From 227db64617feebfcd5be37300f85f97febe1c74d Mon Sep 17 00:00:00 2001 From: blacktop Date: Fri, 11 Nov 2016 12:00:27 -0700 Subject: [PATCH] clean up --- Dockerfile.dev | 23 ----------------------- Makefile | 2 -- README.md | 30 ++++++++++++++++++++++-------- circle.yml | 13 +++++++------ virustotal.go | 38 ++++++++++++++++---------------------- 5 files changed, 45 insertions(+), 61 deletions(-) delete mode 100644 Dockerfile.dev diff --git a/Dockerfile.dev b/Dockerfile.dev deleted file mode 100644 index 865a49e..0000000 --- a/Dockerfile.dev +++ /dev/null @@ -1,23 +0,0 @@ -FROM malice/alpine - -MAINTAINER blacktop, https://github.com/blacktop - -COPY . /go/src/github.com/maliceio/malice-virustotal -RUN apk-install ca-certificates -RUN apk-install -t build-deps go git mercurial \ - && set -x \ - && echo "Building virustotal Go binary..." \ - && cd /go/src/github.com/maliceio/malice-virustotal \ - && mv docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh \ - && export GOPATH=/go \ - && go version \ - && go get \ - && go build -ldflags "-X main.Version=$(cat VERSION) -X main.BuildTime=$(date -u +%Y%m%d)" -o /bin/virustotal \ - && rm -rf /go /tmp/* \ - && apk del --purge build-deps - -WORKDIR /malware - -ENTRYPOINT ["docker-entrypoint.sh"] - -CMD ["--help"] diff --git a/Makefile b/Makefile index 1573237..cb06a4a 100644 --- a/Makefile +++ b/Makefile @@ -7,10 +7,8 @@ dev: docker run --rm $(NAME):dev $(DEV_RUN_OPTS) build: - rm -rf build && mkdir build docker build -t $(NAME):$(VERSION) . sed -i.bu 's/docker image-.*-blue/docker image-$(shell docker images --format "{{.Size}}" $(NAME):$(VERSION))-blue/g' README.md - docker save $(NAME):$(VERSION) | gzip -9 > build/$(NAME)_$(VERSION).tgz release: rm -rf release && mkdir release diff --git a/README.md b/README.md index 4a963a0..c06428d 100644 --- a/README.md +++ b/README.md @@ -54,9 +54,10 @@ Commands: Run 'virustotal COMMAND --help' for more information on a command. ``` -This will output to stdout and POST to malice results API webhook endpoint. +Sample Output +------------- -### Sample Output JSON: +### JSON: ```json { @@ -157,7 +158,7 @@ This will output to stdout and POST to malice results API webhook endpoint. } ``` -### Sample Output STDOUT (Markdown Table): +### STDOUT (Markdown Table): --- @@ -169,20 +170,33 @@ This will output to stdout and POST to malice results API webhook endpoint. --- +Documentation +------------- + ### To write results to [ElasticSearch](https://www.elastic.co/products/elasticsearch) ```bash $ docker volume create --name malice -$ docker run -d -p 9200:9200 -v malice:/data --name elastic elasticsearch -$ docker run --rm --link elastic malice/virustotal --api APIKEY lookup HASH +$ docker run -d --name elastic \ + -p 9200:9200 \ + -v malice:/usr/share/elasticsearch/data \ + blacktop/elasticsearch +$ docker run --rm --link elastic malice/virustotal HASH ``` - -### Documentation - ### Issues Find a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to [file an issue](https://github.com/maliceio/malice-virustotal/issues/new) and I'll get right on it. +### CHANGELOG + +See [`CHANGELOG.md`](https://github.com/maliceio/malice-virustotal/blob/master/CHANGELOG.md) + +### Contributing + +[See all contributors on GitHub](https://github.com/maliceio/malice-virustotal/graphs/contributors). + +Please update the [CHANGELOG.md](https://github.com/maliceio/malice-virustotal/blob/master/CHANGELOG.md) and submit a [Pull Request on GitHub](https://help.github.com/articles/using-pull-requests/). + ### ToDo - [ ] Add docs like [registrator](http://gliderlabs.com/registrator/latest/#getting-registrator) diff --git a/circle.yml b/circle.yml index dc1b70d..dbec8c9 100644 --- a/circle.yml +++ b/circle.yml @@ -3,16 +3,17 @@ machine: - docker dependencies: - pre: - - make circleci + cache_directories: + - "~/docker" override: - - make build - post: - - cp build/* $CIRCLE_ARTIFACTS + - docker info + - if [[ -e ~/docker/image.tar ]]; then docker load --input ~/docker/image.tar; fi + - docker build -t malice_vt . + - mkdir -p ~/docker; docker save malice_vt > ~/docker/image.tar test: override: - - /bin/true + - docker run malice_vt --help deployment: # master: diff --git a/virustotal.go b/virustotal.go index 8805512..edcdc99 100644 --- a/virustotal.go +++ b/virustotal.go @@ -275,9 +275,6 @@ func main() { app.Version = Version + ", BuildTime: " + BuildTime app.Compiled, _ = time.Parse("20060102", BuildTime) app.Usage = "Malice VirusTotal Plugin" - var apikey string - var elasitcsearch string - var table bool app.Flags = []cli.Flag{ cli.BoolFlag{ Name: "verbose, V", @@ -294,23 +291,20 @@ func main() { EnvVar: "MALICE_PROXY", }, cli.BoolFlag{ - Name: "table, t", - Usage: "output as Markdown table", - Destination: &table, + Name: "table, t", + Usage: "output as Markdown table", }, cli.StringFlag{ - Name: "api", - Value: "", - Usage: "VirusTotal API key", - EnvVar: "MALICE_VT_API", - Destination: &apikey, + Name: "api", + Value: "", + Usage: "VirusTotal API key", + EnvVar: "MALICE_VT_API", }, cli.StringFlag{ - Name: "elasitcsearch", - Value: "", - Usage: "elasitcsearch address for Malice to store results", - EnvVar: "MALICE_ELASTICSEARCH", - Destination: &elasitcsearch, + Name: "elasitcsearch", + Value: "", + Usage: "elasitcsearch address for Malice to store results", + EnvVar: "MALICE_ELASTICSEARCH", }, } app.Commands = []cli.Command{ @@ -321,7 +315,7 @@ func main() { ArgsUsage: "FILE to upload to VirusTotal", Action: func(c *cli.Context) error { // Check for valid apikey - if apikey == "" { + if c.String("api") == "" { log.Fatal(fmt.Errorf("Please supply a valid VT_API key with the flag '--api'.")) } if c.Bool("verbose") { @@ -334,7 +328,7 @@ func main() { utils.Assert(err) } // upload file to virustotal.com - scanFile(path, apikey) + scanFile(path, c.String("api")) } else { log.Fatal(fmt.Errorf("Please supply a file to upload to VirusTotal.")) } @@ -348,7 +342,7 @@ func main() { ArgsUsage: "MD5/SHA1/SHA256 hash of file", Action: func(c *cli.Context) error { // Check for valid apikey - if apikey == "" { + if c.String("api") == "" { log.Fatal(fmt.Errorf("Please supply a valid VT_API key with the flag '--api'.")) } if c.Bool("verbose") { @@ -357,10 +351,10 @@ func main() { if c.Args().Present() { hash := c.Args().First() - vtReport := lookupHash(hash, apikey) + vtReport := lookupHash(hash, c.String("api")) // upsert into Database - elasticsearch.InitElasticSearch() + elasticsearch.InitElasticSearch(c.String("elasitcsearch")) elasticsearch.WritePluginResultsToDatabase(elasticsearch.PluginResults{ ID: utils.Getopt("MALICE_SCANID", hash), Name: name, @@ -368,7 +362,7 @@ func main() { Data: vtReport, }) - if table { + if c.Bool("table") { printMarkDownTable(vtReport) } else { vtJSON, err := json.Marshal(vtReport)