Contents

# frozen_string_literal: true

module Mihari
  module Enrichers
    #
    # Shodan enricher
    #
    class Shodan < Base
      #
      # Query Shodan Internet DB
      #
      # @param [Mihari::Models::Artifact] artifact
      #
      # @return [Mihari::Structs::Shodan::InternetDBResponse, nil]
      #
      def call(artifact)
        res = client.query(artifact.data)

        artifact.tap do |tapped|
          tapped.cpes = (res&.cpes || []).map { |cpe| Models::CPE.new(name: cpe) } if tapped.cpes.empty?
          tapped.ports = (res&.ports || []).map { |port| Models::Port.new(number: port) } if tapped.ports.empty?
          if tapped.reverse_dns_names.empty?
            tapped.reverse_dns_names = (res&.hostnames || []).map do |name|
              Models::ReverseDnsName.new(name: name)
            end
          end
        end
      end

      #
      # @param [Mihari::Models::Artifact] artifact
      #
      # @return [Boolean]
      #
      def callable?(artifact)
        false unless supported_data_types.include?(artifact.data_type)
      end

      private

      #
      # @param [Mihari::Models::Artifact] artifact
      #
      # @return [Boolean]
      #
      def callable_relationships?(artifact)
        artifact.cpes.empty? || artifact.ports.empty? || artifact.reverse_dns_names.empty?
      end

      def supported_data_types
        %w[ip]
      end

      def client
        @client ||= Clients::ShodanInternetDB.new(timeout: timeout)
      end
    end
  end
end

Version data entries

2 entries across 2 versions & 1 rubygems

Version	Path
mihari-7.3.1	lib/mihari/enrichers/shodan.rb
mihari-7.3.0	lib/mihari/enrichers/shodan.rb