-
Notifications
You must be signed in to change notification settings - Fork 6
/
Get-CertTransparencyInfo.psm1
205 lines (182 loc) · 9.26 KB
/
Get-CertTransparencyInfo.psm1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
#
# Created by: lucas.cueff[at]lucas-cueff.com
#
# Released on: 01/2018
#
# v0.4.0: fix json request with new crt.sh website version
#
#'(c) 2018 lucas-cueff.com - Distributed under Artistic Licence 2.0 (https://opensource.org/licenses/artistic-license-2.0).'
Function Get-CertTransparencyInfo {
<#
.SYNOPSIS
Get CTL info for domains,fqdn using CRT.sh web site
.DESCRIPTION
Get CTL info for domains,fqdn using CRT.sh web site
.PARAMETER SearchDomain
Mandatory parameter
-SearchDomain string
Provide domain, fqdn to search with crt.sh website
.PARAMETER AdvSearch
-advsearch string {'Subject-email','Subject-CommonName','Subject-OrgaName','Subject-OrgaUnitName','San-DnsName','San-IP','San-RFC822Name','Cert-SubjectKeyIdentifier'}
use advanced search function to target specific data
.PARAMETER GetCertificate
-GetCertificate switch
download all certificates found and add the results in the objects return (property Cli_certificate)
.PARAMETER IncludeExpired
-IncludeExpired switch
include all expired certificates in result
.OUTPUTS
TypeName : Selected.System.Management.Automation.PSCustomObject
Name MemberType Definition
---- ---------- ----------
Equals Method bool Equals(System.Object obj)
GetHashCode Method int GetHashCode()
GetType Method type GetType()
ToString Method string ToString()
Cli_adv_search NoteProperty string Cli_adv_search=San-DnsName
Cli_certificate NoteProperty System.Security.Cryptography.X509Certificates.X509Certificate2 Cli_certificate=[Subject]...
Cli_online_certificate_url NoteProperty string Cli_online_certificate_url=https://crt.sh/?d=172086619
Cli_online_obj_url NoteProperty string Cli_online_obj_url=https://crt.sh/?id=172086619
Cli_search_date NoteProperty datetime Cli_search_date=12/01/2018 16:00:41
Cli_search_request NoteProperty string Cli_search_request=www.yahoo.com
issuer_ca_id NoteProperty int issuer_ca_id=1397
issuer_name NoteProperty string issuer_name=C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
min_cert_id NoteProperty int min_cert_id=172086619
min_entry_timestamp NoteProperty System.DateTime min_entry_timestamp=13/07/2017 18:44:02
name_value NoteProperty string name_value=www.yahoo.com
not_before NoteProperty System.DateTime not_before=13/07/2017 00:00:00
min_cert_id : 172086619
issuer_ca_id : 1397
not_before : 13/07/2017 00:00:00
name_value : www.yahoo.com
issuer_name : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
min_entry_timestamp : 13/07/2017 18:44:02
Cli_online_obj_url : https://crt.sh/?id=172086619
Cli_online_certificate_url : https://crt.sh/?d=172086619
Cli_adv_search : San-DnsName
Cli_search_request : www.yahoo.com
Cli_search_date : 12/01/2018 16:00:41
Cli_certificate : [Subject]
CN=*.att.yahoo.com, O=Yahoo! Inc., L=Sunnyvale, S=CA, C=US
[Issuer]
CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US
[Serial Number]
0549BC2E73877793DF5F5EC7B7AD9161
[Not Before]
13/07/2017 02:00:00
[Not After]
13/01/2018 13:00:00
[Thumbprint]
978E6DB2761BD4BECFF14CFC21F2A7F95E40B12C
.EXAMPLE
get certificate info from CTL databases for google.com domain
C:\PS> Get-CertTransparancyInfo -SearchInfo "google.com"
.EXAMPLE
get certificate info from CTL databases for google-*.com domain
C:\PS> Get-CertTransparancyInfo -SearchInfo "google-*.com"
.EXAMPLE
get certificate info from CTL databases for certificates containing *.google.com in their SAN
C:\PS> Get-CertTransparancyInfo -SearchInfo "*google.com" -AdvSearch San-DnsName
.EXAMPLE
get certificate info from CTL databases for certificates containing *.google.com in their SAN and dump certificate found
C:\PS> Get-CertTransparancyInfo -SearchInfo "*google.com" -AdvSearch San-DnsName -GetCertificate
.EXAMPLE
get certificate info from CTL databases for google.com domain including expired
C:\PS> Get-CertTransparancyInfo -SearchInfo "google.com" -IncludeExpired
#>
[cmdletbinding()]
param(
[parameter(ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$true,Mandatory=$true)]
[string] $SearchInfo,
[parameter(Mandatory=$false)]
[ValidateSet('Subject-email','Subject-CommonName','Subject-OrgaName','Subject-OrgaUnitName','San-DnsName','San-IP','San-RFC822Name','Cert-SubjectKeyIdentifier')]
[String]$AdvSearch,
[parameter(Mandatory=$false)]
[switch]$GetCertificate,
[parameter(Mandatory=$false)]
[switch]$IncludeExpired
)
$SearchInfo = $SearchInfo -replace " ", "+"
$SearchInfo = $SearchInfo -replace "\*", "%"
$script:currentdate = get-date
$script:crtsh = "https://crt.sh/"
if ($IncludeExpired.IsPresent) {
$ExcludeExpired = $null
} Else {
$ExcludeExpired = "&exclude=expired"
}
if ($advsearch){
switch ($advsearch) {
'Subject-email' {$url = "$($crtsh)?E=$($SearchInfo)&output=json$ExcludeExpired"}
'Subject-CommonName' {$url = "$($crtsh)?CN=$($SearchInfo)&output=json$ExcludeExpired"}
'Subject-OrgaName' {$url = "$($crtsh)?O=$($SearchInfo)&output=json$ExcludeExpired"}
'Subject-OrgaUnitName' {$url = "$($crtsh)?OU=$($SearchInfo)&output=json$ExcludeExpired"}
'San-DnsName' {$url = "$($crtsh)?dNSName=$($SearchInfo)&output=json$ExcludeExpired"}
'San-IP' {$url = "$($crtsh)?iPAddress=$($SearchInfo)&output=json$ExcludeExpired"}
'San-RFC822Name' {$url = "$($crtsh)?rfc822Name=$($SearchInfo)&output=json$ExcludeExpired"}
'Cert-SubjectKeyIdentifier' {$url = "$($crtsh)?ski=$($SearchInfo)&output=json$ExcludeExpired"}
Default {$url = "$($crtsh)?q=$($SearchInfo)&output=json"}
}
} else {
$url = "$($crtsh)?q=$($SearchInfo)&output=json"
}
$Script:FinalCTLInfo = @()
$Script:CTLTemplateObject = New-Object psobject
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "min_cert_id" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "issuer_ca_id" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "not_before" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "name_value" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "issuer_name" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "min_entry_timestamp" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "Cli_online_obj_url" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "Cli_online_certificate_url" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "Cli_adv_search" -Value $false
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "Cli_search_request" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "Cli_search_date" -Value $null
$CTLTemplateObject | Add-Member -MemberType NoteProperty -Name "Cli_certificate" -Value $null
try {
$webdata = invoke-webrequest $url
} catch {
if ($_.Exception.Response.StatusCode.Value__ -eq 404) {
write-warning "No certificate found"
} Else {
write-warning "website error or not available"
write-error "Error Type: $($_.Exception.GetType().FullName)"
write-error "Error Message: $($_.Exception.Message)"
}
return
}
try {
$Filteredwebdata = $webdata.content | convertfrom-json
} catch {
write-warning "Error when parsing Json file"
write-error "Error Type: $($_.Exception.GetType().FullName)"
write-error "Error Message: $($_.Exception.Message)"
return
}
foreach ($data in $Filteredwebdata) {
$tmpobj = $Script:CTLTemplateObject | select-object *
$tmpobj.min_cert_id = $data.min_cert_id
$tmpobj.issuer_ca_id = $data.issuer_ca_id
$tmpobj.name_value = $data.name_value
$tmpobj.issuer_name = $data.issuer_name
$tmpobj.not_before = get-date $data.not_before
$tmpobj.min_entry_timestamp = get-date $data.min_entry_timestamp
$tmpobj.Cli_online_obj_url = "$($crtsh)?id=$($data.min_cert_id)"
$tmpobj.Cli_online_certificate_url = "$($crtsh)?d=$($data.min_cert_id)"
if ($advsearch) {$tmpobj.Cli_adv_search = $advsearch}
$tmpobj.Cli_search_request = $SearchInfo
$tmpobj.Cli_search_date = $currentdate
if ($GetCertificate.IsPresent) {
$tmpcert = Invoke-WebRequest "$($tmpobj.Cli_online_certificate_url)" -ErrorAction Continue
if ($tmpcert) {
$tmpobcert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$tmpobcert.Import($tmpcert.content)
$tmpobj.Cli_certificate = $tmpobcert
}
}
$Script:FinalCTLInfo += $tmpobj
}
If ($FinalCTLInfo) {return $FinalCTLInfo}
}
Export-ModuleMember -Function Get-CertTransparencyInfo