How to convert a response from Invoke-RestMethod to JSON?

Question

desired output:

nicholas@mordor:~$ 
nicholas@mordor:~$ lynx https://api.iocparser.com/url --dump
{"message": "The method is not allowed for the requested URL."}
nicholas@mordor:~$

doesn't have to be pretty.

current output:

PS /home/nicholas> 
PS /home/nicholas> (Invoke-RestMethod -Method Post -Uri 'https://api.iocparser.com/url' -Headers @{"Content-Type" = "application/json"} -Body (@{'url' = 'https://pastebin.com/raw/rgnvuYi2'} | ConvertTo-Json) | ConvertTo-xml).outerxml
<?xml version="1.0" encoding="utf-8"?><Objects><Object Type="System.Management.Automation.PSCustomObject"><Property Name="data" Type="System.Management.Automation.PSCustomObject"><Property Type="System.String">@{FILE_HASH_SHA1=System.Object[]; DOMAIN=System.Object[]; IPv6=System.Object[]; YARA_RULE=System.Object[]; IPv4=System.Object[]; EMAIL=System.Object[]; FILE_NAME=System.Object[]; BITCOIN_ADDRESS=System.Object[]; URL=System.Object[]; MAC_ADDRESS=System.Object[]; FILE_HASH_MD5=System.Object[]; CVE=System.Object[]; FILE_HASH_SHA256=System.Object[]; ASN=System.Object[]; MITRE_ATT&amp;CK=System.Object[]}</Property><Property Name="FILE_HASH_SHA1" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="DOMAIN" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="IPv6" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="YARA_RULE" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="IPv4" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="EMAIL" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="FILE_NAME" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="BITCOIN_ADDRESS" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="URL" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="MAC_ADDRESS" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="FILE_HASH_MD5" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="CVE" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="FILE_HASH_SHA256" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="ASN" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property><Property Name="MITRE_ATT&amp;CK" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property></Property><Property Name="meta" Type="System.Management.Automation.PSCustomObject"><Property Type="System.String">@{description=https://pastebin.com/raw/rgnvuYi2; title=https://pastebin.com/raw/rgnvuYi2; url=https://pastebin.com/raw/rgnvuYi2; tags=System.Object[]}</Property><Property Name="description" Type="System.Management.Automation.PSNoteProperty">https://pastebin.com/raw/rgnvuYi2</Property><Property Name="title" Type="System.Management.Automation.PSNoteProperty">https://pastebin.com/raw/rgnvuYi2</Property><Property Name="url" Type="System.Management.Automation.PSNoteProperty">https://pastebin.com/raw/rgnvuYi2</Property><Property Name="tags" Type="System.Management.Automation.PSNoteProperty">System.Object[]</Property></Property><Property Name="status" Type="System.String">success</Property></Object></Objects>
PS /home/nicholas>        
PS /home/nicholas> 
PS /home/nicholas> 
PS /home/nicholas> (Invoke-RestMethod -Method Post -Uri 'https://api.iocparser.com/url' -Headers @{"Content-Type" = "application/json"} -Body (@{'url' = 'https://pastebin.com/raw/rgnvuYi2'} | ConvertTo-Json) | ConvertTo-json).tostring

OverloadDefinitions
-------------------
string ToString()
string ToString(System.IFormatProvider provider)
string IConvertible.ToString(System.IFormatProvider provider)


PS /home/nicholas>

leaving aside that I'm not passing the URL properly, I'm only interested in the raw result, or, even better, a JSON object (or similar).

after a first quick look, you may have omitted parentheses on `toString`, which just shows the Overloads as shown in the output. Update that to `toString()` and see if that fixes it. — mjsqu, Nov 18 '20 at 03:07
I'm not exactly sure that's quite the right output, @mjsqu but it's probably enough so I can start using the API. — Nicholas Saunders, Nov 18 '20 at 04:37

Nicholas Saunders · Answer 1 · 2020-11-18T04:57:03.967

thanks to mjsqu:

PS /home/nicholas> 
PS /home/nicholas> (Invoke-RestMethod -Method Post -Uri 'https://api.iocparser.com/url' -Headers @{"Content-Type" = "application/json"} -Body (@{'url' = 'https://pastebin.com/raw/rgnvuYi2'} | ConvertTo-Json) | ConvertTo-json).tostring()
{
  "data": {
    "FILE_HASH_SHA1": [],
    "DOMAIN": [
      "pops.works",
      "educ.somerset.gov.uk",
      "www.malware-traffic-analysis.net"
    ],
    "IPv6": [],
    "YARA_RULE": [],
    "IPv4": [
      "195.123.221.93",
      "203.176.135.102"
    ],
    "EMAIL": [
      "ghill1@educ.somerset.gov.uk"
    ],
    "FILE_NAME": [
      "index.html",
      "13.xls",
      "1333ab4nu59ok.exe",
      "omuscreativos.php"
    ],
    "BITCOIN_ADDRESS": [],
    "URL": [
      "http://203.176.135.102:8082/jim747/WIN7PC_W617601.F97B577E1419B4CB127BE49CF55CB5D5/90",
      "http://203.176.135.102:8082/ono47/WIN7PC_W617601.45C53ECFF74734259CB34797A36C2804/81/",
      "https://pops.works/manahet/omuscreativos.php",
      "http://195.123.221.93:443/ono47/WIN7PC_W617601.45C53ECFF74734259CB34797A36C2804/81/",
      "http://www.malware-traffic-analysis.net/2020/06/16/index.html",
      "https://pops.works/manahet/",
      "http://203.176.135.102:8082/jim747/WIN7PC_W617601.F97B577E1419B4CB127BE49CF55CB5D5/81/",
      "http://203.176.135.102:8082/ono47/WIN7PC_W617601.45C53ECFF74734259CB34797A36C2804/90",
      "http://195.123.221.93:443/jim747/WIN7PC_W617601.F97B577E1419B4CB127BE49CF55CB5D5/81/"
    ],
    "MAC_ADDRESS": [],
    "FILE_HASH_MD5": [
      "45C53ECFF74734259CB34797A36C2804",
      "097f3773c30aea33b0ab4a0bcd73c4e0",
      "5ebfefd6165826b56658dce374c33cf9",
      "F97B577E1419B4CB127BE49CF55CB5D5"
    ],
    "CVE": [],
    "FILE_HASH_SHA256": [],
    "ASN": [],
    "MITRE_ATT&CK": []
  },
  "meta": {
    "description": "https://pastebin.com/raw/rgnvuYi2",
    "title": "https://pastebin.com/raw/rgnvuYi2",
    "url": "https://pastebin.com/raw/rgnvuYi2",
    "tags": []
  },
  "status": "success"
}
PS /home/nicholas>

seems okay. See also:

How do I POST from Powershell using Invoke-RestMethod

How to convert a response from Invoke-RestMethod to JSON?

1 Answers1