Rename file and class and print result
This commit is contained in:
parent
ba1ce88901
commit
df8aa9868b
@ -7,11 +7,15 @@ import dns.name
|
|||||||
from config import DNS_QUERIES_TYPE
|
from config import DNS_QUERIES_TYPE
|
||||||
|
|
||||||
|
|
||||||
class DNSInformations:
|
class DNSChecker:
|
||||||
def __init__(self, api_key, fqdn):
|
def __init__(self, api_key, fqdn, rrtype=DNS_QUERIES_TYPE):
|
||||||
self._fqdn = fqdn
|
self._fqdn = fqdn
|
||||||
|
self._rrtype = rrtype
|
||||||
|
|
||||||
def checkDomainExist(self):
|
def checkDomainExist(self):
|
||||||
|
"""
|
||||||
|
This function check if the domain exist
|
||||||
|
"""
|
||||||
try:
|
try:
|
||||||
res_query = dns.resolver.resolve(self._fqdn, 'NS')
|
res_query = dns.resolver.resolve(self._fqdn, 'NS')
|
||||||
except dns.resolver.NoAnswer:
|
except dns.resolver.NoAnswer:
|
||||||
@ -21,6 +25,10 @@ class DNSInformations:
|
|||||||
return True
|
return True
|
||||||
|
|
||||||
def whois(self):
|
def whois(self):
|
||||||
|
"""
|
||||||
|
This function will get an whois request for having some information
|
||||||
|
regarding the domain
|
||||||
|
"""
|
||||||
report = dict()
|
report = dict()
|
||||||
w = whois.whois(self._fqdn)
|
w = whois.whois(self._fqdn)
|
||||||
report['domain_name'] = w.domain_name
|
report['domain_name'] = w.domain_name
|
||||||
@ -33,10 +41,13 @@ class DNSInformations:
|
|||||||
return report
|
return report
|
||||||
|
|
||||||
def resolver(self):
|
def resolver(self):
|
||||||
|
"""
|
||||||
|
This function will resolv the FQDN with different type of RR
|
||||||
|
"""
|
||||||
report = dict()
|
report = dict()
|
||||||
|
|
||||||
for t in DNS_QUERIES_TYPE.keys():
|
for t in self._rrtype.keys():
|
||||||
report[t] = self._resolving(self._fqdn, t, DNS_QUERIES_TYPE[t])
|
report[t] = self._resolving(self._fqdn, t, self._rrtype[t])
|
||||||
return report
|
return report
|
||||||
|
|
||||||
def _resolving(self, fqdn, t, attr):
|
def _resolving(self, fqdn, t, attr):
|
68
main.py
68
main.py
@ -4,7 +4,7 @@
|
|||||||
from argparse import ArgumentParser
|
from argparse import ArgumentParser
|
||||||
from config import VT_ATTRIBUTES_MAPPING
|
from config import VT_ATTRIBUTES_MAPPING
|
||||||
from vt import VT
|
from vt import VT
|
||||||
from dnsinformations import DNSInformations as DNS
|
from dnschecker import DNSChecker as DNS
|
||||||
import ipaddress
|
import ipaddress
|
||||||
from datetime import datetime
|
from datetime import datetime
|
||||||
from hashing import Hash
|
from hashing import Hash
|
||||||
@ -108,7 +108,7 @@ def main():
|
|||||||
if args.domain:
|
if args.domain:
|
||||||
_parsingDomain(config, args.domain, report)
|
_parsingDomain(config, args.domain, report)
|
||||||
if args.host:
|
if args.host:
|
||||||
pass
|
_parsingHost(config, args.host, report)
|
||||||
if args.ip:
|
if args.ip:
|
||||||
_parsingIP(config, args.ip, report)
|
_parsingIP(config, args.ip, report)
|
||||||
# Analyse hash file
|
# Analyse hash file
|
||||||
@ -210,6 +210,19 @@ def _parsingIP(config, ip, report):
|
|||||||
except KeyError:
|
except KeyError:
|
||||||
print(f"Cannot find the key {vt}")
|
print(f"Cannot find the key {vt}")
|
||||||
|
|
||||||
|
def _parsingHost(config, fqdn, report):
|
||||||
|
vt = VT(config['api_key_vt'])
|
||||||
|
dns = DNS(config['api_key_vt'], fqdn, {'A': 'address'})
|
||||||
|
|
||||||
|
# Resolv and print results
|
||||||
|
report['resolving'] = dns.resolver()
|
||||||
|
_printDNSResolving(report['resolving'])
|
||||||
|
|
||||||
|
# Print VirusTotal
|
||||||
|
report['vt'] = dict()
|
||||||
|
vt.getDomainReport(fqdn, report['vt'])
|
||||||
|
_printDNSVirusTotal(report['vt'])
|
||||||
|
|
||||||
def _parsingDomain(config, fqdn, report):
|
def _parsingDomain(config, fqdn, report):
|
||||||
vt = VT(config['api_key_vt'])
|
vt = VT(config['api_key_vt'])
|
||||||
dns = DNS(config['api_key_vt'], fqdn)
|
dns = DNS(config['api_key_vt'], fqdn)
|
||||||
@ -219,41 +232,50 @@ def _parsingDomain(config, fqdn, report):
|
|||||||
print(f"The domain {fqdn} do not exist")
|
print(f"The domain {fqdn} do not exist")
|
||||||
return
|
return
|
||||||
|
|
||||||
|
# Resolving domain
|
||||||
|
report['resolving'] = dns.resolver()
|
||||||
|
_printDNSResolving(report['resolving'])
|
||||||
|
|
||||||
|
# Whois request and print the result
|
||||||
|
report['whois'] = dns.whois()
|
||||||
|
_printDNSWhois(report['whois'])
|
||||||
|
|
||||||
|
# Print VirusTotal
|
||||||
|
report['vt'] = dict()
|
||||||
|
vt.getDomainReport(fqdn, report['vt'])
|
||||||
|
_printDNSVirusTotal(report['vt'])
|
||||||
|
|
||||||
|
def _printDNSResolving(report):
|
||||||
print("----------------------")
|
print("----------------------")
|
||||||
print("| resolving |")
|
print("| resolving |")
|
||||||
print("----------------------")
|
print("----------------------")
|
||||||
report['resolving'] = dns.resolver()
|
for key in report.keys():
|
||||||
for key in report['resolving'].keys():
|
|
||||||
print(f"{key}: ")
|
print(f"{key}: ")
|
||||||
for entry in report['resolving'][key]:
|
for entry in report[key]:
|
||||||
for subkey in entry.keys():
|
for subkey in entry.keys():
|
||||||
value = entry[subkey]
|
value = entry[subkey]
|
||||||
if isinstance(value, bytes):
|
if isinstance(value, bytes):
|
||||||
value = value.decode()
|
value = value.decode()
|
||||||
print(f"\t{subkey}: {value}")
|
print(f"\t{subkey}: {value}")
|
||||||
|
|
||||||
print("\n----------------------")
|
def _printDNSVirusTotal(report):
|
||||||
print("| whois |")
|
|
||||||
print("----------------------")
|
|
||||||
report['whois'] = dns.whois()
|
|
||||||
report_whois = report['whois']
|
|
||||||
for key in report_whois.keys():
|
|
||||||
if isinstance(report_whois[key], list):
|
|
||||||
print(f"{key}:")
|
|
||||||
for value in report_whois[key]:
|
|
||||||
print(f"\t{value}")
|
|
||||||
else:
|
|
||||||
print(f"{key}: {report_whois[key]}")
|
|
||||||
|
|
||||||
print("\n----------------------")
|
print("\n----------------------")
|
||||||
print("| VirusTotal |")
|
print("| VirusTotal |")
|
||||||
print("----------------------")
|
print("----------------------")
|
||||||
report['vt'] = dict()
|
for key in report:
|
||||||
vt.getDomainReport(fqdn, report['vt'])
|
print(f"{key}: {report[key]}")
|
||||||
report_vt = report['vt']
|
|
||||||
for key in report_vt:
|
|
||||||
print(f"{key}: {report_vt[key]}")
|
|
||||||
|
|
||||||
|
def _printDNSWhois(report):
|
||||||
|
print("\n----------------------")
|
||||||
|
print("| whois |")
|
||||||
|
print("----------------------")
|
||||||
|
for key in report.keys():
|
||||||
|
if isinstance(report[key], list):
|
||||||
|
print(f"{key}:")
|
||||||
|
for value in report[key]:
|
||||||
|
print(f"\t{value}")
|
||||||
|
else:
|
||||||
|
print(f"{key}: {report[key]}")
|
||||||
|
|
||||||
if __name__ == "__main__":
|
if __name__ == "__main__":
|
||||||
main()
|
main()
|
||||||
|
9
vt.py
9
vt.py
@ -13,6 +13,9 @@ class VT:
|
|||||||
}
|
}
|
||||||
|
|
||||||
def getIPVirusTotal(self, ip):
|
def getIPVirusTotal(self, ip):
|
||||||
|
"""
|
||||||
|
This function get IP information from VirusTotal
|
||||||
|
"""
|
||||||
res = requests.get(
|
res = requests.get(
|
||||||
f"{self._url}/ip_addresses/{ip}",
|
f"{self._url}/ip_addresses/{ip}",
|
||||||
headers=self._headers
|
headers=self._headers
|
||||||
@ -38,6 +41,9 @@ class VT:
|
|||||||
return data
|
return data
|
||||||
|
|
||||||
def getDomainReport(self, fqdn, report):
|
def getDomainReport(self, fqdn, report):
|
||||||
|
"""
|
||||||
|
This function get the report for the specific domain
|
||||||
|
"""
|
||||||
res = requests.get(
|
res = requests.get(
|
||||||
f"{self._url}/domains/{fqdn}",
|
f"{self._url}/domains/{fqdn}",
|
||||||
headers=self._headers
|
headers=self._headers
|
||||||
@ -65,6 +71,9 @@ class VT:
|
|||||||
report['malicious'] += 1
|
report['malicious'] += 1
|
||||||
|
|
||||||
def getRateFromHash(self, h, report):
|
def getRateFromHash(self, h, report):
|
||||||
|
"""
|
||||||
|
This function get the report of the hash specified by the parameter h
|
||||||
|
"""
|
||||||
headers = self._headers
|
headers = self._headers
|
||||||
|
|
||||||
res = requests.get(
|
res = requests.get(
|
||||||
|
Loading…
Reference in New Issue
Block a user