diff --git a/your_daily_dose_malware/commands/utils/retrieve_malware.py b/your_daily_dose_malware/commands/utils/retrieve_malware.py index bcc79e1..2824108 100644 --- a/your_daily_dose_malware/commands/utils/retrieve_malware.py +++ b/your_daily_dose_malware/commands/utils/retrieve_malware.py @@ -2,11 +2,13 @@ import requests import os + def hundred_most_recent(headers_info): - response = requests.post('https://mb-api.abuse.ch/api/v1/', data={'query':'get_recent','selector':'100'}, headers=headers_info) + response = requests.post('https://mb-api.abuse.ch/api/v1/', data={'query': 'get_recent', 'selector': '100'}, + headers=headers_info) json_response = response.json() if json_response['query_status'] == 'no_selector': - click.echo(' No selector provided. Please use either time or limit as selector',color=True) + click.echo(' No selector provided. Please use either time or limit as selector', color=True) if json_response['query_status'] == 'unknown_selector': click.echo(' Selector unknown. Please use either time or limit as selector') if json_response['query_status'] == 'no_results': @@ -18,32 +20,35 @@ def hundred_most_recent(headers_info): sha256_name = data['sha256_hash'] if os.path.exists(f'malware_{sha256_name[:4]}.zip'): continue - response = requests.post('https://mb-api.abuse.ch/api/v1/', data={'query':'get_file','sha256_hash':sha256_name}, headers=headers_info) + response = requests.post('https://mb-api.abuse.ch/api/v1/', + data={'query': 'get_file', 'sha256_hash': sha256_name}, headers=headers_info) with open(f'malware_{sha256_name[:4]}.zip', 'wb+') as f: f.write(response.content) click.echo(f' malware_{sha256_name[:4]}.zip downloaded') + def all_most_recent(headers_info): - response = requests.post('https://bazaar.abuse.ch/export/txt/sha256/recent', headers=headers_info) - with open('sha256_names.txt', 'wb+') as f: + response = requests.post('https://bazaar.abuse.ch/export/txt/sha256/recent', headers=headers_info) + with open('sha256_names.txt', 'wb+') as f: + f.write(response.content) + f.seek(0) # go back to the top of the file + new_hashes = list() + file_lines = [line.strip() for line in f.readlines()] + for index, line in enumerate(file_lines, start=0): + if index > 8 and index < len(file_lines) - 1: # skip the first 9 lines and last line + click.echo(line) + new_hashes.append(line) + continue + with open('sha256_names.txt', 'w') as f: + for line in new_hashes: + f.write(line.decode('utf-8') + '\n') + sha256_names = open('sha256_names.txt', 'r').readlines() + click.echo(f' {len(sha256_names)} hashes downloaded') + for sha256_hash in sha256_names: + if os.path.exists(f'malware_{sha256_hash[:4]}.zip'): + continue + response = requests.post('https://mb-api.abuse.ch/api/v1/', + data={'query': 'get_file', 'sha256_hash': sha256_hash}, headers=headers_info) + with open(f'malware_{sha256_hash[:4]}.zip', 'wb') as f: f.write(response.content) - f.seek(0) # go back to the top of the file - new_hashes = list() - file_lines = [line.strip() for line in f.readlines()] - for index, line in enumerate(file_lines,start=0): - if index > 8 and index < len(file_lines)-1: # skip the first 9 lines and last line - click.echo(line) - new_hashes.append(line) - continue - with open('sha256_names.txt', 'w') as f: - for line in new_hashes: - f.write(line.decode('utf-8') + '\n') - sha256_names = open('sha256_names.txt', 'r').readlines() - click.echo(f' {len(sha256_names)} hashes downloaded') - for sha256_hash in sha256_names: - if os.path.exists(f'malware_{sha256_hash[:4]}.zip'): - continue - response = requests.post('https://mb-api.abuse.ch/api/v1/', data={'query':'get_file','sha256_hash':sha256_hash}, headers=headers_info) - with open(f'malware_{sha256_hash[:4]}.zip', 'wb') as f: - f.write(response.content) - click.echo(f' malware_{sha256_hash[:4]}.zip downloaded') \ No newline at end of file + click.echo(f' malware_{sha256_hash[:4]}.zip downloaded') diff --git a/your_daily_dose_malware/main.py b/your_daily_dose_malware/main.py index 29a1799..e65ed9f 100644 --- a/your_daily_dose_malware/main.py +++ b/your_daily_dose_malware/main.py @@ -3,8 +3,10 @@ from .commands.utils.retrieve_malware import all_most_recent, hundred_most_recent from dotenv import load_dotenv import os + load_dotenv() + @click.command( help=""" Download eitheir hundred recent malwares uploaded within the last 60 min or all the recent malwares uploaded within the last 48 hours sha256 hash by using api from 'https://mb-api.abuse.ch/api/v1/' @@ -13,18 +15,19 @@ -hr or --hundred-recent: get the lastest hundred recent malwares uploaded within the last 60 min """) -@click.option('-s256','--by-sha256',is_flag=True) -@click.option('-hr','--hundred-recent',is_flag=True) +@click.option('-s256', '--by-sha256', is_flag=True) +@click.option('-hr', '--hundred-recent', is_flag=True) def run_scrapper(by_sha256, hundred_recent): headers = { - 'API-KEY':os.getenv('API_KEY') + 'API-KEY': os.getenv('API_KEY') } if hundred_recent: hundred_most_recent(headers) elif by_sha256: all_most_recent(headers) else: - click.echo(' No selector provided. Please use either by_sha256, hundred_recent as selector',) + click.echo(' No selector provided. Please use either by_sha256, hundred_recent as selector', ) + if __name__ == '__main__': scraper.add_command(run_scrapper)