lookyloo/lookyloo.py
def misp_export(self, capture_uuid: str, /, with_parent: bool=False) -> Union[List[MISPEvent], Dict[str, str]]:
        '''Export a capture in MISP format. You can POST the return of this method
        directly to a MISP instance and it will create an event.'''
        cache = self.capture_cache(capture_uuid)
        if not cache:
            return {'error': 'UUID missing in cache, try again later.'}

        if cache.incomplete_redirects:
            self._cache_capture(capture_uuid)
            cache = self.capture_cache(capture_uuid)
            if not cache:
                return {'error': 'UUID missing in cache, try again later.'}

        ct = self.get_crawled_tree(capture_uuid)

        event = MISPEvent()
        event.info = f'Lookyloo Capture ({cache.url})'
        lookyloo_link: MISPAttribute = event.add_attribute('link', f'https://{self.public_domain}/tree/{capture_uuid}')  # type: ignore
        if not self.is_public_instance:
            lookyloo_link.distribution = 0

        initial_url = URLObject(cache.url)
        initial_url.comment = 'Submitted URL'
        self.__misp_add_ips_to_URLObject(initial_url, ct.root_hartree.hostname_tree)

        redirects: List[URLObject] = []
        for nb, url in enumerate(cache.redirects):
            if url == cache.url:
                continue
            obj = URLObject(url)
            obj.comment = f'Redirect {nb}'
            self.__misp_add_ips_to_URLObject(obj, ct.root_hartree.hostname_tree)
            redirects.append(obj)
        if redirects:
            redirects[-1].comment = f'Last redirect ({nb})'

        if redirects:
            prec_object = initial_url
            for u_object in redirects:
                prec_object.add_reference(u_object, 'redirects-to')
                prec_object = u_object

        initial_obj = event.add_object(initial_url)
        initial_obj.add_reference(lookyloo_link, 'captured-by', 'Capture on lookyloo')

        for u_object in redirects:
            event.add_object(u_object)
        final_redirect = event.objects[-1]

        screenshot: MISPAttribute = event.add_attribute('attachment', 'screenshot_landing_page.png', data=self.get_screenshot(capture_uuid), disable_correlation=True)  # type: ignore
        try:
            fo = FileObject(pseudofile=ct.root_hartree.rendered_node.body, filename=ct.root_hartree.rendered_node.filename)
            fo.comment = 'Content received for the final redirect (before rendering)'
            fo.add_reference(final_redirect, 'loaded-by', 'URL loading that content')
            fo.add_reference(screenshot, 'rendered-as', 'Screenshot of the page')
            event.add_object(fo)
        except Har2TreeError:
            pass
        except AttributeError:
            # No `body` in rendered node
            pass

        if self.vt.available:
            for e_obj in event.objects:
                if e_obj.name != 'url':
                    continue
                vt_obj = self.__misp_add_vt_to_URLObject(e_obj)
                if vt_obj:
                    event.add_object(vt_obj)

        if with_parent and cache.parent:
            parent = self.misp_export(cache.parent, with_parent)
            if isinstance(parent, dict):
                # Something bad happened
                return parent

            event.extends_uuid = parent[-1].uuid
            parent.append(event)
            return parent

        return [event]
Export a capture in MISP format. You can POST the return of this method
        directly to a MISP instance and it will create an event.
Export a capture in MISP format. You can POST the return of this method
directly to a MISP instance and it will create an event.
Export a capture in MISP format . You can POST the return of this method directly to a MISP instance and it will create an event .
def misp_export(self, capture_uuid: str, /, with_parent: bool=False) -> Union[List[MISPEvent], Dict[str, str]]:
        cache = self.capture_cache(capture_uuid)
        if not cache:
            return {'error': 'UUID missing in cache, try again later.'}
        if cache.incomplete_redirects:
            self._cache_capture(capture_uuid)
            cache = self.capture_cache(capture_uuid)
            if not cache:
                return {'error': 'UUID missing in cache, try again later.'}
        ct = self.get_crawled_tree(capture_uuid)
        event = MISPEvent()
        event.info = f'Lookyloo Capture ({cache.url})'
        lookyloo_link: MISPAttribute = event.add_attribute('link', f'https://{self.public_domain}/tree/{capture_uuid}')  
        if not self.is_public_instance:
            lookyloo_link.distribution = 0
        initial_url = URLObject(cache.url)
        initial_url.comment = 'Submitted URL'
        self.__misp_add_ips_to_URLObject(initial_url, ct.root_hartree.hostname_tree)
        redirects: List[URLObject] = []
        for nb, url in enumerate(cache.redirects):
            if url == cache.url:
                continue
            obj = URLObject(url)
            obj.comment = f'Redirect {nb}'
            self.__misp_add_ips_to_URLObject(obj, ct.root_hartree.hostname_tree)
            redirects.append(obj)
        if redirects:
            redirects[-1].comment = f'Last redirect ({nb})'
        if redirects:
            prec_object = initial_url
            for u_object in redirects:
                prec_object.add_reference(u_object, 'redirects-to')
                prec_object = u_object
        initial_obj = event.add_object(initial_url)
        initial_obj.add_reference(lookyloo_link, 'captured-by', 'Capture on lookyloo')
        for u_object in redirects:
            event.add_object(u_object)
        final_redirect = event.objects[-1]
        screenshot: MISPAttribute = event.add_attribute('attachment', 'screenshot_landing_page.png', data=self.get_screenshot(capture_uuid), disable_correlation=True)  
        try:
            fo = FileObject(pseudofile=ct.root_hartree.rendered_node.body, filename=ct.root_hartree.rendered_node.filename)
            fo.comment = 'Content received for the final redirect (before rendering)'
            fo.add_reference(final_redirect, 'loaded-by', 'URL loading that content')
            fo.add_reference(screenshot, 'rendered-as', 'Screenshot of the page')
            event.add_object(fo)
        except Har2TreeError:
            pass
        except AttributeError:
            pass
        if self.vt.available:
            for e_obj in event.objects:
                if e_obj.name != 'url':
                    continue
                vt_obj = self.__misp_add_vt_to_URLObject(e_obj)
                if vt_obj:
                    event.add_object(vt_obj)
        if with_parent and cache.parent:
            parent = self.misp_export(cache.parent, with_parent)
            if isinstance(parent, dict):
                return parent
            event.extends_uuid = parent[-1].uuid
            parent.append(event)
            return parent
        return [event]
def misp_export ( self , capture_uuid : str , / , with_parent : bool = False ) -> Union [ List [ MISPEvent ] , Dict [ str , str ] ] : cache = self . capture_cache ( capture_uuid ) if not cache : return { 'error' : 'UUID missing in cache, try again later.' } if cache . incomplete_redirects : self . _cache_capture ( capture_uuid ) cache = self . capture_cache ( capture_uuid ) if not cache : return { 'error' : 'UUID missing in cache, try again later.' } ct = self . get_crawled_tree ( capture_uuid ) event = MISPEvent ( ) event . info = f'Lookyloo Capture ({cache.url})' lookyloo_link : MISPAttribute = event . add_attribute ( 'link' , f'https://{self.public_domain}/tree/{capture_uuid}' ) if not self . is_public_instance : lookyloo_link . distribution = 0 initial_url = URLObject ( cache . url ) initial_url . comment = 'Submitted URL' self . __misp_add_ips_to_URLObject ( initial_url , ct . root_hartree . hostname_tree ) redirects : List [ URLObject ] = [ ] for nb , url in enumerate ( cache . redirects ) : if url == cache . url : continue obj = URLObject ( url ) obj . comment = f'Redirect {nb}' self . __misp_add_ips_to_URLObject ( obj , ct . root_hartree . hostname_tree ) redirects . append ( obj ) if redirects : redirects [ - 1 ] . comment = f'Last redirect ({nb})' if redirects : prec_object = initial_url for u_object in redirects : prec_object . add_reference ( u_object , 'redirects-to' ) prec_object = u_object initial_obj = event . add_object ( initial_url ) initial_obj . add_reference ( lookyloo_link , 'captured-by' , 'Capture on lookyloo' ) for u_object in redirects : event . add_object ( u_object ) final_redirect = event . objects [ - 1 ] screenshot : MISPAttribute = event . add_attribute ( 'attachment' , 'screenshot_landing_page.png' , data = self . get_screenshot ( capture_uuid ) , disable_correlation = True ) try : fo = FileObject ( pseudofile = ct . root_hartree . rendered_node . body , filename = ct . root_hartree . rendered_node . filename ) fo . comment = 'Content received for the final redirect (before rendering)' fo . add_reference ( final_redirect , 'loaded-by' , 'URL loading that content' ) fo . add_reference ( screenshot , 'rendered-as' , 'Screenshot of the page' ) event . add_object ( fo ) except Har2TreeError : pass except AttributeError : pass if self . vt . available : for e_obj in event . objects : if e_obj . name != 'url' : continue vt_obj = self . __misp_add_vt_to_URLObject ( e_obj ) if vt_obj : event . add_object ( vt_obj ) if with_parent and cache . parent : parent = self . misp_export ( cache . parent , with_parent ) if isinstance ( parent , dict ) : return parent event . extends_uuid = parent [ - 1 ] . uuid parent . append ( event ) return parent return [ event ]
Export a capture in MISP format.
Export a capture in MISP format .
'''Export a capture in MISP format. You can POST the return of this method
        directly to a MISP instance and it will create an event.''' # type: ignore # type: ignore # No `body` in rendered node # Something bad happened
self
capture_uuid
str
with_parent
bool