bbot 2.4.2.6615rc0__tar.gz → 2.4.2.6623rc0__tar.gz

{bbot-2.4.2.6615rc0 → bbot-2.4.2.6623rc0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.4.2.6615rc0
+Version: 2.4.2.6623rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.4.2.6615rc0 → bbot-2.4.2.6623rc0}/bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.4.2.6615rc"
+__version__ = "v2.4.2.6623rc"
 
 from .scanner import Scanner, Preset
 

bbot-2.4.2.6623rc0/bbot/modules/github_usersearch.py

@@ -0,0 +1,75 @@
+from bbot.modules.templates.github import github
+from bbot.modules.templates.subdomain_enum import subdomain_enum
+
+
+class github_usersearch(github, subdomain_enum):
+    watched_events = ["DNS_NAME"]
+    produced_events = ["SOCIAL", "EMAIL_ADDRESS"]
+    flags = ["passive", "safe", "code-enum"]
+    meta = {
+        "description": "Query Github's API for users with emails matching in scope domains that may not be discoverable by listing members of the organization.",
+        "created_date": "2025-05-10",
+        "author": "@domwhewell-sage",
+        "auth_required": True,
+    }
+    options = {"api_key": ""}
+    options_desc = {"api_key": "Github token"}
+
+    async def handle_event(self, event):
+        self.verbose("Searching for users with emails matching in scope domains")
+        query = self.make_query(event)
+        users = await self.query_users(query)
+        for user, email in users:
+            user_url = f"https://github.com/{user}"
+            event_data = {"platform": "github", "profile_name": user, "url": user_url}
+            user_event = self.make_event(event_data, "SOCIAL", tags="github-org-member", parent=event)
+            if user_event:
+                await self.emit_event(
+                    user_event,
+                    context=f"{{module}} searched for users with {{DNS_NAME}} in the profile and discovered {{event.type}}: {user_url}",
+                )
+            if email:
+                await self.emit_event(
+                    email,
+                    "EMAIL_ADDRESS",
+                    parent=event,
+                    context=f"{{module}} found an {{event.type}} on the github profile {user_url}: {{event.data}}",
+                )
+
+    async def query_users(self, query):
+        users = []
+        graphql_query = f"""query search_users {{
+            search(query: "{query}", type: USER, first: 100, after: "{{NEXT_KEY}}") {{
+                userCount
+                pageInfo {{
+                    hasNextPage
+                    endCursor
+                }}
+                edges {{
+                    node {{
+                        ... on User {{
+                          login
+                          # bio Commented out as user can add arbritrary domains to their bio
+                          email # Email is verified by github
+                          websiteUrl # Website is not verified by github
+                        }}
+                    }}
+                }}
+            }}
+        }}"""
+        async for data in self.github_graphql_request(graphql_query, "search"):
+            if data:
+                user_count = data.get("userCount", 0)
+                self.verbose(f"Found {user_count} users with the query {query}, verifying if they are in-scope...")
+                edges = data.get("edges", [])
+                for node in edges:
+                    user = node.get("node", {})
+                    in_scope_hosts = await self.scan.extract_in_scope_hostnames(str(user))
+                    if in_scope_hosts:
+                        login = user.get("login", "")
+                        email = user.get("email", None)
+                        self.verbose(
+                            f'Found in-scope hostname(s): "{in_scope_hosts}" in the profile https://github.com/{login}, the profile appears to be in-scope'
+                        )
+                        users.append((login, email))
+        return users

{bbot-2.4.2.6615rc0 → bbot-2.4.2.6623rc0}/bbot/modules/templates/github.py

@@ -44,3 +44,31 @@ class github(BaseModule):
             self.trace(traceback.format_exc())
             return None, f"Error with API ({str(e).strip()})"
         return True
+
+    async def github_graphql_request(self, graphql_query, resp_key):
+        url = f"{self.base_url}/graphql"
+        next_key = ""
+        has_next_page = True
+
+        while has_next_page:
+            query = graphql_query.replace("{NEXT_KEY}", next_key)
+            r = await self.api_request(url, method="POST", json={"query": query})
+            if r is None:
+                break
+            status_code = getattr(r, "status_code", 0)
+            if status_code == 403:
+                self.warning("Github is rate-limiting us (HTTP status: 403)")
+                break
+            try:
+                json = r.json()
+            except Exception as e:
+                self.warning(f"Failed to decode JSON for {r.url} (HTTP status: {status_code}): {e}")
+                break
+
+            data = json.get("data", {}).get(resp_key, {})
+            yield data
+
+            # Update pagination variables
+            page_info = data.get("pageInfo", {})
+            has_next_page = page_info.get("hasNextPage", False)
+            next_key = page_info.get("endCursor", "")

bbot-2.4.2.6623rc0/bbot/test/test_step_2/module_tests/test_module_github_usersearch.py

@@ -0,0 +1,138 @@
+from .base import ModuleTestBase
+
+
+class TestGithub_Usersearch(ModuleTestBase):
+    config_overrides = {"modules": {"github_usersearch": {"api_key": "asdf"}}}
+    query_1 = """query search_users {
+            search(query: "blacklanternsecurity.com", type: USER, first: 100, after: "") {
+                userCount
+                pageInfo {
+                    hasNextPage
+                    endCursor
+                }
+                edges {
+                    node {
+                        ... on User {
+                          login
+                          # bio Commented out as user can add arbritrary domains to their bio
+                          email # Email is verified by github
+                          websiteUrl # Website is not verified by github
+                        }
+                    }
+                }
+            }
+        }"""
+    query_2 = """query search_users {
+            search(query: "blacklanternsecurity.com", type: USER, first: 100, after: "Y3Vyc29yOjUz") {
+                userCount
+                pageInfo {
+                    hasNextPage
+                    endCursor
+                }
+                edges {
+                    node {
+                        ... on User {
+                          login
+                          # bio Commented out as user can add arbritrary domains to their bio
+                          email # Email is verified by github
+                          websiteUrl # Website is not verified by github
+                        }
+                    }
+                }
+            }
+        }"""
+
+    async def setup_before_prep(self, module_test):
+        module_test.httpx_mock.add_response(url="https://api.github.com/zen")
+        module_test.httpx_mock.add_response(
+            url="https://api.github.com/graphql",
+            match_headers={"Authorization": "token asdf"},
+            match_json={"query": self.query_1},
+            json={
+                "data": {
+                    "search": {
+                        "userCount": 2,
+                        "pageInfo": {"hasNextPage": True, "endCursor": "Y3Vyc29yOjUz"},
+                        "edges": [
+                            {
+                                "node": {
+                                    "login": "user_one",
+                                    "email": "test@blacklanternsecurity.com",
+                                    "websiteUrl": None,
+                                }
+                            },
+                            {"node": {"login": "user_two", "email": None, "websiteUrl": None}},
+                        ],
+                    }
+                }
+            },
+        )
+        module_test.httpx_mock.add_response(
+            url="https://api.github.com/graphql",
+            match_headers={"Authorization": "token asdf"},
+            match_json={"query": self.query_2},
+            json={
+                "data": {
+                    "search": {
+                        "userCount": 1,
+                        "pageInfo": {"hasNextPage": False, "endCursor": "Y3Vyc29yOjU"},
+                        "edges": [
+                            {
+                                "node": {
+                                    "login": "user_three",
+                                    "email": None,
+                                    "websiteUrl": "https://blog.blacklanternsecurity.com",
+                                }
+                            }
+                        ],
+                    }
+                }
+            },
+        )
+
+    def check(self, module_test, events):
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "SOCIAL"
+                and e.data["platform"] == "github"
+                and e.data["profile_name"] == "user_one"
+                and str(e.module) == "github_usersearch"
+                and "github-org-member" in e.tags
+                and e.scope_distance == 1
+            ]
+        ), "Failed to find user_one github"
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "EMAIL_ADDRESS"
+                and e.data == "test@blacklanternsecurity.com"
+                and str(e.module) == "github_usersearch"
+            ]
+        ), "Failed to find email address for user_one"
+        assert 0 == len(
+            [
+                e
+                for e in events
+                if e.type == "SOCIAL"
+                and e.data["platform"] == "github"
+                and e.data["profile_name"] == "user_two"
+                and str(e.module) == "github_usersearch"
+                and "github-org-member" in e.tags
+                and e.scope_distance == 1
+            ]
+        ), "user_two should not be in scope due to no email or website"
+        assert 1 == len(
+            [
+                e
+                for e in events
+                if e.type == "SOCIAL"
+                and e.data["platform"] == "github"
+                and e.data["profile_name"] == "user_three"
+                and str(e.module) == "github_usersearch"
+                and "github-org-member" in e.tags
+                and e.scope_distance == 1
+            ]
+        ), "Failed to find user_three github"

{bbot-2.4.2.6615rc0 → bbot-2.4.2.6623rc0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "bbot"
-version = "v2.4.2.6615rc"
+version = "v2.4.2.6623rc"
 description = "OSINT automation for hackers."
 authors = [
     "TheTechromancer",
@@ -73,7 +73,7 @@ pytest-asyncio = "0.25.3"
 uvicorn = ">=0.32,<0.35"
 fastapi = "^0.115.5"
 pytest-httpx = ">=0.35"
-ruff = "0.9.7"
+ruff = "0.11.10"
 
 [tool.poetry.group.docs.dependencies]
 mkdocs = "^1.5.2"