theresafewconors/sooty

The SOC Analysts all-in-one CLI tool to automate and speed up workflow.

Overview

Sooty is a tool developed with the task of aiding SOC analysts with automating part of their workflow. One of the goals of Sooty is to perform as many of the routine checks as possible, allowing the analyst more time to spend on deeper analysis within the same time-frame. Details for many of Sooty's features can be found below.

Sooty is now proudly supported by Tines.com! The SOAR Platform for Enterprise Security Teams.

Contents

• Current Features
• Requirements & Installation
• Development
• Changelog
• Roadmap
• Contributors

Sooty can Currently:

• Sanitise URL's to be safe to send in emails
• Perform reverse DNS and DNS lookups
• Perform reputation checks from:
  • VirusTotal
  • BadIP's
  • Abuse IPDB
• Identify if an address is potentially malicious, used for spam, web bots:
  • Botvrij.eu
  • myip.ms
  • Firehol
• Check if an IP address is a TOR exit node
• Decode Proofpoint URL's, UTF-8 encoded URLS, Office SafeLink URL's, Base64 Strings and Cisco7 Passwords.
• Get file hashes and compare them against VirusTotal (see requirements)
• Perform WhoIs Lookups
• Check Usernames and Emails against HaveIBeenPwned to see if a breach has occurred. (see requirements)
• Simple analysis of emails to retrieve URL's, emails and header information.
• Extract IP addresses from emails.
• Unshorten URL's that have been shortened by external services. (Limited to 10 requests per hour)
• Query URLScan.io for reputation reports.
• Analyze email addresses for known malicious activity and report on domain reputation utilising EmailRep.io
• Create dynamic email templates that can be used as a base for phishing triage response.(.msg only, .eml coming in future update)
• Perform analysis enrichment on phishing mails using the HaveIBeenPwned database, and can identify if an email address has been compromised in the past, when it happened and where the breach occurred. (Requires API Key).
• Submit URL's to PhishTank. (see requirements)
• Unfurl URL's via the CLI version of Unfurl.
• See below for a full list and layout of currently available tools:

└── Main Menu
   ├── Sanitize URL's for use in emails
   |  └── URL Sanitizing Tool
   ├── Decoders
   |   ├── ProofPoint Decoder
   |   ├── URL Decoder
   |   ├── Office Safelinks Decoder
   |   ├── URL Unshortener
   |   ├── Base 64 Decoder
   |   ├── Cisco Password 7 Decoder
   |   └── Unfurl URL
   ├── Reputation Checker
   |   └── Reputation Checker for IP's, URL's or email addresses
   ├── DNS Tools
   |   ├── Reverse DNS Lookup
   |   ├── DNS Lookup
   |   └── WhoIs Lookup
   ├── Hashing Functions
   |   ├── Hash a File
   |   ├── Hash a Text Input
   |   ├── Check a hash for known malicious activity
   |   └── Hash a file and check for known malicious activity
   ├── Phishing Analysis
   |   ├── Analyze an Email
   |   ├── Analyze an email address for known malicious activity
   |   ├── Generate an email template based on analysis
   |   ├── Analyze a URL with Phishtank
   |   └── HaveIBeenPwned Lookup
   ├── URL Scan
   |   └── URLScan.io lookup
   ├── Extra's
   |   ├── About
   |   ├── Contributors
   |   ├── Version
   |   ├── Wiki
   |   └── Github Repo
   └── Exit

Requirements and Installation

• Python 3.x
• Install all dependencies from the requirements.txt file. pip install -r requirements.txt
• Launch the tool by navigating to the main directory, and executing with python Sooty.py, or simply Sooty.py
• Several API Keys are required to have full functionality with Sooty. However, it will still function without these keys, just without the added functionality they provide. Links are found below:
  • VirusTotal API Key
  • URLScan.io API Key
  • AbuseIPDB API Key
  • HaveIBeenPwned API Key
  • PhishTank API Key
  • EMAILREP API KEY
• Replace the corresponding key in the example_config.yaml file, and rename the file to config.yaml, example layout below:
• For PhishTank support, an unique app name is also required as an additional field. Simply update the config.yaml file with your unique name.

Launch with Docker

• docker build -t sooty . && docker run --rm -it sooty

Development

Want to contribute? Great!

Code Contributions

• If you wish to work on a feature, leave a comment on the issue page and I will assign you to it.
• Under the projects tab is a list of features that are waiting to be started / completed.
• All code modifications, enhancements or additions must be done through a pull request.
• Once reviewed and merged, contributors will be added to the ReadMe.

Found a Bug? Show Me!

Bugs and Issues

• If an issue / bug is found, please open a ticket in the issue tracker and use the bug report template. Fill in this template and include any additional relevant information.
• If you wish to work on a known bug, leave a comment on the issue page and open a Pull Request to track progress. I will assign you to it.
• If there is an issue with installation or usage, use the supplied template and I will respond ASAP.

Requesting Features

• New features / requests should start by opening an issue. Please use the accompanying template when creating a new issue. This helps track new features and prevent crossover. Attach any additional info that seems relevant if necessary. Before creating a new issue, please check the Projects Tab to see if this issue has already been requested, or directly with the other open issues.

Changelog

Version 1.3 - The Templating Update

• Added first iteration of dynamic email templates that generate based on Sooty's analysis, example below:
• Docker Image added
• Unfurl added

Version 1.2 - The Phishing Update

• Added first iteration of the Phishing tool.
• Able to analyze an email (outlook / .msg only tested at the moment) and retrieve emails, urls (Proofpoint decode if necessary) and extract info from headers.
• Extract IP's from body of email.
• Reputation check on sender of email, and provide enriched information.

Version 1.1 - The Reputation Update

• Improved Rep Checker
• Added HaveIBeenPwned Functionality
• Added DNS Tools and WhoIs Functionality
• Added Hash and VirusTotal Checkers
• Added Abuse IPDB, Tor Exit Node, BadIP's to Reputation Checker

Version 1.0

• Initial Release
• URL and Proofpoint Decoder
• Initial implementation of Reputation Checker
• Sanitize links to be safe for email

Roadmap

This is an outline of what features will be coming in future versions.

Version 1.2 - The Phishing Update

• Scan email attachments for malicious content, macros, files, scan hashes, etc.

Version 1.3 - The Templating Update

• Add dynamic email templates that generate based on Sooty's analysis. Edit: Added
• Verify MX Records
• Perform DKIM Verification

Version 1.4 - The PCAP Analysis Update

• Add ability to analyze .pcap files and provide concise, enriched information.

Version 1.x - The Case Update

• Add a 'New Case' Feature, allowing output of the tool to be output to a txt file.

Contributors:

Code Contributions:

• Aaron J Copley for his modified version of ProofPoint's code to decode ProofPoint URL's
• James Duarte for adding a hash and auto-check option to the hashing function
• mrpnkt for adding the missing whois requirement to requirements.txt
• Gurulhu for adding the Base64 Decoder to the Decoders menu.
• AndThenEnteredAlex for adding the URLScan Function from URLScan.io
• Eric Kelson for fixing pywin32 requirement not necessary on Linux systems in requirements.txt.
• Jenetiks for removing and tidying up duplicate imports that had accumulated over time, and for providing a toggle between public and private scans on URLScan.io
• Nikosch86 for fixing an issue with hexdigest not correctly storing a file hash.
• Naveci for numerous bug fixes, QoL improvements, Cisco 7 Password Decoding, and introduced a workflow to helps with issues in future. Phishtank support has now also been added, and additional IP blacklists for the reputation checker.
• MrMeeseeks2014 fox fixing a bug relating to hash uploads.
• mrn42 for adding Docker Support.
• Ryan Benson for adding Unfurl support to the decoders section.
• Nitin Mukesh identified and fixed a bug with the BadIP's reputation lookup, and creating a stored txt output of Sooty's analysis.
• Sarthak for fixing an issue related to the emailrep API key.
• Lesander who fixed an issue with bash not recognizing Sooty as an executable file.

Documentation Contributors:

• Danielf-5 for improvements in the readability
• Paralax for fixing typo's in the readme.
• mrn42 for adding Docker documentation to the readme

sooty's Issues

Missing URL prompt in OPTION 2: Decoders (PP, URL) > OPTION 1: ProofPoint Decoder

OPTION 2: Decoders (PP, URL) > OPTION 1: ProofPoint Decoder

This option works (the URL is decoded correctly) but upon selecting 'OPTION 1' you're taken to the next line with no prompt for the URL.

Using 'OPTION 2: URL Decoder' presents you with 'url: ' which I think is the intended behavior.

Add OPSEC leak disclaimer when using active features

What is the feature that you are requesting?
Some features used in the tool can leak information to attackers and open source intelligence such as the scan to URLscan.
Therefore the tool should provide a one-shot disclaimer and a disclaimer likely in the README.

I would also suggest adding the passive alternative of scan -> search.

Additional information

Scanning on URLscan can lead to expose sensitive documents, sessions. It can also tip attacker that a specific campaign and even a specific email address is valid, information that they can use in a more advanced campaign.

haveibeenpwned functionality

Would using the HIBP API similarly to the VT API be a possible feature request?

More features:

These are some more things I'm currently working on
VirusTotal
-URL scan
-submit file hash
Alien Vault OTX - pull reputation data on:
-domain
-ip
Apility (they have a free API, it has a rate limit, but I haven't hit it ever.
-domain
-ip

The more sources, the better, since some miss things. If there are more sources, a sort of average "combined threat score" can be found. Let me know if you're interested in any of these.

A few more I might be wanting to work on in the future are:
urlhaus - to pull urls and hashes
threatminer

Love letter

Saw the Check if the IP is a Tor exit node looked at the code. You would be amazed at how many people don't know about that, good job! https://github.com/TheresAFewConors/Sooty/blob/master/Sooty.py#L204

Analyze an email

I believe this feature works, I am just not easily understanding how to present it the header? I select option 1 and I get this:
Error Opening File

Extracting Headers...
Header Error
Traceback (most recent call last):
File "Sooty.py", line 592, in analyzePhish
print(" FROM: ", str(msg.SenderName), ", ", str(msg.SenderEmailAddress))
UnboundLocalError: local variable 'msg' referenced before assignment

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "Sooty.py", line 996, in
mainMenu()
File "Sooty.py", line 165, in mainMenu
switchMenu(input())
File "Sooty.py", line 54, in switchMenu
phishingMenu()
File "Sooty.py", line 573, in phishingMenu
phishingSwitch(input())
File "Sooty.py", line 101, in phishingSwitch
analyzePhish()
File "Sooty.py", line 603, in analyzePhish
f.close()

I realize it is an error saying that it didn't receive any input but where do I put the header?

Thanks,

urlscan.io

Hello. I have python code for integration with urlscan.io (api key required). If this is a feature you'd like to add I can create a pull request.

Link Unshortener - https://unshorten.it/

Another good tool, may overlap with current options but worth mentioning since its had a few additions. The API is mentioned on the contact page.

Pywin32 dependency install fails

Pip install -r requirements.txt results in:

Collecting pywin32==224 (from -r requirements.txt (line 12))
ERROR: Could not find a version that satisfies the requirement pywin32==224 (from -r requirements.txt (line 12)) (from versions: none)

Same for pip3.

Tried this on both plain Ubuntu 18.04 LTS and Ubuntu 18.04 LTS in Windows subsystem for Linux: same error.

Issue installing requirements

Issue installing requirements

Collecting dfir-unfurl (from -r requirements.txt (line 6))
Could not find a version that satisfies the requirement dfir-unfurl (from -r requirements.txt (line 6)) (from versions: )
No matching distribution found for dfir-unfurl (from -r requirements.txt (line 6))

What Operating System are you using?
Kali / Debian

Requisites.txt not updated?

fixed, no probs. was something with the python version

HaveIBeenPwned API Now Authenticated and Priced

Sadly, instead of just tying the API requests to tokens issued on an account like everyone else is doing, Troy has added a monthly cost to it's use. (Which paired with the recent announcement to sell HIBP hints towards a total cash-in on his end)

I suppose the necessary change here would be adding the token field like you've done with the others.

No Module named 'strictyaml'

Describe the bug
Hi while I was trying to launch Sooty for the first time. I received a message error that no module named 'strictyaml'. This stopped launching Sooty
Reproduction Steps
Steps to reproduce the behavior:
1.navigate the the main branch on cli
2. launch Sooty by command python3 Sooty.py
3. error pop up and no further action
...

Expected behavior
Application to launch

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop Operating System:

• Kali Linux 2019.1

Additional context
Add any other context about the problem here.

Cannot get Sooty.py to launch

What is the Issue you are experiencing?
Give a description of what issue you are facing? eg. issue installing from requirements file, etc.

I have cloned the Sooty github page, installed the requirements, and I am running Python 3+. whenever I CD into the 'sooty' directory, I cannot get the application to launch.

What Operating System are you using?
The OS of the device that Sooty is running on.
I am using a Virtual environment with Debian. LinuxMint

Additional Information
Any additional information that may benefit this case.
Looks like other github actions are all performing normally, I just cannot get the application to launch.

Traceback

Describe the bug
Traceback

I've installed this tool many times and have only been able to get it working once and the last 4 times always fails. I work in a SOC and would love to be able to use this for my workflow.

Reproduction Steps
Steps to reproduce the behavior:

Traceback (most recent call last):
  File "Sooty.py", line 17, in <module>
    import strictyaml
ModuleNotFoundError: No module named 'strictyaml'

Desktop Operating System:

• OS: Ubuntu 18.04, Ubuntu 20.04, Windows Subsystem for Linux

Redoing the menus to clean up the code

What is the feature that you are requesting?
I'm thinking of redoing the menus to clean up the code. By putting the contents in dictionaries, we could generate the menus more consistently. It would allow us to take a lot of the printing code out. I haven't counted lines, but it might be quite a lot.
Another advantage: adding a new function only requires an edit in one part of the document - the dictionary.

What's your take?

Additional information
An example is listed below. I do need to really think about this carefully as it won't be entirely as easy as the example code below.

Is your feature request related to a problem? Please describe.
N/A

Additional context
Current code example for the phishing menu:

def phishingMenu():
    print("\n --------------------------------- ")
    print("          P H I S H I N G          ")
    print(" --------------------------------- ")
    print(" What would you like to do? ")
    print(" OPTION 1: Analyze an Email ")
    print(" OPTION 2: Analyze an Email Address for Known Activity")
    print(" OPTION 3: Generate an Email Template based on Analysis")
    print(" OPTION 4: Analyze an URL with Phishtank")
    print(" OPTION 9: HaveIBeenPwned")
    print(" OPTION 0: Exit to Main Menu")
    phishingSwitch(input())

def phishingSwitch(choice):
    if choice == '1':
        analyzePhish()
    if choice == '2':
        analyzeEmailInput()
    if choice == '3':
        emailTemplateGen()
    if choice == '4':
        phishtankModule()
    if choice == '9':
        haveIBeenPwned()
    else:
        mainMenu()

We could shorten this to the following dict:

phishingMenuDict = {
    # Number is the keyboard shortcut, name is the functionname, desc is what the users see as menu option
    0: {"name":"exit", "desc":"back to main menu"},
    1: {"name":"analyzePhish", "desc":"Analyze an Email"},
    2: {"name":"analyzeEmailInput", "desc":"Analyze an Email Address for Known Activity"},
    3: {"name":"emailTemplateGen", "desc":"Generate an Email Template based on Analysis"},
    4: {"name":"phishtankModule", "desc":"Analyze an URL with Phishtank"}
    9: {"name":"haveIBeenPwned", "desc":"HaveIBeenPwned"}
}

Then we need to write 1 function to generate a menu so that we could throw multiple of these dicts to that function. some semi code:

def menuGenerator(menuName):
    print(20 * "-")
    if menu = "main":
        print(mainMenuDict["title"])
    else:
        print(someOtherMenuDictName)
    print((20 * "-") + "\n")

    # That's the printing covered, below is the menu selection
    for menuItem in someOtherMenuDict:
        # Prints something like    Option 1: Analyze an Email
        print("  Option " + menuItem + ": " + someOtherMenuDictName["desc"])
    
    userChoice = input()
    # Check user input
    if userChoice in someOtherMenuDict:
        someOtherMenuDict(userChoice)
    else:
        print("Invalid option, please choose again")

Unable to use the tool when use ubuntu with proxy setting

What is the Issue you are experiencing?
Give a description of what issue you are facing? eg. issue installing from requirements file, etc.
Cannot use the sooty.py when i use the ubuntu PC with proxy setting

What Operating System are you using?
The OS of the device that Sooty is running on.
ubuntu 20

Additional Information
Any additional information that may benefit this case.

Program crash

Hey,

I was testing out Sooty today, but I ran into an issue just testing out something.
I did a reputation check for a website (first one that came to mind) and i got the following traceback info.

 WHO IS REPORT:
  CIDR:      13.32.0.0/12
  Name:      AT-88-Z
  Range:     13.32.0.0 - 13.47.255.255
  Descr:     Amazon Technologies Inc.
  Country:   US
  State:     WA
  City:      Seattle
  Address:   410 Terry Ave N.
  Post Code: 98109
  Created:   2016-08-09
  Updated:   2018-04-12

 VirusTotal Report:
 There's been an error - check your API key, or VirusTotal is possible down
Traceback (most recent call last):
  File "C:\code\Sooty\venv\lib\site-packages\urllib3\contrib\pyopenssl.py", line 456, in wrap_socket
    cnx.do_handshake()
  File "C:\code\Sooty\venv\lib\site-packages\OpenSSL\SSL.py", line 1915, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "C:\code\Sooty\venv\lib\site-packages\OpenSSL\SSL.py", line 1639, in _raise_ssl_error
    raise SysCallError(errno, errorcode.get(errno))
OpenSSL.SSL.SysCallError: (10054, 'WSAECONNRESET')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\code\Sooty\venv\lib\site-packages\urllib3\connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "C:\code\Sooty\venv\lib\site-packages\urllib3\connectionpool.py", line 343, in _make_request
    self._validate_conn(conn)
  File "C:\code\Sooty\venv\lib\site-packages\urllib3\connectionpool.py", line 839, in _validate_conn
    conn.connect()
  File "C:\code\Sooty\venv\lib\site-packages\urllib3\connection.py", line 344, in connect
    ssl_context=context)
  File "C:\code\Sooty\venv\lib\site-packages\urllib3\util\ssl_.py", line 347, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "C:\code\Sooty\venv\lib\site-packages\urllib3\contrib\pyopenssl.py", line 462, in wrap_socket
    raise ssl.SSLError('bad handshake: %r' % e)
ssl.SSLError: ("bad handshake: SysCallError(10054, 'WSAECONNRESET')",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\code\Sooty\venv\lib\site-packages\requests\adapters.py", line 449, in send
    timeout=timeout
  File "C:\code\Sooty\venv\lib\site-packages\urllib3\connectionpool.py", line 638, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "C:\code\Sooty\venv\lib\site-packages\urllib3\util\retry.py", line 399, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='check.torproject.org', port=443): Max retries exceeded with url: /cgi-bin/TorBulkExitList.py?ip=1.1.1.1 (Caused by SSLError(SSLError("bad handshake: SysCallError(10054, 'WSAECONNRESET')")))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\code\Sooty\Sooty.py", line 996, in <module>
    mainMenu()
  File "C:\code\Sooty\Sooty.py", line 165, in mainMenu
    switchMenu(input())
  File "C:\code\Sooty\Sooty.py", line 54, in switchMenu
    phishingMenu()
  File "C:\code\Sooty\Sooty.py", line 573, in phishingMenu
    phishingSwitch(input())
  File "C:\code\Sooty\Sooty.py", line 107, in phishingSwitch
    haveIBeenPwned()
  File "C:\code\Sooty\Sooty.py", line 679, in haveIBeenPwned
    phishingMenu()
  File "C:\code\Sooty\Sooty.py", line 573, in phishingMenu
    phishingSwitch(input())
  File "C:\code\Sooty\Sooty.py", line 109, in phishingSwitch
    mainMenu()
  File "C:\code\Sooty\Sooty.py", line 165, in mainMenu
    switchMenu(input())
  File "C:\code\Sooty\Sooty.py", line 48, in switchMenu
    repChecker()
  File "C:\code\Sooty\Sooty.py", line 355, in repChecker
    req = requests.get(TOR_URL)
  File "C:\code\Sooty\venv\lib\site-packages\requests\api.py", line 75, in get
    return request('get', url, params=params, **kwargs)
  File "C:\code\Sooty\venv\lib\site-packages\requests\api.py", line 60, in request
    return session.request(method=method, url=url, **kwargs)
  File "C:\code\Sooty\venv\lib\site-packages\requests\sessions.py", line 533, in request
    resp = self.send(prep, **send_kwargs)
  File "C:\code\Sooty\venv\lib\site-packages\requests\sessions.py", line 646, in send
    r = adapter.send(request, **kwargs)
  File "C:\code\Sooty\venv\lib\site-packages\requests\adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='check.torproject.org', port=443): Max retries exceeded with url: /cgi-bin/TorBulkExitList.py?ip=1.1.1.1 (Caused by SSLError(SSLError("bad handshake: SysCallError(10054, 'WSAECONNRESET')")))

I haven't had the time yet to find out why this is happening myself. There seems to be an SSL verification issue, but I don't know with which service.

Update to use Email Rep API Key

What is the feature that you are requesting?
Update email rep checker to utilize API key for extended requests

Additional information
No

Is your feature request related to a problem? Please describe.
Currently limited with very few requests that can be used, using an API key gives two options depending on the key:

• Free: 50 queries per day
• Enterprise: Unlimited

Still allows for Sooty to make requests without a key, just provides further functionality.

Debug errors in BadIP APi

What is the feature that you are requesting?
1.) The BadIP API returns "IP Not Found" even for some IPs present in the BadIP DB, i would work on the code to make it full-proof.

Additional information

• ...
• ...

Is your feature request related to a problem? Please describe.
BadIP is making decision based on just 1 category listed for the IOC.
Customize the code to consider all the categories marked and display result.

Additional context

StrictYaml Issue

This is not a bug, I think this is just me being a rusher, but I am trying to debug my own issue trying to install this,

I have run the requirments.txt against pip and install all the features, I am now in the process of running the sooty.py file

Traceback (most recent call last):
  File "Sooty.py", line 17, in <module>
    import strictyaml
ModuleNotFoundError: No module named 'strictyaml

But when checking

root@kali:/home/kali/Desktop# pip install strictyaml
Requirement already satisfied: strictyaml in /usr/local/lib/python2.7/dist-packages (1.0.6)
Requirement already satisfied: python-dateutil>=2.6.0 in /usr/local/lib/python2.7/dist-packages (from strictyaml) (2.8.1)
Requirement already satisfied: ruamel.yaml>=0.14.2 in /usr/local/lib/python2.7/dist-packages (from strictyaml) (0.16.7)
Requirement already satisfied: six>=1.5 in /usr/local/lib/python2.7/dist-packages (from python-dateutil>=2.6.0->strictyaml) (1.12.0)
Requirement already satisfied: ruamel.yaml.clib>=0.1.2; platform_python_implementation == "CPython" and python_version < "3.8" in /usr/local/lib/python2.7/dist-packages (from ruamel.yaml>=0.14.2->strictyaml) (0.2.0)
Requirement already satisfied: ruamel.ordereddict; platform_python_implementation == "CPython" and python_version <= "2.7" in /usr/local/lib/python2.7/dist-packages (from ruamel.yaml>=0.14.2->strictyaml) (0.4.14)

Looks like I already have it installed?

I wonder if you know how I could look at resolving this! in the mean time

Kind Regards,

Jay,

Base64 Decoder

Add support to Base64 extraction and decoding for URLs.
Already done on my fork, under the Decoders menu.
I just run a regex to detect possible b64 strings and then try to decode each match, printing on success.

Virustotal error

Pip install the requirement.txt in Kali linux.

---

R E P U T A T I O N C H E C K

Enter IP, URL or Email Address: 8.8.8.8

WHO IS REPORT:
CIDR: 8.0.0.0/9
Name: LVLT-ORG-8-8
Range: 8.0.0.0 - 8.127.255.255
Descr: Level 3 Parent, LLC
Country: US
State: LA
City: Monroe
Address: 100 CenturyLink Drive
Post Code: 71203
Created: 1992-12-01
Updated: 2018-04-23

VirusTotal Report:
Traceback (most recent call last):
File "Sooty.py", line 1218, in
mainMenu()
File "Sooty.py", line 180, in mainMenu
switchMenu(input())
File "Sooty.py", line 55, in switchMenu
repChecker()
File "Sooty.py", line 392, in repChecker
params = {'apikey': configvars.data['VT_API_KEY'], 'ip': wIP}
NameError: name 'configvars' is not defined

Any idea?

Output to Txt file

What is the feature that you are requesting?
The feature will automatically create a TxT file with the name of the URL, IP provided for reputation check and save the output of the reputation check feature to that file with proper formatting.

Additional information
If further / more specific details are required, feel free to list them here.

• ... This feature will allow users to maintain a report of all the IOCs been analyzed.
• ... Good for documentation for sending / sharing with team members.

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. If not related to an existing problem this can be left blank or removed.

Additional context
Add any other context, screenshots or information about the feature request here.

Email/Phishing Headers

Nice work on the enhancements, I'll keep adding until you tell me to stop haha

• A decoder along the lines of >> Paste internet headers from email >> tool outputs fields of interest (e.g Sender IP, Original true sender address, SPF etc.) in a pretty and liftable snippet

Analyze an Email - .eml support

What is the feature that you are requesting?
.eml support for the _ Analyze an Email_ feature. As .msg is Windows only.

Change URLScan.io default -- add option?

What is the feature that you are requesting?
Default URLScan type to private

Additional information
Instead of defaulting to public, what do you think of defaulting to private with an option to choose what you want, or just hit enter to leave default?

Is your feature request related to a problem? Please describe.
No problem, just thinking. Before I submit a PR with changes, I wanted to bounce the idea off of you first since it is your baby after all.

Additional context
None. Just a privacy goof.

Request for CLI flags as option instead of menu

Thanks for your work on Sooty so far, super helpful!

I'd like to be able to interact with Sooty via the CLI rather than the text menu.

ie: ./Sooty --sanitise "URL" or ./Sooty --AnalyzeEmail "email.msg"

It'd make it faster than using the TUI and scriptable.

Sooty.py hard crashes Python3 on macOS 10.15.7

What is the Issue you are experiencing?
All of the dependancies install without any issues. However when I run python3 Sooty.py Python crashes

What Operating System are you using?
macOS 10.15.7
Python 3.8.6

Additional Information
The issue appears to be in the libcrypto module

/usr/lib/libcrypto.dylib
abort() called
Invalid dylib load. Clients should not load the unversioned libcrypto dylib as it does not have a stable ABI.

Suggestions/Enhancements

Some suggestions:

More IP reputation sources, maybe operating individually but have 'scoring' option that weights them based on total results?

• https://docs.abuseipdb.com/#introduction
• https://www.apivoid.com/api/ip-reputation/

Bitcon address reputation checker:

• https://www.bitcoinabuse.com/api-docs

Some kind of phone number reputation checker:

• https://ekata.com/solutions/identity-check/

URL Scanner tool, for browsing to a suspect site:

• https://urlscan.io/about-api/

Office Safelinks Stripper, like:

• http://www.o365atp.com/

Host scanning with Nessus or Nmap, or both?

Email not opening if a space is in its name

Issue
Emails don't open on first attempt if a space is in the email name

Effect
Emails have to be opened a second time in order for Python to read them

Visual Studio 2015 dependency

Apologies if this is a daft question but to get the email analysis working I had to install VS 2015 Update 3 however I note that mainstream support has now ended. (https://support.microsoft.com/en-gb/lifecycle/search/1117)

Is there a more recent version this works with/is there a plan to move to something newer?

Request time

Hello, I tried to make a file that contains hash list. I make a some modification for list.txt input. I have a purpose for match hash list with vt hash signature to decide its malware or not line by line. But the problem is, that it takes a very long time for giving the result. I am new in programming, so i dont know whats wrong with that. Sorry I'm not fluent in English, i hope u understand what im saying. is there any solution?

Windows 10 2004 Cryptography fails to install

What is the Issue you are experiencing?
Give a description of what issue you are facing? eg. issue installing from requirements file, etc.
Cannot get past PEP 517 during cryptography install

What Operating System are you using?
The OS of the device that Sooty is running on.
--Windows 10 Pro 2004
--Python 3.8 via Windows Store (Tried 3.9 from Python website as well)

Additional Information
Any additional information that may benefit this case. (apologies for the bold section of the log; I'm done frustrating myself trying to figure out why it's doing that)
--Log entry:

Building wheels for collected packages: cffi, cryptography
Building wheel for cffi (setup.py) ... error
ERROR: Command errored out with exit status 1:
command: 'C:\Users\cpi\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.8_qbz5n2kfra8p0\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'C:\Users\cpi\AppData\Local\Temp\pip-install-48xku_ov\cffi\setup.py'"'"'; file='"'"'C:\Users\cpi\AppData\Local\Temp\pip-install-48xku_ov\cffi\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(file);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, file, '"'"'exec'"'"'))' bdist_wheel -d 'C:\Users\cpi\AppData\Local\Temp\pip-wheel-jvlszf95'
cwd: C:\Users\cpi\AppData\Local\Temp\pip-install-48xku_ov\cffi
Complete output (37 lines):
configtest.c
running bdist_wheel
running build
running build_py
creating build
creating build\lib.win-amd64-3.8
creating build\lib.win-amd64-3.8\cffi
copying cffi\api.py -> build\lib.win-amd64-3.8\cffi
copying cffi\backend_ctypes.py -> build\lib.win-amd64-3.8\cffi
copying cffi\cffi_opcode.py -> build\lib.win-amd64-3.8\cffi
copying cffi\commontypes.py -> build\lib.win-amd64-3.8\cffi
copying cffi\cparser.py -> build\lib.win-amd64-3.8\cffi
copying cffi\error.py -> build\lib.win-amd64-3.8\cffi
copying cffi\ffiplatform.py -> build\lib.win-amd64-3.8\cffi
copying cffi\lock.py -> build\lib.win-amd64-3.8\cffi
copying cffi\model.py -> build\lib.win-amd64-3.8\cffi
copying cffi\pkgconfig.py -> build\lib.win-amd64-3.8\cffi
copying cffi\recompiler.py -> build\lib.win-amd64-3.8\cffi
copying cffi\setuptools_ext.py -> build\lib.win-amd64-3.8\cffi
copying cffi\vengine_cpy.py -> build\lib.win-amd64-3.8\cffi
copying cffi\vengine_gen.py -> build\lib.win-amd64-3.8\cffi
copying cffi\verifier.py -> build\lib.win-amd64-3.8\cffi
copying cffi_init.py -> build\lib.win-amd64-3.8\cffi
copying cffi_cffi_include.h -> build\lib.win-amd64-3.8\cffi
copying cffi\parse_c_type.h -> build\lib.win-amd64-3.8\cffi
copying cffi_embedding.h -> build\lib.win-amd64-3.8\cffi
copying cffi_cffi_errors.h -> build\lib.win-amd64-3.8\cffi
running build_ext
building '_cffi_backend' extension
creating build\temp.win-amd64-3.8
creating build\temp.win-amd64-3.8\Release
creating build\temp.win-amd64-3.8\Release\c
creating build\temp.win-amd64-3.8\Release\c\libffi_msvc
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\BIN\x86_amd64\cl.exe /c /nologo /Ox /W3 /GL /DNDEBUG /MD -Ic/libffi_msvc "-IC:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1776.0_x64__qbz5n2kfra8p0\include" "-IC:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1776.0_x64__qbz5n2kfra8p0\include" "-IC:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\INCLUDE" "-IC:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\ATLMFC\INCLUDE" "-IC:\Program Files (x86)\Windows Kits\10\include\10.0.10240.0\ucrt" /Tcc/_cffi_backend.c /Fobuild\temp.win-amd64-3.8\Release\c/_cffi_backend.obj
_cffi_backend.c
c:\program files\windowsapps\pythonsoftwarefoundation.python.3.8_3.8.1776.0_x64__qbz5n2kfra8p0\include\pyconfig.h(206): fatal error C1083: Cannot open include file: 'basetsd.h': No such file or directory
error: command 'C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\BIN\x86_amd64\cl.exe' failed with exit status 2

---

ERROR: Failed building wheel for cffi
Running setup.py clean for cffi
Building wheel for cryptography (PEP 517) ... error
ERROR: Command errored out with exit status 1:
command: 'C:\Users\cpi\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.8_qbz5n2kfra8p0\python.exe' 'C:\Users\cpi\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.8_qbz5n2kfra8p0\LocalCache\local-packages\Python38\site-packages\pip_vendor\pep517_in_process.py' build_wheel 'C:\Users\cpi\AppData\Local\Temp\tmptrr7hwl8'
cwd: C:\Users\cpi\AppData\Local\Temp\pip-install-48xku_ov\cryptography
Complete output (136 lines):
running bdist_wheel
running build
running build_py
creating build
creating build\lib.win-amd64-3.8
creating build\lib.win-amd64-3.8\cryptography
copying src\cryptography\exceptions.py -> build\lib.win-amd64-3.8\cryptography
copying src\cryptography\fernet.py -> build\lib.win-amd64-3.8\cryptography
copying src\cryptography\utils.py -> build\lib.win-amd64-3.8\cryptography
copying src\cryptography_about_.py -> build\lib.win-amd64-3.8\cryptography
copying src\cryptography_init_.py -> build\lib.win-amd64-3.8\cryptography
creating build\lib.win-amd64-3.8\cryptography\hazmat
copying src\cryptography\hazmat_oid.py -> build\lib.win-amd64-3.8\cryptography\hazmat
copying src\cryptography\hazmat_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat
creating build\lib.win-amd64-3.8\cryptography\x509
copying src\cryptography\x509\base.py -> build\lib.win-amd64-3.8\cryptography\x509
copying src\cryptography\x509\certificate_transparency.py -> build\lib.win-amd64-3.8\cryptography\x509
copying src\cryptography\x509\extensions.py -> build\lib.win-amd64-3.8\cryptography\x509
copying src\cryptography\x509\general_name.py -> build\lib.win-amd64-3.8\cryptography\x509
copying src\cryptography\x509\name.py -> build\lib.win-amd64-3.8\cryptography\x509
copying src\cryptography\x509\ocsp.py -> build\lib.win-amd64-3.8\cryptography\x509
copying src\cryptography\x509\oid.py -> build\lib.win-amd64-3.8\cryptography\x509
copying src\cryptography\x509_init_.py -> build\lib.win-amd64-3.8\cryptography\x509
creating build\lib.win-amd64-3.8\cryptography\hazmat\backends
copying src\cryptography\hazmat\backends\interfaces.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends
copying src\cryptography\hazmat\backends_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends
creating build\lib.win-amd64-3.8\cryptography\hazmat\bindings
copying src\cryptography\hazmat\bindings_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\bindings
creating build\lib.win-amd64-3.8\cryptography\hazmat\primitives
copying src\cryptography\hazmat\primitives\cmac.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives
copying src\cryptography\hazmat\primitives\constant_time.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives
copying src\cryptography\hazmat\primitives\hashes.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives
copying src\cryptography\hazmat\primitives\hmac.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives
copying src\cryptography\hazmat\primitives\keywrap.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives
copying src\cryptography\hazmat\primitives\padding.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives
copying src\cryptography\hazmat\primitives\poly1305.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives
copying src\cryptography\hazmat\primitives_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives
creating build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\aead.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\backend.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\ciphers.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\cmac.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\decode_asn1.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\dh.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\dsa.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\ec.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\ed25519.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\ed448.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\encode_asn1.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\hashes.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\hmac.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\ocsp.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\poly1305.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\rsa.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\utils.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\x25519.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\x448.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl\x509.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
copying src\cryptography\hazmat\backends\openssl_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\backends\openssl
creating build\lib.win-amd64-3.8\cryptography\hazmat\bindings\openssl
copying src\cryptography\hazmat\bindings\openssl\binding.py -> build\lib.win-amd64-3.8\cryptography\hazmat\bindings\openssl
copying src\cryptography\hazmat\bindings\openssl_conditional.py -> build\lib.win-amd64-3.8\cryptography\hazmat\bindings\openssl
copying src\cryptography\hazmat\bindings\openssl_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\bindings\openssl
creating build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\dh.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\dsa.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\ec.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\ed25519.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\ed448.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\padding.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\rsa.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\utils.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\x25519.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric\x448.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
copying src\cryptography\hazmat\primitives\asymmetric_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\asymmetric
creating build\lib.win-amd64-3.8\cryptography\hazmat\primitives\ciphers
copying src\cryptography\hazmat\primitives\ciphers\aead.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\ciphers
copying src\cryptography\hazmat\primitives\ciphers\algorithms.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\ciphers
copying src\cryptography\hazmat\primitives\ciphers\base.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\ciphers
copying src\cryptography\hazmat\primitives\ciphers\modes.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\ciphers
copying src\cryptography\hazmat\primitives\ciphers_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\ciphers
creating build\lib.win-amd64-3.8\cryptography\hazmat\primitives\kdf
copying src\cryptography\hazmat\primitives\kdf\concatkdf.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\kdf
copying src\cryptography\hazmat\primitives\kdf\hkdf.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\kdf
copying src\cryptography\hazmat\primitives\kdf\kbkdf.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\kdf
copying src\cryptography\hazmat\primitives\kdf\pbkdf2.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\kdf
copying src\cryptography\hazmat\primitives\kdf\scrypt.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\kdf
copying src\cryptography\hazmat\primitives\kdf\x963kdf.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\kdf
copying src\cryptography\hazmat\primitives\kdf_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\kdf
creating build\lib.win-amd64-3.8\cryptography\hazmat\primitives\serialization
copying src\cryptography\hazmat\primitives\serialization\base.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\serialization
copying src\cryptography\hazmat\primitives\serialization\pkcs12.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\serialization
copying src\cryptography\hazmat\primitives\serialization\ssh.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\serialization
copying src\cryptography\hazmat\primitives\serialization_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\serialization
creating build\lib.win-amd64-3.8\cryptography\hazmat\primitives\twofactor
copying src\cryptography\hazmat\primitives\twofactor\hotp.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\twofactor
copying src\cryptography\hazmat\primitives\twofactor\totp.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\twofactor
copying src\cryptography\hazmat\primitives\twofactor\utils.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\twofactor
copying src\cryptography\hazmat\primitives\twofactor_init_.py -> build\lib.win-amd64-3.8\cryptography\hazmat\primitives\twofactor
running egg_info
writing src\cryptography.egg-info\PKG-INFO
writing dependency_links to src\cryptography.egg-info\dependency_links.txt
writing requirements to src\cryptography.egg-info\requires.txt
writing top-level names to src\cryptography.egg-info\top_level.txt
reading manifest file 'src\cryptography.egg-info\SOURCES.txt'
reading manifest template 'MANIFEST.in'
no previously-included directories found matching 'docs_build'
warning: no previously-included files found matching 'vectors'
warning: no previously-included files matching '' found under directory 'vectors'
warning: no previously-included files found matching 'azure-pipelines.yml'
warning: no previously-included files found matching '.azure-pipelines'
warning: no previously-included files found matching '.travis.yml'
warning: no previously-included files found matching '.travis'
warning: no previously-included files matching '' found under directory '.azure-pipelines'
warning: no previously-included files matching '*' found under directory '.travis'
warning: no previously-included files found matching 'release.py'
warning: no previously-included files found matching '.coveragerc'
warning: no previously-included files found matching 'codecov.yml'
warning: no previously-included files found matching 'dev-requirements.txt'
warning: no previously-included files found matching 'rtd-requirements.txt'
warning: no previously-included files found matching 'tox.ini'
writing manifest file 'src\cryptography.egg-info\SOURCES.txt'
running build_ext
generating cffi module 'build\temp.win-amd64-3.8\Release\_padding.c'
creating build\temp.win-amd64-3.8
creating build\temp.win-amd64-3.8\Release
generating cffi module 'build\temp.win-amd64-3.8\Release\_constant_time.c'
generating cffi module 'build\temp.win-amd64-3.8\Release\_openssl.c'
building '_openssl' extension
creating build\temp.win-amd64-3.8\Release\build
creating build\temp.win-amd64-3.8\Release\build\temp.win-amd64-3.8
creating build\temp.win-amd64-3.8\Release\build\temp.win-amd64-3.8\Release
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\BIN\x86_amd64\cl.exe /c /nologo /Ox /W3 /GL /DNDEBUG /MD "-IC:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1776.0_x64__qbz5n2kfra8p0\include" "-IC:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1776.0_x64__qbz5n2kfra8p0\include" "-IC:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\INCLUDE" "-IC:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\ATLMFC\INCLUDE" "-IC:\Program Files (x86)\Windows Kits\10\include\10.0.10240.0\ucrt" /Tcbuild\temp.win-amd64-3.8\Release_openssl.c /Fobuild\temp.win-amd64-3.8\Release\build\temp.win-amd64-3.8\Release_openssl.obj
_openssl.c
C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1776.0_x64__qbz5n2kfra8p0\include\pyconfig.h(206): fatal error C1083: Cannot open include file: 'basetsd.h': No such file or directory
error: command 'C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\BIN\x86_amd64\cl.exe' failed with exit status 2

ERROR: Failed building wheel for cryptography
Failed to build cffi cryptography
ERROR: Could not build wheels for cryptography which use PEP 517 and cannot be installed directly

Requirements.txt install fails on non-windows platforms

requirements.txt file specifies pywin32 as a requirement, however this only applies if you are using windows. It will fail if you are not. Changing to pywin32==224; sys_platform == ‘windows’ will fix issue.

unable to run sooty.py

When try to run Sooty.py in Kali after installing all requirement.txt using pip command with Python3 available.

Getting error when I ran python Sooty.py
Traceback (most recent call last):
File "Sooty.py", line 13, in
import urllib.parse
ImportError: No module named parse

No module named 'tkinter'

Describe the bug
No module named 'tkinter' when running for first time

Traceback (most recent call last):
File "Sooty.py", line 21, in
import tkinter
ModuleNotFoundError: No module named 'tkinter'

Reproduction Steps
Steps to reproduce the behavior:

1. git clones repo into dir
2. went to dir
3. pip3 install -r requirements
   ...

Expected behavior
A clear and concise description of what was expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop Operating System:

• OS: Ubuntu 19.04

Additional context
Python 3.7.5

IOC extractor from PDF / webpage

What is the feature that you are requesting?
It would be useful to have an ioc extractor from PDF or webpages, to CSV

Additional information
Maybe this module would be useful: https://github.com/armbues/ioc_parser

Additional context
For instance, a new report from AV vendors came out. I could use Sooty to extract IOCs and input it in our tools.

ModuleNotFoundError when trying to run

/Sooty-master/Sooty.py", line 10, in
from unfurl import core ModuleNotFoundError: No module named 'unfurl'
MacOS Catalina

Add Phish Tank Capability

#7 https://www.phishtank.com/api_info.php - Verify if a URL has been used in a phishing attack

Reputation Checker can't handle domains

Using Office365.com as an example, the WhoIs and VT check work fine, but the next two don't:

 Checking BadIP's... 
  Error reaching BadIPs

 ABUSEIPDB Report:
   Error Reaching ABUSE IPDB

Whereas when using the IP that was resolved through the WhoIS check (52.165.129.203):

 Checking BadIP's... 
  IP not found

 ABUSEIPDB Report:
   IP:          52.165.129.203
   Reports:     0
   Abuse Score: 0%
   Last Report: None

Can the script not be tweaked to just use the IP resolved through the WhoIS check to perform those final two checks?

Non-ASCII character

When trying to launch Sooty, getting the below error.

python Sooty.py
File "Sooty.py", line 822
SyntaxError: Non-ASCII character '\xe2' in file Sooty.py on line 822, but no encoding declared; see http://python.org/dev/peps/pep-0263/ for details

No module name "strictyaml"

Can not execute Sooty after install

S.O. Ubuntu Server 18.04.4
Python3
installed all the requirements --> OK
modify API Keys in config.yaml

but when i try to run "python3 Sooty.py" i get this error message:

"Traceback (most recent call last):
File "Sooty.py", line 17, in
import strictyaml
ModuleNotFoundError: No module named 'strictyaml'"

Emails not being released by Python

Issue
Issue caused by Python not releasing the email files.

Effect
Emails cannot be opened twice during the same instance.

WhoIs lookup endless loop

Describe the bug
When using the Option 4: DNS lookup and select option 3: WHOIS Lookup, when entering any of the requested i.e. IP / Domain the result goes into endless loop, it does not exit after giving the output. See attached

Reproduction Steps
Steps to reproduce the behavior:

1. Select Option 4: DNS Lookup
2. Select option 3: WhoIs lookup
3. Enter any value and check
   ...

Expected behavior
It should have thrown the output and given another prompt to select options, rather it goes into endless loop.

Screenshots
attached screenshot

Desktop Operating System:

• OS: [e.g. Win10, Linux, etc.]

Additional context
Add any other context about the problem here.

Contributor

I appreciate the call out as a contributor for the Proofpoint script, but I can't take credit for it. I wanted to be sure that you saw my reply on Gist (https://gist.github.com/aaronjcopley/65a5198bf7b35361fdd315e786be9b9d#gistcomment-2936712) because I also noted there is a newer version published there.

Thanks!

Unable to install on Ubuntu 18.04

Hi,

While installing we are getting below error

python3 Sooty.py
Traceback (most recent call last):
File "Sooty.py", line 11, in
import html.parser
ModuleNotFoundError: No module named 'html.parser'

SyntaxError: invalid syntax

The following Error:

ubuntu@ubuntu-VirtualBox:~/Desktop$ python Sooty.py
File "Sooty.py", line 7
[<]!DOCTYPE html[>]
^
SyntaxError: invalid syntax

hashRating defaulting to "Hash was not found in Malware Database"

Describe the bug
When utilizing the function hashRating(), as soon it hits:
if value['detected'] == True:
it moves to the except statement.

Reproduction Steps
Steps to reproduce the behavior:

1. removed function to isolate the code
2. add print statements before and after if and for lines
3. used known bad hash: e428cee7a89bf236f43c1ef30de2e58d96ce7763b658cb1dfae3cfc246933713
4. adding print(result) after:
   result = response.json()
   shows the full results, but the counting for total hits is off and not needed due to totals listed in the response.

Expected behavior
A clear and concise description of what was expected to happen.
Expect to get a total number of hits from VirusTotal or a not found.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop Operating System:

• OS: Win10

Additional context
Working on on modifying the function and will post when done.

Tracking Case for PR35

Tracking case for PR35

• Introduces Github workflow with linting_check.yaml
• Bugfix for problems with certain packeges.