passivetotal 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d1844555714450cff7c7fdf042d3bd9888e300eb
-  data.tar.gz: a1b743c9a386b12981e533cbbcdfcd60568bcede
+  metadata.gz: 3a5c4295b8d9ad1670b868891fe25e1bdefd0b49
+  data.tar.gz: 1900ed9a136ea09cf7756f7119a4a59338ddc729
 SHA512:
-  metadata.gz: b154abc61be44ad6be8b96afcdaff311022d18722f26192d6cb498a31f872be038c7ffec72a5a8b1255ca378d30271b32419ea89282a3c514e9dc47c89cb92ba
-  data.tar.gz: 51432b063381d9169e6694577ff42eec84b7f58ca5dddfebcb767fdb4958fa715663193e7e162cfd477f3cc31f7f53a9981c113b29ddee9fcb0b157c448b294d
+  metadata.gz: 7aa3c8d247c8388b3f7b0c46b88cacc10110af9418b59937e850c6442db1990ee16f6a02fdcee9d561e37af989164a01aacb9205c12d7c4a3df0bd371c3ad74a
+  data.tar.gz: 06de2d45b2f0ad06af9ec828ec5029fe75900635084124ab0d5d069b16e5edb9b07435b073ac4b1753a8e2045943df9fedd3359fb1c677dd40ba94866ee10602

data/README.md

@@ -41,11 +41,13 @@ Included in the gem is a command-line tool, passivetotal, with the following usa
 	  -H <ip or hash> Queries for SSL certificate history associated with a given IP or SHA-1 hash
 	  -T <ip or dom>  Queries for Tracker information associated with a given IP or domain
 	  -o <ip or dom>  Queries for OSINT on a given IP or domain
+	  -M <ip or dom>  Queries for Malware sample records for a given IP or domain
 	SETTING VALUES  -i <value>      Sets the value, used in conjuntion with -c, -t, -e, -w, -d, or -x
 	                  Valid values for -i depend on what it's used with:
 	                  -c : malicious, non-malicious, suspicious, unknown
 	                  -t : <a tag name consisting of characters: [a-zA-Z_]>
 	                  -e, -w, -d, -x: true, false
+
 ## Usage
 
     # Initialize the API wrapper with an apikey (using the default endpoint URL of https://api.passivetotal.org/v2/)
@@ -61,7 +63,7 @@ Included in the gem is a command-line tool, passivetotal, with the following usa
     # query passive DNS results for the ipv4 address, 107.170.89.121
     res << @pt.passive('107.170.89.121')
     # query for subdomains of passivetotal.org
-    #res << @pt.subdomains('passivetotal.org')
+    res << @pt.subdomains('*.passivetotal.org')
     # query for unique IPv4 resolutions of passivetotal.org
     res << @pt.unique('passivetotal.org')
     # query for the classification of www.passivetotal.org
@@ -98,6 +100,10 @@ Included in the gem is a command-line tool, passivetotal, with the following usa
     res << @pt.ssl_certificate_history('e9a6647d6aba52dc47b3838c920c9ee59bad7034')
     # retrieve certificate history from IPv4 address of 52.8.228.23
     res << @pt.ssl_certificate_history('52.8.228.23')
+    # query for malware sample records by the domain "noorno.com"
+    res << @pt.malware("noorno.com")
+    # query for malware sample records by the ip addres 98.124.243.47
+    res << @pt.malware("98.124.243.47")
     # dump all this glorious information to feast your eyes upon
     pp res
 

data/lib/passivetotal/api.rb

@@ -330,7 +330,17 @@ module PassiveTotal # :nodoc:
         get('trackers/search', {'query' => query, 'type' => type})
       end
     end
-
+    
+    # malware: get sample information based from domain
+    # query: ip or domain
+    def malware(query)
+      is_valid_with_error(__method__, [:ipv4, :domain], query)
+      if domain?(query)
+        query = normalize_domain(query)
+      end
+      get('enrichment/malware', {'query' => query})
+    end
+ 
     private
     
     # returns true if the given string is a dotted quad IPv4 address

data/lib/passivetotal/cli.rb

@@ -35,6 +35,7 @@ module PassiveTotal # :nodoc:
         [ '--ssl_history', '-H', GetoptLong::REQUIRED_ARGUMENT ],
         [ '--trackers', '-T', GetoptLong::REQUIRED_ARGUMENT ],
         [ '--osint', '-o', GetoptLong::REQUIRED_ARGUMENT ],
+        [ '--malware', '-M', GetoptLong::REQUIRED_ARGUMENT ],
         [ '--set', '-i', GetoptLong::REQUIRED_ARGUMENT ]
       )
       
@@ -96,6 +97,9 @@ module PassiveTotal # :nodoc:
         when '--osint'
           options[:method] = :osint
           options[:query] = arg
+        when '--malware'
+          options[:method] = :malware
+          options[:query] = arg
         when '--set'
           options[:set] = arg.dup
         else
@@ -149,6 +153,7 @@ module PassiveTotal # :nodoc:
       help_text << "  -H <ip or hash> Queries for SSL certificate history associated with a given IP or SHA-1 hash\n"
       help_text << "  -T <ip or dom>  Queries for Tracker information associated with a given IP or domain\n"
       help_text << "  -o <ip or dom>  Queries for OSINT on a given IP or domain\n"
+      help_text << "  -M <ip or dom>  Queries for Malware sample records for a given IP or domain\n"
       help_text << "SETTING VALUES"
       help_text << "  -i <value>      Sets the value, used in conjuntion with -c, -t, -e, -w, -d, or -x\n"
       help_text << "                  Valid values for -i depend on what it's used with:\n"

data/lib/passivetotal/version.rb

@@ -1,3 +1,3 @@
 module PassiveTotal
-  VERSION = "1.0.0"
+  VERSION = "1.0.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: passivetotal
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - chrislee35