Class: Mihari::Analyzers::Urlscan

Inherits:
Base
  • Object
show all
Defined in:
lib/mihari/analyzers/urlscan.rb

Instance Attribute Summary collapse

Attributes inherited from Base

#the_hive

Instance Method Summary collapse

Methods inherited from Base

#run, #run_emitter

Constructor Details

#initialize(query, title: nil, description: nil, tags: [], target_type: "url") ⇒ Urlscan

Returns a new instance of Urlscan.

Raises:

  • (ArgumentError) 


15
16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/mihari/analyzers/urlscan.rb', line 15

def initialize(query, title: nil, description: nil, tags: [], target_type: "url")
  super()

  @api = ::UrlScan::API.new
  @query = query
  @title = title || "urlscan lookup"
  @description = description || "query = #{query}"
  @tags = tags
  @target_type = target_type

  raise ArgumentError, "type should be url, domain or ip." unless valid_target_type?
end

Instance Attribute Details

#api ⇒ Object (readonly)

Returns the value of attribute api.



8
9
10
 
# File 'lib/mihari/analyzers/urlscan.rb', line 8

def api
  @api
end

#description ⇒ Object (readonly)

Returns the value of attribute description.



10
11
12
 
# File 'lib/mihari/analyzers/urlscan.rb', line 10

def description
  @description
end

#query ⇒ Object (readonly)

Returns the value of attribute query.



11
12
13
 
# File 'lib/mihari/analyzers/urlscan.rb', line 11

def query
  @query
end

#tags ⇒ Object (readonly)

Returns the value of attribute tags.



12
13
14
 
# File 'lib/mihari/analyzers/urlscan.rb', line 12

def tags
  @tags
end

#target_type ⇒ Object (readonly)

Returns the value of attribute target_type.



13
14
15
 
# File 'lib/mihari/analyzers/urlscan.rb', line 13

def target_type
  @target_type
end

#title ⇒ Object (readonly)

Returns the value of attribute title.



9
10
11
 
# File 'lib/mihari/analyzers/urlscan.rb', line 9

def title
  @title
end

Instance Method Details

#artifacts ⇒ Object 



28
29
30
31
32
33
34
35
36
 
# File 'lib/mihari/analyzers/urlscan.rb', line 28

def artifacts
  result = search
  return [] unless result

  results = result.dig("results") || []
  results.map do |match|
    match.dig "page", target_type
  end.compact.uniq
end