Merge pull request #100 from rmarsollier/master

Some improvements of virustotal plugin
pull/106/head
Alexandre Dulaunoy 2017-02-10 17:47:51 +01:00 committed by GitHub
commit 09bf2f918f
1 changed files with 24 additions and 3 deletions

View File

@ -6,12 +6,12 @@ import base64
import os import os
misperrors = {'error': 'Error'} misperrors = {'error': 'Error'}
mispattributes = {'input': ['hostname', 'domain', "ip-src", "ip-dst"], mispattributes = {'input': ['hostname', 'domain', "ip-src", "ip-dst", "md5", "sha1", "sha256", "sha512"],
'output':['domain', "ip-src", "ip-dst", "text"] 'output':['domain', "ip-src", "ip-dst", "text", "md5", "sha1", "sha256", "sha512", "ssdeep", "authentihash", "filename"]
} }
# possible module-types: 'expansion', 'hover' or both # possible module-types: 'expansion', 'hover' or both
moduleinfo = {'version': '', 'author': 'Hannah Ward', moduleinfo = {'version': '2', 'author': 'Hannah Ward',
'description': 'Get information from virustotal', 'description': 'Get information from virustotal',
'module-type': ['expansion']} 'module-type': ['expansion']}
@ -39,6 +39,14 @@ def handler(q=False):
r["results"] += getDomain(q["domain"], key) r["results"] += getDomain(q["domain"], key)
if 'hostname' in q: if 'hostname' in q:
r["results"] += getDomain(q['hostname'], key) r["results"] += getDomain(q['hostname'], key)
if 'md5' in q:
r["results"] += getHash(q['md5'], key)
if 'sha1' in q:
r["results"] += getHash(q['sha1'], key)
if 'sha256' in q:
r["results"] += getHash(q['sha256'], key)
if 'sha512' in q:
r["results"] += getHash(q['sha512'], key)
uniq = [] uniq = []
for res in r["results"]: for res in r["results"]:
@ -47,6 +55,19 @@ def handler(q=False):
r["results"] = uniq r["results"] = uniq
return r return r
def getHash(hash, key, do_not_recurse = False):
global limit
toReturn = []
req = requests.get("https://www.virustotal.com/vtapi/v2/file/report",
params = { "allinfo":1, "apikey":key, 'resource': hash}
).json()
if req["response_code"] == 0:
#Nothing found
return []
toReturn += getMoreInfo(req, key)
return toReturn
def getIP(ip, key, do_not_recurse = False): def getIP(ip, key, do_not_recurse = False):
global limit global limit
toReturn = [] toReturn = []