Mihari - A Helper To Run OSINT Queries & Manage Results Continuously

# For Debian / Ubuntu apt-get install sqlite3 libsqlite3-dev libpq-dev

docker pull ninoseki/mihari

$ mihari Commands: mihari alerts # Show the alerts on TheHive mihari binaryedge [QUERY] # BinaryEdge host search by a query mihari censys [QUERY] # Censys IPv4 search by a query mihari circl [DOMAIN|SHA1] # CIRCL passive DNS/SSL lookup by a domain or SHA1 certificate fingerprint mihari crtsh [QUERY] # crt.sh search by a query mihari dnpedia [QUERY] # DNPedia domain search by a query mihari dnstwister [DOMAIN] # dnstwister lookup by a domain mihari free_text [TEXT] # Cross search with search engines by a free text mihari help [COMMAND] # Describe available commands or one specific command mihari http_hash # Cross search with search engines by a hash of an HTTP response (SHA256, MD5 and MurmurH ash3) mihari import_from_json # Give a JSON input via STDIN mihari onyphe [QUERY] # Onyphe datascan search by a query mihari otx [IP|DOMAIN] # OTX lookup by an IP or domain mihari passive_dns [IP|DOMAIN] # Cross search with passive DNS services by an ip or domain mihari passive_ssl [SHA1] # Cross search with passive SSL services by an SHA1 certificate fingerprint mihari passivetotal [IP|DOMAIN|EMAIL|SHA1] # PassiveTotal lookup by an ip, domain, email or SHA1 certificate fingerprint mihari pulsedive [IP|DOMAIN] # Pulsedive lookup by an ip or domain mihari reverse_whois [EMAIL] # Cross search with reverse whois services by an email mihari securitytrails [IP|DOMAIN|EMAIL] # SecurityTrails lookup by an ip, domain or email mihari securitytrails_domain_feed [REGEXP] # SecurityTrails new domain feed search by a regexp mihari shodan [QUERY] # Shodan host search by a query mihari ssh_fingerprint [FINGERPRINT] # Cross search with search engines by an SSH fingerprint (e.g. dc:14:de:8e:d7:c1:15:43:23:82:25:81:d2:59:e8:c0) mihari status # Show the current configuration status mihari urlscan [QUERY] # urlscan search by a given query mihari virustotal [IP|DOMAIN] # VirusTotal resolutions lookup by an ip or domain mihari zoomeye [QUERY] # ZoomEye search by a query Options: [--config=CONFIG] # path to config file

$ mihari help http_hash Usage: mihari http_hash Options: [--title=TITLE] # title [--description=DESCRIPTION] # description [--tags=one two three] # tags [--md5=MD5] # MD5 hash [--sha256=SHA256] # SHA256 hash [--mmh3=N] # MurmurHash3 hash Cross search with search engines by a hash of an HTTP response (SHA256, MD5 and MurmurHash3)

mihari http_hash --md5=881191f7736b5b8cfad5959ca99d2a51 --sha256=b064187ebdc51721708ad98cd89dacc346017cb0fb0457d530032d387f1ff20e --mmh3=-1467534799

wget http://example.com -O /tmp/index.html mihari http_hash --html /tmp/index.html

# Censys lookup for PANDA C2 mihari censys '("PANDA" AND "SMAdmin" AND "layui")' --title "PANDA C2" # VirusTotal passive DNS lookup of a FAKESPY host mihari virustotal "jppost-hi.top" --title "FAKESPY passive DNS" # You can pass a "defanged" indicator as an input mihari virustotal "jppost-hi[.]top" --title "FAKESPY passive DNS"

echo '{ "title": "test", "description": "test", "artifacts": ["1.1.1.1", "github.com", "2.2.2.2"] }' | mihari import_from_json

{ "title": "test", "description": "test", "artifacts": ["1.1.1.1", "github.com"], "tags": ["test"] }

mihari virustotal 1.1.1.1 --config /path/to/yaml.yml

database: /tmp/mihari.db thehive_api_endpoint: https://localhost thehive_api_key: foo virustotal_api_key: foo

require "mihari" module Mihari module Analyzers class Example < Base def title "example" end def description "example" end def artifacts ["9.9.9.9", "example.com"] end def tags ["example"] end end end end example = Mihari::Analyzers::Example.new example.run

$ docker run --rm ninoseki/mihari # Note that you should pass configurations via environment variables $ docker run --rm ninoseki/mihari -e THEHIVE_API_ENDPOINT="http://THEHIVE_URL" -e THEHIVE_API_KEY="API KEY" mihari # or $ docker run --rm ninoseki/mihari --env-file ~/.mihari.env mihari