bbot 2.3.0.5368rc0__py3-none-any.whl → 2.3.0.5376rc0__py3-none-any.whl

bbot/__init__.py

@@ -1,4 +1,4 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.3.0.5368rc"
+__version__ = "v2.3.0.5376rc"
 
 from .scanner import Scanner, Preset

bbot/cli.py

@@ -29,7 +29,6 @@ scan_name = ""
 
 
 async def _main():
-
     import asyncio
     import traceback
     from contextlib import suppress
@@ -45,7 +44,6 @@ async def _main():
     global scan_name
 
     try:
-
         # start by creating a default scan preset
         preset = Preset(_log=True, name="bbot_cli_main")
         # parse command line arguments and merge into preset
@@ -81,7 +79,6 @@ async def _main():
 
         # if we're listing modules or their options
         if options.list_modules or options.list_module_options:
-
             # if no modules or flags are specified, enable everything
             if not (options.modules or options.output_modules or options.flags):
                 for module, preloaded in preset.module_loader.preloaded().items():
@@ -172,7 +169,6 @@ async def _main():
             log.trace(f"Command: {' '.join(sys.argv)}")
 
             if sys.stdin.isatty():
-
                 # warn if any targets belong directly to a cloud provider
                 for event in scan.target.seeds.events:
                     if event.type == "DNS_NAME":

bbot/core/config/files.py

@@ -10,7 +10,6 @@ bbot_code_dir = Path(__file__).parent.parent.parent
 
 
 class BBOTConfigFiles:
-
     config_dir = (Path.home() / ".config" / "bbot").resolve()
     defaults_filename = (bbot_code_dir / "defaults.yml").resolve()
     config_filename = (config_dir / "bbot.yml").resolve()

bbot/core/event/base.py

@@ -1180,7 +1180,6 @@ class URL_UNVERIFIED(BaseEvent):
         self.num_redirects = getattr(self.parent, "num_redirects", 0)
 
     def _data_id(self):
-
         data = super()._data_id()
 
         # remove the querystring for URL/URL_UNVERIFIED events, because we will conditionally add it back in (based on settings)
@@ -1267,7 +1266,6 @@ class URL_UNVERIFIED(BaseEvent):
 
 
 class URL(URL_UNVERIFIED):
-
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
 
@@ -1309,7 +1307,6 @@ class URL_HINT(URL_UNVERIFIED):
 
 
 class WEB_PARAMETER(DictHostEvent):
-
     def _data_id(self):
         # dedupe by url:name:param_type
         url = self.data.get("url", "")

bbot/core/helpers/dns/dns.py

@@ -16,7 +16,6 @@ log = logging.getLogger("bbot.core.helpers.dns")
 
 
 class DNSHelper(EngineClient):
-
     SERVER_CLASS = DNSEngine
     ERROR_CLASS = DNSError
 

bbot/core/helpers/dns/engine.py

@@ -24,7 +24,6 @@ all_rdtypes = ["A", "AAAA", "SRV", "MX", "NS", "SOA", "CNAME", "TXT"]
 
 
 class DNSEngine(EngineServer):
-
     CMDS = {
         0: "resolve",
         1: "resolve_raw",
@@ -476,7 +475,6 @@ class DNSEngine(EngineServer):
         # for every parent domain, starting with the shortest
         parents = list(domain_parents(query))
         for parent in parents[::-1]:
-
             # check if the parent domain is set up with wildcards
             wildcard_results = await self.is_wildcard_domain(parent, rdtypes_to_check)
 

bbot/core/helpers/dns/mock.py

@@ -5,7 +5,6 @@ log = logging.getLogger("bbot.core.helpers.dns.mock")
 
 
 class MockResolver:
-
     def __init__(self, mock_data=None, custom_lookup_fn=None):
         self.mock_data = mock_data if mock_data else {}
         self._custom_lookup_fn = custom_lookup_fn

bbot/core/helpers/libmagic.py

@@ -2,7 +2,6 @@ import puremagic
 
 
 def get_magic_info(file):
-
     magic_detections = puremagic.magic_file(file)
     if magic_detections:
         magic_detections.sort(key=lambda x: x.confidence, reverse=True)

bbot/core/helpers/process.py

@@ -7,7 +7,6 @@ from .misc import in_exception_chain
 
 
 class BBOTThread(threading.Thread):
-
     default_name = "default bbot thread"
 
     def __init__(self, *args, **kwargs):
@@ -24,7 +23,6 @@ class BBOTThread(threading.Thread):
 
 
 class BBOTProcess(SpawnProcess):
-
     default_name = "bbot process pool"
 
     def __init__(self, *args, **kwargs):

bbot/core/helpers/validators.py

@@ -299,7 +299,6 @@ def is_email(email):
 
 
 class Validators:
-
     def __init__(self, parent_helper):
         self.parent_helper = parent_helper
 

bbot/core/helpers/web/engine.py

@@ -14,7 +14,6 @@ log = logging.getLogger("bbot.core.helpers.web.engine")
 
 
 class HTTPEngine(EngineServer):
-
     CMDS = {
         0: "request",
         1: "request_batch",

bbot/core/helpers/web/web.py

@@ -19,7 +19,6 @@ log = logging.getLogger("bbot.core.helpers.web")
 
 
 class WebHelper(EngineClient):
-
     SERVER_CLASS = HTTPEngine
     ERROR_CLASS = WebError
 

bbot/core/modules.py

@@ -337,7 +337,6 @@ class ModuleLoader:
             # look for classes
             if type(root_element) == ast.ClassDef:
                 for class_attr in root_element.body:
-
                     # class attributes that are dictionaries
                     if type(class_attr) == ast.Assign and type(class_attr.value) == ast.Dict:
                         # module options

bbot/db/sql/models.py

@@ -69,7 +69,6 @@ class BBOTBaseModel(SQLModel):
 
 
 class Event(BBOTBaseModel, table=True):
-
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         data = self._get_data(self.data, self.type)

bbot/modules/baddns.py

@@ -55,7 +55,6 @@ class baddns(BaseModule):
         return True
 
     async def handle_event(self, event):
-
         tasks = []
         for ModuleClass in self.select_modules():
             kwargs = {
@@ -75,7 +74,6 @@ class baddns(BaseModule):
             tasks.append((module_instance, task))
 
         async for completed_task in self.helpers.as_completed([task for _, task in tasks]):
-
             module_instance = next((m for m, t in tasks if t == completed_task), None)
             try:
                 task_result = await completed_task

bbot/modules/baddns_direct.py

@@ -51,7 +51,6 @@ class baddns_direct(BaseModule):
 
         CNAME_direct_instance = CNAME_direct_module(event.host, **kwargs)
         if await CNAME_direct_instance.dispatch():
-
             results = CNAME_direct_instance.analyze()
             if results and len(results) > 0:
                 for r in results:

bbot/modules/dnstlsrpt.py

@@ -0,0 +1,144 @@
+# dnstlsrpt.py
+#
+# Checks for and parses common TLS-RPT TXT records, e.g. _smtp._tls.target.domain
+#
+# TLS-RPT policies may contain email addresses or URL's for reporting destinations, typically the email addresses are software processed inboxes, but they may also be to individual humans or team inboxes.
+#
+# The domain portion of any email address or URL is also passively checked and added as appropriate, for additional inspection by other modules.
+#
+# Example records,
+# _smtp._tls.example.com TXT "v=TLSRPTv1;rua=https://tlsrpt.azurewebsites.net/report"
+# _smtp._tls.example.net TXT "v=TLSRPTv1; rua=mailto:sts-reports@example.net;"
+#
+# TODO: extract %{UNIQUE_ID}% from hosted services as ORG_STUB ?
+#   e.g. %{UNIQUE_ID}%@tlsrpt.hosted.service.provider is usually a tenant specific ID.
+#   e.g. tlsrpt@%{UNIQUE_ID}%.hosted.service.provider is usually a tenant specific ID.
+
+from bbot.modules.base import BaseModule
+from bbot.core.helpers.dns.helpers import service_record
+
+import re
+
+from bbot.core.helpers.regexes import email_regex, url_regexes
+
+_tlsrpt_regex = r"^v=(?P<v>TLSRPTv[0-9]+); *(?P<kvps>.*)$"
+tlsrpt_regex = re.compile(_tlsrpt_regex, re.I)
+
+_tlsrpt_kvp_regex = r"(?P<k>\w+)=(?P<v>[^;]+);*"
+tlsrpt_kvp_regex = re.compile(_tlsrpt_kvp_regex)
+
+_csul = r"(?P<uri>[^, ]+)"
+csul = re.compile(_csul)
+
+
+class dnstlsrpt(BaseModule):
+    watched_events = ["DNS_NAME"]
+    produced_events = ["EMAIL_ADDRESS", "URL_UNVERIFIED", "RAW_DNS_RECORD"]
+    flags = ["subdomain-enum", "cloud-enum", "email-enum", "passive", "safe"]
+    meta = {
+        "description": "Check for TLS-RPT records",
+        "author": "@colin-stubbs",
+        "created_date": "2024-07-26",
+    }
+    options = {
+        "emit_emails": True,
+        "emit_raw_dns_records": False,
+        "emit_urls": True,
+        "emit_vulnerabilities": True,
+    }
+    options_desc = {
+        "emit_emails": "Emit EMAIL_ADDRESS events",
+        "emit_raw_dns_records": "Emit RAW_DNS_RECORD events",
+        "emit_urls": "Emit URL_UNVERIFIED events",
+        "emit_vulnerabilities": "Emit VULNERABILITY events",
+    }
+
+    async def setup(self):
+        self.emit_emails = self.config.get("emit_emails", True)
+        self.emit_raw_dns_records = self.config.get("emit_raw_dns_records", False)
+        self.emit_urls = self.config.get("emit_urls", True)
+        self.emit_vulnerabilities = self.config.get("emit_vulnerabilities", True)
+        return await super().setup()
+
+    def _incoming_dedup_hash(self, event):
+        # dedupe by parent
+        parent_domain = self.helpers.parent_domain(event.data)
+        return hash(parent_domain), "already processed parent domain"
+
+    async def filter_event(self, event):
+        if "_wildcard" in str(event.host).split("."):
+            return False, "event is wildcard"
+
+        # there's no value in inspecting service records
+        if service_record(event.host) == True:
+            return False, "service record detected"
+
+        return True
+
+    async def handle_event(self, event):
+        rdtype = "TXT"
+        tags = ["tlsrpt-record"]
+        hostname = f"_smtp._tls.{event.host}"
+
+        r = await self.helpers.resolve_raw(hostname, type=rdtype)
+
+        if r:
+            raw_results, errors = r
+            for answer in raw_results:
+                if self.emit_raw_dns_records:
+                    await self.emit_event(
+                        {"host": hostname, "type": rdtype, "answer": answer.to_text()},
+                        "RAW_DNS_RECORD",
+                        parent=event,
+                        tags=tags.append(f"{rdtype.lower()}-record"),
+                        context=f"{rdtype} lookup on {hostname} produced {{event.type}}",
+                    )
+
+                # we need to fix TXT data that may have been split across two different rdata's
+                # e.g. we will get a single string, but within that string we may have two parts such as:
+                # answer = '"part 1 that was really long" "part 2 that did not fit in part 1"'
+                # NOTE: the leading and trailing double quotes are essential as part of a raw DNS TXT record, or another record type that contains a free form text string as a component.
+                s = answer.to_text().strip('"').replace('" "', "")
+
+                # validate TLSRPT record, tag appropriately
+                tlsrpt_match = tlsrpt_regex.search(s)
+
+                if (
+                    tlsrpt_match
+                    and tlsrpt_match.group("v")
+                    and tlsrpt_match.group("kvps")
+                    and tlsrpt_match.group("kvps") != ""
+                ):
+                    for kvp_match in tlsrpt_kvp_regex.finditer(tlsrpt_match.group("kvps")):
+                        key = kvp_match.group("k").lower()
+
+                        if key == "rua":
+                            for csul_match in csul.finditer(kvp_match.group("v")):
+                                if csul_match.group("uri"):
+                                    for match in email_regex.finditer(csul_match.group("uri")):
+                                        start, end = match.span()
+                                        email = csul_match.group("uri")[start:end]
+
+                                        if self.emit_emails:
+                                            await self.emit_event(
+                                                email,
+                                                "EMAIL_ADDRESS",
+                                                tags=tags.append(f"tlsrpt-record-{key}"),
+                                                parent=event,
+                                            )
+
+                                    for url_regex in url_regexes:
+                                        for match in url_regex.finditer(csul_match.group("uri")):
+                                            start, end = match.span()
+                                            url = csul_match.group("uri")[start:end]
+
+                                            if self.emit_urls:
+                                                await self.emit_event(
+                                                    url,
+                                                    "URL_UNVERIFIED",
+                                                    tags=tags.append(f"tlsrpt-record-{key}"),
+                                                    parent=event,
+                                                )
+
+
+# EOF

bbot/modules/dotnetnuke.py

@@ -32,7 +32,6 @@ class dotnetnuke(BaseModule):
         self.interactsh_instance = None
 
         if self.scan.config.get("interactsh_disable", False) == False:
-
             try:
                 self.interactsh_instance = self.helpers.interactsh()
                 self.interactsh_domain = await self.interactsh_instance.register(callback=self.interactsh_callback)
@@ -114,7 +113,6 @@ class dotnetnuke(BaseModule):
                         )
 
             if "endpoint" not in event.tags:
-
                 # NewsArticlesSlider ImageHandler.ashx File Read
                 result = await self.helpers.request(
                     f'{event.data["url"]}/DesktopModules/dnnUI_NewsArticlesSlider/ImageHandler.ashx?img=~/web.config'

bbot/modules/internal/excavate.py

@@ -62,7 +62,6 @@ def _exclude_key(original_dict, key_to_exclude):
 
 
 def extract_params_url(parsed_url):
-
     params = parse_qs(parsed_url.query)
     flat_params = {k: v[0] for k, v in params.items()}
 
@@ -94,7 +93,6 @@ def extract_params_location(location_header_value, original_parsed_url):
 
 
 class YaraRuleSettings:
-
     def __init__(self, description, tags, emit_match):
         self.description = description
         self.tags = tags
@@ -263,7 +261,6 @@ class ExcavateRule:
 
 
 class CustomExtractor(ExcavateRule):
-
     def __init__(self, excavate):
         super().__init__(excavate)
 
@@ -358,7 +355,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
         )
 
     class ParameterExtractor(ExcavateRule):
-
         yara_rules = {}
 
         class ParameterExtractorRule:
@@ -372,7 +368,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                 self.result = result
 
         class GetJquery(ParameterExtractorRule):
-
             name = "GET jquery"
             discovery_regex = r"/\$.get\([^\)].+\)/ nocase"
             extraction_regex = re.compile(r"\$.get\([\'\"](.+)[\'\"].+(\{.+\})\)")
@@ -393,8 +388,12 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                     for action, extracted_parameters in extracted_results:
                         extracted_parameters_dict = self.convert_to_dict(extracted_parameters)
                         for parameter_name, original_value in extracted_parameters_dict.items():
-                            yield self.output_type, parameter_name, original_value, action, _exclude_key(
-                                extracted_parameters_dict, parameter_name
+                            yield (
+                                self.output_type,
+                                parameter_name,
+                                original_value,
+                                action,
+                                _exclude_key(extracted_parameters_dict, parameter_name),
                             )
 
         class PostJquery(GetJquery):
@@ -418,8 +417,12 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                         k: v[0] if isinstance(v, list) and len(v) == 1 else v for k, v in query_strings.items()
                     }
                     for parameter_name, original_value in query_strings_dict.items():
-                        yield self.output_type, parameter_name, original_value, url, _exclude_key(
-                            query_strings_dict, parameter_name
+                        yield (
+                            self.output_type,
+                            parameter_name,
+                            original_value,
+                            url,
+                            _exclude_key(query_strings_dict, parameter_name),
                         )
 
         class GetForm(ParameterExtractorRule):
@@ -444,8 +447,12 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                             form_parameters[parameter_name] = original_value
 
                         for parameter_name, original_value in form_parameters.items():
-                            yield self.output_type, parameter_name, original_value, form_action, _exclude_key(
-                                form_parameters, parameter_name
+                            yield (
+                                self.output_type,
+                                parameter_name,
+                                original_value,
+                                form_action,
+                                _exclude_key(form_parameters, parameter_name),
                             )
 
         class PostForm(GetForm):
@@ -485,7 +492,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                             endpoint,
                             additional_params,
                         ) in extracted_params:
-
                             self.excavate.debug(
                                 f"Found Parameter [{parameter_name}] in [{parameterExtractorSubModule.name}] ParameterExtractor Submodule"
                             )
@@ -497,7 +503,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                             )
 
                             if self.excavate.helpers.validate_parameter(parameter_name, parameter_type):
-
                                 if self.excavate.in_bl(parameter_name) == False:
                                     parsed_url = urlparse(url)
                                     description = f"HTTP Extracted Parameter [{parameter_name}] ({parameterExtractorSubModule.name} Submodule)"
@@ -532,7 +537,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                         await self.report(domain, event, yara_rule_settings, discovery_context, event_type="DNS_NAME")
 
     class EmailExtractor(ExcavateRule):
-
         yara_rules = {
             "email": 'rule email { meta: description = "contains email address" strings: $email = /[^\\W_][\\w\\-\\.\\+\']{0,100}@[a-zA-Z0-9\\-]{1,100}(\\.[a-zA-Z0-9\\-]{1,100})*\\.[a-zA-Z]{2,63}/ nocase fullword condition: $email }',
         }
@@ -551,7 +555,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
         }
 
     class ErrorExtractor(ExcavateRule):
-
         signatures = {
             "PHP_1": r"/\.php on line [0-9]+/",
             "PHP_2": r"/\.php<\/b> on line <b>[0-9]+/",
@@ -589,7 +592,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                     await self.report(event_data, event, yara_rule_settings, discovery_context, event_type="FINDING")
 
     class SerializationExtractor(ExcavateRule):
-
         regexes = {
             "Java": re.compile(r"[^a-zA-Z0-9\/+]rO0[a-zA-Z0-9+\/]+={0,2}"),
             "DOTNET": re.compile(r"[^a-zA-Z0-9\/+]AAEAAAD\/\/[a-zA-Z0-9\/+]+={0,2}"),
@@ -619,7 +621,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                     await self.report(event_data, event, yara_rule_settings, discovery_context, event_type="FINDING")
 
     class FunctionalityExtractor(ExcavateRule):
-
         yara_rules = {
             "File_Upload_Functionality": r'rule File_Upload_Functionality { meta: description = "contains file upload functionality" strings: $fileuploadfunc = /<input[^>]+type=["\']?file["\']?[^>]+>/ nocase condition: $fileuploadfunc }',
             "Web_Service_WSDL": r'rule Web_Service_WSDL { meta: emit_match = "True" description = "contains a web service WSDL URL" strings: $wsdl = /https?:\/\/[^\s]*\.(wsdl)/ nocase condition: $wsdl }',
@@ -704,7 +705,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
         tag_attribute_regex = bbot_regexes.tag_attribute_regex
 
         async def process(self, yara_results, event, yara_rule_settings, discovery_context):
-
             for identifier, results in yara_results.items():
                 urls_found = 0
                 final_url = ""
@@ -897,7 +897,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
         decoded_data = await self.helpers.re.recursive_decode(data)
 
         if self.parameter_extraction:
-
             content_type_lower = content_type.lower() if content_type else ""
             extraction_map = {
                 "json": self.helpers.extract_params_json,
@@ -934,7 +933,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                 self.hugewarning(f"YARA Rule {rule_name} not found in pre-compiled rules")
 
     async def handle_event(self, event):
-
         if event.type == "HTTP_RESPONSE":
             # Harvest GET parameters from URL, if it came directly from the target, and parameter extraction is enabled
             if (
@@ -1023,7 +1021,6 @@ class excavate(BaseInternalModule, BaseInterceptModule):
 
                             # Try to extract parameters from the redirect URL
                             if self.parameter_extraction:
-
                                 for (
                                     method,
                                     parsed_url,

bbot/modules/paramminer_headers.py

@@ -82,7 +82,6 @@ class paramminer_headers(BaseModule):
     header_regex = re.compile(r"^[!#$%&\'*+\-.^_`|~0-9a-zA-Z]+: [^\r\n]+$")
 
     async def setup(self):
-
         self.recycle_words = self.config.get("recycle_words", True)
         self.event_dict = {}
         self.already_checked = set()
@@ -157,7 +156,6 @@ class paramminer_headers(BaseModule):
             )
 
     async def handle_event(self, event):
-
         # If recycle words is enabled, we will collect WEB_PARAMETERS we find to build our list in finish()
         # We also collect any parameters of type "SPECULATIVE"
         if event.type == "WEB_PARAMETER":
@@ -201,7 +199,7 @@ class paramminer_headers(BaseModule):
             return
         for count, args, kwargs in self.gen_count_args(url):
             r = await self.helpers.request(*args, **kwargs)
-            if r is not None and not ((str(r.status_code)[0] in ("4", "5"))):
+            if r is not None and not (str(r.status_code)[0] in ("4", "5")):
                 return count
 
     def gen_count_args(self, url):
@@ -240,7 +238,6 @@ class paramminer_headers(BaseModule):
         return await compare_helper.compare(url, headers=test_headers, check_reflection=(len(header_list) == 1))
 
     async def finish(self):
-
         untested_matches = sorted(list(self.extracted_words_master.copy()))
         for url, (event, batch_size) in list(self.event_dict.items()):
             try:

bbot/modules/trufflehog.py

@@ -13,7 +13,7 @@ class trufflehog(BaseModule):
     }
 
     options = {
-        "version": "3.84.0",
+        "version": "3.84.1",
         "config": "",
         "only_verified": True,
         "concurrency": 8,

bbot/scanner/preset/args.py

@@ -10,7 +10,6 @@ log = logging.getLogger("bbot.presets.args")
 
 
 class BBOTArgs:
-
     # module config options to exclude from validation
     exclude_from_validation = re.compile(r".*modules\.[a-z0-9_]+\.(?:batch_size|module_threads)$")
 

bbot/scanner/preset/environ.py

@@ -65,7 +65,6 @@ omegaconf.OmegaConf.register_new_resolver("env", env_resolver)
 
 
 class BBOTEnviron:
-
     def __init__(self, preset):
         self.preset = preset
 

bbot/test/test_step_2/module_tests/test_module_asset_inventory.py

@@ -10,7 +10,6 @@ class TestAsset_Inventory(ModuleTestBase):
     masscan_output = """{   "ip": "127.0.0.1",   "timestamp": "1680197558", "ports": [ {"port": 9999, "proto": "tcp", "status": "open", "reason": "syn-ack", "ttl": 54} ] }"""
 
     async def setup_before_prep(self, module_test):
-
         async def run_masscan(command, *args, **kwargs):
             if "masscan" in command[:2]:
                 targets = open(command[11]).read().splitlines()

bbot/test/test_step_2/module_tests/test_module_dnsbrute.py

@@ -7,7 +7,6 @@ class TestDnsbrute(ModuleTestBase):
     config_overrides = {"modules": {"dnsbrute": {"wordlist": str(subdomain_wordlist), "max_depth": 3}}}
 
     async def setup_after_prep(self, module_test):
-
         old_run_live = module_test.scan.helpers.run_live
 
         async def new_run_live(*command, check=False, text=True, **kwargs):

bbot/test/test_step_2/module_tests/test_module_dnsbrute_mutations.py

@@ -11,7 +11,6 @@ class TestDnsbrute_mutations(ModuleTestBase):
     ]
 
     async def setup_after_prep(self, module_test):
-
         old_run_live = module_test.scan.helpers.run_live
 
         async def new_run_live(*command, check=False, text=True, **kwargs):

bbot/test/test_step_2/module_tests/test_module_dnscommonsrv.py

@@ -8,7 +8,6 @@ class TestDNSCommonSRV(ModuleTestBase):
     config_overrides = {"dns": {"minimal": False}}
 
     async def setup_after_prep(self, module_test):
-
         old_run_live = module_test.scan.helpers.run_live
 
         async def new_run_live(*command, check=False, text=True, **kwargs):

bbot/test/test_step_2/module_tests/test_module_dnstlsrpt.py

@@ -0,0 +1,64 @@
+from .base import ModuleTestBase
+
+raw_smtp_tls_txt = '"v=TLSRPTv1; rua=mailto:tlsrpt@sub.blacklanternsecurity.notreal,mailto:test@on.thirdparty.com, https://tlspost.example.com;"'
+
+
+class TestDNSTLSRPT(ModuleTestBase):
+    targets = ["blacklanternsecurity.notreal"]
+    modules_overrides = ["dnstlsrpt", "speculate"]
+    config_overrides = {"modules": {"dnstlsrpt": {"emit_raw_dns_records": True}}, "scope": {"report_distance": 1}}
+
+    async def setup_after_prep(self, module_test):
+        await module_test.mock_dns(
+            {
+                "blacklanternsecurity.notreal": {
+                    "A": ["127.0.0.11"],
+                },
+                "_tls.blacklanternsecurity.notreal": {
+                    "A": ["127.0.0.22"],
+                },
+                "_smtp._tls.blacklanternsecurity.notreal": {
+                    "A": ["127.0.0.33"],
+                    "TXT": [raw_smtp_tls_txt],
+                },
+                "_tls._smtp._tls.blacklanternsecurity.notreal": {
+                    "A": ["127.0.0.44"],
+                },
+                "_smtp._tls._smtp._tls.blacklanternsecurity.notreal": {
+                    "TXT": [raw_smtp_tls_txt],
+                },
+                "sub.blacklanternsecurity.notreal": {
+                    "A": ["127.0.0.55"],
+                },
+            }
+        )
+
+    def check(self, module_test, events):
+        assert any(
+            e.type == "RAW_DNS_RECORD" and e.data["answer"] == raw_smtp_tls_txt for e in events
+        ), "Failed to emit RAW_DNS_RECORD"
+        assert any(
+            e.type == "DNS_NAME" and e.data == "sub.blacklanternsecurity.notreal" for e in events
+        ), "Failed to detect sub-domain"
+        assert any(
+            e.type == "EMAIL_ADDRESS" and e.data == "tlsrpt@sub.blacklanternsecurity.notreal" for e in events
+        ), "Failed to detect email address"
+        assert any(
+            e.type == "EMAIL_ADDRESS" and e.data == "test@on.thirdparty.com" for e in events
+        ), "Failed to detect third party email address"
+        assert any(
+            e.type == "URL_UNVERIFIED" and e.data == "https://tlspost.example.com/" for e in events
+        ), "Failed to detect third party URL"
+
+
+class TestDNSTLSRPTRecursiveRecursion(TestDNSTLSRPT):
+    config_overrides = {
+        "scope": {"report_distance": 1},
+        "modules": {"dnstlsrpt": {"emit_raw_dns_records": True}},
+    }
+
+    def check(self, module_test, events):
+        assert not any(
+            e.type == "RAW_DNS_RECORD" and e.data["host"] == "_mta-sts._mta-sts.blacklanternsecurity.notreal"
+            for e in events
+        ), "Unwanted recursion occurring"

bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py

@@ -146,14 +146,12 @@ class TestDotnetnuke_blindssrf(ModuleTestBase):
         return Response("alive", status=200)
 
     async def setup_before_prep(self, module_test):
-
         self.interactsh_mock_instance = module_test.mock_interactsh("dotnetnuke_blindssrf")
         module_test.monkeypatch.setattr(
             module_test.scan.helpers, "interactsh", lambda *args, **kwargs: self.interactsh_mock_instance
         )
 
     async def setup_after_prep(self, module_test):
-
         # Simulate DotNetNuke Instance
         expect_args = {"method": "GET", "uri": "/"}
         respond_args = {"response_data": dotnetnuke_http_response}

bbot/test/test_step_2/module_tests/test_module_excavate.py

@@ -13,7 +13,6 @@ class TestExcavate(ModuleTestBase):
     config_overrides = {"web": {"spider_distance": 1, "spider_depth": 1}}
 
     async def setup_before_prep(self, module_test):
-
         response_data = """
         ftp://ftp.test.notreal
         \\nhttps://www1.test.notreal
@@ -181,7 +180,6 @@ class TestExcavateRedirect(TestExcavate):
         module_test.httpserver.no_handler_status_code = 404
 
     def check(self, module_test, events):
-
         assert 1 == len(
             [
                 e
@@ -332,7 +330,6 @@ class TestExcavateMaxLinksPerPage(TestExcavate):
 
 
 class TestExcavateCSP(TestExcavate):
-
     csp_test_header = "default-src 'self'; script-src asdf.test.notreal; object-src 'none';"
 
     async def setup_before_prep(self, module_test):
@@ -356,7 +353,6 @@ class TestExcavateURL(TestExcavate):
 
 
 class TestExcavateURL_IP(TestExcavate):
-
     targets = ["http://127.0.0.1:8888/", "127.0.0.2"]
 
     async def setup_before_prep(self, module_test):
@@ -405,7 +401,6 @@ class TestExcavateSerializationPositive(TestExcavate):
 
 
 class TestExcavateNonHttpScheme(TestExcavate):
-
     targets = ["http://127.0.0.1:8888/", "test.notreal"]
 
     non_http_scheme_html = """
@@ -425,7 +420,6 @@ class TestExcavateNonHttpScheme(TestExcavate):
         module_test.httpserver.expect_request("/").respond_with_data(self.non_http_scheme_html)
 
     def check(self, module_test, events):
-
         found_hxxp_url = False
         found_ftp_url = False
         found_nonsense_url = False
@@ -540,7 +534,6 @@ class TestExcavateParameterExtraction(TestExcavate):
 
 
 class TestExcavateParameterExtraction_getparam(ModuleTestBase):
-
     targets = ["http://127.0.0.1:8888/"]
 
     # hunt is added as parameter extraction is only activated by one or more modules that consume WEB_PARAMETER
@@ -554,11 +547,9 @@ class TestExcavateParameterExtraction_getparam(ModuleTestBase):
         module_test.set_expect_requests(respond_args=respond_args)
 
     def check(self, module_test, events):
-
         excavate_getparam_extraction = False
         for e in events:
             if e.type == "WEB_PARAMETER":
-
                 if "HTTP Extracted Parameter [hack] (HTML Tags Submodule)" in e.data["description"]:
                     excavate_getparam_extraction = True
         assert excavate_getparam_extraction, "Excavate failed to extract web parameter"
@@ -626,7 +617,6 @@ class excavateTestRule(ExcavateRule):
 
 
 class TestExcavateYara(TestExcavate):
-
     targets = ["http://127.0.0.1:8888/"]
     yara_test_html = """
     <html>
@@ -641,12 +631,10 @@ class TestExcavateYara(TestExcavate):
 """
 
     async def setup_before_prep(self, module_test):
-
         self.modules_overrides = ["excavate", "httpx"]
         module_test.httpserver.expect_request("/").respond_with_data(self.yara_test_html)
 
     async def setup_after_prep(self, module_test):
-
         excavate_module = module_test.scan.modules["excavate"]
         excavateruleinstance = excavateTestRule(excavate_module)
         excavate_module.add_yara_rule(
@@ -665,7 +653,6 @@ class TestExcavateYara(TestExcavate):
         found_yara_string_1 = False
         found_yara_string_2 = False
         for e in events:
-
             if e.type == "FINDING":
                 if e.data["description"] == "HTTP response (body) Contains the text AAAABBBBCCCC":
                     found_yara_string_1 = True
@@ -677,7 +664,6 @@ class TestExcavateYara(TestExcavate):
 
 
 class TestExcavateYaraCustom(TestExcavateYara):
-
     rule_file = [
         'rule SearchForText { meta: description = "Contains the text AAAABBBBCCCC" strings: $text = "AAAABBBBCCCC" condition: $text }',
         'rule SearchForText2 { meta: description = "Contains the text DDDDEEEEFFFF" strings: $text2 = "DDDDEEEEFFFF" condition: $text2 }',
@@ -711,7 +697,6 @@ class TestExcavateSpiderDedupe(ModuleTestBase):
         module_test.httpserver.expect_request("/spider").respond_with_data("hi")
 
     def check(self, module_test, events):
-
         found_url_unverified_spider_max = False
         found_url_unverified_dummy = False
         found_url_event = False
@@ -803,7 +788,6 @@ class TestExcavate_retain_querystring(ModuleTestBase):
 
 
 class TestExcavate_retain_querystring_not(TestExcavate_retain_querystring):
-
     config_overrides = {
         "url_querystring_remove": False,
         "url_querystring_collapse": False,
@@ -827,7 +811,6 @@ class TestExcavate_retain_querystring_not(TestExcavate_retain_querystring):
 
 
 class TestExcavate_webparameter_outofscope(ModuleTestBase):
-
     html_body = "<html><a class=button href='https://socialmediasite.com/send?text=foo'><a class=button href='https://outofscope.com/send?text=foo'></html>"
 
     targets = ["http://127.0.0.1:8888", "socialmediasite.com"]
@@ -858,13 +841,11 @@ class TestExcavate_webparameter_outofscope(ModuleTestBase):
 
 
 class TestExcavateHeaders(ModuleTestBase):
-
     targets = ["http://127.0.0.1:8888/"]
     modules_overrides = ["excavate", "httpx", "hunt"]
     config_overrides = {"web": {"spider_distance": 1, "spider_depth": 1}}
 
     async def setup_before_prep(self, module_test):
-
         module_test.httpserver.expect_request("/").respond_with_data(
             "<html><p>test</p></html>",
             status=200,
@@ -877,7 +858,6 @@ class TestExcavateHeaders(ModuleTestBase):
         )
 
     def check(self, module_test, events):
-
         found_first_cookie = False
         found_second_cookie = False
 

bbot/test/test_step_2/module_tests/test_module_paramminer_cookies.py

@@ -36,7 +36,6 @@ class TestParamminer_Cookies(Paramminer_Headers):
         module_test.set_expect_requests(respond_args=respond_args)
 
     def check(self, module_test, events):
-
         found_reflected_cookie = False
         false_positive_match = False
 

bbot/test/test_step_2/module_tests/test_module_paramminer_getparams.py

@@ -89,7 +89,6 @@ class TestParamminer_Getparams_boring_off(TestParamminer_Getparams):
         module_test.set_expect_requests(respond_args=respond_args)
 
     def check(self, module_test, events):
-
         emitted_boring_parameter = False
         for e in events:
             if e.type == "WEB_PARAMETER":
@@ -106,7 +105,6 @@ class TestParamminer_Getparams_boring_on(TestParamminer_Getparams_boring_off):
     }
 
     def check(self, module_test, events):
-
         emitted_boring_parameter = False
 
         for e in events:
@@ -160,15 +158,12 @@ class TestParamminer_Getparams_finish(Paramminer_Headers):
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
     def check(self, module_test, events):
-
         excavate_extracted_web_parameter = False
         found_hidden_getparam_recycled = False
         emitted_excavate_paramminer_duplicate = False
 
         for e in events:
-
             if e.type == "WEB_PARAMETER":
-
                 if (
                     "http://127.0.0.1:8888/test2.php" in e.data["url"]
                     and "HTTP Extracted Parameter [abcd1234] (HTML Tags Submodule)" in e.data["description"]
@@ -213,7 +208,6 @@ class TestParamminer_Getparams_xmlspeculative(Paramminer_Headers):
     """
 
     async def setup_after_prep(self, module_test):
-
         module_test.scan.modules["paramminer_getparams"].rand_string = lambda *args, **kwargs: "AAAAAAAAAAAAAA"
         module_test.monkeypatch.setattr(
             helper.HttpCompare, "gen_cache_buster", lambda *args, **kwargs: {"AAAAAA": "1"}

bbot/test/test_step_2/module_tests/test_module_paramminer_headers.py

@@ -39,7 +39,6 @@ class Paramminer_Headers(ModuleTestBase):
         module_test.set_expect_requests(respond_args=respond_args)
 
     def check(self, module_test, events):
-
         found_reflected_header = False
         false_positive_match = False
 
@@ -60,7 +59,6 @@ class TestParamminer_Headers(Paramminer_Headers):
 
 
 class TestParamminer_Headers_noreflection(Paramminer_Headers):
-
     found_nonreflected_header = False
 
     headers_body_match = """
@@ -82,7 +80,6 @@ class TestParamminer_Headers_noreflection(Paramminer_Headers):
 
 
 class TestParamminer_Headers_extract(Paramminer_Headers):
-
     modules_overrides = ["httpx", "paramminer_headers", "excavate"]
     config_overrides = {
         "modules": {
@@ -123,7 +120,6 @@ class TestParamminer_Headers_extract(Paramminer_Headers):
         module_test.set_expect_requests(respond_args=respond_args)
 
     def check(self, module_test, events):
-
         excavate_extracted_web_parameter = False
         used_recycled_parameter = False
 
@@ -139,17 +135,14 @@ class TestParamminer_Headers_extract(Paramminer_Headers):
 
 
 class TestParamminer_Headers_extract_norecycle(TestParamminer_Headers_extract):
-
     modules_overrides = ["httpx", "excavate"]
     config_overrides = {}
 
     async def setup_after_prep(self, module_test):
-
         respond_args = {"response_data": self.headers_body}
         module_test.set_expect_requests(respond_args=respond_args)
 
     def check(self, module_test, events):
-
         excavate_extracted_web_parameter = False
 
         for e in events:

bbot/test/test_step_2/module_tests/test_module_portscan.py

@@ -21,7 +21,6 @@ class TestPortscan(ModuleTestBase):
     masscan_output_ping = """{   "ip": "8.8.8.8",   "timestamp": "1719862594", "ports": [ {"port": 0, "proto": "icmp", "status": "open", "reason": "none", "ttl": 54} ] }"""
 
     async def setup_after_prep(self, module_test):
-
         from bbot.modules.base import BaseModule
 
         class DummyModule(BaseModule):

{bbot-2.3.0.5368rc0.dist-info → bbot-2.3.0.5376rc0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: bbot
-Version: 2.3.0.5368rc0
+Version: 2.3.0.5376rc0
 Summary: OSINT automation for hackers.
 Home-page: https://github.com/blacklanternsecurity/bbot
 License: GPL-3.0

{bbot-2.3.0.5368rc0.dist-info → bbot-2.3.0.5376rc0.dist-info}/RECORD

@@ -1,13 +1,13 @@
-bbot/__init__.py,sha256=iB0LrMZRMIy60deRW5QZhqK39EBW1AXbqQAH9IzSHTk,130
-bbot/cli.py,sha256=-9d6yCAYZaP0lIOCja-fSk3MiNclc-kbEgos10jYNUQ,10440
+bbot/__init__.py,sha256=axMbsMMdxGO7hofgbNW8GFlsfp7fd12R17RP3nRqYC0,130
+bbot/cli.py,sha256=f_HbPSOyR7ishGb-UVwGdI71kLFrvkko4d01lDYlSdE,10436
 bbot/core/__init__.py,sha256=l255GJE_DvUnWvrRb0J5lG-iMztJ8zVvoweDOfegGtI,46
 bbot/core/config/__init__.py,sha256=zYNw2Me6tsEr8hOOkLb4BQ97GB7Kis2k--G81S8vofU,342
-bbot/core/config/files.py,sha256=pNrcw61UKKZeMt0rp9Ac5mUK7LdIRmcpojMxI-LwjeA,1413
+bbot/core/config/files.py,sha256=zANvrTRLJQIOWSNkxd9MpWmf9cQFr0gRZLUxeIbTwQc,1412
 bbot/core/config/logger.py,sha256=YBWLg3x0bEaHKQR8Fn9e1Y0OeyFTED0fgAMtUZT2gEw,10583
 bbot/core/core.py,sha256=zFSbPd0YcjpeI1uO9U6lYY5gKmzNSTGhduvXvB6qZ0M,7065
 bbot/core/engine.py,sha256=uauGZgd7zAnJwNmVVPDicwHbUVCa8pV_pif49lgYeWk,29364
 bbot/core/event/__init__.py,sha256=8ut88ZUg0kbtWkOx2j3XzNr_3kTfgoM-3UdiWHFA_ag,56
-bbot/core/event/base.py,sha256=MPhb_SFaoE7WHeqf-C7x8oRITTL1xoa4mXO8y3YsQQI,61465
+bbot/core/event/base.py,sha256=_WKPUeCFc6hC7G2DQaLOlHqdre-TBWWlUEvfJF3g2zU,61462
 bbot/core/event/helpers.py,sha256=PUN4Trq5_wpKVuhmwUQWAr40apgMXhJ9Gz-VfZ0j3lA,1554
 bbot/core/flags.py,sha256=Ltvm8Bc4D65I55HuU5bzyjO1R3yMDNpVmreGU83ZBXE,1266
 bbot/core/helpers/__init__.py,sha256=0UNwcZjNsX41hbHdo3yZPuARkYWch-okI68DScexve4,86
@@ -21,33 +21,33 @@ bbot/core/helpers/depsinstaller/sudo_askpass.py,sha256=yGa2OQv30RO75QkMuG1iruKqb
 bbot/core/helpers/diff.py,sha256=7waBeHFGnAKn-R-sBd-wc3yjwxT_umwy4YxfE7JFd6w,10599
 bbot/core/helpers/dns/__init__.py,sha256=2JK8P0BUfPlh4CTuuOWQCOacwL7NEtGFYPJsxbA0Zwo,27
 bbot/core/helpers/dns/brute.py,sha256=sTlgFabHVL5rNaD8Pef0kXap1gM4LFpc71kdR9j7pdE,6990
-bbot/core/helpers/dns/dns.py,sha256=Lp-_W2_ViihQI960wGFHsQGbQvFy4HdtzAlgMe5yiag,8437
-bbot/core/helpers/dns/engine.py,sha256=3LMwgqrFaLwAwF1OfGUtT4GkJHJv-ZieE3G5j7fcKSk,28749
+bbot/core/helpers/dns/dns.py,sha256=xlmHIdH4I4cn0dHeyYHipPiqeagibBW-BCHMbIlxtsw,8436
+bbot/core/helpers/dns/engine.py,sha256=senRWnKADkH3z8lcPPMGCPVfKHnXHk2HejqAV9iGa4E,28747
 bbot/core/helpers/dns/helpers.py,sha256=aQroIuz5TxrCZ4zoplOaqLj3ZNgOgDRKn0xM8GKz2dA,8505
-bbot/core/helpers/dns/mock.py,sha256=Ztkp2aOuwDJ0NTQSlAk2H0s3Stx9wIM22Qm3VtqWMKM,2589
+bbot/core/helpers/dns/mock.py,sha256=FCPrihu6O4kun38IH70RfktsXIKKfe0Qx5PMzZVUdsY,2588
 bbot/core/helpers/files.py,sha256=GqrwNGJljUvGSzaOW5-Y357hkt7j88dOYbzQxJGsdTc,5787
 bbot/core/helpers/helper.py,sha256=t6bv_wwI_MYlVpBAh9_c318rRSKGmoejx6qO9JOldbI,8423
 bbot/core/helpers/interactsh.py,sha256=Q9IHUzH-T7e1s4YTHevHe-VJj1Mokv0EHY16UZJdl8M,12627
-bbot/core/helpers/libmagic.py,sha256=RHx1WZ4KJlfSLSeb6NYW_Rel7WmuZUl5ebofASrc0HY,3461
+bbot/core/helpers/libmagic.py,sha256=QMHyxjgDLb2jyjBvK1MQ-xt6WkGXhKcHu9ZP1li-sik,3460
 bbot/core/helpers/misc.py,sha256=fphXVSGtW70m2xdUCPDdISLtLwIG1v_cL6RxgNGmJNk,87757
 bbot/core/helpers/names_generator.py,sha256=Sj_Q-7KQyElEpalzlUadSwaniESqrIVVEle9ycPIiho,10322
 bbot/core/helpers/ntlm.py,sha256=P2Xj4-GPos2iAzw4dfk0FJp6oGyycGhu2x6sLDVjYjs,2573
-bbot/core/helpers/process.py,sha256=2bbveUuLIrr6wjixZRdFX-gqNE-b7rxVpzBPHYNcmzM,1704
+bbot/core/helpers/process.py,sha256=00uRpLMFi3Pt3uT8qXwAIhsXdoa7h-ifoXh0sGYgwqs,1702
 bbot/core/helpers/ratelimiter.py,sha256=K8qFIyJPJtfdb9kSW6_lL6ahWqxR2uWyCBkDlg6uJgo,1990
 bbot/core/helpers/regex.py,sha256=XURaY6ijpOYYU9lzWMAKg12G1VFtGJjlJl07_eN1xxk,4170
 bbot/core/helpers/regexes.py,sha256=-IHbsvS9XJXHkfbthaB1CbRaikDt1pmiiUsbOJW7wpc,5946
 bbot/core/helpers/url.py,sha256=1NDrvirODzzD6Mcssu-4WDNerMeMdekHCFzhRCS0m3g,5947
-bbot/core/helpers/validators.py,sha256=cglRDybXiFDh2vKwqjqv7Ruu1TWmSzPcbuQ3Rvky5JU,9696
+bbot/core/helpers/validators.py,sha256=TIjgtHS6fMObjTszDJ_nng3YMJpuV6BzKdmkQ2LY3Qk,9695
 bbot/core/helpers/web/__init__.py,sha256=pIEkL3DhjaGTSmZ7D3yKKYwWpntoLRILekV2wWsbsws,27
 bbot/core/helpers/web/client.py,sha256=vDRhUQ6onkNzeJCqWd8oCQb08rLrWB2Sg7sDH7ZssK0,3562
-bbot/core/helpers/web/engine.py,sha256=14_JBkdBt_PhnWIUfJ9DY5E81_Orb7HhvHgEfFBwIks,8870
+bbot/core/helpers/web/engine.py,sha256=hwFSWrW8fDzinmKS27u1RHl3rP-QM05FOZp8zXWD5AY,8869
 bbot/core/helpers/web/ssl_context.py,sha256=aWVgl-d0HoE8B4EBKNxaa5UAzQmx79DjDByfBw9tezo,356
-bbot/core/helpers/web/web.py,sha256=ebjlOXlnVFIJlLDUBzp6L3iBPrpDJDgB4jW_pYFU6Xs,22658
+bbot/core/helpers/web/web.py,sha256=sdsffF3F_gj76DwfFcgW9D70Vj8HJszSNxw21QJdUKk,22657
 bbot/core/helpers/wordcloud.py,sha256=WdQwboCNcCxcUdLuB6MMMDQBL4ZshFM_f6GW7nUZEBQ,19819
-bbot/core/modules.py,sha256=OOUSncr-EM6bJBrI3iH5wvfnpTXKQ-A8OL8UMvkL0CU,31432
+bbot/core/modules.py,sha256=k4a-4cxdpQGA-17vELWOZ8eqsMSrd4nk5g3eOJVhx9g,31431
 bbot/core/multiprocess.py,sha256=ocQHanskJ09gHwe7RZmwNdZyCOQyeyUoIHCtLbtvXUk,1771
 bbot/core/shared_deps.py,sha256=A3vrI62uPTTayNIHhWAj6xz43cj--oXWC4prmDlgJnw,6958
-bbot/db/sql/models.py,sha256=Y_Bx-BT51lEGZEuadKaeXHM9hcECUTSsbGf3ZnIxZ0g,4885
+bbot/db/sql/models.py,sha256=SrUdDOBCICzXJBY29p0VvILhMQ1JCuh725bqvIYogX0,4884
 bbot/defaults.yml,sha256=d1uVZOWzaJ7IM5YF-Zpambb8Gdbas-aCInqoWElxsEw,6221
 bbot/errors.py,sha256=xwQcD26nU9oc7-o0kv5jmEDTInmi8_W8eKAgQZZxdVM,953
 bbot/logger.py,sha256=rLcLzNDvfR8rFj7_tZ-f5QB3Z8T0RVroact3W0ogjpA,1408
@@ -57,8 +57,8 @@ bbot/modules/anubisdb.py,sha256=JCy2YCfa0e_VawpzNmcPXAosKUthmYGutireJ0gMDws,1916
 bbot/modules/apkpure.py,sha256=V-bGIFV7b91kXo24OitACip8Rx5qaoI1p6iHwbICxwk,2434
 bbot/modules/azure_realm.py,sha256=pP2PUlLy0K9KKaE8aNcznWjDW3PKHvnMejdOSc-o4ms,1612
 bbot/modules/azure_tenant.py,sha256=cKS53GjvrplaFFYvacUmJKCdLB6h7Yp_AzHNFuKtFrU,5374
-bbot/modules/baddns.py,sha256=66-_9Ck5KtewnwgGoWaa0hZI9WXNfIX9myubT5wsmds,6380
-bbot/modules/baddns_direct.py,sha256=vGkW9-OMmE_lXZfqZ8xhy3_A7PCs36SxPfDe8IYh2ZQ,3819
+bbot/modules/baddns.py,sha256=SP-o0M2dq5QIkaQZUKl9YZiOXdZasty-fHPxTJJAeR0,6378
+bbot/modules/baddns_direct.py,sha256=pe_seO74XI4b6w4Q_IBDNvtBjmD-7it5ts0Z-FB0L6k,3818
 bbot/modules/baddns_zone.py,sha256=IcewDBtA_-64NCNFojEFd9jt2YBek6ltB2mmqdDH6LE,1034
 bbot/modules/badsecrets.py,sha256=JSukBYdD3yuvVy84DkyX48428R_LgQ7P39tjTRAD_Mo,5107
 bbot/modules/base.py,sha256=-nPgoPjMwcveZ81fzb4TwhbtBFqNYorj-zD3TG91ZPg,71115
@@ -93,9 +93,10 @@ bbot/modules/dnsbrute_mutations.py,sha256=bOJidK_oKZe87u8e9t0mEFnyuBi93UiNsQvpZY
 bbot/modules/dnscaa.py,sha256=pyaLqHrdsVhqtd1JBZVjKKcuYT_ywUbFYkrnfXcGD5s,5014
 bbot/modules/dnscommonsrv.py,sha256=gEErfSur7Odkaif4CbXYx3OZ3FQrQESyiMGPbcDKSIg,1538
 bbot/modules/dnsdumpster.py,sha256=n-UP428_9kAmh_1gf55jeh-3uWyr1EZN0AYSnT3uOnU,3253
+bbot/modules/dnstlsrpt.py,sha256=LW-8NTfUlYAlSlDrDBcELTe4LTrAI412J03xQfAL93Y,6427
 bbot/modules/docker_pull.py,sha256=Dp8de9UCCELcozwmZphA3lMh8qZaXyDo2kfwG45Wm3w,9069
 bbot/modules/dockerhub.py,sha256=ruvTP8Uz5LEuX-_SrKDzByvSNtd1ofZbX-lRTeKUB24,3491
-bbot/modules/dotnetnuke.py,sha256=XZysDA99ahQSLXR8RPROlmUwDxqrxvBFvscZMYBmsmc,10539
+bbot/modules/dotnetnuke.py,sha256=qS1lzAmvWlDYrm1ODufIBvIS20oTr7m7m3xU-a5PGUA,10537
 bbot/modules/emailformat.py,sha256=RLPJW-xitYB-VT4Lp08qVzFkXx_kMyV_035JT_Yf4fM,1082
 bbot/modules/extractous.py,sha256=22pc62jOs_4E3uZtBjUbUksLTadNr9sp_4r0-eU1un8,4551
 bbot/modules/ffuf_shortnames.py,sha256=9Kh0kJsw7XXpXmCkiB5eAhG4h9rSo8Y-mB3p0EDa_l0,12624
@@ -122,7 +123,7 @@ bbot/modules/internal/aggregate.py,sha256=csWYIt2fUp9K_CRxP3bndUMIjpNIh8rmBubp5F
 bbot/modules/internal/base.py,sha256=BXO4Hc7XKaAOaLzolF3krJX1KibPxtek2GTQUgnCHk0,387
 bbot/modules/internal/cloudcheck.py,sha256=86wYVzoY8OeorpqQFger9UrdNdu2vTkd8XmC9xtplUc,4727
 bbot/modules/internal/dnsresolve.py,sha256=UW88BlpJ7gOjPARrjVgtwpDIDPNQZRpuIRpL2yVP6T4,15251
-bbot/modules/internal/excavate.py,sha256=XCwEreroQIRPBnKBNo1epLHcbycCZGYTuW73Zi8qZLU,51174
+bbot/modules/internal/excavate.py,sha256=3kQqtA0yAfPXtwyhiDiywDVBXIsq5H9qAVBW6SB2wuY,51536
 bbot/modules/internal/speculate.py,sha256=hOJPrmJP8-APqSEbmYsbKrvovLIGIz4dJUoZyusq0w0,9270
 bbot/modules/internetdb.py,sha256=Edg0Z84dH8dPTZMd7RlzvYBYNq8JHs_ns_ldnFxwRKo,5415
 bbot/modules/ip2location.py,sha256=yGivX9fzvwvLpnqmYCP2a8SPjTarzrZxfRluog-nkME,2628
@@ -158,7 +159,7 @@ bbot/modules/output/web_report.py,sha256=lZ0FqRZ7Jz1lljI9JMhH9gjtWLaTCSpSnAKQGAc
 bbot/modules/output/websocket.py,sha256=sDTtHU-Ey_tvS0gMi6PVPV9L4qAmGyWeccxAKfEWCac,2278
 bbot/modules/paramminer_cookies.py,sha256=q1PzftHQpCHLz81_VgLZsO6moia7ZtnU32igfcySi2w,1816
 bbot/modules/paramminer_getparams.py,sha256=_j6rgaqV5wGJoa8p5-KKbe2YsVGUtmWIanCVtFiF97Y,1893
-bbot/modules/paramminer_headers.py,sha256=QEnWxveQVuS91MEYKYtfquqdNzimN7sQHuxpcqiTHpo,10305
+bbot/modules/paramminer_headers.py,sha256=fljlCoRuH6ML4Hz2ZCGH7Yr3aeOgRM896KfS8TVBKrs,10300
 bbot/modules/passivetotal.py,sha256=uGT6c_CUxBNInmClsTg8afIYA2ZykKYYCgjkyzujfHg,1653
 bbot/modules/pgp.py,sha256=Xu2M9WEIlwTm5-Lv29g7BblI05tD9Dl0XsYSeY6UURs,2065
 bbot/modules/portscan.py,sha256=2VSoxoh0AypE8DoGKHqE-a57G4Z91XEo3kquQ5OpM3Y,14656
@@ -189,7 +190,7 @@ bbot/modules/templates/sql.py,sha256=o-CdyyoJvHJdJBKkj3CIGXYxUta4w2AB_2Vr-k7cDDU
 bbot/modules/templates/subdomain_enum.py,sha256=54prHdg_wgTBHIJLPLbDWBqq2x978NDfDOGG7R5A6fQ,8403
 bbot/modules/templates/webhook.py,sha256=MYhKWrNYrsfM0a4PR6yVotudLyyCwgmy2eI-l9LvpBs,3706
 bbot/modules/trickest.py,sha256=MRgLW0YiDWzlWdAjyqfPPLFb-a51r-Ffn_dphiJI_gA,1550
-bbot/modules/trufflehog.py,sha256=yOoCszQe6ZoJGBUHfFp-lj5JH-Izp9R-CltsmZnI3Fw,8554
+bbot/modules/trufflehog.py,sha256=NCggggfFFdHn-tpws0mvD2OYLQcKkYDLb1P6CRySPWM,8554
 bbot/modules/url_manipulation.py,sha256=BI-OhlzNzP5xvwzHphL4qdehc4NiEYnL2BNK-JoEm90,4322
 bbot/modules/urlscan.py,sha256=ajhiX2sj-zZDlKU1q5rE8JTzxioj1mDLqZ9PRSQCpAw,3741
 bbot/modules/viewdns.py,sha256=f0vwoLpua2Ovw1gcrjoafUdaAP9fi4bHgTUiDOe8iWg,2596
@@ -219,9 +220,9 @@ bbot/scanner/__init__.py,sha256=gCyAAbkNm8_KozNpDENCKqO3E3ZCgseplnz40AtiJ1U,56
 bbot/scanner/dispatcher.py,sha256=_hsIegfUDrt8CUdXqgRvp1J0UwwzqVSDxjQmiviO41c,793
 bbot/scanner/manager.py,sha256=_5FBfxOmSMUeGp_-ryyGGl0pxb_eu-NSWft-lH1Pyog,10466
 bbot/scanner/preset/__init__.py,sha256=Jf2hWsHlTFtWNXL6gXD8_ZbKPFUM564ppdSxHFYnIJU,27
-bbot/scanner/preset/args.py,sha256=4pGyv7Ve7rZpsTKB7af5k1b_h-IrOLDLagAwUq8QFeg,16024
+bbot/scanner/preset/args.py,sha256=wuG-eVCsl-4EpmJoNeuuFB4sFNulOgCYFc_8P7ztKLE,16023
 bbot/scanner/preset/conditions.py,sha256=hFL9cSIWGEsv2TfM5UGurf0c91cyaM8egb5IngBmIjA,1569
-bbot/scanner/preset/environ.py,sha256=-wbFk1YHpU8IJLKVw23Q3btQTICeX0iulURo7D673L0,4732
+bbot/scanner/preset/environ.py,sha256=9KbEOLWkUdoAf5Ez_2A1NNm6QduQElbnNnrPi6VDhZs,4731
 bbot/scanner/preset/path.py,sha256=Q29MO8cOEn690yW6bB08P72kbZ3C-H_TOEoXuwWnFM8,2274
 bbot/scanner/preset/preset.py,sha256=QHUKc2raBArcdzn3op7BhLJHJpb5yjDsQumOvvOw85E,40058
 bbot/scanner/scanner.py,sha256=YPvu4KMKLAM_P-kzww5JdvX6JMVHC0gq6P0kUOt1_X8,53884
@@ -270,7 +271,7 @@ bbot/test/test_step_2/module_tests/test_module_ajaxpro.py,sha256=0sPzcm0O3mmeqcO
 bbot/test/test_step_2/module_tests/test_module_anubisdb.py,sha256=aQHUUswX2VJYoUWFm3cInXnUK4lkU-ah3b2BnxWgWcQ,546
 bbot/test/test_step_2/module_tests/test_module_apkpure.py,sha256=8KM-JCir0doUupwN3JwV5OPaPE_Jq_hz2-96-ZKGpRI,2823
 bbot/test/test_step_2/module_tests/test_module_asn.py,sha256=qIbitSAEAmYyxhpxvdFDsQrHaaxfgKsFox9Q3jTmvgI,10616
-bbot/test/test_step_2/module_tests/test_module_asset_inventory.py,sha256=S21Wuwwg2U4pM5G4KZI4-rDp4V654rZTl_GZG-mPjjY,3879
+bbot/test/test_step_2/module_tests/test_module_asset_inventory.py,sha256=NEMSPBlczpA5NbQpIcRBpRXpVnfS9lmSS1U7eJmIXAU,3878
 bbot/test/test_step_2/module_tests/test_module_azure_realm.py,sha256=uCNeyKmlC26tcyQGyasnTqzzVWo_oKy_EHKEVVh8W9o,1287
 bbot/test/test_step_2/module_tests/test_module_azure_tenant.py,sha256=Aaid6Ftb_qBOmjcUDauXeI6WZcBz49Wli5Yk8FWrZVc,4805
 bbot/test/test_step_2/module_tests/test_module_baddns.py,sha256=vJYZZeYPYO2BbR4fdpB8KjGei3APB9gxOlrnU3lamXU,2822
@@ -303,18 +304,19 @@ bbot/test/test_step_2/module_tests/test_module_dehashed.py,sha256=YVsTEFEPchahDT
 bbot/test/test_step_2/module_tests/test_module_digitorus.py,sha256=81mNwDb4WLUibstUSD8TowSJB3B5DBneS2LWimie9y4,1613
 bbot/test/test_step_2/module_tests/test_module_discord.py,sha256=Z66fGb-kkdZTQfUh6WZiM35Ad-gDyvwxlA7mUUB2vnQ,1838
 bbot/test/test_step_2/module_tests/test_module_dnsbimi.py,sha256=Ag24Bcm4MFxgUwvXXubPGE6mLMBsJGwfhCQ6paK-rRU,4391
-bbot/test/test_step_2/module_tests/test_module_dnsbrute.py,sha256=33j93ayz7Ul4Fvg7plf6H4LKcUgFuEH4SlAXnNkEmD0,5153
-bbot/test/test_step_2/module_tests/test_module_dnsbrute_mutations.py,sha256=Faojc5UHkUP2lMeWukUjLOU6tQSL3HdeepjuVIcs4rY,3902
+bbot/test/test_step_2/module_tests/test_module_dnsbrute.py,sha256=x6p3rhLPbEvtOjV1u9C25He15xrVJq6diKEx-05sdtk,5152
+bbot/test/test_step_2/module_tests/test_module_dnsbrute_mutations.py,sha256=AkL1cOCwHF1unabsbMZz_HXs45K6myxmPndNbcigbjo,3901
 bbot/test/test_step_2/module_tests/test_module_dnscaa.py,sha256=5JaAYt-oFGON8Gc4xJNyc2UtjCp97OEiaJrvD04VHQM,2751
-bbot/test/test_step_2/module_tests/test_module_dnscommonsrv.py,sha256=rUGodidcI1vGMXadaaEKByXonjXiUYnl9bWOmuum6tU,8260
+bbot/test/test_step_2/module_tests/test_module_dnscommonsrv.py,sha256=T9RwPZCAnSVgnjLH7bBpH516owws_B2yxhiDRPBAp40,8259
 bbot/test/test_step_2/module_tests/test_module_dnsdumpster.py,sha256=pgwOrfq_qNxbDBCAffspz6qlbd9MU5yZxguJizqHpFU,59749
 bbot/test/test_step_2/module_tests/test_module_dnsresolve.py,sha256=15LEcggP_eVYFQdMO1zHTvoGc6n8IaUjsQDmX0sZS4o,2077
+bbot/test/test_step_2/module_tests/test_module_dnstlsrpt.py,sha256=tAXUcu66BrNOo4AWvJfHft8IWKJtL0pLhfWstpl5zUc,2640
 bbot/test/test_step_2/module_tests/test_module_docker_pull.py,sha256=-JSAo51dS3Ie9RaLBcWK0kfbg8bCPr7mohpFGAwOKPQ,27988
 bbot/test/test_step_2/module_tests/test_module_dockerhub.py,sha256=9T8CFcFP32MOppUmSVNBUSifnk2kMONqzW_7vvvKdpk,3907
-bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py,sha256=UyVmrw22n7AfBoh_eEjDU_IBqyofXO2lV6GFFudaJTI,8116
+bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py,sha256=voi1C_v7VeaRe_-yzCybO9FUxnFf9qzWkoUY66KYiGI,8114
 bbot/test/test_step_2/module_tests/test_module_emailformat.py,sha256=cKxBPnEQ4AiRKV_-hSYEE6756ypst3hi6MN0L5RTukY,461
 bbot/test/test_step_2/module_tests/test_module_emails.py,sha256=bZjtO8N3GG2_g6SUEYprAFLcsi7SlwNPJJ0nODfrWYU,944
-bbot/test/test_step_2/module_tests/test_module_excavate.py,sha256=Myq6xkLPueT4m-Rzp8PPC_zF5vzq9JbtV8N46yAhWYE,42179
+bbot/test/test_step_2/module_tests/test_module_excavate.py,sha256=jK0MQsaIVkg-QOKrvJde4zw_L6moHqy7soyLBO3TFUY,42159
 bbot/test/test_step_2/module_tests/test_module_extractous.py,sha256=FiMSgddx2qnxGIDImvofrd5hPRQIIul6Y67wwNsgEqE,17973
 bbot/test/test_step_2/module_tests/test_module_ffuf.py,sha256=aSB49aN77sw-2LNTDHckiEEaHAn_85xCJno1shdOwus,2964
 bbot/test/test_step_2/module_tests/test_module_ffuf_shortnames.py,sha256=s8E7M9d1fhm__krM4lmteyTtSsYpVL4hn1z8ub7RVss,7608
@@ -352,12 +354,12 @@ bbot/test/test_step_2/module_tests/test_module_ntlm.py,sha256=N8SrrA-q8CMtL2Mcdz
 bbot/test/test_step_2/module_tests/test_module_nuclei.py,sha256=rLCTuKWnGWiGDcVnMjk4D7x6RGftEj3D4Woqpam-cgQ,7050
 bbot/test/test_step_2/module_tests/test_module_oauth.py,sha256=i6kSBK-aa7QREGaGAi6WeDaD3susclAqImUxW2i2tyc,9482
 bbot/test/test_step_2/module_tests/test_module_otx.py,sha256=tWkJlrdSCP2IUPGkB2RoS_xUN1xndMwyRDNyDfj5l3s,1160
-bbot/test/test_step_2/module_tests/test_module_paramminer_cookies.py,sha256=BHbyFTh37DX7RdDQChqtbs8emCHXUTZGGq3e4UlklEA,2377
-bbot/test/test_step_2/module_tests/test_module_paramminer_getparams.py,sha256=mWHeWQ_di3q6cMt164xaQ2hjqYkuIil8grs7-Um87PY,10083
-bbot/test/test_step_2/module_tests/test_module_paramminer_headers.py,sha256=qTT-5fyqw69LaZBxak3FvPfH7lh9W0KVBtJgslD-3eQ,5545
+bbot/test/test_step_2/module_tests/test_module_paramminer_cookies.py,sha256=lQZkbaCFh5znw-wDBB2Jz4lCYm0g_AOSPZM_bAhNqbE,2376
+bbot/test/test_step_2/module_tests/test_module_paramminer_getparams.py,sha256=-nQjicpNlwsXWi-SSz8IRUMKnjHpjXtSv3aSwTWbCvM,10077
+bbot/test/test_step_2/module_tests/test_module_paramminer_headers.py,sha256=wutLsVnsL3tk7nIwKb-0xbjvyFlim9rXyCfylt2l-W0,5538
 bbot/test/test_step_2/module_tests/test_module_passivetotal.py,sha256=fTGQECQ0OzcwiH64-0igFRKO-rs3kXScivZord_oWWU,1120
 bbot/test/test_step_2/module_tests/test_module_pgp.py,sha256=-m-nPq6WR5UzPDuxeZbuzBQfFi1QfrZQ8RZH4g11ocE,1609
-bbot/test/test_step_2/module_tests/test_module_portscan.py,sha256=MsemMkkKVCJBd3HuyP5FOasfDGCj-JK7bpiPjBpmTjk,7552
+bbot/test/test_step_2/module_tests/test_module_portscan.py,sha256=8TZyzlWQcBDFEiArs-wpbsRlVXzwqlE6LjrPx6vctQk,7551
 bbot/test/test_step_2/module_tests/test_module_postgres.py,sha256=6Seqq1Bq2FEXbJnTi_BYv8ZZPWdy-SfnY8UJN24Op0Q,2689
 bbot/test/test_step_2/module_tests/test_module_postman.py,sha256=XvgfMgUhJuVgGkgT-JzxJyevNSVv7YvX1yLKJHmD3dw,5026
 bbot/test/test_step_2/module_tests/test_module_postman_download.py,sha256=B_NajQaGQjwMSmcBCr37_7cvcnw4Zmh8k_hVoWL7bVI,21623
@@ -412,8 +414,8 @@ bbot/wordlists/raft-small-extensions-lowercase_CLEANED.txt,sha256=ruUQwVfia1_m2u
 bbot/wordlists/top_open_ports_nmap.txt,sha256=LmdFYkfapSxn1pVuQC2LkOIY2hMLgG-Xts7DVtYzweM,42727
 bbot/wordlists/valid_url_schemes.txt,sha256=VciB-ww0y-O8Ii1wpTR6rJzGDiC2r-dhVsIJApS1ZYU,3309
 bbot/wordlists/wordninja_dns.txt.gz,sha256=DYHvvfW0TvzrVwyprqODAk4tGOxv5ezNmCPSdPuDUnQ,570241
-bbot-2.3.0.5368rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
-bbot-2.3.0.5368rc0.dist-info/METADATA,sha256=e-e7hGd8nNwzr1H_5l_ceyFBFstZ-tbTnvBYmfX7w14,17893
-bbot-2.3.0.5368rc0.dist-info/WHEEL,sha256=Nq82e9rUAnEjt98J6MlVmMCZb-t9cYE2Ir1kpBmnWfs,88
-bbot-2.3.0.5368rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
-bbot-2.3.0.5368rc0.dist-info/RECORD,,
+bbot-2.3.0.5376rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
+bbot-2.3.0.5376rc0.dist-info/METADATA,sha256=9IQwlCJ32F6Qp4wPblchHo4XaX41A8BjZOz_3skrnaI,17893
+bbot-2.3.0.5376rc0.dist-info/WHEEL,sha256=Nq82e9rUAnEjt98J6MlVmMCZb-t9cYE2Ir1kpBmnWfs,88
+bbot-2.3.0.5376rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
+bbot-2.3.0.5376rc0.dist-info/RECORD,,