sica-fondt/knowledge/cyber-skills/skills/performing-dark-web-monitoring-for-threats/scripts/process.py

#!/usr/bin/env python3
"""
Dark Web Monitoring for Threats Script

Monitors dark web sources for organizational threats:
- Credential leak detection via HIBP and paste sites
- Ransomware leak site monitoring via Ransomwatch
- Brand mention monitoring across dark web sources
- Generates structured intelligence reports

Requirements:
    pip install requests[socks] beautifulsoup4 stix2

Usage:
    python process.py --org "Acme Corp" --domains acme.com,acme.io --check-credentials
    python process.py --org "Acme Corp" --check-ransomware
    python process.py --org "Acme Corp" --full-scan --output report.json
"""

import argparse
import json
import sys
from datetime import datetime
from typing import Optional

import requests


class DarkWebMonitor:
    """Monitor dark web sources for organizational threats."""

    def __init__(self, organization: str, domains: list = None, hibp_key: str = ""):
        self.organization = organization
        self.domains = domains or []
        self.hibp_key = hibp_key
        self.findings = []

    def check_credential_leaks(self) -> list:
        """Check for credential leaks via HIBP API."""
        leaks = []
        headers = {}
        if self.hibp_key:
            headers["hibp-api-key"] = self.hibp_key

        try:
            resp = requests.get(
                "https://haveibeenpwned.com/api/v3/breaches",
                headers=headers,
                timeout=30,
            )
            if resp.status_code == 200:
                breaches = resp.json()
                for domain in self.domains:
                    for breach in breaches:
                        breach_domain = breach.get("Domain", "").lower()
                        if domain.lower() in breach_domain or breach_domain in domain.lower():
                            leak = {
                                "type": "credential_leak",
                                "source": "HIBP",
                                "breach_name": breach["Name"],
                                "breach_date": breach.get("BreachDate"),
                                "data_classes": breach.get("DataClasses", []),
                                "pwn_count": breach.get("PwnCount", 0),
                                "domain": domain,
                                "is_verified": breach.get("IsVerified", False),
                                "severity": "HIGH",
                            }
                            leaks.append(leak)
                            self.findings.append(leak)
                            print(
                                f"[!] Credential leak: {breach['Name']} "
                                f"({breach.get('PwnCount', 0)} accounts)"
                            )
        except Exception as e:
            print(f"[-] HIBP check failed: {e}")

        return leaks

    def check_ransomware_leaks(self) -> list:
        """Check ransomware leak site aggregator for organization mentions."""
        mentions = []
        try:
            resp = requests.get(
                "https://raw.githubusercontent.com/joshhighet/ransomwatch/main/posts.json",
                timeout=30,
            )
            if resp.status_code == 200:
                posts = resp.json()
                org_lower = self.organization.lower()
                domain_patterns = [d.lower().split(".")[0] for d in self.domains]

                for post in posts:
                    title = post.get("post_title", "").lower()
                    if org_lower in title or any(d in title for d in domain_patterns):
                        mention = {
                            "type": "ransomware_leak",
                            "source": "ransomwatch",
                            "group": post.get("group_name", ""),
                            "title": post.get("post_title", ""),
                            "discovered": post.get("discovered", ""),
                            "url": post.get("post_url", ""),
                            "severity": "CRITICAL",
                        }
                        mentions.append(mention)
                        self.findings.append(mention)
                        print(
                            f"[!!!] RANSOMWARE LEAK: {post.get('group_name')} - "
                            f"{post.get('post_title')}"
                        )
        except Exception as e:
            print(f"[-] Ransomwatch check failed: {e}")

        return mentions

    def check_breach_directory(self) -> list:
        """Check public breach directories for organization data."""
        breaches = []
        try:
            # Check BreachDirectory (public API)
            for domain in self.domains:
                resp = requests.get(
                    f"https://breachdirectory.org/api/entries?domain={domain}",
                    timeout=30,
                )
                if resp.status_code == 200:
                    data = resp.json()
                    if data.get("result"):
                        breaches.append({
                            "type": "breach_directory",
                            "domain": domain,
                            "entries_found": len(data.get("result", [])),
                            "severity": "HIGH",
                        })
        except Exception as e:
            print(f"[-] Breach directory check failed: {e}")
        return breaches

    def generate_report(self) -> dict:
        """Generate comprehensive dark web monitoring report."""
        critical = [f for f in self.findings if f.get("severity") == "CRITICAL"]
        high = [f for f in self.findings if f.get("severity") == "HIGH"]
        medium = [f for f in self.findings if f.get("severity") == "MEDIUM"]

        report = {
            "report_metadata": {
                "organization": self.organization,
                "domains_monitored": self.domains,
                "report_date": datetime.utcnow().isoformat(),
                "classification": "TLP:AMBER",
            },
            "executive_summary": (
                f"Dark web monitoring for {self.organization} identified "
                f"{len(critical)} critical, {len(high)} high, and "
                f"{len(medium)} medium severity findings."
            ),
            "findings_by_severity": {
                "critical": critical,
                "high": high,
                "medium": medium,
            },
            "all_findings": self.findings,
            "recommendations": [],
        }

        if critical:
            report["recommendations"].append(
                "IMMEDIATE: Activate incident response for ransomware leak detection. "
                "Assess data exposure scope and notify affected parties."
            )
        if high:
            report["recommendations"].append(
                "URGENT: Force password resets for all accounts in detected breaches. "
                "Enable MFA across all services."
            )
        report["recommendations"].append(
            "ONGOING: Continue dark web monitoring with weekly reporting cadence."
        )

        return report

    def full_scan(self) -> dict:
        """Run all dark web monitoring checks."""
        print(f"[*] Starting dark web monitoring for: {self.organization}")
        print(f"[*] Domains: {', '.join(self.domains)}")

        print("\n[*] Checking credential leaks...")
        self.check_credential_leaks()

        print("\n[*] Checking ransomware leak sites...")
        self.check_ransomware_leaks()

        print(f"\n[+] Total findings: {len(self.findings)}")
        return self.generate_report()


def main():
    parser = argparse.ArgumentParser(description="Dark Web Monitoring Tool")
    parser.add_argument("--org", required=True, help="Organization name")
    parser.add_argument("--domains", help="Comma-separated domains to monitor")
    parser.add_argument("--hibp-key", default="", help="HIBP API key")
    parser.add_argument("--check-credentials", action="store_true")
    parser.add_argument("--check-ransomware", action="store_true")
    parser.add_argument("--full-scan", action="store_true")
    parser.add_argument("--output", default="darkweb_report.json", help="Output file")

    args = parser.parse_args()
    domains = args.domains.split(",") if args.domains else []
    monitor = DarkWebMonitor(args.org, domains, args.hibp_key)

    if args.full_scan:
        report = monitor.full_scan()
    elif args.check_credentials:
        monitor.check_credential_leaks()
        report = monitor.generate_report()
    elif args.check_ransomware:
        monitor.check_ransomware_leaks()
        report = monitor.generate_report()
    else:
        report = monitor.full_scan()

    with open(args.output, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"\n[+] Report saved to {args.output}")
    print(json.dumps(report["executive_summary"], indent=2))


if __name__ == "__main__":
    main()