|
1 | 1 | # Analyzers |
| 2 | + |
2 | 3 | When CertStream found a new certificate update, it will be passed to all the registered analyzers. |
3 | 4 | Each analyzer either returns a boolean value, or a list of matches. |
4 | 5 |
|
5 | 6 | ## Available Analyzers |
6 | 7 |
|
7 | | -### [AlwaysTrueAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/master/certleak/analyzers/alwaystrueanalyzer.py) |
| 8 | +### [AlwaysTrueAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/main/certleak/analyzers/alwaystrueanalyzer.py) |
| 9 | + |
8 | 10 | Analyzer that returns `True` for every certificate update |
9 | 11 |
|
10 | | -### [BasicAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/master/certleak/analyzers/basicanalyzer.py) |
| 12 | +### [BasicAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/main/certleak/analyzers/basicanalyzer.py) |
| 13 | + |
11 | 14 | Base class for all analyzers |
12 | 15 |
|
13 | | -### [CAFingerprintAnalyzer](https://github.com/d-Rickyy-b/certleak/blob/master/certleak/analyzers/cafingerprintanalyzer.py) |
| 16 | +### [CAFingerprintAnalyzer](https://github.com/d-Rickyy-b/certleak/blob/main/certleak/analyzers/cafingerprintanalyzer.py) |
| 17 | + |
14 | 18 | Finds certificate updates that are signed by a CA with a specified fingerprint. |
15 | 19 |
|
16 | | -### [DNSTwistAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/master/certleak/analyzers/dnstwistanalyzer.py) |
| 20 | +### [DNSTwistAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/main/certleak/analyzers/dnstwistanalyzer.py) |
| 21 | + |
17 | 22 | Built on top of [dnstwist](https://github.com/elceef/dnstwist), this analyzer generates lists of permutated domans and matches the domains in each certificate update against them. |
18 | 23 |
|
19 | | -### [DomainRegexAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/master/certleak/analyzers/domainregexanalyzer.py) |
| 24 | +### [DomainRegexAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/main/certleak/analyzers/domainregexanalyzer.py) |
| 25 | + |
20 | 26 | Matches a given regex pattern against all the domain names contained in the certificate. |
21 | 27 |
|
22 | | -### [FullDomainAnalyzer](https://github.com/d-Rickyy-b/certleak/blob/master/certleak/analyzers/fulldomainanalyzer.py) |
| 28 | +### [FullDomainAnalyzer](https://github.com/d-Rickyy-b/certleak/blob/main/certleak/analyzers/fulldomainanalyzer.py) |
| 29 | + |
23 | 30 | Matches certificate updates that contain a specified word. |
24 | 31 |
|
25 | | -### [LetsEncryptAnalyzer](https://github.com/d-Rickyy-b/certleak/blob/master/certleak/analyzers/letsencryptanalyzer.py) |
| 32 | +### [LetsEncryptAnalyzer](https://github.com/d-Rickyy-b/certleak/blob/main/certleak/analyzers/letsencryptanalyzer.py) |
| 33 | + |
26 | 34 | Analyzer for finding certificate updates that are signed by Let's Encrypt. |
27 | 35 |
|
28 | | -### [PreCertAnalyzer](https://github.com/d-Rickyy-b/certleak/blob/master/certleak/analyzers/precertanalyzer.py) |
| 36 | +### [PreCertAnalyzer](https://github.com/d-Rickyy-b/certleak/blob/main/certleak/analyzers/precertanalyzer.py) |
| 37 | + |
29 | 38 | Finds pre certificate updates. Can be used to exclude precerts. |
30 | 39 |
|
31 | | -### [RegexDomainAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/master/certleak/analyzers/regexdomainanalyzer.py) |
| 40 | +### [RegexDomainAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/main/certleak/analyzers/regexdomainanalyzer.py) |
| 41 | + |
32 | 42 | Probably the same as "DomainRegexAnalyzer" - TBD |
33 | 43 |
|
34 | | -### [SubDomainAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/master/certleak/analyzers/subdomainanalyzer.py) |
| 44 | +### [SubDomainAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/main/certleak/analyzers/subdomainanalyzer.py) |
| 45 | + |
35 | 46 | Filters certificate updates for certain subdomains. For example the subdomains `imap.` or `blog.` |
36 | 47 |
|
37 | | -### [TLDAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/master/certleak/analyzers/tldanalyzer.py) |
| 48 | +### [TLDAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/main/certleak/analyzers/tldanalyzer.py) |
| 49 | + |
38 | 50 | Finds certificate updates for domains of given TLDs. For example all domains ending with `.com`. |
39 | 51 |
|
40 | | -### [WildcardCertAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/master/certleak/analyzers/wildcardcertanalyzer.py) |
| 52 | +### [WildcardCertAnalyzer](https://github.com/d-Rickyy-b/certleak/tree/main/certleak/analyzers/wildcardcertanalyzer.py) |
| 53 | + |
41 | 54 | Finds all certificate updates with wildcard domains - For example `*.example.com`. |
42 | 55 |
|
43 | | -### [x509Analyzer](https://github.com/d-Rickyy-b/certleak/tree/master/certleak/analyzers/x509analyzer.py) |
| 56 | +### [x509Analyzer](https://github.com/d-Rickyy-b/certleak/tree/main/certleak/analyzers/x509analyzer.py) |
| 57 | + |
44 | 58 | Not all the certificates are x509 certs. This analyzer fiulters them. Best to be used in combination with other analyzers. |
45 | 59 |
|
46 | 60 | ## Combining analyzers |
47 | | -You can combine analyzers logically via AND, OR and a NOT operator. |
| 61 | + |
| 62 | +You can combine analyzers logically via AND, OR and a NOT operator. |
48 | 63 |
|
49 | 64 | ### AND |
| 65 | + |
50 | 66 | Use the ampersand (`&`) char to combine two analyzers with the logical AND operator. |
51 | 67 |
|
52 | 68 | ### OR |
| 69 | + |
53 | 70 | Use the pipe (`|`) char to combine two analyzers with the logical OR operator. |
54 | 71 |
|
55 | 72 | ### NOT |
56 | | -Us the tilde (`~`) char to negate the result of an analyzer. |
57 | | - |
| 73 | + |
| 74 | +Us the tilde (`~`) char to negate the result of an analyzer. |
58 | 75 | For example: you want all matches of the TLD `.com` but not the ones matching `example.com`. |
| 76 | + |
59 | 77 | ```python |
60 | 78 | dotcomAnalyzer = TLDAnalyzer(actions, ".com") |
61 | 79 | examplecomAnalyzer = FullDomainAnalyzer(actions=None, contained_words="example.com"): |
|
0 commit comments