bbot 2.5.0.6782rc0__tar.gz → 2.5.0.6803rc0__tar.gz

{bbot-2.5.0.6782rc0 → bbot-2.5.0.6803rc0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.5.0.6782rc0
+Version: 2.5.0.6803rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.5.0.6782rc0 → bbot-2.5.0.6803rc0}/bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.5.0.6782rc"
+__version__ = "v2.5.0.6803rc"
 
 from .scanner import Scanner, Preset
 

{bbot-2.5.0.6782rc0 → bbot-2.5.0.6803rc0}/bbot/core/helpers/depsinstaller/installer.py

@@ -32,6 +32,20 @@ class DepsInstaller:
         "bash": "bash",
         "which": "which",
         "tar": "tar",
+        "xz": [
+            {
+                "name": "Install xz-utils (Debian)",
+                "package": {"name": ["xz-utils"], "state": "present"},
+                "become": True,
+                "when": "ansible_facts['os_family'] == 'Debian'",
+            },
+            {
+                "name": "Install xz (Non-Debian)",
+                "package": {"name": ["xz"], "state": "present"},
+                "become": True,
+                "when": "ansible_facts['os_family'] != 'Debian'",
+            },
+        ],
         # debian why are you like this
         "7z": [
             {
@@ -53,6 +67,44 @@ class DepsInstaller:
                 "when": "ansible_facts['distribution'] == 'Fedora'",
             },
         ],
+        # to compile just about any tool, we need the openssl dev headers
+        "openssl": [
+            {
+                "name": "Install OpenSSL library and development headers (Debian/Ubuntu)",
+                "package": {"name": ["libssl-dev", "openssl"], "state": "present"},
+                "become": True,
+                "when": "ansible_facts['os_family'] == 'Debian'",
+                "ignore_errors": True,
+            },
+            {
+                "name": "Install OpenSSL library and development headers (RedHat/CentOS/Fedora)",
+                "package": {"name": ["openssl", "openssl-devel"], "state": "present"},
+                "become": True,
+                "when": "ansible_facts['os_family'] == 'RedHat' or ansible_facts['os_family'] == 'Suse' ",
+                "ignore_errors": True,
+            },
+            {
+                "name": "Install OpenSSL library and development headers (Arch)",
+                "package": {"name": ["openssl"], "state": "present"},
+                "become": True,
+                "when": "ansible_facts['os_family'] == 'Archlinux'",
+                "ignore_errors": True,
+            },
+            {
+                "name": "Install OpenSSL library and development headers (Alpine)",
+                "package": {"name": ["openssl", "openssl-dev"], "state": "present"},
+                "become": True,
+                "when": "ansible_facts['os_family'] == 'Alpine'",
+                "ignore_errors": True,
+            },
+            {
+                "name": "Install OpenSSL library and development headers (FreeBSD)",
+                "package": {"name": ["openssl"], "state": "present"},
+                "become": True,
+                "when": "ansible_facts['os_family'] == 'FreeBSD'",
+                "ignore_errors": True,
+            },
+        ],
     }
 
     def __init__(self, parent_helper):

{bbot-2.5.0.6782rc0 → bbot-2.5.0.6803rc0}/bbot/core/helpers/misc.py

@@ -831,7 +831,9 @@ def rand_string(length=10, digits=True, numeric_only=False):
     return "".join(random.choice(pool) for _ in range(length))
 
 
-def truncate_string(s, n):
+def truncate_string(s: str, n: int) -> str:
+    if not isinstance(s, str):
+        raise ValueError(f"Expected string, got {type(s)}")
     if len(s) > n:
         return s[: n - 3] + "..."
     else:

{bbot-2.5.0.6782rc0 → bbot-2.5.0.6803rc0}/bbot/core/helpers/web/engine.py

@@ -208,7 +208,7 @@ class HTTPEngine(EngineServer):
                 raise
             else:
                 log.warning(
-                    f"Invalid URL (possibly due to dangerous redirect) on request to : {url}: {truncate_string(e, 200)}"
+                    f"Invalid URL (possibly due to dangerous redirect) on request to : {url}: {truncate_string(str(e), 200)}"
                 )
                 log.trace(traceback.format_exc())
         except ssl.SSLError as e:

bbot-2.5.0.6803rc0/bbot/modules/graphql_introspection.py

@@ -0,0 +1,142 @@
+import json
+from pathlib import Path
+from bbot.modules.base import BaseModule
+
+
+class graphql_introspection(BaseModule):
+    watched_events = ["URL"]
+    produced_events = ["FINDING"]
+    flags = ["safe", "active", "web-basic"]
+    meta = {
+        "description": "Perform GraphQL introspection on a target",
+        "created_date": "2025-07-01",
+        "author": "@mukesh-dream11",
+    }
+    options = {
+        "graphql_endpoint_urls": ["/", "/graphql", "/v1/graphql"],
+        "output_folder": "",
+    }
+    options_desc = {
+        "graphql_endpoint_urls": "List of GraphQL endpoint to suffix to the target URL",
+        "output_folder": "Folder to save the GraphQL schemas to",
+    }
+
+    async def setup(self):
+        output_folder = self.config.get("output_folder", "")
+        if output_folder:
+            self.output_dir = Path(output_folder) / "graphql-schemas"
+        else:
+            self.output_dir = self.scan.home / "graphql-schemas"
+        self.helpers.mkdir(self.output_dir)
+        return True
+
+    async def filter_event(self, event):
+        # Dedup by the base URL
+        base_url = event.parsed_url._replace(path="/", query="", fragment="").geturl()
+        return hash(base_url)
+
+    async def handle_event(self, event):
+        base_url = event.parsed_url._replace(path="/", query="", fragment="").geturl().rstrip("/")
+        for endpoint_url in self.config.get("graphql_endpoint_urls", []):
+            url = f"{base_url}{endpoint_url}"
+            request_args = {
+                "url": url,
+                "method": "POST",
+                "json": {
+                    "query": """\
+query IntrospectionQuery {
+    __schema {
+        queryType {
+            name
+        }
+        mutationType {
+            name
+        }
+        types {
+            name
+            kind
+            description
+            fields(includeDeprecated: true) {
+                name
+                description
+                type {
+                    ... TypeRef
+                }
+                isDeprecated
+                deprecationReason
+            }
+            interfaces {
+                ... TypeRef
+            }
+            possibleTypes {
+                ... TypeRef
+            }
+            enumValues(includeDeprecated: true) {
+                name
+                description
+                isDeprecated
+                deprecationReason
+            }
+            ofType {
+                ... TypeRef
+            }
+        }
+    }
+}
+
+fragment TypeRef on __Type {
+    kind
+    name
+    ofType {
+    kind
+    name
+    ofType {
+        kind
+        name
+        ofType {
+        kind
+        name
+        ofType {
+            kind
+            name
+            ofType {
+            kind
+            name
+            ofType {
+                kind
+                name
+                ofType {
+                kind
+                name
+                }
+            }
+            }
+        }
+        }
+    }
+    }
+}"""
+                },
+            }
+            response = await self.helpers.request(**request_args)
+            if not response or response.status_code != 200:
+                self.debug(f"Failed to get GraphQL schema for {url} (status code {response.status_code})")
+                continue
+            try:
+                response_json = response.json()
+            except json.JSONDecodeError:
+                self.debug(f"Failed to parse JSON for {url}")
+                continue
+            if response_json.get("data", {}).get("__schema", {}).get("types", []):
+                filename = f"schema-{self.helpers.tagify(url)}.json"
+                filename = self.output_dir / filename
+                with open(filename, "w") as f:
+                    json.dump(response_json, f)
+                await self.emit_event(
+                    {"url": url, "description": "GraphQL schema", "path": str(filename.relative_to(self.scan.home))},
+                    "FINDING",
+                    event,
+                    context=f"{{module}} found GraphQL schema at {url}",
+                )
+                # return, because we only want to find one schema per target
+                return

{bbot-2.5.0.6782rc0 → bbot-2.5.0.6803rc0}/bbot/modules/nuclei.py

@@ -282,7 +282,7 @@ class nuclei(BaseModule):
                     else:
                         self.debug("Nuclei result missing one or more required elements, not reporting. JSON: ({j})")
         finally:
-            stats_file.unlink()
+            stats_file.unlink(missing_ok=True)
 
     def log_nuclei_status(self, line):
         if self.silent:

{bbot-2.5.0.6782rc0 → bbot-2.5.0.6803rc0}/bbot/modules/portscan.py

@@ -144,7 +144,7 @@ class portscan(BaseModule):
                                 emitted_hosts.add(host)
         finally:
             for file in (stats_file, target_file):
-                file.unlink()
+                file.unlink(missing_ok=True)
 
     async def make_targets(self, events, scanned_tracker):
         """

{bbot-2.5.0.6782rc0 → bbot-2.5.0.6803rc0}/bbot/modules/trufflehog.py

@@ -14,7 +14,7 @@ class trufflehog(BaseModule):
     }
 
     options = {
-        "version": "3.89.2",
+        "version": "3.90.1",
         "config": "",
         "only_verified": True,
         "concurrency": 8,
@@ -198,7 +198,7 @@ class trufflehog(BaseModule):
 
                     yield (decoder_name, detector_name, raw_result, rawv2_result, verified, source_metadata)
         finally:
-            stats_file.unlink()
+            stats_file.unlink(missing_ok=True)
 
     def log_trufflehog_status(self, path, line):
         try:

bbot-2.5.0.6803rc0/bbot/test/test_step_2/module_tests/test_module_graphql_introspection.py

@@ -0,0 +1,34 @@
+from .base import ModuleTestBase
+
+
+class TestGraphQLIntrospectionNon200(ModuleTestBase):
+    targets = ["http://127.0.0.1:8888"]
+    modules_overrides = ["graphql_introspection"]
+
+    async def setup_after_prep(self, module_test):
+        module_test.set_expect_requests(
+            expect_args={"method": "POST", "uri": "/"},
+            respond_args={"response_data": "ok"},
+        )
+
+    def check(self, module_test, events):
+        assert all(e.type != "FINDING" for e in events), "should have raised 0 events"
+
+
+class TestGraphQLIntrospection(ModuleTestBase):
+    targets = ["http://127.0.0.1:8888"]
+    modules_overrides = ["graphql_introspection"]
+
+    async def setup_after_prep(self, module_test):
+        module_test.set_expect_requests(
+            expect_args={"method": "POST", "uri": "/"},
+            respond_args={
+                "response_data": """{"data": {"__schema": {"types": ["dummy"]}}}""",
+            },
+        )
+
+    def check(self, module_test, events):
+        finding = [e for e in events if e.type == "FINDING"]
+        assert finding, "should have raised 1 FINDING event"
+        assert finding[0].data["url"] == "http://127.0.0.1:8888/"
+        assert finding[0].data["description"] == "GraphQL schema"

{bbot-2.5.0.6782rc0 → bbot-2.5.0.6803rc0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "bbot"
-version = "v2.5.0.6782rc"
+version = "v2.5.0.6803rc"
 description = "OSINT automation for hackers."
 authors = [
     "TheTechromancer",
@@ -73,7 +73,7 @@ pytest-asyncio = "0.25.3"
 uvicorn = ">=0.32,<0.35"
 fastapi = "^0.115.5"
 pytest-httpx = ">=0.35"
-ruff = "0.11.11"
+ruff = "0.12.4"
 
 [tool.poetry.group.docs.dependencies]
 mkdocs = "^1.5.2"