-
Notifications
You must be signed in to change notification settings - Fork 7
/
ToTags.py
68 lines (59 loc) · 3.21 KB
/
ToTags.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
from maltego_trx.maltego import MaltegoMsg, MaltegoTransform, UIM_INFORM
from maltego_trx.transform import DiscoverableTransform
from extensions import registry
from api.utils import create_entity_with_details, get_currency_from_entity_details, get_address_details, get_entity_details
@registry.register_transform(
display_name='To Tags',
input_entity='maltego.Cryptocurrency',
description='Returns known attribution tags',
output_entities=['maltego.Cryptocurrency']
)
class ToTags(DiscoverableTransform):
"""
Lookup the attribution tags associated with a Virtual Asset and the entity (cluster) it belongs to.
"""
@classmethod
def create_entities(cls, request: MaltegoMsg, responseMaltego: MaltegoTransform):
query_type = "tags"
entity_details = request.Properties
if 'cryptocurrency.wallet.name' in entity_details: # If so, we are looking for tags in a cluster
query_type = "entity_tags"
address = int(entity_details['cluster_ID'])
currencies = [str(entity_details['currency'])] #if it is a cluster the currency is known
#if 'properties.cryptocurrencyaddress' in entity_details: #Else, we are looking for tags on a specific address
# address = str(entity_details['properties.cryptocurrencyaddress'])
else:
if "currency" in entity_details: #if a currency is already specified in the details, we use that currency and only that one. Else, we try to figure out what currency this could be and check all.
currencies = [entity_details['currency']]
else:
currencies = get_currency_from_entity_details(request.Properties) # We use regex to check what Cryptocurrency this is. This could return BTC and BCH since they are similar.
if currencies[1]:
responseMaltego.addUIMessage("\n" + currencies[1] + "\n",UIM_INFORM)
return
currencies = currencies[0]
address = entity_details['properties.cryptocurrencyaddress']
for currency in currencies:
if (query_type == "tags"):#i.e.: for cryptocurrency addresses
results = get_address_details(currency,address)
else:#i.e. for clusters
results = get_entity_details(currency,address)
if results[1] :
if "504 Bad Gateway" in results[1]:# the Graphsense server is missing a </hr> in its HTTP504 response page which bugs Maltego hence the below. handling...
responseMaltego.addUIMessage("\nThere was a Graphsense server 504 Bad Gateway response running the query " + query_type + " for " + currency + "\n",UIM_INFORM)
if "(404)" in results[1]:
responseMaltego.addUIMessage("\nNothing found in " + currency + " for : " + str(address) + "\n",UIM_INFORM)
else:
responseMaltego.addUIMessage(results[1],UIM_INFORM)
#return
else:
responses = create_entity_with_details(results[0],currency,query_type, responseMaltego)
if responses[1]:
if "504 Bad Gateway" in responses[1]:
responseMaltego.addUIMessage("\nThere was a Graphsense server 504 Bad Gateway response while creating the results:\n" + " for " + currency + "\n",UIM_INFORM)
if "(404)" in responses[1]:
responseMaltego.addUIMessage("\nNothing found in " + currency + " for : " + str(address) + "\n",UIM_INFORM)
else:
responseMaltego.addUIMessage(responses[1],UIM_INFORM)
return
if __name__ == "__main__":
create_entities(sys.argv[1])