Contents

# frozen_string_literal: true

module Mihari
  module Enrichers
    #
    # Shodan enricher
    #
    class Shodan < Base
      #
      # Query Shodan Internet DB
      #
      # @param [Mihari::Models::Artifact] artifact
      #
      # @return [Mihari::Structs::Shodan::InternetDBResponse, nil]
      #
      def call(artifact)
        res = client.query(artifact.data)

        artifact.tap do |tapped|
          tapped.cpes = (res&.cpes || []).map { |cpe| Models::CPE.new(name: cpe) } if tapped.cpes.empty?
          tapped.ports = (res&.ports || []).map { |port| Models::Port.new(number: port) } if tapped.ports.empty?

          if tapped.reverse_dns_names.empty?
            tapped.reverse_dns_names = (res&.hostnames || []).map do |name|
              Models::ReverseDnsName.new(name:)
            end
          end

          if tapped.vulnerabilities.empty?
            tapped.vulnerabilities = (res&.vulns || []).map do |name|
              Models::Vulnerability.new(name:)
            end
          end
        end
      end

      private

      #
      # @param [Mihari::Models::Artifact] artifact
      #
      # @return [Boolean]
      #
      def callable_relationships?(artifact)
        artifact.cpes.empty? || artifact.ports.empty? || artifact.reverse_dns_names.empty? || artifact.vulnerabilities.empty?
      end

      def supported_data_types
        %w[ip]
      end

      def client
        @client ||= Clients::ShodanInternetDB.new(timeout:)
      end
    end
  end
end

Version data entries

10 entries across 10 versions & 1 rubygems

Version	Path
mihari-8.0.2	lib/mihari/enrichers/shodan.rb
mihari-8.0.1	lib/mihari/enrichers/shodan.rb
mihari-8.0.0	lib/mihari/enrichers/shodan.rb
mihari-7.6.4	lib/mihari/enrichers/shodan.rb
mihari-7.6.3	lib/mihari/enrichers/shodan.rb
mihari-7.6.2	lib/mihari/enrichers/shodan.rb
mihari-7.6.1	lib/mihari/enrichers/shodan.rb
mihari-7.6.0	lib/mihari/enrichers/shodan.rb
mihari-7.5.0	lib/mihari/enrichers/shodan.rb
mihari-7.4.0	lib/mihari/enrichers/shodan.rb