Harvis/apivoid_handler.py at main · offsec-org/Harvis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
import config
import requests
import json

estimated_queries = None

#TODOS: make every requst handle in case of no credits/HTTP error

def get_estimated_queries():
    global estimated_queries
    r = requests.get(
        "https://endpoint.apivoid.com/threatlog/v1/pay-as-you-go/?key=" + config.apivoid_key + "&host=www.google.com")
    results = json.loads(r.text)
    estimated_queries = results["estimated_queries"]
    return

def check_propagation(domain,ip):
    global estimated_queries
    r = requests.get("https://endpoint.apivoid.com/dnspropagation/v1/pay-as-you-go/?key=" + config.apivoid_key + "&host=" + domain+ "&dns_type=A")
    results = json.loads(r.text)
    resolvers = results["data"]["propagation"]
    estimated_queries = results["estimated_queries"]
    count = 0
    for i in resolvers:
        if i["response"].replace("\n","") != ip:
            count += 1
    if count > 8:
        return False
    return True

def check_burned_domain(domains_in_use):
    global estimated_queries
    domains_brn = []
    for i in domains_in_use:
        r = requests.get(
            "https://endpoint.apivoid.com/domainbl/v1/pay-as-you-go/?key=" +config.apivoid_key +"&host="+i)
        results = json.loads(r.text)
        blacklist = results["data"]["report"]["blacklists"]["engines"]
        blacklist_list = []
        estimated_queries = results["estimated_queries"]
       # blacklist[6]["detected"] = True
        for j in blacklist:
            if blacklist[j]["detected"] == True:
                blacklist_list.append(blacklist[j])
        if len(blacklist_list) > 0:
            domains_brn.append({"domains":i,"blacklist_list":blacklist_list})

    return domains_brn

def check_burned_c2_list(c2_list):
    global estimated_queries
    ips_brn = []
    for i in c2_list:
        r = requests.get(
            "https://endpoint.apivoid.com/iprep/v1/pay-as-you-go/?key=" + config.apivoid_key + "&ip=" + c2_list[i]["ip"])
        results = json.loads(r.text)
        blacklist = results["data"]["report"]["blacklists"]["engines"]
        blacklist_list = []
        estimated_queries = results["estimated_queries"]
        for j in blacklist:
            if blacklist[j]["detected"] == True:
                blacklist_list.append(blacklist[j])
        if len(blacklist_list) > 0:
            ips_brn.append({"ips":c2_list[i]["ip"],"blacklist_list":blacklist_list})
    return ips_brn

def check_burned_redirectors(redirectors):
    global estimated_queries
    ips_brn = []
    for i in redirectors:
        r = requests.get(
            "https://endpoint.apivoid.com/iprep/v1/pay-as-you-go/?key=" + config.apivoid_key + "&ip=" + redirectors[i]["ip"])
        results = json.loads(r.text)
        estimated_queries = results["estimated_queries"]
        blacklist = results["data"]["report"]["blacklists"]["engines"]
        blacklist_list = []
        for j in blacklist:
            if blacklist[j]["detected"] == True:
                blacklist_list.append(blacklist[j])
        if len(blacklist_list) > 0:
            ips_brn.append({"ips": redirectors[i]["ip"], "blacklist_list": blacklist_list})
    return ips_brn