prehistoric-systems/Zeus-Scanner
1
0
Fork 0
mirror of https://github.com/Ekultek/Zeus-Scanner.git synced 2026-03-11 08:55:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

updating some doc strings, will be updating them more in time. just wanted to go ahead and start on them for now

Browse source
This commit is contained in:
ekultek 2017-10-16 10:03:35 -05:00
parent fc782c71fb
commit a909ac6c74
6 changed files with 84 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/attacks/admin_panel_finder/__init__.py
View file

@ -22,6 +22,10 @@ from lib.core.settings import (
def check_for_robots(url, ext="/robots.txt", data_sep="-" * 30):
"""
check if the URL has a robots.txt in it and collect `interesting` information
out of the page
"""
url = replace_http(url)
interesting = set()
full_url = "{}{}{}".format("http://", url, ext)
@ -52,6 +56,9 @@ def check_for_robots(url, ext="/robots.txt", data_sep="-" * 30):
def check_for_admin_page(url, exts, protocol="http://", **kwargs):
"""
bruteforce the admin page of given URL
"""
verbose = kwargs.get("verbose", False)
show_possibles = kwargs.get("show_possibles", False)
possible_connections, connections = set(), set()
@ -127,11 +134,17 @@ def check_for_admin_page(url, exts, protocol="http://", **kwargs):
def __load_extensions(filename="{}/etc/link_ext.txt"):
"""
load the extenstions to use from the etc/link_ext file
"""
with open(filename.format(os.getcwd())) as ext:
return ext.readlines()
def main(url, show=False, verbose=False, **kwargs):
"""
main method to be called
"""
do_threading = kwargs.get("do_threading", False)
proc_num = kwargs.get("proc_num", 3)
logger.info(set_color(

12
lib/attacks/intel_me/__init__.py
View file

@ -15,6 +15,9 @@ from var.auto_issue.github import request_issue_creation
def __get_auth_headers(target, port=16992, source=None, agent=None, proxy=None):
"""
get the authorization headers from the URL
"""
if not source or 'WWW-Authenticate' not in source.headers['WWW-Authenticate']:
logger.info(set_color(
"header value not established, attempting to get bypass..."
@ -44,6 +47,9 @@ def __get_auth_headers(target, port=16992, source=None, agent=None, proxy=None):
def __get_raw_data(target, page, agent=None, proxy=None):
"""
collect all the information from an exploitable target
"""
logger.info(set_color(
"getting raw information..."
))
@ -58,6 +64,9 @@ def __get_raw_data(target, page, agent=None, proxy=None):
def __get_hardware(target, agent=None, proxy=None):
"""
collect all the hardware information from an exploitable target
"""
req = __get_raw_data(target, 'hw-sys', agent=agent, proxy=proxy)
if not req.status_code == 200:
return None
@ -94,6 +103,9 @@ def __get_hardware(target, agent=None, proxy=None):
def main_intel_amt(url, agent=None, proxy=None, **kwargs):
"""
main attack method to be called
"""
do_ip_address = kwargs.get("do_ip", False)
proxy = proxy_string_to_dict(proxy) or None
agent = agent or DEFAULT_USER_AGENT

23
lib/attacks/xss_scan/__init__.py
View file

@ -23,6 +23,9 @@ from lib.core.settings import (
def list_tamper_scripts(path="{}/lib/tamper_scripts"):
"""
create a list of available tamper scripts from the tamper script directory
"""
retval = set()
exclude = ["__init__.py", ".pyc"]
for item in os.listdir(path.format(os.getcwd())):
@ -34,6 +37,9 @@ def list_tamper_scripts(path="{}/lib/tamper_scripts"):
def __tamper_payload(payload, tamper_type, warning=True, **kwargs):
"""
add the tamper to the payload from the given tamper type
"""
acceptable = list_tamper_scripts()
if tamper_type in acceptable:
tamper_name = "lib.tamper_scripts.{}_encode"
@ -44,10 +50,16 @@ def __tamper_payload(payload, tamper_type, warning=True, **kwargs):
def __load_payloads(filename="{}/etc/xss_payloads.txt"):
"""
load the tamper payloads from the etc/xss_payloads file
"""
with open(filename.format(os.getcwd())) as payloads: return payloads.readlines()
def create_urls(url, payload_list, tamper=None):
"""
create the tampered URL's, write them to a temporary file and read them from there
"""
tf = tempfile.NamedTemporaryFile(delete=False)
tf_name = tf.name
with tf as tmp:
@ -71,6 +83,9 @@ def create_urls(url, payload_list, tamper=None):
def find_xss_script(url, **kwargs):
"""
parse the URL for the given XSS payload
"""
data = urlparse.urlparse(url)
payload_parser = {"path": 2, "query": 4, "fragment": 5}
if data[payload_parser["fragment"]] is not "" or None:
@ -87,6 +102,11 @@ def find_xss_script(url, **kwargs):
def scan_xss(url, agent=None, proxy=None):
"""
scan the payload to see if the XSS is still present in the HTML, if it is there's a very good
chance that the URL is vulnerable to XSS attacks. Usually what will happen is the payload will
be tampered or encoded if the site is not vulnerable
"""
user_agent = agent or DEFAULT_USER_AGENT
config_proxy = proxy_string_to_dict(proxy)
config_headers = {"connection": "close", "user-agent": user_agent}
@ -103,6 +123,9 @@ def scan_xss(url, agent=None, proxy=None):
def main_xss(start_url, verbose=False, proxy=None, agent=None, tamper=None):
"""
main attack method to be called
"""
if tamper:
logger.info(set_color(
"tampering payloads with '{}'...".format(tamper)

28
lib/core/settings.py
View file

@ -23,7 +23,7 @@ except NameError:
# clone link
CLONE = "https://github.com/ekultek/zeus-scanner.git"
# current version <major.minor.commit.patch ID>
VERSION = "1.0.49.feea"
VERSION = "1.0.50"
# colors to output depending on the version
VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30}
# version string formatting
@ -83,6 +83,7 @@ AUTHORIZED_SEARCH_ENGINES = {
"duckduckgo": "http://duckduckgo.com",
"google": "http://google.com"
}
# extensions to exclude from the spider
SPIDER_EXT_EXCLUDE = (
"3ds", "3g2", "3gp", "7z", "DS_Store",
"a", "aac", "adp", "ai", "aif", "aiff",
@ -314,6 +315,9 @@ def prompt(question, opts=None):
def find_application(application, opt="path", verbose=False):
"""
find the given application on the users system by parsing the given configuration file
"""
retval = []
with open(TOOL_PATHS) as config:
read_conf = config.read()
@ -334,6 +338,9 @@ def get_random_dork(filename="{}/etc/dorks.txt"):
def update_zeus():
"""
update zeus to the newest version
"""
can_update = True if ".git" in os.listdir(os.getcwd()) else False
if can_update:
return os.system("git pull origin master")
@ -344,6 +351,9 @@ def update_zeus():
def create_tree(start, conns, down="|", over="-", sep="-" * 40):
"""
create a tree of connections made, will be used for things like XSS and admin pages
"""
print("{}\nStarting URL: {}\n\nConnections:".format(sep, start))
for con in conns:
print(
@ -355,11 +365,18 @@ def create_tree(start, conns, down="|", over="-", sep="-" * 40):
def get_true_url(url):
"""
get the true URL of an otherwise messy URL
"""
data = url.split("/")
return "{}//{}".format(data[0], data[2])
def fix_log_file(logfile=get_latest_log_file(CURRENT_LOG_FILE_PATH)):
"""
fix the log file, the way the color is set causes the log file to get code escapes (\033),
this will delete them out of the file
"""
retval = ""
escape_seq_regex = re.compile("\033\[\d+[*m]")
with open(logfile, "r+") as to_fix:
@ -372,6 +389,9 @@ def fix_log_file(logfile=get_latest_log_file(CURRENT_LOG_FILE_PATH)):
def write_to_log_file(data_to_write, path, filename):
"""
write all found data to a log file
"""
create_dir(path.format(os.getcwd()))
full_file_path = "{}/{}".format(
path.format(os.getcwd()), filename.format(len(os.listdir(path.format(
@ -396,6 +416,9 @@ def write_to_log_file(data_to_write, path, filename):
def search_for_process(name):
"""
search for a given process to see if it's started or not
"""
all_process_names = set()
for pid in psutil.pids():
process = psutil.Process(pid)
@ -404,6 +427,9 @@ def search_for_process(name):
def get_browser_version():
"""
obtain the firefox browser version, this is necessary because zeus can only handle certain versions.
"""
logger.info(set_color(
"attempting to get firefox browser version..."
))

3
var/google_search/search.py
View file

@ -64,6 +64,9 @@ def bypass_ip_block(url):
def extract_webcache_url(webcache_url, splitter="+"):
"""
extract the true URL from Google's webcache URL's
"""
webcache_url = unquote(webcache_url)
webcache_regex = re.compile(r"cache:(.{,16})?:")
data = webcache_regex.split(webcache_url)

6
zeus.py
View file

@ -455,6 +455,9 @@ if __name__ == "__main__":
def __run_attacks_main():
"""
main method to run the attacks
"""
which_log_to_use = {
"dork": URL_LOG_PATH,
"spider": SPIDER_LOG_PATH
@ -591,6 +594,7 @@ if __name__ == "__main__":
request_issue_creation()
pass
# spider a given webpage for all available URL's
elif opt.spiderWebSite:
problem_identifiers = ["http://", "https://"]
if not URL_REGEX.match(opt.spiderWebSite):
@ -619,6 +623,7 @@ if __name__ == "__main__":
__run_attacks_main()
# enumerate a file and run attacks on the URL's provided
elif opt.fileToEnumerate is not None:
__run_attacks_main()
@ -704,5 +709,6 @@ if __name__ == "__main__":
))
request_issue_creation()
# fix the log file before shutting down incase you want to look at it
fix_log_file()
shutdown()