bbot 2.0.1.4654rc0__py3-none-any.whl → 2.3.0.5397rc0__py3-none-any.whl

bbot/test/test_step_2/module_tests/test_module_social.py

@@ -14,13 +14,14 @@ class TestSocial(ModuleTestBase):
                 <a href="https://hub.docker.com/r/blacklanternsecurity"/>
                 <a href="https://hub.docker.com/r/blacklanternsecurity/bbot"/>
                 <a href="https://hub.docker.com/r/blacklanternSECURITY/bbot"/>
+                <a href="https://www.postman.com/blacklanternsecurity/bbot"/>
             </html>
             """
         }
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
     def check(self, module_test, events):
-        assert 3 == len([e for e in events if e.type == "SOCIAL"])
+        assert 4 == len([e for e in events if e.type == "SOCIAL"])
         assert 1 == len(
             [
                 e
@@ -46,3 +47,12 @@ class TestSocial(ModuleTestBase):
                 and e.data["profile_name"] == "blacklanternsecurity"
             ]
         )
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "SOCIAL"
+                and e.data["platform"] == "postman"
+                and e.data["profile_name"] == "blacklanternsecurity"
+            ]
+        )

bbot/test/test_step_2/module_tests/test_module_speculate.py

@@ -62,10 +62,8 @@ class TestSpeculate_OpenPorts(ModuleTestBase):
         for e in module_test.scan.modules["dummy"].events:
             events_data.add(e.data)
         assert all(
-            [
-                x in events_data
+            x in events_data
                 for x in ("evilcorp.com:80", "evilcorp.com:443", "asdf.evilcorp.com:80", "asdf.evilcorp.com:443")
-            ]
         )
 
 
@@ -79,8 +77,6 @@ class TestSpeculate_OpenPorts_Portscanner(TestSpeculate_OpenPorts):
         for e in module_test.scan.modules["dummy"].events:
             events_data.add(e.data)
         assert not any(
-            [
-                x in events_data
+            x in events_data
                 for x in ("evilcorp.com:80", "evilcorp.com:443", "asdf.evilcorp.com:80", "asdf.evilcorp.com:443")
-            ]
         )

bbot/test/test_step_2/module_tests/test_module_splunk.py

@@ -52,7 +52,7 @@ class TestSplunk(ModuleTestBase):
         module_test.httpx_mock.add_response()
 
     def check(self, module_test, events):
-        assert self.got_event == True
-        assert self.headers_correct == True
-        assert self.method_correct == True
-        assert self.url_correct == True
+        assert self.got_event is True
+        assert self.headers_correct is True
+        assert self.method_correct is True
+        assert self.url_correct is True

bbot/test/test_step_2/module_tests/test_module_sqlite.py

@@ -0,0 +1,18 @@
+import sqlite3
+from .base import ModuleTestBase
+
+
+class TestSQLite(ModuleTestBase):
+    targets = ["evilcorp.com"]
+
+    def check(self, module_test, events):
+        sqlite_output_file = module_test.scan.home / "output.sqlite"
+        assert sqlite_output_file.exists(), "SQLite output file not found"
+        with sqlite3.connect(sqlite_output_file) as db:
+            cursor = db.cursor()
+            results = cursor.execute("SELECT * FROM event").fetchall()
+            assert len(results) == 3, "No events found in SQLite database"
+            results = cursor.execute("SELECT * FROM scan").fetchall()
+            assert len(results) == 1, "No scans found in SQLite database"
+            results = cursor.execute("SELECT * FROM target").fetchall()
+            assert len(results) == 1, "No targets found in SQLite database"

bbot/test/test_step_2/module_tests/test_module_sslcert.py

@@ -6,7 +6,7 @@ class TestSSLCert(ModuleTestBase):
     config_overrides = {"scope": {"report_distance": 1}}
 
     def check(self, module_test, events):
-        assert len(events) == 6
+        assert len(events) == 7
         assert 1 == len(
             [
                 e

bbot/test/test_step_2/module_tests/test_module_stdout.py

@@ -41,13 +41,15 @@ class TestStdoutJSON(TestStdout):
     def check(self, module_test, events):
         out, err = module_test.capsys.readouterr()
         lines = out.splitlines()
-        assert len(lines) == 2
+        assert len(lines) == 3
         for i, line in enumerate(lines):
             event = json.loads(line)
             if i == 0:
                 assert event["type"] == "SCAN"
-            elif i == 2:
+            elif i == 1:
                 assert event["type"] == "DNS_NAME" and event["data"] == "blacklanternsecurity.com"
+            if i == 2:
+                assert event["type"] == "SCAN"
 
 
 class TestStdoutJSONFields(TestStdout):
@@ -56,7 +58,7 @@ class TestStdoutJSONFields(TestStdout):
     def check(self, module_test, events):
         out, err = module_test.capsys.readouterr()
         lines = out.splitlines()
-        assert len(lines) == 2
+        assert len(lines) == 3
         for line in lines:
             event = json.loads(line)
             assert set(event) == {"data", "module_sequence"}

bbot/test/test_step_2/module_tests/test_module_subdomaincenter.py

@@ -4,7 +4,7 @@ from .base import ModuleTestBase
 class TestSubdomainCenter(ModuleTestBase):
     async def setup_after_prep(self, module_test):
         module_test.httpx_mock.add_response(
-            url=f"https://api.subdomain.center/?domain=blacklanternsecurity.com",
+            url="https://api.subdomain.center/?domain=blacklanternsecurity.com",
             json=["asdf.blacklanternsecurity.com", "zzzz.blacklanternsecurity.com"],
         )
 

bbot/test/test_step_2/module_tests/test_module_subdomainradar.py

@@ -0,0 +1,208 @@
+from .base import ModuleTestBase
+
+
+class TestSubDomainRadar(ModuleTestBase):
+    config_overrides = {"modules": {"subdomainradar": {"api_key": "asdf"}}}
+
+    async def setup_before_prep(self, module_test):
+        await module_test.mock_dns(
+            {
+                "blacklanternsecurity.com": {"A": ["127.0.0.88"]},
+                "www.blacklanternsecurity.com": {"A": ["127.0.0.88"]},
+                "asdf.blacklanternsecurity.com": {"A": ["127.0.0.88"]},
+            }
+        )
+        module_test.httpx_mock.add_response(
+            url="https://api.subdomainradar.io/profile",
+            match_headers={"Authorization": "Bearer asdf"},
+        )
+        module_test.httpx_mock.add_response(
+            url="https://api.subdomainradar.io/enumerate",
+            method="POST",
+            json={
+                "tasks": {"blacklanternsecurity.com": "86de4531-0a67-41fe-b5e4-8ce8207d6245"},
+                "message": "Tasks initiated",
+            },
+            match_headers={"Authorization": "Bearer asdf"},
+        )
+        module_test.httpx_mock.add_response(
+            url="https://api.subdomainradar.io/tasks/86de4531-0a67-41fe-b5e4-8ce8207d6245",
+            match_headers={"Authorization": "Bearer asdf"},
+            json={
+                "task_id": "86de4531-0a67-41fe-b5e4-8ce8207d6245",
+                "status": "completed",
+                "domain": "blacklanternsecurity.com",
+                "subdomains": [
+                    {
+                        "subdomain": "www.blacklanternsecurity.com",
+                        "ip": None,
+                        "reverse_dns": [],
+                        "country": None,
+                        "timestamp": None,
+                    },
+                    {
+                        "subdomain": "asdf.blacklanternsecurity.com",
+                        "ip": None,
+                        "reverse_dns": [],
+                        "country": None,
+                        "timestamp": None,
+                    },
+                ],
+                "total_subdomains": 2,
+                "rank": None,
+                "whois": {
+                    "domain_name": ["BLACKLANTERNSECURITY.COM", "blacklanternsecurity.com"],
+                    "registrar": "MarkMonitor, Inc.",
+                    "creation_date": ["1992-11-04T05:00:00", "1992-11-04T05:00:00+00:00"],
+                    "expiration_date": ["2026-11-03T05:00:00", "2026-11-03T00:00:00+00:00"],
+                    "last_updated": ["2024-10-02T10:15:20", "2024-10-02T10:15:20+00:00"],
+                    "status": [
+                        "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
+                        "clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
+                        "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited",
+                        "serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited",
+                        "serverTransferProhibited https://icann.org/epp#serverTransferProhibited",
+                        "serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited",
+                        "clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)",
+                        "clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)",
+                        "clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)",
+                        "serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)",
+                        "serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)",
+                        "serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)",
+                    ],
+                    "nameservers": [
+                        "A1-12.AKAM.NET",
+                        "A10-67.AKAM.NET",
+                        "A12-64.AKAM.NET",
+                        "A28-65.AKAM.NET",
+                        "A7-66.AKAM.NET",
+                        "A9-67.AKAM.NET",
+                        "EDNS69.ULTRADNS.BIZ",
+                        "EDNS69.ULTRADNS.COM",
+                        "EDNS69.ULTRADNS.NET",
+                        "EDNS69.ULTRADNS.ORG",
+                        "edns69.ultradns.biz",
+                        "a12-64.akam.net",
+                        "edns69.ultradns.net",
+                        "edns69.ultradns.org",
+                        "a10-67.akam.net",
+                        "a28-65.akam.net",
+                        "a9-67.akam.net",
+                        "a1-12.akam.net",
+                        "a7-66.akam.net",
+                        "edns69.ultradns.com",
+                    ],
+                    "emails": [
+                        "abusecomplaints@markmonitor.com",
+                        "admin@dnstinations.com",
+                        "whoisrequest@markmonitor.com",
+                    ],
+                    "dnssec": "unsigned",
+                    "org": "DNStination Inc.",
+                    "address": "3450 Sacramento Street, Suite 405",
+                    "city": "San Francisco",
+                    "state": "CA",
+                    "zipcode": None,
+                    "country": "US",
+                },
+                "enumerators": ["Aquarius Enumerator", "Beta Enumerator", "Chi Enumerator", "Eta Enumerator"],
+                "timestamp": "2024-10-06T02:48:10.075636",
+                "error": None,
+                "is_notification": False,
+                "notification_domain_id": None,
+                "demo": False,
+                "user_id": 49,
+                "time_to_finish": 41,
+            },
+        )
+        module_test.httpx_mock.add_response(
+            url="https://api.subdomainradar.io/enumerators/groups",
+            match_headers={"Authorization": "Bearer asdf"},
+            json=[
+                {
+                    "id": "1",
+                    "name": "Fast",
+                    "description": "Enumerators optimized for high-speed scanning and rapid data collection",
+                    "enumerators": [
+                        {"display_name": "Beta Enumerator"},
+                        {"display_name": "Chi Enumerator"},
+                        {"display_name": "Aquarius Enumerator"},
+                        {"display_name": "Eta Enumerator"},
+                    ],
+                },
+                {
+                    "id": "2",
+                    "name": "Medium",
+                    "description": "Enumerators balanced for moderate speed with a focus on thoroughness",
+                    "enumerators": [
+                        {"display_name": "Kappa Enumerator"},
+                        {"display_name": "Lambda Enumerator"},
+                        {"display_name": "Mu Enumerator"},
+                        {"display_name": "Pi Enumerator"},
+                        {"display_name": "Tau Enumerator"},
+                        {"display_name": "Beta Enumerator"},
+                        {"display_name": "Chi Enumerator"},
+                        {"display_name": "Psi Enumerator"},
+                        {"display_name": "Aquarius Enumerator"},
+                        {"display_name": "Zeta Enumerator"},
+                        {"display_name": "Eta Enumerator"},
+                    ],
+                },
+                {
+                    "id": "3",
+                    "name": "Deep",
+                    "description": "Enumerators designed for exhaustive searches and in-depth data analysis",
+                    "enumerators": [
+                        {"display_name": "Alpha Enumerator"},
+                        {"display_name": "Kappa Enumerator"},
+                        {"display_name": "Lambda Enumerator"},
+                        {"display_name": "Mu Enumerator"},
+                        {"display_name": "Nu Enumerator"},
+                        {"display_name": "Xi Enumerator"},
+                        {"display_name": "Pi Enumerator"},
+                        {"display_name": "Rho Enumerator"},
+                        {"display_name": "Sigma Enumerator"},
+                        {"display_name": "Tau Enumerator"},
+                        {"display_name": "Beta Enumerator"},
+                        {"display_name": "Chi Enumerator"},
+                        {"display_name": "Omega Enumerator"},
+                        {"display_name": "Psi Enumerator"},
+                        {"display_name": "Phi Enumerator"},
+                        {"display_name": "Axon Enumerator"},
+                        {"display_name": "Aquarius Enumerator"},
+                        {"display_name": "Pegasus Enumerator"},
+                        {"display_name": "Petra Enumerator"},
+                        {"display_name": "Oasis Enumerator"},
+                        {"display_name": "Mike Enumerator"},
+                        {"display_name": "Cat Enumerator"},
+                        {"display_name": "Brutus Enumerator"},
+                        {"display_name": "Dee Enumerator"},
+                        {"display_name": "Jul Enumerator"},
+                        {"display_name": "Eve Enumerator"},
+                        {"display_name": "Frank Enumerator"},
+                        {"display_name": "Gus Enumerator"},
+                        {"display_name": "Hank Enumerator"},
+                        {"display_name": "Delta Enumerator"},
+                        {"display_name": "Ivy Enumerator"},
+                        {"display_name": "Jack Enumerator"},
+                        {"display_name": "Karl Enumerator"},
+                        {"display_name": "Liam Enumerator"},
+                        {"display_name": "Nora Enumerator"},
+                        {"display_name": "Mars Enumerator"},
+                        {"display_name": "Neptune Enumerator"},
+                        {"display_name": "Orion Enumerator"},
+                        {"display_name": "Oedipus Enumerator"},
+                        {"display_name": "Pandora Enumerator"},
+                        {"display_name": "Epsilon Enumerator"},
+                        {"display_name": "Zeta Enumerator"},
+                        {"display_name": "Eta Enumerator"},
+                        {"display_name": "Theta Enumerator"},
+                        {"display_name": "Iota Enumerator"},
+                    ],
+                },
+            ],
+        )
+
+    def check(self, module_test, events):
+        assert any(e.data == "www.blacklanternsecurity.com" for e in events), "Failed to detect subdomain #1"
+        assert any(e.data == "asdf.blacklanternsecurity.com" for e in events), "Failed to detect subdomain #2"

bbot/test/test_step_2/module_tests/test_module_subdomains.py

@@ -6,7 +6,7 @@ class TestSubdomains(ModuleTestBase):
 
     async def setup_after_prep(self, module_test):
         module_test.httpx_mock.add_response(
-            url=f"https://api.subdomain.center/?domain=blacklanternsecurity.com",
+            url="https://api.subdomain.center/?domain=blacklanternsecurity.com",
             json=["asdfasdf.blacklanternsecurity.com", "zzzzzzzz.blacklanternsecurity.com"],
         )
 

bbot/test/test_step_2/module_tests/test_module_teams.py

@@ -16,13 +16,15 @@ class TestTeams(DiscordBase):
             module_test.request_count += 1
             if module_test.request_count == 2:
                 return httpx.Response(
-                    status_code=200,
-                    text="Webhook message delivery failed with error: Microsoft Teams endpoint returned HTTP error 429 with ContextId tcid=0,server=msgapi-production-eus-azsc2-4-170,cv=deadbeef=2..",
+                    status_code=400,
+                    json={
+                        "error": {
+                            "code": "WorkflowTriggerIsNotEnabled",
+                            "message": "Could not execute workflow 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' trigger 'manual' with state 'Disabled': trigger is not enabled.",
+                        }
+                    },
                 )
             else:
-                return httpx.Response(
-                    status_code=200,
-                    text="1",
-                )
+                return httpx.Response(status_code=200)
 
         module_test.httpx_mock.add_callback(custom_response, url=self.webhook_url)

bbot/test/test_step_2/module_tests/test_module_telerik.py

@@ -11,7 +11,7 @@ class TestTelerik(ModuleTestBase):
         # Simulate Telerik.Web.UI.WebResource.axd?type=rau detection
         expect_args = {"method": "GET", "uri": "/Telerik.Web.UI.WebResource.axd", "query_string": "type=rau"}
         respond_args = {
-            "response_data": '{ "message" : "RadAsyncUpload handler is registered succesfully, however, it may not be accessed directly." }'
+            "response_data": '{ "message" : "RadAsyncUpload handler is registered successfully, however, it may not be accessed directly." }'
         }
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)