f3nris
d2742ec6fb
Three keyless sources for the questions an analyst asks first: - circl-hashlookup 1.0.0: is this hash known software (NSRL, distro packages, Windows updates)? `score` 0 for a known file, 100 when CIRCL flags it KnownMalicious, so an enrichment rule with benign 0 marks it benign; an unknown hash is an HTTP 404, read as "no record". Single and bulk lookups; base_url for a self-hosted instance. - rdap 1.0.0: who registered a domain, IP block or AS, and when — with age_days for the phishing question. Authoritative server from the IANA bootstrap, rdap.org as fallback; a host name walks up to its registered domain; GDPR placeholders are not reported as registrants; a TLD with no RDAP (.ch) is an error, not a fake "unregistered". - crtsh 1.0.0: Certificate Transparency — sub-domains with first/last seen, issuers, recent certificates, and a starts_with mode for look-alikes of a brand (crt.sh no longer searches with a leading wildcard). Retries the 502/503/504 its shared front throws under load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5
46 lines
2.7 KiB
YAML
46 lines
2.7 KiB
YAML
id: crtsh
|
|
name: crt.sh (Certificate Transparency)
|
|
version: 1.0.0
|
|
description: "crt.sh by Sectigo — searches the public Certificate Transparency logs, where every publicly trusted TLS certificate is recorded. Lists a domain's sub-domains and who issued their certificates, shows when a host first got a certificate (a phishing site usually gets one the day it goes live), and finds look-alike domains that start with a client's brand. Free, no API key; stdlib-only. crt.sh is a shared public service: it is slow on big domains and a starts_with search on a short word can time out — keep searches narrow."
|
|
changelog: "1.0.0 — Initial release: certificate search (sub-domains, exact name, starts with), test connection."
|
|
category: enrichment
|
|
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "crt.sh server (default https://crt.sh)"
|
|
default: https://crt.sh
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required: []
|
|
|
|
commands:
|
|
- id: search_certificates
|
|
name: crtsh-search-certificates
|
|
description: "Certificates logged for a domain. Returns `names` (each DNS name seen, with the first and last time a certificate covered it, newest first, at most 1000 — `name_count` counts them all), `issuers` (certificate count per CA) and `certificates` (the most recent ones, with a crt.sh link). mode: subdomains (default — the domain and every name under it), exact (that name only), starts_with (every logged name beginning with the text, any TLD: look-alikes of a brand such as brand-login.com or brand.co; crt.sh no longer searches for text in the middle of a name, so my-brand.com is not found)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
domain: { type: string, description: "Domain, or the brand to look for with mode=starts_with" }
|
|
mode:
|
|
type: string
|
|
description: "subdomains | exact | starts_with (default subdomains)"
|
|
enum: [subdomains, exact, starts_with]
|
|
exclude_expired: { type: boolean, description: "Ignore expired certificates (default true)" }
|
|
since_days: { type: number, description: "Only certificates issued in the last N days (0 = no limit, default 0)" }
|
|
limit: { type: number, description: "How many certificates to return in `certificates` (default 50, max 500); `names` and `issuers` always count them all" }
|
|
required: [domain]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: crtsh-test-connection
|
|
description: "Run a tiny search against crt.sh (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|