《云安全》在线系列讲座之二 --- 人云亦云

显示全部楼层 · 发表于 2011-3-21 15:03:25

nkspark 发表于 2011-3-21 07:13
讲座一参见：《云安全》在线系列讲座之一 --- 云安全基本概念，http://bbs.kafan.cn/thread-934671-1 ...

如果你有一个样本，能够被某个杀毒软件查出，却没有被本首席的这款全球最强软件查出的话，本首席直接把面前的显示器吃了。

很不幸，这样的样本很多，你需要吃显示器了。

显示全部楼层 · 发表于 2011-3-21 15:09:43

很抱歉，吃显示器吧

显示全部楼层 · 发表于 2011-3-21 15:09:47

回复 21楼 jefffire 的帖子

是用vt的API接口吧

显示全部楼层 · 发表于 2011-3-21 15:12:26

What is the VirusTotal API?
The VirusTotal API lets you upload and scan files, submit and scan URLs, access finished scan reports and make automatic comments on URLs or samples without the need of using the HTML website interface. In other words, it allows you to build simple scripts to access the information generated by VirusTotal.

The chosen format for the API is HTTP POST requests with JSON object responses and it is limited to at most 20 requests of any nature in a given 5 minutes time frame. If you run a honeyclient, honeypot or any other automation that is going to provide resources to VirusTotal and not only retrieve reports you are entitled to a special API with a higher request rate quota, ask for it at info@virustotal.com. The public API is a free service, available for any web site or application that is free to consumers.

The API must not be used in commercial products or services, it can not be used as a substitute for antivirus products and it can not be integrated in any project that may harm the antivirus industry directly or indirectly. Noncompliance of these terms will result in inmediate permanent ban of the infractor individual or organization. Please see the terms of use for more information.

How do I start?
The process could not be easier. Sign up to VT Community (using the sign in box at the top left hand side of the page). Once you have a valid VT Community account, you will find your personal API key in the inbox of your account (sign in and drop down the My account menu). This key is all you need to use VirusTotal's API.

So what can I do with the VirusTotal API?
The following examples show how to perform specific tasks with the API, the examples are coded in Python, but take into account that they work with any coding language, you just need to be able to perform HTTP requests and load JSON objects. Some implementations of the API in other languages can be found at the bottom of this page.

Note that the API response format will always be a dictionary containing at least a result field. If the item you searched for was not present this result will be 0, if you exceeded the public API request rate it will be -2, if the API key provided is incorrect it will be -1, any other case is detailed in the following sections.

显示全部楼层 · 发表于 2011-3-21 15:14:57

本帖最后由李白vs苏轼于 2011-3-21 15:27 编辑

Using VirusTotal API with Java

JVirusTotal vt = new JVirusTotal(your_API_key);
String url = "http://www.x.x";
// submit an URL
vt.submitScanURL(url);
// retrieve an URL scan report
vt.retrieveURLscan(url);
// retrieve a file scan report
vt.retrieveFilescan(getMD5Sum(new URL(url)));
The following class is used to get the MD5 hash of a file, by giving its URL.
import java.io.IOException;
import java.io.InputStream;
import java.math.BigInteger;
import java.net.MalformedURLException;
import java.net.URL;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
public class md5 {
/**
* it calculates the md5sum
*
* @param url file url
* @return md5sum
*/
public static String getMD5Sum(URL url) {
MessageDigest digest = null;
try {
digest = MessageDigest.getInstance("MD5");
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
}
byte[] buffer = new byte[8192];
int read = 0;
String output = "";
InputStream is = null;
try {
is = url.openStream();
while( (read = is.read(buffer)) > 0) {
digest.update(buffer, 0, read);
}
byte[] md5sum = digest.digest();
BigInteger bigInt = new BigInteger(1, md5sum);
output = bigInt.toString(16);
}
catch(IOException e) {
e.printStackTrace();
} finally {
try {
is.close();
} catch(IOException e) {
e.printStackTrace();
}
}
return output;
}
public static void main (String[] s) throws MalformedURLException{
System.out.println(getMD5Sum(new URL("http://www.x.x")));
}
}

复制代码

显示全部楼层 · 发表于 2011-3-21 15:23:30

nkspark 发表于 2011-3-21 07:13
讲座一参见：《云安全》在线系列讲座之一 --- 云安全基本概念，http://bbs.kafan.cn/thread-934671-1 ...

本来以为你是不懂。才发现原来您是混看雪论坛的。对装糊涂的人，我表示遗憾

显示全部楼层 · 发表于 2011-3-21 15:28:50

jefffire 发表于 2011-3-21 15:03
如果你有一个样本，能够被某个杀毒软件查出，却没有被本首席的这款全球最强软件查出的话，本首席直接把面 ...

空口无凭啊，上图，上样本...

显示全部楼层 · 发表于 2011-3-21 15:29:07

sevenday 发表于 2011-3-21 15:09
很抱歉，吃显示器吧

空口无凭啊，上图，上样本...

显示全部楼层 · 发表于 2011-3-21 15:32:12

本帖最后由李白vs苏轼于 2011-3-21 15:47 编辑

首席,为啥在我这里就一闪而过什么也没有呢

显示全部楼层 · 发表于 2011-3-21 15:32:29

楼主看来还是有点低调的, 还没用原创标签.

不过还是得到一个魅力呀

[技术原创] 《云安全》在线系列讲座之二 --- 人云亦云