bbot 2.7.1.7175rc0__tar.gz → 2.7.1.7198rc0__tar.gz

{bbot-2.7.1.7175rc0 → bbot-2.7.1.7198rc0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bbot
-Version: 2.7.1.7175rc0
+Version: 2.7.1.7198rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 License-File: LICENSE

{bbot-2.7.1.7175rc0 → bbot-2.7.1.7198rc0}/bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.7.1.7175rc"
+__version__ = "v2.7.1.7198rc"
 
 from .scanner import Scanner, Preset
 

{bbot-2.7.1.7175rc0 → bbot-2.7.1.7198rc0}/bbot/modules/emailformat.py

@@ -15,13 +15,29 @@ class emailformat(BaseModule):
 
     base_url = "https://www.email-format.com"
 
+    async def setup(self):
+        self.cfemail_regex = self.helpers.re.compile(r'data-cfemail="([0-9a-z]+)"')
+        return True
+
     async def handle_event(self, event):
         _, query = self.helpers.split_domain(event.data)
         url = f"{self.base_url}/d/{self.helpers.quote(query)}/"
         r = await self.api_request(url)
         if not r:
             return
-        for email in await self.helpers.re.extract_emails(r.text):
+
+        encrypted_emails = await self.helpers.re.findall(self.cfemail_regex, r.text)
+
+        for enc in encrypted_emails:
+            enc_len = len(enc)
+
+            if enc_len < 2 or enc_len % 2 != 0:
+                continue
+
+            key = int(enc[:2], 16)
+
+            email = "".join([chr(int(enc[i : i + 2], 16) ^ key) for i in range(2, enc_len, 2)]).lower()
+
             if email.endswith(query):
                 await self.emit_event(
                     email,

{bbot-2.7.1.7175rc0 → bbot-2.7.1.7198rc0}/bbot/test/test_step_2/module_tests/test_module_emailformat.py

@@ -5,7 +5,7 @@ class TestEmailFormat(ModuleTestBase):
     async def setup_before_prep(self, module_test):
         module_test.httpx_mock.add_response(
             url="https://www.email-format.com/d/blacklanternsecurity.com/",
-            text="<p>info@blacklanternsecurity.com</a>",
+            text="""<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="0a63646c654a68666b6961666b647e6f7864796f697f78637e7324696567">[email&#160;protected]</a>""",
         )
 
     def check(self, module_test, events):

{bbot-2.7.1.7175rc0 → bbot-2.7.1.7198rc0}/bbot/test/test_step_2/module_tests/test_module_emails.py

@@ -1,13 +1,13 @@
 from .base import ModuleTestBase
 
 
-class TestEmais(ModuleTestBase):
+class TestEmails(ModuleTestBase):
     modules_overrides = ["emails", "emailformat", "skymem"]
 
     async def setup_before_prep(self, module_test):
         module_test.httpx_mock.add_response(
             url="https://www.email-format.com/d/blacklanternsecurity.com/",
-            text="<p>info@blacklanternsecurity.com</p>",
+            text="""<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="0a63646c654a68666b6961666b647e6f7864796f697f78637e7324696567">[email&#160;protected]</a>""",
         )
         module_test.httpx_mock.add_response(
             url="https://www.skymem.info/srch?q=blacklanternsecurity.com",

{bbot-2.7.1.7175rc0 → bbot-2.7.1.7198rc0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "bbot"
-version = "v2.7.1.7175rc"
+version = "v2.7.1.7198rc"
 description = "OSINT automation for hackers."
 authors = [
     "TheTechromancer",
@@ -75,7 +75,7 @@ uvicorn = ">=0.32,<0.36"
 fastapi = ">=0.115.5,<0.118.0"
 pytest-httpx = ">=0.35"
 pytest-benchmark = ">=4,<6"
-ruff = "0.13.3"
+ruff = "0.14.0"
 
 [tool.poetry.group.docs.dependencies]
 mkdocs = "^1.5.2"

bbot-2.7.1.7175rc0/bbot/modules/censys.py

@@ -1,98 +0,0 @@
-from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
-
-
-class censys(subdomain_enum_apikey):
-    """
-    thanks to https://github.com/owasp-amass/amass/blob/master/resources/scripts/cert/censys.ads
-    """
-
-    watched_events = ["DNS_NAME"]
-    produced_events = ["DNS_NAME"]
-    flags = ["subdomain-enum", "passive", "safe"]
-    meta = {
-        "description": "Query the Censys API",
-        "created_date": "2022-08-04",
-        "author": "@TheTechromancer",
-        "auth_required": True,
-    }
-    options = {"api_key": "", "max_pages": 5}
-    options_desc = {
-        "api_key": "Censys.io API Key in the format of 'key:secret'",
-        "max_pages": "Maximum number of pages to fetch (100 results per page)",
-    }
-
-    base_url = "https://search.censys.io/api"
-
-    async def setup(self):
-        self.max_pages = self.config.get("max_pages", 5)
-        return await super().setup()
-
-    async def ping(self):
-        url = f"{self.base_url}/v1/account"
-        resp = await self.api_request(url, retry_on_http_429=False)
-        d = resp.json()
-        assert isinstance(d, dict), f"Invalid response from {url}: {resp}"
-        quota = d.get("quota", {})
-        used = int(quota.get("used", 0))
-        allowance = int(quota.get("allowance", 0))
-        assert used < allowance, "No quota remaining"
-
-    def prepare_api_request(self, url, kwargs):
-        api_id, api_secret = self.api_key.split(":", 1)
-        kwargs["auth"] = (api_id, api_secret)
-        return url, kwargs
-
-    async def query(self, query):
-        results = set()
-        cursor = ""
-        for i in range(self.max_pages):
-            url = f"{self.base_url}/v2/certificates/search"
-            json_data = {
-                "q": f"names: {query}",
-                "per_page": 100,
-            }
-            if cursor:
-                json_data.update({"cursor": cursor})
-            resp = await self.api_request(
-                url,
-                method="POST",
-                json=json_data,
-            )
-
-            if resp is None:
-                break
-
-            try:
-                d = resp.json()
-            except Exception as e:
-                self.warning(f"Failed to parse JSON from {url} (response: {resp}): {e}")
-
-            if resp.status_code < 200 or resp.status_code >= 400:
-                if isinstance(d, dict):
-                    error = d.get("error", "")
-                    if error:
-                        self.warning(error)
-                self.verbose(f'Non-200 Status code: {resp.status_code} for query "{query}", page #{i + 1}')
-                self.debug(f"Response: {resp.text}")
-                break
-            else:
-                if d is None:
-                    break
-                elif not isinstance(d, dict):
-                    break
-                status = d.get("status", "").lower()
-                result = d.get("result", {})
-                hits = result.get("hits", [])
-                if status != "ok" or not hits:
-                    break
-
-                for h in hits:
-                    names = h.get("names", [])
-                    for n in names:
-                        results.add(n.strip(".*").lower())
-
-                cursor = result.get("links", {}).get("next", "")
-                if not cursor:
-                    break
-
-        return results

bbot-2.7.1.7175rc0/bbot/modules/zoomeye.py

@@ -1,77 +0,0 @@
-from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
-
-
-class zoomeye(subdomain_enum_apikey):
-    watched_events = ["DNS_NAME"]
-    produced_events = ["DNS_NAME"]
-    flags = ["affiliates", "subdomain-enum", "passive", "safe"]
-    meta = {
-        "description": "Query ZoomEye's API for subdomains",
-        "created_date": "2022-08-03",
-        "author": "@TheTechromancer",
-        "auth_required": True,
-    }
-    options = {"api_key": "", "max_pages": 20, "include_related": False}
-    options_desc = {
-        "api_key": "ZoomEye API key",
-        "max_pages": "How many pages of results to fetch",
-        "include_related": "Include domains which may be related to the target",
-    }
-
-    base_url = "https://api.zoomeye.hk"
-
-    async def setup(self):
-        self.max_pages = self.config.get("max_pages", 20)
-        self.include_related = self.config.get("include_related", False)
-        return await super().setup()
-
-    def prepare_api_request(self, url, kwargs):
-        kwargs["headers"]["API-KEY"] = self.api_key
-        return url, kwargs
-
-    async def ping(self):
-        url = f"{self.base_url}/resources-info"
-        r = await self.api_request(url, retry_on_http_429=False)
-        assert int(r.json()["quota_info"]["remain_total_quota"]) > 0, "No quota remaining"
-
-    async def handle_event(self, event):
-        query = self.make_query(event)
-        results = await self.query(query)
-        if results:
-            for hostname in results:
-                if hostname == event:
-                    continue
-                tags = []
-                if not hostname.endswith(f".{query}"):
-                    tags = ["affiliate"]
-                await self.emit_event(
-                    hostname,
-                    "DNS_NAME",
-                    event,
-                    tags=tags,
-                    context=f'{{module}} searched ZoomEye API for "{query}" and found {{event.type}}: {{event.data}}',
-                )
-
-    async def query(self, query):
-        results = set()
-        query_type = 0 if self.include_related else 1
-        url = f"{self.base_url}/domain/search?q={self.helpers.quote(query)}&type={query_type}&page=" + "{page}"
-        i = 0
-        agen = self.api_page_iter(url)
-        try:
-            async for j in agen:
-                r = list(await self.parse_results(j))
-                if r:
-                    results.update(set(r))
-                if not r or i >= (self.max_pages - 1):
-                    break
-                i += 1
-        finally:
-            await agen.aclose()
-        return results
-
-    async def parse_results(self, r):
-        results = set()
-        for entry in r.get("list", []):
-            results.add(entry["name"])
-        return results

bbot-2.7.1.7175rc0/bbot/test/test_step_2/module_tests/test_module_censys.py

@@ -1,83 +0,0 @@
-from .base import ModuleTestBase
-
-
-class TestCensys(ModuleTestBase):
-    config_overrides = {"modules": {"censys": {"api_key": "api_id:api_secret"}}}
-
-    async def setup_before_prep(self, module_test):
-        module_test.httpx_mock.add_response(
-            url="https://search.censys.io/api/v1/account",
-            match_headers={"Authorization": "Basic YXBpX2lkOmFwaV9zZWNyZXQ="},
-            json={
-                "email": "info@blacklanternsecurity.com",
-                "login": "nope",
-                "first_login": "1917-08-03 20:03:55",
-                "last_login": "1918-05-19 01:15:22",
-                "quota": {"used": 26, "allowance": 250, "resets_at": "1919-06-03 16:30:32"},
-            },
-        )
-        module_test.httpx_mock.add_response(
-            url="https://search.censys.io/api/v2/certificates/search",
-            match_headers={"Authorization": "Basic YXBpX2lkOmFwaV9zZWNyZXQ="},
-            method="POST",
-            match_json={"q": "names: blacklanternsecurity.com", "per_page": 100},
-            json={
-                "code": 200,
-                "status": "OK",
-                "result": {
-                    "query": "names: blacklanternsecurity.com",
-                    "total": 196,
-                    "duration_ms": 1046,
-                    "hits": [
-                        {
-                            "parsed": {
-                                "validity_period": {
-                                    "not_before": "2021-11-18T00:09:46Z",
-                                    "not_after": "2022-11-18T00:09:46Z",
-                                },
-                                "issuer_dn": "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com\\, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2",
-                                "subject_dn": "CN=asdf.blacklanternsecurity.com",
-                            },
-                            "fingerprint_sha256": "590ad51b8db62925f0fd3f300264c6a36692e20ceec2b5a22e7e4b41c1575cdc",
-                            "names": ["asdf.blacklanternsecurity.com", "asdf2.blacklanternsecurity.com"],
-                        },
-                    ],
-                    "links": {"next": "NextToken", "prev": ""},
-                },
-            },
-        )
-        module_test.httpx_mock.add_response(
-            url="https://search.censys.io/api/v2/certificates/search",
-            match_headers={"Authorization": "Basic YXBpX2lkOmFwaV9zZWNyZXQ="},
-            method="POST",
-            match_json={"q": "names: blacklanternsecurity.com", "per_page": 100, "cursor": "NextToken"},
-            json={
-                "code": 200,
-                "status": "OK",
-                "result": {
-                    "query": "names: blacklanternsecurity.com",
-                    "total": 196,
-                    "duration_ms": 1046,
-                    "hits": [
-                        {
-                            "parsed": {
-                                "validity_period": {
-                                    "not_before": "2021-11-18T00:09:46Z",
-                                    "not_after": "2022-11-18T00:09:46Z",
-                                },
-                                "issuer_dn": "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com\\, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2",
-                                "subject_dn": "CN=zzzz.blacklanternsecurity.com",
-                            },
-                            "fingerprint_sha256": "590ad51b8db62925f0fd3f300264c6a36692e20ceec2b5a22e7e4b41c1575cdc",
-                            "names": ["zzzz.blacklanternsecurity.com"],
-                        },
-                    ],
-                    "links": {"next": "", "prev": ""},
-                },
-            },
-        )
-
-    def check(self, module_test, events):
-        assert any(e.data == "asdf.blacklanternsecurity.com" for e in events), "Failed to detect asdf subdomain"
-        assert any(e.data == "asdf2.blacklanternsecurity.com" for e in events), "Failed to detect asdf2 subdomain"
-        assert any(e.data == "zzzz.blacklanternsecurity.com" for e in events), "Failed to detect zzzz subdomain"

bbot-2.7.1.7175rc0/bbot/test/test_step_2/module_tests/test_module_zoomeye.py

@@ -1,35 +0,0 @@
-from .base import ModuleTestBase
-
-
-class TestZoomEye(ModuleTestBase):
-    config_overrides = {"modules": {"zoomeye": {"api_key": "asdf", "include_related": True, "max_pages": 3}}}
-
-    async def setup_before_prep(self, module_test):
-        module_test.httpx_mock.add_response(
-            url="https://api.zoomeye.hk/resources-info",
-            match_headers={"API-KEY": "asdf"},
-            json={"quota_info": {"remain_total_quota": 5}},
-        )
-        module_test.httpx_mock.add_response(
-            url="https://api.zoomeye.hk/domain/search?q=blacklanternsecurity.com&type=0&page=1",
-            json={"list": [{"name": "asdf.blacklanternsecurity.com"}]},
-        )
-        module_test.httpx_mock.add_response(
-            url="https://api.zoomeye.hk/domain/search?q=blacklanternsecurity.com&type=0&page=2",
-            json={"list": [{"name": "zzzz.blacklanternsecurity.com"}]},
-        )
-        module_test.httpx_mock.add_response(
-            url="https://api.zoomeye.hk/domain/search?q=blacklanternsecurity.com&type=0&page=3",
-            json={"list": [{"name": "ffff.blacklanternsecurity.com"}, {"name": "affiliate.bls"}]},
-        )
-        module_test.httpx_mock.add_response(
-            url="https://api.zoomeye.hk/domain/search?q=blacklanternsecurity.com&type=0&page=4",
-            json={"list": [{"name": "nope.blacklanternsecurity.com"}]},
-        )
-
-    def check(self, module_test, events):
-        assert any(e.data == "asdf.blacklanternsecurity.com" for e in events), "Failed to detect subdomain #1"
-        assert any(e.data == "zzzz.blacklanternsecurity.com" for e in events), "Failed to detect subdomain #2"
-        assert any(e.data == "ffff.blacklanternsecurity.com" for e in events), "Failed to detect subdomain #3"
-        assert any(e.data == "affiliate.bls" and "affiliate" in e.tags for e in events), "Failed to detect affiliate"
-        assert not any(e.data == "nope.blacklanternsecurity.com" for e in events), "Failed to obey max_pages"