78 lines
2.8 KiB
Python
78 lines
2.8 KiB
Python
|
import json
|
||
|
|
import os
|
||
|
|
import requests
|
||
|
|
from dotenv import load_dotenv
|
||
|
|
from pprint import pprint
|
||
|
|
from constants import URL, DOMAIN, IPV4, IPV6
|
||
|
|
|
||
|
|
# Would be nice to define some constants, f.e. for the various API urls, the headers, etc.
|
||
|
|
|
||
|
|
|
||
|
|
def environment():
|
||
|
|
load_dotenv()
|
||
|
|
api_key = os.getenv("VT_API")
|
||
|
|
return api_key
|
||
|
|
|
||
|
|
|
||
|
|
# Unfortunately this works for actual URLs, not domains. See: https://docs.virustotal.com/reference/domain-info
|
||
|
|
# This also doesn't work for IPv6 addresses, where the response_dict does not have a 'data' key. So I would have to revamp this module and make separate functions called based on host type (URL, IPv4 and -6, domain).
|
||
|
|
|
||
|
|
|
||
|
|
def analysis_object(api_key, host):
|
||
|
|
url = "https://www.virustotal.com/api/v3/urls"
|
||
|
|
payload = {"url": ""}
|
||
|
|
payload.update({"url": host})
|
||
|
|
headers = {
|
||
|
|
"accept": "application/json",
|
||
|
|
"content-type": "application/x-www-form-urlencoded",
|
||
|
|
"x-apikey": api_key,
|
||
|
|
}
|
||
|
|
response = requests.post(url, data=payload, headers=headers)
|
||
|
|
response_dict = json.loads(response.text)
|
||
|
|
response_id = response_dict["data"]["id"]
|
||
|
|
return response_id
|
||
|
|
|
||
|
|
|
||
|
|
def analyse_domain(api_key, host):
|
||
|
|
url = "https://www.virustotal.com/api/v3/domains/" + host
|
||
|
|
headers = {
|
||
|
|
"accept": "application/json",
|
||
|
|
"content-type": "application/x-www-form-urlencoded",
|
||
|
|
"x-apikey": api_key,
|
||
|
|
}
|
||
|
|
analysis_response = requests.get(url, headers=headers)
|
||
|
|
response_dict = json.loads(analysis_response.text)
|
||
|
|
# Probably still need to turn the requests.get into a json like below
|
||
|
|
return response_dict
|
||
|
|
|
||
|
|
|
||
|
|
def analyse_URL(api_key, response_id):
|
||
|
|
analysis_url = "https://www.virustotal.com/api/v3/analyses/{}".format(response_id)
|
||
|
|
headers = {"accept": "application/json", "x-apikey": api_key}
|
||
|
|
analysis_response = requests.get(analysis_url, headers=headers)
|
||
|
|
analysis_dict = json.loads(analysis_response.text)
|
||
|
|
# return analysis_response.text
|
||
|
|
return analysis_dict
|
||
|
|
|
||
|
|
|
||
|
|
def analyse_IP(api_key, host):
|
||
|
|
analysis_url = "https://www.virustotal.com/api/v3/ip_addresses/{}".format(host)
|
||
|
|
headers = {"accept": "application/json", "x-apikey": api_key}
|
||
|
|
analysis_response = requests.get(analysis_url, headers=headers)
|
||
|
|
analysis_dict = json.loads(analysis_response.text)
|
||
|
|
# Implement this: https://docs.virustotal.com/reference/ip-info
|
||
|
|
return analysis_dict
|
||
|
|
|
||
|
|
|
||
|
|
def analyse(host, host_type):
|
||
|
|
api_key = environment()
|
||
|
|
if host_type == URL:
|
||
|
|
response_id = analysis_object(api_key, host)
|
||
|
|
result = analyse_URL(api_key, response_id)
|
||
|
|
elif host_type == DOMAIN:
|
||
|
|
result = analyse_domain(api_key, host)
|
||
|
|
# elif for IPv4 and IPv6.
|
||
|
|
elif host_type == IPV4 or IPV6:
|
||
|
|
result = analyse_IP(api_key, host)
|
||
|
|
return result
|