zeustracker.py 文件源码

def search(self):
        mod.display(self.module_name, "", "INFO", "Searching...")
        url = "https://zeustracker.abuse.ch/"
        paths = [
            "blocklist.php?download=baddomains",
            "blocklist.php?download=ipblocklist",
            "blocklist.php?download=compromised"
        ]
        for path in paths:
            if self.type == "URL":
                try:
                    self.ioc = self.ioc.split("://")[1]
                except:
                    pass
            content = Cache(self.module_name, url, path, self.search_method).content
            for line in content.split("\n"):
                if path.split("=")[1] == "compromised":
                    if self.type == "URL":
                        if self.ioc == line:
                            mod.display(self.module_name, self.ioc, "FOUND", "%s%s"%(url, path))
                            return
                    else:
                        line = line.split("/")[0]
                        try:
                            line = line.split(":")[0]
                        except:
                            pass
                if self.type == "domain" and validators.domain(line.strip()):
                    if line.strip() == self.ioc:
                        mod.display(self.module_name, self.ioc, "FOUND", "%s%s"%(url, path))
                        return
                elif self.type == "IPv4" and validators.ipv4(line.strip()):
                    if line.strip() == self.ioc:
                        mod.display(self.module_name, self.ioc, "FOUND", "%s%s"%(url, path))
                        return