Skip to content

Commit 9f07fcb

Browse files
monoidicWagner
monoidic
authored and
Wagner
committed
TST: Add honeypot HTTP scanner tests
1 parent 3242295 commit 9f07fcb

File tree

3 files changed

+114
-0
lines changed

3 files changed

+114
-0
lines changed

‎intelmq/tests/bots/parsers/shadowserver/test_event4_honeypot_http_scan.py‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# SPDX-FileCopyrightText: 2021 Mikk Margus Möll <mikk@cert.ee>
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-or-later
4+
5+
# -*- coding: utf-8 -*-
6+
7+
import os
8+
import unittest
9+
10+
import intelmq.lib.test as test
11+
import intelmq.lib.utils as utils
12+
from intelmq.bots.parsers.shadowserver.parser import ShadowserverParserBot
13+
14+
with open(os.path.join(os.path.dirname(__file__),
15+
'testdata/event4_honeypot_http_scan.csv')) as handle:
16+
EXAMPLE_FILE = handle.read()
17+
EXAMPLE_LINES = EXAMPLE_FILE.splitlines()
18+
19+
EXAMPLE_REPORT = {'feed.name': 'Honeypot-HTTP-Scan',
20+
"raw": utils.base64_encode(EXAMPLE_FILE),
21+
"__type": "Report",
22+
"time.observation": "2021-08-01T12:00:00+00:00",
23+
"extra.file_name": "2021-08-01-event4_honeypot_http_scan.csv",
24+
}
25+
26+
EVENTS = [{'__type': 'Event',
27+
'feed.name': 'Honeypot-HTTP-Scan',
28+
'classification.identifier': 'honeypot-http-scan',
29+
'classification.taxonomy': 'other',
30+
'classification.type': 'other',
31+
'destination.asn': 5678,
32+
'destination.geolocation.cc': 'UK',
33+
'destination.geolocation.city': 'MAIDENHEAD',
34+
'destination.geolocation.region': 'WINDSOR AND MAIDENHEAD',
35+
'destination.ip': '109.87.65.43',
36+
'destination.port': 80,
37+
'extra.http_url': '/js/ueditor/wwwroot/way-board.cgi',
38+
'extra.destination.naics': 518210,
39+
'extra.protocol': 'tcp',
40+
'extra.public_source': 'CAPRICA-EU',
41+
'extra.request_raw': 'R0VUIC9qcy91ZWRpdG9yL3d3d3Jvb3Qvd2F5LWJvYXJkLmNnaSBIVFRQLzEuMHJuQWNjZXB0OiB0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhybkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZXJuQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNXJuQ29ubmVjdGlvbjogY2xvc2VybkRudDogMXJuSG9zdDogMTA5Ljg3LjY1LjQzcm5PcmlnaW46IGh0dHA6Ly8xMDkuODcuNjUuNDNyblJlZmVyZXI6IGh0dHA6Ly8xMDkuODcuNjUuNDMvcm5Vc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA2LjE7IFdPVzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNTMuMC4yNzg1LjEwNCBTYWZhcmkvNTM3LjM2IENvcmUvMS41My4zMDg0LjQwMCBRUUJyb3dzZXIvOS42LjExMzQ2LjQwMA==',
42+
'extra.source.naics': 518210,
43+
'extra.source.sector': 'Communications, Service Provider, and Hosting Service',
44+
'extra.version': '3.1.3-dev',
45+
'malware.name': 'http-scan',
46+
'protocol.application': 'http',
47+
'raw': utils.base64_encode('\n'.join([EXAMPLE_LINES[0],
48+
EXAMPLE_LINES[1]])),
49+
'source.asn': 1234,
50+
'source.geolocation.cc': 'EE',
51+
'source.geolocation.city': 'TALLINN',
52+
'source.geolocation.region': 'HARJUMAA',
53+
'source.ip': '191.23.45.67',
54+
'source.port': 36455,
55+
'source.reverse_dns': '191-23-45-67-host.example.com',
56+
'time.observation': '2021-08-01T12:00:00+00:00',
57+
'time.source': '2021-08-01T00:24:08+00:00'},
58+
{'__type': 'Event',
59+
'feed.name': 'Honeypot-HTTP-Scan',
60+
'classification.identifier': 'honeypot-http-scan',
61+
'classification.taxonomy': 'other',
62+
'classification.type': 'other',
63+
'destination.asn': 23456,
64+
'destination.geolocation.cc': 'UA',
65+
'destination.geolocation.city': 'KHARKIV',
66+
'destination.geolocation.region': "KHARKIVS'KA OBLAST'",
67+
'destination.ip': '82.41.20.10',
68+
'destination.port': 8080,
69+
'extra.http_url': '/',
70+
'extra.method': 'GET',
71+
'extra.protocol': 'tcp',
72+
'extra.public_source': 'CAPRICA-EU',
73+
'extra.request_raw': 'R0VUIC8gSFRUUC8xLjENCkhvc3Q6IDgyLjQxLjIwLjEwOjgwODANCkFjY2VwdDogdGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksKi8qO3E9MC44DQpBY2NlcHQtRW5jb2Rpbmc6IGRlZmxhdGUsIGd6aXAsIGlkZW50aXR5DQpBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTO3E9MC42LGVuO3E9MC40DQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA1LjE7IHJ2OjkuMC4xKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzkuMC4xDQoNCg==',
74+
'extra.url_scheme': 'http',
75+
'extra.user_agent': 'Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1',
76+
'malware.name': 'http-scan',
77+
'protocol.application': 'http',
78+
'raw': utils.base64_encode('\n'.join([EXAMPLE_LINES[0],
79+
EXAMPLE_LINES[2]])),
80+
'source.asn': 12345,
81+
'source.geolocation.cc': 'EE',
82+
'source.geolocation.city': 'TALLINN',
83+
'source.geolocation.region': 'HARJUMAA',
84+
'source.ip': '45.67.89.123',
85+
'source.port': 58610,
86+
'time.observation': '2021-08-01T12:00:00+00:00',
87+
'time.source': '2021-08-01T05:21:59+00:00'},
88+
]
89+
90+
91+
class TestShadowserverParserBot(test.BotTestCase, unittest.TestCase):
92+
"""
93+
A TestCase for a ShadowserverParserBot.
94+
"""
95+
96+
@classmethod
97+
def set_bot(cls):
98+
cls.bot_reference = ShadowserverParserBot
99+
cls.default_input_message = EXAMPLE_REPORT
100+
101+
def test_event(self):
102+
""" Test if correct Event has been produced. """
103+
self.run_bot()
104+
for i, EVENT in enumerate(EVENTS):
105+
self.assertMessageEqual(i, EVENT)
106+
107+
108+
if __name__ == '__main__': # pragma: no cover
109+
unittest.main()

‎intelmq/tests/bots/parsers/shadowserver/testdata/event4_honeypot_http_scan.csv‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
"timestamp","protocol","src_ip","src_port","src_asn","src_geo","src_region","src_city","src_hostname","src_naics","src_sector","device_vendor","device_type","device_model","dst_ip","dst_port","dst_asn","dst_geo","dst_region","dst_city","dst_hostname","dst_naics","dst_sector","public_source","infection","family","tag","application","version","event_id","pattern","http_url","http_agent","http_request_method","url_scheme","session_tags","vulnerability_enum","vulnerability_id","vulnerability_class","vulnerability_score","vulnerability_severity","vulnerability_version","threat_framework","threat_tactic_id","threat_technique_id","target_vendor","target_product","target_class","file_md5","file_sha256","request_raw","body_raw"
2+
"2021-08-01 00:24:08","tcp","191.23.45.67",36455,1234,"EE","HARJUMAA","TALLINN","191-23-45-67-host.example.com",518210,"Communications, Service Provider, and Hosting Service",,,,"109.87.65.43",80,5678,"UK","WINDSOR AND MAIDENHEAD","MAIDENHEAD",,518210,,"CAPRICA-EU","http-scan",,,,"3.1.3-dev",,"unknown","/js/ueditor/wwwroot/way-board.cgi",,,,,,,,,,,,,,,,,,,"GET /js/ueditor/wwwroot/way-board.cgi HTTP/1.0rnAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8rnAccept-Encoding: gzip, deflaternAccept-Language: en-US,en;q=0.5rnConnection: closernDnt: 1rnHost: 109.87.65.43rnOrigin: http://109.87.65.43rnReferer: http://109.87.65.43/rnUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.3084.400 QQBrowser/9.6.11346.400",
3+
"2021-08-01 05:21:59","tcp","45.67.89.123",58610,12345,"EE","HARJUMAA","TALLINN",,,,,,,"82.41.20.10",8080,23456,"UA","KHARKIVS'KA OBLAST'","KHARKIV",,,,"CAPRICA-EU","http-scan",,,,,,,"/","Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","GET","http",,,,,,,,,,,,,,,,"R0VUIC8gSFRUUC8xLjENCkhvc3Q6IDgyLjQxLjIwLjEwOjgwODANCkFjY2VwdDogdGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksKi8qO3E9MC44DQpBY2NlcHQtRW5jb2Rpbmc6IGRlZmxhdGUsIGd6aXAsIGlkZW50aXR5DQpBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTO3E9MC42LGVuO3E9MC40DQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA1LjE7IHJ2OjkuMC4xKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzkuMC4xDQoNCg==",

‎intelmq/tests/bots/parsers/shadowserver/testdata/event4_honeypot_http_scan.csv.license‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
SPDX-FileCopyrightText: 2021 Mikk Margus Möll <mikk@cert.ee>
2+
SPDX-License-Identifier: AGPL-3.0-or-later

0 commit comments

Comments
 (0)