Class: ThreatExpert::Search

Inherits:
Object
  • Object
show all
Defined in:
lib/threatexpert/search.rb

Constant Summary collapse

@@baseurl = 
'http://www.threatexpert.com'

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Search

Returns a new instance of Search.



8
9
 
# File 'lib/threatexpert/search.rb', line 8

def initialize
end

Instance Method Details

#_parse_list(nextpage) ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
 
# File 'lib/threatexpert/search.rb', line 21

def _parse_list(nextpage)
  hashes = []
  while nextpage
    page = open(nextpage).read
    nextpage = nil
    n = Nokogiri::HTML.parse(page)
    n.xpath('//a').each do |a|
      if a['href'] =~ /report\.aspx\?md5=([0-9a-fA-F]{32,128})/
        hashes << $1
      elsif a.text == 'Next'
        nextpage = "http://www.threatexpert.com/"+a['href']
      end
    end
  end
  hashes
end

#_parse_report(page) ⇒ Object 



38
39
40
41
42
 
# File 'lib/threatexpert/search.rb', line 38

def _parse_report(page)
  page = open(page).read
  return nil if page =~ /<status>not_found<\/status>/
  Crack::XML.parse(page)
end

#md5(hash) ⇒ Object 



11
12
13
14
 
# File 'lib/threatexpert/search.rb', line 11

def md5(hash)
  url = @@baseurl+"/report.aspx?md5=#{hash}&xml=1"
  _parse_report(url)
end

#name(mwname) ⇒ Object 



16
17
18
19
 
# File 'lib/threatexpert/search.rb', line 16

def name(mwname)
  url = @@baseurl+"/reports.aspx?find=#{mwname}"
  _parse_list(url)
end