From ed3d15c26f343847b89f36f43943c42187c0f133 Mon Sep 17 00:00:00 2001 From: ekultek Date: Sat, 11 Nov 2017 10:43:19 -0600 Subject: [PATCH] threading has been enabled on admin panel finder, be careful when going over 10 threads, you will be warned if you go over --- lib/attacks/admin_panel_finder/__init__.py | 23 +++++----- lib/core/settings.py | 49 ++++++++++++++++++++-- zeus.py | 7 +++- 3 files changed, 62 insertions(+), 17 deletions(-) diff --git a/lib/attacks/admin_panel_finder/__init__.py b/lib/attacks/admin_panel_finder/__init__.py index a87b0d2..f8d5466 100644 --- a/lib/attacks/admin_panel_finder/__init__.py +++ b/lib/attacks/admin_panel_finder/__init__.py @@ -1,5 +1,5 @@ import os -import multiprocessing +import threading try: # Python 2 from urllib.request import urlopen @@ -183,7 +183,7 @@ def main(url, show=False, verbose=False, **kwargs): main method to be called """ do_threading = kwargs.get("do_threading", False) - proc_num = kwargs.get("proc_num", 3) + proc_num = kwargs.get("proc_num", 5) batch = kwargs.get("batch", False) lib.core.settings.logger.info(lib.core.settings.set_color( "parsing robots.txt..." @@ -210,18 +210,19 @@ def main(url, show=False, verbose=False, **kwargs): )) if do_threading: lib.core.settings.logger.warning(lib.core.settings.set_color( - "starting parallel processing with {} processes, this " - "will depend on your GPU speed...".format(proc_num), level=30 + "starting {} threads, you will not be able to end the process until " + "it is completed...".format(proc_num), level=30 )) tasks = [] for _ in range(0, proc_num): - p = multiprocessing.Process(target=check_for_admin_page, args=(url, extensions), kwargs={ - "show_possibles": show, - "verbose": verbose + t = threading.Thread(target=check_for_admin_page, args=(url, extensions), kwargs={ + "verbose": verbose, + "show_possibles": show }) - p.start() - tasks.append(p) - for proc in tasks: - proc.join() + t.daemon = True + tasks.append(t) + for thread in tasks: + thread.start() + thread.join() else: check_for_admin_page(url, extensions, show_possibles=show, verbose=verbose) \ No newline at end of file diff --git a/lib/core/settings.py b/lib/core/settings.py index 4d5c682..3eac3fe 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -52,9 +52,9 @@ PATCH_ID = str(subprocess.check_output(["git", "rev-parse", "origin/master"]))[: CLONE = "https://github.com/ekultek/zeus-scanner.git" # current version -VERSION = "1.2.3.{}".format(PATCH_ID) -# colors to output depending on the version +VERSION = "1.2.4".format(PATCH_ID) +# colors to output depending on the version VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30} # version string formatting @@ -84,6 +84,9 @@ DEFAULT_USER_AGENT = "Zeus-Scanner/{} (Language=Python/{}; Platform={})".format( VERSION, sys.version.split(" ")[0], platform.platform().split("-")[0] ) +# max number of threads allowed +MAX_THREADS = 10 + # path to the checksum CHECKSUM_PATH = "{}/etc/checksum/md5sum.md5".format(os.getcwd()) @@ -277,6 +280,9 @@ def find_running_opts(options): def parse_conf_file(config_path): + """ + parse a sqlmap configuration file + """ set_options = [] skip_opt_schema = ("", "False", "0") parser = ConfigParser.ConfigParser(allow_no_value=True) @@ -860,6 +866,37 @@ def deprecation(target_version, method, connect=True, *args, **kwargs): shutdown() +def check_thread_num(number, batch=False, default=5): + """ + if you specify more threads then the max number you will be prompted if not running batch + """ + logger.warning(set_color( + "you have specified {} threads, it is highly advised to not go over {} threads, " + "doing so will most likely not give a significant performance increase and also " + "will most likely cause unforeseen issues...".format(number, MAX_THREADS), level=30 + )) + question_msg = "would you like to continue anyways" + default_msg = "defaulting to 5 threads..." + if not batch: + question = prompt( + question_msg, opts="yN" + ) + if question.lower().startswith("n"): + logger.info(set_color( + default_msg + )) + return default + else: + prompt( + question_msg, opts="yN", default="n" + ) + logger.info(set_color( + default_msg + )) + return default + return number + + def run_attacks(url, **kwargs): """ run the attacks if any are requested @@ -883,6 +920,10 @@ def run_attacks(url, **kwargs): proxy = kwargs.get("proxy", None) agent = kwargs.get("agent", None) conf_file = kwargs.get("conf_file", None) + threads = kwargs.get("threads", None) + + if threads > MAX_THREADS: + threads = check_thread_num(threads, batch=batch) __enabled_attacks = { "sqlmap": sqlmap, @@ -930,14 +971,14 @@ def run_attacks(url, **kwargs): ) elif admin: main( - url, show=show_all, + url, show=show_all, proc_num=threads, verbose=verbose, do_threading=do_threading, batch=batch ) elif xss: if check_for_protection(PROTECTED, "xss"): main_xss( url, verbose=verbose, proxy=proxy, - agent=agent, tamper=tamper_script, batch=batch + agent=agent, tamper=tamper_script, batch=batch, ) elif whois: whois_lookup_main( diff --git a/zeus.py b/zeus.py index 8554590..f1acac7 100755 --- a/zeus.py +++ b/zeus.py @@ -100,7 +100,7 @@ if __name__ == "__main__": attacks.add_option("--tamper", dest="tamperXssPayloads", metavar="TAMPER-SCRIPT", help="Send the XSS payloads through tampering before sending to the target") attacks.add_option("--thread", dest="threadPanels", action="store_true", - help=optparse.SUPPRESS_HELP) + help="Run multiple threads on functions that support multi-threading") attacks.add_option("--auto", dest="autoStartSqlmap", action="store_true", help="Automatically start the sqlmap API (or at least try to)") @@ -159,6 +159,8 @@ if __name__ == "__main__": help="Hide the banner during running") misc.add_option("--version", dest="showCurrentVersion", action="store_true", help="Show the current version and exit") + misc.add_option("-T", "--x-threads", dest="amountOfThreads", metavar="THREAD-AMOUNT", type=int, + help="Specify how many threads you want to pass") parser.add_option_group(mandatory) parser.add_option_group(attacks) @@ -293,7 +295,8 @@ if __name__ == "__main__": sqlmap_args=opt.sqlmapArguments, nmap_args=opt.nmapArguments, show_all=opt.showAllConnections, do_threading=opt.threadPanels, tamper_script=opt.tamperXssPayloads, timeout=opt.controlTimeout, - proxy=proxy_to_use, agent=agent_to_use, conf_file=opt.sqlmapConfigFile + proxy=proxy_to_use, agent=agent_to_use, conf_file=opt.sqlmapConfigFile, + threads=opt.amountOfThreads )