Class: PassiveDNS::VirusTotal

Inherits:
Object
  • Object
show all
Defined in:
lib/passivedns/client/virustotal.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(config = "#{ENV['HOME']}/.virustotal") ⇒ VirusTotal

Returns a new instance of VirusTotal.



9
10
11
12
13
14
15
16
 
# File 'lib/passivedns/client/virustotal.rb', line 9

def initialize(config="#{ENV['HOME']}/.virustotal")
	if File.exist?(config)
		@apikey = File.open(config).read.split(/\n/)[0]
		$stderr.puts "DEBUG: VirusTotal#initialize(#{@apikey})" if @debug
	else
		raise "Configuration file for VirusTotal is required for intialization\nFormat of configuration file (default: #{ENV['HOME']}/.virustotal) is the 64 hex character apikey on one line."
	end
end

Instance Attribute Details

#debug ⇒ Object

Returns the value of attribute debug.



8
9
10
 
# File 'lib/passivedns/client/virustotal.rb', line 8

def debug
  @debug
end

Instance Method Details

#lookup(label) ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
 
# File 'lib/passivedns/client/virustotal.rb', line 37

def lookup(label)
	$stderr.puts "DEBUG: VirusTotal.lookup(#{label})" if @debug
	Timeout::timeout(240) {
		url = nil
		if label =~ /^[\d\.]+$/
			url = "https://www.virustotal.com/vtapi/v2/ip-address/report?ip=#{label}&apikey=#{@apikey}"
		else
			url = "https://www.virustotal.com/vtapi/v2/domain/report?domain=#{label}&apikey=#{@apikey}"
		end
		$stderr.puts "DEBUG: VirusTotal url = #{url}" if @debug
		url = URI.parse url
		http = Net::HTTP.new(url.host, url.port)
		http.use_ssl = (url.scheme == 'https')
		http.verify_mode = OpenSSL::SSL::VERIFY_NONE
		http.verify_depth = 5
		request = Net::HTTP::Get.new(url.path+"?"+url.query)
		request.add_field("User-Agent", "Ruby/#{RUBY_VERSION} passivedns-client rubygem v#{PassiveDNS::Client::VERSION}")
		t1 = Time.now
		response = http.request(request)
		t2 = Time.now
		parse_json(response.body, label, t2-t1)
	}
rescue Timeout::Error => e
	$stderr.puts "VirusTotal lookup timed out: #{label}"
end

#parse_json(page, query, response_time = 0) ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
 
# File 'lib/passivedns/client/virustotal.rb', line 18

def parse_json(page,query,response_time=0)
	res = []
	# need to remove the json_class tag or the parser will crap itself trying to find a class to align it to
	data = JSON.parse(page)
	if data['resolutions']
		data['resolutions'].each do |row|
			if row['ip_address']
				res << PDNSResult.new('VirusTotal',response_time,query,row['ip_address'],'A',nil,nil,row['last_resolved'])
			elsif row['hostname']
				res << PDNSResult.new('VirusTotal',response_time,row['hostname'],query,'A',nil,nil,row['last_resolved'])
			end
		end
	end
	res
rescue Exception => e
	$stderr.puts "VirusTotal Exception: #{e}"
	raise e
end