos,avianca,aw,aws,ax,axa,az,azure,ba,baby,baidu,banamex,bananarepublic,band,bank,bar,barcelona,barclaycard,barclays,barefoot,bargains,baseball,basketball,bauhaus,bayern,bb,bbc,bbt,bbva,bcg,bcn,bd,be,beats,beauty,beer,bentley,berlin,best,bestbuy,bet,bf,bg,bh,bharti,bi,bible,bid,bike,bing,bingo,bio,biz,bj,black,blackfriday,blockbuster,blog,bloomberg,blue,bm,bms,bmw,bn,bnpparibas,bo,boats,boehringer,bofa,bom,bond,boo,book,booking,bosch,bostik,boston,bot,boutique,box,br,bradesco,bridgestone,broadway,broker,brother,brussels,bs,bt,budapest,bugatti,build,builders,business,buy,buzz,bv,bw,by,bz,bzh,ca,cab,cafe,cal,call,calvinklein,cam,camera,camp,cancerresearch,canon,capetown,capital,capitalone,car,caravan,cards,care,career,careers,cars,casa,case,cash,casino,cat,catering,catholic,cba,cbn,cbre,cbs,cc,cd,center,ceo,cern,cf,cfa,cfd,cg,ch,chanel,channel,charity,chase,chat,cheap,chintai,christmas,chrome,church,ci,cipriani,circle,cisco,citadel,citi,citic,city,cityeats,ck,cl,claims,cleaning,click,clinic,clinique,clothing,cloud,club,clubmed,cm,cn,co,coach,codes,coffee,college,cologne,com,comcast,commbank,community,company,compare,computer,comsec,condos,construction,consulting,contact,contractors,cooking,cookingchannel,cool,coop,corsica,country,coupon,coupons,courses,cpa,cr,credit,creditcard,creditunion,cricket,crown,crs,cruise,cruises,csc,cu,cuisinella,cv,cw,cx,cy,cymru,cyou,cz,dabur,dad,dance,data,date,dating,datsun,day,dclk,dds,de,deal,dealer,deals,degree,delivery,dell,deloitte,delta,democrat,dental,dentist,desi,design,dev,dhl,diamonds,diet,digital,direct,directory,discount,discover,dish,diy,dj,dk,dm,dnp,do,docs,doctor,dog,domains,dot,download,drive,dtv,dubai,duck,dunlop,dupont,durban,dvag,dvr,dz,earth,eat,ec,eco,edeka,edu,education,ee,eg,email,emerck,energy,engineer,engineering,enterprises,epson,equipment,er,ericsson,erni,es,esq,estate,et,etisalat,eu,eurovision,eus,events,exchange,expert,exposed,express,extraspace,fage,fail,fairwinds,faith,family,fan,fans,farm,farmers,fashion,fast,fedex,feedback,ferrari,ferrero,fi,fiat,fidelity,fido,film,final,finance,financial,fire,firestone,firmdale,fish,fishing,fit,fitness,fj,fk,flickr,flights,flir,florist,flowers,fly,fm,fo,foo,food,foodnetwork,football,ford,forex,forsale,forum,foundation,fox,fr,free,fresenius,frl,frogans,frontdoor,frontier,ftr,fujitsu,fun,fund,furniture,futbol,fyi,ga,gal,gallery,gallo,gallup,game,games,gap,garden,gay,gb,gbiz,gd,gdn,ge,gea,gent,genting,george,gf,gg,ggee,gh,gi,gift,gifts,gives,giving,gl,glade,glass,gle,global,globo,gm,gmail,gmbh,gmo,gmx,gn,godaddy,gold,goldpoint,golf,goo,goodyear,goog,google,gop,got,gov,gp,gq,gr,grainger,graphics,gratis,green,gripe,grocery,group,gs,gt,gu,guardian,gucci,guge,guide,guitars,guru,gw,gy,hair,hamburg,hangout,haus,hbo,hdfc,hdfcbank,health,healthcare,help,helsinki,here,hermes,hgtv,hiphop,hisamitsu,hitachi,hiv,hk,hkt,hm,hn,hockey,holdings,holiday,homedepot,homegoods,homes,homesense,honda,horse,hospital,host,hosting,hot,hoteles,hotels,hotmail,house,how,hr,hsbc,ht,hu,hughes,hyatt,hyundai,ibm,icbc,ice,icu,id,ie,ieee,ifm,ikano,il,im,imamat,imdb,immo,immobilien,in,inc,industries,infiniti,info,ing,ink,institute,insurance,insure,int,international,intuit,investments,io,ipiranga,iq,ir,irish,is,ismaili,ist,istanbul,it,itau,itv,jaguar,java,jcb,je,jeep,jetzt,jewelry,jio,jll,jm,jmp,jnj,jo,jobs,joburg,jot,joy,jp,jpmorgan,jprs,juegos,juniper,kaufen,kddi,ke,kerryhotels,kerrylogistics,kerryproperties,kfh,kg,kh,ki,kia,kim,kinder,kindle,kitchen,kiwi,km,kn,koeln,komatsu,kosher,kp,kpmg,kpn,kr,krd,kred,kuokgroup,kw,ky,kyoto,kz,la,lacaixa,lamborghini,lamer,lancaster,lancia,land,landrover,lanxess,lasalle,lat,latino,latrobe,law,lawyer,lb,lc,lds,lease,leclerc,lefrak,legal,lego,lexus,lgbt,li,lidl,life,lifeinsurance,lifestyle,lighting,like,lilly,limited,limo,lincoln,linde,link,lipsy,live,living,lixil,lk,llc,llp,loan,loans,locker,locus,loft,lol,london,lotte,lotto,love,lpl,lplfinancial,lr,ls,lt,ltd,ltda,lu,lundbeck,luxe,luxury,lv,ly,ma,macys,madrid,maif,maison,makeup,man,management,mango,map,market,marketing,markets,marriott,marshalls,maserati,mattel,mba,mc,mckinsey,md,me,med,media,meet,melbourne,meme,memorial,men,menu,merckmsd,mg,mh,miami,microsoft,mil,mini,mint,mit,mitsubishi,mk,ml,mlb,mls,mm,mma,mn,mo,mobi,mobile,moda,moe,moi,mom,monash,money,monster,mormon,mortgage,moscow,moto,motorcycles,mov,movie,mp,mq,mr,ms,msd,mt,mtn,mtr,mu,museum,music,mutual,mv,mw,mx,my,mz,na,nab,nagoya,name,natura,navy,nba,nc,ne,nec,net,netbank,netflix,network,neustar,new,news,next,nextdirect,nexus,nf,nfl,ng,ngo,nhk,ni,nico,nike,nikon,ninja,nissan,nissay,nl,no,nokia,northwesternmutual,norton,now,nowruz,nowtv,np,nr,nra,nrw,ntt,nu,nyc,nz,obi,observer,off,office,okinawa,olayan,olayangroup,oldnavy,ollo,om,omega,one,ong,onl,online,ooo,open,oracle,orange,org,organic,origins,osaka,otsuka,ott,ovh,pa,page,panasonic,paris,pars,partners,parts,party,passagens,pay,pccw,pe,pet,pf,pfizer,pg,ph,pharmacy,phd,philips,phone,photo,photography,photos,physio,pics,pictet,pictures,pid,pin,ping,pink,pioneer,pizza,pk,pl,place,play,playstation,plumbing,plus,pm,pn,pnc,pohl,poker,politie,porn,post,pr,pramerica,praxi,press,prime,pro,prod,productions,prof,progressive,promo,properties,property,protection,pru,prudential,ps,pt,pub,pw,pwc,py,qa,qpon,quebec,quest,racing,radio,raid,re,read,realestate,realtor,realty,recipes,red,redstone,redumbrella,rehab,reise,reisen,reit,reliance,ren,rent,rentals,repair,report,republican,rest,restaurant,review,reviews,rexroth,rich,richardli,ricoh,ril,rio,rip,ro,rocher,rocks,rodeo,rogers,room,rs,rsvp,ru,rugby,ruhr,run,rw,rwe,ryukyu,sa,saarland,safe,safety,sakura,sale,salon,samsclub,samsung,sandvik,sandvikcoromant,sanofi,sap,sarl,sas,save,saxo,sb,sbi,sbs,sc,sca,scb,schaeffler,schmidt,scholarships,school,schule,schwarz,science,scjohnson,scot,sd,se,search,seat,secure,security,seek,select,sener,services,ses,seven,sew,sex,sexy,sfr,sg,sh,shangrila,sharp,shaw,shell,shia,shiksha,shoes,shop,shopping,shouji,show,showtime,si,silk,sina,singles,site,sj,sk,ski,skin,sky,skype,sl,sling,sm,smart,smile,sn,sncf,so,soccer,social,softbank,software,sohu,solar,solutions,song,sony,soy,spa,space,sport,spot,sr,srl,ss,st,stada,staples,star,statebank,statefarm,stc,stcgroup,stockholm,storage,store,stream,studio,study,style,su,sucks,supplies,supply,support,surf,surgery,suzuki,sv,swatch,swiss,sx,sy,sydney,systems,sz,tab,taipei,talk,taobao,target,tatamotors,tatar,tattoo,tax,taxi,tc,tci,td,tdk,team,tech,technology,tel,temasek,tennis,teva,tf,tg,th,thd,theater,theatre,tiaa,tickets,tienda,tiffany,tips,tires,tirol,tj,tjmaxx,tjx,tk,tkmaxx,tl,tm,tmall,tn,to,today,tokyo,tools,top,toray,toshiba,total,tours,town,toyota,toys,tr,trade,trading,training,travel,travelchannel,travelers,travelersinsurance,trust,trv,tt,tube,tui,tunes,tushu,tv,tvs,tw,tz,ua,ubank,ubs,ug,uk,unicom,university,uno,uol,ups,us,uy,uz,va,vacations,vana,vanguard,vc,ve,vegas,ventures,verisign,versicherung,vet,vg,vi,viajes,video,vig,viking,villas,vin,vip,virgin,visa,vision,viva,vivo,vlaanderen,vn,vodka,volkswagen,volvo,vote,voting,voto,voyage,vu,vuelos,wales,walmart,walter,wang,wanggou,watch,watches,weather,weatherchannel,webcam,weber,website,wed,wedding,weibo,weir,wf,whoswho,wien,wiki,williamhill,win,windows,wine,winners,wme,wolterskluwer,woodside,work,works,world,wow,ws,wtc,wtf,xbox,xerox,xfinity,xihuan,xin,कॉम,セール,佛山,ಭಾರತ,慈善,集团,在线,한국,ଭାରତ,点看,คอม,ভাৰত,ভারত,八卦,ישראל,موقع,বাংলা,公益,公司,香格里拉,网站,移动,我爱你,москва,қаз,католик,онлайн,сайт,联通,срб,бг,бел,קום,时尚,微博,淡马锡,ファッション,орг,नेट,ストア,アマゾン,삼성,சிங்கப்பூர்,商标,商店,商城,дети,мкд,ею,ポイント,新闻,家電,كوم,中文网,中信,中国,中國,娱乐,谷歌,భారత్,ලංකා,電訊盈科,购物,クラウド,ભારત,通販,भारतम्,भारत,भारोत,网店,संगठन,餐厅,网络,ком,укр,香港,亚马逊,诺基亚,食品,飞利浦,台湾,台灣,手机,мон,الجزائر,عمان,ارامكو,ایران,العليان,اتصالات,امارات,بازار,موريتانيا,پاکستان,الاردن,بارت,بھارت,المغرب,ابوظبي,البحرين,السعودية,ڀارت,كاثوليك,سودان,همراه,عراق,مليسيا,澳門,닷컴,政府,شبكة,بيتك,عرب,გე,机构,组织机构,健康,ไทย,سورية,招聘,рус,рф,تونس,大拿,ລາວ,みんな,グーグル,ευ,ελ,世界,書籍,ഭാരതം,ਭਾਰਤ,网址,닷넷,コム,天主教,游戏,vermögensberater,vermögensberatung,企业,信息,嘉里大酒店,嘉里,مصر,قطر,广东,இலங்கை,இந்தியா,հայ,新加坡,فلسطين,政务,xxx,xyz,yachts,yahoo,yamaxun,yandex,ye,yodobashi,yoga,yokohama,you,youtube,yt,yun,za,zappos,zara,zero,zip,zm,zone,zuerich,zw".split(/,/)
|
26
|
+
|
27
27
|
# initialize a new PassiveTotal::API object
|
28
28
|
# username: the email address associated with your PassiveTotal API key.
|
29
29
|
# apikey: is 64-hexcharacter string
|
@@ -36,44 +36,44 @@ module PassiveTotal # :nodoc:
|
|
36
36
|
@apikey = apikey
|
37
37
|
@endpoint = endpoint
|
38
38
|
end
|
39
|
-
|
39
|
+
|
40
40
|
# Account : Get account details your account.
|
41
41
|
def account
|
42
42
|
get('account')
|
43
43
|
end
|
44
|
-
|
44
|
+
|
45
45
|
# Account History : Get history associated with your account.
|
46
46
|
def account_history
|
47
47
|
get('account/history')
|
48
48
|
end
|
49
|
-
|
49
|
+
|
50
50
|
# history is an alias for account_history
|
51
51
|
alias_method :history, :account_history
|
52
|
-
|
52
|
+
|
53
53
|
# Account organization : Get details about the organization your account is associated with.
|
54
54
|
def account_organization
|
55
55
|
get('account/organization')
|
56
56
|
end
|
57
|
-
|
57
|
+
|
58
58
|
# organization is an alias for account_organization
|
59
59
|
alias_method :organization, :account_organization
|
60
|
-
|
60
|
+
|
61
61
|
# Account organization teamstream : Get the teamstream for the organization your account is associated with.
|
62
62
|
def account_organization_teamstream
|
63
63
|
get('account/organization/teamstream')
|
64
64
|
end
|
65
|
-
|
65
|
+
|
66
66
|
# teamstream is an alias for account_organization_teamstream
|
67
67
|
alias_method :teamstream, :account_organization_teamstream
|
68
|
-
|
68
|
+
|
69
69
|
# Account sources : Get source details for a specific source.
|
70
70
|
def account_sources(source)
|
71
71
|
get('account/sources', {'source' => source})
|
72
72
|
end
|
73
|
-
|
73
|
+
|
74
74
|
# sources is an alias for account_sources
|
75
75
|
alias_method :sources, :account_sources
|
76
|
-
|
76
|
+
|
77
77
|
|
78
78
|
# Passive provides a complete passive DNS picture for a domain or IP address including first/last seen values, deconflicted values, sources used, unique counts and enrichment for all values.
|
79
79
|
# query: A domain or IP address to query
|
@@ -94,10 +94,10 @@ module PassiveTotal # :nodoc:
|
|
94
94
|
end
|
95
95
|
get('dns/passive/unique', {'query' => query})
|
96
96
|
end
|
97
|
-
|
97
|
+
|
98
98
|
# unique is an alias for passive_unique
|
99
99
|
alias_method :unique, :passive_unique
|
100
|
-
|
100
|
+
|
101
101
|
# Enrichment : Enrich the given query with metadata
|
102
102
|
# query: A domain or IP address to query
|
103
103
|
def enrichment(query)
|
@@ -107,10 +107,10 @@ module PassiveTotal # :nodoc:
|
|
107
107
|
end
|
108
108
|
get('enrichment', {'query' => query})
|
109
109
|
end
|
110
|
-
|
110
|
+
|
111
111
|
# metadata is an alias for enrichment
|
112
112
|
alias_method :metadata, :enrichment
|
113
|
-
|
113
|
+
|
114
114
|
# Enrichment bulk : Enrich each of the given queries with metadata
|
115
115
|
# query: An array of domains or IP addresses to query
|
116
116
|
def bulk_enrichment(query)
|
@@ -136,7 +136,7 @@ module PassiveTotal # :nodoc:
|
|
136
136
|
end
|
137
137
|
get('enrichment/osint', {'query' => query})
|
138
138
|
end
|
139
|
-
|
139
|
+
|
140
140
|
# osint bulk : Enrich each of the given queries with metadata
|
141
141
|
# query: An array of domains or IP addresses to query
|
142
142
|
def bulk_osint(query)
|
@@ -158,7 +158,7 @@ module PassiveTotal # :nodoc:
|
|
158
158
|
def subdomains(query)
|
159
159
|
get('enrichment/subdomains', {'query' => query})
|
160
160
|
end
|
161
|
-
|
161
|
+
|
162
162
|
# whois: Get WHOIS data for a domain or IP address
|
163
163
|
# query: ipv4, domain, or, if you specify a field, any value for that field
|
164
164
|
# field: field name to query if not the default ip/domain field
|
@@ -175,7 +175,17 @@ module PassiveTotal # :nodoc:
|
|
175
175
|
get('whois', {'query' => query, 'compact_record' => 'false'})
|
176
176
|
end
|
177
177
|
end
|
178
|
-
|
178
|
+
|
179
|
+
# whois: Get reputation data for a domain or IP address
|
180
|
+
# query: A domain or IP address to query
|
181
|
+
def reputation(query)
|
182
|
+
is_valid_with_error(__method__, [:ipv4, :domain], query)
|
183
|
+
if domain?(query)
|
184
|
+
query = normalize_domain(query)
|
185
|
+
end
|
186
|
+
get('reputation', {'query' => query})
|
187
|
+
end
|
188
|
+
|
179
189
|
# Add a user-tag to an IP or domain
|
180
190
|
# query: A domain or IP address to tag
|
181
191
|
# tag: Value used to tag query value. Should only consist of alphanumeric, underscores and hyphen values
|
@@ -184,7 +194,7 @@ module PassiveTotal # :nodoc:
|
|
184
194
|
is_valid_with_error(__method__, [:tag], tag)
|
185
195
|
post('actions/tags', { 'query' => query, 'tags' => [tag] })
|
186
196
|
end
|
187
|
-
|
197
|
+
|
188
198
|
# Remove a user-tag to an IP or domain
|
189
199
|
# query: A domain or IP address to remove a tag from
|
190
200
|
# tag: Value used to tag query value. Should only consist of alphanumeric, underscores and hyphen values
|
@@ -193,7 +203,7 @@ module PassiveTotal # :nodoc:
|
|
193
203
|
is_valid_with_error(__method__, [:tag], tag)
|
194
204
|
delete('actions/tags', { 'query' => query, 'tags' => [tag] })
|
195
205
|
end
|
196
|
-
|
206
|
+
|
197
207
|
# PassiveTotal uses the notion of classifications to highlight table rows a certain color based on how they have been rated.
|
198
208
|
# PassiveTotal::API#classification() queries if only one argument is given, and sets if both are given
|
199
209
|
# query: A domain or IP address to query
|
@@ -209,7 +219,7 @@ module PassiveTotal # :nodoc:
|
|
209
219
|
post('actions/classification', { 'query' => query, 'classification' => set })
|
210
220
|
end
|
211
221
|
end
|
212
|
-
|
222
|
+
|
213
223
|
# Get the classification for a query in bulk
|
214
224
|
# query: An array of domains or IP address to query
|
215
225
|
def bulk_classification(query)
|
@@ -225,7 +235,7 @@ module PassiveTotal # :nodoc:
|
|
225
235
|
end
|
226
236
|
get_with_data('actions/bulk/classification', { 'query' => query })
|
227
237
|
end
|
228
|
-
|
238
|
+
|
229
239
|
# PassiveTotal allows users to notate if a domain or IP address have ever been compromised. These values aid in letting users know that a site may be benign, but it was used in an attack at some point in time.
|
230
240
|
# PassiveTotal::API#ever_compromised() queries if only one argument is given, and sets if both are given
|
231
241
|
# query: A domain or IP address to query
|
@@ -242,9 +252,9 @@ module PassiveTotal # :nodoc:
|
|
242
252
|
post('actions/ever-compromised', { 'query' => query, 'status' => set })
|
243
253
|
end
|
244
254
|
end
|
245
|
-
|
255
|
+
|
246
256
|
alias_method :compromised, :ever_compromised
|
247
|
-
|
257
|
+
|
248
258
|
# PassiveTotal allows users to notate if a domain is associated with a dynamic DNS provider.
|
249
259
|
# PassiveTotal::API#dynamic() queries if only one argument is given, and sets if both are given
|
250
260
|
# query: A domain to query
|
@@ -259,7 +269,7 @@ module PassiveTotal # :nodoc:
|
|
259
269
|
post('actions/dynamic-dns', { 'query' => query, 'status' => set })
|
260
270
|
end
|
261
271
|
end
|
262
|
-
|
272
|
+
|
263
273
|
# PassiveTotal allows users to notate if an ip or domain is "monitored".
|
264
274
|
# PassiveTotal::API#monitor() queries if only one argument is given, and sets if both are given
|
265
275
|
# query: A domain to query
|
@@ -276,7 +286,7 @@ module PassiveTotal # :nodoc:
|
|
276
286
|
post('actions/monitor', { 'query' => query, 'status' => set })
|
277
287
|
end
|
278
288
|
end
|
279
|
-
|
289
|
+
|
280
290
|
# monitoring is an alias for monitor
|
281
291
|
alias_method :monitoring, :monitor
|
282
292
|
alias_method :watching, :monitor
|
@@ -294,7 +304,7 @@ module PassiveTotal # :nodoc:
|
|
294
304
|
post('actions/sinkhole', { 'query' => query, 'status' => set })
|
295
305
|
end
|
296
306
|
end
|
297
|
-
|
307
|
+
|
298
308
|
|
299
309
|
# PassiveTotal uses three types of tags (user, global, and temporal) in order to provide context back to the user.
|
300
310
|
# query: A domain or IP address to query
|
@@ -311,7 +321,7 @@ module PassiveTotal # :nodoc:
|
|
311
321
|
post('actions/tag', { 'query' => query, 'tags' => [set] })
|
312
322
|
end
|
313
323
|
end
|
314
|
-
|
324
|
+
|
315
325
|
# Search Tags : Search for items based on tag value
|
316
326
|
# PassiveTotal uses three types of tags (user, global, and temporal) in order to provide context back to the user.
|
317
327
|
# query: A domain or IP address to query
|
@@ -343,7 +353,7 @@ module PassiveTotal # :nodoc:
|
|
343
353
|
get_params('ssl-certificate/search', { 'query' => query, 'field' => field })
|
344
354
|
end
|
345
355
|
end
|
346
|
-
|
356
|
+
|
347
357
|
# PassiveTotal tracks some interesting metadata about a host
|
348
358
|
# query: a hostname or ip address
|
349
359
|
def components(query)
|
@@ -353,7 +363,7 @@ module PassiveTotal # :nodoc:
|
|
353
363
|
end
|
354
364
|
get('host-attributes/components', {'query' => query})
|
355
365
|
end
|
356
|
-
|
366
|
+
|
357
367
|
# trackers: Get all tracking codes for a domain or IP address.
|
358
368
|
# query: ip or domain, or, if type is supplied, a valid tracker ID
|
359
369
|
# type: A valid tracker type to search:
|
@@ -370,7 +380,7 @@ module PassiveTotal # :nodoc:
|
|
370
380
|
get('trackers/search', {'query' => query, 'type' => type})
|
371
381
|
end
|
372
382
|
end
|
373
|
-
|
383
|
+
|
374
384
|
# malware: get sample information based from domain
|
375
385
|
# query: ip or domain
|
376
386
|
def malware(query)
|
@@ -380,7 +390,7 @@ module PassiveTotal # :nodoc:
|
|
380
390
|
end
|
381
391
|
get('enrichment/malware', {'query' => query})
|
382
392
|
end
|
383
|
-
|
393
|
+
|
384
394
|
# malware bulk: get sample information based from domains
|
385
395
|
# query: An array of domains or IP addresses to query
|
386
396
|
def bulk_malware(query)
|
@@ -396,10 +406,10 @@ module PassiveTotal # :nodoc:
|
|
396
406
|
end
|
397
407
|
get_with_data('enrichment/bulk/malware', { 'query' => query })
|
398
408
|
end
|
399
|
-
|
400
|
-
|
409
|
+
|
410
|
+
|
401
411
|
private
|
402
|
-
|
412
|
+
|
403
413
|
# returns true if the given string is a dotted quad IPv4 address
|
404
414
|
def ipv4?(ip)
|
405
415
|
if ip =~ /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/
|
@@ -407,14 +417,14 @@ module PassiveTotal # :nodoc:
|
|
407
417
|
end
|
408
418
|
false
|
409
419
|
end
|
410
|
-
|
420
|
+
|
411
421
|
# returns true if the given string looks like a domain and ends with a known top-level domain (TLD)
|
412
422
|
def domain?(domain)
|
413
423
|
return false if domain.nil?
|
414
424
|
domain = normalize_domain(domain)
|
415
425
|
domain =~ /^[a-zA-Z0-9\-\.]{3,255}$/ and TLDS.index(domain.split(/\./).last)
|
416
426
|
end
|
417
|
-
|
427
|
+
|
418
428
|
# returns true if the given string looks like a SHA-1 hash, i.e., 40 character hex string
|
419
429
|
def hash?(hash)
|
420
430
|
return false if hash.nil?
|
@@ -423,17 +433,17 @@ module PassiveTotal # :nodoc:
|
|
423
433
|
end
|
424
434
|
false
|
425
435
|
end
|
426
|
-
|
436
|
+
|
427
437
|
# returns true if the given string matches a valid classification
|
428
438
|
def classification?(c)
|
429
439
|
not ["malicious", "non-malicious", "suspicious", "unknown"].index(c).nil?
|
430
440
|
end
|
431
|
-
|
441
|
+
|
432
442
|
# returns true is the given object matches true or false
|
433
443
|
def bool?(b)
|
434
444
|
not ['true', 'false'].index(b.to_s).nil?
|
435
445
|
end
|
436
|
-
|
446
|
+
|
437
447
|
# returns true if the given string looks like a valid tag
|
438
448
|
def tag?(t)
|
439
449
|
return false if t.nil?
|
@@ -442,27 +452,27 @@ module PassiveTotal # :nodoc:
|
|
442
452
|
end
|
443
453
|
false
|
444
454
|
end
|
445
|
-
|
455
|
+
|
446
456
|
def ssl_field?(f)
|
447
457
|
return false if f.nil?
|
448
|
-
not ["issuerSurname", "subjectOrganizationName", "issuerCountry", "issuerOrganizationUnitName",
|
449
|
-
"fingerprint", "subjectOrganizationUnitName", "serialNumber", "subjectEmailAddress", "subjectCountry",
|
450
|
-
"issuerGivenName", "subjectCommonName", "issuerCommonName", "issuerStateOrProvinceName", "issuerProvince",
|
451
|
-
"subjectStateOrProvinceName", "sha1", "sslVersion", "subjectStreetAddress", "subjectSerialNumber",
|
452
|
-
"issuerOrganizationName", "subjectSurname", "subjectLocalityName", "issuerStreetAddress",
|
458
|
+
not ["issuerSurname", "subjectOrganizationName", "issuerCountry", "issuerOrganizationUnitName",
|
459
|
+
"fingerprint", "subjectOrganizationUnitName", "serialNumber", "subjectEmailAddress", "subjectCountry",
|
460
|
+
"issuerGivenName", "subjectCommonName", "issuerCommonName", "issuerStateOrProvinceName", "issuerProvince",
|
461
|
+
"subjectStateOrProvinceName", "sha1", "sslVersion", "subjectStreetAddress", "subjectSerialNumber",
|
462
|
+
"issuerOrganizationName", "subjectSurname", "subjectLocalityName", "issuerStreetAddress",
|
453
463
|
"issuerLocalityName", "subjectGivenName", "subjectProvince", "issuerSerialNumber", "issuerEmailAddress"].index(f).nil?
|
454
464
|
end
|
455
|
-
|
465
|
+
|
456
466
|
def whois_field?(f)
|
457
467
|
return false if f.nil?
|
458
468
|
not ["domain", "email", "name", "organization", "address", "phone", "nameserver"].index(f).nil?
|
459
469
|
end
|
460
|
-
|
470
|
+
|
461
471
|
def tracker_type?(t)
|
462
472
|
return false if t.nil?
|
463
473
|
not ["YandexMetricaCounterId", "ClickyId", "GoogleAnalyticsAccountNumber", "NewRelicId", "MixpanelId", "GoogleAnalyticsTrackingId"].index(t).nil?
|
464
474
|
end
|
465
|
-
|
475
|
+
|
466
476
|
# lowercases and removes a trailing period (if one exists) from a domain name
|
467
477
|
def normalize_domain(domain)
|
468
478
|
return domain.downcase.gsub(/\.$/,'')
|
@@ -472,26 +482,26 @@ module PassiveTotal # :nodoc:
|
|
472
482
|
def get(api, params={})
|
473
483
|
url2json(:GET, "#{@endpoint}#{api}", params)
|
474
484
|
end
|
475
|
-
|
485
|
+
|
476
486
|
# helper function to perform an HTTP GET against the web API
|
477
487
|
def get_params(api, params)
|
478
488
|
url2json(:GET, "#{@endpoint}#{api}", params)
|
479
489
|
end
|
480
|
-
|
490
|
+
|
481
491
|
def get_with_data(api, params={})
|
482
492
|
url2json(:GET_DATA, "#{@endpoint}#{api}", params)
|
483
493
|
end
|
484
|
-
|
494
|
+
|
485
495
|
# helper function to perform an HTTP POST against the web API
|
486
496
|
def post(api, params)
|
487
497
|
url2json(:POST, "#{@endpoint}#{api}", params)
|
488
498
|
end
|
489
|
-
|
499
|
+
|
490
500
|
# helper function to perform an HTTP DELETE against the web API
|
491
501
|
def delete(api, params)
|
492
502
|
url2json(:DELETE, "#{@endpoint}#{api}", params)
|
493
503
|
end
|
494
|
-
|
504
|
+
|
495
505
|
# main helper function to perform HTTP interactions with the web API.
|
496
506
|
def url2json(method, url, params)
|
497
507
|
if method == :GET
|
@@ -533,13 +543,13 @@ module PassiveTotal # :nodoc:
|
|
533
543
|
response = http.request(request)
|
534
544
|
delta = (Time.now - t1).to_f
|
535
545
|
data = JSON.parse(response.body)
|
536
|
-
|
546
|
+
|
537
547
|
obj = Transaction.new(
|
538
548
|
Query.new(method, params['query'], params[method] || params['tag'], url, params),
|
539
549
|
Response.new(response.body, response.code == '200', data),
|
540
550
|
delta
|
541
551
|
)
|
542
|
-
|
552
|
+
|
543
553
|
if data['error']
|
544
554
|
message = data['error']['message']
|
545
555
|
case message
|
@@ -554,7 +564,7 @@ module PassiveTotal # :nodoc:
|
|
554
564
|
|
555
565
|
return obj
|
556
566
|
end
|
557
|
-
|
567
|
+
|
558
568
|
# tests an item to see if it matches a valid type
|
559
569
|
def is_valid?(types, item)
|
560
570
|
types.each do |type|
|
@@ -580,7 +590,7 @@ module PassiveTotal # :nodoc:
|
|
580
590
|
end
|
581
591
|
return false
|
582
592
|
end
|
583
|
-
|
593
|
+
|
584
594
|
# tests an item to see if it matches a valid type and raises an ArgumentError if invalid
|
585
595
|
def is_valid_with_error(methname, types, item)
|
586
596
|
valid = is_valid?(types, item)
|
@@ -591,4 +601,4 @@ module PassiveTotal # :nodoc:
|
|
591
601
|
end
|
592
602
|
|
593
603
|
end
|
594
|
-
end
|
604
|
+
end
|
data/lib/passivetotal/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: passivetotal
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.0.
|
4
|
+
version: 1.0.6
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- chrislee35
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2021-12-01 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: json
|
@@ -30,42 +30,42 @@ dependencies:
|
|
30
30
|
requirements:
|
31
31
|
- - "~>"
|
32
32
|
- !ruby/object:Gem::Version
|
33
|
-
version:
|
33
|
+
version: 2.2.10
|
34
34
|
type: :development
|
35
35
|
prerelease: false
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
38
|
- - "~>"
|
39
39
|
- !ruby/object:Gem::Version
|
40
|
-
version:
|
40
|
+
version: 2.2.10
|
41
41
|
- !ruby/object:Gem::Dependency
|
42
42
|
name: rake
|
43
43
|
requirement: !ruby/object:Gem::Requirement
|
44
44
|
requirements:
|
45
45
|
- - "~>"
|
46
46
|
- !ruby/object:Gem::Version
|
47
|
-
version: '
|
47
|
+
version: '13.0'
|
48
48
|
type: :development
|
49
49
|
prerelease: false
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
51
51
|
requirements:
|
52
52
|
- - "~>"
|
53
53
|
- !ruby/object:Gem::Version
|
54
|
-
version: '
|
54
|
+
version: '13.0'
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
56
|
name: minitest
|
57
57
|
requirement: !ruby/object:Gem::Requirement
|
58
58
|
requirements:
|
59
|
-
- - "
|
59
|
+
- - "~>"
|
60
60
|
- !ruby/object:Gem::Version
|
61
|
-
version: '
|
61
|
+
version: '5.14'
|
62
62
|
type: :development
|
63
63
|
prerelease: false
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
|
-
- - "
|
66
|
+
- - "~>"
|
67
67
|
- !ruby/object:Gem::Version
|
68
|
-
version: '
|
68
|
+
version: '5.14'
|
69
69
|
description: PassiveTotal offers an extensive API for users of the platform that maps
|
70
70
|
most major actions available in the web application to a corresponding call. There
|
71
71
|
are two flavors of the API available for use, stable and current. In order to use
|
@@ -79,25 +79,18 @@ executables:
|
|
79
79
|
extensions: []
|
80
80
|
extra_rdoc_files: []
|
81
81
|
files:
|
82
|
-
- ".gitignore"
|
83
|
-
- ".travis.yml"
|
84
|
-
- Gemfile
|
85
|
-
- LICENSE.txt
|
86
|
-
- README.md
|
87
|
-
- Rakefile
|
88
82
|
- bin/passivetotal
|
89
83
|
- lib/passivetotal.rb
|
90
84
|
- lib/passivetotal/api.rb
|
91
85
|
- lib/passivetotal/cli.rb
|
92
86
|
- lib/passivetotal/version.rb
|
93
|
-
- passivetotal.gemspec
|
94
87
|
- utils/console
|
95
88
|
- utils/setup
|
96
89
|
homepage: https://github.com/chrislee35/passivetotal
|
97
90
|
licenses:
|
98
91
|
- MIT
|
99
92
|
metadata: {}
|
100
|
-
post_install_message:
|
93
|
+
post_install_message:
|
101
94
|
rdoc_options: []
|
102
95
|
require_paths:
|
103
96
|
- lib
|
@@ -112,9 +105,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
112
105
|
- !ruby/object:Gem::Version
|
113
106
|
version: '0'
|
114
107
|
requirements: []
|
115
|
-
|
116
|
-
|
117
|
-
signing_key:
|
108
|
+
rubygems_version: 3.1.2
|
109
|
+
signing_key:
|
118
110
|
specification_version: 4
|
119
|
-
summary: Wrapper library for PassiveTotal.org's
|
111
|
+
summary: Wrapper library for PassiveTotal.org's Web API
|
120
112
|
test_files: []
|
data/.gitignore
DELETED
data/.travis.yml
DELETED
data/Gemfile
DELETED
data/LICENSE.txt
DELETED
@@ -1,21 +0,0 @@
|
|
1
|
-
The MIT License (MIT)
|
2
|
-
|
3
|
-
Copyright (c) 2015 chrislee35
|
4
|
-
|
5
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
6
|
-
of this software and associated documentation files (the "Software"), to deal
|
7
|
-
in the Software without restriction, including without limitation the rights
|
8
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
9
|
-
copies of the Software, and to permit persons to whom the Software is
|
10
|
-
furnished to do so, subject to the following conditions:
|
11
|
-
|
12
|
-
The above copyright notice and this permission notice shall be included in
|
13
|
-
all copies or substantial portions of the Software.
|
14
|
-
|
15
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
16
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
17
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
18
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
19
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
20
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
21
|
-
THE SOFTWARE.
|
data/README.md
DELETED
@@ -1,163 +0,0 @@
|
|
1
|
-
# PassiveTotal
|
2
|
-
|
3
|
-
The PassiveTotal gem is (currently) a thin wrapper around PassiveTotal.org's Web-based API.
|
4
|
-
|
5
|
-
## Installation
|
6
|
-
|
7
|
-
Add this line to your application's Gemfile:
|
8
|
-
|
9
|
-
```ruby
|
10
|
-
gem 'passivetotal'
|
11
|
-
```
|
12
|
-
|
13
|
-
And then execute:
|
14
|
-
|
15
|
-
$ bundle
|
16
|
-
|
17
|
-
Or install it yourself as:
|
18
|
-
|
19
|
-
$ gem install passivetotal
|
20
|
-
|
21
|
-
## Command Line Tool
|
22
|
-
|
23
|
-
Included in the gem is a command-line tool, passivetotal, with the following usage:
|
24
|
-
|
25
|
-
Usage: bin/passivetotal [-v] [-u <username>] [-k <apikey>] <action flag> <query> [-i <value>]
|
26
|
-
-h Help
|
27
|
-
-v Verbose output
|
28
|
-
-u <username> Sets the Username, defaults to the environment variable PASSIVETOTAL_USERNAME
|
29
|
-
-k <apikey> Sets the APIKEY, defaults to the environment variable PASSIVETOTAL_APIKEY
|
30
|
-
ACTIONS (You have to select one, last one wins) -m <ip or dom> Queries metadata for given IP or domain
|
31
|
-
-p <ip or dom> Queries passive DNS data for given IP or domain
|
32
|
-
-c <ip or dom> Queries (or sets) the classification for a given IP or domain
|
33
|
-
-t <ip or dom> Queries (adds or removes) the tags associated with a given IP or domain
|
34
|
-
* To remove a tag, prepend a dash, '-' to the tag name when using the -i option
|
35
|
-
-e <ip or dom> Queries (or sets) the ever compromised flag on a given IP or domain
|
36
|
-
-w <ip or dom> Queries (or sets) the watched flag on a given IP or domain
|
37
|
-
-s <dom> Queries the subdomains for a given domain
|
38
|
-
-d <dom> Queries (or sets) if a domain is a dynamic DNS domain
|
39
|
-
-x <ip> Queries (or sets) if a given IP is a sinkhole
|
40
|
-
-l <hash> Queries for SSL certificates/IP addresses associated with a given SHA-1 hash
|
41
|
-
-H <ip or hash> Queries for SSL certificate history associated with a given IP or SHA-1 hash
|
42
|
-
-T <ip or dom> Queries for Tracker information associated with a given IP or domain
|
43
|
-
-o <ip or dom> Queries for OSINT on a given IP or domain
|
44
|
-
-M <ip or dom> Queries for Malware sample records for a given IP or domain
|
45
|
-
SETTING VALUES -i <value> Sets the value, used in conjuntion with -c, -t, -e, -w, -d, or -x
|
46
|
-
Valid values for -i depend on what it's used with:
|
47
|
-
-c : malicious, non-malicious, suspicious, unknown
|
48
|
-
-t : <a tag name consisting of characters: [a-zA-Z_]>
|
49
|
-
-e, -w, -d, -x: true, false
|
50
|
-
|
51
|
-
## Usage
|
52
|
-
|
53
|
-
# Initialize the API wrapper with an apikey (using the default endpoint URL of https://api.passivetotal.org/v2/)
|
54
|
-
pt = PassiveTotal::API.new(user, apikey)
|
55
|
-
# Create an array to shove results into
|
56
|
-
res = Array.new
|
57
|
-
|
58
|
-
# ACCOUNT API
|
59
|
-
# Get account details your account.
|
60
|
-
res << @pt.account
|
61
|
-
# Get history associated with your account.
|
62
|
-
res << @pt.history
|
63
|
-
# Get notifications that have been posted to your account.
|
64
|
-
res << @pt.notifications
|
65
|
-
# Get details about the organization your account is associated with.
|
66
|
-
res << @pt.organization
|
67
|
-
# Get the teamstream for the organization your account is associated with.
|
68
|
-
res << @pt.teamstream
|
69
|
-
# Get source details for a specific source.
|
70
|
-
res << @pt.sources('riskiq')
|
71
|
-
|
72
|
-
# DNS API
|
73
|
-
# query passive DNS results for the domain, www.passivetotal.org
|
74
|
-
res << @pt.passive('www.passivetotal.org')
|
75
|
-
# query passive DNS results for the ipv4 address, 107.170.89.121
|
76
|
-
res << @pt.passive('107.170.89.121')
|
77
|
-
# query for unique IPv4 resolutions of passivetotal.org
|
78
|
-
res << @pt.unique('passivetotal.org')
|
79
|
-
|
80
|
-
# ENRICHMENT API
|
81
|
-
# query enrichment for the domain, www.passivetotal.org
|
82
|
-
res << @pt.enrichment('www.passivetotal.org')
|
83
|
-
# query enrichment for the ipv4 address, 107.170.89.121
|
84
|
-
res << @pt.enrichment('107.170.89.121')
|
85
|
-
# Get malware data
|
86
|
-
res << @pt.malware('noorno.com')
|
87
|
-
# query for malware sample records by the ip addres 98.124.243.47
|
88
|
-
res << @pt.malware("98.124.243.47")
|
89
|
-
# Get opensource intelligence data
|
90
|
-
res << @pt.osint("xxxmobiletubez.com")
|
91
|
-
# query for subdomains of passivetotal.org
|
92
|
-
res << @pt.subdomains('*.passivetotal.org')
|
93
|
-
|
94
|
-
# WHOIS API
|
95
|
-
# Get WHOIS data for a domain or IP address
|
96
|
-
res << @pt.whois("passivetotal.org")
|
97
|
-
# Get WHOIS records based on field matching queries.
|
98
|
-
res << @pt.whois("proxy4655031@1and1-private-registration.com", "email")
|
99
|
-
|
100
|
-
# ACTIONS API
|
101
|
-
# query for the tags associated with www.chrisleephd.us
|
102
|
-
res << @pt.tags('www.chrisleephd.us')
|
103
|
-
# add the "cool" tag to www.chrisleephd.us
|
104
|
-
res << @pt.add_tag('www.chrisleephd.us', 'cool')
|
105
|
-
# remove the "cool" tag from www.chrisleephd.us (aww, I was cool for a few milliseconds :( )
|
106
|
-
res << @pt.remove_tag('www.chrisleephd.us', 'cool')
|
107
|
-
# query for the classification of www.passivetotal.org
|
108
|
-
res << @pt.classification('www.passivetotal.org')
|
109
|
-
# set the classification of www.passivetotal.org as benign
|
110
|
-
res << @pt.classification('www.passivetotal.org', 'non-malicious')
|
111
|
-
# query if www.passivetotal.org has ever been listed as compromised
|
112
|
-
res << @pt.ever_compromised('www.passivetotal.org')
|
113
|
-
# set the ever_compromised flag for www.passivetotal.org to false to indicate that it was never compromised or that it is in sole control of a malicious actor.
|
114
|
-
res << @pt.ever_compromised('www.passivetotal.org', false)
|
115
|
-
# check if www.passivetotal.org is a dynamic dns domain/host
|
116
|
-
res << @pt.dynamic('www.passivetotal.org')
|
117
|
-
# flag www.passivetotal.org as not a dynamic dns domain/host
|
118
|
-
res << @pt.dynamic('www.passivetotal.org', false)
|
119
|
-
# check if www.passivetotal.org is being watched
|
120
|
-
res << @pt.monitor('www.passivetotal.org')
|
121
|
-
# unwatch www.passivetotal.org
|
122
|
-
res << @pt.monitor('www.passivetotal.org', false)
|
123
|
-
# query if 107.170.89.121 is a sinkhole
|
124
|
-
res << @pt.sinkhole('107.170.89.121')
|
125
|
-
# set 107.170.89.121 as not a sinkhole
|
126
|
-
res << @pt.sinkhole('107.170.89.121', false)
|
127
|
-
|
128
|
-
# HOST API
|
129
|
-
# Get detailed information about a host
|
130
|
-
res << @pt.components('passivetotal.org')
|
131
|
-
# Get all tracking codes for a domain or IP address.
|
132
|
-
res << @pt.trackers('passivetotal.org')
|
133
|
-
# Get hosts matching a specific tracker ID
|
134
|
-
res << @pt.trackers('UA-49901229', 'GoogleAnalyticsAccountNumber')
|
135
|
-
|
136
|
-
# SSL API
|
137
|
-
# list sites associated with SSL certificates with SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
|
138
|
-
res << @pt.ssl_certificate('e9a6647d6aba52dc47b3838c920c9ee59bad7034')
|
139
|
-
# list sites associated with SSL certificates with SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
|
140
|
-
res << @pt.ssl_certificate('2317683628587350290823564500811277499', 'serialNumber')
|
141
|
-
# retrieve certificate history based on SHA-1 hash of e9a6647d6aba52dc47b3838c920c9ee59bad7034
|
142
|
-
res << @pt.ssl_certificate_history('e9a6647d6aba52dc47b3838c920c9ee59bad7034')
|
143
|
-
# retrieve certificate history from IPv4 address of 52.8.228.23
|
144
|
-
res << @pt.ssl_certificate_history('52.8.228.23')
|
145
|
-
|
146
|
-
# dump all this glorious information to feast your eyes upon
|
147
|
-
pp res
|
148
|
-
|
149
|
-
## Development
|
150
|
-
|
151
|
-
After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
|
152
|
-
|
153
|
-
To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
|
154
|
-
|
155
|
-
## Contributing
|
156
|
-
|
157
|
-
Bug reports and pull requests are welcome on GitHub at https://github.com/chrislee35/passivetotal.
|
158
|
-
|
159
|
-
|
160
|
-
## License
|
161
|
-
|
162
|
-
The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
|
163
|
-
|
data/Rakefile
DELETED
data/passivetotal.gemspec
DELETED
@@ -1,26 +0,0 @@
|
|
1
|
-
# coding: utf-8
|
2
|
-
lib = File.expand_path('../lib', __FILE__)
|
3
|
-
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
4
|
-
require 'passivetotal/version'
|
5
|
-
|
6
|
-
Gem::Specification.new do |spec|
|
7
|
-
spec.name = "passivetotal"
|
8
|
-
spec.version = PassiveTotal::VERSION
|
9
|
-
spec.authors = ["chrislee35"]
|
10
|
-
spec.email = ["rubygems@chrislee.dhs.org"]
|
11
|
-
|
12
|
-
spec.summary = %q{Wrapper library for PassiveTotal.org's W eb API}
|
13
|
-
spec.description = %q{PassiveTotal offers an extensive API for users of the platform that maps most major actions available in the web application to a corresponding call. There are two flavors of the API available for use, stable and current. In order to use the stable API, add the version indicator (vX) into the URL as documented below. If you would rather use the current API which includes new changes and experiments, replace the version indicator with "current".}
|
14
|
-
spec.homepage = "https://github.com/chrislee35/passivetotal"
|
15
|
-
spec.license = "MIT"
|
16
|
-
|
17
|
-
spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
|
18
|
-
spec.bindir = "bin"
|
19
|
-
spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
|
20
|
-
spec.require_paths = ["lib"]
|
21
|
-
|
22
|
-
spec.add_runtime_dependency "json", "~> 2.0"
|
23
|
-
spec.add_development_dependency "bundler", "~> 1.10"
|
24
|
-
spec.add_development_dependency "rake", "~> 12.0"
|
25
|
-
spec.add_development_dependency "minitest"
|
26
|
-
end
|