Class: ThreatExpert::Search

Inherits:
Object
  • Object
show all
Defined in:
lib/threatexpert/search.rb

Constant Summary collapse

@@baseurl = 
'http://www.threatexpert.com'

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Search

Returns a new instance of Search.



8
9
 
# File 'lib/threatexpert/search.rb', line 8

def initialize
end

Instance Method Details

#_parse_list(nextpage) ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
 
# File 'lib/threatexpert/search.rb', line 21

def _parse_list(nextpage)
	hashes = []
	while nextpage
		page = open(nextpage).read
		nextpage = nil
		n = Nokogiri::HTML.parse(page)
		n.xpath('//a').each do |a|
			if a['href'] =~ /report\.aspx\?md5=([0-9a-fA-F]{32,128})/
				hashes << $1
			elsif a.text == 'Next'
				nextpage = "http://www.threatexpert.com/"+a['href']
			end
		end
	end
	hashes
end

#_parse_report(page) ⇒ Object 



38
39
40
41
42
 
# File 'lib/threatexpert/search.rb', line 38

def _parse_report(page)
	page = open(page).read
	return nil if page =~ /<status>not_found<\/status>/
	Crack::XML.parse(page)
end

#md5(hash) ⇒ Object 



11
12
13
14
 
# File 'lib/threatexpert/search.rb', line 11

def md5(hash)
	url = @@baseurl+"/report.aspx?md5=#{hash}&xml=1"
	_parse_report(url)
end

#name(mwname) ⇒ Object 



16
17
18
19
 
# File 'lib/threatexpert/search.rb', line 16

def name(mwname)
	url = @@baseurl+"/reports.aspx?find=#{mwname}"
	_parse_list(url)
end