sonar-client 0.1.1.pre → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: a0a22718af920b0a25379d0e6a1de7f8c5a21de2
-  data.tar.gz: c662403673f22f221939e87cb40e623e4b0289bb
+SHA256:
+  metadata.gz: e013916a1cf6c42fbd99d568ee88529cc7ac581b83aad80a4b62e4c2175aec7e
+  data.tar.gz: fb2e18d3b290f1dffb370448c603f3853fd380635ca79c5e8936e124f24fdcd5
 SHA512:
-  metadata.gz: ec58eac6918e22b85c462b7f2da638c58e640d10bca319130422f626f796517e67fe17f3355197cee0eb616126438f6ffd17502b5e80c66981eedb4de210f655
-  data.tar.gz: 6e59096a6f87ace1a081a2fd268727d306cb7838ac9f4ebb1219f2c7ff8dc736e5ba5c11f14297fb3047ff2d034d27615df863b0aa27c19fb76ebcb95ede9c2b
+  metadata.gz: 61c7694ca76d748ad6354f0010ab0891f28d4ed28999e4d57b32d15d5e816e0bf5fd57d311fac06937a19be937a1295016bdf44b9823faa748e51eeaf5b8f71f
+  data.tar.gz: 6dc07ee303279815e6b88f662be748292875d198f72759a828b4032ce012c27b9915869e89ba197b057261c5e7208db59075959fbef4b0db830cb891b6ad8142

data/.travis.yml

@@ -2,14 +2,22 @@ language: ruby
 sudo: false
 cache: bundler
 rvm:
-  - 2.1.5
-  - jruby
+  - '2.4.5'
+  - '2.5.5'
+  - '2.6.5'
+  - '2.7.1'
+  - 'jruby-head'
 before_install:
+  - gem install bundler
+  - gem update bundler
   - "echo 'gem: --no-ri --no-rdoc' > ~/.gemrc"
   - rake --version
 before_script:
   - bundle exec rake --version
 script: bundle exec rspec
+notifications:
+  email:
+    - r7_labs@rapid7.com
 #
 # Environment variables should be set in Travis repository settings per
 # https://docs.travis-ci.com/user/environment-variables/#Defining-Variables-in-Repository-Settings

data/bin/sonar

@@ -6,6 +6,8 @@ require 'sonar'
 
 begin
   Sonar::CLI.start(ARGV)
+rescue Sonar::Search::SearchError => e
+  exit 1
 rescue Interrupt
   puts 'Quitting...'
 end

data/lib/sonar/cli/cli.rb

@@ -2,11 +2,14 @@
 
 require 'thor'
 require 'sonar/cli/rcfile'
+require 'sonar/search'
+require 'sonar/request'
 require 'awesome_print'
+require 'table_print'
 
 module Sonar
   class CLI < Thor
-    class_option 'format', type: :string, desc: 'Flat JSON, JSON lines, or pretty printed [flat/lines/pretty]'
+    class_option 'format', type: :string, desc: 'Flat JSON (include empty collections), JSON lines of collection data (default), or pretty printed [flat/lines/pretty]'
 
     def initialize(*)
       @config = Sonar::RCFile.instance.load_file
@@ -24,29 +27,34 @@ module Sonar
       ap @client.usage
     end
 
-    desc 'search [QUERY TYPE] [QUERY TERM]', 'Search anything from Sonars'
+    desc 'search [QUERY TYPE] [QUERY TERM]', 'Search any query type from Sonar or specify \'all\' as QUERY TYPE to search them all.'
     method_option 'record_limit', type: :numeric, aliases: '-n', desc: 'Maximum number of records to fetch'
     method_option 'exact', type: :boolean, aliases: '-e', desc: 'Search for the query string exactly, do not include partial string matches'
-
     def search(type, term)
-      @query = {}
-      @query[type.to_sym] = term
-      @query[:limit] = options['record_limit']
-      @query[:exact] = options['exact']
-      resp = @client.search(@query)
+      types = [type]
 
-      if resp.is_a?(Sonar::Request::RequestIterator)
-        resp.each do |data|
-          print_json(cleanup_data(data), options['format'])
+      if type == 'all'
+        if term =~ Search::IS_IP
+          types = @client.ip_search_type_names
+        else
+          types = @client.domain_search_type_names
         end
-      else
-        print_json(cleanup_data(resp), options['format'])
+      end
+
+      types.each do |type|
+        @query = {}
+        @query[type.to_sym] = term
+        @query[:limit] = options['record_limit']
+        @query[:exact] = options['exact']
+        resp = @client.search(@query)
+        handle_search_response(resp)
       end
     end
 
     desc 'types', 'List all Sonar query types'
     def types
-      ap Search::QUERY_TYPES_MAP
+      tp.set :io, $stdout
+      tp Search::QUERY_TYPES, :name, { description: { width: 100 } }, :input
     end
 
     desc 'config', 'Sonar config file location'
@@ -74,6 +82,21 @@ module Sonar
       end
     end
 
+    def handle_search_response(resp)
+      errors = 0
+      if resp.is_a?(Sonar::Request::RequestIterator)
+        resp.each do |data|
+          errors += 1 if data.key?('errors') || data.key?('error')
+          print_json(cleanup_data(data), options['format'])
+        end
+      else
+        errors += 1 if resp.key?('errors') || resp.key?('error')
+        print_json(cleanup_data(resp), options['format'])
+      end
+
+      raise Search::SearchError.new("Encountered #{errors} errors while searching") if errors > 0
+    end
+
     # Clean up whitespace and parse JSON values in responses
     def cleanup_data(data)
       return data unless data.is_a?(Hash) && data.has_key?('collection')

data/lib/sonar/search.rb

@@ -2,21 +2,51 @@
 
 module Sonar
   module Search
+
+    # Allow IP queries to be in the form of "1.", "1.2.", "1.2.3.", and "1.2.3.4"
+    IS_IP = /^(\d{1,3}\.|\d{1,3}\.\d{1,3}\.|\d{1,3}\.\d{1,3}\.\d{1,3}\.|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/
+
     # Implemented search query types
-    QUERY_TYPES_MAP = {
-      'certificate' => 'Certificate lookup',
-      'certips'     => 'Certificate to IPs',
-      'rdns'        => 'IP to Reverse DNS Lookup or DNS Lookup to IP',
-      'fdns'        => 'Domains to IP or IPs to Domain',
-      'ipcerts'     => 'IP to Certificates',
-      'namecerts'   => 'Domain to Certificates',
-      'links_to'    => 'HTTP References to Domain',
-      'ports'       => 'Open Ports',
-      'processed'   => 'Open Ports (Processed)',
-      'raw'         => 'Open Ports (Raw)',
-      'sslcert'     => 'Certificate Details',
-      'whois_ip'    => 'Whois (IP)'
-    }
+    QUERY_TYPES = [
+      { name: 'certificate', description: 'Certificate lookup', input: 'sha' },
+      { name: 'certips', description: 'Certificate to IPs', input: 'sha' },
+      { name: 'rdns', description: 'IP to Reverse DNS Lookup or DNS Lookup to IP', input: 'ip' },
+      { name: 'fdns', description: 'Domains to IP or IPs to Domain', input: 'domain' },
+      { name: 'ipcerts', description: 'IP to Certificates', input: 'ip' },
+      { name: 'namecerts', description: 'Domain to Certificates', input: 'domain' },
+      { name: 'links_to', description: 'HTTP References to Domain', input: 'domain' },
+      { name: 'ports', description: 'Open Ports', input: 'ip' },
+      { name: 'processed', description: 'Open Ports (Processed)', input: 'ip' },
+      { name: 'raw', description: 'Open Ports (Raw)', input: 'ip' },
+      { name: 'sslcert', description: 'Certificate Details', input: 'sha' },
+      { name: 'all', description: 'Search all appropriate search types for an IP or domain', input: 'all' }
+    ]
+
+    ##
+    # Generic exception for errors encountered while searching
+    ##
+    class SearchError < StandardError
+    end
+
+    def ip_search_type_names
+      ip_search_types.map { |type| type[:name] }
+    end
+
+    def domain_search_type_names
+      domain_search_types.map { |type| type[:name] }
+    end
+
+    def ip_search_types
+      QUERY_TYPES.select { |type| type[:input] == 'ip' }
+    end
+
+    def domain_search_types
+      QUERY_TYPES.select { |type| type[:input] == 'domain' }
+    end
+
+    def query_type_names
+      QUERY_TYPES.map { |type| type[:name] }
+    end
 
     ##
     # Get search
@@ -26,7 +56,7 @@ module Sonar
     #
     # @return [Hashie::Mash] with response of search
     def search(params = {})
-      type_query = params.select { |k, _v| QUERY_TYPES_MAP.keys.include?(k.to_s) }.first
+      type_query = params.select { |k, _v| query_type_names.include?(k.to_s) }.first
       fail ArgumentError, "The query type provided is invalid or not yet implemented." unless type_query
       type = type_query[0].to_sym
       params[:q] = type_query[1]

data/lib/sonar/version.rb

@@ -1,3 +1,3 @@
 module Sonar
-  VERSION = "0.1.1.pre"
+  VERSION = "0.1.6"
 end

data/sonar-client.gemspec

@@ -18,11 +18,12 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
-  spec.add_dependency 'faraday_middleware', '~> 0.9.0'
-  spec.add_dependency 'hashie', '~> 2.0.3'
+  spec.add_dependency 'faraday_middleware'
+  spec.add_dependency 'hashie'
   spec.add_dependency 'multi_json'
   spec.add_dependency 'thor'
   spec.add_dependency 'awesome_print'
+  spec.add_dependency 'table_print'
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake"
@@ -30,8 +31,8 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "simplecov"
   spec.add_development_dependency "simplecov-rcov"
   spec.add_development_dependency "yard"
-  spec.add_development_dependency "vcr", '~> 2.8.0'
+  spec.add_development_dependency "vcr", '~> 4.0.0'
   spec.add_development_dependency "shoulda"
-  spec.add_development_dependency "webmock", '~> 1.8.0'
+  spec.add_development_dependency "webmock", '~> 3.5.1'
   spec.add_development_dependency "api_matchers"
 end

data/spec/sonar/cli_spec.rb

@@ -6,9 +6,8 @@ describe Sonar::CLI do
     before do
       Sonar::RCFile.instance.path = "#{fixtures_path}/sonar-stock.rc"
     end
-    it 'warns user of missing config values when trying to search' do
-      output = run_command('search rdns 8.8.8.8')
-      expect(output).to match(/Could not authenticate/)
+    it 'throws an exception because of errors' do
+      expect { run_command('search rdns 8.8.8.8') }.to raise_error(Sonar::Search::SearchError)
     end
   end
 
@@ -17,7 +16,7 @@ describe Sonar::CLI do
       Sonar::RCFile.instance.path = "#{fixtures_path}/sonar.rc"
     end
     it "should return the profile" do
-      output = run_command('profile')
+      output =  run_command('profile')
       expect(output).to match(/email@asdfasdfasfd.com/)
     end
 
@@ -28,11 +27,11 @@ describe Sonar::CLI do
         )
       end
       it 'strips whitespace from values' do
-        output = run_command('search rdns 8.8.8.8')
+        output =  run_command('search rdns 8.8.8.8')
         expect(output).to eq('{"collection":[{"address":"192.168.1.1"}],"more":"false"}')
       end
       it 'can return lines format' do
-        output = run_command('search --format lines rdns 8.8.8.8')
+        output =  run_command('search --format lines rdns 8.8.8.8')
         expect(output).to eq('{"address":"192.168.1.1"}')
       end
     end
@@ -43,7 +42,7 @@ describe Sonar::CLI do
         )
       end
       it 'parses the nested values in an array' do
-        output = run_command('search sslcert 152a0a633aaf13f02c428ac1a3e672e895512bfd')
+        output =  run_command('search sslcert 152a0a633aaf13f02c428ac1a3e672e895512bfd')
         expect(JSON.parse(output)['collection'].first['details'].first['subject']['ST']).to eq('California')
       end
     end
@@ -54,38 +53,61 @@ describe Sonar::CLI do
         )
       end
       xit 'parses the nested value as a string' do
-        output = run_command('search processed 8.8.8.')
+        output =  run_command('search processed 8.8.8.')
         expect(JSON.parse(output)['collection'].first['value']['ip']).to eq('8.8.8.8')
       end
     end
     describe 'searching with #exact --exact option' do
-      context 'client that returns fdns for rapid7 IP exact' do
+      context 'client that returns fdns for rapid7 exact' do
         before do
           allow_any_instance_of(Sonar::Client).to receive(:search).and_return(
-            Sonar::Client.new.search(fdns: '208.118.227.20', exact: true)
+            Sonar::Client.new.search(fdns: 'rapid7.com', exact: true)
           )
         end
         it 'matches exactly with --exact' do
-          output = run_command('search fdns 208.118.227.20 --exact')
+          output =  run_command('search fdns rapid7.com --exact')
           expect(JSON.parse(output)['collection'].size).to be >= 1
-          expect(JSON.parse(output)['collection'].any? { |c| c['name'] == '208.118.227.20' }).to be(true)
+          expect(JSON.parse(output)['collection'].map{ |x| x['name'] }.uniq).to eq ['rapid7.com']
         end
       end
       context 'client that returns fdns for rapid7 IP' do
         before do
           allow_any_instance_of(Sonar::Client).to receive(:search).and_return(
-            Sonar::Client.new.search(fdns: '208.118.227.20')
+            Sonar::Client.new.search(fdns: 'rapid7.com')
           )
         end
-        it 'matches exactly without --exact' do
-          output = run_command('search fdns 208.118.227.20')
-          expect(JSON.parse(output)['collection'].size).to be >  1
+        it 'matches many domains without --exact' do
+          output =  run_command('search fdns rapid7.com')
+          expect(JSON.parse(output)['collection'].map{ |x| x['name'] }.uniq.size).to be >  1
         end
       end
     end
+
+    describe 'sonar types command' do
+      it 'returns all sonar search types' do
+        output = run_command('types')
+        expect(output).to match(/Certificate to IPs/)
+      end
+    end
+
+    describe 'search all command' do
+      before do
+        allow_any_instance_of(Sonar::Client).to receive(:search).and_return(
+          Sonar::Client.new.search(fdns: '208.118.227.20', exact: true)
+        )
+      end
+      it 'returns results when searching for an IP' do
+        output = run_command('search all 208.118.227.20')
+        expect(output).to match(/rapid7\.com/)
+      end
+      it 'returns results when searching for a domain' do
+        output = run_command('search all rapid7.com')
+        expect(output).to match(/208\.118\.227\.20/)
+      end
+    end
   end
 
   def run_command(args)
-    capture(:stdout) { Sonar::CLI.start(args.split) }.strip
+    capture(:stdout) { ret = Sonar::CLI.start(args.split) }.strip
   end
 end

data/spec/sonar/search_spec.rb

@@ -2,8 +2,29 @@
 require 'spec_helper'
 
 describe Sonar::Search do
+  let(:dummy_class) {
+    Class.new { extend Sonar::Search }
+  }
   let(:client) { Sonar::Client.new }
 
+  describe "#ip_search_type_names" do
+    it 'includes rdns' do
+      expect(dummy_class.ip_search_type_names).to include('rdns')
+    end
+    it 'does not include fdns' do
+      expect(dummy_class.ip_search_type_names).to_not include('fdns')
+    end
+  end
+
+  describe "#domain_search_type_names" do
+    it 'includes fdns' do
+      expect(dummy_class.domain_search_type_names).to include('fdns')
+    end
+    it 'does not include rdns' do
+      expect(dummy_class.domain_search_type_names).to_not include('rdns')
+    end
+  end
+
   describe "parameters" do
     describe "query type" do
       context "with an invalid query type" do
@@ -15,12 +36,12 @@ describe Sonar::Search do
 
     describe "exact" do
       it "shouldn't match anything when #exact is true" do
-        resp = client.search(rdns: "1.1.", exact: true)
+        resp = client.search(fdns: ".rapid7.com", exact: true)
         expect(resp["collection"].size).to eq(0)
       end
       it "should match when #exact is false" do
-        resp = client.search(rdns: "1.1.", exact: false)
-        expect(resp["collection"].first["address"]).to match(/^1.1./)
+        resp = client.search(fdns: ".rapid7.com", exact: false)
+        expect(resp["collection"].size).to be > 0
       end
     end
 
@@ -89,16 +110,16 @@ describe Sonar::Search do
       it "returns hashie response of search" do
         expect(resp.class).to eq(Hashie::Mash)
       end
-      it "finds fdnsname 208.118.227.10 for rapid7.com" do
-        expect(resp['collection'].any? { |x| x['address'] == '208.118.227.10' }).to be(true)
+      it "finds fdnsname multiple IP addresses for rapid7.com" do
+        expect(resp['collection'].select { |x| x['address'] }.size).to be >= 2
       end
     end
 
     context "fdnsip" do
       let(:resp) { client.search(fdns: '208.118.227.10') }
 
-      it "finds fdnsip rapid7.com at 208.118.227.10" do
-        expect(resp['collection'].any? { |x| x['address'].match('rapid7') }).to be(true)
+      it "finds fdnsip rapid7 domains at 208.118.227.10" do
+        expect(resp['collection'].any? { |x| x['address'].match('rapidseven') }).to be(true)
       end
     end
 
@@ -152,14 +173,6 @@ describe Sonar::Search do
     end
   end
 
-  context "whois_ip" do
-    let(:resp) { client.search(whois_ip: '208.118.227.10') }
-
-    xit "should find rapid7.com" do
-      expect(resp['name']).to eq('TWDX-208-118-227-0-1')
-    end
-  end
-
   # TODO: actually check response
   context "raw" do
     let(:resp) { client.search(raw: '208.118.227.10') }

metadata

@@ -1,43 +1,43 @@
 --- !ruby/object:Gem::Specification
 name: sonar-client
 version: !ruby/object:Gem::Version
-  version: 0.1.1.pre
+  version: 0.1.6
 platform: ruby
 authors:
 - Paul Deardorff & HD Moore
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-12 00:00:00.000000000 Z
+date: 2020-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday_middleware
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.0
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.0
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: hashie
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.3
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.3
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: multi_json
   requirement: !ruby/object:Gem::Requirement
@@ -80,6 +80,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: table_print
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -170,14 +184,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.8.0
+        version: 4.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.8.0
+        version: 4.0.0
 - !ruby/object:Gem::Dependency
   name: shoulda
   requirement: !ruby/object:Gem::Requirement
@@ -198,14 +212,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: 3.5.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: 3.5.1
 - !ruby/object:Gem::Dependency
   name: api_matchers
   requirement: !ruby/object:Gem::Requirement
@@ -275,12 +289,12 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.3
+rubygems_version: 2.7.9
 signing_key: 
 specification_version: 4
 summary: API Wrapper for Sonar
@@ -296,4 +310,3 @@ test_files:
 - spec/sonar/user_spec.rb
 - spec/sonar_spec.rb
 - spec/spec_helper.rb
-has_rdoc: