Skip to content

Commit 2ab9e5b

Browse files
gabriel-pezegabriel-peze
committed
[client] feat(SCV): fix formating (#4266)
1 parent 748a27b commit 2ab9e5b

File tree

3 files changed

+271
-24
lines changed

3 files changed

+271
-24
lines changed

‎pyoaev/contracts/contract_config.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ class ContractConfig:
119119
color_dark: str
120120
color_light: str
121121

122+
122123
@dataclass
123124
class Domain:
124125
domain_id: str
@@ -127,6 +128,7 @@ class Domain:
127128
domain_created_at: str
128129
domain_updated_at: str
129130

131+
130132
@dataclass
131133
class Contract:
132134
contract_id: str

‎pyoaev/security_domain/builder.py‎

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,22 +10,40 @@ def _find_in_keywords(self, keywords, search):
1010
def get_associated_security_domains(self, name, description):
1111
domains = []
1212

13-
if self._find_in_keywords(SecurityDomainsKeyWords.ENDPOINT, name) or self._find_in_keywords(SecurityDomainsKeyWords.ENDPOINT, description):
13+
if self._find_in_keywords(
14+
SecurityDomainsKeyWords.ENDPOINT, name
15+
) or self._find_in_keywords(SecurityDomainsKeyWords.ENDPOINT, description):
1416
domains.append(SecurityDomains.ENDPOINT.value)
15-
if self._find_in_keywords(SecurityDomainsKeyWords.NETWORK, name) or self._find_in_keywords(SecurityDomainsKeyWords.NETWORK, description):
17+
if self._find_in_keywords(
18+
SecurityDomainsKeyWords.NETWORK, name
19+
) or self._find_in_keywords(SecurityDomainsKeyWords.NETWORK, description):
1620
domains.append(SecurityDomains.NETWORK.value)
17-
if self._find_in_keywords(SecurityDomainsKeyWords.WEB_APP, name) or self._find_in_keywords(SecurityDomainsKeyWords.WEB_APP, description):
21+
if self._find_in_keywords(
22+
SecurityDomainsKeyWords.WEB_APP, name
23+
) or self._find_in_keywords(SecurityDomainsKeyWords.WEB_APP, description):
1824
domains.append(SecurityDomains.WEB_APP.value)
19-
if self._find_in_keywords(SecurityDomainsKeyWords.EMAIL_INFILTRATION, name) or self._find_in_keywords(SecurityDomainsKeyWords.EMAIL_INFILTRATION, description):
25+
if self._find_in_keywords(
26+
SecurityDomainsKeyWords.EMAIL_INFILTRATION, name
27+
) or self._find_in_keywords(
28+
SecurityDomainsKeyWords.EMAIL_INFILTRATION, description
29+
):
2030
domains.append(SecurityDomains.EMAIL_INFILTRATION.value)
21-
if self._find_in_keywords(SecurityDomainsKeyWords.DATA_EXFILTRATION, name) or self._find_in_keywords(SecurityDomainsKeyWords.DATA_EXFILTRATION, description):
31+
if self._find_in_keywords(
32+
SecurityDomainsKeyWords.DATA_EXFILTRATION, name
33+
) or self._find_in_keywords(
34+
SecurityDomainsKeyWords.DATA_EXFILTRATION, description
35+
):
2236
domains.append(SecurityDomains.DATA_EXFILTRATION.value)
23-
if self._find_in_keywords(SecurityDomainsKeyWords.URL_FILTERING, name) or self._find_in_keywords(SecurityDomainsKeyWords.URL_FILTERING, description):
37+
if self._find_in_keywords(
38+
SecurityDomainsKeyWords.URL_FILTERING, name
39+
) or self._find_in_keywords(SecurityDomainsKeyWords.URL_FILTERING, description):
2440
domains.append(SecurityDomains.URL_FILTERING.value)
25-
if self._find_in_keywords(SecurityDomainsKeyWords.CLOUD, name) or self._find_in_keywords(SecurityDomainsKeyWords.CLOUD, description):
41+
if self._find_in_keywords(
42+
SecurityDomainsKeyWords.CLOUD, name
43+
) or self._find_in_keywords(SecurityDomainsKeyWords.CLOUD, description):
2644
domains.append(SecurityDomains.CLOUD.value)
2745

2846
if 0 == len(domains):
2947
domains.append(SecurityDomains.ENDPOINT.value)
3048

31-
return domains
49+
return domains

‎pyoaev/security_domain/types.py‎

Lines changed: 243 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,248 @@
22

33

44
class SecurityDomainsKeyWords(Enum):
5-
ENDPOINT = ["lsass", "registry", "dll injection", "kernel", "winlogon", "scheduled task", "wmi", "powershell", "process injection", "credential dumping", "rootkit", "startup folder", "bits jobs", "removable media", "hardware additions", "browser extension", "firmware", "bootkit", "master boot record", "clipboard", "screen capture", "audio capture", "video capture", "disk wipe", "ransomware", "debugger evasion", "sandbox evasion", "reflective code", "access token", "system binary proxy", "Bitsadmin Download (PowerShell)"]
6-
NETWORK = ["lateral movement", "packet sniff", "port scan", "man-in-the-middle", "arp spoof", "smb", "rdp", "dns tunnel", "network share", "c2", "beacon", "firewall", "domain controller", "kerberos", "golden ticket", "silver ticket", "domain trust", "active directory", "ldap", "network boundary", "bgp hijack", "bgp hijack", "dns hijack", "dhcp poison", "forced authentication", "remote service", "network device", "vlan hopping", "protocol tunnel", "traffic signaling", "weaken encryption", "exploitation remote"]
7-
WEB_APP = ["sql injection", "cross-site script", "web shell", "csrf", "file upload vulnerability", "apache", "nginx", "iis", "php", "javascript", "rest api", "cookie", "server-side request forgery", "ssrf", "xml external entity", "xxe", "deserialization", "path traversal", "local file inclusion", "remote file inclusion", "template injection", "ssti", "api abuse", "drive-by compromise", "browser exploit", "forge web credential", "web service", "defacement", "server software component", "reverse proxy", "webdav", "session hijack"]
8-
EMAIL_INFILTRATION = ["spearphishing attachment", "spearphishing link", "phishing", "malicious attachment", "email account", "outlook", "exchange", "smtp", "mail server", "social engineering", "inbox rule", "dkim", "business email compromise", "bec", "email forwarding rule", "email delegation", "oauth consent", "reply-to manipulation", "email thread hijack", "internal spearphishing", "email collection", "zimbra", "mapi", "email template", "spoof sender", "dmarc", "spf", "email gateway", "link shortener"]
9-
DATA_EXFILTRATION = ["exfiltrat", "data staging", "data compressed", "steganography", "covert channel", "database dump", "automated collection", "intellectual property", "cloud storage exfil", "ftp exfil", "physical medium", "air gap", "scheduled transfer", "alternate protocol", "icmp tunnel", "dns exfiltration", "automated exfiltration", "web service exfil", "pastebin", "code repository", "cloud account transfer", "email exfil", "data destruction", "data encrypted", "image steganography"]
10-
URL_FILTERING = ["domain fronting", "url shorten", "typosquatting", "typosquatting", "homograph", "punycode", "url reputation", "content filter", "web gateway", "safe browsing", "url categorization", "blacklist bypass", "whitelist", "redirect", "proxy bypass", "dns over https", "dns over tls", "unicode domain", "url encode", "double encode", "open redirect", "captive portal", "proxy pac", "socks proxy", "vpn bypass", "domain generation", "fast flux", "url confusion", "subdomain takeover", "Bitsadmin Download (PowerShell)"]
11-
CLOUD = ["aws", "azure", "gcp", "lambda", "s3 bucket", "blob storage", "kubernetes", "docker", "serverless", "cloud instance", "iam role", "iam role", "saas", "tenant", "subscription", "api gateway", "microservice", "cloud trail", "cloudtrail", "cloud formation", "terraform", "cloud init", "metadata service", "instance metadata", "cloud api", "resource policy", "cloud dashboard", "unused region", "snapshot", "cloud backup", "object storage", "cloud function", "service principal", "managed identity", "cloud key", "sas token", "assume role"]
5+
ENDPOINT = [
6+
"lsass",
7+
"registry",
8+
"dll injection",
9+
"kernel",
10+
"winlogon",
11+
"scheduled task",
12+
"wmi",
13+
"powershell",
14+
"process injection",
15+
"credential dumping",
16+
"rootkit",
17+
"startup folder",
18+
"bits jobs",
19+
"removable media",
20+
"hardware additions",
21+
"browser extension",
22+
"firmware",
23+
"bootkit",
24+
"master boot record",
25+
"clipboard",
26+
"screen capture",
27+
"audio capture",
28+
"video capture",
29+
"disk wipe",
30+
"ransomware",
31+
"debugger evasion",
32+
"sandbox evasion",
33+
"reflective code",
34+
"access token",
35+
"system binary proxy",
36+
"Bitsadmin Download (PowerShell)",
37+
]
38+
NETWORK = [
39+
"lateral movement",
40+
"packet sniff",
41+
"port scan",
42+
"man-in-the-middle",
43+
"arp spoof",
44+
"smb",
45+
"rdp",
46+
"dns tunnel",
47+
"network share",
48+
"c2",
49+
"beacon",
50+
"firewall",
51+
"domain controller",
52+
"kerberos",
53+
"golden ticket",
54+
"silver ticket",
55+
"domain trust",
56+
"active directory",
57+
"ldap",
58+
"network boundary",
59+
"bgp hijack",
60+
"bgp hijack",
61+
"dns hijack",
62+
"dhcp poison",
63+
"forced authentication",
64+
"remote service",
65+
"network device",
66+
"vlan hopping",
67+
"protocol tunnel",
68+
"traffic signaling",
69+
"weaken encryption",
70+
"exploitation remote",
71+
]
72+
WEB_APP = [
73+
"sql injection",
74+
"cross-site script",
75+
"web shell",
76+
"csrf",
77+
"file upload vulnerability",
78+
"apache",
79+
"nginx",
80+
"iis",
81+
"php",
82+
"javascript",
83+
"rest api",
84+
"cookie",
85+
"server-side request forgery",
86+
"ssrf",
87+
"xml external entity",
88+
"xxe",
89+
"deserialization",
90+
"path traversal",
91+
"local file inclusion",
92+
"remote file inclusion",
93+
"template injection",
94+
"ssti",
95+
"api abuse",
96+
"drive-by compromise",
97+
"browser exploit",
98+
"forge web credential",
99+
"web service",
100+
"defacement",
101+
"server software component",
102+
"reverse proxy",
103+
"webdav",
104+
"session hijack",
105+
]
106+
EMAIL_INFILTRATION = [
107+
"spearphishing attachment",
108+
"spearphishing link",
109+
"phishing",
110+
"malicious attachment",
111+
"email account",
112+
"outlook",
113+
"exchange",
114+
"smtp",
115+
"mail server",
116+
"social engineering",
117+
"inbox rule",
118+
"dkim",
119+
"business email compromise",
120+
"bec",
121+
"email forwarding rule",
122+
"email delegation",
123+
"oauth consent",
124+
"reply-to manipulation",
125+
"email thread hijack",
126+
"internal spearphishing",
127+
"email collection",
128+
"zimbra",
129+
"mapi",
130+
"email template",
131+
"spoof sender",
132+
"dmarc",
133+
"spf",
134+
"email gateway",
135+
"link shortener",
136+
]
137+
DATA_EXFILTRATION = [
138+
"exfiltrat",
139+
"data staging",
140+
"data compressed",
141+
"steganography",
142+
"covert channel",
143+
"database dump",
144+
"automated collection",
145+
"intellectual property",
146+
"cloud storage exfil",
147+
"ftp exfil",
148+
"physical medium",
149+
"air gap",
150+
"scheduled transfer",
151+
"alternate protocol",
152+
"icmp tunnel",
153+
"dns exfiltration",
154+
"automated exfiltration",
155+
"web service exfil",
156+
"pastebin",
157+
"code repository",
158+
"cloud account transfer",
159+
"email exfil",
160+
"data destruction",
161+
"data encrypted",
162+
"image steganography",
163+
]
164+
URL_FILTERING = [
165+
"domain fronting",
166+
"url shorten",
167+
"typosquatting",
168+
"typosquatting",
169+
"homograph",
170+
"punycode",
171+
"url reputation",
172+
"content filter",
173+
"web gateway",
174+
"safe browsing",
175+
"url categorization",
176+
"blacklist bypass",
177+
"whitelist",
178+
"redirect",
179+
"proxy bypass",
180+
"dns over https",
181+
"dns over tls",
182+
"unicode domain",
183+
"url encode",
184+
"double encode",
185+
"open redirect",
186+
"captive portal",
187+
"proxy pac",
188+
"socks proxy",
189+
"vpn bypass",
190+
"domain generation",
191+
"fast flux",
192+
"url confusion",
193+
"subdomain takeover",
194+
"Bitsadmin Download (PowerShell)",
195+
]
196+
CLOUD = [
197+
"aws",
198+
"azure",
199+
"gcp",
200+
"lambda",
201+
"s3 bucket",
202+
"blob storage",
203+
"kubernetes",
204+
"docker",
205+
"serverless",
206+
"cloud instance",
207+
"iam role",
208+
"iam role",
209+
"saas",
210+
"tenant",
211+
"subscription",
212+
"api gateway",
213+
"microservice",
214+
"cloud trail",
215+
"cloudtrail",
216+
"cloud formation",
217+
"terraform",
218+
"cloud init",
219+
"metadata service",
220+
"instance metadata",
221+
"cloud api",
222+
"resource policy",
223+
"cloud dashboard",
224+
"unused region",
225+
"snapshot",
226+
"cloud backup",
227+
"object storage",
228+
"cloud function",
229+
"service principal",
230+
"managed identity",
231+
"cloud key",
232+
"sas token",
233+
"assume role",
234+
]
235+
12236

13237
class SecurityDomains(Enum):
14-
ENDPOINT = { "domain_name": "Endpoint", "domain_color": "#389CFF" }
15-
NETWORK = { "domain_name": "Network", "domain_color": "#009933" }
16-
WEB_APP = { "domain_name": "Web App", "domain_color": "#FF9933" }
17-
EMAIL_INFILTRATION = { "domain_name": "E-mail Infiltration", "domain_color": "#FF6666" }
18-
DATA_EXFILTRATION = { "domain_name": "Data Exfiltration", "domain_color": "#9933CC" }
19-
URL_FILTERING = { "domain_name": "Url Filtering", "domain_color": "#66CCFF" }
20-
CLOUD = { "domain_name": "Cloud", "domain_color": "#9999CC" }
21-
TABLE_TOP = { "domain_name": "Table Top", "domain_color": "#FFCC33" }
22-
TOCLASSIFY = { "domain_name": "To classify", "domain_color": "#FFFFFF" }
238+
ENDPOINT = {"domain_name": "Endpoint", "domain_color": "#389CFF"}
239+
NETWORK = {"domain_name": "Network", "domain_color": "#009933"}
240+
WEB_APP = {"domain_name": "Web App", "domain_color": "#FF9933"}
241+
EMAIL_INFILTRATION = {
242+
"domain_name": "E-mail Infiltration",
243+
"domain_color": "#FF6666",
244+
}
245+
DATA_EXFILTRATION = {"domain_name": "Data Exfiltration", "domain_color": "#9933CC"}
246+
URL_FILTERING = {"domain_name": "Url Filtering", "domain_color": "#66CCFF"}
247+
CLOUD = {"domain_name": "Cloud", "domain_color": "#9999CC"}
248+
TABLE_TOP = {"domain_name": "Table Top", "domain_color": "#FFCC33"}
249+
TOCLASSIFY = {"domain_name": "To classify", "domain_color": "#FFFFFF"}

0 commit comments

Comments
 (0)