Python MaltegoTransform.getVar方法代码示例

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
def new_transform(arg):
    m = MaltegoTransform()
    m.parseArguments(arg)
    ip = m.getVar('ipv4-address')
    wrkspc = m.getVar('workspace')
    url = 'http://10.1.99.250:8125/api/v1.0/%s/%s/asn' % (wrkspc, ip)
    try:
        r = requests.get(url)
        j = r.json()
        for i in j['items']:
            ent = m.addEntity('maltego.AS', i['asn'])
            ent.addAdditionalFields('workspace', 'Workspace ID', True, wrkspc)
    except Exception as e:
        m.addUIMessage(str(e))
    m.returnOutput()

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
def new_transform(arg):
    emails = []
    m = MaltegoTransform()
    m.parseArguments(arg)
    domain = m.getVar('fqdn')
    ip = m.getVar('ipaddr')
    wrkspc = m.getVar('workspace')
    url = 'http://10.1.99.250:8125/api/v1.0/%s/%s/domains' % (wrkspc, ip)
    try:
        r = requests.get(url)
        j = r.json()
        for i in j['items']:
            if domain in i['domain']:
                for x in i['data']['emails']:
                    if x not in emails:
                        emails.append(x)
        for t in emails:
            ent = m.addEntity('maltego.EmailAddress', t)
            ent.addAdditionalFields('workspace', 'Workspace ID', True, wrkspc)
    except Exception as e:
        m.addUIMessage(str(e))
    m.returnOutput()

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
def main():
#    print "Content-type: xml\n\n";
#    MaltegoXML_in = sys.stdin.read()
#    logging.debug(MaltegoXML_in)
#    if MaltegoXML_in <> '':
#     m = MaltegoMsg(MaltegoXML_in)

    TRX = MaltegoTransform()
    TRX.parseArguments(sys.argv)
    lat = float(TRX.getVar("latitude"))
    lng = float(TRX.getVar("longitude"))
    address = TRX.getVar("longaddress")

    logging.debug(lat)
    logging.debug(address)

    try:
        f = open("wigle_creds.txt", "r")
        user, passw, email,proxy = f.readline().strip().split(":")
    except Exception, e:
        print "ERROR: Unable to read Wigle user & pass, email (and optional proxy) from wigle_creds.txt"
        print e
        exit(-1)

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
#!/usr/bin/python
# Pull all the ingress sources attached to an ingress rule

from MaltegoTransform import *
import boto.ec2
import sys
from init import load_credentials

creds = load_credentials()
REGION = creds[2]

m = MaltegoTransform()
m.parseArguments(sys.argv)
ingress_src = m.getVar("GroupID")

try:
    conn = boto.ec2.connect_to_region(REGION, aws_access_key_id=creds[0], aws_secret_access_key=creds[1])

    reservations = conn.get_all_instances()

    for i in reservations:
        group_nums = len(i.instances[0].groups)
        for z in range(group_nums):
            group_id = i.instances[0].groups[z].id
            if str(group_id) == str(ingress_src):
                sec_rules = conn.get_all_security_groups(group_ids=group_id)[0].rules
                rule_nums = len(sec_rules)
                for g in range(rule_nums):
                    ent = m.addEntity('matterasmus.AmazonEC2IngressSource', str(conn.get_all_security_groups(group_ids=group_id)[0].rules[g].grants))
                    ent.addAdditionalFields("Source", "Source", "strict", str(conn.get_all_security_groups(group_ids=group_id)[0].rules[g].grants))
                    ent.addAdditionalFields("GroupID", "Group ID", "strict", str(group_id))

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
#!/usr/bin/python
# Pull all the egress destinations attached to an egress rule

from MaltegoTransform import *
import boto.ec2
import sys
from init import load_credentials

creds = load_credentials()
REGION = creds[2]

m = MaltegoTransform()
m.parseArguments(sys.argv)
egress_dst = m.getVar("GroupID")

try:
    conn = boto.ec2.connect_to_region(REGION, aws_access_key_id=creds[0], aws_secret_access_key=creds[1])

    reservations = conn.get_all_instances()

    for i in reservations:
        group_nums = len(i.instances[0].groups)
        for z in range(group_nums):
            group_id = i.instances[0].groups[z].id
            if str(group_id) == str(egress_dst):
                egress_rules = conn.get_all_security_groups(group_ids=group_id)[0].rules_egress
                number_of_egress = len(egress_rules)
                for g in range(number_of_egress):
                    ent = m.addEntity('matterasmus.AmazonEC2IngressSource', str(conn.get_all_security_groups(group_ids=group_id)[0].rules[g].grants))
                    ent.addAdditionalFields("Source", "Source", "strict", str(conn.get_all_security_groups(group_ids=group_id)[0].rules[g].grants))
                    ent.addAdditionalFields("GroupID", "Group ID", "strict", str(group_id))

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
            TRX.throwExceptions()
            exit(0)
        #loging.error(len(r))

        # The dirtiest hack of dirty hacks.
        if not shadowKey:
            shadowKey = "derpderpderp"
        if shadowKey and str(m.Type) == "snoopy.Snoopy":
            filters.append( mtk.c.mtkey == shadowKey )
            filters.append( mtk.c.user == users.c.user )
            filters.append( sess.c.drone == users.c.drone )

#Option Two, Local:
else:

    drone = TRX.getVar("properties.drone")
    if TRX.getVar("drone"):
        drone = TRX.getVar("drone")
    
    location = TRX.getVar("properties.dronelocation")
    if TRX.getVar("location"):
        location = TRX.getVar("location")
    
    start_time = TRX.getVar("properties.start_time", "2000-01-01 00:00:00.0")
    if TRX.getVar("start_time"):
        start_time = TRX.getVar("start_time", "2000-01-01 00:00:00.0")
    
    end_time = TRX.getVar("properties.end_time", "2037-01-01 00:00:00.0")
    if TRX.getVar("end_time"):
        end_time = TRX.getVar("end_time", "2037-01-01 00:00:00.0")
    

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
#!/usr/bin/python 
import sys
import csv
import os,sys,time,random
from MaltegoTransform import *
import EasyDialogs

me = MaltegoTransform();
me.parseArguments(sys.argv);
csv_file = me.getVar("file");
if (csv_file is None):
	defaultFile = "c:\stafflist.csv"
	csv_file = EasyDialogs.AskString("Which file do you want to use?",defaultFile);

if (csv_file is None):
	me.returnOutput();
	exit();
	


csv_reader = csv.reader(open(csv_file), delimiter = ',');
Emails = []
for row in csv_reader:
	Emails.append(row[0]);

EmailsUnique = dict(map(lambda i: (i,1),Emails)).keys()
for s in Emails:
	myentity = me.addEntity("EmailAddress",s);
	myentity.addAdditionalFields("file","CSV File",None,csv_file);
	

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
#!/usr/bin/python

#################
# NMAP VULN TOOL#
#################

import os, sys
from MaltegoTransform import *

m_ent = MaltegoTransform()
m_ent.parseArguments(sys.argv)

banner_grab = m_ent.getVar("banner")
open_grab = m_ent.getVar("opening")

if open_grab == "open":
    me_add = m_ent.addEntity("Banner", banner_grab)
    me_add.setType("jf.SuperFunTransforms")

m_ent.returnOutput()

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
username = config.get('credentials', 'username')
password = config.get('credentials', 'password')
auth = config.get('splunk','auth')
searchhead = config.get('splunk','searchhead')
timeframe = config.get('splunk', 'timeframe')
status = config.get('splunk', 'status')
proxy = config.get('splunk', 'proxy')
proxy_ip = config.get('splunk','proxy_ip')
proxy_port = config.get('splunk', 'proxy_port')

# Setting up Maltego entities and getting initial variables.

me = MaltegoTransform()
me.parseArguments(sys.argv)
application = sys.argv[1]
ds = me.getVar("ds")
dsport = me.getVar("dsport")

# Determine which REST call to make based on authentication setting.

if auth == "1":
	if proxy == "1":
		output = subprocess.check_output('curl -u ' + username + ':' + password + ' --socks5 ' + proxy_ip + ':' + proxy_port + ' -s -k https://' + ds + ':' + dsport + '/services/deployment/server/clients', shell=True)
	else:	
		output = subprocess.check_output('curl -u ' + username + ':' + password + ' -s -k https://' + ds + ':' + dsport + '/services/deployment/server/clients', shell=True)
else:
	if proxy == "1":
		output = subprocess.check_output('curl --socks5 ' + proxy_ip + ':' + proxy_port + ' -s -k https://' + ds + ':' + dsport + '/services/deployment/server/clients', shell=True)
	else:	
		output = subprocess.check_output('curl -s -k https://' + ds + ':' + dsport + '/services/deployment/server/clients', shell=True)

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
#!/usr/bin/env python

# Maltego transform for getting the robots.txt file from websites

from MaltegoTransform import *
import requests

m = MaltegoTransform()
m.parseArguments(sys.argv)

website = m.getVar('fqdn')
port = m.getVar('ports')
port = port.split(',')
ssl = m.getVar('website.ssl-enabled')
robots = []

try:
  for c in port:
    if ssl == 'true':
      url = 'https://' + website + ':' + str(c) + '/robots.txt'
      r = requests.get(url)
      if r.status_code == 200:
        robots = str(r.text).split('\n')
        for i in robots:
          ent = m.addEntity('maltego.Phrase', i)
          ent.addAdditionalFields("url","Original URL",True,url)
      else:
        m.addUIMessage("No Robots.txt found..")
    else:
      url = 'http://' + website + ':' + str(c) + '/robots.txt'
      r = requests.get(url)

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
#!/usr/bin/python
# Get all the instances in our Region

from MaltegoTransform import *
import sys
import boto3

mt = MaltegoTransform()
mt.parseArguments(sys.argv)
REGION = mt.getVar('RegionName')

try:
    client = boto3.resource('ec2', region_name=REGION)
    instances = client.instances.all()

    mt.addUIMessage("Getting instances in " + REGION)
    for instance in instances:
        ent = mt.addEntity('matterasmus.AmazonEC2Instance', instance.tags[0].get("Value"))
        ent.addAdditionalFields("InstanceId", "Instance ID", "strict", str(instance.id))
        ent.addAdditionalFields("InstanceType", "Instance Type", "strict", instance.instance_type)
        ent.addAdditionalFields("KeyName", "Key Name", "strict", instance.key_name)
        ent.addAdditionalFields("PrivateIp", "Private Ip", "strict", instance.private_ip_address)
        ent.addAdditionalFields("RegionName", "Region Name", "strict", REGION)
        ent.addAdditionalFields("InstanceState", "Instance State", True, str(instance.state['Name']))
        ent.addAdditionalFields("LaunchDate", "Launch Date", True, str(instance.launch_time))
    else:
        mt.addUIMessage("Completed.")
except Exception as e:
    mt.addUIMessage(str(e))

mt.returnOutput()

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
config = ConfigParser.SafeConfigParser()
config.read(configFile)

username = config.get('credentials', 'username')
password = config.get('credentials', 'password')
auth = config.get('splunk','auth')
searchhead = config.get('splunk','searchhead')
timeframe = config.get('splunk', 'timeframe')
status = config.get('splunk', 'status')

# Setting up Maltego entities and getting initial variables.

me = MaltegoTransform()
me.parseArguments(sys.argv)
ds = sys.argv[1]
dsport = me.getVar("dsport")

# Determine which REST call to make based on authentication setting.

if auth == "1":
	output = subprocess.check_output('curl -u ' + username + ':' + password + ' -s -k https://' + ds + ':' + dsport + '/services/deployment/server/clients', shell=True)
if auth == "0":		
	output = subprocess.check_output('curl -s -k https://' + ds + ':' + dsport + '/services/deployment/server/clients', shell=True)

# XML Parsing with ElementTree

root = ET.fromstring(output)
entry = root.find('{http://www.w3.org/2005/Atom}entry')
content = entry.find('{http://www.w3.org/2005/Atom}content')
dic = content.find('{http://dev.splunk.com/ns/rest}dict')
apps = dic.find(".//{http://dev.splunk.com/ns/rest}key[@name='applications']")

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
from MaltegoTransform import *
from mcrits_utils import *

crits = mcrits()

me = MaltegoTransform()
me.parseArguments(sys.argv)
id_ = me.getVar("id")
crits_type = me.getVar("crits_type")

for result in crits.get_related(crits_type, id_, "Event"):
    # For each related object, get the details.
    obj = crits.get_single_obj("Event", result[1])
    ent = me.addEntity(result[0], obj["title"])
    ent.addAdditionalFields(fieldName="id", displayName="id", value=result[1])

me.returnOutput()

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
def main():
    #    print "Content-type: xml\n\n";
    #    MaltegoXML_in = sys.stdin.read()
    #    logging.debug(MaltegoXML_in)
    #    if MaltegoXML_in <> '':
    #     m = MaltegoMsg(MaltegoXML_in)

    TRX = MaltegoTransform()
    TRX.parseArguments(sys.argv)
    # ssid = TRX.getVar("ssid")
    logging.debug(ssid)
    logging.debug(type(ssid))

    user = TRX.getVar("wigleUser")
    passw = TRX.getVar("wiglePass")
    email = TRX.getVar("wigleEmail")
    proxy = TRX.getVar("wigleProxy")

    if not user or not passw or not email:
        print "ERROR: Please supply Wigle credentials in the 'Property View' on the right --->"
        exit(-1)

    wig = Wigle(user, passw, email, proxy)
    if not wig.login():
        print "ERROR: Unable to login to Wigle with supplied wigle creds. Please check them."
        exit(-1)
    locations = wig.lookupSSID(ssid)
    if "error" in locations:
        print "ERROR: Unable to query Wigle. Perhaps your IP/user is shunned. Error was '%s'" % locations
        exit(-1)

    for address in locations:
        if len(locations) > 20:
            break
        # ssid = b64decode(ssid)
        # ssid=escape(ssid)
        # ssid = illegal_xml_re.sub('', ssid)
        logging.debug(type(address))

        street_view_url1 = (
            "http://maps.googleapis.com/maps/api/streetview?size=800x800&amp;sensor=false&amp;location=%s,%s"
            % (str(address["lat"]), str(address["long"]))
        )
        street_view_url2 = "https://maps.google.com/maps?q=&layer=c&cbp=11,0,0,0,0&cbll=%s,%s " % (
            str(address["lat"]),
            str(address["long"]),
        )
        map_url = "http://maps.google.com/maps?t=h&q=%s,%s" % (str(address["lat"]), str(address["long"]))
        flag_img = "http://www.geognos.com/api/en/countries/flag/%s.png" % str(address["code"]).upper()

        # NewEnt=TRX.addEntity("maltego.Location", address['shortaddress'].encode('utf-8'))
        NewEnt = TRX.addEntity("snoopy.ssidLocation", address["shortaddress"].encode("utf-8"))
        NewEnt.addAdditionalFields("city", "city", "strict", address["city"].encode("utf-8"))
        NewEnt.addAdditionalFields("countrycode", "countrycode", "strict", address["code"].encode("utf-8"))
        NewEnt.addAdditionalFields("country", "country", "strict", address["country"].encode("utf-8"))
        NewEnt.addAdditionalFields("lat", "lat", "strict", str(address["lat"]))
        NewEnt.addAdditionalFields("long", "long", "strict", str(address["long"]))
        NewEnt.addAdditionalFields("longaddress", "longaddress", "strict", address["longaddress"].encode("utf-8"))
        NewEnt.addAdditionalFields("location.areacode", "Area Code", "strict", address["postcode"])
        NewEnt.addAdditionalFields("road", "Road", "strict", address["road"].encode("utf-8"))
        NewEnt.addAdditionalFields("streetaddress", "streetaddress", "strict", address["shortaddress"].encode("utf-8"))
        NewEnt.addAdditionalFields("ssid", "SSID", "strict", address["ssid"])
        NewEnt.addAdditionalFields("state", "State", "strict", address["state"].encode("utf-8"))
        NewEnt.addAdditionalFields("area", "Area", "strict", address["suburb"].encode("utf-8"))

        NewEnt.addAdditionalFields("googleMap", "Google map", "nostrict", map_url)
        NewEnt.addAdditionalFields("streetView", "Street View", "nostrict", street_view_url2)

        # NewEnt.setIconURL(flag_img)
        logging.debug(street_view_url1)
        NewEnt.setIconURL(street_view_url1)

        NewEnt.addDisplayInformation("<a href='%s'>Click for map </a>" % street_view_url2, "Street view")

    TRX.returnOutput()

# 需要导入模块: import MaltegoTransform [as 别名]
# 或者: from MaltegoTransform import getVar [as 别名]
#!/usr/bin/env python

"""Expand the entities related to an RF Event."""

import sys
from MaltegoTransform import *
from APIUtil import APIUtil
from rf_maltego_conv import *
mt = MaltegoTransform()

mt.parseArguments(sys.argv)
eid = mt.getVar("eid")

rfapi = APIUtil()

reference_query = {
    "reference": {
        "cluster_id":eid,
        "limit": 100
    }
}

sys.stderr.write("RF querying...\n")
ents = []
seen_ids = set()
seen_ids.add(eid)
for ceid, ent in rfapi.query(reference_query).get("entities", {}).items():
    if ceid not in seen_ids:
        ent["id"] = ceid
        ents.append(ent)
        seen_ids.add(ceid)