Skip to content

Failing to parse Maltego transform request message #44

@caolan

Description

@caolan

I'm trying to run canari run-server to access a transform, it appears to expose the transforms through the HTTP server but when a request comes in from the TDS it fails to properly parse the request data. The incoming XML looks as follows:

<MaltegoMessage>
   <MaltegoTransformRequestMessage>
      <Entities>
         <Entity Type="DNSName">
            <AdditionalFields>
               <Field Name="fqdn" DisplayName="DNS Name">example.com</Field>
            </AdditionalFields>
            <Value>example.com</Value>
            <Weight>0</Weight>
         </Entity>
      </Entities>
      <Limits SoftLimit="12" HardLimit="12"/>
   </MaltegoTransformRequestMessage>
</MaltegoMessage>

This appears to match the models in canari/maltego/message.py, although I've had to change the msg = MaltegoTransformRequestMessage.parse(request_str).message line in MaltegoTransformRequestHandler.dotransform to msg = MaltegoMessage.parse(request_str).message otherwise it complains about receiving a MaltegoMessage tag (I've also tried just stripping that part of the request out, with no luck). This appears to get further parsing the request but I see no entities in the parsed request data - causing the transform request to fail with status code 400 and the message "Unsupported input entity!".

I'm still digging but any pointers would be much appreciated. Have you tried canari run-server with an iTDS server before?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions