Skip to content

Commit 8bad5f2

Browse files
rmurray-r7rmurray-r7
authored
Dig - (SDK Automation prep) (#3271) (#3280)
* Dig - (SDK Automation prep) * Fixing rogue space
1 parent 210c9ea commit 8bad5f2

File tree

6 files changed

+81
-108
lines changed

6 files changed

+81
-108
lines changed

‎plugins/dig/.CHECKSUM

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
2-
"spec": "8ff0f3308351b1a44cf24084dbf42ce8",
3-
"manifest": "2e3c5a1e4029c779bf99991d18b47a67",
4-
"setup": "b5a0e6ff2254c0ce4138185e153bfe5c",
2+
"spec": "27c69da329e52ad56295c324244dd5bc",
3+
"manifest": "12033dcedfa9de909a9d0a864d163d46",
4+
"setup": "bce73ad5aedfe707b30a60de01a4f385",
55
"schemas": [
66
{
77
"identifier": "forward/schema.py",

‎plugins/dig/Dockerfile

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-plugin:6.2.2
1+
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-plugin:6.2.5
22

33
LABEL organization=rapid7
44
LABEL sdk=python
55

6-
RUN apk update && apk add --no-cache bind-tools
6+
RUN apk update && apk add --no-cache --virtual bind-tools
77

88
WORKDIR /python/src
99

@@ -14,7 +14,7 @@ RUN if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
1414

1515
ADD . /python/src
1616

17-
RUN python setup.py build && python setup.py install
17+
RUN pip install .
1818

1919
# User to run plugin code. The two supported users are: root, nobody
2020
USER nobody

‎plugins/dig/bin/komand_dig

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ from sys import argv
66

77
Name = "DNS"
88
Vendor = "rapid7"
9-
Version = "2.0.4"
9+
Version = "2.0.5"
1010
Description = "The DNS plugin is used for forward and reverse DNS lookups. This plugin uses [Dig](https://linux.die.net/man/1/dig), or Domain Information Groper, which is a network administration command-line tool for querying Domain Name System (DNS) name servers"
1111

1212

‎plugins/dig/help.md

+5-32
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ Example input:
6060
|question|string|False|Question asked|google.com|
6161
|status|string|False|Query status [ NOERROR | FORMERR | NXDOMAIN | SERVFAIL | REFUSED ...]|NOERROR|
6262

63-
On success, the raw output will look like the following:
63+
Example output:
6464

6565
```
6666
{
@@ -76,20 +76,6 @@ On success, the raw output will look like the following:
7676
}
7777
```
7878

79-
On failure, the raw output will look like the following:
80-
81-
```
82-
83-
{
84-
"status": "NOERROR",
85-
"answer": "google-public-dns-a.google.com",
86-
"nameserver": "10.0.2.3",
87-
"question": "8.8.8.8.8",
88-
"fulloutput": "\n; <<>> Dig 9.9.5-9+deb8u9-Debian <<>> -x 8.8.8.8.8\n;; global options: +cmd\n;; Got answer:\n;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20097\n;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0\n\n;; QUESTION SECTION:\n;8.8.8.8.8.in-addr.arpa.\t\tIN\tPTR\n\n;; ANSWER SECTION:\n8.8.8.8.8.in-addr.arpa.\t62286\tIN\tPTR\tgoogle-public-dns-a.google.com.\n\n;; Query time: 2 msec\n;; SERVER: 10.0.2.3#53(10.0.2.3)\n;; WHEN: Fri Jan 27 01:21:10 UTC 2017\n;; MSG SIZE rcvd: 84\n\n"
89-
},
90-
91-
```
92-
9379
#### Reverse Lookup
9480

9581
This action is used to request a reverse lookup for an IP address
@@ -120,7 +106,7 @@ Example input:
120106
|question|string|False|Question asked|8.8.8.8|
121107
|status|string|False|Query status [ NOERROR | FORMERR | NXDOMAIN | SERVFAIL | REFUSED ...]|NOERROR|
122108

123-
On success, the raw output will look like the following:
109+
Example output:
124110

125111
```
126112
{
@@ -131,19 +117,6 @@ On success, the raw output will look like the following:
131117
"status": "NOERROR"
132118
}
133119
```
134-
135-
On failure, the raw output will look like the following:
136-
137-
```
138-
{
139-
"status": "NOERROR",
140-
"answer": "dns.google",
141-
"fulloutput": "\n; <<>> DiG 9.14.8 <<>> -x 8.8.8.8\n;; global optio...",
142-
"nameserver": "192.168.65.1",
143-
"question": "8.8.8.8"
144-
}
145-
```
146-
147120
### Triggers
148121

149122
*This plugin does not contain any triggers.*
@@ -157,7 +130,7 @@ On failure, the raw output will look like the following:
157130

158131
## Troubleshooting
159132

160-
The `status` variable contains the [DNS status code](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml) name from the DNS server's response.
133+
* The `status` variable contains the [DNS status code](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml) name from the DNS server's response.
161134
Dig has at least the following status codes implemented:
162135

163136
```
@@ -167,7 +140,7 @@ SERVFAIL
167140
NXDOMAIN
168141
NOTIMP
169142
REFUSED
170-
YXDOMAIN
143+
YXDOMAIN
171144
YXRRSET
172145
NXRRSET
173146
NOTAUTH
@@ -183,9 +156,9 @@ Common examples:
183156
* `status = "NOERRROR"` - The DNS response contains an answer
184157
* `status = "NXDOMAIN"` - The DNS response did not have an answer i.e. Non-Existent Domain
185158

186-
187159
# Version History
188160

161+
* 2.0.5 - Updated SDK to the latest version (6.2.5)
189162
* 2.0.4 - Updated SDK to the latest version (v6.2.2) | Address vulnerabilities
190163
* 2.0.3 - Initial updates for fedramp compliance | Updated SDK to the latest
191164
* 2.0.2 - Updated SDK to the latest version | Added validation for input parameters

‎plugins/dig/plugin.spec.yaml

+68-68
Original file line numberDiff line numberDiff line change
@@ -3,85 +3,77 @@ extension: plugin
33
products: [insightconnect]
44
name: dig
55
title: DNS
6-
description: The DNS plugin is used for forward and reverse DNS lookups. This plugin uses [Dig](https://linux.die.net/man/1/dig), or Domain Information Groper, which is a network administration command-line tool for querying Domain Name System (DNS) name servers
7-
version: 2.0.4
6+
description: The DNS plugin is used for forward and reverse DNS lookups. This plugin
7+
uses [Dig](https://linux.die.net/man/1/dig), or Domain Information Groper, which
8+
is a network administration command-line tool for querying Domain Name System (DNS)
9+
name servers
10+
version: 2.0.5
811
connection_version: 2
912
vendor: rapid7
1013
support: community
11-
supported_versions: ["2024-09-10"]
14+
supported_versions: ['2024-09-10']
1215
status: []
1316
sdk:
1417
type: full
15-
version: 6.2.2
18+
version: 6.2.5
1619
user: nobody
1720
packages:
18-
- bind-tools
21+
- bind-tools
1922
cloud_ready: true
2023
fedramp_ready: true
2124
resources:
2225
source_url: https://github.com/rapid7/insightconnect-plugins/tree/master/plugins/dig
2326
license_url: https://github.com/rapid7/insightconnect-plugins/blob/master/LICENSE
2427
tags:
25-
- dig
26-
- dns
28+
- dig
29+
- dns
2730
hub_tags:
2831
use_cases: [threat_detection_and_response, offensive_security]
2932
keywords: [dig, dns, cloud_enabled]
3033
features: []
31-
troubleshooting: |
32-
The `status` variable contains the [DNS status code](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml) name from the DNS server's response.
33-
Dig has at least the following status codes implemented:
34-
35-
```
36-
NOERROR
37-
FORMERR
38-
SERVFAIL
39-
NXDOMAIN
40-
NOTIMP
41-
REFUSED
42-
YXDOMAIN
43-
YXRRSET
44-
NXRRSET
45-
NOTAUTH
46-
NOTZONE
47-
BADVERS
48-
```
49-
50-
You can test the `status` variable in a Decision or Filter step to check for its value.
51-
For example, in your workflow, if the resolution doesn't return an answer, then you may want to attempt a second lookup from a passive DNS service.
52-
53-
Common examples:
54-
55-
* `status = "NOERRROR"` - The DNS response contains an answer
56-
* `status = "NXDOMAIN"` - The DNS response did not have an answer i.e. Non-Existent Domain
34+
troubleshooting:
35+
- "The `status` variable contains the [DNS status code](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml)
36+
name from the DNS server's response.\nDig has at least the following status codes
37+
implemented:\n\n```\nNOERROR\nFORMERR\nSERVFAIL\nNXDOMAIN\nNOTIMP\nREFUSED\nYXDOMAIN
38+
\nYXRRSET\nNXRRSET\nNOTAUTH\nNOTZONE\nBADVERS\n```\n\nYou can test the `status` variable
39+
in a Decision or Filter step to check for its value.\nFor example, in your workflow,
40+
if the resolution doesn't return an answer, then you may want to attempt a second
41+
lookup from a passive DNS service.\n\nCommon examples:\n\n* `status = \"NOERRROR\"\
42+
` - The DNS response contains an answer\n* `status = \"NXDOMAIN\"` - The DNS response
43+
did not have an answer i.e. Non-Existent Domain"
5744
key_features:
58-
- "Forward DNS lookup to find an IP address from a domain name"
59-
- "Reverse DNS lookup to find a domain name from an IP address"
45+
- Forward DNS lookup to find an IP address from a domain name
46+
- Reverse DNS lookup to find a domain name from an IP address
6047
links:
61-
- "[Dig](https://linux.die.net/man/1/dig)"
48+
- '[Dig](https://linux.die.net/man/1/dig)'
6249
references:
63-
- "[Dig](https://linux.die.net/man/1/dig)"
64-
- "[DNS Status Code](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml)"
50+
- '[Dig](https://linux.die.net/man/1/dig)'
51+
- '[DNS Status Code](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml)'
6552
version_history:
66-
- "2.0.4 - Updated SDK to the latest version (v6.2.2) | Address vulnerabilities"
67-
- "2.0.3 - Initial updates for fedramp compliance | Updated SDK to the latest"
68-
- "2.0.2 - Updated SDK to the latest version | Added validation for input parameters"
69-
- "2.0.1 - Added `__init__.py` file to `unit_test` folder | Refreshed with new Tooling"
70-
- "2.0.0 - Rename Dig plugin to DNS"
71-
- "1.0.7 - Fix bug in `safe_parse` function | Fix bug when `answers` in function `execute_command` is str"
72-
- "1.0.6 - Upgrade to latest Python plugin runtime | Define `cloud_ready` in spec"
73-
- "1.0.5 - Update to v4 Python plugin runtime"
74-
- "1.0.4 - Add example inputs"
75-
- '1.0.3 - Use input and output constants | Change docker image from `komand/python-2-slim-plugin:2` to `komand/python-3-37-slim-plugin:3` to reduce plugin image size | Added "f" strings | Remove duplicate code | Add user nobody to Dockerfile'
76-
- "1.0.2 - New spec and help.md format for the Extension Library"
77-
- "1.0.1 - Update to use the `komand/python-2-slim-plugin:2` Docker image to reduce plugin size"
78-
- "1.0.0 - Support web server mode"
79-
- "0.3.2 - Update to v2 Python plugin architecture"
80-
- "0.3.1 - SSL bug fix in SDK"
81-
- "0.3.0 - Add all_answers and last_answer to the forward lookup action"
82-
- "0.2.0 - Add option to use custom resolver"
83-
- "0.1.1 - Increased result validation"
84-
- "0.1.0 - Initial plugin"
53+
- 2.0.5 - Updated SDK to the latest version (6.2.5)
54+
- 2.0.4 - Updated SDK to the latest version (v6.2.2) | Address vulnerabilities
55+
- 2.0.3 - Initial updates for fedramp compliance | Updated SDK to the latest
56+
- 2.0.2 - Updated SDK to the latest version | Added validation for input parameters
57+
- 2.0.1 - Added `__init__.py` file to `unit_test` folder | Refreshed with new Tooling
58+
- 2.0.0 - Rename Dig plugin to DNS
59+
- 1.0.7 - Fix bug in `safe_parse` function | Fix bug when `answers` in function `execute_command`
60+
is str
61+
- 1.0.6 - Upgrade to latest Python plugin runtime | Define `cloud_ready` in spec
62+
- 1.0.5 - Update to v4 Python plugin runtime
63+
- 1.0.4 - Add example inputs
64+
- 1.0.3 - Use input and output constants | Change docker image from `komand/python-2-slim-plugin:2`
65+
to `komand/python-3-37-slim-plugin:3` to reduce plugin image size | Added "f" strings
66+
| Remove duplicate code | Add user nobody to Dockerfile
67+
- 1.0.2 - New spec and help.md format for the Extension Library
68+
- 1.0.1 - Update to use the `komand/python-2-slim-plugin:2` Docker image to reduce
69+
plugin size
70+
- 1.0.0 - Support web server mode
71+
- 0.3.2 - Update to v2 Python plugin architecture
72+
- 0.3.1 - SSL bug fix in SDK
73+
- 0.3.0 - Add all_answers and last_answer to the forward lookup action
74+
- 0.2.0 - Add option to use custom resolver
75+
- 0.1.1 - Increased result validation
76+
- 0.1.0 - Initial plugin
8577
actions:
8678
forward:
8779
title: Forward Lookup
@@ -104,14 +96,14 @@ actions:
10496
description: Query type e.g. ANY, A, MX, NS, etc
10597
type: string
10698
enum:
107-
- A
108-
- AAAA
109-
- ANY
110-
- CNAME
111-
- MX
112-
- NS
113-
- PTR
114-
- SOA
99+
- A
100+
- AAAA
101+
- ANY
102+
- CNAME
103+
- MX
104+
- NS
105+
- PTR
106+
- SOA
115107
required: true
116108
example: MX
117109
output:
@@ -123,7 +115,8 @@ actions:
123115
example: \n; <<>> DiG 9.12.4-P2 <<>> google.com A\n;; global ...
124116
status:
125117
title: Query Status
126-
description: "Query status [ NOERROR | FORMERR | NXDOMAIN | SERVFAIL | REFUSED ...]"
118+
description: Query status [ NOERROR | FORMERR | NXDOMAIN | SERVFAIL | REFUSED
119+
...]
127120
type: string
128121
required: false
129122
example: NOERROR
@@ -179,10 +172,17 @@ actions:
179172
description: Full DNS output
180173
type: string
181174
required: false
182-
example: '\n; <<>> Dig 9.9.5-9+deb8u9-Debian <<>> -x 8.8.8.8\n;; global options: +cmd\n;; Got answer:\n;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59406\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version: 0, flags:; udp: 512\n;; QUESTION SECTION:\n;8.8.8.8.in-addr.arpa.\t\tIN\tPTR\n\n;; ANSWER SECTION:\n8.8.8.8.in-addr.arpa.\t68133\tIN\tPTR\tgoogle-public-dns-a.google.com.\n\n;; Query time: 22 msec\n;; SERVER: 10.0.2.3#53(10.0.2.3)\n;; WHEN: Thu Jan 26 23:43:43 UTC 2017\n;; MSG SIZE rcvd: 93\n\n'
175+
example: '\n; <<>> Dig 9.9.5-9+deb8u9-Debian <<>> -x 8.8.8.8\n;; global options:
176+
+cmd\n;; Got answer:\n;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
177+
59406\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL:
178+
1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version: 0, flags:; udp: 512\n;; QUESTION
179+
SECTION:\n;8.8.8.8.in-addr.arpa.\t\tIN\tPTR\n\n;; ANSWER SECTION:\n8.8.8.8.in-addr.arpa.\t68133\tIN\tPTR\tgoogle-public-dns-a.google.com.\n\n;;
180+
Query time: 22 msec\n;; SERVER: 10.0.2.3#53(10.0.2.3)\n;; WHEN: Thu Jan
181+
26 23:43:43 UTC 2017\n;; MSG SIZE rcvd: 93\n\n'
183182
status:
184183
title: Query Status
185-
description: Query status [ NOERROR | FORMERR | NXDOMAIN | SERVFAIL | REFUSED ...]
184+
description: Query status [ NOERROR | FORMERR | NXDOMAIN | SERVFAIL | REFUSED
185+
...]
186186
type: string
187187
required: false
188188
example: NOERROR

‎plugins/dig/setup.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44

55
setup(name="dig-rapid7-plugin",
6-
version="2.0.4",
6+
version="2.0.5",
77
description="The DNS plugin is used for forward and reverse DNS lookups. This plugin uses [Dig](https://linux.die.net/man/1/dig), or Domain Information Groper, which is a network administration command-line tool for querying Domain Name System (DNS) name servers",
88
author="rapid7",
99
author_email="",

0 commit comments

Comments
 (0)