Certificate-Transparency-to-Slack

KO | EN

gitlite — search

#javascript #typescript #go #golang #android #machine-learning #rust #deep-learning #linux #nodejs #windows #cli #security #mcp

Certificate-Transparency-to-Slack

(★ 10)

Monitor your domains for newly issued certificates and alert to Slack in near-realtime

Certificate-Transparency-to-Slack 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Certificate Transparency to Slack

This is a Python script that scrapes the [Cert Spotter API](https://sslmate.com/certspotter/) for newly issued certificates for domains you are monitoring and dumps them to a Slack channel.

There are a number of use cases for why you might want to do this:

* Blue/Security teams should be pro-actively monitoring their domains for (i) misissuance of certificates and (ii) new infrastructure and services being spun up which may be inappropriately exposed to the public internet
* Red-teamers and Bug Bounty hunters alike can also use this to be alerted when certificates have been issued which could indicate new targets to perform recon and assessments on

The script has been written, and is intended to run in AWS Lambda.

Note: Please feel free to contribute and make pull requests as I know there will be more efficient ways to do this

## How does it work?

The script does the following:

* Checks whether this is the first time the domain is being monitored (i.e., does a stored certificate ID for the domain already exist?)
* If this domain has not been monitored before then the script will call out to the Cert Spotter API, grab the latest issued certificate ID and store it in a marker file. We start monitoring from this point on.
* If this domain has already been monitored then the script pulls the certificate ID out of the marker file and checks to see if any certificates have been issued since that certificate ID
* Dump any new certificates to Slack

I have compared this script with Facebook's CT monitoring service, Cert Spotter (e-mail service) and several others - this tool always alerts me the fastest.

Here's a diagram which shows both scenarios (top: new domain and bottom: subsequent runs)

![how-it-works-diagram](https://raw.githubusercontent.com/emtunc/Certificate-Transparency-to-Slack/master/screenshots/how-it-works.png)

## What do I need?

You'll need the following:

* Storage - local disk or S3 bucket - doesn't matter what you call it but it will be referenced in the script
* [Cert Spotter API Credentials](https://sslmate.com/account/api_credentials) - there is a free tier which allows 100 full-domain queries/hour
* [Slack Incoming Webhook](https://api.slack.com/incoming-webhooks) - really easy to create an app and link it to a #channel of your choice
* Domains you want to monitor!
* Update the script with the above information
* Update the .yml if you intend to use it

### Environment variables

| Variable                  | Description                                                 |
| --------------            | ------------------------------------------------------------|
| `SLACK_WEBHOOK`           | Slack URL for notifications                                 |
| `MONITOR_DOMAINS`         | Comma delimited list of domains to query from API           |
| `CERTSPOTTER_API_TOKEN`   | CertSpotter API token                                       |
| `FILESYSTEM_PATH`         | volume mount target for persistence / state                 |
| `SLEEP_DELAY`             | how long to wait between each call, adjust for ratelimiting |
| `LOG_FORMAT`              | `json` or `syslog` for logging flavor                       |
| `DEBUG`                   | `true/false` adjust logger level for troubleshooting        |

## Screenshots

![Alt text](https://raw.githubusercontent.com/emtunc/Certificate-Transparency-to-Slack/master/screenshots/slack-alert.png)

## Join the conversation

A public Slack Workspace exists for a [previous project of mine](https://github.com/emtunc/SlackPirate) - I'm still on there so anyone can join to discuss new features, changes, feature requests or simply ask for help. Here's the invite link:

https://join.slack.com/t/slackpirate/shared_invite/enQtNTIyNjMxNDUyMzc0LTkzY2RkNGRlYTFiNWQ4OTYxMjYyZDRjZTAxZmEyNzAwZWVkYmVmZjk2MzJmYWQ5ODI4MmYxNmQyNDk2OTQ3MTQ

Certificate-Transparency-to-Slack

Certificate-Transparency-to-Slack 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Certificate-Transparency-to-Slack

Certificate-Transparency-to-Slack 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README