Sha256: 9238db6171708e96294279ff8fa5d9ab8fb95a28b8469665e1f7c674d06101c8
Contents?: true
Size: 1.67 KB
Versions: 13
Compression:
Stored size: 1.67 KB
Contents
# frozen_string_literal: true require "passive_circl" module Mihari module Analyzers class CIRCL < Base include Mixins::Refang param :query option :title, default: proc { "CIRCL passive DNS/SSL search" } option :description, default: proc { "query = #{query}" } option :tags, default: proc { [] } attr_reader :type def initialize(*args, **kwargs) super @query = refang(query) @type = TypeChecker.type(query) end def artifacts search || [] end private def configuration_keys %w[circl_passive_password circl_passive_username] end def api @api ||= ::PassiveCIRCL::API.new(username: Mihari.config.circl_passive_username, password: Mihari.config.circl_passive_password) end # # Passive DNS/SSL search # # @return [Array<String>] # def search case @type when "domain" passive_dns_search when "hash" passive_ssl_search else raise InvalidInputError, "#{@query}(type: #{@type || "unknown"}) is not supported." end end # # Passive DNS search # # @return [Array<String>] # def passive_dns_search results = api.dns.query(@query) results.filter_map do |result| type = result["rrtype"] type == "A" ? result["rdata"] : nil end.uniq end # # Passive SSL search # # @return [Array<String>] # def passive_ssl_search result = api.ssl.cquery(@query) seen = result["seen"] || [] seen.uniq end end end end
Version data entries
13 entries across 13 versions & 1 rubygems