diff --git a/README.md b/README.md index f5e656c..7fb566e 100644 --- a/README.md +++ b/README.md @@ -87,6 +87,26 @@ puts resp.scans ``` +### Domain Report +```ruby +# domain +resp = api.domain_report(domain) + +# confirm result +puts resp.detected_urls +``` + + +### IP address Report +```ruby +# IP address +resp = api.ip_report(ip) + +# confirm result +puts resp.detected_communicating_samples +``` + + ## Features ### Support API * file/scan @@ -94,10 +114,8 @@ puts resp.scans * file/report * url/scan * url/report - -### Not implemented yet -* ip-address/report * domain/report +* ip-address/report ### Unsupported * comments/puts diff --git a/lib/vtapi/api.rb b/lib/vtapi/api.rb index c3ce413..08acd77 100644 --- a/lib/vtapi/api.rb +++ b/lib/vtapi/api.rb @@ -55,10 +55,29 @@ def url_report(url) http_post('url/report', resource: url) end - def http_post(path, params = {}) + def ip_report(ip) + raise 'only one IP address can be scanned at a time' if ip.is_a? Array + http_get('ip-address/report', ip: ip) + end + + def domain_report(domain) + raise 'only one domain can be scanned at a time' if domain.is_a? Array + http_get('domain/report', domain: domain) + end + + def http_query(verb, path, params = { }) uri = BASE_URL + path params['apikey'] = @apikey - resp = RestClient.post(uri, params) do |resp, req, result, &block| + params = + case verb + when :get + { params: params } + when :post + params + else + raise "Unsupported verb: #{verb}" + end + resp = RestClient.send(verb, uri, params) do |resp, req, result, &block| case resp.code when 204 raise ExceedAPILimit, "you exceed the public API request rate limit: key[#{@apikey}]" @@ -70,4 +89,12 @@ def http_post(path, params = {}) end Response.parse(resp.body) end + + def http_get(path, params = {}) + http_query(:get, path, params) + end + + def http_post(path, params = {}) + http_query(:post, path, params) + end end diff --git a/spec/vtapi_spec.rb b/spec/vtapi_spec.rb index 90f7293..bfa80aa 100644 --- a/spec/vtapi_spec.rb +++ b/spec/vtapi_spec.rb @@ -169,6 +169,29 @@ end end + describe '#ip_report' do + let(:sample_response) { '{}' } + let(:api_url) { 'https://www.virustotal.com/vtapi/v2/ip-address/report?apikey=test%20apikey&ip=8.8.8.8' } + let(:target_ip) { '8.8.8.8' } + subject { api.ip_report(target_ip) } + it "should connect to 'https://www.virustotal.com/vtapi/v2/ip-address/report?apikey=test%20apikey&ip=8.8.8.8'" do + stub_request(:get, api_url) + .to_return(:body => sample_response, :status => 200) + subject + end + end + describe '#domain_report' do + let(:sample_response) { '{}' } + let(:api_url) { 'https://www.virustotal.com/vtapi/v2/domain/report?apikey=test%20apikey&domain=8.8.8.8' } + let(:target_domain) { '8.8.8.8' } + subject { api.domain_report(target_domain) } + + it "should connect to 'https://www.virustotal.com/vtapi/v2/domain/report?apikey=test%20apikey&domain=8.8.8.8'" do + stub_request(:get, api_url) + .to_return(:body => sample_response, :status => 200) + subject + end + end end