Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multiple improvements #34

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Multiple improvements #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f770409
Multiple improvements
buffer Jun 21, 2017
28ba90e
Fixing remaining python2 print statements
fhightower Oct 18, 2017
c06acb0
Merge pull request #1 from fhightower/print-statement-fix
buffer Oct 18, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions bin/iocp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,14 +40,14 @@ import argparse
from iocp import Parser

if __name__ == "__main__":
argparser = argparse.ArgumentParser()
argparser.add_argument('PATH', action='store', help='File/directory/URL to report(s)')
argparser.add_argument('-p', dest='INI', default=None, help='Pattern file')
argparser.add_argument('-i', dest='INPUT_FORMAT', default='pdf', help='Input format (pdf/txt/html)')
argparser.add_argument('-o', dest='OUTPUT_FORMAT', default='csv', help='Output format (csv/tsv/json/yara/netflow)')
argparser.add_argument('-d', dest='DEDUP', action='store_true', default=False, help='Deduplicate matches')
argparser.add_argument('-l', dest='LIB', default='pdfminer', help='PDF parsing library (pypdf2/pdfminer)')
args = argparser.parse_args()
argparser = argparse.ArgumentParser()
argparser.add_argument('PATH', action='store', help='File/directory/URL to report(s)')
argparser.add_argument('-p', dest='INI', default=None, help='Pattern file')
argparser.add_argument('-i', dest='INPUT_FORMAT', default='pdf', help='Input format (pdf/txt/html)')
argparser.add_argument('-o', dest='OUTPUT_FORMAT', default='csv', help='Output format (csv/tsv/json/yara/netflow)')
argparser.add_argument('-d', dest='DEDUP', action='store_true', default=False, help='Deduplicate matches')
argparser.add_argument('-l', dest='LIB', default='pdfminer', help='PDF parsing library (pypdf2/pdfminer)')
args = argparser.parse_args()

parser = Parser.Parser(args.INI, args.INPUT_FORMAT, args.DEDUP, args.LIB, args.OUTPUT_FORMAT)
parser.parse(args.PATH)
parser = Parser.Parser(args.INI, args.INPUT_FORMAT, args.DEDUP, args.LIB, args.OUTPUT_FORMAT)
parser.parse(args.PATH)
184 changes: 96 additions & 88 deletions iocp/Output.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,112 +7,120 @@

OUTPUT_FORMATS = ('csv', 'tsv', 'json', 'yara', 'netflow', )


def getHandler(output_format):
output_format = output_format.lower()
if output_format not in OUTPUT_FORMATS:
print("[WARNING] Invalid output format specified... using CSV")
output_format = 'csv'
output_format = output_format.lower()
if output_format not in OUTPUT_FORMATS:
print("[WARNING] Invalid output format specified... using CSV")
output_format = 'csv'

handler_format = "OutputHandler_" + output_format
handler_class = getattr(sys.modules[__name__], handler_format)

handler_format = "OutputHandler_" + output_format
handler_class = getattr(sys.modules[__name__], handler_format)
return handler_class()

return handler_class()

class OutputHandler(object):
def print_match(self, fpath, page, name, match):
pass
def print_match(self, fpath, page, name, match):
pass

def print_header(self, fpath):
pass

def print_header(self, fpath):
pass
def print_footer(self, fpath):
pass

def print_footer(self, fpath):
pass
def print_error(self, fpath, exception):
print("[ERROR] %s" % (exception))

def print_error(self, fpath, exception):
print("[ERROR] %s" % (exception))

class OutputHandler_csv(OutputHandler):
def __init__(self):
self.csv_writer = csv.writer(sys.stdout)
def __init__(self):
self.csv_writer = csv.writer(sys.stdout)

def print_match(self, fpath, page, name, match):
self.csv_writer.writerow((fpath, page, name, match))
def print_match(self, fpath, page, name, match):
self.csv_writer.writerow((fpath, page, name, match))

def print_error(self, fpath, exception):
self.csv_writer.writerow((fpath, '0', 'error', exception))

def print_error(self, fpath, exception):
self.csv_writer.writerow((fpath, '0', 'error', exception))

class OutputHandler_tsv(OutputHandler):
def __init__(self):
self.csv_writer = csv.writer(sys.stdout, delimiter = '\t')
def __init__(self):
self.csv_writer = csv.writer(sys.stdout, delimiter = '\t')

def print_match(self, fpath, page, name, match):
self.csv_writer.writerow((fpath, page, name, match))

def print_match(self, fpath, page, name, match):
self.csv_writer.writerow((fpath, page, name, match))
def print_error(self, fpath, exception):
self.csv_writer.writerow((fpath, '0', 'error', exception))

def print_error(self, fpath, exception):
self.csv_writer.writerow((fpath, '0', 'error', exception))

class OutputHandler_json(OutputHandler):
def print_match(self, fpath, page, name, match):
data = {
'path' : fpath,
'file' : os.path.basename(fpath),
'page' : page,
'type' : name,
'match': match
}

print(json.dumps(data))

def print_error(self, fpath, exception):
data = {
'path' : fpath,
'file' : os.path.basename(fpath),
'type' : 'error',
'exception' : exception
}

print(json.dumps(data))
def print_match(self, fpath, page, name, match):
data = {
'path' : fpath,
'file' : os.path.basename(fpath),
'page' : page,
'type' : name,
'match': match
}

print(json.dumps(data))

def print_error(self, fpath, exception):
data = {
'path' : fpath,
'file' : os.path.basename(fpath),
'type' : 'error',
'exception' : exception
}

print(json.dumps(data))


class OutputHandler_yara(OutputHandler):
def __init__(self):
self.rule_enc = ''.join(chr(c) if chr(c).isupper() or chr(c).islower() or chr(c).isdigit() else '_' for c in range(256))

def print_match(self, fpath, page, name, match):
if name in self.cnt:
self.cnt[name] += 1
else:
self.cnt[name] = 1

string_id = "$%s%d" % (name, self.cnt[name])
self.sids.append(string_id)
string_value = match.replace('\\', '\\\\')
print("\t\t%s = \"%s\"" % (string_id, string_value))

def print_header(self, fpath):
rule_name = os.path.splitext(os.path.basename(fpath))[0].translate(self.rule_enc)

print("rule %s" % (rule_name))
print("{")
print("\tstrings:")

self.cnt = {}
self.sids = []

def print_footer(self, fpath):
cond = ' or '.join(self.sids)

print("\tcondition:")
print("\t\t" + cond)
print("}")

def __init__(self):
self.rule_enc = ''.join(chr(c) if chr(c).isupper() or chr(c).islower() or chr(c).isdigit() else '_' for c in range(256))

def print_match(self, fpath, page, name, match):
if name in self.cnt:
self.cnt[name] += 1
else:
self.cnt[name] = 1

string_id = "$%s%d" % (name, self.cnt[name])
self.sids.append(string_id)
string_value = match.replace('\\', '\\\\')
print("\t\t%s = \"%s\"" % (string_id, string_value))

def print_header(self, fpath):
rule_name = os.path.splitext(os.path.basename(fpath))[0].translate(self.rule_enc)

print("rule %s" % (rule_name))
print("{")
print("\tstrings:")

self.cnt = {}
self.sids = []

def print_footer(self, fpath):
cond = ' or '.join(self.sids)

print("\tcondition:")
print("\t\t" + cond)
print("}")


class OutputHandler_netflow(OutputHandler):
def __init__(self):
print "host 255.255.255.255"

def print_match(self, fpath, page, name, match):
data = {
'type' : name,
'match': match
}
if data["type"] == "IP":
print " or host %s " % data["match"]
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Python3 error on print command due to lack of braces

def __init__(self):
print("host 255.255.255.255")

def print_match(self, fpath, page, name, match):
data = {
'type' : name,
'match': match
}

if data["type"] == "IP":
print(" or host %s " % data["match"])
Loading