diff --git a/api/alienvault.go b/api/alienvault.go
index 11dfd2fc0fc8fb7d7a7e93ba0199de8092dc2d87..acb618d05fbcb1faf6a5bf7fec635e002df11dde 100644
--- a/api/alienvault.go
+++ b/api/alienvault.go
@@ -13,9 +13,6 @@ import (
// CallAlienVaultUrl function takes a url, returns data on it from the alienvault api
func CallAlienVaultUrl(url string) (response utils.FrontendResponse) {
- //DENNE FUNKSJONEN KAN UTARBEIDES TIL Å BARE RETURNERE MALCICIOUS / SUSPCIOUS OM DET BEFINNER SEG NEVNT I NOEN
- // PULSEES (Problemet her er at ting som er OK kan være i pulse... Må tenke litt her)
- // Convert []byte to string and print to screen
APIKey := utils.APIKeyOTX
getURL := "https://otx.alienvault.com//api/v1/indicators/url/" + url + "/general"
@@ -67,28 +64,25 @@ func CallAlienVaultUrl(url string) (response utils.FrontendResponse) {
func CallAlienVaultHash(hash string, response *utils.FrontendResponse2, wg *sync.WaitGroup) {
defer wg.Done()
- response.SourceName = "AlienVault"
+ response.SourceName = "AlienVault" //Adds sourcename
- APIKey := utils.APIKeyOTX
+ APIKey := utils.APIKeyOTX //Gets API key
- getURL := "https://otx.alienvault.com//api/v1/indicators/file/" + hash + "/general"
+ getURL := "https://otx.alienvault.com//api/v1/indicators/file/" + hash + "/general" //Sets the endpoint URL
req, err := http.NewRequest("GET", getURL, nil)
req.Header.Set("X-OTX-API-KEY", APIKey)
- //fmt.Println(req.Header)
-
client := &http.Client{}
res, err := client.Do(req)
- //fmt.Println(res.Status)
- //fmt.Print(string(res.Body))
+
if err != nil {
fmt.Println("ERROR IN Request", err)
logging.Logerror(err, "ERROR IN REQUEST, AlienVault API")
utils.SetGenericError(response)
}
- if res.StatusCode == 200 {
+ if res.StatusCode == 200 { //Checks Statuscode IF ok, continue.
defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)
@@ -107,9 +101,6 @@ func CallAlienVaultHash(hash string, response *utils.FrontendResponse2, wg *sync
fmt.Println(err)
}
- //output:= string(body)
- //fmt.Println(output)
- //fmt.Println("\n\nAMOUNT OF PULSES:::::: ", jsonResponse.PulseInfo.Count)
utils.SetResponseObjectAlienVaultHash(jsonResponse, response)
} else {
@@ -119,15 +110,11 @@ func CallAlienVaultHash(hash string, response *utils.FrontendResponse2, wg *sync
response.NO.Content = "Vi har møtt på en error, sjekk om filhashen er en gyldig filhash."
response.NO.Status = "ERROR"
}
- //HER KAN VI SJEKKE OM "VERDICT feltet er" MALICIOUS, SUSPICIOUS ELLER NOE ANNET. OG Bare returnere det.
}
func TestAlienVaultUrl(url string, response *utils.FrontendResponse2, wg *sync.WaitGroup) {
-
defer wg.Done()
- //DENNE FUNKSJONEN KAN UTARBEIDES TIL Å BARE RETURNERE MALCICIOUS / SUSPCIOUS OM DET BEFINNER SEG NEVNT I NOEN
- // PULSEES (Problemet her er at ting som er OK kan være i pulse... Må tenke litt her)
- // Convert []byte to string and print to screen
+
APIKey := utils.APIKeyOTX
getURL := "https://otx.alienvault.com//api/v1/indicators/url/" + url + "/general"
@@ -135,7 +122,7 @@ func TestAlienVaultUrl(url string, response *utils.FrontendResponse2, wg *sync.W
req, err := http.NewRequest("GET", getURL, nil)
req.Header.Set("X-OTX-API-KEY", APIKey)
- //fmt.Println(req.Header)
+
client := &http.Client{}
@@ -160,19 +147,5 @@ func TestAlienVaultUrl(url string, response *utils.FrontendResponse2, wg *sync.W
logging.Logerror(err, "ERROR unmarshalling, AlienVault URLsearch API")
}
- /*
- //output:= string(body)
- //fmt.Println(output)
- //fmt.Println("\n\nAMOUNT OF PULSES:::::: ", jsonResponse.PulseInfo.Count)
- if(jsonResponse.PulseInfo.Count == 0){
- response.Status = "Safe"
- }else{
- response.Status = "Risk"
- }
-
- response.SourceName="AlienVault"
- */
-
- //response = string(body)
utils.SetResponseObjectAlienVault(jsonResponse, response)
}
diff --git a/api/google.go b/api/google.go
index 8f0be0dd4d66e0045a0dc1fc932d6be192a30ebb..9a4d11a877dd127aa0ea8d536d56ad41b591f891 100644
--- a/api/google.go
+++ b/api/google.go
@@ -134,20 +134,16 @@ func TestGoGoogleUrl(url string, response *utils.FrontendResponse2, wg *sync.Wai
httpSearchURL = "http://" + container[1]
- fmt.Println("1 : This is the HTTP URL after splitting and concatinating", httpSearchURL)
- fmt.Println("1 : This is the HTTPs URL after splitting and concatinating", httpsSearchURL)
} else if strings.Contains(url, "http://") {
httpSearchURL = url
container := strings.SplitAfter(url, "http://")
httpsSearchURL = "https://" + container[1]
- fmt.Println("2 : This is the HTTP URL after splitting and concatinating", httpSearchURL)
- fmt.Println("2 : This is the HTTPs URL after splitting and concatinating", httpsSearchURL)
+
} else {
httpSearchURL = "http://" + url
httpsSearchURL = "https://" + url
- fmt.Println("3 : This is the HTTP URL after splitting and concatinating", httpSearchURL)
- fmt.Println("4 : This is the HTTPs URL after splitting and concatinating", httpsSearchURL)
+
}
APIKey := utils.APIKeyGoogle
@@ -183,7 +179,10 @@ func TestGoGoogleUrl(url string, response *utils.FrontendResponse2, wg *sync.Wai
res, err := client.Do(req)
if err != nil {
- panic(err)
+ fmt.Println("Error: in google api response")
+ logging.Logerror(err, "ERROR reading google api response, Google API")
+ utils.SetGenericError(response)
+ return
}
defer res.Body.Close()
@@ -204,31 +203,6 @@ func TestGoGoogleUrl(url string, response *utils.FrontendResponse2, wg *sync.Wai
}
output := string(body)
fmt.Println("BODY::!", output)
- //fmt.Println("ThreatType::::",jsonResponse.Matches[0].ThreatType)
- //fmt.Println("response Body:", string(body))
- /*
- if len(jsonResponse.Matches) != 0 {
- response.Content = "This URL has been marked as malicious by Google Safebrowsing, visiting is NOT recommended"
- switch jsonResponse.Matches[0].ThreatType {
- case "MALWARE":
- response.Status = "Risk"
-
- case "SOCIAL_ENGINEERING":
- response.Status = "Risk"
-
- case "UNWANTED_SOFTWARE":
- response.Status = "Risk"
-
- default:
- response.Status = "potentially unsafe"
- response.Content = "This URL has been marked as suspicious, not recommended to visit."
- }
- } else {
- response.Status = "Safe"
- response.Content = "Google safebrowsing has no data that indicates this is an unsafe URL"
- }
-
- response.SourceName = "Google SafeBrowsing Api"
- */
+
utils.SetResponeObjectGoogle(jsonResponse, response)
}
diff --git a/api/hash-intelligence.go b/api/hash-intelligence.go
index 97bb1d34f35c74e88d88b0dceb0af8c95f615242..bf47524b516c787d0790211517e82c7bddef4e8c 100644
--- a/api/hash-intelligence.go
+++ b/api/hash-intelligence.go
@@ -56,23 +56,14 @@ func HashIntelligence(c *gin.Context) {
logging.Logerror(err, "ERROR handling redis response, hash-intelligence")
http.Error(c.Writer, "Failed retrieving api data.", http.StatusInternalServerError)
return
- // Maybe do another call to delete the key from the database?
}
- /**
- //var checkData utils.ResultFrontendResponse
- err = json.Unmarshal(responseBytes, &checkdata)
- if err!=nil {
- fmt.Println(string(checkData))
- }
- fmt.Println(string(checkData))
- */
+
err = json.Unmarshal(responseBytes, &hashInt)
if err != nil {
fmt.Println("Error handling redis response:" + err.Error())
logging.Logerror(err, "Error unmarshalling response, hash-intelligence")
http.Error(c.Writer, "Failed retrieving api data.", http.StatusInternalServerError)
return
- // Maybe do another call to delete the key from the database?
}
}
@@ -90,18 +81,18 @@ func hashSearch(hash string) (data []byte, err error, complete bool) {
AlienVaultpointer = &responseData[1]
wg.Add(2)
- go CallHybridAnalysisHash(hash, hybridApointer, &wg)
+ go CallHybridAnalysisHash(hash, hybridApointer, &wg) //Threaded calls to hybrid analysis and Alien vault intelligence gathering.
go CallAlienVaultHash(hash, AlienVaultpointer, &wg)
- wg.Wait()
+ wg.Wait() //Wait till both functions are complete.
- var resultResponse utils.ResultFrontendResponse
+ var resultResponse utils.ResultFrontendResponse //Creates a new datastructure to add data to.
resultResponse.FrontendResponse = responseData[:]
var resultPointer = &resultResponse
- utils.SetResultHash(resultPointer, len(responseData))
+ utils.SetResultHash(resultPointer, len(responseData)) //Calls function to set the result string based on data.
- complete = checkIfIntelligenceCompleteHash(resultResponse, len(responseData))
+ complete = checkIfIntelligenceCompleteHash(resultResponse, len(responseData)) //Checks if data is complete & ready to be cached.
hashInt, err := json.Marshal(resultResponse)
if err != nil {
fmt.Println(err)
@@ -109,9 +100,11 @@ func hashSearch(hash string) (data []byte, err error, complete bool) {
return nil, err, complete
}
- return hashInt, nil, complete
+ return hashInt, nil, complete //Returns the intelligence, a nil error, and a bool if the intelligence is complete.
}
+
+//This function checks if the intelligence is complete.
func checkIfIntelligenceCompleteHash(jsonData utils.ResultFrontendResponse, size int) (complete bool) {
complete = true
diff --git a/api/url-intelligence.go b/api/url-intelligence.go
index 0a777ddafe3a7be513c9b0475191f59efc01e84e..65b9138eefebd04abd035cdb0d37ade64c82f7a4 100644
--- a/api/url-intelligence.go
+++ b/api/url-intelligence.go
@@ -46,7 +46,7 @@ func UrlIntelligence(c *gin.Context) {
fmt.Println("Bool is true")
fmt.Println(response)
}
- //fmt.Println("WHERE IS MY CONTENT 2", responseData2)
+
// Cache hit
} else {
fmt.Println("Cache hit")
@@ -56,23 +56,16 @@ func UrlIntelligence(c *gin.Context) {
logging.Logerror(err, "Error handling redis response - Url-intelligence:")
http.Error(c.Writer, "Failed retrieving api data.", http.StatusInternalServerError)
return
- // Maybe do another call to delete the key from the database?
- }
- /**
- //var checkData utils.ResultFrontendResponse
- err = json.Unmarshal(responseBytes, &checkdata)
- if err!=nil {
- fmt.Println(string(checkData))
+
}
- fmt.Println(string(checkData))
- */
+
err = json.Unmarshal(responseBytes, &URLint)
if err != nil {
fmt.Println("Error handling redis response:" + err.Error())
logging.Logerror(err, "Error handling redis response - Url-intelligence:")
http.Error(c.Writer, "Failed retrieving api data.", http.StatusInternalServerError)
return
- // Maybe do another call to delete the key from the database?
+
}
}
@@ -81,9 +74,9 @@ func UrlIntelligence(c *gin.Context) {
// Makes the api requests used in urlIntelligence
func urlSearch(url string) (data []byte, err error, complete bool) {
- var wg sync.WaitGroup //Vente gruppe for goroutiner
+ var wg sync.WaitGroup //Wait group for go routines
var URLint []byte
- var responseData [4]utils.FrontendResponse2
+ var responseData [4]utils.FrontendResponse2 //Array of frontend response structs
var p, VirusTotal, urlscanio, alienvault *utils.FrontendResponse2
p = &responseData[0]
@@ -112,10 +105,11 @@ func urlSearch(url string) (data []byte, err error, complete bool) {
utils.SetResultURL(setResults, len(responseData))
- //TESTING FUNCTIONALITY FOR SCREENSHOT OF URLS
+
+ //FUNCTIONALITY FOR SCREENSHOT OF URLS
utils.ScreenshotURL(url, setResults) ////
- ////
- fmt.Println(len(resultResponse.Screenshot)) ////
+
+ //fmt.Println(len(resultResponse.Screenshot)) ////Check if screenshot contains anything (Is valid)
complete = checkIfIntelligenceComplete(resultResponse, len(responseData)) //This runs a check to see if the intelligence is complete
//If complete is true the intelligence will be cached,
@@ -127,8 +121,6 @@ func urlSearch(url string) (data []byte, err error, complete bool) {
return URLint, err, complete
}
- //fmt.Println("WHERE IS MY CONTENT 1", responseData)
-
return URLint, nil, complete
}