Select Page

Rust Threat hunting Guide: Using the Virustotal API

by | Oct 15, 2019 | Programming, Rust

It could be said Rust is the programming language of the future. The Rust compiler emphasizes safety first. It can prioritize memory management in ways that humans can’t. Security vulnerabilities are released daily for software created using languages that require the coder to manage safety.

Learning to manage memory takes decades of experience to master. Programmers with thirty years of experience may not even fully understand why they are doing something instead of relying on rote memory.

Want to learn Python GUI’s? Read GETTING STARTED BUILDING A PYTHON GUI USING PYQT5

There is a tradeoff however. Higher level languages like Python and Ruby don’t involve the programmer in referencing memory in the program while Rust does. This means Rust has a steep learning curve.

Here’s What You Need

  • Rust version 1.36.0
  • A VirusTotal API key
  • owlinux’s library – github.com/owlinux1000/virustotal.rs

The first step is to create a new project using cargo, Rust’s package manager. Think of it as being similar to Python and pip. Pip retrieves and downloads libraries. Cargo does this as well but is way more powerful than pip. It can run tests, compile optimized code for highest speed performance, etc.

$ cargo new url_scanner

Before that let’s take a look at the directory structure for this project.

+ url_scanner
  |__ Cargo.toml
  + src
    |__ scanner.rs

The dependencies in the form of crates are managed using the project’s cargo.toml file.

Cargo.toml

I set the version number to “*” which means any. By default cargo will download the latest version in this case.

[package]
name = "url_scanner"
version = "0.1.0"
authors = ["macbook"]
edition = "2018"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
virustotal = "*"

url_scanner.rs – this holds the main function of the project, the entry point of the program.

use virustotal::*;


fn main() {

    let api = "get-one";
    let url = "https://www.google.com";
    let res = url::scan(api, url);

    println!("{:?}",|x| url::report(api, &res.scan_id.unwrap()));
    
}

To run the program, cargo run.

The VirusTotal response comes back with a lot of data about google.com as we can see.

permalink: Some(“https://www.virustotal.com/url/d0e196a0c25d35dd0a84593cbae0f38333aa58529936444ea26453eab28dfc86/analysis/1571176751/”), filescan_id: None, positives: Some(0), total: Some(71), scans: Some({“Google Safebrowsing”: FileScan { detected: Some(false), version: None, result: Some(“clean site”), update: None, detail: None }

Take It Further

Let’s say you wanted to get the response_code field’s value to determine if it’s a one or a zero. 

use virustotal::*;


fn main() {

    let api = "get-one";
    let url = "https://www.google.com";
    let res = url::scan(api, url);
    let x = url::report(api, &res.scan_id.unwrap());
  
    println!("{:?}",x.response_code)
    
}

There is an existing report for google.com what a surprise! That means the code will return a one as a response.

error: