-
Notifications
You must be signed in to change notification settings - Fork 15
/
censys_ip_to_cert.py
131 lines (124 loc) · 6.28 KB
/
censys_ip_to_cert.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
"""
This script is written by Mark Parsons and is to be used in Maltego to lookup IP addresses in Censys.io and look for
ssl certificates
Date: 12/22/2015
This assumes this script is first, uid is second, secreted is third, ip is fourth and the related object is 5th
"""
import requests
import json
from MaltegoTransform import *
def main():
mt = MaltegoTransform()
if len(sys.argv) != 5:
mt.addException("You appear to be missing your uid and secret. Here is what was in your path: {s}".format(
s=sys.argv))
mt.throwExceptions()
censys_uid = sys.argv[1]
censys_secret = sys.argv[2]
ip = sys.argv[3]
auth = (censys_uid, censys_secret)
page = 1
query = {'query': 'ip: {ip}'.format(ip=ip), 'fields': ['443.https.tls.certificate.parsed.fingerprint_sha1',
'443.https.tls.certificate.parsed.issuer_dn',
'443.https.tls.certificate.parsed.subject_dn',
'updated_at'], 'page': page}
try:
request = requests.post('https://www.censys.io/api/v1/search/ipv4', data=json.dumps(query), auth=auth)
if request.status_code == 200:
results = request.json()
pages = results['metadata']['pages']
if results['metadata']['count'] > 0:
parse_results(results['results'], mt)
if pages > 1 > 4:
mt.addUIMessage("Found more than one page. Getting up to the first 100 results")
for i in range(2, 5):
page = i
query['page'] = page
request = requests.post('https://www.censys.io/api/v1/search/ipv4', data=json.dumps(query),
auth=auth)
if request.status_code == 200:
results = request.json()
if results['metadata']['count'] > 0:
parse_results(results['results'], mt)
else:
if request.status_code == 400:
results = request.json()
mt.addException(str(results['error']))
if request.status_code == 429:
results = request.json()
mt.addException(str(results['error']))
if request.status_code == 404:
mt.addException("No info found")
if request.status_code == 500:
mt.addException("There has been a server error!!!")
if pages < 5 > 1:
for i in range(2, pages):
page = i
query['page'] = page
request = requests.post('https://www.censys.io/api/v1/search/ipv4', data=json.dumps(query),
auth=auth)
if request.status_code == 200:
results = request.json()
if results['metadata']['count'] > 0:
parse_results(results['results'], mt)
else:
if request.status_code == 400:
results = request.json()
mt.addException(str(results['error']))
if request.status_code == 429:
results = request.json()
mt.addException(str(results['error']))
if request.status_code == 404:
mt.addException("No info found")
if request.status_code == 500:
mt.addException("There has been a server error!!!")
else:
mt.addUIMessage("No SSL certs were found on this ip: {ip}".format(ip=ip))
mt.returnOutput()
else:
if request.status_code == 400:
results = request.json()
mt.addException(str(results['error']))
if request.status_code == 429:
results = request.json()
mt.addException(str(results['error']))
if request.status_code == 404:
mt.addException("No SSL certs were found on this ip: {ip}".format(ip=ip))
if request.status_code == 500:
mt.addException("There has been a server error!!!")
mt.throwExceptions()
except requests.exceptions.RequestException as e:
mt.addException(str(e))
mt.throwExceptions()
def parse_results(results, mt):
for result in results:
if '443' in result and 'https' in result['443'] and 'tls' in result['443']['https'] and 'certificate' in \
result['443']['https']['tls'] and 'parsed' in result['443']['https']['tls']['certificate'] :
parsed = result['443']['https']['tls']['certificate']['parsed']
if 'fingerprint_sha1' in parsed:
sha1 = parsed['fingerprint_sha1']
else:
sha1 = "No sha1 found"
if 'issuer_dn' in parsed:
issuer = parsed['issuer_dn'].encode('utf-8').strip()
else:
issuer = "No issuer found"
if 'subject_dn' in parsed:
subject = parsed['subject_dn'].encode('utf-8').strip()
else:
subject = "No subject found"
if 'updated_at' in result:
updated = result['updated_at']
else:
updated = "No updated_at timestamp"
sslcert = mt.addEntity("censys.sslcertificate", sha1)
sslcert.addAdditionalFields("property.issuer", "Cert Issuer", True, issuer)
sslcert.addAdditionalFields("property.subject", "Cert Subject", True, subject)
sslcert.addAdditionalFields("property.last_updated", "Last updated time", True, updated)
else:
mt.addUIMessage("Hmm there is info on the IP but not ssl :( ")
if __name__ == "__main__":
try:
main()
except KeyboardInterrupt:
print "User aborted."