iT邦幫忙

2025 iThome 鐵人賽

DAY 4
0
Security

安全助手養成 Vibe UP系列 第 4

Day 4:簡易POC驗證可行性-RSS新聞

  • 分享至 

  • xImage
  •  

威脅情資這面向可以看一些資安相關新聞,通常會有RSS可以訂閱,以這為目標,試著看能不能收到

驗證一、RSS.APP

照著網頁指引,10分鐘左右Exploit-DB(https://www.exploit-db.com/rss.xml) 資訊推到我的Discord頻道,技術上是可行的,但要訂閱更多就需要支付費用。
https://ithelp.ithome.com.tw/upload/images/20250918/20077752i4S75xpUoo.png
https://ithelp.ithome.com.tw/upload/images/20250918/20077752SZlG33ENSn.png
https://ithelp.ithome.com.tw/upload/images/20250918/200777522R3eJqU865.png

驗證二、Azure Functions

每月免費提供高達 1,000,000 次執行,試著VibeCode出一個程式,第一次使用花了一個多小時時間理解原理,使用vscode安裝Azure Function擴充功能,用AI修改預設程式內容,把程式Deploy上去
https://ithelp.ithome.com.tw/upload/images/20250918/20077752UgIRSqTyEj.png
https://ithelp.ithome.com.tw/upload/images/20250918/20077752VvAOX2ekCl.png

import logging
import azure.functions as func
import requests
import feedparser
import time
from datetime import datetime, timedelta

app = func.FunctionApp()

DISCORD_WEBHOOK_URL = "https://discord.com/api/webhooks/填入自己的"
RSS_FEED_URL_EXPLOIT_DB = "https://www.exploit-db.com/rss.xml"
RSS_FEED_URL_RANSOMWARE = "https://www.ransomware.live/rss.xml"

@app.timer_trigger(schedule="0 0 8 * * *", arg_name="myTimer", run_on_startup=False,
              use_monitor=False) 
def RSS_ExploitDB(myTimer: func.TimerRequest) -> None:
    if myTimer.past_due:
        logging.info('The timer is past due!')

    logging.info('Python timer trigger function executed.')

    feed = feedparser.parse(RSS_FEED_URL_EXPLOIT_DB)
    if not feed.entries:
        logging.warning("No RSS entries found.")
        return

    now = datetime.utcnow()
    one_day_ago = now - timedelta(days=1)
    one_month_ago = now - timedelta(days=30)
    sent_count = 0
    for entry in feed.entries:
        # published_parsed 是 struct_time
        if hasattr(entry, "published_parsed"):
            published = datetime.fromtimestamp(time.mktime(entry.published_parsed))
            if published < one_day_ago:
                continue  # 超過一天就跳過
        else:
            continue  # 沒有時間資訊就跳過

        title = entry.get("title", "No Title")
        link = entry.get("link", "")
        description = entry.get("description", "")
        content = f"**{title}**\n{description}\n{link}"

        data = {"content": content}
        try:
            resp = requests.post(DISCORD_WEBHOOK_URL, json=data)
            if resp.status_code == 204:
                logging.info("Message sent to Discord successfully.")
                sent_count += 1
            else:
                logging.error(f"Failed to send message to Discord: {resp.status_code} {resp.text}")
        except Exception as e:
            logging.error(f"Exception sending to Discord: {e}")

    logging.info(f"Total sent: {sent_count}")


@app.timer_trigger(schedule="0 0 8 * * *", arg_name="myTimer2", run_on_startup=False,
              use_monitor=False) 
def RSS_Ransomware(myTimer2: func.TimerRequest) -> None:
    if myTimer2.past_due:
        logging.info('The timer is past due!')

    logging.info('Python timer trigger function executed.')

    feed = feedparser.parse(RSS_FEED_URL_RANSOMWARE)
    if not feed.entries:
        logging.warning("No RSS entries found.")
        return

    now = datetime.utcnow()
    one_day_ago = now - timedelta(days=1)
    one_month_ago = now - timedelta(days=30)
    sent_count = 0
    for entry in feed.entries:
        # published_parsed 是 struct_time
        if hasattr(entry, "published_parsed"):
            published = datetime.fromtimestamp(time.mktime(entry.published_parsed))
            if published < one_day_ago:
                continue  # 超過一天就跳過
        else:
            continue  # 沒有時間資訊就跳過

        title = entry.get("title", "No Title")
        link = entry.get("link", "")
        description = entry.get("description", "")
        content = f"**{title}**\n{description}\n{link}"

        data = {"content": content}
        try:
            resp = requests.post(DISCORD_WEBHOOK_URL, json=data)
            if resp.status_code == 204:
                logging.info("Message sent to Discord successfully.")
                sent_count += 1
            else:
                logging.error(f"Failed to send message to Discord: {resp.status_code} {resp.text}")
        except Exception as e:
            logging.error(f"Exception sending to Discord: {e}")

    logging.info(f"Total sent: {sent_count}")

按下執行測試,Discord收到訊息
https://ithelp.ithome.com.tw/upload/images/20250918/20077752KdQtz0eimx.png


上一篇
Day 3:調查常見可用的自動化工具
系列文
安全助手養成 Vibe UP4
圖片
  熱門推薦
圖片
{{ item.channelVendor }} | {{ item.webinarstarted }} |
{{ formatDate(item.duration) }}
直播中

尚未有邦友留言

立即登入留言