Jump to content

Recommended Posts

Hi,

I've written a simple function to send a File hash to virus total with HTTP.au3 UDF but it doesn't work. This is the function:

#Include <HTTP.au3>
Func VThash ($hash, $apikey = '[MY API KEY (can't display)]')
    $host = 'www.virustotal.com'
    $page = '/api/scan_file.json'
    $apikeyencode = _HTTPEncodeString($apikey)
    $hashencode = _HTTPEncodeString($hash)
    $socket = _HTTPConnect(host)
    $data = 'resource: '&$hashencode&@CRLF&'key: '&$apikeyencode
    _HTTPPost($host, $page, $socket, $data)
    $info = _HTTPRead($socket, 3)
    _HTTPClose($socket)
    return $info
EndFunc

and this is a piece of code for testing:

#Include <VT.au3>
$info = VThash('7ae26902586cfbd5b246f5e45e14458b')
msgbox(0, "test", $info)

and this is the tcp stream :

POST /api/scan_file.json HTTP/1.1
Host: www.virustotal.com
User-Agent: AutoItScript/3.3.6.1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 113

resource: 7ae26902586cfbd5b246f5e45e14458b
key: [MY API KEY (can't display)]
HTTP/1.0 200 OK
Date: Thu, 14 Jul 2011 14:57:18 GMT
Server: Apache
Content-Length: 14
Content-Type: text/html
X-Cache: MISS from viruskill2.hispasec.com
Via: 1.1 viruskill2.hispasec.com:80 (squid/2.7.STABLE9)
Connection: close

{"result": -1}

I get 0 in the messagebox. I think it's because virustotal need HTTPS connexion, so I want to know how to do a https connection using HTTP.au3, and what else I have to do.

Thanks in advance,

Servabat

Link to post
Share on other sites

Hi i try to wrote something for VirusTotal too... but i don`t nothing about winHTTP and is not easy learn it, but i have how retrieve the report from a hash.

Says thanks to Chefito he`s the one who write this.

#include "WinHttp.au3"

    Opt("MustDeclareVars", 1)

    ; Initialize and get session handle
    Global $hOpen = _WinHttpOpen()
    ; Get connection handle
    Global $hConnect = _WinHttpConnect($hOpen, "www.virustotal.com")

    ; Simple-request it...
    MsgBox(64, "Resultados del anĂ¡lisis", _WinHttpSimpleRequest($hConnect, "POST", "/api/get_file_report.json", Default, "resource=779f2f7623a90dac3197b11f802c87ff063efcaf4a67b234b0d25f0ffa66fe9c&key=5e667a8e7bdbf27c42038500ff995b0840f1e68966cacdafc49c402aaa077a50"))

    ; Close handles
    _WinHttpCloseHandle($hConnect)
    _WinHttpCloseHandle($hOpen)

And a version with object winhttp.winhttprequest.5.1:

$oHTTP = ObjCreate("winhttp.winhttprequest.5.1")
    $oHTTP.Open("POST","http://www.virustotal.com/api/get_file_report.json")
    $oHTTP.Send(StringToBinary("resource=779f2f7623a90dac3197b11f802c87ff063efcaf4a67b234b0d25f0ffa66fe9c&key=5e667a8e7bdbf27c42038500ff995b0840f1e68966cacdafc49c402aaa077a50"))
    $HTMLSource = $oHTTP.Responsetext
    MsgBox(0,"RESULTADO",$HTMLSource)
Edited by monoscout999
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...