seclook is a security lookup CLI tool that allows you to query various security services on the fly. It is essentially a wrapper over the requests library that removes the need to manually search within Web UIs or write your own requests in Postman or cURL to query these services.
You can look up information using commands like seclook [service] [value], where the service can be virustotal, shodan, emailrep, and so on. The value is the information you're querying for and varies by service.
pip install seclook- Copy config.ini.sample from this directory and place it in
~/.seclook/config.ini - Open
~/.seclook/config.iniand add in your own API keys for the services you want to use.
Some services (e.g., GreyNoise, ThreatFox) don't require API keys, but may be rate-limited more quickly without one or have other limitations. Others (e.g., YARAify) do not need an API key at all and will not be referenced in the config file.
Basic usage of seclook is as follows:
seclook [service] [value]For example, to look up IP 1.1.1.1 on AbuseIPDB, you'd run:
seclook abuseipdb 1.1.1.1You can send the JSON response to OpenAI GPT-4 for summarization:
seclook virustotal 44d88612fea8a8f36de82e1278abb02f --gpt4You can pipe the output to fx or jq for further processing:
seclook emailrep andrew@akatz.org | fxYou can grep the output for known keys to get specific information:
seclook virustotal 44d88612fea8a8f36de82e1278abb02f | grep malicious--export – Use this flag to export the results to a JSON file on your Desktop.
--gpt4 – Use this flag to summarize the JSON response from a service in GPT4.
You can also view supported services by passing list as the service name:
seclook listTo upgrade seclook to the latest version:
pip install --upgrade seclookIf you'd like to contribute to seclook, please feel free to fork the repository, create a feature branch, and then submit a Pull Request.
MIT License