feat(hibp): new Have I Been Pwned breach-enrichment integration
HIBP API v3 + Pwned Passwords, 6 commands: account breaches/pastes, list/get breach, password pwned check (k-anonymity, password never transmitted). API-key auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,72 @@
|
||||
id: hibp
|
||||
name: Have I Been Pwned
|
||||
version: 1.0.0
|
||||
description: "Have I Been Pwned (API v3 + Pwned Passwords) — breach enrichment: check an email for breaches and pastes, list and read breaches, and check whether a password appears in breaches (k-anonymity, password never sent). API-key authentication; stdlib-only, no extra Python dependencies."
|
||||
changelog: "1.0.0 — Initial release: account breaches/pastes, list/get breach, password pwned check."
|
||||
category: enrichment
|
||||
|
||||
# Per-instance configuration. The API key is sent as the 'hibp-api-key' header
|
||||
# (required for account lookups). A User-Agent is always sent, as HIBP requires.
|
||||
config_schema:
|
||||
properties:
|
||||
api_key:
|
||||
type: string
|
||||
description: "Have I Been Pwned API key"
|
||||
x-soar-sensitive: true
|
||||
required:
|
||||
- api_key
|
||||
|
||||
commands:
|
||||
- id: account_breaches
|
||||
name: hibp-account-breaches
|
||||
description: "Get the breaches an email address appears in."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
email: { type: string, description: "Email address to check" }
|
||||
required: [email]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: account_pastes
|
||||
name: hibp-account-pastes
|
||||
description: "Get the pastes an email address appears in."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
email: { type: string, description: "Email address to check" }
|
||||
required: [email]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_breaches
|
||||
name: hibp-list-breaches
|
||||
description: "List all breaches in the system (optionally filtered by domain)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
domain: { type: string, description: "Optional domain filter" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_breach
|
||||
name: hibp-get-breach
|
||||
description: "Get the details of a single breach by name."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Breach name (e.g. Adobe)" }
|
||||
required: [name]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: password_pwned
|
||||
name: hibp-password-pwned
|
||||
description: "Check whether a password appears in known breaches (via k-anonymity; the password itself is never transmitted)."
|
||||
inputs_schema:
|
||||
properties:
|
||||
password: { type: string, description: "The password to check" }
|
||||
required: [password]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: test_connection
|
||||
name: hibp-test-connection
|
||||
description: "Verify the API key (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
@@ -0,0 +1,54 @@
|
||||
import json, os, sys, hashlib, urllib.parse, urllib.request, urllib.error
|
||||
|
||||
BASE = "https://haveibeenpwned.com/api/v3"
|
||||
|
||||
|
||||
def _cfg():
|
||||
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, cfg, params=None):
|
||||
url = BASE + path
|
||||
if params:
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
if clean:
|
||||
url += "?" + urllib.parse.urlencode(clean)
|
||||
headers = {"hibp-api-key": str(cfg.get("api_key", "")), "User-Agent": "Riposte-SOAR", "Accept": "application/json"}
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=60) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def _run(fn):
|
||||
try:
|
||||
print(json.dumps(fn(_cfg(), _inputs())))
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
q = lambda v: urllib.parse.quote(str(v), safe="")
|
||||
|
||||
|
||||
def main(cfg, inputs):
|
||||
email = inputs.get("email")
|
||||
if not email:
|
||||
raise Exception("email is required")
|
||||
try:
|
||||
result = request("/breachedaccount/" + q(email), cfg, params={"truncateResponse": "false"})
|
||||
except urllib.error.HTTPError as e:
|
||||
if e.code == 404:
|
||||
return {"email": email, "breaches": []}
|
||||
raise
|
||||
return {"email": email, "breaches": result}
|
||||
|
||||
|
||||
_run(main)
|
||||
@@ -0,0 +1,54 @@
|
||||
import json, os, sys, hashlib, urllib.parse, urllib.request, urllib.error
|
||||
|
||||
BASE = "https://haveibeenpwned.com/api/v3"
|
||||
|
||||
|
||||
def _cfg():
|
||||
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, cfg, params=None):
|
||||
url = BASE + path
|
||||
if params:
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
if clean:
|
||||
url += "?" + urllib.parse.urlencode(clean)
|
||||
headers = {"hibp-api-key": str(cfg.get("api_key", "")), "User-Agent": "Riposte-SOAR", "Accept": "application/json"}
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=60) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def _run(fn):
|
||||
try:
|
||||
print(json.dumps(fn(_cfg(), _inputs())))
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
q = lambda v: urllib.parse.quote(str(v), safe="")
|
||||
|
||||
|
||||
def main(cfg, inputs):
|
||||
email = inputs.get("email")
|
||||
if not email:
|
||||
raise Exception("email is required")
|
||||
try:
|
||||
result = request("/pasteaccount/" + q(email), cfg)
|
||||
except urllib.error.HTTPError as e:
|
||||
if e.code == 404:
|
||||
return {"email": email, "pastes": []}
|
||||
raise
|
||||
return {"email": email, "pastes": result}
|
||||
|
||||
|
||||
_run(main)
|
||||
@@ -0,0 +1,49 @@
|
||||
import json, os, sys, hashlib, urllib.parse, urllib.request, urllib.error
|
||||
|
||||
BASE = "https://haveibeenpwned.com/api/v3"
|
||||
|
||||
|
||||
def _cfg():
|
||||
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, cfg, params=None):
|
||||
url = BASE + path
|
||||
if params:
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
if clean:
|
||||
url += "?" + urllib.parse.urlencode(clean)
|
||||
headers = {"hibp-api-key": str(cfg.get("api_key", "")), "User-Agent": "Riposte-SOAR", "Accept": "application/json"}
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=60) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def _run(fn):
|
||||
try:
|
||||
print(json.dumps(fn(_cfg(), _inputs())))
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
q = lambda v: urllib.parse.quote(str(v), safe="")
|
||||
|
||||
|
||||
def main(cfg, inputs):
|
||||
name = inputs.get("name")
|
||||
if not name:
|
||||
raise Exception("name is required")
|
||||
result = request("/breach/" + q(name), cfg)
|
||||
return result
|
||||
|
||||
|
||||
_run(main)
|
||||
@@ -0,0 +1,47 @@
|
||||
import json, os, sys, hashlib, urllib.parse, urllib.request, urllib.error
|
||||
|
||||
BASE = "https://haveibeenpwned.com/api/v3"
|
||||
|
||||
|
||||
def _cfg():
|
||||
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, cfg, params=None):
|
||||
url = BASE + path
|
||||
if params:
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
if clean:
|
||||
url += "?" + urllib.parse.urlencode(clean)
|
||||
headers = {"hibp-api-key": str(cfg.get("api_key", "")), "User-Agent": "Riposte-SOAR", "Accept": "application/json"}
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=60) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def _run(fn):
|
||||
try:
|
||||
print(json.dumps(fn(_cfg(), _inputs())))
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
q = lambda v: urllib.parse.quote(str(v), safe="")
|
||||
|
||||
|
||||
def main(cfg, inputs):
|
||||
domain = inputs.get("domain")
|
||||
result = request("/breaches", cfg, params={"domain": domain})
|
||||
return {"breaches": result}
|
||||
|
||||
|
||||
_run(main)
|
||||
@@ -0,0 +1,66 @@
|
||||
import json, os, sys, hashlib, urllib.parse, urllib.request, urllib.error
|
||||
|
||||
BASE = "https://haveibeenpwned.com/api/v3"
|
||||
|
||||
|
||||
def _cfg():
|
||||
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, cfg, params=None):
|
||||
url = BASE + path
|
||||
if params:
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
if clean:
|
||||
url += "?" + urllib.parse.urlencode(clean)
|
||||
headers = {"hibp-api-key": str(cfg.get("api_key", "")), "User-Agent": "Riposte-SOAR", "Accept": "application/json"}
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=60) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def _run(fn):
|
||||
try:
|
||||
print(json.dumps(fn(_cfg(), _inputs())))
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
q = lambda v: urllib.parse.quote(str(v), safe="")
|
||||
|
||||
|
||||
def main(cfg, inputs):
|
||||
password = inputs.get("password")
|
||||
if not password:
|
||||
raise Exception("password is required")
|
||||
|
||||
sha1 = hashlib.sha1(password.encode("utf-8")).hexdigest().upper()
|
||||
prefix = sha1[:5]
|
||||
suffix = sha1[5:]
|
||||
|
||||
url = "https://api.pwnedpasswords.com/range/" + prefix
|
||||
req = urllib.request.Request(url, headers={"User-Agent": "Riposte-SOAR"}, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=60) as r:
|
||||
body = r.read().decode("utf-8", "replace")
|
||||
|
||||
for line in body.splitlines():
|
||||
line = line.strip()
|
||||
if not line or ":" not in line:
|
||||
continue
|
||||
line_suffix, count = line.split(":", 1)
|
||||
if line_suffix.strip().upper() == suffix.upper():
|
||||
return {"pwned": True, "count": int(count.strip())}
|
||||
|
||||
return {"pwned": False, "count": 0}
|
||||
|
||||
|
||||
_run(main)
|
||||
@@ -0,0 +1,46 @@
|
||||
import json, os, sys, hashlib, urllib.parse, urllib.request, urllib.error
|
||||
|
||||
BASE = "https://haveibeenpwned.com/api/v3"
|
||||
|
||||
|
||||
def _cfg():
|
||||
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, cfg, params=None):
|
||||
url = BASE + path
|
||||
if params:
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
if clean:
|
||||
url += "?" + urllib.parse.urlencode(clean)
|
||||
headers = {"hibp-api-key": str(cfg.get("api_key", "")), "User-Agent": "Riposte-SOAR", "Accept": "application/json"}
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=60) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def _run(fn):
|
||||
try:
|
||||
print(json.dumps(fn(_cfg(), _inputs())))
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
q = lambda v: urllib.parse.quote(str(v), safe="")
|
||||
|
||||
|
||||
def main(cfg, inputs):
|
||||
request("/breaches", cfg)
|
||||
return {"ok": True}
|
||||
|
||||
|
||||
_run(main)
|
||||
Reference in New Issue
Block a user