moriarty-project 0.1.6__py3-none-any.whl

moriarty/cli/intelligence.py

@@ -0,0 +1,329 @@
+"""Comandos para gerenciamento de inteligência local."""
+from pathlib import Path
+from typing import List, Optional, Dict, Any
+
+import typer
+from rich.console import Console
+from rich.table import Table
+from rich.progress import Progress, SpinnerColumn, TextColumn
+
+from moriarty.data import (
+    get_local_intelligence,
+    IOC, IOCType, ThreatType,
+    load_iocs_from_file, save_iocs_to_file
+)
+
+app = typer.Typer(name="intel", help="🔍 Gerenciamento de inteligência local")
+console = Console()
+
+# Tipos de IOC suportados para autocompletar
+IOC_TYPES = [t.value for t in IOCType]
+THREAT_TYPES = [t.value for t in ThreatType]
+
+# Configuração
+DEFAULT_DATA_DIR = Path("~/.moriarty/data").expanduser()
+
+def _get_intel():
+    """Retorna uma instância de LocalIntelligence."""
+    return get_local_intelligence()
+
+@app.command("add")
+def add_ioc(
+    value: str = typer.Argument(..., help="Valor do IOC"),
+    ioc_type: str = typer.Argument(..., help=f"Tipo do IOC: {', '.join(IOC_TYPES)}", 
+                                 autocompletion=lambda: IOC_TYPES),
+    threat_type: str = typer.Option("unknown", "--threat", "-t", 
+                                  help=f"Tipo de ameaça: {', '.join(THREAT_TYPES)}",
+                                  autocompletion=lambda: THREAT_TYPES),
+    source: str = typer.Option("manual", "--source", "-s", 
+                             help="Fonte da informação"),
+    confidence: int = typer.Option(50, "--confidence", "-c", 
+                                 min=0, max=100, 
+                                 help="Nível de confiança (0-100)"),
+    tags: str = typer.Option("", "--tags", help="Tags separadas por vírgula"),
+    notes: str = typer.Option("", "--notes", "-n", help="Notas adicionais"),
+):
+    """Adiciona um novo IOC à base de inteligência local."""
+    try:
+        # Valida o tipo de IOC
+        ioc_type_enum = IOCType(ioc_type.lower())
+        threat_type_enum = ThreatType(threat_type.lower())
+        
+        # Cria o IOC
+        ioc = IOC(
+            value=value,
+            ioc_type=ioc_type_enum,
+            threat_type=threat_type_enum,
+            source=source,
+            confidence=confidence,
+            tags=[t.strip() for t in tags.split(",") if t.strip()],
+            metadata={"notes": notes} if notes else {}
+        )
+        
+        # Adiciona ao sistema
+        intel = _get_intel()
+        if intel.add_ioc(ioc):
+            console.print(f"✅ [green]IOC adicionado com sucesso![/green]")
+            _display_ioc(ioc)
+        else:
+            console.print("[red]❌ Falha ao adicionar IOC.[/red]")
+            
+    except ValueError as e:
+        console.print(f"[red]❌ Erro: {str(e)}[/red]")
+        raise typer.Exit(1)
+
+@app.command("search")
+def search_iocs(
+    query: str = typer.Argument(..., help="Termo de busca"),
+    limit: int = typer.Option(20, "--limit", "-l", help="Número máximo de resultados"),
+    output: Optional[Path] = typer.Option(None, "--output", "-o", help="Arquivo de saída"),
+    format: str = typer.Option("table", "--format", "-f", 
+                             help="Formato de saída: table, json, yaml, csv")
+):
+    """Busca IOCs na base de inteligência local."""
+    intel = _get_intel()
+    
+    with Progress(
+        SpinnerColumn(),
+        TextColumn("[progress.description]{task.description}"),
+        transient=True,
+    ) as progress:
+        progress.add_task(description="Buscando IOCs...", total=None)
+        results = intel.search_iocs(query, limit=limit)
+    
+    if not results:
+        console.print("[yellow]Nenhum IOC encontrado.[/yellow]")
+        return
+    
+    # Formata a saída
+    if output:
+        _export_results(results, output, format)
+        console.print(f"✅ Resultados exportados para [cyan]{output}[/cyan]")
+    else:
+        if format == "table":
+            _display_iocs_table(results)
+        else:
+            _export_results(results, None, format)
+
+@app.command("get")
+def get_ioc(
+    ioc_type: str = typer.Argument(..., help=f"Tipo do IOC: {', '.join(IOC_TYPES)}",
+                                 autocompletion=lambda: IOC_TYPES),
+    value: str = typer.Argument(..., help="Valor do IOC"),
+):
+    """Obtém detalhes de um IOC específico."""
+    intel = _get_intel()
+    
+    try:
+        ioc = intel.get_ioc(ioc_type, value)
+        if not ioc:
+            console.print("[yellow]IOC não encontrado.[/yellow]")
+            return
+            
+        _display_ioc(ioc)
+        
+        # Mostra IOCs relacionados
+        related = intel.get_related_iocs(ioc)
+        if any(related.values()):
+            console.print("\n[bold]Relacionados:[/bold]")
+            for rel_type, items in related.items():
+                if items:
+                    console.print(f"  [cyan]{rel_type.title()}:[/cyan]")
+                    for item in items[:3]:  # Mostra no máximo 3 itens por categoria
+                        console.print(f"    • {item.value} ([yellow]{item.threat_type.value}[/yellow])")
+    except ValueError as e:
+        console.print(f"[red]❌ Erro: {str(e)}[/red]")
+        raise typer.Exit(1)
+
+@app.command("import")
+def import_iocs(
+    file_path: Path = typer.Argument(..., help="Arquivo para importar"),
+    format: str = typer.Option("auto", "--format", "-f", 
+                             help="Formato do arquivo: auto, json, yaml, csv"),
+):
+    """Importa IOCs de um arquivo."""
+    if not file_path.exists():
+        console.print(f"[red]❌ Arquivo não encontrado: {file_path}[/red]")
+        raise typer.Exit(1)
+    
+    try:
+        intel = _get_intel()
+        count = intel.import_iocs(file_path, format)
+        console.print(f"✅ [green]Importados {count} IOCs com sucesso![/green]")
+    except Exception as e:
+        console.print(f"[red]❌ Erro ao importar IOCs: {str(e)}[/red]")
+        raise typer.Exit(1)
+
+@app.command("export")
+def export_iocs(
+    output_file: Path = typer.Argument(..., help="Arquivo de saída"),
+    format: str = typer.Option("json", "--format", "-f", 
+                             help="Formato de saída: json, yaml, csv"),
+    query: Optional[str] = typer.Option(None, "--query", "-q", 
+                                      help="Filtrar IOCs por termo"),
+):
+    """Exporta IOCs para um arquivo."""
+    try:
+        intel = _get_intel()
+        
+        if query:
+            # Exporta apenas os IOCs que correspondem à consulta
+            iocs = intel.search_iocs(query, limit=1000)  # Limite razoável
+            if not iocs:
+                console.print("[yellow]Nenhum IOC encontrado para exportar.[/yellow]")
+                return
+                
+            # Converte para dicionários
+            ioc_dicts = [ioc.to_dict() for ioc in iocs]
+            
+            # Salva no formato especificado
+            save_iocs_to_file(ioc_dicts, output_file, format)
+        else:
+            # Exporta todos os IOCs
+            intel.export_iocs(output_file, format)
+            
+        console.print(f"✅ [green]IOCs exportados para [cyan]{output_file}[/cyan] no formato {format.upper()}[/green]")
+        
+    except Exception as e:
+        console.print(f"[red]❌ Erro ao exportar IOCs: {str(e)}[/red]")
+        raise typer.Exit(1)
+
+@app.command("update")
+def update_signatures(
+    force: bool = typer.Option(False, "--force", "-f", 
+                             help="Forçar atualização mesmo se não for necessário")
+):
+    """Atualiza as assinaturas de ameaças a partir das fontes configuradas."""
+    with Progress(
+        SpinnerColumn(),
+        TextColumn("[progress.description]{task.description}"),
+        transient=True,
+    ) as progress:
+        progress.add_task(description="Atualizando assinaturas...", total=None)
+        
+        try:
+            intel = _get_intel()
+            updated = intel.update_signatures(force=force)
+            
+            if updated:
+                console.print("✅ [green]Assinaturas atualizadas com sucesso![/green]")
+            else:
+                console.print("ℹ️  [yellow]As assinaturas já estão atualizadas.[/yellow]")
+                
+        except Exception as e:
+            console.print(f"[red]❌ Erro ao atualizar assinaturas: {str(e)}[/red]")
+            raise typer.Exit(1)
+
+def _display_ioc(ioc: IOC):
+    """Exibe os detalhes de um IOC formatado."""
+    from rich.panel import Panel
+    from rich.text import Text
+    from rich.syntax import Syntax
+    
+    # Cabeçalho com tipo e valor
+    header = Text()
+    header.append(f"{ioc.ioc_type.value.upper()}: ", style="bold")
+    header.append(ioc.value, style="bold green")
+    
+    # Detalhes
+    details = []
+    details.append(f"[cyan]Ameaça:[/cyan] [yellow]{ioc.threat_type.value}[/yellow]")
+    details.append(f"[cyan]Fonte:[/cyan] {ioc.source}")
+    details.append(f"[cyan]Confiança:[/cyan] {ioc.confidence}/100")
+    
+    if ioc.tags:
+        tags = ", ".join(f"[yellow]{t}[/yellow]" for t in ioc.tags)
+        details.append(f"[cyan]Tags:[/cyan] {tags}")
+    
+    if ioc.first_seen:
+        details.append(f"[cyan]Primeira vez visto:[/cyan] {ioc.first_seen}")
+    
+    if ioc.last_seen:
+        details.append(f"[cyan]Última vez visto:[/cyan] {ioc.last_seen}")
+    
+    # Metadados adicionais
+    if ioc.metadata:
+        details.append("\n[bold]Metadados:[/bold]")
+        for k, v in ioc.metadata.items():
+            details.append(f"  [cyan]{k}:[/cyan] {v}")
+    
+    # Cria o painel
+    panel = Panel(
+        "\n".join(details),
+        title=header,
+        border_style="blue",
+        expand=False
+    )
+    
+    console.print(panel)
+
+def _display_iocs_table(iocs: List[IOC]):
+    """Exibe uma tabela com múltiplos IOCs."""
+    from rich.table import Table
+    
+    table = Table(show_header=True, header_style="bold magenta")
+    table.add_column("Tipo", style="cyan")
+    table.add_column("Valor", style="green")
+    table.add_column("Ameaça", style="yellow")
+    table.add_column("Fonte")
+    table.add_column("Confiança", justify="right")
+    table.add_column("Tags")
+    
+    for ioc in iocs:
+        table.add_row(
+            ioc.ioc_type.value.upper(),
+            ioc.value,
+            ioc.threat_type.value,
+            ioc.source,
+            str(ioc.confidence),
+            ", ".join(ioc.tags) if ioc.tags else ""
+        )
+    
+    console.print(table)
+
+def _export_results(iocs: List[IOC], output: Optional[Path] = None, 
+                  format: str = "table") -> str:
+    """Exporta os resultados para o formato especificado."""
+    import json
+    import yaml
+    import csv
+    from io import StringIO
+    
+    # Converte para dicionários
+    ioc_dicts = [ioc.to_dict() for ioc in iocs]
+    
+    if format == "json":
+        result = json.dumps({"iocs": ioc_dicts}, indent=2, ensure_ascii=False)
+    elif format in ("yaml", "yml"):
+        result = yaml.safe_dump({"iocs": ioc_dicts}, allow_unicode=True)
+    elif format == "csv":
+        if not ioc_dicts:
+            return ""
+            
+        # Extrai todos os campos possíveis
+        all_fields = set()
+        for ioc in ioc_dicts:
+            all_fields.update(ioc.keys())
+        
+        fieldnames = sorted(all_fields)
+        
+        # Escreve para uma string
+        output = StringIO()
+        writer = csv.DictWriter(output, fieldnames=fieldnames)
+        writer.writeheader()
+        writer.writerows(ioc_dicts)
+        result = output.getvalue()
+    else:
+        raise ValueError(f"Formato não suportado: {format}")
+    
+    # Se um arquivo de saída for especificado, salva nele
+    if output:
+        with open(output, 'w', encoding='utf-8') as f:
+            f.write(result)
+    
+    return result
+
+# Adiciona o comando ao grupo principal
+def register_app(main_app):
+    """Registra os comandos de inteligência na aplicação principal."""
+    main_app.add_typer(app, name="intel", help="🔍 Comandos de inteligência local")

moriarty/cli/output.py

@@ -0,0 +1,62 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+import typer
+from rich.console import Console
+
+from .state import CLIState, GlobalOptions
+
+console = Console()
+
+try:
+    import orjson  # type: ignore
+except ModuleNotFoundError:  # pragma: no cover
+    import json
+
+    def _dumps(data: Any) -> bytes:
+        return json.dumps(data, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+else:
+    def _dumps(data: Any) -> bytes:
+        return orjson.dumps(data, option=orjson.OPT_INDENT_2)  # type: ignore[attr-defined]
+
+
+try:
+    import yaml
+except ModuleNotFoundError:  # pragma: no cover
+    yaml = None  # type: ignore
+
+
+def ensure_state(ctx: typer.Context) -> CLIState:
+    obj = ctx.obj
+    if isinstance(obj, CLIState):
+        return obj
+    state = CLIState(options=GlobalOptions())
+    ctx.obj = state
+    return state
+
+
+def emit_json(payload: Dict[str, Any], target: Optional[str], fallback: Optional[str]) -> None:
+    destination = target or fallback
+    data = _dumps(payload)
+    if destination in (None, "-"):
+        console.print_json(data=data.decode("utf-8"))
+    else:
+        Path(destination).write_bytes(data)
+        console.print(f"[success]JSON escrito em {destination}")
+
+
+def emit_yaml(payload: Dict[str, Any], target: Optional[str], fallback: Optional[str]) -> None:
+    if yaml is None:
+        raise typer.BadParameter("PyYAML é necessário para saída YAML, instale a dependência.")
+    destination = target or fallback
+    data = yaml.safe_dump(payload, sort_keys=False)
+    if destination in (None, "-"):
+        console.print(data)
+    else:
+        Path(destination).write_text(data, encoding="utf-8")
+        console.print(f"[success]YAML escrito em {destination}")
+
+
+__all__ = ["console", "ensure_state", "emit_json", "emit_yaml"]

moriarty/cli/rdap.py

@@ -0,0 +1,94 @@
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+import typer
+from rich import box
+from rich.table import Table
+
+from .async_utils import run_async
+from .output import console, emit_json, emit_yaml, ensure_state
+from ..modules.orchestrator import Orchestrator
+from ..modules.rdap import RDAPResult, RDAPService
+from ..net.rdap_client import RDAPClient
+
+app = typer.Typer(add_completion=False, help="Consultas RDAP.")
+
+
+@app.command("domain")
+def domain(
+    ctx: typer.Context,
+    domain: str = typer.Option(..., "--domain", "-d", help="Domínio a consultar."),
+    json_output: Optional[str] = typer.Option(None, "--json", help="Escreve saída JSON no caminho ou '-'"),
+) -> None:
+    _execute_rdap(ctx, query=domain, path="domain", json_output=json_output)
+
+
+@app.command("ip")
+def ip(
+    ctx: typer.Context,
+    ip_value: str = typer.Option(..., "--ip", "-i", help="Endereço IP ou prefixo."),
+    json_output: Optional[str] = typer.Option(None, "--json", help="Escreve saída JSON no caminho ou '-'"),
+) -> None:
+    _execute_rdap(ctx, query=ip_value, path="ip", json_output=json_output)
+
+
+def _execute_rdap(ctx: typer.Context, query: str, path: str, json_output: Optional[str]) -> None:
+    state = ensure_state(ctx)
+    orchestrator: Orchestrator = Orchestrator(
+        concurrency=state.options.concurrency,
+        timeout=state.options.timeout,
+    )
+    service = RDAPService(
+        client=RDAPClient(timeout=state.options.timeout, http2=True),
+        orchestrator=orchestrator,
+    )
+
+    if path == "domain":
+        result = run_async(service.domain(query))
+    else:
+        result = run_async(service.ip(query))
+
+    payload = _result_to_dict(result)
+    output_format = ("json" if json_output else state.options.format).lower()
+
+    if output_format == "json":
+        emit_json(payload, json_output, state.options.output)
+    elif output_format == "yaml":
+        emit_yaml(payload, json_output, state.options.output)
+    else:
+        _render_table(result)
+
+
+def _render_table(result: RDAPResult) -> None:
+    table = Table(title=f"RDAP · {result.query}", box=box.SIMPLE_HEAVY)
+    table.add_column("Campo", style="cyan", no_wrap=True)
+    table.add_column("Valor", style="white")
+
+    table.add_row("URL", result.url)
+    table.add_row("Status", str(result.status))
+    table.add_row("Latência (ms)", f"{result.latency_ms:.2f}")
+    handle = result.response.get("handle")
+    if handle:
+        table.add_row("Handle", str(handle))
+    entity_type = result.response.get("objectClassName")
+    if entity_type:
+        table.add_row("Objeto", str(entity_type))
+    events = result.response.get("events", [])
+    if events:
+        table.add_row("Eventos", "\n".join(f"{e.get('eventAction')}: {e.get('eventDate')}" for e in events))
+
+    console.print(table)
+
+
+def _result_to_dict(result: RDAPResult) -> Dict[str, Any]:
+    return {
+        "query": result.query,
+        "url": result.url,
+        "status": result.status,
+        "latency_ms": result.latency_ms,
+        "response": result.response,
+    }
+
+
+__all__ = ["app"]

moriarty/cli/state.py

@@ -0,0 +1,38 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Optional
+
+from ..logging.config import LogStyle
+
+
+@dataclass
+class GlobalOptions:
+    concurrency: int = 50
+    timeout: float = 8.0
+    proxy: Optional[str] = None
+    headless: str = "auto"
+    allowlist_domain: Optional[str] = None
+    output: Optional[str] = None
+    format: str = "table"
+    redact: bool = True
+    verbose: bool = False
+    quiet: bool = False
+    professional_mode: bool = False
+    seed: Optional[int] = None
+    dry_run: bool = False
+    plan_only: bool = False
+    sign: bool = False
+    resume_path: Optional[str] = None
+    http3: bool = False
+    doh: Optional[str] = None
+    dot: Optional[str] = None
+    logs: LogStyle = "structured"
+
+
+@dataclass
+class CLIState:
+    options: GlobalOptions
+
+
+__all__ = ["CLIState", "GlobalOptions"]

moriarty/cli/tls.py

@@ -0,0 +1,91 @@
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+import typer
+from rich import box
+from rich.table import Table
+
+from .async_utils import run_async
+from .output import console, emit_json, emit_yaml, ensure_state
+from ..modules.orchestrator import Orchestrator
+from ..modules.tls_scan import TLSScanService
+from ..net.tls_client import TLSClient, TLSInspection
+
+app = typer.Typer(add_completion=False, help="Inspeção de certificados TLS.")
+
+
+@app.command("certs")
+def certs(
+    ctx: typer.Context,
+    domain: str = typer.Option(..., "--domain", "-d", help="Host a ser inspecionado."),
+    port: int = typer.Option(443, help="Porta TLS."),
+    json_output: Optional[str] = typer.Option(None, "--json", help="Escreve saída JSON no caminho ou '-'"),
+) -> None:
+    state = ensure_state(ctx)
+    orchestrator: Orchestrator[TLSInspection] = Orchestrator(
+        concurrency=state.options.concurrency,
+        timeout=state.options.timeout,
+    )
+
+    service = TLSScanService(
+        client=TLSClient(timeout=state.options.timeout),
+        orchestrator=orchestrator,
+        host=domain,
+        port=port,
+    )
+
+    result = run_async(service.run())
+    payload = _result_to_dict(result.inspection)
+
+    output_format = ("json" if json_output else state.options.format).lower()
+    if output_format == "json":
+        emit_json(payload, json_output, state.options.output)
+    elif output_format == "yaml":
+        emit_yaml(payload, json_output, state.options.output)
+    else:
+        _render_table(result.inspection)
+
+
+def _render_table(inspection: TLSInspection) -> None:
+    table = Table(title=f"TLS Certs · {inspection.host}:{inspection.port}", box=box.SIMPLE_HEAVY)
+    table.add_column("Campo", style="cyan", no_wrap=True)
+    table.add_column("Valor", style="white")
+
+    table.add_row("Protocolo", inspection.protocol or "—")
+    table.add_row("Cipher", inspection.cipher or "—")
+    table.add_row("Latência (ms)", f"{inspection.latency_ms:.2f}")
+
+    for idx, cert in enumerate(inspection.certificates, start=1):
+        table.add_row(f"Certificado {idx} - Subject", cert.subject or "—")
+        table.add_row(f"Certificado {idx} - Issuer", cert.issuer or "—")
+        table.add_row(f"Certificado {idx} - Validade", f"{cert.not_before} → {cert.not_after}")
+        table.add_row(f"Certificado {idx} - SHA256", cert.fingerprint_sha256)
+        if cert.subject_alt_names:
+            table.add_row(f"Certificado {idx} - SANs", ", ".join(cert.subject_alt_names))
+
+    console.print(table)
+
+
+def _result_to_dict(inspection: TLSInspection) -> Dict[str, Any]:
+    return {
+        "host": inspection.host,
+        "port": inspection.port,
+        "protocol": inspection.protocol,
+        "cipher": inspection.cipher,
+        "latency_ms": inspection.latency_ms,
+        "certificates": [
+            {
+                "subject": cert.subject,
+                "issuer": cert.issuer,
+                "not_before": cert.not_before.isoformat(),
+                "not_after": cert.not_after.isoformat(),
+                "fingerprint_sha256": cert.fingerprint_sha256,
+                "subject_alt_names": cert.subject_alt_names,
+            }
+            for cert in inspection.certificates
+        ],
+    }
+
+
+__all__ = ["app"]