bbot 2.3.1__py3-none-any.whl → 2.3.1.5818rc0__py3-none-any.whl

bbot/__init__.py

@@ -1,4 +1,4 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.3.1"
+__version__ = "v2.3.1.5818rc"
 
 from .scanner import Scanner, Preset

bbot/modules/telerik.py

@@ -5,6 +5,21 @@ from bbot.modules.base import BaseModule
 
 
 class telerik(BaseModule):
+    """
+    Test for endpoints associated with Telerik.Web.UI.dll
+
+    Telerik.Web.UI.WebResource.axd (CVE-2017-11317)
+    Telerik.Web.UI.DialogHandler.aspx (CVE-2017-9248)
+    Telerik.Web.UI.SpellCheckHandler.axd (associated with CVE-2017-9248)
+    ChartImage.axd (CVE-2019-19790)
+
+    For the Telerik Report Server vulnerability (CVE-2024-4358) Use the Nuclei Template: (https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4358.yaml)
+
+    With exploit_RAU_crypto enabled, the module will attempt to exploit CVE-2017-11317. THIS WILL UPLOAD A (benign) FILE IF SUCCESSFUL.
+
+    Will dedupe to host by default (running against first received URL). With include_subdirs enabled, will run against every directory.
+    """
+
     watched_events = ["URL", "HTTP_RESPONSE"]
     produced_events = ["VULNERABILITY", "FINDING"]
     flags = ["active", "aggressive", "web-thorough"]
@@ -139,8 +154,11 @@ class telerik(BaseModule):
 
     RAUConfirmed = []
 
-    options = {"exploit_RAU_crypto": False}
-    options_desc = {"exploit_RAU_crypto": "Attempt to confirm any RAU AXD detections are vulnerable"}
+    options = {"exploit_RAU_crypto": False, "include_subdirs": False}
+    options_desc = {
+        "exploit_RAU_crypto": "Attempt to confirm any RAU AXD detections are vulnerable",
+        "include_subdirs": "Include subdirectories in the scan (off by default)",  # will create many finding events if used in conjunction with web spider or ffuf
+    }
 
     in_scope_only = True
 
@@ -162,19 +180,33 @@ class telerik(BaseModule):
 
     _module_threads = 5
 
+    @staticmethod
+    def normalize_url(url):
+        return str(url.rstrip("/") + "/").lower()
+
     def _incoming_dedup_hash(self, event):
         if event.type == "URL":
-            return hash(event.host)
-        else:
-            return hash(event.data["url"])
+            if self.config.get("include_subdirs") is True:
+                return hash(f"{event.type}{self.normalize_url(event.data)}")
+            else:
+                return hash(f"{event.type}{event.netloc}")
+        else:  # HTTP_RESPONSE
+            return hash(f"{event.type}{event.data['url']}")
 
     async def handle_event(self, event):
         if event.type == "URL":
+            if self.config.get("include_subdirs"):
+                base_url = self.normalize_url(event.data)  # Use the entire URL including subdirectories
+
+            else:
+                base_url = f"{event.parsed_url.scheme}://{event.parsed_url.netloc}/"  # path will be omitted
+
+            # Check for RAU AXD Handler
             webresource = "Telerik.Web.UI.WebResource.axd?type=rau"
-            result, _ = await self.test_detector(event.data, webresource)
+            result, _ = await self.test_detector(base_url, webresource)
             if result:
                 if "RadAsyncUpload handler is registered successfully" in result.text:
-                    self.debug("Detected Telerik instance (Telerik.Web.UI.WebResource.axd?type=rau)")
+                    self.verbose("Detected Telerik instance (Telerik.Web.UI.WebResource.axd?type=rau)")
 
                     probe_data = {
                         "rauPostData": (
@@ -211,15 +243,14 @@ class telerik(BaseModule):
 
                     description = f"Telerik RAU AXD Handler detected. Verbose Errors Enabled: [{str(verbose_errors)}] Version Guess: [{version}]"
                     await self.emit_event(
-                        {"host": str(event.host), "url": f"{event.data}{webresource}", "description": description},
+                        {"host": str(event.host), "url": f"{base_url}{webresource}", "description": description},
                         "FINDING",
                         event,
-                        context=f"{{module}} scanned {event.data} and identified {{event.type}}: Telerik RAU AXD Handler",
+                        context=f"{{module}} scanned {base_url} and identified {{event.type}}: Telerik RAU AXD Handler",
                     )
                     if self.config.get("exploit_RAU_crypto") is True:
-                        hostname = urlparse(event.data).netloc
-                        if hostname not in self.RAUConfirmed:
-                            self.RAUConfirmed.append(hostname)
+                        if base_url not in self.RAUConfirmed:
+                            self.RAUConfirmed.append(base_url)
                             root_tool_path = self.scan.helpers.tools_dir / "telerik"
                             self.debug(root_tool_path)
 
@@ -242,17 +273,17 @@ class telerik(BaseModule):
                                             "severity": "CRITICAL",
                                             "description": description,
                                             "host": str(event.host),
-                                            "url": f"{event.data}{webresource}",
+                                            "url": f"{base_url}{webresource}",
                                         },
                                         "VULNERABILITY",
                                         event,
-                                        context=f"{{module}} scanned {event.data} and identified critical {{event.type}}: {description}",
+                                        context=f"{{module}} scanned {base_url} and identified critical {{event.type}}: {description}",
                                     )
                                     break
 
             urls = {}
             for dh in self.DialogHandlerUrls:
-                url = self.create_url(event.data, f"{dh}?dp=1")
+                url = self.create_url(base_url, f"{dh}?dp=1")
                 urls[url] = dh
 
             gen = self.helpers.request_batch(list(urls))
@@ -265,14 +296,14 @@ class telerik(BaseModule):
                     # tolerate some random errors
                     if fail_count < 2:
                         continue
-                    self.debug(f"Cancelling run against {event.data} due to failed request")
+                    self.debug(f"Cancelling run against {base_url} due to failed request")
                     await gen.aclose()
                 else:
                     if "Cannot deserialize dialog parameters" in response.text:
                         self.debug(f"Detected Telerik UI instance ({dh})")
                         description = "Telerik DialogHandler detected"
                         await self.emit_event(
-                            {"host": str(event.host), "url": f"{event.data}{dh}", "description": description},
+                            {"host": str(event.host), "url": f"{base_url}{dh}", "description": description},
                             "FINDING",
                             event,
                         )
@@ -280,12 +311,12 @@ class telerik(BaseModule):
                         await gen.aclose()
 
             spellcheckhandler = "Telerik.Web.UI.SpellCheckHandler.axd"
-            result, _ = await self.test_detector(event.data, spellcheckhandler)
+            result, _ = await self.test_detector(base_url, spellcheckhandler)
             status_code = getattr(result, "status_code", 0)
             # The standard behavior for the spellcheck handler without parameters is a 500
             if status_code == 500:
                 # Sometimes webapps will just return 500 for everything, so rule out the false positive
-                validate_result, _ = await self.test_detector(event.data, self.helpers.rand_string())
+                validate_result, _ = await self.test_detector(base_url, self.helpers.rand_string())
                 self.debug(validate_result)
                 validate_status_code = getattr(validate_result, "status_code", 0)
                 if validate_status_code not in (0, 500):
@@ -294,31 +325,31 @@ class telerik(BaseModule):
                     await self.emit_event(
                         {
                             "host": str(event.host),
-                            "url": f"{event.data}{spellcheckhandler}",
+                            "url": f"{base_url}{spellcheckhandler}",
                             "description": description,
                         },
                         "FINDING",
                         event,
-                        context=f"{{module}} scanned {event.data} and identified {{event.type}}: Telerik SpellCheckHandler",
+                        context=f"{{module}} scanned {base_url} and identified {{event.type}}: Telerik SpellCheckHandler",
                     )
 
             chartimagehandler = "ChartImage.axd?ImageName=bqYXJAqm315eEd6b%2bY4%2bGqZpe7a1kY0e89gfXli%2bjFw%3d"
-            result, _ = await self.test_detector(event.data, chartimagehandler)
+            result, _ = await self.test_detector(base_url, chartimagehandler)
             status_code = getattr(result, "status_code", 0)
             if status_code == 200:
                 chartimagehandler_error = "ChartImage.axd?ImageName="
-                result_error, _ = await self.test_detector(event.data, chartimagehandler_error)
+                result_error, _ = await self.test_detector(base_url, chartimagehandler_error)
                 error_status_code = getattr(result_error, "status_code", 0)
                 if error_status_code not in (0, 200):
                     await self.emit_event(
                         {
                             "host": str(event.host),
-                            "url": f"{event.data}{chartimagehandler}",
+                            "url": f"{base_url}{chartimagehandler}",
                             "description": "Telerik ChartImage AXD Handler Detected",
                         },
                         "FINDING",
                         event,
-                        context=f"{{module}} scanned {event.data} and identified {{event.type}}: Telerik ChartImage AXD Handler",
+                        context=f"{{module}} scanned {base_url} and identified {{event.type}}: Telerik ChartImage AXD Handler",
                     )
 
         elif event.type == "HTTP_RESPONSE":
@@ -348,14 +379,8 @@ class telerik(BaseModule):
                         context="{module} searched HTTP_RESPONSE and identified {event.type}: Telerik AsyncUpload",
                     )
 
-        # Check for RAD Controls in URL
-
     def create_url(self, baseurl, detector):
-        if not baseurl.endswith("/"):
-            url = f"{baseurl}/{detector}"
-        else:
-            url = f"{baseurl}{detector}"
-        return url
+        return f"{baseurl}{detector}"
 
     async def test_detector(self, baseurl, detector):
         result = None

bbot/presets/web/dotnet-audit.yml

@@ -19,3 +19,4 @@ config:
       extensions: asp,aspx,ashx,asmx,ascx
     telerik:
       exploit_RAU_crypto: True
+      include_subdirs: True # Run against every directory, not the default first received URL per-host

bbot/test/test_step_2/module_tests/test_module_telerik.py

@@ -1,5 +1,5 @@
 import re
-from .base import ModuleTestBase
+from .base import ModuleTestBase, tempwordlist
 
 
 class TestTelerik(ModuleTestBase):
@@ -28,7 +28,7 @@ class TestTelerik(ModuleTestBase):
         }
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
-        # Simulate DialogHandler detection
+        # Simulate SpellCheckHandler detection
         expect_args = {"method": "GET", "uri": "/Telerik.Web.UI.SpellCheckHandler.axd"}
         respond_args = {"status": 500}
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
@@ -114,3 +114,58 @@ class TestTelerik(ModuleTestBase):
         assert telerik_dialoghandler_detection, "Telerik dialoghandler detection failed"
         assert telerik_chartimage_detection, "Telerik chartimage detection failed"
         assert telerik_http_response_parameters_detection, "Telerik SerializedParameters detection failed"
+
+
+class TestTelerikDialogHandler_includesubdirs(TestTelerik):
+    targets = ["http://127.0.0.1:8888/", "http://127.0.0.1:8888/temp/"]
+    config_overrides = {
+        "modules": {
+            "telerik": {
+                "include_subdirs": True,
+            },
+        }
+    }
+    modules_overrides = ["httpx", "telerik"]
+
+    async def setup_before_prep(self, module_test):
+        # Simulate NO SpellCheckHandler detection (not testing for that with this test)
+        expect_args = {"method": "GET", "uri": "/Telerik.Web.UI.SpellCheckHandler.axd"}
+        respond_args = {"status": 404}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        # Simulate DialogHandler detection
+        expect_args = {"method": "GET", "uri": "/App_Master/Telerik.Web.UI.DialogHandler.aspx"}
+        respond_args = {
+            "response_data": '<input type="hidden" name="dialogParametersHolder" id="dialogParametersHolder" /><div style=\'color:red\'>Cannot deserialize dialog parameters. Please refresh the editor page.</div><div>Error Message:Invalid length for a Base-64 char array or string.</div></form></body></html>'
+        }
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        # Simulate DialogHandler detection (in /temp)
+        expect_args = {"method": "GET", "uri": "/temp/App_Master/Telerik.Web.UI.DialogHandler.aspx"}
+        respond_args = {
+            "response_data": '<input type="hidden" name="dialogParametersHolder" id="dialogParametersHolder" /><div style=\'color:red\'>Cannot deserialize dialog parameters. Please refresh the editor page.</div><div>Error Message:Invalid length for a Base-64 char array or string.</div></form></body></html>'
+        }
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        # Simulate /temp directory detection
+        expect_args = {"method": "GET", "uri": "/temp/"}
+        respond_args = {"response_data": "Temporary directory found"}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        # Fallback
+        expect_args = {"method": "GET", "uri": "/"}
+        respond_args = {"response_data": "alive"}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+    async def setup_after_prep(self, module_test):
+        module_test.scan.modules["telerik"].telerikVersions = ["2014.2.724", "2014.3.1024", "2015.1.204"]
+        module_test.scan.modules["telerik"].DialogHandlerUrls = [
+            "App_Master/Telerik.Web.UI.DialogHandler.aspx",
+        ]
+
+    def check(self, module_test, events):
+        # Check if the expected requests were made
+        finding_count = sum(
+            1 for e in events if e.type == "FINDING" and "Telerik DialogHandler detected" in e.data["description"]
+        )
+        assert finding_count == 2, "Expected 2 FINDING events (root and /temp), got {finding_count}"

{bbot-2.3.1.dist-info → bbot-2.3.1.5818rc0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.3.1
+Version: 2.3.1.5818rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.3.1.dist-info → bbot-2.3.1.5818rc0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-bbot/__init__.py,sha256=9tKCKJdKi4W7gV89WCtpSPnt_sbfKiKcYJ-jR5Ter9c,123
+bbot/__init__.py,sha256=84uhPTH3TNfR-SYUMJc3nC7qGRu7Sf_VgzzMbtKvoVE,130
 bbot/cli.py,sha256=Jdhrtcpwzq4Pm71bikElx1Fj_gWN5x_GEkp7W42iQxQ,10753
 bbot/core/__init__.py,sha256=l255GJE_DvUnWvrRb0J5lG-iMztJ8zVvoweDOfegGtI,46
 bbot/core/config/__init__.py,sha256=zYNw2Me6tsEr8hOOkLb4BQ97GB7Kis2k--G81S8vofU,342
@@ -183,7 +183,7 @@ bbot/modules/social.py,sha256=SaXC8gK69k9aMNHS9y7b-Ag-w7U7DbeXqrZRx9CtXLw,2499
 bbot/modules/sslcert.py,sha256=83rf_rzlj4iku3gldx1_R1L_v3ZCGItGPay8JviUy9w,8211
 bbot/modules/subdomaincenter.py,sha256=aWjcIqGGWnAj2ePwcS4sgUJDUsq0trY3Klhr_lcc4dg,1424
 bbot/modules/subdomainradar.py,sha256=YlRNMtNGLpa13KZ7aksAMVZdSjxe1tkywU5RXlwXpPc,6784
-bbot/modules/telerik.py,sha256=zEgA3Wtn9o7DjMySLf5RsRpbpnFyzfmZvzL8xbL95lc,17587
+bbot/modules/telerik.py,sha256=9F7-MrAiulM5W26JxydAJ6nqD_Di7_X6RoTpCb3S5FI,18930
 bbot/modules/templates/bucket.py,sha256=muLPpfAGtcNhL0tLU-qHTlTNIz4yncRcVjdZMqVRtUI,7153
 bbot/modules/templates/github.py,sha256=n6cVjf62ezkztCRAcXNnlxfCkB0VRWqn138mOOt6T08,1454
 bbot/modules/templates/postman.py,sha256=MIpz2q_r6LP0kIEgByo7oX5qHhMZLOhr7oKzJI9Beec,6959
@@ -217,7 +217,7 @@ bbot/presets/spider.yml,sha256=-7HkEEZS_fFESPVzGi91eNf2ZwfAv1lU9oyFp0dhuZA,400
 bbot/presets/subdomain-enum.yml,sha256=tn9h8TlVB_uS3nKZFUP72HzceoRONSef66mGLWzxj9w,414
 bbot/presets/web/dirbust-heavy.yml,sha256=NDqu7p0Hx1RsZCVnaEWRgI_iL9O0io-tvWerxJf36SM,653
 bbot/presets/web/dirbust-light.yml,sha256=5zSANdjKfYh49kFlsElYY2G6acVrZFzDCEkyqwU6oOQ,203
-bbot/presets/web/dotnet-audit.yml,sha256=7ZlE7Q3F1p5g6AO33-m1lPzPW12_tRKEDXy4eaLXlCk,335
+bbot/presets/web/dotnet-audit.yml,sha256=FdUaBUftkzr9TX3evpJec3oZTSU4o77FVKwTgWqyxHU,438
 bbot/presets/web/iis-shortnames.yml,sha256=EcYKMpl-cI8Xb79_u4wQS42yFXxDpLH9OqINcFUXoTE,176
 bbot/presets/web/paramminer.yml,sha256=VuiXkxrOAeqXlk9Gmuo938_REvbbTH6-lxTrlyWAvZ4,163
 bbot/presets/web-basic.yml,sha256=6YWSYclbuf9yr8-gILDpLvOUj5QjP4rlarm5_d5iBFw,79
@@ -391,7 +391,7 @@ bbot/test/test_step_2/module_tests/test_module_subdomaincenter.py,sha256=KXprbHa
 bbot/test/test_step_2/module_tests/test_module_subdomainradar.py,sha256=c6aUKr4yrGJqrQP0hOaP6Ao4-PQn1N_IlaqSw6E-xW8,10672
 bbot/test/test_step_2/module_tests/test_module_subdomains.py,sha256=r1zCmw5ZZ_0wA7L7cDg9dpgdpRigjQXhf-Zm7P4ya9Q,1108
 bbot/test/test_step_2/module_tests/test_module_teams.py,sha256=r91ZZxhj3pEhKnjr1jGwhcqOPXTqNJNupC1CDKccfH8,1638
-bbot/test/test_step_2/module_tests/test_module_telerik.py,sha256=_EynKEnQXIV0y2YC0VzGozSCqp9VCLWYqTX8OCv85SU,7752
+bbot/test/test_step_2/module_tests/test_module_telerik.py,sha256=fnOzpw9VbqSj1o7ERpq9cS1UJqE0BYxM2GHzILwyFPs,10742
 bbot/test/test_step_2/module_tests/test_module_trickest.py,sha256=6mTYH6fIah-WbKnFI-_WZBwRdKFi-oeWyVtl1n0nVAU,1630
 bbot/test/test_step_2/module_tests/test_module_trufflehog.py,sha256=H8bvRfeUrDgIcJFxQIv3RyksSTKdjG8AsKOqK-2ISjU,95420
 bbot/test/test_step_2/module_tests/test_module_txt.py,sha256=R-EBfEZM0jwY2yuVyfYhoccDOl0Y2uQZSkXQ1HyinUA,247
@@ -422,8 +422,8 @@ bbot/wordlists/raft-small-extensions-lowercase_CLEANED.txt,sha256=ZSIVebs7ptMvHx
 bbot/wordlists/top_open_ports_nmap.txt,sha256=LmdFYkfapSxn1pVuQC2LkOIY2hMLgG-Xts7DVtYzweM,42727
 bbot/wordlists/valid_url_schemes.txt,sha256=0B_VAr9Dv7aYhwi6JSBDU-3M76vNtzN0qEC_RNLo7HE,3310
 bbot/wordlists/wordninja_dns.txt.gz,sha256=DYHvvfW0TvzrVwyprqODAk4tGOxv5ezNmCPSdPuDUnQ,570241
-bbot-2.3.1.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
-bbot-2.3.1.dist-info/METADATA,sha256=yTl9SYJxb7JTuiujOZfc48QrUoxh0y8R4JvQgWuGeRQ,18216
-bbot-2.3.1.dist-info/WHEEL,sha256=IYZQI976HJqqOpQU6PHkJ8fb3tMNBFjg-Cn-pwAbaFM,88
-bbot-2.3.1.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
-bbot-2.3.1.dist-info/RECORD,,
+bbot-2.3.1.5818rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
+bbot-2.3.1.5818rc0.dist-info/METADATA,sha256=crcIDiczOiK8BW38L6ixKnNS5H45-zOoqceUERZTbLw,18224
+bbot-2.3.1.5818rc0.dist-info/WHEEL,sha256=IYZQI976HJqqOpQU6PHkJ8fb3tMNBFjg-Cn-pwAbaFM,88
+bbot-2.3.1.5818rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
+bbot-2.3.1.5818rc0.dist-info/RECORD,,