bbot 2.4.2.6615rc0__py3-none-any.whl → 2.4.2.6623rc0__py3-none-any.whl

bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.4.2.6615rc"
+__version__ = "v2.4.2.6623rc"
 
 from .scanner import Scanner, Preset
 

bbot/modules/github_usersearch.py

@@ -0,0 +1,75 @@
+from bbot.modules.templates.github import github
+from bbot.modules.templates.subdomain_enum import subdomain_enum
+
+
+class github_usersearch(github, subdomain_enum):
+    watched_events = ["DNS_NAME"]
+    produced_events = ["SOCIAL", "EMAIL_ADDRESS"]
+    flags = ["passive", "safe", "code-enum"]
+    meta = {
+        "description": "Query Github's API for users with emails matching in scope domains that may not be discoverable by listing members of the organization.",
+        "created_date": "2025-05-10",
+        "author": "@domwhewell-sage",
+        "auth_required": True,
+    }
+    options = {"api_key": ""}
+    options_desc = {"api_key": "Github token"}
+
+    async def handle_event(self, event):
+        self.verbose("Searching for users with emails matching in scope domains")
+        query = self.make_query(event)
+        users = await self.query_users(query)
+        for user, email in users:
+            user_url = f"https://github.com/{user}"
+            event_data = {"platform": "github", "profile_name": user, "url": user_url}
+            user_event = self.make_event(event_data, "SOCIAL", tags="github-org-member", parent=event)
+            if user_event:
+                await self.emit_event(
+                    user_event,
+                    context=f"{{module}} searched for users with {{DNS_NAME}} in the profile and discovered {{event.type}}: {user_url}",
+                )
+            if email:
+                await self.emit_event(
+                    email,
+                    "EMAIL_ADDRESS",
+                    parent=event,
+                    context=f"{{module}} found an {{event.type}} on the github profile {user_url}: {{event.data}}",
+                )
+
+    async def query_users(self, query):
+        users = []
+        graphql_query = f"""query search_users {{
+            search(query: "{query}", type: USER, first: 100, after: "{{NEXT_KEY}}") {{
+                userCount
+                pageInfo {{
+                    hasNextPage
+                    endCursor
+                }}
+                edges {{
+                    node {{
+                        ... on User {{
+                          login
+                          # bio Commented out as user can add arbritrary domains to their bio
+                          email # Email is verified by github
+                          websiteUrl # Website is not verified by github
+                        }}
+                    }}
+                }}
+            }}
+        }}"""
+        async for data in self.github_graphql_request(graphql_query, "search"):
+            if data:
+                user_count = data.get("userCount", 0)
+                self.verbose(f"Found {user_count} users with the query {query}, verifying if they are in-scope...")
+                edges = data.get("edges", [])
+                for node in edges:
+                    user = node.get("node", {})
+                    in_scope_hosts = await self.scan.extract_in_scope_hostnames(str(user))
+                    if in_scope_hosts:
+                        login = user.get("login", "")
+                        email = user.get("email", None)
+                        self.verbose(
+                            f'Found in-scope hostname(s): "{in_scope_hosts}" in the profile https://github.com/{login}, the profile appears to be in-scope'
+                        )
+                        users.append((login, email))
+        return users

bbot/modules/templates/github.py

@@ -44,3 +44,31 @@ class github(BaseModule):
             self.trace(traceback.format_exc())
             return None, f"Error with API ({str(e).strip()})"
         return True
+
+    async def github_graphql_request(self, graphql_query, resp_key):
+        url = f"{self.base_url}/graphql"
+        next_key = ""
+        has_next_page = True
+
+        while has_next_page:
+            query = graphql_query.replace("{NEXT_KEY}", next_key)
+            r = await self.api_request(url, method="POST", json={"query": query})
+            if r is None:
+                break
+            status_code = getattr(r, "status_code", 0)
+            if status_code == 403:
+                self.warning("Github is rate-limiting us (HTTP status: 403)")
+                break
+            try:
+                json = r.json()
+            except Exception as e:
+                self.warning(f"Failed to decode JSON for {r.url} (HTTP status: {status_code}): {e}")
+                break
+
+            data = json.get("data", {}).get(resp_key, {})
+            yield data
+
+            # Update pagination variables
+            page_info = data.get("pageInfo", {})
+            has_next_page = page_info.get("hasNextPage", False)
+            next_key = page_info.get("endCursor", "")

bbot/test/test_step_2/module_tests/test_module_github_usersearch.py

@@ -0,0 +1,138 @@
+from .base import ModuleTestBase
+
+
+class TestGithub_Usersearch(ModuleTestBase):
+    config_overrides = {"modules": {"github_usersearch": {"api_key": "asdf"}}}
+    query_1 = """query search_users {
+            search(query: "blacklanternsecurity.com", type: USER, first: 100, after: "") {
+                userCount
+                pageInfo {
+                    hasNextPage
+                    endCursor
+                }
+                edges {
+                    node {
+                        ... on User {
+                          login
+                          # bio Commented out as user can add arbritrary domains to their bio
+                          email # Email is verified by github
+                          websiteUrl # Website is not verified by github
+                        }
+                    }
+                }
+            }
+        }"""
+    query_2 = """query search_users {
+            search(query: "blacklanternsecurity.com", type: USER, first: 100, after: "Y3Vyc29yOjUz") {
+                userCount
+                pageInfo {
+                    hasNextPage
+                    endCursor
+                }
+                edges {
+                    node {
+                        ... on User {
+                          login
+                          # bio Commented out as user can add arbritrary domains to their bio
+                          email # Email is verified by github
+                          websiteUrl # Website is not verified by github
+                        }
+                    }
+                }
+            }
+        }"""
+
+    async def setup_before_prep(self, module_test):
+        module_test.httpx_mock.add_response(url="https://api.github.com/zen")
+        module_test.httpx_mock.add_response(
+            url="https://api.github.com/graphql",
+            match_headers={"Authorization": "token asdf"},
+            match_json={"query": self.query_1},
+            json={
+                "data": {
+                    "search": {
+                        "userCount": 2,
+                        "pageInfo": {"hasNextPage": True, "endCursor": "Y3Vyc29yOjUz"},
+                        "edges": [
+                            {
+                                "node": {
+                                    "login": "user_one",
+                                    "email": "test@blacklanternsecurity.com",
+                                    "websiteUrl": None,
+                                }
+                            },
+                            {"node": {"login": "user_two", "email": None, "websiteUrl": None}},
+                        ],
+                    }
+                }
+            },
+        )
+        module_test.httpx_mock.add_response(
+            url="https://api.github.com/graphql",
+            match_headers={"Authorization": "token asdf"},
+            match_json={"query": self.query_2},
+            json={
+                "data": {
+                    "search": {
+                        "userCount": 1,
+                        "pageInfo": {"hasNextPage": False, "endCursor": "Y3Vyc29yOjU"},
+                        "edges": [
+                            {
+                                "node": {
+                                    "login": "user_three",
+                                    "email": None,
+                                    "websiteUrl": "https://blog.blacklanternsecurity.com",
+                                }
+                            }
+                        ],
+                    }
+                }
+            },
+        )
+
+    def check(self, module_test, events):
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "SOCIAL"
+                and e.data["platform"] == "github"
+                and e.data["profile_name"] == "user_one"
+                and str(e.module) == "github_usersearch"
+                and "github-org-member" in e.tags
+                and e.scope_distance == 1
+            ]
+        ), "Failed to find user_one github"
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "EMAIL_ADDRESS"
+                and e.data == "test@blacklanternsecurity.com"
+                and str(e.module) == "github_usersearch"
+            ]
+        ), "Failed to find email address for user_one"
+        assert 0 == len(
+            [
+                e
+                for e in events
+                if e.type == "SOCIAL"
+                and e.data["platform"] == "github"
+                and e.data["profile_name"] == "user_two"
+                and str(e.module) == "github_usersearch"
+                and "github-org-member" in e.tags
+                and e.scope_distance == 1
+            ]
+        ), "user_two should not be in scope due to no email or website"
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "SOCIAL"
+                and e.data["platform"] == "github"
+                and e.data["profile_name"] == "user_three"
+                and str(e.module) == "github_usersearch"
+                and "github-org-member" in e.tags
+                and e.scope_distance == 1
+            ]
+        ), "Failed to find user_three github"

{bbot-2.4.2.6615rc0.dist-info → bbot-2.4.2.6623rc0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.4.2.6615rc0
+Version: 2.4.2.6623rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.4.2.6615rc0.dist-info → bbot-2.4.2.6623rc0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-bbot/__init__.py,sha256=WtQlPfgPAVNvoBoKj72lcIDazIAJx93c82MqqeYuhNU,163
+bbot/__init__.py,sha256=k0pwYL_4Erj2fgs_7ngRan2CpJgelJDddDUSs2EcqkE,163
 bbot/cli.py,sha256=1QJbANVw9Q3GFM92H2QRV2ds5756ulm08CDZwzwPpeI,11888
 bbot/core/__init__.py,sha256=l255GJE_DvUnWvrRb0J5lG-iMztJ8zVvoweDOfegGtI,46
 bbot/core/config/__init__.py,sha256=zYNw2Me6tsEr8hOOkLb4BQ97GB7Kis2k--G81S8vofU,342
@@ -108,6 +108,7 @@ bbot/modules/git_clone.py,sha256=XFZXx0k97EMY3E5PZzdNvqQzZddOfRMaVp5ol2gk11s,246
 bbot/modules/gitdumper.py,sha256=XBYt6oSXm09FJVdH37zrn9T1Nhqc0zK4KLugMevedOw,11531
 bbot/modules/github_codesearch.py,sha256=a-r2vE9N9WyBpFUiKCsg0TK4Qn7DaEGyVRTUKzkDLWA,3641
 bbot/modules/github_org.py,sha256=WM18vJCHuOHJJ5rPzQzQ3Pmp7XPPuaMeVgNfW-FlO0k,8938
+bbot/modules/github_usersearch.py,sha256=G8knkQBJsn7EKcMhcEaFPiB_Y5S96e2VaseBubsqOyk,3407
 bbot/modules/github_workflows.py,sha256=RDtzR0DC2sqiWzMtiqlrCSwtZHWL2MoIJBKd6LVTAdI,9720
 bbot/modules/gitlab.py,sha256=9oWWpBijeHCjuFBfWW4HvNqt7bvJvrBgBjaaz_UPPnE,5964
 bbot/modules/google_playstore.py,sha256=N4QjzQag_bgDXfX17rytBiiWA-SQtYI2N0J_ZNEOdv0,3701
@@ -199,7 +200,7 @@ bbot/modules/subdomaincenter.py,sha256=aWjcIqGGWnAj2ePwcS4sgUJDUsq0trY3Klhr_lcc4
 bbot/modules/subdomainradar.py,sha256=YlRNMtNGLpa13KZ7aksAMVZdSjxe1tkywU5RXlwXpPc,6784
 bbot/modules/telerik.py,sha256=i9Zy2JZXLrmwSslFzVFVWApQNwTwNcrGsb_UxBuCtkI,18905
 bbot/modules/templates/bucket.py,sha256=muLPpfAGtcNhL0tLU-qHTlTNIz4yncRcVjdZMqVRtUI,7153
-bbot/modules/templates/github.py,sha256=n6cVjf62ezkztCRAcXNnlxfCkB0VRWqn138mOOt6T08,1454
+bbot/modules/templates/github.py,sha256=lrV1EYPqjtPkJsS0fQfqmLvGchNo_fO3A75W9-03gxY,2531
 bbot/modules/templates/postman.py,sha256=MIpz2q_r6LP0kIEgByo7oX5qHhMZLOhr7oKzJI9Beec,6959
 bbot/modules/templates/shodan.py,sha256=MXBvlmfw3jZFqT47v10UkqMSyQR-zBIxMJmK7PWw6uw,1174
 bbot/modules/templates/sql.py,sha256=o-CdyyoJvHJdJBKkj3CIGXYxUta4w2AB_2Vr-k7cDDU,3553
@@ -358,6 +359,7 @@ bbot/test/test_step_2/module_tests/test_module_git_clone.py,sha256=Mo0Q7bCXcrkGW
 bbot/test/test_step_2/module_tests/test_module_gitdumper.py,sha256=ya_eQUQk0344G7iqBYMls2z5H-bYM87rydbz-ACR2Ng,17461
 bbot/test/test_step_2/module_tests/test_module_github_codesearch.py,sha256=M50xBiGG2EuPGXDJU6uFsSUE-fhqZl3CzYtNdszW7LM,4735
 bbot/test/test_step_2/module_tests/test_module_github_org.py,sha256=5tKO6NH4TPBeIdeTf7Bz9PUZ1pcvKsjrG0nFhc3YgT0,25458
+bbot/test/test_step_2/module_tests/test_module_github_usersearch.py,sha256=IIQ0tYZjQN8_L8u_N4m8Nz3kbB4IyBp95tYCPcQeScg,5264
 bbot/test/test_step_2/module_tests/test_module_github_workflows.py,sha256=o_teEaskm3H22QEKod5KJayFvvcgOQoG4eItGWv8C8E,38006
 bbot/test/test_step_2/module_tests/test_module_gitlab.py,sha256=fnwE7BWTU6EQquKdGLCiaX_LwVwvzOLev3Y9GheTLSY,11859
 bbot/test/test_step_2/module_tests/test_module_google_playstore.py,sha256=uTRqpAGI9HI-rOk_6jdV44OoSqi0QQQ3aTVzvuV0dtc,3034
@@ -448,8 +450,8 @@ bbot/wordlists/raft-small-extensions-lowercase_CLEANED.txt,sha256=ZSIVebs7ptMvHx
 bbot/wordlists/top_open_ports_nmap.txt,sha256=LmdFYkfapSxn1pVuQC2LkOIY2hMLgG-Xts7DVtYzweM,42727
 bbot/wordlists/valid_url_schemes.txt,sha256=0B_VAr9Dv7aYhwi6JSBDU-3M76vNtzN0qEC_RNLo7HE,3310
 bbot/wordlists/wordninja_dns.txt.gz,sha256=DYHvvfW0TvzrVwyprqODAk4tGOxv5ezNmCPSdPuDUnQ,570241
-bbot-2.4.2.6615rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
-bbot-2.4.2.6615rc0.dist-info/METADATA,sha256=zMFFr-b2zwl7kcxtDOUqz8TPuk0-KGGywvBGXnFJL90,18308
-bbot-2.4.2.6615rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-bbot-2.4.2.6615rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
-bbot-2.4.2.6615rc0.dist-info/RECORD,,
+bbot-2.4.2.6623rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
+bbot-2.4.2.6623rc0.dist-info/METADATA,sha256=OUGmmKHKf4zBdtAG1oxDolDrlqVvSyQ8TDY1M7m6IDU,18308
+bbot-2.4.2.6623rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+bbot-2.4.2.6623rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
+bbot-2.4.2.6623rc0.dist-info/RECORD,,