seclook 0.8

Simple security lookups via CLI

seclook

seclook is a security lookup CLI tool that allows you to query various security services on the fly. It is essentially a wrapper over the requests library that removes the need to manually search within Web UIs or write your own requests in Postman or cURL to query these services.

You can look up information using commands like seclook [service] [value], where the service can be virustotal, shodan, emailrep, and so on. The value is the information you're querying for and varies by service.

Installation

1. pip install seclook
2. Copy config.ini.sample from this directory and place it in ~/.seclook/config.ini
3. Open ~/.seclook/config.ini and add in your own API keys for the services you want to use.

Some services (e.g., GreyNoise, ThreatFox) don't require API keys, but may be rate-limited more quickly without one or have other limitations. Others (e.g., YARAify) do not need an API key at all and will not be referenced in the config file.

Usage

Basic usage of seclook is as follows:

seclook [service] [value]

For example, to look up IP 1.1.1.1 on AbuseIPDB, you'd run:

seclook abuseipdb 1.1.1.1

You can pipe the output to fx or jq for further processing:

seclook emailrep [e-mail] | fx

You can grep the output for known keys to get specific information:

seclook virustotal 44d88612fea8a8f36de82e1278abb02f | grep malicious

Options

--export – Use this flag to export the results to a JSON file in your current working directory.

Supported services

• quick
• VirusTotal
• Shodan
• Emailrep
• AbuseIPDB
• GreyNoise
• ThreatFox
• Pulsedive
• Yaraify

You can also view supported services by passing list as the service name:

seclook list

Upgrading

To upgrade seclook to the latest version:

pip install --upgrade seclook

Contributing

If you'd like to contribute to seclook, please feel free to fork the repository, create a feature branch, and then submit a Pull Request.

License

MIT License

Contact

[e-mail]