TheresAFewConors/Sooty

hashRating defaulting to "Hash was not found in Malware Database"

mrmeeseeks2014 opened this issue · 5 comments

Describe the bug
When utilizing the function hashRating(), as soon it hits:
if value['detected'] == True:
it moves to the except statement.

Reproduction Steps
Steps to reproduce the behavior:

  1. removed function to isolate the code
  2. add print statements before and after if and for lines
  3. used known bad hash: e428cee7a89bf236f43c1ef30de2e58d96ce7763b658cb1dfae3cfc246933713
  4. adding print(result) after:
    result = response.json()
    shows the full results, but the counting for total hits is off and not needed due to totals listed in the response.

Expected behavior
A clear and concise description of what was expected to happen.
Expect to get a total number of hits from VirusTotal or a not found.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop Operating System:

  • OS: Win10

Additional context
Working on on modifying the function and will post when done.

My version:

def hashRating():
    apierror = False
    count = 0
    # VT Hash Checker
    fileHash = str(input(" Enter Hash of file: ").strip())
    url = 'https://www.virustotal.com/vtapi/v2/file/report'

    params = {'apikey':  configvars.data['VT_API_KEY'], 'resource': fileHash}
    response = requests.get(url, params=params)

    try:  # EAFP
        result = response.json()
    except:
        apierror = True
        print("Error: Invalid API Key")
    
    if not apierror:
        if result['response_code'] == 0:
            print("\n Hash was not found in Malware Database")
        elif result['response_code'] == 1:
            print(" VirusTotal Report: " + str(result['positives']) + "/" + str(result['total']) + " detections found")
            print("   Report Link: " + "https://www.virustotal.com/gui/file/" + fileHash + "/detection")
        else:
            print("No Response")`

@mrmeeseeks2014 Thanks for opening an issue, and nice find with the this bug.

I tested your fix and it seems to be working correctly as far as I can tell. I made a small edit to the

params = {'apikey': ... } field for two reasons:

  • remove your API key from being hardcoded
  • to use the config file

If you want to open a pull request for this I'll add it as a hot-fix so you get credit. The dev build is in the process of a refactor so if you want to open a PR to master and I'll accept is from there.

I had issues with "pull request" so I just forked off your repository and made the change there.

I am new to using/contributing to Github, which could have been the issue too.

Thats fine, you have to fork the repo first to make changes before you can open a PR anyway. Once you're happy with the changes and are ready to merge with the rest of the codebase you can open a PR and then compare your fork with the master branch. There's a guide here that might help with using Github and PullRequest's

If you have any further issues let me know on here and I'll try give you a hand getting started with Github

PR #48 opened to merge changes.