Rename file and class and print result

This commit is contained in:
geoffrey 2024-06-22 15:11:01 +02:00
parent ba1ce88901
commit df8aa9868b
3 changed files with 69 additions and 27 deletions

@ -7,11 +7,15 @@ import dns.name
from config import DNS_QUERIES_TYPE from config import DNS_QUERIES_TYPE
class DNSInformations: class DNSChecker:
def __init__(self, api_key, fqdn): def __init__(self, api_key, fqdn, rrtype=DNS_QUERIES_TYPE):
self._fqdn = fqdn self._fqdn = fqdn
self._rrtype = rrtype
def checkDomainExist(self): def checkDomainExist(self):
"""
This function check if the domain exist
"""
try: try:
res_query = dns.resolver.resolve(self._fqdn, 'NS') res_query = dns.resolver.resolve(self._fqdn, 'NS')
except dns.resolver.NoAnswer: except dns.resolver.NoAnswer:
@ -21,6 +25,10 @@ class DNSInformations:
return True return True
def whois(self): def whois(self):
"""
This function will get an whois request for having some information
regarding the domain
"""
report = dict() report = dict()
w = whois.whois(self._fqdn) w = whois.whois(self._fqdn)
report['domain_name'] = w.domain_name report['domain_name'] = w.domain_name
@ -33,10 +41,13 @@ class DNSInformations:
return report return report
def resolver(self): def resolver(self):
"""
This function will resolv the FQDN with different type of RR
"""
report = dict() report = dict()
for t in DNS_QUERIES_TYPE.keys(): for t in self._rrtype.keys():
report[t] = self._resolving(self._fqdn, t, DNS_QUERIES_TYPE[t]) report[t] = self._resolving(self._fqdn, t, self._rrtype[t])
return report return report
def _resolving(self, fqdn, t, attr): def _resolving(self, fqdn, t, attr):

68
main.py

@ -4,7 +4,7 @@
from argparse import ArgumentParser from argparse import ArgumentParser
from config import VT_ATTRIBUTES_MAPPING from config import VT_ATTRIBUTES_MAPPING
from vt import VT from vt import VT
from dnsinformations import DNSInformations as DNS from dnschecker import DNSChecker as DNS
import ipaddress import ipaddress
from datetime import datetime from datetime import datetime
from hashing import Hash from hashing import Hash
@ -108,7 +108,7 @@ def main():
if args.domain: if args.domain:
_parsingDomain(config, args.domain, report) _parsingDomain(config, args.domain, report)
if args.host: if args.host:
pass _parsingHost(config, args.host, report)
if args.ip: if args.ip:
_parsingIP(config, args.ip, report) _parsingIP(config, args.ip, report)
# Analyse hash file # Analyse hash file
@ -210,6 +210,19 @@ def _parsingIP(config, ip, report):
except KeyError: except KeyError:
print(f"Cannot find the key {vt}") print(f"Cannot find the key {vt}")
def _parsingHost(config, fqdn, report):
vt = VT(config['api_key_vt'])
dns = DNS(config['api_key_vt'], fqdn, {'A': 'address'})
# Resolv and print results
report['resolving'] = dns.resolver()
_printDNSResolving(report['resolving'])
# Print VirusTotal
report['vt'] = dict()
vt.getDomainReport(fqdn, report['vt'])
_printDNSVirusTotal(report['vt'])
def _parsingDomain(config, fqdn, report): def _parsingDomain(config, fqdn, report):
vt = VT(config['api_key_vt']) vt = VT(config['api_key_vt'])
dns = DNS(config['api_key_vt'], fqdn) dns = DNS(config['api_key_vt'], fqdn)
@ -219,41 +232,50 @@ def _parsingDomain(config, fqdn, report):
print(f"The domain {fqdn} do not exist") print(f"The domain {fqdn} do not exist")
return return
# Resolving domain
report['resolving'] = dns.resolver()
_printDNSResolving(report['resolving'])
# Whois request and print the result
report['whois'] = dns.whois()
_printDNSWhois(report['whois'])
# Print VirusTotal
report['vt'] = dict()
vt.getDomainReport(fqdn, report['vt'])
_printDNSVirusTotal(report['vt'])
def _printDNSResolving(report):
print("----------------------") print("----------------------")
print("| resolving |") print("| resolving |")
print("----------------------") print("----------------------")
report['resolving'] = dns.resolver() for key in report.keys():
for key in report['resolving'].keys():
print(f"{key}: ") print(f"{key}: ")
for entry in report['resolving'][key]: for entry in report[key]:
for subkey in entry.keys(): for subkey in entry.keys():
value = entry[subkey] value = entry[subkey]
if isinstance(value, bytes): if isinstance(value, bytes):
value = value.decode() value = value.decode()
print(f"\t{subkey}: {value}") print(f"\t{subkey}: {value}")
print("\n----------------------") def _printDNSVirusTotal(report):
print("| whois |")
print("----------------------")
report['whois'] = dns.whois()
report_whois = report['whois']
for key in report_whois.keys():
if isinstance(report_whois[key], list):
print(f"{key}:")
for value in report_whois[key]:
print(f"\t{value}")
else:
print(f"{key}: {report_whois[key]}")
print("\n----------------------") print("\n----------------------")
print("| VirusTotal |") print("| VirusTotal |")
print("----------------------") print("----------------------")
report['vt'] = dict() for key in report:
vt.getDomainReport(fqdn, report['vt']) print(f"{key}: {report[key]}")
report_vt = report['vt']
for key in report_vt:
print(f"{key}: {report_vt[key]}")
def _printDNSWhois(report):
print("\n----------------------")
print("| whois |")
print("----------------------")
for key in report.keys():
if isinstance(report[key], list):
print(f"{key}:")
for value in report[key]:
print(f"\t{value}")
else:
print(f"{key}: {report[key]}")
if __name__ == "__main__": if __name__ == "__main__":
main() main()

9
vt.py

@ -13,6 +13,9 @@ class VT:
} }
def getIPVirusTotal(self, ip): def getIPVirusTotal(self, ip):
"""
This function get IP information from VirusTotal
"""
res = requests.get( res = requests.get(
f"{self._url}/ip_addresses/{ip}", f"{self._url}/ip_addresses/{ip}",
headers=self._headers headers=self._headers
@ -38,6 +41,9 @@ class VT:
return data return data
def getDomainReport(self, fqdn, report): def getDomainReport(self, fqdn, report):
"""
This function get the report for the specific domain
"""
res = requests.get( res = requests.get(
f"{self._url}/domains/{fqdn}", f"{self._url}/domains/{fqdn}",
headers=self._headers headers=self._headers
@ -65,6 +71,9 @@ class VT:
report['malicious'] += 1 report['malicious'] += 1
def getRateFromHash(self, h, report): def getRateFromHash(self, h, report):
"""
This function get the report of the hash specified by the parameter h
"""
headers = self._headers headers = self._headers
res = requests.get( res = requests.get(