mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-09-18 13:45:52 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
@@ -0,0 +1,228 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Dark Web Monitoring for Threats Script
|
||||
|
||||
Monitors dark web sources for organizational threats:
|
||||
- Credential leak detection via HIBP and paste sites
|
||||
- Ransomware leak site monitoring via Ransomwatch
|
||||
- Brand mention monitoring across dark web sources
|
||||
- Generates structured intelligence reports
|
||||
|
||||
Requirements:
|
||||
pip install requests[socks] beautifulsoup4 stix2
|
||||
|
||||
Usage:
|
||||
python process.py --org "Acme Corp" --domains acme.com,acme.io --check-credentials
|
||||
python process.py --org "Acme Corp" --check-ransomware
|
||||
python process.py --org "Acme Corp" --full-scan --output report.json
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
from datetime import datetime
|
||||
from typing import Optional
|
||||
|
||||
import requests
|
||||
|
||||
|
||||
class DarkWebMonitor:
|
||||
"""Monitor dark web sources for organizational threats."""
|
||||
|
||||
def __init__(self, organization: str, domains: list = None, hibp_key: str = ""):
|
||||
self.organization = organization
|
||||
self.domains = domains or []
|
||||
self.hibp_key = hibp_key
|
||||
self.findings = []
|
||||
|
||||
def check_credential_leaks(self) -> list:
|
||||
"""Check for credential leaks via HIBP API."""
|
||||
leaks = []
|
||||
headers = {}
|
||||
if self.hibp_key:
|
||||
headers["hibp-api-key"] = self.hibp_key
|
||||
|
||||
try:
|
||||
resp = requests.get(
|
||||
"https://haveibeenpwned.com/api/v3/breaches",
|
||||
headers=headers,
|
||||
timeout=30,
|
||||
)
|
||||
if resp.status_code == 200:
|
||||
breaches = resp.json()
|
||||
for domain in self.domains:
|
||||
for breach in breaches:
|
||||
breach_domain = breach.get("Domain", "").lower()
|
||||
if domain.lower() in breach_domain or breach_domain in domain.lower():
|
||||
leak = {
|
||||
"type": "credential_leak",
|
||||
"source": "HIBP",
|
||||
"breach_name": breach["Name"],
|
||||
"breach_date": breach.get("BreachDate"),
|
||||
"data_classes": breach.get("DataClasses", []),
|
||||
"pwn_count": breach.get("PwnCount", 0),
|
||||
"domain": domain,
|
||||
"is_verified": breach.get("IsVerified", False),
|
||||
"severity": "HIGH",
|
||||
}
|
||||
leaks.append(leak)
|
||||
self.findings.append(leak)
|
||||
print(
|
||||
f"[!] Credential leak: {breach['Name']} "
|
||||
f"({breach.get('PwnCount', 0)} accounts)"
|
||||
)
|
||||
except Exception as e:
|
||||
print(f"[-] HIBP check failed: {e}")
|
||||
|
||||
return leaks
|
||||
|
||||
def check_ransomware_leaks(self) -> list:
|
||||
"""Check ransomware leak site aggregator for organization mentions."""
|
||||
mentions = []
|
||||
try:
|
||||
resp = requests.get(
|
||||
"https://raw.githubusercontent.com/joshhighet/ransomwatch/main/posts.json",
|
||||
timeout=30,
|
||||
)
|
||||
if resp.status_code == 200:
|
||||
posts = resp.json()
|
||||
org_lower = self.organization.lower()
|
||||
domain_patterns = [d.lower().split(".")[0] for d in self.domains]
|
||||
|
||||
for post in posts:
|
||||
title = post.get("post_title", "").lower()
|
||||
if org_lower in title or any(d in title for d in domain_patterns):
|
||||
mention = {
|
||||
"type": "ransomware_leak",
|
||||
"source": "ransomwatch",
|
||||
"group": post.get("group_name", ""),
|
||||
"title": post.get("post_title", ""),
|
||||
"discovered": post.get("discovered", ""),
|
||||
"url": post.get("post_url", ""),
|
||||
"severity": "CRITICAL",
|
||||
}
|
||||
mentions.append(mention)
|
||||
self.findings.append(mention)
|
||||
print(
|
||||
f"[!!!] RANSOMWARE LEAK: {post.get('group_name')} - "
|
||||
f"{post.get('post_title')}"
|
||||
)
|
||||
except Exception as e:
|
||||
print(f"[-] Ransomwatch check failed: {e}")
|
||||
|
||||
return mentions
|
||||
|
||||
def check_breach_directory(self) -> list:
|
||||
"""Check public breach directories for organization data."""
|
||||
breaches = []
|
||||
try:
|
||||
# Check BreachDirectory (public API)
|
||||
for domain in self.domains:
|
||||
resp = requests.get(
|
||||
f"https://breachdirectory.org/api/entries?domain={domain}",
|
||||
timeout=30,
|
||||
)
|
||||
if resp.status_code == 200:
|
||||
data = resp.json()
|
||||
if data.get("result"):
|
||||
breaches.append({
|
||||
"type": "breach_directory",
|
||||
"domain": domain,
|
||||
"entries_found": len(data.get("result", [])),
|
||||
"severity": "HIGH",
|
||||
})
|
||||
except Exception as e:
|
||||
print(f"[-] Breach directory check failed: {e}")
|
||||
return breaches
|
||||
|
||||
def generate_report(self) -> dict:
|
||||
"""Generate comprehensive dark web monitoring report."""
|
||||
critical = [f for f in self.findings if f.get("severity") == "CRITICAL"]
|
||||
high = [f for f in self.findings if f.get("severity") == "HIGH"]
|
||||
medium = [f for f in self.findings if f.get("severity") == "MEDIUM"]
|
||||
|
||||
report = {
|
||||
"report_metadata": {
|
||||
"organization": self.organization,
|
||||
"domains_monitored": self.domains,
|
||||
"report_date": datetime.utcnow().isoformat(),
|
||||
"classification": "TLP:AMBER",
|
||||
},
|
||||
"executive_summary": (
|
||||
f"Dark web monitoring for {self.organization} identified "
|
||||
f"{len(critical)} critical, {len(high)} high, and "
|
||||
f"{len(medium)} medium severity findings."
|
||||
),
|
||||
"findings_by_severity": {
|
||||
"critical": critical,
|
||||
"high": high,
|
||||
"medium": medium,
|
||||
},
|
||||
"all_findings": self.findings,
|
||||
"recommendations": [],
|
||||
}
|
||||
|
||||
if critical:
|
||||
report["recommendations"].append(
|
||||
"IMMEDIATE: Activate incident response for ransomware leak detection. "
|
||||
"Assess data exposure scope and notify affected parties."
|
||||
)
|
||||
if high:
|
||||
report["recommendations"].append(
|
||||
"URGENT: Force password resets for all accounts in detected breaches. "
|
||||
"Enable MFA across all services."
|
||||
)
|
||||
report["recommendations"].append(
|
||||
"ONGOING: Continue dark web monitoring with weekly reporting cadence."
|
||||
)
|
||||
|
||||
return report
|
||||
|
||||
def full_scan(self) -> dict:
|
||||
"""Run all dark web monitoring checks."""
|
||||
print(f"[*] Starting dark web monitoring for: {self.organization}")
|
||||
print(f"[*] Domains: {', '.join(self.domains)}")
|
||||
|
||||
print("\n[*] Checking credential leaks...")
|
||||
self.check_credential_leaks()
|
||||
|
||||
print("\n[*] Checking ransomware leak sites...")
|
||||
self.check_ransomware_leaks()
|
||||
|
||||
print(f"\n[+] Total findings: {len(self.findings)}")
|
||||
return self.generate_report()
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description="Dark Web Monitoring Tool")
|
||||
parser.add_argument("--org", required=True, help="Organization name")
|
||||
parser.add_argument("--domains", help="Comma-separated domains to monitor")
|
||||
parser.add_argument("--hibp-key", default="", help="HIBP API key")
|
||||
parser.add_argument("--check-credentials", action="store_true")
|
||||
parser.add_argument("--check-ransomware", action="store_true")
|
||||
parser.add_argument("--full-scan", action="store_true")
|
||||
parser.add_argument("--output", default="darkweb_report.json", help="Output file")
|
||||
|
||||
args = parser.parse_args()
|
||||
domains = args.domains.split(",") if args.domains else []
|
||||
monitor = DarkWebMonitor(args.org, domains, args.hibp_key)
|
||||
|
||||
if args.full_scan:
|
||||
report = monitor.full_scan()
|
||||
elif args.check_credentials:
|
||||
monitor.check_credential_leaks()
|
||||
report = monitor.generate_report()
|
||||
elif args.check_ransomware:
|
||||
monitor.check_ransomware_leaks()
|
||||
report = monitor.generate_report()
|
||||
else:
|
||||
report = monitor.full_scan()
|
||||
|
||||
with open(args.output, "w") as f:
|
||||
json.dump(report, f, indent=2, default=str)
|
||||
print(f"\n[+] Report saved to {args.output}")
|
||||
print(json.dumps(report["executive_summary"], indent=2))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user