pax_global_header00006660000000000000000000000064152030656160014516gustar00rootroot0000000000000052 comment=c7e4cdbde9778757444d96e6321785fa6972beed vt-cli-1.3.1/000077500000000000000000000000001520306561600127165ustar00rootroot00000000000000vt-cli-1.3.1/.gitattributes000066400000000000000000000000231520306561600156040ustar00rootroot00000000000000* text=auto eol=lf vt-cli-1.3.1/.github/000077500000000000000000000000001520306561600142565ustar00rootroot00000000000000vt-cli-1.3.1/.github/workflows/000077500000000000000000000000001520306561600163135ustar00rootroot00000000000000vt-cli-1.3.1/.github/workflows/build.yaml000066400000000000000000000004271520306561600203010ustar00rootroot00000000000000name: Build on: push: branches: - master pull_request: branches: - master jobs: build: name: Build runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-go@v5 - name: Build run: make build vt-cli-1.3.1/.github/workflows/release.yaml000066400000000000000000000015301520306561600206160ustar00rootroot00000000000000name: Release on: push: tags: - "*.*.*" jobs: create_release: name: Create release runs-on: ubuntu-latest env: GITHUB_TOKEN: ${{ secrets.TOKEN }} steps: - uses: actions/checkout@v4 - uses: actions/setup-go@v5 - id: get_version run: echo ::set-output name=VERSION::$(echo $GITHUB_REF | cut -d / -f 3) - name: Install dependencies run: | go install github.com/mitchellh/gox@latest go install github.com/tcnksm/ghr@latest - name: Add GOPATH to search path run: echo `go env GOPATH`/bin >> $GITHUB_PATH - name: Build run: make all env: VERSION: ${{ steps.get_version.outputs.VERSION }} - name: Create release run: ./new_release.sh env: VERSION: ${{ steps.get_version.outputs.VERSION }} vt-cli-1.3.1/.gitignore000066400000000000000000000000241520306561600147020ustar00rootroot00000000000000build vendor .idea/*vt-cli-1.3.1/AUTHORS000066400000000000000000000007271520306561600137740ustar00rootroot00000000000000# This is the official list of authors for copyright purposes. # # This does not necessarily list everyone who has contributed code, since in # some cases, their employer may be the copyright holder. To see the full list # of contributors, see the revision history in source control or # https://github.com/VirusTotal/vt-cli/graphs/contributors. # # Authors who wish to be recognized in this file should add themselves (or # their employer, as appropriate). Google Inc. vt-cli-1.3.1/LICENSE000066400000000000000000000261361520306561600137330ustar00rootroot00000000000000 Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. vt-cli-1.3.1/Makefile000066400000000000000000000013741520306561600143630ustar00rootroot00000000000000# This how we want to name the binary output BINARY=./build/vt # Setup the -ldflags option for go build here, interpolate the variable values LDFLAGS=-ldflags "-X github.com/VirusTotal/vt-cli/cmd.Version=${VERSION}" # Builds the project .PHONY: build build: go build ${LDFLAGS} -o ${BINARY} ./vt/main.go # Installs our project: copies binaries .PHONY: install install: go install ${LDFLAGS} github.com/VirusTotal/vt-cli/vt # Build the project for multiple architectures .PHONY: all all: gox ${LDFLAGS} \ -osarch="linux/amd64 linux/386 windows/amd64 windows/386 darwin/amd64 freebsd/amd64 freebsd/386" \ -output "build/{{.OS}}/{{.Arch}}/{{.Dir}}" github.com/VirusTotal/vt-cli/vt # Cleans our project: deletes binaries .PHONY: clean clean: rm -rf ./build vt-cli-1.3.1/README.md000066400000000000000000000355301520306561600142030ustar00rootroot00000000000000# VirusTotal CLI Welcome to the VirusTotal CLI, a tool designed for those who love both VirusTotal and command-line interfaces. With this tool you can do everything you'd normally do using VirusTotal's web page, including: * Retrieve information about a [file](doc/vt_file.md), [URL](doc/vt_url.md), [domain name](doc/vt_domain.md), [IP address](doc/vt_ip.md), etc. * [Search](doc/vt_search.md) for files and URLs using VirusTotal Intelligence query syntax. * [Download files](doc/vt_download.md). * [Manage your LiveHunt YARA rules](doc/vt_hunting_ruleset.md). * [Launch Retrohunt jobs](doc/vt_retrohunt_start.md) and [get their results](doc/vt_retrohunt_matches.md). And much [more](doc/vt.md)... ## See it in action [![asciicast](https://asciinema.org/a/179696.png)](https://asciinema.org/a/179696) ## Getting started As this tool uses the [VirusTotal API](https://docs.virustotal.com/reference) under the hood, you will need a VirusTotal API key. By [signing up](https://www.virustotal.com/#/join-us) with VirusTotal you will receive a free API key however, free API keys have a limited amount of requests per minute, and they don't have access to some premium features like searches and file downloads. If you are interested in using those premium features please [contact us](https://www.virustotal.com/gui/contact-us/). ### Installing the tool There are two ways of installing the tool: by using one of our pre-compiled binaries or by building it by yourself. #### Pre-compiled binaries The pre-compiled binaries can be found on [the releases page](https://github.com/VirusTotal/vt-cli/releases). There are binaries for Windows, Linux and Mac OS X. To use them, just download the file, decompress it and place it in a directory where you think is more convenient to use. #### Manual building To compile the program you'll need [Go 1.14.x or higher installed in your system](https://go.dev/doc/install) and type the following commands: ```sh $ git clone https://github.com/VirusTotal/vt-cli $ cd vt-cli $ make install ``` NOTE: in order to use the `vt` binary, make sure the `GOBIN` is part of your `PATH` env variable: ```sh $ export GOBIN=`go env GOPATH`/bin $ export PATH=$PATH:$GOBIN ``` ##### Mac OS Download the MacOS package from [the releases page](https://github.com/VirusTotal/vt-cli/releases). Copy the file to a location in your PATH, then remove the quarantine flag. ```sh $ unzip MacOSX.zip $ mkdir -p $HOME/bin $ mv vt $HOME/bin $ export PATH=$PATH:$HOME/bin $ xattr -d com.apple.quarantine $HOME/bin/vt ``` Alternative solution for Mac OS users, there's a [brew formula](https://formulae.brew.sh/formula/virustotal-cli) available. Please note this is not maintained by VirusTotal. ```sh $ brew install virustotal-cli ``` ##### Windows For Windows users, there's a [Winget manifest](https://github.com/microsoft/winget-pkgs/tree/master/manifests/v/VirusTotal/vt-cli) available. Please note this is not maintained by VirusTotal. ```powershell winget install VirusTotal.vt-cli ``` Chocolatey is [also supported](https://community.chocolatey.org/packages/vt-cli) (Also not maintained by VirusTotal): ```powershell choco install vt-cli ``` ### A note on Window's console If you plan to use `vt-cli` in Windows on a regular basis we highly recommend you avoid the standard Windows console and use [Cygwin](https://www.cygwin.com/) instead. The Windows console is *very* slow when printing large amounts of text (as `vt-cli` usually does) while Cygwin performs much better. Additionally, you can benefit from Cygwin's support for command auto-completion, a handy feature that the Windows console doesn't offer. In order to take advantage of auto-completion make sure to include the `bash-completion` package while installing Cygwin. ### Configuring your API key Once you have installed the vt-cli tool you may want to configure it with your API key. This is not strictly necessary, as you can provide your API key every time you invoke the tool by using the `--apikey` option (`-k` in short form), but that's a bit of a hassle if you are going to use the tool frequently (and we bet you'll do!). For configuring your API key just type: ```sh $ vt init ``` This command will ask for your API key, and save it to a config file in your home directory (~/.vt.toml). You can also specify your API key using the `VTCLI_APIKEY` environment variable. If you specify your API key in multiple ways, the `--apikey` option will have the highest precedence, followed by the `VTCLI_APIKEY` environment variable, the API key in the configuration file will be used as the last resort. ### Use with a proxy If you are behind an HTTP proxy you can tell `vt-cli` which is the address of your proxy server in multiple ways. One is using the `--proxy` option, like in: ```sh $ vt --proxy http://myproxy.com:1234 ``` You can also use the `VTCLI_PROXY` environment variable, or add the following line to the config file: ```sh proxy="http://myproxy.com:1234" ``` ### Setup Bash completion If you are going to use this tool frequently you may want to have command auto-completion. It saves both precious time and keystrokes. Notice however that you must configure your API as described in the previous section *before* following the steps listed below. The API is necessary for determining the commands that you will have access to. * Linux: ```sh $ vt completion bash > /etc/bash_completion.d/vt ``` * Mac OS X: ```sh $ brew install bash-completion $ vt completion bash > $(brew --prefix)/etc/bash_completion.d/vt ``` Add the following lines to `~/.bash_profile`: ```sh if [ -f $(brew --prefix)/etc/bash_completion ]; then . $(brew --prefix)/etc/bash_completion fi ``` * Cygwin: Make sure the `bash-completion` package is installed (Cygwin doesn't install it by default) and type: ```sh $ vt completion bash > /usr/share/bash-completion/completions/vt ``` :heavy_exclamation_mark: You may need to restart your shell in order for autocompletion to start working. ### Setup ZSH completion The output script from `vt completion zsh` needs to be put somewhere under the `$fpath` directory. For example, `.oh-my-zsh/completions` directory: ```shellsession $ mkdir /Users/$USERNAME/.oh-my-zsh/completions $ vt completion zsh > /Users/$USERNAME/.oh-my-zsh/completions/_vt ``` Restart the shell. ## Usage examples * Get information about a file: ```sh $ vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 ``` * Get information about a file in JSON format: ```sh $ vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 --format json ``` * Get a specific analysis report for a file: ```sh $ # File analysis IDs can be given as `f--`... $ vt analysis f-8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85-1546309359 $ # ...or as a Base64 encoded string, retrieved from the `vt scan file` command: $ vt scan file test.txt test.txt MDJiY2FiZmZmZmQxNmZlMGZjMjUwZjA4Y2FkOTVlMGM6MTU0NjQ1NDUyMA== $ vt analysis MDJiY2FiZmZmZmQxNmZlMGZjMjUwZjA4Y2FkOTVlMGM6MTU0NjQ1NDUyMA== - _id: "MDJiY2FiZmZmZmQxNmZlMGZjMjUwZjA4Y2FkOTVlMGM6MTU0NjQ1NDUyMA==" _type: "analysis" date: 1546454520 # 2019-01-02 13:42:00 -0500 EST stats: failure: 0 harmless: 0 malicious: 0 suspicious: 0 timeout: 0 type-unsupported: 0 undetected: 0 status: "queued" ``` * Download files given a list of hashes in a text file, one hash per line: ```sh $ cat /path/list_of_hashes.txt | vt download - ``` * Get information about a URL: ```sh $ vt url http://www.virustotal.com ``` * Get the IP address that served a URL: ```sh $ vt url last_serving_ip_address http://www.virustotal.com ``` * Search for files: ```sh $ vt search "positives:5+ type:pdf" ``` * Scan a file: ```sh $ vt scan file ZDZiOTcxY2JhNDE0MWU5ZWRjN2JjNGQ2NTdhN2VjODU6MTU3MDE3Mjg1NQ== $ vt analysis ZDZiOTcxY2JhNDE0MWU5ZWRjN2JjNGQ2NTdhN2VjODU6MTU3MDE3Mjg1NQ== - _id: "ZDZiOTcxY2JhNDE0MWU5ZWRjN2JjNGQ2NTdhN2VjODU6MTU3MDE3Mjg1NQ==" _type: "analysis" date: 1570172855 # 2019-10-04 09:07:35 +0200 CEST stats: failure: 0 harmless: 0 malicious: 0 suspicious: 0 timeout: 0 type-unsupported: 0 undetected: 0 status: "queued" ``` * Export detections and tags of files from a search in CSV format: ```sh $ vt search "positives:5+ type:pdf" -i sha256,last_analysis_stats.malicious,tags --format csv ``` * Export detections and tags of files from a search in JSON format: ```sh $ vt search "positives:5+ type:pdf" -i sha256,last_analysis_stats.malicious,tags --format json ``` ## Getting only what you want When you ask for information about a file, URL, domain, IP address or any other object in VirusTotal, you get a lot of data (by default in YAML format) that is usually more than what you need. You can narrow down the information shown by the vt-cli tool by using the `--include` and `--exclude` command-line options (`-i` and `-x` in short form). These options accept patterns that are matched against the fields composing the data, and allow you to include only a subset of them, or exclude any field that is not interesting for you. Let's see how it works using the data we have about `http://www.virustotal.com` as an example: ```sh $ vt url http://www.virustotal.com - _id: 1db0ad7dbcec0676710ea0eaacd35d5e471d3e11944d53bcbd31f0cbd11bce31 _type: "url" first_submission_date: 1275391445 # 2010-06-01 13:24:05 +0200 CEST last_analysis_date: 1532442650 # 2018-07-24 16:30:50 +0200 CEST last_analysis_results: ADMINUSLabs: category: "harmless" engine_name: "ADMINUSLabs" result: "clean" AegisLab WebGuard: category: "harmless" engine_name: "AegisLab WebGuard" result: "clean" AlienVault: category: "harmless" engine_name: "AlienVault" result: "clean" last_http_response_code: 200 last_http_response_content_length: 7216 last_http_response_content_sha256: "7ed66734d9fb8c5a922fffd039c1cd5d85f8c2bb39d14803983528437852ba94" last_http_response_headers: age: "26" cache-control: "public, max-age=60" content-length: "7216" content-type: "text/html" date: "Tue, 24 Jul 2018 14:30:24 GMT" etag: "\"bGPKJQ\"" expires: "Tue, 24 Jul 2018 14:31:24 GMT" server: "Google Frontend" x-cloud-trace-context: "131ac6cb5e2cdb7970d54ee42fd5ce4a" x-frame-options: "DENY" last_submission_date: 1532442650 # 2018-07-24 16:30:50 +0200 CEST private: false reputation: 1484 times_submitted: 213227 total_votes: harmless: 660 malicious: 197 ``` Notice that the returned data usually follows a hierarchical structure, with some top-level fields that may contain subfields which in turn can contain their own subfields. In the example above `last_http_response_headers` has subfields `age`, `cache-control`, `content-length` and so on, while `total_votes` has `harmless` and `malicious`. For referring to a particular field within the hierarchy we can use a path, similar to how we identify a file in our computers, but in this case, we are going to use a dot character (.) as the separator for path components, instead of the slashes (or backslashes) used by most file systems. The following ones are valid paths for our example structure: * `last_http_response_headers.age` * `total_votes.harmless` * `last_analysis_results.ADMINUSLabs.category` * `last_analysis_results.ADMINUSLabs.engine_name` The filters accepted by both `--include` and `--exclude` are paths in which we can use `*` and `**` as placeholders for one and many path elements respectively. For example `foo.*` matches `foo.bar` but not `foo.bar.baz`, while `foo.**` matches `foo.bar`, `foo.bar.baz` and `foo.bar.baz.qux`. In the other hand, `foo.*.qux` matches `foo.bar.qux` and `foo.baz.qux` but not `foo.bar.baz.qux`, while `foo.**.qux` matches `foo.bar.baz.qux` and any other path starting with `foo` and ending with `qux`. For cherry-picking only the fields you want, you should use `--include` followed by a path pattern as explained above. You can also include more than one pattern either by using the `--include` argument multiple times, or by using it with a comma-separated list of patterns. The following two options are equivalent: ```sh $ vt url http://www.virustotal.com --include=reputation --include=total_votes.* $ vt url http://www.virustotal.com --include=reputation,total_votes.* ``` Here you have different examples with their outputs (assuming that `vt url http://www.virustotal.com` returns the structure shown above): ```sh $ vt url http://www.virustotal.com --include=last_http_response_headers.server - last_http_response_headers: server: "Google Frontend" ``` ```sh $ vt url http://www.virustotal.com --include=last_http_response_headers.* - last_http_response_headers: age: "26" cache-control: "public, max-age=60" content-length: "7216" content-type: "text/html" date: "Tue, 24 Jul 2018 14:30:24 GMT" etag: "\"bGPKJQ\"" expires: "Tue, 24 Jul 2018 14:31:24 GMT" server: "Google Frontend" x-cloud-trace-context: "131ac6cb5e2cdb7970d54ee42fd5ce4a" x-frame-options: "DENY" ``` ```sh $ vt url http://www.virustotal.com --include=last_analysis_results.** - last_analysis_results: ADMINUSLabs: category: "harmless" engine_name: "ADMINUSLabs" result: "clean" AegisLab WebGuard: category: "harmless" engine_name: "AegisLab WebGuard" result: "clean" AlienVault: category: "harmless" engine_name: "AlienVault" result: "clean" ``` ```sh $ vt url http://www.virustotal.com --include=last_analysis_results.*.result - last_analysis_results: ADMINUSLabs: result: "clean" AegisLab WebGuard: result: "clean" AlienVault: result: "clean" ``` ```sh $ vt url http://www.virustotal.com --include=**.result - last_analysis_results: ADMINUSLabs: result: "clean" AegisLab WebGuard: result: "clean" AlienVault: result: "clean" ``` Also notice that `_id` and `_type` are also field names and therefore you can use them in your filters: ```sh $ vt url http://www.virustotal.com --include=_id,_type,**.result - _id: "1db0ad7dbcec0676710ea0eaacd35d5e471d3e11944d53bcbd31f0cbd11bce31" _type: "file" last_analysis_results: ADMINUSLabs: result: "clean" AegisLab WebGuard: result: "clean" AlienVault: result: "clean" ``` The `--exclude` option works similarly to `--include` but instead of including the matching fields in the output, it includes everything except the matching fields. You can use this option when you want to keep most of the fields, but leave out a few of them that are not interesting. If you use `--include` and `--exclude` simultaneously `--include` enters in action first, including only the fields that match the `--include` patterns, while `--exclude` comes in after that, removing any remaining field that matches the `--exclude` patterns. vt-cli-1.3.1/cmd/000077500000000000000000000000001520306561600134615ustar00rootroot00000000000000vt-cli-1.3.1/cmd/analysis.go000066400000000000000000000040351520306561600156350ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "github.com/VirusTotal/vt-cli/utils" "regexp" "github.com/spf13/cobra" ) var analysisCmdHelp = `Get a file or URL analysis. This command receives one or more analysis identifiers and returns information about the analysis. The data is returned in the same order as the identifiers appear in the command line. If the command receives a single hypen (-) the analysis identifiers are read from the standard input, one per line. ` var analysisCmdExample = ` vt analysis f-e04b82f7f8afc6e599d4913bee5eb571921ec8958d1ea5e3bbffe9c7ea9a0960-1542306475 vt analysis u-1db0ad7dbcec0676710ea0eaacd35d5e471d3e11944d53bcbd31f0cbd11bce31-1542292491 cat list_of_analysis_ids | vt analysis -` // NewAnalysisCmd returns a new instance of the 'analysis' command. func NewAnalysisCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"an"}, Use: "analysis [hash]...", Short: "Get a file or URL analysis", Long: analysisCmdHelp, Example: analysisCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { re, _ := regexp.Compile(`(f|u)-[[:xdigit:]]{64}-\d+|[\d\w=]{20,}`) p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "analyses/%s", utils.StringReaderFromCmdArgs(args), re) }, } addThreadsFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) return cmd } vt-cli-1.3.1/cmd/cmd.go000066400000000000000000000074161520306561600145630ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "fmt" "io" "os" "github.com/spf13/cobra" "github.com/fatih/color" "github.com/spf13/pflag" "github.com/VirusTotal/vt-cli/utils" "github.com/VirusTotal/vt-cli/yaml" ) var colorScheme = yaml.Colors{ KeyColor: color.New(color.FgYellow), ValueColor: color.New(color.FgHiGreen), CommentColor: color.New(color.Faint)} func addAPIKeyFlag(flags *pflag.FlagSet) { flags.StringP( "apikey", "k", "", "API key") } func addFormatFlag(flags *pflag.FlagSet) { flags.String( "format", "yaml", "Output format (yaml/json/csv)") } func addHostFlag(flags *pflag.FlagSet) { flags.String( "host", "www.virustotal.com", "API host name") flags.MarkHidden("host") } func addProxyFlag(flags *pflag.FlagSet) { flags.String( "proxy", "", "HTTP proxy") flags.MarkHidden("proxy") } func addIncludeExcludeFlags(flags *pflag.FlagSet) { flags.StringSliceP( "include", "i", []string{"**"}, "include fields matching the provided pattern") flags.StringSliceP( "exclude", "x", []string{}, "exclude fields matching the provided pattern") } func addThreadsFlag(flags *pflag.FlagSet) { flags.IntP( "threads", "t", 5, "number of threads working in parallel") } func addRecursive(flags *pflag.FlagSet) { flags.BoolP( "recursive", "r", false, "enable recursive traversal of subdirectories") } func addMaxDepth(flags *pflag.FlagSet) { flags.IntP( "maxDepth", "d", 1, "maximum recursion depth for directory traversal") } func addIDOnlyFlag(flags *pflag.FlagSet) { flags.BoolP( "identifiers-only", "I", false, "print identifiers only") } func addLimitFlag(flags *pflag.FlagSet) { flags.IntP( "limit", "n", 10, "maximum number of results") } func addCursorFlag(flags *pflag.FlagSet) { flags.StringP( "cursor", "c", "", "cursor for continuing where the previous request left") } func addOutputFlag(flags *pflag.FlagSet) { flags.StringP( "output", "o", ".", "directory where downloaded files are put") } func addPrivateFlag(flags *pflag.FlagSet) { flags.BoolP( "private", "P", false, "include private ones (requires private scanning privileges)") } func addFilterFlag(flags *pflag.FlagSet) { flags.StringP( "filter", "f", "", "filter") } func addVerboseFlag(flags *pflag.FlagSet) { flags.BoolP( "verbose", "v", false, "verbose output") } func addSilentFlag(flags *pflag.FlagSet) { flags.BoolP( "silent", "s", false, "Silent or quiet mode. Do not show progress meter") } func addHumanFlag(flags *pflag.FlagSet) { flags.BoolP( "human", "H", false, "output in a human-friendly format") } // ReadFile reads the specified file and returns its content. If filename is "-" // the data is read from stdin. func ReadFile(filename string) ([]byte, error) { if filename == "-" { return io.ReadAll(os.Stdin) } return os.ReadFile(filename) } // NewAPIClient returns a new utils.APIClient. func NewAPIClient() (*utils.APIClient, error) { return utils.NewAPIClient(fmt.Sprintf("vt-cli %s", Version)) } // NewPrinter creates a new utils.Printer. func NewPrinter(cmd *cobra.Command) (*utils.Printer, error) { client, err := NewAPIClient() if err != nil { return nil, err } return utils.NewPrinter(client, cmd, &colorScheme) } vt-cli-1.3.1/cmd/collection.go000066400000000000000000000232571520306561600161540ustar00rootroot00000000000000package cmd import ( "fmt" "io" "net" "regexp" "strings" "github.com/VirusTotal/vt-go" "github.com/VirusTotal/vt-cli/utils" "github.com/spf13/cobra" "github.com/spf13/viper" ) type objectDescriptor struct { Type string `json:"type"` Id string `json:"id,omitempty"` Url string `json:"url,omitempty"` } var collectionCmdHelp = `Get information about one or more collections. This command receives one or more collection IDs and returns information about them. The information for each collection is returned in the same order as the collections are passed to the command. If the command receives a single hypen (-) the collection will be read from the standard input, one per line.` var collectionCmdExample = ` vt collection malpedia_win_emotet vt collection malpedia_win_emotet alienvault_603eb1abdd4812819c64e197 cat list_of_collections | vt collection -n [collection_name] -d [collection_description] -` // NewCollectionCmd returns a new instance of the 'collection' command. func NewCollectionCmd() *cobra.Command { cmd := &cobra.Command{ Use: "collection [collection]...", Short: "Get information about collections", Long: collectionCmdHelp, Example: collectionCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "collections/%s", utils.StringReaderFromCmdArgs(args), nil) }, } cmd.AddCommand(NewCollectionCreateCmd()) cmd.AddCommand(NewCollectionRenameCmd()) cmd.AddCommand(NewCollectionUpdateCmd()) cmd.AddCommand(NewCollectionDeleteCmd()) cmd.AddCommand(NewCollectionRemoveItemsCmd()) addRelationshipCmds(cmd, "collections", "collection", "[collection]", false) addThreadsFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) return cmd } var createCollectionCmdHelp = `Creates a collection from a list of IOCs. This command receives one of more IoCs (sha256 hashes, URLs, domains, IP addresses) and creates a collection from them. If the command receives a single hypen (-) the IoCs will be read from the standard input.` var createCollectionExample = ` vt collection create -n [collection_name] -d [collection_description] www.example.com vt collection create -n [collection_name] -d [collection_description] www.example.com 8.8.8.8 cat list_of_iocs | vt collection create -n [collection_name] -d [collection_description] -` // NewCollectionCreateCmd returns a command for creating a collection. func NewCollectionCreateCmd() *cobra.Command { cmd := &cobra.Command{ Use: "create [ioc]...", Short: "Create a collection.", Long: createCollectionCmdHelp, Example: createCollectionExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { c, err := NewAPIClient() if err != nil { return err } p, err := NewPrinter(cmd) if err != nil { return err } reader := utils.StringReaderFromCmdArgs(args) collection := vt.NewObject("collection") collection.SetString("name", viper.GetString("name")) collection.SetString("description", viper.GetString("description")) collection.SetData("raw_items", rawFromReader(reader)) if err := c.PostObject(vt.URL("collections"), collection); err != nil { return err } if viper.GetBool("identifiers-only") { fmt.Printf("%s\n", collection.ID()) } else { if err := p.PrintObject(collection); err != nil { return err } } return nil }, } cmd.Flags().StringP( "name", "n", "", "Collection's name (required)") cmd.Flags().StringP( "description", "d", "", "Collection's description (required)") _ = cmd.MarkFlagRequired("name") _ = cmd.MarkFlagRequired("description") addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) return cmd } func patchCollection(id, attr string, value interface{}) error { client, err := NewAPIClient() if err != nil { return err } obj := vt.NewObjectWithID("collection", id) obj.Set(attr, value) return client.PatchObject(vt.URL("collections/%s", id), obj) } // NewCollectionRenameCmd returns a command for renaming a collection. func NewCollectionRenameCmd() *cobra.Command { return &cobra.Command{ Use: "rename [collection id] [name]", Short: "Rename collection.", Args: cobra.ExactArgs(2), RunE: func(cmd *cobra.Command, args []string) error { return patchCollection(args[0], "name", args[1]) }, } } var updateCollectionCmdHelp = `Adds new items to a collection. This command receives a collection ID and one of more IoCs (sha256 hashes, URLs, domains, IP addresses) and adds them to the collection. If the command receives a single hypen (-) the IoCs will be read from the standard input.` var updateCollectionExample = ` vt collection update [collection id] www.example.com vt collection update [collection id] www.example.com 8.8.8.8 cat list_of_iocs | vt collection update [collection id] -` // NewCollectionUpdateCmd returns a command for adding new items to a collection. func NewCollectionUpdateCmd() *cobra.Command { return &cobra.Command{ Use: "update [collection id] [ioc]...", Short: "Add new items to a collection.", Args: cobra.MinimumNArgs(2), Long: updateCollectionCmdHelp, Example: updateCollectionExample, RunE: func(cmd *cobra.Command, args []string) error { c, err := NewAPIClient() if err != nil { return err } p, err := NewPrinter(cmd) if err != nil { return err } collection := vt.NewObjectWithID("collection", args[0]) reader := utils.StringReaderFromCmdArgs(args[1:]) collection.SetData("raw_items", rawFromReader(reader)) if err := c.PatchObject(vt.URL("collections/%s", args[0]), collection); err != nil { return err } if viper.GetBool("identifiers-only") { fmt.Printf("%s\n", collection.ID()) } else { if err := p.PrintObject(collection); err != nil { return err } } return nil }, } } var removeCollectionItemsCmdHelp = `Remove items from a collection. This command receives a collection ID and one of more IoCs (sha256 hashes, URLs, domains, IP addresses) and removes them from the collection. If the command receives a single hypen (-) the IoCs will be read from the standard input.` var removeCollectionItemsExample = ` vt collection remove [collection id] www.example.com vt collection remove [collection id] www.example.com 8.8.8.8 cat list_of_iocs | vt collection remove [collection id] -` // NewCollectionRemoveItemsCmd returns a command for removing items from a collection. func NewCollectionRemoveItemsCmd() *cobra.Command { return &cobra.Command{ Use: "remove [collection id] [ioc]...", Short: "Remove items from a collection.", Args: cobra.MinimumNArgs(2), Long: removeCollectionItemsCmdHelp, Example: removeCollectionItemsExample, RunE: func(cmd *cobra.Command, args []string) error { c, err := NewAPIClient() if err != nil { return err } relationshipDescriptors := descriptorsFromReader( utils.StringReaderFromCmdArgs(args[1:])) for relationshipName, descriptors := range relationshipDescriptors { url := vt.URL("collections/%s/%s", args[0], relationshipName) response, err := c.DeleteData(url, descriptors) if err != nil { return err } if response.Error.Code != "" { return response.Error } } return nil }, } } var deleteCollectionCmdHelp = `Delete a collection. This command receives a collection ID and deletes it.` var deleteCollectionExample = ` vt collection delete [collection id]` // NewCollectionDeleteCmd returns a command for deleting a collection. func NewCollectionDeleteCmd() *cobra.Command { return &cobra.Command{ Use: "delete [collection id]", Short: "Delete a collection.", Args: cobra.MinimumNArgs(1), Long: deleteCollectionCmdHelp, Example: deleteCollectionExample, RunE: func(cmd *cobra.Command, args []string) error { c, err := NewAPIClient() if err != nil { return err } url := vt.URL("collections/%s", args[0]) response, err := c.Delete(url) if err != nil { return err } if response.Error.Code != "" { return response.Error } return nil }, } } func rawFromReader(reader utils.StringReader) string { var lines []string for { next, err := reader.ReadString() if err == io.EOF { break } lines = append(lines, next) } return strings.Join(lines, " ") } func descriptorsFromReader(reader utils.StringReader) map[string][]objectDescriptor { descriptors := make(map[string][]objectDescriptor) hashPattern := regexp.MustCompile("[0-9a-fA-F]{32,64}") urlPattern := regexp.MustCompile("[hH][tTxX]{2}[pP][sS]?://.*") // At least two domain parts. domainPattern := regexp.MustCompile(".*[^.]+\\.[^.]+.*") for { next, err := reader.ReadString() if err == io.EOF { break } if match := hashPattern.MatchString(next); match { files := descriptors["files"] files = append(files, objectDescriptor{ Type: "file", Id: next, }) descriptors["files"] = files } else if net.ParseIP(next) != nil { if strings.Contains(next, ".") { ipAddresses := descriptors["ip_addresses"] ipAddresses = append(ipAddresses, objectDescriptor{ Type: "ip_address", Id: next, }) descriptors["ip_addresses"] = ipAddresses } else { // IPv6, skip. } } else if urlPattern.MatchString(next) { urls := descriptors["urls"] urls = append(urls, objectDescriptor{ Type: "url", Url: next, }) descriptors["urls"] = urls } else if domainPattern.MatchString(next) { domains := descriptors["domains"] domains = append(domains, objectDescriptor{ Type: "domain", Id: next, }) descriptors["domains"] = domains } } return descriptors } vt-cli-1.3.1/cmd/completion.go000066400000000000000000000040721520306561600161640ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "fmt" "io" "os" "github.com/spf13/cobra" ) var bashCompletionGenerators = map[string]func(out io.Writer, cmd *cobra.Command) error{ "bash": func(out io.Writer, cmd *cobra.Command) error { return cmd.GenBashCompletion(out) }, "zsh": func(out io.Writer, cmd *cobra.Command) error { return cmd.GenZshCompletion(out) }, "fish": func(out io.Writer, cmd *cobra.Command) error { return cmd.GenFishCompletion(out, true) }, } var completionCmdHelp = `Output shell completion code for the specified shell (bash or zsh). The shell code must be evaluated to provide interactive completion of vt commands. This can be done by sourcing it from the .bash_profile. Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2` // NewCompletionCmd returns command 'completion' func NewCompletionCmd() *cobra.Command { cmd := &cobra.Command{ Use: "completion ", Short: "Output shell completion code for the specified shell (bash or zsh)", Long: completionCmdHelp, Args: cobra.ExactArgs(1), PreRunE: func(cmd *cobra.Command, args []string) error { _, found := bashCompletionGenerators[args[0]] if !found { return fmt.Errorf("Unsupported shell type %q", args[0]) } return nil }, Run: func(cmd *cobra.Command, args []string) { run, _ := bashCompletionGenerators[args[0]] run(os.Stdout, cmd.Parent()) }, } cmd.MarkZshCompPositionalArgumentWords(1, "bash", "zsh") return cmd } vt-cli-1.3.1/cmd/domain.go000066400000000000000000000035571520306561600152710ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "github.com/VirusTotal/vt-cli/utils" "github.com/spf13/cobra" ) var domainCmdHelp = `Get information about one or more Internet domains. This command receives one or more Internet domains and returns information about them. The data is returned in the same order as the domains appear in the command line. If the command receives a single hypen (-) the domains are read from the standard input, one per line. ` var domainCmdExample = ` vt domain virustotal.com vt domain virustotal.com google.com cat list_of_domains | vt domain -` // NewDomainCmd returns a new instance of the 'domain' command. func NewDomainCmd() *cobra.Command { cmd := &cobra.Command{ Use: "domain [domain]...", Short: "Get information about Internet domains", Long: domainCmdHelp, Example: domainCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "domains/%s", utils.StringReaderFromCmdArgs(args), nil) }, } addRelationshipCmds(cmd, "domains", "domain", "[domain]", false) addThreadsFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) return cmd } vt-cli-1.3.1/cmd/download.go000066400000000000000000000146321520306561600156250ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "encoding/json" "errors" "fmt" "os" "path" "regexp" "time" "github.com/VirusTotal/vt-cli/utils" vt "github.com/VirusTotal/vt-go" "github.com/briandowns/spinner" grab "github.com/cavaliergopher/grab/v3" "github.com/fatih/color" "github.com/spf13/cobra" "github.com/spf13/viper" ) type downloadCallback func(grabResp *grab.Response) type fileDownloader struct { grab *grab.Client client *utils.APIClient } func newFileDownloader(client *utils.APIClient) fileDownloader { return fileDownloader{ grab: grab.NewClient(), client: client} } func (d *fileDownloader) DownloadFile(downloadURL, dstPath string, callback downloadCallback) error { req, err := grab.NewRequest(dstPath, downloadURL) if err != nil { return err } req.HTTPRequest.Header.Add("x-apikey", d.client.APIKey) resp := d.grab.Do(req) t := time.NewTicker(500 * time.Millisecond) defer t.Stop() Loop: for { select { case <-t.C: callback(resp) case <-resp.Done: if err := resp.Err(); err != nil { return fmt.Errorf("download error: %+v", err) } callback(resp) break Loop } } return nil } // Standard downloader, it implements the Doer interface and downloads // individual files. type downloader struct { fileDownloader } func (d *downloader) Do(file interface{}, ds *utils.DoerState) string { var hash string if f, isObject := file.(*vt.Object); isObject { hash = f.ID() } else { hash = file.(string) } ds.Progress = fmt.Sprintf("%s %4.1f%%", hash, 0.0) // Get download URL var downloadURL string _, err := d.client.GetData(vt.URL("files/%s/download_url", hash), &downloadURL) if err == nil { dstPath := path.Join(viper.GetString("output"), hash) err = d.DownloadFile(downloadURL, dstPath, func(resp *grab.Response) { progress := 100 * resp.Progress() if progress < 100 { ds.Progress = fmt.Sprintf("%s %4.1f%% %6.1f KBi/s", hash, progress, resp.BytesPerSecond()/1024) } }) } msg := color.GreenString("ok") if err != nil { if apiErr, ok := err.(vt.Error); ok && apiErr.Code == "NotFoundError" { msg = color.RedString("not found") } else { msg = color.RedString(err.Error()) } } return fmt.Sprintf("%s [%s]", hash, msg) } // ZIP downloader, uses the API for creating ZIP files in the backend. type zipDownloader struct { fileDownloader } func (z *zipDownloader) Download(hashes utils.StringReader, password string) error { spin := spinner.New(spinner.CharSets[6], 250*time.Millisecond) spin.Color("green") spin.Suffix = " creating ZIP..." spin.Start() defer spin.Stop() hashList := make([]string, 0) for hash, err := hashes.ReadString(); err == nil; hash, err = hashes.ReadString() { hashList = append(hashList, hash) } req := struct { Hashes []string `json:"hashes,omitempty"` Password string `json:"password,omitempty"` }{ Hashes: hashList, Password: password, } resp, err := z.client.PostData(vt.URL("intelligence/zip_files"), &req) if err != nil { return err } var obj *vt.Object if err := json.Unmarshal(resp.Data, &obj); err != nil { return err } for obj.MustGetString("status") != "finished" { obj, err = z.client.GetObject(vt.URL("intelligence/zip_files/%s", obj.ID())) if err != nil { return err } switch status, _ := obj.GetString("status"); status { case "error-starting": return errors.New("Error starting ZIP file creation") case "error-creating": return errors.New("Error creating ZIP file") case "timeout": return errors.New("ZIP file creation is taking too long") } progress, _ := obj.GetFloat64("progress") spin.Suffix = fmt.Sprintf(" creating ZIP... %2.0f%%", progress*100) time.Sleep(2 * time.Second) } url := vt.URL("intelligence/zip_files/%s/download", obj.ID()) dstPath := viper.GetString("output") err = z.DownloadFile(url.String(), dstPath, func(resp *grab.Response) { spin.Suffix = fmt.Sprintf( " downloading ZIP %4.1f%% %6.1f KBi/s", resp.Progress()*100, resp.BytesPerSecond()/1024) }) return err } var downloadCmdHelp = `Download one or more files. This command receives one or more file hashes (SHA-256, SHA-1 or MD5) and downloads the files from VirusTotal. For using this command you need an API key with access to VirusTotal Intelligence. If the command receives a single hypen (-) the hashes are read from the standard input, one per line.` var downladCmdExample = ` vt download 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 vt download 76cdb2bad9582d23c1f6f4d868218d6c 44d88612fea8a8f36de82e1278abb02f cat list_of_hashes | vt download -` // NewDownloadCmd returns a new instance of the 'download' command. func NewDownloadCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"dl"}, Use: "download", Short: "Download files", Long: downloadCmdHelp, Example: downladCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { var argReader utils.StringReader if len(args) == 1 && args[0] == "-" { argReader = utils.NewStringIOReader(os.Stdin) } else { argReader = utils.NewStringArrayReader(args) } client, err := NewAPIClient() if err != nil { return err } re, _ := regexp.Compile(`^([[:xdigit:]]{64}|[[:xdigit:]]{40}|[[:xdigit:]]{32})$`) hashes := utils.NewFilteredStringReader(argReader, re) if viper.GetBool("zip") { z := zipDownloader{newFileDownloader(client)} err = z.Download(hashes, viper.GetString("zip-password")) } else { c := utils.NewCoordinator(viper.GetInt("threads")) c.DoWithStringsFromReader( &downloader{newFileDownloader(client)}, hashes) } return err }, } cmd.Flags().BoolP("zip", "z", false, "download in a ZIP file") cmd.Flags().String("zip-password", "", "password for the ZIP file, used with --zip") addThreadsFlag(cmd.Flags()) addOutputFlag(cmd.Flags()) return cmd } vt-cli-1.3.1/cmd/file.go000066400000000000000000000045011520306561600147270ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "regexp" "github.com/VirusTotal/vt-cli/utils" "github.com/spf13/cobra" "github.com/spf13/viper" ) var fileCmdHelp = `Get information about one or more files. This command receives one or more hashes (SHA-256, SHA-1 or MD5) and returns information about the corresponding files. The information for each file appears in the same order as the hashes are passed to the command. If the command receives a single hypen (-) the hashes are read from the standard input, one per line. ` var fileCmdExample = ` vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 vt file 76cdb2bad9582d23c1f6f4d868218d6c vt file 76cdb2bad9582d23c1f6f4d868218d6c 44d88612fea8a8f36de82e1278abb02f cat list_of_hashes | vt file -` // NewFileCmd returns a new instance of the 'file' command. func NewFileCmd() *cobra.Command { cmd := &cobra.Command{ Use: "file [hash]...", Short: "Get information about files", Long: fileCmdHelp, Example: fileCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { re, _ := regexp.Compile("[[:xdigit:]]{64}|[[:xdigit:]]{40}|[[:xdigit:]]{32}") p, err := NewPrinter(cmd) if err != nil { return err } if viper.GetBool("private") { return p.GetAndPrintObjectsWithFallback( []string{"files/%s", "private/files/%s"}, utils.StringReaderFromCmdArgs(args), re) } else { return p.GetAndPrintObjects( "files/%s", utils.StringReaderFromCmdArgs(args), re) } }, } addRelationshipCmds(cmd, "files", "file", "[hash]", true) addThreadsFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addPrivateFlag(cmd.Flags()) return cmd } vt-cli-1.3.1/cmd/gendoc.go000066400000000000000000000022361520306561600152520ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "github.com/spf13/cobra" "github.com/spf13/cobra/doc" ) // NewGenDocCmd returns a new instance of the 'gendoc' command. func NewGenDocCmd() *cobra.Command { return &cobra.Command{ Hidden: true, Use: "gendoc [output dir]", Short: "Generate documentation", Args: cobra.MaximumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { outputDir := "." if len(args) == 1 { outputDir = args[0] } cmd.Root().DisableAutoGenTag = true return doc.GenMarkdownTree(cmd.Parent(), outputDir) }, } } vt-cli-1.3.1/cmd/group.go000066400000000000000000000027271520306561600151540ustar00rootroot00000000000000// Copyright © 2019 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "github.com/VirusTotal/vt-cli/utils" "github.com/spf13/cobra" ) var groupCmdHelp = `Get information about a group.` var groupCmdExample = ` vt group mygroup` // NewGroupCmd returns a new instance of the 'group' command. func NewGroupCmd() *cobra.Command { cmd := &cobra.Command{ Use: "group [groupname]...", Short: "Get information about VirusTotal groups", Long: groupCmdHelp, Example: groupCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "groups/%s", utils.StringReaderFromCmdArgs(args), nil) }, } addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addThreadsFlag(cmd.Flags()) cmd.AddCommand(NewPrivilegeCmd("group")) return cmd } vt-cli-1.3.1/cmd/hunting.go000066400000000000000000000261041520306561600154670ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "bufio" "errors" "fmt" "os" "regexp" "strconv" "sync" "github.com/VirusTotal/vt-cli/utils" vt "github.com/VirusTotal/vt-go" "github.com/spf13/cobra" "github.com/spf13/viper" ) var notificationsDeleteCmdHelp = `Delete hunting notifications. This command deletes the malware hunting notifications associated to the currently configured API key.` // NewHuntingNotificationDeleteCmd returns a command for deleting all hunting // notifications for the current user. func NewHuntingNotificationDeleteCmd() *cobra.Command { cmd := &cobra.Command{ Use: "delete [notification id]...", Short: "Delete hunting notifications", Long: notificationsDeleteCmdHelp, RunE: func(cmd *cobra.Command, args []string) error { deleteAll := viper.GetBool("all") deleteTag := viper.GetString("with-tag") if len(args) == 0 && !deleteAll && deleteTag == "" { return errors.New("Specify notification id or use --all or --with-tag") } client, err := NewAPIClient() if err != nil { return err } if deleteAll { _, err = client.Delete(vt.URL("intelligence/hunting_notifications")) } else if deleteTag != "" { _, err = client.Delete(vt.URL("intelligence/hunting_notifications?tag=%s", deleteTag)) } else { var wg sync.WaitGroup for _, arg := range args { wg.Add(1) go func(notificationID string) { url := vt.URL("intelligence/hunting_notifications/%s", notificationID) if _, err := client.Delete(url); err != nil { fmt.Fprintf(os.Stderr, "%v\n", err) } wg.Done() }(arg) } wg.Wait() } return err }, } cmd.Flags().BoolP("all", "a", false, "delete all notifications") cmd.Flags().StringP("with-tag", "t", "", "delete notifications with a given tag") return cmd } var notificationsListCmdHelp = `List malware hunting notifications. This command list the malware hunting notifications associated to the currently configured API key.` // NewHuntingNotificationListCmd returns a new instance of the 'notifications list' command. func NewHuntingNotificationListCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"ls"}, Use: "list", Short: "List notifications", Long: notificationsListCmdHelp, RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.PrintCollection(vt.URL("intelligence/hunting_notifications?relationships=file")) }, } addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addFilterFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) cmd.AddCommand(NewHuntingNotificationDeleteCmd()) return cmd } // NewHuntingNotificationCmd returns a new instance of the 'notifications' command. func NewHuntingNotificationCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"nt"}, Use: "notification [id]...", Short: "Manage malware hunting notifications", Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { re, _ := regexp.Compile("\\d+") p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "intelligence/hunting_notifications/%s", utils.StringReaderFromCmdArgs(args), re) }, } addThreadsFlag(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) cmd.AddCommand(NewHuntingNotificationListCmd()) cmd.AddCommand(NewHuntingNotificationDeleteCmd()) return cmd } var rulesetsListCmdHelp = `List malware hunting rulesets. This command list the malware hunting rulesets associated to the currently configured API key.` // NewHuntingRulesetListCmd returns a new instance of the 'rulesets list' command. func NewHuntingRulesetListCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"ls"}, Use: "list", Short: "List rulesets", Long: rulesetsListCmdHelp, RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.PrintCollection(vt.URL("intelligence/hunting_rulesets?relationships=owner,editors")) }, } addIncludeExcludeFlags(cmd.Flags()) addFilterFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) return cmd } func patchRuleset(id, attr string, value interface{}) error { client, err := NewAPIClient() if err != nil { return err } obj := vt.NewObjectWithID("hunting_ruleset", id) obj.Set(attr, value) return client.PatchObject(vt.URL("intelligence/hunting_rulesets/%s", id), obj) } // NewHuntingRulesetDisableCmd returns a command for disabling a given ruleset. func NewHuntingRulesetDisableCmd() *cobra.Command { return &cobra.Command{ Use: "disable [ruleset id]", Short: "Disable ruleset", Args: cobra.ExactArgs(1), RunE: func(cmd *cobra.Command, args []string) error { return patchRuleset(args[0], "enabled", false) }, } } // NewHuntingRulesetEnableCmd returns a command for enabling a given ruleset. func NewHuntingRulesetEnableCmd() *cobra.Command { return &cobra.Command{ Use: "enable [ruleset id]", Short: "Enable ruleset", Args: cobra.ExactArgs(1), RunE: func(cmd *cobra.Command, args []string) error { return patchRuleset(args[0], "enabled", true) }, } } // NewHuntingRulesetRenameCmd returns a command for renaming a given ruleset. func NewHuntingRulesetRenameCmd() *cobra.Command { return &cobra.Command{ Use: "rename [ruleset id] [name]", Short: "Rename ruleset", Args: cobra.ExactArgs(2), RunE: func(cmd *cobra.Command, args []string) error { return patchRuleset(args[0], "name", args[1]) }, } } // NewHuntingRulesetSetLimitCmd returns a command for changing a ruleset's limit. func NewHuntingRulesetSetLimitCmd() *cobra.Command { return &cobra.Command{ Use: "setlimit [ruleset id] [limit]", Short: "Set ruleset limit", Args: cobra.MinimumNArgs(2), RunE: func(cmd *cobra.Command, args []string) error { limit, err := strconv.Atoi(args[1]) if err != nil { return fmt.Errorf("invalid limit: %s", args[1]) } return patchRuleset(args[0], "limit", limit) }, } } // NewHuntingRulesetUpdateCmd returns a command for updating ruleset's rules. func NewHuntingRulesetUpdateCmd() *cobra.Command { return &cobra.Command{ Use: "update [ruleset id] [rules file]", Short: "Change the rules for a ruleset", Args: cobra.MinimumNArgs(2), RunE: func(cmd *cobra.Command, args []string) error { rules, err := ReadFile(args[1]) if err != nil { return err } return patchRuleset(args[0], "rules", string(rules)) }, } } // NewHuntingRulesetDeleteCmd returns a command for deleting a given ruleset. func NewHuntingRulesetDeleteCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"del", "rm"}, Use: "delete [ruleset id]...", Short: "Delete rulesets", RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } deleteAll := viper.GetBool("all") if len(args) == 0 && !deleteAll { return errors.New("Specify ruleset id or use --all") } if deleteAll { fmt.Print("Enter your VirusTotal username to confirm: ") scanner := bufio.NewScanner(os.Stdin) scanner.Scan() username := scanner.Text() _, err = client.Delete( vt.URL("intelligence/hunting_rulesets"), vt.WithHeader("x-confirm-delete", username)) } else { var wg sync.WaitGroup for _, arg := range args { wg.Add(1) go func(rulesetID string) { url := vt.URL("intelligence/hunting_rulesets/%s", rulesetID) if _, err := client.Delete(url); err != nil { fmt.Fprintf(os.Stderr, "%v\n", err) } wg.Done() }(arg) } wg.Wait() } return err }, } cmd.Flags().BoolP("all", "a", false, "delete all rulesets") return cmd } // NewHuntingRulesetAddCmd returns a command for adding a new ruleset. func NewHuntingRulesetAddCmd() *cobra.Command { cmd := &cobra.Command{ Use: "add [ruleset name] [rules file]", Short: "Add a new ruleset", Args: cobra.ExactArgs(2), RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } p, err := NewPrinter(cmd) if err != nil { return err } rules, err := ReadFile(args[1]) if err != nil { return err } obj := vt.NewObject("hunting_ruleset") obj.SetString("name", args[0]) obj.SetString("rules", string(rules)) err = client.PostObject(vt.URL("intelligence/hunting_rulesets"), obj) if err != nil { return err } return p.PrintObject(obj) }, } cmd.MarkZshCompPositionalArgumentFile(2) return cmd } // NewHuntingRulesetSetNotificationEmailsCmd returns a command for setting // notification emails to a ruleset. func NewHuntingRulesetSetNotificationEmailsCmd() *cobra.Command { cmd := &cobra.Command{ Use: "notification_emails [ruleset id] [email]...", Short: "Set ruleset notification emails", Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { return patchRuleset(args[0], "notification_emails", args[1:]) }, } return cmd } // NewHuntingRulesetCmd returns a new instance of the 'rulesets' command. func NewHuntingRulesetCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"rs"}, Use: "ruleset [id]...", Short: "Manage hunting rulesets", Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { re, _ := regexp.Compile("\\d+") p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "intelligence/hunting_rulesets/%s?relationships=owner,editors", utils.StringReaderFromCmdArgs(args), re) }, } addThreadsFlag(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) cmd.AddCommand(NewHuntingRulesetAddCmd()) cmd.AddCommand(NewHuntingRulesetDeleteCmd()) cmd.AddCommand(NewHuntingRulesetDisableCmd()) cmd.AddCommand(NewHuntingRulesetEnableCmd()) cmd.AddCommand(NewHuntingRulesetSetNotificationEmailsCmd()) cmd.AddCommand(NewHuntingRulesetListCmd()) cmd.AddCommand(NewHuntingRulesetRenameCmd()) cmd.AddCommand(NewHuntingRulesetSetLimitCmd()) cmd.AddCommand(NewHuntingRulesetUpdateCmd()) return cmd } // NewHuntingCmd returns a new instance of the 'hunting' command. func NewHuntingCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"ht"}, Use: "hunting", Short: "Manage malware hunting rules and notifications", } cmd.AddCommand(NewHuntingNotificationCmd()) cmd.AddCommand(NewHuntingRulesetCmd()) return cmd } vt-cli-1.3.1/cmd/init.go000066400000000000000000000100011520306561600147430ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "encoding/gob" "fmt" "os" "path" vt "github.com/VirusTotal/vt-go" "github.com/spf13/cobra" ) var initCmdHelp = `Initialize or re-initialize this command-line tool. This command will ask for your API key and save it in a local file, so you don't need to enter it everytime you use the tool. It will also retrieve additional metadata from VirusTotal for making the tool even more powerful.` var vtBanner = ` ██╗ ██╗██╗██████╗ ██╗ ██╗███████╗████████╗ ██████╗ ████████╗ █████╗ ██╗ ██║ ██║██║██╔══██╗██║ ██║██╔════╝╚══██╔══╝██╔═══██╗╚══██╔══╝██╔══██╗██║ ██║ ██║██║██████╔╝██║ ██║███████╗ ██║ ██║ ██║ ██║ ███████║██║ ╚██╗ ██╔╝██║██╔══██╗██║ ██║╚════██║ ██║ ██║ ██║ ██║ ██╔══██║██║ ╚████╔╝ ██║██║ ██║╚██████╔╝███████║ ██║ ╚██████╔╝ ██║ ██║ ██║███████╗ ╚═══╝ ╚═╝╚═╝ ╚═╝ ╚═════╝ ╚══════╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝ VirusTotal Command-Line Interface: Threat Intelligence at your fingertips. ` // NewInitCmd returns a 'init' command. func NewInitCmd() *cobra.Command { return &cobra.Command{ Use: "init", Short: "Initialize or re-initialize vt command-line tool", Long: initCmdHelp, Run: func(cmd *cobra.Command, args []string) { fmt.Print(vtBanner) apiKey := cmd.Flags().Lookup("apikey").Value.String() if apiKey == "" { fmt.Print("Enter your API key: ") fmt.Scanln(&apiKey) } client := vt.NewClient(apiKey) metadata, err := client.GetMetadata() if err != nil { fmt.Fprintln(os.Stderr, err) os.Exit(1) } homeDir, err := os.UserHomeDir() if err != nil { fmt.Fprintln(os.Stderr, err) os.Exit(1) } cacheDir, err := os.UserCacheDir() if err != nil { fmt.Fprintln(os.Stderr, err) os.Exit(1) } if err := os.MkdirAll(cacheDir, 0755); err != nil { fmt.Fprintln(os.Stderr, err) os.Exit(1) } relCacheFile, err := os.Create(path.Join(cacheDir, ".vt.relationships.cache")) if err != nil { fmt.Fprintln(os.Stderr, err) os.Exit(1) } defer relCacheFile.Close() enc := gob.NewEncoder(relCacheFile) if err := enc.Encode(metadata.Relationships); err != nil { fmt.Fprintln(os.Stderr, err) os.Exit(1) } configFilePath := path.Join(homeDir, ".vt.toml") configFile, err := os.OpenFile(configFilePath, os.O_CREATE|os.O_WRONLY, 0600) if err != nil { fmt.Fprintln(os.Stderr, err) os.Exit(1) } defer configFile.Close() _, err = fmt.Fprintf(configFile, "apikey=\"%s\"\n", apiKey) if err != nil { fmt.Fprintln(os.Stderr, err) os.Exit(1) } fmt.Printf("API key written to config file: %s\n", configFilePath) fmt.Printf("Relationships cache written to: %s\n", relCacheFile.Name()) }, } } vt-cli-1.3.1/cmd/ioc_stream.go000066400000000000000000000137301520306561600161410ustar00rootroot00000000000000// Copyright © 2023 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "fmt" "regexp" "strings" "github.com/spf13/viper" "golang.org/x/sync/errgroup" "github.com/VirusTotal/vt-go" "github.com/VirusTotal/vt-cli/utils" "github.com/spf13/cobra" ) var iocStreamCmdExamples = `## List: # List notifications from a hunting rule by name vt iocstream list -f "origin:hunting tag:my_rule" # List notifications from a hunting ruleset by name vt iocstream list -f "origin:hunting tag:myRuleset" # List just the entity IDs of your IoC Stream matches vt iocstream list -I # List ALL the entity IDs in your IoC Stream and store them in a csv file (this might take a while) vt iocstream list -I –limit 9999999 > results.csv # List the first IoC Stream notifications including the hash, last_analysis_stats, size and file type vt iocstream list -i "_id,last_analysis_stats,size,type_tag" # Check if a hash is in your IoC Stream matches vt iocstream list -f "entity_type:file entity_id:hash" ## Delete: # Delete all notifications matching a filter, e.g. all matches for a YARA rule/ruleset. This process is # asynchronous, so it can take a while to delete all the notifications. vt iocstream delete -f "origin:hunting tag:my_rule" # Delete a single notification with ID 1234568. The notification ID is displayed in the context_attributes. vt iocstream delete 1234568` var iocStreamListCmdExamples = `# List notifications from a hunting rule by name vt iocstream list -f "origin:hunting tag:my_rule" # List notifications from a hunting ruleset by name vt iocstream list -f "origin:hunting tag:myRuleset" # List just the entity IDs of your IoC Stream matches vt iocstream list -I # List ALL the entity IDs in your IoC Stream and store them in a csv file (this might take a while) vt iocstream list -I –limit 9999999 > results.csv # List the first IoC Stream notifications including the hash, last_analysis_stats, size and file type vt iocstream list -i "_id,last_analysis_stats,size,type_tag" # Check if a hash is in your IoC Stream matches vt iocstream list -f "entity_type:file entity_id:hash"` var iocStreamDeleteCmdExamples = `# Delete all notifications matching a filter, e.g. all matches for a YARA rule/ruleset vt iocstream delete -f "origin:hunting tag:my_rule" # Delete a single notification with ID 1234568. The notification ID is displayed in the context_attributes. vt iocstream delete 1234568` // NewIOCStreamCmd returns a new instance of the `ioc func NewIOCStreamCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"is"}, Use: "iocstream [notification_id]...", Short: "Manage IoC Stream notifications", Example: iocStreamCmdExamples, Args: cobra.ExactArgs(1), RunE: func(cmd *cobra.Command, args []string) error { re, _ := regexp.Compile("\\d+") p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "ioc_stream_notifications/%s", utils.StringReaderFromCmdArgs(args), re) }, } addThreadsFlag(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) cmd.AddCommand(NewIOCStreamListCmd()) cmd.AddCommand(NewIOCStreamDeleteCmd()) return cmd } // NewIOCStreamListCmd returns a new instance of the `ioc_stream list` command. func NewIOCStreamListCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"il"}, Use: "list", Short: "List IoCs from notifications", Example: iocStreamListCmdExamples, RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.PrintCollection(vt.URL("ioc_stream")) }, } addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addFilterFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) return cmd } var iocStreamNotificationsDeleteCmdHelp = `Delete notifications from the IoC Stream. The command accepts a list of IoC Stream notification IDs. If no IDs are provided, then all the IoC Stream notifications matching the given filter are deleted. ` // NewIOCStreamDeleteCmd returns a new instance of the `ioc_stream delete` command. func NewIOCStreamDeleteCmd() *cobra.Command { cmd := &cobra.Command{ Use: "delete [notification id]...", Short: "Deletes notifications from the IoC Stream", Long: iocStreamNotificationsDeleteCmdHelp, Example: iocStreamDeleteCmdExamples, RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } if len(args) > 0 { eg := &errgroup.Group{} for _, arg := range args { notificationId := arg eg.Go(func() error { targetUrl := vt.URL("ioc_stream_notifications/%s", notificationId) _, err := client.Delete(targetUrl) return err }) } return eg.Wait() } else { filterFlag := viper.GetString("filter") targetUrl := vt.URL("ioc_stream") if strings.TrimSpace(filterFlag) == "" { fmt.Println("This will delete all your IoC Stream notifications.") fmt.Print("Confirm (y/n)? ") var s string fmt.Scanln(&s) if s != "y" { return nil } } else { q := targetUrl.Query() q.Set("filter", filterFlag) targetUrl.RawQuery = q.Encode() } if _, err := client.Delete(targetUrl); err != nil { return err } fmt.Println("Notifications being deleted. This can take a while depending on the number of notifications.") } return nil }, } addFilterFlag(cmd.Flags()) return cmd } vt-cli-1.3.1/cmd/ip.go000066400000000000000000000036321520306561600144240ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "regexp" "github.com/VirusTotal/vt-cli/utils" "github.com/spf13/cobra" ) var ipCmdHelp = `Get information about one or more IP addresses. This command receives one or more IP addresses and returns information about them. The information for each IP address is returned in the same order as the IP addresses are passed to the command. If the command receives a single hypen (-) the IP addresses will be read from the standard input, one per line.` var ipCmdExample = ` vt ip 8.8.8.8 vt ip 8.8.8.8 8.8.4.4 cat list_of_ips | vt ip -` // NewIPCmd returns a new instance of the 'ip' command. func NewIPCmd() *cobra.Command { cmd := &cobra.Command{ Use: "ip [ip]...", Short: "Get information about IP addresses", Long: ipCmdHelp, Example: ipCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { re, _ := regexp.Compile(`\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}`) p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "ip_addresses/%s", utils.StringReaderFromCmdArgs(args), re) }, } addRelationshipCmds(cmd, "ip_addresses", "ip_address", "[ip]", false) addThreadsFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) return cmd } vt-cli-1.3.1/cmd/meta.go000066400000000000000000000027211520306561600147400ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "os" "github.com/gobwas/glob" "github.com/VirusTotal/vt-cli/yaml" "github.com/spf13/cobra" ) var metaCmdHelp = `Returns metadata about VirusTotal. Metadata includes the full list of engines, relationships supported by each type of objects, and other useful information.` // NewMetaCmd returns a new instance of the 'meta' command. func NewMetaCmd() *cobra.Command { return &cobra.Command{ Use: "meta", Short: "Returns metadata about VirusTotal", Long: metaCmdHelp, RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } metadata, err := client.GetMetadata() if err != nil { return err } return yaml.NewEncoder(os.Stdout, yaml.EncoderColors(&colorScheme), yaml.EncoderDateKeys([]glob.Glob{}), ).Encode(metadata) }, } } vt-cli-1.3.1/cmd/monitor.go000066400000000000000000000326141520306561600155050ustar00rootroot00000000000000// Copyright © 2019 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "errors" "fmt" "io" "os" "path" "path/filepath" "regexp" "strings" "sync" "github.com/VirusTotal/vt-cli/utils" vt "github.com/VirusTotal/vt-go" grab "github.com/cavaliergopher/grab/v3" "github.com/fatih/color" "github.com/spf13/cobra" "github.com/spf13/viper" ) var base64RegExp = `^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$` var monitorItemsCmdExample = ` vt monitor list vt monitor list --filter "path:/myfolder/" --include path vt monitor list --filter "tag:detected" --include path,last_analysis_results.*.result,last_detections_count` // NewMonitorItemsListCmd returns a list or monitor_items according to a filter. func NewMonitorItemsListCmd() *cobra.Command { cmd := &cobra.Command{ Use: "list", Short: "List monitor in your account", Example: monitorItemsCmdExample, RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.PrintCollection(vt.URL("monitor/items")) }, } addIncludeExcludeFlags(cmd.Flags()) addFilterFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) return cmd } // Monitor downloader, it implements the Doer interface. Retrieves the item // path to know the destination filename and downloads and save each individual // file using fileDownloader.DownloadFile type monitorDownloader struct { fileDownloader } func (d *monitorDownloader) Do(file interface{}, ds *utils.DoerState) string { var monitorItemID string if f, isObject := file.(*vt.Object); isObject { monitorItemID = f.ID() } else { monitorItemID = file.(string) } // Resolve MonitorItemID to path ds.Progress = fmt.Sprintf("%s [resolving path]", monitorItemID) var obj *vt.Object obj, err := d.client.GetObject(vt.URL("monitor/items/%s", monitorItemID)) if err != nil { return fmt.Sprintf("%s [%s]", monitorItemID, color.RedString(err.Error())) } monitorPath, err := obj.GetString("path") if err != nil { return fmt.Sprintf("%s [%s]", monitorItemID, color.RedString(err.Error())) } monitorPath = strings.TrimPrefix(monitorPath, "/") // From now progress shows the path instead of monitorItemID ds.Progress = fmt.Sprintf("%s %4.1f%%", monitorPath, 0.0) // Get download URL var downloadURL string _, err = d.client.GetData(vt.URL("monitor/items/%s/download_url", monitorItemID), &downloadURL) if err == nil { dstPath := path.Join(viper.GetString("output"), monitorPath) err = d.DownloadFile(downloadURL, dstPath, func(resp *grab.Response) { progress := 100 * resp.Progress() if progress < 100 { ds.Progress = fmt.Sprintf("%s %4.1f%% %6.1f KBi/s", monitorPath, progress, resp.BytesPerSecond()/1024) } }) } msg := color.GreenString("ok") if err != nil { if apiErr, ok := err.(vt.Error); ok && apiErr.Code == "NotFoundError" { msg = color.RedString("not found") } else { msg = color.RedString(err.Error()) } } return fmt.Sprintf("%s [%s]", monitorPath, msg) } var monitorItemsDownloadCmdHelp = `Download files from your account. This command download files in your monitor account using their MonitorItemID.` var monitorItemsDownloadCmdExample = ` vt monitor download "MonitorItemID" vt monitor download "MonitorItemID1" "MonitorItemID2" ... cat list_of_monitor_ids | vt monitor download -` // NewMonitorItemsDownloadCmd returns a command for downloading files from your // monitor account. func NewMonitorItemsDownloadCmd() *cobra.Command { cmd := &cobra.Command{ Use: "download [monitor_id]...", Short: "Download files from your monitor account", Long: monitorItemsDownloadCmdHelp, Example: monitorItemsDownloadCmdExample, RunE: func(cmd *cobra.Command, args []string) error { var argReader utils.StringReader if len(args) == 0 { return errors.New("No item provided") } else if len(args) == 1 && args[0] == "-" { argReader = utils.NewStringIOReader(os.Stdin) } else { argReader = utils.NewStringArrayReader(args) } client, err := NewAPIClient() if err != nil { return err } re, _ := regexp.Compile(base64RegExp) monitorItemIDs := utils.NewFilteredStringReader(argReader, re) c := utils.NewCoordinator(viper.GetInt("threads")) c.DoWithStringsFromReader( &monitorDownloader{fileDownloader: newFileDownloader(client)}, monitorItemIDs) return err }, } addThreadsFlag(cmd.Flags()) addOutputFlag(cmd.Flags()) return cmd } var monitorItemsSetDetailsCmdHelp = `Set details metadata for a file. This command sets details metadata for a file in your monitor account referenced by a MonitorItemID.` var monitorItemsSetDetailsCmdExample = ` vt monitor setdetails "MonitorItemID" "Some file metadata." cat multiline_details | vt monitor setdetails "MonitorItemID"` // NewMonitorItemsSetDetailsCmd returns a command for configuring item details. func NewMonitorItemsSetDetailsCmd() *cobra.Command { cmd := &cobra.Command{ Use: "setdetails [monitor_id] [details_string]", Short: "Sets details metadata for a monitor file", Long: monitorItemsSetDetailsCmdHelp, Example: monitorItemsSetDetailsCmdExample, RunE: func(cmd *cobra.Command, args []string) error { var monitorItemID, details string if len(args) == 0 { return errors.New("No item provided") } else if len(args) == 1 { detailsBytes, err := io.ReadAll(os.Stdin) details = string(detailsBytes) if err != nil { return err } } else { details = args[1] } monitorItemID = args[0] client, err := NewAPIClient() if err != nil { return err } re, _ := regexp.Compile(base64RegExp) if !re.MatchString(monitorItemID) { return errors.New("Bad MonitorItemID") } obj := vt.NewObjectWithID("monitor_item", monitorItemID) obj.Set("details", details) return client.PatchObject( vt.URL("monitor/items/%s/config", monitorItemID), obj) }, } return cmd } var monitorItemsDeleteDetailsCmdHelp = `Delete details metadata from files. This command delete details metadata from a file or files in your monitor account that was previously set.` // NewMonitorItemsDeleteDetailsCmd returns a command for removing item details. func NewMonitorItemsDeleteDetailsCmd() *cobra.Command { cmd := &cobra.Command{ Use: "deletedetails [monitor_id]...", Short: "Delete details metadata from files", Long: monitorItemsDeleteDetailsCmdHelp, RunE: func(cmd *cobra.Command, args []string) error { if len(args) == 0 { return errors.New("No item provided") } client, err := NewAPIClient() if err != nil { return err } var waitGroup sync.WaitGroup for _, arg := range args { waitGroup.Add(1) go func(monitorItemID string) { url := vt.URL("monitor/items/%s/config", monitorItemID) obj := vt.NewObjectWithID("monitor_item", monitorItemID) obj.Set("details", nil) if err := client.PatchObject(url, obj); err != nil { fmt.Fprintf(os.Stderr, "%v\n", err) } waitGroup.Done() }(arg) } waitGroup.Wait() return nil }, } return cmd } var monitorItemsDeleteCmdHelp = `Delete files in your account. This command deletes files in your monitor account using a MonitorItemID, deleting a folder recursivelly deletes all files and folders inside it.` // NewMonitorItemsDeleteCmd returns a command for deleting files in your monitor // account. func NewMonitorItemsDeleteCmd() *cobra.Command { cmd := &cobra.Command{ Use: "delete [monitor_id]...", Short: "Delete monitor files", Long: monitorItemsDeleteCmdHelp, RunE: func(cmd *cobra.Command, args []string) error { if len(args) == 0 { return errors.New("No item provided") } client, err := NewAPIClient() if err != nil { return err } var waitGroup sync.WaitGroup for _, arg := range args { waitGroup.Add(1) go func(monitorItemID string) { url := vt.URL("monitor/items/%s", monitorItemID) if _, err := client.Delete(url); err != nil { fmt.Fprintf(os.Stderr, "%v\n", err) } waitGroup.Done() }(arg) } waitGroup.Wait() return err }, } return cmd } // MonitorFileUpload doer type monitorFileUpload struct { uploader *vt.MonitorUploader } type uploadParams struct { filePath string remotePath string } func (s *monitorFileUpload) Do(file interface{}, ds *utils.DoerState) string { params := file.(uploadParams) progressCh := make(chan float32) defer close(progressCh) go func() { for progress := range progressCh { if progress < 100 { ds.Progress = fmt.Sprintf("%s uploading... %4.1f%%", params.filePath, progress) } else { ds.Progress = fmt.Sprintf("%s done.", params.filePath) } } }() f, err := os.Open(params.filePath) if err != nil { return fmt.Sprintf("%s", err) } defer f.Close() item, err := s.uploader.Upload(f, params.remotePath, progressCh) if err != nil { return fmt.Sprintf("%s", err) } return fmt.Sprintf("%s %s", params.filePath, item.ID()) } // runMonitorItemUpload exectutes the items upload, requesting verification from user func runMonitorItemUpload(cmd *cobra.Command, args []string) error { localPath := args[0] remotePath := args[1] // Check if first arg is a file or a folder pathStat, err := os.Stat(localPath) if err != nil { return err } ch := make(chan interface{}) switch mode := pathStat.Mode(); { case mode.IsDir(): // Upload tree to remote localPathClean := strings.TrimRight(localPath, string(os.PathSeparator)) + string(os.PathSeparator) remotePathClean := strings.TrimRight(remotePath, "/") + "/" filesParams := make([]uploadParams, 0) filepath.Walk( localPathClean, func(path string, info os.FileInfo, err error) error { if !info.Mode().IsRegular() { return nil } relativePath := strings.SplitN(path, localPathClean, 2)[1] remoteAbsoluteFilename := remotePathClean + relativePath filesParams = append(filesParams, uploadParams{path, remoteAbsoluteFilename}) return nil }) // Confirm user want to create those files in remote fmt.Println("Following files are going to be created:") for _, params := range filesParams { fmt.Println(params.filePath + " -> " + params.remotePath) } var s string fmt.Println("Confirm(y/n)?") fmt.Scanln(&s) if s != "y" { return nil } go func() { for _, params := range filesParams { ch <- params } close(ch) }() case mode.IsRegular(): // Upload only one file to remote go func() { params := uploadParams{localPath, remotePath} ch <- params close(ch) }() default: return errors.New("Not a regular file or folder") } client, err := NewAPIClient() if err != nil { return err } s := &monitorFileUpload{uploader: client.NewMonitorUploader()} c := utils.NewCoordinator(viper.GetInt("threads")) c.DoWithItemsFromChannel(s, ch) return nil } var monitorItemUploadCmdHelp = `Upload a file or files contained in a folder. This command receives one file or folder path and uploads them to your VirusTotal Monitor account. It returns uploaded the file paths followed by their corresponding monitor ID. You can use the "vt monitor [monitor_id]" command for retrieving information about the it.` var monitorItemUploadCmdExample = ` vt monitor item upload foo.exe /remote_folder/foo.exe vt monitor item upload myfolder/ /another_remote_folder/` // NewMonitorItemsUploadCmd returns a new instance of the 'mointor upload file' command. func NewMonitorItemsUploadCmd() *cobra.Command { cmd := &cobra.Command{ Use: "upload [file/folder] [remote_path]", Short: "Upload one or more files to your account", Long: monitorItemUploadCmdHelp, Example: monitorItemUploadCmdExample, Args: cobra.ExactArgs(2), RunE: runMonitorItemUpload, } addThreadsFlag(cmd.Flags()) return cmd } var monitorCmdHelp = `Manage your VirusTotal Monitor account. This command allows you to manage the contents of your account and retrieve information about analyses performed to your collection. Reference: https://docs.virustotal.com/reference/monitor` // NewMonitorCmd returns a new instance of the 'monitor_item' command. func NewMonitorCmd() *cobra.Command { cmd := &cobra.Command{ Use: "monitor [monitor_id]...", Short: "Manage your monitor account", Long: monitorCmdHelp, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { re, _ := regexp.Compile(base64RegExp) p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects("monitor/items/%s", utils.StringReaderFromCmdArgs(args), re) }, } addThreadsFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) cmd.AddCommand(NewMonitorItemsListCmd()) cmd.AddCommand(NewMonitorItemsUploadCmd()) cmd.AddCommand(NewMonitorItemsDeleteCmd()) cmd.AddCommand(NewMonitorItemsDownloadCmd()) cmd.AddCommand(NewMonitorItemsSetDetailsCmd()) cmd.AddCommand(NewMonitorItemsDeleteDetailsCmd()) addRelationshipCmds(cmd, "monitor/items", "monitor_item", "[monitor_id]", false) return cmd } vt-cli-1.3.1/cmd/monitorpartner.go000066400000000000000000000120751520306561600171000ustar00rootroot00000000000000// Copyright © 2019 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "errors" "fmt" "os" "path" "regexp" "github.com/VirusTotal/vt-cli/utils" vt "github.com/VirusTotal/vt-go" grab "github.com/cavaliergopher/grab/v3" "github.com/fatih/color" "github.com/spf13/cobra" "github.com/spf13/viper" ) var monitorPartnerItemsCmdExample = ` vt monitorpartner list vt monitorpartner list --filter "engine:" --include sha256,first_detection_date` // NewMonitorPartnerHashesListCmd returns a list or monitor_partner according to a filter. func NewMonitorPartnerHashesListCmd() *cobra.Command { cmd := &cobra.Command{ Use: "list", Short: "List available monitor partner hashes", Example: monitorPartnerItemsCmdExample, RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.PrintCollection(vt.URL("monitor_partner/hashes")) }, } addIncludeExcludeFlags(cmd.Flags()) addFilterFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) return cmd } // Monitor Partner downloader, it implements the Doer interface. Retrieves the item // path to know the destination filename and downloads and save each individual // file using fileDownloader.DownloadFile type monitorPartnerDownloader struct { fileDownloader } func (d *monitorPartnerDownloader) Do(file interface{}, ds *utils.DoerState) string { var hash string if f, isObject := file.(*vt.Object); isObject { hash = f.ID() } else { hash = file.(string) } ds.Progress = fmt.Sprintf("%s %4.1f%%", hash, 0.0) // Get download URL var downloadURL string _, err := d.client.GetData(vt.URL("monitor_partner/files/%s/download_url", hash), &downloadURL) if err == nil { dstPath := path.Join(viper.GetString("output"), hash) err = d.DownloadFile(downloadURL, dstPath, func(resp *grab.Response) { progress := 100 * resp.Progress() if progress < 100 { ds.Progress = fmt.Sprintf("%s %4.1f%% %6.1f KBi/s", hash, progress, resp.BytesPerSecond()/1024) } }) } msg := color.GreenString("ok") if err != nil { if apiErr, ok := err.(vt.Error); ok && apiErr.Code == "NotFoundError" { msg = color.RedString("not found") } else { msg = color.RedString(err.Error()) } } return fmt.Sprintf("%s [%s]", hash, msg) } var monitorPartnerHashDownloadCmdHelp = `Download files from your partner account. This command download files from your monitor partner account using their sha256.` var monitorPartnerHashDownloadCmdExample = ` vt monitorpartner download ... cat list_of_monitor_ids | vt monitorpartner download -` // NewMonitorPartnerHashDownloadCmd returns a command for downloading files from your // monitor account. func NewMonitorPartnerHashDownloadCmd() *cobra.Command { cmd := &cobra.Command{ Use: "download [sha256]...", Short: "Download files from your monitor partner account", Long: monitorPartnerHashDownloadCmdHelp, Example: monitorPartnerHashDownloadCmdExample, RunE: func(cmd *cobra.Command, args []string) error { var argReader utils.StringReader if len(args) == 0 { return errors.New("No hash provided") } else if len(args) == 1 && args[0] == "-" { argReader = utils.NewStringIOReader(os.Stdin) } else { argReader = utils.NewStringArrayReader(args) } client, err := NewAPIClient() if err != nil { return err } re, _ := regexp.Compile("[[:xdigit:]]{64}") monitorHashes := utils.NewFilteredStringReader(argReader, re) c := utils.NewCoordinator(viper.GetInt("threads")) c.DoWithStringsFromReader( &monitorPartnerDownloader{fileDownloader: newFileDownloader(client)}, monitorHashes) return err }, } addThreadsFlag(cmd.Flags()) addOutputFlag(cmd.Flags()) return cmd } var monitorPartnerCmdHelp = `Manage your VirusTotal Monitor Partner account. This command allows you to list and retrieve files detected by your engine. Reference: https://docs.virustotal.com/reference/monitor-partner` // NewMonitorPartnerCmd returns a new instance of the 'monitor_hash' command. func NewMonitorPartnerCmd() *cobra.Command { cmd := &cobra.Command{ Use: "monitorpartner", Short: "Manage your monitor partner account", Long: monitorPartnerCmdHelp, Args: cobra.MinimumNArgs(1), } addThreadsFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) cmd.AddCommand(NewMonitorPartnerHashesListCmd()) cmd.AddCommand(NewMonitorPartnerHashDownloadCmd()) addRelationshipCmds(cmd, "monitor_partner/hashes", "monitor_hash", "[sha256]", false) return cmd } vt-cli-1.3.1/cmd/privileges.go000066400000000000000000000052621520306561600161660ustar00rootroot00000000000000package cmd import ( "fmt" "github.com/VirusTotal/vt-go" "github.com/spf13/cobra" "github.com/spf13/viper" "strconv" "time" ) func NewPrivilegeCmd(target string) *cobra.Command { cmd := &cobra.Command{ Use: "privileges", Short: fmt.Sprintf("Change %s privileges", target), } cmd.AddCommand(NewPrivilegeGrantCmd(target)) cmd.AddCommand(NewPrivilegeRevokeCmd(target)) return cmd } type Privilege struct { Granted bool `json:"granted"` ExpirationDate int64 `json:"expiration_date"` } type Privileges map[string]Privilege func NewPrivilegeGrantCmd(target string) *cobra.Command { cmd := &cobra.Command{ Use: fmt.Sprintf("grant [%sname] [privilege]...", target), Short: fmt.Sprintf("Grant privileges to a %s", target), Example: fmt.Sprintf(" vt %s privileges grant my%s intelligence downloads-tier-2", target, target), Args: cobra.MinimumNArgs(2), RunE: func(cmd *cobra.Command, args []string) error { var expirationDate int64 if expiration:= viper.GetString("expiration"); expiration != "" { var err error expirationDate, err = strconv.ParseInt(expiration, 10, 64) if err != nil { if t, err := time.Parse("2006-01-02", expiration); err == nil { expirationDate = t.Unix() } else { return fmt.Errorf( "%s is not a valid expiration date, either use a UNIX timestamp or date in YYYY-MM-DD format", expiration) } } } privileges := Privileges{} for _, arg := range args[1:] { p := Privilege{Granted: true} if expirationDate != 0 { p.ExpirationDate = expirationDate } privileges[arg] = p } client, err := NewAPIClient() if err != nil { return err } obj := vt.NewObjectWithID(target, args[0]) obj.Set("privileges", privileges) return client.PatchObject(vt.URL("%ss/%s", target, args[0]), obj) }, } cmd.Flags().StringP("" + "expiration", "e", "", "expiration time for the granted privileges (UNIX timestamp or YYYY-MM-DD)") return cmd } func NewPrivilegeRevokeCmd(target string) *cobra.Command { return &cobra.Command{ Use: fmt.Sprintf("revoke [%sname] [privilege]...", target), Short: fmt.Sprintf("Revoke privileges from a %s", target), Example: fmt.Sprintf(" vt %s privileges revoke my%s intelligence downloads-tier-2", target, target), Args: cobra.MinimumNArgs(2), RunE: func(cmd *cobra.Command, args []string) error { privileges := Privileges{} for _, arg := range args[1:] { privileges[arg] = Privilege{Granted: false} } client, err := NewAPIClient() if err != nil { return err } obj := vt.NewObjectWithID(target, args[0]) obj.Set("privileges", privileges) return client.PatchObject(vt.URL("%ss/%s", target, args[0]), obj) }, } } vt-cli-1.3.1/cmd/relationship.go000066400000000000000000000121601520306561600165110ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "encoding/base64" "encoding/gob" "fmt" "os" "path" "sync" "github.com/VirusTotal/vt-cli/utils" vt "github.com/VirusTotal/vt-go" "github.com/spf13/cobra" "github.com/spf13/viper" ) var objectRelationshipsMap map[string][]vt.RelationshipMeta func init() { if cacheDir, err := os.UserCacheDir(); err == nil { cacheFile := path.Join(cacheDir, ".vt.relationships.cache") // We used to store the cache file in user's home directory. Let's // move it to the cache directory. if homeDir, err := os.UserHomeDir(); err == nil { oldCacheFile := path.Join(homeDir, ".vt.relationships.cache") if _, err := os.Stat(oldCacheFile); err == nil { if err := os.MkdirAll(cacheDir, 0755); err == nil { os.Rename(oldCacheFile, cacheFile) } } } f, err := os.Open(cacheFile) if err == nil { defer f.Close() dec := gob.NewDecoder(f) dec.Decode(&objectRelationshipsMap) } else { } } } func getRelatedObjects(collection, objectID, relationship string, limit int) ([]map[string]interface{}, error) { if collection == "urls" { // If collections is "urls" the objectID is the URL itself and // it needs to be encoded in base64. objectID = base64.RawURLEncoding.EncodeToString([]byte(objectID)) } client, err := NewAPIClient() if err != nil { return nil, err } it, err := client.Iterator( vt.URL("%s/%s/%s", collection, objectID, relationship), vt.IteratorLimit(limit)) if err != nil { return nil, err } defer it.Close() result := make([]map[string]interface{}, 0) for it.Next() { obj := it.Get() result = append(result, utils.ObjectToMap(obj)) } if err := it.Error(); err != nil { return nil, err } return result, nil } // NewRelationshipCmd returns a new instance of the 'relationship' command. func NewRelationshipCmd(collection, relationship, use, description string, private_flag bool) *cobra.Command { cmd := &cobra.Command{ Args: cobra.ExactArgs(1), Use: fmt.Sprintf("%s %s", relationship, use), Short: description, RunE: func(cmd *cobra.Command, args []string) error { objectID := args[0] if collection == "urls" { // If collections is "urls" let's encode the objectID is the // URL itself and it needs to be encoded in base64. objectID = base64.RawURLEncoding.EncodeToString([]byte(objectID)) } p, err := NewPrinter(cmd) if err != nil { return err } if viper.GetBool("private") { collection = "private/" + collection } url := vt.URL("%s/%s/%s", collection, objectID, relationship) return p.PrintCollection(url) }, } addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) if private_flag { addPrivateFlag(cmd.Flags()) } return cmd } // NewRelationshipsCmd returns a new instance of the 'relationships' command. func NewRelationshipsCmd(collection, objectType, use string, private_flag bool) *cobra.Command { cmd := &cobra.Command{ Use: fmt.Sprintf("relationships %s", use), Short: "Get all relationships.", Args: cobra.ExactArgs(1), RunE: func(cmd *cobra.Command, args []string) error { var wg sync.WaitGroup var sm sync.Map if viper.GetBool("private") { objectType = "private_" + objectType collection = "private/" + collection } for _, r := range objectRelationshipsMap[objectType] { wg.Add(1) go func(relationshipName string) { objs, err := getRelatedObjects( collection, args[0], relationshipName, viper.GetInt("limit")) if err != nil { fmt.Println(err) } else if len(objs) > 0 { sm.Store(relationshipName, objs) } wg.Done() }(r.Name) } wg.Wait() m := make(map[string]interface{}) sm.Range(func(key, value interface{}) bool { m[key.(string)] = value return true }) if viper.IsSet("include") || viper.IsSet("exclude") { m = utils.FilterMap(m, viper.GetStringSlice("include"), viper.GetStringSlice("exclude")) } p, err := NewPrinter(cmd) if err != nil { return err } return p.Print(m) }, } addIncludeExcludeFlags(cmd.Flags()) addLimitFlag(cmd.Flags()) if private_flag { addPrivateFlag(cmd.Flags()) } return cmd } func addRelationshipCmds(cmd *cobra.Command, collection, objectType, use string, private_flag bool) { relationships := objectRelationshipsMap[objectType] for _, r := range relationships { cmd.AddCommand(NewRelationshipCmd(collection, r.Name, use, r.Description, private_flag)) } cmd.AddCommand(NewRelationshipsCmd(collection, objectType, use, private_flag)) } vt-cli-1.3.1/cmd/retrohunt.go000066400000000000000000000177221520306561600160530ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "fmt" "github.com/VirusTotal/vt-cli/utils" "io" "os" "regexp" "strings" "sync" "time" humanize "github.com/dustin/go-humanize" vt "github.com/VirusTotal/vt-go" "github.com/gosuri/uitable" "github.com/spf13/cobra" "github.com/spf13/viper" ) var rulesPattern = regexp.MustCompile(`rule\s+(\w+)\s*(:(\s*\w+\s*)+)?{`) func retrohuntListTable(cmd *cobra.Command) error { client, err := NewAPIClient() if err != nil { return err } it, err := client.Iterator( vt.URL("intelligence/retrohunt_jobs"), vt.IteratorLimit(viper.GetInt("limit")), vt.IteratorFilter(viper.GetString("filter"))) if err != nil { return err } defer it.Close() table := uitable.New() table.AddRow( "JOB ID", "CREATED", "STARTED", "STATUS", "ETA", "SCANNED", "MATCHES", "RULES") table.RightAlign(5) table.RightAlign(6) for it.Next() { job := it.Get() status := job.MustGetString("status") startDate := "not yet" if s, err := job.GetTime("start_date"); err == nil { startDate = humanize.Time(s) } if status == "queued" || status == "running" { status = fmt.Sprintf("%s (%.1f%%)", status, job.MustGetFloat64("progress")) } eta := "-" if e, err := job.GetInt64("eta_seconds"); err == nil { eta = time.Duration(e * 1000000000).String() } rules, _ := job.GetString("rules") matches := rulesPattern.FindAllStringSubmatch(rules, 5) ruleNames := make([]string, len(matches)) for i, m := range matches { ruleNames[i] = m[1] } rules = strings.Join(ruleNames, ", ") if len(rules) > 40 { rules = rules[0:40] + "…" } creationDate, _ := job.GetTime("creation_date") scannedBytes, _ := job.GetInt64("scanned_bytes") numMatches, _ := job.GetInt64("num_matches") table.AddRow( job.ID(), humanize.Time(creationDate), startDate, status, eta, humanize.Bytes(uint64(scannedBytes)), humanize.Comma(numMatches), rules) } fmt.Println(table) return it.Error() } // NewRetrohuntListCmd returns a new instance of the 'list' command. func NewRetrohuntListCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"ls"}, Use: "list", Short: "List retrohunt jobs", Long: `List retrohunt jobs.`, RunE: func(cmd *cobra.Command, args []string) error { if viper.GetBool("human") { for _, flag := range []string{"cursor", "include", "exclude"} { if cmd.Flag(flag).Changed { return fmt.Errorf("--%s can't be used with --human", flag) } } return retrohuntListTable(cmd) } p, err := NewPrinter(cmd) if err != nil { return err } return p.PrintCollection(vt.URL("intelligence/retrohunt_jobs")) }, } addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addFilterFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) addHumanFlag(cmd.Flags()) return cmd } var retrohuntStartCmdHelp = `Start a retrohunt job. This command receives a file containing YARA rules and starts a retrohunt job with those rules.` // NewRetrohuntStartCmd returns a new instance of the 'start' command. func NewRetrohuntStartCmd() *cobra.Command { cmd := &cobra.Command{ Use: "start [file]", Short: "Start a retrohunt job", Long: retrohuntStartCmdHelp, Args: cobra.ExactArgs(1), RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } var rules []byte if args[0] == "-" { rules, err = io.ReadAll(os.Stdin) } else { rules, err = os.ReadFile(args[0]) } if err != nil { return err } obj := vt.NewObject("retrohunt_job") obj.SetString("rules", string(rules)) obj.SetString("corpus", viper.GetString("corpus")) before := viper.GetString("before") after := viper.GetString("after") var timeRange map[string]int64 if before != "" || after != "" { timeRange = make(map[string]int64) obj.Set("time_range", timeRange) } if after != "" { if t, err := time.Parse("2006-01-02", after); err == nil { timeRange["start"] = t.Unix() } else { return err } } if before != "" { if t, err := time.Parse("2006-01-02", before); err == nil { timeRange["end"] = t.Unix() } else { return err } } err = client.PostObject(vt.URL("intelligence/retrohunt_jobs"), obj) if err != nil { return err } fmt.Println(obj.ID()) return nil }, } cmd.Flags().String( "before", "", "scan files sent to VirusTotal before the given date (format: YYYY-MM-DD)") cmd.Flags().String( "after", "", "scan files sent to VirusTotal after the given date (format: YYYY-MM-DD)") cmd.Flags().String( "corpus", "main", "specify the corpus that will be scanned, possible values are \"main\" and \"goodware\"") cmd.MarkZshCompPositionalArgumentFile(1) return cmd } // NewRetrohuntAbortCmd returns a new instance of the 'abort' command. func NewRetrohuntAbortCmd() *cobra.Command { return &cobra.Command{ Use: "abort [job id]", Short: "Abort a retrohunt job", Args: cobra.ExactArgs(1), RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } url := vt.URL("intelligence/retrohunt_jobs/%s/abort", args[0]) _, err = client.Post(url, nil) return err }, } } // NewRetrohuntDeleteCmd returns a new instance of the 'delete' command. func NewRetrohuntDeleteCmd() *cobra.Command { return &cobra.Command{ Aliases: []string{"del", "rm"}, Use: "delete [job id]...", Short: "Delete a retrohunt job", Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } var wg sync.WaitGroup for _, arg := range args { wg.Add(1) go func(jobID string) { url := vt.URL("intelligence/retrohunt_jobs/%s", jobID) if _, err := client.Delete(url); err != nil { fmt.Fprintf(os.Stderr, "%v\n", err) } wg.Done() }(arg) } wg.Wait() return nil }, } } // NewRetrohuntMatchesCmd returns a new instance of the 'matches' command. func NewRetrohuntMatchesCmd() *cobra.Command { cmd := &cobra.Command{ Use: "matches [job id]", Short: "Get matches for a retrohunt job", Args: cobra.ExactArgs(1), RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.PrintCollection(vt.URL("intelligence/retrohunt_jobs/%s/matching_files", args[0])) }, } addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) return cmd } // NewRetrohuntCmd returns a new instance of the 'retrohunt' command. func NewRetrohuntCmd() *cobra.Command { cmd := &cobra.Command{ Aliases: []string{"rh"}, Use: "retrohunt [id]...", Short: "Manage retrohunt jobs", Long: `Manage retrohunt jobs.`, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { re, _ := regexp.Compile("\\w+-\\d+") p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "intelligence/retrohunt_jobs/%s", utils.StringReaderFromCmdArgs(args), re) }, } addThreadsFlag(cmd.Flags()) cmd.AddCommand(NewRetrohuntAbortCmd()) cmd.AddCommand(NewRetrohuntDeleteCmd()) cmd.AddCommand(NewRetrohuntListCmd()) cmd.AddCommand(NewRetrohuntMatchesCmd()) cmd.AddCommand(NewRetrohuntStartCmd()) return cmd } vt-cli-1.3.1/cmd/scan.go000066400000000000000000000222241520306561600147360ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "context" "fmt" "os" "strings" "time" "github.com/VirusTotal/vt-cli/utils" vt "github.com/VirusTotal/vt-go" "github.com/spf13/cobra" "github.com/spf13/pflag" "github.com/spf13/viper" ) const ( // PollFrequency defines the interval in which requests are sent to the // VT API to check if the analysis is completed. PollFrequency = 10 * time.Second // TimeoutLimit defines the maximum amount of minutes to wait for an // analysis' results. TimeoutLimit = 10 * time.Minute ) // waitForAnalysisResults calls every PollFrequency seconds to the VT API and // checks whether an analysis is completed or not. When the analysis is completed // it is returned. func waitForAnalysisResults(cli *utils.APIClient, analysisId string, ds *utils.DoerState) (*vt.Object, error) { ds.Progress = "Waiting for analysis completion..." ticker := time.NewTicker(PollFrequency) defer ticker.Stop() ctx, cancel := context.WithTimeout(context.Background(), TimeoutLimit) defer cancel() i := 1 for { select { case <-ctx.Done(): return nil, ctx.Err() case <-ticker.C: ds.Progress = fmt.Sprintf("Waiting for analysis completion...%s", strings.Repeat(".", i)) i++ if obj, err := cli.GetObject(vt.URL(fmt.Sprintf("analyses/%s", analysisId))); err != nil { // If the API returned an error 503 (transient error) retry; otherwise just return // the error to the user. if e, ok := err.(*vt.Error); !ok || e.Code != "TransientError" { ds.Progress = "" return nil, fmt.Errorf("error retrieving analysis result: %v", err) } } else if status, _ := obj.Get("status"); status == "completed" { ds.Progress = "" // Request the full object report and return it instead of just // the analysis results. return cli.GetObject(vt.URL(fmt.Sprintf("analyses/%s/item", analysisId))) } } } } type fileScanner struct { scanner *vt.FileScanner cli *utils.APIClient printer *utils.Printer showInVT bool waitForCompletion bool password string } func (s *fileScanner) Do(path interface{}, ds *utils.DoerState) string { progressCh := make(chan float32) defer close(progressCh) go func() { for progress := range progressCh { if progress < 100 { ds.Progress = fmt.Sprintf("%s uploading... %4.1f%%", path, progress) } else { ds.Progress = fmt.Sprintf("%s scanning...", path) } } }() f, err := os.Open(path.(string)) if err != nil { return err.Error() } defer f.Close() var analysis *vt.Object if s.password != "" { analysis, err = s.scanner.ScanFileWithParameters( f, progressCh, map[string]string{"password": s.password}) } else { analysis, err = s.scanner.ScanFile(f, progressCh) } if err != nil { return err.Error() } if s.showInVT { // Return the analysis URL in VT so users can visit it. return fmt.Sprintf( "%s https://www.virustotal.com/gui/file-analysis/%s", path.(string), analysis.ID()) } if s.waitForCompletion { analysisResult, err := waitForAnalysisResults(s.cli, analysis.ID(), ds) if err != nil { return err.Error() } s.printer.PrintObject(analysisResult) return "" } return fmt.Sprintf("%s %s", path.(string), analysis.ID()) } var scanFileCmdHelp = `Scan one or more files. This command receives one or more file paths and uploads them to VirusTotal for scanning. It returns the file paths followed by their corresponding analysis IDs. You can use the "vt analysis" command for retrieving information about the analyses or you can use the --wait flag to see the results when the analysis is completed. If the command receives a single hypen (-) the file paths are read from the standard input, one per line. The command can also receive a directory to scan all files contained on it.` var scanFileCmdExample = ` vt scan file foo.exe vt scan file foo.exe bar.exe vt scan file foo/ cat list_of_file_paths | vt scan file -` // NewScanFileCmd returns a new instance of the 'scan file' command. func NewScanFileCmd() *cobra.Command { cmd := &cobra.Command{ Use: "file [[dir] | [file]...]", Short: "Scan one or more files", Long: scanFileCmdHelp, Example: scanFileCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { c := utils.NewCoordinator(viper.GetInt("threads")) var argReader utils.StringReader if len(args) == 1 && args[0] == "-" { argReader = utils.NewStringIOReader(os.Stdin) } else if len(args) == 1 && utils.IsDir(args[0]) { recursive := viper.GetBool("recursive") maxDepth := viper.GetInt("maxDepth") argReader, _ = utils.NewFileDirReader(args[0], recursive, maxDepth) } else { argReader = utils.NewStringArrayReader(args) } client, err := NewAPIClient() if err != nil { return err } p, err := NewPrinter(cmd) if err != nil { return err } s := &fileScanner{ scanner: client.NewFileScanner(), showInVT: viper.GetBool("open"), waitForCompletion: viper.GetBool("wait"), password: viper.GetString("password"), printer: p, cli: client} c.DoWithStringsFromReader(s, argReader) return nil }, } addRecursive(cmd.Flags()) addMaxDepth(cmd.Flags()) addThreadsFlag(cmd.Flags()) addOpenInVTFlag(cmd.Flags()) addPasswordFlag(cmd.Flags()) addWaitForCompletionFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) cmd.MarkZshCompPositionalArgumentFile(1) return cmd } type urlScanner struct { scanner *vt.URLScanner cli *utils.APIClient printer *utils.Printer showInVT bool waitForCompletion bool } func (s *urlScanner) Do(url interface{}, ds *utils.DoerState) string { analysis, err := s.scanner.Scan(url.(string)) if err != nil { return err.Error() } if s.showInVT { return fmt.Sprintf( "%s https://www.virustotal.com/gui/url-analysis/%s", url, analysis.ID()) } if s.waitForCompletion { analysisResult, err := waitForAnalysisResults(s.cli, analysis.ID(), ds) if err != nil { return err.Error() } s.printer.PrintObject(analysisResult) return "" } return fmt.Sprintf("%s %s", url, analysis.ID()) } var scanURLCmdHelp = `Scan one or more URLs. This command receives one or more URLs and scan them. It returns the URLs followed by their corresponding analysis IDs. You can use the "vt analysis" command for retrieving information about the analyses or you can use the --wait flag to see the results when the analysis is completed. If the command receives a single hypen (-) the URLs are read from the standard input, one per line.` var scanURLCmdExample = ` vt scan url http://foo.com vt scan url http://foo.com http://bar.com cat list_of_urls | vt scan urls -` // NewScanURLCmd returns a new instance of the 'scan url' command. func NewScanURLCmd() *cobra.Command { cmd := &cobra.Command{ Use: "url [url]...", Short: "Scan one of more URLs", Long: scanURLCmdHelp, Example: scanURLCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { c := utils.NewCoordinator(viper.GetInt("threads")) var argReader utils.StringReader if len(args) == 1 && args[0] == "-" { argReader = utils.NewStringIOReader(os.Stdin) } else { argReader = utils.NewStringArrayReader(args) } client, err := NewAPIClient() if err != nil { return err } p, err := NewPrinter(cmd) if err != nil { return err } s := &urlScanner{ scanner: client.NewURLScanner(), showInVT: viper.GetBool("open"), waitForCompletion: viper.GetBool("wait"), printer: p, cli: client} c.DoWithStringsFromReader(s, argReader) return nil }, } addThreadsFlag(cmd.Flags()) addOpenInVTFlag(cmd.Flags()) addWaitForCompletionFlag(cmd.Flags()) return cmd } var scanCmdHelp = `Scan files or URLs. This group of commands allow to scan files and URLs.` // NewScanCmd returns a new instance of the 'scan' command. func NewScanCmd() *cobra.Command { cmd := &cobra.Command{ Use: "scan", Short: "Scan files or URLs", Long: scanCmdHelp, } cmd.AddCommand(NewScanURLCmd()) cmd.AddCommand(NewScanFileCmd()) return cmd } func addOpenInVTFlag(flags *pflag.FlagSet) { flags.BoolP( "open", "o", false, "Return an URL to see the analysis report at the VirusTotal web GUI") } func addWaitForCompletionFlag(flags *pflag.FlagSet) { flags.BoolP( "wait", "w", false, "Wait until the analysis is completed and show the analysis results") } func addPasswordFlag(flags *pflag.FlagSet) { flags.StringP( "password", "p", "", "Password of the protected file") } vt-cli-1.3.1/cmd/search.go000066400000000000000000000143661520306561600152670ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "fmt" "strings" "github.com/spf13/viper" "github.com/VirusTotal/vt-cli/utils" vt "github.com/VirusTotal/vt-go" "github.com/spf13/cobra" ) func preRunSearchCmd(c *cobra.Command, args []string) error { if viper.GetBool("download") { for _, flag := range []string{"include", "identifiers-only"} { if c.Flag(flag).Changed { return fmt.Errorf("--%s can't be used with --download", flag) } } } else { for _, flag := range []string{"output", "threads"} { if c.Flag(flag).Changed { return fmt.Errorf("--%s must be used with --download", flag) } } } return nil } func runSearchCmd(cmd *cobra.Command, args []string) error { batchSize := 25 if viper.GetInt("limit") < batchSize { batchSize = viper.GetInt("limit") } client, err := NewAPIClient() if err != nil { return err } it, err := client.Search(args[0], vt.IteratorLimit(viper.GetInt("limit")), vt.IteratorCursor(viper.GetString("cursor")), vt.IteratorBatchSize(batchSize), vt.IteratorDescriptorsOnly( viper.GetBool("identifiers-only") || viper.GetBool("download"))) if err != nil { return err } if viper.GetBool("download") { ch := make(chan interface{}) go func() { for it.Next() { obj := it.Get() ch <- obj.ID() } close(ch) }() c := utils.NewCoordinator(viper.GetInt("threads")) c.DoWithItemsFromChannel(&downloader{newFileDownloader(client)}, ch) return it.Error() } p, err := NewPrinter(cmd) if err != nil { return err } return p.PrintIterator(it) } var cmdSearchHelp = `Search for files using VirusTotal Intelligence's query language.` var cmdSearchExample = ` vt search eicar vt search "foobar p:1+"` // NewSearchCmd returns a new instance of the 'search' command. func NewSearchCmd() *cobra.Command { cmd := &cobra.Command{ Args: cobra.ExactArgs(1), Use: "search [query]", Short: "Search for files in VirusTotal Intelligence", Long: cmdSearchHelp, Example: cmdSearchExample, PreRunE: preRunSearchCmd, RunE: runSearchCmd, } cmd.Flags().BoolP( "download", "d", false, "download files that match the query") addIDOnlyFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) addThreadsFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) addOutputFlag(cmd.Flags()) cmd.AddCommand(NewContentSearchCmd()) return cmd } type matchPrinter struct { client *utils.APIClient idOnly bool } func (m *matchPrinter) Do(fileObj interface{}, ds *utils.DoerState) string { f := fileObj.(*vt.Object) var line string if m.idOnly { line = f.ID() } else { var s string confidence, _ := f.GetContextFloat64("confidence") snippetID, _ := f.GetContextString("snippet") inSubFile, _ := f.GetContextBool("match_in_subfile") snippets := make([]string, 0) _, err := m.client.GetData(vt.URL("intelligence/search/snippets/%s", snippetID), &snippets) if err == nil { s = strings.Join(snippets, "\n\n") s = strings.Replace(s, "\x1c", "\033[1m", -1) s = strings.Replace(s, "\x1d", "\033[0m", -1) } else { s = "" } line = fmt.Sprintf( "%s\n\nsha256 : %s\nscore : %03.1f \nsubfile : %v\n\n%s\n", strings.Repeat("_", 76), f.ID(), confidence, inSubFile, s) } return line } func getIgnoredSubstrings(meta map[string]interface{}) []string { if i, ok := meta["ignored_substrings"]; ok { ii := i.([]interface{}) ss := make([]string, len(ii)) for i := range ss { ss[i] = ii[i].(string) } return ss } return nil } func runContentSearchCmd(cmd *cobra.Command, args []string) error { batchSize := 10 if viper.GetInt("limit") < batchSize { batchSize = viper.GetInt("limit") } client, err := NewAPIClient() if err != nil { return err } terms := make([]string, len(args)) for i, arg := range args { terms[i] = fmt.Sprintf("content:%s", arg) } it, err := client.Search(strings.Join(terms, " "), vt.IteratorLimit(viper.GetInt("limit")), vt.IteratorCursor(viper.GetString("cursor")), vt.IteratorBatchSize(batchSize), vt.IteratorDescriptorsOnly( viper.GetBool("identifiers-only") || viper.GetBool("download"))) if err != nil { return err } c := utils.NewCoordinator(viper.GetInt("threads")) var doer utils.Doer if viper.GetBool("download") { doer = &downloader{newFileDownloader(client)} } else { doer = &matchPrinter{client, viper.GetBool("identifiers-only")} c.EnableSpinner() } c.DoWithObjectsFromIterator(doer, it, batchSize) if ignored := getIgnoredSubstrings(it.Meta()); ignored != nil { colorScheme.CommentColor.Printf( "IGNORED SUBSTRINGS:\n%s\n", strings.Join(ignored, "\n")) } p, err := NewPrinter(cmd) if err != nil { return err } p.PrintCommandLineWithCursor(it) return it.Error() } var cmdContentSearchHelp = `Search for content within files in VirusTotal` var cmdContentSearchExample = ` vt search content foobarbaz vt search content '"foo bar baz"' vt search content {cafebabe} vt search content '{70 6C 75 73 76 69 63 [1] 79 61 72 61}' vt search content '/virustotal(.org|.com)/'` // NewContentSearchCmd returns a new instance of the 'search content' command. func NewContentSearchCmd() *cobra.Command { cmd := &cobra.Command{ Args: cobra.MinimumNArgs(1), Use: "content [query]", Short: "Search for patterns within files in VirusTotal Intelligence", Long: cmdContentSearchHelp, Example: cmdContentSearchExample, RunE: runContentSearchCmd, } cmd.Flags().BoolP( "download", "d", false, "download files that match the query") cmd.Flags().BoolP( "exact-matches-only", "e", false, "exact matches only") addThreadsFlag(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) return cmd } vt-cli-1.3.1/cmd/threat_profile.go000066400000000000000000000314731520306561600170270ustar00rootroot00000000000000package cmd import ( "fmt" "os" "github.com/VirusTotal/vt-go" "github.com/spf13/cobra" "github.com/spf13/viper" "github.com/VirusTotal/vt-cli/utils" ) var threatProfileCmdHelp = `Get information about one or more Threat Profiles. This command receives one or more Threat Profile IDs and returns information about them. The information for each profile is returned in the same order as the IDs are passed to the command. If the command receives a single hyphen (-) the IDs will be read from the standard input, one per line.` var threatProfileCmdExample = ` vt threatprofile vt threatprofile cat list_of_profile_ids | vt threatprofile -` // NewThreatProfileCmd returns a new instance of the 'threatprofile' command. func NewThreatProfileCmd() *cobra.Command { cmd := &cobra.Command{ Use: "threatprofile [id]...", Short: "Get information about Threat Profiles", Long: threatProfileCmdHelp, Example: threatProfileCmdExample, Args: cobra.MinimumNArgs(1), // For fetching specific profiles by ID RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "threat_profiles/%s", utils.StringReaderFromCmdArgs(args), nil) // No specific regexp for ID needed }, } addRelationshipCmds(cmd, "threat_profiles", "threat_profile", "[id]", false) addThreadsFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) cmd.AddCommand(NewThreatProfileListCmd()) cmd.AddCommand(NewThreatProfileCreateCmd()) cmd.AddCommand(NewThreatProfileUpdateCmd()) cmd.AddCommand(NewThreatProfileDeleteCmd()) return cmd } var threatProfileListCmdHelp = `List Threat Profiles.` var threatProfileListCmdExample = ` vt threatprofile list vt threatprofile list --filter "name:APT" --limit 10 vt threatprofile list --cursor ` // NewThreatProfileListCmd returns a command for listing Threat Profiles. func NewThreatProfileListCmd() *cobra.Command { cmd := &cobra.Command{ Use: "list", Short: "List Threat Profiles", Long: threatProfileListCmdHelp, Example: threatProfileListCmdExample, RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.PrintCollection(vt.URL("threat_profiles")) }, } addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addFilterFlag(cmd.Flags()) addLimitFlag(cmd.Flags()) addCursorFlag(cmd.Flags()) return cmd } var threatProfileUpdateCmdHelp = `Update a Threat Profile. This command updates an existing Threat Profile with the specified ID. You can update attributes like name, interests, and recommendation configuration.` var threatProfileUpdateCmdExample = ` vt threatprofile update --name "Updated Name" vt threatprofile update --targeted-region "US,CA" --actor-motivation "cybercrime"` // NewThreatProfileUpdateCmd returns a command for updating a Threat Profile. func NewThreatProfileUpdateCmd() *cobra.Command { cmd := &cobra.Command{ Use: "update [id]", Short: "Update a Threat Profile", Long: threatProfileUpdateCmdHelp, Example: threatProfileUpdateCmdExample, Args: cobra.ExactArgs(1), // Threat Profile ID is required RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } printer, err := NewPrinter(cmd) if err != nil { return err } profileID := args[0] threatProfile := vt.NewObjectWithID("threat_profile", profileID) // Check and set flags for attributes if cmd.Flags().Changed("name") { threatProfile.SetString("name", viper.GetString("name")) } // Check and set flags for interests interestsData := make(map[string]interface{}) interestsChanged := false if cmd.Flags().Changed("targeted-industry") { interestsData["INTEREST_TYPE_TARGETED_INDUSTRY"] = viper.GetStringSlice("targeted-industry") interestsChanged = true } if cmd.Flags().Changed("targeted-region") { interestsData["INTEREST_TYPE_TARGETED_REGION"] = viper.GetStringSlice("targeted-region") interestsChanged = true } if cmd.Flags().Changed("source-region") { interestsData["INTEREST_TYPE_SOURCE_REGION"] = viper.GetStringSlice("source-region") interestsChanged = true } if cmd.Flags().Changed("malware-role") { interestsData["INTEREST_TYPE_MALWARE_ROLE"] = viper.GetStringSlice("malware-role") interestsChanged = true } if cmd.Flags().Changed("actor-motivation") { interestsData["INTEREST_TYPE_ACTOR_MOTIVATION"] = viper.GetStringSlice("actor-motivation") interestsChanged = true } if interestsChanged { threatProfile.Set("interests", interestsData) } // Check and set flags for recommendation_config recommendationConfigData := make(map[string]interface{}) recommendationConfigChanged := false if cmd.Flags().Changed("max-recs-per-type") { recommendationConfigData["max_recs_per_type"] = viper.GetInt("max-recs-per-type") recommendationConfigChanged = true } if cmd.Flags().Changed("min-categories-matched") { recommendationConfigData["min_categories_matched"] = viper.GetInt("min-categories-matched") recommendationConfigChanged = true } if cmd.Flags().Changed("max-days-since-last-seen") { recommendationConfigData["max_days_since_last_seen"] = viper.GetInt("max-days-since-last-seen") recommendationConfigChanged = true } if recommendationConfigChanged { threatProfile.Set("recommendation_config", recommendationConfigData) } // Need to check if *any* flag was changed besides the default ones // (like --format, --apikey, etc.). If only the ID is provided // without any update flags, it should probably error or do nothing. // Let's check if any of the specific update flags were changed. updateFlagsChanged := cmd.Flags().Changed("name") || interestsChanged || recommendationConfigChanged if !updateFlagsChanged { return fmt.Errorf("no update flags provided. Use --help for available flags") } if err := client.PatchObject(vt.URL("threat_profiles/%s", profileID), threatProfile); err != nil { return err } // Fetch the updated object to print the full details, as PatchObject might not return all attributes updatedThreatProfile, err := client.GetObject(vt.URL("threat_profiles/%s", profileID)) if err != nil { // If fetching the updated object fails, at least report the patch was successful fmt.Fprintf(os.Stderr, "Warning: Failed to fetch updated threat profile details: %v\n", err) fmt.Printf("Threat profile %s updated successfully.\n", profileID) return nil } if viper.GetBool("identifiers-only") { fmt.Printf("%s\n", updatedThreatProfile.ID()) } else { return printer.PrintObject(updatedThreatProfile) } return nil }, } // Add flags for updatable attributes cmd.Flags().StringP("name", "n", "", "Threat Profile's name") // Flags for interests (optional, can be updated) cmd.Flags().StringSlice("targeted-industry", []string{}, "List of targeted industries (comma-separated)") cmd.Flags().StringSlice("targeted-region", []string{}, "List of targeted regions (comma-separated)") cmd.Flags().StringSlice("source-region", []string{}, "List of source regions (comma-separated)") cmd.Flags().StringSlice("malware-role", []string{}, "List of malware roles (comma-separated)") cmd.Flags().StringSlice("actor-motivation", []string{}, "List of actors’ motivations (comma-separated)") // Flags for recommendation_config (optional, can be updated) cmd.Flags().Int("max-recs-per-type", 0, "Max recommendations per type (1-20)") // Use 0 as default to detect if set cmd.Flags().Int("min-categories-matched", 0, "Min matching categories for recommendation (1-5)") cmd.Flags().Int("max-days-since-last-seen", 0, "Max lookback period in days for recommendations (1-365)") addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) return cmd } var threatProfileDeleteCmdHelp = `Delete one or more Threat Profiles. This command receives one or more Threat Profile IDs and deletes them. The command will ask for confirmation before deleting.` var threatProfileDeleteCmdExample = ` vt threatprofile delete vt threatprofile delete cat list_of_profile_ids | vt threatprofile delete -` // NewThreatProfileDeleteCmd returns a command for deleting Threat Profiles. func NewThreatProfileDeleteCmd() *cobra.Command { cmd := &cobra.Command{ Use: "delete [id]...", Short: "Delete Threat Profiles", Long: threatProfileDeleteCmdHelp, Example: threatProfileDeleteCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } for _, id := range args { if _, err := client.Delete(vt.URL("threat_profiles/%s", id)); err != nil { return err } } return nil }, } return cmd } var createThreatProfileCmdHelp = `Creates a Threat Profile. This command creates a new Threat Profile with the specified name, description, interests, and recommendation configuration. For interest types, provide comma-separated values if multiple values are needed for a single interest type flag.` var createThreatProfileCmdExample = ` vt threatprofile create --name "My New Threat Profile" --targeted-region "US,ES"` // NewThreatProfileCreateCmd returns a command for creating a Threat Profile. func NewThreatProfileCreateCmd() *cobra.Command { cmd := &cobra.Command{ Use: "create", Short: "Create a Threat Profile", Long: createThreatProfileCmdHelp, Example: createThreatProfileCmdExample, RunE: func(cmd *cobra.Command, args []string) error { client, err := NewAPIClient() if err != nil { return err } printer, err := NewPrinter(cmd) if err != nil { return err } threatProfile := vt.NewObject("threat_profile") threatProfile.SetString("name", viper.GetString("name")) // Optional interests interestsData := make(map[string]interface{}) if viper.IsSet("targeted-industry") { interestsData["INTEREST_TYPE_TARGETED_INDUSTRY"] = viper.GetStringSlice("targeted-industry") } if viper.IsSet("targeted-region") { interestsData["INTEREST_TYPE_TARGETED_REGION"] = viper.GetStringSlice("targeted-region") } if viper.IsSet("source-region") { interestsData["INTEREST_TYPE_SOURCE_REGION"] = viper.GetStringSlice("source-region") } if viper.IsSet("malware-role") { interestsData["INTEREST_TYPE_MALWARE_ROLE"] = viper.GetStringSlice("malware-role") } if viper.IsSet("actor-motivation") { interestsData["INTEREST_TYPE_ACTOR_MOTIVATION"] = viper.GetStringSlice("actor-motivation") } if len(interestsData) > 0 { threatProfile.Set("interests", interestsData) } // Optional recommendation_config recommendationConfigData := make(map[string]interface{}) if viper.IsSet("max-recs-per-type") { recommendationConfigData["max_recs_per_type"] = viper.GetInt("max-recs-per-type") } if viper.IsSet("min-categories-matched") { recommendationConfigData["min_categories_matched"] = viper.GetInt("min-categories-matched") } if viper.IsSet("max-days-since-last-seen") { recommendationConfigData["max_days_since_last_seen"] = viper.GetInt("max-days-since-last-seen") } if len(recommendationConfigData) > 0 { threatProfile.Set("recommendation_config", recommendationConfigData) } if err := client.PostObject(vt.URL("threat_profiles"), threatProfile); err != nil { return err } if viper.GetBool("identifiers-only") { fmt.Printf("%s\n", threatProfile.ID()) } else { return printer.PrintObject(threatProfile) } return nil }, } cmd.Flags().StringP("name", "n", "", "Threat Profile's name (required)") _ = cmd.MarkFlagRequired("name") // Flags for interests cmd.Flags().StringSlice("targeted-industry", []string{}, "List of targeted industries (comma-separated)") cmd.Flags().StringSlice("targeted-region", []string{}, "List of targeted regions (comma-separated)") cmd.Flags().StringSlice("source-region", []string{}, "List of source regions (comma-separated)") cmd.Flags().StringSlice("malware-role", []string{}, "List of malware roles (comma-separated)") cmd.Flags().StringSlice("actor-motivation", []string{}, "List of actors’ motivations (comma-separated)") // Flags for recommendation_config cmd.Flags().Int("max-recs-per-type", 10, "Max recommendations per type (1-20, default 10 if not set by API)") // Default to 0 to check if set cmd.Flags().Int("min-categories-matched", 1, "Min matching categories for recommendation (1-5, default 1 if not set by API)") cmd.Flags().Int("max-days-since-last-seen", 180, "Max lookback period in days for recommendations (1-365, default 180 if not set by API)") addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) return cmd } vt-cli-1.3.1/cmd/url.go000066400000000000000000000053361520306561600146210ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "encoding/base64" "regexp" "github.com/VirusTotal/vt-cli/utils" "github.com/spf13/cobra" "github.com/spf13/viper" ) var urlCmdHelp = `Get information about one or more URLs. This command receives one or more URLs and returns information about them. URL hashes as returned in the "object_id" field are also accepted. The information about each URL is returned in the same order as the URLs are passed to the command. If the command receives a single hypen (-) the URLs are read from the standard input, one per line. ` var urlCmdExample = ` vt url https://www.virustotal.com vt url f1177df4692356280844e1d5af67cc4a9eccecf77aa61c229d483b7082c70a8e cat list_of_urls | vt url -` // Regular expressions used for validating a URL identifier. var urlID = regexp.MustCompile(`[0-9a-fA-F]{64}`) // NewURLCmd returns a new instance of the 'url' command. func NewURLCmd() *cobra.Command { cmd := &cobra.Command{ Use: "url [url]...", Short: "Get information about URLs", Long: urlCmdHelp, Example: urlCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } r := utils.NewMappedStringReader( utils.StringReaderFromCmdArgs(args), func(url string) string { if urlID.MatchString(url) { // The user provided a URL identifier as returned by // VirusTotal's API, which consists in the URL's SHA-256. // In that case use the identifier as is. return url } // If the user provides an actual URL, it needs to be // encoded as base64 before being used. return base64.RawURLEncoding.EncodeToString([]byte(url)) }) if viper.GetBool("private") { return p.GetAndPrintObjectsWithFallback( []string{"urls/%s", "private/urls/%s"}, r, nil) } else { return p.GetAndPrintObjects( "urls/%s", r, nil) } }, } addRelationshipCmds(cmd, "urls", "url", "[url]", true) addThreadsFlag(cmd.Flags()) addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addPrivateFlag(cmd.Flags()) return cmd } vt-cli-1.3.1/cmd/user.go000066400000000000000000000033501520306561600147670ustar00rootroot00000000000000// Copyright © 2019 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "strings" "github.com/VirusTotal/vt-cli/utils" "github.com/spf13/cobra" ) var userCmdHelp = `Get information about a VirusTotal user.` var userCmdExample = ` vt user joe vt user 1ebb658141155c16d8bf89629379098b4cf31d4613b13784a108c6a4805c963b vt user joe@domain.com` // NewUserCmd returns a new instance of the 'user' command. func NewUserCmd() *cobra.Command { cmd := &cobra.Command{ Use: "user [username | apikey | email]...", Short: "Get information about VirusTotal users", Long: userCmdHelp, Example: userCmdExample, Args: cobra.MinimumNArgs(1), RunE: func(cmd *cobra.Command, args []string) error { p, err := NewPrinter(cmd) if err != nil { return err } return p.GetAndPrintObjects( "users/%s?relationships="+strings.Join([]string{ "groups", "api_quota_group", "intelligence_quota_group", "monitor_quota_group", }, ","), utils.StringReaderFromCmdArgs(args), nil) }, } addIncludeExcludeFlags(cmd.Flags()) addIDOnlyFlag(cmd.Flags()) addThreadsFlag(cmd.Flags()) cmd.AddCommand(NewPrivilegeCmd("user")) return cmd } vt-cli-1.3.1/cmd/version.go000066400000000000000000000021341520306561600154750ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "fmt" "github.com/spf13/cobra" ) // Version is the current version number. This variable is initialized using the // -X linker flag while building the program. var Version string // NewVersionCmd returns command 'version' func NewVersionCmd() *cobra.Command { return &cobra.Command{ Use: "version", Short: "Show version number", Args: cobra.ExactArgs(0), Run: func(cmd *cobra.Command, args []string) { fmt.Printf("vt-cli %s\n", Version) }, } } vt-cli-1.3.1/cmd/vt.go000066400000000000000000000053151520306561600144450ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package cmd import ( "fmt" "os" vt "github.com/VirusTotal/vt-go" "github.com/spf13/cobra" "github.com/spf13/viper" ) // NewVTCommand creates the `vt` command and its nested children. func NewVTCommand() *cobra.Command { cmd := &cobra.Command{ Use: "vt", Short: "A command-line tool for interacting with VirusTotal", Long: `A command-line tool for interacting with VirusTotal.`, PersistentPreRunE: func(cmd *cobra.Command, args []string) error { if err := viper.BindPFlags(cmd.PersistentFlags()); err != nil { return err } if err := viper.BindPFlags(cmd.Flags()); err != nil { return err } host := viper.GetString("host") if host != "" { vt.SetHost(host) } proxy := viper.GetString("proxy") if proxy != "" { os.Setenv("http_proxy", proxy) } if viper.GetBool("verbose") { if configFile := viper.ConfigFileUsed(); configFile != "" { fmt.Fprintf(os.Stderr, "* Config file: %s\n", configFile) } if apiKey := viper.GetString("apikey"); apiKey != "" { fmt.Fprintf(os.Stderr, "* API key: %s\n", apiKey) } fmt.Fprintf(os.Stderr, "* API host: %s\n", host) } return nil }, } addAPIKeyFlag(cmd.PersistentFlags()) addFormatFlag(cmd.PersistentFlags()) addHostFlag(cmd.PersistentFlags()) addProxyFlag(cmd.PersistentFlags()) addSilentFlag(cmd.PersistentFlags()) addVerboseFlag(cmd.PersistentFlags()) cmd.AddCommand(NewAnalysisCmd()) cmd.AddCommand(NewCollectionCmd()) cmd.AddCommand(NewCompletionCmd()) cmd.AddCommand(NewDomainCmd()) cmd.AddCommand(NewDownloadCmd()) cmd.AddCommand(NewFileCmd()) cmd.AddCommand(NewGenDocCmd()) cmd.AddCommand(NewGroupCmd()) cmd.AddCommand(NewHuntingCmd()) cmd.AddCommand(NewIOCStreamCmd()) cmd.AddCommand(NewInitCmd()) cmd.AddCommand(NewIPCmd()) cmd.AddCommand(NewMetaCmd()) cmd.AddCommand(NewRetrohuntCmd()) cmd.AddCommand(NewScanCmd()) cmd.AddCommand(NewSearchCmd()) cmd.AddCommand(NewURLCmd()) cmd.AddCommand(NewUserCmd()) cmd.AddCommand(NewVersionCmd()) cmd.AddCommand(NewMonitorCmd()) cmd.AddCommand(NewMonitorPartnerCmd()) cmd.AddCommand(NewThreatProfileCmd()) return cmd } vt-cli-1.3.1/csv/000077500000000000000000000000001520306561600135115ustar00rootroot00000000000000vt-cli-1.3.1/csv/csv.go000066400000000000000000000043101520306561600146310ustar00rootroot00000000000000// Copyright © 2023 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package csv import ( "encoding/csv" "fmt" "io" "reflect" "sort" ) // An Encoder writes values as CSV to an output stream. type Encoder struct { w io.Writer } // NewEncoder returns a new CSV encoder that writes to w. func NewEncoder(w io.Writer) *Encoder { return &Encoder{w: w} } // Encode writes the CSV encoding of v to the stream. func (enc *Encoder) Encode(v interface{}) error { if v == nil { _, err := enc.w.Write([]byte("null")) return err } var items []interface{} val := reflect.ValueOf(v) switch val.Kind() { case reflect.Slice: items = make([]interface{}, val.Len()) for i := 0; i < val.Len(); i++ { items[i] = val.Index(i).Interface() } default: items = []interface{}{v} } numObjects := len(items) flattenObjects := make([]map[string]interface{}, numObjects) for i := 0; i < numObjects; i++ { f, err := flatten(items[i]) if err != nil { return err } flattenObjects[i] = f } keys := make(map[string]struct{}) for _, o := range flattenObjects { for k := range o { keys[k] = struct{}{} } } header := make([]string, len(keys)) i := 0 for k := range keys { header[i] = k i++ } sort.Strings(header) w := csv.NewWriter(enc.w) if len(header) > 1 || len(header) == 0 && header[0] != "" { if err := w.Write(header); err != nil { return err } } for _, o := range flattenObjects { record := make([]string, len(keys)) for i, key := range header { val, ok := o[key] if ok && val != nil { record[i] = fmt.Sprintf("%v", val) } } if err := w.Write(record); err != nil { return err } } w.Flush() return w.Error() } vt-cli-1.3.1/csv/csv_test.go000066400000000000000000000023461520306561600156770ustar00rootroot00000000000000// Copyright © 2023 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package csv import ( "bytes" "testing" "github.com/stretchr/testify/assert" ) type Case struct { data interface{} expected string } var csvTests = []Case{ { data: nil, expected: "null", }, { data: []int{1, 2, 3}, expected: "1\n2\n3\n", }, { data: map[string]interface{}{ "b": []int{1, 2}, "a": 2, "c": nil, }, expected: "a,b,c\n2,\"1,2\",null\n", }, } func TestCSV(t *testing.T) { for _, test := range csvTests { b := new(bytes.Buffer) err := NewEncoder(b).Encode(test.data) assert.NoError(t, err) assert.Equal(t, test.expected, b.String(), "Test %v", test.data) } } vt-cli-1.3.1/csv/flatten.go000066400000000000000000000054341520306561600155030ustar00rootroot00000000000000// Copyright © 2023 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package csv import ( "encoding/json" "fmt" "reflect" "strings" ) func flatten(i interface{}) (map[string]interface{}, error) { result := make(map[string]interface{}) err := flattenValue(reflect.ValueOf(i), "", result) return result, err } func flattenValue(v reflect.Value, prefix string, m map[string]interface{}) error { switch v.Kind() { case reflect.Map: return flattenMap(v, prefix, m) case reflect.Struct: return flattenStruct(v, prefix, m) case reflect.Slice: return flattenSlice(v, prefix, m) case reflect.Interface, reflect.Ptr: if v.IsNil() { m[prefix] = "null" } else { return flattenValue(v.Elem(), prefix, m) } default: m[prefix] = v.Interface() } return nil } func flattenSlice(v reflect.Value, prefix string, m map[string]interface{}) error { n := v.Len() if n == 0 { return nil } first := v.Index(0) if first.Kind() == reflect.Interface { if !first.IsNil() { first = first.Elem() } } switch first.Kind() { case reflect.Map, reflect.Slice, reflect.Struct: // Add the JSON representation of lists with complex types. // Otherwise the number of CSV headers can grow significantly. b, err := json.Marshal(v.Interface()) if err != nil { return err } m[prefix] = string(b) default: values := make([]string, v.Len()) for i := 0; i < v.Len(); i++ { val := v.Index(i).Interface() if val == nil { values[i] = "null" } else { values[i] = fmt.Sprintf("%v", val) } } m[prefix] = strings.Join(values, ",") } return nil } func flattenStruct(v reflect.Value, prefix string, m map[string]interface{}) (err error) { n := v.NumField() if prefix != "" { prefix += "/" } for i := 0; i < n; i++ { typeField := v.Type().Field(i) key := typeField.Tag.Get("csv") if key == "" { key = v.Type().Field(i).Name } if err = flattenValue(v.Field(i), prefix+key, m); err != nil { return err } } return err } func flattenMap(v reflect.Value, prefix string, m map[string]interface{}) (err error) { if prefix != "" { prefix += "/" } for _, k := range v.MapKeys() { if err := flattenValue(v.MapIndex(k), fmt.Sprintf("%v%v", prefix, k.Interface()), m); err != nil { return err } } return nil } vt-cli-1.3.1/csv/flatten_test.go000066400000000000000000000065661520306561600165510ustar00rootroot00000000000000// Copyright © 2023 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package csv import ( "testing" "github.com/stretchr/testify/assert" ) type T struct { data interface{} expected map[string]interface{} } var tests = []T{ { data: "foo", expected: map[string]interface{}{"": "foo"}, }, { data: 1, expected: map[string]interface{}{"": 1}, }, { data: false, expected: map[string]interface{}{"": false}, }, { data: true, expected: map[string]interface{}{"": true}, }, { data: map[string]string{}, expected: map[string]interface{}{}, }, { data: map[string]map[string]string{ "foo": {}, }, expected: map[string]interface{}{}, }, { data: []string{}, expected: map[string]interface{}{}, }, { data: map[string]string{ "uno": "1", "dos": "2", "tres": "3", "": "", "#foo": "foo", "|foo": "foo", "_foo": "foo", }, expected: map[string]interface{}{ "": "", "uno": "1", "dos": "2", "tres": "3", "#foo": "foo", "|foo": "foo", "_foo": "foo", }, }, { data: []string{ "uno", "dos", "tres", }, expected: map[string]interface{}{"": "uno,dos,tres"}, }, { data: struct { Foo string Bar string }{ "uno", "dos", }, expected: map[string]interface{}{ "Foo": "uno", "Bar": "dos", }, }, { data: struct { Foo string }{ "uno\ndos", }, expected: map[string]interface{}{"Foo": "uno\ndos"}, }, { data: map[string]interface{}{ "numbers": []interface{}{ map[string]string{ "number": "1", "numeral": "first", }, map[string]string{ "number": "2", "numeral": "second", }, }, }, expected: map[string]interface{}{ "numbers": "[{\"number\":\"1\",\"numeral\":\"first\"},{\"number\":\"2\",\"numeral\":\"second\"}]", }, }, { data: struct { A map[string]string B map[string][]int }{ A: map[string]string{"1": "xx", "2": "yy"}, B: map[string][]int{"hello": {1, 2}}, }, expected: map[string]interface{}{ "A/1": "xx", "A/2": "yy", "B/hello": "1,2", }, }, { data: map[string]interface{}{ "key1": struct { A int B bool `csv:"field"` C []bool }{ A: 2, B: true, C: []bool{true, false}, }, "key2": map[interface{}]interface{}{ 1: []string{"hello", "world"}, 2: []string{}, true: "test", 2.1: map[string]string{ "x": "x", "y": "", }, }, }, expected: map[string]interface{}{ "key1/A": 2, "key1/field": true, "key1/C": "true,false", "key2/1": "hello,world", "key2/true": "test", "key2/2.1/x": "x", "key2/2.1/y": "", }, }, } func TestFlatten(t *testing.T) { for _, test := range tests { result, err := flatten(test.data) assert.NoError(t, err) assert.Equal(t, test.expected, result, "Test %v", test.data) } } vt-cli-1.3.1/doc/000077500000000000000000000000001520306561600134635ustar00rootroot00000000000000vt-cli-1.3.1/doc/vt.md000066400000000000000000000034371520306561600144450ustar00rootroot00000000000000## vt A command-line tool for interacting with VirusTotal ### Synopsis A command-line tool for interacting with VirusTotal. ### Options ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -h, --help help for vt -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt analysis](vt_analysis.md) - Get a file or URL analysis * [vt collection](vt_collection.md) - Get information about collections * [vt completion](vt_completion.md) - Output shell completion code for the specified shell (bash or zsh) * [vt domain](vt_domain.md) - Get information about Internet domains * [vt download](vt_download.md) - Download files * [vt file](vt_file.md) - Get information about files * [vt group](vt_group.md) - Get information about VirusTotal groups * [vt hunting](vt_hunting.md) - Manage malware hunting rules and notifications * [vt init](vt_init.md) - Initialize or re-initialize vt command-line tool * [vt iocstream](vt_iocstream.md) - Manage IoC Stream notifications * [vt ip](vt_ip.md) - Get information about IP addresses * [vt meta](vt_meta.md) - Returns metadata about VirusTotal * [vt monitor](vt_monitor.md) - Manage your monitor account * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs * [vt scan](vt_scan.md) - Scan files or URLs * [vt search](vt_search.md) - Search for files in VirusTotal Intelligence * [vt threatprofile](vt_threatprofile.md) - Get information about Threat Profiles * [vt url](vt_url.md) - Get information about URLs * [vt user](vt_user.md) - Get information about VirusTotal users * [vt version](vt_version.md) - Show version number vt-cli-1.3.1/doc/vt_analysis.md000066400000000000000000000025521520306561600163450ustar00rootroot00000000000000## vt analysis Get a file or URL analysis ### Synopsis Get a file or URL analysis. This command receives one or more analysis identifiers and returns information about the analysis. The data is returned in the same order as the identifiers appear in the command line. If the command receives a single hypen (-) the analysis identifiers are read from the standard input, one per line. ``` vt analysis [hash]... [flags] ``` ### Examples ``` vt analysis f-e04b82f7f8afc6e599d4913bee5eb571921ec8958d1ea5e3bbffe9c7ea9a0960-1542306475 vt analysis u-1db0ad7dbcec0676710ea0eaacd35d5e471d3e11944d53bcbd31f0cbd11bce31-1542292491 cat list_of_analysis_ids | vt analysis - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analysis -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/doc/vt_collection.md000066400000000000000000000076551520306561600166660ustar00rootroot00000000000000## vt collection Get information about collections ### Synopsis Get information about one or more collections. This command receives one or more collection IDs and returns information about them. The information for each collection is returned in the same order as the collections are passed to the command. If the command receives a single hypen (-) the collection will be read from the standard input, one per line. ``` vt collection [collection]... [flags] ``` ### Examples ``` vt collection malpedia_win_emotet vt collection malpedia_win_emotet alienvault_603eb1abdd4812819c64e197 cat list_of_collections | vt collection -n [collection_name] -d [collection_description] - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collection -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt collection associations](vt_collection_associations.md) - Collection's related collections (associations). * [vt collection attack_techniques](vt_collection_attack_techniques.md) - Collection's ATT&CK techniques. * [vt collection autogenerated_graphs](vt_collection_autogenerated_graphs.md) - Autogenerated graphs related to the collection. * [vt collection campaigns](vt_collection_campaigns.md) - Collection's related campaigns. * [vt collection collections](vt_collection_collections.md) - Collection's related collections. * [vt collection comments](vt_collection_comments.md) - Comments for the collection. * [vt collection create](vt_collection_create.md) - Create a collection. * [vt collection delete](vt_collection_delete.md) - Delete a collection. * [vt collection domains](vt_collection_domains.md) - Collection's domains. * [vt collection files](vt_collection_files.md) - Collection's files. * [vt collection ip_addresses](vt_collection_ip_addresses.md) - Collection's IP addresses. * [vt collection malware_families](vt_collection_malware_families.md) - Collection's related malware families. * [vt collection owner](vt_collection_owner.md) - Owner of the collection. * [vt collection references](vt_collection_references.md) - Collection's references. * [vt collection related_collections](vt_collection_related_collections.md) - Returns the Collections containing IOCs which are in this Collection. * [vt collection related_references](vt_collection_related_references.md) - Returns the References of the IOCs in this Collection. * [vt collection related_reports](vt_collection_related_reports.md) - Collection's related reports * [vt collection relationships](vt_collection_relationships.md) - Get all relationships. * [vt collection remove](vt_collection_remove.md) - Remove items from a collection. * [vt collection rename](vt_collection_rename.md) - Rename collection. * [vt collection reports](vt_collection_reports.md) - Collection's related reports. * [vt collection software_toolkits](vt_collection_software_toolkits.md) - Collection's related software toolkits. * [vt collection subscription_preferences](vt_collection_subscription_preferences.md) - Subscription preference for the given user. * [vt collection threat_actors](vt_collection_threat_actors.md) - Collection's related threat actors. * [vt collection update](vt_collection_update.md) - Add new items to a collection. * [vt collection urls](vt_collection_urls.md) - Collection's URLs. * [vt collection vulnerabilities](vt_collection_vulnerabilities.md) - Collection's related vulnerabilities. vt-cli-1.3.1/doc/vt_collection_associations.md000066400000000000000000000016311520306561600214310ustar00rootroot00000000000000## vt collection associations Collection's related collections (associations). ``` vt collection associations [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for associations -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_attack_techniques.md000066400000000000000000000016271520306561600224360ustar00rootroot00000000000000## vt collection attack_techniques Collection's ATT&CK techniques. ``` vt collection attack_techniques [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_autogenerated_graphs.md000066400000000000000000000016601520306561600231270ustar00rootroot00000000000000## vt collection autogenerated_graphs Autogenerated graphs related to the collection. ``` vt collection autogenerated_graphs [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for autogenerated_graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_campaigns.md000066400000000000000000000015771520306561600207050ustar00rootroot00000000000000## vt collection campaigns Collection's related campaigns. ``` vt collection campaigns [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for campaigns -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_collections.md000066400000000000000000000016071520306561600212530ustar00rootroot00000000000000## vt collection collections Collection's related collections. ``` vt collection collections [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_comments.md000066400000000000000000000015711520306561600205620ustar00rootroot00000000000000## vt collection comments Comments for the collection. ``` vt collection comments [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_create.md000066400000000000000000000026201520306561600201740ustar00rootroot00000000000000## vt collection create Create a collection. ### Synopsis Creates a collection from a list of IOCs. This command receives one of more IoCs (sha256 hashes, URLs, domains, IP addresses) and creates a collection from them. If the command receives a single hypen (-) the IoCs will be read from the standard input. ``` vt collection create [ioc]... [flags] ``` ### Examples ``` vt collection create -n [collection_name] -d [collection_description] www.example.com vt collection create -n [collection_name] -d [collection_description] www.example.com 8.8.8.8 cat list_of_iocs | vt collection create -n [collection_name] -d [collection_description] - ``` ### Options ``` -d, --description string Collection's description (required) -x, --exclude strings exclude fields matching the provided pattern -h, --help help for create -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --name string Collection's name (required) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_delete.md000066400000000000000000000012271520306561600201750ustar00rootroot00000000000000## vt collection delete Delete a collection. ### Synopsis Delete a collection. This command receives a collection ID and deletes it. ``` vt collection delete [collection id] [flags] ``` ### Examples ``` vt collection delete [collection id] ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_domains.md000066400000000000000000000015571520306561600203730ustar00rootroot00000000000000## vt collection domains Collection's domains. ``` vt collection domains [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_files.md000066400000000000000000000015471520306561600200420ustar00rootroot00000000000000## vt collection files Collection's files. ``` vt collection files [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_ip_addresses.md000066400000000000000000000016031520306561600213760ustar00rootroot00000000000000## vt collection ip_addresses Collection's IP addresses. ``` vt collection ip_addresses [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ip_addresses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_malware_families.md000066400000000000000000000016331520306561600222350ustar00rootroot00000000000000## vt collection malware_families Collection's related malware families. ``` vt collection malware_families [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for malware_families -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_owner.md000066400000000000000000000015541520306561600200700ustar00rootroot00000000000000## vt collection owner Owner of the collection. ``` vt collection owner [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for owner -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_references.md000066400000000000000000000015731520306561600210600ustar00rootroot00000000000000## vt collection references Collection's references. ``` vt collection references [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_related_collections.md000066400000000000000000000017031520306561600227500ustar00rootroot00000000000000## vt collection related_collections Returns the Collections containing IOCs which are in this Collection. ``` vt collection related_collections [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_related_references.md000066400000000000000000000016611520306561600225560ustar00rootroot00000000000000## vt collection related_references Returns the References of the IOCs in this Collection. ``` vt collection related_references [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_related_reports.md000066400000000000000000000016161520306561600221330ustar00rootroot00000000000000## vt collection related_reports Collection's related reports ``` vt collection related_reports [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_relationships.md000066400000000000000000000013731520306561600216210ustar00rootroot00000000000000## vt collection relationships Get all relationships. ``` vt collection relationships [collection] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_remove.md000066400000000000000000000017641520306561600202360ustar00rootroot00000000000000## vt collection remove Remove items from a collection. ### Synopsis Remove items from a collection. This command receives a collection ID and one of more IoCs (sha256 hashes, URLs, domains, IP addresses) and removes them from the collection. If the command receives a single hypen (-) the IoCs will be read from the standard input. ``` vt collection remove [collection id] [ioc]... [flags] ``` ### Examples ``` vt collection remove [collection id] www.example.com vt collection remove [collection id] www.example.com 8.8.8.8 cat list_of_iocs | vt collection remove [collection id] - ``` ### Options ``` -h, --help help for remove ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_rename.md000066400000000000000000000010031520306561600201720ustar00rootroot00000000000000## vt collection rename Rename collection. ``` vt collection rename [collection id] [name] [flags] ``` ### Options ``` -h, --help help for rename ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_reports.md000066400000000000000000000015671520306561600204400ustar00rootroot00000000000000## vt collection reports Collection's related reports. ``` vt collection reports [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_sigma_rules.md000066400000000000000000000014221520306561600212420ustar00rootroot00000000000000## vt collection sigma_rules Collection's SIGMA rules. ``` vt collection sigma_rules [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for sigma_rules -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_software_toolkits.md000066400000000000000000000016371520306561600225220ustar00rootroot00000000000000## vt collection software_toolkits Collection's related software toolkits. ``` vt collection software_toolkits [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for software_toolkits -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_stats.md000066400000000000000000000014271520306561600200730ustar00rootroot00000000000000## vt collection stats Monthly lookup and submission stats per country. ``` vt collection stats [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for stats -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_subscribed_users.md000066400000000000000000000014531520306561600223020ustar00rootroot00000000000000## vt collection subscribed_users Users subscribed to the collection. ``` vt collection subscribed_users [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for subscribed_users -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_subscription_preferences.md000066400000000000000000000016701520306561600240420ustar00rootroot00000000000000## vt collection subscription_preferences Subscription preference for the given user. ``` vt collection subscription_preferences [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for subscription_preferences -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_threat_actors.md000066400000000000000000000016171520306561600216000ustar00rootroot00000000000000## vt collection threat_actors Collection's related threat actors. ``` vt collection threat_actors [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_update.md000066400000000000000000000017561520306561600202240ustar00rootroot00000000000000## vt collection update Add new items to a collection. ### Synopsis Adds new items to a collection. This command receives a collection ID and one of more IoCs (sha256 hashes, URLs, domains, IP addresses) and adds them to the collection. If the command receives a single hypen (-) the IoCs will be read from the standard input. ``` vt collection update [collection id] [ioc]... [flags] ``` ### Examples ``` vt collection update [collection id] www.example.com vt collection update [collection id] www.example.com 8.8.8.8 cat list_of_iocs | vt collection update [collection id] - ``` ### Options ``` -h, --help help for update ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_urls.md000066400000000000000000000015431520306561600177210ustar00rootroot00000000000000## vt collection urls Collection's URLs. ``` vt collection urls [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_vulnerabilities.md000066400000000000000000000016271520306561600221400ustar00rootroot00000000000000## vt collection vulnerabilities Collection's related vulnerabilities. ``` vt collection vulnerabilities [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for vulnerabilities -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_collection_yara_rulesets.md000066400000000000000000000014321520306561600216130ustar00rootroot00000000000000## vt collection yara_rulesets Collection's YARA rulesets. ``` vt collection yara_rulesets [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for yara_rulesets -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/doc/vt_completion.md000066400000000000000000000015141520306561600166700ustar00rootroot00000000000000## vt completion Output shell completion code for the specified shell (bash or zsh) ### Synopsis Output shell completion code for the specified shell (bash or zsh). The shell code must be evaluated to provide interactive completion of vt commands. This can be done by sourcing it from the .bash_profile. Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 ``` vt completion [flags] ``` ### Options ``` -h, --help help for completion ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/doc/vt_domain.md000066400000000000000000000104201520306561600157620ustar00rootroot00000000000000## vt domain Get information about Internet domains ### Synopsis Get information about one or more Internet domains. This command receives one or more Internet domains and returns information about them. The data is returned in the same order as the domains appear in the command line. If the command receives a single hypen (-) the domains are read from the standard input, one per line. ``` vt domain [domain]... [flags] ``` ### Examples ``` vt domain virustotal.com vt domain virustotal.com google.com cat list_of_domains | vt domain - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for domain -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt domain associations](vt_domain_associations.md) - Returns the collections related to the IOC. * [vt domain caa_records](vt_domain_caa_records.md) - Records CAA for the domain. * [vt domain campaigns](vt_domain_campaigns.md) - IOC's related campaigns. * [vt domain cname_records](vt_domain_cname_records.md) - Records CNAME for the domain. * [vt domain collections](vt_domain_collections.md) - Returns the collections related to the IOC. * [vt domain comments](vt_domain_comments.md) - Comments for the domain or IP address. * [vt domain communicating_files](vt_domain_communicating_files.md) - Files that communicate with the domain. * [vt domain downloaded_files](vt_domain_downloaded_files.md) - Files downloaded from the domain. * [vt domain graphs](vt_domain_graphs.md) - Graphs containing the domain/ip. * [vt domain historical_ssl_certificates](vt_domain_historical_ssl_certificates.md) - SSL certificate history. * [vt domain historical_whois](vt_domain_historical_whois.md) - Historical Whois. * [vt domain immediate_parent](vt_domain_immediate_parent.md) - Immediate parent domain. * [vt domain malware_families](vt_domain_malware_families.md) - IOC's related malware families. * [vt domain memory_pattern_parents](vt_domain_memory_pattern_parents.md) - Files having a domain as string on memory during sandbox execution. * [vt domain mx_records](vt_domain_mx_records.md) - Records MX for the domain. * [vt domain ns_records](vt_domain_ns_records.md) - Records NS for the domain. * [vt domain parent](vt_domain_parent.md) - Parent domain. * [vt domain references](vt_domain_references.md) - Returns the References related to the domain. * [vt domain referrer_files](vt_domain_referrer_files.md) - Files containing the domain. * [vt domain related_comments](vt_domain_related_comments.md) - Comments for the Domain or IP's related entities. * [vt domain related_references](vt_domain_related_references.md) - Returns the direct and related references containing this domain. * [vt domain related_reports](vt_domain_related_reports.md) - IOC's related reports * [vt domain related_threat_actors](vt_domain_related_threat_actors.md) - IOC's related threat actors. * [vt domain relationships](vt_domain_relationships.md) - Get all relationships. * [vt domain reports](vt_domain_reports.md) - IOC's related reports. * [vt domain resolutions](vt_domain_resolutions.md) - DNS resolutions for the domain. * [vt domain siblings](vt_domain_siblings.md) - Subdomains that share the same domain. * [vt domain soa_records](vt_domain_soa_records.md) - Records SOA for the domain. * [vt domain software_toolkits](vt_domain_software_toolkits.md) - IOC's related software toolkits. * [vt domain subdomains](vt_domain_subdomains.md) - Subdomains of the domain. * [vt domain urls](vt_domain_urls.md) - URLs related to the domain. * [vt domain user_votes](vt_domain_user_votes.md) - Item's votes made by current signed-in user. * [vt domain votes](vt_domain_votes.md) - Item's votes. * [vt domain vulnerabilities](vt_domain_vulnerabilities.md) - IOC's related vulnerabilities. vt-cli-1.3.1/doc/vt_domain_associations.md000066400000000000000000000016051520306561600205460ustar00rootroot00000000000000## vt domain associations Returns the collections related to the IOC. ``` vt domain associations [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for associations -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_caa_records.md000066400000000000000000000015621520306561600203160ustar00rootroot00000000000000## vt domain caa_records Records CAA for the domain. ``` vt domain caa_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for caa_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_campaigns.md000066400000000000000000000015511520306561600200110ustar00rootroot00000000000000## vt domain campaigns IOC's related campaigns. ``` vt domain campaigns [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for campaigns -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_cname_records.md000066400000000000000000000015721520306561600206560ustar00rootroot00000000000000## vt domain cname_records Records CNAME for the domain. ``` vt domain cname_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for cname_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_collections.md000066400000000000000000000016021520306561600203620ustar00rootroot00000000000000## vt domain collections Returns the collections related to the IOC. ``` vt domain collections [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_comments.md000066400000000000000000000015641520306561600177000ustar00rootroot00000000000000## vt domain comments Comments for the domain or IP address. ``` vt domain comments [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_communicating_files.md000066400000000000000000000016261520306561600220710ustar00rootroot00000000000000## vt domain communicating_files Files that communicate with the domain. ``` vt domain communicating_files [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for communicating_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_downloaded_files.md000066400000000000000000000016071520306561600213530ustar00rootroot00000000000000## vt domain downloaded_files Files downloaded from the domain. ``` vt domain downloaded_files [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for downloaded_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_graphs.md000066400000000000000000000015501520306561600173320ustar00rootroot00000000000000## vt domain graphs Graphs containing the domain/ip. ``` vt domain graphs [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_historical_ssl_certificates.md000066400000000000000000000016371520306561600236230ustar00rootroot00000000000000## vt domain historical_ssl_certificates SSL certificate history. ``` vt domain historical_ssl_certificates [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for historical_ssl_certificates -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_historical_whois.md000066400000000000000000000015671520306561600214300ustar00rootroot00000000000000## vt domain historical_whois Historical Whois. ``` vt domain historical_whois [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for historical_whois -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_immediate_parent.md000066400000000000000000000015761520306561600213650ustar00rootroot00000000000000## vt domain immediate_parent Immediate parent domain. ``` vt domain immediate_parent [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for immediate_parent -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_malware_families.md000066400000000000000000000016051520306561600213500ustar00rootroot00000000000000## vt domain malware_families IOC's related malware families. ``` vt domain malware_families [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for malware_families -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_memory_pattern_parents.md000066400000000000000000000016731520306561600226550ustar00rootroot00000000000000## vt domain memory_pattern_parents Files having a domain as string on memory during sandbox execution. ``` vt domain memory_pattern_parents [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_mx_records.md000066400000000000000000000015561520306561600202210ustar00rootroot00000000000000## vt domain mx_records Records MX for the domain. ``` vt domain mx_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for mx_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_ns_records.md000066400000000000000000000015561520306561600202150ustar00rootroot00000000000000## vt domain ns_records Records NS for the domain. ``` vt domain ns_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ns_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_parent.md000066400000000000000000000015261520306561600173420ustar00rootroot00000000000000## vt domain parent Parent domain. ``` vt domain parent [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for parent -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_references.md000066400000000000000000000016011520306561600201640ustar00rootroot00000000000000## vt domain references Returns the References related to the domain. ``` vt domain references [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_referrer_files.md000066400000000000000000000015741520306561600210520ustar00rootroot00000000000000## vt domain referrer_files Files containing the domain. ``` vt domain referrer_files [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for referrer_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_related_attack_techniques.md000066400000000000000000000015301520306561600232430ustar00rootroot00000000000000## vt domain related_attack_techniques Returns the Attack Techniques of Collections containing this Domain. ``` vt domain related_attack_techniques [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_related_comments.md000066400000000000000000000016271520306561600214000ustar00rootroot00000000000000## vt domain related_comments Comments for the Domain or IP's related entities. ``` vt domain related_comments [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_related_references.md000066400000000000000000000016551520306561600216750ustar00rootroot00000000000000## vt domain related_references Returns the direct and related references containing this domain. ``` vt domain related_references [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_related_reports.md000066400000000000000000000015701520306561600212460ustar00rootroot00000000000000## vt domain related_reports IOC's related reports ``` vt domain related_reports [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_related_threat_actors.md000066400000000000000000000016211520306561600224070ustar00rootroot00000000000000## vt domain related_threat_actors IOC's related threat actors. ``` vt domain related_threat_actors [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_relationships.md000066400000000000000000000013541520306561600207340ustar00rootroot00000000000000## vt domain relationships Get all relationships. ``` vt domain relationships [domain] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_reports.md000066400000000000000000000015411520306561600175440ustar00rootroot00000000000000## vt domain reports IOC's related reports. ``` vt domain reports [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_resolutions.md000066400000000000000000000015661520306561600204430ustar00rootroot00000000000000## vt domain resolutions DNS resolutions for the domain. ``` vt domain resolutions [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for resolutions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_siblings.md000066400000000000000000000015641520306561600176650ustar00rootroot00000000000000## vt domain siblings Subdomains that share the same domain. ``` vt domain siblings [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for siblings -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_soa_records.md000066400000000000000000000015621520306561600203540ustar00rootroot00000000000000## vt domain soa_records Records SOA for the domain. ``` vt domain soa_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for soa_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_software_toolkits.md000066400000000000000000000016111520306561600216260ustar00rootroot00000000000000## vt domain software_toolkits IOC's related software toolkits. ``` vt domain software_toolkits [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for software_toolkits -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_subdomains.md000066400000000000000000000015551520306561600202170ustar00rootroot00000000000000## vt domain subdomains Subdomains of the domain. ``` vt domain subdomains [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for subdomains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_urls.md000066400000000000000000000015351520306561600170360ustar00rootroot00000000000000## vt domain urls URLs related to the domain. ``` vt domain urls [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_user_votes.md000066400000000000000000000016001520306561600202400ustar00rootroot00000000000000## vt domain user_votes Item's votes made by current signed-in user. ``` vt domain user_votes [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user_votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_votes.md000066400000000000000000000015221520306561600172050ustar00rootroot00000000000000## vt domain votes Item's votes. ``` vt domain votes [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_domain_vulnerabilities.md000066400000000000000000000016011520306561600212440ustar00rootroot00000000000000## vt domain vulnerabilities IOC's related vulnerabilities. ``` vt domain vulnerabilities [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for vulnerabilities -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/doc/vt_download.md000066400000000000000000000024661520306561600163350ustar00rootroot00000000000000## vt download Download files ### Synopsis Download one or more files. This command receives one or more file hashes (SHA-256, SHA-1 or MD5) and downloads the files from VirusTotal. For using this command you need an API key with access to VirusTotal Intelligence. If the command receives a single hypen (-) the hashes are read from the standard input, one per line. ``` vt download [flags] ``` ### Examples ``` vt download 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 vt download 76cdb2bad9582d23c1f6f4d868218d6c 44d88612fea8a8f36de82e1278abb02f cat list_of_hashes | vt download - ``` ### Options ``` -h, --help help for download -o, --output string directory where downloaded files are put (default ".") -t, --threads int number of threads working in parallel (default 5) -z, --zip download in a ZIP file --zip-password string password for the ZIP file, used with --zip ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/doc/vt_file.md000066400000000000000000000147521520306561600154460ustar00rootroot00000000000000## vt file Get information about files ### Synopsis Get information about one or more files. This command receives one or more hashes (SHA-256, SHA-1 or MD5) and returns information about the corresponding files. The information for each file appears in the same order as the hashes are passed to the command. If the command receives a single hypen (-) the hashes are read from the standard input, one per line. ``` vt file [hash]... [flags] ``` ### Examples ``` vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 vt file 76cdb2bad9582d23c1f6f4d868218d6c vt file 76cdb2bad9582d23c1f6f4d868218d6c 44d88612fea8a8f36de82e1278abb02f cat list_of_hashes | vt file - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for file -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt file analyses](vt_file_analyses.md) - Analyses for the file. * [vt file associations](vt_file_associations.md) - Returns the collections related to the IOC. * [vt file attack_techniques](vt_file_attack_techniques.md) - Returns the Attack Techniques of the File. * [vt file behaviours](vt_file_behaviours.md) - Behaviour reports for the file. * [vt file bundled_files](vt_file_bundled_files.md) - Files bundled within the file. * [vt file campaigns](vt_file_campaigns.md) - IOC's related campaigns. * [vt file carbonblack_children](vt_file_carbonblack_children.md) - Files derived from the file according to Carbon Black. * [vt file carbonblack_parents](vt_file_carbonblack_parents.md) - Files from where the file was derived according to Carbon Black. * [vt file clues](vt_file_clues.md) - Clues for the file. * [vt file code_blocks](vt_file_code_blocks.md) - Code blocks of the file. * [vt file collections](vt_file_collections.md) - Returns the collections related to the IOC. * [vt file comments](vt_file_comments.md) - Comments for the file. * [vt file compressed_parents](vt_file_compressed_parents.md) - Compressed files that contain the file. * [vt file contacted_domains](vt_file_contacted_domains.md) - Domains contacted by the file. * [vt file contacted_ips](vt_file_contacted_ips.md) - IP addresses contacted by the file. * [vt file contacted_urls](vt_file_contacted_urls.md) - URLs contacted by the file. * [vt file distributors](vt_file_distributors.md) - Software marketplaces distributing the file. * [vt file dropped_files](vt_file_dropped_files.md) - Files dropped by the file. * [vt file email_attachments](vt_file_email_attachments.md) - Files attached to the email. * [vt file email_parents](vt_file_email_parents.md) - Email files that contained the file. * [vt file embedded_domains](vt_file_embedded_domains.md) - Domain names embedded in the file. * [vt file embedded_ips](vt_file_embedded_ips.md) - IP addresses embedded in the file. * [vt file embedded_urls](vt_file_embedded_urls.md) - URLs embedded in the file. * [vt file execution_parents](vt_file_execution_parents.md) - Files that executed the file. * [vt file graphs](vt_file_graphs.md) - Graphs that include the file. * [vt file itw_domains](vt_file_itw_domains.md) - In the wild domains from where the file has been downloaded. * [vt file itw_ips](vt_file_itw_ips.md) - In the wild IP addresses from where the file has been downloaded. * [vt file itw_urls](vt_file_itw_urls.md) - In the wild URLs from where the file has been downloaded. * [vt file malware_families](vt_file_malware_families.md) - IOC's related malware families. * [vt file memory_pattern_domains](vt_file_memory_pattern_domains.md) - Domain string patterns found in memory during sandbox execution. * [vt file memory_pattern_ips](vt_file_memory_pattern_ips.md) - IP address string patterns found in memory during sandbox execution. * [vt file memory_pattern_urls](vt_file_memory_pattern_urls.md) - URL string patterns found in memory during sandbox execution. * [vt file overlay_children](vt_file_overlay_children.md) - Files contained by the file as an overlay. * [vt file overlay_parents](vt_file_overlay_parents.md) - Files that contain the file as an overlay. * [vt file parent_resource_urls](vt_file_parent_resource_urls.md) - Returns the URLs where this file has been loaded as resource. * [vt file pcap_children](vt_file_pcap_children.md) - PCAP files seen in the file. * [vt file pcap_parents](vt_file_pcap_parents.md) - PCAP files that contain the file. * [vt file pe_resource_children](vt_file_pe_resource_children.md) - PE files contained by the file as a resource. * [vt file pe_resource_parents](vt_file_pe_resource_parents.md) - PE files containing the file as a resource. * [vt file references](vt_file_references.md) - Returns the References for the file. * [vt file related_attack_techniques](vt_file_related_attack_techniques.md) - Returns the Attack Techniques of the Collections containing this File. * [vt file related_references](vt_file_related_references.md) - Returns Direct References plus References of the Collections containing this File. * [vt file related_reports](vt_file_related_reports.md) - IOC's related reports * [vt file related_threat_actors](vt_file_related_threat_actors.md) - IOC's related threat actors. * [vt file relationships](vt_file_relationships.md) - Get all relationships. * [vt file reports](vt_file_reports.md) - IOC's related reports. * [vt file screenshots](vt_file_screenshots.md) - Screenshots obtained from the execution of the file. * [vt file similar_files](vt_file_similar_files.md) - Files that are similar to the file, using only VHASH. * [vt file software_toolkits](vt_file_software_toolkits.md) - IOC's related software toolkits. * [vt file submissions](vt_file_submissions.md) - Submissions for the file. * [vt file urls_for_embedded_js](vt_file_urls_for_embedded_js.md) - URLs where this (JS) file is embedded. * [vt file user_votes](vt_file_user_votes.md) - Item's votes made by current signed-in user. * [vt file votes](vt_file_votes.md) - Item's votes. * [vt file vulnerabilities](vt_file_vulnerabilities.md) - IOC's related vulnerabilities. vt-cli-1.3.1/doc/vt_file_analyses.md000066400000000000000000000015171520306561600173400ustar00rootroot00000000000000## vt file analyses Analyses for the file. ``` vt file analyses [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analyses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_associations.md000066400000000000000000000015601520306561600202160ustar00rootroot00000000000000## vt file associations Returns the collections related to the IOC. ``` vt file associations [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for associations -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_attack_techniques.md000066400000000000000000000015761520306561600212250ustar00rootroot00000000000000## vt file attack_techniques Returns the Attack Techniques of the File. ``` vt file attack_techniques [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_behaviours.md000066400000000000000000000015361520306561600176710ustar00rootroot00000000000000## vt file behaviours Behaviour reports for the file. ``` vt file behaviours [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for behaviours -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_bundled_files.md000066400000000000000000000015461520306561600203220ustar00rootroot00000000000000## vt file bundled_files Files bundled within the file. ``` vt file bundled_files [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for bundled_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_campaigns.md000066400000000000000000000015241520306561600174610ustar00rootroot00000000000000## vt file campaigns IOC's related campaigns. ``` vt file campaigns [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for campaigns -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_carbonblack_children.md000066400000000000000000000016231520306561600216300ustar00rootroot00000000000000## vt file carbonblack_children Files derived from the file according to Carbon Black. ``` vt file carbonblack_children [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for carbonblack_children -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_carbonblack_parents.md000066400000000000000000000016321520306561600215140ustar00rootroot00000000000000## vt file carbonblack_parents Files from where the file was derived according to Carbon Black. ``` vt file carbonblack_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for carbonblack_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_ciphered_bundled_files.md000066400000000000000000000013431520306561600221600ustar00rootroot00000000000000## vt file ciphered_bundled_files ### Synopsis ``` vt file ciphered_bundled_files [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ciphered_bundled_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_ciphered_parents.md000066400000000000000000000014331520306561600210350ustar00rootroot00000000000000## vt file ciphered_parents Ciphered files that contain the file. ### Synopsis Ciphered files that contain the file. ``` vt file ciphered_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ciphered_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_clues.md000066400000000000000000000015031520306561600166270ustar00rootroot00000000000000## vt file clues Clues for the file. ``` vt file clues [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for clues -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_code_blocks.md000066400000000000000000000015321520306561600177650ustar00rootroot00000000000000## vt file code_blocks Code blocks of the file. ``` vt file code_blocks [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for code_blocks -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_collections.md000066400000000000000000000015551520306561600200410ustar00rootroot00000000000000## vt file collections Returns the collections related to the IOC. ``` vt file collections [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_comments.md000066400000000000000000000015171520306561600173460ustar00rootroot00000000000000## vt file comments Comments for the file. ``` vt file comments [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_compressed_parents.md000066400000000000000000000015761520306561600214260ustar00rootroot00000000000000## vt file compressed_parents Compressed files that contain the file. ``` vt file compressed_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for compressed_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_contacted_domains.md000066400000000000000000000015621520306561600211770ustar00rootroot00000000000000## vt file contacted_domains Domains contacted by the file. ``` vt file contacted_domains [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_contacted_ips.md000066400000000000000000000015531520306561600203400ustar00rootroot00000000000000## vt file contacted_ips IP addresses contacted by the file. ``` vt file contacted_ips [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_contacted_urls.md000066400000000000000000000015461520306561600205340ustar00rootroot00000000000000## vt file contacted_urls URLs contacted by the file. ``` vt file contacted_urls [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_distributors.md000066400000000000000000000015611520306561600202550ustar00rootroot00000000000000## vt file distributors Software marketplaces distributing the file. ``` vt file distributors [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for distributors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_dropped_files.md000066400000000000000000000015421520306561600203360ustar00rootroot00000000000000## vt file dropped_files Files dropped by the file. ``` vt file dropped_files [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for dropped_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_email_attachments.md000066400000000000000000000015601520306561600212010ustar00rootroot00000000000000## vt file email_attachments Files attached to the email. ``` vt file email_attachments [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for email_attachments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_email_parents.md000066400000000000000000000015541520306561600203450ustar00rootroot00000000000000## vt file email_parents Email files that contained the file. ``` vt file email_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for email_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_email_senders.md000066400000000000000000000013721520306561600203320ustar00rootroot00000000000000## vt file email_senders Email sender's email addresses. ``` vt file email_senders [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for email_senders -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_embedded_domains.md000066400000000000000000000015631520306561600207650ustar00rootroot00000000000000## vt file embedded_domains Domain names embedded in the file. ``` vt file embedded_domains [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for embedded_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_embedded_ips.md000066400000000000000000000015471520306561600201300ustar00rootroot00000000000000## vt file embedded_ips IP addresses embedded in the file. ``` vt file embedded_ips [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for embedded_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_embedded_urls.md000066400000000000000000000015421520306561600203150ustar00rootroot00000000000000## vt file embedded_urls URLs embedded in the file. ``` vt file embedded_urls [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for embedded_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_execution_parents.md000066400000000000000000000015611520306561600212570ustar00rootroot00000000000000## vt file execution_parents Files that executed the file. ``` vt file execution_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for execution_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_graphs.md000066400000000000000000000015201520306561600167770ustar00rootroot00000000000000## vt file graphs Graphs that include the file. ``` vt file graphs [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_hash_collisions.md000066400000000000000000000014171520306561600207010ustar00rootroot00000000000000## vt file hash_collisions Files with the same MD5 or SHA1 than the file. ``` vt file hash_collisions [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for hash_collisions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_itw_domains.md000066400000000000000000000015761520306561600200430ustar00rootroot00000000000000## vt file itw_domains In the wild domains from where the file has been downloaded. ``` vt file itw_domains [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for itw_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_itw_ips.md000066400000000000000000000015671520306561600172040ustar00rootroot00000000000000## vt file itw_ips In the wild IP addresses from where the file has been downloaded. ``` vt file itw_ips [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for itw_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_itw_urls.md000066400000000000000000000015621520306561600173710ustar00rootroot00000000000000## vt file itw_urls In the wild URLs from where the file has been downloaded. ``` vt file itw_urls [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for itw_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_malware_families.md000066400000000000000000000015601520306561600210200ustar00rootroot00000000000000## vt file malware_families IOC's related malware families. ``` vt file malware_families [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for malware_families -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_memory_pattern_domains.md000066400000000000000000000016431520306561600223000ustar00rootroot00000000000000## vt file memory_pattern_domains Domain string patterns found in memory during sandbox execution. ``` vt file memory_pattern_domains [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_memory_pattern_ips.md000066400000000000000000000016331520306561600214400ustar00rootroot00000000000000## vt file memory_pattern_ips IP address string patterns found in memory during sandbox execution. ``` vt file memory_pattern_ips [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_memory_pattern_urls.md000066400000000000000000000016271520306561600216350ustar00rootroot00000000000000## vt file memory_pattern_urls URL string patterns found in memory during sandbox execution. ``` vt file memory_pattern_urls [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_overlay_children.md000066400000000000000000000015731520306561600210540ustar00rootroot00000000000000## vt file overlay_children Files contained by the file as an overlay. ``` vt file overlay_children [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for overlay_children -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_overlay_parents.md000066400000000000000000000015701520306561600207350ustar00rootroot00000000000000## vt file overlay_parents Files that contain the file as an overlay. ``` vt file overlay_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for overlay_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_parent_resource_urls.md000066400000000000000000000016321520306561600217640ustar00rootroot00000000000000## vt file parent_resource_urls Returns the URLs where this file has been loaded as resource. ``` vt file parent_resource_urls [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for parent_resource_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_pcap_children.md000066400000000000000000000015441520306561600203140ustar00rootroot00000000000000## vt file pcap_children PCAP files seen in the file. ``` vt file pcap_children [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for pcap_children -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_pcap_parents.md000066400000000000000000000015461520306561600202020ustar00rootroot00000000000000## vt file pcap_parents PCAP files that contain the file. ``` vt file pcap_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for pcap_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_pe_resource_children.md000066400000000000000000000016121520306561600217000ustar00rootroot00000000000000## vt file pe_resource_children PE files contained by the file as a resource. ``` vt file pe_resource_children [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for pe_resource_children -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_pe_resource_parents.md000066400000000000000000000016051520306561600215660ustar00rootroot00000000000000## vt file pe_resource_parents PE files containing the file as a resource. ``` vt file pe_resource_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for pe_resource_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_references.md000066400000000000000000000015431520306561600176410ustar00rootroot00000000000000## vt file references Returns the References for the file. ``` vt file references [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_related_attack_techniques.md000066400000000000000000000016621520306561600227210ustar00rootroot00000000000000## vt file related_attack_techniques Returns the Attack Techniques of the Collections containing this File. ``` vt file related_attack_techniques [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_related_references.md000066400000000000000000000016551520306561600213450ustar00rootroot00000000000000## vt file related_references Returns Direct References plus References of the Collections containing this File. ``` vt file related_references [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_related_reports.md000066400000000000000000000015431520306561600207160ustar00rootroot00000000000000## vt file related_reports IOC's related reports ``` vt file related_reports [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_related_threat_actors.md000066400000000000000000000015741520306561600220660ustar00rootroot00000000000000## vt file related_threat_actors IOC's related threat actors. ``` vt file related_threat_actors [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_relationships.md000066400000000000000000000013271520306561600204040ustar00rootroot00000000000000## vt file relationships Get all relationships. ``` vt file relationships [hash] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_reports.md000066400000000000000000000015141520306561600172140ustar00rootroot00000000000000## vt file reports IOC's related reports. ``` vt file reports [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_screenshots.md000066400000000000000000000015661520306561600200650ustar00rootroot00000000000000## vt file screenshots Screenshots obtained from the execution of the file. ``` vt file screenshots [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for screenshots -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_sigma_analysis.md000066400000000000000000000013721520306561600205230ustar00rootroot00000000000000## vt file sigma_analysis Sigma analysis for the file. ``` vt file sigma_analysis [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for sigma_analysis -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_similar_files.md000066400000000000000000000015751520306561600203470ustar00rootroot00000000000000## vt file similar_files Files that are similar to the file, using only VHASH. ``` vt file similar_files [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for similar_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_software_toolkits.md000066400000000000000000000015641520306561600213050ustar00rootroot00000000000000## vt file software_toolkits IOC's related software toolkits. ``` vt file software_toolkits [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for software_toolkits -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_submissions.md000066400000000000000000000015331520306561600200750ustar00rootroot00000000000000## vt file submissions Submissions for the file. ``` vt file submissions [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for submissions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_urls_for_embedded_js.md000066400000000000000000000016031520306561600216550ustar00rootroot00000000000000## vt file urls_for_embedded_js URLs where this (JS) file is embedded. ``` vt file urls_for_embedded_js [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls_for_embedded_js -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_user_votes.md000066400000000000000000000015531520306561600177170ustar00rootroot00000000000000## vt file user_votes Item's votes made by current signed-in user. ``` vt file user_votes [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user_votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_votes.md000066400000000000000000000014751520306561600166640ustar00rootroot00000000000000## vt file votes Item's votes. ``` vt file votes [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_file_vulnerabilities.md000066400000000000000000000015541520306561600207230ustar00rootroot00000000000000## vt file vulnerabilities IOC's related vulnerabilities. ``` vt file vulnerabilities [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for vulnerabilities -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/doc/vt_group.md000066400000000000000000000017001520306561600156500ustar00rootroot00000000000000## vt group Get information about VirusTotal groups ### Synopsis Get information about a group. ``` vt group [groupname]... [flags] ``` ### Examples ``` vt group mygroup ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for group -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt group privileges](vt_group_privileges.md) - Change group privileges vt-cli-1.3.1/doc/vt_group_privileges.md000066400000000000000000000012051520306561600201010ustar00rootroot00000000000000## vt group privileges Change group privileges ### Options ``` -h, --help help for privileges ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt group](vt_group.md) - Get information about VirusTotal groups * [vt group privileges grant](vt_group_privileges_grant.md) - Grant privileges to a group * [vt group privileges revoke](vt_group_privileges_revoke.md) - Revoke privileges from a group vt-cli-1.3.1/doc/vt_group_privileges_grant.md000066400000000000000000000013471520306561600213030ustar00rootroot00000000000000## vt group privileges grant Grant privileges to a group ``` vt group privileges grant [groupname] [privilege]... [flags] ``` ### Examples ``` vt group privileges grant mygroup intelligence downloads-tier-2 ``` ### Options ``` -e, --expiration string expiration time for the granted privileges (UNIX timestamp or YYYY-MM-DD) -h, --help help for grant ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt group privileges](vt_group_privileges.md) - Change group privileges vt-cli-1.3.1/doc/vt_group_privileges_revoke.md000066400000000000000000000011731520306561600214600ustar00rootroot00000000000000## vt group privileges revoke Revoke privileges from a group ``` vt group privileges revoke [groupname] [privilege]... [flags] ``` ### Examples ``` vt group privileges revoke mygroup intelligence downloads-tier-2 ``` ### Options ``` -h, --help help for revoke ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt group privileges](vt_group_privileges.md) - Change group privileges vt-cli-1.3.1/doc/vt_hunting.md000066400000000000000000000011761520306561600161770ustar00rootroot00000000000000## vt hunting Manage malware hunting rules and notifications ### Options ``` -h, --help help for hunting ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt hunting notification](vt_hunting_notification.md) - Manage malware hunting notifications * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_hunting_notification.md000066400000000000000000000020011520306561600207310ustar00rootroot00000000000000## vt hunting notification Manage malware hunting notifications ``` vt hunting notification [id]... [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for notification -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting](vt_hunting.md) - Manage malware hunting rules and notifications * [vt hunting notification delete](vt_hunting_notification_delete.md) - Delete hunting notifications * [vt hunting notification list](vt_hunting_notification_list.md) - List notifications vt-cli-1.3.1/doc/vt_hunting_notification_delete.md000066400000000000000000000015111520306561600222600ustar00rootroot00000000000000## vt hunting notification delete Delete hunting notifications ### Synopsis Delete hunting notifications. This command deletes the malware hunting notifications associated to the currently configured API key. ``` vt hunting notification delete [notification id]... [flags] ``` ### Options ``` -a, --all delete all notifications -h, --help help for delete -t, --with-tag string delete notifications with a given tag ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting notification](vt_hunting_notification.md) - Manage malware hunting notifications vt-cli-1.3.1/doc/vt_hunting_notification_list.md000066400000000000000000000022531520306561600217750ustar00rootroot00000000000000## vt hunting notification list List notifications ### Synopsis List malware hunting notifications. This command list the malware hunting notifications associated to the currently configured API key. ``` vt hunting notification list [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting notification](vt_hunting_notification.md) - Manage malware hunting notifications * [vt hunting notification list delete](vt_hunting_notification_list_delete.md) - Delete hunting notifications vt-cli-1.3.1/doc/vt_hunting_notification_list_delete.md000066400000000000000000000015131520306561600233150ustar00rootroot00000000000000## vt hunting notification list delete Delete hunting notifications ### Synopsis Delete hunting notifications. This command deletes the malware hunting notifications associated to the currently configured API key. ``` vt hunting notification list delete [notification id]... [flags] ``` ### Options ``` -a, --all delete all notifications -h, --help help for delete -t, --with-tag string delete notifications with a given tag ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting notification list](vt_hunting_notification_list.md) - List notifications vt-cli-1.3.1/doc/vt_hunting_ruleset.md000066400000000000000000000030431520306561600177350ustar00rootroot00000000000000## vt hunting ruleset Manage hunting rulesets ``` vt hunting ruleset [id]... [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ruleset -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting](vt_hunting.md) - Manage malware hunting rules and notifications * [vt hunting ruleset add](vt_hunting_ruleset_add.md) - Add a new ruleset * [vt hunting ruleset delete](vt_hunting_ruleset_delete.md) - Delete rulesets * [vt hunting ruleset disable](vt_hunting_ruleset_disable.md) - Disable ruleset * [vt hunting ruleset enable](vt_hunting_ruleset_enable.md) - Enable ruleset * [vt hunting ruleset list](vt_hunting_ruleset_list.md) - List rulesets * [vt hunting ruleset notification_emails](vt_hunting_ruleset_notification_emails.md) - Set ruleset notification emails * [vt hunting ruleset rename](vt_hunting_ruleset_rename.md) - Rename ruleset * [vt hunting ruleset setlimit](vt_hunting_ruleset_setlimit.md) - Set ruleset limit * [vt hunting ruleset update](vt_hunting_ruleset_update.md) - Change the rules for a ruleset vt-cli-1.3.1/doc/vt_hunting_ruleset_add.md000066400000000000000000000010101520306561600205350ustar00rootroot00000000000000## vt hunting ruleset add Add a new ruleset ``` vt hunting ruleset add [ruleset name] [rules file] [flags] ``` ### Options ``` -h, --help help for add ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_hunting_ruleset_delete.md000066400000000000000000000010461520306561600212600ustar00rootroot00000000000000## vt hunting ruleset delete Delete rulesets ``` vt hunting ruleset delete [ruleset id]... [flags] ``` ### Options ``` -a, --all delete all rulesets -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_hunting_ruleset_disable.md000066400000000000000000000010031520306561600214120ustar00rootroot00000000000000## vt hunting ruleset disable Disable ruleset ``` vt hunting ruleset disable [ruleset id] [flags] ``` ### Options ``` -h, --help help for disable ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_hunting_ruleset_enable.md000066400000000000000000000007771520306561600212560ustar00rootroot00000000000000## vt hunting ruleset enable Enable ruleset ``` vt hunting ruleset enable [ruleset id] [flags] ``` ### Options ``` -h, --help help for enable ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_hunting_ruleset_list.md000066400000000000000000000020131520306561600207640ustar00rootroot00000000000000## vt hunting ruleset list List rulesets ### Synopsis List malware hunting rulesets. This command list the malware hunting rulesets associated to the currently configured API key. ``` vt hunting ruleset list [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_hunting_ruleset_notification_emails.md000066400000000000000000000011021520306561600240270ustar00rootroot00000000000000## vt hunting ruleset notification_emails Set ruleset notification emails ``` vt hunting ruleset notification_emails [ruleset id] [email]... [flags] ``` ### Options ``` -h, --help help for notification_emails ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_hunting_ruleset_rename.md000066400000000000000000000010061520306561600212610ustar00rootroot00000000000000## vt hunting ruleset rename Rename ruleset ``` vt hunting ruleset rename [ruleset id] [name] [flags] ``` ### Options ``` -h, --help help for rename ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_hunting_ruleset_setlimit.md000066400000000000000000000010201520306561600216400ustar00rootroot00000000000000## vt hunting ruleset setlimit Set ruleset limit ``` vt hunting ruleset setlimit [ruleset id] [limit] [flags] ``` ### Options ``` -h, --help help for setlimit ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_hunting_ruleset_update.md000066400000000000000000000010341520306561600212750ustar00rootroot00000000000000## vt hunting ruleset update Change the rules for a ruleset ``` vt hunting ruleset update [ruleset id] [rules file] [flags] ``` ### Options ``` -h, --help help for update ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/doc/vt_init.md000066400000000000000000000014161520306561600154630ustar00rootroot00000000000000## vt init Initialize or re-initialize vt command-line tool ### Synopsis Initialize or re-initialize this command-line tool. This command will ask for your API key and save it in a local file, so you don't need to enter it everytime you use the tool. It will also retrieve additional metadata from VirusTotal for making the tool even more powerful. ``` vt init [flags] ``` ### Options ``` -h, --help help for init ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/doc/vt_iocstream.md000066400000000000000000000040401520306561600165020ustar00rootroot00000000000000## vt iocstream Manage IoC Stream notifications ``` vt iocstream [notification_id]... [flags] ``` ### Examples ``` ## List: # List notifications from a hunting rule by name vt iocstream list -f "origin:hunting tag:my_rule" # List notifications from a hunting ruleset by name vt iocstream list -f "origin:hunting tag:myRuleset" # List just the entity IDs of your IoC Stream matches vt iocstream list -I # List ALL the entity IDs in your IoC Stream and store them in a csv file (this might take a while) vt iocstream list -I –limit 9999999 > results.csv # List the first IoC Stream notifications including the hash, last_analysis_stats, size and file type vt iocstream list -i "_id,last_analysis_stats,size,type_tag" # Check if a hash is in your IoC Stream matches vt iocstream list -f "entity_type:file entity_id:hash" ## Delete: # Delete all notifications matching a filter, e.g. all matches for a YARA rule/ruleset. This process is # asynchronous, so it can take a while to delete all the notifications. vt iocstream delete -f "origin:hunting tag:my_rule" # Delete a single notification with ID 1234568. The notification ID is displayed in the context_attributes. vt iocstream delete 1234568 ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for iocstream -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt iocstream delete](vt_iocstream_delete.md) - Deletes notifications from the IoC Stream * [vt iocstream list](vt_iocstream_list.md) - List IoCs from notifications vt-cli-1.3.1/doc/vt_iocstream_delete.md000066400000000000000000000020771520306561600200340ustar00rootroot00000000000000## vt iocstream delete Deletes notifications from the IoC Stream ### Synopsis Delete notifications from the IoC Stream. The command accepts a list of IoC Stream notification IDs. If no IDs are provided, then all the IoC Stream notifications matching the given filter are deleted. ``` vt iocstream delete [notification id]... [flags] ``` ### Examples ``` # Delete all notifications matching a filter, e.g. all matches for a YARA rule/ruleset vt iocstream delete -f "origin:hunting tag:my_rule" # Delete a single notification with ID 1234568. The notification ID is displayed in the context_attributes. vt iocstream delete 1234568 ``` ### Options ``` -f, --filter string filter -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt iocstream](vt_iocstream.md) - Manage IoC Stream notifications vt-cli-1.3.1/doc/vt_iocstream_list.md000066400000000000000000000031131520306561600175350ustar00rootroot00000000000000## vt iocstream list List IoCs from notifications ``` vt iocstream list [flags] ``` ### Examples ``` # List notifications from a hunting rule by name vt iocstream list -f "origin:hunting tag:my_rule" # List notifications from a hunting ruleset by name vt iocstream list -f "origin:hunting tag:myRuleset" # List just the entity IDs of your IoC Stream matches vt iocstream list -I # List ALL the entity IDs in your IoC Stream and store them in a csv file (this might take a while) vt iocstream list -I –limit 9999999 > results.csv # List the first IoC Stream notifications including the hash, last_analysis_stats, size and file type vt iocstream list -i "_id,last_analysis_stats,size,type_tag" # Check if a hash is in your IoC Stream matches vt iocstream list -f "entity_type:file entity_id:hash" ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt iocstream](vt_iocstream.md) - Manage IoC Stream notifications vt-cli-1.3.1/doc/vt_ip.md000066400000000000000000000065151520306561600151350ustar00rootroot00000000000000## vt ip Get information about IP addresses ### Synopsis Get information about one or more IP addresses. This command receives one or more IP addresses and returns information about them. The information for each IP address is returned in the same order as the IP addresses are passed to the command. If the command receives a single hypen (-) the IP addresses will be read from the standard input, one per line. ``` vt ip [ip]... [flags] ``` ### Examples ``` vt ip 8.8.8.8 vt ip 8.8.8.8 8.8.4.4 cat list_of_ips | vt ip - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ip -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt ip associations](vt_ip_associations.md) - Returns the collections related to the IOC. * [vt ip campaigns](vt_ip_campaigns.md) - IOC's related campaigns. * [vt ip collections](vt_ip_collections.md) - Returns the collections related to the IOC. * [vt ip comments](vt_ip_comments.md) - Comments for the domain or IP address. * [vt ip communicating_files](vt_ip_communicating_files.md) - Files that communicate with the ip. * [vt ip downloaded_files](vt_ip_downloaded_files.md) - Files downloaded from the ip. * [vt ip graphs](vt_ip_graphs.md) - Graphs containing the domain/ip. * [vt ip historical_ssl_certificates](vt_ip_historical_ssl_certificates.md) - SSL certificate history. * [vt ip historical_whois](vt_ip_historical_whois.md) - Historical Whois. * [vt ip malware_families](vt_ip_malware_families.md) - IOC's related malware families. * [vt ip memory_pattern_parents](vt_ip_memory_pattern_parents.md) - Files having a IP as string on memory during sandbox execution. * [vt ip references](vt_ip_references.md) - Returns the References related to the IP Address. * [vt ip referrer_files](vt_ip_referrer_files.md) - Files containing the domain/ip. * [vt ip related_comments](vt_ip_related_comments.md) - Comments for the Domain or IP's related entities. * [vt ip related_references](vt_ip_related_references.md) - Returns the direct and related references containing this IP. * [vt ip related_reports](vt_ip_related_reports.md) - IOC's related reports * [vt ip related_threat_actors](vt_ip_related_threat_actors.md) - IOC's related threat actors. * [vt ip relationships](vt_ip_relationships.md) - Get all relationships. * [vt ip reports](vt_ip_reports.md) - IOC's related reports. * [vt ip resolutions](vt_ip_resolutions.md) - DNS resolutions for the IP address. * [vt ip software_toolkits](vt_ip_software_toolkits.md) - IOC's related software toolkits. * [vt ip urls](vt_ip_urls.md) - URLs related to the ip. * [vt ip user_votes](vt_ip_user_votes.md) - Item's votes made by current signed-in user. * [vt ip votes](vt_ip_votes.md) - Item's votes. * [vt ip vulnerabilities](vt_ip_vulnerabilities.md) - IOC's related vulnerabilities. vt-cli-1.3.1/doc/vt_ip_associations.md000066400000000000000000000015551520306561600177130ustar00rootroot00000000000000## vt ip associations Returns the collections related to the IOC. ``` vt ip associations [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for associations -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_campaigns.md000066400000000000000000000015211520306561600171470ustar00rootroot00000000000000## vt ip campaigns IOC's related campaigns. ``` vt ip campaigns [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for campaigns -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_collections.md000066400000000000000000000015521520306561600175270ustar00rootroot00000000000000## vt ip collections Returns the collections related to the IOC. ``` vt ip collections [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_comments.md000066400000000000000000000015341520306561600170360ustar00rootroot00000000000000## vt ip comments Comments for the domain or IP address. ``` vt ip comments [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_communicating_files.md000066400000000000000000000015721520306561600212320ustar00rootroot00000000000000## vt ip communicating_files Files that communicate with the ip. ``` vt ip communicating_files [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for communicating_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_downloaded_files.md000066400000000000000000000015531520306561600205140ustar00rootroot00000000000000## vt ip downloaded_files Files downloaded from the ip. ``` vt ip downloaded_files [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for downloaded_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_graphs.md000066400000000000000000000015201520306561600164700ustar00rootroot00000000000000## vt ip graphs Graphs containing the domain/ip. ``` vt ip graphs [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_historical_ssl_certificates.md000066400000000000000000000016071520306561600227610ustar00rootroot00000000000000## vt ip historical_ssl_certificates SSL certificate history. ``` vt ip historical_ssl_certificates [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for historical_ssl_certificates -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_historical_whois.md000066400000000000000000000015371520306561600205660ustar00rootroot00000000000000## vt ip historical_whois Historical Whois. ``` vt ip historical_whois [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for historical_whois -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_malware_families.md000066400000000000000000000015551520306561600205150ustar00rootroot00000000000000## vt ip malware_families IOC's related malware families. ``` vt ip malware_families [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for malware_families -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_memory_pattern_parents.md000066400000000000000000000016371520306561600220160ustar00rootroot00000000000000## vt ip memory_pattern_parents Files having a IP as string on memory during sandbox execution. ``` vt ip memory_pattern_parents [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_references.md000066400000000000000000000015551520306561600173350ustar00rootroot00000000000000## vt ip references Returns the References related to the IP Address. ``` vt ip references [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_referrer_files.md000066400000000000000000000015471520306561600202130ustar00rootroot00000000000000## vt ip referrer_files Files containing the domain/ip. ``` vt ip referrer_files [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for referrer_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_related_attack_techniques.md000066400000000000000000000015001520306561600224010ustar00rootroot00000000000000## vt ip related_attack_techniques Returns the Attack Techniques of the Collections containing this IP. ``` vt ip related_attack_techniques [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_related_comments.md000066400000000000000000000015771520306561600205450ustar00rootroot00000000000000## vt ip related_comments Comments for the Domain or IP's related entities. ``` vt ip related_comments [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_related_references.md000066400000000000000000000016211520306561600210270ustar00rootroot00000000000000## vt ip related_references Returns the direct and related references containing this IP. ``` vt ip related_references [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_related_reports.md000066400000000000000000000015401520306561600204040ustar00rootroot00000000000000## vt ip related_reports IOC's related reports ``` vt ip related_reports [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_related_threat_actors.md000066400000000000000000000015711520306561600215540ustar00rootroot00000000000000## vt ip related_threat_actors IOC's related threat actors. ``` vt ip related_threat_actors [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_relationships.md000066400000000000000000000013241520306561600200720ustar00rootroot00000000000000## vt ip relationships Get all relationships. ``` vt ip relationships [ip] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_reports.md000066400000000000000000000015111520306561600167020ustar00rootroot00000000000000## vt ip reports IOC's related reports. ``` vt ip reports [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_resolutions.md000066400000000000000000000015421520306561600175760ustar00rootroot00000000000000## vt ip resolutions DNS resolutions for the IP address. ``` vt ip resolutions [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for resolutions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_software_toolkits.md000066400000000000000000000015611520306561600207730ustar00rootroot00000000000000## vt ip software_toolkits IOC's related software toolkits. ``` vt ip software_toolkits [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for software_toolkits -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_urls.md000066400000000000000000000015011520306561600161700ustar00rootroot00000000000000## vt ip urls URLs related to the ip. ``` vt ip urls [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_user_votes.md000066400000000000000000000015501520306561600174050ustar00rootroot00000000000000## vt ip user_votes Item's votes made by current signed-in user. ``` vt ip user_votes [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user_votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_votes.md000066400000000000000000000014721520306561600163520ustar00rootroot00000000000000## vt ip votes Item's votes. ``` vt ip votes [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_ip_vulnerabilities.md000066400000000000000000000015511520306561600204110ustar00rootroot00000000000000## vt ip vulnerabilities IOC's related vulnerabilities. ``` vt ip vulnerabilities [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for vulnerabilities -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/doc/vt_man.md000066400000000000000000000005531520306561600152740ustar00rootroot00000000000000## vt man ### Synopsis ``` vt man [flags] ``` ### Options ``` -h, --help help for man ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal ###### Auto generated by spf13/cobra on 25-Jun-2020 vt-cli-1.3.1/doc/vt_meta.md000066400000000000000000000012111520306561600154370ustar00rootroot00000000000000## vt meta Returns metadata about VirusTotal ### Synopsis Returns metadata about VirusTotal. Metadata includes the full list of engines, relationships supported by each type of objects, and other useful information. ``` vt meta [flags] ``` ### Options ``` -h, --help help for meta ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/doc/vt_monitor.md000066400000000000000000000030571520306561600162120ustar00rootroot00000000000000## vt monitor Manage your monitor account ### Synopsis Manage your VirusTotal Monitor account. This command allows you to manage the contents of your account and retrieve information about analyses performed to your collection. Reference: https://docs.virustotal.com/reference/monitor ``` vt monitor [monitor_id]... [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for monitor -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt monitor delete](vt_monitor_delete.md) - Delete monitor files * [vt monitor deletedetails](vt_monitor_deletedetails.md) - Delete details metadata from files * [vt monitor download](vt_monitor_download.md) - Download files from your monitor account * [vt monitor list](vt_monitor_list.md) - List monitor in your account * [vt monitor relationships](vt_monitor_relationships.md) - Get all relationships. * [vt monitor setdetails](vt_monitor_setdetails.md) - Sets details metadata for a monitor file * [vt monitor upload](vt_monitor_upload.md) - Upload one or more files to your account vt-cli-1.3.1/doc/vt_monitor_analyses.md000066400000000000000000000013641520306561600201100ustar00rootroot00000000000000## vt monitor analyses Analyses for the hash. ``` vt monitor analyses [monitor_id] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analyses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitor_comments.md000066400000000000000000000013671520306561600201210ustar00rootroot00000000000000## vt monitor comments Comments for the hash. ### Synopsis Comments for the hash. ``` vt monitor comments [monitor_id] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitor_delete.md000066400000000000000000000012541520306561600175310ustar00rootroot00000000000000## vt monitor delete Delete monitor files ### Synopsis Delete files in your account. This command deletes files in your monitor account using a MonitorItemID, deleting a folder recursivelly deletes all files and folders inside it. ``` vt monitor delete [monitor_id]... [flags] ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitor_deletedetails.md000066400000000000000000000012561520306561600211010ustar00rootroot00000000000000## vt monitor deletedetails Delete details metadata from files ### Synopsis Delete details metadata from files. This command delete details metadata from a file or files in your monitor account that was previously set. ``` vt monitor deletedetails [monitor_id]... [flags] ``` ### Options ``` -h, --help help for deletedetails ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitor_download.md000066400000000000000000000017241520306561600201000ustar00rootroot00000000000000## vt monitor download Download files from your monitor account ### Synopsis Download files from your account. This command download files in your monitor account using their MonitorItemID. ``` vt monitor download [monitor_id]... [flags] ``` ### Examples ``` vt monitor download "MonitorItemID" vt monitor download "MonitorItemID1" "MonitorItemID2" ... cat list_of_monitor_ids | vt monitor download - ``` ### Options ``` -h, --help help for download -o, --output string directory where downloaded files are put (default ".") -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitor_list.md000066400000000000000000000020131520306561600172340ustar00rootroot00000000000000## vt monitor list List monitor in your account ``` vt monitor list [flags] ``` ### Examples ``` vt monitor list vt monitor list --filter "path:/myfolder/" --include path vt monitor list --filter "tag:detected" --include path,last_analysis_results.*.result,last_detections_count ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitor_owner.md000066400000000000000000000013761520306561600174260ustar00rootroot00000000000000## vt monitor owner User or group owning the item. ### Synopsis User or group owning the item. ``` vt monitor owner [monitor_id] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for owner -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitor_relationships.md000066400000000000000000000013511520306561600211510ustar00rootroot00000000000000## vt monitor relationships Get all relationships. ``` vt monitor relationships [monitor_id] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitor_setdetails.md000066400000000000000000000015051520306561600204270ustar00rootroot00000000000000## vt monitor setdetails Sets details metadata for a monitor file ### Synopsis Set details metadata for a file. This command sets details metadata for a file in your monitor account referenced by a MonitorItemID. ``` vt monitor setdetails [monitor_id] [details_string] [flags] ``` ### Examples ``` vt monitor setdetails "MonitorItemID" "Some file metadata." cat multiline_details | vt monitor setdetails "MonitorItemID" ``` ### Options ``` -h, --help help for setdetails ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitor_upload.md000066400000000000000000000020601520306561600175470ustar00rootroot00000000000000## vt monitor upload Upload one or more files to your account ### Synopsis Upload a file or files contained in a folder. This command receives one file or folder path and uploads them to your VirusTotal Monitor account. It returns uploaded the file paths followed by their corresponding monitor ID. You can use the "vt monitor [monitor_id]" command for retrieving information about the it. ``` vt monitor upload [file/folder] [remote_path] [flags] ``` ### Examples ``` vt monitor item upload foo.exe /remote_folder/foo.exe vt monitor item upload myfolder/ /another_remote_folder/ ``` ### Options ``` -h, --help help for upload -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/doc/vt_monitorpartner.md000066400000000000000000000023171520306561600176040ustar00rootroot00000000000000## vt monitorpartner Manage your monitor partner account ### Synopsis Manage your VirusTotal Monitor Partner account. This command allows you to list and retrieve files detected by your engine. Reference: https://docs.virustotal.com/reference/monitor-partner ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for monitorpartner -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt monitorpartner download](vt_monitorpartner_download.md) - Download files from your monitor partner account * [vt monitorpartner list](vt_monitorpartner_list.md) - List available monitor partner hashes * [vt monitorpartner relationships](vt_monitorpartner_relationships.md) - Get all relationships. vt-cli-1.3.1/doc/vt_monitorpartner_analyses.md000066400000000000000000000014241520306561600215010ustar00rootroot00000000000000## vt monitorpartner analyses Analyses for the hash. ``` vt monitorpartner analyses [sha256] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analyses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/doc/vt_monitorpartner_comments.md000066400000000000000000000014241520306561600215070ustar00rootroot00000000000000## vt monitorpartner comments Comments for the hash. ``` vt monitorpartner comments [sha256] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/doc/vt_monitorpartner_download.md000066400000000000000000000017431520306561600214750ustar00rootroot00000000000000## vt monitorpartner download Download files from your monitor partner account ### Synopsis Download files from your partner account. This command download files from your monitor partner account using their sha256. ``` vt monitorpartner download [sha256]... [flags] ``` ### Examples ``` vt monitorpartner download ... cat list_of_monitor_ids | vt monitorpartner download - ``` ### Options ``` -h, --help help for download -o, --output string directory where downloaded files are put (default ".") -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/doc/vt_monitorpartner_items.md000066400000000000000000000014151520306561600210030ustar00rootroot00000000000000## vt monitorpartner items Items with a given hash. ``` vt monitorpartner items [sha256] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for items -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/doc/vt_monitorpartner_list.md000066400000000000000000000017631520306561600206430ustar00rootroot00000000000000## vt monitorpartner list List available monitor partner hashes ``` vt monitorpartner list [flags] ``` ### Examples ``` vt monitorpartner list vt monitorpartner list --filter "engine:" --include sha256,first_detection_date ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/doc/vt_monitorpartner_relationships.md000066400000000000000000000014111520306561600225420ustar00rootroot00000000000000## vt monitorpartner relationships Get all relationships. ``` vt monitorpartner relationships [sha256] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/doc/vt_retrohunt.md000066400000000000000000000017131520306561600165520ustar00rootroot00000000000000## vt retrohunt Manage retrohunt jobs ### Synopsis Manage retrohunt jobs. ``` vt retrohunt [id]... [flags] ``` ### Options ``` -h, --help help for retrohunt -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt retrohunt abort](vt_retrohunt_abort.md) - Abort a retrohunt job * [vt retrohunt delete](vt_retrohunt_delete.md) - Delete a retrohunt job * [vt retrohunt list](vt_retrohunt_list.md) - List retrohunt jobs * [vt retrohunt matches](vt_retrohunt_matches.md) - Get matches for a retrohunt job * [vt retrohunt start](vt_retrohunt_start.md) - Start a retrohunt job vt-cli-1.3.1/doc/vt_retrohunt_abort.md000066400000000000000000000007451520306561600177450ustar00rootroot00000000000000## vt retrohunt abort Abort a retrohunt job ``` vt retrohunt abort [job id] [flags] ``` ### Options ``` -h, --help help for abort ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/doc/vt_retrohunt_delete.md000066400000000000000000000007541520306561600201000ustar00rootroot00000000000000## vt retrohunt delete Delete a retrohunt job ``` vt retrohunt delete [job id]... [flags] ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/doc/vt_retrohunt_list.md000066400000000000000000000017121520306561600176040ustar00rootroot00000000000000## vt retrohunt list List retrohunt jobs ### Synopsis List retrohunt jobs. ``` vt retrohunt list [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -H, --human output in a human-friendly format -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/doc/vt_retrohunt_matches.md000066400000000000000000000015451520306561600202610ustar00rootroot00000000000000## vt retrohunt matches Get matches for a retrohunt job ``` vt retrohunt matches [job id] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for matches -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/doc/vt_retrohunt_start.md000066400000000000000000000016601520306561600177700ustar00rootroot00000000000000## vt retrohunt start Start a retrohunt job ### Synopsis Start a retrohunt job. This command receives a file containing YARA rules and starts a retrohunt job with those rules. ``` vt retrohunt start [file] [flags] ``` ### Options ``` --after string scan files sent to VirusTotal after the given date (format: YYYY-MM-DD) --before string scan files sent to VirusTotal before the given date (format: YYYY-MM-DD) --corpus string specify the corpus that will be scanned, possible values are "main" and "goodware" (default "main") -h, --help help for start ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/doc/vt_scan.md000066400000000000000000000012011520306561600154340ustar00rootroot00000000000000## vt scan Scan files or URLs ### Synopsis Scan files or URLs. This group of commands allow to scan files and URLs. ### Options ``` -h, --help help for scan ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt scan file](vt_scan_file.md) - Scan one or more files * [vt scan url](vt_scan_url.md) - Scan one of more URLs vt-cli-1.3.1/doc/vt_scan_file.md000066400000000000000000000031601520306561600164410ustar00rootroot00000000000000## vt scan file Scan one or more files ### Synopsis Scan one or more files. This command receives one or more file paths and uploads them to VirusTotal for scanning. It returns the file paths followed by their corresponding analysis IDs. You can use the "vt analysis" command for retrieving information about the analyses or you can use the --wait flag to see the results when the analysis is completed. If the command receives a single hypen (-) the file paths are read from the standard input, one per line. The command can also receive a directory to scan all files contained on it. ``` vt scan file [[dir] | [file]...] [flags] ``` ### Examples ``` vt scan file foo.exe vt scan file foo.exe bar.exe vt scan file foo/ cat list_of_file_paths | vt scan file - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for file -i, --include strings include fields matching the provided pattern (default [**]) -o, --open Return an URL to see the analysis report at the VirusTotal web GUI -p, --password string Password of the protected file -t, --threads int number of threads working in parallel (default 5) -w, --wait Wait until the analysis is completed and show the analysis results ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt scan](vt_scan.md) - Scan files or URLs vt-cli-1.3.1/doc/vt_scan_url.md000066400000000000000000000023671520306561600163340ustar00rootroot00000000000000## vt scan url Scan one of more URLs ### Synopsis Scan one or more URLs. This command receives one or more URLs and scan them. It returns the URLs followed by their corresponding analysis IDs. You can use the "vt analysis" command for retrieving information about the analyses or you can use the --wait flag to see the results when the analysis is completed. If the command receives a single hypen (-) the URLs are read from the standard input, one per line. ``` vt scan url [url]... [flags] ``` ### Examples ``` vt scan url http://foo.com vt scan url http://foo.com http://bar.com cat list_of_urls | vt scan urls - ``` ### Options ``` -h, --help help for url -o, --open Return an URL to see the analysis report at the VirusTotal web GUI -t, --threads int number of threads working in parallel (default 5) -w, --wait Wait until the analysis is completed and show the analysis results ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt scan](vt_scan.md) - Scan files or URLs vt-cli-1.3.1/doc/vt_search.md000066400000000000000000000024771520306561600157750ustar00rootroot00000000000000## vt search Search for files in VirusTotal Intelligence ### Synopsis Search for files using VirusTotal Intelligence's query language. ``` vt search [query] [flags] ``` ### Examples ``` vt search eicar vt search "foobar p:1+" ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -d, --download download files that match the query -x, --exclude strings exclude fields matching the provided pattern -h, --help help for search -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) -o, --output string directory where downloaded files are put (default ".") -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt search content](vt_search_content.md) - Search for patterns within files in VirusTotal Intelligence vt-cli-1.3.1/doc/vt_search_content.md000066400000000000000000000023231520306561600175150ustar00rootroot00000000000000## vt search content Search for patterns within files in VirusTotal Intelligence ### Synopsis Search for content within files in VirusTotal ``` vt search content [query] [flags] ``` ### Examples ``` vt search content foobarbaz vt search content '"foo bar baz"' vt search content {cafebabe} vt search content '{70 6C 75 73 76 69 63 [1] 79 61 72 61}' vt search content '/virustotal(.org|.com)/' ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -d, --download download files that match the query -e, --exact-matches-only exact matches only -h, --help help for content -I, --identifiers-only print identifiers only -n, --limit int maximum number of results (default 10) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt search](vt_search.md) - Search for files in VirusTotal Intelligence vt-cli-1.3.1/doc/vt_threatprofile.md000066400000000000000000000033231520306561600173670ustar00rootroot00000000000000## vt threatprofile Get information about Threat Profiles ### Synopsis Get information about one or more Threat Profiles. This command receives one or more Threat Profile IDs and returns information about them. The information for each profile is returned in the same order as the IDs are passed to the command. If the command receives a single hyphen (-) the IDs will be read from the standard input, one per line. ``` vt threatprofile [id]... [flags] ``` ### Examples ``` vt threatprofile vt threatprofile cat list_of_profile_ids | vt threatprofile - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for threatprofile -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt threatprofile create](vt_threatprofile_create.md) - Create a Threat Profile * [vt threatprofile delete](vt_threatprofile_delete.md) - Delete Threat Profiles * [vt threatprofile list](vt_threatprofile_list.md) - List Threat Profiles * [vt threatprofile relationships](vt_threatprofile_relationships.md) - Get all relationships. * [vt threatprofile update](vt_threatprofile_update.md) - Update a Threat Profile vt-cli-1.3.1/doc/vt_threatprofile_create.md000066400000000000000000000037711520306561600207210ustar00rootroot00000000000000## vt threatprofile create Create a Threat Profile ### Synopsis Creates a Threat Profile. This command creates a new Threat Profile with the specified name, description, interests, and recommendation configuration. For interest types, provide comma-separated values if multiple values are needed for a single interest type flag. ``` vt threatprofile create [flags] ``` ### Examples ``` vt threatprofile create --name "My New Threat Profile" --targeted-region "US,ES" ``` ### Options ``` --actor-motivation strings List of actors’ motivations (comma-separated) -x, --exclude strings exclude fields matching the provided pattern -h, --help help for create -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) --malware-role strings List of malware roles (comma-separated) --max-days-since-last-seen int Max lookback period in days for recommendations (1-365, default 180 if not set by API) (default 180) --max-recs-per-type int Max recommendations per type (1-20, default 10 if not set by API) (default 10) --min-categories-matched int Min matching categories for recommendation (1-5, default 1 if not set by API) (default 1) -n, --name string Threat Profile's name (required) --source-region strings List of source regions (comma-separated) --targeted-industry strings List of targeted industries (comma-separated) --targeted-region strings List of targeted regions (comma-separated) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt threatprofile](vt_threatprofile.md) - Get information about Threat Profiles vt-cli-1.3.1/doc/vt_threatprofile_delete.md000066400000000000000000000015501520306561600207110ustar00rootroot00000000000000## vt threatprofile delete Delete Threat Profiles ### Synopsis Delete one or more Threat Profiles. This command receives one or more Threat Profile IDs and deletes them. The command will ask for confirmation before deleting. ``` vt threatprofile delete [id]... [flags] ``` ### Examples ``` vt threatprofile delete vt threatprofile delete cat list_of_profile_ids | vt threatprofile delete - ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt threatprofile](vt_threatprofile.md) - Get information about Threat Profiles vt-cli-1.3.1/doc/vt_threatprofile_list.md000066400000000000000000000021051520306561600204170ustar00rootroot00000000000000## vt threatprofile list List Threat Profiles ### Synopsis List Threat Profiles. ``` vt threatprofile list [flags] ``` ### Examples ``` vt threatprofile list vt threatprofile list --filter "name:APT" --limit 10 vt threatprofile list --cursor ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt threatprofile](vt_threatprofile.md) - Get information about Threat Profiles vt-cli-1.3.1/doc/vt_threatprofile_relationships.md000066400000000000000000000014031520306561600223300ustar00rootroot00000000000000## vt threatprofile relationships Get all relationships. ``` vt threatprofile relationships [id] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt threatprofile](vt_threatprofile.md) - Get information about Threat Profiles vt-cli-1.3.1/doc/vt_threatprofile_update.md000066400000000000000000000035461520306561600207400ustar00rootroot00000000000000## vt threatprofile update Update a Threat Profile ### Synopsis Update a Threat Profile. This command updates an existing Threat Profile with the specified ID. You can update attributes like name, interests, and recommendation configuration. ``` vt threatprofile update [id] [flags] ``` ### Examples ``` vt threatprofile update --name "Updated Name" vt threatprofile update --targeted-region "US,CA" --actor-motivation "cybercrime" ``` ### Options ``` --actor-motivation strings List of actors’ motivations (comma-separated) -x, --exclude strings exclude fields matching the provided pattern -h, --help help for update -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) --malware-role strings List of malware roles (comma-separated) --max-days-since-last-seen int Max lookback period in days for recommendations (1-365) --max-recs-per-type int Max recommendations per type (1-20) --min-categories-matched int Min matching categories for recommendation (1-5) -n, --name string Threat Profile's name --source-region strings List of source regions (comma-separated) --targeted-industry strings List of targeted industries (comma-separated) --targeted-region strings List of targeted regions (comma-separated) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt threatprofile](vt_threatprofile.md) - Get information about Threat Profiles vt-cli-1.3.1/doc/vt_url.md000066400000000000000000000110341520306561600153170ustar00rootroot00000000000000## vt url Get information about URLs ### Synopsis Get information about one or more URLs. This command receives one or more URLs and returns information about them. URL hashes as returned in the "object_id" field are also accepted. The information about each URL is returned in the same order as the URLs are passed to the command. If the command receives a single hypen (-) the URLs are read from the standard input, one per line. ``` vt url [url]... [flags] ``` ### Examples ``` vt url https://www.virustotal.com vt url f1177df4692356280844e1d5af67cc4a9eccecf77aa61c229d483b7082c70a8e cat list_of_urls | vt url - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for url -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt url analyses](vt_url_analyses.md) - Analyses for the URL. * [vt url associations](vt_url_associations.md) - Returns the collections related to the IOC. * [vt url campaigns](vt_url_campaigns.md) - IOC's related campaigns. * [vt url collections](vt_url_collections.md) - Returns the collections related to the IOC. * [vt url comments](vt_url_comments.md) - Comments for the URL. * [vt url communicating_files](vt_url_communicating_files.md) - Files that communicate with this url when they are executed. * [vt url contacted_domains](vt_url_contacted_domains.md) - Distinct domains from which the URL loads some kind of resource. * [vt url contacted_ips](vt_url_contacted_ips.md) - Distinct IP addresses from which the URL loads some kind of resource. * [vt url downloaded_files](vt_url_downloaded_files.md) - Interesting files downloaded from the URL. * [vt url embedded_js_files](vt_url_embedded_js_files.md) - JS files embedded in a URL. * [vt url graphs](vt_url_graphs.md) - Graphs that include the URL. * [vt url http_response_contents](vt_url_http_response_contents.md) - HTTP response contents from the URL. * [vt url last_serving_ip_address](vt_url_last_serving_ip_address.md) - Last IP address that served the URL. * [vt url malware_families](vt_url_malware_families.md) - IOC's related malware families. * [vt url memory_pattern_parents](vt_url_memory_pattern_parents.md) - Files having a domain as string on memory during sandbox execution. * [vt url network_location](vt_url_network_location.md) - Domain or IP address for the URL. * [vt url parent_resource_urls](vt_url_parent_resource_urls.md) - Returns the URLs where this URL has been loaded as resource. * [vt url redirecting_urls](vt_url_redirecting_urls.md) - URLs that redirected to the given URL. * [vt url redirects_to](vt_url_redirects_to.md) - URLs that this url redirects to. * [vt url references](vt_url_references.md) - Returns the References related to the URL. * [vt url referrer_files](vt_url_referrer_files.md) - Files containing the URL. * [vt url referrer_urls](vt_url_referrer_urls.md) - URLs that refer to the given URL. * [vt url related_collections](vt_url_related_collections.md) - Returns the Collections of the parent Domains or IPs of this URL. * [vt url related_comments](vt_url_related_comments.md) - Comments for the URL. * [vt url related_references](vt_url_related_references.md) - Returns the direct and related references containing this URL. * [vt url related_reports](vt_url_related_reports.md) - IOC's related reports * [vt url related_threat_actors](vt_url_related_threat_actors.md) - IOC's related threat actors. * [vt url relationships](vt_url_relationships.md) - Get all relationships. * [vt url reports](vt_url_reports.md) - IOC's related reports. * [vt url software_toolkits](vt_url_software_toolkits.md) - IOC's related software toolkits. * [vt url submissions](vt_url_submissions.md) - Submissions for the URL. * [vt url urls_related_by_tracker_id](vt_url_urls_related_by_tracker_id.md) - URLs that share the same tracker ID. * [vt url user_votes](vt_url_user_votes.md) - Item's votes made by current signed-in user. * [vt url votes](vt_url_votes.md) - Item's votes. * [vt url vulnerabilities](vt_url_vulnerabilities.md) - IOC's related vulnerabilities. vt-cli-1.3.1/doc/vt_url_analyses.md000066400000000000000000000015101520306561600172140ustar00rootroot00000000000000## vt url analyses Analyses for the URL. ``` vt url analyses [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analyses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_associations.md000066400000000000000000000015521520306561600201020ustar00rootroot00000000000000## vt url associations Returns the collections related to the IOC. ``` vt url associations [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for associations -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_campaigns.md000066400000000000000000000015161520306561600173450ustar00rootroot00000000000000## vt url campaigns IOC's related campaigns. ``` vt url campaigns [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for campaigns -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_collections.md000066400000000000000000000015471520306561600177250ustar00rootroot00000000000000## vt url collections Returns the collections related to the IOC. ``` vt url collections [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_comments.md000066400000000000000000000015101520306561600172220ustar00rootroot00000000000000## vt url comments Comments for the URL. ``` vt url comments [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_communicating_files.md000066400000000000000000000016201520306561600214160ustar00rootroot00000000000000## vt url communicating_files Files that communicate with this url when they are executed. ``` vt url communicating_files [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for communicating_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_contacted_domains.md000066400000000000000000000016161520306561600210620ustar00rootroot00000000000000## vt url contacted_domains Distinct domains from which the URL loads some kind of resource. ``` vt url contacted_domains [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_contacted_ips.md000066400000000000000000000016071520306561600202230ustar00rootroot00000000000000## vt url contacted_ips Distinct IP addresses from which the URL loads some kind of resource. ``` vt url contacted_ips [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_downloaded_files.md000066400000000000000000000015651520306561600207110ustar00rootroot00000000000000## vt url downloaded_files Interesting files downloaded from the URL. ``` vt url downloaded_files [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for downloaded_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_embedded_js_files.md000066400000000000000000000015511520306561600210110ustar00rootroot00000000000000## vt url embedded_js_files JS files embedded in a URL. ``` vt url embedded_js_files [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for embedded_js_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_graphs.md000066400000000000000000000015111520306561600166620ustar00rootroot00000000000000## vt url graphs Graphs that include the URL. ``` vt url graphs [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_http_response_contents.md000066400000000000000000000016011520306561600222100ustar00rootroot00000000000000## vt url http_response_contents HTTP response contents from the URL. ``` vt url http_response_contents [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for http_response_contents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_last_serving_ip_address.md000066400000000000000000000016041520306561600222760ustar00rootroot00000000000000## vt url last_serving_ip_address Last IP address that served the URL. ``` vt url last_serving_ip_address [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for last_serving_ip_address -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_malware_families.md000066400000000000000000000015521520306561600207040ustar00rootroot00000000000000## vt url malware_families IOC's related malware families. ``` vt url malware_families [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for malware_families -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_memory_pattern_parents.md000066400000000000000000000016401520306561600222020ustar00rootroot00000000000000## vt url memory_pattern_parents Files having a domain as string on memory during sandbox execution. ``` vt url memory_pattern_parents [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_network_location.md000066400000000000000000000015541520306561600207660ustar00rootroot00000000000000## vt url network_location Domain or IP address for the URL. ``` vt url network_location [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for network_location -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_parent_resource_urls.md000066400000000000000000000016231520306561600216470ustar00rootroot00000000000000## vt url parent_resource_urls Returns the URLs where this URL has been loaded as resource. ``` vt url parent_resource_urls [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for parent_resource_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_redirecting_urls.md000066400000000000000000000015611520306561600207470ustar00rootroot00000000000000## vt url redirecting_urls URLs that redirected to the given URL. ``` vt url redirecting_urls [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for redirecting_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_redirects_to.md000066400000000000000000000015371520306561600200740ustar00rootroot00000000000000## vt url redirects_to URLs that this url redirects to. ``` vt url redirects_to [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for redirects_to -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_references.md000066400000000000000000000015431520306561600175240ustar00rootroot00000000000000## vt url references Returns the References related to the URL. ``` vt url references [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_referrer_files.md000066400000000000000000000015361520306561600204030ustar00rootroot00000000000000## vt url referrer_files Files containing the URL. ``` vt url referrer_files [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for referrer_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_referrer_urls.md000066400000000000000000000015431520306561600202640ustar00rootroot00000000000000## vt url referrer_urls URLs that refer to the given URL. ``` vt url referrer_urls [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for referrer_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_related_attack_techniques.md000066400000000000000000000014761520306561600226070ustar00rootroot00000000000000## vt url related_attack_techniques Returns the Attack Techniques of the Collections containing this URL. ``` vt url related_attack_techniques [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_related_collections.md000066400000000000000000000016251520306561600214220ustar00rootroot00000000000000## vt url related_collections Returns the Collections of the parent Domains or IPs of this URL. ``` vt url related_collections [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_related_comments.md000066400000000000000000000015401520306561600207250ustar00rootroot00000000000000## vt url related_comments Comments for the URL. ``` vt url related_comments [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_related_references.md000066400000000000000000000016171520306561600212260ustar00rootroot00000000000000## vt url related_references Returns the direct and related references containing this URL. ``` vt url related_references [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_related_reports.md000066400000000000000000000015351520306561600206020ustar00rootroot00000000000000## vt url related_reports IOC's related reports ``` vt url related_reports [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_related_threat_actors.md000066400000000000000000000015661520306561600217520ustar00rootroot00000000000000## vt url related_threat_actors IOC's related threat actors. ``` vt url related_threat_actors [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_relationships.md000066400000000000000000000013211520306561600202610ustar00rootroot00000000000000## vt url relationships Get all relationships. ``` vt url relationships [url] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_reports.md000066400000000000000000000015061520306561600171000ustar00rootroot00000000000000## vt url reports IOC's related reports. ``` vt url reports [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for reports -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_software_toolkits.md000066400000000000000000000015561520306561600211710ustar00rootroot00000000000000## vt url software_toolkits IOC's related software toolkits. ``` vt url software_toolkits [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for software_toolkits -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_submissions.md000066400000000000000000000015241520306561600177600ustar00rootroot00000000000000## vt url submissions Submissions for the URL. ``` vt url submissions [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for submissions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_urls_related_by_tracker_id.md000066400000000000000000000016151520306561600227510ustar00rootroot00000000000000## vt url urls_related_by_tracker_id URLs that share the same tracker ID. ``` vt url urls_related_by_tracker_id [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls_related_by_tracker_id -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_user_votes.md000066400000000000000000000015451520306561600176030ustar00rootroot00000000000000## vt url user_votes Item's votes made by current signed-in user. ``` vt url user_votes [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user_votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_votes.md000066400000000000000000000014671520306561600165500ustar00rootroot00000000000000## vt url votes Item's votes. ``` vt url votes [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_url_vulnerabilities.md000066400000000000000000000015461520306561600206070ustar00rootroot00000000000000## vt url vulnerabilities IOC's related vulnerabilities. ``` vt url vulnerabilities [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for vulnerabilities -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/doc/vt_user.md000066400000000000000000000020621520306561600154740ustar00rootroot00000000000000## vt user Get information about VirusTotal users ### Synopsis Get information about a VirusTotal user. ``` vt user [username | apikey | email]... [flags] ``` ### Examples ``` vt user joe vt user 1ebb658141155c16d8bf89629379098b4cf31d4613b13784a108c6a4805c963b vt user joe@domain.com ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt user privileges](vt_user_privileges.md) - Change user privileges vt-cli-1.3.1/doc/vt_user_privileges.md000066400000000000000000000011721520306561600177260ustar00rootroot00000000000000## vt user privileges Change user privileges ### Options ``` -h, --help help for privileges ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt user](vt_user.md) - Get information about VirusTotal users * [vt user privileges grant](vt_user_privileges_grant.md) - Grant privileges to a user * [vt user privileges revoke](vt_user_privileges_revoke.md) - Revoke privileges from a user vt-cli-1.3.1/doc/vt_user_privileges_grant.md000066400000000000000000000013361520306561600211230ustar00rootroot00000000000000## vt user privileges grant Grant privileges to a user ``` vt user privileges grant [username] [privilege]... [flags] ``` ### Examples ``` vt user privileges grant myuser intelligence downloads-tier-2 ``` ### Options ``` -e, --expiration string expiration time for the granted privileges (UNIX timestamp or YYYY-MM-DD) -h, --help help for grant ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt user privileges](vt_user_privileges.md) - Change user privileges vt-cli-1.3.1/doc/vt_user_privileges_revoke.md000066400000000000000000000011621520306561600213000ustar00rootroot00000000000000## vt user privileges revoke Revoke privileges from a user ``` vt user privileges revoke [username] [privilege]... [flags] ``` ### Examples ``` vt user privileges revoke myuser intelligence downloads-tier-2 ``` ### Options ``` -h, --help help for revoke ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt user privileges](vt_user_privileges.md) - Change user privileges vt-cli-1.3.1/doc/vt_version.md000066400000000000000000000007261520306561600162100ustar00rootroot00000000000000## vt version Show version number ``` vt version [flags] ``` ### Options ``` -h, --help help for version ``` ### Options inherited from parent commands ``` -k, --apikey string API key --format string Output format (yaml/json/csv) (default "yaml") -s, --silent Silent or quiet mode. Do not show progress meter -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/go.mod000066400000000000000000000040751520306561600140320ustar00rootroot00000000000000module github.com/VirusTotal/vt-cli go 1.22.0 require ( github.com/VirusTotal/vt-go v1.1.0 github.com/briandowns/spinner v1.23.1 github.com/cavaliergopher/grab/v3 v3.0.1 github.com/dustin/go-humanize v1.0.1 github.com/fatih/color v1.17.0 github.com/gobwas/glob v0.2.3 github.com/gosuri/uitable v0.0.4 github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213 github.com/plusvic/go-ansi v0.0.0-20180516115420-9879244c4340 github.com/spf13/cobra v1.8.1 github.com/spf13/pflag v1.0.5 github.com/spf13/viper v1.19.0 github.com/stretchr/testify v1.9.0 golang.org/x/sync v0.6.0 ) require ( github.com/clipperhouse/uax29/v2 v2.2.0 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/fsnotify/fsnotify v1.7.0 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/hashicorp/hcl v1.0.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/magiconair/properties v1.8.7 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-runewidth v0.0.19 // indirect github.com/mitchellh/mapstructure v1.5.0 // indirect github.com/pelletier/go-toml/v2 v2.2.2 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/sagikazarmark/locafero v0.4.0 // indirect github.com/sagikazarmark/slog-shim v0.1.0 // indirect github.com/sourcegraph/conc v0.3.0 // indirect github.com/spf13/afero v1.11.0 // indirect github.com/spf13/cast v1.6.0 // indirect github.com/subosito/gotenv v1.6.0 // indirect github.com/thedevsaddam/gojsonq/v2 v2.5.2 // indirect go.uber.org/atomic v1.9.0 // indirect go.uber.org/multierr v1.9.0 // indirect golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect golang.org/x/sys v0.18.0 // indirect golang.org/x/term v0.1.0 // indirect golang.org/x/text v0.14.0 // indirect gopkg.in/ini.v1 v1.67.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) vt-cli-1.3.1/go.sum000066400000000000000000000242451520306561600140600ustar00rootroot00000000000000github.com/VirusTotal/vt-go v1.1.0 h1:RsVUZJD7ByInQNywZNRBd4RGOZjWQr0CuflySKamh/8= github.com/VirusTotal/vt-go v1.1.0/go.mod h1:u1+HeRyl/gQs67eDgVEWNE7+x+zCyXhdtNVrRJR5YPE= github.com/briandowns/spinner v1.23.1 h1:t5fDPmScwUjozhDj4FA46p5acZWIPXYE30qW2Ptu650= github.com/briandowns/spinner v1.23.1/go.mod h1:LaZeM4wm2Ywy6vO571mvhQNRcWfRUnXOs0RcKV0wYKM= github.com/cavaliergopher/grab/v3 v3.0.1 h1:4z7TkBfmPjmLAAmkkAZNX/6QJ1nNFdv3SdIHXju0Fr4= github.com/cavaliergopher/grab/v3 v3.0.1/go.mod h1:1U/KNnD+Ft6JJiYoYBAimKH2XrYptb8Kl3DFGmsjpq4= github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY= github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4= github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4= github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI= github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8= github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA= github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY= github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo= github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4= github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213 h1:qGQQKEcAR99REcMpsXCp3lJ03zYT1PkRd3kQGPn9GVg= github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213/go.mod h1:vNUNkEQ1e29fT/6vq2aBdFsgNPmy8qMdSay1npru+Sw= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY= github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw= github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM= github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs= github.com/plusvic/go-ansi v0.0.0-20180516115420-9879244c4340 h1:sF/uuIPQuC995BsfdZhNDbVY2e9Qgglk6RuE5E1Bszk= github.com/plusvic/go-ansi v0.0.0-20180516115420-9879244c4340/go.mod h1:eYI1gLV8ZbwceONT13eTBeMU7+TukMsdE+fty2DPyl4= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8= github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ= github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4= github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE= github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ= github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo= github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0= github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8= github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY= github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0= github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo= github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM= github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/viper v1.19.0 h1:RWq5SEjt8o25SROyN3z2OrDB9l7RPd3lwTWU8EcEdcI= github.com/spf13/viper v1.19.0/go.mod h1:GQUN9bilAbhU/jgc1bKs99f/suXKeUMct8Adx5+Ntkg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8= github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU= github.com/thedevsaddam/gojsonq/v2 v2.5.2 h1:CoMVaYyKFsVj6TjU6APqAhAvC07hTI6IQen8PHzHYY0= github.com/thedevsaddam/gojsonq/v2 v2.5.2/go.mod h1:bv6Xa7kWy82uT0LnXPE2SzGqTj33TAEeR560MdJkiXs= go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE= go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI= go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ= golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g= golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k= golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4= golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.1.0 h1:g6Z6vPFA9dYBAF7DWcH6sCcOntplXsDKcliusYijMlw= golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA= gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= vt-cli-1.3.1/man/000077500000000000000000000000001520306561600134715ustar00rootroot00000000000000vt-cli-1.3.1/man/vt.md000066400000000000000000000031371520306561600144500ustar00rootroot00000000000000## vt A command-line tool for interacting with VirusTotal ### Synopsis A command-line tool for interacting with VirusTotal. ### Options ``` -k, --apikey string API key -h, --help help for vt --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt analysis](vt_analysis.md) - Get a file or URL analysis * [vt collection](vt_collection.md) - Get information about collections * [vt completion](vt_completion.md) - Output shell completion code for the specified shell (bash or zsh) * [vt domain](vt_domain.md) - Get information about Internet domains * [vt download](vt_download.md) - Download files * [vt file](vt_file.md) - Get information about files * [vt group](vt_group.md) - Get information about VirusTotal groups * [vt hunting](vt_hunting.md) - Manage malware hunting rules and notifications * [vt init](vt_init.md) - Initialize or re-initialize vt command-line tool * [vt iocstream](vt_iocstream.md) - Manage IoC Stream notifications * [vt ip](vt_ip.md) - Get information about IP addresses * [vt meta](vt_meta.md) - Returns metadata about VirusTotal * [vt monitor](vt_monitor.md) - Manage your monitor account * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs * [vt scan](vt_scan.md) - Scan files or URLs * [vt search](vt_search.md) - Search for files in VirusTotal Intelligence * [vt url](vt_url.md) - Get information about URLs * [vt user](vt_user.md) - Get information about VirusTotal users * [vt version](vt_version.md) - Show version number vt-cli-1.3.1/man/vt_analysis.md000066400000000000000000000023751520306561600163560ustar00rootroot00000000000000## vt analysis Get a file or URL analysis ### Synopsis Get a file or URL analysis. This command receives one or more analysis identifiers and returns information about the analysis. The data is returned in the same order as the identifiers appear in the command line. If the command receives a single hypen (-) the analysis identifiers are read from the standard input, one per line. ``` vt analysis [hash]... [flags] ``` ### Examples ``` vt analysis f-e04b82f7f8afc6e599d4913bee5eb571921ec8958d1ea5e3bbffe9c7ea9a0960-1542306475 vt analysis u-1db0ad7dbcec0676710ea0eaacd35d5e471d3e11944d53bcbd31f0cbd11bce31-1542292491 cat list_of_analysis_ids | vt analysis - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analysis -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/man/vt_collection.md000066400000000000000000000061711520306561600166640ustar00rootroot00000000000000## vt collection Get information about collections ### Synopsis Get information about one or more collections. This command receives one or more collection IDs and returns information about them. The information for each collection is returned in the same order as the collections are passed to the command. If the command receives a single hypen (-) the collection will be read from the standard input, one per line. ``` vt collection [collection]... [flags] ``` ### Examples ``` vt collection malpedia_win_emotet vt collection malpedia_win_emotet alienvault_603eb1abdd4812819c64e197 cat list_of_collections | vt collection -n [collection_name] -d [collection_description] - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collection -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt collection attack_techniques](vt_collection_attack_techniques.md) - Collection's ATT&CK techniques. * [vt collection autogenerated_graphs](vt_collection_autogenerated_graphs.md) - Autogenerated graphs related to the collection. * [vt collection comments](vt_collection_comments.md) - Comments for the collection. * [vt collection create](vt_collection_create.md) - Create a collection. * [vt collection delete](vt_collection_delete.md) - Delete a collection. * [vt collection domains](vt_collection_domains.md) - Collection's domains. * [vt collection files](vt_collection_files.md) - Collection's files. * [vt collection ip_addresses](vt_collection_ip_addresses.md) - Collection's IP addresses. * [vt collection owner](vt_collection_owner.md) - User who created the collection. * [vt collection references](vt_collection_references.md) - Collection's references. * [vt collection relationships](vt_collection_relationships.md) - Get all relationships. * [vt collection remove](vt_collection_remove.md) - Remove items from a collection. * [vt collection rename](vt_collection_rename.md) - Rename collection. * [vt collection sigma_rules](vt_collection_sigma_rules.md) - Collection's SIGMA rules. * [vt collection stats](vt_collection_stats.md) - Monthly lookup and submission stats per country. * [vt collection subscribed_users](vt_collection_subscribed_users.md) - Users subscribed to the collection. * [vt collection subscription_preferences](vt_collection_subscription_preferences.md) - Subscription preference for the given user. * [vt collection threat_actors](vt_collection_threat_actors.md) - Collection's threat actors. * [vt collection update](vt_collection_update.md) - Add new items to a collection. * [vt collection urls](vt_collection_urls.md) - Collection's URLs. * [vt collection yara_rulesets](vt_collection_yara_rulesets.md) - Collection's YARA rulesets. vt-cli-1.3.1/man/vt_collection_attack_techniques.md000066400000000000000000000014521520306561600224400ustar00rootroot00000000000000## vt collection attack_techniques Collection's ATT&CK techniques. ``` vt collection attack_techniques [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_autogenerated_graphs.md000066400000000000000000000015031520306561600231310ustar00rootroot00000000000000## vt collection autogenerated_graphs Autogenerated graphs related to the collection. ``` vt collection autogenerated_graphs [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for autogenerated_graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_comments.md000066400000000000000000000014141520306561600205640ustar00rootroot00000000000000## vt collection comments Comments for the collection. ``` vt collection comments [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_create.md000066400000000000000000000024431520306561600202050ustar00rootroot00000000000000## vt collection create Create a collection. ### Synopsis Creates a collection from a list of IOCs. This command receives one of more IoCs (sha256 hashes, URLs, domains, IP addresses) and creates a collection from them. If the command receives a single hypen (-) the IoCs will be read from the standard input. ``` vt collection create [ioc]... [flags] ``` ### Examples ``` vt collection create -n [collection_name] -d [collection_description] www.example.com vt collection create -n [collection_name] -d [collection_description] www.example.com 8.8.8.8 cat list_of_iocs | vt collection create -n [collection_name] -d [collection_description] - ``` ### Options ``` -d, --description string Collection's description (required) -x, --exclude strings exclude fields matching the provided pattern -h, --help help for create -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --name string Collection's name (required) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_delete.md000066400000000000000000000010521520306561600201770ustar00rootroot00000000000000## vt collection delete Delete a collection. ### Synopsis Delete a collection. This command receives a collection ID and deletes it. ``` vt collection delete [collection id] [flags] ``` ### Examples ``` vt collection delete [collection id] ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_domains.md000066400000000000000000000014021520306561600203660ustar00rootroot00000000000000## vt collection domains Collection's domains. ``` vt collection domains [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_files.md000066400000000000000000000013721520306561600200440ustar00rootroot00000000000000## vt collection files Collection's files. ``` vt collection files [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_ip_addresses.md000066400000000000000000000014261520306561600214070ustar00rootroot00000000000000## vt collection ip_addresses Collection's IP addresses. ``` vt collection ip_addresses [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ip_addresses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_owner.md000066400000000000000000000014071520306561600200730ustar00rootroot00000000000000## vt collection owner User who created the collection. ``` vt collection owner [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for owner -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_references.md000066400000000000000000000014161520306561600210620ustar00rootroot00000000000000## vt collection references Collection's references. ``` vt collection references [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_relationships.md000066400000000000000000000012161520306561600216230ustar00rootroot00000000000000## vt collection relationships Get all relationships. ``` vt collection relationships [collection] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_remove.md000066400000000000000000000016071520306561600202400ustar00rootroot00000000000000## vt collection remove Remove items from a collection. ### Synopsis Remove items from a collection. This command receives a collection ID and one of more IoCs (sha256 hashes, URLs, domains, IP addresses) and removes them from the collection. If the command receives a single hypen (-) the IoCs will be read from the standard input. ``` vt collection remove [collection id] [ioc]... [flags] ``` ### Examples ``` vt collection remove [collection id] www.example.com vt collection remove [collection id] www.example.com 8.8.8.8 cat list_of_iocs | vt collection remove [collection id] - ``` ### Options ``` -h, --help help for remove ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_rename.md000066400000000000000000000006261520306561600202120ustar00rootroot00000000000000## vt collection rename Rename collection. ``` vt collection rename [collection id] [name] [flags] ``` ### Options ``` -h, --help help for rename ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_sigma_rules.md000066400000000000000000000014221520306561600212500ustar00rootroot00000000000000## vt collection sigma_rules Collection's SIGMA rules. ``` vt collection sigma_rules [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for sigma_rules -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_stats.md000066400000000000000000000014271520306561600201010ustar00rootroot00000000000000## vt collection stats Monthly lookup and submission stats per country. ``` vt collection stats [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for stats -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_subscribed_users.md000066400000000000000000000014531520306561600223100ustar00rootroot00000000000000## vt collection subscribed_users Users subscribed to the collection. ``` vt collection subscribed_users [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for subscribed_users -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_subscription_preferences.md000066400000000000000000000015131520306561600240440ustar00rootroot00000000000000## vt collection subscription_preferences Subscription preference for the given user. ``` vt collection subscription_preferences [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for subscription_preferences -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_threat_actors.md000066400000000000000000000014321520306561600216010ustar00rootroot00000000000000## vt collection threat_actors Collection's threat actors. ``` vt collection threat_actors [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_update.md000066400000000000000000000016011520306561600202170ustar00rootroot00000000000000## vt collection update Add new items to a collection. ### Synopsis Adds new items to a collection. This command receives a collection ID and one of more IoCs (sha256 hashes, URLs, domains, IP addresses) and adds them to the collection. If the command receives a single hypen (-) the IoCs will be read from the standard input. ``` vt collection update [collection id] [ioc]... [flags] ``` ### Examples ``` vt collection update [collection id] www.example.com vt collection update [collection id] www.example.com 8.8.8.8 cat list_of_iocs | vt collection update [collection id] - ``` ### Options ``` -h, --help help for update ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_urls.md000066400000000000000000000013661520306561600177320ustar00rootroot00000000000000## vt collection urls Collection's URLs. ``` vt collection urls [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_collection_yara_rulesets.md000066400000000000000000000014321520306561600216210ustar00rootroot00000000000000## vt collection yara_rulesets Collection's YARA rulesets. ``` vt collection yara_rulesets [collection] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for yara_rulesets -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt collection](vt_collection.md) - Get information about collections vt-cli-1.3.1/man/vt_completion.md000066400000000000000000000013371520306561600167010ustar00rootroot00000000000000## vt completion Output shell completion code for the specified shell (bash or zsh) ### Synopsis Output shell completion code for the specified shell (bash or zsh). The shell code must be evaluated to provide interactive completion of vt commands. This can be done by sourcing it from the .bash_profile. Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 ``` vt completion [flags] ``` ### Options ``` -h, --help help for completion ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/man/vt_domain.md000066400000000000000000000073671520306561600160100ustar00rootroot00000000000000## vt domain Get information about Internet domains ### Synopsis Get information about one or more Internet domains. This command receives one or more Internet domains and returns information about them. The data is returned in the same order as the domains appear in the command line. If the command receives a single hypen (-) the domains are read from the standard input, one per line. ``` vt domain [domain]... [flags] ``` ### Examples ``` vt domain virustotal.com vt domain virustotal.com google.com cat list_of_domains | vt domain - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for domain -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt domain caa_records](vt_domain_caa_records.md) - Records CAA for the domain. * [vt domain cname_records](vt_domain_cname_records.md) - Records CNAME for the domain. * [vt domain collections](vt_domain_collections.md) - Returns the collections related to the domain. * [vt domain comments](vt_domain_comments.md) - Comments for the domain or IP address. * [vt domain communicating_files](vt_domain_communicating_files.md) - Files that communicate with the domain. * [vt domain downloaded_files](vt_domain_downloaded_files.md) - Files downloaded from the domain. * [vt domain graphs](vt_domain_graphs.md) - Graphs containing the domain/ip. * [vt domain historical_ssl_certificates](vt_domain_historical_ssl_certificates.md) - SSL certificate history. * [vt domain historical_whois](vt_domain_historical_whois.md) - Historical Whois. * [vt domain immediate_parent](vt_domain_immediate_parent.md) - Immediate parent domain. * [vt domain memory_pattern_parents](vt_domain_memory_pattern_parents.md) - Files having a domain as string on memory during sandbox execution. * [vt domain mx_records](vt_domain_mx_records.md) - Records MX for the domain. * [vt domain ns_records](vt_domain_ns_records.md) - Records NS for the domain. * [vt domain parent](vt_domain_parent.md) - Parent domain. * [vt domain references](vt_domain_references.md) - Returns the References related to the domain. * [vt domain referrer_files](vt_domain_referrer_files.md) - Files containing the domain. * [vt domain related_attack_techniques](vt_domain_related_attack_techniques.md) - Returns the Attack Techniques of Collections containing this Domain. * [vt domain related_comments](vt_domain_related_comments.md) - Comments for the Domain or IP's related entities. * [vt domain related_references](vt_domain_related_references.md) - Returns the References of the Collections containing this Domain. * [vt domain related_threat_actors](vt_domain_related_threat_actors.md) - Returns the Threat Actors of the Collections containing this Domain. * [vt domain relationships](vt_domain_relationships.md) - Get all relationships. * [vt domain resolutions](vt_domain_resolutions.md) - DNS resolutions for the domain. * [vt domain siblings](vt_domain_siblings.md) - Subdomains that share the same domain. * [vt domain soa_records](vt_domain_soa_records.md) - Records SOA for the domain. * [vt domain subdomains](vt_domain_subdomains.md) - Subdomains of the domain. * [vt domain urls](vt_domain_urls.md) - URLs related to the domain. * [vt domain user_votes](vt_domain_user_votes.md) - Item's votes made by current signed-in user. * [vt domain votes](vt_domain_votes.md) - Item's votes. vt-cli-1.3.1/man/vt_domain_caa_records.md000066400000000000000000000014051520306561600203200ustar00rootroot00000000000000## vt domain caa_records Records CAA for the domain. ``` vt domain caa_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for caa_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_cname_records.md000066400000000000000000000014151520306561600206600ustar00rootroot00000000000000## vt domain cname_records Records CNAME for the domain. ``` vt domain cname_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for cname_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_collections.md000066400000000000000000000014301520306561600203670ustar00rootroot00000000000000## vt domain collections Returns the collections related to the domain. ``` vt domain collections [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_comments.md000066400000000000000000000014071520306561600177020ustar00rootroot00000000000000## vt domain comments Comments for the domain or IP address. ``` vt domain comments [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_communicating_files.md000066400000000000000000000014511520306561600220730ustar00rootroot00000000000000## vt domain communicating_files Files that communicate with the domain. ``` vt domain communicating_files [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for communicating_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_downloaded_files.md000066400000000000000000000014321520306561600213550ustar00rootroot00000000000000## vt domain downloaded_files Files downloaded from the domain. ``` vt domain downloaded_files [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for downloaded_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_graphs.md000066400000000000000000000013731520306561600173430ustar00rootroot00000000000000## vt domain graphs Graphs containing the domain/ip. ``` vt domain graphs [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_historical_ssl_certificates.md000066400000000000000000000014621520306561600236250ustar00rootroot00000000000000## vt domain historical_ssl_certificates SSL certificate history. ``` vt domain historical_ssl_certificates [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for historical_ssl_certificates -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_historical_whois.md000066400000000000000000000014121520306561600214230ustar00rootroot00000000000000## vt domain historical_whois Historical Whois. ``` vt domain historical_whois [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for historical_whois -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_immediate_parent.md000066400000000000000000000014211520306561600213600ustar00rootroot00000000000000## vt domain immediate_parent Immediate parent domain. ``` vt domain immediate_parent [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for immediate_parent -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_memory_pattern_parents.md000066400000000000000000000015161520306561600226570ustar00rootroot00000000000000## vt domain memory_pattern_parents Files having a domain as string on memory during sandbox execution. ``` vt domain memory_pattern_parents [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_mx_records.md000066400000000000000000000014011520306561600202140ustar00rootroot00000000000000## vt domain mx_records Records MX for the domain. ``` vt domain mx_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for mx_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_ns_records.md000066400000000000000000000014011520306561600202100ustar00rootroot00000000000000## vt domain ns_records Records NS for the domain. ``` vt domain ns_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ns_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_parent.md000066400000000000000000000013511520306561600173440ustar00rootroot00000000000000## vt domain parent Parent domain. ``` vt domain parent [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for parent -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_references.md000066400000000000000000000014241520306561600201750ustar00rootroot00000000000000## vt domain references Returns the References related to the domain. ``` vt domain references [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_referrer_files.md000066400000000000000000000014171520306561600210540ustar00rootroot00000000000000## vt domain referrer_files Files containing the domain. ``` vt domain referrer_files [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for referrer_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_related_attack_techniques.md000066400000000000000000000015301520306561600232510ustar00rootroot00000000000000## vt domain related_attack_techniques Returns the Attack Techniques of Collections containing this Domain. ``` vt domain related_attack_techniques [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_related_comments.md000066400000000000000000000014521520306561600214020ustar00rootroot00000000000000## vt domain related_comments Comments for the Domain or IP's related entities. ``` vt domain related_comments [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_related_references.md000066400000000000000000000015001520306561600216700ustar00rootroot00000000000000## vt domain related_references Returns the References of the Collections containing this Domain. ``` vt domain related_references [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_related_threat_actors.md000066400000000000000000000015141520306561600224160ustar00rootroot00000000000000## vt domain related_threat_actors Returns the Threat Actors of the Collections containing this Domain. ``` vt domain related_threat_actors [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_relationships.md000066400000000000000000000011771520306561600207450ustar00rootroot00000000000000## vt domain relationships Get all relationships. ``` vt domain relationships [domain] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_resolutions.md000066400000000000000000000014111520306561600204360ustar00rootroot00000000000000## vt domain resolutions DNS resolutions for the domain. ``` vt domain resolutions [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for resolutions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_siblings.md000066400000000000000000000014071520306561600176670ustar00rootroot00000000000000## vt domain siblings Subdomains that share the same domain. ``` vt domain siblings [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for siblings -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_soa_records.md000066400000000000000000000014051520306561600203560ustar00rootroot00000000000000## vt domain soa_records Records SOA for the domain. ``` vt domain soa_records [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for soa_records -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_subdomains.md000066400000000000000000000014001520306561600202120ustar00rootroot00000000000000## vt domain subdomains Subdomains of the domain. ``` vt domain subdomains [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for subdomains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_urls.md000066400000000000000000000013601520306561600170400ustar00rootroot00000000000000## vt domain urls URLs related to the domain. ``` vt domain urls [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_user_votes.md000066400000000000000000000014231520306561600202510ustar00rootroot00000000000000## vt domain user_votes Item's votes made by current signed-in user. ``` vt domain user_votes [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user_votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_domain_votes.md000066400000000000000000000013451520306561600172160ustar00rootroot00000000000000## vt domain votes Item's votes. ``` vt domain votes [domain] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt domain](vt_domain.md) - Get information about Internet domains vt-cli-1.3.1/man/vt_download.md000066400000000000000000000023111520306561600163300ustar00rootroot00000000000000## vt download Download files ### Synopsis Download one or more files. This command receives one or more file hashes (SHA-256, SHA-1 or MD5) and downloads the files from VirusTotal. For using this command you need an API key with access to VirusTotal Intelligence. If the command receives a single hypen (-) the hashes are read from the standard input, one per line. ``` vt download [flags] ``` ### Examples ``` vt download 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 vt download 76cdb2bad9582d23c1f6f4d868218d6c 44d88612fea8a8f36de82e1278abb02f cat list_of_hashes | vt download - ``` ### Options ``` -h, --help help for download -o, --output string directory where downloaded files are put (default ".") -t, --threads int number of threads working in parallel (default 5) -z, --zip download in a ZIP file --zip-password string password for the ZIP file, used with --zip ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/man/vt_file.md000066400000000000000000000135221520306561600154460ustar00rootroot00000000000000## vt file Get information about files ### Synopsis Get information about one or more files. This command receives one or more hashes (SHA-256, SHA-1 or MD5) and returns information about the corresponding files. The information for each file appears in the same order as the hashes are passed to the command. If the command receives a single hypen (-) the hashes are read from the standard input, one per line. ``` vt file [hash]... [flags] ``` ### Examples ``` vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 vt file 76cdb2bad9582d23c1f6f4d868218d6c vt file 76cdb2bad9582d23c1f6f4d868218d6c 44d88612fea8a8f36de82e1278abb02f cat list_of_hashes | vt file - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for file -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt file analyses](vt_file_analyses.md) - Analyses for the file. * [vt file behaviours](vt_file_behaviours.md) - Behaviour reports for the file. * [vt file bundled_files](vt_file_bundled_files.md) - Files bundled within the file. * [vt file carbonblack_children](vt_file_carbonblack_children.md) - Files derived from the file according to Carbon Black. * [vt file carbonblack_parents](vt_file_carbonblack_parents.md) - Files from where the file was derived according to Carbon Black. * [vt file clues](vt_file_clues.md) - Clues for the file. * [vt file code_blocks](vt_file_code_blocks.md) - Code blocks of the file. * [vt file collections](vt_file_collections.md) - Returns the collections related to the file. * [vt file comments](vt_file_comments.md) - Comments for the file. * [vt file compressed_parents](vt_file_compressed_parents.md) - Compressed files that contain the file. * [vt file contacted_domains](vt_file_contacted_domains.md) - Domains contacted by the file. * [vt file contacted_ips](vt_file_contacted_ips.md) - IP addresses contacted by the file. * [vt file contacted_urls](vt_file_contacted_urls.md) - URLs contacted by the file. * [vt file distributors](vt_file_distributors.md) - Software marketplaces distributing the file. * [vt file dropped_files](vt_file_dropped_files.md) - Files dropped by the file. * [vt file email_attachments](vt_file_email_attachments.md) - Files attached to the email. * [vt file email_parents](vt_file_email_parents.md) - Email files that contained the file. * [vt file email_senders](vt_file_email_senders.md) - Email sender's email addresses. * [vt file embedded_domains](vt_file_embedded_domains.md) - Domain names embedded in the file. * [vt file embedded_ips](vt_file_embedded_ips.md) - IP addresses embedded in the file. * [vt file embedded_urls](vt_file_embedded_urls.md) - URLs embedded in the file. * [vt file execution_parents](vt_file_execution_parents.md) - Files that executed the file. * [vt file graphs](vt_file_graphs.md) - Graphs that include the file. * [vt file hash_collisions](vt_file_hash_collisions.md) - Files with the same MD5 or SHA1 than the file. * [vt file itw_domains](vt_file_itw_domains.md) - In the wild domains from where the file has been downloaded. * [vt file itw_ips](vt_file_itw_ips.md) - In the wild IP addresses from where the file has been downloaded. * [vt file itw_urls](vt_file_itw_urls.md) - In the wild URLs from where the file has been downloaded. * [vt file memory_pattern_domains](vt_file_memory_pattern_domains.md) - Domain string patterns found in memory during sandbox execution. * [vt file memory_pattern_ips](vt_file_memory_pattern_ips.md) - IP address string patterns found in memory during sandbox execution. * [vt file memory_pattern_urls](vt_file_memory_pattern_urls.md) - URL string patterns found in memory during sandbox execution. * [vt file overlay_children](vt_file_overlay_children.md) - Files contained by the file as an overlay. * [vt file overlay_parents](vt_file_overlay_parents.md) - Files that contain the file as an overlay. * [vt file pcap_children](vt_file_pcap_children.md) - PCAP files seen in the file. * [vt file pcap_parents](vt_file_pcap_parents.md) - PCAP files that contain the file. * [vt file pe_resource_children](vt_file_pe_resource_children.md) - PE files contained by the file as a resource. * [vt file pe_resource_parents](vt_file_pe_resource_parents.md) - PE files containing the file as a resource. * [vt file references](vt_file_references.md) - Returns the References for the file. * [vt file related_attack_techniques](vt_file_related_attack_techniques.md) - Returns the Attack Techniques of the Collections containing this File. * [vt file related_references](vt_file_related_references.md) - Returns the References of the Collections containing this File. * [vt file related_threat_actors](vt_file_related_threat_actors.md) - Returns the Threat Actors of the Collections containing this File. * [vt file relationships](vt_file_relationships.md) - Get all relationships. * [vt file screenshots](vt_file_screenshots.md) - Screenshots obtained from the execution of the file. * [vt file sigma_analysis](vt_file_sigma_analysis.md) - Sigma analysis for the file. * [vt file similar_files](vt_file_similar_files.md) - Files that are similar to the file. * [vt file submissions](vt_file_submissions.md) - Submissions for the file. * [vt file urls_for_embedded_js](vt_file_urls_for_embedded_js.md) - URLs where this (JS) file is embedded. * [vt file user_votes](vt_file_user_votes.md) - Item's votes made by current signed-in user. * [vt file votes](vt_file_votes.md) - Item's votes. vt-cli-1.3.1/man/vt_file_analyses.md000066400000000000000000000013421520306561600173420ustar00rootroot00000000000000## vt file analyses Analyses for the file. ``` vt file analyses [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analyses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_behaviours.md000066400000000000000000000013611520306561600176730ustar00rootroot00000000000000## vt file behaviours Behaviour reports for the file. ``` vt file behaviours [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for behaviours -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_bundled_files.md000066400000000000000000000013711520306561600203240ustar00rootroot00000000000000## vt file bundled_files Files bundled within the file. ``` vt file bundled_files [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for bundled_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_carbonblack_children.md000066400000000000000000000014461520306561600216410ustar00rootroot00000000000000## vt file carbonblack_children Files derived from the file according to Carbon Black. ``` vt file carbonblack_children [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for carbonblack_children -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_carbonblack_parents.md000066400000000000000000000014551520306561600215250ustar00rootroot00000000000000## vt file carbonblack_parents Files from where the file was derived according to Carbon Black. ``` vt file carbonblack_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for carbonblack_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_ciphered_bundled_files.md000066400000000000000000000013501520306561600221640ustar00rootroot00000000000000## vt file ciphered_bundled_files ### Synopsis ``` vt file ciphered_bundled_files [hash] [flags] ``` ### Options ``` -c, --cursor string cursor -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ciphered_bundled_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files ###### Auto generated by spf13/cobra on 25-Jun-2020 vt-cli-1.3.1/man/vt_file_ciphered_parents.md000066400000000000000000000014401520306561600210410ustar00rootroot00000000000000## vt file ciphered_parents Ciphered files that contain the file. ### Synopsis Ciphered files that contain the file. ``` vt file ciphered_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ciphered_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files ###### Auto generated by spf13/cobra on 25-Jun-2020 vt-cli-1.3.1/man/vt_file_clues.md000066400000000000000000000013261520306561600166400ustar00rootroot00000000000000## vt file clues Clues for the file. ``` vt file clues [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for clues -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_code_blocks.md000066400000000000000000000013551520306561600177760ustar00rootroot00000000000000## vt file code_blocks Code blocks of the file. ``` vt file code_blocks [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for code_blocks -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_collections.md000066400000000000000000000014011520306561600200350ustar00rootroot00000000000000## vt file collections Returns the collections related to the file. ``` vt file collections [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_comments.md000066400000000000000000000013421520306561600173500ustar00rootroot00000000000000## vt file comments Comments for the file. ``` vt file comments [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_compressed_parents.md000066400000000000000000000014211520306561600214210ustar00rootroot00000000000000## vt file compressed_parents Compressed files that contain the file. ``` vt file compressed_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for compressed_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_contacted_domains.md000066400000000000000000000014051520306561600212010ustar00rootroot00000000000000## vt file contacted_domains Domains contacted by the file. ``` vt file contacted_domains [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_contacted_ips.md000066400000000000000000000013761520306561600203510ustar00rootroot00000000000000## vt file contacted_ips IP addresses contacted by the file. ``` vt file contacted_ips [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_contacted_urls.md000066400000000000000000000013711520306561600205360ustar00rootroot00000000000000## vt file contacted_urls URLs contacted by the file. ``` vt file contacted_urls [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_distributors.md000066400000000000000000000014041520306561600202570ustar00rootroot00000000000000## vt file distributors Software marketplaces distributing the file. ``` vt file distributors [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for distributors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_dropped_files.md000066400000000000000000000013651520306561600203470ustar00rootroot00000000000000## vt file dropped_files Files dropped by the file. ``` vt file dropped_files [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for dropped_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_email_attachments.md000066400000000000000000000014031520306561600212030ustar00rootroot00000000000000## vt file email_attachments Files attached to the email. ``` vt file email_attachments [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for email_attachments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_email_parents.md000066400000000000000000000013771520306561600203560ustar00rootroot00000000000000## vt file email_parents Email files that contained the file. ``` vt file email_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for email_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_email_senders.md000066400000000000000000000013721520306561600203400ustar00rootroot00000000000000## vt file email_senders Email sender's email addresses. ``` vt file email_senders [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for email_senders -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_embedded_domains.md000066400000000000000000000014061520306561600207670ustar00rootroot00000000000000## vt file embedded_domains Domain names embedded in the file. ``` vt file embedded_domains [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for embedded_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_embedded_ips.md000066400000000000000000000013721520306561600201320ustar00rootroot00000000000000## vt file embedded_ips IP addresses embedded in the file. ``` vt file embedded_ips [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for embedded_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_embedded_urls.md000066400000000000000000000013651520306561600203260ustar00rootroot00000000000000## vt file embedded_urls URLs embedded in the file. ``` vt file embedded_urls [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for embedded_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_execution_parents.md000066400000000000000000000014041520306561600212610ustar00rootroot00000000000000## vt file execution_parents Files that executed the file. ``` vt file execution_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for execution_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_graphs.md000066400000000000000000000013431520306561600170100ustar00rootroot00000000000000## vt file graphs Graphs that include the file. ``` vt file graphs [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_hash_collisions.md000066400000000000000000000014171520306561600207070ustar00rootroot00000000000000## vt file hash_collisions Files with the same MD5 or SHA1 than the file. ``` vt file hash_collisions [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for hash_collisions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_itw_domains.md000066400000000000000000000014211520306561600200360ustar00rootroot00000000000000## vt file itw_domains In the wild domains from where the file has been downloaded. ``` vt file itw_domains [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for itw_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_itw_ips.md000066400000000000000000000014121520306561600171770ustar00rootroot00000000000000## vt file itw_ips In the wild IP addresses from where the file has been downloaded. ``` vt file itw_ips [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for itw_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_itw_urls.md000066400000000000000000000014051520306561600173730ustar00rootroot00000000000000## vt file itw_urls In the wild URLs from where the file has been downloaded. ``` vt file itw_urls [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for itw_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_memory_pattern_domains.md000066400000000000000000000014661520306561600223110ustar00rootroot00000000000000## vt file memory_pattern_domains Domain string patterns found in memory during sandbox execution. ``` vt file memory_pattern_domains [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_memory_pattern_ips.md000066400000000000000000000014561520306561600214510ustar00rootroot00000000000000## vt file memory_pattern_ips IP address string patterns found in memory during sandbox execution. ``` vt file memory_pattern_ips [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_memory_pattern_urls.md000066400000000000000000000014521520306561600216370ustar00rootroot00000000000000## vt file memory_pattern_urls URL string patterns found in memory during sandbox execution. ``` vt file memory_pattern_urls [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_overlay_children.md000066400000000000000000000014161520306561600210560ustar00rootroot00000000000000## vt file overlay_children Files contained by the file as an overlay. ``` vt file overlay_children [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for overlay_children -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_overlay_parents.md000066400000000000000000000014131520306561600207370ustar00rootroot00000000000000## vt file overlay_parents Files that contain the file as an overlay. ``` vt file overlay_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for overlay_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_pcap_children.md000066400000000000000000000013671520306561600203250ustar00rootroot00000000000000## vt file pcap_children PCAP files seen in the file. ``` vt file pcap_children [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for pcap_children -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_pcap_parents.md000066400000000000000000000013711520306561600202040ustar00rootroot00000000000000## vt file pcap_parents PCAP files that contain the file. ``` vt file pcap_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for pcap_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_pe_resource_children.md000066400000000000000000000014351520306561600217110ustar00rootroot00000000000000## vt file pe_resource_children PE files contained by the file as a resource. ``` vt file pe_resource_children [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for pe_resource_children -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_pe_resource_parents.md000066400000000000000000000014301520306561600215700ustar00rootroot00000000000000## vt file pe_resource_parents PE files containing the file as a resource. ``` vt file pe_resource_parents [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for pe_resource_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_references.md000066400000000000000000000013661520306561600176520ustar00rootroot00000000000000## vt file references Returns the References for the file. ``` vt file references [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_related_attack_techniques.md000066400000000000000000000015051520306561600227230ustar00rootroot00000000000000## vt file related_attack_techniques Returns the Attack Techniques of the Collections containing this File. ``` vt file related_attack_techniques [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_related_references.md000066400000000000000000000014511520306561600213450ustar00rootroot00000000000000## vt file related_references Returns the References of the Collections containing this File. ``` vt file related_references [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_related_threat_actors.md000066400000000000000000000014651520306561600220730ustar00rootroot00000000000000## vt file related_threat_actors Returns the Threat Actors of the Collections containing this File. ``` vt file related_threat_actors [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_relationships.md000066400000000000000000000011521520306561600204060ustar00rootroot00000000000000## vt file relationships Get all relationships. ``` vt file relationships [hash] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_screenshots.md000066400000000000000000000014111520306561600200600ustar00rootroot00000000000000## vt file screenshots Screenshots obtained from the execution of the file. ``` vt file screenshots [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for screenshots -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_sigma_analysis.md000066400000000000000000000013721520306561600205310ustar00rootroot00000000000000## vt file sigma_analysis Sigma analysis for the file. ``` vt file sigma_analysis [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for sigma_analysis -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_similar_files.md000066400000000000000000000013761520306561600203540ustar00rootroot00000000000000## vt file similar_files Files that are similar to the file. ``` vt file similar_files [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for similar_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_submissions.md000066400000000000000000000013561520306561600201060ustar00rootroot00000000000000## vt file submissions Submissions for the file. ``` vt file submissions [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for submissions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_urls_for_embedded_js.md000066400000000000000000000014261520306561600216660ustar00rootroot00000000000000## vt file urls_for_embedded_js URLs where this (JS) file is embedded. ``` vt file urls_for_embedded_js [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls_for_embedded_js -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_user_votes.md000066400000000000000000000013761520306561600177300ustar00rootroot00000000000000## vt file user_votes Item's votes made by current signed-in user. ``` vt file user_votes [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user_votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_file_votes.md000066400000000000000000000013201520306561600166570ustar00rootroot00000000000000## vt file votes Item's votes. ``` vt file votes [hash] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt file](vt_file.md) - Get information about files vt-cli-1.3.1/man/vt_group.md000066400000000000000000000015231520306561600156610ustar00rootroot00000000000000## vt group Get information about VirusTotal groups ### Synopsis Get information about a group. ``` vt group [groupname]... [flags] ``` ### Examples ``` vt group mygroup ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for group -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt group privileges](vt_group_privileges.md) - Change group privileges vt-cli-1.3.1/man/vt_group_privileges.md000066400000000000000000000010301520306561600201030ustar00rootroot00000000000000## vt group privileges Change group privileges ### Options ``` -h, --help help for privileges ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt group](vt_group.md) - Get information about VirusTotal groups * [vt group privileges grant](vt_group_privileges_grant.md) - Grant privileges to a group * [vt group privileges revoke](vt_group_privileges_revoke.md) - Revoke privileges from a group vt-cli-1.3.1/man/vt_group_privileges_grant.md000066400000000000000000000011721520306561600213050ustar00rootroot00000000000000## vt group privileges grant Grant privileges to a group ``` vt group privileges grant [groupname] [privilege]... [flags] ``` ### Examples ``` vt group privileges grant mygroup intelligence downloads-tier-2 ``` ### Options ``` -e, --expiration string expiration time for the granted privileges (UNIX timestamp or YYYY-MM-DD) -h, --help help for grant ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt group privileges](vt_group_privileges.md) - Change group privileges vt-cli-1.3.1/man/vt_group_privileges_revoke.md000066400000000000000000000010161520306561600214620ustar00rootroot00000000000000## vt group privileges revoke Revoke privileges from a group ``` vt group privileges revoke [groupname] [privilege]... [flags] ``` ### Examples ``` vt group privileges revoke mygroup intelligence downloads-tier-2 ``` ### Options ``` -h, --help help for revoke ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt group privileges](vt_group_privileges.md) - Change group privileges vt-cli-1.3.1/man/vt_hunting.md000066400000000000000000000010211520306561600161720ustar00rootroot00000000000000## vt hunting Manage malware hunting rules and notifications ### Options ``` -h, --help help for hunting ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt hunting notification](vt_hunting_notification.md) - Manage malware hunting notifications * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_hunting_notification.md000066400000000000000000000016241520306561600207510ustar00rootroot00000000000000## vt hunting notification Manage malware hunting notifications ``` vt hunting notification [id]... [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for notification -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting](vt_hunting.md) - Manage malware hunting rules and notifications * [vt hunting notification delete](vt_hunting_notification_delete.md) - Delete hunting notifications * [vt hunting notification list](vt_hunting_notification_list.md) - List notifications vt-cli-1.3.1/man/vt_hunting_notification_delete.md000066400000000000000000000013341520306561600222710ustar00rootroot00000000000000## vt hunting notification delete Delete hunting notifications ### Synopsis Delete hunting notifications. This command deletes the malware hunting notifications associated to the currently configured API key. ``` vt hunting notification delete [notification id]... [flags] ``` ### Options ``` -a, --all delete all notifications -h, --help help for delete -t, --with-tag string delete notifications with a given tag ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting notification](vt_hunting_notification.md) - Manage malware hunting notifications vt-cli-1.3.1/man/vt_hunting_notification_list.md000066400000000000000000000020761520306561600220060ustar00rootroot00000000000000## vt hunting notification list List notifications ### Synopsis List malware hunting notifications. This command list the malware hunting notifications associated to the currently configured API key. ``` vt hunting notification list [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting notification](vt_hunting_notification.md) - Manage malware hunting notifications * [vt hunting notification list delete](vt_hunting_notification_list_delete.md) - Delete hunting notifications vt-cli-1.3.1/man/vt_hunting_notification_list_delete.md000066400000000000000000000013361520306561600233260ustar00rootroot00000000000000## vt hunting notification list delete Delete hunting notifications ### Synopsis Delete hunting notifications. This command deletes the malware hunting notifications associated to the currently configured API key. ``` vt hunting notification list delete [notification id]... [flags] ``` ### Options ``` -a, --all delete all notifications -h, --help help for delete -t, --with-tag string delete notifications with a given tag ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting notification list](vt_hunting_notification_list.md) - List notifications vt-cli-1.3.1/man/vt_hunting_ruleset.md000066400000000000000000000026661520306561600177550ustar00rootroot00000000000000## vt hunting ruleset Manage hunting rulesets ``` vt hunting ruleset [id]... [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ruleset -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting](vt_hunting.md) - Manage malware hunting rules and notifications * [vt hunting ruleset add](vt_hunting_ruleset_add.md) - Add a new ruleset * [vt hunting ruleset delete](vt_hunting_ruleset_delete.md) - Delete rulesets * [vt hunting ruleset disable](vt_hunting_ruleset_disable.md) - Disable ruleset * [vt hunting ruleset enable](vt_hunting_ruleset_enable.md) - Enable ruleset * [vt hunting ruleset list](vt_hunting_ruleset_list.md) - List rulesets * [vt hunting ruleset notification_emails](vt_hunting_ruleset_notification_emails.md) - Set ruleset notification emails * [vt hunting ruleset rename](vt_hunting_ruleset_rename.md) - Rename ruleset * [vt hunting ruleset setlimit](vt_hunting_ruleset_setlimit.md) - Set ruleset limit * [vt hunting ruleset update](vt_hunting_ruleset_update.md) - Change the rules for a ruleset vt-cli-1.3.1/man/vt_hunting_ruleset_add.md000066400000000000000000000006331520306561600205550ustar00rootroot00000000000000## vt hunting ruleset add Add a new ruleset ``` vt hunting ruleset add [ruleset name] [rules file] [flags] ``` ### Options ``` -h, --help help for add ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_hunting_ruleset_delete.md000066400000000000000000000006711520306561600212710ustar00rootroot00000000000000## vt hunting ruleset delete Delete rulesets ``` vt hunting ruleset delete [ruleset id]... [flags] ``` ### Options ``` -a, --all delete all rulesets -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_hunting_ruleset_disable.md000066400000000000000000000006261520306561600214320ustar00rootroot00000000000000## vt hunting ruleset disable Disable ruleset ``` vt hunting ruleset disable [ruleset id] [flags] ``` ### Options ``` -h, --help help for disable ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_hunting_ruleset_enable.md000066400000000000000000000006221520306561600212510ustar00rootroot00000000000000## vt hunting ruleset enable Enable ruleset ``` vt hunting ruleset enable [ruleset id] [flags] ``` ### Options ``` -h, --help help for enable ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_hunting_ruleset_list.md000066400000000000000000000016361520306561600210040ustar00rootroot00000000000000## vt hunting ruleset list List rulesets ### Synopsis List malware hunting rulesets. This command list the malware hunting rulesets associated to the currently configured API key. ``` vt hunting ruleset list [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_hunting_ruleset_notification_emails.md000066400000000000000000000007251520306561600240470ustar00rootroot00000000000000## vt hunting ruleset notification_emails Set ruleset notification emails ``` vt hunting ruleset notification_emails [ruleset id] [email]... [flags] ``` ### Options ``` -h, --help help for notification_emails ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_hunting_ruleset_rename.md000066400000000000000000000006311520306561600212720ustar00rootroot00000000000000## vt hunting ruleset rename Rename ruleset ``` vt hunting ruleset rename [ruleset id] [name] [flags] ``` ### Options ``` -h, --help help for rename ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_hunting_ruleset_setlimit.md000066400000000000000000000006431520306561600216600ustar00rootroot00000000000000## vt hunting ruleset setlimit Set ruleset limit ``` vt hunting ruleset setlimit [ruleset id] [limit] [flags] ``` ### Options ``` -h, --help help for setlimit ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_hunting_ruleset_update.md000066400000000000000000000006571520306561600213150ustar00rootroot00000000000000## vt hunting ruleset update Change the rules for a ruleset ``` vt hunting ruleset update [ruleset id] [rules file] [flags] ``` ### Options ``` -h, --help help for update ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt hunting ruleset](vt_hunting_ruleset.md) - Manage hunting rulesets vt-cli-1.3.1/man/vt_init.md000066400000000000000000000012411520306561600154650ustar00rootroot00000000000000## vt init Initialize or re-initialize vt command-line tool ### Synopsis Initialize or re-initialize this command-line tool. This command will ask for your API key and save it in a local file, so you don't need to enter it everytime you use the tool. It will also retrieve additional metadata from VirusTotal for making the tool even more powerful. ``` vt init [flags] ``` ### Options ``` -h, --help help for init ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/man/vt_iocstream.md000066400000000000000000000036711520306561600165210ustar00rootroot00000000000000## vt iocstream Manage IoC Stream notifications ``` vt iocstream [notification_id]... [flags] ``` ### Examples ``` ## List: # List notifications from a hunting rule by name vt iocstream list -f "origin:hunting tag:my_rule" # List notifications from a hunting ruleset by name vt iocstream list -f "origin:hunting tag:myRuleset" # List just the entity IDs of your IoC Stream matches vt iocstream list -I # List ALL the entity IDs in your IoC Stream and store them in a csv file (this might take a while) vt iocstream list -I –limit 9999999 > results.csv # List the first IoC Stream notifications including the hash, last_analysis_stats, size and file type vt iocstream list -i "_id,last_analysis_stats,size,type_tag" # Check if a hash is in your IoC Stream matches vt iocstream list -f "entity_type:file entity_id:hash" ## Delete: # Delete all notifications matching a filter, e.g. all matches for a Yara rule/ruleset. This process is # asynchronous, so it can take a while to see all the notifications deleted. vt iocstream delete -f "origin:hunting tag:my_rule" # Delete a single notification with ID 1234568. The notification ID is displayed in the context_attributes. vt iocstream delete 1234568 ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for iocstream -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt iocstream delete](vt_iocstream_delete.md) - Deletes notifications from the IoC Stream * [vt iocstream list](vt_iocstream_list.md) - List IoCs from notifications vt-cli-1.3.1/man/vt_iocstream_delete.md000066400000000000000000000017221520306561600200360ustar00rootroot00000000000000## vt iocstream delete Deletes notifications from the IoC Stream ### Synopsis Delete notifications from the IoC Stream. The command accepts a list of IoC Stream notification IDs. If no IDs are provided, then all the IoC Stream notifications matching the given filter are deleted. ``` vt iocstream delete [notification id]... [flags] ``` ### Examples ``` # Delete all notifications matching a filter, e.g. all matches for a Yara rule/ruleset vt iocstream delete -f "origin:hunting tag:my_rule" # Delete a single notification with ID 1234568. The notification ID is displayed in the context_attributes. vt iocstream delete 1234568 ``` ### Options ``` -f, --filter string filter -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt iocstream](vt_iocstream.md) - Manage IoC Stream notifications vt-cli-1.3.1/man/vt_iocstream_list.md000066400000000000000000000027371520306561600175560ustar00rootroot00000000000000## vt iocstream list List IoCs from notifications ``` vt iocstream list [flags] ``` ### Examples ``` # List notifications from a hunting rule by name vt iocstream list -f "origin:hunting tag:my_rule" # List notifications from a hunting ruleset by name vt iocstream list -f "origin:hunting tag:myRuleset" # List just the entity IDs of your IoC Stream matches vt iocstream list -I # List ALL the entity IDs in your IoC Stream and store them in a csv file (this might take a while) vt iocstream list -I –limit 9999999 > results.csv # List the first IoC Stream notifications including the hash, last_analysis_stats, size and file type vt iocstream list -i "_id,last_analysis_stats,size,type_tag" # Check if a hash is in your IoC Stream matches vt iocstream list -f "entity_type:file entity_id:hash" ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt iocstream](vt_iocstream.md) - Manage IoC Stream notifications vt-cli-1.3.1/man/vt_ip.md000066400000000000000000000055441520306561600151440ustar00rootroot00000000000000## vt ip Get information about IP addresses ### Synopsis Get information about one or more IP addresses. This command receives one or more IP addresses and returns information about them. The information for each IP address is returned in the same order as the IP addresses are passed to the command. If the command receives a single hypen (-) the IP addresses will be read from the standard input, one per line. ``` vt ip [ip]... [flags] ``` ### Examples ``` vt ip 8.8.8.8 vt ip 8.8.8.8 8.8.4.4 cat list_of_ips | vt ip - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for ip -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt ip collections](vt_ip_collections.md) - Returns the collections related to the IP Address. * [vt ip comments](vt_ip_comments.md) - Comments for the domain or IP address. * [vt ip communicating_files](vt_ip_communicating_files.md) - Files that communicate with the ip. * [vt ip downloaded_files](vt_ip_downloaded_files.md) - Files downloaded from the ip. * [vt ip graphs](vt_ip_graphs.md) - Graphs containing the domain/ip. * [vt ip historical_ssl_certificates](vt_ip_historical_ssl_certificates.md) - SSL certificate history. * [vt ip historical_whois](vt_ip_historical_whois.md) - Historical Whois. * [vt ip memory_pattern_parents](vt_ip_memory_pattern_parents.md) - Files having a IP as string on memory during sandbox execution. * [vt ip references](vt_ip_references.md) - Returns the References related to the IP Address. * [vt ip referrer_files](vt_ip_referrer_files.md) - Files containing the domain/ip. * [vt ip related_attack_techniques](vt_ip_related_attack_techniques.md) - Returns the Attack Techniques of the Collections containing this IP. * [vt ip related_comments](vt_ip_related_comments.md) - Comments for the Domain or IP's related entities. * [vt ip related_references](vt_ip_related_references.md) - Returns the References of the Collections containing this IP. * [vt ip related_threat_actors](vt_ip_related_threat_actors.md) - Returns the Threat Actors of the Collections containing this IP. * [vt ip relationships](vt_ip_relationships.md) - Get all relationships. * [vt ip resolutions](vt_ip_resolutions.md) - DNS resolutions for the IP address. * [vt ip urls](vt_ip_urls.md) - URLs related to the ip. * [vt ip user_votes](vt_ip_user_votes.md) - Item's votes made by current signed-in user. * [vt ip votes](vt_ip_votes.md) - Item's votes. vt-cli-1.3.1/man/vt_ip_collections.md000066400000000000000000000014041520306561600175310ustar00rootroot00000000000000## vt ip collections Returns the collections related to the IP Address. ``` vt ip collections [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_comments.md000066400000000000000000000013571520306561600170470ustar00rootroot00000000000000## vt ip comments Comments for the domain or IP address. ``` vt ip comments [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_communicating_files.md000066400000000000000000000014151520306561600212340ustar00rootroot00000000000000## vt ip communicating_files Files that communicate with the ip. ``` vt ip communicating_files [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for communicating_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_downloaded_files.md000066400000000000000000000013761520306561600205250ustar00rootroot00000000000000## vt ip downloaded_files Files downloaded from the ip. ``` vt ip downloaded_files [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for downloaded_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_graphs.md000066400000000000000000000013431520306561600165010ustar00rootroot00000000000000## vt ip graphs Graphs containing the domain/ip. ``` vt ip graphs [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_historical_ssl_certificates.md000066400000000000000000000014321520306561600227630ustar00rootroot00000000000000## vt ip historical_ssl_certificates SSL certificate history. ``` vt ip historical_ssl_certificates [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for historical_ssl_certificates -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_historical_whois.md000066400000000000000000000013621520306561600205700ustar00rootroot00000000000000## vt ip historical_whois Historical Whois. ``` vt ip historical_whois [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for historical_whois -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_memory_pattern_parents.md000066400000000000000000000014621520306561600220200ustar00rootroot00000000000000## vt ip memory_pattern_parents Files having a IP as string on memory during sandbox execution. ``` vt ip memory_pattern_parents [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_references.md000066400000000000000000000014001520306561600173300ustar00rootroot00000000000000## vt ip references Returns the References related to the IP Address. ``` vt ip references [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_referrer_files.md000066400000000000000000000013721520306561600202150ustar00rootroot00000000000000## vt ip referrer_files Files containing the domain/ip. ``` vt ip referrer_files [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for referrer_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_related_attack_techniques.md000066400000000000000000000015001520306561600224070ustar00rootroot00000000000000## vt ip related_attack_techniques Returns the Attack Techniques of the Collections containing this IP. ``` vt ip related_attack_techniques [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_related_comments.md000066400000000000000000000014221520306561600205400ustar00rootroot00000000000000## vt ip related_comments Comments for the Domain or IP's related entities. ``` vt ip related_comments [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_related_references.md000066400000000000000000000014441520306561600210400ustar00rootroot00000000000000## vt ip related_references Returns the References of the Collections containing this IP. ``` vt ip related_references [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_related_threat_actors.md000066400000000000000000000014601520306561600215570ustar00rootroot00000000000000## vt ip related_threat_actors Returns the Threat Actors of the Collections containing this IP. ``` vt ip related_threat_actors [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_relationships.md000066400000000000000000000011471520306561600201030ustar00rootroot00000000000000## vt ip relationships Get all relationships. ``` vt ip relationships [ip] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_resolutions.md000066400000000000000000000013651520306561600176070ustar00rootroot00000000000000## vt ip resolutions DNS resolutions for the IP address. ``` vt ip resolutions [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for resolutions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_urls.md000066400000000000000000000013241520306561600162010ustar00rootroot00000000000000## vt ip urls URLs related to the ip. ``` vt ip urls [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_user_votes.md000066400000000000000000000013731520306561600174160ustar00rootroot00000000000000## vt ip user_votes Item's votes made by current signed-in user. ``` vt ip user_votes [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user_votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_ip_votes.md000066400000000000000000000013151520306561600163540ustar00rootroot00000000000000## vt ip votes Item's votes. ``` vt ip votes [ip] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt ip](vt_ip.md) - Get information about IP addresses vt-cli-1.3.1/man/vt_man.md000066400000000000000000000005531520306561600153020ustar00rootroot00000000000000## vt man ### Synopsis ``` vt man [flags] ``` ### Options ``` -h, --help help for man ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal ###### Auto generated by spf13/cobra on 25-Jun-2020 vt-cli-1.3.1/man/vt_meta.md000066400000000000000000000010341520306561600154500ustar00rootroot00000000000000## vt meta Returns metadata about VirusTotal ### Synopsis Returns metadata about VirusTotal. Metadata includes the full list of engines, relationships supported by each type of objects, and other useful information. ``` vt meta [flags] ``` ### Options ``` -h, --help help for meta ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/man/vt_monitor.md000066400000000000000000000030221520306561600162100ustar00rootroot00000000000000## vt monitor Manage your monitor account ### Synopsis Manage your VirusTotal Monitor account. This command allows you to manage the contents of your account and retrieve information about analyses performed to your collection. Reference: https://docs.virustotal.com/reference/monitor ``` vt monitor [monitor_id]... [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for monitor -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt monitor analyses](vt_monitor_analyses.md) - Analyses for the hash. * [vt monitor delete](vt_monitor_delete.md) - Delete monitor files * [vt monitor deletedetails](vt_monitor_deletedetails.md) - Download files from your monitor account * [vt monitor download](vt_monitor_download.md) - Download files from your monitor account * [vt monitor list](vt_monitor_list.md) - List monitor in your account * [vt monitor relationships](vt_monitor_relationships.md) - Get all relationships. * [vt monitor setdetails](vt_monitor_setdetails.md) - Sets details metadata for a monitor file * [vt monitor upload](vt_monitor_upload.md) - Upload one or more files to your account vt-cli-1.3.1/man/vt_monitor_analyses.md000066400000000000000000000013641520306561600201160ustar00rootroot00000000000000## vt monitor analyses Analyses for the hash. ``` vt monitor analyses [monitor_id] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analyses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/man/vt_monitor_comments.md000066400000000000000000000013741520306561600201250ustar00rootroot00000000000000## vt monitor comments Comments for the hash. ### Synopsis Comments for the hash. ``` vt monitor comments [monitor_id] [flags] ``` ### Options ``` -c, --cursor string cursor -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account ###### Auto generated by spf13/cobra on 25-Jun-2020 vt-cli-1.3.1/man/vt_monitor_delete.md000066400000000000000000000010771520306561600175420ustar00rootroot00000000000000## vt monitor delete Delete monitor files ### Synopsis Delete files in your account. This command deletes files in your monitor account using a MonitorItemID, deleting a folder recursivelly deletes all files and folders inside it. ``` vt monitor delete [monitor_id]... [flags] ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/man/vt_monitor_deletedetails.md000066400000000000000000000010761520306561600211070ustar00rootroot00000000000000## vt monitor deletedetails Download files from your monitor account ### Synopsis Set details metadata for a file. This command sets details metadata for a file in your monitor account referenced by a MonitorItemID. ``` vt monitor deletedetails [monitor_id]... [flags] ``` ### Options ``` -h, --help help for deletedetails ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/man/vt_monitor_download.md000066400000000000000000000015471520306561600201110ustar00rootroot00000000000000## vt monitor download Download files from your monitor account ### Synopsis Download files from your account. This command download files in your monitor account using their MonitorItemID. ``` vt monitor download [monitor_id]... [flags] ``` ### Examples ``` vt monitor download "MonitorItemID" vt monitor download "MonitorItemID1" "MonitorItemID2" ... cat list_of_monitor_ids | vt monitor download - ``` ### Options ``` -h, --help help for download -o, --output string directory where downloaded files are put (default ".") -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/man/vt_monitor_list.md000066400000000000000000000016361520306561600172540ustar00rootroot00000000000000## vt monitor list List monitor in your account ``` vt monitor list [flags] ``` ### Examples ``` vt monitor list vt monitor list --filter "path:/myfolder/" --include path vt monitor list --filter "tag:detected" --include path,last_analysis_results.*.result,last_detections_count ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/man/vt_monitor_owner.md000066400000000000000000000014031520306561600174230ustar00rootroot00000000000000## vt monitor owner User or group owning the item. ### Synopsis User or group owning the item. ``` vt monitor owner [monitor_id] [flags] ``` ### Options ``` -c, --cursor string cursor -x, --exclude strings exclude fields matching the provided pattern -h, --help help for owner -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string api key -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account ###### Auto generated by spf13/cobra on 25-Jun-2020 vt-cli-1.3.1/man/vt_monitor_relationships.md000066400000000000000000000011741520306561600211620ustar00rootroot00000000000000## vt monitor relationships Get all relationships. ``` vt monitor relationships [monitor_id] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/man/vt_monitor_setdetails.md000066400000000000000000000013301520306561600204310ustar00rootroot00000000000000## vt monitor setdetails Sets details metadata for a monitor file ### Synopsis Set details metadata for a file. This command sets details metadata for a file in your monitor account referenced by a MonitorItemID. ``` vt monitor setdetails [monitor_id] [details_string] [flags] ``` ### Examples ``` vt monitor setdetails "MonitorItemID" "Some file metadata." cat multiline_details | vt monitor setdetails "MonitorItemID" ``` ### Options ``` -h, --help help for setdetails ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/man/vt_monitor_upload.md000066400000000000000000000017031520306561600175600ustar00rootroot00000000000000## vt monitor upload Upload one or more files to your account ### Synopsis Upload a file or files contained in a folder. This command receives one file or folder path and uploads them to your VirusTotal Monitor account. It returns uploaded the file paths followed by their corresponding monitor ID. You can use the "vt monitor [monitor_id]" command for retrieving information about the it. ``` vt monitor upload [file/folder] [remote_path] [flags] ``` ### Examples ``` vt monitor item upload foo.exe /remote_folder/foo.exe vt monitor item upload myfolder/ /another_remote_folder/ ``` ### Options ``` -h, --help help for upload -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitor](vt_monitor.md) - Manage your monitor account vt-cli-1.3.1/man/vt_monitorpartner.md000066400000000000000000000025461520306561600176160ustar00rootroot00000000000000## vt monitorpartner Manage your monitor partner account ### Synopsis Manage your VirusTotal Monitor Partner account. This command allows you to list and retrieve files detected by your engine. Reference: https://docs.virustotal.com/reference/monitor-partner ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for monitorpartner -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt monitorpartner analyses](vt_monitorpartner_analyses.md) - Analyses for the hash. * [vt monitorpartner comments](vt_monitorpartner_comments.md) - Comments for the hash. * [vt monitorpartner download](vt_monitorpartner_download.md) - Download files from your monitor partner account * [vt monitorpartner items](vt_monitorpartner_items.md) - Items with a given hash. * [vt monitorpartner list](vt_monitorpartner_list.md) - List available monitor partner hashes * [vt monitorpartner relationships](vt_monitorpartner_relationships.md) - Get all relationships. vt-cli-1.3.1/man/vt_monitorpartner_analyses.md000066400000000000000000000014241520306561600215070ustar00rootroot00000000000000## vt monitorpartner analyses Analyses for the hash. ``` vt monitorpartner analyses [sha256] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analyses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/man/vt_monitorpartner_comments.md000066400000000000000000000014241520306561600215150ustar00rootroot00000000000000## vt monitorpartner comments Comments for the hash. ``` vt monitorpartner comments [sha256] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/man/vt_monitorpartner_download.md000066400000000000000000000015661520306561600215060ustar00rootroot00000000000000## vt monitorpartner download Download files from your monitor partner account ### Synopsis Download files from your partner account. This command download files from your monitor partner account using their sha256. ``` vt monitorpartner download [sha256]... [flags] ``` ### Examples ``` vt monitorpartner download ... cat list_of_monitor_ids | vt monitorpartner download - ``` ### Options ``` -h, --help help for download -o, --output string directory where downloaded files are put (default ".") -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/man/vt_monitorpartner_items.md000066400000000000000000000014151520306561600210110ustar00rootroot00000000000000## vt monitorpartner items Items with a given hash. ``` vt monitorpartner items [sha256] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for items -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/man/vt_monitorpartner_list.md000066400000000000000000000017131520306561600206440ustar00rootroot00000000000000## vt monitorpartner list List available monitor partner hashes ``` vt monitorpartner list [flags] ``` ### Examples ``` vt monitor list vt monitor list --filter "path:/myfolder/" --include path vt monitor list --filter "tag:detected" --include path,last_analysis_results.*.result,last_detections_count ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/man/vt_monitorpartner_relationships.md000066400000000000000000000012341520306561600225530ustar00rootroot00000000000000## vt monitorpartner relationships Get all relationships. ``` vt monitorpartner relationships [sha256] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt monitorpartner](vt_monitorpartner.md) - Manage your monitor partner account vt-cli-1.3.1/man/vt_retrohunt.md000066400000000000000000000015361520306561600165630ustar00rootroot00000000000000## vt retrohunt Manage retrohunt jobs ### Synopsis Manage retrohunt jobs. ``` vt retrohunt [id]... [flags] ``` ### Options ``` -h, --help help for retrohunt -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt retrohunt abort](vt_retrohunt_abort.md) - Abort a retrohunt job * [vt retrohunt delete](vt_retrohunt_delete.md) - Delete a retrohunt job * [vt retrohunt list](vt_retrohunt_list.md) - List retrohunt jobs * [vt retrohunt matches](vt_retrohunt_matches.md) - Get matches for a retrohunt job * [vt retrohunt start](vt_retrohunt_start.md) - Start a retrohunt job vt-cli-1.3.1/man/vt_retrohunt_abort.md000066400000000000000000000005701520306561600177470ustar00rootroot00000000000000## vt retrohunt abort Abort a retrohunt job ``` vt retrohunt abort [job id] [flags] ``` ### Options ``` -h, --help help for abort ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/man/vt_retrohunt_delete.md000066400000000000000000000005771520306561600201110ustar00rootroot00000000000000## vt retrohunt delete Delete a retrohunt job ``` vt retrohunt delete [job id]... [flags] ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/man/vt_retrohunt_list.md000066400000000000000000000015351520306561600176150ustar00rootroot00000000000000## vt retrohunt list List retrohunt jobs ### Synopsis List retrohunt jobs. ``` vt retrohunt list [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -f, --filter string filter -h, --help help for list -H, --human output in a human-friendly format -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/man/vt_retrohunt_matches.md000066400000000000000000000013701520306561600202630ustar00rootroot00000000000000## vt retrohunt matches Get matches for a retrohunt job ``` vt retrohunt matches [job id] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for matches -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/man/vt_retrohunt_start.md000066400000000000000000000015031520306561600177720ustar00rootroot00000000000000## vt retrohunt start Start a retrohunt job ### Synopsis Start a retrohunt job. This command receives a file containing YARA rules and starts a retrohunt job with those rules. ``` vt retrohunt start [file] [flags] ``` ### Options ``` --after string scan files sent to VirusTotal after the given date (format: YYYY-MM-DD) --before string scan files sent to VirusTotal before the given date (format: YYYY-MM-DD) --corpus string specify the corpus that will be scanned, possible values are "main" and "goodware" (default "main") -h, --help help for start ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt retrohunt](vt_retrohunt.md) - Manage retrohunt jobs vt-cli-1.3.1/man/vt_scan.md000066400000000000000000000010241520306561600154450ustar00rootroot00000000000000## vt scan Scan files or URLs ### Synopsis Scan files or URLs. This group of commands allow to scan files and URLs. ### Options ``` -h, --help help for scan ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt scan file](vt_scan_file.md) - Scan one or more files * [vt scan url](vt_scan_url.md) - Scan one of more URLs vt-cli-1.3.1/man/vt_scan_file.md000066400000000000000000000021631520306561600164510ustar00rootroot00000000000000## vt scan file Scan one or more files ### Synopsis Scan one or more files. This command receives one or more file paths and uploads them to VirusTotal for scanning. It returns the file paths followed by their corresponding analysis IDs. You can use the "vt analysis" command for retrieving information about the analyses. If the command receives a single hypen (-) the file paths are read from the standard input, one per line. The command can also receive a directory to scan all files contained on it. ``` vt scan file [[dir] | [file]...] [flags] ``` ### Examples ``` vt scan file foo.exe vt scan file foo.exe bar.exe vt scan file foo/ cat list_of_file_paths | vt scan file - ``` ### Options ``` -h, --help help for file -o, --open Return an URL to see the analysis report at the VirusTotal web GUI -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt scan](vt_scan.md) - Scan files or URLs vt-cli-1.3.1/man/vt_scan_url.md000066400000000000000000000017401520306561600163340ustar00rootroot00000000000000## vt scan url Scan one of more URLs ### Synopsis Scan one or more URLs. This command receives one or more URLs and scan them. It returns the URLs followed by their corresponding analysis IDs. You can use the "vt analysis" command for retrieving information about the analyses. If the command receives a single hypen (-) the URLs are read from the standard input, one per line. ``` vt scan url [url]... [flags] ``` ### Examples ``` vt scan url http://foo.com vt scan url http://foo.com http://bar.com cat list_of_urls | vt scan urls - ``` ### Options ``` -h, --help help for url -o, --open Return an URL to see the analysis report at the VirusTotal web GUI -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt scan](vt_scan.md) - Scan files or URLs vt-cli-1.3.1/man/vt_search.md000066400000000000000000000023221520306561600157700ustar00rootroot00000000000000## vt search Search for files in VirusTotal Intelligence ### Synopsis Search for files using VirusTotal Intelligence's query language. ``` vt search [query] [flags] ``` ### Examples ``` vt search eicar vt search "foobar p:1+" ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -d, --download download files that match the query -x, --exclude strings exclude fields matching the provided pattern -h, --help help for search -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) -o, --output string directory where downloaded files are put (default ".") -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt search content](vt_search_content.md) - Search for patterns within files in VirusTotal Intelligence vt-cli-1.3.1/man/vt_search_content.md000066400000000000000000000021461520306561600175260ustar00rootroot00000000000000## vt search content Search for patterns within files in VirusTotal Intelligence ### Synopsis Search for content within files in VirusTotal ``` vt search content [query] [flags] ``` ### Examples ``` vt search content foobarbaz vt search content '"foo bar baz"' vt search content {cafebabe} vt search content '{70 6C 75 73 76 69 63 [1] 79 61 72 61}' vt search content '/virustotal(.org|.com)/' ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -d, --download download files that match the query -e, --exact-matches-only exact matches only -h, --help help for content -I, --identifiers-only print identifiers only -n, --limit int maximum number of results (default 10) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt search](vt_search.md) - Search for files in VirusTotal Intelligence vt-cli-1.3.1/man/vt_url.md000066400000000000000000000076261520306561600153410ustar00rootroot00000000000000## vt url Get information about URLs ### Synopsis Get information about one or more URLs. This command receives one or more URLs and returns information about them. URL hashes as returned in the "object_id" field are also accepted. The information about each URL is returned in the same order as the URLs are passed to the command. If the command receives a single hypen (-) the URLs are read from the standard input, one per line. ``` vt url [url]... [flags] ``` ### Examples ``` vt url https://www.virustotal.com vt url f1177df4692356280844e1d5af67cc4a9eccecf77aa61c229d483b7082c70a8e cat list_of_urls | vt url - ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for url -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt url analyses](vt_url_analyses.md) - Analyses for the URL. * [vt url collections](vt_url_collections.md) - Returns the collections related to the URL. * [vt url comments](vt_url_comments.md) - Comments for the URL. * [vt url communicating_files](vt_url_communicating_files.md) - Files that communicate with this url when they are executed. * [vt url contacted_domains](vt_url_contacted_domains.md) - Distinct domains from which the URL loads some kind of resource. * [vt url contacted_ips](vt_url_contacted_ips.md) - Distinct IP addresses from which the URL loads some kind of resource. * [vt url downloaded_files](vt_url_downloaded_files.md) - Files downloaded from the URL. * [vt url embedded_js_files](vt_url_embedded_js_files.md) - JS files embedded in a URL. * [vt url graphs](vt_url_graphs.md) - Graphs that include the URL. * [vt url http_response_contents](vt_url_http_response_contents.md) - HTTP response contents from the URL. * [vt url last_serving_ip_address](vt_url_last_serving_ip_address.md) - Last IP address that served the URL. * [vt url memory_pattern_parents](vt_url_memory_pattern_parents.md) - Files having a domain as string on memory during sandbox execution. * [vt url network_location](vt_url_network_location.md) - Domain or IP address for the URL. * [vt url redirecting_urls](vt_url_redirecting_urls.md) - URLs that redirected to the given URL. * [vt url redirects_to](vt_url_redirects_to.md) - URLs that this url redirects to. * [vt url references](vt_url_references.md) - Returns the References related to the URL. * [vt url referrer_files](vt_url_referrer_files.md) - Files containing the URL. * [vt url referrer_urls](vt_url_referrer_urls.md) - URLs that refer to the given URL. * [vt url related_attack_techniques](vt_url_related_attack_techniques.md) - Returns the Attack Techniques of the Collections containing this URL. * [vt url related_collections](vt_url_related_collections.md) - Returns the Collections of the parent Domains or IPs of this URL. * [vt url related_comments](vt_url_related_comments.md) - Comments for the URL. * [vt url related_references](vt_url_related_references.md) - Returns the References of the Collections containing this URL. * [vt url related_threat_actors](vt_url_related_threat_actors.md) - Returns the Threat Actors of the Collections containing this URL. * [vt url relationships](vt_url_relationships.md) - Get all relationships. * [vt url submissions](vt_url_submissions.md) - Submissions for the URL. * [vt url urls_related_by_tracker_id](vt_url_urls_related_by_tracker_id.md) - URLs that share the same tracker ID. * [vt url user_votes](vt_url_user_votes.md) - Item's votes made by current signed-in user. * [vt url votes](vt_url_votes.md) - Item's votes. vt-cli-1.3.1/man/vt_url_analyses.md000066400000000000000000000013331520306561600172250ustar00rootroot00000000000000## vt url analyses Analyses for the URL. ``` vt url analyses [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for analyses -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_collections.md000066400000000000000000000013721520306561600177270ustar00rootroot00000000000000## vt url collections Returns the collections related to the URL. ``` vt url collections [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_comments.md000066400000000000000000000013331520306561600172330ustar00rootroot00000000000000## vt url comments Comments for the URL. ``` vt url comments [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_communicating_files.md000066400000000000000000000014431520306561600214270ustar00rootroot00000000000000## vt url communicating_files Files that communicate with this url when they are executed. ``` vt url communicating_files [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for communicating_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_contacted_domains.md000066400000000000000000000014411520306561600210640ustar00rootroot00000000000000## vt url contacted_domains Distinct domains from which the URL loads some kind of resource. ``` vt url contacted_domains [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_domains -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_contacted_ips.md000066400000000000000000000014321520306561600202250ustar00rootroot00000000000000## vt url contacted_ips Distinct IP addresses from which the URL loads some kind of resource. ``` vt url contacted_ips [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for contacted_ips -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_downloaded_files.md000066400000000000000000000013741520306561600207150ustar00rootroot00000000000000## vt url downloaded_files Files downloaded from the URL. ``` vt url downloaded_files [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for downloaded_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_embedded_js_files.md000066400000000000000000000013741520306561600210220ustar00rootroot00000000000000## vt url embedded_js_files JS files embedded in a URL. ``` vt url embedded_js_files [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for embedded_js_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_graphs.md000066400000000000000000000013341520306561600166730ustar00rootroot00000000000000## vt url graphs Graphs that include the URL. ``` vt url graphs [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for graphs -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_http_response_contents.md000066400000000000000000000014241520306561600222210ustar00rootroot00000000000000## vt url http_response_contents HTTP response contents from the URL. ``` vt url http_response_contents [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for http_response_contents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_last_serving_ip_address.md000066400000000000000000000014271520306561600223070ustar00rootroot00000000000000## vt url last_serving_ip_address Last IP address that served the URL. ``` vt url last_serving_ip_address [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for last_serving_ip_address -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_memory_pattern_parents.md000066400000000000000000000014631520306561600222130ustar00rootroot00000000000000## vt url memory_pattern_parents Files having a domain as string on memory during sandbox execution. ``` vt url memory_pattern_parents [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for memory_pattern_parents -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_network_location.md000066400000000000000000000013771520306561600207770ustar00rootroot00000000000000## vt url network_location Domain or IP address for the URL. ``` vt url network_location [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for network_location -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_redirecting_urls.md000066400000000000000000000014041520306561600207510ustar00rootroot00000000000000## vt url redirecting_urls URLs that redirected to the given URL. ``` vt url redirecting_urls [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for redirecting_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_redirects_to.md000066400000000000000000000013621520306561600200760ustar00rootroot00000000000000## vt url redirects_to URLs that this url redirects to. ``` vt url redirects_to [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for redirects_to -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_references.md000066400000000000000000000013661520306561600175350ustar00rootroot00000000000000## vt url references Returns the References related to the URL. ``` vt url references [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_referrer_files.md000066400000000000000000000013611520306561600204050ustar00rootroot00000000000000## vt url referrer_files Files containing the URL. ``` vt url referrer_files [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for referrer_files -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_referrer_urls.md000066400000000000000000000013661520306561600202750ustar00rootroot00000000000000## vt url referrer_urls URLs that refer to the given URL. ``` vt url referrer_urls [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for referrer_urls -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_related_attack_techniques.md000066400000000000000000000014761520306561600226150ustar00rootroot00000000000000## vt url related_attack_techniques Returns the Attack Techniques of the Collections containing this URL. ``` vt url related_attack_techniques [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_attack_techniques -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_related_collections.md000066400000000000000000000014501520306561600214240ustar00rootroot00000000000000## vt url related_collections Returns the Collections of the parent Domains or IPs of this URL. ``` vt url related_collections [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_collections -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_related_comments.md000066400000000000000000000013631520306561600207360ustar00rootroot00000000000000## vt url related_comments Comments for the URL. ``` vt url related_comments [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_comments -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_related_references.md000066400000000000000000000014421520306561600212300ustar00rootroot00000000000000## vt url related_references Returns the References of the Collections containing this URL. ``` vt url related_references [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_references -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_related_threat_actors.md000066400000000000000000000014561520306561600217560ustar00rootroot00000000000000## vt url related_threat_actors Returns the Threat Actors of the Collections containing this URL. ``` vt url related_threat_actors [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for related_threat_actors -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_relationships.md000066400000000000000000000011441520306561600202720ustar00rootroot00000000000000## vt url relationships Get all relationships. ``` vt url relationships [url] [flags] ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for relationships -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_submissions.md000066400000000000000000000013471520306561600177710ustar00rootroot00000000000000## vt url submissions Submissions for the URL. ``` vt url submissions [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for submissions -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_urls_related_by_tracker_id.md000066400000000000000000000014401520306561600227530ustar00rootroot00000000000000## vt url urls_related_by_tracker_id URLs that share the same tracker ID. ``` vt url urls_related_by_tracker_id [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for urls_related_by_tracker_id -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_user_votes.md000066400000000000000000000013701520306561600176050ustar00rootroot00000000000000## vt url user_votes Item's votes made by current signed-in user. ``` vt url user_votes [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user_votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_url_votes.md000066400000000000000000000013121520306561600165430ustar00rootroot00000000000000## vt url votes Item's votes. ``` vt url votes [url] [flags] ``` ### Options ``` -c, --cursor string cursor for continuing where the previous request left -x, --exclude strings exclude fields matching the provided pattern -h, --help help for votes -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -n, --limit int maximum number of results (default 10) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt url](vt_url.md) - Get information about URLs vt-cli-1.3.1/man/vt_user.md000066400000000000000000000017051520306561600155050ustar00rootroot00000000000000## vt user Get information about VirusTotal users ### Synopsis Get information about a VirusTotal user. ``` vt user [username | apikey | email]... [flags] ``` ### Examples ``` vt user joe vt user 1ebb658141155c16d8bf89629379098b4cf31d4613b13784a108c6a4805c963b vt user joe@domain.com ``` ### Options ``` -x, --exclude strings exclude fields matching the provided pattern -h, --help help for user -I, --identifiers-only print identifiers only -i, --include strings include fields matching the provided pattern (default [**]) -t, --threads int number of threads working in parallel (default 5) ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal * [vt user privileges](vt_user_privileges.md) - Change user privileges vt-cli-1.3.1/man/vt_user_privileges.md000066400000000000000000000010151520306561600177300ustar00rootroot00000000000000## vt user privileges Change user privileges ### Options ``` -h, --help help for privileges ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt user](vt_user.md) - Get information about VirusTotal users * [vt user privileges grant](vt_user_privileges_grant.md) - Grant privileges to a user * [vt user privileges revoke](vt_user_privileges_revoke.md) - Revoke privileges from a user vt-cli-1.3.1/man/vt_user_privileges_grant.md000066400000000000000000000011611520306561600211250ustar00rootroot00000000000000## vt user privileges grant Grant privileges to a user ``` vt user privileges grant [username] [privilege]... [flags] ``` ### Examples ``` vt user privileges grant myuser intelligence downloads-tier-2 ``` ### Options ``` -e, --expiration string expiration time for the granted privileges (UNIX timestamp or YYYY-MM-DD) -h, --help help for grant ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt user privileges](vt_user_privileges.md) - Change user privileges vt-cli-1.3.1/man/vt_user_privileges_revoke.md000066400000000000000000000010051520306561600213020ustar00rootroot00000000000000## vt user privileges revoke Revoke privileges from a user ``` vt user privileges revoke [username] [privilege]... [flags] ``` ### Examples ``` vt user privileges revoke myuser intelligence downloads-tier-2 ``` ### Options ``` -h, --help help for revoke ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt user privileges](vt_user_privileges.md) - Change user privileges vt-cli-1.3.1/man/vt_version.md000066400000000000000000000005511520306561600162120ustar00rootroot00000000000000## vt version Show version number ``` vt version [flags] ``` ### Options ``` -h, --help help for version ``` ### Options inherited from parent commands ``` -k, --apikey string API key --proxy string HTTP proxy -v, --verbose verbose output ``` ### SEE ALSO * [vt](vt.md) - A command-line tool for interacting with VirusTotal vt-cli-1.3.1/new_release.sh000077500000000000000000000006401520306561600155460ustar00rootroot00000000000000#!/bin/bash mkdir dist zip -j dist/MacOSX.zip build/darwin/amd64/vt zip -j dist/Linux32.zip build/linux/386/vt zip -j dist/Linux64.zip build/linux/amd64/vt zip -j dist/Windows32.zip build/windows/386/vt.exe zip -j dist/Windows64.zip build/windows/amd64/vt.exe zip -j dist/FreeBSD32.zip build/freebsd/386/vt zip -j dist/FreeBSD64.zip build/freebsd/amd64/vt ghr -t $GITHUB_TOKEN -u VirusTotal -replace $VERSION dist/ vt-cli-1.3.1/utils/000077500000000000000000000000001520306561600140565ustar00rootroot00000000000000vt-cli-1.3.1/utils/client.go000066400000000000000000000107721520306561600156720ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils import ( "container/heap" "errors" "fmt" "os" "sync" vt "github.com/VirusTotal/vt-go" "github.com/spf13/viper" ) // APIClient represents a VirusTotal API client. type APIClient struct { *vt.Client } // NewAPIClient returns a new VirusTotal API client using the API key configured // either using the program configuration file or the --apikey command-line flag. func NewAPIClient(agent string) (*APIClient, error) { apikey := viper.GetString("apikey") if apikey == "" { return nil, errors.New( "An API key is needed. Either use the --apikey flag or run \"vt init\" to set up your API key") } c := vt.NewClient(apikey) c.Agent = agent return &APIClient{c}, nil } // RetrieveObjects retrieves objects from the specified endpoint. The endpoint // must contain a %s placeholder that will be replaced with items from the args // slice. The objects are put into the outCh as they are retrieved. func (c *APIClient) RetrieveObjects(endpoint string, args []string, outCh chan *vt.Object, errCh chan error) error { return c.RetrieveObjectsWithFallback([]string{endpoint}, args, outCh, errCh) } // RetrieveObjectsWithFallback retrieves objects from the specified endpoints. It // tries the endpoints in the order they are provided until one of them returns // the object. The endpoint strings must contain a %s placeholder that will be // replaced with items from the args slice. The objects are put into the outCh // as they are retrieved. func (c *APIClient) RetrieveObjectsWithFallback(endpoints []string, args []string, outCh chan *vt.Object, errCh chan error) error { // Make sure outCh and errCh are closed defer close(outCh) defer close(errCh) h := PQueue{} heap.Init(&h) objCh := make(chan PQueueNode) getWg := &sync.WaitGroup{} // Channel used for limiting the number of parallel goroutines threads := viper.GetInt("threads") if threads == 0 { panic("RetrieveObjects called with 0 threads") } throttler := make(chan interface{}, threads) // Read object IDs from the input channel, launch goroutines to retrieve the // objects and send them through objCh together with a number indicating // their order in the input. As goroutines run in parallel the objects can // be sent out of order to objCh, but the order number is used to reorder // them. for order, arg := range args { getWg.Add(1) go func(order int, arg string) { throttler <- nil var obj *vt.Object var err error for _, endpoint := range endpoints { obj, err = c.GetObject(vt.URL(endpoint, arg)) if err == nil { objCh <- PQueueNode{Priority: order, Data: obj} break } if apiErr, ok := err.(vt.Error); ok && apiErr.Code == "NotFoundError" { // Try the next endpoint } else { fmt.Fprintln(os.Stderr, err) os.Exit(1) } } if err != nil { objCh <- PQueueNode{Priority: order, Data: err} } getWg.Done() <-throttler }(order, arg) } outWg := &sync.WaitGroup{} outWg.Add(1) // Read objects from objCh, put them into a priority queue and send them in // their original order to outCh. go func() { order := 0 for p := range objCh { heap.Push(&h, p) // If the object in the top of the queue is the next one in the order // it can be sent to outCh and removed from the queue, if not, we keep // pushing objects into the queue. if h[0].Priority == order { if obj, ok := h[0].Data.(*vt.Object); ok { outCh <- obj } else { errCh <- h[0].Data.(error) } heap.Pop(&h) order++ } } // Send to outCh any object remaining in the queue for h.Len() > 0 { item := heap.Pop(&h).(PQueueNode).Data if obj, ok := item.(*vt.Object); ok { outCh <- obj } else { errCh <- item.(error) } } outWg.Done() }() // Wait for all objects to be retrieved getWg.Wait() // Once all object were retrieved is safe to close objCh. close(objCh) // Wait for objects to be sent to outCh outWg.Wait() return nil } vt-cli-1.3.1/utils/do.go000066400000000000000000000114241520306561600150110ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils import ( "fmt" "github.com/fatih/color" "sync" "time" vt "github.com/VirusTotal/vt-go" "github.com/briandowns/spinner" "github.com/plusvic/go-ansi" "github.com/spf13/viper" ) // Coordinator coordinates the work of multiple instances of a Doer that run // in parallel. type Coordinator struct { Threads int Spinner *spinner.Spinner printingWg *sync.WaitGroup doerStates []DoerState resultsCh chan string } // DoerState represents the current state of a Doer. type DoerState struct { Progress string } // Doer is the interface that must be implemented for any type to be used with // DoWithStringsFromReader and DoWithStringsFromChannel. type Doer interface { Do(interface{}, *DoerState) string } // NewCoordinator creates a new instance of Coordinator. func NewCoordinator(threads int) *Coordinator { return &Coordinator{Threads: threads} } // EnableSpinner activates an animation while the coordinator is waiting. func (c *Coordinator) EnableSpinner() { c.Spinner = spinner.New(spinner.CharSets[6], 250*time.Millisecond) c.Spinner.Color("green") c.Spinner.Suffix = " wait..." } // DoWithStringsFromReader calls the Do of a type implementing the Doer // interface with strings read from a StringReader. The doer's Do method is // called once for each string, and this function doesn't exit until the // StringReader returns an empty string. func (c *Coordinator) DoWithStringsFromReader(doer Doer, reader StringReader) { ch := make(chan interface{}) go func() { for s, err := reader.ReadString(); s != "" || err == nil; s, err = reader.ReadString() { ch <- s } close(ch) }() c.DoWithItemsFromChannel(doer, ch) } // DoWithObjectsFromIterator calls the Do of a type implementing the Doer // interface with the objects returned by a vt.Iterator. Objects returned by the // iterator are put in a channel with a buffer size of bufferSize. func (c *Coordinator) DoWithObjectsFromIterator(doer Doer, it *vt.Iterator, bufferSize int) { ch := make(chan interface{}, bufferSize) go func() { for it.Next() { ch <- it.Get() } close(ch) }() c.DoWithItemsFromChannel(doer, ch) } // DoWithItemsFromChannel calls the Do method of a type implementing the Doer // interface with items read from a channel. This function doesn't exit until // the channel is closed. func (c *Coordinator) DoWithItemsFromChannel(doer Doer, ch <-chan interface{}) { c.resultsCh = make(chan string, c.Threads) c.doerStates = make([]DoerState, c.Threads) wg := &sync.WaitGroup{} for i := 0; i < c.Threads; i++ { wg.Add(1) go func(i int) { for arg := range ch { c.resultsCh <- doer.Do(arg, &c.doerStates[i]) c.doerStates[i].Progress = "" } wg.Done() }(i) } c.printingWg = &sync.WaitGroup{} c.printingWg.Add(1) // Use the NoColor flag from the color library as an indicator of whether // or not stdout is a tty or a file. If NoColor is true it means that // stdout is being redirected to a file and we don't want escape sequences // in the output, in that case print only the final results from the doers, // without any progress indication. if color.NoColor || viper.GetBool("silent") { go c.printResultsOnly() } else { go c.printProgressAndResults() } wg.Wait() close(c.resultsCh) c.printingWg.Wait() } func (c *Coordinator) printResultsOnly() { for res := range c.resultsCh { ansi.Println(res) } c.printingWg.Done() } func (c *Coordinator) printProgressAndResults() { Loop: for { if c.Spinner != nil { c.Spinner.Start() } select { case res, ok := <-c.resultsCh: if !ok { break Loop } if c.Spinner != nil { c.Spinner.Stop() } ansi.Printf("%s", res) ansi.EraseInLine(0) // Clear to the end of the line. fmt.Println() default: // Print progress for pending workers lines := 0 for _, ds := range c.doerStates { if ds.Progress != "" { ansi.Printf("%s", ds.Progress) ansi.EraseInLine(0) // Clear to the end of the line. fmt.Println() lines++ } } time.Sleep(time.Millisecond * 250) if lines > 0 { // Move cursor up, to the line it was before printing worker's progress ansi.CursorPreviousLine(lines) } } } if c.Spinner != nil { c.Spinner.Stop() } c.printingWg.Done() } vt-cli-1.3.1/utils/file_utils.go000066400000000000000000000052571520306561600165550ustar00rootroot00000000000000// Copyright © 2019 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils import ( "errors" "fmt" "io/fs" "os" "path/filepath" "strings" ) // NewFileDirReader reads all files from the given directory `fileDir`. // It can optionally traverse subdirectories if `recursive` is true, // and will limit recursion to `maxDepth` levels if specified. // // Uses the standard library's `filepath.WalkDir` to traverse directories efficiently, // and `fs.SkipDir` to skip directories when recursion is disabled or maxDepth is reached. func NewFileDirReader(fileDir string, recursive bool, maxDepth int) (*StringArrayReader, error) { var filePaths []string rootDepth := pathDepth(fileDir) var errs []error // filePaths is safely appended within WalkDir because WalkDir executes the callback sequentially. // No race conditions occur in this implementation, even with slice reallocation. err := filepath.WalkDir(fileDir, func(path string, d fs.DirEntry, err error) error { if err != nil { errs = append(errs, fmt.Errorf("%s: %w", path, err)) if d != nil && d.IsDir() { return fs.SkipDir } return nil } if d != nil && !d.IsDir() { filePaths = append(filePaths, path) return nil } currentDepth := pathDepth(path) - rootDepth // we skip directory if recursive is disabled or // if we reached configured maxDepth if !recursive && path != fileDir || currentDepth >= maxDepth { return fs.SkipDir } return nil }) if err != nil { errs = append(errs, err) } return &StringArrayReader{strings: filePaths}, errors.Join(errs...) } // pathDepth returns the depth of a given path by counting its components. // It uses filepath.Separator, which ensures correct behavior across all platforms // (Windows, macOS, Linux), regardless of the underlying path separator. func pathDepth(path string) int { return len(strings.Split(filepath.Clean(path), string(filepath.Separator))) } // IsDir function returns whether a file is a directory or not func IsDir(f string) bool { fileInfo, err := os.Stat(f) if err != nil { // error reading the file, assuming it is not a directory return false } return fileInfo.IsDir() } vt-cli-1.3.1/utils/file_utils_test.go000066400000000000000000000150471520306561600176120ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils import ( "os" "path/filepath" "strings" "testing" "github.com/google/go-cmp/cmp" ) func Test_NewFileDirReader(t *testing.T) { t.Parallel() useCases := []struct { name string directories []string files []string recursive bool maxDepth int want func(string) *StringArrayReader }{ { name: "want get back empty files", directories: []string{}, files: []string{}, recursive: true, maxDepth: 2, want: func(d string) *StringArrayReader { return &StringArrayReader{ strings: nil, } }, }, { name: "want to read single file", directories: []string{}, files: []string{"z.txt"}, recursive: true, maxDepth: 2, want: func(d string) *StringArrayReader { return &StringArrayReader{ strings: []string{ filepath.Join(d, "z.txt"), }, } }, }, { name: "want read all files within all subdirectories", directories: []string{"sub", "sub/sub", ".hidden"}, files: []string{"a.txt", "b.txt", "sub/c.txt", "sub/sub/d.txt", ".hidden/config"}, recursive: true, maxDepth: 3, want: func(d string) *StringArrayReader { return &StringArrayReader{ strings: []string{ filepath.Join(d, ".hidden/config"), filepath.Join(d, "a.txt"), filepath.Join(d, "b.txt"), filepath.Join(d, "sub/c.txt"), filepath.Join(d, "sub/sub/d.txt"), }, } }, }, { name: "want to ignore all subdirectories", directories: []string{"sub", "sub/sub"}, files: []string{"a.txt", "b.txt", "sub/c.txt", "sub/sub/d.txt"}, recursive: false, maxDepth: 10, want: func(d string) *StringArrayReader { return &StringArrayReader{ strings: []string{ filepath.Join(d, "a.txt"), filepath.Join(d, "b.txt"), }, } }, }, { name: "want to read until first depth", directories: []string{"sub", "sub/sub"}, files: []string{"a.txt", "b.txt", "sub/c.txt", "sub/sub/d.txt"}, recursive: true, maxDepth: 1, want: func(d string) *StringArrayReader { return &StringArrayReader{ strings: []string{ filepath.Join(d, "a.txt"), filepath.Join(d, "b.txt"), }, } }, }, { name: "want to read until second depth", directories: []string{"sub", "sub/sub"}, files: []string{"a.txt", "b.txt", "sub/c.txt", "sub/sub/d.txt"}, recursive: true, maxDepth: 2, want: func(d string) *StringArrayReader { return &StringArrayReader{ strings: []string{ filepath.Join(d, "a.txt"), filepath.Join(d, "b.txt"), filepath.Join(d, "sub/c.txt"), }, } }, }, } for _, uc := range useCases { t.Run(uc.name, func(t *testing.T) { // create a temp directory, and will clean up after test ends rootDir := t.TempDir() for _, d := range uc.directories { path := filepath.Join(rootDir, d) rwxPerm := os.FileMode(0755) if err := os.Mkdir(path, rwxPerm); err != nil { t.Fatalf("unexpected error while Mkdir %v", err) } } for _, f := range uc.files { path := filepath.Join(rootDir, f) rwPerm := os.FileMode(0644) if err := os.WriteFile(path, []byte("hello world!"), rwPerm); err != nil { t.Fatalf("unexpected error while WriteFile %v", err) } } got, err := NewFileDirReader(rootDir, uc.recursive, uc.maxDepth) if err != nil { t.Errorf("unexpected error while NewFileDirReader err:%v", err) } if diff := cmp.Diff( uc.want(rootDir), got, cmp.AllowUnexported(StringArrayReader{}), ); diff != "" { t.Errorf("unexpected StringArrayReader mismatch (-want +got):\n%s", diff) } }) } } func Test_NewFileDirReader_Error(t *testing.T) { t.Parallel() rootDir := t.TempDir() rwxPerm := os.FileMode(0755) if err := os.WriteFile(filepath.Join(rootDir, "a.txt"), []byte("hello world!"), rwxPerm); err != nil { t.Fatalf("unexpected error while WriteFile %v", err) } if err := os.WriteFile(filepath.Join(rootDir, "z.txt"), []byte("hello world!"), rwxPerm); err != nil { t.Fatalf("unexpected error while WriteFile %v", err) } path := filepath.Join(rootDir, "sub") noPerm := os.FileMode(0000) if err := os.Mkdir(path, noPerm); err != nil { t.Fatalf("unexpected error while Mkdir %v", err) } path = filepath.Join(rootDir, "sub_2") if err := os.Mkdir(path, rwxPerm); err != nil { t.Fatalf("unexpected error while Mkdir %v", err) } if err := os.WriteFile(filepath.Join(path, "www.txt"), []byte("hello world!"), rwxPerm); err != nil { t.Fatalf("unexpected error while WriteFile %v", err) } sr, err := NewFileDirReader(rootDir, false, 10) if err != nil { t.Errorf("unexpected error while NewFileDirReader err:%v", err) } sr, err = NewFileDirReader(rootDir, true, 10) if !strings.Contains(err.Error(), "permission denied") { t.Errorf("unexpected error permissions denied message got:%v", err.Error()) } if diff := cmp.Diff( &StringArrayReader{ strings: []string{ filepath.Join(rootDir, "a.txt"), // note we are ignoring, and not getting back sub permission denied directory filepath.Join(rootDir, "sub_2/www.txt"), filepath.Join(rootDir, "z.txt"), }, }, sr, cmp.AllowUnexported(StringArrayReader{}), ); diff != "" { t.Errorf("unexpected StringArrayReader mismatch (-want +got):\n%s", diff) } } func Test_pathDepth(t *testing.T) { t.Parallel() useCases := []struct { name string dir string want int }{ { name: "want one depth when empty directory", want: 1, }, { name: "want one depth when simple directory", dir: "a", want: 1, }, { name: "want 2 depth when sub directory", dir: "a/a", want: 2, }, { name: "want 3 depth when sub directory", dir: "a-a/b_bb__/cccc/", want: 3, }, } for _, uc := range useCases { t.Run(uc.name, func(t *testing.T) { if got, want := pathDepth(uc.dir), uc.want; got != want { t.Errorf("unexpected pathDepth, got:%v, want:%v", got, want) } }) } } vt-cli-1.3.1/utils/filter.go000066400000000000000000000106501520306561600156740ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils import ( glob "github.com/gobwas/glob" "reflect" "strings" ) // FilterMap receives a map with string keys and arbitrary values (possibly // other maps) and return a new map which is a subset of the original one // containing only the keys matching any of the patterns in "include" and // excluding keys matching any of the patterns in "exclude". The logic for // determining if a key matches the pattern goes as follow: // // * The path for the key is computed. If the key is in the top-level map its // path is the key itself, if the key is contained within a nested map its // path is the concatenation of the parent's path and the key, using a dot (.) // as a separator. The path for "key" in {a:{b:{key:val}}} is a.b.key. // // * The path is matched against the pattern, which can contain asterisks (*) // as a placeholder for any character different from a dot (.) and ** as a // placeholder for any character including a dot. For more information go to: // https://godoc.org/github.com/gobwas/glob#Compile // // * If the path matches any pattern in "include" the key is included in the // resulting map, as long as it doesn't match a pattern in "exclude". // func FilterMap(m map[string]interface{}, include, exclude []string) map[string]interface{} { includeGlob := make([]glob.Glob, len(include)) excludeGlob := make([]glob.Glob, len(exclude)) for i, p := range include { cp := glob.MustCompile(p, '.') includeGlob[i] = cp } // For each include pattern that do not ends with **, add the same pattern // but ended in .**. This because when someone says that she wants to include // "foo.bar", where "foo.bar" is dictionary, what she actually expects is // getting the dictionary with all its keys, but the keys inside the // dictionary don't match the "foo.bar" pattern, so we add "foo.bar.**". for _, p := range include { if !strings.HasSuffix(p, "**") { includeGlob = append(includeGlob, glob.MustCompile(p+".**", '.')) } } for i, p := range exclude { cp := glob.MustCompile(p, '.') excludeGlob[i] = cp } // The same happens if you exclude "foo.bar", what you actually mean is // excluding "foo.bar" and "foo.bar.**". for _, p := range exclude { if !strings.HasSuffix(p, "**") { excludeGlob = append(excludeGlob, glob.MustCompile(p+".**", '.')) } } filtered := filterMap(reflect.ValueOf(m), includeGlob, excludeGlob, "") return filtered.Interface().(map[string]interface{}) } // actualValue returns v if it's not an interface. If v is an interface it // returns the value pointed to by the interface. func actualValue(v reflect.Value) reflect.Value { if v.Kind() == reflect.Interface { return v.Elem() } return v } // filterMap is the internal version of FilterMap. func filterMap(m reflect.Value, include, exclude []glob.Glob, prefix string) reflect.Value { result := reflect.MakeMap(m.Type()) for _, k := range m.MapKeys() { path := k.String() if prefix != "" { path = prefix + "." + path } match := false for _, p := range include { if p.Match(path) { match = true break } } for _, p := range exclude { if p.Match(path) { match = false break } } v := actualValue(m.MapIndex(k)) switch v.Kind() { case reflect.Map: fm := filterMap(v, include, exclude, path) if fm.Len() > 0 { result.SetMapIndex(k, fm) } case reflect.Slice: s := reflect.MakeSlice(v.Type(), 0, v.Len()) for i := 0; i < v.Len(); i++ { sliceItem := v.Index(i) if actualValue(sliceItem).Kind() == reflect.Map { fm := filterMap(actualValue(sliceItem), include, exclude, path) if fm.Len() > 0 { s = reflect.Append(s, fm) } } else if match { s = reflect.Append(s, sliceItem) } } if s.Len() > 0 { result.SetMapIndex(k, s) } default: if match { result.SetMapIndex(k, v) } } } return result } vt-cli-1.3.1/utils/filter_test.go000066400000000000000000000113651520306561600167370ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils_test import ( "reflect" "testing" "github.com/VirusTotal/vt-cli/utils" ) var testMap = map[string]interface{}{ "foo": map[string]interface{}{ "qux": map[string]interface{}{ "quux": map[string]interface{}{ "key1": "val1", "key2": "val2", "key3": []string{"val3"}, }, }, }, "bar": map[string]interface{}{ "corge": map[string]interface{}{ "key2": "val2", }, }, "baz": map[string]interface{}{ "key3": "val3", }, "qux": []interface{}{ map[string]interface{}{ "key4": "val4", }, map[string]interface{}{ "key5": "val5", }, }, "ary": []string{"1", "3"}, } type testCase struct { include []string exclude []string input map[string]interface{} output map[string]interface{} } var testCases = []testCase{ testCase{ include: []string{"foo**"}, input: testMap, output: map[string]interface{}{ "foo": map[string]interface{}{ "qux": map[string]interface{}{ "quux": map[string]interface{}{ "key1": "val1", "key2": "val2", "key3": []string{"val3"}, }, }, }, }, }, testCase{ include: []string{"foo"}, exclude: []string{"**.quux"}, input: testMap, output: map[string]interface{}{ }, }, testCase{ include: []string{"foo**"}, exclude: []string{"**.key1"}, input: testMap, output: map[string]interface{}{ "foo": map[string]interface{}{ "qux": map[string]interface{}{ "quux": map[string]interface{}{ "key2": "val2", "key3": []string{"val3"}, }, }, }, }, }, testCase{ include: []string{"foo**"}, exclude: []string{"**.key1"}, input: testMap, output: map[string]interface{}{ "foo": map[string]interface{}{ "qux": map[string]interface{}{ "quux": map[string]interface{}{ "key2": "val2", "key3": []string{"val3"}, }, }, }, }, }, testCase{ include: []string{"foo.qux.**"}, input: testMap, output: map[string]interface{}{ "foo": map[string]interface{}{ "qux": map[string]interface{}{ "quux": map[string]interface{}{ "key1": "val1", "key2": "val2", "key3": []string{"val3"}, }, }, }, }, }, testCase{ include: []string{"foo.qux.quux.key*"}, input: testMap, output: map[string]interface{}{ "foo": map[string]interface{}{ "qux": map[string]interface{}{ "quux": map[string]interface{}{ "key1": "val1", "key2": "val2", "key3": []string{"val3"}, }, }, }, }, }, testCase{ include: []string{"foo.qux.quux.key2"}, input: testMap, output: map[string]interface{}{ "foo": map[string]interface{}{ "qux": map[string]interface{}{ "quux": map[string]interface{}{ "key2": "val2", }, }, }, }, }, testCase{ include: []string{"ba**"}, exclude: []string{"baz**"}, input: testMap, output: map[string]interface{}{ "bar": map[string]interface{}{ "corge": map[string]interface{}{ "key2": "val2", }, }, }, }, testCase{ include: []string{"**.key2"}, input: testMap, output: map[string]interface{}{ "foo": map[string]interface{}{ "qux": map[string]interface{}{ "quux": map[string]interface{}{ "key2": "val2", }, }, }, "bar": map[string]interface{}{ "corge": map[string]interface{}{ "key2": "val2", }, }, }, }, testCase{ include: []string{"**.key5"}, input: testMap, output: map[string]interface{}{ "qux": []interface{}{ map[string]interface{}{ "key5": "val5", }, }, }, }, testCase{ include: []string{"qux"}, input: testMap, output: map[string]interface{}{ "qux": []interface{}{ map[string]interface{}{ "key4": "val4", }, map[string]interface{}{ "key5": "val5", }, }, }, }, testCase{ include: []string{"ary"}, input: testMap, output: map[string]interface{}{ "ary": []string{"1", "3"}, }, }, } func TestFilterMap(t *testing.T) { for _, tc := range testCases { r := utils.FilterMap(tc.input, tc.include, tc.exclude) eq := reflect.DeepEqual(r, tc.output) if !eq { t.Errorf( "Test failed with filter \"%s\".\n\nExpecting: %v\n\nGot: %v\n", tc.include, tc.output, r) } } } vt-cli-1.3.1/utils/pqueue.go000066400000000000000000000026401520306561600157130ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils // PQueueNode is a node in a priority queues type PQueueNode struct { Priority int Data interface{} } // PQueue is a type implementing a priority queue type PQueue []PQueueNode func (pq PQueue) Len() int { return len(pq) } func (pq PQueue) Less(i, j int) bool { return pq[i].Priority < pq[j].Priority } func (pq PQueue) Swap(i, j int) { pq[i], pq[j] = pq[j], pq[i] } // Push and Pop use pointer receivers because they modify the slice's length, // not just its contents. // Push add a value to the tail of the priority queue func (pq *PQueue) Push(x interface{}) { *pq = append(*pq, x.(PQueueNode)) } // Pop removes a value from the head of the priority queue func (pq *PQueue) Pop() interface{} { old := *pq n := len(old) x := old[n-1] *pq = old[0 : n-1] return x } vt-cli-1.3.1/utils/pqueue_test.go000066400000000000000000000025611520306561600167540ustar00rootroot00000000000000// Copyright © 2017 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils_test import ( "container/heap" "testing" utils "github.com/VirusTotal/vt-cli/utils" ) func TestPQueue(t *testing.T) { pq := utils.PQueue{} heap.Init(&pq) heap.Push(&pq, utils.PQueueNode{Priority: 4, Data: "4"}) heap.Push(&pq, utils.PQueueNode{Priority: 0, Data: "0"}) heap.Push(&pq, utils.PQueueNode{Priority: 2, Data: "2"}) if heap.Pop(&pq).(utils.PQueueNode).Data.(string) != "0" { t.Errorf("") } heap.Push(&pq, utils.PQueueNode{Priority: 1, Data: "1"}) if heap.Pop(&pq).(utils.PQueueNode).Data.(string) != "1" { t.Errorf("") } if heap.Pop(&pq).(utils.PQueueNode).Data.(string) != "2" { t.Errorf("") } if heap.Pop(&pq).(utils.PQueueNode).Data.(string) != "4" { t.Errorf("") } if pq.Len() != 0 { t.Errorf("") } } vt-cli-1.3.1/utils/printer.go000066400000000000000000000203461520306561600160750ustar00rootroot00000000000000// Copyright © 2019 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils import ( "encoding/json" "errors" "fmt" "net/url" "os" "regexp" "strings" "sync" "github.com/VirusTotal/vt-cli/csv" "github.com/VirusTotal/vt-cli/yaml" vt "github.com/VirusTotal/vt-go" "github.com/fatih/color" glob "github.com/gobwas/glob" ansi "github.com/k0kubun/go-ansi" "github.com/spf13/cobra" "github.com/spf13/pflag" "github.com/spf13/viper" ) // Printer prints objects to stdout. type Printer struct { client *APIClient colors *yaml.Colors cmd *cobra.Command } // NewPrinter creates a new object printer. func NewPrinter(client *APIClient, cmd *cobra.Command, colors *yaml.Colors) (*Printer, error) { return &Printer{client: client, cmd: cmd, colors: colors}, nil } // Print prints the provided data to stdout. func (p *Printer) Print(data interface{}) error { format := strings.ToLower(viper.GetString("format")) if format == "" || format == "yaml" { return yaml.NewEncoder( ansi.NewAnsiStdout(), yaml.EncoderColors(p.colors), yaml.EncoderDateKeys([]glob.Glob{ glob.MustCompile("last_login"), glob.MustCompile("user_since"), glob.MustCompile("date"), glob.MustCompile("*_date"), })).Encode(data) } else if format == "json" { encoder := json.NewEncoder(ansi.NewAnsiStdout()) encoder.SetIndent("", " ") return encoder.Encode(data) } else if format == "csv" { return csv.NewEncoder(ansi.NewAnsiStdout()).Encode(data) } else { return errors.New("unknown format") } } // PrintSyncMap prints a sync.Map. func (p *Printer) PrintSyncMap(sm *sync.Map) error { m := make(map[string]interface{}) sm.Range(func(key, value interface{}) bool { m[key.(string)] = value return true }) if viper.IsSet("include") || viper.IsSet("exclude") { m = FilterMap(m, viper.GetStringSlice("include"), viper.GetStringSlice("exclude")) } return p.Print(m) } // ObjectToMap function that returns the attributes for an object as a map. // Keys are attribute names and values are the attribute's value. Two special // keys _id and _type are also included in the map with object's identifier // and type respectively. The map is filtered according to the filters specified // in the --include and --exclude command-line arguments. func ObjectToMap(obj *vt.Object) map[string]interface{} { m := make(map[string]interface{}) m["_id"] = obj.ID() m["_type"] = obj.Type() contextAttributes := make(map[string]interface{}) for _, attr := range obj.ContextAttributes() { contextAttributes[attr], _ = obj.GetContext(attr) } if len(contextAttributes) > 0 { m["_context_attributes"] = contextAttributes } for _, attr := range obj.Attributes() { m[attr], _ = obj.Get(attr) } for _, name := range obj.Relationships() { r, _ := obj.GetRelationship(name) relatedObjs := r.Objects() if r.IsOneToOne() { if len(relatedObjs) > 0 { m[name] = relatedObjs[0].ID() } else { m[name] = nil } } else { l := make([]string, 0) for _, obj := range relatedObjs { l = append(l, obj.ID()) } m[name] = l } } return m } // PrintObjects prints all the specified objects to stdout. func (p *Printer) PrintObjects(objs []*vt.Object) error { list := make([]map[string]interface{}, 0) for _, obj := range objs { m := ObjectToMap(obj) if viper.IsSet("include") || viper.IsSet("exclude") { m = FilterMap(m, viper.GetStringSlice("include"), viper.GetStringSlice("exclude")) } if len(m) > 0 { list = append(list, m) } } if len(list) > 0 { return p.Print(list) } return nil } // PrintObject prints the specified object to stdout. func (p *Printer) PrintObject(obj *vt.Object) error { objs := make([]*vt.Object, 1) objs[0] = obj return p.PrintObjects(objs) } // GetAndPrintObjects retrieves objects from the specified endpoint and prints // them. The endpoint must contain a %s placeholder that will be replaced with // items from the args slice. If args contains a single "-" string, the args are // read from stdin one per line. If argRe is non-nil, only args that match the // regular expression are used and the rest are discarded. func (p *Printer) GetAndPrintObjects(endpoint string, r StringReader, argRe *regexp.Regexp) error { return p.GetAndPrintObjectsWithFallback([]string{endpoint}, r, argRe) } // GetAndPrintObjectsWithFallback retrieves objects from the specified endpoints and // prints them. The function tries the endpoints in the order they are provided // until one of them returns the object. The endpoint must contain a %s placeholder // that will be replaced with items from the args slice. If args contains a single // "-" string, the args are read from stdin one per line. If argRe is non-nil, only // args that match the regular expression are used and the rest are discarded. func (p *Printer) GetAndPrintObjectsWithFallback(endpoints []string, r StringReader, argRe *regexp.Regexp) error { if argRe != nil { r = NewFilteredStringReader(r, argRe) } filteredArgs := make([]string, 0) for s, err := r.ReadString(); s != "" || err == nil; s, err = r.ReadString() { filteredArgs = append(filteredArgs, s) } objectsCh := make(chan *vt.Object) errorsCh := make(chan error, len(filteredArgs)) go p.client.RetrieveObjectsWithFallback(endpoints, filteredArgs, objectsCh, errorsCh) if viper.GetBool("identifiers-only") { var objectIds []string for obj := range objectsCh { objectIds = append(objectIds, obj.ID()) } if err := p.Print(objectIds); err != nil { return err } } else { var objects []*vt.Object for obj := range objectsCh { objects = append(objects, obj) } if err := p.PrintObjects(objects); err != nil { return err } } for err := range errorsCh { fmt.Fprintln(os.Stderr, err) } return nil } // PrintCollection prints a collection of objects retrieved from the collection // specified by the collection URL. func (p *Printer) PrintCollection(collection *url.URL) error { it, err := p.client.Iterator(collection, vt.IteratorLimit(viper.GetInt("limit")), vt.IteratorCursor(viper.GetString("cursor")), vt.IteratorFilter(viper.GetString("filter"))) if err != nil { return err } return p.PrintIterator(it) } // PrintIterator prints the objects returned by an object iterator. func (p *Printer) PrintIterator(it *vt.Iterator) error { var objs []*vt.Object var ids []string for it.Next() { obj := it.Get() if viper.GetBool("identifiers-only") { ids = append(ids, obj.ID()) } else { objs = append(objs, obj) } } if err := it.Error(); err != nil { return err } if viper.GetBool("identifiers-only") { if err := p.Print(ids); err != nil { return err } } else { if err := p.PrintObjects(objs); err != nil { return err } } p.PrintCommandLineWithCursor(it) return nil } // PrintCommandLineWithCursor prints the same command-line that was used for // executing the program but adding or replacing the --cursor flag with // the current cursor for the given iterator. func (p *Printer) PrintCommandLineWithCursor(it *vt.Iterator) { if cursor := it.Cursor(); cursor != "" { args := p.cmd.Flags().Args() for i, arg := range args { args[i] = fmt.Sprintf("'%s'", arg) } flags := make([]string, 0) p.cmd.Flags().Visit(func(flag *pflag.Flag) { if flag.Name != "cursor" { var f string switch flag.Value.Type() { case "stringSlice": ss, _ := p.cmd.Flags().GetStringSlice(flag.Name) f = fmt.Sprintf("--%s='%s'", flag.Name, strings.Join(ss, ",")) default: f = fmt.Sprintf("--%s=%v", flag.Name, flag.Value.String()) } flags = append(flags, f) } }) flags = append(flags, fmt.Sprintf("--cursor=%s", cursor)) color.New(color.Faint).Fprintf( ansi.NewAnsiStderr(), "\nMORE WITH:\n%s %s %s\n", p.cmd.CommandPath(), strings.Join(args, " "), strings.Join(flags, " ")) } } vt-cli-1.3.1/utils/string_reader.go000066400000000000000000000105361520306561600172420ustar00rootroot00000000000000// Copyright © 2019 The VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package utils import ( "bufio" "io" "os" "regexp" "strings" ) // StringReader is the interface that wraps the ReadString method. type StringReader interface { ReadString() (string, error) } // StringArrayReader is a wrapper around a slice of strings that implements // the StringReader interface. Each time the ReadString method is called a // string from the array is returned and the position is advanced by one. When // all strings have been returned ReadString returns an io.EOF error. type StringArrayReader struct { strings []string pos int } // NewStringArrayReader creates a new StringArrayReader. func NewStringArrayReader(strings []string) *StringArrayReader { return &StringArrayReader{strings: strings} } // ReadString reads one string from StringArrayReader. When all strings have // been returned ReadString returns an io.EOF error. func (sar *StringArrayReader) ReadString() (string, error) { if sar.pos == len(sar.strings) { return "", io.EOF } s := sar.strings[sar.pos] sar.pos++ return s, nil } // StringIOReader is a wrapper around a bufio.Scanner that implements the // StringReader interface. type StringIOReader struct { scanner *bufio.Scanner } // NewStringIOReader creates a new StringIOReader. func NewStringIOReader(r io.Reader) *StringIOReader { return &StringIOReader{scanner: bufio.NewScanner(r)} } // ReadString reads one string from StringIOReader. When all strings have // been returned ReadString returns an io.EOF error. func (sir *StringIOReader) ReadString() (string, error) { for sir.scanner.Scan() { s := strings.TrimSpace(sir.scanner.Text()) if s != "" { return s, nil } } return "", io.EOF } // FilteredStringReader filters a StringReader returning only the strings that // match a given regular expression. type FilteredStringReader struct { r StringReader re *regexp.Regexp } // NewFilteredStringReader creates a new FilteredStringReader that reads strings // from r and return only those that match re. func NewFilteredStringReader(r StringReader, re *regexp.Regexp) *FilteredStringReader { return &FilteredStringReader{r: r, re: re} } // ReadString reads strings from the underlying StringReader and returns the // first one that matches the regular expression specified while creating the // FilteredStringReader. If no more strings can be read err is io.EOF. func (f *FilteredStringReader) ReadString() (s string, err error) { for s, err = f.r.ReadString(); s != "" || err == nil; s, err = f.r.ReadString() { if f.re.MatchString(s) { return s, err } } return s, err } // MappedStringReader reads strings from a StringReader and call a map function // that transforms the strings in some other string. type MappedStringReader struct { r StringReader mapFn func(string) string } // NewMappedStringReader creates a new MappedStringReader that reads strings from // r and can call mapFn for transforming the string before returning it. func NewMappedStringReader(r StringReader, mapFn func(string) string) *MappedStringReader { return &MappedStringReader{r: r, mapFn: mapFn} } // ReadString reads strings from the underlying StringReader and can call the // map function associated to the MappedStringReader with that string, then // returns the result produced by the map function. func (m *MappedStringReader) ReadString() (s string, err error) { if s, err = m.r.ReadString(); err == nil { return m.mapFn(s), nil } return s, err } // StringReaderFromCmdArgs returns a string reader for reading the arguments // passed in the command line. If the arguments consists in single hypen "-", // they are read from stdin. func StringReaderFromCmdArgs(args []string) StringReader { if len(args) == 1 && args[0] == "-" { return NewStringIOReader(os.Stdin) } else { return NewStringArrayReader(args) } } vt-cli-1.3.1/vt/000077500000000000000000000000001520306561600133475ustar00rootroot00000000000000vt-cli-1.3.1/vt/main.go000066400000000000000000000030711520306561600146230ustar00rootroot00000000000000// Copyright © 2017 VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package main import ( "fmt" "os" "github.com/VirusTotal/vt-cli/cmd" "github.com/spf13/cobra" "github.com/spf13/viper" ) // initConfig reads in config file and ENV variables if set. func initConfig() { // Find homeDir directory. homeDir, err := os.UserHomeDir() if err != nil { fmt.Fprintln(os.Stderr, err) os.Exit(1) } // Search config in home directory and current directory viper.AddConfigPath(homeDir) viper.AddConfigPath(".") // Config file must be named .vt + format extension (.toml, .json, etc) viper.SetConfigName(".vt") // The prefix for all environment variables will be VTCLI_. Examples: // VTCLI_PROXY, VTCLI_APIKEY. viper.SetEnvPrefix("VTCLI") // Read in environment variables that match viper.AutomaticEnv() // If a config file is found, read it in. viper.ReadInConfig() } func init() { cobra.OnInitialize(initConfig) } func main() { vtCmd := cmd.NewVTCommand() if err := vtCmd.Execute(); err != nil { os.Exit(1) } } vt-cli-1.3.1/yaml/000077500000000000000000000000001520306561600136605ustar00rootroot00000000000000vt-cli-1.3.1/yaml/sorter.go000066400000000000000000000060371520306561600155330ustar00rootroot00000000000000// Copyright © 2017 VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package yaml import ( "reflect" "unicode" ) type keyList []reflect.Value func (l keyList) Len() int { return len(l) } func (l keyList) Swap(i, j int) { l[i], l[j] = l[j], l[i] } func (l keyList) Less(i, j int) bool { a := l[i] b := l[j] ak := a.Kind() bk := b.Kind() for (ak == reflect.Interface || ak == reflect.Ptr) && !a.IsNil() { a = a.Elem() ak = a.Kind() } for (bk == reflect.Interface || bk == reflect.Ptr) && !b.IsNil() { b = b.Elem() bk = b.Kind() } af, aok := keyFloat(a) bf, bok := keyFloat(b) if aok && bok { if af != bf { return af < bf } if ak != bk { return ak < bk } return numLess(a, b) } if ak != reflect.String || bk != reflect.String { return ak < bk } ar, br := []rune(a.String()), []rune(b.String()) for i := 0; i < len(ar) && i < len(br); i++ { if ar[i] == br[i] { continue } al := unicode.IsLetter(ar[i]) bl := unicode.IsLetter(br[i]) if al && bl { return ar[i] < br[i] } if al || bl { return bl } var ai, bi int var an, bn int64 for ai = i; ai < len(ar) && unicode.IsDigit(ar[ai]); ai++ { an = an*10 + int64(ar[ai]-'0') } for bi = i; bi < len(br) && unicode.IsDigit(br[bi]); bi++ { bn = bn*10 + int64(br[bi]-'0') } if an != bn { return an < bn } if ai != bi { return ai < bi } return ar[i] < br[i] } return len(ar) < len(br) } // keyFloat returns a float value for v if it is a number/bool // and whether it is a number/bool or not. func keyFloat(v reflect.Value) (f float64, ok bool) { switch v.Kind() { case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64: return float64(v.Int()), true case reflect.Float32, reflect.Float64: return v.Float(), true case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr: return float64(v.Uint()), true case reflect.Bool: if v.Bool() { return 1, true } return 0, true } return 0, false } // numLess returns whether a < b. // a and b must necessarily have the same kind. func numLess(a, b reflect.Value) bool { switch a.Kind() { case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64: return a.Int() < b.Int() case reflect.Float32, reflect.Float64: return a.Float() < b.Float() case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr: return a.Uint() < b.Uint() case reflect.Bool: return !a.Bool() && b.Bool() } panic("not a number") } vt-cli-1.3.1/yaml/yaml.go000066400000000000000000000166541520306561600151650ustar00rootroot00000000000000// Copyright © 2017 VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package yaml import ( "fmt" "io" "reflect" "sort" "strconv" "strings" "time" "unicode" "unicode/utf8" "github.com/fatih/color" glob "github.com/gobwas/glob" ) // Colors is a structure passed to NewEncoder for specifying the colors used // for printing keys, values and comments in the resulting YAML. type Colors struct { KeyColor *color.Color ValueColor *color.Color CommentColor *color.Color } // An Encoder writes values as YAML to an output stream. type Encoder struct { w io.Writer keyPrinter func(w io.Writer, format string, a ...interface{}) commentPrinter func(w io.Writer, format string, a ...interface{}) // List of globs that define the keys whose values should be encoded as a // date. Every key that matches any of the globs are considered a key if // they are a number. dateKeys []glob.Glob Colors *Colors indentSize int } // EncoderOption represents an option for creating a new encoder. type EncoderOption func(*Encoder) // EncoderColors sets the colors for highlighting keys, values and comments. func EncoderColors(c *Colors) EncoderOption { return func(e *Encoder) { e.Colors = c } } // EncoderDateKeys sets a list of globs that define the keys whose values // should be encoded as a date. Every key that matches any of the globs and // have a numeric value are encoded as a date, which means that a comment is // added with the human-friendly date. func EncoderDateKeys(g []glob.Glob) EncoderOption { return func(e *Encoder) { e.dateKeys = g } } // EncoderIndent sets the indentation size used while encoding the YAML. func EncoderIndent(i int) EncoderOption { return func(e *Encoder) { e.indentSize = i } } // NewEncoder returns a new YAML encoder that writes to w. func NewEncoder(w io.Writer, options ...EncoderOption) *Encoder { enc := &Encoder{w: w, indentSize: 2} for _, opt := range options { opt(enc) } if enc.Colors == nil { enc.Colors = &Colors{ KeyColor: color.New(), ValueColor: color.New(), CommentColor: color.New(), } } return enc } // lineBreakV decides whether or not a line break should be written based in // the type of v. It returns an indentation increment, a boolean indicating if // a line break was actually written and an error. func (enc *Encoder) lineBreakV(v reflect.Value, indent int) (int, error) { switch v.Kind() { case reflect.Interface: if v.IsNil() { return 0, nil } return enc.lineBreakV(v.Elem(), indent) case reflect.Map: if v.Len() > 0 { return enc.indentSize, enc.lineBreak(indent + enc.indentSize) } case reflect.Slice: if v.Len() > 0 { return 0, enc.lineBreak(indent) } } return 0, nil } // lineBreak writes a line break into the encoder's writer, followed by // the number of indention characters specified by indent. func (enc *Encoder) lineBreak(indent int) error { _, err := fmt.Fprintf(enc.w, "\n%s", strings.Repeat(" ", indent)) return err } func (enc *Encoder) matchDateKey(key string) bool { for _, glob := range enc.dateKeys { if glob.Match(key) { return true } } return false } func (enc *Encoder) encodeMap(m reflect.Value, indent int, prefix string) (err error) { keyPrinter := enc.Colors.KeyColor.FprintfFunc() commentPrinter := enc.Colors.CommentColor.FprintfFunc() keys := keyList(m.MapKeys()) sort.Sort(keys) n := len(keys) if prefix != "" { prefix += "." } var indentIncr int for i, k := range keys { // If the key is an empty string or starts with some non-letter character // let's enclose the key in double quotes. firstChar, kLen := utf8.DecodeRuneInString(k.String()) if kLen == 0 || (firstChar != '_' && !unicode.IsLetter(firstChar)) { keyPrinter(enc.w, "\"%s\": ", k) } else { keyPrinter(enc.w, "%s: ", k) } v := m.MapIndex(k) if indentIncr, err = enc.lineBreakV(v, indent); err != nil { return err } if err = enc.encodeValue(v, indent+indentIncr, prefix+k.String()); err != nil { return err } switch v.Kind() { case reflect.Interface: v = v.Elem() case reflect.Ptr: v = v.Elem() } if v.IsValid() { vt := v.Type() ks := k.String() // If key matches any of the patterns specified in the EncoderDateKeys // option while creating the YAML encoder, this field should be treated // as a date, let's add a comment with the date in a human-readable format. if enc.matchDateKey(ks) { var ts int64 switch { case vt.Name() == "Number" && vt.PkgPath() == "encoding/json": var err error if ts, err = strconv.ParseInt(v.String(), 10, 64); err != nil { panic(err) } case vt.Name() == "float64": ts = int64(v.Float()) case vt.Name() == "int64": ts = v.Int() } commentPrinter(enc.w, " # %v", time.Unix(ts, 0)) } } if i < n-1 { err = enc.lineBreak(indent) } if err != nil { return err } } return err } // encodeValue writes the YAML encoding of v. func (enc *Encoder) encodeValue(v reflect.Value, indent int, prefix string) (err error) { switch v.Kind() { case reflect.Map: return enc.encodeMap(v, indent, prefix) case reflect.Struct: m := make(map[string]interface{}) n := v.NumField() for i := 0; i < n; i++ { typeField := v.Type().Field(i) key := typeField.Tag.Get("yaml") if key == "" { key = typeField.Name } m[key] = v.Field(i).Interface() } return enc.encodeMap(reflect.ValueOf(m), indent, prefix) case reflect.Slice: n := v.Len() if n == 0 { fmt.Fprint(enc.w, "[]") } for i := 0; i < n; i++ { _, err = fmt.Fprint(enc.w, "- ") if err == nil { err = enc.encodeValue(v.Index(i), 2+indent, prefix) } if err == nil && i < n-1 { err = enc.lineBreak(indent) } if err != nil { return err } } case reflect.Interface, reflect.Ptr: if v.IsNil() { _, err = fmt.Fprintf(enc.w, "null") } else { err = enc.encodeValue(v.Elem(), indent, prefix) } case reflect.String: s := v.String() t := v.Type() switch { case t.PkgPath() == "encoding/json" && t.Name() == "Number": // This string is a actually a json.Number. _, err = enc.Colors.ValueColor.Fprintf(enc.w, "%s", s) case strings.Contains(s, "\n"): // If string contains new line characters lets encode it as a // literal block. Example: // literal_block : | // Lorem ipsum dolor sit amet consectetur // adipiscing elit potenti, ante taciti montes // risus mollis enc.Colors.ValueColor.Fprint(enc.w, "|") for _, line := range strings.Split(s, "\n") { enc.lineBreak(2 + indent) enc.Colors.ValueColor.Fprintf(enc.w, "%s", line) } default: _, err = enc.Colors.ValueColor.Fprintf(enc.w, "%#v", v) } default: _, err = enc.Colors.ValueColor.Fprintf(enc.w, "%#v", v) } return err } // Encode writes the YAML encoding of v to the stream. func (enc *Encoder) Encode(v interface{}) error { if err := enc.encodeValue(reflect.ValueOf(v), 0, ""); err != nil { return err } return enc.lineBreak(0) } vt-cli-1.3.1/yaml/yaml_test.go000066400000000000000000000070121520306561600162100ustar00rootroot00000000000000// Copyright © 2017 VirusTotal CLI authors. All Rights Reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package yaml import ( "bytes" "encoding/json" "fmt" "strings" "testing" "time" "github.com/gobwas/glob" "github.com/stretchr/testify/assert" ) type T struct { data interface{} yaml string } func Y(s string) string { t := make([]string, 0) for _, l := range strings.Split(s, "\n") { if len(l) > 3 { t = append(t, strings.Replace(l[3:], "\t", " ", -1)) } } return strings.Join(t, "\n") + "\n" } var tests = []T{ { data: "foo", yaml: Y(` "foo" `), }, { data: 1, yaml: Y(` 1 `), }, { data: json.Number("1"), yaml: Y(` 1 `), }, { data: json.Number("1.0"), yaml: Y(` 1.0 `), }, { data: false, yaml: Y(` false `), }, { data: true, yaml: Y(` true `), }, { data: map[string]string{}, yaml: Y(``), }, { data: map[string]map[string]string{ "foo": map[string]string{}, }, yaml: Y(` foo: `), }, { data: []string{}, yaml: Y(` []`), }, { data: map[string]string{ "uno": "1", "dos": "2", "tres": "3", "": "", "#foo": "foo", "|foo": "foo", "_foo": "foo", }, yaml: Y(` "": "" "#foo": "foo" _foo: "foo" "|foo": "foo" dos: "2" tres: "3" uno: "1" `), }, { data: []string{ "uno", "dos", "tres", }, yaml: Y(` - "uno" - "dos" - "tres" `), }, { data: struct { Foo string Bar string }{ "uno", "dos", }, // Struct fields are re-ordered alphabetically. yaml: Y(` Bar: "dos" Foo: "uno" `), }, { data: struct { Foo string }{ "uno\ndos", }, yaml: Y(` Foo: | uno dos `), }, { data: map[string]interface{}{ "numbers": []interface{}{ map[string]string{ "number": "1", "numeral": "first", }, map[string]string{ "number": "2", "numeral": "second", }, }, }, yaml: Y(` numbers:` + " " + ` - number: "1" numeral: "first" - number: "2" numeral: "second" `), }, { data: struct { Foo_date json.Number }{ Foo_date: "10000", }, yaml: Y(fmt.Sprintf(` Foo_date: 10000 # %v `, time.Unix(10000, 0))), }, { data: struct { Bar_date int64 }{ Bar_date: 10000, }, yaml: Y(fmt.Sprintf(` Bar_date: 10000 # %v `, time.Unix(10000, 0))), }, { data: struct { Baz_date float64 }{ Baz_date: 1618312811, }, yaml: Y(fmt.Sprintf(` Baz_date: 1.618312811e+09 # %v `, time.Unix(1618312811, 0))), }, } func TestYAML(t *testing.T) { var b bytes.Buffer for _, test := range tests { enc := NewEncoder(&b, EncoderIndent(1), EncoderDateKeys([]glob.Glob{ glob.MustCompile("*_date"), })) assert.NoError(t, enc.Encode(test.data)) assert.Equal(t, test.yaml, b.String(), "Test %v", test.data) b.Reset() } enc := NewEncoder(&b, EncoderIndent(1), EncoderDateKeys([]glob.Glob{ glob.MustCompile("*_date"), })) assert.NoError(t, enc.Encode(tests[5].data)) assert.Equal(t, tests[5].yaml, b.String()) }