Seon.io module #1141

krishnasism · 2021-02-13T05:11:01Z

No description provided.

Update - 30/9

Update

upd

Update master 16-01-2021

codecov-io · 2021-02-13T05:17:20Z

Codecov Report

Merging #1141 (879d514) into master (4ffad6a) will decrease coverage by 0.30%.
The diff coverage is 29.18%.

@@            Coverage Diff             @@
##           master    #1141      +/-   ##
==========================================
- Coverage   50.78%   50.47%   -0.31%     
==========================================
  Files         442      454      +12     
  Lines       35777    36536     +759     
==========================================
+ Hits        18168    18443     +275     
- Misses      17609    18093     +484

Impacted Files	Coverage Δ
spiderfoot/db.py	`75.30% <ø> (ø)`
modules/sfp_seon.py	`14.94% <14.94%> (ø)`
test/unit/modules/test_sfp_seon.py	`100.00% <100.00%> (ø)`
modules/sfp_pageinfo.py	`32.35% <0.00%> (-3.14%)`	⬇️
modules/sfp_shodan.py	`18.37% <0.00%> (-1.63%)`	⬇️
modules/sfp_s3bucket.py	`22.12% <0.00%> (-0.40%)`	⬇️
modules/sfp_binaryedge.py	`13.18% <0.00%> (-0.15%)`	⬇️
sfcli.py	`31.18% <0.00%> (ø)`
test/unit/modules/test_sfp_ipapicom.py	`60.00% <0.00%> (ø)`
... and 13 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4ffad6a...879d514. Read the comment docs.

smicallef · 2021-02-18T19:30:56Z

modules/sfp_seon.py

+    # Option descriptions
+    optdescs = {
+        'api_key': "API Key for seon.io",
+        'fraud_threshold': 'Minimum fraud score for target to be marked as malicious(0-100)',


Missing space after malicious.

smicallef · 2021-02-18T19:31:43Z

modules/sfp_seon.py

+            "MALICIOUS_EMAILADDR",
+            "EMAILADDR_DELIVERABLE",
+            "EMAILADDR_UNDELIVERABLE",
+            "SOCIAL_MEDIAL",


smicallef · 2021-02-18T19:34:37Z

modules/sfp_seon.py

+                        evt = SpiderFootEvent('TCP_PORT_OPEN', f"{eventData}:{port}", self.__name__, event)
+                        self.notifyListeners(evt)
+
+                if resultSet.get('tor'):


These following events should only be reported if they are positive. i.e. I don't think it's valuable to report that something is NOT a VPN, for example, since most things won't be.

smicallef · 2021-02-18T19:35:45Z

modules/sfp_seon.py

+                    for site in socialMediaList:
+                        if resultSet.get('account_details').get(site):
+                            if resultSet.get('account_details').get(site).get('url'):
+                                evt = SpiderFootEvent("SOCIAL_MEDIA", f"{site}: <SFURL> {resultSet.get('account_details').get(site).get('url')} </SFURL>", self.__name__, event)


No space after <SFURL> and before </SFURL>.

smicallef · 2021-02-18T19:44:10Z

modules/sfp_seon.py

+                    evt = SpiderFootEvent("PROVIDER_TELCO", resultSet.get('carrier'), self.__name__, event)
+                    self.notifyListeners(evt)
+
+            evt = SpiderFootEvent('RAW_RIR_DATA', str(resultSet), self.__name__, event)


RAW_RIR_DATA should only be reported if data was found. Also, it's only being reported in this elif branch - it should probably be up one further.

smicallef · 2021-02-28T19:45:46Z

modules/sfp_seon.py

+
+    # Option descriptions
+    optdescs = {
+        'api_key': "API Key for seon.io",


This should be in the form of <name> API Key.

smicallef · 2021-02-28T19:46:41Z

modules/sfp_seon.py

+            self.errorState = True
+            return
+
+        if self.errorState:


Check should be higher up.

smicallef · 2021-02-28T19:48:29Z

modules/sfp_seon.py

+
+                if resultSet.get('country'):
+                    location = ', '.join(filter(None, [resultSet.get('city'), resultSet.get('state_prov'), resultSet.get('country')]))
+                    location += f"\n-Latitude: {resultSet.get('latitude')}\n-Longitude: {resultSet.get('longitude')}"


Lat/Lon has its own event type - PHYSICAL_COORDINATES, so should be a separate additional event.

smicallef · 2021-03-11T18:00:22Z

modules/sfp_seon.py

+            useragent=self.opts['_useragent']
+        )
+
+        return json.loads(res['content'])


Should have the regular 404, 429, etc. checks here before returning and setting errorState if appropriate.

smicallef · 2021-03-11T18:01:39Z

modules/sfp_seon.py

+
+            resultSet = data.get('data')
+            if resultSet:
+                if resultSet.get('score') >= self.opts['fraud_threshold']:


When using .get() and expecting an integer for comparison, set 0 as the value to be returned in case the key isn't found (e.g. resultSet.get('score', 0), so that you don't raise an exception for trying to compare a None with a number.

smicallef · 2021-03-11T18:04:06Z

modules/sfp_seon.py

+
+                    if resultSet.get('public_proxy'):
+                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is Public Proxy: {resultSet.get('public_proxy')}", self.__name__, event)
+                        self.notifyListeners(evt)


If the entity isn't a proxy, etc. will this still result in an event? It should not - i.e. we only want events here if the entity is a proxy, etc.

It should not go in if its False

smicallef · 2021-03-11T18:04:38Z

modules/sfp_seon.py

+                        evt = SpiderFootEvent('TCP_PORT_OPEN', f"{eventData}:{port}", self.__name__, event)
+                        self.notifyListeners(evt)
+
+                evt = SpiderFootEvent('RAW_RIR_DATA', str(resultSet), self.__name__, event)


RAW_RIR_DATA should only be reported if data was found for the entity.

krishnasism and others added 10 commits September 30, 2020 21:45

Merge pull request #11 from smicallef/master

70ca018

Update - 30/9

Merge pull request #12 from smicallef/master

252ba75

Update

Merge pull request #13 from smicallef/master

975c297

Update

Merge pull request #14 from smicallef/master

0dcd554

upd

Merge pull request #15 from smicallef/master

7dd6fce

Update master 16-01-2021

SEON

2ca46c1

First commit

25cef01

seon

26247ba

seon test

d033914

Remove debug statement

d166ad1

smicallef reviewed Feb 18, 2021

View reviewed changes

modules/sfp_seon.py Outdated

"MALICIOUS_EMAILADDR",

"EMAILADDR_DELIVERABLE",

"EMAILADDR_UNDELIVERABLE",

"SOCIAL_MEDIAL",

Copy link

Owner

smicallef Feb 18, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo

smicallef reviewed Feb 18, 2021

View reviewed changes

Code review changes

6db6434

smicallef reviewed Feb 28, 2021

View reviewed changes

modules/sfp_seon.py Outdated

self.errorState = True

return

if self.errorState:

Copy link

Owner

smicallef Feb 28, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check should be higher up.

smicallef reviewed Feb 28, 2021

View reviewed changes

krishnasism added 2 commits March 1, 2021 09:58

Code review changes

9af6fbf

Dummy commit

2ff5005

smicallef reviewed Mar 11, 2021

View reviewed changes

krishnasism added 2 commits March 13, 2021 09:13

Code review changes

a9d6671

Code review

879d514

smicallef merged commit d2a4935 into smicallef:master Mar 27, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Seon.io module #1141

Seon.io module #1141

krishnasism commented Feb 13, 2021

codecov-io commented Feb 13, 2021 •

edited

Loading

smicallef Feb 18, 2021

smicallef Feb 18, 2021

smicallef Feb 18, 2021

smicallef Feb 18, 2021 •

edited

Loading

smicallef Feb 18, 2021 •

edited

Loading

smicallef Feb 28, 2021

smicallef Feb 28, 2021

smicallef Feb 28, 2021

smicallef Mar 11, 2021

smicallef Mar 11, 2021 •

edited

Loading

smicallef Mar 11, 2021

krishnasism Mar 13, 2021

smicallef Mar 11, 2021

Seon.io module #1141

Seon.io module #1141

Conversation

krishnasism commented Feb 13, 2021

codecov-io commented Feb 13, 2021 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

smicallef Feb 18, 2021 • edited Loading

Choose a reason for hiding this comment

smicallef Feb 18, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

smicallef Mar 11, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-io commented Feb 13, 2021 •

edited

Loading

smicallef Feb 18, 2021 •

edited

Loading

smicallef Feb 18, 2021 •

edited

Loading

smicallef Mar 11, 2021 •

edited

Loading