src/Netcraft.php
public function parse()
    {
        foreach ($this->parsedMail->getAttachments() as $attachment) {
            if (preg_match(config("{$this->configBase}.parser.report_file"), $attachment->filename)) {
                if (preg_match_all(
                    '/([\w\-]+): (.*)[ ]*\r?\n/',
                    str_replace("\r", "", $attachment->getContent()),
                    $matches
                )) {
                    $report = array_combine($matches[1], $matches[2]);

                    // We need this field to detect the feed, so we need to check it first
                    if (!empty($report['Report-Type'])) {
                        // Handle aliasses first
                        foreach (config("{$this->configBase}.parser.aliases") as $alias => $real) {
                            if ($report['Report-Type'] == $alias) {
                                $report['Report-Type'] = $real;
                            }
                        }

                        $this->feedName = $report['Report-Type'];

                        // If feed is known and enabled, validate data and save report
                        if ($this->isKnownFeed() && $this->isEnabledFeed()) {
                            switch ($report['Source-Type']) {
                                case 'uri':
                                    // Match case 1:
                                    // A single line with 'http* [x.x.x.x]' (note the space)
                                    preg_match(
                                        '/\[([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\]/',
                                        $this->parsedMail->getMessageBody(),
                                        $matches
                                    );
                                    if (count($matches) == 2 && empty($report['Ip'])) {
                                        $report['Ip'] = $matches[1];
                                    }

                                    // Match case 2:
                                    // Somewhere a line will end (watch out for mime split!) 'address x.x.x.x.'
                                    preg_match(
                                        '/address ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\./',
                                        $this->parsedMail->getMessageBody(),
                                        $matches
                                    );
                                    if (count($matches) == 2 && empty($report['Ip'])) {
                                        $report['Ip'] = $matches[1];
                                    }

                                    // Match case 3:
                                    // IPv6 report
                                    if (preg_match(
                                        '/(?>(?>([a-f0-9]{1,4})(?>:(?1)){7}|'.
                                        '(?!(?:.*[a-f0-9](?>:|$)){8,})((?1)(?>:(?1)){0,6})?::(?2)?)|(?>('.
                                        '?>(?1)(?>:(?1)){5}:|(?!(?:.*[a-f0-9]:){6,})(?3)?::(?>((?1)(?>:('.
                                        '?1)){0,4}):)?)?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\.(?4)){3}))/',
                                        $this->parsedMail->getMessageBody(),
                                        $matches
                                    )) {
                                        $report['Ip'] = $matches[0];
                                    }
                                    break;
                                case 'ipv4':
                                case 'ipv6':
                                case 'ip-address':
                                default:
                                    $report['Ip'] = $report['Source'];
                                    break;
                            }

                            // Sanity check
                            if ($this->hasRequiredFields($report) === true) {
                                // incident has all requirements met, filter and add!
                                $report = $this->applyFilters($report);

                                // Manually update some fields for easier handling
                                if ($report['Report-Type'] == 'phishing') {
                                    $url = $report['Source'];
                                }

                                if ($report['Report-Type'] == 'malware-attack') {
                                    // Download-Link to Domain / Uri
                                    $url = $report['Download-Link'];
                                }

                                $incident = new Incident();
                                $incident->source      = config("{$this->configBase}.parser.name");
                                $incident->source_id   = false;
                                $incident->ip          = $report['Ip'];
                                $incident->domain      = empty($url) ? false : getDomain($url);
                                $incident->class       = config("{$this->configBase}.feeds.{$this->feedName}.class");
                                $incident->type        = config("{$this->configBase}.feeds.{$this->feedName}.type");
                                $incident->timestamp   = strtotime($report['Date']);
                                $incident->information = json_encode($report);

                                $this->incidents[] = $incident;

                            }
                        }
                    }
                }
            }
        }

        return $this->success();
    }
public function parse()
    {
        foreach ($this->parsedMail->getAttachments() as $attachment) {
            if (preg_match(config("{$this->configBase}.parser.report_file"), $attachment->filename)) {
                if (preg_match_all(
                    '/([\w\-]+): (.*)[ ]*\r?\n/',
                    str_replace("\r", "", $attachment->getContent()),
                    $matches
                )) {
                    $report = array_combine($matches[1], $matches[2]);

                    // We need this field to detect the feed, so we need to check it first
                    if (!empty($report['Report-Type'])) {
                        // Handle aliasses first
                        foreach (config("{$this->configBase}.parser.aliases") as $alias => $real) {
                            if ($report['Report-Type'] == $alias) {
                                $report['Report-Type'] = $real;
                            }
                        }

                        $this->feedName = $report['Report-Type'];

                        // If feed is known and enabled, validate data and save report
                        if ($this->isKnownFeed() && $this->isEnabledFeed()) {
                            switch ($report['Source-Type']) {
                                case 'uri':
                                    // Match case 1:
                                    // A single line with 'http* [x.x.x.x]' (note the space)
                                    preg_match(
                                        '/\[([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\]/',
                                        $this->parsedMail->getMessageBody(),
                                        $matches
                                    );
                                    if (count($matches) == 2 && empty($report['Ip'])) {
                                        $report['Ip'] = $matches[1];
                                    }

                                    // Match case 2:
                                    // Somewhere a line will end (watch out for mime split!) 'address x.x.x.x.'
                                    preg_match(
                                        '/address ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\./',
                                        $this->parsedMail->getMessageBody(),
                                        $matches
                                    );
                                    if (count($matches) == 2 && empty($report['Ip'])) {
                                        $report['Ip'] = $matches[1];
                                    }

                                    // Match case 3:
                                    // IPv6 report
                                    if (preg_match(
                                        '/(?>(?>([a-f0-9]{1,4})(?>:(?1)){7}|'.
                                        '(?!(?:.*[a-f0-9](?>:|$)){8,})((?1)(?>:(?1)){0,6})?::(?2)?)|(?>('.
                                        '?>(?1)(?>:(?1)){5}:|(?!(?:.*[a-f0-9]:){6,})(?3)?::(?>((?1)(?>:('.
                                        '?1)){0,4}):)?)?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\.(?4)){3}))/',
                                        $this->parsedMail->getMessageBody(),
                                        $matches
                                    )) {
                                        $report['Ip'] = $matches[0];
                                    }
                                    break;
                                case 'ipv4':
                                case 'ipv6':
                                case 'ip-address':
                                default:
                                    $report['Ip'] = $report['Source'];
                                    break;
                            }

                            // Sanity check
                            if ($this->hasRequiredFields($report) === true) {
                                // incident has all requirements met, filter and add!
                                $report = $this->applyFilters($report);

                                // Manually update some fields for easier handling
                                if ($report['Report-Type'] == 'phishing') {
                                    $url = $report['Source'];
                                }

                                if ($report['Report-Type'] == 'malware-attack') {
                                    // Download-Link to Domain / Uri
                                    $url = $report['Download-Link'];
                                }

                                $incident = new Incident();
                                $incident->source      = config("{$this->configBase}.parser.name");
                                $incident->source_id   = false;
                                $incident->ip          = $report['Ip'];
                                $incident->domain      = empty($url) ? false : getDomain($url);
                                $incident->class       = config("{$this->configBase}.feeds.{$this->feedName}.class");
                                $incident->type        = config("{$this->configBase}.feeds.{$this->feedName}.type");
                                $incident->timestamp   = strtotime($report['Date']);
                                $incident->information = json_encode($report);

                                $this->incidents[] = $incident;

                            }
                        }
                    }
                }
            }
        }

        return $this->success();
    }
public function parse ( ) { foreach ( $ this -> parsedMail -> getAttachments ( ) as $ attachment ) { if ( preg_match ( config ( "{$this->configBase}.parser.report_file" ) , $ attachment -> filename ) ) { if ( preg_match_all ( '/([\w\-]+): (.*)[ ]*\r?\n/' , str_replace ( "\r" , "" , $ attachment -> getContent ( ) ) , $ matches ) ) { $ report = array_combine ( $ matches [ 1 ] , $ matches [ 2 ] ) ; // We need this field to detect the feed, so we need to check it first if ( ! empty ( $ report [ 'Report-Type' ] ) ) { // Handle aliasses first foreach ( config ( "{$this->configBase}.parser.aliases" ) as $ alias => $ real ) { if ( $ report [ 'Report-Type' ] == $ alias ) { $ report [ 'Report-Type' ] = $ real ; } } $ this -> feedName = $ report [ 'Report-Type' ] ; // If feed is known and enabled, validate data and save report if ( $ this -> isKnownFeed ( ) && $ this -> isEnabledFeed ( ) ) { switch ( $ report [ 'Source-Type' ] ) { case 'uri' : // Match case 1: // A single line with 'http* [x.x.x.x]' (note the space) preg_match ( '/\[([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\]/' , $ this -> parsedMail -> getMessageBody ( ) , $ matches ) ; if ( count ( $ matches ) == 2 && empty ( $ report [ 'Ip' ] ) ) { $ report [ 'Ip' ] = $ matches [ 1 ] ; } // Match case 2: // Somewhere a line will end (watch out for mime split!) 'address x.x.x.x.' preg_match ( '/address ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\./' , $ this -> parsedMail -> getMessageBody ( ) , $ matches ) ; if ( count ( $ matches ) == 2 && empty ( $ report [ 'Ip' ] ) ) { $ report [ 'Ip' ] = $ matches [ 1 ] ; } // Match case 3: // IPv6 report if ( preg_match ( '/(?>(?>([a-f0-9]{1,4})(?>:(?1)){7}|' . '(?!(?:.*[a-f0-9](?>:|$)){8,})((?1)(?>:(?1)){0,6})?::(?2)?)|(?>(' . '?>(?1)(?>:(?1)){5}:|(?!(?:.*[a-f0-9]:){6,})(?3)?::(?>((?1)(?>:(' . '?1)){0,4}):)?)?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\.(?4)){3}))/' , $ this -> parsedMail -> getMessageBody ( ) , $ matches ) ) { $ report [ 'Ip' ] = $ matches [ 0 ] ; } break ; case 'ipv4' : case 'ipv6' : case 'ip-address' : default : $ report [ 'Ip' ] = $ report [ 'Source' ] ; break ; } // Sanity check if ( $ this -> hasRequiredFields ( $ report ) === true ) { // incident has all requirements met, filter and add! $ report = $ this -> applyFilters ( $ report ) ; // Manually update some fields for easier handling if ( $ report [ 'Report-Type' ] == 'phishing' ) { $ url = $ report [ 'Source' ] ; } if ( $ report [ 'Report-Type' ] == 'malware-attack' ) { // Download-Link to Domain / Uri $ url = $ report [ 'Download-Link' ] ; } $ incident = new Incident ( ) ; $ incident -> source = config ( "{$this->configBase}.parser.name" ) ; $ incident -> source_id = false ; $ incident -> ip = $ report [ 'Ip' ] ; $ incident -> domain = empty ( $ url ) ? false : getDomain ( $ url ) ; $ incident -> class = config ( "{$this->configBase}.feeds.{$this->feedName}.class" ) ; $ incident -> type = config ( "{$this->configBase}.feeds.{$this->feedName}.type" ) ; $ incident -> timestamp = strtotime ( $ report [ 'Date' ] ) ; $ incident -> information = json_encode ( $ report ) ; $ this -> incidents [ ] = $ incident ; } } } } } } return $ this -> success ( ) ; }
Parse attachments
@return array    Returns array with failed or success data
(See parser-common/src/Parser.php) for more info.
Parse attachments