def show_services(self, toolbox):
"""
Display supported services in a table.
:param Toolbox toolbox: Toolbox
"""
data = list()
columns = [
'Service',
'Default port',
'# Tools',
'# Checks',
]
for service in self.list_services(multi=True):
data.append([
service,
'N/A' if service == 'multi' else '{port}/{proto}'.format(
port = self.services[service]['default_port'],
proto = self.services[service]['protocol']),
'{nb_installed}/{nb_tools}'.format(
nb_installed = toolbox.nb_tools(filter_service=service,
only_installed=True),
nb_tools = toolbox.nb_tools(filter_service=service)),
'N/A' if service == 'multi' \
else self.services[service]['checks'].nb_checks(),
])
Output.title1('Supported services')
Output.table(columns, data, hrules=False)
def print_http_headers(self):
"""Print HTTP Response Headers if available"""
if self.get_http_headers():
logger.info('HTTP Response headers:')
for l in self.get_http_headers().splitlines():
Output.print(' | {}'.format(l))
print()
def show_products(self, filter_service=None):
"""
Display supported products in a table
:param list filter_service: Filter on services (default: all)
"""
data = list()
columns = [
'Type',
'Product Names',
]
services = self.list_services() if filter_service is None else [
filter_service
]
for service in services:
products = self.services[service]['products']
for product_type in products:
names = sorted(
self.services[service]['products'][product_type])
names = StringUtils.wrap(', '.join(names), 100)
data.append([product_type, names])
Output.title1('Available products for {filter}'.format(
filter='all services' if filter_service is None \
else 'service ' + filter_service))
if not data:
logger.warning('No product')
else:
Output.table(columns, data)
def update_for_service(self, service, fast_mode=False):
"""
Update the tools for a given service.
:param str service: Name of the service targeted by the tools to update
(may be "multi")
:param bool fast_mode: Set to true to disable prompts and install checks
"""
if service not in self.services: return
Output.title1(
'Update tools for service: {service}'.format(service=service))
if not self.tools[service]:
logger.info('No tool specific to this service in the toolbox')
else:
i = 1
for tool in self.tools[service]:
if i > 1: print()
Output.title2(
'[{svc}][{i:02}/{max:02}] Update {tool_name}:'.format(
svc=service,
i=i,
max=len(self.tools[service]),
tool_name=tool.name))
tool.update(self.settings, fast_mode=fast_mode)
i += 1
def show(self):
"""Display selected results"""
results = self.get_results()
Output.title2('Attacks results:')
if not results:
logger.warning('No results to display')
else:
data = list()
columns = [
'IP',
'Port',
'Proto',
'Service',
'Check id',
'Category',
'Check',
'# Commands run',
]
for r in results:
data.append([
r.service.host.ip,
r.service.port,
{
Protocol.TCP: 'tcp',
Protocol.UDP: 'udp'
}.get(r.service.protocol),
r.service.name,
r.id,
r.category,
r.check,
len(r.command_outputs),
])
Output.table(columns, data, hrules=False)
def show(self):
"""Show selected products"""
results = self.get_results()
if not results:
logger.warning('No product to display')
else:
data = list()
columns = [
'IP',
'Hostname',
'Service',
'Port',
'Proto',
'Type',
'Name',
'Version',
]
for r in results:
data.append([
r.service.host.ip,
r.service.host.hostname \
if r.service.host.hostname != str(r.service.host.ip) else '',
r.service.name,
r.service.port,
{Protocol.TCP: 'tcp', Protocol.UDP: 'udp'}.get(r.service.protocol),
r.type,
r.name,
r.version,
])
Output.table(columns, data, hrules=False)
def check(self):
"""
Check the toolbox: Run all check commands (when available) from all
installed tools, in automatic mode (i.e. checks based on exit codes)
In case of an error code returned by one check command (!= 0), the function
stops and exits the program with exit code 1 (error).
Otherwise, if all check commands have returned a success exit code (0),
it exits the program with exit code 0 (success).
Designed to be used for Continuous Integration.
"""
Output.title1('Automatic check of installed tools')
for service in self.services:
for tool in self.tools[service]:
if tool.installed:
# Automatic mode (no prompt), only based on exit status
status = tool.run_check_command(fast_mode=True)
if not status:
logger.error('An error occured with the tool "{tool}". Exit ' \
'check with exit code 1...'.format(tool=tool.name))
sys.exit(1)
print()
print()
logger.success('No error has been detected with all tools check commands. ' \
'Exit with success code 0...')
sys.exit(0)
def show(self):
"""Display selected hosts"""
results = self.get_results()
if not results:
logger.warning('No host to display')
else:
data = list()
columns = [
'IP',
'Hostname',
'OS',
'Type',
'Vendor',
'Comment',
'TCP',
'UDP',
]
for r in results:
data.append([
r.ip,
StringUtils.wrap(r.hostname, 45) if r.hostname != str(r.ip) else '',
StringUtils.wrap(r.os, 50),
r.type,
StringUtils.wrap(r.vendor, 30),
StringUtils.shorten(r.comment, 40),
r.get_nb_services(Protocol.TCP),
r.get_nb_services(Protocol.UDP),
])
Output.table(columns, data, hrules=False)
def __run_install_update(self, fast_mode, update=False):
"""
Run install or update command.
:param fast_mode: Set to true to disable prompts
:param update: Mode selector, True for update | False for install (default)
:return: Install/Update status
:rtype: bool
"""
if update : cmd = self.update_command.get_cmdline(self.tool_dir)
else : cmd = self.install_command.get_cmdline(self.tool_dir)
mode = 'update' if update else 'install'
logger.info('Description: {descr}'.format(descr=self.description))
#Output.print('{mode} command : {cmd}'.format(
# mode=mode.capitalize(), cmd=cmd_short))
if fast_mode \
or Output.prompt_confirm('Confirm {mode} ?'.format(mode=mode), default=True):
Output.begin_cmd(cmd)
ProcessLauncher(cmd).start()
Output.delimiter()
logger.success('Tool {mode} has finished'.format(mode=mode))
return True
else:
logger.warning('Tool {mode} aborted'.format(mode=mode))
return False
def show(self):
"""Display selected credentials"""
results = self.get_results()
if not results:
logger.warning('No credential to display')
else:
data = list()
columns = [
'IP',
'Hostname',
'Service',
'Port',
'Proto',
'Type',
'Username',
'Password',
'URL',
'Comment',
]
for r in results:
data.append([
r.service.host.ip,
r.service.host.hostname \
if r.service.host.hostname != str(r.service.host.ip) else '',
r.service.name,
r.service.port,
{Protocol.TCP: 'tcp', Protocol.UDP: 'udp'}.get(r.service.protocol),
r.type or '',
'<empty>' if r.username == '' else r.username,
{'': '<empty>', None: '<???>'}.get(r.password, r.password),
StringUtils.wrap(r.service.url, 50),
StringUtils.wrap(r.comment, 50),
])
Output.table(columns, data, hrules=False)
def show(self):
"""Display selected specific options"""
results = self.get_results()
if not results:
logger.warning('No specific option to display')
else:
data = list()
columns = [
'IP',
'Hostname',
'Service',
'Port',
'Proto',
'Name',
'Value',
]
for r in results:
data.append([
r.service.host.ip,
r.service.host.hostname \
if r.service.host.hostname != str(r.service.host.ip) else '',
r.service.name,
r.service.port,
{Protocol.TCP: 'tcp', Protocol.UDP: 'udp'}.get(r.service.protocol),
r.name,
r.value,
])
Output.table(columns, data, hrules=False)
def attack(self):
"""
Run the attack against all targets
:param fast_mode:
"""
# Initialize top status/progress bar
# If single target (total=None), the counter format will be used instead of the progress bar format
attack_progress = manager.counter(
total=len(self.targets) + 1 if len(self.targets) > 1 else None,
desc='',
unit='target',
bar_format=STATUSBAR_FORMAT, # For multi targets
counter_format=STATUSBAR_FORMAT_SINGLE) # For single target
time.sleep(.5) # hack for progress bar display
for i in range(1, len(self.targets) + 1):
print()
self.show_summary()
print()
# Target selection
if not self.fast_mode:
if len(self.targets) > 1:
self.current_targetid = Output.prompt_choice_range(
'Attack target # ? [{default}] '.format(
default=self.current_targetid), 1,
len(self.targets), self.current_targetid)
else:
if Output.prompt_confirm('Start attack ?', default=True):
self.current_targetid = 1
else:
logger.warning('Attack canceled !')
sys.exit(1)
target = self.targets[self.current_targetid - 1]
# Update status/progress bar
status = 'Current target [{cur}/{total}]: host {ip} | port {port}/{proto} | service {service}'.format(
cur=i,
total=len(self.targets),
ip=target.get_ip(),
port=target.get_port(),
proto=target.get_protocol(),
service=target.get_service_name())
attack_progress.desc = '{status}{fill}'.format(
status=status, fill=' ' * (DESC_LENGTH - len(status)))
attack_progress.update()
print()
# Launch the attack on the selected target
self.__attack_target(self.current_targetid, attack_progress)
self.current_targetid += 1
attack_progress.update()
time.sleep(.5)
attack_progress.close()
manager.stop() # Clear progress bars
def show(self):
"""Display selected vulnerabilities"""
results = self.get_results()
if not results:
logger.warning('No vulnerability to display')
else:
data = list()
columns = [
'IP',
'Service',
'Port',
'Proto',
'Vulnerability',
]
for r in results:
data.append([
r.service.host.ip,
r.service.name,
r.service.port,
{
Protocol.TCP: 'tcp',
Protocol.UDP: 'udp'
}.get(r.service.protocol),
StringUtils.wrap(r.name, 140),
])
Output.table(columns, data, hrules=False)
def show_services(self, toolbox):
"""
Show all supported services along with number of installed tools / total number
:param toolbox: Toolbox object
:return: None
"""
data = list()
columns = [
'Service',
'Default port',
'# Tools',
'# Checks',
]
for service in self.list_services(multi=True):
data.append([
service,
'N/A' if service == 'multi' else '{port}/{proto}'.format(
port=self.services[service]['default_port'],
proto=self.services[service]['protocol']),
'{nb_installed}/{nb_tools}'.format(
nb_installed=toolbox.nb_tools_installed(service),
nb_tools=toolbox.nb_tools(service)),
'N/A' if service == 'multi' else
self.services[service]['checks'].nb_checks(),
])
Output.title1('Supported services')
Output.table(columns, data, hrules=False)
def show_categories(self, filter_service=None):
"""
Show list of categories of checks for the given service or all services
:param filter_service: None or given service
:return: None
"""
data = list()
columns = [
'Category',
'Services',
]
services = self.list_services() if filter_service is None else [
filter_service
]
svcbycat = defaultdict(list)
for service in services:
for category in self.services[service]['checks'].categories:
svcbycat[category].append(service)
for category in svcbycat:
data.append([
category,
StringUtils.wrap(', '.join(svcbycat[category]), 100)
])
Output.table(columns, data)
def show(self):
"""Display selected services"""
results = self.get_results()
if not results:
logger.warning('No service to display')
else:
data = list()
columns = [
'id',
'IP',
#'Hostname',
'Port',
'Proto',
'Service',
'Banner',
'URL',
'Comment/Title',
'Checks',
'Creds',
'Vulns',
]
for r in results:
# Creds numbers
nb_userpass = r.get_nb_credentials(single_username=False)
nb_usernames = r.get_nb_credentials(single_username=True)
nb_creds = '{}{}{}'.format(
'{}'.format(Output.colored(str(nb_userpass), color='green' \
if nb_userpass > 0 else None)) if nb_userpass > 0 else '',
'/' if nb_userpass > 0 and nb_usernames > 0 else '',
'{} usr'.format(Output.colored(str(nb_usernames), color='yellow' \
if nb_usernames > 0 else None)) if nb_usernames > 0 else '')
nb_vulns = Output.colored(str(len(r.vulns)), color='green' \
if len(r.vulns) > 0 else None) if len(r.vulns) > 0 else ''
# Col "Comment/Title" (title is for HTML title for HTTP)
if r.html_title:
comment = r.html_title
else:
comment = r.comment
data.append([
r.id,
r.host.ip,
#r.host.hostname,
r.port,
{
Protocol.TCP: 'tcp',
Protocol.UDP: 'udp'
}.get(r.protocol),
r.name,
StringUtils.wrap(r.banner, 55),
StringUtils.wrap(r.url, 50),
StringUtils.shorten(comment, 40),
len(r.results),
nb_creds,
nb_vulns,
])
Output.table(columns, data, hrules=False)
def change_current_mission(self, name, verbose=False):
mission = self.sqlsess.query(Mission).filter(Mission.name == name).first()
if not mission:
logger.error('No mission with this name')
else:
self.current_mission = name
self.prompt = Output.colored('jok3rdb', color='light_green', attrs='bold') + \
Output.colored('[{mission}]'.format(mission=name), color='light_blue', attrs='bold') + \
Output.colored('> ', color='light_green', attrs='bold')
if verbose: logger.info('Selected mission is now {name}'.format(name=name))
def print_technos(self):
"""
Display web technologies detected in a table.
"""
if len(self.technos) > 0:
data = list()
columns = ['Name', 'Version']
for t in self.technos:
data.append([t['name'], t['version']])
Output.table(columns, data, hrules=False)
else:
logger.warning('No technology detected')
def remove_tool(self, tool_name):
"""
Remove one tool from the toolbox.
:param str tool_name: Name of the tool to remove
:return: Status of removal
:rtype: bool
"""
tool = self.get_tool(tool_name)
if not tool:
logger.warning('No tool with this name in the toolbox')
return False
else:
Output.title2('Remove {tool_name}:'.format(tool_name=tool.name))
return tool.remove(self.settings)
def show_summary(self):
"""
"""
data = list()
columns = [
'id',
'IP',
'Hostname',
'Port',
'Proto',
'Service',
'Banner',
'URL',
]
id_ = 1
for target in self.targets:
pointer_color = 'blue' if self.current_targetid == id_ else None
pointer_attr = 'bold' if self.current_targetid == id_ else None
data.append([
Output.colored(
'>' +
str(id_) if self.current_targetid == id_ else str(id_),
color=pointer_color,
attrs=pointer_attr),
Output.colored(target.get_ip(),
color=pointer_color,
attrs=pointer_attr),
Output.colored(target.get_host(),
color=pointer_color,
attrs=pointer_attr),
Output.colored(str(target.get_port()),
color=pointer_color,
attrs=pointer_attr),
Output.colored(target.get_protocol(),
color=pointer_color,
attrs=pointer_attr),
Output.colored(target.get_service_name(),
color=pointer_color,
attrs=pointer_attr),
Output.colored(StringUtils.wrap(target.get_banner(), 70),
color=pointer_color,
attrs=pointer_attr),
Output.colored(StringUtils.wrap(target.get_url(), 50),
color=pointer_color,
attrs=pointer_attr),
])
id_ += 1
Output.table(columns, data, hrules=False)
def do_mission(self, args):
"""Missions management"""
print()
req = MissionsRequester(self.sqlsess)
if args.add:
if req.add(args.add):
self.change_current_mission(args.add, verbose=True)
elif args.comment:
req.add_filter(Condition(args.comment[0], FilterData.MISSION_EXACT))
req.edit_comment(args.comment[1])
elif args.delete:
req.add_filter(Condition(args.delete, FilterData.MISSION_EXACT))
req.delete()
elif args.reset:
if Output.prompt_confirm('Are you sure you want to delete all missions ?', default=False):
req.reset()
elif args.rename:
req.rename(args.rename[0], args.rename[1])
elif args.search:
filter_ = Filter()
filter_.add_condition(Condition(args.search, FilterData.MISSION))
filter_.add_condition(Condition(args.search, FilterData.COMMENT_MISSION))
req.add_filter(filter_)
req.show(self.current_mission)
elif args.name:
self.change_current_mission(args.name, verbose=True)
else:
print('All available missions:')
req.show(self.current_mission)
print()
def update_tool(self, tool_name, fast_mode=False):
"""
Update one tool from the toolbox.
:param str tool_name: Name of the tool to update
:param bool fast_mode: Set to true to disable prompts and install checks
:return: Status of update
:rtype: bool
"""
tool = self.get_tool(tool_name)
if not tool:
logger.warning('No tool with this name in the toolbox')
return False
else:
Output.title2('Update {tool_name}:'.format(tool_name=tool.name))
return tool.update(self.settings, fast_mode)
def info(self):
"""
Modes mode Info
"""
self.mode = Mode.INFO
parser = self.__create_subcmd_parser()
info = parser.add_argument_group(Output.colored('Info', attrs='bold'))
info_mxg = info.add_mutually_exclusive_group()
info_mxg.add_argument('--services',
help='List supported services',
action='store_true',
dest='show_services',
default=False)
info_mxg.add_argument('--options',
help='List supported context-specific options',
action='store_true',
dest='show_specific_options',
default=False)
info_mxg.add_argument(
'--http-auth-types',
help='List the supported HTTP authentication types',
action='store_true',
dest='show_http_auth_types',
default=False)
info_mxg.add_argument('--checks',
help='List all the checks for the given service',
action='store',
dest='show_checks',
metavar='<service>',
default=None)
self.subparser = parser
self.args = parser.parse_args(sys.argv[2:])
def show(self):
results = self.get_results()
if not results:
logger.warning('No service to display')
else:
data = list()
columns = [
'id',
'IP',
#'Hostname',
'Port',
'Proto',
'Service',
'Banner',
'URL',
'Comment',
'Checks',
'Creds',
]
for r in results:
nb_userpass = r.get_nb_credentials(single_username=False)
nb_usernames = r.get_nb_credentials(single_username=True)
nb_creds = '{}{}{}'.format(
'{}'.format(Output.colored(str(nb_userpass), color='green' \
if nb_userpass > 0 else None)) if nb_userpass > 0 else '',
'/' if nb_userpass > 0 and nb_usernames > 0 else '',
'{} users'.format(Output.colored(str(nb_usernames), color='yellow' \
if nb_usernames > 0 else None)) if nb_usernames > 0 else '')
data.append([
r.id,
r.host.ip,
#r.host.hostname,
r.port,
{
Protocol.TCP: 'tcp',
Protocol.UDP: 'udp'
}.get(r.protocol),
r.name,
StringUtils.wrap(r.banner, 65),
StringUtils.wrap(r.url, 50),
StringUtils.wrap(r.comment, 50),
len(r.results),
nb_creds,
])
Output.table(columns, data, hrules=False)
def do_hosts(self, args):
"""Hosts in the current mission scope"""
print()
req = HostsRequester(self.sqlsess)
req.select_mission(self.current_mission)
# Logical AND is applied between all specified filtering options
filter_ = Filter(FilterOperator.AND)
if args.addrs:
for addr in args.addrs:
if NetUtils.is_valid_ip(addr) or NetUtils.is_valid_ip_range(addr):
filter_.add_condition(Condition(addr, FilterData.IP))
else:
filter_.add_condition(Condition(addr, FilterData.HOST))
if args.search:
filter_search = Filter(FilterOperator.OR)
filter_search.add_condition(Condition(args.search, FilterData.HOST))
filter_search.add_condition(Condition(args.search, FilterData.OS))
filter_search.add_condition(Condition(args.search, FilterData.COMMENT_HOST))
filter_.add_condition(filter_search)
if args.order:
req.order_by(args.order)
try:
req.add_filter(filter_)
except FilterException as e:
logger.error(e)
return
# Operations
if args.comment:
if not req.filter_applied:
if not Output.prompt_confirm('No filter applied. Are you sure you want to edit comment for ALL hosts in current mission ?', default=False):
logger.info('Canceled')
return
req.edit_comment(args.comment)
elif args.delete:
if not req.filter_applied:
if not Output.prompt_confirm('No filter applied. Are you sure you want to delete ALL hosts and related services in current mission', default=False):
logger.info('Canceled')
return
req.delete()
else:
req.show()
print()
def show_authentication_types(self, service='http'):
"""Display list of authentication types for HTTP."""
Output.title1('Supported {service} authentication types'.format(
service=service.upper()))
if not self.is_service_supported(service, multi=False):
logger.warning('The service {service} is not supported'.format(
service=service))
elif not self.services[service]['auth_types']:
logger.warning('No special authentication type for this service')
else:
data = list()
for t in sorted(self.services[service]['auth_types']):
data.append([t])
Output.table(['Authentication types'], data, hrules=False)
def show(self, filter_service=None):
"""
Display information about supported attack profiles
:param str filter_service: Service name to filter with (default: no filter)
"""
data = list()
columns = [
'Profile',
'Description',
]
for p in self.profiles:
#print(p.checks)
if not filter_service or p.is_service_supported(filter_service):
data.append([
Output.colored(p.name, attrs='bold'),
StringUtils.wrap(p.description, 120)
])
if filter_service:
service = 'for service {}'.format(filter_service.upper())
else:
service = ''
Output.title1('Attack Profiles {service}'.format(service=service))
Output.table(columns, data, hrules=False)
if not filter_service:
print
Output.print('Run "info --attack-profiles <service>" to see the attack ' \
'profiles supported for a given service.')
def show(self, highlight=None):
"""
Display selected missions.
:param str highlight: Name of the mission to highlight
"""
results = self.get_results()
if not results:
logger.warning('No matching mission')
else:
data = list()
columns = [
'Mission',
'Creation date',
'Comment',
'# Hosts',
'# Services',
]
for mission in results:
color = 'light_green' if mission.name == highlight else None
data.append([
Output.colored(mission.name, color=color),
Output.colored(str(mission.creation_date), color=color),
Output.colored(StringUtils.wrap(mission.comment, 50), color=color),
Output.colored(len(mission.hosts), color=color),
Output.colored(mission.get_nb_services(), color=color),
])
Output.table(columns, data, hrules=False)
def show_search_results(self, string, nb_words=12):
"""
Display command outputs search results.
For good readability, only some words surrounding the search string are
displayed.
:param str string: Search string (accepts wildcard "%")
:param int nb_words: Number of words surrounding the search string to show
"""
results = self.query.filter(CommandOutput.output.ilike('%'+string+'%'))
if not results:
logger.error('No result')
else:
Output.title2('Search results:')
data = list()
columns = [
'IP',
'Port',
'Proto',
'Service',
'Check id',
'Category',
'Check',
'Matching text',
]
for r in results:
match = StringUtils.surrounding_text(r.outputraw, string, nb_words)
# There might have several matches in one command result (one row
# per match)
for m in match:
data.append([
r.result.service.host.ip,
r.result.service.port,
{Protocol.TCP: 'tcp', Protocol.UDP: 'udp'}.get(
r.result.service.protocol),
r.result.service.name,
r.result.id,
r.result.category,
r.result.check,
StringUtils.wrap(m, 70),
])
print()
Output.table(columns, data, hrules=False)
def __run_check_command(self):
"""
Run the check command. The goal is to quickly check if the tool is not buggy or
missing some dependencies
:return: Boolean indicating if tool is correctly installed
"""
logger.info('Running the check command for the tool {tool}...'.format(
tool=self.name_display))
cmd = self.check_command.get_cmdline(self.tool_dir)
Output.begin_cmd(cmd)
ProcessLauncher(cmd).start()
Output.delimiter()
return Output.prompt_confirm(
'Does the tool {tool} seem to be running correctly ?'.format(
tool=self.name_display),
default=True)
