MobSF/Mobile-Security-Framework-MobSF
1
0
Fork 0
mirror of https://github.com/MobSF/Mobile-Security-Framework-MobSF.git synced 2026-10-12 02:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

IP to Geolocation

Browse Source
This commit is contained in:
Ajin Abraham
2020-01-29 21:32:54 -05:00
parent 22ebe9bac9
commit 704d08c218
12 changed files with 253 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MalwareAnalyzer/views/domain_check.py
+28 -5
View File
@@ -4,17 +4,24 @@ import io
import logging
import os
import re
from socket import (
gaierror,
gethostbyname,
)
from urllib.parse import urlparse
from django.conf import settings
from MobSF.utils import (is_internet_available,
update_local_db)
import IP2Location
from MobSF.utils import (
is_internet_available,
update_local_db,
)
logger = logging.getLogger(__name__)
# PATH
MALWARE_DB_DIR = settings.SIGNATURE_DIR
IP2LocObj = IP2Location.IP2Location()
def update_malware_db():
@@ -77,12 +84,28 @@ def malware_check(urllist):
and (len(dmn_url) > 1))
or details_dict['ip'].startswith(domain)):
result[domain] = details_dict
# Good Domains
offline_db = os.path.join(settings.BASE_DIR,
'signatures',
'IP2LOCATION-LITE-DB5.IPV6.BIN')
IP2LocObj.open(offline_db)
for domain in domainlist:
# Good Domains
if domain not in result:
tmp_d = {}
tmp_d['bad'] = 'no'
result[domain] = tmp_d
# GeoIP
ip = None
try:
ip = gethostbyname(domain)
except gaierror:
pass
if ip:
rec = IP2LocObj.get_all(ip)
result[domain]['geolocation'] = rec.__dict__
else:
result[domain]['geolocation'] = None
IP2LocObj.close()
except Exception:
logger.exception('[ERROR] Performing Malware Check')
return result
requirements.txt
+1
View File
@@ -19,6 +19,7 @@ asn1crypto==1.3.0
oscrypto==1.1.0
distro==1.4.0
pyopenssl==19.1.0
IP2Location==8.4.1
# Do not update the following
apkid==2.0.3
pyparsing<2.3 # pyup: ignore
signatures/IP2LOCATION-LITE-DB5.IPV6.BIN
Executable
BIN
View File
Binary file not shown.
templates/dynamic_analysis/android/dynamic_report.html
+29 -20
View File
@@ -454,38 +454,47 @@
</p>
<div class="table-responsive">
{% if domains %}
<table class="table table-bordered table-hover table-striped">
{% if urls|length > 1 %}
<table id="table_malware" class="table table-bordered table-hover table-striped">
<thead>
<tr>
<th>DOMAIN</th>
<th>STATUS</th>
<th>GEOLOCATION</th>
</tr>
</thead>
{% endif %}
<tbody>
{% for domain, details in domains.items %}
{% for domain, details in domains.items %}
<tr><td>{{domain}}</td><td>
{% if details|key:"bad" == "yes" %}
<span class="badge bg-danger">malware</span></br>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="badge bg-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
{% if details|key:"bad" == "yes" %}
<span class="badge bg-danger">malware</span><br/>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="badge bg-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
{% else %}
<span class="badge bg-success">good</span></br>
<span class="badge bg-success">good</span><br/>
{% endif %}
</td>
<td>
{% if details|key:"geolocation" %}
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
<strong>Latitude: </strong>{{details|key:"geolocation"|key:"latitude"}} <br/>
<strong>Longitude: </strong>{{details|key:"geolocation"|key:"longitude"}} <br/>
<strong>View: <a target="_blank" href="http://maps.google.com/maps?q={{details|key:"geolocation"|key:"latitude"}},{{details|key:"geolocation"|key:"longitude"}}">Google Map</a>
</td> </tr>
{% endfor %}
</tbody>
</table>
{% else %}
No Geolocation information available.
{% endif %}
</td>
</tr>
{% endfor %}
</tbody>
</table>
{% endif %}
</div>
</div>
templates/pdf/android_binary_analysis.pdf.html
+31 -20
View File
@@ -719,37 +719,48 @@ body {
</div>
<div class="panel-body">
<div class="table-responsive">
<table class="table table-bordered table-hover table-striped">
{% if urls %}
<table id="table_malware" class="table table-bordered table-hover table-striped">
<thead>
<tr>
<th>Domain</th>
<th>Status</th>
<th>DOMAIN</th>
<th>STATUS</th>
<th>GEOLOCATION</th>
</tr>
</thead>
{% endif %}
<tbody>
{% for domain, details in domains.items %}
<tbody>
{% for domain, details in domains.items %}
<tr><td>{{domain}}</td><td>
{% if details|key:"bad" == "yes" %}
<span class="label label-danger">malware</span></br>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="label label-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
<span class="badge bg-danger">malware</span><br/>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="badge bg-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
{% else %}
<span class="label label-success">good</span></br>
<span class="badge bg-success">good</span><br/>
{% endif %}
</td>
<td>
{% if details|key:"geolocation" %}
<pre>
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
<strong>Latitude: </strong>{{details|key:"geolocation"|key:"latitude"}} <br/>
<strong>Longitude: </strong>{{details|key:"geolocation"|key:"longitude"}} <br/>
<strong>View: <a target="_blank" href="http://maps.google.com/maps?q={{details|key:"geolocation"|key:"latitude"}},{{details|key:"geolocation"|key:"longitude"}}">Google Map</a>
</td> </tr>
{% else %}
No Geolocation information available.
{% endif %}
</td>
</tr>
{% endfor %}
</tbody>
</table>
</tbody>
</table>
</div>
</div>
templates/pdf/android_source_analysis_pdf.html
+30 -20
View File
@@ -497,37 +497,47 @@ body {
</div>
<div class="panel-body">
<div class="table-responsive">
<table class="table table-bordered table-hover table-striped">
{% if urls %}
<table id="table_malware" class="table table-bordered table-hover table-striped">
<thead>
<tr>
<th>Domain</th>
<th>Status</th>
<th>DOMAIN</th>
<th>STATUS</th>
<th>GEOLOCATION</th>
</tr>
</thead>
{% endif %}
<tbody>
{% for domain, details in domains.items %}
<tbody>
{% for domain, details in domains.items %}
<tr><td>{{domain}}</td><td>
{% if details|key:"bad" == "yes" %}
<span class="label label-danger">malware</span></br>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="label label-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
<span class="badge bg-danger">malware</span><br/>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="badge bg-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
{% else %}
<span class="label label-success">good</span></br>
<span class="badge bg-success">good</span><br/>
{% endif %}
</td>
<td>
{% if details|key:"geolocation" %}
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
<strong>Latitude: </strong>{{details|key:"geolocation"|key:"latitude"}} <br/>
<strong>Longitude: </strong>{{details|key:"geolocation"|key:"longitude"}} <br/>
<strong>View: <a target="_blank" href="http://maps.google.com/maps?q={{details|key:"geolocation"|key:"latitude"}},{{details|key:"geolocation"|key:"longitude"}}">Google Map</a>
</td> </tr>
{% else %}
No Geolocation information available.
{% endif %}
</td>
</tr>
{% endfor %}
</tbody>
</table>
</tbody>
</table>
</div>
</div>
templates/pdf/ios_binary_analysis_pdf.html
+38 -28
View File
@@ -521,37 +521,47 @@ body {
</div>
<div class="panel-body">
<div class="table-responsive">
<table class="table table-bordered table-hover table-striped">
{% if urls %}
<thead>
<tr>
<th>Domain</th>
<th>Status</th>
</tr>
</thead>
{% endif %}
<tbody>
<table id="table_malware" class="table table-bordered table-hover table-striped">
<thead>
<tr>
<th>DOMAIN</th>
<th>STATUS</th>
<th>GEOLOCATION</th>
</tr>
</thead>
<tbody>
{% for domain, details in domains.items %}
<tr><td>{{domain}}</td><td>
{% for domain, details in domains.items %}
<tr><td>{{domain}}</td><td>
{% if details|key:"bad" == "yes" %}
<span class="label label-danger">malware</span></br>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="label label-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
{% else %}
<span class="label label-success">good</span></br>
{% endif %}
</td> </tr>
{% endfor %}
{% if details|key:"bad" == "yes" %}
<span class="badge bg-danger">malware</span><br/>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="badge bg-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
{% else %}
<span class="badge bg-success">good</span><br/>
{% endif %}
</td>
<td>
{% if details|key:"geolocation" %}
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
<strong>Latitude: </strong>{{details|key:"geolocation"|key:"latitude"}} <br/>
<strong>Longitude: </strong>{{details|key:"geolocation"|key:"longitude"}} <br/>
<strong>View: <a target="_blank" href="http://maps.google.com/maps?q={{details|key:"geolocation"|key:"latitude"}},{{details|key:"geolocation"|key:"longitude"}}">Google Map</a>
{% else %}
No Geolocation information available.
{% endif %}
</td>
</tr>
{% endfor %}
</tbody>
</table>
</table>
</div>
</div>
templates/pdf/ios_source_analysis_pdf.html
+30 -20
View File
@@ -502,37 +502,47 @@ body {
</div>
<div class="panel-body">
<div class="table-responsive">
<table class="table table-bordered table-hover table-striped">
{% if urls %}
<table id="table_malware" class="table table-bordered table-hover table-striped">
<thead>
<tr>
<th>Domain</th>
<th>Status</th>
<th>DOMAIN</th>
<th>STATUS</th>
<th>GEOLOCATION</th>
</tr>
</thead>
{% endif %}
<tbody>
{% for domain, details in domains.items %}
<tr><td>{{domain}}</td><td>
{% for domain, details in domains.items %}
<tr><td>{{domain}}</td><td>
{% if details|key:"bad" == "yes" %}
<span class="label label-danger">malware</span></br>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="label label-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
<span class="badge bg-danger">malware</span><br/>
<pre>
<strong>URL: </strong>{{details|key:"domain_or_url"}}
<strong>IP: </strong><span class="badge bg-danger">{{details|key:"ip"}}</span>
<strong>Description: </strong>{{details|key:"desc"}}
</pre>
{% else %}
<span class="label label-success">good</span></br>
<span class="badge bg-success">good</span><br/>
{% endif %}
</td>
<td>
{% if details|key:"geolocation" %}
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
<strong>Latitude: </strong>{{details|key:"geolocation"|key:"latitude"}} <br/>
<strong>Longitude: </strong>{{details|key:"geolocation"|key:"longitude"}} <br/>
<strong>View: <a target="_blank" href="http://maps.google.com/maps?q={{details|key:"geolocation"|key:"latitude"}},{{details|key:"geolocation"|key:"longitude"}}">Google Map</a>
</td> </tr>
{% else %}
No Geolocation information available.
{% endif %}
</td>
</tr>
{% endfor %}
</tbody>
</table>
</tbody>
</table>
</div>
</div>
templates/static_analysis/android_binary_analysis.html
+16 -1
View File
@@ -1201,6 +1201,7 @@
<tr>
<th>DOMAIN</th>
<th>STATUS</th>
<th>GEOLOCATION</th>
</tr>
</thead>
<tbody>
@@ -1217,7 +1218,21 @@
{% else %}
<span class="badge bg-success">good</span><br/>
{% endif %}
</td></tr>
</td>
<td>
{% if details|key:"geolocation" %}
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
<strong>Latitude: </strong>{{details|key:"geolocation"|key:"latitude"}} <br/>
<strong>Longitude: </strong>{{details|key:"geolocation"|key:"longitude"}} <br/>
<strong>View: <a target="_blank" href="http://maps.google.com/maps?q={{details|key:"geolocation"|key:"latitude"}},{{details|key:"geolocation"|key:"longitude"}}">Google Map</a>
{% else %}
No Geolocation information available.
{% endif %}
</td>
</tr>
{% endfor %}
</tbody>
</table>
templates/static_analysis/android_source_analysis.html
+16 -1
View File
@@ -856,6 +856,7 @@
<tr>
<th>DOMAIN</th>
<th>STATUS</th>
<th>GEOLOCATION</th>
</tr>
</thead>
<tbody>
@@ -872,7 +873,21 @@
{% else %}
<span class="badge bg-success">good</span><br/>
{% endif %}
</td></tr>
</td>
<td>
{% if details|key:"geolocation" %}
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
<strong>Latitude: </strong>{{details|key:"geolocation"|key:"latitude"}} <br/>
<strong>Longitude: </strong>{{details|key:"geolocation"|key:"longitude"}} <br/>
<strong>View: <a target="_blank" href="http://maps.google.com/maps?q={{details|key:"geolocation"|key:"latitude"}},{{details|key:"geolocation"|key:"longitude"}}">Google Map</a>
{% else %}
No Geolocation information available.
{% endif %}
</td>
</tr>
{% endfor %}
</tbody>
</table>
templates/static_analysis/ios_binary_analysis.html
+17 -1
View File
@@ -718,6 +718,7 @@
<tr>
<th>DOMAIN</th>
<th>STATUS</th>
<th>GEOLOCATION</th>
</tr>
</thead>
<tbody>
@@ -734,7 +735,22 @@
{% else %}
<span class="badge bg-success">good</span><br/>
{% endif %}
</td></tr>
</td>
<td>
{% if details|key:"geolocation" %}
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
<strong>Latitude: </strong>{{details|key:"geolocation"|key:"latitude"}} <br/>
<strong>Longitude: </strong>{{details|key:"geolocation"|key:"longitude"}} <br/>
<strong>View: <a target="_blank" href="http://maps.google.com/maps?q={{details|key:"geolocation"|key:"latitude"}},{{details|key:"geolocation"|key:"longitude"}}">Google Map</a>
{% else %}
No Geolocation information available.
{% endif %}
</td>
</tr>
{% endfor %}
</tbody>
</table>
templates/static_analysis/ios_source_analysis.html
+17 -1
View File
@@ -680,6 +680,7 @@
<tr>
<th>DOMAIN</th>
<th>STATUS</th>
<th>GEOLOCATION</th>
</tr>
</thead>
<tbody>
@@ -696,7 +697,22 @@
{% else %}
<span class="badge bg-success">good</span><br/>
{% endif %}
</td></tr>
</td>
<td>
{% if details|key:"geolocation" %}
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
<strong>Latitude: </strong>{{details|key:"geolocation"|key:"latitude"}} <br/>
<strong>Longitude: </strong>{{details|key:"geolocation"|key:"longitude"}} <br/>
<strong>View: <a target="_blank" href="http://maps.google.com/maps?q={{details|key:"geolocation"|key:"latitude"}},{{details|key:"geolocation"|key:"longitude"}}">Google Map</a>
{% else %}
No Geolocation information available.
{% endif %}
</td>
</tr>
{% endfor %}
</tbody>
</table>