From 9421e16826db85a575c3224984b1b6c4420324a0 Mon Sep 17 00:00:00 2001
From: shmilylty <admin@hackfun.org>
Date: Sat, 30 Nov 2019 21:00:04 +0800
Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0AlienVault=E6=8E=A5=E5=8F=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 oneforall/modules/intelligence/alienvault.py | 61 ++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 oneforall/modules/intelligence/alienvault.py

diff --git a/oneforall/modules/intelligence/alienvault.py b/oneforall/modules/intelligence/alienvault.py
new file mode 100644
index 0000000..599c61f
--- /dev/null
+++ b/oneforall/modules/intelligence/alienvault.py
@@ -0,0 +1,61 @@
+import time
+
+from common.query import Query
+
+
+class AlienVault(Query):
+    def __init__(self, domain):
+        Query.__init__(self)
+        self.domain = self.register(domain)
+        self.module = 'Intelligence'
+        self.source = 'AlienVaultQuery'
+
+    def query(self):
+        """
+        向接口查询子域并做子域匹配
+        """
+        time.sleep(self.delay)
+        self.header = self.get_header()
+        self.proxy = self.get_proxy(self.source)
+
+        base = 'https://otx.alienvault.com/api/v1/indicators/domain'
+        dns = f'{base}/{self.domain}/passive_dns'
+        resp = self.get(dns)
+        if not resp:
+            return
+        json = resp.json()
+        subdomains = self.match(self.domain, str(json))
+        self.subdomains = self.subdomains.union(subdomains)
+
+        url = f'{base}/{self.domain}/url_list'
+        resp = self.get(url)
+        if not resp:
+            return
+        json = resp.json()
+        subdomains = self.match(self.domain, str(json))
+        self.subdomains = self.subdomains.union(subdomains)
+
+    def run(self):
+        """
+        类执行入口
+        """
+        self.begin()
+        self.query()
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def do(domain):  # 统一入口名字 方便多线程调用
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    query = AlienVault(domain)
+    query.run()
+
+
+if __name__ == '__main__':
+    do('example.com')