diff --git a/etc/link_ext.txt b/etc/link_ext.txt index 96ce6d8..4fda973 100644 --- a/etc/link_ext.txt +++ b/etc/link_ext.txt @@ -167,8 +167,6 @@ /admin/login.html /admin/initialadmin.php /webadmin/admin.asp -:2083 -:2082 /pureadmin/ /login_out%EXT% /administr8.html @@ -379,7 +377,6 @@ /moderator/ /acceso.%EXT% /admin/pages/home_admin.php -:82 /administrator/index.asp /wplogin/ /adminLogin.asp @@ -594,7 +591,6 @@ /admin/dashboard.php /blogindex/ /administratorlogin/ -:23 /bb-admin/index.php /administrator/account.php /admin1.php diff --git a/lib/attacks/admin_panel_finder/__init__.py b/lib/attacks/admin_panel_finder/__init__.py index f5c02bc..74d43eb 100644 --- a/lib/attacks/admin_panel_finder/__init__.py +++ b/lib/attacks/admin_panel_finder/__init__.py @@ -110,8 +110,8 @@ def check_for_admin_page(url, exts, protocol="http://", **kwargs): create_tree(url, connections) else: logger.fatal(set_color( - "did not find any successful connections to {}'s " - "admin page", level=50 + "did not receive any successful connections to the admin page of " + "{}...".format(url), level=50 )) if show_possibles: if len(possible_connections) != 0: @@ -131,14 +131,16 @@ def __load_extensions(filename="{}/etc/link_ext.txt"): return ext.readlines() -def main(url, show=False, verbose=False, do_threading=False, proc_num=3): +def main(url, show=False, verbose=False, **kwargs): + do_threading = kwargs.get("do_threading", False) + proc_num = kwargs.get("proc_num", 3) logger.info(set_color( "parsing robots.txt..." )) results = check_for_robots(url) if not results: logger.warning(set_color( - "seems like this page doesn't have a robots.txt...", level=30 + "seems like this page is blocking access to robots.txt...", level=30 )) logger.info(set_color( "loading extensions..." diff --git a/lib/core/settings.py b/lib/core/settings.py index 97da9b3..6de9b6b 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -22,7 +22,7 @@ except NameError: # clone link CLONE = "https://github.com/ekultek/zeus-scanner.git" # current version -VERSION = "1.0.40.9d4b" +VERSION = "1.0.41" # colors to output depending on the version VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30} # version string formatting @@ -108,6 +108,11 @@ SPIDER_EXT_EXCLUDE = ( "woff2", "wvx", "xbm", "xif", "xls", "xlsx", "xlt", "xm", "xpi", "xpm", "xwd", "xz", "z", "zip", "zipx" ) +# urls to exclude from being grabbed during the searching +URL_EXCLUDES = ( + "www.google.com", "map.google.com", "mail.google.com", "drive.google.com", + "news.google.com", "accounts.google.com", "books.google.com" +) DBMS_ERRORS = { # regular expressions used for DBMS recognition based on error message response "MySQL": (r"SQL syntax.*MySQL", r"Warning.*mysql_.*", r"valid MySQL result", r"MySqlClient\."), "PostgreSQL": (r"PostgreSQL.*ERROR", r"Warning.*\Wpg_.*", r"valid PostgreSQL result", r"Npgsql\."), @@ -389,6 +394,4 @@ def search_for_process(name): for pid in psutil.pids(): process = psutil.Process(pid) all_process_names.add(" ".join(process.cmdline()).strip()) - if not any(name in proc for proc in list(all_process_names)): - return False - return True + return False if not any(name in proc for proc in list(all_process_names)) else True \ No newline at end of file diff --git a/var/google_search/search.py b/var/google_search/search.py index cebca5e..68bf75f 100644 --- a/var/google_search/search.py +++ b/var/google_search/search.py @@ -31,7 +31,8 @@ from lib.core.settings import ( write_to_log_file, get_proxy_type, prompt, - EXTRACTED_URL_LOG + EXTRACTED_URL_LOG, + URL_EXCLUDES ) try: @@ -69,12 +70,13 @@ def extract_webcache_url(webcache_url, splitter="+"): return None -def get_urls(query, url, verbose=False, warning=True, user_agent=None, proxy=None, **kwargs): +def get_urls(query, url, verbose=False, warning=True, **kwargs): """ Bypass Google captchas and Google API by using selenium-webdriver to gather the Google URL. This will open a robot controlled browser window and attempt to get a URL from Google that will be used for scraping afterwards. """ + proxy, user_agent = kwargs.get("proxy", None), kwargs.get("user_agent", None) if verbose: logger.debug(set_color( "setting up the virtual display to hide the browser...", level=10 @@ -187,42 +189,16 @@ def parse_search_results( """ Parse a webpage from Google for URL's with a GET(query) parameter """ - exclude = ( - "www.google.com", "map.google.com", "mail.google.com", "drive.google.com", - "news.google.com", "accounts.google.com" - ) splitter = "&" retval = set() query_url = None - def __get_headers(): - proxy_string, user_agent = None, None - try: - proxy_string = kwargs.get("proxy") - except: - pass - - try: - user_agent = kwargs.get("agent") - except: - pass - - return proxy_string, user_agent + proxy_string, user_agent = kwargs.get("proxy", None), kwargs.get("agent", None) if verbose: logger.debug(set_color( "checking for user-agent and proxy configuration...", level=10 )) - proxy_string, user_agent = __get_headers() - - if proxy_string is None: - proxy_string = None - else: - proxy_string = proxy_string_to_dict(proxy_string) - if user_agent is None: - user_agent = DEFAULT_USER_AGENT - else: - user_agent = user_agent user_agent_info = "adjusting user-agent header to {}..." if user_agent is not DEFAULT_USER_AGENT: @@ -281,7 +257,7 @@ def parse_search_results( for url in list(urls): url = unquote(url) if not any(u in url for u in url_skip_schema): - if URL_QUERY_REGEX.match(url) and not any(l in url for l in exclude): + if URL_QUERY_REGEX.match(url) and not any(l in url for l in URL_EXCLUDES): if isinstance(url, unicode): url = str(url).encode("utf-8") if "webcache" in url: @@ -325,7 +301,7 @@ def parse_search_results( return list(retval) if len(retval) != 0 else None -def search_multiple_pages(query, link_amount, proxy=None, agent=None, verbose=False): +def search_multiple_pages(query, link_amount, verbose=False, **kwargs): def __config_proxy(proxy_string): proxy_type_schema = { @@ -342,6 +318,8 @@ def search_multiple_pages(query, link_amount, proxy=None, agent=None, verbose=Fa ) return proxy_config + proxy, agent = kwargs.get("proxy", None), kwargs.get("agent", None) + if proxy is not None: if verbose: logger.debug(set_color( diff --git a/zeus.py b/zeus.py index ab16921..fea569c 100755 --- a/zeus.py +++ b/zeus.py @@ -353,7 +353,7 @@ if __name__ == "__main__": for line in opt.nmapArguments.split(splitter["nmap"]): try: data = line.index(" ") - except: + except Exception: data = None pass if data is not None: @@ -374,13 +374,19 @@ if __name__ == "__main__": return retval - def __run_attacks( - url, sqlmap=False, nmap=False, intel=False, xss=False, - verbose=False, admin=False, batch=False, auto_start=False - ): + def __run_attacks(url, **kwargs): """ run the attacks if any are requested """ + nmap = kwargs.get("nmap", False) + sqlmap = kwargs.get("sqlmap", False) + intel = kwargs.get("intel", False) + xss = kwargs.get("xss", False) + admin = kwargs.get("admin", False) + verbose = kwargs.get("verbose", False) + batch = kwargs.get("batch", False) + auto_start = kwargs.get("auto_start", False) + __enabled_attacks = { "sqlmap": opt.runSqliScan, "port": opt.runPortScan, @@ -411,18 +417,31 @@ if __name__ == "__main__": if question.lower().startswith("y"): if sqlmap: - return sqlmap_scan.sqlmap_scan_main(url.strip(), verbose=verbose, opts=__create_arguments(sqlmap=True), - auto_start=auto_start) + return sqlmap_scan.sqlmap_scan_main( + url.strip(), verbose=verbose, + opts=__create_arguments(sqlmap=True), auto_start=auto_start) elif nmap: url_ip_address = replace_http(url.strip()) - return nmap_scan.perform_port_scan(url_ip_address, verbose=verbose, opts=__create_arguments(nmap=True)) + return nmap_scan.perform_port_scan( + url_ip_address, verbose=verbose, + opts=__create_arguments(nmap=True) + ) elif intel: url = get_true_url(url) - return intel_me.main_intel_amt(url, agent=agent_to_use, proxy=proxy_to_use) + return intel_me.main_intel_amt( + url, agent=agent_to_use, + proxy=proxy_to_use + ) elif admin: - main(url, show=opt.showAllConnections, verbose=verbose, do_threading=opt.threadPanels) + main( + url, show=opt.showAllConnections, + verbose=verbose, do_threading=opt.threadPanels + ) elif xss: - main_xss(url, verbose=verbose, proxy=proxy_to_use, agent=agent_to_use, tamper=opt.tamperXssPayloads) + main_xss( + url, verbose=verbose, proxy=proxy_to_use, + agent=agent_to_use, tamper=opt.tamperXssPayloads + ) else: pass else: @@ -451,14 +470,20 @@ if __name__ == "__main__": "unable to run attacks appears that no file was created for the retrieved data...", level=40 )) shutdown() - if opt.runSqliScan or opt.runPortScan or opt.intelCheck or opt.adminPanelFinder or opt.runXssScan: + options = [ + opt.runSqliScan, opt.runPortScan, + opt.intelCheck, opt.adminPanelFinder, + opt.runXssScan + ] + if any(options): with open(urls_to_use) as urls: for url in urls.readlines(): __run_attacks( url.strip(), - sqlmap=opt.runSqliScan, nmap=opt.runPortScan, intel=opt.intelCheck, xss=opt.runXssScan, - admin=opt.adminPanelFinder, verbose=opt.runInVerbose, batch=opt.runInBatch, - auto_start=opt.autoStartSqlmap + sqlmap=opt.runSqliScan, nmap=opt.runPortScan, + intel=opt.intelCheck, xss=opt.runXssScan, + admin=opt.adminPanelFinder, verbose=opt.runInVerbose, + batch=opt.runInBatch, auto_start=opt.autoStartSqlmap ) @@ -593,20 +618,7 @@ if __name__ == "__main__": __run_attacks_main() elif opt.fileToEnumerate is not None: - with open(opt.fileToEnumerate) as urls: - if opt.runSqliScan or opt.runPortScan or opt.intelCheck or opt.adminPanelFinder or opt.runXssScan: - for url in urls.readlines(): - url = url.strip() - __run_attacks( - url, - sqlmap=opt.runSqliScan, nmap=opt.runPortScan, intel=opt.intelCheck, xss=opt.runXssScan, - admin=opt.adminPanelFinder, verbose=opt.runInVerbose, batch=opt.runInBatch - ) - else: - logger.fatal(set_color( - "failed to provide an attack argument, attack argument must be provided " - "for Zeus to attack the provided URL's", level=50 - )) + __run_attacks_main() else: logger.critical(set_color(