prehistoric-systems/Zeus-Scanner
1
0
Fork 0
mirror of https://github.com/Ekultek/Zeus-Scanner.git synced 2026-03-11 08:55:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

getting rid of the '...' at the end of the output string, got sick of typing it os now it won't be there anymore

Browse source
This commit is contained in:
ekultek 2017-12-07 07:27:20 -06:00
parent 43199d690d
commit b16a9c184a
24 changed files with 353 additions and 339 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
bin/unzip_gecko.py
View file

@ -28,7 +28,7 @@ def disclaimer():
else:
lib.core.settings.logger.fatal(lib.core.settings.set_color(
"you have not agreed with the terms of service, so "
"Zeus will shut down now...", level=50
"Zeus will shut down now", level=50
))
return False
@ -114,7 +114,7 @@ def check_xvfb(exc="Xvfb"):
"""
if whichcraft.which(exc) is None:
lib.core.settings.logger.info(lib.core.settings.set_color(
"installing Xvfb, required by pyvirutaldisplay..."
"installing Xvfb, required by pyvirutaldisplay"
))
subprocess.call(["sudo", "apt-get", "install", "xvfb"])
else:
@ -150,7 +150,7 @@ def untar_gecko(filename="{}/bin/drivers/geckodriver-v0.{}.0-linux{}.tar.gz", ve
gecko_version = config_gecko_version(ff_version)
if gecko_version is None:
lib.core.settings.logger.fatal(lib.core.settings.set_color(
"your current firefox version is not supported by Zeus...", level=50
"your current firefox version is not supported by Zeus", level=50
))
lib.core.common.shutdown()
gecko_full_filename = filename.format(os.getcwd(), gecko_version, file_arch)
@ -159,30 +159,30 @@ def untar_gecko(filename="{}/bin/drivers/geckodriver-v0.{}.0-linux{}.tar.gz", ve
tar = tarfile.open(filename.format(os.getcwd(), gecko_version, file_arch), "r:gz")
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"extracting the correct driver for your architecture...", level=10
"extracting the correct driver for your architecture", level=10
))
try:
tar.extractall("/usr/bin")
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"driver extracted into /usr/bin (you may change this, but ensure that it "
"is in your PATH)...", level=10
"is in your PATH)", level=10
))
except IOError as e:
if "Text file busy" in str(e):
lib.core.settings.logger.info(lib.core.settings.set_color(
"the driver is already installed..."
"the driver is already installed"
))
tar.close()
pass
except Exception as e:
if "[Errno 13] Permission denied: '/usr/bin/geckodriver'" in str(e):
lib.core.settings.logger.exception(lib.core.settings.set_color(
"first run must be ran as root (sudo python zeus.py)...", level=50
"first run must be ran as root (sudo python zeus.py)", level=50
))
else:
lib.core.settings.logger.exception(lib.core.settings.set_color(
"ran into exception '{}', logged to current log file...".format(e), level=50
"ran into exception '{}', logged to current log file".format(e), level=50
))
exit(-1)
tar.close()
@ -194,7 +194,7 @@ def ensure_placed(item="geckodriver", verbose=False):
"""
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"ensuring that the driver exists in your system path...", level=10
"ensuring that the driver exists in your system path", level=10
))
if not whichcraft.which(item):
lib.core.settings.logger.fatal(lib.core.settings.set_color(
@ -206,7 +206,7 @@ def ensure_placed(item="geckodriver", verbose=False):
else:
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"driver exists, continuing...", level=10
"driver exists, continuing", level=10
))
return True
@ -217,24 +217,24 @@ def main(rewrite="{}/bin/executed.txt", verbose=False):
"""
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"verifying operating system...", level=10
"verifying operating system", level=10
))
if not check_os():
raise NotImplementedError(lib.core.settings.set_color(
"as of now, Zeus requires Linux to run successfully "
"your current operating system '{}' is not implemented "
"yet...".format(platform.platform()), level=50
"yet".format(platform.platform()), level=50
))
if check_if_run():
if not disclaimer():
exit(1)
lib.core.settings.logger.info(lib.core.settings.set_color(
"seems this is your first time running the application, "
"doing setup please wait..."
"doing setup please wait"
))
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"checking if xvfb is on your system...", level=10
"checking if xvfb is on your system", level=10
))
find_tools()
check_xvfb()
@ -244,10 +244,10 @@ def main(rewrite="{}/bin/executed.txt", verbose=False):
with open(rewrite.format(os.getcwd()), "w") as rw:
rw.write("TRUE")
lib.core.settings.logger.info(lib.core.settings.set_color(
"done, continuing process..."
"done, continuing process"
))
else:
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"already ran, skipping...", level=10
"already ran, skipping", level=10
))

95
etc/checksum/md5sum.md5
View file

@ -1,4 +1,4 @@
1caf80ae9a944960ef67773c2bbdd6b2 ./zeus.py
5aefb2a3061ff01c215ef170b8832369 ./zeus.py
4b32db388e8acda35570c734d27c950c ./etc/scripts/launch_sqlmap.sh
6ad5f22ec4a6f8324bfb1b01ab6d51ec ./etc/scripts/cleanup.sh
74d7bee13890a9dd279bb857591647ce ./etc/scripts/reinstall.sh
@ -9,105 +9,110 @@
d3ad89703575a712a0aeead2b176d8c5 ./etc/html/clickjacking_test_page.html
642a77905d8bb4e5533e0e9c2137c0fa ./etc/text_files/agents.txt
82cc68f46539d0255f7ce14cd86cd49b ./etc/text_files/link_ext.txt
9659c647c725773e82d130e0f5c73c57 ./etc/text_files/dorks.txt
dc7bfc3d7b9b23340ee37806316bd770 ./etc/text_files/xss_payloads.txt
19eb1b4899140544ee5911f091e71710 ./etc/text_files/dorks.txt
cf85d83da34d70720193d83950c31fdc ./etc/text_files/xss_payloads.txt
6cabeb9919d2301efc4ba3d8869282d6 ./etc/checksum/md5sum.md5
5250f0aa13b8af4775efa506e77de1ce ./etc/xml/headers.xml
d41d8cd98f00b204e9800998ecf8427e ./bin/__init__.py
ebd255c3ab49efde3155338e5d596b63 ./bin/unzip_gecko.py
3be7ee6f4267e0d0cf2143b58792527b ./bin/paths/path_config.ini
a0e18eb30258bbab246f983b6af95d5c ./bin/unzip_gecko.py
c0d83f0b82a6b30de8811e69e6d95c61 ./bin/executed.txt
dc1eb4ebe0f372af48b5a9c107ebc68d ./bin/drivers/geckodriver-v0.18.0-linux32.tar.gz
be18faeea6e7db9db6990d8667e2298f ./bin/drivers/geckodriver-v0.17.0-linux64.tar.gz
79b1a158f96d29942a111c0905f1c807 ./bin/drivers/geckodriver-v0.17.0-linux32.tar.gz
ca6935a72fd0527d15a78a17a35e56e8 ./bin/drivers/geckodriver-v0.19.0-linux64.tar.gz
4ccb56fb3700005c9f9188f84152f21a ./bin/drivers/geckodriver-v0.18.0-linux64.tar.gz
07cd383c8aef8ea5ef194a506141afd6 ./bin/drivers/geckodriver-v0.19.0-linux32.tar.gz
785c28da8b681a7e23964f99118b5aab ./lib/tamper_scripts/obfuscateordinal_encode.py
145e4a7dc985e99962dabe3b221fc51e ./lib/tamper_scripts/obfuscateordinal_encode.py
10bf1bc4ef0287d31633148fab557e8a ./lib/tamper_scripts/uppercase_encode.py
5b68de0ce3a783b870921b09b5222146 ./lib/tamper_scripts/hex_encode.py
fcef22874b6732fd1b1bd062e18e65db ./lib/tamper_scripts/hex_encode.py
1537b3b94566aebf0f89bed074e96581 ./lib/tamper_scripts/url_encode.py
d41d8cd98f00b204e9800998ecf8427e ./lib/tamper_scripts/__init__.py
7b636a332b2e99547ec9565d8e094308 ./lib/tamper_scripts/unicode_encode.py
07a792bccd13f64873a27aee4aaa8ea6 ./lib/tamper_scripts/space2comment_encode.py
1053a0c89e514d2c94bc822d34715896 ./lib/tamper_scripts/randomcase_encode.py
349c30cbab4308bd94829d92b4e34f9d ./lib/tamper_scripts/lowercase_encode.py
6e1d6276a295f6c5d41b6f6f0e1316b0 ./lib/tamper_scripts/enclosebrackets_encode.py
694231b4c2f99406481c34ced85ddfe1 ./lib/tamper_scripts/base64_encode.py
6ac38bec8c32eab57efa01f7a06dff14 ./lib/tamper_scripts/space2null_encode.py
3b8c95a6a3b7cecce5118f2fb1ccc6b8 ./lib/tamper_scripts/appendnull_encode.py
0c5e78674a8d27e7c20af1dca8656789 ./lib/tamper_scripts/enclosebrackets_encode.py
5824916df46428a8304ee0156bcee989 ./lib/tamper_scripts/multispace2comment_encode.py
9fd42d65993aa20d1bf5acbc4d042d2e ./lib/tamper_scripts/base64_encode.py
f77b7a9a19b94e26903eeecf5a787ea3 ./lib/tamper_scripts/space2null_encode.py
3b8c95a6a3b7cecce5118f2fb1ccc6b8 ./lib/tamper_scripts/appendnull_encode.py
d41d8cd98f00b204e9800998ecf8427e ./lib/__init__.py
6299b188a730844954044887f528435a ./lib/firewall/cloudfront.py
d41d8cd98f00b204e9800998ecf8427e ./lib/firewall/__init__.py
eb3a3066efbcf87dbc10a49be445cb8f ./lib/firewall/urlscan.py
81a29a14d72980a306fbaec0dc772048 ./lib/firewall/fortigate.py
d4986f3d95a773d7c3585b07bcd6310e ./lib/firewall/sucuri.py
763af6773e920d6bdc185f5bd4df6084 ./lib/firewall/dw.py
e4514021485dbb94c3f0023b04af01ad ./lib/firewall/aws.py
eb3a3066efbcf87dbc10a49be445cb8f ./lib/firewall/urlscan.py
71744d7a95f42063a8fb6e720932cd3d ./lib/firewall/sonicwall.py
7af3ee8615c7dc761f050e0ba638eaef ./lib/firewall/armor.py
1f303641d59686d544f2986ff74c6b31 ./lib/firewall/webseal.py
78e6b01feb9bad68c2fc8a79e75930fd ./lib/firewall/yundun.py
e4eef006dd909c222b1b9f48826c3ef5 ./lib/firewall/pk.py
bf5285dc059c761e1719bc734ae8504f ./lib/firewall/varnish.py
6b370050b40d8c1d2221424f756c7842 ./lib/firewall/paloalto.py
73c1727e604ec6e00541687bfc64c0d6 ./lib/firewall/akamai.py
6bbe2f6f6a2a1ddf0e416e94ec1f0763 ./lib/firewall/siteguard.py
787e21ed577ff05b095aa0f0e5e5e9bf ./lib/firewall/cloudflare.py
c3f01fc8ff7dfe7759f63bf16b00f127 ./lib/firewall/wordfence.py
6ccf3a1df5aa6429cd3365b7b8ded8f4 ./lib/firewall/powerful.py
54815706261c32b57fbbdc99244b5cdd ./lib/firewall/modsecurity.py
5ee20e2c158d0734b4dd5a8eb47f8ea5 ./lib/firewall/squid.py
71744d7a95f42063a8fb6e720932cd3d ./lib/firewall/sonicwall.py
9070b43428bd17fd5faf86995cb559a2 ./lib/firewall/stringray.py
bf5285dc059c761e1719bc734ae8504f ./lib/firewall/varnish.py
78e6b01feb9bad68c2fc8a79e75930fd ./lib/firewall/yundun.py
cb45428e92485b759ff5cb46a0be9c73 ./lib/firewall/yunsuo.py
2f0a935d2bb9b8aa711e511f48595a81 ./lib/firewall/powerful.py
bbd8b4c6100070d420d48dc7dfc297eb ./lib/firewall/webknight.py
54815706261c32b57fbbdc99244b5cdd ./lib/firewall/modsecurity.py
9070b43428bd17fd5faf86995cb559a2 ./lib/firewall/stringray.py
5ee20e2c158d0734b4dd5a8eb47f8ea5 ./lib/firewall/squid.py
95b908a21c0ff456ae59df4c6c189c54 ./lib/firewall/wallarm.py
cb45428e92485b759ff5cb46a0be9c73 ./lib/firewall/yunsuo.py
8fc8d62377bebbfa7ca4d70a79eab115 ./lib/firewall/bigip.py
73c1727e604ec6e00541687bfc64c0d6 ./lib/firewall/akamai.py
7af3ee8615c7dc761f050e0ba638eaef ./lib/firewall/armor.py
763af6773e920d6bdc185f5bd4df6084 ./lib/firewall/dw.py
81a29a14d72980a306fbaec0dc772048 ./lib/firewall/fortigate.py
6ea65a0160c21e144e92334acc2e3667 ./lib/firewall/anquanbao.py
22a0ad8f2fa1a16b651cb5ae37ca9b0d ./lib/firewall/generic.py
ed18ed1f72f3887e63fa7ce060841e4a ./lib/plugins/aardvark.py
a8b3e6924bab72607b1d1c1a8dcb561d ./lib/plugins/4d.py
03355a122c047dc598fc271620119978 ./lib/plugins/jquery.py
d41d8cd98f00b204e9800998ecf8427e ./lib/plugins/__init__.py
353db8b22c031433ea73a12943927557 ./lib/plugins/clipbucket.py
5908a81cc9b332348b26a3ccd5ddb798 ./lib/plugins/ihtml.py
d76d2839ed8875739328bb5f2a838ba6 ./lib/plugins/360.py
16e4708c510811760129f6fb4842e92e ./lib/plugins/3dcart.py
2ce0a2101bb5706a136de83a729965f3 ./lib/plugins/b2evolution.py
b4ab6d1e0d3582fc66111988b246acc0 ./lib/plugins/bmcremedy.py
497facc7b12e6e691aab65980d8f5026 ./lib/plugins/bmcremedy.py
2dcee5bc924732dd21f16983eef9a99d ./lib/plugins/abyss.py
d2c100e6e6f7fbda8448d36a6928c979 ./lib/plugins/68classified.py
f1eb201cce16853049a615805b01bc60 ./lib/plugins/bomgar.py
ce3b79dc80e369ffd55d2cbe90e6a0ab ./lib/plugins/mssqlreportmanager.py
55ec8cde9d438a90327911910164abf2 ./lib/plugins/opengraph.py
8658f8a185499ec6d10b1d2da6104c27 ./lib/plugins/atomfeed.py
c2533d4a8dc5fdaa4b8d584588b32ec2 ./lib/plugins/html5.py
a3ed012f11ff2bffbc143fbef63d0c12 ./lib/plugins/3com.py
55d834ae87e96787807e21b65ec68bca ./lib/plugins/moodle.py
44019a327ec1db91851d652630788742 ./lib/plugins/googleapi.py
c4ac50a3f3550c62219e7e4f38d4b496 ./lib/plugins/1024.py
0b63885649f369ea410c8169e947fdab ./lib/plugins/accellion.py
76a1d1decfb872bfafdf510c656f113a ./lib/plugins/rssfeed.py
320f0db977c85b477ba1ea78b140cb8a ./lib/plugins/4images.py
35dc8b7da4becb60662aab3c48a9210b ./lib/plugins/openxchange.py
353db8b22c031433ea73a12943927557 ./lib/plugins/clipbucket.py
ce3b79dc80e369ffd55d2cbe90e6a0ab ./lib/plugins/mssqlreportmanager.py
9976a90f1b54439ead699c9e94591662 ./lib/attacks/gist_lookup/__init__.py
86224bd899c2a2438042cbdc077dc4cc ./lib/attacks/clickjacking_scan/__init__.py
6e2a1e74537869b1da3556d11bd44f56 ./lib/attacks/gist_lookup/__init__.py
bdb7ff546787d38bbbd0aac9d4a4cdf8 ./lib/attacks/clickjacking_scan/__init__.py
d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/__init__.py
4c644b0e3a62b6c1528d34a04837aa35 ./lib/attacks/sqlmap_scan/__init__.py
6e9e0a9e2c72e00d8690c0177b695d56 ./lib/attacks/sqlmap_scan/__init__.py
5e5bb575014ebe613db6bf671d008cf8 ./lib/attacks/sqlmap_scan/sqlmap_opts.py
7bc7a6f3e85651aab3588f087563eded ./lib/attacks/whois_lookup/__init__.py
8ec72bb33df998e32b925e3060d9d17a ./lib/attacks/whois_lookup/whois.py
916b768e783ff771bce80bd6f5112d4f ./lib/attacks/admin_panel_finder/__init__.py
f87f388a9ded1cd8a7e333353652c4df ./lib/attacks/xss_scan/__init__.py
6b8ad5d11aa7f1e2b5f993ca3dde1975 ./lib/attacks/nmap_scan/__init__.py
d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/whois_lookup/__init__.py
c5b69617f040fef1d5930948905aa8d0 ./lib/attacks/whois_lookup/whois.py
4fd96bb3002e949687d7ae863ee87264 ./lib/attacks/admin_panel_finder/__init__.py
352b3740b54ef13b77ec57e9e68372b5 ./lib/attacks/xss_scan/__init__.py
40ba04fb18dcbb81cb42376a825c238f ./lib/attacks/nmap_scan/__init__.py
216999fa0e84866d5c1d96d5676034e4 ./lib/attacks/nmap_scan/nmap_opts.py
58fc608d8936c34a364dd1cbf6d9f157 ./lib/header_check/__init__.py
d2f8777360a73a412ef158eff2fdf631 ./lib/core/common.py
4433353fb5c55578391d8b4006191ee8 ./lib/core/errors.py
38d8ce4aec42ec147b44a36c69b15ea8 ./lib/core/parse.py
d41d8cd98f00b204e9800998ecf8427e ./lib/core/__init__.py
695cac06efac7a656e1abc4c75c314b3 ./lib/core/settings.py
daab1cac629a5f59abfeb510d0cb9b67 ./lib/header_check/__init__.py
7ead0f672d2e6a318f0179a3c1ddf3aa ./lib/core/common.py
de4254c5e40f7aa4fb81e0608f758a2c ./lib/core/decorators.py
9a02e5b913d210350545ac26510a63c9 ./var/search/__init__.py
83928f6c090722d87a905a447cb51aed ./var/search/selenium_search.py
cfcce04aac694eee7a6c73969861ce43 ./var/search/pgp_search.py
4433353fb5c55578391d8b4006191ee8 ./lib/core/errors.py
d41d8cd98f00b204e9800998ecf8427e ./lib/core/__init__.py
7c9b60a263a48003a94355cca05faf03 ./lib/core/settings.py
57a98c7d8c20a381dcd18ccdf5e0dc0d ./lib/core/parse.py
d41d8cd98f00b204e9800998ecf8427e ./var/__init__.py
d41d8cd98f00b204e9800998ecf8427e ./var/auto_issue/__init__.py
0c11c16126baf789388a661bbbefb149 ./var/auto_issue/github.py
222102e56b3f4b9facda7ed28690d3f7 ./var/blackwidow/__init__.py
8e9092a4783a2d82f49c2dd824f11950 ./var/auto_issue/github.py
503e44b36f0bcd81e20840be5b73320e ./var/search/__init__.py
16ddba4cae577df7264b3933accf4167 ./var/search/selenium_search.py
12340de27a75273cd444f7257d354311 ./var/search/pgp_search.py
9fb35fe53091eadcad3a21589c18a87c ./var/blackwidow/__init__.py

3
etc/text_files/dorks.txt
View file

@ -68,7 +68,7 @@ ext:ics ics
ext:inc "pwd=" "UID="
ext:inc "pwd=" "UID="
ext:ini intext:env.ini
ext:ini Version=... password
ext:ini Version= password
ext:ini Version=4.0.0.4 password
ext:ini eudora.ini
ext:ini eudora.ini
@ -755,7 +755,6 @@ intitle:"Remote Desktop Web Connection" inurl:tsweb
intitle:"Retina Report" "CONFIDENTIAL INFORMATION"
intitle:"SFXAdmin - sfx_global" | intitle:"SFXAdmin - sfx_local" | intitle:"SFXAdmin - sfx_test"
intitle:"SHOUTcast Administrator" inurl:admin.cgi
intitle:"SWW link" "Please wait....."
intitle:"Samba Web Administration Tool" intext:"Help Workgroup"
intitle:"SuSE Linux Openexchange Server" "Please activate Javas?ri?t!"
intitle:"Supero Doctor III" -inurl:supermicro

46
lib/attacks/admin_panel_finder/__init__.py
View file

@ -35,7 +35,7 @@ def check_for_externals(url, data_sep="-" * 30, **kwargs):
currently_searching = ext[robots if robots else sitemap]
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"currently searching for a '{}'...".format(currently_searching), level=10
"currently searching for a '{}'".format(currently_searching), level=10
))
try:
@ -44,13 +44,13 @@ def check_for_externals(url, data_sep="-" * 30, **kwargs):
_, code, data, _ = lib.core.common.get_page(full_url)
except (TooManyRedirects, ConnectionError, ReadTimeout):
lib.core.settings.logger.error(lib.core.settings.set_color(
"connection to '{}' failed, assuming does not exist and continuing...".format(full_url), level=40
"connection to '{}' failed, assuming does not exist and continuing".format(full_url), level=40
))
return False
if code == 404:
lib.core.settings.logger.error(lib.core.settings.set_color(
"unable to connect to '{}', assuming does not exist and continuing...".format(
"unable to connect to '{}', assuming does not exist and continuing".format(
full_url
), level=40
))
@ -80,7 +80,7 @@ def check_for_externals(url, data_sep="-" * 30, **kwargs):
)
)
lib.core.settings.logger.info(lib.core.settings.set_color(
"robots.txt page will be saved into a file...", level=25
"robots.txt page will be saved into a file", level=25
))
return lib.core.common.write_to_log_file(
data, lib.core.settings.ROBOTS_PAGE_PATH, lib.core.settings.ROBOTS_TXT_FILENAME.format(
@ -89,7 +89,7 @@ def check_for_externals(url, data_sep="-" * 30, **kwargs):
)
elif sitemap:
lib.core.settings.logger.info(lib.core.settings.set_color(
"found a sitemap, saving to file...", level=25
"found a sitemap, saving to file", level=25
))
return lib.core.common.write_to_log_file(
data, lib.core.settings.SITEMAP_FILE_LOG_PATH, lib.core.settings.SITEMAP_FILENAME.format(
@ -114,12 +114,12 @@ def check_for_admin_page(url, exts, protocol="http://", **kwargs):
true_url = "{}{}{}".format(protocol, stripped_url, ext)
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"trying '{}'...".format(true_url), level=10
"trying '{}'".format(true_url), level=10
))
try:
urlopen(true_url, timeout=5)
lib.core.settings.logger.info(lib.core.settings.set_color(
"connected successfully to '{}'...".format(true_url), level=25
"connected successfully to '{}'".format(true_url), level=25
))
connections.add(true_url)
except HTTPError as e:
@ -127,7 +127,7 @@ def check_for_admin_page(url, exts, protocol="http://", **kwargs):
if verbose:
if "Access Denied" in str(e):
lib.core.settings.logger.warning(lib.core.settings.set_color(
"got access denied, possible control panel found without external access on '{}'...".format(
"got access denied, possible control panel found without external access on '{}'".format(
true_url
),
level=30
@ -137,7 +137,7 @@ def check_for_admin_page(url, exts, protocol="http://", **kwargs):
for error_code in lib.core.common.STATUS_CODES.iterkeys():
if int(data[2].split(":")[0]) == error_code:
lib.core.settings.logger.error(lib.core.settings.set_color(
"failed to connect got error code {} (reason: {})...".format(
"failed to connect got error code {} (reason: {})".format(
data[2], lib.core.common.STATUS_CODES[error_code]
), level=40
))
@ -145,33 +145,33 @@ def check_for_admin_page(url, exts, protocol="http://", **kwargs):
if verbose:
if "<urlopen error timed out>" or "timeout: timed out" in str(e):
lib.core.settings.logger.warning(lib.core.settings.set_color(
"connection timed out assuming won't connect and skipping...", level=30
"connection timed out assuming won't connect and skipping", level=30
))
else:
lib.core.settings.logger.exception(lib.core.settings.set_color(
"failed to connect with unexpected error '{}'...".format(str(e)), level=50
"failed to connect with unexpected error '{}'".format(str(e)), level=50
))
request_issue_creation()
possible_connections, connections = list(possible_connections), list(connections)
data_msg = "found {} possible connections(s) and {} successful connection(s)..."
data_msg = "found {} possible connections(s) and {} successful connection(s)"
lib.core.settings.logger.info(lib.core.settings.set_color(
data_msg.format(len(possible_connections), len(connections))
))
if len(connections) > 0:
# create the connection tree if we got some connections
lib.core.settings.logger.info(lib.core.settings.set_color(
"creating connection tree..."
"creating connection tree"
))
lib.core.settings.create_tree(url, connections)
else:
lib.core.settings.logger.fatal(lib.core.settings.set_color(
"did not receive any successful connections to the admin page of "
"{}...".format(url), level=50
"{}".format(url), level=50
))
if show_possibles:
if len(possible_connections) > 0:
lib.core.settings.logger.info(lib.core.settings.set_color(
"creating possible connection tree..."
"creating possible connection tree"
))
lib.core.settings.create_tree(url, possible_connections)
else:
@ -181,7 +181,7 @@ def check_for_admin_page(url, exts, protocol="http://", **kwargs):
))
if len(connections) > 0:
lib.core.settings.logger.warning(lib.core.settings.set_color(
"only writing successful connections to log file...", level=30
"only writing successful connections to log file", level=30
))
lib.core.common.write_to_log_file(
list(connections),
@ -211,32 +211,32 @@ def main(url, show=False, verbose=False, **kwargs):
try:
lib.core.settings.logger.info(lib.core.settings.set_color(
"parsing robots.txt..."
"parsing robots.txt"
))
results = check_for_externals(url, robots=True, batch=batch)
if not results:
lib.core.settings.logger.warning(lib.core.settings.set_color(
"seems like this page is either blocking access to robots.txt or it does not exist...", level=30
"seems like this page is either blocking access to robots.txt or it does not exist", level=30
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"checking for a sitemap..."
"checking for a sitemap"
))
check_for_externals(url, sitemap=True)
lib.core.settings.logger.info(lib.core.settings.set_color(
"loading extensions..."
"loading extensions"
))
extensions = __load_extensions()
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"loaded a total of {} extensions...".format(len(extensions)), level=10
"loaded a total of {} extensions".format(len(extensions)), level=10
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"attempting to bruteforce admin panel..."
"attempting to bruteforce admin panel"
))
if do_threading:
lib.core.settings.logger.warning(lib.core.settings.set_color(
"starting {} threads, you will not be able to end the process until "
"it is completed...".format(proc_num), level=30
"it is completed".format(proc_num), level=30
))
tasks = []
for _ in range(0, proc_num):

12
lib/attacks/clickjacking_scan/__init__.py
View file

@ -65,7 +65,7 @@ def clickjacking_main(url, **kwargs):
)
if question.lower().startswith("n"):
lib.core.settings.logger.info(lib.core.settings.set_color(
"automatically removing all queries from URL..."
"automatically removing all queries from URL"
))
url = "http://{}".format(lib.core.settings.replace_http(url, complete=True))
@ -73,14 +73,14 @@ def clickjacking_main(url, **kwargs):
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"generating HTML...", level=10
"generating HTML", level=10
))
data = scanner.generate_html()
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"HTML generated successfully...", level=10
"HTML generated successfully", level=10
))
print("{}\n{}\n{}".format("-" * 30, data, "-" * 30))
@ -90,7 +90,7 @@ def clickjacking_main(url, **kwargs):
if results:
lib.core.settings.logger.info(lib.core.settings.set_color(
"it appears that provided URL '{}' is vulnerable to clickjacking, writing "
"to HTML file...".format(url), level=25
"to HTML file".format(url), level=25
))
lib.core.common.write_to_log_file(
data,
@ -99,7 +99,7 @@ def clickjacking_main(url, **kwargs):
)
else:
lib.core.settings.logger.error(lib.core.settings.set_color(
"provided URL '{}' seems to have the correct protection from clickjacking...".format(
"provided URL '{}' seems to have the correct protection from clickjacking".format(
url
), level=40
))
@ -109,6 +109,6 @@ def clickjacking_main(url, **kwargs):
except Exception as e: # until I figure out the errors, we'll just make issues about them
lib.core.settings.logger.exception(lib.core.settings.set_color(
"Zeus failed to process the clickjacking test and received "
"error code '{}'...".format(e), level=50
"error code '{}'".format(e), level=50
))
var.auto_issue.github.request_issue_creation()

26
lib/attacks/nmap_scan/__init__.py
View file

@ -52,7 +52,7 @@ class NmapHook(object):
"""
# have to create a spacer or the output comes out funky..
spacer_data = {4: " " * 8, 6: " " * 6, 8: " " * 4}
lib.core.settings.logger.info(lib.core.settings.set_color("finding data for IP '{}'...".format(self.ip)))
lib.core.settings.logger.info(lib.core.settings.set_color("finding data for IP '{}'".format(self.ip)))
json_data = json.loads(json_data)["scan"]
host = json_data[self.ip]["hostnames"][0]["name"]
host_skip = (not len(host) == 0, " ", "", None)
@ -99,35 +99,35 @@ def perform_port_scan(url, scanner=NmapHook, **kwargs):
with lib.core.decorators.TimeOut(seconds=timeout_time):
lib.core.settings.logger.warning(lib.core.settings.set_color(
"if the port scan is not completed in {}(m) it will timeout...".format(
"if the port scan is not completed in {}(m) it will timeout".format(
lib.core.settings.convert_to_minutes(timeout_time)
), level=30
))
url = url.strip()
lib.core.settings.logger.info(lib.core.settings.set_color(
"attempting to find IP address for hostname '{}'...".format(url)
"attempting to find IP address for hostname '{}'".format(url)
))
try:
found_ip_address = socket.gethostbyname(url)
except socket.gaierror:
lib.core.settings.logger.fatal(lib.core.settings.set_color(
"failed to gather IP address for URL '{}'...".format(url)
"failed to gather IP address for URL '{}'".format(url)
))
return
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"checking for nmap on your system...", level=10
"checking for nmap on your system", level=10
))
nmap_exists = "".join(find_nmap())
if nmap_exists:
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"nmap has been found under '{}'...".format(nmap_exists), level=10
"nmap has been found under '{}'".format(nmap_exists), level=10
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"starting port scan on IP address '{}'...".format(found_ip_address)
"starting port scan on IP address '{}'".format(found_ip_address)
))
try:
data = scanner(found_ip_address, opts=opts)
@ -135,11 +135,11 @@ def perform_port_scan(url, scanner=NmapHook, **kwargs):
data.show_open_ports(json_data)
file_path = data.send_to_file(json_data)
lib.core.settings.logger.info(lib.core.settings.set_color(
"port scan completed, all data saved to JSON file under '{}'...".format(file_path)
"port scan completed, all data saved to JSON file under '{}'".format(file_path)
))
except KeyError:
lib.core.settings.logger.fatal(lib.core.settings.set_color(
"no port information found for '{}({})'...".format(
"no port information found for '{}({})'".format(
url, found_ip_address
), level=50
))
@ -150,20 +150,20 @@ def perform_port_scan(url, scanner=NmapHook, **kwargs):
lib.core.settings.logger.error(lib.core.settings.set_color(
"port scan is taking to long and has hit the timeout, you "
"can increase this time by passing the --time-sec flag (IE "
"--time-sec 300)...", level=40
"--time-sec 300)", level=40
))
except Exception as e:
lib.core.settings.logger.exception(lib.core.settings.set_color(
"ran into exception '{}', cannot continue quitting...".format(e), level=50
"ran into exception '{}', cannot continue quitting".format(e), level=50
))
request_issue_creation()
pass
else:
lib.core.settings.logger.fatal(lib.core.settings.set_color(
"nmap was not found on your system...", level=50
"nmap was not found on your system", level=50
))
lib.core.common.run_fix(
"would you like to automatically install it",
"sudo sh {}".format(lib.core.settings.NMAP_INSTALLER_TOOL),
"nmap is not installed, please install it in order to continue..."
"nmap is not installed, please install it in order to continue"
)

34
lib/attacks/sqlmap_scan/__init__.py
View file

@ -111,7 +111,7 @@ class SqlmapHook(object):
if current_status != "running":
raise lib.core.errors.SqlmapFailedStart(
"sqlmap API failed to start the run, check the client and see what "
"the problem is and try again..."
"the problem is and try again"
)
already_displayed = set()
while current_status == "running":
@ -156,7 +156,7 @@ def sqlmap_scan_main(url, port=None, verbose=None, opts=None, auto_start=False):
if auto_start:
lib.core.settings.logger.info(lib.core.settings.set_color(
"attempting to launch sqlmap API..."
"attempting to launch sqlmap API"
))
sqlmap_api_command = shlex.split("sudo sh {} p {}".format(
lib.core.settings.LAUNCH_SQLMAP_API_TOOL, "".join(found_path)
@ -164,58 +164,58 @@ def sqlmap_scan_main(url, port=None, verbose=None, opts=None, auto_start=False):
subprocess.Popen(sqlmap_api_command, stdout=subprocess.PIPE)
if is_started:
lib.core.settings.logger.info(lib.core.settings.set_color(
"sqlmap API is up and running, continuing process..."
"sqlmap API is up and running, continuing process"
))
else:
lib.core.settings.logger.error(lib.core.settings.set_color(
"there was a problem starting sqlmap API...", level=40
"there was a problem starting sqlmap API", level=40
))
lib.core.common.prompt(
"manually start the API and press enter when ready..."
"manually start the API and press enter when ready"
)
else:
if not is_started:
lib.core.common.prompt(
"sqlmap API is not started, start it and press enter to continue..."
"sqlmap API is not started, start it and press enter to continue"
)
try:
sqlmap_scan = SqlmapHook(url, port=port)
lib.core.settings.logger.info(lib.core.settings.set_color(
"initializing new sqlmap scan with given URL '{}'...".format(url)
"initializing new sqlmap scan with given URL '{}'".format(url)
))
sqlmap_scan.init_new_scan()
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"scan initialized...", level=10
"scan initialized", level=10
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"gathering sqlmap API scan ID..."
"gathering sqlmap API scan ID"
))
api_id = sqlmap_scan.get_scan_id()
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"current sqlmap scan ID: '{}'...".format(api_id), level=10
"current sqlmap scan ID: '{}'".format(api_id), level=10
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"starting sqlmap scan on url: '{}'...".format(url), level=25
"starting sqlmap scan on url: '{}'".format(url), level=25
))
if opts:
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"using arguments: '{}'...".format(opts), level=10
"using arguments: '{}'".format(opts), level=10
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"adding arguments to sqlmap API..."
"adding arguments to sqlmap API"
))
else:
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"no arguments passed, skipping...", level=10
"no arguments passed, skipping", level=10
))
lib.core.settings.logger.warning(lib.core.settings.set_color(
"please keep in mind that this is the API, output will "
"not be saved to log file, it may take a little longer "
"to finish processing, launching sqlmap...", level=30
"to finish processing, launching sqlmap", level=30
))
sqlmap_scan.start_scan(api_id, opts=opts)
print("-" * 30)
@ -224,7 +224,7 @@ def sqlmap_scan_main(url, port=None, verbose=None, opts=None, auto_start=False):
except requests.exceptions.HTTPError as e:
lib.core.settings.logger.exception(lib.core.settings.set_color(
"ran into error '{}', seems you didn't start the server, check "
"the server port and try again...".format(e), level=50
"the server port and try again".format(e), level=50
))
pass
except KeyboardInterrupt:
@ -236,7 +236,7 @@ def sqlmap_scan_main(url, port=None, verbose=None, opts=None, auto_start=False):
"sqlmap API is not started, did you forget to start it? "
"You will need to open a new terminal, cd into sqlmap, and "
"run `python sqlmapapi.py -s` otherwise pass the correct flags "
"to auto start the API...", level=40
"to auto start the API", level=40
))
pass
else:

10
lib/attacks/whois_lookup/whois.py
View file

@ -74,7 +74,7 @@ def whois_lookup_main(domain, **kwargs):
try:
lib.core.settings.logger.info(lib.core.settings.set_color(
"performing WhoIs lookup on given domain '{}'...".format(domain)
"performing WhoIs lookup on given domain '{}'".format(domain)
))
if timeout is not None:
time.sleep(timeout)
@ -82,14 +82,14 @@ def whois_lookup_main(domain, **kwargs):
raw_information = gather_raw_whois_info(domain)
except Exception:
lib.core.settings.logger.error(lib.core.settings.set_color(
"unable to produce information from WhoIs lookup...", level=40
"unable to produce information from WhoIs lookup", level=40
))
return None
lib.core.settings.logger.info(lib.core.settings.set_color(
"discovered raw information...", level=25
"discovered raw information", level=25
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"gathering interesting information..."
"gathering interesting information"
))
interesting_data = get_interesting(raw_information)
if verbose:
@ -97,7 +97,7 @@ def whois_lookup_main(domain, **kwargs):
human_readable_display(domain, interesting_data)
except (ValueError, Exception):
lib.core.settings.logger.error(lib.core.settings.set_color(
"unable to display any information from WhoIs lookup on domain '{}'...".format(domain), level=50
"unable to display any information from WhoIs lookup on domain '{}'".format(domain), level=50
))
return None
lib.core.common.write_to_log_file(

36
lib/attacks/xss_scan/__init__.py
View file

@ -40,7 +40,7 @@ def __tamper_payload(payload, tamper_type, warning=True, **kwargs):
if warning:
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"tampering payload with '{}'...".format(tamper), level=10
"tampering payload with '{}'".format(tamper), level=10
))
if tamper in acceptable:
tamper_name = "lib.tamper_scripts.{}_encode"
@ -74,7 +74,7 @@ def create_urls(url, payload_list, tamper=None, verbose=False):
payload = __tamper_payload(payload, tamper_type=tamper, warning=False, verbose=verbose)
except InvalidTamperProvided:
lib.core.settings.logger.warning(lib.core.settings.set_color(
"you provided and invalid tamper script, acceptable tamper scripts are: {}...".format(
"you provided and invalid tamper script, acceptable tamper scripts are: {}".format(
" | ".join(list_tamper_scripts()), level=40
)
))
@ -96,7 +96,7 @@ def find_xss_script(url, **kwargs):
else:
retval = data[payload_parser["query"]]
# just double checking...
# just double checking
if retval == "" or None:
retval = data[payload_parser["path"]]
return retval
@ -114,7 +114,7 @@ def scan_xss(url, agent=None, proxy=None):
if url_verification.search(url) is None:
lib.core.settings.logger.warning(lib.core.settings.set_color(
"protocol missing from URL, automatically assigning protocol...", level=30
"protocol missing from URL, automatically assigning protocol", level=30
))
url = auto_assign.format(url)
@ -160,30 +160,30 @@ def main_xss(start_url, proxy=None, agent=None, **kwargs):
try:
if tamper:
lib.core.settings.logger.info(lib.core.settings.set_color(
"tampering payloads with '{}'...".format(tamper)
"tampering payloads with '{}'".format(tamper)
))
find_xss_script(start_url)
lib.core.settings.logger.info(lib.core.settings.set_color(
"loading payloads..."
"loading payloads"
))
payloads = __load_payloads()
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"a total of {} payloads loaded...".format(len(payloads)), level=10
"a total of {} payloads loaded".format(len(payloads)), level=10
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"payloads will be written to a temporary file and read from there..."
"payloads will be written to a temporary file and read from there"
))
filename = create_urls(start_url, payloads, tamper=tamper, verbose=verbose)
lib.core.settings.logger.info(lib.core.settings.set_color(
"loaded URL's have been saved to '{}'...".format(filename), level=25
"loaded URL's have been saved to '{}'".format(filename), level=25
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"testing for XSS vulnerabilities on host '{}'...".format(start_url)
"testing for XSS vulnerabilities on host '{}'".format(start_url)
))
if proxy is not None:
lib.core.settings.logger.info(lib.core.settings.set_color(
"using proxy '{}'...".format(proxy)
"using proxy '{}'".format(proxy)
))
success = set()
with open(filename) as urls:
@ -194,31 +194,31 @@ def main_xss(start_url, proxy=None, agent=None, **kwargs):
result = scan_xss(url, proxy=proxy, agent=agent)
if verbose:
lib.core.settings.logger.info(lib.core.settings.set_color(
"trying payload '{}'...".format(payload)
"trying payload '{}'".format(payload)
))
if result[0] != "sqli" and result[0] is True:
success.add(url)
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"payload '{}' appears to be usable...".format(payload), level=15
"payload '{}' appears to be usable".format(payload), level=15
))
elif result[0] is "sqli":
if i <= 1:
lib.core.settings.logger.error(lib.core.settings.set_color(
"loaded URL '{}' threw a DBMS error and appears to be injectable, test for "
"SQL injection, backend DBMS appears to be '{}'...".format(
"SQL injection, backend DBMS appears to be '{}'".format(
url, result[1]
), level=40
))
else:
if verbose:
lib.core.settings.logger.error(lib.core.settings.set_color(
"SQL error discovered...", level=40
"SQL error discovered", level=40
))
else:
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"host '{}' does not appear to be vulnerable to XSS attacks with payload '{}'...".format(
"host '{}' does not appear to be vulnerable to XSS attacks with payload '{}'".format(
start_url, payload
), level=10
))
@ -228,7 +228,7 @@ def main_xss(start_url, proxy=None, agent=None, **kwargs):
requests.exceptions.ReadTimeout
):
lib.core.settings.logger.error(lib.core.settings.set_color(
"payload '{}' caused a connection error, assuming no good and continuing...".format(payload), level=40
"payload '{}' caused a connection error, assuming no good and continuing".format(payload), level=40
))
if len(success) != 0:
@ -238,7 +238,7 @@ def main_xss(start_url, proxy=None, agent=None, **kwargs):
lib.core.settings.create_tree(start_url, list(success))
else:
lib.core.settings.logger.error(lib.core.settings.set_color(
"host '{}' does not appear to be vulnerable to XSS attacks...".format(start_url), level=40
"host '{}' does not appear to be vulnerable to XSS attacks".format(start_url), level=40
))
question_msg = "would you like to keep the created URLs saved for further testing"
if not batch:

8
lib/core/common.py
View file

@ -162,7 +162,7 @@ def write_to_log_file(data_to_write, path, filename, blacklist=False):
items = log.readlines()
if any(d.strip() == data_to_write for d in items):
lib.core.settings.logger.info(lib.core.settings.set_color(
"query already in blacklist..."
"query already in blacklist"
))
return full_file_path
else:
@ -181,7 +181,7 @@ def write_to_log_file(data_to_write, path, filename, blacklist=False):
else:
log.write(data_to_write + "\n")
lib.core.settings.logger.info(lib.core.settings.set_color(
"successfully wrote found items to '{}'...".format(full_file_path)
"successfully wrote found items to '{}'".format(full_file_path)
))
return full_file_path
@ -276,7 +276,7 @@ def run_fix(message, command, fail_message, exit_process=False):
subprocess.call(cmd)
if exit_process:
lib.core.settings.logger.info(lib.core.settings.set_color(
"command completed successfully, should be safe to re-run Zeus..."
"command completed successfully, should be safe to re-run Zeus"
))
else:
lib.core.settings.logger.fatal(lib.core.settings.set_color(
@ -331,7 +331,7 @@ def get_page(url, **kwargs):
if proxy is not None and "127.0.0.1" in proxy:
lib.core.settings.logger.warning(lib.core.settings.set_color(
"timeout has been set to 40s due to Tor being used..."
"timeout has been set to 40s due to Tor being used"
))
req = requests.get(url, params=headers, proxies=proxies, verify=False, timeout=40)
else:

6
lib/core/parse.py
View file

@ -221,7 +221,7 @@ class ZeusParser(OptionParser):
)
print("\n")
lib.core.settings.logger.info(lib.core.settings.set_color(
"for more information about sqlmap arguments, see here '{}'...".format(
"for more information about sqlmap arguments, see here '{}'".format(
lib.core.settings.SQLMAP_MAN_PAGE_URL
)
))
@ -240,7 +240,7 @@ class ZeusParser(OptionParser):
)
print("\n")
lib.core.settings.logger.info(lib.core.settings.set_color(
"for more information on what the arguments do please see here '{}'...".format(
"for more information on what the arguments do please see here '{}'".format(
lib.core.settings.NMAP_MAN_PAGE_URL
)
))
@ -249,7 +249,7 @@ class ZeusParser(OptionParser):
# update the program
if opt.updateZeus:
lib.core.settings.logger.info(lib.core.settings.set_color(
"update in progress..."
"update in progress"
))
lib.core.settings.update_zeus()
lib.core.common.shutdown()

52
lib/core/settings.py
View file

@ -45,7 +45,7 @@ CLONE = "https://github.com/ekultek/zeus-scanner.git"
ISSUE_LINK = "https://github.com/ekultek/zeus-scanner/issues"
# current version <major.minor.commit.patch ID>
VERSION = "1.4.3.{}".format(PATCH_ID)
VERSION = "1.4.4.{}".format(PATCH_ID)
# colors to output depending on the version
VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30}
@ -465,7 +465,7 @@ def setup(verbose=False):
"""
if verbose:
logger.debug(set_color(
"checking if the application has been run before...", level=10
"checking if the application has been run before", level=10
))
bin.unzip_gecko.main(verbose=verbose)
@ -513,12 +513,12 @@ def grab_random_agent(agent_path="{}/etc/text_files/agents.txt", verbose=False):
"""
if verbose:
logger.debug(set_color(
"grabbing random user-agent from '{}'...".format(agent_path.format(os.getcwd())), level=10
"grabbing random user-agent from '{}'".format(agent_path.format(os.getcwd())), level=10
))
with open(agent_path.format(os.getcwd())) as agents:
retval = random.choice(agents.readlines())
logger.info(set_color(
"random agent being used '{}'...".format(retval.strip())
"random agent being used '{}'".format(retval.strip())
))
return retval.strip()
@ -555,7 +555,7 @@ def update_zeus():
return os.system("git pull origin master")
else:
logger.fatal(set_color(
"no git repository found in directory, unable to update automatically..."
"no git repository found in directory, unable to update automatically"
))
@ -613,21 +613,21 @@ def get_browser_version():
obtain the firefox browser version, this is necessary because zeus can only handle certain versions.
"""
logger.info(set_color(
"attempting to get firefox browser version..."
"attempting to get firefox browser version"
))
try:
firefox_version_command = shlex.split("firefox --version")
output = subprocess.check_output(firefox_version_command)
except (OSError, Exception):
logger.error(set_color(
"failed to run firefox...", level=50
"failed to run firefox", level=50
))
return "failed to start"
try:
major, minor = map(int, re.search(r"(\d+).(\d+)", output).groups())
except (ValueError, Exception):
logger.error(set_color(
"failed to parse '{}' for version number...".format(output), level=50
"failed to parse '{}' for version number".format(output), level=50
))
return "failed to gather"
return major, minor
@ -647,7 +647,7 @@ def config_headers(**kwargs):
elif rand_proxy is not None:
if verbose:
logger.debug(set_color(
"loading random proxy from '{}'...".format(rand_proxy), level=10
"loading random proxy from '{}'".format(rand_proxy), level=10
))
with open(rand_proxy) as proxies:
possible = proxies.readlines()
@ -693,8 +693,8 @@ def config_search_engine(**kwargs):
ddg = kwargs.get("ddg", False)
enum = kwargs.get("enum", None)
non_default_msg = "specified to use non-default search engine..."
se_message = "using '{}' as the search engine..."
non_default_msg = "specified to use non-default search engine"
se_message = "using '{}' as the search engine"
if ddg:
if verbose:
logger.debug(set_color(
@ -706,7 +706,7 @@ def config_search_engine(**kwargs):
se = AUTHORIZED_SEARCH_ENGINES["duckduckgo"]
elif aol:
logger.warning(set_color(
"AOL will take a little longer due to pop-ups...", level=30
"AOL will take a little longer due to pop-ups", level=30
))
if verbose:
logger.debug(set_color(
@ -727,16 +727,16 @@ def config_search_engine(**kwargs):
se = AUTHORIZED_SEARCH_ENGINES["bing"]
elif enum is not None:
logger.info(set_color(
"running enumeration on given file '{}'...".format(enum)
"running enumeration on given file '{}'".format(enum)
))
se = None
else:
if verbose:
logger.debug(set_color(
"using default search engine (Google)...", level=10
"using default search engine (Google)", level=10
))
logger.info(set_color(
"using default search engine..."
"using default search engine"
))
se = AUTHORIZED_SEARCH_ENGINES["google"]
return se
@ -753,7 +753,7 @@ def create_arguments(**kwargs):
conf_file = kwargs.get("conf", None)
logger.info(set_color(
"creating arguments for {}...".format("sqlmap" if sqlmap else "nmap")
"creating arguments for {}".format("sqlmap" if sqlmap else "nmap")
))
retval = []
splitter = {"sqlmap": ",", "nmap": "|"}
@ -765,7 +765,7 @@ def create_arguments(**kwargs):
if o.lower() == opt[0]:
retval.append((o, opt[1]))
elif sqlmap:
warn_msg = "option '{}' is not recognized by sqlmap API, skipping..."
warn_msg = "option '{}' is not recognized by sqlmap API, skipping"
if sqlmap_args is not None:
for line in sqlmap_args.split(splitter["sqlmap"]):
try:
@ -788,7 +788,7 @@ def create_arguments(**kwargs):
))
elif nmap:
warning_msg = "option {} is not known by the nmap api, skipping..."
warning_msg = "option {} is not known by the nmap api, skipping"
if nmap_args is not None:
for line in nmap_args.split(splitter["nmap"]):
try:
@ -826,7 +826,7 @@ def create_random_ip():
if generated == "0.0.0.0" or "255.255.255.255":
generated = __get_nodes() # if it isn't a real IP regenerate it
logger.info(set_color(
"random IP address generated for header '{}'...".format(generated)
"random IP address generated for header '{}'".format(generated)
))
return generated
@ -854,7 +854,7 @@ def check_for_protection(protected, attack_type):
if attack_type in items or "all" in items:
logger.warning(set_color(
"provided target seems to have protection against this attack type...", level=30
"provided target seems to have protection against this attack type", level=30
))
protected.clear() # clear the set
return True
@ -868,7 +868,7 @@ def deprecation(target_version, method, connect=True, *args, **kwargs):
print(
"[{} DEPRECATION] {}".format(
time.strftime("%H:%M:%S"), set_color(
"{} will be deprecated by version {}...".format(
"{} will be deprecated by version {}".format(
method.__name__, target_version
), level=35
)
@ -880,7 +880,7 @@ def deprecation(target_version, method, connect=True, *args, **kwargs):
"[{} DEPRECATION] {}".format(
time.strftime("%H:%M:%S"), set_color(
"{} has been deprecated and will no longer work, "
"this attack type will be completely removed by v{}...".format(
"this attack type will be completely removed by v{}".format(
method.__name__, target_version
), level=35
)
@ -896,10 +896,10 @@ def check_thread_num(number, batch=False, default=5):
logger.warning(set_color(
"you have specified {} threads, it is highly advised to not go over {} threads, "
"doing so will most likely not give a significant performance increase and also "
"will most likely cause unforeseen issues...".format(number, MAX_THREADS), level=30
"will most likely cause unforeseen issues".format(number, MAX_THREADS), level=30
))
question_msg = "would you like to continue anyways"
default_msg = "defaulting to 5 threads..."
default_msg = "defaulting to 5 threads"
if not batch:
question = lib.core.common.prompt(
question_msg, opts="yN"
@ -969,7 +969,7 @@ def run_attacks(url, **kwargs):
"as of now only 1 attack is supported at a time, choose "
"your attack and try again. You can use the -f flag if "
"you do not want to complete an entire search again "
"(IE -f /home/me/zeus-scanner/log/url-log/url-log-1.log)...", level=40
"(IE -f /home/me/zeus-scanner/log/url-log/url-log-1.log)", level=40
))
lib.core.common.shutdown()
@ -1030,7 +1030,7 @@ def run_attacks(url, **kwargs):
pass
else:
logger.warning(set_color(
"skipping '{}'...".format(url), level=30
"skipping '{}'".format(url), level=30
))

84
lib/header_check/__init__.py
View file

@ -16,7 +16,8 @@ from lib.core.common import (
shutdown,
pause,
get_page,
HTTP_HEADER
HTTP_HEADER,
STATUS_CODES
)
from lib.core.settings import (
logger, set_color,
@ -56,11 +57,6 @@ def get_charset(html, headers, **kwargs):
def detect_protection(url, status, html, headers, **kwargs):
verbose = kwargs.get("verbose", False)
if verbose:
logger.debug(set_color(
"attempting connection to '{}'...".format(url), level=10
))
try:
# make sure there are no DBMS errors in the HTML
for dbms in DBMS_ERRORS:
@ -69,7 +65,7 @@ def detect_protection(url, status, html, headers, **kwargs):
logger.warning(set_color(
"it appears that the WAF/IDS/IPS check threw a DBMS error and may be vulnerable "
"to SQL injection attacks. it appears the backend DBMS is '{}', site will be "
"saved for further processing...".format(dbms), level=30
"saved for further processing".format(dbms), level=30
))
write_to_log_file(url, SQLI_SITES_FILEPATH, SQLI_FOUND_FILENAME)
return None
@ -80,7 +76,7 @@ def detect_protection(url, status, html, headers, **kwargs):
item = item[:-3]
if verbose:
logger.debug(set_color(
"loading script '{}'...".format(item), level=10
"loading script '{}'".format(item), level=10
))
detection_name = "lib.firewall.{}"
detection_name = detection_name.format(item)
@ -93,7 +89,7 @@ def detect_protection(url, status, html, headers, **kwargs):
del retval[retval.index("Generic (Unknown)")]
except (Exception, IndexError):
logger.warning(set_color(
"multiple firewalls identified ({}), displaying most likely...".format(
"multiple firewalls identified ({}), displaying most likely".format(
", ".join([item.split("(")[0] for item in retval])
), level=30
))
@ -104,7 +100,7 @@ def detect_protection(url, status, html, headers, **kwargs):
logger.warning(set_color(
"discovered firewall is unknown to Zeus, saving fingerprint to file. "
"if you know the details or the context of the firewall please create "
"an issue ({}) with the fingerprint, or a pull request with the script...".format(
"an issue ({}) with the fingerprint, or a pull request with the script".format(
ISSUE_LINK
), level=30
))
@ -119,12 +115,12 @@ def detect_protection(url, status, html, headers, **kwargs):
except Exception as e:
if any(err in str(e) for err in ["Read timed out.", "Connection reset by peer"]):
logger.warning(set_color(
"detection request failed, assuming no protection and continuing...", level=30
"detection request failed, assuming no protection and continuing", level=30
))
return None
else:
logger.exception(set_color(
"Zeus ran into an unexpected error '{}'...".format(e), level=50
"Zeus ran into an unexpected error '{}'".format(e), level=50
))
request_issue_creation()
return None
@ -141,7 +137,7 @@ def detect_plugins(html, headers, **kwargs):
plugin = plugin[:-3]
if verbose:
logger.debug(set_color(
"loading script '{}'...".format(plugin), level=10
"loading script '{}'".format(plugin), level=10
))
plugin_detection = "lib.plugins.{}"
plugin_detection = plugin_detection.format(plugin)
@ -155,12 +151,12 @@ def detect_plugins(html, headers, **kwargs):
logger.exception(str(e))
if "Read timed out." or "Connection reset by peer" in str(e):
logger.warning(set_color(
"plugin request failed, assuming no plugins and continuing...", level=30
"plugin request failed, assuming no plugins and continuing", level=30
))
return None
else:
logger.exception(set_color(
"plugin detection has failed with error {}...".format(str(e))
"plugin detection has failed with error {}".format(str(e))
))
request_issue_creation()
@ -185,7 +181,7 @@ def load_headers(url, req, **kwargs):
if len(req.cookies) > 0:
logger.info(set_color(
"found a request cookie, saving to file...", level=25
"found a request cookie, saving to file", level=25
))
try:
cookie_start = req.cookies.keys()
@ -251,6 +247,7 @@ def main_header_check(url, **kwargs):
identify_waf = kwargs.get("identify_waf", True)
identify_plugins = kwargs.get("identify_plugins", True)
show_description = kwargs.get("show_description", False)
attempts = kwargs.get("attempts", 3)
default_sleep_time = 5
protection = {"hostname": url}
@ -269,65 +266,70 @@ def main_header_check(url, **kwargs):
req, status, html, headers = get_page(url, proxy=proxy, agent=agent, xforward=xforward)
logger.info(set_color(
"detecting target charset..."
"detecting target charset"
))
charset = get_charset(url, headers)
charset = get_charset(html, headers)
if charset is not None:
logger.info(set_color(
"target charset appears to be '{}'...".format(charset), level=25
"target charset appears to be '{}'".format(charset), level=25
))
else:
logger.warning(set_color(
"unable to detect target charset...", level=30
"unable to detect target charset", level=30
))
if identify_waf:
waf_url = "{} {}".format(url, PROTECTION_CHECK_PAYLOAD)
waf_url = "{} {}".format(url.strip(), PROTECTION_CHECK_PAYLOAD)
_, waf_status, waf_html, waf_headers = get_page(waf_url, xforward=xforward, proxy=proxy, agent=agent)
logger.info(set_color(
"checking if target URL is protected by some kind of WAF/IPS/IDS..."
"checking if target URL is protected by some kind of WAF/IPS/IDS"
))
if verbose:
logger.debug(set_color(
"attempting connection to '{}'".format(waf_url), level=10
))
identified_waf = detect_protection(url, waf_status, waf_html, waf_headers, verbose=verbose)
if identified_waf is None:
logger.info(set_color(
"no WAF/IDS/IPS has been identified on target URL...", level=25
"no WAF/IDS/IPS has been identified on target URL", level=25
))
else:
logger.warning(set_color(
"the target URL WAF/IDS/IPS has been identified as '{}'...".format(identified_waf), level=35
"the target URL WAF/IDS/IPS has been identified as '{}'".format(identified_waf), level=35
))
if identify_plugins:
logger.info(set_color(
"attempting to identify plugins..."
"attempting to identify plugins"
))
identified_plugin = detect_plugins(html, headers, verbose=verbose)
if identified_plugin is not None:
for plugin in identified_plugin:
if show_description:
logger.info(set_color(
"possible plugin identified as '{}' (description: '{}')...".format(
"possible plugin identified as '{}' (description: '{}')".format(
plugin[0], plugin[1]
), level=25
))
else:
logger.info(set_color(
"possible plugin identified as '{}'...".format(
"possible plugin identified as '{}'".format(
plugin[0]
), level=25
))
else:
logger.warning(set_color(
"no known plugins identified on target...", level=30
"no known plugins identified on target", level=30
))
if verbose:
logger.debug(set_color(
"loading XML data...", level=10
"loading XML data", level=10
))
comparable_headers = load_xml_data(HEADER_XML_DATA)
logger.info(set_color(
"attempting to get request headers for '{}'...".format(url.strip())
"attempting to get request headers for '{}'".format(url.strip())
))
try:
found_headers = load_headers(url, req)
@ -336,52 +338,56 @@ def main_header_check(url, **kwargs):
found_headers = None
else:
logger.exception(set_color(
"Zeus has hit an unexpected error and cannot continue '{}'...".format(e), level=50
"Zeus has hit an unexpected error and cannot continue '{}'".format(e), level=50
))
request_issue_creation()
if found_headers is not None:
if verbose:
logger.debug(set_color(
"fetched {}...".format(found_headers), level=10
"fetched {}".format(found_headers), level=10
))
headers_established = [str(h) for h in compare_headers(found_headers, comparable_headers)]
for key in definition.iterkeys():
if any(key in h.lower() for h in headers_established):
logger.warning(set_color(
"provided target has {}...".format(definition[key][0]), level=30
"provided target has {}".format(definition[key][0]), level=30
))
for key in found_headers.iterkeys():
protection[key] = found_headers[key]
logger.info(set_color(
"writing found headers to log file...", level=25
"writing found headers to log file", level=25
))
return write_to_log_file(protection, HEADER_RESULT_PATH, HEADERS_FILENAME.format(replace_http(url)))
else:
logger.error(set_color(
"unable to retrieve headers for site '{}'...".format(url.strip()), level=40
"unable to retrieve headers for site '{}'".format(url.strip()), level=40
))
except ConnectionError:
attempts = attempts - 1
if attempts == 0:
return False
logger.warning(set_color(
"target actively refused the connection, sleeping for {}s and retrying...".format(
"target actively refused the connection, sleeping for {}s and retrying the request".format(
default_sleep_time
), level=30
))
time.sleep(default_sleep_time)
main_header_check(
url, proxy=proxy, agent=agent, xforward=xforward, show_description=show_description,
identify_plugins=identify_plugins, identify_waf=identify_waf, verbose=verbose
identify_plugins=identify_plugins, identify_waf=identify_waf, verbose=verbose,
attempts=attempts
)
except ReadTimeout:
logger.error(set_color(
"meta-data retrieval failed due to target URL timing out, skipping...", level=40
"meta-data retrieval failed due to target URL timing out, skipping", level=40
))
except KeyboardInterrupt:
if not pause():
shutdown()
except Exception as e:
logger.exception(set_color(
"meta-data retrieval failed with unexpected error '{}'...".format(
"meta-data retrieval failed with unexpected error '{}'".format(
str(e)
), level=50
))

2
lib/tamper_scripts/base64_encode.py
View file

@ -11,6 +11,6 @@ def tamper(payload, **kwargs):
if warning:
logger.warning(set_color(
"base64 tamper scripts may increase the possibility of not finding vulnerabilities "
"in otherwise vulnerable sites...", level=30
"in otherwise vulnerable sites", level=30
))
return base64.b64encode(payload)

2
lib/tamper_scripts/enclosebrackets_encode.py
View file

@ -12,7 +12,7 @@ def tamper(payload, **kwargs):
if warning:
logger.warning(set_color(
"enclosing brackets is meant to be used as an obfuscation "
"against an already valid vulnerable site...", level=30
"against an already valid vulnerable site", level=30
))
to_enclose = string.digits

2
lib/tamper_scripts/hex_encode.py
View file

@ -8,7 +8,7 @@ def tamper(payload, **kwargs):
warning = kwargs.get("warning", True)
if warning:
logger.warning(set_color(
"hex tamper scripts may increase the risk of false positives...", level=30
"hex tamper scripts may increase the risk of false positives", level=30
))
retval = hex(hash(payload))
if "-" in str(retval):

2
lib/tamper_scripts/obfuscateordinal_encode.py
View file

@ -10,7 +10,7 @@ def tamper(payload, **kwargs):
if warning:
logger.warning(set_color(
"obfuscating the payloads by ordinal equivalents may increase the risk "
"of false positives...", level=30
"of false positives", level=30
))
retval = ""

2
lib/tamper_scripts/space2null_encode.py
View file

@ -9,7 +9,7 @@ def tamper(payload, **kwargs):
if warning:
logger.warning(set_color(
"NULL encoding tamper scripts may increase the possibility of not finding vulnerabilities "
"in otherwise vulnerable sites...", level=30
"in otherwise vulnerable sites", level=30
))
retval = ""

18
var/auto_issue/github.py
View file

@ -40,7 +40,7 @@ def request_issue_creation():
if not lib.core.settings.get_md5sum():
lib.core.settings.logger.fatal(lib.core.settings.set_color(
"it appears that your checksums did not match, therefore it is assumed "
"that you have edited some of the code, issue request denied...", level=50
"that you have edited some of the code, issue request denied", level=50
))
lib.core.common.shutdown()
@ -49,18 +49,18 @@ def request_issue_creation():
)
if question.lower().startswith("n"):
lib.core.settings.logger.error(lib.core.settings.set_color(
"Zeus has experienced an internal error and cannot continue, shutting down...", level=40
"Zeus has experienced an internal error and cannot continue, shutting down", level=40
))
lib.core.common.shutdown()
lib.core.settings.fix_log_file()
lib.core.settings.logger.info(lib.core.settings.set_color(
"Zeus got an unexpected error and will automatically create an issue for this error, please wait..."
"Zeus got an unexpected error and will automatically create an issue for this error, please wait"
))
def __extract_stacktrace(file_data):
lib.core.settings.logger.info(lib.core.settings.set_color(
"extracting traceback from log file..."
"extracting traceback from log file"
))
retval, buff_mode, _buffer = [], False, ""
with open(file_data, "r+") as log:
@ -73,12 +73,12 @@ def request_issue_creation():
_buffer = ""
if buff_mode:
if len(line) > 400:
line = line[:400] + "...\n"
line = line[:400] + "\n"
_buffer += line
return "".join(retval)
lib.core.settings.logger.info(lib.core.settings.set_color(
"getting authorization..."
"getting authorization"
))
token = lib.core.settings.get_token(lib.core.settings.GITHUB_AUTH_PATH)
@ -95,7 +95,7 @@ def request_issue_creation():
"body": "Zeus version:\n`{}`\n\n"
"Firefox version:\n`{}`\n\n"
"Geckodriver version:\n`{}`\n\n"
"Error info:\n```{}````\n\n"
"Error info:\n```{}```\n\n"
"Running details:\n`{}`\n\n"
"Commands used:\n`{}`\n\n"
"Log file info:\n```{}```".format(
@ -121,12 +121,12 @@ def request_issue_creation():
urllib2.urlopen(req, timeout=10).read()
lib.core.settings.logger.info(lib.core.settings.set_color(
"issue has been created successfully with the following name '{}', your unique identifier "
"for this issue is '{}' and the URL to your issue is '{}'...".format(
"for this issue is '{}' and the URL to your issue is '{}'".format(
issue_title, identifier, find_url(identifier)
)
))
except Exception as e:
lib.core.settings.logger.exception(lib.core.settings.set_color(
"failed to auto create the issue, got exception '{}', "
"you may manually create an issue...".format(e), level=50
"you may manually create an issue".format(e), level=50
))

22
var/blackwidow/__init__.py
View file

@ -55,14 +55,14 @@ class Blackwidow(object):
else:
info_msg += ""
lib.core.settings.logger.fatal(lib.core.settings.set_color(
"provided website '{}' is refusing connection{}...".format(
"provided website '{}' is refusing connection{}".format(
self.url, info_msg
), level=50
))
lib.core.common.shutdown()
else:
lib.core.settings.logger.exception(lib.core.settings.set_color(
"failed to connect to '{}' received error '{}'...".format(
"failed to connect to '{}' received error '{}'".format(
self.url, e
), level=50
))
@ -106,27 +106,27 @@ def blackwidow_main(url, **kwargs):
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"settings user-agent to '{}'...".format(agent), level=10
"settings user-agent to '{}'".format(agent), level=10
))
if proxy is not None:
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"running behind proxy '{}'...".format(proxy), level=10
"running behind proxy '{}'".format(proxy), level=10
))
lib.core.settings.create_dir("{}/{}".format(os.getcwd(), "log/blackwidow-log"))
lib.core.settings.logger.info(lib.core.settings.set_color(
"starting blackwidow on '{}'...".format(url)
"starting blackwidow on '{}'".format(url)
))
crawler = Blackwidow(url, user_agent=agent, proxy=proxy, forward=forward)
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"testing connection to the URL...", level=10
"testing connection to the URL", level=10
))
test_code = crawler.test_connection()
if not test_code[0] == "ok":
error_msg = (
"connection test failed with status code: {}, reason: '{}'. "
"test connection needs to pass, try a different link..."
"test connection needs to pass, try a different link"
)
for error_code in lib.core.common.STATUS_CODES.keys():
if error_code == test_code[1]:
@ -144,15 +144,15 @@ def blackwidow_main(url, **kwargs):
lib.core.common.shutdown()
else:
lib.core.settings.logger.info(lib.core.settings.set_color(
"connection test succeeded, continuing...", level=25
"connection test succeeded, continuing", level=25
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"crawling given URL '{}' for links...".format(url)
"crawling given URL '{}' for links".format(url)
))
found = crawler.scrape_page_for_links(url)
if len(found) > 0:
lib.core.settings.logger.info(lib.core.settings.set_color(
"found a total of {} links from given URL '{}'...".format(
"found a total of {} links from given URL '{}'".format(
len(found), url
), level=25
))
@ -160,5 +160,5 @@ def blackwidow_main(url, **kwargs):
filename=lib.core.settings.BLACKWIDOW_FILENAME)
else:
lib.core.settings.logger.fatal(lib.core.settings.set_color(
"did not find any usable links from '{}'...".format(url), level=50
"did not find any usable links from '{}'".format(url), level=50
))

4
var/search/__init__.py
View file

@ -128,7 +128,7 @@ class SetBrowser(object):
try:
if not self.tor:
logger.info(set_color(
"setting the browser..."
"setting the browser"
))
profile.set_preference("general.useragent.override", self.agent)
browser = webdriver.Firefox(profile, proxy=self.__set_proxy())
@ -137,7 +137,7 @@ class SetBrowser(object):
browser = webdriver.Firefox(profile, proxy=self.__set_proxy())
else:
logger.info(set_color(
"setting the Tor browser emulation..."
"setting the Tor browser emulation"
))
profile = self.__tor_browser_emulation(profile)
browser = webdriver.Firefox(profile)

20
var/search/pgp_search.py
View file

@ -109,18 +109,18 @@ def get_pgp_keys(url_list, query, attribute="pre", **kwargs):
identity_matcher = re.compile(r"\bbegin.pgp.public.key.block", re.I)
amount_left = len(url_list)
lib.core.settings.logger.info(lib.core.settings.set_color(
"checking a maximum of {} PGP keys...".format(amount_to_search)
"checking a maximum of {} PGP keys".format(amount_to_search)
))
for i, url in enumerate(url_list, start=1):
if i >= amount_to_search:
break
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"checking '{}'...".format(url), level=10
"checking '{}'".format(url), level=10
))
if i % 25 == 0:
lib.core.settings.logger.info(lib.core.settings.set_color(
"currently checking PGP key #{}, {} left to check ({} total found)...".format(
"currently checking PGP key #{}, {} left to check ({} total found)".format(
i, amount_to_search - i, amount_left
)
))
@ -140,7 +140,7 @@ def get_pgp_keys(url_list, query, attribute="pre", **kwargs):
extracted_keys.add(context)
except ReadTimeout:
lib.core.settings.logger.error(lib.core.settings.set_color(
"PGP key failed connection, assuming no good and skipping...", level=40
"PGP key failed connection, assuming no good and skipping", level=40
))
for i, k in enumerate(extracted_keys):
pgp_key = str(k).split("<{}>".format(attribute)) # split the string by the tag
@ -164,7 +164,7 @@ def pgp_main(query, verbose=False):
except Exception:
query = query
lib.core.settings.logger.info(lib.core.settings.set_color(
"searching public PGP files with given query '{}'...".format(query)
"searching public PGP files with given query '{}'".format(query)
))
try:
html = obtain_html(
@ -172,25 +172,25 @@ def pgp_main(query, verbose=False):
)
except (Exception, ReadTimeout):
lib.core.settings.logger.warning(lib.core.settings.set_color(
"connection failed, assuming no PGP keys...", level=30
"connection failed, assuming no PGP keys", level=30
))
html = None
if html is not None:
urls = gather_urls(html)
lib.core.settings.logger.info(lib.core.settings.set_color(
"found a total of {} URLs...".format(len(urls))
"found a total of {} URLs".format(len(urls))
))
if verbose:
lib.core.settings.logger.debug(lib.core.settings.set_color(
"found a '{}'...".format(urls), level=10
"found a '{}'".format(urls), level=10
))
lib.core.settings.logger.info(lib.core.settings.set_color(
"gathering PGP key(s) and writing to a file...", level=25
"gathering PGP key(s) and writing to a file", level=25
))
return get_pgp_keys(urls, query, verbose=verbose)
else:
lib.core.settings.logger.warning(lib.core.settings.set_color(
"did not find anything using query '{}'...".format(query), level=30
"did not find anything using query '{}'".format(query), level=30
))
except KeyboardInterrupt:
if not lib.core.common.pause():

106
var/search/selenium_search.py
View file

@ -75,20 +75,20 @@ def get_urls(query, url, verbose=False, **kwargs):
batch = kwargs.get("batch", False)
xforward = kwargs.get("xforward", False)
logger.info(set_color(
"setting up virtual display to hide the browser..."
"setting up virtual display to hide the browser"
))
ff_display = Display(visible=0, size=(800, 600))
ff_display.start()
browser = var.search.SetBrowser(agent=user_agent, proxy=proxy, tor=tor, xforward=xforward).set_browser()
logger.info(set_color("browser will open shortly...", level=25))
logger.info(set_color("browser will open shortly", level=25))
browser.get(url)
if verbose:
logger.debug(set_color(
"searching search engine for the 'q' element (search button)...", level=10
"searching search engine for the 'q' element (search button)", level=10
))
search = browser.find_element_by_name('q')
logger.info(set_color(
"searching search engine using query '{}'...".format(query)
"searching search engine using query '{}'".format(query)
))
try:
# enter the text you want to search and hit enter
@ -98,7 +98,7 @@ def get_urls(query, url, verbose=False, **kwargs):
time.sleep(3)
else:
logger.warning(set_color(
"sleep time has been increased to 10 seconds due to tor being used...", level=30
"sleep time has been increased to 10 seconds due to tor being used", level=30
))
time.sleep(10)
except ElementNotInteractableException:
@ -110,19 +110,19 @@ def get_urls(query, url, verbose=False, **kwargs):
except UnicodeDecodeError:
logger.error(set_color(
"your query '{}' appears to have unicode characters in it, selenium is not "
"properly formatted to handle unicode characters, this dork will be skipped...".format(
"properly formatted to handle unicode characters, this dork will be skipped".format(
query
), level=40
))
if verbose:
logger.debug(set_color(
"obtaining URL from selenium..."
"obtaining URL from selenium"
))
try:
retval = browser.current_url
except UnexpectedAlertPresentException:
logger.warning(set_color(
"alert present, closing...", level=30
"alert present, closing", level=30
))
# discover the alert and close it before continuing
alert = browser.switch_to.alert
@ -131,7 +131,7 @@ def get_urls(query, url, verbose=False, **kwargs):
# if you have been IP banned, we'll extract the URL from it
if IP_BAN_REGEX.search(retval) is not None:
logger.warning(set_color(
"it appears that Google is attempting to block your IP address, attempting bypass...", level=30
"it appears that Google is attempting to block your IP address, attempting bypass", level=30
))
try:
retval = URLParser(retval).extract_ip_ban_url()
@ -155,7 +155,7 @@ def get_urls(query, url, verbose=False, **kwargs):
write_to_log_file(retval, EXTRACTED_URL_LOG, EXTRACTED_URL_FILENAME)
logger.info(set_color(
"it is advised to extract the URL's from the produced URL written to the above "
"(IE open the log, copy the url into firefox)...".format(retval)
"(IE open the log, copy the url into firefox)".format(retval)
))
shutdown()
except Exception as e:
@ -165,7 +165,7 @@ def get_urls(query, url, verbose=False, **kwargs):
ff_display.stop()
logger.exception(set_color(
"zeus was unable to extract the correct URL from the ban URL '{}', "
"got exception '{}'...".format(
"got exception '{}'".format(
unquote(retval), e
), level=50
))
@ -173,7 +173,7 @@ def get_urls(query, url, verbose=False, **kwargs):
shutdown()
if verbose:
logger.debug(set_color(
"found current URL from selenium browser...", level=10
"found current URL from selenium browser", level=10
))
logger.info(set_color(
"closing the browser and continuing process.."
@ -201,31 +201,31 @@ def parse_search_results(query, url_to_search, verbose=False, **kwargs):
if verbose:
logger.debug(set_color(
"parsing blacklist...", level=10
"parsing blacklist", level=10
))
parse_blacklist(query, BLACKLIST_FILE_PATH, batch=batch)
if verbose:
logger.debug(set_color(
"checking for user-agent and proxy configuration...", level=10
"checking for user-agent and proxy configuration", level=10
))
if not parse_webcache and "google" in url_to_search:
logger.warning(set_color(
"will not parse webcache URL's (to parse webcache pass -W)...", level=30
"will not parse webcache URL's (to parse webcache pass -W)", level=30
))
if not pull_all:
logger.warning(set_color(
"only pulling URLs with GET(query) parameters (to pull all URL's pass -E)...", level=30
"only pulling URLs with GET(query) parameters (to pull all URL's pass -E)", level=30
))
user_agent_info = "adjusting user-agent header to {}..."
user_agent_info = "adjusting user-agent header to {}"
if user_agent is not DEFAULT_USER_AGENT:
user_agent_info = user_agent_info.format(user_agent.strip())
else:
user_agent_info = user_agent_info.format("default user agent '{}'".format(DEFAULT_USER_AGENT))
proxy_string_info = "setting proxy to {}..."
proxy_string_info = "setting proxy to {}"
if proxy_string is not None:
proxy_string = proxy_string_to_dict(proxy_string)
proxy_string_info = proxy_string_info.format(
@ -236,13 +236,13 @@ def parse_search_results(query, url_to_search, verbose=False, **kwargs):
"tor proxy settings"
)
else:
proxy_string_info = "no proxy configuration detected..."
proxy_string_info = "no proxy configuration detected"
if forward_for:
ip_to_use = (create_random_ip(), create_random_ip(), create_random_ip())
if verbose:
logger.debug(set_color(
"random IP addresses generated for headers '{}'...".format(ip_to_use), level=10
"random IP addresses generated for headers '{}'".format(ip_to_use), level=10
))
headers = {
@ -256,7 +256,7 @@ def parse_search_results(query, url_to_search, verbose=False, **kwargs):
HTTP_HEADER.USER_AGENT: user_agent
}
logger.info(set_color(
"attempting to gather query URL..."
"attempting to gather query URL"
))
try:
query_url = get_urls(
@ -268,17 +268,17 @@ def parse_search_results(query, url_to_search, verbose=False, **kwargs):
logger.fatal(set_color(
"firefox was not found in the default location on your system, "
"check your installation and make sure it is in /usr/lib, if you "
"find it there, restart your system and try again...", level=50
"find it there, restart your system and try again", level=50
))
elif "connection refused" in str(e).lower():
logger.fatal(set_color(
"there are to many sessions of firefox opened and selenium cannot "
"create a new one...", level=50
"create a new one", level=50
))
run_fix(
"would you like to attempt to auto clean the open sessions",
"sudo sh {}".format(CLEANUP_TOOL_PATH),
"kill off the open sessions of firefox and re-run Zeus...",
"kill off the open sessions of firefox and re-run Zeus",
exit_process=True
)
elif "Program install error!" in str(e):
@ -289,50 +289,50 @@ def parse_search_results(query, url_to_search, verbose=False, **kwargs):
run_fix(
"would you like to attempt to fix this issue automatically",
"sudo sh {}".format(FIX_PROGRAM_INSTALL_PATH),
"you can manually try and re-install Xvfb to fix the problem...",
"you can manually try and re-install Xvfb to fix the problem",
exit_process=True
)
elif "Message: Reached error page:" in str(e):
logger.fatal(set_color(
"geckodriver has hit an error that usually means it needs to be reinstalled...", level=50
"geckodriver has hit an error that usually means it needs to be reinstalled", level=50
))
question = prompt(
"would you like to attempt a reinstallation of the geckodriver", opts="yN"
)
if question.lower().startswith("y"):
logger.warning(set_color(
"rewriting all executed information, path information, and removing geckodriver...", level=30
"rewriting all executed information, path information, and removing geckodriver", level=30
))
rewrite_all_paths()
logger.info(set_color(
"all paths rewritten, you will be forced to re-install everything next run of Zeus..."
"all paths rewritten, you will be forced to re-install everything next run of Zeus"
))
else:
logger.fatal(set_color(
"you will need to remove the geckodriver from /usr/bin and reinstall it...", level=50
"you will need to remove the geckodriver from /usr/bin and reinstall it", level=50
))
shutdown()
elif "Unable to find a matching set of capabilities" in str(e):
logger.fatal(set_color(
"it appears that firefox, selenium, and geckodriver are not playing nice with one another...", level=50
"it appears that firefox, selenium, and geckodriver are not playing nice with one another", level=50
))
run_fix(
"would you like to attempt to resolve this issue automatically",
"sudo sh {}".format(REINSTALL_TOOL),
("you will need to reinstall firefox to a later version, update selenium, and reinstall the "
"geckodriver to continue using Zeus..."),
"geckodriver to continue using Zeus"),
exit_process=True
)
else:
logger.exception(set_color(
"{} failed to gather the URL from search engine, caught exception '{}' "
"exception has been logged to current log file...".format(
"exception has been logged to current log file".format(
os.path.basename(__file__), str(e).strip()), level=50)
)
request_issue_creation()
shutdown()
logger.info(set_color(
"URL successfully gathered, searching for GET parameters..."
"URL successfully gathered, searching for GET parameters"
))
logger.info(set_color(proxy_string_info))
@ -341,7 +341,7 @@ def parse_search_results(query, url_to_search, verbose=False, **kwargs):
req = requests.get(query_url, proxies=proxy_string, params=headers)
except ConnectionError:
logger.warning(set_color(
"target machine refused connection, delaying and trying again...", level=30
"target machine refused connection, delaying and trying again", level=30
))
time.sleep(3)
req = requests.get(query_url, proxies=proxy_string, params=headers)
@ -365,15 +365,15 @@ def parse_search_results(query, url_to_search, verbose=False, **kwargs):
if verbose:
try:
logger.debug(set_color(
"found '{}'...".format(url.split(splitter)[0]), level=10
"found '{}'".format(url.split(splitter)[0]), level=10
))
except TypeError:
logger.debug(set_color(
"found '{}'...".format(str(url).split(splitter)[0]), level=10
"found '{}'".format(str(url).split(splitter)[0]), level=10
))
except AttributeError:
logger.debug(set_color(
"found '{}...".format(str(url)), level=10
"found '{}".format(str(url)), level=10
))
if url is not None:
retval.add(url.split(splitter)[0])
@ -384,12 +384,12 @@ def parse_search_results(query, url_to_search, verbose=False, **kwargs):
if parse_webcache:
if "webcache" in url:
logger.info(set_color(
"found a webcache URL, extracting..."
"found a webcache URL, extracting"
))
url = URLParser(url).extract_webcache_url()
if verbose:
logger.debug(set_color(
"found '{}'...".format(url), level=15
"found '{}'".format(url), level=15
))
true_retval.add(url)
else:
@ -403,16 +403,16 @@ def parse_search_results(query, url_to_search, verbose=False, **kwargs):
amount_of_urls = len(open(file_path).readlines())
success_rate = calculate_success(amount_of_urls)
logger.info(set_color(
"provided query has a {} success rate...".format(success_rate)
"provided query has a {} success rate".format(success_rate)
))
else:
logger.fatal(set_color(
"did not find any URLs with given query '{}' writing query to blacklist...".format(query), level=50
"did not find any URLs with given query '{}' writing query to blacklist".format(query), level=50
))
write_to_log_file(query, BLACKLIST_FILE_PATH, BLACKLIST_FILENAME, blacklist=True)
shutdown()
logger.info(set_color(
"found a total of {} URLs with given query '{}'...".format(len(true_retval), query)
"found a total of {} URLs with given query '{}'".format(len(true_retval), query)
))
return list(true_retval) if len(true_retval) != 0 else None
@ -431,7 +431,7 @@ def search_multiple_pages(query, link_amount, verbose=False, **kwargs):
search_engine = AUTHORIZED_SEARCH_ENGINES["search-results"]
logger.warning(set_color(
"searching multiple pages will not be done on Google...".format(search_engine), level=30
"searching multiple pages will not be done on Google".format(search_engine), level=30
))
if not parse_blacklist(query, BLACKLIST_FILE_PATH, batch=batch):
@ -455,11 +455,11 @@ def search_multiple_pages(query, link_amount, verbose=False, **kwargs):
while len(retval) <= link_amount:
if verbose:
logger.debug(set_color(
"searching page number {}...".format(page_number), level=10
"searching page number {}".format(page_number), level=10
))
if page_number % 10 == 0:
logger.info(set_color(
"currently on page {} of search results...".format(
"currently on page {} of search results".format(
page_number
)
))
@ -481,44 +481,44 @@ def search_multiple_pages(query, link_amount, verbose=False, **kwargs):
page_number += 1
else:
logger.warning(set_color(
"hit max page number {}...".format(MAX_PAGE_NUMBER), level=30
"hit max page number {}".format(MAX_PAGE_NUMBER), level=30
))
break
else:
logger.warning(set_color(
"no more results found for given query '{}'...".format(query), level=30
"no more results found for given query '{}'".format(query), level=30
))
break
except KeyboardInterrupt:
logger.error(set_color(
"user aborted, dumping already found URL(s)...", level=40
"user aborted, dumping already found URL(s)", level=40
))
write_to_log_file(retval, URL_LOG_PATH, URL_FILENAME)
logger.info(set_color(
"found a total of {} URL(s)...".format(len(retval)), level=25
"found a total of {} URL(s)".format(len(retval)), level=25
))
shutdown()
except Exception as e:
logger.exception(set_color(
"Zeus ran into an unexpected error '{}'...".format(e), level=50
"Zeus ran into an unexpected error '{}'".format(e), level=50
))
request_issue_creation()
shutdown()
if len(retval) > 0:
logger.info(set_color(
"a total of {} URL(s) found out of the requested {}...".format(len(retval), link_amount), level=25
"a total of {} URL(s) found out of the requested {}".format(len(retval), link_amount), level=25
))
file_path = write_to_log_file(retval, URL_LOG_PATH, URL_FILENAME)
if show_success:
amount_of_urls = len(open(file_path).readlines())
success_rate = calculate_success(amount_of_urls)
logger.info(set_color(
"provided query has a {} success rate...".format(success_rate)
"provided query has a {} success rate".format(success_rate)
))
return list(retval)
else:
logger.warning(set_color(
"did not find any links with given query '{}' writing to blacklist...".format(query), level=30
"did not find any links with given query '{}' writing to blacklist".format(query), level=30
))
write_to_log_file(query, BLACKLIST_FILE_PATH, BLACKLIST_FILENAME)

68
zeus.py
View file

@ -58,11 +58,11 @@ if __name__ == "__main__":
if opt.runInVerbose:
being_run = find_running_opts(opt)
logger.debug(set_color(
"running with options '{}'...".format(being_run), level=10
"running with options '{}'".format(being_run), level=10
))
logger.info(set_color(
"log file being saved to '{}'...".format(get_latest_log_file(CURRENT_LOG_FILE_PATH))
"log file being saved to '{}'".format(get_latest_log_file(CURRENT_LOG_FILE_PATH))
))
@ -83,7 +83,7 @@ if __name__ == "__main__":
if urls_to_use is None:
logger.error(set_color(
"unable to run attacks appears that no file was created for the retrieved data...", level=40
"unable to run attacks appears that no file was created for the retrieved data", level=40
))
shutdown()
options = [
@ -98,24 +98,28 @@ if __name__ == "__main__":
current = i
if "webcache" in url:
logger.warning(set_color(
"ran into unexpected webcache URL skipping...", level=30
"ran into unexpected webcache URL skipping", level=30
))
current -= 1
else:
logger.info(set_color(
"currently running on '{}' (target #{})...".format(
"currently running on '{}' (target #{})".format(
url.strip(), current
), level=25
))
logger.info(set_color(
"fetching target meta-data..."
"fetching target meta-data"
))
main_header_check(
identified = main_header_check(
url, verbose=opt.runInVerbose, agent=agent_to_use,
proxy=proxy_to_use, xforward=opt.forwardedForRandomIP,
identify_plugins=opt.identifyPlugin, identify_waf=opt.identifyProtection,
show_description=opt.showPluginDescription
)
if not identified:
logger.error(set_color(
"target is refusing to allow meta-data dumping, skipping", level=40
))
run_attacks(
url.strip(),
sqlmap=opt.runSqliScan, nmap=opt.runPortScan, pgp=opt.pgpLookup,
@ -146,7 +150,7 @@ if __name__ == "__main__":
# use a personal dork as the query
if opt.dorkToUse is not None and not opt.searchMultiplePages:
logger.info(set_color(
"starting dork scan with query '{}'...".format(opt.dorkToUse)
"starting dork scan with query '{}'".format(opt.dorkToUse)
))
try:
selenium_search.parse_search_results(
@ -159,19 +163,19 @@ if __name__ == "__main__":
supported_proxy_types = ("socks5", "socks4", "https", "http")
logger.fatal(set_color(
"the provided proxy is not valid, specify the protocol and try again, supported "
"proxy protocols are {} (IE socks5://127.0.0.1:9050)...".format(
"proxy protocols are {} (IE socks5://127.0.0.1:9050)".format(
", ".join(list(supported_proxy_types))), level=50
))
except Exception as e:
if "Permission denied:" in str(e):
logger.fatal(set_color(
"your permissions are not allowing Zeus to run, "
"try running Zeus with sudo...", level=50
"try running Zeus with sudo", level=50
))
shutdown()
else:
logger.exception(set_color(
"ran into exception '{}'...".format(e), level=50
"ran into exception '{}'".format(e), level=50
))
request_issue_creation()
pass
@ -189,7 +193,7 @@ if __name__ == "__main__":
if dork_to_use is None:
logger.warning(set_color(
"there has been no dork to specified to do the searching, defaulting to random dork...", level=30
"there has been no dork to specified to do the searching, defaulting to random dork", level=30
))
dork_to_use = get_random_dork()
@ -197,14 +201,14 @@ if __name__ == "__main__":
if opt.amountToSearch is None:
logger.warning(set_color(
"did not specify amount of links to find defaulting to 75...", level=30
"did not specify amount of links to find defaulting to 75", level=30
))
link_amount_to_search = 75
else:
link_amount_to_search = opt.amountToSearch
logger.info(set_color(
"searching Google using dork '{}' for a total of {} links...".format(
"searching Google using dork '{}' for a total of {} links".format(
dork_to_use, link_amount_to_search
)
))
@ -218,11 +222,11 @@ if __name__ == "__main__":
except Exception as e:
if "Error 400" in str(e):
logger.fatal(set_color(
"failed to connect to search engine...".format(e), level=50
"failed to connect to search engine".format(e), level=50
))
else:
logger.exception(set_color(
"failed with unexpected error '{}'...".format(e), level=50
"failed with unexpected error '{}'".format(e), level=50
))
shutdown()
@ -234,7 +238,7 @@ if __name__ == "__main__":
for dork in dorks.readlines():
dork = dork.strip()
logger.info(set_color(
"starting dork scan with query '{}'...".format(dork)
"starting dork scan with query '{}'".format(dork)
))
try:
selenium_search.parse_search_results(
@ -244,7 +248,7 @@ if __name__ == "__main__":
)
except Exception as e:
logger.exception(set_color(
"ran into exception '{}'...".format(e), level=50
"ran into exception '{}'".format(e), level=50
))
request_issue_creation()
pass
@ -256,10 +260,10 @@ if __name__ == "__main__":
random_dork = get_random_dork().strip()
if opt.runInVerbose:
logger.debug(set_color(
"choosing random dork from etc/dorks.txt...", level=10
"choosing random dork from etc/dorks.txt", level=10
))
logger.info(set_color(
"using random dork '{}' as the search query...".format(random_dork)
"using random dork '{}' as the search query".format(random_dork)
))
try:
selenium_search.parse_search_results(
@ -271,7 +275,7 @@ if __name__ == "__main__":
except Exception as e:
logger.exception(set_color(
"ran into exception '{}' and cannot continue, saved to current log file...".format(e),
"ran into exception '{}' and cannot continue, saved to current log file".format(e),
level=50
))
request_issue_creation()
@ -281,7 +285,7 @@ if __name__ == "__main__":
elif opt.spiderWebSite:
problem_identifiers = ["http://", "https://"]
if not URL_REGEX.match(opt.spiderWebSite):
err_msg = "URL did not match a true URL{}..."
err_msg = "URL did not match a true URL{}"
if not any(m in opt.spiderWebSite for m in problem_identifiers):
err_msg = err_msg.format(" issue seems to be that http:// "
"or https:// is not present in the URL")
@ -317,7 +321,7 @@ if __name__ == "__main__":
# enumerate a file and run attacks on the URL's provided
elif opt.fileToEnumerate is not None:
logger.info(set_color(
"found a total of {} URL's to enumerate in given file...".format(
"found a total of {} URL's to enumerate in given file".format(
len(open(opt.fileToEnumerate).readlines())
)
))
@ -325,7 +329,7 @@ if __name__ == "__main__":
else:
logger.critical(set_color(
"failed to provide a mandatory argument, you will be redirected to the help menu...", level=50
"failed to provide a mandatory argument, you will be redirected to the help menu", level=50
))
time.sleep(2)
zeus_help_menu_command = shlex.split("python zeus.py --help")
@ -333,7 +337,7 @@ if __name__ == "__main__":
except IOError as e:
if "Invalid URL" in str(e):
logger.exception(set_color(
"URL provided is not valid, schema appears to be missing...", level=50
"URL provided is not valid, schema appears to be missing", level=50
))
request_issue_creation()
shutdown()
@ -346,22 +350,22 @@ if __name__ == "__main__":
elif "No such file or directory" in str(e):
logger.exception(e)
logger.fatal(set_color(
"provided file does not exist, make sure you have the full path...", level=50
"provided file does not exist, make sure you have the full path", level=50
))
else:
logger.exception(set_color(
"Zeus has hit an unexpected error and cannot continue, error code '{}'...".format(e), level=50
"Zeus has hit an unexpected error and cannot continue, error code '{}'".format(e), level=50
))
request_issue_creation()
except KeyboardInterrupt:
logger.fatal(set_color(
"user aborted process...", level=50
"user aborted process", level=50
))
shutdown()
except UnboundLocalError:
logger.warning(set_color(
"do not interrupt the browser when selenium is running, "
"it will cause Zeus to crash...", level=30
"it will cause Zeus to crash", level=30
))
except Exception as e:
if "url did not match a true url" in str(e).lower():
@ -369,13 +373,13 @@ if __name__ == "__main__":
"you did not provide a URL that is capable of being processed, "
"the URL provided to the spider needs to contain protocol as well "
"ie. 'http://google.com' (it is advised not to add the GET parameter), "
"fix the URL you want to scan and try again...", level=40
"fix the URL you want to scan and try again", level=40
))
shutdown()
elif "Service geckodriver unexpectedly exited" in str(e):
logger.fatal(set_color(
"it seems your firefox version is not compatible with the geckodriver version, "
"please re-install Zeus and try again...", level=50
"please re-install Zeus and try again", level=50
))
shutdown()
elif "Max retries exceeded with url" in str(e):
@ -387,7 +391,7 @@ if __name__ == "__main__":
shutdown()
else:
logger.exception(set_color(
"ran into exception '{}' exception has been saved to log file...".format(e), level=50
"ran into exception '{}' exception has been saved to log file".format(e), level=50
))
request_issue_creation()