-
Notifications
You must be signed in to change notification settings - Fork 33
/
VT_Domain_Scanner_py3.py
171 lines (140 loc) · 6.64 KB
/
VT_Domain_Scanner_py3.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
__author__ = 'Matthew Clairmont'
__version__ = '1.0'
__date__ = 'July 10, 2018'
# Remake of the Python 2.7 version
# VT Domain Scanner takes a file of domains, submits them to the Virus Total
# domain scanning API and outputs the domain and AV hits to a text file.
# If you have a private API key, you can change the sleep times to 1 for faster scanning
import time
import requests
import csv
apikey = '' #### ENTER API KEY HERE ####
requests.urllib3.disable_warnings()
client = requests.session()
client.verify = False
domainErrors = []
delay = {}
# scan the domain to ensure results are fresh
def DomainScanner(domain):
url = 'https://www.virustotal.com/vtapi/v2/url/scan'
params = {'apikey': apikey, 'url': domain}
# attempt connection to VT API and save response as r
try:
r = client.post(url, params=params)
except requests.ConnectTimeout as timeout:
print('Connection timed out. Error is as follows-')
print(timeout)
# sanitize domain after upload for safety
domainSani = domain.replace('.', '[.]')
print(domainSani)
print(r)
# handle ValueError response which may indicate an invalid key or an error with scan
# if an except is raised, add the domain to a list for tracking purposes
if r.status_code == 200:
try:
jsonResponse = r.json()
# print error if the scan had an issue
if jsonResponse['response_code'] is not 1:
print('There was an error submitting the domain for scanning.')
print(jsonResponse['verbose_msg'])
elif jsonResponse['response_code'] == -2:
print('{!s} is queued for scanning.'.format(domainSani))
delay[domain] = 'queued'
else:
print('{!s} was scanned successfully.'.format(domainSani))
except ValueError:
print('There was an error when scanning {!s}. Adding domain to error list....'.format(domainSani))
domainErrors.append(domain)
# return domain errors for notifying user when script completes
time.sleep(15) ############### IF YOU HAVE A PRIVATE ACCESS YOU CAN CHANGE THIS TO 1 ###################
return delay
# API TOS issue handling
elif r.status_code == 204:
print('Received HTTP 204 response. You may have exceeded your API request quota or rate limit.')
print('https://support.virustotal.com/hc/en-us/articles/115002118525-The-4-requests-minute-limitation-of-the-'
'Public-API-is-too-low-for-me-how-can-I-have-access-to-a-higher-quota-')
def DomainReportReader(domain, delay):
# sleep 15 to control requests/min to API. Public APIs only allow for 4/min threshold,
# you WILL get a warning email to the owner of the account if you exceed this limit.
# Private API allows for tiered levels of queries/second.
# check to see if we have a delay in the report being available
# if we do, delay for a little bit longer in hopes of the report being ready
if delay:
if domain in delay:
time.sleep(10)
url = 'https://www.virustotal.com/vtapi/v2/url/report'
params = {'apikey': apikey, 'resource': domain}
# attempt connection to VT API and save response as r
try:
r = client.post(url, params=params)
except requests.ConnectTimeout as timeout:
print('Connection timed out. Error is as follows-')
print(timeout)
exit(1)
# sanitize domain after upload for safety
domainSani = domain.replace('.', '[.]')
# handle ValueError response which may indicate an invalid key or an error with scan
# if an except is raised, add the domain to a list for tracking purposes
if r.status_code == 200:
try:
jsonResponse = r.json()
# print error if the scan had an issue
if jsonResponse['response_code'] is 0:
print('There was an error submitting the domain for scanning.')
pass
elif jsonResponse['response_code'] == -2:
print('Report for {!r} is not ready yet. Please check the site\'s report.'.format(domainSani))
else:
print('Report is ready for', domainSani)
# print(jsonResponse)
permalink = jsonResponse['permalink']
scandate = jsonResponse['scan_date']
positives = jsonResponse['positives']
total = jsonResponse['total']
data = [scandate, domainSani, positives, total, permalink]
return data
except ValueError:
print('There was an error when scanning {!s}. Adding domain to error list....'.format(domainSani))
domainErrors.append(domainSani)
except KeyError:
print('There was an error when scanning {!s}. Adding domain to error list....'.format(domainSani))
domainErrors.append(domainSani)
# API TOS issue handling
elif r.status_code == 204:
print('Received HTTP 204 response. You may have exceeded your API request quota or rate limit.')
print('https://support.virustotal.com/hc/en-us/articles/115002118525-The-4-requests-minute-limitation-of-the-'
'Public-API-is-too-low-for-me-how-can-I-have-access-to-a-higher-quota-')
time.sleep(10)
DomainReportReader(domain, delay)
# open results file and write header
try:
rfile = open('results.csv', 'w+', newline='')
dataWriter = csv.writer(rfile, delimiter = ',')
header = ['Scan Date', 'Domain', '# of Positive Scans', '# of Total Scans', 'Permalink']
dataWriter.writerow(header)
except IOError as ioerr:
print('Please ensure the file is closed.')
print(ioerr)
##### CHANGE TO TEXT FILE PATH. ONE DOMAIN PER LINE! #####
try:
# read domains from file and pass them to DomainScanner and DomainReportReader
with open('domains.txt', 'r') as infile: # keeping the file open because it shouldnt
# be opened/modified during reading anyway
for domain in infile:
domain = domain.strip('\n')
try:
delay = DomainScanner(domain)
data = DomainReportReader(domain, delay)
if data:
dataWriter.writerow(data)
time.sleep(15) # wait for VT API rate limiting
except Exception as err: # keeping it
print('Encountered an error but scanning will continue.', err)
except IOError as ioerr:
print('Please ensure the file is closed.')
print(ioerr)
# inform the user if there were any errors encountered
count = len(domainErrors)
if count > 0:
print('There were {!s} errors scanning domains'.format(count))
print(domainErrors)