bbot 2.5.0.6747rc0__py3-none-any.whl → 2.5.0.6765rc0__py3-none-any.whl

bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.5.0.6747rc"
+__version__ = "v2.5.0.6765rc"
 
 from .scanner import Scanner, Preset
 

bbot/core/helpers/names_generator.py

@@ -173,6 +173,7 @@ adjectives = [
     "pasty",
     "peckish",
     "pedantic",
+    "pensive",
     "pernicious",
     "perturbed",
     "perverted",
@@ -671,6 +672,7 @@ names = [
     "tracy",
     "travis",
     "treebeard",
+    "trent",
     "triss",
     "tyler",
     "tyrell",

bbot/modules/aspnet_bin_exposure.py

@@ -0,0 +1,80 @@
+from bbot.modules.base import BaseModule
+
+
+class aspnet_bin_exposure(BaseModule):
+    watched_events = ["URL"]
+    produced_events = ["VULNERABILITY"]
+    flags = ["active", "safe", "web-thorough"]
+    meta = {
+        "description": "Check for ASP.NET Security Feature Bypasses (CVE-2023-36899 and CVE-2023-36560)",
+        "created_date": "2025-01-28",
+        "author": "@liquidsec",
+    }
+
+    in_scope_only = True
+    test_dlls = [
+        "Telerik.Web.UI.dll",
+        "Newtonsoft.Json.dll",
+        "System.Net.Http.dll",
+        "EntityFramework.dll",
+        "AjaxControlToolkit.dll",
+    ]
+
+    @staticmethod
+    def normalize_url(url):
+        return str(url.rstrip("/") + "/").lower()
+
+    def _incoming_dedup_hash(self, event):
+        return hash(self.normalize_url(event.data))
+
+    async def handle_event(self, event):
+        normalized_url = self.normalize_url(event.data)
+        for test_dll in self.test_dlls:
+            for technique in ["b/(S(X))in/###DLL_PLACEHOLDER###/(S(X))/", "(S(X))/b/(S(X))in/###DLL_PLACEHOLDER###"]:
+                test_url = f"{normalized_url}{technique.replace('###DLL_PLACEHOLDER###', test_dll)}"
+                self.debug(f"Sending test URL: [{test_url}]")
+                kwargs = {"method": "GET", "allow_redirects": False, "timeout": 10}
+                test_result = await self.helpers.request(test_url, **kwargs)
+                if test_result:
+                    if test_result.status_code == 200 and (
+                        "content-type" in test_result.headers
+                        and "application/x-msdownload" in test_result.headers["content-type"]
+                    ):
+                        self.debug(
+                            f"Got positive result for probe with test url: [{test_url}]. Status Code: [{test_result.status_code}] Content Length: [{len(test_result.content)}]"
+                        )
+
+                        if test_result.status_code == 200 and (
+                            "content-type" in test_result.headers
+                            and "application/x-msdownload" in test_result.headers["content-type"]
+                        ):
+                            confirm_url = (
+                                f"{normalized_url}{technique.replace('###DLL_PLACEHOLDER###', 'oopsnotarealdll.dll')}"
+                            )
+                            confirm_result = await self.helpers.request(confirm_url, **kwargs)
+
+                            if confirm_result and (
+                                confirm_result.status_code != 200
+                                or not (
+                                    "content-type" in confirm_result.headers
+                                    and "application/x-msdownload" in confirm_result.headers["content-type"]
+                                )
+                            ):
+                                description = f"IIS Bin Directory DLL Exposure. Detection Url: [{test_url}]"
+                                await self.emit_event(
+                                    {
+                                        "severity": "HIGH",
+                                        "host": str(event.host),
+                                        "url": normalized_url,
+                                        "description": description,
+                                    },
+                                    "VULNERABILITY",
+                                    event,
+                                    context="{module} detected IIS Bin Directory DLL Exposure vulnerability",
+                                )
+                                return True
+
+    async def filter_event(self, event):
+        if "dir" in event.tags:
+            return True
+        return False

bbot/modules/iis_shortnames.py

@@ -166,6 +166,10 @@ class iis_shortnames(BaseModule):
 
         cl = ext_char_list if extension_mode is True else char_list
 
+        self.debug(
+            f"Solving shortname recursive for {target} with prefix {prefix} and extension mode {extension_mode}"
+        )
+
         urls_and_kwargs = []
 
         for c in cl:
@@ -334,6 +338,18 @@ class iis_shortnames(BaseModule):
                     for url_hint in url_hint_list:
                         if "." in url_hint:
                             hint_type = "shortname-endpoint"
+                            # Check if it's a ZIP file
+                            if url_hint.lower().endswith(".zip"):
+                                await self.emit_event(
+                                    {
+                                        "host": str(event.host),
+                                        "url": event.data,
+                                        "description": f"Possible backup file (zip) in web root: {normalized_url}{url_hint}",
+                                    },
+                                    "FINDING",
+                                    event,
+                                    context=f"{{module}} discovered possible backup file in web root: {url_hint}",
+                                )
                         else:
                             hint_type = "shortname-directory"
 

bbot/presets/web/dotnet-audit.yml

@@ -12,6 +12,7 @@ modules:
   - telerik
   - ajaxpro
   - dotnetnuke
+  - aspnet_bin_exposure
 
 config:
   modules:

bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py

@@ -0,0 +1,73 @@
+from .base import ModuleTestBase
+import re
+
+
+class TestAspnetBinExposure(ModuleTestBase):
+    targets = ["http://127.0.0.1:8888"]
+    modules_overrides = ["httpx", "aspnet_bin_exposure"]
+    config_overrides = {
+        "modules": {
+            "aspnet_bin_exposure": {
+                "test_dlls": [
+                    "Newtonsoft.Json.dll",
+                ]
+            }
+        }
+    }
+
+    async def setup_before_prep(self, module_test):
+        # Simulate successful DLL exposure
+        expect_args = {
+            "method": "GET",
+            "uri": "/b/(S(X))in/Newtonsoft.Json.dll/(S(X))/",
+        }
+        respond_args = {
+            "status": 200,
+            "headers": {"content-type": "application/x-msdownload"},
+            "response_data": b"MZ\x90\x00\x03\x00\x00\x00",
+        }
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        # Simulate failed DLL exposure (confirmation test)
+        expect_args = {
+            "method": "GET",
+            "uri": "/b/(S(X))in/oopsnotarealdll.dll/(S(X))/",
+        }
+        respond_args = {"status": 404}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        # Simulate alternative technique
+        expect_args = {
+            "method": "GET",
+            "uri": "/(S(X))/b/(S(X))in/Newtonsoft.Json.dll",
+        }
+        respond_args = {
+            "status": 200,
+            "headers": {"content-type": "application/x-msdownload"},
+            "response_data": b"MZ\x90\x00\x03\x00\x00\x00",
+        }
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        # Simulate failed alternative technique (confirmation test)
+        expect_args = {
+            "method": "GET",
+            "uri": "/(S(X))/b/(S(X))in/oopsnotarealdll.dll",
+        }
+        respond_args = {"status": 404}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        # Fallback for any other requests
+        expect_args = {"uri": re.compile(r"^/.*$")}
+        respond_args = {"status": 404}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+    def check(self, module_test, events):
+        vulnerability_found = False
+        for e in events:
+            if e.type == "VULNERABILITY" and "IIS Bin Directory DLL Exposure" in e.data["description"]:
+                vulnerability_found = True
+                assert e.data["severity"] == "HIGH", "Vulnerability severity should be HIGH"
+                assert "Detection Url" in e.data["description"], "Description should include detection URL"
+                break
+
+        assert vulnerability_found, "No vulnerability event was found"

bbot/test/test_step_2/module_tests/test_module_iis_shortnames.py

@@ -43,19 +43,64 @@ class TestIIS_Shortnames(ModuleTestBase):
         respond_args = {"response_data": "", "status": 400}
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
-        for char in "BLSHAX":
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BA\*~1\*.*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BAC\*~1\*.*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACK\*~1\*.*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKU\*~1\*.*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP\*~1\*/a.aspx$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP~1\*$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP~1\.Z\*/a.aspx$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP~1\.ZI\*/a.aspx$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        expect_args = {"method": "GET", "uri": re.compile(r"\/BACKUP~1\.ZIP\*/a.aspx$")}
+        respond_args = {"response_data": "", "status": 400}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+        for char in "BLSHAXCKUP":
             expect_args = {"method": "GET", "uri": re.compile(rf"\/\*{char}\*~1\*.*$")}
             respond_args = {"response_data": "", "status": 400}
             module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
+        for char in "ZIP":
+            expect_args = {"method": "GET", "uri": re.compile(rf"\/\*~1\*{char}\*.*$")}
+            respond_args = {"response_data": "", "status": 400}
+            module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
     def check(self, module_test, events):
         vulnerabilityEmitted = False
         url_hintEmitted = False
+        zip_findingEmitted = False
         for e in events:
             if e.type == "VULNERABILITY" and "iis-magic-url" not in e.tags:
                 vulnerabilityEmitted = True
             if e.type == "URL_HINT" and e.data == "http://127.0.0.1:8888/BLSHAX~1":
                 url_hintEmitted = True
+            if e.type == "FINDING" and "Possible backup file (zip) in web root" in e.data["description"]:
+                zip_findingEmitted = True
 
         assert vulnerabilityEmitted
         assert url_hintEmitted
+        assert zip_findingEmitted

{bbot-2.5.0.6747rc0.dist-info → bbot-2.5.0.6765rc0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.5.0.6747rc0
+Version: 2.5.0.6765rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.5.0.6747rc0.dist-info → bbot-2.5.0.6765rc0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-bbot/__init__.py,sha256=pxeuo70U_vqMHkwUAo51WHCNc0HztWcI_zbineRuYUY,163
+bbot/__init__.py,sha256=FlPvmAeCzCmU4LnwoCMJUBlY6Mk29_UBVZbz2EIYJ7k,163
 bbot/cli.py,sha256=1QJbANVw9Q3GFM92H2QRV2ds5756ulm08CDZwzwPpeI,11888
 bbot/core/__init__.py,sha256=l255GJE_DvUnWvrRb0J5lG-iMztJ8zVvoweDOfegGtI,46
 bbot/core/config/__init__.py,sha256=zYNw2Me6tsEr8hOOkLb4BQ97GB7Kis2k--G81S8vofU,342
@@ -30,7 +30,7 @@ bbot/core/helpers/helper.py,sha256=u-q_Ka9pY1atvC-FChxYpURM7b3_0gaCNIHSG__Wi74,8
 bbot/core/helpers/interactsh.py,sha256=VBYYH6-rWBofRsgemndK6iZNmyifOps8vgQOw2mac4k,12624
 bbot/core/helpers/libmagic.py,sha256=QMHyxjgDLb2jyjBvK1MQ-xt6WkGXhKcHu9ZP1li-sik,3460
 bbot/core/helpers/misc.py,sha256=hi5iyzpLc6oFk5XrWQN7leuRDyuZtdWuKVBxTUpQ_RY,88757
-bbot/core/helpers/names_generator.py,sha256=FFDW4uxTTznHhE5Com5o__Nyi0Wl61gcRv0FHgYTI8s,10566
+bbot/core/helpers/names_generator.py,sha256=zmo4MyuOnAYjiUDiORhq9T9bHmA_gW72Y2kHMAqVENU,10594
 bbot/core/helpers/ntlm.py,sha256=P2Xj4-GPos2iAzw4dfk0FJp6oGyycGhu2x6sLDVjYjs,2573
 bbot/core/helpers/process.py,sha256=00uRpLMFi3Pt3uT8qXwAIhsXdoa7h-ifoXh0sGYgwqs,1702
 bbot/core/helpers/ratelimiter.py,sha256=fQp5mKfqfCkDkZzgntDu4NWlRsWSMCto0V8vaV8-34k,2115
@@ -57,6 +57,7 @@ bbot/modules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 bbot/modules/ajaxpro.py,sha256=daE1yQoCsSI5c4dh3YKwRSggTISNjWgrK7qTPidk7cU,3764
 bbot/modules/anubisdb.py,sha256=JCy2YCfa0e_VawpzNmcPXAosKUthmYGutireJ0gMDws,1916
 bbot/modules/apkpure.py,sha256=a_VRujUOIk7SVWyI9-N-nJVqfMApciIRdXVc-y_Ebuw,2558
+bbot/modules/aspnet_bin_exposure.py,sha256=X16mK8tff7-LOcbS4fUschkDRdVVz9r2N8Ta2EZzw2Y,3737
 bbot/modules/azure_realm.py,sha256=pP2PUlLy0K9KKaE8aNcznWjDW3PKHvnMejdOSc-o4ms,1612
 bbot/modules/azure_tenant.py,sha256=qBn7CUA_hth2PqW55XZVjYxIw20xLYrMntXc6mYpmKU,5366
 bbot/modules/baddns.py,sha256=ubO3KDfcIMJnMjyZX5FWZ4GWxLSekV_JQV7QvsPjtD0,6693
@@ -118,7 +119,7 @@ bbot/modules/host_header.py,sha256=uDjwidMdeNPMRfzQ2YW4REEGsZqnGOZHbOS6GgdNd9s,7
 bbot/modules/httpx.py,sha256=z0sgnfLqIXyiadM0rKQK2p86lka7rC4pGCfTVUqU5Lk,8118
 bbot/modules/hunt.py,sha256=zt-RKBiOlAKozHA-ZvuPeSOISEu7rIo2aHXQWEsILhw,6607
 bbot/modules/hunterio.py,sha256=dL8IUecJQzNJgvtHArQ1Lz574MbRTF7GbLxp6lLcs0o,2644
-bbot/modules/iis_shortnames.py,sha256=DHGquxEoNl7pjmStBzhvxhD3lvkz5gQmZkGF1nGGHm0,15410
+bbot/modules/iis_shortnames.py,sha256=TD4kow8TB9slz0SENrfxmQ0Yo9WwsY6DB3j0vvgUIbA,16296
 bbot/modules/internal/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 bbot/modules/internal/aggregate.py,sha256=HnnfTX2GYsOz8IFtfrRX1uXV6rvFx4uG9lmYJF2sdog,419
 bbot/modules/internal/base.py,sha256=BXO4Hc7XKaAOaLzolF3krJX1KibPxtek2GTQUgnCHk0,387
@@ -233,7 +234,7 @@ bbot/presets/subdomain-enum.yml,sha256=tn9h8TlVB_uS3nKZFUP72HzceoRONSef66mGLWzxj
 bbot/presets/tech-detect.yml,sha256=0eEzviy33kZojXpUfKVK0lHhiQrNAopCMEJNL8Clunw,176
 bbot/presets/web/dirbust-heavy.yml,sha256=NDqu7p0Hx1RsZCVnaEWRgI_iL9O0io-tvWerxJf36SM,653
 bbot/presets/web/dirbust-light.yml,sha256=5zSANdjKfYh49kFlsElYY2G6acVrZFzDCEkyqwU6oOQ,203
-bbot/presets/web/dotnet-audit.yml,sha256=FViiccDXG08P3INNe06bLPeatejbw8Kb1HW5xgdUJNU,520
+bbot/presets/web/dotnet-audit.yml,sha256=h9CWZ1QeMsXovjyIzoa7Rcv8hfDib447ZKNxwXBzz1w,544
 bbot/presets/web/iis-shortnames.yml,sha256=EcYKMpl-cI8Xb79_u4wQS42yFXxDpLH9OqINcFUXoTE,176
 bbot/presets/web/lightfuzz-heavy.yml,sha256=zb7DPT-tf5MxTXkVpHn8cx2YwpbaGwZOST8vbhAOWZ0,459
 bbot/presets/web/lightfuzz-light.yml,sha256=pkjTa5ULeOhCgRYPAoJR-cVfyhErT3I1aqmWGHTIgBk,899
@@ -301,6 +302,7 @@ bbot/test/test_step_2/module_tests/test_module_ajaxpro.py,sha256=S2pFV0TgOJ01SMH
 bbot/test/test_step_2/module_tests/test_module_anubisdb.py,sha256=y_GMm20Fy4z9L0fN2dYOExaSsi8Z9PwMKnAjSsYhBk8,545
 bbot/test/test_step_2/module_tests/test_module_apkpure.py,sha256=-G4hoRPFhNH-rj6MvuhqlwiXHqBqHgfFGYxbzoyKz2s,2983
 bbot/test/test_step_2/module_tests/test_module_asn.py,sha256=qIbitSAEAmYyxhpxvdFDsQrHaaxfgKsFox9Q3jTmvgI,10616
+bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py,sha256=x2WZxe4W08emvTUDf85AakIb-zq5Fu5NlAxbHCrD9bo,2757
 bbot/test/test_step_2/module_tests/test_module_asset_inventory.py,sha256=NEMSPBlczpA5NbQpIcRBpRXpVnfS9lmSS1U7eJmIXAU,3878
 bbot/test/test_step_2/module_tests/test_module_azure_realm.py,sha256=gPRvGA9RHsAcYlHxQG0lHZOYolyzbe6L-ALGIvW-Mg0,1288
 bbot/test/test_step_2/module_tests/test_module_azure_tenant.py,sha256=Aaid6Ftb_qBOmjcUDauXeI6WZcBz49Wli5Yk8FWrZVc,4805
@@ -368,7 +370,7 @@ bbot/test/test_step_2/module_tests/test_module_http.py,sha256=KhsQvqpVa6zmMa79jV
 bbot/test/test_step_2/module_tests/test_module_httpx.py,sha256=qgwtfB-X5Syq1jIm9GN6sz1wRGE7MhwUySsubarCdUs,7070
 bbot/test/test_step_2/module_tests/test_module_hunt.py,sha256=lRCtas8uAq02W-DkLg0YsJLxt2eiYmSErIdanwoKZdo,1564
 bbot/test/test_step_2/module_tests/test_module_hunterio.py,sha256=s0ENxJzLuUu7MD-_-H0ClpLqPuhsQbX-3IgTuiHR5Xs,6982
-bbot/test/test_step_2/module_tests/test_module_iis_shortnames.py,sha256=JJUoLvw4CqP_iBUlkhnsNjn1wVEYKCBgAldOmm9Vv80,2913
+bbot/test/test_step_2/module_tests/test_module_iis_shortnames.py,sha256=91B1S41PVMrqlCTJq17MG7baB7x7JUsjdXnT-E2FozU,5528
 bbot/test/test_step_2/module_tests/test_module_ip2location.py,sha256=VRuXQelBc3hTNXiAJZD0ow5R4t6L8xAi_tS62TFLJKA,1123
 bbot/test/test_step_2/module_tests/test_module_ipneighbor.py,sha256=Bc5xaiIpleC7j5Lz2Y8S9i6PHETOg4KmwiLNJ9HeMx8,608
 bbot/test/test_step_2/module_tests/test_module_ipstack.py,sha256=C0Le03UqvShpATogq9M54V7FKfwJROBMWSvAYfOeOdo,2735
@@ -449,8 +451,8 @@ bbot/wordlists/raft-small-extensions-lowercase_CLEANED.txt,sha256=ZSIVebs7ptMvHx
 bbot/wordlists/top_open_ports_nmap.txt,sha256=LmdFYkfapSxn1pVuQC2LkOIY2hMLgG-Xts7DVtYzweM,42727
 bbot/wordlists/valid_url_schemes.txt,sha256=0B_VAr9Dv7aYhwi6JSBDU-3M76vNtzN0qEC_RNLo7HE,3310
 bbot/wordlists/wordninja_dns.txt.gz,sha256=DYHvvfW0TvzrVwyprqODAk4tGOxv5ezNmCPSdPuDUnQ,570241
-bbot-2.5.0.6747rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
-bbot-2.5.0.6747rc0.dist-info/METADATA,sha256=SoJBZLCdXmnygG2NiH0aTbxy2M9aokc4vstbLgWqXww,18308
-bbot-2.5.0.6747rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-bbot-2.5.0.6747rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
-bbot-2.5.0.6747rc0.dist-info/RECORD,,
+bbot-2.5.0.6765rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
+bbot-2.5.0.6765rc0.dist-info/METADATA,sha256=TE4UX4SAN8on8fP6_s0fl0zErdTm1Nsr9lcajwTe8l8,18308
+bbot-2.5.0.6765rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+bbot-2.5.0.6765rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
+bbot-2.5.0.6765rc0.dist-info/RECORD,,