bbot 2.4.2.6608rc0__tar.gz → 2.4.2.6615rc0__tar.gz

{bbot-2.4.2.6608rc0 → bbot-2.4.2.6615rc0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.4.2.6608rc0
+Version: 2.4.2.6615rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.4.2.6608rc0 → bbot-2.4.2.6615rc0}/bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.4.2.6608rc"
+__version__ = "v2.4.2.6615rc"
 
 from .scanner import Scanner, Preset
 

{bbot-2.4.2.6608rc0 → bbot-2.4.2.6615rc0}/bbot/modules/dehashed.py

@@ -13,23 +13,23 @@ class dehashed(subdomain_enum):
         "author": "@SpamFaux",
         "auth_required": True,
     }
-    options = {"username": "", "api_key": ""}
-    options_desc = {"username": "Email Address associated with your API key", "api_key": "DeHashed API Key"}
+    options = {"api_key": ""}
+    options_desc = {"api_key": "DeHashed API Key"}
     target_only = True
 
-    base_url = "https://api.dehashed.com/search"
+    base_url = "https://api.dehashed.com/v2/search"
 
     async def setup(self):
-        self.username = self.config.get("username", "")
         self.api_key = self.config.get("api_key", "")
-        self.auth = (self.username, self.api_key)
         self.headers = {
             "Accept": "application/json",
+            "Content-Type": "application/json",
+            "Dehashed-Api-Key": self.api_key,
         }
 
         # soft-fail if we don't have the necessary information to make queries
-        if not (self.username and self.api_key):
-            return None, "No username / API key set"
+        if not self.api_key:
+            return None, "No API key set"
 
         return await super().setup()
 
@@ -38,29 +38,31 @@ class dehashed(subdomain_enum):
         async for entries in self.query(query):
             for entry in entries:
                 # we have to clean up the email field because dehashed does a poor job of it
-                email_str = entry.get("email", "").replace("\\", "")
-                found_emails = list(await self.helpers.re.extract_emails(email_str))
-                if not found_emails:
-                    self.debug(f"Invalid email from dehashed.com: {email_str}")
-                    continue
-                email = found_emails[0]
+                emails = []
+                for email in entry.get("email", []):
+                    email_str = email.replace("\\", "")
+                    found_emails = list(await self.helpers.re.extract_emails(email_str))
+                    if not found_emails:
+                        self.debug(f"Invalid email from dehashed.com: {email_str}")
+                        continue
+                    emails += found_emails
 
-                user = entry.get("username", "")
-                pw = entry.get("password", "")
-                h_pw = entry.get("hashed_password", "")
+                users = entry.get("username", [])
+                pws = entry.get("password", [])
+                h_pws = entry.get("hashed_password", [])
                 db_name = entry.get("database_name", "")
 
                 tags = []
                 if db_name:
                     tags = [f"db-{db_name}"]
-                if email:
+                for email in emails:
                     email_event = self.make_event(email, "EMAIL_ADDRESS", parent=event, tags=tags)
                     if email_event is not None:
                         await self.emit_event(
                             email_event,
                             context=f'{{module}} searched API for "{query}" and found {{event.type}}: {{event.data}}',
                         )
-                        if user:
+                        for user in users:
                             await self.emit_event(
                                 f"{email}:{user}",
                                 "USERNAME",
@@ -68,7 +70,7 @@ class dehashed(subdomain_enum):
                                 tags=tags,
                                 context=f"{{module}} found {email} with {{event.type}}: {{event.data}}",
                             )
-                        if pw:
+                        for pw in pws:
                             await self.emit_event(
                                 f"{email}:{pw}",
                                 "PASSWORD",
@@ -76,7 +78,7 @@ class dehashed(subdomain_enum):
                                 tags=tags,
                                 context=f"{{module}} found {email} with {{event.type}}: {{event.data}}",
                             )
-                        if h_pw:
+                        for h_pw in h_pws:
                             await self.emit_event(
                                 f"{email}:{h_pw}",
                                 "HASHED_PASSWORD",
@@ -86,30 +88,33 @@ class dehashed(subdomain_enum):
                             )
 
     async def query(self, domain):
-        query = f"domain:{domain}"
-        url = f"{self.base_url}?query={query}&size=10000&page=" + "{page}"
-        page = 0
-        num_entries = 0
-        agen = self.api_page_iter(url=url, auth=self.auth, headers=self.headers, _json=False)
+        url = self.base_url
+        json = {
+            "query": "",
+            "page": 1,
+            "size": 10000,  # The maximum permitted size and pagination.
+        }
+        json["query"] = f"domain:{domain}"
+        json["page"] = 1
+        max_pages = 1
+        agen = self.api_page_iter(url=url, headers=self.headers, _json=False, method="POST", json=json)
         async for result in agen:
             result_json = {}
             with suppress(Exception):
                 result_json = result.json()
             total = result_json.get("total", 0)
             entries = result_json.get("entries", [])
-            if entries is None:
-                entries = []
-            num_entries += len(entries)
-            page += 1
-            if (page >= 3) or (not entries):
-                if result is not None and result.status_code != 200:
-                    self.warning(
-                        f"Error retrieving results from dehashed.com (status code {result.status_code}): {result.text}"
-                    )
-                elif (page >= 3) and (total > num_entries):
-                    self.info(
-                        f"{domain} has {total:,} results in Dehashed. The API can only process the first 30,000 results. Please check dehashed.com to get the remaining results."
-                    )
+            json["page"] += 1
+            if result is not None and result.status_code != 200:
+                self.warning(
+                    f"Error retrieving results from dehashed.com (status code {result.status_code}): {result.text}"
+                )
+            elif (json["page"] > max_pages) and (total > (json["size"] * max_pages)):
+                self.info(
+                    f"{domain} has {total:,} results in Dehashed. The API can only process the first 10,000 results. Please check dehashed.com to get the remaining results."
+                )
+            if entries:
+                yield entries
+            if not entries or json["page"] > max_pages:
                 await agen.aclose()
                 break
-            yield entries

{bbot-2.4.2.6608rc0 → bbot-2.4.2.6615rc0}/bbot/test/test_step_2/module_tests/base.py

@@ -91,9 +91,9 @@ class ModuleTestBase:
     async def module_test(
         self, httpx_mock, bbot_httpserver, bbot_httpserver_ssl, monkeypatch, request, caplog, capsys
     ):
-        # Skip dastardly test if we're in the distro tests (because dastardly uses docker)
+        # If a test uses docker, we can't run it in the distro tests
         if os.getenv("BBOT_DISTRO_TESTS") and self.skip_distro_tests:
-            pytest.skip("Skipping module_test for dastardly module due to BBOT_DISTRO_TESTS environment variable")
+            pytest.skip("Skipping test since it uses docker")
 
         self.log.info(f"Starting {self.name} module test")
         module_test = self.ModuleTest(

bbot-2.4.2.6615rc0/bbot/test/test_step_2/module_tests/test_module_dehashed.py

@@ -0,0 +1,159 @@
+from .base import ModuleTestBase
+
+
+class TestDehashed(ModuleTestBase):
+    modules_overrides = ["dehashed", "speculate"]
+    config_overrides = {
+        "scope": {"report_distance": 2},
+        "modules": {"dehashed": {"api_key": "deadbeef"}},
+    }
+
+    async def setup_before_prep(self, module_test):
+        module_test.httpx_mock.add_response(
+            url="https://api.dehashed.com/v2/search",
+            method="POST",
+            json={
+                "balance": 10000,
+                "entries": [
+                    {
+                        "id": "4363462346",
+                        "email": ["bob@blacklanternsecurity.com"],
+                        "ip_address": ["127.0.0.9"],
+                        "username": ["bob@bob.com"],
+                        "hashed_password": ["$2a$12$pVmwJ7pXEr3mE.DmCCE4fOUDdeadbeefd2KuCy/tq1ZUFyEOH2bve"],
+                        "name": ["Bob Smith"],
+                        "phone": ["+91283423839"],
+                        "database_name": "eatstreet",
+                        "raw_record": {"le_only": True, "unstructured": True},
+                    },
+                    {
+                        "id": "234623453454",
+                        "email": ["tim@blacklanternsecurity.com"],
+                        "username": ["timmy"],
+                        "password": ["TimTamSlam69"],
+                        "name": "Tim Tam",
+                        "phone": ["+123455667"],
+                        "database_name": "eatstreet",
+                    },
+                ],
+                "took": "61ms",
+                "total": 2,
+            },
+        )
+        await module_test.mock_dns(
+            {
+                "bob.com": {"A": ["127.0.0.1"]},
+                "blacklanternsecurity.com": {"A": ["127.0.0.1"]},
+            }
+        )
+
+    def check(self, module_test, events):
+        assert len(events) == 12
+        assert 1 == len([e for e in events if e.type == "DNS_NAME" and e.data == "blacklanternsecurity.com"])
+        assert 1 == len([e for e in events if e.type == "ORG_STUB" and e.data == "blacklanternsecurity"])
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "EMAIL_ADDRESS"
+                and e.data == "bob@bob.com"
+                and e.scope_distance == 1
+                and "affiliate" in e.tags
+            ]
+        )
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "DNS_NAME" and e.data == "bob.com" and e.scope_distance == 1 and "affiliate" in e.tags
+            ]
+        )
+        assert 1 == len([e for e in events if e.type == "EMAIL_ADDRESS" and e.data == "bob@blacklanternsecurity.com"])
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "USERNAME"
+                and e.data == "bob@blacklanternsecurity.com:bob@bob.com"
+                and e.parent.data == "bob@blacklanternsecurity.com"
+            ]
+        )
+        assert 1 == len([e for e in events if e.type == "EMAIL_ADDRESS" and e.data == "tim@blacklanternsecurity.com"])
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "HASHED_PASSWORD"
+                and e.data
+                == "bob@blacklanternsecurity.com:$2a$12$pVmwJ7pXEr3mE.DmCCE4fOUDdeadbeefd2KuCy/tq1ZUFyEOH2bve"
+            ]
+        )
+        assert 1 == len(
+            [e for e in events if e.type == "PASSWORD" and e.data == "tim@blacklanternsecurity.com:TimTamSlam69"]
+        )
+        assert 1 == len([e for e in events if e.type == "USERNAME" and e.data == "tim@blacklanternsecurity.com:timmy"])
+
+
+class TestDehashedBadEmail(TestDehashed):
+    async def setup_before_prep(self, module_test):
+        module_test.httpx_mock.add_response(
+            url="https://api.dehashed.com/v2/search",
+            method="POST",
+            json={
+                "balance": 10000,
+                "entries": [
+                    {
+                        "id": "EZxg4Lz-INLUt6uRXZaV",
+                        "email": ["foo.example.com"],
+                        "database_name": "Collections",
+                    },
+                ],
+                "took": "41ms",
+                "total": 1,
+            },
+        )
+
+    def check(self, module_test, events):
+        debug_log_content = open(module_test.scan.home / "debug.log").read()
+        assert "Invalid email from dehashed.com: foo.example.com" in debug_log_content
+
+
+class TestDehashedHTTPError(TestDehashed):
+    async def setup_before_prep(self, module_test):
+        module_test.httpx_mock.add_response(
+            url="https://api.dehashed.com/v2/search",
+            method="POST",
+            json={"error": "issue with request body"},
+            status_code=400,
+        )
+
+    def check(self, module_test, events):
+        scan_log_content = open(module_test.scan.home / "scan.log").read()
+        assert (
+            'Error retrieving results from dehashed.com (status code 400): {"error":"issue with request body"}'
+            in scan_log_content
+        )
+
+
+class TestDehashedTooManyResults(TestDehashed):
+    async def setup_before_prep(self, module_test):
+        module_test.httpx_mock.add_response(
+            url="https://api.dehashed.com/v2/search",
+            method="POST",
+            json={
+                "balance": 10000,
+                "entries": [
+                    {
+                        "id": "VXhNxj46SGsW4Lworh-G",
+                        "email": ["bob@bob.com"],
+                        "database_name": "Collections",
+                    },
+                ],
+                "took": "40ms",
+                "total": 10001,
+            },
+        )
+
+    def check(self, module_test, events):
+        scan_log_content = open(module_test.scan.home / "scan.log").read()
+        assert "has 10,001 results in Dehashed. The API can only process the first 10,000 results." in scan_log_content

{bbot-2.4.2.6608rc0 → bbot-2.4.2.6615rc0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "bbot"
-version = "v2.4.2.6608rc"
+version = "v2.4.2.6615rc"
 description = "OSINT automation for hackers."
 authors = [
     "TheTechromancer",

bbot-2.4.2.6608rc0/bbot/modules/dastardly.py

@@ -1,137 +0,0 @@
-from lxml import etree
-from bbot.modules.base import BaseModule
-
-
-class dastardly(BaseModule):
-    watched_events = ["HTTP_RESPONSE"]
-    produced_events = ["FINDING", "VULNERABILITY"]
-    flags = ["active", "aggressive", "slow", "web-thorough", "deadly"]
-    meta = {
-        "description": "Lightweight web application security scanner",
-        "created_date": "2023-12-11",
-        "author": "@domwhewell-sage",
-    }
-
-    deps_pip = ["lxml~=5.3.0"]
-    deps_common = ["docker"]
-    per_hostport_only = True
-
-    default_discovery_context = "{module} performed a light web scan against {event.parent.data['url']} and discovered {event.data['description']} at {event.data['url']}"
-
-    async def setup(self):
-        await self.run_process("systemctl", "start", "docker", sudo=True)
-        await self.run_process("docker", "pull", "public.ecr.aws/portswigger/dastardly:latest", sudo=True)
-        self.output_dir = self.scan.home / "dastardly"
-        self.helpers.mkdir(self.output_dir)
-        return True
-
-    async def filter_event(self, event):
-        # Reject redirects. This helps to avoid scanning the same site twice.
-        is_redirect = str(event.data["status_code"]).startswith("30")
-        if is_redirect:
-            return False, "URL is a redirect"
-        return True
-
-    async def handle_event(self, event):
-        host = event.parsed_url._replace(path="/").geturl()
-        self.verbose(f"Running Dastardly scan against {host}")
-        command, output_file = self.construct_command(host)
-        finished_proc = await self.run_process(command, sudo=True)
-        self.debug(f"dastardly stdout: {getattr(finished_proc, 'stdout', '')}")
-        self.debug(f"dastardly stderr: {getattr(finished_proc, 'stderr', '')}")
-        for testsuite in self.parse_dastardly_xml(output_file):
-            url = testsuite.endpoint
-            for testcase in testsuite.testcases:
-                for failure in testcase.failures:
-                    if failure.severity == "Info":
-                        await self.emit_event(
-                            {
-                                "host": str(event.host),
-                                "url": url,
-                                "description": failure.instance,
-                            },
-                            "FINDING",
-                            event,
-                            context=f"{{module}} executed web scan against {host} and identified {{event.type}}: {failure.instance}",
-                        )
-                    else:
-                        await self.emit_event(
-                            {
-                                "severity": failure.severity,
-                                "host": str(event.host),
-                                "url": url,
-                                "description": failure.instance,
-                            },
-                            "VULNERABILITY",
-                            event,
-                            context=f"{{module}} executed web scan against {host} and identified {failure.severity.lower()} {{event.type}}: {failure.instance}",
-                        )
-
-    def construct_command(self, target):
-        date_time = self.helpers.make_date()
-        file_name = self.helpers.tagify(target)
-        temp_path = self.output_dir / f"{date_time}_{file_name}.xml"
-        command = [
-            "docker",
-            "run",
-            "--user",
-            "0",
-            "--rm",
-            "-v",
-            f"{self.output_dir}:/dastardly",
-            "-e",
-            f"BURP_START_URL={target}",
-            "-e",
-            f"BURP_REPORT_FILE_PATH=/dastardly/{temp_path.name}",
-            "public.ecr.aws/portswigger/dastardly:latest",
-        ]
-        return command, temp_path
-
-    def parse_dastardly_xml(self, xml_file):
-        try:
-            with open(xml_file, "rb") as f:
-                et = etree.parse(f, parser=etree.XMLParser(recover=True, resolve_entities=False))
-                for testsuite in et.iter("testsuite"):
-                    yield TestSuite(testsuite)
-        except FileNotFoundError:
-            self.debug(f"Could not find Dastardly XML file at {xml_file}")
-        except OSError as e:
-            self.verbose(f"Error opening Dastardly XML file at {xml_file}: {e}")
-        except etree.ParseError as e:
-            self.warning(f"Error parsing Dastardly XML at {xml_file}: {e}")
-
-
-class Failure:
-    def __init__(self, xml):
-        self.etree = xml
-
-        # instance information
-        self.instance = self.etree.attrib.get("message", "")
-        self.severity = self.etree.attrib.get("type", "")
-        self.text = self.etree.text
-
-
-class TestCase:
-    def __init__(self, xml):
-        self.etree = xml
-
-        # title information
-        self.title = self.etree.attrib.get("name", "")
-
-        # findings / failures(as dastardly names them)
-        self.failures = []
-        for failure in self.etree.findall("failure"):
-            self.failures.append(Failure(failure))
-
-
-class TestSuite:
-    def __init__(self, xml):
-        self.etree = xml
-
-        # endpoint information
-        self.endpoint = self.etree.attrib.get("name", "")
-
-        # test cases
-        self.testcases = []
-        for testcase in self.etree.findall("testcase"):
-            self.testcases.append(TestCase(testcase))

bbot-2.4.2.6608rc0/bbot/test/test_step_2/module_tests/test_module_dastardly.py

@@ -1,70 +0,0 @@
-import json
-from werkzeug import Response
-
-from .base import ModuleTestBase
-
-
-class TestDastardly(ModuleTestBase):
-    targets = ["http://127.0.0.1:5556/"]
-    modules_overrides = ["httpx", "dastardly"]
-    skip_distro_tests = True
-
-    web_response = """<!DOCTYPE html>
-    <html>
-    <body>
-        <a href="/test?test=yes">visit this<a/>
-    </body>
-    </html>"""
-
-    def xss_handler(self, request):
-        response = f"""<!DOCTYPE html>
-    <html>
-    <head>
-        <title>Email Form</title>
-    </head>
-    <body>
-        {request.args.get("test", "")}
-    </body>
-    </html>"""
-        return Response(response, content_type="text/html")
-
-    async def get_docker_ip(self, module_test):
-        docker_ip = "172.17.0.1"
-        try:
-            ip_output = await module_test.scan.helpers.run(["ip", "-j", "-4", "a", "show", "dev", "docker0"])
-            interface_json = json.loads(ip_output.stdout)
-            docker_ip = interface_json[0]["addr_info"][0]["local"]
-        except Exception:
-            pass
-        return docker_ip
-
-    async def setup_after_prep(self, module_test):
-        httpserver = module_test.request_fixture.getfixturevalue("bbot_httpserver_allinterfaces")
-        httpserver.expect_request("/").respond_with_data(self.web_response)
-        httpserver.expect_request("/test").respond_with_handler(self.xss_handler)
-
-        # get docker IP
-        docker_ip = await self.get_docker_ip(module_test)
-        module_test.scan.target.seeds.add(docker_ip)
-
-        # replace 127.0.0.1 with docker host IP to allow dastardly access to local http server
-        old_filter_event = module_test.module.filter_event
-
-        def new_filter_event(event):
-            self.new_url = f"http://{docker_ip}:5556/"
-            event.data["url"] = self.new_url
-            event.parsed_url = module_test.scan.helpers.urlparse(self.new_url)
-            return old_filter_event(event)
-
-        module_test.monkeypatch.setattr(module_test.module, "filter_event", new_filter_event)
-
-    def check(self, module_test, events):
-        assert 1 == len(
-            [
-                e
-                for e in events
-                if e.type == "VULNERABILITY"
-                and f"{self.new_url}test" in e.data["description"]
-                and "Cross-site scripting".lower() in e.data["description"].lower()
-            ]
-        )

bbot-2.4.2.6608rc0/bbot/test/test_step_2/module_tests/test_module_dehashed.py

@@ -1,102 +0,0 @@
-from .base import ModuleTestBase
-
-dehashed_domain_response = {
-    "balance": 10000,
-    "entries": [
-        {
-            "id": "4363462346",
-            "email": "bob@blacklanternsecurity.com",
-            "ip_address": "",
-            "username": "bob@bob.com",
-            "password": "",
-            "hashed_password": "$2a$12$pVmwJ7pXEr3mE.DmCCE4fOUDdeadbeefd2KuCy/tq1ZUFyEOH2bve",
-            "name": "Bob Smith",
-            "vin": "",
-            "address": "",
-            "phone": "+91283423839",
-            "database_name": "eatstreet",
-        },
-        {
-            "id": "234623453454",
-            "email": "tim@blacklanternsecurity.com",
-            "ip_address": "",
-            "username": "timmy",
-            "password": "TimTamSlam69",
-            "hashed_password": "",
-            "name": "Tim Tam",
-            "vin": "",
-            "address": "",
-            "phone": "+123455667",
-            "database_name": "eatstreet",
-        },
-    ],
-    "success": True,
-    "took": "61µs",
-    "total": 2,
-}
-
-
-class TestDehashed(ModuleTestBase):
-    modules_overrides = ["dehashed", "speculate"]
-    config_overrides = {
-        "scope": {"report_distance": 2},
-        "modules": {"dehashed": {"username": "admin", "api_key": "deadbeef"}},
-    }
-
-    async def setup_before_prep(self, module_test):
-        module_test.httpx_mock.add_response(
-            url="https://api.dehashed.com/search?query=domain:blacklanternsecurity.com&size=10000&page=1",
-            json=dehashed_domain_response,
-        )
-        await module_test.mock_dns(
-            {
-                "bob.com": {"A": ["127.0.0.1"]},
-                "blacklanternsecurity.com": {"A": ["127.0.0.1"]},
-            }
-        )
-
-    def check(self, module_test, events):
-        assert len(events) == 12
-        assert 1 == len([e for e in events if e.type == "DNS_NAME" and e.data == "blacklanternsecurity.com"])
-        assert 1 == len([e for e in events if e.type == "ORG_STUB" and e.data == "blacklanternsecurity"])
-        assert 1 == len(
-            [
-                e
-                for e in events
-                if e.type == "EMAIL_ADDRESS"
-                and e.data == "bob@bob.com"
-                and e.scope_distance == 1
-                and "affiliate" in e.tags
-            ]
-        )
-        assert 1 == len(
-            [
-                e
-                for e in events
-                if e.type == "DNS_NAME" and e.data == "bob.com" and e.scope_distance == 1 and "affiliate" in e.tags
-            ]
-        )
-        assert 1 == len([e for e in events if e.type == "EMAIL_ADDRESS" and e.data == "bob@blacklanternsecurity.com"])
-        assert 1 == len(
-            [
-                e
-                for e in events
-                if e.type == "USERNAME"
-                and e.data == "bob@blacklanternsecurity.com:bob@bob.com"
-                and e.parent.data == "bob@blacklanternsecurity.com"
-            ]
-        )
-        assert 1 == len([e for e in events if e.type == "EMAIL_ADDRESS" and e.data == "tim@blacklanternsecurity.com"])
-        assert 1 == len(
-            [
-                e
-                for e in events
-                if e.type == "HASHED_PASSWORD"
-                and e.data
-                == "bob@blacklanternsecurity.com:$2a$12$pVmwJ7pXEr3mE.DmCCE4fOUDdeadbeefd2KuCy/tq1ZUFyEOH2bve"
-            ]
-        )
-        assert 1 == len(
-            [e for e in events if e.type == "PASSWORD" and e.data == "tim@blacklanternsecurity.com:TimTamSlam69"]
-        )
-        assert 1 == len([e for e in events if e.type == "USERNAME" and e.data == "tim@blacklanternsecurity.com:timmy"])