-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathVT v4.ps1
48 lines (38 loc) · 1.26 KB
/
VT v4.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
While($TRUE){
function Get-VT {
[CmdletBinding()]
#https://github.com/jkerai1/VirusTotal-IP-powershell
param ([Parameter(Mandatory=$true)] $I)
$I = $I.Trim()
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Function submit-VT($I)
{
$VTbody = @{resource = $I;}
$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("x-apikey", "KEY GOES HERE")
$VTResult = Invoke-WebRequest -Uri "https://www.virustotal.com/api/v3/ip_addresses/$I" -Method GET -Headers $headers
return $VTResult}
$VTresult = submit-VT($I)
#Write-Host $VTresult
$data = ConvertFrom-Json $VTresult
if ([int]$data.data.attributes.last_analysis_stats.malicious -gt 0) { $outcome = "`nThis IP has a malicious rating. Blacklisting is advised."}
else {$outcome = "`nThis IP has a neutral reputation on VirusTotal.`n"}
## Display results
Function DisplayResults(){
Write-Host "=======================================================================`n"
$mystring = @"
Source IP: $I
Country: $($data.data.attributes.country)
ASN: $($data.data.attributes.as_owner)
VirusTotal URL: https://www.virustotal.com/gui/ip-address/$I/detection
$outcome
"@
Write-Host $mystring
$mystring | set-clipboard
}
DisplayResults # 52.222.236.10
}
VT
pause
}