def conclude(self):
result_path = utils.replace_argument(self.options,
'$WORKSPACE/headers/details')
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
#head of csv file
random_json = utils.reading_json(os.listdir(result_path)[0])
summary_head = ','.join(random_json.keys()) + ",source\n"
report_path = utils.replace_argument(
self.options, '$WORKSPACE/headers/summary-$TARGET.csv')
with open(report_path, 'w+') as r:
r.write(summary_head)
# really_details = {}
for filename in glob.iglob(result_path + '/**/*.json'):
details = utils.reading_json(filename)
summarybody = ",".join([v['pass'] for k, v in details.items()
]) + "," + filename + "\n"
with open(report_path, 'a+') as r:
r.write(summarybody)
utils.check_output(report_path)
main_json['Modules'][self.module_name] = {"path": report_path}
def prepare_input(self):
if self.is_direct:
# if direct input was file just read it
if utils.not_empty_file(self.is_direct):
domains = utils.just_read(self.is_direct).splitlines()
http_domains_path = self.is_direct
# get input string
else:
domains = [self.is_direct.strip()]
http_domains_path = utils.reading_json(
utils.replace_argument(
self.options, '$WORKSPACE/directory/domain-lists.txt'))
utils.just_write(http_domains_path, "\n".join(domains))
else:
http_domains_path = utils.replace_argument(
self.options, '$WORKSPACE/assets/http-$OUTPUT.txt')
# if assets module done return it
if utils.not_empty_file(http_domains_path):
domains = utils.just_read(http_domains_path).splitlines()
return domains, http_domains_path
# matching IP with subdomain
main_json = utils.reading_json(
utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'))
domains = [x.get('Domain') for x in main_json['Subdomains']]
http_domains_path = utils.reading_json(
utils.replace_argument(
self.options, '$WORKSPACE/directory/domain-lists.txt'))
utils.just_write(http_domains_path, "\n".join(domains))
return domains, http_domains_path
def nmap_vuln(self):
utils.print_good('Starting Nmap VulnScan')
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = []
if self.options['SPEED'] == 'slow':
ip_list = [x.get("IP")
for x in main_json['Subdomains'] if x.get("IP") is not None] + main_json['IP Space']
elif self.options['SPEED'] == 'quick':
ip_list = [x.get("IP")
for x in main_json['Subdomains'] if x.get("IP") is not None]
ip_list = set([ip for ip in ip_list if ip != 'N/A'])
if self.options['DEBUG'] == 'True':
ip_list = list(ip_list)[:5]
# Scan every 5 IP at time Increse if you want
for part in list(utils.chunks(ip_list, 2)):
for ip in part:
cmd = 'sudo nmap -T4 -Pn -n -sSV -p- {0} --script $PLUGINS_PATH/vulners --oA $WORKSPACE/vulnscan/{0}-nmap'.format(
ip.strip())
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/vulnscan/{0}-nmap.nmap'.format(ip.strip()))
std_path = utils.replace_argument(
self.options, '$WORKSPACE/vulnscan/std-{0}-nmap.std'.format(ip.strip()))
execute.send_cmd(self.options, cmd, output_path, std_path, self.module_name)
# check if previous task done or not every 30 second
while not utils.checking_done(module=self.module_name):
time.sleep(60)
def conclude(self):
output_path = utils.replace_argument(
self.options, '$WORKSPACE/portscan/$OUTPUT-masscan.xml')
if not utils.not_empty_file(output_path):
return
self.create_html_report()
#parsing masscan xml
tree = ET.parse(output_path)
root = tree.getroot()
masscan_json = {}
for host in root.iter('host'):
ip = host[0].get('addr')
ports = [(str(x.get('portid')) + "/" + str(x.get('protocol')))
for x in host[1]]
masscan_json[ip] = ports
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
#update the main json
for i in range(len(main_json['Subdomains'])):
ip = main_json['Subdomains'][i].get('IP')
if ip != "N/A" and ip in masscan_json.keys():
main_json['Subdomains'][i]['Ports'] = masscan_json.get(ip)
utils.just_write(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
def conclude(self):
utils.print_banner("Conclusion for {0}".format(self.module_name))
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = utils.checking_done(
module=self.module_name, get_json=True)
ips_file = utils.replace_argument(
self.options, '$WORKSPACE/ipspace/$OUTPUT-ipspace.txt')
with open(ips_file, 'r') as s:
ips = s.read().splitlines()
main_json['IP Space'] = ips
# print(main_json['IP Space'])
#write that json again
utils.just_write(utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'),
main_json,
is_json=True)
#logging
logfile = utils.replace_argument(self.options, '$WORKSPACE/log.json')
utils.save_all_cmd(logfile)
utils.print_banner("{0} Done".format(self.module_name))
def conclude(self):
output_path = utils.replace_argument(
self.options, '$WORKSPACE/portscan/$OUTPUT-masscan.xml')
if not utils.not_empty_file(output_path):
return
self.create_html_report()
#parsing masscan xml
tree = ET.parse(output_path)
root = tree.getroot()
masscan_json = {}
for host in root.iter('host'):
ip = host[0].get('addr')
ports = [(str(x.get('portid')) + "/" + str(x.get('protocol')))
for x in host[1]]
masscan_json[ip] = ports
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
#update the main json
for i in range(len(main_json['Subdomains'])):
ip = main_json['Subdomains'][i].get('IP')
if ip != "N/A" and ip in masscan_json.keys():
main_json['Subdomains'][i]['Ports'] = masscan_json.get(ip)
#just save commands
logfile = utils.replace_argument(self.options, '$WORKSPACE/log.json')
utils.save_all_cmd(self.options, logfile)
utils.just_write(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
def result_parsing(self):
utils.print_good('Parsing XML for masscan report')
utils.make_directory(
self.options['WORKSPACE'] + '/portscan/parsed')
result_path = utils.replace_argument(
self.options, '$WORKSPACE/portscan')
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
for filename in glob.iglob(result_path + '/**/*.xml'):
ip = filename.split('/')[-1].split('-masscan.xml')[0]
masscan_report = NmapParser.parse_fromfile(filename)
masscan_report_json = json.dumps(masscan_report)
# store the raw json
utils.just_write(utils.replace_argument(
self.options, '$WORKSPACE/portscan/parsed/{0}.json'.format(ip)), masscan_report_json, is_json=True)
services = [x['__NmapHost__']['_services']
for x in masscan_report_json['_host']]
# ports = [y.get('_portid') for y in services]
ports = []
for service in services:
for element in service:
ports.append(
{"port": str(element['_portid']), "service": str(element['_protocol'])})
for i in range(len(main_json['Subdomains'])):
if main_json['Subdomains'][i]['IP'] == ip:
main_json['Subdomains'][i]['Network']['Ports'] = ports
utils.just_write(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
def run(self):
commands = execute.get_commands(
self.options, self.module_name).get('routines')
for item in commands:
utils.print_good('Starting {0}'.format(item.get('banner')))
#really execute it
execute.send_cmd(self.options, item.get('cmd'), item.get(
'output_path'), item.get('std_path'), self.module_name)
time.sleep(1)
utils.just_waiting(self.options, self.module_name, seconds=10, times=5)
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
for item in commands:
if "Whois" in item.get('cmd'):
main_json["Info"]["Whois"] = {"path": item.get('output_path')}
if "Dig" in item.get('cmd'):
main_json["Info"]["Dig"] = {"path": item.get('output_path')}
utils.just_write(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
def conclude(self):
output_path = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt')
# matching IP with subdomain
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
with open(output_path, 'r') as i:
data = i.read().splitlines()
ips = []
for line in data:
if " A " in line:
subdomain = line.split('. A ')[0]
ip = line.split('. A ')[1]
ips.append(ip)
for i in range(len(main_json['Subdomains'])):
if subdomain == main_json['Subdomains'][i]['Domain']:
main_json['Subdomains'][i]['IP'] = ip
final_ip = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
with open(final_ip, 'w+') as fip:
fip.write("\n".join(str(ip) for ip in ips))
utils.just_write(utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'),
main_json,
is_json=True)
def conclude(self):
self.unique_result()
utils.print_banner("Conclusion for {0}".format(self.module_name))
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
all_subdomain = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-$OUTPUT.txt')
with open(all_subdomain, 'r+') as s:
subdomains = s.read().splitlines()
for subdomain in subdomains:
main_json['Subdomains'].append({
"Domain": subdomain,
"IP": "N/A",
"Technology": [],
"Ports": [],
})
utils.just_write(utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'),
main_json,
is_json=True)
utils.print_banner("Done for {0}".format(self.module_name))
def run(self):
commands = execute.get_commands(self.options,
self.module_name).get('routines')
for item in commands:
utils.print_good('Starting {0}'.format(item.get('banner')))
#really execute it
execute.send_cmd(self.options, item.get('cmd'),
item.get('output_path'), item.get('std_path'),
self.module_name)
time.sleep(1)
utils.just_waiting(self.options, self.module_name, seconds=10, times=5)
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
for item in commands:
if "Whois" in item.get('cmd'):
main_json["Info"]["Whois"] = {"path": item.get('output_path')}
if "Dig" in item.get('cmd'):
main_json["Info"]["Dig"] = {"path": item.get('output_path')}
utils.just_write(utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'),
main_json,
is_json=True)
def quick_gobuster(self):
utils.print_good('Starting gobuster for short wordlist')
if self.is_direct:
domains = utils.just_read(self.is_direct).splitlines()
else:
#matching IP with subdomain
main_json = utils.reading_json(
utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'))
domains = [x.get('Domain') for x in main_json['Subdomains']]
if self.options['DEBUG'] == 'True':
domains = domains[:5]
custom_logs = {"module": self.module_name, "content": []}
for part in utils.chunks(domains, 3):
for domain in part:
#just strip everything to save local, it won't affect the result
strip_domain = domain.replace('http://', '').replace(
'https://', '').replace('/', '-')
cmd = '$GO_PATH/gobuster -k -q -e -x php,jsp,aspx,html,json -w $PLUGINS_PATH/wordlists/quick-content-discovery.txt -t 100 -o $WORKSPACE/directory/{1}-gobuster.txt -s 200,301,307 -u "{0}" '.format(
domain.strip(), strip_domain)
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options,
'$WORKSPACE/directory/quick/{0}-gobuster.txt'.format(
strip_domain))
std_path = utils.replace_argument(
self.options,
'$WORKSPACE/directory/quick/std-{0}-gobuster.std'.format(
strip_domain))
execute.send_cmd(self.options, cmd, output_path, std_path,
self.module_name)
# time.sleep(0.5)
#set status to done because this gonna will be submit when all command was done
custom_logs['content'].append({
"cmd": cmd,
"std_path": std_path,
"output_path": output_path,
"status": "Done"
})
#just wait couple seconds and continue but not completely stop the routine
time.sleep(20)
#submit a log
utils.print_info('Update activities log')
utils.force_done(self.options, self.module_name)
# utils.update_activities(self.options, str(custom_logs))
#just save commands
logfile = utils.replace_argument(self.options, '$WORKSPACE/log.json')
utils.save_all_cmd(self.options, logfile)
def conclude(self):
self.unique_result()
utils.print_banner("Conclusion for {0}".format(self.module_name))
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
all_subdomain = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-$OUTPUT.txt')
with open(all_subdomain, 'r') as s:
subdomains = s.read().splitlines()
for subdomain in subdomains:
main_json['Subdomains'].append({"Domain": subdomain})
main_json['Modules'][self.module_name] = utils.checking_done(
module=self.module_name, get_json=True)
utils.just_write(utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'),
main_json,
is_json=True)
#write that json again
# utils.just_write(utils.reading_json(), main_json, is_json=True)
#logging
logfile = utils.replace_argument(self.options, '$WORKSPACE/log.json')
utils.save_all_cmd(logfile)
utils.print_banner("{0}".format(self.module_name))
def dirsearch(self):
utils.print_good('Starting dirsearch')
#matching IP with subdomain
main_json = utils.reading_json(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
domains = [x.get('Domain') for x in main_json['Subdomains']]
if self.options['DEBUG'] == 'True':
domains = domains[:5]
custom_logs = {"module": self.module_name, "content": []}
for part in list(utils.chunks(domains, 2)):
for domain in part:
cmd = "python3 $PLUGINS_PATH/dirsearch/dirsearch.py --json-report=$WORKSPACE/directory/{0}-dirsearch.json -u '{0}' -e php,jsp,aspx,js,html -t 20 -b".format(domain.strip())
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(self.options, '$WORKSPACE/directory/{0}-dirsearch.json'.format(domain.strip()))
std_path = utils.replace_argument(self.options, '$WORKSPACE/directory/std-{0}-dirsearch.std'.format(domain.strip()))
execute.send_cmd(cmd, output_path, std_path, self.module_name, True)
# time.sleep(0.5)
#set status to done because this gonna will be submit when all command was done
custom_logs['content'].append({"cmd": cmd, "std_path": std_path, "output_path": output_path, "status": "Done"})
#just wait couple seconds and continue but not completely stop the routine
time.sleep(20)
#submit a log
utils.print_info('Update activities log')
utils.update_activities(str(custom_logs))
def prepare_input(self):
if self.is_direct:
if utils.not_empty_file(self.is_direct):
ip_file = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
# print(ip_file)
ip_list = utils.just_read(ip_file).splitlines()
ip_list = list(set([ip for ip in ip_list if ip != 'N/A']))
else:
ip_list = utils.resolve_input(self.is_direct)
else:
main_json = utils.reading_json(
utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = []
if self.options['SPEED'] == 'slow':
ip_list = [
x.get("IP")
for x in main_json['Subdomains'] if x.get("IP") is not None
] + main_json['IP Space']
elif self.options['SPEED'] == 'quick':
ip_list = [
x.get("IP") for x in main_json['Subdomains']
if x.get("IP") is not None
]
ip_list = set([ip for ip in ip_list if ip != 'N/A'])
return ip_list
def parsing_ouput(self):
utils.print_good('Parsing result found to a file')
final_result = utils.replace_argument(
self.options, '$WORKSPACE/directory/$OUTPUT-summary.txt')
# dirsearch part
dirsearch_files = utils.list_files(self.options['WORKSPACE'] +
'/directory/quick',
pattern='*-dirsearch.txt')
for file in dirsearch_files:
data = utils.just_read(file)
if data:
utils.just_append(final_result, data)
# wfuzz part
wfuzz_files = utils.list_files(self.options['WORKSPACE'] +
'/directory/quick',
pattern='*-wfuzz.json')
for file in wfuzz_files:
data_json = utils.reading_json(file)
if data_json:
data = "\n".join([x.get("url") for x in data_json])
utils.just_append(final_result, data)
# final_result
utils.clean_up(final_result)
utils.check_output(final_result)
def summary_report(options):
global headers
workspace = utils.get_workspace(options=options)
try:
url = options['REMOTE_API'] + "/api/workspace/{0}".format(workspace)
r = sender(url, headers=headers, data={}, method='GET')
if r:
main_json = r.json()
except Exception:
main_json_path = Path(options.get('WORKSPACE')).joinpath(
'{0}.json'.format(workspace))
main_json = utils.reading_json(main_json_path)
if not main_json:
utils.print_bad("Can't get log file for {0} workspace".format(
options.get('TARGET')))
return None
subdomains = main_json.get('Subdomains')
head = ['Domain', 'IP', 'Technologies', 'Ports']
contents = []
for element in subdomains:
item = [
element.get('Domain'),
element.get('IP'),
"\n".join(element.get('Technology')),
",".join(element.get('Ports')),
]
contents.append(item)
print(tabulate(contents, head, tablefmt="grid"))
def full_report(options):
global headers
try:
workspace = utils.get_workspace(options=options)
url = options['REMOTE_API'] + "/api/{0}/activities".format(workspace)
r = sender(url, headers=headers, data={}, method='GET')
if r:
raw_reports = r.json()
except Exception:
log_path = Path(options.get('WORKSPACE')).joinpath('log.json')
raw_reports = utils.reading_json(log_path)
if not raw_reports:
utils.print_bad("Can't get log file for {0} workspace".format(
options.get('TARGET')))
return None
modules = list(raw_reports.keys())
for module in modules:
if check_module(options, module):
reports = raw_reports.get(module)
utils.print_banner(module)
for report in reports:
cmd = report.get('cmd')
utils.print_info("Command Executed: {0}\n".format(cmd))
output_path = report.get('output_path')
std_path = report.get('std_path')
if 'raw' in options.get('REPORT').lower():
read_report(std_path)
elif 'full' in options.get('REPORT').lower():
read_report(output_path)
utils.print_line()
def prepare_input(self):
if self.is_direct:
# if direct input was file just read it
if utils.not_empty_file(self.is_direct):
ip_list = utils.just_read(self.is_direct).splitlines()
# get input string
else:
ip_list = utils.get_domain(self.is_direct).strip()
else:
main_json = utils.reading_json(
utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = []
if self.options['SPEED'] == 'slow':
ip_list = [
x.get("IP")
for x in main_json['Subdomains'] if x.get("IP") is not None
] + main_json['IP Space']
elif self.options['SPEED'] == 'quick':
ip_list = [
x.get("IP") for x in main_json['Subdomains']
if x.get("IP") is not None
]
ip_list = list(set([ip for ip in ip_list if ip != 'N/A']))
if self.options['DEBUG'] == 'True':
ip_list = list(ip_list)[:5]
# utils.print_debug(ip_list)
return ip_list
def conclude(self):
main_json = utils.reading_json(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = utils.checking_done(module=self.module_name, get_json=True)
#write that json again
utils.just_write(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
def dirsearch(self):
utils.print_good('Starting dirsearch')
if self.is_direct:
domains = utils.just_read(self.is_direct).splitlines()
else:
#matching IP with subdomain
main_json = utils.reading_json(
utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'))
domains = [x.get('Domain') for x in main_json['Subdomains']]
if self.options['DEBUG'] == 'True':
domains = domains[:5]
custom_logs = {"module": self.module_name, "content": []}
for part in utils.chunks(domains, 3):
for domain in part:
#just strip everything to save local, it won't affect the result
strip_domain = domain.replace('http://', '').replace(
'https://', '').replace('/', '-')
cmd = "python3 $PLUGINS_PATH/dirsearch/dirsearch.py -b -e php,zip,aspx,js --wordlist=$PLUGINS_PATH/wordlists/really-quick.txt --simple-report=$WORKSPACE/directory/quick/{1}-dirsearch.txt -t 50 -u {0}".format(
domain, strip_domain)
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options,
'$WORKSPACE/directory/quick/{0}-dirsearch.txt'.format(
strip_domain))
std_path = utils.replace_argument(
self.options,
'$WORKSPACE/directory/quick/std-{0}-dirsearch.std'.format(
strip_domain))
execute.send_cmd(self.options, cmd, output_path, std_path,
self.module_name)
# time.sleep(0.5)
#set status to done because this gonna will be submit when all command was done
custom_logs['content'].append({
"cmd": cmd,
"std_path": std_path,
"output_path": output_path,
"status": "Done"
})
#just wait couple seconds and continue but not completely stop the routine
time.sleep(20)
#submit a log
utils.print_info('Update activities log')
# utils.update_activities(self.options, str(custom_logs))
utils.force_done(self.options, self.module_name)
#just save commands
logfile = utils.replace_argument(self.options, '$WORKSPACE/log.json')
utils.save_all_cmd(self.options, logfile)
def technology_detection(self):
all_subdomain_path = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-$OUTPUT.txt')
if not utils.not_empty_file(all_subdomain_path):
return
#add https:// prefix for all domain
domains = utils.just_read(all_subdomain_path).splitlines()
scheme_path = utils.replace_argument(
self.options, '$WORKSPACE/recon/all-scheme-$OUTPUT.txt')
utils.just_write(
scheme_path,
"\n".join(domains + [("https://" + x.strip()) for x in domains]))
#really execute command
cmd = '$GO_PATH/webanalyze -apps $PLUGINS_PATH/apps.json -hosts $WORKSPACE/recon/all-scheme-$OUTPUT.txt -output json -worker 20 | tee $WORKSPACE/recon/$OUTPUT-technology.json'
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/recon/$OUTPUT-technology.json')
execute.send_cmd(self.options, cmd, '', '', self.module_name)
utils.just_waiting(self.options, self.module_name, seconds=10)
with open(output_path, encoding='utf-8') as o:
data = o.read().splitlines()
#parsing output to get technology
techs = {}
for line in data:
jsonl = json.loads(line)
if jsonl.get('matches'):
subdomain = jsonl.get('hostname').replace('https://', '')
if techs.get(subdomain):
techs[subdomain] += [
x.get('app_name') for x in jsonl.get('matches')
]
else:
techs[subdomain] = [
x.get('app_name') for x in jsonl.get('matches')
]
# print(techs)
#update the main json and rewrite that
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
for i in range(len(main_json['Subdomains'])):
sub = main_json['Subdomains'][i].get('Domain')
if techs.get(sub):
main_json['Subdomains'][i]["Technology"] = techs.get(sub)
utils.just_write(utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'),
main_json,
is_json=True)
def technology_detection(self):
all_subdomain_path = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-$OUTPUT.txt')
if not utils.not_empty_file(all_subdomain_path):
return
#add https:// prefix for all domain
domains = utils.just_read(all_subdomain_path).splitlines()
scheme_path = utils.replace_argument(
self.options, '$WORKSPACE/recon/all-scheme-$OUTPUT.txt')
utils.just_write(scheme_path, "\n".join(
domains + [("https://" + x.strip()) for x in domains]))
#really execute command
cmd = '$GO_PATH/webanalyze -apps $PLUGINS_PATH/apps.json -hosts $WORKSPACE/recon/all-scheme-$OUTPUT.txt -output json -worker 20 | tee $WORKSPACE/recon/$OUTPUT-technology.json'
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/recon/$OUTPUT-technology.json')
execute.send_cmd(self.options, cmd, output_path,
'', self.module_name)
utils.just_waiting(self.options, self.module_name, seconds=10, times=20)
with open(output_path, encoding='utf-8') as o:
data = o.read().splitlines()
#parsing output to get technology
techs = {}
for line in data:
try:
jsonl = json.loads(line)
if jsonl.get('matches'):
subdomain = jsonl.get('hostname').replace('https://', '')
if techs.get(subdomain):
techs[subdomain] += [x.get('app_name')
for x in jsonl.get('matches')]
else:
techs[subdomain] = [x.get('app_name')
for x in jsonl.get('matches')]
except:
pass
# print(techs)
#update the main json and rewrite that
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
for i in range(len(main_json['Subdomains'])):
sub = main_json['Subdomains'][i].get('Domain')
if techs.get(sub):
main_json['Subdomains'][i]["Technology"] = techs.get(sub)
utils.just_write(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
def conclude(self):
result_path = utils.replace_argument(self.options,
'$WORKSPACE/headers/details')
report_path = utils.replace_argument(
self.options, '$WORKSPACE/headers/summary-$TARGET.csv')
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
#head of csv file
random_json = utils.reading_json(result_path + "/" +
os.listdir(result_path)[0])
summary_head = "domain," + ','.join(
random_json.keys()) + ",score,details\n"
with open(report_path, 'w+') as r:
r.write(summary_head)
for filename in os.listdir(result_path):
real_path = result_path + "/" + filename
details = utils.reading_json(real_path)
if details:
summarybody = filename.replace('-observatory.json', '')
score = 100
for k, v in details.items():
if "not-implemented" in v.get('result'):
summarybody += ',' + "Not Implement"
elif v.get('pass') == True:
summarybody += ',' + "Pass"
else:
summarybody += ',' + "Fail"
score += int(v.get('score_modifier'))
#if score is below zero just make it 0 like
if score < 0:
score = 0
summarybody += ',' + str(score) + ',' + real_path + "\n"
with open(report_path, 'a+') as r:
r.write(summarybody)
def local_get_report(options):
command_path = str(BASE_DIR.joinpath('rest/commands.json'))
commands = utils.reading_json(command_path)
# create skeleton dict
final_reports = []
for key in commands.keys():
final_reports.append({
"module": key,
"reports": []
})
# get workspace name
ws_name = options.get('TARGET')
for k in commands.keys():
if "report" in commands[k].keys():
report = utils.replace_argument(
options, commands[k].get("report"))
# @TODO refactor this later
if type(report) == str:
if utils.not_empty_file(report):
report_path = report.replace(
options.get('WORKSPACE'), ws_name)
report_item = {
"path": report_path,
"type": "html",
}
for i in range(len(final_reports)):
if final_reports[i].get('module') == k:
final_reports[i]["reports"].append(
report_item)
elif type(report) == list:
for item in report:
report_path = utils.replace_argument(
options, item.get("path"))
if utils.not_empty_file(report_path):
report_path = report_path.replace(
options.get('WORKSPACE'), ws_name)
report_item = {
"path": report_path,
"type": item.get("type"),
}
for i in range(len(final_reports)):
if final_reports[i].get('module') == k:
final_reports[i]["reports"].append(
report_item)
# just clean up
clean_reports = []
for i in range(len(final_reports)):
if final_reports[i].get('reports'):
clean_reports.append(final_reports[i])
return {'reports': clean_reports}
def create_ip_result(self):
utils.print_good('Create IP for list of domain result')
# check if direct input is file or just single string
if self.is_direct:
if utils.not_empty_file(self.is_direct):
cmd = '$PLUGINS_PATH/massdns/bin/massdns -r $PLUGINS_PATH/massdns/lists/resolvers.txt -t A -o S -w $WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt $INPUT_LIST'
# just return if direct input is just a string
else:
return
else:
final_ip = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
if utils.not_empty_file(final_ip):
return
cmd = '$PLUGINS_PATH/massdns/bin/massdns -r $PLUGINS_PATH/massdns/lists/resolvers.txt -t A -o S -w $WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt $WORKSPACE/subdomain/final-$OUTPUT.txt'
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt')
execute.send_cmd(self.options, cmd, '', '', self.module_name)
utils.just_waiting(self.options, self.module_name, seconds=5)
# matching IP with subdomain
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
# get ips from amass stuff
ips = []
if self.is_direct:
if self.options.get("INPUT_LIST"):
ips.extend(utils.extract_ip(self.options.get('INPUT_LIST')))
if utils.not_empty_file(output_path):
data = utils.just_read(output_path).splitlines()
for line in data:
if " A " in line:
subdomain = line.split('. A ')[0]
ip = line.split('. A ')[1]
ips.append(str(ip))
for i in range(len(main_json['Subdomains'])):
if subdomain == main_json['Subdomains'][i]['Domain']:
main_json['Subdomains'][i]['IP'] = ip
final_ip = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
utils.just_write(final_ip, "\n".join(ips))
utils.just_write(utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'),
main_json,
is_json=True)
def conclude(self):
result_path = utils.replace_argument(
self.options, '$WORKSPACE/headers/details')
report_path = utils.replace_argument(
self.options, '$WORKSPACE/headers/summary-$TARGET.csv')
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
#head of csv file
random_json = utils.reading_json(
result_path + "/" + os.listdir(result_path)[0])
summary_head = "domain," + ','.join(random_json.keys()) + ",score,details\n"
with open(report_path, 'w+') as r:
r.write(summary_head)
for filename in os.listdir(result_path):
real_path = result_path + "/" + filename
details = utils.reading_json(real_path)
if details:
summarybody = filename.replace('-observatory.json', '')
score = 100
for k, v in details.items():
if "not-implemented" in v.get('result'):
summarybody += ',' + "Not Implement"
elif v.get('pass') == True:
summarybody += ',' + "Pass"
else:
summarybody += ',' + "Fail"
score += int(v.get('score_modifier'))
#if score is below zero just make it 0 like
if score < 0:
score = 0
summarybody += ',' + str(score) + ',' + real_path + "\n"
with open(report_path, 'a+') as r:
r.write(summarybody)
def conclude(self):
main_json = utils.reading_json(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = utils.checking_done(module=self.module_name, get_json=True)
#write that json again
utils.just_write(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
#logging
logfile = utils.replace_argument(self.options, '$WORKSPACE/log.json')
utils.save_all_cmd(logfile)
utils.print_banner("{0} Done".format(self.module_name))
def masscan(self):
utils.print_good('Starting masscan')
time.sleep(1)
if self.is_direct:
ip_file = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
# print(ip_file)
# print(utils.just_read(ip_file))
ip_list = utils.just_read(ip_file).splitlines()
ip_list = list(set([ip for ip in ip_list if ip != 'N/A']))
else:
main_json = utils.reading_json(
utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = []
if self.options['SPEED'] == 'slow':
ip_list = [
x.get("IP")
for x in main_json['Subdomains'] if x.get("IP") is not None
] + main_json['IP Space']
elif self.options['SPEED'] == 'quick':
ip_list = [
x.get("IP") for x in main_json['Subdomains']
if x.get("IP") is not None
]
ip_list = set([ip for ip in ip_list if ip != 'N/A'])
if self.options['DEBUG'] == "True":
utils.print_info("just testing 5 first host")
ip_list = list(ip_list)[:5]
utils.just_write(
utils.replace_argument(self.options,
'$WORKSPACE/subdomain/IP-$TARGET.txt'),
"\n".join(ip_list))
# print(ip_list)
time.sleep(1)
cmd = "sudo masscan --rate 1000 -p0-65535 -iL $WORKSPACE/subdomain/IP-$TARGET.txt -oX $WORKSPACE/portscan/$OUTPUT-masscan.xml --wait 0"
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/portscan/$OUTPUT-masscan.xml')
std_path = utils.replace_argument(
self.options, '$WORKSPACE/portscan/std-$OUTPUT-masscan.std')
execute.send_cmd(self.options, cmd, output_path, std_path,
self.module_name)
def conclude(self):
utils.print_banner("Conclusion for {0}".format(self.module_name))
main_json = utils.reading_json(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
ips_file = utils.replace_argument(self.options, '$WORKSPACE/ipspace/$OUTPUT-ipspace.txt')
with open(ips_file, 'r') as s:
ips = s.read().splitlines()
main_json['IP Space'] = ips
#write that json again
utils.just_write(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
utils.print_banner("{0} Done".format(self.module_name))
def conclude(self):
utils.print_banner("Conclusion for {0}".format(self.module_name))
main_json = utils.reading_json(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
ips_file = utils.replace_argument(self.options, '$WORKSPACE/ipspace/$OUTPUT-ipspace.txt')
with open(ips_file, 'r') as s:
ips = s.read().splitlines()
main_json['IP Space'] = ips
#write that json again
utils.just_write(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
utils.print_banner("{0} Done".format(self.module_name))
def dirsearch(self):
utils.print_good('Starting dirsearch')
if self.is_direct:
domains = utils.just_read(self.is_direct).splitlines()
else:
#matching IP with subdomain
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
domains = [x.get('Domain') for x in main_json['Subdomains']]
if self.options['DEBUG'] == 'True':
domains = domains[:5]
custom_logs = {"module": self.module_name, "content": []}
for part in utils.chunks(domains, 3):
for domain in part:
#just strip everything to save local, it won't affect the result
strip_domain = domain.replace(
'http://', '').replace('https://', '').replace('/', '-')
cmd = "python3 $PLUGINS_PATH/dirsearch/dirsearch.py -b -e php,zip,aspx,js --wordlist=$PLUGINS_PATH/wordlists/really-quick.txt --simple-report=$WORKSPACE/directory/quick/{1}-dirsearch.txt -t 50 -u {0}".format(
domain, strip_domain)
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/directory/quick/{0}-dirsearch.txt'.format(strip_domain))
std_path = utils.replace_argument(
self.options, '$WORKSPACE/directory/quick/std-{0}-dirsearch.std'.format(strip_domain))
execute.send_cmd(self.options, cmd, output_path,
std_path, self.module_name)
# time.sleep(0.5)
#set status to done because this gonna will be submit when all command was done
custom_logs['content'].append(
{"cmd": cmd, "std_path": std_path, "output_path": output_path, "status": "Done"})
#just wait couple seconds and continue but not completely stop the routine
time.sleep(20)
#submit a log
utils.print_info('Update activities log')
# utils.update_activities(self.options, str(custom_logs))
utils.force_done(self.options, self.module_name)
#just save commands
logfile = utils.replace_argument(self.options, '$WORKSPACE/log.json')
utils.save_all_cmd(self.options, logfile)
def resolve_ip(self):
utils.print_good('Create IP for list of domain result')
final_ip = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
all_subdomain_path = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-$OUTPUT.txt')
# we this have done or not found anything just return
if utils.not_empty_file(
final_ip) or not utils.not_empty_file(all_subdomain_path):
return
cmd = '$PLUGINS_PATH/massdns/bin/massdns -r $PLUGINS_PATH/massdns/lists/resolvers.txt -t A -o S -w $WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt $WORKSPACE/subdomain/final-$OUTPUT.txt'
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt')
execute.send_cmd(self.options, cmd, '', '', self.module_name)
utils.just_waiting(self.options, self.module_name, seconds=5, times=5)
# load main json
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
data = utils.just_read(output_path)
if data:
ips = []
for line in data.splitlines():
if " A " in line:
subdomain = line.split('. A ')[0]
ip = line.split('. A ')[1]
ips.append(ip)
for i in range(len(main_json['Subdomains'])):
if subdomain == main_json['Subdomains'][i]['Domain']:
main_json['Subdomains'][i]['IP'] = ip
final_ip = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
with open(final_ip, 'w+') as fip:
fip.write("\n".join(str(ip) for ip in ips))
# update the main json file
utils.just_write(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'),
main_json,
is_json=True)
def quick_gobuster(self):
utils.print_good('Starting gobuster for short wordlist')
if self.is_direct:
domains = utils.just_read(self.is_direct).splitlines()
else:
#matching IP with subdomain
main_json = utils.reading_json(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
domains = [x.get('Domain') for x in main_json['Subdomains']]
if self.options['DEBUG'] == 'True':
domains = domains[:5]
custom_logs = {"module": self.module_name, "content": []}
for part in utils.chunks(domains, 3):
for domain in part:
#just strip everything to save local, it won't affect the result
strip_domain = domain.replace(
'http://', '').replace('https://', '').replace('/', '-')
cmd = '$GO_PATH/gobuster -k -q -e -x php,jsp,aspx,html,json -w $PLUGINS_PATH/wordlists/quick-content-discovery.txt -t 100 -o $WORKSPACE/directory/{1}-gobuster.txt -s 200,301,307 -u "{0}" '.format(
domain.strip(), strip_domain)
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/directory/quick/{0}-gobuster.txt'.format(strip_domain))
std_path = utils.replace_argument(
self.options, '$WORKSPACE/directory/quick/std-{0}-gobuster.std'.format(strip_domain))
execute.send_cmd(self.options, cmd, output_path, std_path, self.module_name)
# time.sleep(0.5)
#set status to done because this gonna will be submit when all command was done
custom_logs['content'].append({"cmd": cmd, "std_path": std_path, "output_path": output_path, "status": "Done"})
#just wait couple seconds and continue but not completely stop the routine
time.sleep(20)
#submit a log
utils.print_info('Update activities log')
utils.force_done(self.options, self.module_name)
# utils.update_activities(self.options, str(custom_logs))
#just save commands
logfile = utils.replace_argument(self.options, '$WORKSPACE/log.json')
utils.save_all_cmd(self.options, logfile)
def prepare_input(self):
if self.is_direct:
# if direct input was file just read it
if utils.not_empty_file(self.is_direct):
domains = utils.just_read(self.is_direct).splitlines()
# get input string
else:
domains = [self.is_direct.strip()]
else:
# matching IP with subdomain
main_json = utils.reading_json(
utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'))
domains = [x.get('Domain') for x in main_json['Subdomains']]
return domains
def create_ip_result(self):
utils.print_good('Create IP for list of domain result')
if self.is_direct:
cmd = '$PLUGINS_PATH/massdns/bin/massdns -r $PLUGINS_PATH/massdns/lists/resolvers.txt -t A -o S -w $WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt $INPUT'
else:
final_ip = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
if utils.not_empty_file(final_ip):
return
cmd = '$PLUGINS_PATH/massdns/bin/massdns -r $PLUGINS_PATH/massdns/lists/resolvers.txt -t A -o S -w $WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt $WORKSPACE/subdomain/final-$OUTPUT.txt'
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt')
execute.send_cmd(self.options, cmd, '', '', self.module_name)
utils.just_waiting(self.options, self.module_name, seconds=5)
# matching IP with subdomain
main_json = utils.reading_json(
utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
with open(output_path, 'r') as i:
data = i.read().splitlines()
ips = []
for line in data:
if " A " in line:
subdomain = line.split('. A ')[0]
ip = line.split('. A ')[1]
ips.append(ip)
for i in range(len(main_json['Subdomains'])):
if subdomain == main_json['Subdomains'][i]['Domain']:
main_json['Subdomains'][i]['IP'] = ip
final_ip = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
with open(final_ip, 'w+') as fip:
fip.write("\n".join(str(ip) for ip in ips))
utils.just_write(utils.replace_argument(self.options,
'$WORKSPACE/$COMPANY.json'),
main_json,
is_json=True)
def create_ip_result(self):
utils.print_good('Create IP for list of domain result')
if self.is_direct:
cmd = '$PLUGINS_PATH/massdns/bin/massdns -r $PLUGINS_PATH/massdns/lists/resolvers.txt -t A -o S -w $WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt $INPUT'
else:
final_ip = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
if utils.not_empty_file(final_ip):
return
cmd = '$PLUGINS_PATH/massdns/bin/massdns -r $PLUGINS_PATH/massdns/lists/resolvers.txt -t A -o S -w $WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt $WORKSPACE/subdomain/final-$OUTPUT.txt'
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/massdns-IP-$OUTPUT.txt')
execute.send_cmd(self.options, cmd, '', '', self.module_name)
utils.just_waiting(self.options, self.module_name, seconds=5)
# matching IP with subdomain
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
with open(output_path, 'r') as i:
data = i.read().splitlines()
ips = []
for line in data:
if " A " in line:
subdomain = line.split('. A ')[0]
ip = line.split('. A ')[1]
ips.append(ip)
for i in range(len(main_json['Subdomains'])):
if subdomain == main_json['Subdomains'][i]['Domain']:
main_json['Subdomains'][i]['IP'] = ip
final_ip = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
with open(final_ip, 'w+') as fip:
fip.write("\n".join(str(ip) for ip in ips))
utils.just_write(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
def gobuster(self):
utils.print_good('Starting gobuster')
if self.options['SPEED'] != 'slow':
utils.print_good("Skipping in quick mode")
return
main_json = utils.reading_json(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
domains = [x.get('Domain') for x in main_json['Subdomains']]
for domain in domains:
cmd = '$GO_PATH/gobuster -k -q -e -fw -x php,jsp,aspx,html,json -w $PLUGINS_PATH/wordlists/dir-all.txt -t 100 -o $WORKSPACE/directory/$TARGET-gobuster.txt -s 200,301,307 -u "$TARGET" '
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/directory/{0}-gobuster.json'.format(domain))
std_path = utils.replace_argument(
self.options, '$WORKSPACE/directory/std-{0}-gobuster.std'.format(domain))
execute.send_cmd(self.options, cmd, output_path, std_path, self.module_name, True)
def gobuster(self):
utils.print_good('Starting gobuster')
if self.options['SPEED'] != 'slow':
utils.print_good("Skipping in quick mode")
return
main_json = utils.reading_json(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
domains = [x.get('Domain') for x in main_json['Subdomains']]
for domain in domains:
cmd = '$GO_PATH/gobuster -k -q -e -fw -x php,jsp,aspx,html,json -w $PLUGINS_PATH/wordlists/dir-all.txt -t 100 -o $WORKSPACE/directory/$TARGET-gobuster.txt -u "$TARGET" '
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/directory/{0}-gobuster.json'.format(domain))
std_path = utils.replace_argument(
self.options, '$WORKSPACE/directory/std-{0}-gobuster.std'.format(domain))
execute.send_cmd(self.options, cmd, output_path, std_path, self.module_name, True)
def masscan(self):
utils.print_good('Starting masscan')
time.sleep(1)
if self.is_direct:
ip_file = utils.replace_argument(
self.options, '$WORKSPACE/subdomain/final-IP-$OUTPUT.txt')
# print(ip_file)
# print(utils.just_read(ip_file))
ip_list = utils.just_read(ip_file).splitlines()
ip_list = list(set([ip for ip in ip_list if ip != 'N/A']))
else:
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = []
if self.options['SPEED'] == 'slow':
ip_list = [x.get("IP")
for x in main_json['Subdomains'] if x.get("IP") is not None] + main_json['IP Space']
elif self.options['SPEED'] == 'quick':
ip_list = [x.get("IP")
for x in main_json['Subdomains'] if x.get("IP") is not None]
ip_list = set([ip for ip in ip_list if ip != 'N/A'])
if self.options['DEBUG'] == "True":
utils.print_info("just testing 5 first host")
ip_list = list(ip_list)[:5]
utils.just_write(utils.replace_argument(
self.options, '$WORKSPACE/subdomain/IP-$TARGET.txt'), "\n".join(ip_list))
# print(ip_list)
time.sleep(1)
cmd = "sudo masscan --rate 1000 -p0-65535 -iL $WORKSPACE/subdomain/IP-$TARGET.txt -oX $WORKSPACE/portscan/$OUTPUT-masscan.xml --wait 0"
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/portscan/$OUTPUT-masscan.xml')
std_path = utils.replace_argument(
self.options, '$WORKSPACE/portscan/std-$OUTPUT-masscan.std')
execute.send_cmd(self.options, cmd, output_path, std_path, self.module_name)
def nmap_vuln(self):
utils.print_good('Starting Nmap VulnScan')
if self.is_direct:
ip_list = utils.just_read(self.is_direct).splitlines()
ip_list = list(set([ip for ip in ip_list if ip != 'N/A']))
else:
main_json = utils.reading_json(utils.replace_argument(
self.options, '$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = []
if self.options['SPEED'] == 'slow':
ip_list = [x.get("IP")
for x in main_json['Subdomains'] if x.get("IP") is not None] + main_json['IP Space']
elif self.options['SPEED'] == 'quick':
ip_list = [x.get("IP")
for x in main_json['Subdomains'] if x.get("IP") is not None]
ip_list = list(set([ip for ip in ip_list if ip != 'N/A']))
if self.options['DEBUG'] == 'True':
ip_list = list(ip_list)[:5]
# Scan every 5 IP at time Increse if you want
for part in utils.chunks(ip_list, 2):
for ip in part:
cmd = 'sudo nmap --open -T4 -Pn -n -sSV -p- {0} --script $PLUGINS_PATH/vulners.nse --oA $WORKSPACE/vulnscan/{0}-nmap'.format(
ip.strip())
cmd = utils.replace_argument(self.options, cmd)
output_path = utils.replace_argument(
self.options, '$WORKSPACE/vulnscan/{0}-nmap.nmap'.format(ip.strip()))
std_path = utils.replace_argument(
self.options, '$WORKSPACE/vulnscan/std-{0}-nmap.std'.format(ip.strip()))
execute.send_cmd(self.options, cmd, output_path, std_path, self.module_name)
# check if previous task done or not every 30 second
while not utils.checking_done(self.options, module=self.module_name):
time.sleep(60)
#just save commands
logfile = utils.replace_argument(self.options, '$WORKSPACE/log.json')
utils.save_all_cmd(self.options, logfile)
def conclude(self):
main_json = utils.reading_json(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'))
main_json['Modules'][self.module_name] = utils.checking_done(module=self.module_name, get_json=True)
# write that json again
utils.just_write(utils.replace_argument(self.options, '$WORKSPACE/$COMPANY.json'), main_json, is_json=True)
