chaitanyakrishna/iocscraperIOCPARSER.COM은 다양한 데이터 소스에서 IOCs 및 인텔리전스를 추출할 수 있는 빠르고 신뢰할 수 있는 서비스입니다.
IOC Scraper는 IOCPARSER 서비스를 활용하여 다양한 벤더 블로그, PDF 및 CSV 파일에서 IOC를 가져옵니다. IOC를 파싱하는 것은 시간이 많이 소요되는 과정이지만, 이 스크립트를 사용하면 자동으로 IOC를 추출하고 집계할 수 있습니다.
IOC Scraper는 다양한 IOC 유형을 지원합니다.
| IOC 유형 | 상태 |
|---|---|
| ASN | 지원됨 |
| IPv4, IPv6 | 지원됨 |
| URL, Domain | 지원됨 |
| 지원됨 | |
| MD5, SHA1, SHA256, File Name | 지원됨 |
| MAC Address | 지원됨 |
| MITRE ATT&CK IDs | 지원됨 |
| YARA Rules | 지원됨 |
git clone https://www.github.com/chaitanyakrishna/iocscraper.git
pip3 install -f requirements.txt
python IOC_Scraper.py -h
___ ___ ____ ____
|_ _/ _ \ / ___| / ___| ___ _ __ __ _ _ __ ___ _ __
| | | | | | \___ \ / __| '__/ _` | '_ \ / _ \ '__|
| | |_| | |___ ___) | (__| | | (_| | |_) | __/ |
|___\___/ \____| |____/ \___|_| \__,_| .__/ \___|_|
|_|
usage: IOC_Scraper.py [-h] [-u URL] [-uL FILE_CONTAINING_URLS] [-t TIMEOUT] [-th THREADNUMBER] -o OUTPUT
IOC_Scraper v1.0
Optional Arguments:
-h, --help show this help message and exit
-u URL, --url Single URL for Fetching IOCs
-uL FILE_CONTAINING_URLS, --url-list FILE_CONTAINING_URLS File Containing URL, One URL in One Line.
-t TIMEOUT, --timeout TIMEOUT HTTP Request Timeout. default=60
-th THREADNUMBER, --thread THREADNUMBER Parallel HTTP Request Number. default=100
Required Arguments:
-o OUTPUT, --output OUTPUT Output file name.
python iocscraper.py -u "http://targeturl.com" -o report
python iocscraper.py -uL urls.txt -o report
python IOC_Scraper.py -uL url_list.txt -o report
___ ___ ____ ____
|_ _/ _ \ / ___| / ___| ___ _ __ __ _ _ __ ___ _ __
| | | | | | \___ \ / __| '__/ _` | '_ \ / _ \ '__|
| | |_| | |___ ___) | (__| | | (_| | |_) | __/ |
|___\___/ \____| |____/ \___|_| \__,_| .__/ \___|_|
|_|
====================================================================================================
[Date: 20-01-2022] [Time: 23:03:09] [INFO] Initiating IOC Scraper ...
====================================================================================================
[*] ProgressBar: 14/14 [Fethcing IOC from: thehackernews.com] [Errors: 0] ... 0] ... ...
[Date: 20-01-2022] [Time: 23:03:13] [INFO] Removing Duplicates ...
====================================================================================================
[Date: 20-01-2022] [Time: 23:03:13] [INFO] Fetched IOCs from the following domains
====================================================================================================
1. blog.aquasec.com
2. nationalcybersecurity.com
3. cofense.com
4. thehackernews.com
5. blog.sucuri.net
6. threats.amnpardaz.com
7. www.crowdstrike.com
8. www.bleepingcomputer.com
9. forensicitguy.github.io
10. marcusedmondson.com
11. rajhackingarticles.blogspot.com
12. research.checkpoint.com
13. www.reddit.com
14. www.zerofox.com
====================================================================================================
[Date: 20-01-2022] [Time: 23:03:13] [INFO] Indicator of Compromise Stats
====================================================================================================
Domain : 52
URL : 26
IPv4 : 15
IPv6 : 0
ASN : 0
FILE_HASH_MD5 : 24
FILE_HASH_SHA1 : 16
FILE_HASH_SHA256 : 3
MITRE_ATTACK : 4
EMAIL : 3
CVE : 7
FILE_NAME : 59
YARA_RULE : 0
MAC_ADDRESS : 0
====================================================================================================
[Date: 20-01-2022] [Time: 23:03:13] [INFO] Total IOCs: 209
====================================================================================================
