-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathquery_completed_database.py
169 lines (140 loc) · 6.47 KB
/
query_completed_database.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
#!/usr/bin/python
__author__='mkkeffeler'
#Miclain Keffeler
#6/6/2017
#This script queries the database and pulls all information on a provided IP address, both current and historic, and displays it
import time
from build_database import MD5
from sqlalchemy import create_engine
from sqlalchemy.ext.declarative import declarative_base
from optparse import OptionParser
import sys
import dateutil.parser
engine = create_engine('sqlite:///feeds/IP_Report.db')
Base = declarative_base()
Base.metadata.bind = engine
from sqlalchemy.orm import sessionmaker
DBSession = sessionmaker(bind = engine)
DBSession.bind = engine
session = DBSession()
# Make a query to find all Persons in the database
def entry_count(counts,entry_count):
if(entry_count > 1):
print "Matching Entries: " + str(entry_count)
if(counts > 1):
print "Total Entries Searched: " + str(counts)
def compare_dates(date1,date2):
newdate1 = dateutil.parser.parse(date1).strftime("%x")
newdate2 = dateutil.parser.parse(date2).strftime('%x')
if (newdate1 > newdate2):
return 1
elif (newdate1 < newdate2):
return -1
elif (newdate1 == newdate2):
return 0
datelist = {}
columns = ["md5","sha1","sha256","threat_name","Published"]
# Retrieve one Address whose person field is point to the person object
# Return the first IP address from all the IP addresses in this table
def print_md5(string):
print "Registrar Name: " + string
def print_sha1(string):
print "Registrar Organization: " + string
def print_sha256(string): #This function is used to print the IP address
print "IP: " + string
def print_threatname(string): #This function is used to print the IP location
print "Location: " + string
def print_Published(string): #This function is used to print the date of review
print "Date of Review: " + str(string)
if __name__ == "__main__":
parser = OptionParser()
parser.add_option("--all", "--all", dest="all1", default="None",
help="Print all elements of an entry that came after a provided published date D/M/YEAR", metavar="all") #Prints all elements of the provided IP address
parser.add_option("--range", "--range", dest="daterange", default="None",
help="Print all elements of an entry that came after a provided published date D/M/YEAR with --all and before the date provided here D/M/YEAR", metavar="all") #Prints all elements of the provided IP address
parser.add_option("--md5", "--md5", dest="s_md5", default="None",
help="search for a sha1 hash within the database", metavar="current")
parser.add_option("--sha1", "--sha1", dest="s_sha1" , default="None",
help="Search for a sha1 hash within the database", metavar="category")
parser.add_option("--sha256", "--sha256", dest="s_sha256" , default="None",
help="Search for a sha256 hash within the database", metavar="ipaddress")
(options, args) = parser.parse_args()
total_entry = 0
total_count = 0
if options.all1 is not "None" and options.daterange is not "None" and options.s_md5 is not "None":
ranges = session.query(MD5).filter(MD5.Published > dateutil.parser.parse(options.all1).strftime("%M/%d/%Y")).all()
for hashentry in ranges:
# if (compare_dates(options.all1,hashentry.Published) == 1 and compare_dates(options.daterange,hashentry.Published) == 1):
# total_entry += 1
# continue
# else:
if(hashentry.md5 == options.s_md5):
print "_______________________"
print "MD5: " + hashentry.md5
print "SHA1: " + hashentry.sha1
print "SHA256: " + hashentry.sha256
print "Threat Name: " + hashentry.threat_name
if (hashentry.Published in datelist):
datelist[hashentry.Published] += 1
print "Published: " + hashentry.Published
total_count += 1
else:
datelist[hashentry.Published] = 1
print "Published: " + hashentry.Published
total_count += 1
total_entry += 1
entry_count(total_count,total_entry)
print datelist
exit()
if options.all1 is not "None" and options.daterange is not "None":
for hashentry in session.query(MD5).all():
if (compare_dates(options.all1,hashentry.Published) == 1 or compare_dates(options.daterange,hashentry.Published) == -1):
total_entry += 1
continue
else:
print datelist
print "TOTAL Entries: " + str(total_entry)
print "Total Entries in Range: " + str(total_count)
print "_______________________"
print "MD5: " + hashentry.md5
print "SHA1: " + hashentry.sha1
print "SHA256: " + hashentry.sha256
print "Threat Name: " + hashentry.threat_name
if (hashentry.Published in datelist):
datelist[hashentry.Published] += 1
print "Published: " + hashentry.Published
total_count += 1
else:
datelist[hashentry.Published] = 1
print "Published: " + hashentry.Published
total_count += 1
total_entry += 1
entry_count(total_count,total_entry)
print datelist
exit()
if options.all1 is not "None":
for hashentry in session.query(MD5).all():
if (compare_dates(options.all1,hashentry.Published) == 1 or compare_dates(options.all1,hashentry.Published) == -1):
total_entry += 1
continue
else:
print "TOTAL Entries: " + str(total_entry)
print "Total Entries in Range: " + str(total_count)
print "_______________________"
print "MD5: " + hashentry.md5
print "SHA1: " + hashentry.sha1
print "SHA256: " + hashentry.sha256
print "Threat Name: " + hashentry.threat_name
if (hashentry.Published in datelist):
datelist[hashentry.Published] += 1
print "Published: " + hashentry.Published
total_count += 1
else:
datelist[hashentry.Published] = 1
print "Published: " + hashentry.Published
total_count += 1
total_entry += 1
entry_count(total_count,total_entry)
print datelist
if len(sys.argv[1:]) == 0:
parser.print_help()