metasploit-framework/modules/auxiliary/scanner/http/httpbl_lookup.rb

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require "net/dns/resolver"

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(update_info(info,
      'Name'		   => 'Http:BL Lookup',
      'Description'	=> %q{
          This module can be used to enumerate information
        about an IP addresses from Project HoneyPot's HTTP Block List.
      },
      'Author' 		=> [ 'mubix' ],
      'License'		=> MSF_LICENSE,
      'References' 	=>
        [
          ['URL', 'http://www.projecthoneypot.org/httpbl_api.php'],
        ]
      ))


    register_options(
      [
        # OptAddressRange.new('RHOSTS', [false, "The target address, range, or CIDR identifier"]),
        OptString.new('HTTPBL_APIKEY', [ true, "Your HTTP:BL api key"])
      ], self.class)
  end

  # Not compatible today
  def support_ipv6?
    false
  end

  def resolve(ip)
    results = ''
    apikey = datastore['HTTPBL_APIKEY']
    query = apikey + '.' + ip.split('.').reverse.join('.') + '.dnsbl.httpbl.org'
    begin
      results = Resolv::DNS.new.getaddress(query).to_s
    rescue Resolv::ResolvError => e
      results = 0
    rescue => e
      print_error e
      results = 0
    end
    return results
  end

  def translate(ip)
    ip.split('.')
  end

  def run_host(ip)
    result = resolve(ip)
    if result != 0
      breakup = result.split('.')
      lastseen = breakup[1]
      threatnum = breakup[2].to_i
      if threatnum < 25 then
        threat = "less than 100"
      elsif threatnum > 25 and threatnum < 49 then
        threat = "over 100"
      elsif threatnum > 50 and threatnum < 99 then
        threat = "over 10,000"
      elsif threatnum > 75 then
        threat = "over 1 million"
      end

      typenum = breakup[3]
      typestring = case typenum
        when '0' then 'Search Engine'
        when '1' then 'Suspicious'
        when '2' then 'Harvester'
        when '3' then 'Suspicious & Harvester'
        when '4' then 'Comment Spammer'
        when '5' then 'Suspicious & Comment Spammer'
        when '6' then 'Harvester & Comment Spammer'
        when '7' then 'Suspicious & Harvester & Comment Spammer'
        else
          "Unknown"
      end

      print_status ""
      print_status "#{ip} resloves to #{result} which means: #{typestring}"
      print_status "=> it was last seen #{lastseen} day ago and has a threat score of #{threatnum} or \'#{threat} spam messages\'"
      print_status "=> more info here: http://www.projecthoneypot.org/ip_#{ip}\n"
    end
  end
end