class ThreatExpert::Search
Public Class Methods
new()
click to toggle source
# File lib/threatexpert/search.rb, line 8 def initialize end
Public Instance Methods
_parse_list(nextpage)
click to toggle source
# File lib/threatexpert/search.rb, line 21 def _parse_list(nextpage) hashes = [] while nextpage page = open(nextpage).read nextpage = nil n = Nokogiri::HTML.parse(page) n.xpath('//a').each do |a| if a['href'] =~ /report\.aspx\?md5=([0-9a-fA-F]{32,128})/ hashes << $1 elsif a.text == 'Next' nextpage = "http://www.threatexpert.com/"+a['href'] end end end hashes end
_parse_report(page)
click to toggle source
# File lib/threatexpert/search.rb, line 38 def _parse_report(page) page = open(page).read return nil if page =~ /<status>not_found<\/status>/ Crack::XML.parse(page) end
md5(hash)
click to toggle source
# File lib/threatexpert/search.rb, line 11 def md5(hash) url = @@baseurl+"/report.aspx?md5=#{hash}&xml=1" _parse_report(url) end
name(mwname)
click to toggle source
# File lib/threatexpert/search.rb, line 16 def name(mwname) url = @@baseurl+"/reports.aspx?find=#{mwname}" _parse_list(url) end