#-------------------------------------------------------------------------------
# Name:         sfp_openbugbounty
# Purpose:      Query the Open Bug Bounty database to see if our target appears.
#
# Author:      Steve Micallef <steve@binarypool.com>
#
# Created:     04/10/2015
# Copyright:   (c) Steve Micallef
# Licence:     GPL
#-------------------------------------------------------------------------------

import re

from sflib import SpiderFoot, SpiderFootPlugin, SpiderFootEvent

class sfp_openbugbounty(SpiderFootPlugin):
    """Open Bug Bounty:Footprint,Investigate,Passive:Leaks, Dumps and Breaches::Check external vulnerability scanning/reporting service openbugbounty.org to see if the target is listed."""

    meta = {
		'name': "Open Bug Bounty",
		'summary': "Check external vulnerability scanning/reporting service openbugbounty.org to see if the target is listed.",
		'flags': [ "" ],
		'useCases': [ "Footprint", "Investigate", "Passive" ],
		'categories': [ "Leaks, Dumps and Breaches" ]
	}

    # Default options
    opts = {
    }

    # Option descriptions
    optdescs = {
    }

    # Be sure to completely clear any class variables in setup()
    # or you run the risk of data persisting between scan runs.

    results = None

    def setup(self, sfc, userOpts=dict()):
        self.sf = sfc
        self.results = self.tempStorage()

        # Clear / reset any other class member variables here
        # or you risk them persisting between threads.

        for opt in list(userOpts.keys()):
            self.opts[opt] = userOpts[opt]

    # What events is this module interested in for input
    def watchedEvents(self):
        return ["INTERNET_NAME"]

    # What events this module produces
    def producedEvents(self):
        ret = ["VULNERABILITY"]

        return ret

    # Query XSSposed.org
    def queryOBB(self, qry):
        ret = list()
        base = "https://www.openbugbounty.org"
        url = "https://www.openbugbounty.org/search/?search=" + qry
        res = self.sf.fetchUrl(url, timeout=30, useragent=self.opts['_useragent'])

        if res['content'] is None:
            self.sf.debug("No content returned from openbugbounty.org")
            return None

        try:
            rx = re.compile(".*<div class=.cell1.><a href=.(.*).>(.*" + qry + ").*?</a></div>.*", re.IGNORECASE)
            for m in rx.findall(res['content']):
                # Report it
                if m[1] == qry or m[1].endswith("."+qry):
                    ret.append("From openbugbounty.org: <SFURL>" + base + m[0] + "</SFURL>")
        except Exception as e:
            self.sf.error("Error processing response from openbugbounty.org: " + str(e), False)
            return None
        return ret

    # Handle events sent to this module
    def handleEvent(self, event):
        eventName = event.eventType
        srcModuleName = event.module
        eventData = event.data
        data = list()

        self.sf.debug("Received event, %s, from %s" % (eventName, srcModuleName))

        # Don't look up stuff twice
        if eventData in self.results:
            self.sf.debug("Skipping " + eventData + " as already mapped.")
            return None
        else:
            self.results[eventData] = True

        obb = self.queryOBB(eventData)
        if obb:
            data.extend(obb)

        for n in data:
            # Notify other modules of what you've found
            e = SpiderFootEvent("VULNERABILITY", n, self.__name__, event)
            self.notifyListeners(e)

# End of sfp_openbugbounty class

@@ -729,18 +729,24 @@
 eta = %7B%0A
-%09%09
+        
 'name': 
@@ -764,18 +764,24 @@
 ounty%22,%0A
-%09%09
+        
 'summary
@@ -892,18 +892,24 @@
 sted.%22,%0A
-%09%09
+        
 'flags':
@@ -917,18 +917,24 @@
 %5B %22%22 %5D,%0A
-%09%09
+        
 'useCase
@@ -984,10 +984,16 @@
  %5D,%0A
-%09%09
+        
 'cat
@@ -1037,10 +1037,1271 @@
 s%22 %5D
-%0A%09
+,%0A        'dataSource': %7B%0A            'website': %22https://www.openbugbounty.org/%22,%0A            'model': %22FREE_NOAUTH_UNLIMITED%22,%0A            'references': %5B%0A                %22https://www.openbugbounty.org/cert/%22%0A            %5D,%0A            'favIcon': %22https://www.openbugbounty.org/favicon.ico%22,%0A            'logo': %22https://www.openbugbounty.org/images/design/logo-obbnew.svg%22,%0A            'description': %22Open Bug Bounty is an open, disintermediated, cost-free, and community-driven bug bounty platform %22%0A                                %22for coordinated, responsible and ISO 29147 compatible vulnerability disclosure.%5Cn%22%0A                                %22The role of Open Bug Bounty is limited to independent verification of the %22%0A                                %22submitted vulnerabilities and proper notification of website owners by all available means. %22%0A                                %22Once notified, the website owner and the researcher are in direct contact to %22%0A                                %22remediate the vulnerability and coordinate its disclosure. %22%0A                                %22At this and at any later stages, we never act as an intermediary between %22%0A                                %22website owners and security researchers.%5Cn%22,%0A        %7D%0A    
 %7D%0A%0A 

Update openbugbounty meta