Cool BBOT Queries

bbot.cypher

# Get all domain names, the IP associated, ASN, and open ports
MATCH (dns:DNS_NAME)
OPTIONAL MATCH (dns)-[r2]->(ip:IP_ADDRESS)
OPTIONAL MATCH (ip)-[r3]->(asn:ASN)
OPTIONAL MATCH (dns)-[r4]->(port:OPEN_TCP_PORT)
RETURN
  dns.data AS Domain,
  ip.data AS IPAddress, 
  asn.data AS ASN,
  collect(DISTINCT TAIL(SPLIT(port.data, ':'))[0]) AS AssociatedPorts
  
# Same analysis starting with IP
MATCH (ip:IP_ADDRESS)-[r]->(asn:ASN)
OPTIONAL MATCH (dns:DNS_NAME)-[r2]->(ip)
OPTIONAL MATCH (ip)-[r3]->(port:OPEN_TCP_PORT)
RETURN 
  ip.data AS IPAddress, 
  asn.data AS ASN,
  collect(dns.data) AS AssociatedDNSNames,
  collect(DISTINCT TAIL(SPLIT(port.data, ':'))[0]) AS AssociatedPorts
  
# Claude-generated slop that has an awesome output. Has domain,ip,open-ports
MATCH (n:DNS_NAME)
WHERE "in-scope" IN n.tags
WITH n, n.data AS domain, n.resolved_hosts AS ips
OPTIONAL MATCH (n) --> (p:OPEN_TCP_PORT)
WITH domain, ips, COLLECT(DISTINCT TAIL(SPLIT(p.data, ':'))) AS domain_ports

UNWIND ips AS ip
OPTIONAL MATCH (ip_node:IP_ADDRESS {data: ip})
WHERE "in-scope" IN ip_node.tags
OPTIONAL MATCH (ip_node) --> (ip_p:OPEN_TCP_PORT)
WITH domain, ip, domain_ports, COLLECT(DISTINCT TAIL(SPLIT(ip_p.data, ':'))) AS ip_ports

RETURN 
  domain AS Domain,
  ip AS IP,
  CASE 
    WHEN SIZE(domain_ports) > 0 THEN domain_ports
    WHEN SIZE(ip_ports) > 0 THEN ip_ports
    ELSE []
  END AS OpenPorts