Merge pull request #97 from alexandreborges/dev

Malwoverview 8.0.2

Author: alexandreborges

README.md

@@ -1,6 +1,6 @@
 # Malwoverview
 
-[<img alt="GitHub release (latest by date)" src="https://img.shields.io/github/v/release/alexandreborges/malwoverview?color=red&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases/tag/v8.0.1) [<img alt="GitHub last commit" src="https://img.shields.io/github/last-commit/alexandreborges/malwoverview?color=Yellow&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases) [<img alt="GitHub Release Date" src="https://img.shields.io/github/release-date/alexandreborges/malwoverview?label=Release%20Date&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases) [<img alt="GitHub" src="https://img.shields.io/github/license/alexandreborges/malwoverview?style=for-the-badge">](https://github.com/alexandreborges/malwoverview/blob/master/LICENSE) 
+[<img alt="GitHub release (latest by date)" src="https://img.shields.io/github/v/release/alexandreborges/malwoverview?color=red&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases/tag/v8.0.2) [<img alt="GitHub last commit" src="https://img.shields.io/github/last-commit/alexandreborges/malwoverview?color=Yellow&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases) [<img alt="GitHub Release Date" src="https://img.shields.io/github/release-date/alexandreborges/malwoverview?label=Release%20Date&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases) [<img alt="GitHub" src="https://img.shields.io/github/license/alexandreborges/malwoverview?style=for-the-badge">](https://github.com/alexandreborges/malwoverview/blob/master/LICENSE) 
 [<img alt="GitHub stars" src="https://img.shields.io/github/stars/alexandreborges/malwoverview?logoColor=Red&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/stargazers)
 [<img alt="Twitter Follow" src="https://img.shields.io/twitter/follow/ale_sp_brazil?style=for-the-badge&logo=X&color=blueviolet">](https://twitter.com/ale_sp_brazil)
 [![Downloads](https://static.pepy.tech/personalized-badge/malwoverview?period=month&units=international_system&left_color=grey&right_color=orange&left_text=Last%2030%20days)](https://pepy.tech/project/malwoverview)
@@ -46,7 +46,7 @@
       See GNU Public License on <http://www.gnu.org/licenses/>.
 
 
-## Current Version: 8.0.1 (Codename: Revolutions)
+## Current Version: 8.0.2 (Codename: Revolutions)
 
      Important note:  Malwoverview does NOT submit samples to any endpoint by default, 
      so it respects possible Non-Disclosure Agreements (NDAs). There're specific options
@@ -119,6 +119,7 @@ This tool aims to :
 52. TUI (Text User Interface) dashboard mode with panel-based navigation.
 53. Gather threat hunting information from URLScan.io — submit URLs, retrieve scan results, and search scans.
 54. LLM-powered threat enrichment — AI-generated risk assessment, MITRE ATT&CK mapping, and analyst recommendations appended to any query result. Supports Claude, Gemini, OpenAI, and Ollama (local).
+55. Batch IP check against VirusTotal from a file containing IP addresses, showing a summary table (IP Address, Country, AS Owner, Detection).
 
 ## CONTRIBUTORS
 
@@ -530,7 +531,7 @@ usage: python malwoverview.py -c <API configuration file> -d <directory> -o <0|1
 -V <argument> -a <1-17> -A <filename> -l <1-7> -L <hash> -j <1-7>
 -J <argument> -p <1-8> -P <argument> -y <1-5> -Y <file name> -n <1-5>
 -N <argument> -m <1-8> -M <argument> -b <1-12> -B <argument> -x <1-9> -X <argument>
--ip <1-7> -IP <argument> -O <directory> --nist <1-5> --NIST <argument> -vc <1-8>
+-ip <1-8> -IP <argument> -O <directory> --nist <1-5> --NIST <argument> -vc <1-8>
 -VC <argument> -s <1-2> -S <argument> -ab <1> -AB <argument> -gn <1> -GN <argument>
 -wh <1-2> -WH <argument> -u <1-5> -U <arg> --correlate-hash <hash> --extract-iocs <file|url> --yara <rules>
 --yara-target <target> --output-format text|json|csv --proxy <url> --quiet --verbose
@@ -850,12 +851,17 @@ MALWARE OPTIONS:
             + 4: Get details for an IP address from Shodan;
             + 5: Get details for an IP address from AbuseIPDB;
             + 6: Get details for an IP address from GreyNoise;
-            + 7: Get details for an IP address from all services (comprehensive).
+            + 7: Get details for an IP address from all services (comprehensive);
+            + 8: Batch check IP addresses from a file (one per line) against
+            VirusTotal and show a summary table (IP Address, Country, AS Owner,
+            Detection). Use -D to choose between Public (-D 1) and Premium
+            (-D 0, default) VT API.
 
       -IP IPARG, --iparg IPARG
 
-            + Provides an IP address (IPv4 or IPv6) for the -ip option. All -ip
-            options (1 through 7) require a valid IP address.
+            + Provides an argument for the -ip option. For -ip 1 through 7 it
+            must be a valid IP address (IPv4 or IPv6); for -ip 8 it must be a
+            file containing IP addresses (one per line).
 
 	-s SHODAN, --shodan SHODAN
 
@@ -1070,6 +1076,7 @@ Subcommand examples (equivalent to flag-based syntax):
       malwoverview triage batch <hashfile>              # same as: malwoverview -x 8 -X <hashfile>
       malwoverview ip all <ipaddr>                      # same as: malwoverview -ip 7 -IP <ipaddr>
       malwoverview ip shodan <ipaddr>                   # same as: malwoverview -ip 4 -IP <ipaddr>
+      malwoverview ip batch <ipfile>                    # same as: malwoverview -ip 8 -IP <ipfile>
       malwoverview whois domain <domain>                # same as: malwoverview -wh 1 -WH <domain>
       malwoverview correlate hash <sha256>              # same as: malwoverview --correlate-hash <sha256>
       malwoverview extract <file|url>                    # same as: malwoverview --extract-iocs <file|url>
@@ -1193,6 +1200,8 @@ Use --help with any subcommand for details:
       malwoverview -ip 5 -IP 8.8.8.8
       malwoverview -ip 6 -IP 8.8.8.8
       malwoverview -ip 7 -IP 8.8.8.8
+      malwoverview -ip 8 -IP /home/remnux/malware/ip_list.txt
+      malwoverview -ip 8 -IP /home/remnux/malware/ip_list.txt -D 1
       malwoverview -s 1 -S 8.8.8.8
       malwoverview -s 2 -S "apache"
       malwoverview -ab 1 -AB 185.220.100.243
@@ -1406,6 +1415,56 @@ Use --help with any subcommand for details:
 
 ## HISTORY
 
+Version 8.0.2:
+
+      This version:
+
+            * Introduces a batch IP check against VirusTotal (-ip 8 / "ip
+              batch" subcommand). Given a file with one IP address per line,
+              it queries VirusTotal for each address and prints a summary
+              table with the IP Address, Country, AS Owner and Detection
+              ratio (e.g. 8/94). Use -D to choose between the Public (-D 1,
+              sleeps 61s every 4 IPs to honour the rate limit) and Premium
+              (-D 0, default) VT API.
+
+            * Fixes the Android device-scan options (-y 1, -y 2 and -y 3),
+              which had stopped working on current Android versions. The
+              package listing is now parsed to support the modern /data/app
+              layout (the '~~' prefix and '==' path segments introduced in
+              Android 10+), and adb's CRLF output is handled so the options
+              also work on Windows. The on-device hashing now uses sha256sum
+              instead of md5sum, so the table shows the SHA256 hash. Clear
+              messages are also printed when adb is not in the PATH or when
+              no third-party packages are found.
+
+            * Fixes a second SSRF bypass in the IOC extraction feature
+              (--extract-iocs <url>). The URL validator only checked the
+              initial address, but the fetch followed HTTP redirects
+              automatically, so a public URL could redirect to an internal or
+              cloud-metadata address (e.g. 169.254.169.254) after the check had
+              already passed. Redirects are now followed manually and every hop
+              is re-validated against the private/reserved-address allowlist,
+              with a maximum redirect limit.
+
+            * Hardens the Android send options (-y 4 and -y 5) against a path
+              traversal triggered by a malicious/compromised connected device.
+              The package name reported by adb is now restricted to valid
+              Android package characters and the output file name is reduced to
+              its base name, so a crafted package listing can no longer cause a
+              file to be written outside the output directory.
+
+            * Fixes an SSRF bypass vulnerability (issue #96) in the IOC
+              extraction URL validator (ioc_extract.py). The previous
+              validation used urlparse() while the actual HTTP request was
+              made by requests, which normalize URLs differently. Crafted
+              inputs such as http://127.0.0.1:6666\@1.1.1.1 could pass the
+              public-hostname check yet still cause requests to connect to
+              an internal address. The validator now rejects URLs containing
+              backslashes, whitespace, or control characters, derives the
+              effective URL via requests.PreparedRequest so the hostname
+              that is actually contacted is the one being validated, and
+              passes that normalized URL to session.get.
+
 Version 8.0.1:
 
       This version:

malwoverview/malwoverview.py

@@ -21,7 +21,7 @@
 # Corey Forman (https://github.com/digitalsleuth)
 # Christian Clauss (https://github.com/cclauss)
 
-# Malwoverview.py: version 8.0.1  (codename: Revolutions)
+# Malwoverview.py: version 8.0.2  (codename: Revolutions)
 
 import os
 import sys
@@ -68,7 +68,7 @@
 __author__ = "Alexandre Borges"
 __copyright__ = "Copyright 2018-2026 Alexandre Borges"
 __license__ = "GNU General Public License v3.0"
-__version__ = "8.0.1"
+__version__ = "8.0.2"
 __email__ = "reverseexploit at proton.me"
 
 def finish_hook(signum, frame):
@@ -109,7 +109,7 @@ def main():
         USER_HOME_DIR = str(Path.home()) + '/'
         cv.windows = 0
 
-    parser = argparse.ArgumentParser(prog=None, description="Malwoverview is a first response tool for threat hunting written by Alexandre Borges. This version is " + __version__, usage="usage: python malwoverview.py -c <API configuration file> -d <directory> -o <0|1> -v <1-13> -V <virustotal arg> -a <1-17> -A <filename> -l <1-7> -L <hash> -j <1-7> -J <URLhaus argument> -p <1-8> -P <polyswarm argument> -y <1-5> -Y <file name> -n <1-5> -N <argument> -m <1-8> -M <argument> -b <1-12> -B <arg> -x <1-9> -X <arg> --nist <1-5> --NIST <argument> -O <output directory> -ip <1-7> -IP <IP address> -vc <1-8> -VC <argument> -s <1-2> -S <arg> -ab <1> -AB <arg> -gn <1> -GN <arg> -wh <1-2> -WH <arg> -u <1-5> -U <arg> --correlate-hash <hash> --extract-iocs <file> --yara <rules> --yara-target <target> --output-format text|json|csv --proxy <url> --quiet --verbose --no-cache --interactive --attack-map")
+    parser = argparse.ArgumentParser(prog=None, description="Malwoverview is a first response tool for threat hunting written by Alexandre Borges. This version is " + __version__, usage="usage: python malwoverview.py -c <API configuration file> -d <directory> -o <0|1> -v <1-13> -V <virustotal arg> -a <1-17> -A <filename> -l <1-7> -L <hash> -j <1-7> -J <URLhaus argument> -p <1-8> -P <polyswarm argument> -y <1-5> -Y <file name> -n <1-5> -N <argument> -m <1-8> -M <argument> -b <1-12> -B <arg> -x <1-9> -X <arg> --nist <1-5> --NIST <argument> -O <output directory> -ip <1-8> -IP <IP address> -vc <1-8> -VC <argument> -s <1-2> -S <arg> -ab <1> -AB <arg> -gn <1> -GN <arg> -wh <1-2> -WH <arg> -u <1-5> -U <arg> --correlate-hash <hash> --extract-iocs <file> --yara <rules> --yara-target <target> --output-format text|json|csv --proxy <url> --quiet --verbose --no-cache --interactive --attack-map")
 
     malware_group = parser.add_argument_group('MALWARE OPTIONS', 'Malware analysis and intelligence query options')
     malware_group.add_argument('-c', '--config', dest='config', type=str, metavar="CONFIG FILE", default=(USER_HOME_DIR + '.malwapi.conf'), help='Use a custom config file to specify API\'s.')
@@ -137,8 +137,8 @@ def main():
     malware_group.add_argument('-x', '--triage', dest='triage', type=int, default=0, metavar="TRIAGE", help='Provides information from TRIAGE according to the specified value: <1> this option gets sample\'s general information by providing an argument with -X option in the following possible formats: sha256:<value>, sha1:<value>, md5:<value>, family:<value>, score:<value>, tag:<value>, url:<value>, wallet:<value>, ip:<value>; <2> Get a sumary report for a given Triage ID (got from option -x 1) ; <3> Submit a sample for analysis ; <4> Submit a sample through a URL for analysis ; <5> Download sample specified by the Triage ID; <6> Download pcapng file from sample associated to given Triage ID; <7> Get a dynamic report for the given Triage ID (got from option -x 1); <8> Batch hash check from a file (one hash per line); <9> Directory scan - computes SHA256 for each file and checks against Triage.')
     malware_group.add_argument('-X', '--triagearg', dest='triagearg', type=str, default='', metavar="TRIAGE_ARG", help='Provides argument for -x option from TRIAGE. If "-x 1" then -X must be a search query (e.g., sha256:<hash>, family:<name>, tag:<tag>, ip:<ip>); If "-x 2" then -X must be a Triage sample ID (obtained from -x 1); If "-x 3" then -X must be a file path to submit; If "-x 4" then -X must be a URL to submit; If "-x 5" or "-x 6" then -X must be a Triage sample ID to download; If "-x 7" then -X must be a Triage sample ID for dynamic report; If "-x 8" then -X must be a file containing hashes (one per line); If "-x 9" then -X must be a directory path to scan.')
     malware_group.add_argument('-O', '--output-dir', dest='output_dir', type=str, default='.', help='Set output directory for all sample downloads.')
-    malware_group.add_argument('-ip', '--ip', dest='ipoption', type=int, default=0, metavar="IP", help='Get IP information from various sources. The possible values are: 1: Get details for an IP address provided with -IP from IPInfo; 2: Get details for an IP address provided with -IP from BGPView; 3: Get details for an IP address provided with -IP from all available intel services (VirusTotal/Alienvault); 4: Get details from Shodan; 5: Get details from AbuseIPDB; 6: Get details from GreyNoise; 7: Get details from all services (comprehensive).')
-    malware_group.add_argument('-IP', '--iparg', dest='iparg', type=str, metavar="IP_ARG", help='Provides an IP address for the -ip option. All -ip options (1 through 7) require a valid IPv4 or IPv6 address.')
+    malware_group.add_argument('-ip', '--ip', dest='ipoption', type=int, default=0, metavar="IP", help='Get IP information from various sources. The possible values are: 1: Get details for an IP address provided with -IP from IPInfo; 2: Get details for an IP address provided with -IP from BGPView; 3: Get details for an IP address provided with -IP from all available intel services (VirusTotal/Alienvault); 4: Get details from Shodan; 5: Get details from AbuseIPDB; 6: Get details from GreyNoise; 7: Get details from all services (comprehensive); 8: Batch check IP addresses from a file (one per line) against VirusTotal and show a summary table (IP Address, Country, AS Owner, Detection). Use -D to choose between Public (-D 1) and Premium (-D 0, default) VT API.')
+    malware_group.add_argument('-IP', '--iparg', dest='iparg', type=str, metavar="IP_ARG", help='Provides an argument for the -ip option. For -ip 1 through 7 it must be a valid IPv4 or IPv6 address; for -ip 8 it must be a file containing IP addresses (one per line).')
     malware_group.add_argument('-s', '--shodan', dest='shodanoption', type=int, default=0, metavar="SHODAN", help='SHODAN options: 1: IP lookup; 2: Search query.')
     malware_group.add_argument('-S', '--shodanarg', dest='shodanarg', type=str, default='', metavar="SHODAN_ARG", help='Provides argument for -s option from SHODAN. If "-s 1" then -S must be an IP address; If "-s 2" then -S must be a search query (e.g., "apache", "port:22 country:BR").')
     malware_group.add_argument('-ab', '--abuseipdb', dest='abuseipdb', type=int, default=0, metavar="ABUSEIPDB", help='ABUSEIPDB options: 1: Check IP reputation.')
@@ -275,6 +275,8 @@ def main():
     ip_greynoise.add_argument('target', help='IP address')
     ip_all = ip_sub.add_parser('all', help='All services lookup')
     ip_all.add_argument('target', help='IP address')
+    ip_batch = ip_sub.add_parser('batch', help='Batch VirusTotal check from a file (one IP per line)')
+    ip_batch.add_argument('target', help='File containing IP addresses (one per line)')
 
     wh_parser = subparsers.add_parser('whois', help='Whois/RDAP lookups')
     wh_sub = wh_parser.add_subparsers(dest='wh_action')
@@ -352,7 +354,7 @@ def main():
             args.hausoption = uh_map.get(args.uh_action, 0)
             args.hausarg = args.target
     elif args.command == 'ip':
-        ip_map = {'info': 1, 'bgp': 2, 'shodan': 4, 'abuse': 5, 'greynoise': 6, 'all': 7}
+        ip_map = {'info': 1, 'bgp': 2, 'shodan': 4, 'abuse': 5, 'greynoise': 6, 'all': 7, 'batch': 8}
         if args.ip_action:
             args.ipoption = ip_map.get(args.ip_action, 0)
             args.iparg = args.target
@@ -538,6 +540,7 @@ def getoption(section, name):
         'uh_url':    (hausoptionx, hausargx, [3], sanitize_url),
         'uh_tag':    (hausoptionx, hausargx, [4, 5], sanitize_tag),
         'ip_addr':   (ipoptionx, ipargx, [1, 2, 3, 4, 5, 6, 7], sanitize_ip),
+        'ip_batch':  (ipoptionx, ipargx, [8], sanitize_path),
         'sh_ip':     (shodanoptionx, shodanargx, [1], sanitize_ip),
         'sh_gen':    (shodanoptionx, shodanargx, [2], sanitize_general),
         'ab_ip':     (abuseipdbx, abuseipdbargx, [1], sanitize_ip),
@@ -609,7 +612,7 @@ def getoption(section, name):
         args.malsharelist not in optval8,
         args.virustotaloption not in optval9,
         args.vtpubpremium not in optval,
-        args.ipoption not in range(8),
+        args.ipoption not in range(9),
         args.androidoption not in optval5,
         args.shodanoption not in range(3),
         args.abuseipdb not in range(2),
@@ -623,7 +626,7 @@ def getoption(section, name):
         virustotaloptionx and virustotalargx, args.direct, fprovided,
         haoptionx and haargx, mallist, args.malsharehash, args.hausoption,
         polyoptionx and polyargx,
-        androidoptionx and androidargx, alienx and alienargsx,
+        androidoptionx in (1, 2, 3) or (androidoptionx and androidargx), alienx and alienargsx,
         malpediax, bazaarx, triagex and triageargx,
         ipoptionx and ipargx,
         nistoption and nistarg,
@@ -865,7 +868,8 @@ def ha_show_and_down(haargx, xx=0):
                 4: (shodan_ext.shodan_ip, [ipargx]),
                 5: (abuseipdb_ext.check_ip, [ipargx]),
                 6: (greynoise_ext.quick_check, [ipargx]),
-                7: (multipleip.get_multiple_ip_details, [ipargx])
+                7: (multipleip.get_multiple_ip_details, [ipargx]),
+                8: (virustotal.vtipbatchcheck, [ipargx, vtpubpremiumx])
             }
         },
         {