detecti-cli 2.0.0__py3-none-any.whl

detecti/modules/crtsh.py

@@ -0,0 +1,98 @@
+"""Certificate Transparency (crt.sh) Subdomain Enumeration Module."""
+
+from __future__ import annotations
+
+import logging
+import re
+from typing import Any, Dict, List, Optional, Set
+from detecti.config import settings
+from detecti.core.models import Finding, FindingType
+from detecti.modules.base import BaseModule
+
+logger = logging.getLogger("detecti.crtsh")
+
+
+class CrtshModule(BaseModule):
+    """Enumerates subdomains using public Certificate Transparency logs via crt.sh."""
+
+    name: str = "crtsh"
+    description: str = "Certificate Transparency logs subdomain discovery"
+    category: str = "recon"
+
+    # Regex to validate valid domain/subdomain formats
+    DOMAIN_REGEX = re.compile(
+        r"^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$"
+    )
+
+    async def run(
+        self,
+        target: str,
+        context: Optional[Dict[str, Any]] = None,
+    ) -> List[Finding]:
+        """Query crt.sh for domain certificates and extract unique subdomains."""
+        # Clean target and extract registered root domain
+        domain = target.strip().lower()
+        if domain.startswith("http://") or domain.startswith("https://"):
+            domain = domain.split("//")[1].split("/")[0]
+        if ":" in domain:
+            domain = domain.split(":")[0]
+        if "/" in domain:
+            domain = domain.split("/")[0]
+
+        import tldextract
+        ext = tldextract.extract(domain)
+        search_domain = ext.registered_domain if (ext.domain and ext.suffix) else domain
+
+        # crt.sh query format
+        url = f"{settings.crtsh_api_url}/"
+        params = {"q": f"%.{search_domain}", "output": "json"}
+
+        findings: List[Finding] = []
+        discovered_subdomains: Set[str] = set()
+
+        try:
+            data = await self.http_client.get_json(url=url, params=params, timeout=20.0)
+            if not data or not isinstance(data, list):
+                logger.debug(f"No certificate data returned from crt.sh for {domain}")
+                return findings
+
+            for entry in data:
+                name_value = entry.get("name_value", "")
+                if not name_value:
+                    continue
+
+                # An entry may contain multiple names separated by newlines
+                names = name_value.split("\n")
+                for name in names:
+                    clean_name = name.strip().lower()
+                    # Strip leading wildcard *.
+                    if clean_name.startswith("*."):
+                        clean_name = clean_name[2:]
+
+                    if (
+                        clean_name
+                        and clean_name.endswith(domain)
+                        and self.DOMAIN_REGEX.match(clean_name)
+                    ):
+                        discovered_subdomains.add(clean_name)
+
+            for sub in sorted(discovered_subdomains):
+                findings.append(
+                    Finding(
+                        type=FindingType.SUBDOMAIN,
+                        target=domain,
+                        value=sub,
+                        source="crt.sh",
+                        metadata={
+                            "parent_domain": domain,
+                            "is_apex": sub == domain,
+                        },
+                    )
+                )
+
+            logger.info(f"crt.sh discovered {len(findings)} unique subdomains for {domain}")
+
+        except Exception as exc:
+            logger.warning(f"Error querying crt.sh for {domain}: {exc}")
+
+        return findings

detecti/modules/exploitdb.py

@@ -0,0 +1,138 @@
+"""ExploitDB & GitHub Proof of Concept (PoC) Intelligence Module."""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import Any, Dict, List, Optional, Set
+import cve_searchsploit as cs
+from detecti.config import settings
+from detecti.core.models import ExploitData, Finding, FindingType
+from detecti.modules.base import BaseModule
+
+logger = logging.getLogger("detecti.exploitdb")
+
+
+class ExploitDBModule(BaseModule):
+    """Searches for public exploits and GitHub Proof-of-Concepts (PoCs) for CVEs."""
+
+    name: str = "exploitdb"
+    description: str = "ExploitDB and GitHub PoC exploit intelligence collector"
+    category: str = "exploit"
+
+    @staticmethod
+    def update_database() -> None:
+        """Update local ExploitDB searchsploit mapping database."""
+        logger.info("Updating local ExploitDB/SearchSploit database...")
+        cs.update_db()
+
+    async def run(
+        self,
+        target: str,
+        context: Optional[Dict[str, Any]] = None,
+    ) -> List[Finding]:
+        """Collect exploits and PoCs for targeted CVEs."""
+        target = target.strip()
+        cves_to_search: Set[str] = set()
+
+        if target.upper().startswith("CVE-"):
+            cves_to_search.add(target.upper())
+
+        if context and "cves" in context:
+            for c in context["cves"]:
+                if isinstance(c, str) and c.upper().startswith("CVE-"):
+                    cves_to_search.add(c.upper())
+
+        if not cves_to_search:
+            logger.debug("No CVEs provided to ExploitDB module.")
+            return []
+
+        findings: List[Finding] = []
+        for cve_id in sorted(cves_to_search):
+            exploits = await self.get_exploits_for_cve(cve_id)
+            for exp in exploits:
+                findings.append(
+                    Finding(
+                        type=FindingType.EXPLOIT,
+                        target=target,
+                        value=f"{cve_id} -> {exp.title}",
+                        source=exp.source,
+                        exploit=exp,
+                        metadata={"cve_id": cve_id, "url": exp.url},
+                    )
+                )
+
+        return findings
+
+    async def get_exploits_for_cve(self, cve_id: str) -> List[ExploitData]:
+        """Search ExploitDB (via cve_searchsploit) and GitHub PoC API concurrently."""
+        results: List[ExploitData] = []
+
+        # 1. Search ExploitDB
+        xdb_task = asyncio.to_thread(self._search_exploitdb, cve_id)
+        # 2. Search GitHub PoCs
+        git_task = self._search_github_pocs(cve_id)
+
+        xdb_results, git_results = await asyncio.gather(xdb_task, git_task, return_exceptions=True)
+
+        if isinstance(xdb_results, list):
+            results.extend(xdb_results)
+        elif isinstance(xdb_results, Exception):
+            logger.debug(f"Error querying ExploitDB for {cve_id}: {xdb_results}")
+
+        if isinstance(git_results, list):
+            results.extend(git_results)
+        elif isinstance(git_results, Exception):
+            logger.debug(f"Error querying GitHub PoCs for {cve_id}: {git_results}")
+
+        return results
+
+    def _search_exploitdb(self, cve_id: str) -> List[ExploitData]:
+        """Search local cve_searchsploit index for ExploitDB entries."""
+        exploits: List[ExploitData] = []
+        try:
+            edb_ids = cs.edbid_from_cve(cve_id)
+            if edb_ids:
+                for eid in edb_ids:
+                    url = f"{settings.exploit_db_base_url}/{eid}"
+                    exploits.append(
+                        ExploitData(
+                            title=f"ExploitDB EDB-ID {eid} for {cve_id}",
+                            source="ExploitDB",
+                            url=url,
+                            verified=True,
+                            exploit_type="Exploit",
+                        )
+                    )
+        except Exception as exc:
+            logger.debug(f"cve_searchsploit lookup failed for {cve_id}: {exc}")
+        return exploits
+
+    async def _search_github_pocs(self, cve_id: str) -> List[ExploitData]:
+        """Search PoC-in-GitHub community aggregator for public PoC repositories."""
+        exploits: List[ExploitData] = []
+        url = f"{settings.github_poc_api_url}/"
+        params = {"cve_id": cve_id}
+
+        try:
+            data = await self.http_client.get_json(url=url, params=params, timeout=12.0)
+            if data and isinstance(data, dict) and "pocs" in data and data["pocs"]:
+                for item in data["pocs"]:
+                    repo_name = item.get("name") or item.get("html_url", "").split("/")[-1]
+                    html_url = item.get("html_url")
+                    owner = item.get("owner", {}).get("login") if isinstance(item.get("owner"), dict) else None
+                    if html_url:
+                        exploits.append(
+                            ExploitData(
+                                title=f"GitHub PoC ({repo_name})",
+                                source="GitHub",
+                                url=html_url,
+                                verified=False,
+                                author=owner,
+                                exploit_type="Proof of Concept",
+                            )
+                        )
+        except Exception as exc:
+            logger.debug(f"GitHub PoC lookup failed for {cve_id}: {exc}")
+
+        return exploits