From a909ac6c7414131ff9c3159ad0567c5e2a57a1ef Mon Sep 17 00:00:00 2001 From: ekultek Date: Mon, 16 Oct 2017 10:03:35 -0500 Subject: [PATCH] updating some doc strings, will be updating them more in time. just wanted to go ahead and start on them for now --- lib/attacks/admin_panel_finder/__init__.py | 13 ++++++++++ lib/attacks/intel_me/__init__.py | 12 ++++++++++ lib/attacks/xss_scan/__init__.py | 23 ++++++++++++++++++ lib/core/settings.py | 28 +++++++++++++++++++++- var/google_search/search.py | 3 +++ zeus.py | 6 +++++ 6 files changed, 84 insertions(+), 1 deletion(-) diff --git a/lib/attacks/admin_panel_finder/__init__.py b/lib/attacks/admin_panel_finder/__init__.py index 74d43eb..c8344e6 100644 --- a/lib/attacks/admin_panel_finder/__init__.py +++ b/lib/attacks/admin_panel_finder/__init__.py @@ -22,6 +22,10 @@ from lib.core.settings import ( def check_for_robots(url, ext="/robots.txt", data_sep="-" * 30): + """ + check if the URL has a robots.txt in it and collect `interesting` information + out of the page + """ url = replace_http(url) interesting = set() full_url = "{}{}{}".format("http://", url, ext) @@ -52,6 +56,9 @@ def check_for_robots(url, ext="/robots.txt", data_sep="-" * 30): def check_for_admin_page(url, exts, protocol="http://", **kwargs): + """ + bruteforce the admin page of given URL + """ verbose = kwargs.get("verbose", False) show_possibles = kwargs.get("show_possibles", False) possible_connections, connections = set(), set() @@ -127,11 +134,17 @@ def check_for_admin_page(url, exts, protocol="http://", **kwargs): def __load_extensions(filename="{}/etc/link_ext.txt"): + """ + load the extenstions to use from the etc/link_ext file + """ with open(filename.format(os.getcwd())) as ext: return ext.readlines() def main(url, show=False, verbose=False, **kwargs): + """ + main method to be called + """ do_threading = kwargs.get("do_threading", False) proc_num = kwargs.get("proc_num", 3) logger.info(set_color( diff --git a/lib/attacks/intel_me/__init__.py b/lib/attacks/intel_me/__init__.py index a662e0a..a287063 100644 --- a/lib/attacks/intel_me/__init__.py +++ b/lib/attacks/intel_me/__init__.py @@ -15,6 +15,9 @@ from var.auto_issue.github import request_issue_creation def __get_auth_headers(target, port=16992, source=None, agent=None, proxy=None): + """ + get the authorization headers from the URL + """ if not source or 'WWW-Authenticate' not in source.headers['WWW-Authenticate']: logger.info(set_color( "header value not established, attempting to get bypass..." @@ -44,6 +47,9 @@ def __get_auth_headers(target, port=16992, source=None, agent=None, proxy=None): def __get_raw_data(target, page, agent=None, proxy=None): + """ + collect all the information from an exploitable target + """ logger.info(set_color( "getting raw information..." )) @@ -58,6 +64,9 @@ def __get_raw_data(target, page, agent=None, proxy=None): def __get_hardware(target, agent=None, proxy=None): + """ + collect all the hardware information from an exploitable target + """ req = __get_raw_data(target, 'hw-sys', agent=agent, proxy=proxy) if not req.status_code == 200: return None @@ -94,6 +103,9 @@ def __get_hardware(target, agent=None, proxy=None): def main_intel_amt(url, agent=None, proxy=None, **kwargs): + """ + main attack method to be called + """ do_ip_address = kwargs.get("do_ip", False) proxy = proxy_string_to_dict(proxy) or None agent = agent or DEFAULT_USER_AGENT diff --git a/lib/attacks/xss_scan/__init__.py b/lib/attacks/xss_scan/__init__.py index b8ac7e1..d11cae0 100644 --- a/lib/attacks/xss_scan/__init__.py +++ b/lib/attacks/xss_scan/__init__.py @@ -23,6 +23,9 @@ from lib.core.settings import ( def list_tamper_scripts(path="{}/lib/tamper_scripts"): + """ + create a list of available tamper scripts from the tamper script directory + """ retval = set() exclude = ["__init__.py", ".pyc"] for item in os.listdir(path.format(os.getcwd())): @@ -34,6 +37,9 @@ def list_tamper_scripts(path="{}/lib/tamper_scripts"): def __tamper_payload(payload, tamper_type, warning=True, **kwargs): + """ + add the tamper to the payload from the given tamper type + """ acceptable = list_tamper_scripts() if tamper_type in acceptable: tamper_name = "lib.tamper_scripts.{}_encode" @@ -44,10 +50,16 @@ def __tamper_payload(payload, tamper_type, warning=True, **kwargs): def __load_payloads(filename="{}/etc/xss_payloads.txt"): + """ + load the tamper payloads from the etc/xss_payloads file + """ with open(filename.format(os.getcwd())) as payloads: return payloads.readlines() def create_urls(url, payload_list, tamper=None): + """ + create the tampered URL's, write them to a temporary file and read them from there + """ tf = tempfile.NamedTemporaryFile(delete=False) tf_name = tf.name with tf as tmp: @@ -71,6 +83,9 @@ def create_urls(url, payload_list, tamper=None): def find_xss_script(url, **kwargs): + """ + parse the URL for the given XSS payload + """ data = urlparse.urlparse(url) payload_parser = {"path": 2, "query": 4, "fragment": 5} if data[payload_parser["fragment"]] is not "" or None: @@ -87,6 +102,11 @@ def find_xss_script(url, **kwargs): def scan_xss(url, agent=None, proxy=None): + """ + scan the payload to see if the XSS is still present in the HTML, if it is there's a very good + chance that the URL is vulnerable to XSS attacks. Usually what will happen is the payload will + be tampered or encoded if the site is not vulnerable + """ user_agent = agent or DEFAULT_USER_AGENT config_proxy = proxy_string_to_dict(proxy) config_headers = {"connection": "close", "user-agent": user_agent} @@ -103,6 +123,9 @@ def scan_xss(url, agent=None, proxy=None): def main_xss(start_url, verbose=False, proxy=None, agent=None, tamper=None): + """ + main attack method to be called + """ if tamper: logger.info(set_color( "tampering payloads with '{}'...".format(tamper) diff --git a/lib/core/settings.py b/lib/core/settings.py index 13be84d..c82be3f 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -23,7 +23,7 @@ except NameError: # clone link CLONE = "https://github.com/ekultek/zeus-scanner.git" # current version -VERSION = "1.0.49.feea" +VERSION = "1.0.50" # colors to output depending on the version VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30} # version string formatting @@ -83,6 +83,7 @@ AUTHORIZED_SEARCH_ENGINES = { "duckduckgo": "http://duckduckgo.com", "google": "http://google.com" } +# extensions to exclude from the spider SPIDER_EXT_EXCLUDE = ( "3ds", "3g2", "3gp", "7z", "DS_Store", "a", "aac", "adp", "ai", "aif", "aiff", @@ -314,6 +315,9 @@ def prompt(question, opts=None): def find_application(application, opt="path", verbose=False): + """ + find the given application on the users system by parsing the given configuration file + """ retval = [] with open(TOOL_PATHS) as config: read_conf = config.read() @@ -334,6 +338,9 @@ def get_random_dork(filename="{}/etc/dorks.txt"): def update_zeus(): + """ + update zeus to the newest version + """ can_update = True if ".git" in os.listdir(os.getcwd()) else False if can_update: return os.system("git pull origin master") @@ -344,6 +351,9 @@ def update_zeus(): def create_tree(start, conns, down="|", over="-", sep="-" * 40): + """ + create a tree of connections made, will be used for things like XSS and admin pages + """ print("{}\nStarting URL: {}\n\nConnections:".format(sep, start)) for con in conns: print( @@ -355,11 +365,18 @@ def create_tree(start, conns, down="|", over="-", sep="-" * 40): def get_true_url(url): + """ + get the true URL of an otherwise messy URL + """ data = url.split("/") return "{}//{}".format(data[0], data[2]) def fix_log_file(logfile=get_latest_log_file(CURRENT_LOG_FILE_PATH)): + """ + fix the log file, the way the color is set causes the log file to get code escapes (\033), + this will delete them out of the file + """ retval = "" escape_seq_regex = re.compile("\033\[\d+[*m]") with open(logfile, "r+") as to_fix: @@ -372,6 +389,9 @@ def fix_log_file(logfile=get_latest_log_file(CURRENT_LOG_FILE_PATH)): def write_to_log_file(data_to_write, path, filename): + """ + write all found data to a log file + """ create_dir(path.format(os.getcwd())) full_file_path = "{}/{}".format( path.format(os.getcwd()), filename.format(len(os.listdir(path.format( @@ -396,6 +416,9 @@ def write_to_log_file(data_to_write, path, filename): def search_for_process(name): + """ + search for a given process to see if it's started or not + """ all_process_names = set() for pid in psutil.pids(): process = psutil.Process(pid) @@ -404,6 +427,9 @@ def search_for_process(name): def get_browser_version(): + """ + obtain the firefox browser version, this is necessary because zeus can only handle certain versions. + """ logger.info(set_color( "attempting to get firefox browser version..." )) diff --git a/var/google_search/search.py b/var/google_search/search.py index ef07adb..47be528 100644 --- a/var/google_search/search.py +++ b/var/google_search/search.py @@ -64,6 +64,9 @@ def bypass_ip_block(url): def extract_webcache_url(webcache_url, splitter="+"): + """ + extract the true URL from Google's webcache URL's + """ webcache_url = unquote(webcache_url) webcache_regex = re.compile(r"cache:(.{,16})?:") data = webcache_regex.split(webcache_url) diff --git a/zeus.py b/zeus.py index 96c6ec1..fab0247 100755 --- a/zeus.py +++ b/zeus.py @@ -455,6 +455,9 @@ if __name__ == "__main__": def __run_attacks_main(): + """ + main method to run the attacks + """ which_log_to_use = { "dork": URL_LOG_PATH, "spider": SPIDER_LOG_PATH @@ -591,6 +594,7 @@ if __name__ == "__main__": request_issue_creation() pass + # spider a given webpage for all available URL's elif opt.spiderWebSite: problem_identifiers = ["http://", "https://"] if not URL_REGEX.match(opt.spiderWebSite): @@ -619,6 +623,7 @@ if __name__ == "__main__": __run_attacks_main() + # enumerate a file and run attacks on the URL's provided elif opt.fileToEnumerate is not None: __run_attacks_main() @@ -704,5 +709,6 @@ if __name__ == "__main__": )) request_issue_creation() + # fix the log file before shutting down incase you want to look at it fix_log_file() shutdown() \ No newline at end of file