evilspider 2.5.0__py3-none-any.whl

_version.py

@@ -0,0 +1,5 @@
+"""Single source of truth for EvilSpider metadata."""
+
+__version__ = "2.5.0"
+__author__ = "Baba01hacker666"
+__license__ = "MIT"

analyzer/__init__.py

@@ -0,0 +1,8 @@
+"""Analyzer module for EvilSpider: Secrets, Tech Fingerprinting, Security Auditing, API parsing."""
+
+from .api_parser import ApiParser
+from .secrets import SecretHunter
+from .security import SecurityAuditor
+from .tech import TechDetector
+
+__all__ = ["SecretHunter", "TechDetector", "SecurityAuditor", "ApiParser"]

analyzer/api_parser.py

@@ -0,0 +1,188 @@
+"""
+EvilSpider - OpenAPI / Swagger & GraphQL API Parser
+Parses API documentation specifications and extracts structured routes and parameters.
+"""
+
+import json
+from typing import Any, Dict, Optional
+
+
+class ApiParser:
+    """Parses OpenAPI, Swagger, and GraphQL endpoints & schemas."""
+
+    def is_api_spec(self, content: str) -> bool:
+        """Determines if the response text looks like an OpenAPI or Swagger spec."""
+        if not content or len(content) < 20:
+            return False
+        if '"swagger"' in content or '"openapi"' in content or "swagger:" in content or "openapi:" in content:
+            return True
+        if '"__schema"' in content or '"__type"' in content:
+            return True
+        return False
+
+    def _join_api_url(self, server_url: str, path: str) -> str:
+        """Joins server base URL and API path properly preserving base path."""
+        s = server_url.rstrip("/")
+        p = path.lstrip("/")
+        return f"{s}/{p}"
+
+    def parse_spec(self, content: str, base_url: str = "") -> Optional[Dict[str, Any]]:
+        """Parses OpenAPI or Swagger content into endpoints and parameters."""
+        data = None
+        try:
+            data = json.loads(content)
+        except Exception:
+            try:
+                import yaml
+
+                data = yaml.safe_load(content)
+            except Exception:
+                return None
+
+        if not isinstance(data, dict):
+            return None
+
+        # Check for GraphQL introspection
+        if "data" in data and "__schema" in data["data"]:
+            return self._parse_graphql_introspection(data["data"]["__schema"], base_url)
+
+        is_swagger = "swagger" in data
+        is_openapi = "openapi" in data
+
+        if not (is_swagger or is_openapi):
+            return None
+
+        version = data.get("openapi") or data.get("swagger")
+        info = data.get("info", {})
+        title = info.get("title", "API")
+        api_description = info.get("description", "")
+
+        servers = []
+        if is_openapi and "servers" in data:
+            for s in data["servers"]:
+                s_url = s.get("url", "")
+                if s_url:
+                    if s_url.startswith(("http://", "https://")):
+                        servers.append(s_url)
+                    elif base_url:
+                        servers.append(self._join_api_url(base_url, s_url))
+        elif is_swagger:
+            host = data.get("host", "")
+            base_path = data.get("basePath", "")
+            schemes = data.get("schemes", ["https"])
+            scheme = schemes[0] if schemes else "https"
+            if host:
+                servers.append(f"{scheme}://{host}{base_path}".rstrip("/"))
+            elif base_path and base_url:
+                servers.append(self._join_api_url(base_url, base_path))
+
+        if not servers and base_url:
+            servers.append(base_url.rstrip("/"))
+
+        endpoints = []
+        paths = data.get("paths", {})
+
+        for path_str, path_item in paths.items():
+            if not isinstance(path_item, dict):
+                continue
+
+            for method in ("get", "post", "put", "delete", "patch", "options", "head"):
+                if method in path_item:
+                    op = path_item[method]
+                    if not isinstance(op, dict):
+                        continue
+
+                    summary = op.get("summary", "")
+                    description = op.get("description", "")
+                    operation_id = op.get("operationId", "")
+                    tags = op.get("tags", [])
+
+                    params = []
+                    all_params = list(path_item.get("parameters", [])) + list(op.get("parameters", []))
+                    for p in all_params:
+                        if isinstance(p, dict) and "name" in p:
+                            params.append(
+                                {
+                                    "name": p.get("name"),
+                                    "in": p.get("in", "query"),
+                                    "required": p.get("required", False),
+                                    "type": p.get("type")
+                                    or (
+                                        p.get("schema", {}).get("type")
+                                        if isinstance(p.get("schema"), dict)
+                                        else "string"
+                                    ),
+                                }
+                            )
+
+                    resolved_urls = [self._join_api_url(s, path_str) for s in servers] if servers else [path_str]
+
+                    endpoints.append(
+                        {
+                            "path": path_str,
+                            "method": method.upper(),
+                            "summary": summary,
+                            "description": description,
+                            "operation_id": operation_id,
+                            "tags": tags,
+                            "parameters": params,
+                            "urls": resolved_urls,
+                        }
+                    )
+
+        return {
+            "type": "OpenAPI" if is_openapi else "Swagger",
+            "version": str(version),
+            "title": title,
+            "description": api_description,
+            "servers": servers,
+            "endpoint_count": len(endpoints),
+            "endpoints": endpoints,
+        }
+
+    def _parse_graphql_introspection(self, schema: Dict[str, Any], base_url: str) -> Dict[str, Any]:
+        types = schema.get("types", [])
+        query_type_name = schema.get("queryType", {}).get("name", "Query") if schema.get("queryType") else "Query"
+        mutation_type_name = (
+            schema.get("mutationType", {}).get("name", "Mutation") if schema.get("mutationType") else "Mutation"
+        )
+
+        queries = []
+        mutations = []
+        custom_types = []
+
+        for t in types:
+            name = t.get("name", "")
+            if name.startswith("__"):
+                continue
+
+            fields = t.get("fields") or []
+            if name == query_type_name:
+                for f in fields:
+                    queries.append(
+                        {
+                            "name": f.get("name"),
+                            "description": f.get("description", ""),
+                            "args": [a.get("name") for a in (f.get("args") or [])],
+                        }
+                    )
+            elif name == mutation_type_name:
+                for f in fields:
+                    mutations.append(
+                        {
+                            "name": f.get("name"),
+                            "description": f.get("description", ""),
+                            "args": [a.get("name") for a in (f.get("args") or [])],
+                        }
+                    )
+            else:
+                custom_types.append(name)
+
+        return {
+            "type": "GraphQL Schema",
+            "url": base_url,
+            "queries": queries,
+            "mutations": mutations,
+            "types_count": len(custom_types),
+            "types": custom_types[:50],
+        }

analyzer/secrets.py

@@ -0,0 +1,363 @@
+"""
+EvilSpider - Sensitive Data & Secret Hunter
+Extracts credentials, API keys, tokens, private keys, and sensitive info from responses.
+"""
+
+import math
+import re
+from typing import Any, Dict, List, Optional
+
+
+class SecretRule:
+    def __init__(
+        self, name: str, severity: str, pattern: str, description: str, category: str = "Credentials", validator=None
+    ):
+        self.name = name
+        self.severity = severity  # CRITICAL, HIGH, MEDIUM, LOW, INFO
+        self.pattern = re.compile(pattern, re.IGNORECASE if "PRIVATE KEY" not in pattern else 0)
+        self.description = description
+        self.category = category
+        self.validator = validator
+
+
+def _shannon_entropy(data: str) -> float:
+    """Calculate Shannon entropy to filter low-entropy false positives."""
+    if not data:
+        return 0.0
+    entropy = 0.0
+    for x in set(data):
+        p_x = float(data.count(x)) / len(data)
+        if p_x > 0:
+            entropy += -p_x * math.log2(p_x)
+    return entropy
+
+
+def _is_dummy_value(val: str) -> bool:
+    """Filter out common placeholder dummy strings."""
+    low = val.lower()
+    dummy_indicators = [
+        "example",
+        "placeholder",
+        "your_key",
+        "your_token",
+        "your_api",
+        "xxxxxx",
+        "123456",
+        "abcdef",
+        "sample",
+        "dummy",
+        "test_key",
+        "mysecret",
+        "change_me",
+        "insert_",
+        "<api_key>",
+        "{api_key}",
+        "undefined",
+        "null",
+        "none",
+    ]
+    return any(d in low for d in dummy_indicators)
+
+
+SECRET_RULES: List[SecretRule] = [
+    # AWS Keys
+    SecretRule(
+        name="AWS Access Key ID",
+        severity="HIGH",
+        pattern=r"\b((?:AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16})\b",
+        description="Amazon Web Services Access Key ID",
+        category="Cloud",
+        validator=lambda m: not _is_dummy_value(m),
+    ),
+    SecretRule(
+        name="AWS Secret Access Key",
+        severity="CRITICAL",
+        pattern=r"(?i)aws_?(?:secret)?_?(?:access)?_?key(?:_id)?\s*[:=]\s*['\"]([A-Za-z0-9/+=]{40})['\"]",
+        description="Amazon Web Services Secret Access Key",
+        category="Cloud",
+        validator=lambda m: _shannon_entropy(m) > 3.0 and not _is_dummy_value(m),
+    ),
+    # Google Cloud
+    SecretRule(
+        name="Google Cloud API Key",
+        severity="HIGH",
+        pattern=r"\b(AIza[0-9A-Za-z_\-]{35})\b",
+        description="Google Cloud / Firebase API Key",
+        category="Cloud",
+        validator=lambda m: not _is_dummy_value(m),
+    ),
+    SecretRule(
+        name="Google OAuth Client Secret",
+        severity="HIGH",
+        pattern=r"(?i)client_secret\s*[:=]\s*['\"]([a-zA-Z0-9_\-]{24,36})['\"]",
+        description="Google OAuth Client Secret",
+        category="OAuth",
+        validator=lambda m: _shannon_entropy(m) > 3.2 and not _is_dummy_value(m),
+    ),
+    # GitHub
+    SecretRule(
+        name="GitHub Personal Access Token (Classic)",
+        severity="CRITICAL",
+        pattern=r"\b(ghp_[0-9a-zA-Z]{36})\b",
+        description="GitHub Classic Personal Access Token",
+        category="VCS",
+    ),
+    SecretRule(
+        name="GitHub Fine-Grained Token",
+        severity="CRITICAL",
+        pattern=r"\b(github_pat_[0-9a-zA-Z_]{82})\b",
+        description="GitHub Fine-Grained Personal Access Token",
+        category="VCS",
+    ),
+    SecretRule(
+        name="GitHub OAuth / App Token",
+        severity="CRITICAL",
+        pattern=r"\b((?:gho|ghu|ghs|ghr)_[0-9a-zA-Z]{36})\b",
+        description="GitHub OAuth / App Access Token",
+        category="VCS",
+    ),
+    # GitLab
+    SecretRule(
+        name="GitLab Personal Access Token",
+        severity="CRITICAL",
+        pattern=r"\b(glpat-[0-9a-zA-Z_\-]{20,24})\b",
+        description="GitLab Personal Access Token",
+        category="VCS",
+    ),
+    # Slack
+    SecretRule(
+        name="Slack Webhook URL",
+        severity="HIGH",
+        pattern=r"https://hooks\.slack\.com/services/T[a-zA-Z0-9_]+/B[a-zA-Z0-9_]+/[a-zA-Z0-9_]+",
+        description="Slack Incoming Webhook URL",
+        category="Messaging",
+    ),
+    SecretRule(
+        name="Slack API Token",
+        severity="CRITICAL",
+        pattern=r"\b(xox[baprs]-[0-9a-zA-Z\-]{10,72})\b",
+        description="Slack API / Bot / User Token",
+        category="Messaging",
+    ),
+    # Stripe
+    SecretRule(
+        name="Stripe Live Secret Key",
+        severity="CRITICAL",
+        pattern=r"\b(sk_live_[0-9a-zA-Z]{24,99})\b",
+        description="Stripe Live Secret Key",
+        category="Payment",
+    ),
+    SecretRule(
+        name="Stripe Live Restricted Key",
+        severity="HIGH",
+        pattern=r"\b(rk_live_[0-9a-zA-Z]{24,99})\b",
+        description="Stripe Live Restricted Key",
+        category="Payment",
+    ),
+    SecretRule(
+        name="Stripe Publishable Key",
+        severity="INFO",
+        pattern=r"\b(pk_live_[0-9a-zA-Z]{24,99})\b",
+        description="Stripe Live Publishable Key",
+        category="Payment",
+    ),
+    # JWT Token
+    SecretRule(
+        name="JSON Web Token (JWT)",
+        severity="MEDIUM",
+        pattern=r"\b(eyJ[a-zA-Z0-9_\-]{10,}\.eyJ[a-zA-Z0-9_\-]{10,}\.[a-zA-Z0-9_\-]{10,})\b",
+        description="JSON Web Token authentication bearer",
+        category="Authentication",
+    ),
+    # Private Keys
+    SecretRule(
+        name="RSA Private Key",
+        severity="CRITICAL",
+        pattern=r"-----BEGIN (?:RSA )?PRIVATE KEY-----[^-]+-----END (?:RSA )?PRIVATE KEY-----",
+        description="RSA Private Key Block",
+        category="Cryptography",
+    ),
+    SecretRule(
+        name="OpenSSH / EC Private Key",
+        severity="CRITICAL",
+        pattern=r"-----BEGIN (?:OPENSSH|EC|DSA) PRIVATE KEY-----[^-]+-----END (?:OPENSSH|EC|DSA) PRIVATE KEY-----",
+        description="OpenSSH or EC/DSA Private Key Block",
+        category="Cryptography",
+    ),
+    SecretRule(
+        name="PGP Private Key",
+        severity="CRITICAL",
+        pattern=r"-----BEGIN PGP PRIVATE KEY BLOCK-----[^-]+-----END PGP PRIVATE KEY BLOCK-----",
+        description="PGP Private Key Block",
+        category="Cryptography",
+    ),
+    # SendGrid, Twilio, Mailgun
+    SecretRule(
+        name="SendGrid API Key",
+        severity="HIGH",
+        pattern=r"\b(SG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43})\b",
+        description="SendGrid API Key",
+        category="Email",
+    ),
+    SecretRule(
+        name="Twilio Account SID",
+        severity="MEDIUM",
+        pattern=r"\b(AC[a-f0-9]{32})\b",
+        description="Twilio Account SID",
+        category="Messaging",
+    ),
+    SecretRule(
+        name="Twilio API Secret",
+        severity="HIGH",
+        pattern=r"\b(SK[a-f0-9]{32})\b",
+        description="Twilio API Secret Key",
+        category="Messaging",
+    ),
+    SecretRule(
+        name="Mailgun API Key",
+        severity="HIGH",
+        pattern=r"\b(key-[0-9a-zA-Z]{32})\b",
+        description="Mailgun API Key",
+        category="Email",
+    ),
+    # Square & Shopify
+    SecretRule(
+        name="Square Access Token",
+        severity="HIGH",
+        pattern=r"\b(sq0atp-[0-9A-Za-z_\-]{22})\b",
+        description="Square OAuth Access Token",
+        category="Payment",
+    ),
+    SecretRule(
+        name="Shopify Access Token",
+        severity="HIGH",
+        pattern=r"\b(shpat_[a-fA-F0-9]{32})\b",
+        description="Shopify Admin API Access Token",
+        category="E-commerce",
+    ),
+    # Telegram & Discord
+    SecretRule(
+        name="Telegram Bot Token",
+        severity="HIGH",
+        pattern=r"\b([0-9]{9,10}:[a-zA-Z0-9_\-]{35})\b",
+        description="Telegram Bot API Token",
+        category="Messaging",
+    ),
+    SecretRule(
+        name="Discord Webhook URL",
+        severity="HIGH",
+        pattern=r"https://(?:canary\.|ptb\.)?discord(?:app)?\.com/api/webhooks/[0-9]+/[a-zA-Z0-9_\-]+",
+        description="Discord Incoming Webhook URL",
+        category="Messaging",
+    ),
+    SecretRule(
+        name="Discord Bot Token",
+        severity="CRITICAL",
+        pattern=r"\b([MN][A-Za-z\d]{23,26}\.[A-Za-z\d_\-]{6}\.[A-Za-z\d_\-]{27,38})\b",
+        description="Discord Bot Token",
+        category="Messaging",
+    ),
+    # Database Connection Strings
+    SecretRule(
+        name="Database Connection URI",
+        severity="CRITICAL",
+        pattern=r"(?:mysql|postgres|postgresql|mongodb|redis|amqp|couchdb)://[a-zA-Z0-9_.\-]+:[a-zA-Z0-9_.\-~%!$&'()*+,;=]+@[a-zA-Z0-9_.\-]+(?::\d+)?(?:/[a-zA-Z0-9_.\-]*)?",
+        description="Database connection URI with credentials",
+        category="Database",
+        validator=lambda m: not _is_dummy_value(m) and "@localhost" not in m.lower() and "@127.0.0.1" not in m,
+    ),
+    # Hardcoded Passwords & Auth Headers in JS/HTML
+    SecretRule(
+        name="Hardcoded Secret / Password Assignment",
+        severity="MEDIUM",
+        pattern=r"(?i)(?:password|passwd|api_secret|client_secret|auth_token|access_token|secret_key)\s*[:=]\s*['\"]([a-zA-Z0-9!@#$%^&*()_+={}\[\]|;:<>,.?/~`_\-]{8,64})['\"]",
+        description="Hardcoded credential or token assignment",
+        category="Credentials",
+        validator=lambda m: _shannon_entropy(m) > 2.8 and not _is_dummy_value(m),
+    ),
+    SecretRule(
+        name="Authorization Bearer Token Header",
+        severity="HIGH",
+        pattern=r"(?i)bearer\s+([a-zA-Z0-9_\-\.]{20,128})",
+        description="Authorization Bearer Token leaked in response",
+        category="Authentication",
+        validator=lambda m: not _is_dummy_value(m) and _shannon_entropy(m) > 3.0,
+    ),
+    # Internal IPs and Leaked Infrastructure
+    SecretRule(
+        name="Private IPv4 Address",
+        severity="INFO",
+        pattern=r"\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b",
+        description="Internal RFC 1918 Private IP Address",
+        category="Infrastructure",
+        validator=lambda m: (
+            not m.startswith("10.0.0.1") and not m.startswith("192.168.1.1") and not m.startswith("127.0.0.1")
+        ),
+    ),
+]
+
+
+class SecretHunter:
+    """Scans response bodies (HTML, JS, JSON, XML) for secrets, tokens, and credentials."""
+
+    def __init__(self, custom_rules: Optional[List[SecretRule]] = None):
+        self.rules = list(SECRET_RULES)
+        if custom_rules:
+            self.rules.extend(custom_rules)
+
+    def mask_secret(self, secret: str) -> str:
+        """Mask sensitive value for safe reporting (e.g., AKIA1234...ABCD)."""
+        if len(secret) <= 8:
+            return "***"
+        prefix_len = min(4, len(secret) // 4)
+        suffix_len = min(4, len(secret) // 4)
+        return f"{secret[:prefix_len]}...{secret[-suffix_len:]}"
+
+    def scan(self, content: str, source_url: str = "") -> List[Dict[str, Any]]:
+        """Scans content and returns structured findings."""
+        findings = []
+        if not content:
+            return findings
+
+        lines = content.splitlines()
+
+        for rule in self.rules:
+            for match in rule.pattern.finditer(content):
+                matched_val = match.group(1) if match.groups() else match.group(0)
+                matched_val = matched_val.strip()
+
+                if rule.validator and not rule.validator(matched_val):
+                    continue
+
+                start_pos = match.start()
+                line_idx = content.count("\n", 0, start_pos)
+                line_num = line_idx + 1
+
+                context_start = max(0, line_idx - 1)
+                context_end = min(len(lines), line_idx + 2)
+                context_lines = lines[context_start:context_end]
+                context_snippet = "\n".join(context_lines)
+
+                findings.append(
+                    {
+                        "rule": rule.name,
+                        "severity": rule.severity,
+                        "category": rule.category,
+                        "description": rule.description,
+                        "matched": matched_val,
+                        "masked": self.mask_secret(matched_val),
+                        "line_number": line_num,
+                        "context_snippet": context_snippet[:250],
+                        "source_url": source_url,
+                    }
+                )
+
+        seen = set()
+        deduped = []
+        for f in findings:
+            key = (f["rule"], f["matched"])
+            if key not in seen:
+                seen.add(key)
+                deduped.append(f)
+
+        return deduped