Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactor Plugins into repeatable Class #10

Open
TheDr1ver opened this issue Aug 30, 2021 · 0 comments
Open

Refactor Plugins into repeatable Class #10

TheDr1ver opened this issue Aug 30, 2021 · 0 comments

Comments

@TheDr1ver
Copy link
Owner

TheDr1ver commented Aug 30, 2021

Right now Shodan and Censys are just a collection of independent functions. This causes a lot of crappy logic in helper.py to the tune of if service == "censys-v2": iocs = censys.censys_v2_extract_certs(iocs, new_res).

Ideally each active plugin would be loaded as a generic, repeatable class, and we could just loop through all active plugins at each of these steps instead of explicitly looking for the slugs we know we've defined.

For example, censys.py does the following:

  • Search for certificate data
  • Clean JSON blobs
  • Remove data from keys that is likely to be highly variable (timestamps, crawler IDs, etc)
  • Extract certificates from JSON blob and add to IOCs
  • Run a custom search against Censys
  • Search Censys for IPs related to a specific certificate
  • Get the details of a specific IP/host

shodan.py basically does the same exact stuff. This should pretty much always be the same for all plugins capable of generating misphunter-host objects.

  • clean JSON blobs
  • Remove data from keys that is likely to be highly variable (timestamps, crawler IDs, etc)
  • Extract certificates from JSON blob and add to IOCs
  • Run a custom search against Shodan
  • Search Shodan for IPs related to a specific certificate
  • Get the details of a specific IP/host
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant