import json import time import os import requests from dotenv import load_dotenv from constants import URL, DOMAIN, IPV4, IPV6, domain_lookup def environment(): load_dotenv() api_key = os.getenv("VT_API") return api_key def analysis_object(api_key, host): url = "https://www.virustotal.com/api/v3/urls" payload = {"url": ""} payload.update({"url": host}) headers = { "accept": "application/json", "content-type": "application/x-www-form-urlencoded", "x-apikey": api_key, } response = requests.post(url, data=payload, headers=headers) response_dict = json.loads(response.text) response_id = response_dict["data"]["id"] return response_id def analyse_domain(api_key, host): url = "https://www.virustotal.com/api/v3/domains/" + host headers = { "accept": "application/json", "content-type": "application/x-www-form-urlencoded", "x-apikey": api_key, } vendors = [] analysis_json = requests.get(url, headers=headers) response_dict = json.loads(analysis_json.text) virustotal_stats = response_dict["data"]["attributes"]["last_analysis_stats"] virustotal_results = response_dict["data"]["attributes"]["last_analysis_results"] last_update = response_dict["data"]["attributes"]["last_update_date"] domain_lookup = dict.fromkeys(["total", "score", "vendors", "last_update"]) total = 0 vendors = [] for key, value in virustotal_stats.items(): total += value for key, value in virustotal_results.items(): if value["category"] == "malicious": vendors.append(key) domain_lookup["total"] = total domain_lookup["score"] = virustotal_stats["malicious"] domain_lookup["vendors"] = vendors domain_lookup["last_update"] = time.strftime( "%d-%m-%Y", time.gmtime(last_update), ) return domain_lookup, response_dict def analyse_URL(api_key, response_id): url = "https://www.virustotal.com/api/v3/analyses/{}".format(response_id) headers = {"accept": "application/json", "x-apikey": api_key} analysis_json = requests.get(url, headers=headers) analysis_dict = json.loads(analysis_json.text) return analysis_dict, analysis_json def analyse_IP(api_key, host): analysis_url = "https://www.virustotal.com/api/v3/ip_addresses/{}".format(host) headers = {"accept": "application/json", "x-apikey": api_key} analysis_json = requests.get(analysis_url, headers=headers) analysis_dict = json.loads(analysis_json.text) # Implement this: https://docs.virustotal.com/reference/ip-info return analysis_dict, analysis_json def analyse(host, host_type): api_key = environment() if host_type == URL: response_id = analysis_object(api_key, host) result, analysis_json = analyse_URL(api_key, response_id) elif host_type == DOMAIN: result, analysis_json = analyse_domain(api_key, host) elif host_type == IPV4 or IPV6: result, analysis_json = analyse_IP(api_key, host) return result, analysis_json