kk的blog: REST

顯示具有 REST 標籤的文章。顯示所有文章

2020/10/03

virustotal 有提供rest api 查詢

免費註冊後就可以在一定限制下免費使用

v2 語法如下

curl --request GET --url 'https://www.virustotal.com/vtapi/v2/ip-address/report?apikey="your api key"&ip=59.177.37.217'|jq

查詢結果如下

{

"asn": 17813,

"undetected_urls": [],

"undetected_downloaded_samples": [],

"country": "IN",

"response_code": 1,

"as_owner": "Mahanagar Telephone Nigam Limited",

"verbose_msg": "IP address in dataset",

"detected_downloaded_samples": [

{

"date": "2020-09-20 23:45:20",

"positives": 21,

"total": 72,

"sha256": "b5cf68c7cb5bb2d21d60bf6654926f61566d95bfd7c9f9e182d032f1da5b4605"

{

"date": "2020-09-20 20:37:59",

"positives": 33,

"total": 72,

"sha256": "c672798dca67f796972b42ad0c89e25d589d2e70eb41892d26adbb6a79f63887"

}

"detected_urls": [

{

"url": "http://59.177.37.217/",

"positives": 7,

"total": 79,

"scan_date": "2020-10-02 18:05:53"

{

"url": "http://59.177.37.217:58256/Mozi.m",

"positives": 8,

"total": 79,

"scan_date": "2020-09-24 02:04:33"

{

"url": "http://59.177.37.217:41901/Mozi.a",

"positives": 8,

"total": 79,

"scan_date": "2020-09-22 16:49:18"

{

"url": "https://59.177.37.217/",

"positives": 4,

"total": 79,

"scan_date": "2020-09-22 13:34:26"

{

"url": "http://59.177.37.217:39302/Mozi.m",

"positives": 9,

"total": 79,

"scan_date": "2020-09-20 21:52:26"

{

"url": "http://59.177.37.217/mozi.m",

"positives": 2,

"total": 79,

"scan_date": "2020-09-16 17:56:36"

{

"url": "http://59.177.37.217:58256/Mozi.m/",

"positives": 1,

"total": 79,

"scan_date": "2020-09-16 14:35:11"

}

"resolutions": []

}

v3 語法如下

curl --request GET --url 'https://www.virustotal.com/api/v3/search?query=209.59.217.36' --header 'x-apikey: your api key'

{

"data": [

{

"attributes": {

"as_owner": "The Endurance International Group, Inc.",

"asn": 29873,

"continent": "NA",

"country": "US",

"last_analysis_results": {

"ADMINUSLabs": {

"category": "harmless",

"engine_name": "ADMINUSLabs",

"method": "blacklist",

"result": "clean"

"AegisLab WebGuard": {

"category": "harmless",

"engine_name": "AegisLab WebGuard",

"method": "blacklist",

"result": "clean"

"AlienVault": {

"category": "harmless",

"engine_name": "AlienVault",

"method": "blacklist",

"result": "clean"

"Antiy-AVL": {

"category": "harmless",

"engine_name": "Antiy-AVL",

"method": "blacklist",

"result": "clean"

"AutoShun": {

"category": "harmless",

"engine_name": "AutoShun",

"method": "blacklist",

"result": "clean"

"Avira": {

"category": "harmless",

"engine_name": "Avira",

"method": "blacklist",

"result": "clean"

"BADWARE.INFO": {

"category": "harmless",

"engine_name": "BADWARE.INFO",

"method": "blacklist",

"result": "clean"

"Baidu-International": {

"category": "harmless",

"engine_name": "Baidu-International",

"method": "blacklist",

"result": "clean"

"BitDefender": {

"category": "harmless",

"engine_name": "BitDefender",

"method": "blacklist",

"result": "clean"

"Blueliv": {

"category": "harmless",

"engine_name": "Blueliv",

"method": "blacklist",

"result": "clean"

"CINS Army": {

"category": "harmless",

"engine_name": "CINS Army",

"method": "blacklist",

"result": "clean"

"CLEAN MX": {

"category": "harmless",

"engine_name": "CLEAN MX",

"method": "blacklist",

"result": "clean"

"CRDF": {

"category": "harmless",

"engine_name": "CRDF",

"method": "blacklist",

"result": "clean"

"Certego": {

"category": "harmless",

"engine_name": "Certego",

"method": "blacklist",

"result": "clean"

"Comodo Valkyrie Verdict": {

"category": "harmless",

"engine_name": "Comodo Valkyrie Verdict",

"method": "blacklist",

"result": "clean"

"CyRadar": {

"category": "harmless",

"engine_name": "CyRadar",

"method": "blacklist",

"result": "clean"

"Cyan": {

"category": "harmless",

"engine_name": "Cyan",

"method": "blacklist",

"result": "clean"

"CyberCrime": {

"category": "harmless",

"engine_name": "CyberCrime",

"method": "blacklist",

"result": "clean"

"DNS8": {

"category": "harmless",

"engine_name": "DNS8",

"method": "blacklist",

"result": "clean"

"Dr.Web": {

"category": "harmless",

"engine_name": "Dr.Web",

"method": "blacklist",

"result": "clean"

"ESET": {

"category": "harmless",

"engine_name": "ESET",

"method": "blacklist",

"result": "clean"

"ESTsecurity-Threat Inside": {

"category": "harmless",

"engine_name": "ESTsecurity-Threat Inside",

"method": "blacklist",

"result": "clean"

"EmergingThreats": {

"category": "harmless",

"engine_name": "EmergingThreats",

"method": "blacklist",

"result": "clean"

"Emsisoft": {

"category": "harmless",

"engine_name": "Emsisoft",

"method": "blacklist",

"result": "clean"

"EonScope": {

"category": "harmless",

"engine_name": "EonScope",

"method": "blacklist",

"result": "clean"

"Forcepoint ThreatSeeker": {

"category": "harmless",

"engine_name": "Forcepoint ThreatSeeker",

"method": "blacklist",

"result": "clean"

"Fortinet": {

"category": "harmless",

"engine_name": "Fortinet",

"method": "blacklist",

"result": "clean"

"FraudScore": {

"category": "harmless",

"engine_name": "FraudScore",

"method": "blacklist",

"result": "clean"

"G-Data": {

"category": "harmless",

"engine_name": "G-Data",

"method": "blacklist",

"result": "clean"

"Google Safebrowsing": {

"category": "harmless",

"engine_name": "Google Safebrowsing",

"method": "blacklist",

"result": "clean"

"GreenSnow": {

"category": "harmless",

"engine_name": "GreenSnow",

"method": "blacklist",

"result": "clean"

"Hoplite Industries": {

"category": "harmless",

"engine_name": "Hoplite Industries",

"method": "blacklist",

"result": "clean"

"IPsum": {

"category": "harmless",

"engine_name": "IPsum",

"method": "blacklist",

"result": "clean"

"K7AntiVirus": {

"category": "harmless",

"engine_name": "K7AntiVirus",

"method": "blacklist",

"result": "clean"

"Kaspersky": {

"category": "harmless",

"engine_name": "Kaspersky",

"method": "blacklist",

"result": "clean"

"Lumu": {

"category": "harmless",

"engine_name": "Lumu",

"method": "blacklist",

"result": "clean"

"MalSilo": {

"category": "harmless",

"engine_name": "MalSilo",

"method": "blacklist",

"result": "clean"

"Malware Domain Blocklist": {

"category": "harmless",

"engine_name": "Malware Domain Blocklist",

"method": "blacklist",

"result": "clean"

"MalwareDomainList": {

"category": "harmless",

"engine_name": "MalwareDomainList",

"method": "blacklist",

"result": "clean"

"MalwarePatrol": {

"category": "harmless",

"engine_name": "MalwarePatrol",

"method": "blacklist",

"result": "clean"

"Malwared": {

"category": "harmless",

"engine_name": "Malwared",

"method": "blacklist",

"result": "clean"

"Netcraft": {

"category": "harmless",

"engine_name": "Netcraft",

"method": "blacklist",

"result": "clean"

"NotMining": {

"category": "harmless",

"engine_name": "NotMining",

"method": "blacklist",

"result": "clean"

"Nucleon": {

"category": "harmless",

"engine_name": "Nucleon",

"method": "blacklist",

"result": "clean"

"OpenPhish": {

"category": "harmless",

"engine_name": "OpenPhish",

"method": "blacklist",

"result": "clean"

"PREBYTES": {

"category": "harmless",

"engine_name": "PREBYTES",

"method": "blacklist",

"result": "clean"

"PhishLabs": {

"category": "harmless",

"engine_name": "PhishLabs",

"method": "blacklist",

"result": "clean"

"Phishing Database": {

"category": "harmless",

"engine_name": "Phishing Database",

"method": "blacklist",

"result": "clean"

"Phishtank": {

"category": "harmless",

"engine_name": "Phishtank",

"method": "blacklist",

"result": "clean"

"Quick Heal": {

"category": "harmless",

"engine_name": "Quick Heal",

"method": "blacklist",

"result": "clean"

"Quttera": {

"category": "harmless",

"engine_name": "Quttera",

"method": "blacklist",

"result": "clean"

"SCUMWARE.org": {

"category": "harmless",

"engine_name": "SCUMWARE.org",

"method": "blacklist",

"result": "clean"

"SecureBrain": {

"category": "harmless",

"engine_name": "SecureBrain",

"method": "blacklist",

"result": "clean"

"Segasec": {

"category": "harmless",

"engine_name": "Segasec",

"method": "blacklist",

"result": "clean"

"Snort IP sample list": {

"category": "suspicious",

"engine_name": "Snort IP sample list",

"method": "blacklist",

"result": "suspicious"

"Sophos": {

"category": "harmless",

"engine_name": "Sophos",

"method": "blacklist",

"result": "clean"

"Spam404": {

"category": "harmless",

"engine_name": "Spam404",

"method": "blacklist",

"result": "clean"

"Spamhaus": {

"category": "harmless",

"engine_name": "Spamhaus",

"method": "blacklist",

"result": "clean"

"StopBadware": {

"category": "harmless",

"engine_name": "StopBadware",

"method": "blacklist",

"result": "clean"

"StopForumSpam": {

"category": "harmless",

"engine_name": "StopForumSpam",

"method": "blacklist",

"result": "clean"

"Sucuri SiteCheck": {

"category": "harmless",

"engine_name": "Sucuri SiteCheck",

"method": "blacklist",

"result": "clean"

"Tencent": {

"category": "harmless",

"engine_name": "Tencent",

"method": "blacklist",

"result": "clean"

"ThreatHive": {

"category": "harmless",

"engine_name": "ThreatHive",

"method": "blacklist",

"result": "clean"

"Threatsourcing": {

"category": "suspicious",

"engine_name": "Threatsourcing",

"method": "blacklist",

"result": "suspicious"

"Trustwave": {

"category": "harmless",

"engine_name": "Trustwave",

"method": "blacklist",

"result": "clean"

"URLhaus": {

"category": "harmless",

"engine_name": "URLhaus",

"method": "blacklist",

"result": "clean"

"VX Vault": {

"category": "harmless",

"engine_name": "VX Vault",

"method": "blacklist",

"result": "clean"

"Virusdie External Site Scan": {

"category": "harmless",

"engine_name": "Virusdie External Site Scan",

"method": "blacklist",

"result": "clean"

"Web Security Guard": {

"category": "harmless",

"engine_name": "Web Security Guard",

"method": "blacklist",

"result": "clean"

"Yandex Safebrowsing": {

"category": "harmless",

"engine_name": "Yandex Safebrowsing",

"method": "blacklist",

"result": "clean"

"ZeroCERT": {

"category": "harmless",

"engine_name": "ZeroCERT",

"method": "blacklist",

"result": "clean"

"desenmascara.me": {

"category": "harmless",

"engine_name": "desenmascara.me",

"method": "blacklist",

"result": "clean"

"malwares.com URL checker": {

"category": "harmless",

"engine_name": "malwares.com URL checker",

"method": "blacklist",

"result": "clean"

"securolytics": {

"category": "harmless",

"engine_name": "securolytics",

"method": "blacklist",

"result": "clean"

"zvelo": {

"category": "harmless",

"engine_name": "zvelo",

"method": "blacklist",

"result": "clean"

}

"last_analysis_stats": {

"harmless": 74,

"malicious": 0,

"suspicious": 2,

"timeout": 0,

"undetected": 0

"last_modification_date": 1601705254,

"network": "209.59.192.0/19",

"regional_internet_registry": "ARIN",

"reputation": 0,

"tags": [],

"total_votes": {

"harmless": 0,

"malicious": 0

"whois": "NetRange: 209.59.192.0 - 209.59.223.255\nCIDR: 209.59.192.0/19\nNetName: BIZLAND-FC02\nNetHandle: NET-209-59-192-0-1\nParent: NET209 (NET-209-0-0-0-0)\nNetType: Direct Allocation\nOriginAS: AS29873\nOrganization: The Endurance International Group, Inc. (EIG-12)\nRegDate: 2004-07-30\nUpdated: 2012-03-02\nRef: https://rdap.arin.net/registry/ip/209.59.192.0\nOrgName: The Endurance International Group, Inc.\nOrgId: EIG-12\nAddress: 10 Corporate Drive\nAddress: Suite 300\nCity: Burlington\nStateProv: MA\nPostalCode: 01803\nCountry: US\nRegDate: 2005-02-07\nUpdated: 2018-06-14\nRef: https://rdap.arin.net/registry/entity/EIG-12\nOrgTechHandle: EIGAR-ARIN\nOrgTechName: eig-arin\nOrgTechPhone: +1-866-897-5421 \nOrgTechEmail: eig-arin@endurance.com\nOrgTechRef: https://rdap.arin.net/registry/entity/EIGAR-ARIN\nOrgAbuseHandle: EIGAB-ARIN\nOrgAbuseName: eig-abuse\nOrgAbusePhone: +1-877-659-6181 \nOrgAbuseEmail: eig-abuse@endurance.com\nOrgAbuseRef: https://rdap.arin.net/registry/entity/EIGAB-ARIN\nOrgNOCHandle: ENO91-ARIN\nOrgNOCName: EIG Network Operations\nOrgNOCPhone: +1-877-659-6181 \nOrgNOCEmail: eig-noc@endurance.com\nOrgNOCRef: https://rdap.arin.net/registry/entity/ENO91-ARIN\n",

"whois_date": 1568088719

"id": "209.59.217.36",

"links": {

"self": "https://www.virustotal.com/api/v3/ip_addresses/209.59.217.36"

"type": "ip_address"

}

"links": {

"self": "https://www.virustotal.com/api/v3/search?query=209.59.217.36"

}

方便用來判斷該ip是否為惡意ip

https://developers.virustotal.com/reference

https://developers.virustotal.com/v3.0/reference

2019/11/28

這几天在玩MHN

感覺還不錯
不過有些地方要注意
試了好久

首先裝server
依照官網的說明沒什麼問題
我是用 ubuntu 18.04

再來是佈署 sensor

網頁介面上有提供deploy的script

官網上有提到有些sensor可以裝在centos
不過網頁介面上的都是for ubuntu跟 respberry pi
有很多sensor可以選擇
不同sensor有不同的功能
不過不是每個都可以用
這地方試了好久

最後我選了 Dionaea
官網上是說只能裝在 Ubuntu 14.04/Centos 7
其他版本有問題
不過我裝在ubuntu 18.04是ok的
只是安裝過程中碰到以下的問題

E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/universe/libe/libemu/libemu2_0.2.0+git20120122-1.2build1_amd64.deb 403 Forbidden [IP: 91.189.88.173 80]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

最後解決的方法是直接下載這個檔然後 dpkg -i
之後就沒問題了
介面還可以接受
資料是放在mongodb裡
也提供 rest可以撈
不過沒找到完整文件
另外就是直接使用mongoexport把資料撈出來
要注意的是mongodb時間是ISODate
如果用bash shell要記得轉換時間

date -u -Ins

每十分鐘從mongodb撈出資料

#!/bin/bash

date -d '10 mins ago' -u -Ins |cut -d ',' -f 1 > /tmp/time
echo "DBQuery.shellBatchSize = 3000000" > /tmp/get10min.js
echo "use mnemosyne" >> /tmp/get10min.js
echo 'db.session.find({"timestamp":{$gt:ISODate("'`cat /tmp/time`'")}})' >> /tmp/get10min.js

mongo < /tmp/get10min.js > /tmp/mhn_10min_data

https://github.com/pwnlandia/mhn

https://github.com/pwnlandia/mhn/wiki/List-of-Supported-Sensors

https://github.com/pwnlandia/mhn/wiki/MHN-REST-APIs

https://github.com/pwnlandia/mhn/wiki/Exporting-Honeypot-Data-from-MHN

https://www.itread01.com/content/1545640216.html

2018/11/13

fortiOS 5.2的REST有問題不要用

最近有個朋友問我有沒有用過fortiget rest的功能 5.2之後提供
其實之前就有再找
只是後來程式都直接用 ssh或telnet去下指令
既然有人問了
就再來找找

一閞始找到的這二個資料
可以查可以刪但不能新增也不能update
所以不要再浪費時間了

https://aimless.jp/blog/archives/2017-04-01-manageing-fortigate-by-rest-api/

https://pypi.org/project/PyFortiAPI/

直到後來找到這個完全沒問題啊而且也不用自己去寫jason格式而且反應速度相當快

https://github.com/DavidChayla/FortigateApi/blob/master/README.md

記錄一下用法

首先要下載回來後要先 import

import sys
sys.path.append('PATH TO FortigateApi.py')

再來依照文件說明

import FortigateApi

fg = FortigateApi.Fortigate('10.20.30.40', 'root', 'admin', 'mypasswd')

fg.AddFwAddress('srv-A','10.1.1.1/32')

200

fg.GetFwAddress('srv-A')

u'{\n "http_method":"GET",\n "results":[\n {\n "name":"srv-A",\n "q_origin_key":"srv-A",\n "uuid":"2103d064-d520-51e6-de84-16e9ab03b8ae",\n "subnet":"10.1.1.1 255.255.255.255",\n "type":"ipmask",\n "start-ip":"10.1.1.1",\n "end-ip":"255.255.255.255",\n "fqdn":"",\n "country":"",\n "url":"",\n "cache-ttl":0,\n "wildcard":"10.1.1.1 255.255.255.255",\n "comment":"",\n "visibility":"enable",\n "associated-interface":"",\n "color":0,\n "tags":[\n ]\n }\n ],\n "vdom":"dc2",\n "path":"firewall",\n "name":"address",\n "mkey":"srv-A",\n "status":"success",\n "http_status":200,\n "serial":"FWF90D3Z13003141",\n "version":"v5.2.9",\n "build":736\n}'

fg.SetFwAddress('srv-A','10.2.2.2/32')

200

fg.DelFwAddress('srv-A')

200

2018/03/29

graylog如果要export大量資料時百萬筆以上
不建議直接在web管理介面上Export as CSV
因為會花很多時間而且有可能導致管理介面當掉
建議使用rest
進到API browser後找到search keyword export
在網頁上輸入搜尋關鍵字時間欄位及限制輸出筆數
確認輸出沒問題
就可以複制語法
把limit刪除後使用curl來export
語法範例如下

curl -u user:passwd 'http://1.2.3.4:9000/api/search/universal/keyword/export?query=source%3A10.0.0.2%20&keyword=last%201%20day&fields=message' > log.csv

2018/01/04

今天打開graylog管理介面時出現新版本 2.4 更新的通知
想說來升看看會不會解決之前 REST 跟 export 的問題
升完後測了一下
目前看來都ok了
不過REST撈出來的格式跟之前不一樣
要改程式了

2017/12/22

接續之前的問題
因為rest一直怪怪的
所以目前只好手動下查詢
但又碰到另一個狀況
OR的條件下太多會當掉XD
目前試出來的結果是最多85筆
範例如下

accept AND (192.168.13.209 OR 192.168.13.30 OR 192.168.13.31 OR 192.168.50.48 OR 192.168.50.194 OR 192.168.10.100 OR 192.168.43.193 OR 192.168.1.103 OR 192.168.15.249 OR 192.168.15.252 OR 192.168.19.9 OR 192.168.15.17 OR 192.168.41.213 OR 192.168.34.96 OR 192.168.35.252 OR 192.168.35.251 OR 192.168.35.253 OR 192.168.35.250 OR 192.168.35.247 OR 192.168.35.248 OR 192.168.35.245 OR 192.168.35.249 OR 192.168.42.34 OR 192.168.41.219 OR 192.168.31.248 OR 192.168.30.47 OR 192.168.74.186 OR 192.168.35.246 OR 192.168.34.184 OR 192.168.31.241 OR 192.168.30.158 OR 192.168.30.244 OR 192.168.25.124 OR 192.168.15.23 OR 192.168.34.69 OR 192.168.26.63 OR 192.168.30.111 OR 192.168.31.239 OR 192.168.34.106 OR 192.168.34.245 OR 192.168.41.209 OR 192.168.41.229 OR 192.168.41.230 OR 192.168.25.217 OR 192.168.25.170 OR 192.168.42.222 OR 192.168.49.178 OR 192.168.50.181 OR 192.168.25.187 OR 192.168.73.12 OR 192.168.94.249 OR 192.168.95.250 OR 192.168.95.252 OR 192.168.95.253 OR 192.168.27.249 OR 192.168.27.245 OR 192.168.27.251 OR 192.168.27.244 OR 192.168.27.252 OR 192.168.27.250 OR 192.168.27.246 OR 192.168.27.248 OR 192.168.26.131 OR 192.168.26.31 OR 192.168.31.242 OR 192.168.31.240 OR 192.168.31.243 OR 192.168.31.244 OR 192.168.31.247 OR 192.168.31.246 OR 192.168.31.251 OR 192.168.31.252 OR 192.168.31.253 OR 192.168.27.243 OR 192.168.27.247 OR 192.168.4.130 OR 192.168.4.108 OR 192.168.15.21 OR 192.168.4.120 OR 192.168.4.121 OR 192.168.4.150 OR 192.168.4.110 OR 192.168.4.170 OR 192.168.4.190 OR 192.168.4.160)

2017/12/02

最近graylog出現一個狀況
不管是在網頁介面上要export查詢的資料或
在其他机器上使用curl透過rest來撈取
二者應該是相同的做法
都會很久
目前還找不到原因
不知是不是因為資料太多的關係
目前的資料
246 indices, 4,908,265,647 documents, 3.0TB

2017/03/10

graylog除了可以從console操作外
還提供了方便的REST API
讓使用者可以方便的使用文字介面 curl 就可以操作
所有提供的資料及相關語法
可以從管理介面得知
從右上角的目前message流量點入後就可以在畫面右方看到API BROWSER

以關鍵字搜尋為例
先在畫面上找到
Search/Keyword : Message search
再來點下List Operations
再點Message search with keyword as timerange

就會出現如下的畫面

有三個必填欄位

query 是關鍵字可以使用 AND NOT OR 跟管理介面搜尋相同
keyword是時間使用 relative 如 last 1 day 等
filelds是欄位使用message

填好後按下 Try it out!
接下來會問帳號密碼
打完送出後就會得到結果了

系統會給一個Request URL
可以複制起來之後只要修改相關參數就可以直接在程式上使用

http://1.2.3.4:9000/api/search/universal/keyword?query=success%20&keyword=Last%205%20minutes&fields=message

使用curl範例如下

curl -u username:password -H 'Accept: application/json' -X GET 'http://1.2.3.4:9000/api/search/universal/keyword?query=%22success%22&keyword=last%201%20hour&fields=message'

方便使用者不進web介面就可以搜尋

但要修改時網址的傳值必須使用ascii 16進位要留意

底下列出參考表及轉換網址

http://www.mikezilla.com/exp0012.html

http://ddddancer.blogspot.tw/2011/11/hex-url-encode.html

http://www.firesun.me/bian-ma-na-xie-shi-er-ascii/

訂閱：文章 (Atom)

2020/10/03

2019/11/28

2018/11/13

fortiOS 5.2的REST有問題 不要用

2018/03/29

2018/01/04

2017/12/22

2017/12/02

2017/03/10

fortiOS 5.2的REST有問題不要用