forensicnomicon 0.2.2

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241

"""
RED tests for scripts/discover_feeds.py

Systematic blog discovery from DFIR aggregator sites.
Pure-logic functions only — no HTTP in unit tests.
"""
import os
import sys

import pytest

sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))


class TestNormalizeDomain:
    def test_strips_www(self):
        from discover_feeds import normalize_domain
        assert normalize_domain("https://www.andreafortuna.org/") == "andreafortuna.org"

    def test_strips_path(self):
        from discover_feeds import normalize_domain
        assert normalize_domain("https://dfir.blog/some/post/") == "dfir.blog"

    def test_lowercases(self):
        from discover_feeds import normalize_domain
        assert normalize_domain("https://DFIR.Blog/") == "dfir.blog"

    def test_no_www(self):
        from discover_feeds import normalize_domain
        assert normalize_domain("https://andreafortuna.org/feed.xml") == "andreafortuna.org"

    def test_blogspot_subdomain_preserved(self):
        from discover_feeds import normalize_domain
        # windowsir.blogspot.com is the identity — don't collapse to blogspot.com
        assert normalize_domain("https://windowsir.blogspot.com/") == "windowsir.blogspot.com"

    def test_strips_trailing_slash(self):
        from discover_feeds import normalize_domain
        assert normalize_domain("https://dfir.blog/") == "dfir.blog"


class TestParseOpmlDomains:
    OPML = """<?xml version="1.0"?>
<opml version="1.0">
  <body>
    <outline text="DFIR Blogs">
      <outline type="rss" text="Windows IR" htmlUrl="https://windowsir.blogspot.com/" xmlUrl="x"/>
      <outline type="rss" text="Andrea Fortuna" htmlUrl="https://www.andreafortuna.org/" xmlUrl="y"/>
    </outline>
    <outline text="Vendor Blogs">
      <outline type="rss" text="Binalyze" htmlUrl="https://www.binalyze.com/blog" xmlUrl="z"/>
    </outline>
  </body>
</opml>"""

    def test_extracts_all_domains(self):
        from discover_feeds import parse_opml_domains
        domains = parse_opml_domains(self.OPML)
        assert "windowsir.blogspot.com" in domains
        assert "andreafortuna.org" in domains
        assert "binalyze.com" in domains

    def test_strips_www(self):
        from discover_feeds import parse_opml_domains
        domains = parse_opml_domains(self.OPML)
        assert "www.andreafortuna.org" not in domains

    def test_empty_opml(self):
        from discover_feeds import parse_opml_domains
        assert parse_opml_domains("<opml><body></body></opml>") == set()

    def test_missing_htmlurl_skipped(self):
        from discover_feeds import parse_opml_domains
        opml = '<opml><body><outline type="rss" text="X" xmlUrl="y"/></body></opml>'
        assert parse_opml_domains(opml) == set()

    def test_returns_set(self):
        from discover_feeds import parse_opml_domains
        result = parse_opml_domains(self.OPML)
        assert isinstance(result, set)


class TestExtractBlogLinks:
    def test_extracts_href_with_text(self):
        from discover_feeds import extract_blog_links
        html = '<a href="https://dfir.blog/">DFIR Blog</a>'
        links = extract_blog_links(html, "https://aboutdfir.com/")
        assert ("DFIR Blog", "https://dfir.blog/") in links

    def test_skips_same_domain_links(self):
        from discover_feeds import extract_blog_links
        html = '<a href="https://aboutdfir.com/resources">Resources</a>'
        links = extract_blog_links(html, "https://aboutdfir.com/")
        assert not any("aboutdfir.com" in url for _, url in links)

    def test_skips_empty_text_links(self):
        from discover_feeds import extract_blog_links
        html = '<a href="https://dfir.blog/"></a>'
        links = extract_blog_links(html, "https://aboutdfir.com/")
        assert all(text.strip() for text, _ in links)

    def test_skips_whitespace_only_text(self):
        from discover_feeds import extract_blog_links
        html = '<a href="https://dfir.blog/">   </a>'
        links = extract_blog_links(html, "https://aboutdfir.com/")
        assert all(text.strip() for text, _ in links)

    def test_deduplicates_by_domain(self):
        from discover_feeds import extract_blog_links
        html = ('<a href="https://dfir.blog/">Blog</a>'
                '<a href="https://dfir.blog/post/1">Post 1</a>')
        links = extract_blog_links(html, "https://aboutdfir.com/")
        domains = [url.split("/")[2] for _, url in links]
        assert len(domains) == len(set(domains))

    def test_handles_relative_urls(self):
        from discover_feeds import extract_blog_links
        # relative links should be skipped (no cross-domain discovery possible)
        html = '<a href="/resources/blogs">Blogs</a>'
        links = extract_blog_links(html, "https://aboutdfir.com/")
        assert not any("aboutdfir.com" not in url for _, url in links
                       if url.startswith("http"))

    def test_multiple_distinct_blogs(self):
        from discover_feeds import extract_blog_links
        html = ('<a href="https://dfir.blog/">DFIR Blog</a>'
                '<a href="https://andreafortuna.org/">Andrea Fortuna</a>')
        links = extract_blog_links(html, "https://aboutdfir.com/")
        urls = [url for _, url in links]
        assert any("dfir.blog" in u for u in urls)
        assert any("andreafortuna.org" in u for u in urls)


class TestIsBlogCandidate:
    def test_plain_blog_accepted(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://andreafortuna.org/") is True

    def test_blogspot_accepted(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://windowsir.blogspot.com/") is True

    def test_twitter_rejected(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://twitter.com/someone") is False

    def test_x_com_rejected(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://x.com/someone") is False

    def test_github_rejected(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://github.com/LOLBAS-Project") is False

    def test_youtube_rejected(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://youtube.com/watch?v=abc") is False

    def test_linkedin_rejected(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://linkedin.com/in/someone") is False

    def test_amazon_tool_rejected(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://aws.amazon.com/s3/") is False

    def test_mitre_rejected(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://attack.mitre.org/techniques/T1059/") is False

    def test_pdf_link_rejected(self):
        from discover_feeds import is_blog_candidate
        assert is_blog_candidate("https://example.com/whitepaper.pdf") is False

    def test_tool_download_rejected(self):
        from discover_feeds import is_blog_candidate
        # vendor tool pages, not blogs
        assert is_blog_candidate("https://www.nirsoft.net/utils/") is False


class TestFindGaps:
    def test_finds_missing_blog(self):
        from discover_feeds import find_gaps
        links = [("Andrea Fortuna", "https://andreafortuna.org/")]
        known = {"windowsir.blogspot.com", "dfir.blog"}
        gaps = find_gaps(links, known)
        assert any("andreafortuna.org" in url for _, url in gaps)

    def test_no_gap_if_known(self):
        from discover_feeds import find_gaps
        links = [("Windows IR", "https://windowsir.blogspot.com/")]
        known = {"windowsir.blogspot.com"}
        gaps = find_gaps(links, known)
        assert gaps == []

    def test_strips_www_before_compare(self):
        from discover_feeds import find_gaps
        links = [("Windows IR", "https://www.windowsir.blogspot.com/")]
        known = {"windowsir.blogspot.com"}
        gaps = find_gaps(links, known)
        assert gaps == []

    def test_multiple_gaps_returned(self):
        from discover_feeds import find_gaps
        links = [
            ("Blog A", "https://a.com/"),
            ("Blog B", "https://b.com/"),
            ("Blog C", "https://c.com/"),
        ]
        known = {"b.com"}
        gaps = find_gaps(links, known)
        gap_urls = [url for _, url in gaps]
        assert any("a.com" in u for u in gap_urls)
        assert any("c.com" in u for u in gap_urls)
        assert not any("b.com" in u for u in gap_urls)

    def test_empty_links_returns_empty(self):
        from discover_feeds import find_gaps
        assert find_gaps([], {"dfir.blog"}) == []

    def test_empty_known_returns_all_links(self):
        from discover_feeds import find_gaps
        links = [("Blog A", "https://a.com/"), ("Blog B", "https://b.com/")]
        gaps = find_gaps(links, set())
        assert len(gaps) == 2


class TestProbeForFeed:
    """probe_for_feed tries common RSS/Atom paths and returns the first that 200s."""

    def test_returns_none_for_clearly_invalid(self):
        from discover_feeds import probe_for_feed
        # Should return None or a string — never raise
        result = probe_for_feed("https://this-domain-does-not-exist-xyz987.com/")
        assert result is None

    def test_signature(self):
        from discover_feeds import probe_for_feed
        import inspect
        sig = inspect.signature(probe_for_feed)
        assert "url" in sig.parameters