ivanrad/sblookup

Command line tool to check URLs against Google Safe Browsing malware/phishing lists.

IMPORTANT NOTE

sblookup was originally written in 2012, and it was written to target an experimental Safe Browsing Lookup API v3. Fast forward to today -- API v3 is now considered legacy/deprecated API, and the current version of the API is v4. While the API v3 keys can still be obtained in Google Developer Console (at the time of this writing), I suspect API v3 will be completely shutdown sometime in 2017. That's the bad news.

There's a bit of good news too. Nowadays, Google seems to publish an official Safe Browsing Lookup command line client (aptly named sblookup ;)), and it is targeting the current API version. It's probably best to start thinking about using/migrating to the Google blessed command line tool.

sblookup

sblookup is a Google Safe Browsing Lookup API command line tool. It returns Safe Browsing verdicts for URLs read from files (or standard input).

Installing

sblookup is a bash script with dependency on curl. To install it, simply copy the script to a local folder (ideally, one that's already in your $PATH), and make sure the execute bit is set.

Using

For help on using sblookup, invoke it with an -h option (i.e. sblookup -h).

NOTE: sblookup is utilizing Google Safe Browsing Lookup API, protocol version 3.1. For more details, and to learn how to obtain Safe Browsing API key, see Google Safe Browsing Lookup API Guide.

Example

	$ cat sblookup_example.txt
	http://www.yahoo.com/
	http://www.google.com/
	http://malware.testing.google.test/testing/malware/
	http://twitter.com/
	http://ianfette.org
	https://github.com/

	$ ./sblookup -a <Safe Browsing API key> sblookup_example.txt
	ok      http://www.yahoo.com/
	ok      http://www.google.com/
	malware http://malware.testing.google.test/testing/malware/
	ok      http://twitter.com/
	malware http://ianfette.org
	ok      https://github.com/

License

Copyright (c) 2012-2014 Ivan Radanovic <ivanra at gmail>.

This code has been published under MIT license. See LICENSE file for more information.

sblookup's Issues

Trailing slash matters in checked URL

Hello,

it is not mentioned in the README.md, note this:

domain.tld - OK
http://domain.tld - OK
http://domain.tld/deceptivesitedir - OK
http://domain.tld/deceptivesitedir/ - phishing

So one have to test directories and use trailing slash too....!

sblookup: error: HTTP/403, possibly invalid API key.

I had this 403 error and prevented it by creating legacy v3 API key at https://console.developers.google.com/apis/credentials/wizard?api=safebrowsing
Thank you for the nice script.

unexpected protocol error, HTTP/000 returned

i try the given sblookup code thro API key but the out put is
command run:-./sblookup -a ABQIAAAA05SKfG4tLA46a2fHMP5uXxTiS8m_8J8u7ie-ne8rBb3_JokVSw example

out put:-000
sblookup: error: unexpected protocol error, HTTP/000 returned.