MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

Cosmetic changes

pull/114/head
Raphaël Vinot 2017-03-05 18:59:36 +01:00
parent ad49fd3819
commit 44867b2adc
1 changed files with 29 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
misp_modules/modules/expansion/virustotal.py
View File

@ -1,9 +1,7 @@
import json import json
import requests import requests
import hashlib from requests import HTTPError
import re
import base64 import base64
import os
misperrors = {'error': 'Error'} misperrors = {'error': 'Error'}
mispattributes = {'input': ['hostname', 'domain', "ip-src", "ip-dst", "md5", "sha1", "sha256", "sha512"], mispattributes = {'input': ['hostname', 'domain', "ip-src", "ip-dst", "md5", "sha1", "sha256", "sha512"],
@ -60,32 +58,33 @@ def handler(q=False):
def getHash(hash, key, do_not_recurse=False): def getHash(hash, key, do_not_recurse=False):
global limit
toReturn = []
try:
req = requests.get("https://www.virustotal.com/vtapi/v2/file/report", req = requests.get("https://www.virustotal.com/vtapi/v2/file/report",
params={"allinfo": 1, "apikey": key, 'resource': hash} params={"allinfo": 1, "apikey": key, 'resource': hash})
).json() try:
except: req.raise_for_status()
return [] req = req.json()
except HTTPError as e:
misperrors['error'] = str(e)
return misperrors
if req["response_code"] == 0: if req["response_code"] == 0:
# Nothing found # Nothing found
return [] return []
toReturn += getMoreInfo(req, key) return getMoreInfo(req, key)
return toReturn
def getIP(ip, key, do_not_recurse=False): def getIP(ip, key, do_not_recurse=False):
global limit global limit
toReturn = [] toReturn = []
try:
req = requests.get("https://www.virustotal.com/vtapi/v2/ip-address/report", req = requests.get("https://www.virustotal.com/vtapi/v2/ip-address/report",
params={"ip": ip, "apikey": key} params={"ip": ip, "apikey": key})
).json() try:
except: req.raise_for_status()
return [] req = req.json()
except HTTPError as e:
misperrors['error'] = str(e)
return misperrors
if req["response_code"] == 0: if req["response_code"] == 0:
# Nothing found # Nothing found
@ -105,12 +104,14 @@ def getIP(ip, key, do_not_recurse=False):
def getDomain(domain, key, do_not_recurse=False): def getDomain(domain, key, do_not_recurse=False):
global limit global limit
toReturn = [] toReturn = []
try:
req = requests.get("https://www.virustotal.com/vtapi/v2/domain/report", req = requests.get("https://www.virustotal.com/vtapi/v2/domain/report",
params={"domain": domain, "apikey": key} params={"domain": domain, "apikey": key})
).json() try:
except: req.raise_for_status()
return [] req = req.json()
except HTTPError as e:
misperrors['error'] = str(e)
return misperrors
if req["response_code"] == 0: if req["response_code"] == 0:
# Nothing found # Nothing found