misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/vulners.py

@@ -0,0 +1,81 @@
+import json
+import vulners
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['vulnerability'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Igor Ivanov',
+    'description': 'An expansion hover module to expand information about CVE id using Vulners API.',
+    'module-type': ['hover'],
+    'name': 'Vulners Lookup',
+    'logo': 'vulners.png',
+    'requirements': ['Vulners python library', 'An access to the Vulners API'],
+    'features': 'This module takes a vulnerability attribute as input and queries the Vulners API in order to get some additional data about it.\n\nThe API then returns details about the vulnerability.',
+    'references': ['https://vulners.com/'],
+    'input': 'A vulnerability attribute.',
+    'output': 'Text giving additional information about the CVE in input.',
+}
+
+# Get API key from https://vulners.com/userinfo
+moduleconfig = ["apikey"]
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('vulnerability'):
+        misperrors['error'] = 'Vulnerability id missing'
+        return misperrors
+
+    ai_summary = ''
+    exploit_summary = ''
+    vuln_summary = ''
+
+    if not request.get('config') or not request['config'].get('apikey'):
+        return {'error': "A Vulners api key is required for this module."}
+
+    key = request['config']['apikey']
+    vulners_api = vulners.Vulners(api_key=key)
+    vulnerability = request.get('vulnerability')
+    vulners_document = vulners_api.document(vulnerability)
+
+    # Get AI scoring from the document if it's already calculated
+    # There is no need to call AI Scoring method
+    if 'score' in vulners_document.get('enchantments', {}):
+        vulners_ai_score = vulners_document['enchantments']['score']['value']
+    else:
+        vulners_ai_score = vulners_api.get_ai_score(vulnerability)
+        if len(vulners_ai_score) == 2:
+            vulners_ai_score = vulners_ai_score[0]
+
+    vulners_exploits = vulners_api.searchExploit(vulnerability)
+
+    if vulners_document:
+        vuln_summary += vulners_document.get('description')
+    else:
+        vuln_summary += 'Non existing CVE'
+
+    if vulners_ai_score:
+        ai_summary += 'Vulners AI Score is ' + str(vulners_ai_score) + " "
+
+    if vulners_exploits:
+        exploit_summary += " ||  " + str(len(vulners_exploits)) + " Public exploits available:\n  "
+        for exploit in vulners_exploits:
+            exploit_summary += exploit['title'] + " " + exploit['href'] + "\n  "
+        exploit_summary += "|| Vulnerability Description:  " + vuln_summary
+
+    summary = ai_summary + exploit_summary + vuln_summary
+
+    r = {'results': [{'types': mispattributes['output'], 'values': summary}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/vysion.py

@@ -0,0 +1,221 @@
+import json
+from pymisp import MISPAttribute, MISPEvent
+from urllib.parse import urlparse
+
+import logging
+
+import vysion.client as vysion
+
+import vysion.dto as dto
+from vysion.dto.util import MISPProcessor
+from . import standard_error_message
+
+misperrors = {"error": "Error"}
+mispattributes = {
+    "input": [
+        "email",
+        "domain",
+        "hostname",
+        "url",
+        "text",
+        "btc",
+        "phone-number",
+        "target-org",
+        "xmr",
+        "dash",
+    ],
+    "format": "misp_standard",
+}
+
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '1',
+    'author': 'Byron Labs',
+    'description': 'Module to enrich the information by making use of the Vysion API.',
+    'module-type': ['expansion'],
+    'name': 'Vysion Enrich',
+    'logo': 'vysion.png',
+    'requirements': ['Vysion python library', 'Vysion API Key'],
+    'features': "This module gets correlated information from Byron Labs' dark web intelligence database. With this you will get several objects containing information related to, for example, an organization victim of a ransomware attack.",
+    'references': ['https://vysion.ai/', 'https://developers.vysion.ai/', 'https://github.com/ByronLabs/vysion-cti/tree/main'],
+    'input': 'company(target-org), country, info, BTC, XMR and DASH address.',
+    'output': 'MISP objects containing title, link to our webapp and TOR, i2p or clearnet URLs.',
+}
+
+# config fields that your code expects from the site admin
+moduleconfig = [
+    "apikey",
+    "event_limit",
+    "proxy_host",
+    "proxy_port",
+    "proxy_username",
+    "proxy_password",
+]
+
+LOGGER = logging.getLogger("vysion")
+LOGGER.setLevel(logging.INFO)
+LOGGER.debug("Starting Vysion")
+
+DEFAULT_RESULTS_LIMIT = 10
+
+
+def get_proxy_settings(config: dict) -> dict:
+    """Returns proxy settings in the requests format.
+    If no proxy settings are set, return None."""
+    proxies = None
+    host = config.get("proxy_host")
+    port = config.get("proxy_port")
+    username = config.get("proxy_username")
+    password = config.get("proxy_password")
+
+    if host:
+        if not port:
+            misperrors["error"] = (
+                "The vysion_proxy_host config is set, "
+                "please also set the vysion_proxy_port."
+            )
+            raise KeyError
+        parsed = urlparse(host)
+        if "http" in parsed.scheme:
+            scheme = "http"
+        else:
+            scheme = parsed.scheme
+        netloc = parsed.netloc
+        host = f"{netloc}:{port}"
+
+        if username:
+            if not password:
+                misperrors["error"] = (
+                    "The vysion_proxy_username config is set, "
+                    "please also set the vysion_proxy_password."
+                )
+                raise KeyError
+            auth = f"{username}:{password}"
+            host = auth + "@" + host
+
+        proxies = {"http": f"{scheme}://{host}", "https": f"{scheme}://{host}"}
+    return proxies
+
+
+def parse_error(status_code: int) -> str:
+
+    status_mapping = {
+        500: "Vysion is blind.",
+        400: "Incorrect request, please check the arguments.",
+        403: "You don't have enough privileges to make the request.",
+    }
+
+    if status_code in status_mapping:
+        return status_mapping[status_code]
+
+    return "Vysion may not be accessible."
+
+
+def handler(q=False):
+
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    if not request.get("config") or not request["config"].get("apikey"):
+        misperrors["error"] = "A Vysion api key is required for this module."
+        return misperrors
+
+    if not request.get("attribute"):
+        return {
+            "error": f"{standard_error_message}, which should contain at least a type, a value and an uuid."
+        }
+
+    if request["attribute"]["type"] not in mispattributes["input"]:
+        return {"error": "Unsupported attribute type."}
+
+    # event_limit = request["config"].get("event_limit")
+    attribute = request["attribute"]
+    proxy_settings = get_proxy_settings(request.get("config"))
+
+    try:
+
+        client = vysion.Client(
+            api_key=request["config"]["apikey"],
+            headers={
+                "x-tool": "MISPModuleVysionExpansion",
+            },
+            proxy=proxy_settings["http"] if proxy_settings else None,
+        )
+
+        LOGGER.debug(attribute)
+
+        misp_attribute = MISPAttribute()
+        misp_attribute.from_dict(**attribute)
+
+        attribute_type = misp_attribute.type
+        attribute_value = misp_attribute.value
+
+        # https://www.misp-project.org/datamodels/#types
+
+        LOGGER.debug(attribute_type)
+
+        result = None
+
+        if attribute_type == "email":
+            result = client.find_email(attribute_value)
+        elif attribute_type == "domain":
+            result = client.find_url(attribute_value)
+        elif attribute_type == "url":
+            result = client.find_url(attribute_value)
+        elif attribute_type == "text":
+            result = client.search(attribute_value)
+        elif attribute_type == "target-org":
+            result = client.search(attribute_value)
+        elif attribute_type == "phone-number":
+            result = client.search(attribute_value)
+        elif attribute_type == "btc":
+            result = client.find_wallet("BTC",attribute_value)
+        elif attribute_type == "xmr":
+            result = client.find_wallet("XMR",attribute_value)
+        elif attribute_type == "dash":
+            result = client.find_wallet("DASH",attribute_value)
+
+        if result is None:
+            return {"results": {}}
+
+        p = MISPProcessor()
+        misp_event: MISPEvent = p.process(result, ref_attribute=misp_attribute)
+
+        LOGGER.info("Vysion client initialized")
+
+        LOGGER.info("Vysion result obtained")
+
+        return {
+            "results": {
+                "Object": [
+                    json.loads(object.to_json()) for object in misp_event.objects
+                ],
+                "Attribute": [
+                    json.loads(attribute.to_json())
+                    for attribute in misp_event.attributes
+                ],
+                "Tag": [
+                    json.loads(tag.to_json())
+                    for tag in misp_event.tags
+                ]
+            }
+        }
+
+    except vysion.APIError as ex:
+
+        LOGGER.error("Error in Vysion")
+        LOGGER.error(ex)
+
+        misperrors["error"] = ex.message
+        return misperrors
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo["config"] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/whois.py

@@ -0,0 +1,72 @@
+# -*- coding: utf-8 -*-
+
+import json
+import socket
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['domain', 'ip-src', 'ip-dst'], 'output': ['freetext']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Raphaël Vinot',
+    'description': 'Module to query a local instance of uwhois (https://github.com/rafiot/uwhoisd).',
+    'module-type': ['expansion'],
+    'name': 'Whois Lookup',
+    'logo': '',
+    'requirements': ['uwhois: A whois python library'],
+    'features': "This module takes a domain or IP address attribute as input and queries a 'Univseral Whois proxy server' to get the correct details of the Whois query on the input value (check the references for more details about this whois server).",
+    'references': ['https://github.com/Lookyloo/uwhoisd'],
+    'input': 'A domain or IP address attribute.',
+    'output': 'Text describing the result of a whois request for the input value.',
+}
+
+moduleconfig = ['server', 'port']
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if request.get('domain'):
+        toquery = request['domain']
+    elif request.get('ip-src'):
+        toquery = request['ip-src']
+    elif request.get('ip-dst'):
+        toquery = request['ip-dst']
+    else:
+        misperrors['error'] = "Unsupported attributes type"
+        return misperrors
+
+    if not request.get('config') or (
+        not request['config'].get('server') and not request['config'].get('port')
+    ):
+        misperrors['error'] = 'Whois local instance address is missing'
+        return misperrors
+
+    if 'event_id' in request:
+        return handle_expansion(
+            request['config']['server'], int(request['config']['port']), toquery
+        )
+
+
+def handle_expansion(server, port, query):
+    bytes_whois = b''
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.connect((server, port))
+        sock.sendall(f'{query}\n'.encode())
+        while True:
+            data = sock.recv(2048)
+            if not data:
+                break
+            bytes_whois += data
+    return {
+        'results': [{'types': mispattributes['output'], 'values': bytes_whois.decode()}]
+    }
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/whoisfreaks.py

@@ -0,0 +1,232 @@
+import json
+
+import requests
+
+misperrors = {'error': 'Error'}
+mispattributes = {
+    'input': ['domain'],
+    'output': ['domain', 'dns-soa-email',
+               'whois-registrant-email', 'whois-registrant-phone',
+               'whois-registrant-name',
+               'whois-registrar', 'whois-creation-date', 'domain']
+}
+moduleinfo = {
+    'version': '1',
+    'author': 'WhoisFreaks',
+    'description': 'An expansion module for https://whoisfreaks.com/ that will provide an enriched analysis of the provided domain, including WHOIS and DNS information.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'WhoisFreaks Lookup',
+    'logo': 'whoisfreaks.png',
+    'requirements': ['An access to the Whoisfreaks API_KEY'],
+    'features': 'The module takes a domain as input and queries the Whoisfreaks API with it.\n\nSome parsing operations are then processed on the result of the query to extract as much information as possible.\n\nAfter this we map the extracted data to MISP attributes.',
+    'references': ['https://whoisfreaks.com/'],
+    'input': 'A domain whose Data is required',
+    'output': 'MISP attributes resulting from the query on Whoisfreaks API, included in the following list:\n- domain\n- dns-soa-email\n- whois-registrant-email\n- whois-registrant-phone\n- whois-registrant-name\n- whois-registrar\n- whois-creation-date\n- domain',
+}
+
+# config fields that your code expects from the site admin
+moduleconfig = ['apikey']
+
+
+def handler(q=False):
+    if q:
+
+        request = json.loads(q)
+
+        if 'config' not in request or (not (request['config'].get('apikey') or ('apiKey' in request['config']))):
+            misperrors['error'] = 'WhoisFreaks authentication is missing' + request
+            return misperrors
+
+        apiKey = request['config'].get('apikey')
+
+        if request.get('domain'):
+            domain = request['domain']
+            return handle_domain(apiKey, domain, misperrors)
+        else:
+            misperrors['error'] = "Unsupported attributes types"
+            return misperrors
+    else:
+        return False
+
+
+def handle_domain(apiKey, domain, errors):
+    result_filtered = {"results": []}
+    r, status_ok = expand_whois(apiKey, domain)
+    if status_ok:
+        if r:
+            result_filtered['results'].extend(r)
+
+    r, status_ok = expand_dns(apiKey, domain)
+    if status_ok:
+        if r:
+            result_filtered['results'].extend(r)
+
+    return result_filtered
+
+
+def expand_whois(apiKey, domain):
+    r = []
+    ns_servers = []
+    status_ok = False
+
+    try:
+        results = get_whois_response(domain, apiKey)
+
+        if results:
+            status_ok = True
+
+            if 'create_date' in results:
+                r.append(
+                    {
+                        'types': ['whois-creation-date'],
+                        'values': [results['create_date']],
+                        'categories': ['Attribution'],
+                        'comment': 'Creation Date for %s by whoisFreaks'
+                                   % domain
+
+                    }
+                )
+
+            if 'domain_registrar' in results:
+                if 'registrar_name' in results['domain_registrar']:
+                    r.append(
+                        {
+                            'types': ['whois-registrant-name'],
+                            'values': [results['domain_registrar']['registrar_name']],
+                            'categories': ['Attribution'],
+                            'comment': 'Whois information of %s by whoisFreaks'
+                                       % domain
+                        }
+                    )
+                if 'email_address' in results['domain_registrar']:
+                    r.append(
+                        {
+                            'types': ['whois-registrant-email'],
+                            'values': [results['domain_registrar']['email_address']],
+                            'categories': ['Attribution'],
+                            'comment': 'Whois information of %s by whoisFreaks'
+                                       % domain
+                        }
+                    )
+
+                if 'phone_number' in results['domain_registrar']:
+                    r.append(
+                        {
+                            'types': ['whois-registrant-email'],
+                            'values': [results['domain_registrar']['phone_number']],
+                            'categories': ['Attribution'],
+                            'comment': 'Whois information of %s by whoisFreaks'
+                                       % domain
+                        }
+                    )
+
+            if 'name_servers' in results:
+                ns_servers = results['name_servers']
+                r.append(
+                    {
+                        'types': ['domain'],
+                        'values': ns_servers,
+                        'categories': ['Attribution'],
+                        'comment': 'Name server for %s by whoisFreaks'
+                                   % domain
+
+                    }
+                )
+
+    except Exception:
+        misperrors['error'] = "Error while processing Whois Data"
+        return [], False
+
+    return r, status_ok
+
+
+def expand_dns(apiKey, domain):
+    r = []
+    status_ok = False
+    list_ipv4 = []
+    list_ipv6 = []
+    servers_mx = []
+    soa_hostnames = []
+
+    try:
+        results = get_dns_response(domain, apiKey)
+
+        if results:
+            status_ok = True
+
+            if 'dnsRecords' in results:
+                dns_records = results['dnsRecords']
+
+            for record in dns_records:
+                if record['dnsType'] == 'A':
+                    list_ipv4.append(record['address'])
+                elif record['dnsType'] == 'AAAA':
+                    list_ipv6.append(record['address'])
+                elif record['dnsType'] == 'MX':
+                    servers_mx.append(record['target'])
+                elif record['dnsType'] == 'SOA':
+                    soa_hostnames.append(record['host'])
+
+            if list_ipv4:
+                r.append({'types': ['domain|ip'],
+                          'values': ['%s|%s' % (domain, ipv4) for ipv4 in
+                                    list_ipv4],
+                          'categories': ['Network activity'],
+                                  'comment': 'ipv4 of %s ' %
+                                    domain
+                                  })
+            if list_ipv6:
+                r.append({'types': ['domain|ip'],
+                          'values': ['%s|%s' % (domain, ipv6) for ipv6 in
+                                    list_ipv6],
+                          'categories': ['Network activity'],
+                          'comment': 'ipv6 of %s' %
+                                    domain
+                          })
+
+            if servers_mx:
+                r.append({'types': ['domain'],
+                          'values': servers_mx,
+                          'categories': ['Network activity'],
+                          'comment': 'mx of %s' %
+                                    domain
+                          })
+            if soa_hostnames:
+                r.append({'types': ['domain'],
+                          'values': soa_hostnames,
+                          'categories': ['Network activity'],
+                          'comment': 'soa hostname of %s' %
+                                    domain
+                          })
+
+
+    except Exception:
+        misperrors['error'] = "Error while processing Whois Data"
+        return [], False
+
+    return r, status_ok
+
+
+def get_whois_response(domain, apiKey):
+    query = requests.get(
+        f"https://api.whoisfreaks.com/v1.0/whois?apiKey={apiKey}&whois=live&domainName={domain}"
+    )
+    if query.status_code != 200 and query.status_code != 206:
+        return {'error': f'Error while querying whoisfreaks.com - {query.status_code}: {query.reason}'}
+    return query.json()
+
+
+def get_dns_response(domain, apiKey):
+    query = requests.get(
+        f"https://api.whoisfreaks.com/v1.0/dns/live?apiKey={apiKey}&domainName={domain}&type=SOA,AAAA,A,MX"
+    )
+    if query.status_code != 200 and query.status_code != 206:
+        return {'error': f'Error while querying whoisfreaks.com - {query.status_code}: {query.reason}'}
+    return query.json()
+
+def introspection():
+    return mispattributes
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/wiki.py

@@ -0,0 +1,58 @@
+import json
+from SPARQLWrapper import SPARQLWrapper, JSON
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['text'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.2',
+    'author': 'Roman Graf',
+    'description': 'An expansion hover module to extract information from Wikidata to have additional information about particular term for analysis.',
+    'module-type': ['hover'],
+    'name': 'Wikidata Lookup',
+    'logo': 'wikidata.png',
+    'requirements': ['SPARQLWrapper python library'],
+    'features': 'This module takes a text attribute as input and queries the Wikidata API. If the text attribute is clear enough to define a specific term, the API returns a wikidata link in response.',
+    'references': ['https://www.wikidata.org'],
+    'input': 'Text attribute.',
+    'output': 'Text attribute.',
+}
+moduleconfig = []
+# sample query text 'Microsoft' should provide Wikidata link https://www.wikidata.org/wiki/Q2283 in response
+wiki_api_url = 'https://query.wikidata.org/bigdata/namespace/wdq/sparql'
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('text'):
+        misperrors['error'] = 'Query text missing'
+        return misperrors
+
+    sparql = SPARQLWrapper(wiki_api_url, agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36')
+    query_string = \
+        "SELECT ?item \n" \
+        "WHERE { \n" \
+        "?item rdfs:label\"" + request.get('text') + "\" @en \n" \
+        "}\n"
+    sparql.setQuery(query_string)
+    sparql.setReturnFormat(JSON)
+    results = sparql.query().convert()
+    try:
+        result = results["results"]["bindings"]
+        summary = result[0]["item"]["value"] if result else 'No additional data found on Wikidata'
+    except Exception as e:
+        misperrors['error'] = 'wikidata API not accessible {}'.format(e)
+        return misperrors['error']
+
+    r = {'results': [{'types': mispattributes['output'], 'values': summary}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo