l9format

README

l9format

l9format is a schema declaration targeted at interoperability between network recon tools used at LeakIX.

Golang

This repository includes the Golang headers used as library in our components.

Other languages

Check l9event.json can be used to derive classes for your favorite language ( python, php ect)

Documentation

Index

• Constants
• type Certificate
• type DatasetSummary
• type GeoLocation
• type GeoPoint
• type L9Event
  • func (event *L9Event) AddSource(source string)
  • func (event *L9Event) AddTag(tag string)
  • func (event *L9Event) HasSource(source string) bool
  • func (event *L9Event) HasTag(tag string) bool
  • func (event *L9Event) HasTransport(transport string) bool
  • func (event *L9Event) MatchServicePlugin(plugin ServicePluginInterface) bool
  • func (event *L9Event) RemoveTransport(transportCheck string)
  • func (event *L9Event) UpdateFingerprint() error
  • func (event *L9Event) Url() string
• type L9HttpEvent
• type L9LeakEvent
• type L9SSHEvent
• type L9SSLEvent
• type L9ServiceEvent
• type Network
• type ServiceCredentials
• type ServicePluginBase
  • func (plugin ServicePluginBase) DialContext(ctx context.Context, network string, addr string) (conn net.Conn, err error)
  • func (plugin ServicePluginBase) GetHttpClient(ctx context.Context, ip string, port string) *http.Client
  • func (plugin ServicePluginBase) GetL9NetworkConnection(event *L9Event) (conn net.Conn, err error)
  • func (plugin ServicePluginBase) GetNetworkConnection(network string, addr string) (conn net.Conn, err error)
• type ServicePluginInterface
• type Software
• type SoftwareModule
• type WebPluginInterface
• type WebPluginRequest
  • func (request *WebPluginRequest) Equal(testRequest WebPluginRequest) bool
  • func (request *WebPluginRequest) EqualAny(testRequests []WebPluginRequest) bool
  • func (request *WebPluginRequest) GetHash() string
• type WebPluginResponse
  • func (resp *WebPluginResponse) GetHash() string

Constants

const SEVERITY_CRITICAL = "critical"

const SEVERITY_HIGH = "high"

const SEVERITY_INFO = "info"

const SEVERITY_LOW = "low"

const SEVERITY_MEDIUM = "medium"

const STAGE_EXFILTRATE = "exfiltrate"

const STAGE_EXPLORE = "explore"

const STAGE_OPEN = "open"

Types

type Certificate

type Certificate struct {
	CommonName  string    `json:"cn"`
	Domains     []string  `json:"domain"`
	Fingerprint string    `json:"fingerprint"`
	KeyAlgo     string    `json:"key_algo"`
	KeySize     int       `json:"key_size"`
	IssuerName  string    `json:"issuer_name"`
	NotBefore   time.Time `json:"not_before"`
	NotAfter    time.Time `json:"not_after"`
	Valid       bool      `json:"valid"`
}

type DatasetSummary

type DatasetSummary struct {
	Rows        int64    `json:"rows"`
	Files       int64    `json:"files"`
	Size        int64    `json:"size"`
	Collections int64    `json:"collections"`
	Infected    bool     `json:"infected"`
	RansomNotes []string `json:"ransom_notes"`
}

type GeoLocation

type GeoLocation struct {
	ContinentName  string   `json:"continent_name"`
	RegionISOCode  string   `json:"region_iso_code"`
	CityName       string   `json:"city_name"`
	CountryISOCode string   `json:"country_iso_code"`
	CountryName    string   `json:"country_name"`
	RegionName     string   `json:"region_name"`
	GeoPoint       GeoPoint `json:"location"`
}

type GeoPoint

type GeoPoint struct {
	Latitude  float64 `json:"lat"`
	Longitude float64 `json:"lon"`
}

type L9Event

type L9Event struct {
	EventType        string         `json:"event_type"`
	EventSource      string         `json:"event_source"`
	EventPipeline    []string       `json:"event_pipeline"`
	EventFingerprint string         `json:"event_fingerprint"`
	Ip               string         `json:"ip"`
	Host             string         `json:"host"`
	Reverse          string         `json:"reverse"`
	Port             string         `json:"port"`
	Mac              string         `json:"mac"`
	Vendor           string         `json:"vendor"`
	Transports       []string       `json:"transport"`
	Protocol         string         `json:"protocol"`
	Http             L9HttpEvent    `json:"http"`
	Summary          string         `json:"summary"`
	Time             time.Time      `json:"time"`
	SSL              L9SSLEvent     `json:"ssl"`
	SSH              L9SSHEvent     `json:"ssh"`
	Service          L9ServiceEvent `json:"service"`
	Leak             L9LeakEvent    `json:"leak"`
	Tags             []string       `json:"tags"`
	GeoIp            GeoLocation    `json:"geoip"`
	Network          Network        `json:"network"`
}

func (*L9Event) AddSource

func (event *L9Event) AddSource(source string)

func (*L9Event) AddTag

func (event *L9Event) AddTag(tag string)

func (*L9Event) HasSource

func (event *L9Event) HasSource(source string) bool

func (*L9Event) HasTag

func (event *L9Event) HasTag(tag string) bool

func (*L9Event) HasTransport

func (event *L9Event) HasTransport(transport string) bool

func (*L9Event) MatchServicePlugin

func (event *L9Event) MatchServicePlugin(plugin ServicePluginInterface) bool

func (*L9Event) RemoveTransport

func (event *L9Event) RemoveTransport(transportCheck string)

func (*L9Event) UpdateFingerprint

func (event *L9Event) UpdateFingerprint() error

func (*L9Event) Url

func (event *L9Event) Url() string

type L9HttpEvent

type L9HttpEvent struct {
	Root        string            `json:"root"`
	Url         string            `json:"url"`
	Status      int               `json:"status"`
	Length      int64             `json:"length"`
	Headers     map[string]string `json:"header"`
	Title       string            `json:"title"`
	FaviconHash string            `json:"favicon_hash"`
}

type L9LeakEvent

type L9LeakEvent struct {
	Stage    string         `json:"stage"`
	Type     string         `json:"type"`
	Severity string         `json:"severity"`
	Dataset  DatasetSummary `json:"dataset"`
}

type L9SSHEvent

type L9SSHEvent struct {
	Fingerprint string `json:"fingerprint"`
	Version     int    `json:"version"`
	Banner      string `json:"banner"`
	Motd        string `json:"motd"`
}

type L9SSLEvent

type L9SSLEvent struct {
	Detected    bool        `json:"detected"`
	Enabled     bool        `json:"enabled"`
	JARM        string      `json:"jarm"`
	CypherSuite string      `json:"cypher_suite"`
	Version     string      `json:"version"`
	Certificate Certificate `json:"certificate"`
}

type L9ServiceEvent

type L9ServiceEvent struct {
	Credentials ServiceCredentials `json:"credentials"`
	Software    Software           `json:"software"`
}

type Network

type Network struct {
	OrganisationName string `json:"organization_name"`
	ASN              int    `json:"asn"`
	NetworkCIDR      string `json:"network"`
}

type ServiceCredentials

type ServiceCredentials struct {
	NoAuth   bool   `json:"noauth"`
	Username string `json:"username"`
	Password string `json:"password"`
	Key      string `json:"key"`
	Raw      []byte `json:"raw"`
}

type ServicePluginBase

type ServicePluginBase struct {
}

func (ServicePluginBase) DialContext

func (plugin ServicePluginBase) DialContext(ctx context.Context, network string, addr string) (conn net.Conn, err error)

func (ServicePluginBase) GetHttpClient

func (plugin ServicePluginBase) GetHttpClient(ctx context.Context, ip string, port string) *http.Client

func (ServicePluginBase) GetL9NetworkConnection

func (plugin ServicePluginBase) GetL9NetworkConnection(event *L9Event) (conn net.Conn, err error)

func (ServicePluginBase) GetNetworkConnection

func (plugin ServicePluginBase) GetNetworkConnection(network string, addr string) (conn net.Conn, err error)

type ServicePluginInterface

type ServicePluginInterface interface {
	GetVersion() (int, int, int)
	GetProtocols() []string
	GetName() string
	GetStage() string
	Run(ctx context.Context, event *L9Event, options map[string]string) (hasLeak bool)
}

type Software

type Software struct {
	Name            string           `json:"name"`
	Version         string           `json:"version"`
	OperatingSystem string           `json:"os"`
	Modules         []SoftwareModule `json:"modules"`
	Fingerprint     string           `json:"fingerprint"`
}

type SoftwareModule

type SoftwareModule struct {
	Name        string `json:"name"`
	Version     string `json:"version"`
	Fingerprint string `json:"fingerprint"`
}

type WebPluginInterface

type WebPluginInterface interface {
	GetVersion() (int, int, int)
	GetRequests() []WebPluginRequest
	GetName() string
	GetStage() string
	Verify(request WebPluginRequest, response WebPluginResponse, event *L9Event, options map[string]string) (hasLeak bool)
}

type WebPluginRequest

type WebPluginRequest struct {
	Method  string
	Path    string
	Headers map[string]string
	Body    []byte
	// contains filtered or unexported fields
}

func (*WebPluginRequest) Equal

func (request *WebPluginRequest) Equal(testRequest WebPluginRequest) bool

func (*WebPluginRequest) EqualAny

func (request *WebPluginRequest) EqualAny(testRequests []WebPluginRequest) bool

func (*WebPluginRequest) GetHash

func (request *WebPluginRequest) GetHash() string

type WebPluginResponse

type WebPluginResponse struct {
	Response *http.Response
	Body     []byte
	Document *goquery.Document
}

func (*WebPluginResponse) GetHash

func (resp *WebPluginResponse) GetHash() string