te-k / harpoon Goto Github PK

Search in all the plugins available for malware using a given mutex

Create harpoon tools repo that would import short scripts in the path :

• ipinfo
• asninfo
• ip2asn
• ...

• http://bgpranking.circl.lu/asn_details?date=;source=;asn=43765
• https://www.circl.lu/projects/bgpranking/

https://peeringdb.com/apidocs/

https://malshare.com/doc.php

https://cymon.io/

something like harpoon help vt

https://www.threatminer.org/

https://developers.facebook.com/products/threat-exchange

I guess their API is a mess ?

https://tech.yandex.com/safebrowsing/

Plugin to research everything possible on a domain (with options about aggressivity)

https://github.com/Yelp/threat_intel
https://github.com/The-Shadowserver-Foundation/api_utils/wiki

Use https://github.com/Te-k/pyshadowserver

Do something like Nhoya/gOSINT@82de01f

Plugin to gather as much information as possible on an email address

• List keys and attached emails
• Graph of keys signed

Three different options :

• Human readable with colors
• CSV
• JSON

It would be nice to have the same option -f everywhere, bu default may change ?

crtsh plugin can return several times the same certificate

• Store in a sqlite db
• Replace print by a function that records everything

https://totalhash.cymru.com/contact-us/

• Check all DNS entries of a domain
• Add complementary information (ASN...)

Like : https://github.com/x0rz/tweets_analyzer

Useful if people are looking for the file of a sample : https://virusshare.com/

https://github.com/sangaline/wayback-machine-scraper

Not sure it is really helpful, they are both pretty expensive

• https://api.builtwith.com/
• https://www.wappalyzer.com/api

https://www.threatcrowd.org/ https://github.com/AlienVault-OTX/ApiV2

add file subcommand and check for its hash

Add HackerTarget OSint tools :

• https://hackertarget.com/ip-tools/
• http://api.hackertarget.com/pagelinks/?q=citizenlab.ca
• https://api.hackertarget.com/httpheaders/?q=www.google.com

https://www.onyphe.io/

General option to keep a shell after harpoon is executed with the context

https://github.com/Grey-Noise-Intelligence/api.greynoise.io

https://www.anomali.com/

I haves problems with telegram.
python and Telethon version is:
python3.6
Telethon 0.17.4.1

root@kali:~/harpoon# harpoon telegram messages cybersecurity
Traceback (most recent call last):
  File "/usr/local/bin/harpoon", line 11, in <module>
    load_entry_point('harpoon==0.1.1', 'console_scripts', 'harpoon')()
  File "/usr/local/lib/python3.6/dist-packages/harpoon-0.1.1-py3.6.egg/harpoon/main.py", line 52, in main
    plugins[args.command].run(config, args, plugins)
  File "/usr/local/lib/python3.6/dist-packages/harpoon-0.1.1-py3.6.egg/harpoon/commands/telegram.py", line 78, in run
    print("%i messages downloaded:" % messages[0])
  File "/usr/lib/python3.6/collections/__init__.py", line 1050, in __getitem__
    def __getitem__(self, i): return self.data[i]
IndexError: list index out of range

Gather all information possible

https://haveibeenpwned.com/API/v2

https://www.dshield.org/api/#ip

Apparently they have a good API and it is open to everyone : https://www.hybrid-analysis.com/apikeys/info

http://apidocs.emergingthreats.net/

• confirm that -t saves tweets and replies
• Graph feature to map relation with other accounts

https://github.com/Te-k/spyonweb

Improvement of Pgp plugin

https://dev.maxmind.com/geoip/geoip2/geolite2/

Sometimes it is extracting the index file and not the mmdb

https://www.phishtank.com/api_info.php

Robtex provides interesting information through the API : https://www.robtex.com/api/

https://pypi.python.org/pypi/fake-useragent

Or at least, use the same UA everywhere (harpoon + version)

http://toolbar.netcraft.com/site_report?url=theguardian.com

https://ipinfo.io/

Add plugin for the Location API http://locationapi.org/products