Add HIBP Paste lookup.
Start adding HIBP entities.
This commit is contained in:
26
Modules/BreachData/HIBP.xml
Normal file
26
Modules/BreachData/HIBP.xml
Normal file
@@ -0,0 +1,26 @@
|
||||
<HIBP>
|
||||
<Data_Breach>
|
||||
<Attributes>
|
||||
<Attribute default="Breach Name" check="String" primary="True">Breach Name</Attribute>
|
||||
<Attribute default="Breach Title" check="String" primary="False">Title</Attribute>
|
||||
<Attribute default="Breach Domain" check="String" primary="False">Domain</Attribute>
|
||||
<Attribute default="0" check="Numbers" primary="False">Pwn Count</Attribute>
|
||||
<Attribute default="Breach Description" check="String" primary="False">Description</Attribute>
|
||||
</Attributes>
|
||||
<Icon>
|
||||
Default.svg
|
||||
</Icon>
|
||||
</Data_Breach>
|
||||
<Paste_Data_Leak>
|
||||
<Attributes>
|
||||
<Attribute default="Paste Identifier" check="String" primary="True">Paste Identifier</Attribute>
|
||||
<Attribute default="Paste Title" check="String" primary="False">Title</Attribute>
|
||||
<Attribute default="Paste Source" check="String" primary="False">Source</Attribute>
|
||||
<Attribute default="Paste ID" check="String" primary="False">Paste ID</Attribute>
|
||||
<Attribute default="0" check="Numbers" primary="False">Email Count</Attribute>
|
||||
</Attributes>
|
||||
<Icon>
|
||||
Default.svg
|
||||
</Icon>
|
||||
</Paste_Data_Leak>
|
||||
</HIBP>
|
||||
@@ -1,15 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
|
||||
class HaveIBeenPwned: # TODO https://haveibeenpwned.com/API/v3
|
||||
|
||||
name = "HIBP Database Lookup"
|
||||
category = "Leaked Data"
|
||||
description = "Find ." # TODO
|
||||
originTypes = {'Phrase', 'Person', 'Social Media Handle'}
|
||||
resultTypes = {'Website'}
|
||||
parameters = {} # TODO
|
||||
|
||||
def resolution(self, entityJsonList, parameters):
|
||||
import requests
|
||||
return "Not yet implemented."
|
||||
62
Modules/BreachData/HaveIBeenPwnedPastes.py
Normal file
62
Modules/BreachData/HaveIBeenPwnedPastes.py
Normal file
@@ -0,0 +1,62 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
|
||||
class HaveIBeenPwnedPastes:
|
||||
name = "HIBP Paste Lookup"
|
||||
category = "Leaked Data"
|
||||
description = "Find all pastes that an account has been involved in."
|
||||
originTypes = {'Email Address'}
|
||||
resultTypes = {'Paste Data Leak'}
|
||||
parameters = {'HIBP API Key': {'description': 'Enter your "Have I Been Pwned" API key. '
|
||||
'You can get a key here: https://haveibeenpwned.com/API/Key',
|
||||
'type': 'String',
|
||||
'value': '',
|
||||
'global': True,
|
||||
'default': 'None'}}
|
||||
|
||||
def resolution(self, entityJsonList, parameters):
|
||||
import requests
|
||||
import json
|
||||
from time import sleep
|
||||
from urllib.parse import quote_plus
|
||||
|
||||
baseURL = "https://haveibeenpwned.com/api/v3/pasteaccount/"
|
||||
requestHeaders = {'hibp-api-key': parameters['HIBP API Key'].strip(), 'user-agent': 'LinkScope Client'}
|
||||
|
||||
returnResults = []
|
||||
|
||||
count = 0
|
||||
while count < len(entityJsonList):
|
||||
entity = entityJsonList[count]
|
||||
emailAddress = entity['Email Address']
|
||||
pasteInfoRequest = requests.get(baseURL + quote_plus(emailAddress), headers=requestHeaders)
|
||||
statusCode = pasteInfoRequest.status_code
|
||||
if statusCode == 401:
|
||||
return "The HIBP API Key provided is invalid."
|
||||
elif statusCode == 429:
|
||||
sleep(2)
|
||||
continue
|
||||
elif statusCode == 503:
|
||||
return "The HIBP Service is unavailable."
|
||||
elif statusCode == 200:
|
||||
pasteContent = json.loads(pasteInfoRequest.content)
|
||||
|
||||
for paste in pasteContent:
|
||||
pasteID = paste['Id']
|
||||
pasteSource = paste['Source']
|
||||
pasteTitle = paste['Title']
|
||||
pasteDate = paste['Date'] # If None, will be the date that this entity was created.
|
||||
pasteEmails = str(paste['EmailCount'])
|
||||
|
||||
returnResults.append([{'Paste Identifier': pasteSource + ' | ' + pasteID,
|
||||
'Title': pasteTitle,
|
||||
'Source': pasteSource,
|
||||
'Paste ID': pasteID,
|
||||
'Email Count': pasteEmails,
|
||||
'Entity Type': 'Paste Data Leak',
|
||||
'Date Created': pasteDate},
|
||||
{entity['uid']: {'Resolution': 'Contained in Paste',
|
||||
'Notes': ''}}])
|
||||
sleep(1.7)
|
||||
count += 1
|
||||
return returnResults
|
||||
Reference in New Issue
Block a user