T09 · Insecure Skill Coding Practices
Warning
- Location
src/ioc_scan.py:153- Finding
Unsanitized URLs and API credentials are transmitted to VirusTotal
- Content
View full analysis
Optional[Dict]: """Consulta URL no VirusTotal (relatório existente).""" if not VIRUSTOTAL_API_KEY: return None url_encoded = urllib.parse.quote(url, safe='') url_api = f"{VT_API_URL_V2}/url/report" params = { 'apikey': VIRUSTOTAL_API_KEY, 'resource': url } try: response = requests.get(url_api, params=params, timeout=30) if response.status_code == 200: data = response.json() if data.get('response_code') == 1: return data return None except Exception as e: print(f"[VirusTotal] Erro: {e}") return None def scan_url_virustotal(url: str) -> Optional[Dict]: """Submete URL para scan no VirusTotal.""" if not VIRUSTOTAL_API_KEY: return None url_api = f"{VT_API_URL_V2}/url/scan" data = { 'apikey': VIRUSTOTAL_API_KEY, 'url': url } try: response = requests.post(url_api, data=data, timeout=30) if response.status_code == 200: result = response.json() # Aguarda e consulta novamente time.sleep(3) return check_url_virustotal(url) return None except Exception as e: print(f"[VirusTotal Scan] Erro: {e}") return None ``` The automatic submission behavior is invoked by the following logic in `scan_ioc`: ```python elif ioc_type == 'url': print(f"[*] Consultando URL: {ioc}") vt_data = check_url_virustotal(ioc) if not vt_data: print(f"[*] Nenhum resultado, submetendo para scan...") vt_data = scan_url_virustotal(ioc) ``` ### Technical Analysis The scanner sends the complete user-supplied URL to VirusTotal w ...[truncated 3575 chars]- Remediation
View remediation