heitt 0.4.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: fbc73d80ab64c2fa158725b6278866a05696a7eb14e9fb4a1f97182e26b64cc3
+  data.tar.gz: 4b0a23a93530cf86b5791e3bec8757bb0f959949980d6481c37c9c2010a4b6b6
+SHA512:
+  metadata.gz: 1b89a08f063a90d0a26ccec811425914f8af7ff5973e33b07599ea240c8ce76b070a1803271039f9e2f381269095e1ec5b874c4727cbf2b5cc64a241d03eb998
+  data.tar.gz: 786a8226e42a20d8466bc256fe1b0ab37cf8fe725b5a20df029410abe52985ea4c91f00a5cf654aee8625abf3b26c8faf207f86ca03c1130793e2e50ad6fda07

data/bin/heitt

@@ -0,0 +1,157 @@
+#!/usr/bin/env ruby
+require 'optparse'
+require 'io/console'
+require 'heitt'
+
+
+module HEITT
+  class CLI
+    attr_accessor :inputs, :extended, :verbose, :output, :json, :database, :show_regex_match, :min_entropy
+
+    def initialize
+      @inputs = []
+      @extended = false
+      @verbose = false
+      @output = ""
+      @json = false
+      @database = ""
+      @show_regex_match = false
+      @min_entropy = 3.5
+    end
+
+
+    def parse!
+      OptionParser.new do |opts|   
+        opts.banner = ""
+        opts.program_name = "heitt"
+        opts.separator "#{header("=========================================================================")}"
+        opts.separator "#{header("HEITT  v#{HEITT::VERSION} - Hash Extraction, Identification & Triage Tool")}"
+        opts.separator "#{header("=========================================================================")}"
+        opts.separator ""
+        opts.separator "Extract and identify hashes from any input."
+        opts.separator "Input may be hash string, a file or read from stin"
+        opts.separator ""
+        opts.separator "Usage: heitt [<INPUT(S)>] [OPTIONS]"
+        opts.separator ""
+        opts.separator "ARGUMENTS:"
+        opts.separator "    [<INPUT(S)>]                     Hash string or filepath"
+        opts.separator ""
+        opts.separator "GENERAL OPTIONS:"
+        opts.on("-h", "--help", "Show this help message and exit"){puts opts; exit}
+        opts.on("-v", "--version", "Show version information"){puts "heitt v#{HEITT::VERSION} by jobotow (#{HEITT::GITHUB})"; exit}
+        opts.separator ""
+
+        opts.separator ""
+        opts.separator "OUTPUT OPTIONS:"
+        opts.on("-V", "--verbose", "Show description and notes for each candidate") {@verbose = true}
+        opts.on("-j", "--json","Output in json format") {@json = true}
+        opts.on("-o", "--output FILEPATH", String, "File to write output to") {|v| @output = v}
+
+        opts.separator ""
+        opts.separator "FILTERING OPTIONS:"
+        opts.on("-e", "--extended", "Show extended candidates") {@extended = true}
+        opts.on("-r", "--regex-match", "Show regex-matched candidates") {@show_regex_match = true}
+        opts.on("-E", "--min-entropy FLOAT", Float, "Minimum entropy threshold[default: 3.5]") {|v| puts "MIN ENTROPY: #{v}"; @min_entropy = v}
+
+        opts.separator ""
+        opts.separator "DATABASE OPTIONS:"
+        opts.on("-D", "--database FILEPATH", String, "Use custom database") {|v| @database = v}
+
+        opts.separator ""
+        opts.separator "EXAMPLES:"
+        opts.separator "    heitt b1946ac92492d2347c6235b4d2611184"
+        opts.separator "    heitt auth.log"
+        opts.separator "    heitt auth.log --json --output result.json"
+        opts.separator "    heitt auth.log --extended --regex-match"
+        opts.separator "    heitt auth.log --min-entropy 4.0"
+        opts.separator "    cat auth.log | heitt "
+        opts.separator ""
+        opts.separator ""
+        opts.separator "NOTES:"
+        opts.separator "    JSON format is default when output is redirected or piped."
+        opts.separator "    Regex-match candidates are hidden by default, use '-r' to show."
+        opts.separator "    Running without input starts interactive mode."
+        opts.separator "#{header("=========================================================================")}"
+        opts.separator "#{header("END OF HELP")}"
+        opts.separator "#{header("=========================================================================")}"
+      end.parse!
+
+      @inputs = if ARGV.empty?
+        if $stdin.tty?
+          # Interactive mode
+          puts "#{header("=== HEITT INTERACTIVE MODE ====\n")}"
+          puts "Enter a hash or file"
+          loop do
+            print "heitt> "
+            input = $stdin.gets&.strip
+            break if input.nil? || input.empty?
+            results = HEITT::Scanner.scan(input, min_entropy: @min_entropy)
+            groups = HEITT::Grouper.group(results)
+            format = @json ? :json : :tree
+            output = case format
+            when :json
+              HEITT::Formatter.json(groups, extended: @extended, show_regex_match: @show_regex_match)
+            else
+              HEITT::Formatter.tree(groups, extended: @extended, show_regex_match: @show_regex_match)
+            end
+            puts output
+            puts ""
+          end
+        else
+          [$stdin.read]
+        end
+
+        
+      else
+        ARGV.dup
+      end
+      self
+    end
+
+    def run 
+      database = @database.empty? ? HEITT::DATABASE : load_custom_database(@database)
+      
+      format = @json || !$stdout.tty? ? :json : :tree
+      output = @inputs.map do |input|
+        results = HEITT::Scanner.scan(input, database: database, min_entropy: @min_entropy)
+        groups = HEITT::Grouper.group(results)
+
+        case format
+        when :json
+          HEITT::Formatter.json(groups, extended: @extended, show_regex_match: @show_regex_match)
+        else
+          HEITT::Formatter.tree(groups, extended: @extended, show_regex_match: @show_regex_match)
+        end
+      end.join("\n")
+
+      unless @output.empty?
+        File.write(@output, output)
+      else
+        puts output
+      end
+    end
+    
+    private
+    def header(text)
+      terminal_width = IO.console.winsize[1] rescue 70
+      text.center(terminal_width)
+    end
+
+
+    def load_custom_database(filepath)
+      unless File.exist?(filepath)
+        puts HEITT::Color.colorize("[ERROR] Database file #{filepath} does not exists", :bold, :red)
+        exit(1)
+      end
+      begin
+        custom_database = JSON.parse(File.read(filepath), symbolize_names: true)
+        HEITT::DATABASE +  custom_database
+      rescue JSON::ParserError => e 
+        puts "#{HEITT::Color.colorize("[ERROR] Invalid JSON in database file: ", :bold, :red)}#{e.message}"
+        exit(1)
+      end
+    end
+  end
+end
+
+cli = HEITT::CLI.new.parse!.run #if __FILE__ == $0