def engine(argvs):
try:
targets = open(argvs[1]).read().rsplit()
except:
print 'no input'
return []
targets = load(targets)
print 'Targets list ...'
for target in targets:
print 'Target:', target, 'Type:', targets[target]
analysis(targets)
return 0
def __go_for_attacks(targets,
check_ranges,
check_subdomains,
log_in_file,
time_sleep,
language,
verbose_level,
retries,
socks_proxy,
users,
passwds,
timeout_sec,
thread_number,
ports,
ping_flag,
methods_args,
backup_ports,
scan_method,
thread_number_host,
graph_flag,
profile,
api_flag,
scan_id=None):
"""
preparing for attacks and managing multi-processing for host
Args:
targets: list of calculated targets
check_ranges: check IP range flag
check_subdomains: check subdomain flag
log_in_file: output filename
time_sleep: time sleep seconds
language: language
verbose_level: verbose level number
retries: retries number
socks_proxy: socks proxy address
users: usernames
passwds: passwords
timeout_sec: timeout seconds
thread_number: thread numbers
ports: port numbers
ping_flag: ping before scan flag
methods_args: method args for modules
backup_ports: port numbers (backup)
scan_method: selected module names
thread_number_host: threads for hosts scan
graph_flag: graph name
profile: profile name
api_flag: API flag
Returns:
True when it ends
"""
suff = now(model="%Y_%m_%d_%H_%M_%S") + "".join(
random.choice(string.ascii_lowercase) for x in range(10))
subs_temp = "{}/tmp/subs_temp_".format(load_file_path()) + suff
range_temp = "{}/tmp/ranges_".format(load_file_path()) + suff
total_targets = -1
for total_targets, _ in enumerate(
analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, retries, socks_proxy, True)):
pass
total_targets += 1
total_targets = total_targets * len(scan_method)
try:
os.remove(range_temp)
except:
pass
range_temp = "{}/tmp/ranges_".format(load_file_path()) + suff
targets = analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, retries, socks_proxy, False)
trying = 0
if scan_id is None:
scan_id = "".join(random.choice("0123456789abcdef") for x in range(32))
scan_cmd = messages(language, "through_API") if api_flag else " ".join(
sys.argv)
for target in targets:
for sm in scan_method:
trying += 1
p = multiprocessing.Process(
target=start_attack,
args=(str(target).rsplit()[0], trying, total_targets, sm,
users, passwds, timeout_sec, thread_number, ports,
log_in_file, time_sleep, language, verbose_level,
socks_proxy, retries, ping_flag, methods_args, scan_id,
scan_cmd))
p.name = str(target) + "->" + sm
p.start()
while 1:
n = 0
processes = multiprocessing.active_children()
for process in processes:
if process.is_alive():
n += 1
else:
processes.remove(process)
if n >= thread_number_host:
time.sleep(0.01)
else:
break
_waiting_for = 0
while 1:
try:
exitflag = True
if len(multiprocessing.active_children()) is not 0:
exitflag = False
_waiting_for += 1
if _waiting_for > 3000:
_waiting_for = 0
info(
messages(language, "waiting").format(", ".join(
[p.name for p in multiprocessing.active_children()])))
time.sleep(0.01)
if exitflag:
break
except KeyboardInterrupt:
for process in multiprocessing.active_children():
process.terminate()
break
info(messages(language, "remove_temp"))
os.remove(subs_temp)
os.remove(range_temp)
info(messages(language, "sorting_results"))
sort_logs(log_in_file, language, graph_flag, scan_id, scan_cmd,
verbose_level, 0, profile, scan_method, backup_ports)
write("\n")
info(messages(language, "done"))
write("\n\n")
finish()
return True
def load():
write('\n\n')
# load libs
from core.color import finish
# load all modules in lib/brute, lib/scan, lib/graph
module_names = load_all_modules()
graph_names = load_all_graphs()
# Parse ARGVs
try:
parser, options, startup_update_flag = load_all_args(
module_names, graph_names)
except SystemExit:
finish()
sys.exit(1)
# Filling Options
check_ranges = options.check_ranges
check_subdomains = options.check_subdomains
targets = options.targets
targets_list = options.targets_list
thread_number = options.thread_number
thread_number_host = options.thread_number_host
log_in_file = options.log_in_file
scan_method = options.scan_method
exclude_method = options.exclude_method
users = options.users
users_list = options.users_list
passwds = options.passwds
passwds_list = options.passwds_list
timeout_sec = options.timeout_sec
ports = options.ports
time_sleep = options.time_sleep
language = options.language
verbose_level = options.verbose_level
show_version = options.show_version
check_update = options.check_update
proxies = options.proxies
proxies_file = options.proxies_file
retries = options.retries
graph_flag = options.graph_flag
help_menu_flag = options.help_menu_flag
ping_flag = options.ping_flag
methods_args = options.methods_args
method_args_list = options.method_args_list
# Checking Requirements
(targets, targets_list, thread_number, thread_number_host,
log_in_file, scan_method, exclude_method, users, users_list,
passwds, passwds_list, timeout_sec, ports, parser, module_names, language, verbose_level, show_version,
check_update, proxies, proxies_file, retries, graph_flag, help_menu_flag, methods_args, method_args_list) = \
check_all_required(
targets, targets_list, thread_number, thread_number_host,
log_in_file, scan_method, exclude_method, users, users_list,
passwds, passwds_list, timeout_sec, ports, parser, module_names, language, verbose_level, show_version,
check_update, proxies, proxies_file, retries, graph_flag, help_menu_flag, methods_args, method_args_list
)
info(messages(language, 0))
# check for update
if startup_update_flag is True:
__version__, __code_name__ = _version_info()
_check(__version__, __code_name__, language)
info(
messages(
language,
96).format(len(load_all_modules()) - 1 + len(load_all_graphs())))
suff = str(datetime.datetime.now()).replace(' ', '_').replace(
':', '-') + '_' + ''.join(
random.choice(string.ascii_uppercase + string.digits)
for _ in range(10))
subs_temp = 'tmp/subs_temp_%s' % (suff)
range_temp = 'tmp/ranges_%s' % (suff)
total_targets = -1
for total_targets, _ in enumerate(
analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, show_version, check_update, proxies,
retries)):
pass
total_targets += 1
total_targets = total_targets * len(scan_method)
targets = analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, show_version, check_update, proxies,
retries)
threads = []
trying = 0
for target in targets:
for sm in scan_method:
trying += 1
t = threading.Thread(
target=start_attack,
args=(str(target).rsplit()[0], trying, total_targets, sm,
users, passwds, timeout_sec, thread_number, ports,
log_in_file, time_sleep, language, verbose_level,
show_version, check_update, proxies, retries, ping_flag,
methods_args))
threads.append(t)
t.start()
while 1:
n = 0
for thread in threads:
if thread.isAlive() is True:
n += 1
else:
threads.remove(thread)
if n >= thread_number_host:
time.sleep(0.01)
else:
break
while 1:
try:
n = True
for thread in threads:
if thread.isAlive() is True:
n = False
time.sleep(0.01)
if n is True:
break
except KeyboardInterrupt:
break
info(messages(language, 42))
os.remove(subs_temp)
os.remove(range_temp)
info(messages(language, 43))
sort_logs(log_in_file, language, graph_flag)
write('\n')
info(messages(language, 44))
write('\n\n')
finish()
def load():
write('\n\n')
info('Nettacker engine started ...')
# module_names = ['smtp_brute', 'ftp_brute', 'rdp_brute', 'ssh_brute', 'http_brute', 'mysql_brute', 'mssql_brute']
module_names = [
'smtp_brute', 'port_scan', 'ftp_brute', 'ssh_brute', 'scada_scan'
]
parser = OptionParser(
usage='python nettacker.py [options]',
description='Nettacker Help Menu',
epilog=
'Please read license and agreements https://github.com/Nettacker/Nettacker'
)
parser.add_option('-r',
'--range',
action='store_true',
default=False,
dest='check_ranges',
help='scan all IPs in range')
parser.add_option('-s',
'--sub-domains',
action='store_true',
default=False,
dest='check_subdomains',
help='find and scan subdomains')
parser.add_option('-t',
'--thread-connection',
action='store',
default=10,
type='int',
dest='thread_number',
help='thread numbers for connections to a host')
parser.add_option('-M',
'--thread-hostscan',
action='store',
default=10,
type='int',
dest='thread_number_host',
help='thread numbers for scan hosts')
parser.add_option('-L',
'--logs',
action='store_true',
default=False,
dest='log_in_file',
help='save all logs in file (logs.txt)')
# Target Options
target = OptionGroup(parser, "Target", "Target input options")
target.add_option('-i',
'--targets',
action='store',
dest='targets',
default=None,
help='target(s) list, separate with ","')
target.add_option('-l',
'--targets-list',
action='store',
dest='targets_list',
default=None,
help='read target(s) from file')
parser.add_option_group(target)
# Methods Options
method = OptionGroup(parser, "Method", "Scan method options")
method.add_option('-a',
'--automatic',
action='store_true',
default=False,
dest='auto_scan',
help='automatically scan every services')
method.add_option('-m',
'--method',
action='store',
dest='scan_method',
default=None,
help='choose scan method %s' % (module_names))
method.add_option('-u',
'--usernames',
action='store',
dest='users',
default=None,
help='username(s) list, separate with ","')
method.add_option('-U',
'--users-list',
action='store',
dest='users_list',
default=None,
help='read username(s) from file')
method.add_option('-p',
'--passwords',
action='store',
dest='passwds',
default=None,
help='password(s) list, separate with ","')
method.add_option('-P',
'--passwords-list',
action='store',
dest='passwds_list',
default=None,
help='read passwords(s) from file')
method.add_option('-g',
'--ports',
action='store',
dest='ports',
default=None,
help='port(s) list, separate with ","')
method.add_option('-T',
'--timeout',
action='store',
dest='timeout_sec',
default=0.5,
type='float',
help='read passwords(s) from file')
parser.add_option_group(method)
# Parse ARGVs
(options, args) = parser.parse_args()
# Checking Requirements
check_ranges = options.check_ranges
check_subdomains = options.check_subdomains
targets = options.targets
targets_list = options.targets_list
thread_number = options.thread_number
thread_number_host = options.thread_number_host
auto_scan = options.auto_scan
scan_method = options.scan_method
users = options.users
users_list = options.users_list
passwds = options.passwds
passwds_list = options.passwds_list
timeout_sec = options.timeout_sec
ports = options.ports
if targets is None and targets_list is None:
parser.print_help()
write('\n')
sys.exit(error('Cannot specify the target(s)'))
else:
if targets is not None:
targets = list(set(targets.rsplit(',')))
elif targets_list is not None:
try:
targets = list(set(open(targets_list, 'rb').read().rsplit()))
except:
sys.exit(
error(
'Cannot specify the target(s), unable to open file: %s'
% (targets_list)))
if thread_number > 100:
warn(
'it\'s better to use thread number lower than 100, BTW we are continuing...'
)
if timeout_sec >= 15:
warn(
'set timeout to %s seconds, it is too big, isn\'t it ? by the way we are continuing...'
)
if auto_scan is True and scan_method is not None:
sys.exit(
error(
'please use specify method or automatic option, you can\'t using both!'
))
if scan_method is not None and scan_method not in module_names:
sys.exit(error('this scan module [%s] not found!' % (scan_method)))
if scan_method is None:
sys.exit(error('please choose your scan method!'))
if auto_scan is True:
sys.exit(
error(
'this module is not ready to use in this version, please choose your scan method'
))
if ports is None and scan_method is not None and (
scan_method[-6:] == '_brute' or scan_method[-5:] == '_scan'):
sys.exit(
error('this module required port(s) (list) to bruteforce/scan!'))
else:
if '-' in ports:
ports = ports.rsplit('-')
ports = range(int(ports[0]), int(ports[1]) + 1)
else:
ports = ports.rsplit(',')
if users is None and users_list is None and scan_method is not None and scan_method[
-6:] == '_brute':
sys.exit(
error('this module required username(s) (list) to bruteforce!'))
else:
if users is not None:
users = list(set(users.rsplit(',')))
if users_list is not None:
try:
users = list(set(
open(users_list).read().rsplit('\n'))) # fix later
except:
sys.exit(
error(
'Cannot specify the username(s), unable to open file: %s'
% (targets_list)))
if passwds is None and passwds_list is None and scan_method is not None and scan_method[
-6:] == '_brute':
sys.exit(
error('this module required password(s) (list) to bruteforce!'))
else:
if passwds is not None:
passwds = list(set(passwds.rsplit(',')))
if passwds_list is not None:
try:
passwds = list(set(
open(passwds_list).read().rsplit('\n'))) # fix later
except:
sys.exit(
error(
'Cannot specify the password(s), unable to open file: %s'
% (targets_list)))
total_targets = analysis(targets, check_ranges, check_subdomains)
targets = open('tmp/tmp_targets')
m = 0
threads = []
max = thread_number_host
trying = 0
for target in targets:
m += 1
trying += 1
t = threading.Thread(target=start_attack,
args=(target.rsplit()[0], m, total_targets,
scan_method, users, passwds, timeout_sec,
thread_number, ports))
threads.append(t)
t.start()
while 1:
n = 0
for thread in threads:
if thread.isAlive() is True:
n += 1
else:
threads.remove(thread)
if n >= max:
time.sleep(0.1)
else:
break
write('\n')
info('done!')
write('\n\n')
def load():
write("\n\n")
# load libs
from core.color import finish
# load all modules in lib/brute, lib/scan, lib/graph
module_names = load_all_modules()
graph_names = load_all_graphs()
# Parse ARGVs
try:
parser, options, startup_update_flag = load_all_args(
module_names, graph_names)
except SystemExit:
finish()
sys.exit(1)
# Filling Options
check_ranges = options.check_ranges
check_subdomains = options.check_subdomains
targets = options.targets
targets_list = options.targets_list
thread_number = options.thread_number + 1
thread_number_host = options.thread_number_host
log_in_file = options.log_in_file
scan_method = options.scan_method
exclude_method = options.exclude_method
users = options.users
users_list = options.users_list
passwds = options.passwds
passwds_list = options.passwds_list
timeout_sec = options.timeout_sec
ports = options.ports
time_sleep = options.time_sleep
language = options.language
verbose_level = options.verbose_level
show_version = options.show_version
check_update = options.check_update
socks_proxy = options.socks_proxy
retries = options.retries
graph_flag = options.graph_flag
help_menu_flag = options.help_menu_flag
ping_flag = options.ping_flag
methods_args = options.methods_args
method_args_list = options.method_args_list
wizard_mode = options.wizard_mode
profile = options.profile
start_api = options.start_api
api_host = options.api_host
api_port = options.api_port
api_debug_mode = options.api_debug_mode
api_access_key = options.api_access_key
api_client_white_list = options.api_client_white_list
api_client_white_list_ips = options.api_client_white_list_ips
api_access_log = options.api_access_log
api_access_log_filename = options.api_access_log_filename
# Checking Requirements
(targets, targets_list, thread_number, thread_number_host,
log_in_file, scan_method, exclude_method, users, users_list,
passwds, passwds_list, timeout_sec, ports, parser, module_names, language, verbose_level, show_version,
check_update, socks_proxy, retries, graph_flag, help_menu_flag, methods_args, method_args_list, wizard_mode,
profile, start_api, api_host, api_port, api_debug_mode, api_access_key, api_client_white_list,
api_client_white_list_ips, api_access_log, api_access_log_filename) = \
check_all_required(
targets, targets_list, thread_number, thread_number_host,
log_in_file, scan_method, exclude_method, users, users_list,
passwds, passwds_list, timeout_sec, ports, parser, module_names, language, verbose_level, show_version,
check_update, socks_proxy, retries, graph_flag, help_menu_flag, methods_args, method_args_list, wizard_mode,
profile, start_api, api_host, api_port, api_debug_mode, api_access_key, api_client_white_list,
api_client_white_list_ips, api_access_log, api_access_log_filename
)
info(messages(language, 0))
# check for update
if startup_update_flag:
__version__, __code_name__ = _version_info()
_check(__version__, __code_name__, language, socks_proxy)
info(
messages(
language,
96).format(len(load_all_modules()) - 1 + len(load_all_graphs())))
suff = now(model="%Y_%m_%d_%H_%M_%S") + "".join(
random.choice(string.ascii_lowercase) for x in range(10))
subs_temp = "tmp/subs_temp_" + suff
range_temp = "tmp/ranges_" + suff
total_targets = -1
for total_targets, _ in enumerate(
analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, retries, socks_proxy, True)):
pass
total_targets += 1
total_targets = total_targets * len(scan_method)
try:
os.remove(range_temp)
except:
pass
range_temp = "tmp/ranges_" + suff
targets = analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, retries, socks_proxy, False)
trying = 0
scan_id = "".join(random.choice("0123456789abcdef") for x in range(32))
scan_cmd = " ".join(sys.argv)
for target in targets:
for sm in scan_method:
trying += 1
p = multiprocessing.Process(
target=start_attack,
args=(str(target).rsplit()[0], trying, total_targets, sm,
users, passwds, timeout_sec, thread_number, ports,
log_in_file, time_sleep, language, verbose_level,
socks_proxy, retries, ping_flag, methods_args, scan_id,
scan_cmd))
p.name = str(target) + "->" + sm
p.start()
while 1:
n = 0
processes = multiprocessing.active_children()
for process in processes:
if process.is_alive():
n += 1
else:
processes.remove(process)
if n >= thread_number_host:
time.sleep(0.01)
else:
break
_waiting_for = 0
while 1:
try:
exitflag = True
if len(multiprocessing.active_children()) is not 0:
exitflag = False
_waiting_for += 1
if _waiting_for > 3000:
_waiting_for = 0
info(
messages(language, 138).format(", ".join(
[p.name for p in multiprocessing.active_children()])))
time.sleep(0.01)
if exitflag:
break
except KeyboardInterrupt:
for process in multiprocessing.active_children():
process.terminate()
break
info(messages(language, 42))
os.remove(subs_temp)
os.remove(range_temp)
info(messages(language, 43))
sort_logs(log_in_file, language, graph_flag)
write("\n")
info(messages(language, 44))
write("\n\n")
finish()
def load():
write('\n\n')
# load all modules in lib/brute and lib/scan
module_names = load_all_modules()
# Parse ARGVs
parser, (options, args) = load_all_args(module_names)
# Filling Options
check_ranges = options.check_ranges
check_subdomains = options.check_subdomains
targets = options.targets
targets_list = options.targets_list
thread_number = options.thread_number
thread_number_host = options.thread_number_host
log_in_file = options.log_in_file
scan_method = options.scan_method
exclude_method = options.exclude_method
users = options.users
users_list = options.users_list
passwds = options.passwds
passwds_list = options.passwds_list
timeout_sec = options.timeout_sec
ports = options.ports
time_sleep = options.time_sleep
language = options.language
verbose_level = options.verbose_level
show_version = options.show_version
check_update = options.check_update
proxies = options.proxies
proxies_file = options.proxies_file
retries = options.retries
info(messages("en", 0))
# Checking Requirements
(targets, targets_list, thread_number, thread_number_host,
log_in_file, scan_method, exclude_method, users, users_list,
passwds, passwds_list, timeout_sec, ports, parser, module_names, language, verbose_level, show_version,
check_update, proxies, proxies_file, retries) = \
check_all_required(
targets, targets_list, thread_number, thread_number_host,
log_in_file, scan_method, exclude_method, users, users_list,
passwds, passwds_list, timeout_sec, ports, parser, module_names, language, verbose_level, show_version,
check_update, proxies, proxies_file, retries
)
suff = str(datetime.datetime.now()).replace(' ', '_').replace(
':', '-') + '_' + ''.join(
random.choice(string.ascii_uppercase + string.digits)
for _ in range(10))
subs_temp = 'tmp/subs_temp_%s' % (suff)
range_temp = 'tmp/ranges_%s' % (suff)
total_targets = -1
for total_targets, _ in enumerate(
analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, show_version, check_update, proxies,
retries)):
pass
total_targets += 1
total_targets = total_targets * len(scan_method)
targets = analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, show_version, check_update, proxies,
retries)
threads = []
trying = 0
for target in targets:
for sm in scan_method:
trying += 1
t = threading.Thread(
target=start_attack,
args=(str(target).rsplit()[0], trying, total_targets, sm,
users, passwds, timeout_sec, thread_number, ports,
log_in_file, time_sleep, language, verbose_level,
show_version, check_update, proxies, retries))
threads.append(t)
t.start()
while 1:
n = 0
for thread in threads:
if thread.isAlive() is True:
n += 1
else:
threads.remove(thread)
if n >= thread_number_host:
time.sleep(0.1)
else:
break
while 1:
n = True
for thread in threads:
if thread.isAlive() is True:
n = False
time.sleep(0.1)
if n is True:
break
info(messages(language, 42))
os.remove(subs_temp)
os.remove(range_temp)
info(messages(language, 43))
sort_logs(log_in_file, language)
write('\n')
info(messages(language, 44))
write('\n\n')
def __scan(config, scan_id, scan_cmd):
# Setting Variables
targets = config["targets"]
check_ranges = config["check_ranges"]
check_subdomains = config["check_subdomains"]
log_in_file = config["log_in_file"]
time_sleep = config["time_sleep"]
language = config["language"]
verbose_level = config["verbose_level"]
retries = config["retries"]
socks_proxy = config["socks_proxy"]
scan_method = config["scan_method"]
users = config["users"]
passwds = config["passwds"]
timeout_sec = config["timeout_sec"]
thread_number = config["thread_number"]
ports = config["ports"]
ping_flag = config["ping_flag"]
methods_args = config["methods_args"]
thread_number_host = config["thread_number_host"]
graph_flag = config["graph_flag"]
suff = now(model="%Y_%m_%d_%H_%M_%S") + "".join(
random.choice(string.ascii_lowercase) for x in range(10))
subs_temp = "tmp/subs_temp_" + suff
range_temp = "tmp/ranges_" + suff
total_targets = -1
for total_targets, _ in enumerate(
analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, retries, socks_proxy, True)):
pass
total_targets += 1
total_targets = total_targets * len(scan_method)
try:
os.remove(range_temp)
except:
pass
range_temp = "tmp/ranges_" + suff
targets = analysis(targets, check_ranges, check_subdomains, subs_temp,
range_temp, log_in_file, time_sleep, language,
verbose_level, retries, socks_proxy, False)
trying = 0
for target in targets:
for sm in scan_method:
trying += 1
p = multiprocessing.Process(
target=start_attack,
args=(str(target).rsplit()[0], trying, total_targets, sm,
users, passwds, timeout_sec, thread_number, ports,
log_in_file, time_sleep, language, verbose_level,
socks_proxy, retries, ping_flag, methods_args, scan_id,
scan_cmd))
p.name = str(target) + "->" + sm
p.start()
while 1:
n = 0
processes = multiprocessing.active_children()
for process in processes:
if process.is_alive():
n += 1
else:
processes.remove(process)
if n >= thread_number_host:
time.sleep(0.01)
else:
break
_waiting_for = 0
while 1:
try:
exitflag = True
if len(multiprocessing.active_children()) is not 0:
exitflag = False
_waiting_for += 1
if _waiting_for > 3000:
_waiting_for = 0
info(
messages(language, 138).format(", ".join(
[p.name for p in multiprocessing.active_children()])))
time.sleep(0.01)
if exitflag:
break
except KeyboardInterrupt:
for process in multiprocessing.active_children():
process.terminate()
break
info(messages(language, 42))
os.remove(subs_temp)
os.remove(range_temp)
info(messages(language, 43))
sort_logs(log_in_file, language, graph_flag)
write("\n")
info(messages(language, 44))
write("\n\n")
finish()
return True
