def attack(self): url = "{}:{}{}".format(self.target, self.port, self.path) response = http_request("GET", url) if response is None: return if response.status_code != 401: print_status("Target is not protected by Digest Auth") return if self.defaults.startswith('file://'): defaults = open(self.defaults[7:], 'r') else: defaults = [self.defaults] with ThreadPoolExecutor(self.threads) as executor: for record in defaults: username, password = record.split(':') executor.submit(self.target_function, url, username, password) if self.credentials: print_success("Credentials found!") headers = ("Target", "Port", "Login", "Password") print_table(headers, *self.credentials) else: print_error("Credentials not found") defaults.close()
def attack(self): ssh = paramiko.SSHClient() try: ssh.connect(self.target, port=self.port) except socket.error: print_error("Connection error: %s:%s" % (self.target, str(self.port))) ssh.close() return except: pass ssh.close() if self.usernames.startswith('file://'): usernames = open(self.usernames[7:], 'r') else: usernames = [self.usernames] if self.passwords.startswith('file://'): passwords = open(self.passwords[7:], 'r') else: passwords = [self.passwords] collection = LockedIterator(itertools.product(usernames, passwords)) self.run_threads(self.threads, self.target_function, collection) if len(self.credentials): print_success("Credentials found!") headers = ("Target", "Port", "Login", "Password") print_table(headers, *self.credentials) else: print_error("Credentials not found")
def attack(self): ftp = ftplib.FTP() try: ftp.connect(self.target, port=int(self.port), timeout=10) except (socket.error, socket.timeout): print_error("Connection error: %s:%s" % (self.target, str(self.port))) ftp.close() return except: pass ftp.close() if self.defaults.startswith('file://'): defaults = open(self.defaults[7:], 'r') else: defaults = [self.defaults] collection = LockedIterator(defaults) self.run_threads(self.threads, self.target_function, collection) if len(self.credentials): print_success("Credentials found!") headers = ("Target", "Port", "Login", "Password") print_table(headers, *self.credentials) else: print_error("Credentials not found")
def attack(self): try: tn = telnetlib.Telnet(self.target, self.port) tn.expect(["login: "******"Login: "******"Connection error {}:{}".format( self.target, self.port)) return if self.usernames.startswith('file://'): usernames = open(self.usernames[7:], 'r') else: usernames = [self.usernames] if self.passwords.startswith('file://'): passwords = open(self.passwords[7:], 'r') else: passwords = [self.passwords] collection = LockedIterator(itertools.product(usernames, passwords)) self.run_threads(self.threads, self.target_function, collection) if len(self.credentials): print_success("Credentials found!") headers = ("Target", "Port", "Login", "Password") print_table(headers, *self.credentials) else: print_error("Credentials not found")
def attack(self): url = "{}:{}{}".format(self.target, self.port, self.path) response = http_request(method="GET", url=url) if response is None: return if response.status_code != 401: print_status("Target is not protected by Basic Auth") return if self.usernames.startswith('file://'): usernames = open(self.usernames[7:], 'r') else: usernames = [self.usernames] if self.passwords.startswith('file://'): passwords = open(self.passwords[7:], 'r') else: passwords = [self.passwords] collection = itertools.product(usernames, passwords) with threads.ThreadPoolExecutor(self.threads) as executor: for record in collection: executor.submit(self.target_function, url, record) if self.credentials: print_success("Credentials found!") headers = ("Target", "Port", "Login", "Password") print_table(headers, *self.credentials) else: print_error("Credentials not found")
def scan_target_ip(self, target_mac): p = threading.Thread(target=self.sniff_answer) p.setDaemon(True) p.start() self._send_scan_packet(target_mac) self.sniff_finished.wait(self.timeout + 1) unique_device = [list(x) for x in set(tuple(x) for x in self.result)] print_table(TABLE_HEADER, *unique_device) print('\n')
def run(self): conf.verb = self.verbose nm = port_scan(protocol='UDP', target=self.target, port=self.port) for host in nm.all_hosts(): if nm[host]['udp'][self.port]['state'] == "open": print_success("Host: %s, port:%s is open" % (host, self.port)) self.get_target_info(host=host, port=self.port) unique_device = [list(x) for x in set(tuple(x) for x in self.result)] print_table(TABLE_HEADER, *unique_device)
def run(self): conf.verb = self.verbose self.sniff_mac_address = get_if_hwaddr(self.nic) p = threading.Thread(target=self.sniff_answer) p.setDaemon(True) p.start() self.exploit(target_mac=PROFINET_BROADCAST_ADDRESS_1) self.exploit(target_mac=PROFINET_BROADCAST_ADDRESS_2) self.sniff_finished.wait(self.timeout + 1) unique_device = [list(x) for x in set(tuple(x) for x in self.result)] print_table(TABLE_HEADER, *unique_device)
def attack(self): url = sanitize_url("{}:{}{}".format(self.target, self.port, self.get_form_path())) try: requests.get(url, verify=False) except (requests.exceptions.MissingSchema, requests.exceptions.InvalidSchema): print_error("Invalid URL format: %s" % url) return except requests.exceptions.ConnectionError: print_error("Connection error: %s" % url) return # authentication type if self.form == 'auto': form_data = self.detect_form() if form_data is None: print_error("Could not detect form") return (form_action, self.data) = form_data if form_action: self.path = form_action else: self.data = self.form print_status("Using following data: ", self.data) # invalid authentication self.invalid_auth() # running threads if self.usernames.startswith('file://'): usernames = open(self.usernames[7:], 'r') else: usernames = [self.usernames] if self.passwords.startswith('file://'): passwords = open(self.passwords[7:], 'r') else: passwords = [self.passwords] collection = LockedIterator(itertools.product(usernames, passwords)) self.run_threads(self.threads, self.target_function, collection) if len(self.credentials): print_success("Credentials found!") headers = ("Target", "Port", "Login", "Password") print_table(headers, *self.credentials) else: print_error("Credentials not found")
def run(self): self.result = [] conf.verb = self.verbose nm = port_scan(protocol='TCP', target=self.target, port=self.port) for host in nm.all_hosts(): if nm[host]['tcp'][self.port]['state'] == "open": print_success("Host: %s, port:%s is open" % (host, self.port)) self.get_target_info(host=host, port=self.port) unique_device = [list(x) for x in set(tuple(x) for x in self.result)] if len(self.result) > 0: print_success("Find %s targets" % len(self.result)) print_table(TABLE_HEADER, *unique_device) print('\r') else: print_error("Didn't find any target on network %s" % self.target)
def attack(self): # todo: check if service is up if self.snmp.startswith('file://'): snmp = open(self.snmp[7:], 'r') else: snmp = [self.snmp] collection = LockedIterator(snmp) self.run_threads(self.threads, self.target_function, collection) if len(self.strings): print_success("Credentials found!") headers = ("Target", "Port", "Community Strings") print_table(headers, *self.strings) else: print_error("Valid community strings not found")
def attack(self): # todo: check if service is up if self.password.startswith('file://'): s7_pass = open(self.password[7:], 'r') else: s7_pass = [self.password] collection = LockedIterator(s7_pass) self.run_threads(self.threads, self.target_function, collection) if len(self.strings): print_success("Credentials found!") headers = ("Target", "Port", "password") print_table(headers, *self.strings) else: print_error("Valid password not found")
def run(self): conf.verb = self.verbose self.exploit() unique_device = [list(x) for x in set(tuple(x) for x in self.result)] print_table(TABLE_HEADER, *unique_device)