6 |
10 |
11 | {% endblock %}
12 |
13 |
--------------------------------------------------------------------------------
/apps/exploit/templates/exploit/searchTarget.html:
--------------------------------------------------------------------------------
1 | {% load static %}
2 |
3 |
6 |
--------------------------------------------------------------------------------
/apps/ip/templates/ip/index.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load humanize %}
5 | {% load static %}
6 |
7 | {{ websrc }}
8 |
7 |
11 | {% include "ip/searchBar.html" %}
12 |
13 | {% endblock %}
14 |
--------------------------------------------------------------------------------
/apps/url/templates/url/index.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load humanize %}
5 | {% load static %}
6 |
8 |
10 | IP Lookup
9 |
7 |
11 | {% include "url/searchBar.html" %}
12 |
13 | {% endblock %}
14 |
--------------------------------------------------------------------------------
/static/admin/img/tooltag-arrowright.svg:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/apps/acti/forms.py:
--------------------------------------------------------------------------------
1 | from django import forms
2 | from django.forms import ModelForm
3 |
4 | class SearchForm(forms.Form):
5 | keyword = forms.CharField(label='', max_length=100, required=False)
6 | keyword.widget.attrs['class'] = 'form-control mr-sm-2 my-2'
7 | keyword.widget.attrs['placeholder'] = 'Search for tweets.'
--------------------------------------------------------------------------------
/apps/reputation/templates/reputation/searchTarget.html:
--------------------------------------------------------------------------------
1 | {% load static %}
2 |
3 |
6 |
--------------------------------------------------------------------------------
/apps/domain/templates/domain/index.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load humanize %}
5 | {% load static %}
6 |
8 |
10 | URL Lookup
9 |
7 |
11 | {% include "domain/searchBar.html" %}
12 |
13 | {% endblock %}
14 |
--------------------------------------------------------------------------------
/apps/filehash/templates/filehash/index.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load humanize %}
5 | {% load static %}
6 |
8 |
10 | Domain Lookup
9 |
7 |
11 | {% include "filehash/searchBar.html" %}
12 |
13 | {% endblock %}
14 |
--------------------------------------------------------------------------------
/apps/dashboard/forms.py:
--------------------------------------------------------------------------------
1 | from django import forms
2 |
3 | class SearchForm(forms.Form):
4 | keyword = forms.CharField(label='', max_length=100, required=True)
5 | keyword.widget.attrs['class'] = 'form-control mr-sm-2 my-2'
6 | keyword.widget.attrs['placeholder'] = 'Search for IP address, Domain, URL, Hash(md5, sha1, sha256), and any keyword'
7 |
8 |
--------------------------------------------------------------------------------
/apps/twitter/forms.py:
--------------------------------------------------------------------------------
1 | from django import forms
2 | from django.forms import ModelForm
3 | #from .models import tweet
4 |
5 | class SearchForm(forms.Form):
6 | keyword = forms.CharField(label='', max_length=100, required=False)
7 | keyword.widget.attrs['class'] = 'form-control mr-sm-2 my-2'
8 | keyword.widget.attrs['placeholder'] = 'Search for tweets.'
--------------------------------------------------------------------------------
/intelligence/celery.py:
--------------------------------------------------------------------------------
1 | import os
2 | from celery import Celery
3 |
4 | os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'intelligence.settings')
5 | app = Celery('intelligence')
6 | app.conf.broker_url = os.environ.get('EXIST_REDIS_URL', 'redis://localhost:6379/0')
7 | app.config_from_object('django.conf:settings', namespace='CELERY')
8 | app.autodiscover_tasks()
9 |
--------------------------------------------------------------------------------
/static/admin/img/README.txt:
--------------------------------------------------------------------------------
1 | All icons are taken from Font Awesome (http://fontawesome.io/) project.
2 | The Font Awesome font is licensed under the SIL OFL 1.1:
3 | - http://scripts.sil.org/OFL
4 |
5 | SVG icons source: https://github.com/encharm/Font-Awesome-SVG-PNG
6 | Font-Awesome-SVG-PNG is licensed under the MIT license (see file license
7 | in current folder).
8 |
--------------------------------------------------------------------------------
/apps/news/forms.py:
--------------------------------------------------------------------------------
1 | from django import forms
2 | from django.forms import ModelForm
3 | from .models import News
4 |
5 | class SearchForm(forms.Form):
6 | keyword = forms.CharField(label='', max_length=100, required=False)
7 | keyword.widget.attrs['class'] = 'form-control mr-sm-2 my-2'
8 | keyword.widget.attrs['placeholder'] = 'Search for News.'
9 |
10 |
--------------------------------------------------------------------------------
/static/admin/img/icon-addlink.svg:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/static/admin/img/tooltag-add.svg:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/apps/threat/admin.py:
--------------------------------------------------------------------------------
1 | from django.contrib import admin
2 |
3 | # Register your models here.
4 | from .models import Event, Attribute, Org, Tag, Object, ObjectReference
5 |
6 | admin.site.register(Event)
7 | admin.site.register(Attribute)
8 | admin.site.register(Org)
9 | admin.site.register(Tag)
10 | admin.site.register(Object)
11 | admin.site.register(ObjectReference)
12 |
13 |
--------------------------------------------------------------------------------
/apps/vuln/forms.py:
--------------------------------------------------------------------------------
1 | from django import forms
2 | from django.forms import ModelForm
3 | from .models import Vuln, Tag
4 |
5 | class SearchForm(forms.Form):
6 | keyword = forms.CharField(label='', max_length=100, required=False)
7 | keyword.widget.attrs['class'] = 'form-control mr-sm-2 my-2'
8 | keyword.widget.attrs['placeholder'] = 'Search for Vuln title.'
9 |
10 |
--------------------------------------------------------------------------------
/static/admin/js/prepopulate.min.js:
--------------------------------------------------------------------------------
1 | (function(c){c.fn.prepopulate=function(e,f,g){return this.each(function(){var a=c(this),b=function(){if(!a.data("_changed")){var b=[];c.each(e,function(a,d){d=c(d);0
8 |
10 | File Hash Lookup
9 |
4 |
12 |
13 |
--------------------------------------------------------------------------------
/static/admin/img/icon-changelink.svg:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/static/admin/js/jquery.init.js:
--------------------------------------------------------------------------------
1 | /*global django:true, jQuery:false*/
2 | /* Puts the included jQuery into our own namespace using noConflict and passing
3 | * it 'true'. This ensures that the included jQuery doesn't pollute the global
4 | * namespace (i.e. this preserves pre-existing values for both window.$ and
5 | * window.jQuery).
6 | */
7 | var django = django || {};
8 | django.jQuery = jQuery.noConflict(true);
9 |
--------------------------------------------------------------------------------
/apps/domain/urls.py:
--------------------------------------------------------------------------------
1 | from django.conf.urls import url
2 |
3 | from . import views
4 |
5 | app_name = 'domain'
6 | urlpatterns = [
7 | url(r'^$', views.IndexView.as_view(), name='index'),
8 | url(r'^(?P
2 |
10 |
--------------------------------------------------------------------------------
/apps/ip/templates/ip/searchBar.html:
--------------------------------------------------------------------------------
1 | {% load static %}
2 |
3 |
3 | {% for key, value in target_form.source %}
4 |
7 | {% endfor %}
8 |
9 |
4 |
12 |
13 |
--------------------------------------------------------------------------------
/apps/exploit/forms.py:
--------------------------------------------------------------------------------
1 | from django import forms
2 | from django.forms import ModelForm
3 | from .models import Exploit
4 |
5 | class SearchForm(forms.Form):
6 | keyword = forms.CharField(label='', max_length=100, required=False)
7 | keyword.widget.attrs['class'] = 'form-control mr-sm-2 my-2'
8 | keyword.widget.attrs['placeholder'] = 'Search for Exploits.'
9 |
10 | class TargetForm(forms.Form):
11 | source = Exploit.SOURCES
12 |
--------------------------------------------------------------------------------
/apps/url/templates/url/searchBar.html:
--------------------------------------------------------------------------------
1 | {% load static %}
2 |
3 |
4 |
12 |
13 |
--------------------------------------------------------------------------------
/scripts/insert2db/news/logs/insert2db.log.2019-06-23:
--------------------------------------------------------------------------------
1 | 2019-06-23 14:48:27,145 root
4 |
12 |
13 |
--------------------------------------------------------------------------------
/apps/domain/templates/domain/searchBar.html:
--------------------------------------------------------------------------------
1 | {% load static %}
2 |
3 |
4 |
12 |
13 |
--------------------------------------------------------------------------------
/apps/exploit/serializers.py:
--------------------------------------------------------------------------------
1 | from rest_framework import serializers
2 | from .models import Exploit
3 |
4 | class exSerializer(serializers.ModelSerializer):
5 | source = serializers.CharField(source='get_source_display')
6 | class Meta:
7 | model = Exploit
8 | fields = ('__all__')
9 |
10 | class sourceSerializer(serializers.ModelSerializer):
11 | class Meta:
12 | model = Exploit
13 | fields = ('SOURCES',)
14 |
--------------------------------------------------------------------------------
/apps/reputation/templates/reputation/searchTargetValue.html:
--------------------------------------------------------------------------------
1 | {% load lookup %}
2 |
3 |
11 |
--------------------------------------------------------------------------------
/apps/filehash/templates/filehash/searchBar.html:
--------------------------------------------------------------------------------
1 | {% load static %}
2 |
3 |
4 | {% for key, value in target_form.source %}
5 |
8 | {% endfor %}
9 |
10 |
4 |
12 |
13 |
--------------------------------------------------------------------------------
/apps/reputation/serializers.py:
--------------------------------------------------------------------------------
1 | from rest_framework import serializers
2 | from .models import blacklist
3 |
4 | class blSerializer(serializers.ModelSerializer):
5 | source = serializers.CharField(source='get_source_display')
6 | class Meta:
7 | model = blacklist
8 | fields = ('__all__')
9 |
10 | class sourceSerializer(serializers.ModelSerializer):
11 | class Meta:
12 | model = blacklist
13 | fields = ('SOURCES',)
14 |
--------------------------------------------------------------------------------
/static/admin/img/icon-yes.svg:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/apps/vuln/admin.py:
--------------------------------------------------------------------------------
1 | from django.contrib import admin
2 |
3 | # Register your models here.
4 | from .models import Vuln, Tag, Vendor, Product, CVSS, Reference, NVD, NVDref, Author
5 |
6 | admin.site.register(Vuln)
7 | admin.site.register(Tag)
8 | admin.site.register(Vendor)
9 | admin.site.register(Product)
10 | admin.site.register(CVSS)
11 | admin.site.register(Reference)
12 | admin.site.register(NVD)
13 | admin.site.register(NVDref)
14 | admin.site.register(Author)
15 |
--------------------------------------------------------------------------------
/conf/exist.conf.template:
--------------------------------------------------------------------------------
1 | [vt]
2 | baseURL = https://www.virustotal.com/vtapi/v2/
3 | apikey = YOUR_KEY
4 |
5 | [geoip]
6 | database = /path/to/your/GeoLite2-City.mmdb
7 |
8 | [shodan]
9 | baseURL = https://api.shodan.io/shodan/host/
10 | apikey = YOUR_API_KEY
11 |
12 | [censys]
13 | baseURL = https://censys.io/api/v1/
14 | api_id = YOUR_API_ID
15 | secret = YOUR_SECRET
16 |
17 | [abuse]
18 | baseURL = https://api.abuseipdb.com/api/v2/check
19 | apikey = YOUR_API_KEY
20 |
--------------------------------------------------------------------------------
/apps/filehash/templatetags/unixtime_tag.py:
--------------------------------------------------------------------------------
1 | from django import template
2 | from datetime import datetime
3 | register = template.Library()
4 |
5 | @register.filter(name="unixtimetostr")
6 | def unixtimetostr(unixtime):
7 | return datetime.fromtimestamp(unixtime).strftime('%Y-%m-%d %H:%M:%S')
8 |
9 | @register.filter(name="unixtimetostrmillisec")
10 | def unixtimetostrmillisec(unixtime):
11 | return datetime.fromtimestamp(unixtime / 1000.0).strftime('%Y-%m-%d %H:%M:%S')
12 |
--------------------------------------------------------------------------------
/static/admin/img/search.svg:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/intelligence/wsgi.py:
--------------------------------------------------------------------------------
1 | """
2 | WSGI config for intelligence project.
3 |
4 | It exposes the WSGI callable as a module-level variable named ``application``.
5 |
6 | For more information on this file, see
7 | https://docs.djangoproject.com/en/1.11/howto/deployment/wsgi/
8 | """
9 |
10 | import os
11 |
12 | from django.core.wsgi import get_wsgi_application
13 |
14 | os.environ.setdefault("DJANGO_SETTINGS_MODULE", "intelligence.settings")
15 |
16 | application = get_wsgi_application()
17 |
--------------------------------------------------------------------------------
/scripts/url/delete_oldtaskresult.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 |
3 | source $(cd $(dirname $0); pwd)/url.conf
4 |
5 | QUERY='delete from django_celery_results_taskresult
6 | where not exists(
7 | select * from(
8 | select * from django_celery_results_taskresult T2
9 | order by date_done desc limit 6
10 | ) T3
11 | where django_celery_results_taskresult.id = T3.id
12 | );'
13 | /usr/bin/mysql -u${USER} -p${PASS} -D${DB} -e "${QUERY}"
14 |
--------------------------------------------------------------------------------
/apps/filehash/urls.py:
--------------------------------------------------------------------------------
1 | from django.conf.urls import url
2 |
3 | from . import views
4 |
5 | app_name = 'filehash'
6 | urlpatterns = [
7 | url(r'^$', views.IndexView.as_view(), name='index'),
8 | url(r'^pcap/(?P
4 |
13 |
14 | {% include "exploit/searchTargetValue.html" %}
15 |
--------------------------------------------------------------------------------
/static/admin/img/icon-alert.svg:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/static/admin/css/fonts.css:
--------------------------------------------------------------------------------
1 | @font-face {
2 | font-family: 'Roboto';
3 | src: url('../fonts/Roboto-Bold-webfont.woff');
4 | font-weight: 700;
5 | font-style: normal;
6 | }
7 |
8 | @font-face {
9 | font-family: 'Roboto';
10 | src: url('../fonts/Roboto-Regular-webfont.woff');
11 | font-weight: 400;
12 | font-style: normal;
13 | }
14 |
15 | @font-face {
16 | font-family: 'Roboto';
17 | src: url('../fonts/Roboto-Light-webfont.woff');
18 | font-weight: 300;
19 | font-style: normal;
20 | }
21 |
--------------------------------------------------------------------------------
/scripts/insert2db/conf/insert2db.conf.template:
--------------------------------------------------------------------------------
1 | [exist]
2 | syspath = /path/to/your/exist
3 |
4 | [misp]
5 | MISP_URL = http://YOUR_MISP_URL
6 | API_KEY = YOUR_MISP_API_KEY
7 |
8 | [malshare]
9 | api_key = YOUR_API_KEY
10 |
11 | [abuse]
12 | api_key = YOUR_API_KEY
13 |
14 | [twitter]
15 | timeline = https://api.twitter.com/1.1/statuses/home_timeline.json
16 | CK = YOUR_CK
17 | CS = YOUR_CS
18 | AT = YOUR_AT
19 | AS = YOUR_AS
20 |
21 | [inoreader]
22 | AppID = YOUR_APPID
23 | AppKey = YOUR_APPKEY
24 | Email = YOUR_EMAIL
25 | Passwd = YOUR_PASSWD
26 |
--------------------------------------------------------------------------------
/static/admin/css/dashboard.css:
--------------------------------------------------------------------------------
1 | /* DASHBOARD */
2 |
3 | .dashboard .module table th {
4 | width: 100%;
5 | }
6 |
7 | .dashboard .module table td {
8 | white-space: nowrap;
9 | }
10 |
11 | .dashboard .module table td a {
12 | display: block;
13 | padding-right: .6em;
14 | }
15 |
16 | /* RECENT ACTIONS MODULE */
17 |
18 | .module ul.actionlist {
19 | margin-left: 0;
20 | }
21 |
22 | ul.actionlist li {
23 | list-style-type: none;
24 | overflow: hidden;
25 | text-overflow: ellipsis;
26 | -o-text-overflow: ellipsis;
27 | }
28 |
--------------------------------------------------------------------------------
/apps/reputation/templates/reputation/searchBar.html:
--------------------------------------------------------------------------------
1 | {% load static %}
2 |
3 |
4 |
13 |
14 | {% include "reputation/searchTargetValue.html" %}
15 |
--------------------------------------------------------------------------------
/static/admin/js/prepopulate_init.js:
--------------------------------------------------------------------------------
1 | (function($) {
2 | 'use strict';
3 | var fields = $('#django-admin-prepopulated-fields-constants').data('prepopulatedFields');
4 | $.each(fields, function(index, field) {
5 | $('.empty-form .form-row .field-' + field.name + ', .empty-form.form-row .field-' + field.name).addClass('prepopulated_field');
6 | $(field.id).data('dependency_list', field.dependency_list).prepopulate(
7 | field.dependency_ids, field.maxLength, field.allowUnicode
8 | );
9 | });
10 | })(django.jQuery);
11 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | # dotenv production file
2 | .env
3 |
4 | # Temporary adding for Docker environment.
5 | Dockerfile
6 | docker-compose.yml
7 | mysql/
8 | redis/
9 |
10 | # Other (like development environment junks).
11 | .python-version
12 | .vscode/
13 | .DS_Store
14 | ._*
15 | __pycache__/
16 | migrations/
17 | *.py[cod]
18 | *.conf
19 | *.log
20 | *.log.*
21 | scripts/insert2db/reputation/data/*/*
22 | scripts/insert2db/vuln/data/*/*
23 | scripts/insert2db/exploit/data/*/data/*
24 | scripts/insert2db/exploit/data/*/*
25 | static/webimg/*
26 | static/websrc/*
27 | dev/
28 |
--------------------------------------------------------------------------------
/apps/threat/templates/threat/searchTargetValue.html:
--------------------------------------------------------------------------------
1 |
2 |
12 |
--------------------------------------------------------------------------------
/apps/dashboard/templates/dashboard/cross.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load humanize %}
5 | {% load static %}
6 |
3 |
4 |
10 |
11 | | 5 | {% for tag in alltag %} 6 | {{ tag.name }} 7 | {% endfor %} 8 | |
7 |
11 |
12 | {% include "dashboard/searchBar.html" %}
13 | {% include "dashboard/crosslist.html" %}
14 |
15 | {% endblock %}
16 |
--------------------------------------------------------------------------------
/static/admin/img/icon-no.svg:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/static/admin/img/inline-delete.svg:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/apps/twitter/models.py:
--------------------------------------------------------------------------------
1 | from django.db import models
2 |
3 | # Create your models here.
4 | import datetime
5 | from django.utils import timezone
6 |
7 | class tweet(models.Model):
8 | id = models.BigAutoField(primary_key=True)
9 | text = models.TextField()
10 | datetime = models.DateTimeField()
11 | user = models.CharField(max_length=255)
12 | screen_name = models.CharField(max_length=15)
13 |
14 | def __str__(self):
15 | return self.id
16 |
17 | def was_published_recently(self):
18 | return self.datetime >= timezone.now() - datetime.timedelta(days=7)
19 |
20 |
--------------------------------------------------------------------------------
/CHANGELOG.md:
--------------------------------------------------------------------------------
1 | # Changelog
2 |
3 | ## [0.0.1](https://github.com/nict-csl/exist/tree/v0.0.1) (2019-03-28)
4 | ### Security
5 | - Directory Traversal in URL Lookup. Reported by Shoji Baba from Kobe Digital Labo Inc. on 2019-03-26. [#2](https://github.com/nict-csl/exist/pull/2)
6 | - CSRF in Twitter Hunter and Threat Hunter. Reported by Shoji Baba from Kobe Digital Labo Inc. on 2019-03-26. [#2](https://github.com/nict-csl/exist/pull/2)
7 |
8 | ### Fixed
9 | - Fix ExploitDB plugin.
10 | - Fix typos in README. [#1](https://github.com/nict-csl/exist/pull/1) ([ninoseki](https://github.com/ninoseki))
11 |
--------------------------------------------------------------------------------
/apps/news_hunter/templates/news_hunter/hunt_edit_form.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load bootstrap4 %}
5 | {% load static %}
6 |
8 |
10 | EXIST
(EXternal Information aggregation System against cyber Threat)
9 |
7 |
17 | {% endblock %}
18 |
--------------------------------------------------------------------------------
/apps/news_hunter/templates/news_hunter/hunt_form.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load bootstrap4 %}
5 | {% load static %}
6 | Edit Hunter
8 | 13 |
14 | Back
15 |
16 |
7 |
17 | {% endblock %}
18 |
--------------------------------------------------------------------------------
/apps/threat/urls.py:
--------------------------------------------------------------------------------
1 | from django.conf.urls import url
2 |
3 | from . import views
4 |
5 | app_name = 'threat'
6 | urlpatterns = [
7 | #url(r'^$', views.EventListView.as_view(), name='event_list'),
8 | url(r'^event/$', views.EventListView.as_view(), name='event_list'),
9 | url(r'^event/(?PCreate New Hunter
8 | 13 |
14 | Back
15 |
16 |
7 |
17 | {% endblock %}
18 |
--------------------------------------------------------------------------------
/apps/threat_hunter/templates/threat_hunter/hunt_form.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load bootstrap4 %}
5 | {% load static %}
6 | Edit Hunter
8 | 13 |
14 | Back
15 |
16 |
7 |
17 | {% endblock %}
18 |
--------------------------------------------------------------------------------
/apps/twitter_hunter/templates/twitter_hunter/hunt_edit_form.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load bootstrap4 %}
5 | {% load static %}
6 | Create New Hunter
8 | 13 |
14 | Back
15 |
16 |
7 |
17 | {% endblock %}
18 |
--------------------------------------------------------------------------------
/apps/twitter_hunter/templates/twitter_hunter/hunt_form.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load bootstrap4 %}
5 | {% load static %}
6 | Edit Hunter
8 | 13 |
14 | Back
15 |
16 |
7 |
17 | {% endblock %}
18 |
--------------------------------------------------------------------------------
/apps/url/urls.py:
--------------------------------------------------------------------------------
1 | from django.conf.urls import url
2 |
3 | from . import views
4 |
5 | app_name = 'url'
6 | urlpatterns = [
7 | url(r'^$', views.IndexView.as_view(), name='index'),
8 | url(r'^code/(?PCreate New Hunter
8 | 13 |
14 | Back
15 |
16 |
7 |
20 | {% endblock %}
21 |
--------------------------------------------------------------------------------
/apps/twitter_hunter/urls.py:
--------------------------------------------------------------------------------
1 | from django.conf.urls import url
2 |
3 | from . import views
4 |
5 | app_name = 'twitter_hunter'
6 | urlpatterns = [
7 | url(r'^$', views.IndexView.as_view(), name='index'),
8 | url(r'^add/$', views.HuntCreateView.as_view(), name='hunt_create'),
9 | url(r'^(?PCreate New Hunter
8 | 16 |
17 | Back
18 |
19 |
2 |
19 |
--------------------------------------------------------------------------------
/apps/threat/templates/threat/org_list.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load humanize %}
5 | {% load static %}
6 |
3 |
4 |
17 |
18 | | Tag | 6 |Name | 7 |Description | 8 |
|---|---|---|
| {{ tag.name }} | 12 |{{ tag.longname }} | 13 |{{ tag.description }} | 14 |
7 |
9 |
10 |
24 |
25 | {% endblock %}
26 |
--------------------------------------------------------------------------------
/apps/threat/templates/threat/tag_list.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 |
3 | {% block content %}
4 | {% load humanize %}
5 | {% load static %}
6 | Orgs: {{ count| intcomma }}
8 || ID | 12 |Name | 13 |
|---|---|
| {{ org.id }} | 19 |{{ org.name }} | 20 |
7 |
9 |
10 |
24 |
25 | {% endblock %}
26 |
--------------------------------------------------------------------------------
/apps/reputation/templates/reputation/searchTargetValue.html.bk:
--------------------------------------------------------------------------------
1 | {% load lookup %}
2 | Tags: {{ count| intcomma }}
8 || ID | 12 |Name | 13 |
|---|---|
| {{ tag.id }} | 19 |{{ tag.name }} | 20 |
3 |
22 |
--------------------------------------------------------------------------------
/apps/threat/templates/threat/searchBar.html:
--------------------------------------------------------------------------------
1 | {% load static %}
2 |
3 |
17 | {% include "threat/searchTargetValue.html" %}
18 |
--------------------------------------------------------------------------------
/manage.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | import os
3 | import sys
4 | import pymysql
5 | pymysql.install_as_MySQLdb()
6 |
7 | if __name__ == "__main__":
8 | os.environ.setdefault("DJANGO_SETTINGS_MODULE", "intelligence.settings")
9 | try:
10 | from django.core.management import execute_from_command_line
11 | except ImportError:
12 | # The above import may fail for some other reason. Ensure that the
13 | # issue is really that Django is missing to avoid masking other
14 | # exceptions on Python 2.
15 | try:
16 | import django
17 | except ImportError:
18 | raise ImportError(
19 | "Couldn't import Django. Are you sure it's installed and "
20 | "available on your PYTHONPATH environment variable? Did you "
21 | "forget to activate a virtual environment?"
22 | )
23 | raise
24 | execute_from_command_line(sys.argv)
25 |
--------------------------------------------------------------------------------
/apps/reputation/api.py:
--------------------------------------------------------------------------------
1 | from rest_framework import viewsets
2 | from rest_framework.filters import SearchFilter
3 | from rest_framework.decorators import list_route
4 | from rest_framework.response import Response
5 | from apps.reputation.models import blacklist
6 | from apps.reputation.serializers import blSerializer, sourceSerializer
7 | from django_filters.rest_framework import DjangoFilterBackend
8 | from django_filters import ModelChoiceFilter, FilterSet
9 | from django.db.models import Q
10 |
11 | class blViewSet(viewsets.ReadOnlyModelViewSet):
12 | queryset = blacklist.objects.order_by('-datetime')
13 | serializer_class = blSerializer
14 | filter_backends = (SearchFilter, DjangoFilterBackend)
15 | search_fields = ['$ip', '$domain', '$url']
16 | filter_fields = ('ip', 'domain', 'url', 'source')
17 |
18 | @list_route()
19 | def sources(self, request):
20 | sources = blacklist.SOURCES
21 | return Response(dict(sources))
22 |
--------------------------------------------------------------------------------
/static/rest_framework/css/prettify.css:
--------------------------------------------------------------------------------
1 | .com { color: #93a1a1; }
2 | .lit { color: #195f91; }
3 | .pun, .opn, .clo { color: #93a1a1; }
4 | .fun { color: #dc322f; }
5 | .str, .atv { color: #D14; }
6 | .kwd, .prettyprint .tag { color: #1e347b; }
7 | .typ, .atn, .dec, .var { color: teal; }
8 | .pln { color: #48484c; }
9 |
10 | .prettyprint {
11 | padding: 8px;
12 | background-color: #f7f7f9;
13 | border: 1px solid #e1e1e8;
14 | }
15 | .prettyprint.linenums {
16 | -webkit-box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
17 | -moz-box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
18 | box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
19 | }
20 |
21 | /* Specify class=linenums on a pre to get line numbering */
22 | ol.linenums {
23 | margin: 0 0 0 33px; /* IE indents via margin-left */
24 | }
25 | ol.linenums li {
26 | padding-left: 12px;
27 | color: #bebec5;
28 | line-height: 20px;
29 | text-shadow: 0 1px 0 #fff;
30 | }
--------------------------------------------------------------------------------
/apps/news_hunter/forms.py:
--------------------------------------------------------------------------------
1 | from django.forms import ModelForm, CharField
2 | from django.utils.translation import ugettext_lazy as _
3 | from .models import Hunt
4 |
5 | def popover_html(label, content):
6 | return label + ' '
7 |
8 | class HuntForm(ModelForm):
9 | class Meta:
10 | model = Hunt
11 | fields = ('name', 'keyword', 'channel', 'notice', )
12 | labels = {
13 | 'notice': popover_html('slack notice', "Slack will be notified if checked."),
14 | }
15 |
16 | def __init__(self, *args, **kwargs):
17 | super().__init__(*args, **kwargs)
18 | self.fields['keyword'].widget.attrs['placeholder'] = "e.g. 'apt1 osint' is apt1 AND osint, and 'apt1,osint' is apt1 OR osint"
19 | self.fields['channel'].widget.attrs['placeholder'] = "slack channel name. default is th-[Name]."
20 |
--------------------------------------------------------------------------------
/apps/threat_hunter/forms.py:
--------------------------------------------------------------------------------
1 | from django.forms import ModelForm, CharField
2 | from django.utils.translation import ugettext_lazy as _
3 | from .models import Hunt
4 |
5 | def popover_html(label, content):
6 | return label + ' '
7 |
8 | class HuntForm(ModelForm):
9 | class Meta:
10 | model = Hunt
11 | fields = ('name', 'keyword', 'channel', 'notice', )
12 | labels = {
13 | 'notice': popover_html('slack notice', "Slack will be notified if checked."),
14 | }
15 |
16 | def __init__(self, *args, **kwargs):
17 | super().__init__(*args, **kwargs)
18 | self.fields['keyword'].widget.attrs['placeholder'] = "e.g. 'apt1 osint' is apt1 AND osint, and 'apt1,osint' is apt1 OR osint"
19 | self.fields['channel'].widget.attrs['placeholder'] = "slack channel name. default is th-[Name]."
20 |
21 |
22 |
--------------------------------------------------------------------------------
/apps/reputation/forms.py:
--------------------------------------------------------------------------------
1 | from django import forms
2 | from django.forms import ModelForm
3 | from .models import blacklist
4 |
5 | class SearchForm(forms.Form):
6 | keyword = forms.CharField(label='', max_length=100, required=False)
7 | keyword.widget.attrs['class'] = 'form-control mr-sm-2 my-2'
8 | keyword.widget.attrs['placeholder'] = 'Search for IP, Domain, URL.'
9 |
10 | class TargetForm(forms.Form):
11 | source = blacklist.SOURCES
12 |
13 | #class TargetForm(ModelForm):
14 | # class Meta:
15 | # model = blacklist
16 | # fields = ('source',)
17 |
18 | # def __init__(self, *args, **kwargs):
19 | # super(TargetForm, self).__init__(*args, **kwargs)
20 | # self.fields['source'].empty_label = 'none'
21 |
22 | # def __init__(self, *args, **kwargs):
23 | # super(TargetForm, self).__init__(*args, **kwargs)
24 | # for field_name, field in self.fields.items():
25 | # field.widget.attrs['class'] = 'form-control btn-group'
26 |
--------------------------------------------------------------------------------
/apps/twitter_hunter/templatetags/twitter_tag.py:
--------------------------------------------------------------------------------
1 | from django import template
2 | register = template.Library()
3 |
4 | #import re
5 | #from urllib.parse import urlparse
6 | #from http.client import HTTPSConnection
7 | #
8 | #def expand(url):
9 | # o = urlparse(url)
10 | # con = HTTPSConnection(o.netloc)
11 | # con.request('HEAD', o.path)
12 | # res = con.getresponse()
13 | # if res.getheader('location') == None:
14 | # return url
15 | # return res.getheader('location')
16 | #
17 | #@register.filter(name="expandurl", is_safe=True, needs_autoescape=True)
18 | #def expandurl(value, autoescape=True):
19 | # result = re.sub(r'http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+', lambda m:expand(m.group(0)), value)
20 | # return result
21 |
22 | @register.filter(name="add_a_tag_name_tooltip", is_safe=True, needs_autoescape=True)
23 | def add_a_tag_name_tooltip(value, autoescape=True):
24 | result = value.replace('rel="nofollow"', 'rel="nofollow" name="tooltip"')
25 | return result
26 |
27 |
--------------------------------------------------------------------------------
/apps/acti/urls.py:
--------------------------------------------------------------------------------
1 | # from django.urls import path
2 | from django.conf.urls import url, include
3 | from django.contrib import admin
4 | from . import views
5 |
6 | app_name = 'acti'
7 | urlpatterns = [
8 | url(r'^$',views.index, name='index'), # インデックス
9 | url(r'^add/$', views.tweet_add, name="tweet_add"),
10 | url(r'^get/$',views.tweet_get, name="tweet_get"),
11 | url(r'^tweet/',include([
12 | url(r'add_annotation/$',views.annotation, name='add_annotation'),
13 | url(r'annotation/(?P
4 |
17 |
20 |
21 | Events: {{ count| intcomma }}
7 || Date (JST) | 11 |Title | 12 |Content | 13 |
|---|---|---|
| {{ nw.datetime }} | 19 |
20 | {{ nw.title }} 21 | {{ nw.source_title }} 22 | |
23 | {{ nw.content|striptags|truncatewords:30 }} | 24 |
5 |
9 |
26 |
29 | {% endblock %}
30 |
--------------------------------------------------------------------------------
/static/admin/js/vendor/xregexp/LICENSE-XREGEXP.txt:
--------------------------------------------------------------------------------
1 | The MIT License
2 |
3 | Copyright (c) 2007-2012 Steven Levithan {{ exploit.title }}
6 | 7 | {% if error_message %}{{ error_message }}
{% endif %} 8 || Published Date (JST) | 11 |{{ exploit.datetime }} | 12 |
|---|---|
| Description | 15 |{{ exploit.description }} | 16 |
| Source | 19 |{{ exploit.get_source_display }} | 20 |
| Referrer | 23 |{{ exploit.referrer }} | 24 |
{{ exploit.text }}Records: {{ count| intcomma }}
8 || Date (JST) | 12 |IP Address | 13 |Domain | 14 |URL | 15 |Source | 16 |VT | 17 |DT | 18 |
|---|---|---|---|---|---|---|
| {{ bl.datetime }} | 24 |{{ bl.ip | default_if_none:'' }} | 25 |{{ bl.domain }} | 26 |{{ bl.url }} | 27 |{{ bl.get_source_display }} | 28 | |
29 |  |
30 |
| Date (JST) | 11 |Tweet | 12 |User | 13 |
|---|---|---|
| {{ tw.datetime }} | 19 |{{ tw.text | urlize | add_a_tag_name_tooltip | linebreaksbr }} | 20 |{{ tw.user }} @{{ tw.screen_name }} | 21 |
9 |
11 |
12 |
27 | {% include "exploit/page.html" %}
28 |
29 | {% endblock %}
30 |
31 | {% block javascript %}
32 |
56 | {% endblock %}
57 |
--------------------------------------------------------------------------------
Records: {{ count| intcomma }}
10 || Date (JST) | 14 |Title | 15 |Source | 16 |
|---|---|---|
| {{ ex.datetime }} | 22 |{{ ex.title }} | 23 |{{ ex.get_source_display }} | 24 |