Sha256: ccaf817035b2b6bbd7fcdf9fc46ae2458c50ab7cd2d66812c8156af6982c4052
Contents?: true
Size: 1.71 KB
Versions: 13
Compression:
Stored size: 1.71 KB
Contents
# frozen_string_literal: true
require "spyse"
require "json"
module Mihari
module Analyzers
class Spyse < Base
param :query
option :title, default: proc { "Spyse search" }
option :description, default: proc { "query = #{query}" }
option :type, default: proc { "domain" }
option :tags, default: proc { [] }
def artifacts
search || []
end
private
def search_params
@search_params ||= JSON.parse(query)
end
def configuration_keys
%w[spyse_api_key]
end
def api
@api ||= ::Spyse::API.new(Mihari.config.spyse_api_key)
end
#
# Check whether a type is valid or not
#
# @return [Boolean]
#
def valid_type?
%w[ip domain cert].include? type
end
#
# Domain search
#
# @return [Array<String>]
#
def domain_search
res = api.domain.search(search_params, limit: 100)
items = res.dig("data", "items") || []
items.map do |item|
item["name"]
end.uniq.compact
end
#
# IP search
#
# @return [Array<String>]
#
def ip_search
res = api.ip.search(search_params, limit: 100)
items = res.dig("data", "items") || []
items.map do |item|
item["ip"]
end.uniq.compact
end
#
# IP/domain search
#
# @return [Array<String>]
#
def search
case type
when "domain"
domain_search
when "ip"
ip_search
else
raise InvalidInputError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type?
end
end
end
end
end
Version data entries
13 entries across 13 versions & 1 rubygems