Invalid response received from module reversedns - Using "Enrich Event"
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 377
- Forks
- 280
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 10
Description
Hey there,
Running latest version of the misp-modules and have updated all :)
Here is a sample MISP event to replicate
misp.event.1788.json
First I mark all the IP's:
Then click on the "Enrich Event" and choose the "reversedns"
This results in this error:
2024-12-17 19:25:37 Error: [RuntimeException] Invalid response received from module reversedns, response data do not contains results field.
Request URL: /events/enrichEvent/1788
Stack Trace:
#0 /var/www/MISP/app/Model/Event.php(6301): Event->enrichment()
#1 /var/www/MISP/app/Controller/EventsController.php(5985): Event->enrichmentRouter()
#2 [internal function]: EventsController->enrichEvent()
#3 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(499): ReflectionMethod->invokeArgs()
#4 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction()
#5 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke()
#6 /var/www/MISP/app/webroot/index.php(105): Dispatcher->dispatch()
#7 {main}
So the IP's it is hitting error on seems to be "8.8.1.1" that does not have a reverse DNS name to it if a normal nslookup returns
nslookup 8.8.1.1
** server can't find 1.1.8.8.in-addr.arpa: NXDOMAIN
The interesting part is that as far as I can see the code it looks to attempt to handle NXDOMAIN, but it must be the combination of attempting to enrich through "Enrich Event".
If I choose the "8.8.1.1" and click the "Add enrichment" it returns
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with the attached event and the reversedns module, then trace the enrichment path through app/Model/Event.php and app/Controller/EventsController.php. Compare the Enrich Event behavior for 8.8.1.1 with the successful Add enrichment path; done means NXDOMAIN responses no longer produce an invalid-response error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100