Version 1.1!

Version 1.1 has been officially released, with new features, bug fixes and stability issues resolved! Added - An option has been added for players to respond to polls for analytical purposes. Available for Slack, Discord and Telegram! Fixed - A problem with the Discord bot has been fixed. - We have changed the way to check options such as "Photos" and "Profile picture" in the injects. Updated - We have updated all the bots dependencies and made some changes to make them work with the new versions.
Base4Security · Oct 28, 2022 · 5f70f8b · 5f70f8b
1 parent d3cc4b8
commit 5f70f8b
Show file tree

Hide file tree

Showing 12 changed files with 470 additions and 114 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,21 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## [1.1] - 2022-10-28
+
+Version 1.1 has been officially released, with new features, bug fixes and stability issues resolved!
+
+### Added
+- An option has been added for players to respond to polls for analytical purposes. Available for **Slack**, **Discord** and **Telegram**!
+
+### Fixed
+- A problem with the Discord bot has been fixed.
+- We have changed the way to check options such as "Photos" and "Profile picture" in the injects.
+
+### Updated
+- We have updated all the bots dependencies and made some changes to make them work with the new versions.
+
+
 ## [1.0] - 2022-04-20 
 
 Releasing the official public version of the framework!
@@ -48,7 +63,7 @@ Launching the latest _and better_ version of the framework supporting Discord!
 -Now the start and resume function are merged into 1 process function!
 
 ### Fixed
-- Fixed a bug within the resume function, injects not properly being choose!
+- Fixed a bug within the resume function, injects not being chosen correctly!
 
 
 ## [0.3] - 2022-01-29 [Private]

diff --git a/Discord/bot.py b/Discord/bot.py
@@ -1,14 +1,16 @@
 from discord.ext import commands
 from dotenv import load_dotenv
-from blurple import ui
 import discord
 import os
 
-from T3SF import T3SF
+from T3SF import *
 
 load_dotenv()
 TOKEN = os.getenv('DISCORD_TOKEN')
-bot = commands.Bot(command_prefix='!')
+
+intents = discord.Intents.default()
+intents.message_content = True
+bot = commands.Bot(command_prefix='!', intents=intents)
 
 T3SF = T3SF(bot=bot)
 
@@ -24,6 +26,10 @@ async def on_ready():
     print(f'{bot.user.id}')
     print('------')
 
+@bot.event
+async def on_interaction(interaction):
+    await T3SF.PollAnswerHandler(payload=interaction)
+
 @bot.command(name='ping', help='Responds with pong to know if the bot is up! Usage -> !ping')
 async def ping(ctx):
     """
@@ -34,7 +40,7 @@ async def ping(ctx):
 
     :stopwatch: `{round(bot.latency*1000)}ms`
     """
-    await ctx.send(embed=ui.Toast(ui.Style.INFO, emoji=False, text=description))
+    response = await ctx.send(embed=discord.Embed(colour=discord.Colour.blue(), description=description))
 
 @bot.command(name="start", help='Starts the Incidents Game. Usage -> !start')
 @commands.has_role("Game Master")
@@ -65,7 +71,7 @@ async def resume(ctx, *, query):
         await T3SF.ProcessIncidents(function_type = "resume", ctx=ctx, itinerator=itinerator)
 
     except Exception as e:
-        print("ERROR - Start function")
+        print("ERROR - Resume function")
         print(e)
         raise
 

diff --git a/Discord/requirements.txt b/Discord/requirements.txt
@@ -1,4 +1,12 @@
-blurple.py==0.5.5
-discord.py==1.7.3
-python-dotenv==0.20.0
-t3sf==1.0
+aiohttp==3.8.3
+aiosignal==1.2.0
+async-timeout==4.0.2
+attrs==22.1.0
+charset-normalizer==2.1.1
+discord.py==2.0.1
+frozenlist==1.3.1
+idna==3.4
+multidict==6.0.2
+python-dotenv==0.21.0
+yarl==1.8.1
+t3sf==1.1
diff --git a/MSEL.xlsx b/MSEL.xlsx
diff --git a/MSEL_EXAMPLE.json b/MSEL_EXAMPLE.json
@@ -1,15 +1,16 @@
 [
  {
     "#": 1,
-    "Real Time": "07:29 AM",
+    "Real Time": "07:29 PM",
     "Date": "Monday 9:30 AM",
     "Subject": "Anomalous Files Detected",
     "From": "Amazon Web Services",
     "Player": "Information Security",
     "Script": "We detected some anomalous files in your S3 Bucket.",
-    "Picture Name": "S3_Bucket.png",
     "Photo": "https://img2.helpnetsecurity.com/posts2018/aws-s3-buckets-public.jpg",
-    "Profile": "https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/1024px-Amazon_Web_Services_Logo.svg.png"
+    "Picture Name": "S3_Bucket.png",
+    "Profile": "https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/1024px-Amazon_Web_Services_Logo.svg.png",
+    "Poll": ""
  },
  {
    "#": 2,
@@ -19,8 +20,10 @@
    "From": "SOC - BASE4",
    "Player": "SRE",
    "Script": "Please note that we detected a large number of phishing emails coming from different email addresses.\n\nIgnore messages from emails with the address @notanemail.net",
+   "Photo": "",
    "Picture Name": "Base_4_SOC.jpg",
-   "Profile": "https://foreseeti.com/wp-content/uploads/2021/09/Ska%CC%88rmavbild-2021-09-02-kl.-15.44.24.png"
+   "Profile": "https://foreseeti.com/wp-content/uploads/2021/09/Ska%CC%88rmavbild-2021-09-02-kl.-15.44.24.png",
+   "Poll": ""
  },
  {
    "#": 3,
@@ -30,8 +33,10 @@
    "From": "Internal",
    "Player": "Data Governance",
    "Script": "Hey Guys!\n\nI found some files from the company exposed online, please take a look!",
+   "Photo": "https://assets-global.website-files.com/5efc3ccdb72aaa7480ec8179/60dc1c3c984ef85123cb0f7b_LinkedIn-Data-Breach-700-million-.png",
    "Picture Name": "attachment.jpg",
-   "Photo": "https://assets-global.website-files.com/5efc3ccdb72aaa7480ec8179/60dc1c3c984ef85123cb0f7b_LinkedIn-Data-Breach-700-million-.png"
+   "Profile": "",
+   "Poll": ""
  },
  {
    "#": 4,
@@ -41,7 +46,10 @@
    "From": "Joaquin Lanfranconi",
    "Player": "Legal",
    "Script": "Hey folks!\n\nI'm about to release a new tool, but I'm not sure which license is better, can you help with this one?\n\nThanks in advance!",
-   "Picture Name": "attachment.jpg"
+   "Photo": "",
+   "Picture Name": "",
+   "Profile": "",
+   "Poll": "MIT | GPL"
  },
  {
    "#": 5,
@@ -52,7 +60,9 @@
    "Player": "PR/Comm",
    "Script": "Hello, \n\nI'm inside your company, I've encrypted all your files, if you want to recover them, check the attached file.",
    "Picture Name": "attachment.jpg",
-   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png"
+   "Profile": "",
+   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png",
+   "Poll": ""
  },
  {
    "#": 6,
@@ -63,7 +73,9 @@
    "Player": "Information Security",
    "Script": "Hello, \n\nI'm inside your company, I've encrypted all your files, if you want to recover them, check the attached file.",
    "Picture Name": "attachment.jpg",
-   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png"
+   "Profile": "",
+   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png",
+   "Poll": ""
  },
  {
    "#": 7,
@@ -74,7 +86,9 @@
    "Player": "SRE",
    "Script": "Hello, \n\nI'm inside your company, I've encrypted all your files, if you want to recover them, check the attached file.",
    "Picture Name": "attachment.jpg",
-   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png"
+   "Profile": "",
+   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png",
+   "Poll": ""
  },
  {
    "#": 8,
@@ -85,7 +99,9 @@
    "Player": "Data Governance",
    "Script": "Hello, \n\nI'm inside your company, I've encrypted all your files, if you want to recover them, check the attached file.",
    "Picture Name": "attachment.jpg",
-   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png"
+   "Profile": "",
+   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png",
+   "Poll": ""
  },
  {
    "#": 9,
@@ -96,7 +112,9 @@
    "Player": "Legal",
    "Script": "Hello, \n\nI'm inside your company, I've encrypted all your files, if you want to recover them, check the attached file.",
    "Picture Name": "attachment.jpg",
-   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png"
+   "Profile": "",
+   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png",
+   "Poll": ""
  },
  {
    "#": 10,
@@ -107,6 +125,34 @@
    "Player": "People",
    "Script": "Hello, \n\nI'm inside your company, I've encrypted all your files, if you want to recover them, check the attached file.",
    "Picture Name": "attachment.jpg",
-   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png"
+   "Profile": "",
+   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png",
+   "Poll": ""
+ },
+ {
+   "#": 11,
+   "Real Time": "07:33 PM",
+   "Date": "Monday 11:10 AM",
+   "Subject": "Encrypted Files!",
+   "From": "Internal",
+   "Player": "Data Governance",
+   "Script": "Guys, we have a major issue!\nWhat should we do in this case, they are asking for a ransom of 2 BTC!\n\nInfoSec confirmed the encrypted files and everything!\nShould we pay them?",
+   "Picture Name": "encrypted_files.jpg",
+   "Profile": "",
+   "Photo": "https://cdn2.hubspot.net/hubfs/486579/lp/academy/malware/wannacry_screenshot.png",
+   "Poll": "Pay the ransom | Don’t pay it"
+ },
+ {
+   "#": 12,
+   "Real Time": "07:35 PM",
+   "Date": "Monday 11:15 AM",
+   "Subject": "Data breach in your company",
+   "From": "New York Times",
+   "Player": "PR/Comm",
+   "Script": "Hello, \nWe have information about a data breach in your company.\nCould you please confirm, what kind of data is compromised?\nThanks!",
+   "Picture Name": "",
+   "Profile": "https://1000logos.net/wp-content/uploads/2017/04/Symbol-New-York-Times.png",
+   "Photo": "",
+   "Poll": ""
  }
 ]
diff --git a/README.md b/README.md
@@ -78,10 +78,16 @@ load_dotenv()
 
 TOKEN = os.getenv('DISCORD_TOKEN')
 
-bot = commands.Bot(command_prefix='!')
+intents = discord.Intents.default()
+intents.message_content = True
+bot = commands.Bot(command_prefix='!', intents=intents)
 
 T3SF = T3SF(bot=bot) # We need to pass the bot's object to the framework.
 
+@bot.event
+async def on_interaction(interaction):
+    await T3SF.PollAnswerHandler(payload=interaction)
+
 @bot.command(name="start", help='Starts the Incidents Game. Usage -> !start')
 async def start(ctx):
         # When the bot receives the command !start,
@@ -109,6 +115,10 @@ app = AsyncApp(token=os.environ["SLACK_BOT_TOKEN"])
 
 T3SF = T3SF(app=app) # We need to pass the app's object to the framework.
 
+@app.action(re.compile("option"))
+async def poll_handler(ack, body, payload):
+    await T3SF.PollAnswerHandler(ack=ack,body=body,payload=payload)
+
 @app.message("!start")
 async def start(message, say):
     # When the bot receives the command !start,

diff --git a/Slack/bot.py b/Slack/bot.py
@@ -8,7 +8,7 @@
 
 from T3SF import *
 
-logging.basicConfig(level=logging.WARNING)
+logging.basicConfig(level=logging.ERROR)
 
 load_dotenv()
 
@@ -20,14 +20,18 @@
 async def regex_handler(ack, body, payload):
     await T3SF.RegexHandler(ack=ack,body=body,payload=payload)
 
+@app.action(re.compile("option"))
+async def poll_handler(ack, body, payload):
+    await T3SF.PollAnswerHandler(ack=ack,body=body,payload=payload)
+
 @app.message('!ping')
 async def ping(message, say):
     """
     Retrieves the !ping command and replies with this message.
     """
     description = """
     PING localhost (127.0.0.1): 56 data bytes\n64 bytes from 127.0.0.1: icmp_seq=0 ttl=113 time=37.758 ms\n64 bytes from 127.0.0.1: icmp_seq=1 ttl=113 time=50.650 ms\n64 bytes from 127.0.0.1: icmp_seq=2 ttl=113 time=42.493 ms\n64 bytes from 127.0.0.1: icmp_seq=3 ttl=113 time=37.637 ms\n--- localhost ping statistics ---\n4 packets transmitted, 4 packets received, 0.0% packet loss\nround-trip min/avg/max/stddev = 37.637/42.135/50.650/5.292 ms\n\n_This is not real xD_"""
-    await app.client.chat_postMessage(channel = message['channel'], attachments = T3SF.Slack.Formatter(color="CL_GREEN", title="🏓 Pong!", description=description))
+    await app.client.chat_postMessage(channel = message['channel'], attachments = T3SF.Slack.Formatter(color="GREEN", title="🏓 Pong!", description=description))
 
 @app.message("!start")
 async def start(message, say):
@@ -66,6 +70,10 @@ async def handle_message_events(body, logger):
     """
     logger.info(body)
 
+@app.event("reaction_added")
+async def handle_reaction_added_events(body, logger):
+    logger.info(body)
+
 @app.error
 async def custom_error_handler(error, body, logger):
     """

diff --git a/Slack/requirements.txt b/Slack/requirements.txt
@@ -1,4 +1,13 @@
-python-dotenv==0.20.0
-slack-bolt==1.13.0
-slack-sdk==3.15.2
-t3sf==1.0
+aiohttp==3.8.3
+aiosignal==1.2.0
+async-timeout==4.0.2
+attrs==22.1.0
+charset-normalizer==2.1.1
+frozenlist==1.3.1
+idna==3.4
+multidict==6.0.2
+python-dotenv==0.21.0
+slack-bolt==1.15.2
+slack-sdk==3.19.2
+yarl==1.8.1
+t3sf==1.1