This repo is no longer actively maintained, however PR's are welcome!

🔍 PSURLScanio

A Powershell module for using the urlscan.io API.

PSURLScanio/PSUrlScanio is a Powershell module/wrapper for the urlscan.io API. The module allows you to quickly query/submit data to the service and incorporate it in to your automated threat hunting/intel processes using PoSh.

For example, let's hunt for some potential HSBC phishing pages that have embedded the companies logo! 🕵️‍

From here we could loop through each result to grab more data, or even retrieve live screenshots!

📦 Install

Head over to urlscan.io and get yourself an API key (https://urlscan.io/user/apikey/new/), install the module and then run Connect-UrlScanio to set your key.

Install-Module -Name PSUrlScanio -Repository PSGallery
Connect-UrlScanio -ApiKey "2126abb6-3686-47ef-bae5-9daf6c9e0888"

📜 Examples

Search for the last scan for the domain github.com.

Search-Urlscanio -Domain github.com -Limit 1 -Specific

TaskDate   : 28/08/2019 19:01:45
Submission : api
id         : 3313e096-3f4a-496f-9e9c-b0924e4d6824
URL        : https://github.com/
ApiResult  : https://urlscan.io/api/v1/result/3313e096-3f4a-496f-9e9c-b0924e4d6824
ResultPage : https://urlscan.io/result/3313e096-3f4a-496f-9e9c-b0924e4d6824

(Omitting -Specific will return any scans where github.com is called in any http request while loading the page)

Do the same but return the entire response rather than basic details.

Search-Urlscanio -Domain github.com -Limit 1 -Specific -Raw Object

task           : @{visibility=public; method=api; ...}
stats          : @{uniqIPs=3; consoleMsgs=0; dataLength=746649; ...}
page           : @{country=US; server=GitHub.com; city=; ...}
uniq_countries : 2
_id            : 3313e096-3f4a-496f-9e9c-b0924e4d6824
result         : https://urlscan.io/api/v1/result/3313e096-3f4a-496f-9e9c-b0924e4d6824

Get results from a specific scan id.

Get-UrlScanioScan -uuid 03ba7a78-e779-4743-ae37-2b683ee9ec74

data     : @{requests=System.Object[]; cookies=System.Object[]; ...}
stats    : @{resourceStats=System.Object[]; protocolStats=System.Object[]; ...}
meta     : @{processors=}
task     : @{uuid=03ba7a78-e779-4743-ae37-2b683ee9ec74; ...}
page     : @{url=https://www.google.com/?gws_rd=ssl; domain=www.google.com; ...}
lists    : @{ips=System.Object[]; countries=System.Object[]; ...}
verdicts : @{overall=; urlscan=; engines=; community=}

Get results from a scan but only return hash information

Get-UrlScanioScan -id 03ba7a78-e779-4743-ae37-2b683ee9ec74 -DataType Hashes

type      size    hash                                                              url
----      ----    ----                                                              ---
Document  237303  3bd8b5dc1430a1cf1bb26c08d7553f9ec2ee2d09b466dcb38e5674e7c368bf9b  https://www.google.com/?...
Image       7960  5776cd87617eacec3bc00ebcf530d1924026033eda852f706c1a675a98915826  https://www.google.com/images/...
Image       9768  a0e3b4584e7c0eb991bd5668a7495674dadccd5d1261dcba749d03700c5bceaa  https://ssl.gstatic.com/gb/...
Image        864  68d641e6402d4fbf0ddd37c95af75afdfad913dd9a7e7c6d3d9589b81512a12e  https://www.gstatic.com/images/...
Image          0  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  https://consent.google.com/...

Kick off a scan on the chosen domain/URL and return the scan results.

Start-UrlScanioScan -Url google.com -ShowResults

data     : @{requests=System.Object[]; cookies=System.Object[]; ...}
stats    : @{resourceStats=System.Object[]; protocolStats=System.Object[]; tlsStats=System.Object[]; ...}
meta     : @{processors=}
task     : @{uuid=781d9c96-7638-4393-b504-3cbc1ef5adfc; time=28/08/2019 19:58:22; ...}
page     : @{url=http://www.google.com/sorry/index?continue=http://google.com/&q=EhAqAQT4AZJUFAAAAAAAAAACGN65m-sFIhkA8aeDS4ML-09ouMDyyvDlbF81DD9ZWHvMMgFy; ...}
lists    : @{ips=System.Object[]; countries=System.Object[]; asns=System.Object[]; domains=System.Object[]; servers=System.Object[]; urls=System.Object[]; linkDomains=System.Object[]; certificates=System.Object[]; hashes=System.Object[]}
verdicts : @{overall=; urlscan=; engines=; community=}

(Example results have been truncated)

❓ FAQ

• Can I contribute?
  • Yes please! Feel free to clone/test/add features and submit a PR or enhancement suggestion. Help yourself to the project board if you feel like it!
• Why can I only get 10000 results? There are way more for this domain!
  • 10k results is the max limit for the API, and I haven't figured out a magical way around it (yet...).
• Something's broke.
  • Please submit an issue for it and I'll take a look!

Support

Feel free to reach out to me via twitter @sysgoblin.

If you fancy supporting me and what I'm working on you can always buy me a sfw beer (aka coffee) by the sponsor button on this repo. ☕👌