From 20390d30dbfe80fb68cfe70c8d369b40f9d31ec8 Mon Sep 17 00:00:00 2001 From: Stone_Red <56473591+Stone-Red-Code@users.noreply.github.com> Date: Sat, 8 Jan 2022 16:13:52 +0100 Subject: [PATCH] - Accept proxycheck api key as parameter - Add Pc Name to tag --- FraudCapturer/DomainHelper.cs | 2 +- FraudCapturer/IpHelper.cs | 4 ++- FraudCapturer/Program.cs | 37 +++++++++++++------- FraudCapturer/Properties/launchSettings.json | 8 +++++ 4 files changed, 36 insertions(+), 15 deletions(-) create mode 100644 FraudCapturer/Properties/launchSettings.json diff --git a/FraudCapturer/DomainHelper.cs b/FraudCapturer/DomainHelper.cs index 2ee4fca..26e8ec7 100644 --- a/FraudCapturer/DomainHelper.cs +++ b/FraudCapturer/DomainHelper.cs @@ -33,7 +33,7 @@ internal class DomainHelper }; HttpClient httpClient = new HttpClient(); - httpClient.DefaultRequestHeaders.Add("User-Agent", $"{Program.AppName} - https://github.com/Stone-Red-Code/FraudCapturer"); + httpClient.DefaultRequestHeaders.Add("User-Agent", $"({Program.AppName}/{Environment.MachineName}) - ({Program.AppUrl})"); AntiFishReqestBody reqestBody = new AntiFishReqestBody() { diff --git a/FraudCapturer/IpHelper.cs b/FraudCapturer/IpHelper.cs index c974b6f..5a9b04c 100644 --- a/FraudCapturer/IpHelper.cs +++ b/FraudCapturer/IpHelper.cs @@ -5,11 +5,13 @@ namespace FraudCapturer; internal class IpHelper { + public static string? ProxycheckApiKey { get; set; } + public static IpInfo? GetIpReputation(IPAddress ipAddress) { HttpClient httpClient = new HttpClient(); - string rawResponseData = httpClient.GetStringAsync($"http://proxycheck.io/v2/{ipAddress}?key=65019k-719i38-2k0r91-36q7o7&risk=2&vpn=1&asn=1&tag={Program.AppName}").GetAwaiter().GetResult(); + string rawResponseData = httpClient.GetStringAsync($"http://proxycheck.io/v2/{ipAddress}?key={ProxycheckApiKey}&risk=2&vpn=1&asn=1&tag={Program.AppName}({Environment.MachineName})").GetAwaiter().GetResult(); JsonDocument responseData = JsonDocument.Parse(rawResponseData); diff --git a/FraudCapturer/Program.cs b/FraudCapturer/Program.cs index 2fb7942..4f471cb 100644 --- a/FraudCapturer/Program.cs +++ b/FraudCapturer/Program.cs @@ -13,6 +13,7 @@ namespace FraudCapturer; public class Program { public const string AppName = "FraudCapturer"; + public const string AppUrl = "https://github.com/Stone-Red-Code/FraudCapturer"; public const string IpStorePath = "ipAdresses.txt"; private static DateTime lastCacheClear; @@ -24,16 +25,28 @@ public class Program /// /// The main entry point for the application. /// - private static void Main() + private static void Main(string[] args) { Console.OutputEncoding = System.Text.Encoding.UTF8; // Print SharpPcap version - Console.WriteLine(AppName); + Console.WriteLine($"{AppName} - {AppUrl}"); Console.WriteLine(); // Retrieve the device list CaptureDeviceList devices = CaptureDeviceList.Instance; + if (string.IsNullOrWhiteSpace(args.FirstOrDefault())) + { + Console.ForegroundColor = ConsoleColor.Red; + Console.WriteLine("No proxycheck api key provided! You are limited to 100 IP checks per day. Get one for free at proxycheck.io."); + Console.WriteLine(); + Console.ResetColor(); + } + else + { + IpHelper.ProxycheckApiKey = args.FirstOrDefault(); + } + // If no devices were found print an error if (devices.Count < 1) { @@ -45,12 +58,12 @@ public class Program Console.WriteLine("----------------------------------------------------"); Console.WriteLine(); + //Print all available devices int i = 0; - // Print out the available devices foreach (ILiveDevice dev in devices) { - Console.WriteLine("{0}) {1}", i, dev.Description); + Console.WriteLine($"{i}) {dev.Description}"); i++; } @@ -72,9 +85,8 @@ public class Program device = devices[choice]; - //Register our handler function to the 'packet arrival' event - device.OnPacketArrival += - new PacketArrivalEventHandler(Device_OnPacketArrival); + //Register handler function to the 'packet arrival' event + device.OnPacketArrival += new PacketArrivalEventHandler(Device_OnPacketArrival); // Open the device for capturing device.Open(); @@ -82,13 +94,8 @@ public class Program Console.WriteLine(); Console.WriteLine("-- Listening on {0}, hit 'Ctrl-C' to exit...", device.Description); - // Start capture 'INFINTE' number of packets + // Start capture of packets device.Capture(); - - // Close the pcap device - // (Note: this line will never be called since - // we're capturing infinite number of packets - device.Close(); } private static void Device_OnPacketArrival(object sender, PacketCapture e) @@ -103,6 +110,7 @@ public class Program IPAddress remoteIpAddress; string direction; + //Check if the package is destined for the PC and determine if it goes in or out. if (IpHelper.IsLocalIpAddress(ip.SourceAddress.ToString())) { remoteIpAddress = ip.DestinationAddress; @@ -118,6 +126,7 @@ public class Program return; } + //Clear cache every 10 minutes. if (DateTime.Now - lastCacheClear >= new TimeSpan(0, 10, 0)) { lastCacheClear = DateTime.Now; @@ -127,6 +136,7 @@ public class Program Console.WriteLine("Cleared cache"); } + //Check if a DNS packet contains a "dangerous" domain. CheckDns(packet, remoteIpAddress, direction); if (capturedIpsCache.Contains(remoteIpAddress.ToString())) @@ -139,6 +149,7 @@ public class Program capturedIpsCache.Add(remoteIpAddress.ToString()); + //Check if ip address is "dangerous" or blocked CheckIpAddress(remoteIpAddress, direction); } } diff --git a/FraudCapturer/Properties/launchSettings.json b/FraudCapturer/Properties/launchSettings.json new file mode 100644 index 0000000..d38217a --- /dev/null +++ b/FraudCapturer/Properties/launchSettings.json @@ -0,0 +1,8 @@ +{ + "profiles": { + "FraudCapturer": { + "commandName": "Project", + "commandLineArgs": "65019k-719i38-2k0r91-36q7o7" + } + } +} \ No newline at end of file