安全分析的几个好的工具网站的使用

最近在工作中还是遇到了一些攻击者追查等等事情，结合自己过去做过一年的安全分析师的经验，对几款比较好的追踪溯源网站的使用做一个简介。

一、关联神器passivetotal

1、网址：https://community.riskiq.com/

2、简介：常用来搜索IP、Domain、URL、whois信息、ipwhois信息等，是一个存储数量比较全面，信息量较大，而且可以和时间关联分析。实现这些维度的互查反查是很重要的一个功能。需要注册哦。

3、截图：

二、样本神器virustotal

1、网址：https://www.virustotal.com/#/home/upload

2、简介：可以查询样本在多家杀毒引擎的扫描检测结果，另外可以查询IP、url、hash，这样可以关联下载downloadurl 、恶意域名、IP，以及恶意的样本hash。（注册之后可付费，在线样本可下载）

3、截图：

4、自己查看vt文档写的一个apilib库

#!/usr/bin/env python
#-*-coding:UTF-8-*-
#引入头文件
import os
import sys
import json
import urllib
import urllib2
import hashlib
import postfile
import simplejson

#全局变量
#APIKEY = None
APIKEY = '033e1a2ae071f8800d558a968717c2674f8eb728cfb6b470d4713dd744600fb7'
MYVTOBJ = None
CRONTOL_BIT = 0
#创建VirusTotal类
class VirusTotal:
    def __init__(self,apikey):
        self.virus_dict = {}
        self.apikey = apikey
        
    def get_virus_dict(self):
        return self.virus_dict
        
    def upload_one_check_file(self,check_file):
        check_host = "www.virustotal.com"
        selector = "https://www.virustotal.com/vtapi/v2/file/scan"
        fields = [("apikey",self.apikey)]
        file_name = os.path.basename(check_file)
        try:
            file_to_check = open(check_file,'rb').read()
        except Exception,ex:
            #log.log(ex,3,1)
            return (-1,ex)
        file_struct = [("file",file_name,file_to_check)]
        try:
            result_json = postfile.post_multipart(check_host,selector,fields,file_struct)
        except Exception,ex:
            #log.log(ex,3,2)
            return (-1,ex)
        return result_json
        
    def upload_check_files(self,files_list):
        result_json_list = []
        if len(files_list) <= 0:
            return (-1,'files_list error')
        for item in files_list:
            ret = self.quick_check(item)
            result_json_list.append(ret)
        return result_json_list
        
    def check_file_rescan(self,scanid):
        url = "https://www.virustotal.com/vtapi/v2/file/rescan"
        scanid_string = None
        if type(scanid) is list:
            for item in scanid:
                scanid_string += str(item)+','
            scanid_string = scanid_string[0:-1]
            parameters = {"resource":scanid_string,"apikey":self.apikey}
            try:
                data = urllib.urlencode(parameters)
                check_request = urllib2.Request(url,data)  
                response = urllib2.urlopen(check_request)  
                result_json = response.read()
            except Exception,ex:
                ##log.log(ex,3,2)
                return (-1,ex)
            return result_json
        parameters = {"resource":scanid,"apikey":self.apikey}
        try:
            data = urllib.urlencode(parameters)  
            check_request = urllib2.Request(url,data)  
            response = urllib2.urlopen(check_request)  
            result_json = response.read()
        except Exception,ex:
            #log.log(ex,3,2)
            return (-1,ex)
        return result_json
    
    def quick_check(self,check_file):
        file_md5 = None
        print str(check_file)
        with open(str(check_file),'rb') as f:
            file_md5 = hashlib.md5()
            file_md5.update(f.read())
            file_md5 = file_md5.hexdigest()
        ret = self.upload_one_check_file(check_file)
        if ret.find('Error 400') >= 0:
            ret = self.check_file_rescan(file_md5)
        ret = simplejson.loads(ret)
        return ret["sha256"]

    def get_report(self,scanid):
        url = "https://www.virustotal.com/vtapi/v2/file/report"  
        parameters = {"resource":scanid,"apikey":self.apikey}
        try:
            data = urllib.urlencode(parameters)  
            report_requset = urllib2.Request(url,data)  
            response = urllib2.urlopen(report_requset)  
            result_json = response.read()
        except Exception,ex:
            #log.log(ex,3,2)
            return (-1,ex)
        return result_json

    def get_report_from_designated_company(self,company,scanid):
        url = "https://www.virustotal.com/vtapi/v2/file/report"  
        parameters = {"resource":scanid,"apikey":self.apikey}
        try:
            data = urllib.urlencode(parameters)  
            report_request = urllib2.Request(url,data)  
            response = urllib2.urlopen(report_request)  
            result_json = response.read()    
            response_dict = simplejson.loads(result_json)
        except Exception,ex:
            #log.log(ex,3,2)
            return (-1,ex)
        return response_dict.get("scans",{}).get(company,{}).get("result")
        
    def url_check(self,check_url):
        url = "https://www.virustotal.com/vtapi/v2/url/scan"
        check_urls = None
        if type(check_url) is list:
            for item in check_url:
                check_urls += str(item)+'
'
            check_urls = check_urls[0:-1]
            parameters = {"url":check_urls,"apikey":self.apikey} 
            try:
                data = urllib.urlencode(parameters)  
                url_check_request = urllib2.Request(url,data)  
                response = urllib2.urlopen(url_check_request)  
                result_json = response.read() 
            except Exception,ex:
                #log.log(ex,3,2)
                return (-1,ex)
            return result_json
        check_urls = str(check_url)
        parameters = {"url":check_urls,"apikey":self.apikey}  
        try:
            data = urllib.urlencode(parameters)  
            url_check_request = urllib2.Request(url,data)  
            response = urllib2.urlopen(url_check_request)  
            result_json = response.read()  
        except Exception,ex:
            #log.log(ex,3,2)
            return (-1,ex)
        return result_json  
        
    def get_url_report(self,check_url):
        url = "https://www.virustotal.com/vtapi/v2/url/report"
        check_urls = None
        if type(check_url) is list:
            for item in check_url:
                check_urls += str(item)+','
            check_urls = check_urls[0:-1]
            parameters = {"resource": "http://www.sohu.com","apikey":self.apikey,"scan":"1"}  
            try:
                data = urllib.urlencode(parameters)  
                url_check_request = urllib2.Request(url,data)  
                response = urllib2.urlopen(url_check_request)  
                result_json = response.read()
            except Exception,ex:
                #log.log(ex,3,2)
                return (-1,ex)
            return result_json
        check_urls = str(check_url)
        parameters = {"resource":check_urls,"apikey":self.apikey}  
        try:
            data = urllib.urlencode(parameters)  
            url_check_request = urllib2.Request(url,data)  
            response = urllib2.urlopen(url_check_request)  
            result_json = response.read()
        except Exception,ex:
            #log.log(ex,3,2)
            return (-1,ex)
        return result_json

    def get_url_report_from_designated_company(self,check_url,company):
        url = "https://www.virustotal.com/vtapi/v2/url/report"
        check_urls = str(check_url)
        parameters = {"resource":check_urls,"apikey":self.apikey}  
        try:
            data = urllib.urlencode(parameters)  
            url_check_request = urllib2.Request(url,data)  
            response = urllib2.urlopen(url_check_request)  
            result_json = response.read()
        except Exception,ex:
            #log.log(ex,3,2)
            return (-1,ex)
        response_dict = simplejson.loads(result_json)  
        return response_dict.get('scans',{}).get(company).get('result')
    
    def ip_check(self,ip):
        url = 'https://www.virustotal.com/vtapi/v2/ip-address/report'  
        parameters = {'ip':ip,'apikey':self.apikey}  
        try:
            response = urllib.urlopen('%s?%s'%(url,urllib.urlencode(parameters))).read()  
            response_dict = json.loads(response)
        except Exception,ex:
            #log.log(ex,3,2)
            return (-1,ex)
        return response_dict 
        
    def domain_check(self,domain):
        url = 'https://www.virustotal.com/vtapi/v2/domain/report'  
        parameters = {'domain':domain,'apikey':self.apikey}
        try:
            response = urllib.urlopen('%s?%s'%(url,urllib.urlencode(parameters))).read()  
            response_dict = json.loads(response)  
        except Exception,ex:
            #log.log(ex,3,2)
            return (-1,ex)
        return  response_dict 


#快速使用函数
def vtocq():
    global APIKEY
    global MYVTOBJ
    global CRONTOL_BIT
    if CRONTOL_BIT != 0:
        return ('-2','ERROR')
    if APIKEY != None:
        MYVTOBJ = VirusTotal(APIKEY)
    else:
        return ('-1','APIKEY information set error!')
    CRONTOL_BIT = 1
    return MYVTOBJ
    
def fcq(file_check,hash_sha1):
    global MYVTOBJ
    ret = MYVTOBJ.quick_check(file_check)
    ret = MYVTOBJ.get_report(hash_sha1) 
    ret = simplejson.loads(ret)
    vtnumber = ret['positives']
    av_macfee = ret['scans']['McAfee']['result']
    av_bkav = ret['scans']['Bkav']['result']
    av_360 = ret['scans']['Qihoo-360']['result']
    ret = { 
        "vtnumber":vtnumber,
        "av_360":av_360,
        "av_bkav":av_bkav,
        "av_macfee":av_macfee
    }
    return ret
    
def vt_check(filecheck,hash_sha1):
    vtocq()
    ret = fcq(filecheck,hash_sha1)
    print ret
    return ret
    
#vt_check('C://PuTTY//plink.exe')
MYVTOBJ = VirusTotal(APIKEY)
print MYVTOBJ.domain_check("lx.com")

三、其他工具：

1、站长之家--站长工具：做一些域名、IP、注册邮箱等信息的关联查询。

2、www.ipip.net：做一些IP地理信息查询。