Cloaken

Unshorten URLs onsite using the power of a Tor proxy server to prevent leaking IP addresses to adversaries.

Data Enrichment & Threat Intelligence · Cloaken

Details

ID	`Cloaken`
Provider	Cloaken
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/vendors-sdk:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Use the Cloaken integration to unshorten URLs in AWS behind TOR.

Use Cases

Unshorten a URL to run the expanded URL through intelligence sources.

Configure Cloaken on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Cloaken.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- credentials : credentials for integration
- Server URL : server url for cloaken instance
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Unshorten a URL: cloaken-unshorten-url

1. Unshorten a URL

Unshortens a URL.

Base Command

cloaken-unshorten-url

Input

Argument Name	Description	Required
url	URL to unshorten.	Required

Context Output

Path	Type	Description
Cloaken.UnshortenedURL	string	The unshortened URL.
Cloaken.OriginalURL	string	The original URL.
Cloaken.Status	integer	Status of the response: BADREQUEST or OK.
URL.Data	string	The unshortened URL.

Command Example

cloaken-unshorten-url url=https://someurl.com

Context Example

{
URL:{Data:"http://badperson.com"},
Cloaken:{
    original_url:"https://tinyurl.com/x223z3223",
    unshortened_url:"http://badperson.com",
   response_status:201
}

Human Readable Output

Cloakened URL:

original_url	unshortened_url
https://tiny.url.com/x223z3223	http://badperson.com

cloaken-screenshot-url

Creates a screenshot of the specified URL.

Base Command

cloaken-screenshot-url

Input

Argument Name	Description	Required
url	The URL for which to take a screenshot.	Required

Context Output

Path	Type	Description
CloakenScreenshot.Url	string	Url
CloakenScreenshot.Status	string	Status of the screenshot.

Configuration parameters

server_url — Server URL (e.g., https://cloaken.cypherint.com) (required)
credentials — Username (required)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (2)

cloaken-screenshot-url
Creates a screenshot of the specified URL.
cloaken-unshorten-url
Unshortens a URL.

Source

Cloaken.py Cloaken.yml Cloaken_description.md

Download History Raw

import demistomock as demisto
import urllib3
from cloakensdk import utility
from cloakensdk.client import SyncClient
from cloakensdk.resources import Url
from CommonServerPython import *

# Disable insecure warnings
urllib3.disable_warnings()


PROXY = handle_proxy("proxy", False)


def get_client():
    server = demisto.params()["server_url"]
    verify = not demisto.params().get("insecure", False)
    password = demisto.params()["credentials"]["password"]
    username = demisto.params()["credentials"]["identifier"]
    client = SyncClient(server_url=server, username=username, verify=verify, password=password)
    return client


if demisto.command() == "test-module":
    # This is the call made when pressing the integration test button.
    client = get_client()
    demisto.results("ok")

if demisto.command() == "cloaken-unshorten-url":
    client = get_client()
    url = demisto.args()["url"]
    resource = Url(client)
    resource.unshorten(url)
    response = resource.full_request()

    response_code = response.get("response_code", "NA")
    response_status = response.get("status", "FAILED")
    if response_status == "Success":
        # successfully unshortened the url
        url_data = response.get("data", {}).get("unshortened_url")
        cloaken_context = {
            "OriginalURL": url,
            "UnshortenedURL": url_data,
            "Status": response_code,
        }
        ec = {outputPaths["url"]: {"Data": url_data}, "Cloaken": cloaken_context}
        return_outputs(tableToMarkdown("Cloakened URL", cloaken_context), ec, cloaken_context)
    elif response_code == 400:
        # url was malformed
        return_warning("Not able to resolve or malformed URL ")
    else:
        # server error or unavailable
        return_error("Error Cloaken Unshorten: " + str(response.get("data", "key missing")))

if demisto.command() == "cloaken-screenshot-url":
    client = get_client()
    url = demisto.args()["url"]
    screenshot = utility.RasterizeAndRetrieveImage(client, url=url)
    context = {"Url": url, "Status": "failed"}
    try:
        result = screenshot.get_screenshot()
        if result.get("data", "") != "":
            stored_img = fileResult(result.get("filename", "screenshot.png"), result.get("data", ""), "image")
            demisto.results(
                {
                    "Type": entryTypes["image"],
                    "ContentsFormat": formats["text"],
                    "File": stored_img["File"],
                    "FileID": stored_img["FileID"],
                    "Contents": "",
                }
            )
            context["Status"] = "Success"
            return_outputs(tableToMarkdown("Screenshot Succeeded", context), {"CloakenScreenshot": context}, context)
        else:
            return_warning("No Screenshot data available")

    except utility.RasterizeTimeout as e:
        return_warning("Screenshot Timed Out: " + str(e))
    except utility.RasterizeException as e:
        return_warning("Screenshot Failed: " + str(e))