bbot 2.6.0.6856rc0__py3-none-any.whl → 2.6.0.6879rc0__py3-none-any.whl

bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.6.0.6856rc"
+__version__ = "v2.6.0.6879rc"
 
 from .scanner import Scanner, Preset
 

bbot/core/helpers/misc.py

@@ -216,26 +216,29 @@ def split_host_port(d):
     host = None
     port = None
     scheme = None
+
+    # first, try to parse as an IP address
     if is_ip(d):
         return make_ip_type(d), port
 
+    # if not an IP address, try to parse as a host:port
     match = bbot_regexes.split_host_port_regex.match(d)
     if match is None:
-        raise ValueError(f'split_port() failed to parse "{d}"')
+        raise ValueError(f'split_host_port() failed to parse "{d}"')
     scheme = match.group("scheme")
     netloc = match.group("netloc")
     if netloc is None:
-        raise ValueError(f'split_port() failed to parse "{d}"')
+        raise ValueError(f'split_host_port() failed to parse "{d}"')
 
     match = bbot_regexes.extract_open_port_regex.match(netloc)
     if match is None:
-        raise ValueError(f'split_port() failed to parse netloc "{netloc}" (original value: {d})')
+        raise ValueError(f'split_host_port() failed to parse netloc "{netloc}" (original value: {d})')
 
     host = match.group(2)
     if host is None:
         host = match.group(1)
     if host is None:
-        raise ValueError(f'split_port() failed to locate host in netloc "{netloc}" (original value: {d})')
+        raise ValueError(f'split_host_port() failed to locate host in netloc "{netloc}" (original value: {d})')
 
     port = match.group(3)
     if port is None and scheme is not None:

bbot/core/helpers/regexes.py

@@ -23,13 +23,28 @@ num_regex = re.compile(r"\d+")
 _ipv4_regex = r"(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}"
 ipv4_regex = re.compile(_ipv4_regex, re.I)
 
-# IPv6 is complicated, so we have accommodate alternative patterns,
-# :(:[A-F0-9]{1,4}){1,7} == ::1, ::ffff:1
-# ([A-F0-9]{1,4}:){1,7}: == 2001::, 2001:db8::, 2001:db8:0:1:2:3::
-# ([A-F0-9]{1,4}:){1,6}:([A-F0-9]{1,4}) == 2001::1, 2001:db8::1, 2001:db8:0:1:2:3::1
-# ([A-F0-9]{1,4}:){7,7}([A-F0-9]{1,4}) == 1:1:1:1:1:1:1:1, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-
-_ipv6_regex = r"(:(:[A-F0-9]{1,4}){1,7}|([A-F0-9]{1,4}:){1,7}:|([A-F0-9]{1,4}:){1,6}:([A-F0-9]{1,4})|([A-F0-9]{1,4}:){7,7}([A-F0-9]{1,4}))"
+# IPv6 regex breakdown:
+#
+# (?:                            # —— address body ——
+# We have to individually account for all possible variations of: "N left hextets :: M right hextets" with N+M ≤ 8 or fully expanded 8 hextets.
+#   (?:[A-F0-9]{1,4}:){7}[A-F0-9]{1,4}        # 8 hextets, no compression.
+# | (?:[A-F0-9]{1,4}:){1,7}:                  # 1–7 left, then "::" (0 right).
+# | (?:[A-F0-9]{1,4}:){1,6}:[A-F0-9]{1,4}     # 1–6 left, "::", 1 right.
+# | (?:[A-F0-9]{1,4}:){1,5}(?::[A-F0-9]{1,4}){1,2}  # 1–5 left, "::", 1–2 right.
+# | (?:[A-F0-9]{1,4}:){1,4}(?::[A-F0-9]{1,4}){1,3}  # 1–4 left, "::", 1–3 right.
+# | (?:[A-F0-9]{1,4}:){1,3}(?::[A-F0-9]{1,4}){1,4}  # 1–3 left, "::", 1–4 right.
+# | (?:[A-F0-9]{1,4}:){1,2}(?::[A-F0-9]{1,4}){1,5}  # 1–2 left, "::", 1–5 right.
+# | [A-F0-9]{1,4}:(?::[A-F0-9]{1,4}){1,6}           # 1 left,    "::", 1–6 right.
+# | :(?::[A-F0-9]{1,4}){1,7}                        # 0 left,    "::", 1–7 right.
+# | ::                                              # all zeros.
+# )
+#
+# Notes:
+# - Does not match IPv4-embedded forms (e.g., ::ffff:192.0.2.1).
+# - Does not match zone IDs (e.g., %eth0).
+# - Pure syntax check; will not validate special ranges.
+
+_ipv6_regex = r"(?:(?:[A-F0-9]{1,4}:){7}[A-F0-9]{1,4}|(?:[A-F0-9]{1,4}:){1,7}:|(?:[A-F0-9]{1,4}:){1,6}:[A-F0-9]{1,4}|(?:[A-F0-9]{1,4}:){1,5}(?::[A-F0-9]{1,4}){1,2}|(?:[A-F0-9]{1,4}:){1,4}(?::[A-F0-9]{1,4}){1,3}|(?:[A-F0-9]{1,4}:){1,3}(?::[A-F0-9]{1,4}){1,4}|(?:[A-F0-9]{1,4}:){1,2}(?::[A-F0-9]{1,4}){1,5}|[A-F0-9]{1,4}:(?::[A-F0-9]{1,4}){1,6}|:(?::[A-F0-9]{1,4}){1,7}|::)"
 ipv6_regex = re.compile(_ipv6_regex, re.I)
 
 _ip_range_regexes = (
@@ -173,7 +188,9 @@ button_tag_regex2 = re.compile(
 )
 tag_attribute_regex = re.compile(r"<[^>]*(?:href|action|src)\s*=\s*[\"\']?(?!mailto:)([^\'\"\>]+)[\"\']?[^>]*>")
 
-valid_netloc = r"[^\s!@#$%^&()=/?\\'\";~`<>]+"
+_invalid_netloc_chars = r"\s!@#$%^&()=/?\\'\";~`<>"
+# first char must not be a colon, even though it's a valid char for a netloc
+valid_netloc = r"[^" + (_invalid_netloc_chars + ":") + r"]{1}[^" + _invalid_netloc_chars + "]*"
 
 _split_host_port_regex = r"(?:(?P<scheme>[a-z0-9]{1,20})://)?(?:[^?]*@)?(?P<netloc>" + valid_netloc + ")"
 split_host_port_regex = re.compile(_split_host_port_regex, re.I)

bbot/test/test_step_1/test_helpers.py

@@ -155,6 +155,7 @@ async def test_helpers_misc(helpers, scan, bbot_scanner, bbot_httpserver):
     assert helpers.extract_host("https://[dead::beef]:22?a=b") == ("dead::beef", "https://[", "]:22?a=b")
     assert helpers.extract_host("https://[dead::beef]/?a=b") == ("dead::beef", "https://[", "]/?a=b")
     assert helpers.extract_host("https://[dead::beef]?a=b") == ("dead::beef", "https://[", "]?a=b")
+    assert helpers.extract_host("https://[::1]") == ("::1", "https://[", "]")
     assert helpers.extract_host("ftp://username:password@my-ftp.com/my-file.csv") == (
         "my-ftp.com",
         "ftp://username:password@",

bbot/test/test_step_1/test_regexes.py

@@ -6,9 +6,6 @@ from bbot.core.helpers import regexes
 from bbot.errors import ValidationError
 from bbot.core.event.helpers import EventSeed
 
-# NOTE: :2001:db8:: will currently cause an exception...
-# e.g. raised unknown error: split_port() failed to parse netloc ":2001:db8::"
-
 
 def test_ip_regexes():
     bad_ip = [
@@ -23,6 +20,15 @@ def test_ip_regexes():
         "2001:db8:g::",  # includes non-hex character,
         "2001.db8.80",  # weird dot separated thing that might actually resolve as a DNS_NAME
         "9e:3e:53:29:43:64",  # MAC address, poor regex patterning will often detect these.
+        "2001:db8:1:2:3:4:5",  # only 7 groups, no zero-compression
+        "2001:db8:1:2:3:4:5:6:7",  # too many groups
+        "2001:db8::1::1",  # multiple ::
+        "2001:db8::zzzz",  # non-hex character
+        "2001:db8::12345",  # hex value too long
+        ":2001:db8::1",  # starts with :
+        ":2001:db8::",  # starts with :
+        "cafe:80",  # looks like open port
+        "12:34:56:78:9A:BC",  # mac address
     ]
 
     good_ip = [
@@ -46,6 +52,17 @@ def test_ip_regexes():
         "1::1",
         "ffff::ffff",
         "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
+        "2001:db8::ff00:42:8329",
+        "2001:0db8:0000:0000:0000:0000:0000:0001",
+        "2001:db8:0:0:0:0:0:1",
+        "2001:db8::1",
+        "2001:db8::dead:beef",
+        "2001:db8:1:2:3:4:5:6",
+        "2001:db8:1:2:3:4:5:ffff",
+        "::",
+        "::ffff",
+        "::dead:beef",
+        "::DEAD:BEEF",
     ]
 
     ip_address_regexes = regexes.event_type_regexes["IP_ADDRESS"]
@@ -61,7 +78,7 @@ def test_ip_regexes():
                 if ip.startswith("["):
                     assert ip == "[2001:db8::]:80"
                 else:
-                    assert ip == "203.0.113.0:80"
+                    assert ip in ("cafe:80", "203.0.113.0:80")
                 continue
             if event_type == "DNS_NAME":
                 if ip.startswith("2001"):

{bbot-2.6.0.6856rc0.dist-info → bbot-2.6.0.6879rc0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.6.0.6856rc0
+Version: 2.6.0.6879rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.6.0.6856rc0.dist-info → bbot-2.6.0.6879rc0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-bbot/__init__.py,sha256=o-b4P_7LI1NPD0_Y6JpdYZ3zLkdrqs5vxGWG8lQWqoE,163
+bbot/__init__.py,sha256=0zLArYXvP2IYuEdyudSmse_PpwWOH8rmqpQc9oijqpY,163
 bbot/cli.py,sha256=1QJbANVw9Q3GFM92H2QRV2ds5756ulm08CDZwzwPpeI,11888
 bbot/core/__init__.py,sha256=l255GJE_DvUnWvrRb0J5lG-iMztJ8zVvoweDOfegGtI,46
 bbot/core/config/__init__.py,sha256=zYNw2Me6tsEr8hOOkLb4BQ97GB7Kis2k--G81S8vofU,342
@@ -29,13 +29,13 @@ bbot/core/helpers/files.py,sha256=9tVr3973QvX8l6o3TweD5_MCZiQpuJVffbzW0U7Z30U,57
 bbot/core/helpers/helper.py,sha256=u-q_Ka9pY1atvC-FChxYpURM7b3_0gaCNIHSG__Wi74,8538
 bbot/core/helpers/interactsh.py,sha256=VBYYH6-rWBofRsgemndK6iZNmyifOps8vgQOw2mac4k,12624
 bbot/core/helpers/libmagic.py,sha256=QMHyxjgDLb2jyjBvK1MQ-xt6WkGXhKcHu9ZP1li-sik,3460
-bbot/core/helpers/misc.py,sha256=1bib2ECQdPuw8aylGH0x616Nv6yDthjycApGUsyuyI8,88915
+bbot/core/helpers/misc.py,sha256=kQzxGBvD87nyEIXiT8JjIpPh5KKC_rKyHrOVoPG14cw,89035
 bbot/core/helpers/names_generator.py,sha256=zmo4MyuOnAYjiUDiORhq9T9bHmA_gW72Y2kHMAqVENU,10594
 bbot/core/helpers/ntlm.py,sha256=P2Xj4-GPos2iAzw4dfk0FJp6oGyycGhu2x6sLDVjYjs,2573
 bbot/core/helpers/process.py,sha256=00uRpLMFi3Pt3uT8qXwAIhsXdoa7h-ifoXh0sGYgwqs,1702
 bbot/core/helpers/ratelimiter.py,sha256=fQp5mKfqfCkDkZzgntDu4NWlRsWSMCto0V8vaV8-34k,2115
 bbot/core/helpers/regex.py,sha256=02gRS9DZjGfyuc16SsC9vSweBy6ATV3cz23LZMLgjoo,4578
-bbot/core/helpers/regexes.py,sha256=6VLUvcZfDlXInVcsIXQkC_hfqIOmvw5m--vkj3hkSss,7503
+bbot/core/helpers/regexes.py,sha256=8bPyUKQJZ6Oor5wuJ4n4VJ0R8zPDrOAIdZ4GRU57OMA,8771
 bbot/core/helpers/url.py,sha256=eunp4PNNulhitjDpl9tXJkgbTmLgGXmPaGAEaExRqTY,6352
 bbot/core/helpers/validators.py,sha256=-WBYvjlwi5SsVtn_LankKGI8vaBza2NqvM1lGbVmiN4,9711
 bbot/core/helpers/web/__init__.py,sha256=tSDInpfUIj9Gi0m4Icwbrx21uc6Jj1-keE7SIfO9g20,35
@@ -282,13 +282,13 @@ bbot/test/test_step_1/test_engine.py,sha256=3HkCPtYhUxiZzfA-BRHpLsyaRj9wIXKbb49B
 bbot/test/test_step_1/test_event_seeds.py,sha256=s_0BRqkahX4MYYqkmPqgcCsFrMbiXdTfLuKqNU2jkEU,6652
 bbot/test/test_step_1/test_events.py,sha256=Evm_rw5Y6W3H6eAGTlNcSWGALVo9PpKi_Rs80trPuXE,54312
 bbot/test/test_step_1/test_files.py,sha256=5Q_3jPpMXULxDHsanSDUaj8zF8bXzKdiJZHOmoYpLhQ,699
-bbot/test/test_step_1/test_helpers.py,sha256=RoX7wQiQ2zoIF4z1NprdilMAQTBKzg47jtO010tK53o,40203
+bbot/test/test_step_1/test_helpers.py,sha256=7GP6-95yWRBGhx0-p6N7zZVEDcF9EO9wc0rkhs1JDsg,40281
 bbot/test/test_step_1/test_manager_deduplication.py,sha256=hZQpDXzg6zvzxFolVOcJuY-ME8NXjZUsqS70BRNXp8A,15594
 bbot/test/test_step_1/test_manager_scope_accuracy.py,sha256=JV1bQHt9EIM0GmGS4T4Brz_L2lfcwTxtNC06cfv7r64,79763
 bbot/test/test_step_1/test_modules_basic.py,sha256=ELpGlsthSq8HaxB5My8-ESVHqMxqdL5Of0STMIyaWzA,20001
 bbot/test/test_step_1/test_presets.py,sha256=HnJhKwDnVh9Y6adgxqe85677rWpnFil_WS5GjX21ZvM,40959
 bbot/test/test_step_1/test_python_api.py,sha256=Fk5bxEsPSjsMZ_CcRMTJft8I48EizwHJivG9Fy4jIu0,5502
-bbot/test/test_step_1/test_regexes.py,sha256=wSx_e6hgHuBh95igL_fauWKK4a1xXujs9TtyLBaMwRM,14636
+bbot/test/test_step_1/test_regexes.py,sha256=GEJE4NY6ge0WnG3BcFgRiT78ksy2xpFk6UdS9vGQMPs,15254
 bbot/test/test_step_1/test_scan.py,sha256=vnUF646MinLTdRAD_AwZ5sAqq6gmoHV7WlgNp5sjc_M,10875
 bbot/test/test_step_1/test_scope.py,sha256=S2nssENKJKCvgXUMyU8MFQmXHeUIz0C_sbWGkdYti2A,3063
 bbot/test/test_step_1/test_target.py,sha256=4Xz6Fns_6wa2O3AXDBvd7W04LCfZSCiit2lezQJicTI,19472
@@ -453,8 +453,8 @@ bbot/wordlists/raft-small-extensions-lowercase_CLEANED.txt,sha256=ZSIVebs7ptMvHx
 bbot/wordlists/top_open_ports_nmap.txt,sha256=LmdFYkfapSxn1pVuQC2LkOIY2hMLgG-Xts7DVtYzweM,42727
 bbot/wordlists/valid_url_schemes.txt,sha256=0B_VAr9Dv7aYhwi6JSBDU-3M76vNtzN0qEC_RNLo7HE,3310
 bbot/wordlists/wordninja_dns.txt.gz,sha256=DYHvvfW0TvzrVwyprqODAk4tGOxv5ezNmCPSdPuDUnQ,570241
-bbot-2.6.0.6856rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
-bbot-2.6.0.6856rc0.dist-info/METADATA,sha256=oMvTVaagbYVmlMc5wab2JvCljUkJyNLhHrUnzYJeTbc,18308
-bbot-2.6.0.6856rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-bbot-2.6.0.6856rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
-bbot-2.6.0.6856rc0.dist-info/RECORD,,
+bbot-2.6.0.6879rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
+bbot-2.6.0.6879rc0.dist-info/METADATA,sha256=SXUifolZS0-aYkrdnMuC1pRGhEvZ6oR-GwVsZqMd0j4,18308
+bbot-2.6.0.6879rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+bbot-2.6.0.6879rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
+bbot-2.6.0.6879rc0.dist-info/RECORD,,