forensic-cli 1.2.13__tar.gz → 1.4.0__tar.gz

{forensic_cli-1.2.13/src/forensic_cli.egg-info → forensic_cli-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forensic-cli
-Version: 1.2.13
+Version: 1.4.0
 Summary: DevKit Forense - CLI para análise de navegadores e rede
 Home-page: https://github.com/ErickG123/devkit_forense
 Author: Erick Gabriel dos Santos Alves

{forensic_cli-1.2.13 → forensic_cli-1.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "forensic-cli"
-version = "1.2.13"
+version = "1.4.0"
 description = "DevKit Forense - CLI para análise de navegadores e rede"
 readme = "README.md"
 license = {text = "MIT"}

{forensic_cli-1.2.13 → forensic_cli-1.4.0}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="forensic_cli",
-    version="1.2.13",
+    version="1.4.0",
     author="Erick Gabriel dos Santos Alves",
     author_email="erickgabrielalves0@gmail.com",
     description="Toolkit modular para análise de evidências digitais",

{forensic_cli-1.2.13 → forensic_cli-1.4.0}/src/cli/commands/network.py

@@ -1,9 +1,10 @@
 import typer
 from rich import print
 from rich.text import Text
+from rich.table import Table
 
 from core.network.network_map import run as run_network_map
-from core.network.port_scanner import scan_host
+from core.network.port_scanner import scan_host, parse_ports
 from core.network.ping_sweep import parse_network, ping_host
 from core.network.fingerprinting import detect_os
 from core.network.traceroute import traceroute_host
@@ -15,20 +16,80 @@ from core.network.snmp_scan import snmp_scan
 
 network_app = typer.Typer(help="Conjunto de ferramentas para análise e exploração de redes")
 
-@network_app.command("map", help="Mapeia dispositivos ativos na rede e salva os resultados em JSON/CSV")
+@network_app.command("map", help="Mapeia dispositivos ativos na rede e salva os resultados")
 def map(
-    network: str = typer.Option(..., help="Range de IPs da rede. Exemplo: 192.168.1.1-254"),
-    output_dir: str = typer.Option("./output", help="Diretório para salvar os resultados"),
+    network: str = typer.Option(..., "--network", "-n", help="Range de IPs da rede. Ex: 192.168.1.1-254"),
+
+    ports: str = typer.Option(
+        "21,22,80,443,445,8080", 
+        "--ports", 
+        "-p", 
+        help="Portas para escanear em cada host."
+    ),
+
+    output_dir: str = typer.Option(
+        "./output", 
+        "--output", 
+        "-o", 
+        help="Diretório para salvar os resultados"
+    ),
 ):
-    result = run_network_map(network, output_dir)
-    typer.echo(f"Resultados salvos em: {result['json_file']} e {result['csv_file']}")
+    typer.echo(f"[+] Iniciando mapeamento da rede {network} nas portas [{ports}]...")
+
+    result = run_network_map(network, ports, output_dir)
+
+    if result and result.get('json_file'):
+        typer.echo(f"Resultados salvos em: {result.get('json_file')} e {result.get('csv_file')}")
 
 @network_app.command("scan", help="Realiza um scan de portas em um host específico")
 def scan(
-    ip: str = typer.Option(..., help="Endereço IP do host. Exemplo: 192.168.0.10")
+    target: str = typer.Option(..., "--target", "-t", help="Alvo do scan (IP ou hostname)"),
+    ports: str = typer.Option("21,22,53,80,443,445,3306,8080", "--ports", "-p", help="Portas para escanear. Ex: '22,80,100-200'")
 ):
-    result = scan_host(ip)
-    print(result)
+    try:
+        ports_to_scan = parse_ports(ports)
+        num_ports = len(ports_to_scan)
+
+        if num_ports == 0:
+            print("[yellow]Nenhuma porta especificada para o scan.[/yellow]")
+            raise typer.Exit()
+
+        typer.echo(f"[+] Iniciando scan em {num_ports} porta(s) de {target}...")
+
+        results = []
+        with typer.progressbar(length=num_ports, label="Scanning ports") as progress:
+            def update_progress():
+                progress.update(1)
+
+            results = scan_host(
+                target=target,
+                ports=ports,
+                callback=update_progress
+            )
+
+        table = Table(title=f"Resultados do Scan para {target}")
+        table.add_column("Porta", style="cyan")
+        table.add_column("Protocolo", style="magenta")
+        table.add_column("Status", style="green")
+        table.add_column("Serviço", style="yellow")
+        table.add_column("Banner / Detalhes", style="white", overflow="fold")
+
+        if not results:
+            print(f"[yellow]Nenhuma porta aberta encontrada para '{target}' no range '{ports}'.[/yellow]")
+            return
+
+        for res in results:
+            table.add_row(
+                str(res["port"]),
+                res["protocol"],
+                res["status"],
+                res["service"],
+                res["banner"]
+            )
+        print(table)
+
+    except ValueError as e:
+        print(f"[bold red]Erro: {e}[/bold red]")
 
 @network_app.command("sweep", help="Verifica hosts ativos em um range de IPs via ping")
 def sweep(

{forensic_cli-1.2.13 → forensic_cli-1.4.0}/src/core/browser/common_words.py

@@ -1,4 +1,3 @@
-# core/browser/words_extractor.py
 import sqlite3
 import shutil
 import tempfile

forensic_cli-1.4.0/src/core/network/network_map.py

@@ -0,0 +1,126 @@
+import os
+import json
+import csv
+from datetime import datetime
+from concurrent.futures import ThreadPoolExecutor, as_completed
+import typer
+
+from .ping_sweep import ping_sweep
+from .arp_scan import arp_scan
+from .port_scanner import scan_host
+from .utils import get_mac, get_vendor, get_hostname
+from .fingerprinting import detect_os
+from .traceroute import traceroute_host
+from .snmp_scan import snmp_scan
+from .dns_recon import dns_recon
+from .smb_scan import smb_scan
+from .ip_info import ip_info_lookup
+
+def _process_host(host: str, ports_to_scan: str) -> dict:
+    open_ports = scan_host(host, ports=ports_to_scan)
+
+    try:
+        mac = get_mac(host)
+        vendor = get_vendor(mac) if mac else None
+    except Exception:
+        mac = None
+        vendor = None
+
+    hostname = get_hostname(host)
+    
+    os_info = detect_os(host, ports=open_ports, mac_vendor=vendor)
+    hops = traceroute_host(host)
+    snmp_info = snmp_scan(host)
+    dns_info = dns_recon([host])
+    smb_info = smb_scan([host])
+    ip_info = ip_info_lookup(host)
+
+    return {
+        "host": host,
+        "hostname": hostname,
+        "mac": mac,
+        "vendor": vendor,
+        "open_ports": open_ports,
+        "os_info": os_info,
+        "traceroute": hops,
+        "snmp": snmp_info,
+        "dns": dns_info[0] if dns_info else {},
+        "smb": smb_info[0] if smb_info else {},
+        "ip_info": ip_info
+    }
+
+def build_network_map(network: str, ports: str, workers: int = 50):
+    hosts = ping_sweep(network)
+    if not hosts:
+        typer.echo("[+] Ping sweep não encontrou hosts, tentando ARP scan...")
+        hosts = arp_scan(network)
+
+    if not hosts:
+        typer.echo("[!] Nenhum host ativo encontrado na rede especificada.")
+        return []
+
+    results = []
+    typer.echo(f"[+] {len(hosts)} host(s) ativo(s) encontrado(s). Iniciando análise detalhada...")
+
+    with ThreadPoolExecutor(max_workers=workers) as executor:
+        future_to_host = {executor.submit(_process_host, host, ports): host for host in hosts}
+
+        with typer.progressbar(as_completed(future_to_host), length=len(hosts), label="Mapeando Rede") as progress:
+            for future in progress:
+                try:
+                    host_data = future.result()
+                    results.append(host_data)
+                except Exception as exc:
+                    host = future_to_host[future]
+                    typer.echo(f"\n[!] Erro ao processar o host {host}: {exc}")
+    
+    return results
+
+def save_network_map(results: list, output_dir: str, prefix="network_map"):
+    os.makedirs(output_dir, exist_ok=True)
+    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+
+    json_file = os.path.join(output_dir, f"{prefix}_{timestamp}.json")
+    csv_file = os.path.join(output_dir, f"{prefix}_{timestamp}.csv")
+
+    with open(json_file, "w", encoding="utf-8") as f:
+        json.dump(results, f, indent=4, ensure_ascii=False)
+
+    flat_results = []
+    for row in results:
+        flat_row = {
+            "host": row.get("host"),
+            "hostname": row.get("hostname"),
+            "mac": row.get("mac"),
+            "vendor": row.get("vendor"),
+            "os_type": row.get("os_info", {}).get("os"),
+            "host_type": row.get("os_info", {}).get("host_type"),
+            "open_ports_count": len(row.get("open_ports", [])),
+            "traceroute_hops": len(row.get("traceroute", [])),
+            "snmp_sys_name": row.get("snmp", {}).get("sys_name"),
+            "dns_hostname": row.get("dns", {}).get("hostname"),
+            "smb_shares_count": len(row.get("smb", {}).get("shares", [])),
+            "asn": row.get("ip_info", {}).get("asn"),
+            "network_name": row.get("ip_info", {}).get("network_name"),
+        }
+        flat_results.append(flat_row)
+        
+    if not flat_results:
+        return json_file, None
+
+    with open(csv_file, "w", newline="", encoding="utf-8") as f:
+        fieldnames = flat_results[0].keys()
+        writer = csv.DictWriter(f, fieldnames=fieldnames)
+        writer.writeheader()
+        writer.writerows(flat_results)
+
+    return json_file, csv_file
+
+def run(network: str, ports: str, output_dir: str, prefix="network_map"):
+    results = build_network_map(network, ports)
+    
+    if results:
+        json_file, csv_file = save_network_map(results, output_dir, prefix)
+        return {"results": results, "json_file": json_file, "csv_file": csv_file}
+    else:
+        return {}

forensic_cli-1.4.0/src/core/network/port_scanner.py

@@ -0,0 +1,138 @@
+import socket
+import ssl
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from typing import Callable, Dict, List, Optional, Set
+
+TCP_PROBES: Dict[int, bytes] = {
+    80: b"HEAD / HTTP/1.1\r\nHost: target\r\n\r\n",
+    21: b"FEAT\r\n",
+}
+
+PORT_ALERTS: Dict[int, str] = {
+    21: "FTP", 22: "SSH", 23: "Telnet", 25: "SMTP", 53: "DNS",
+    80: "HTTP", 110: "POP3", 137: "NetBIOS-NS", 139: "NetBIOS", 143: "IMAP",
+    443: "HTTPS", 445: "SMB", 993: "IMAPS", 995: "POP3S",
+    1900: "UPnP", 3306: "MySQL", 3389: "RDP", 5432: "PostgreSQL",
+    5900: "VNC", 8080: "HTTP-Proxy",
+}
+
+def _clean_banner(banner_bytes: bytes) -> str:
+    try:
+        banner_str = banner_bytes.decode(errors='ignore')
+        printable_banner = "".join(char for char in banner_str if char.isprintable() or char.isspace())
+        return printable_banner.strip()
+    except Exception:
+        return "Falha ao decodificar banner"
+
+def parse_ports(port_str: str) -> List[int]:
+    ports: Set[int] = set()
+    try:
+        parts = port_str.split(',')
+        for part in parts:
+            if '-' in part:
+                start, end = map(int, part.split('-'))
+                ports.update(range(start, end + 1))
+            else:
+                ports.add(int(part))
+    except ValueError:
+        raise ValueError("Formato de porta inválido. Use '80', '22,80,443' ou '1-1024'.")
+
+    return sorted(list(ports))
+
+def _scan_tcp(ip: str, port: int, timeout: float) -> Optional[Dict]:
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+            s.settimeout(timeout)
+            if s.connect_ex((ip, port)) == 0:
+                banner = ""
+                if port == 443:
+                    try:
+                        context = ssl.create_default_context()
+                        with context.wrap_socket(s, server_hostname=ip) as ss:
+                            cert = ss.getpeercert()
+                            subject = dict(x[0] for x in cert.get('subject', []))
+                            banner = f"SSL Cert for: {subject.get('commonName', 'N/A')}"
+                    except Exception:
+                        banner = "SSL Handshake Error"
+                else:
+                    try:
+                        if port in TCP_PROBES:
+                            s.send(TCP_PROBES[port])
+                        raw_banner = s.recv(1024)
+                        cleaned_banner = _clean_banner(raw_banner)
+                        if port in [80, 8080] and cleaned_banner:
+                            banner = cleaned_banner.splitlines()[0]
+                        else:
+                            banner = cleaned_banner
+                    except (socket.timeout, ConnectionResetError):
+                        pass
+
+                return {
+                    "port": port, "protocol": "TCP", "status": "open",
+                    "banner": banner or "sem banner",
+                    "service": PORT_ALERTS.get(port, "unknown")
+                }
+    except (socket.timeout, OSError):
+        pass
+
+    return None
+
+def _scan_udp(ip: str, port: int, timeout: float) -> Optional[Dict]:
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
+            s.settimeout(timeout)
+            s.sendto(b"", (ip, port))
+            try:
+                s.recvfrom(1024)
+                return {
+                    "port": port, "protocol": "UDP", "status": "open",
+                    "banner": "response received",
+                    "service": PORT_ALERTS.get(port, "unknown")
+                }
+            except socket.timeout:
+                return {
+                    "port": port, "protocol": "UDP", "status": "open|filtered",
+                    "banner": "no response",
+                    "service": PORT_ALERTS.get(port, "unknown")
+                }
+    except (OSError, socket.timeout):
+        pass
+
+    return None
+
+def scan_host(
+    target: str,
+    ports: str,
+    udp: bool = False,
+    workers: int = 100,
+    timeout: float = 1.0,
+    callback: Optional[Callable] = None
+) -> List[Dict]:
+    try:
+        ip = socket.gethostbyname(target)
+    except socket.gaierror:
+        raise ValueError(f"Hostname '{target}' não pôde ser resolvido.")
+
+    tcp_ports_to_scan = parse_ports(ports)
+    udp_ports_to_scan = parse_ports("53,67,68,161,500") if udp else []
+    
+    total_ports = len(tcp_ports_to_scan) + len(udp_ports_to_scan)
+    if total_ports == 0:
+        return []
+
+    results: List[Dict] = []
+    with ThreadPoolExecutor(max_workers=workers) as executor:
+        futures = [executor.submit(_scan_tcp, ip, port, timeout) for port in tcp_ports_to_scan]
+        futures += [executor.submit(_scan_udp, ip, port, timeout) for port in udp_ports_to_scan]
+
+        for future in as_completed(futures):
+            res = future.result()
+            if res:
+                results.append(res)
+            
+            if callback:
+                callback()
+
+    results.sort(key=lambda x: x["port"])
+
+    return results

{forensic_cli-1.2.13 → forensic_cli-1.4.0/src/forensic_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forensic-cli
-Version: 1.2.13
+Version: 1.4.0
 Summary: DevKit Forense - CLI para análise de navegadores e rede
 Home-page: https://github.com/ErickG123/devkit_forense
 Author: Erick Gabriel dos Santos Alves

forensic_cli-1.2.13/src/core/network/network_map.py

@@ -1,120 +0,0 @@
-import os
-import json
-import csv
-from datetime import datetime
-import threading
-import typer
-
-from core.network.ping_sweep import ping_sweep
-from core.network.arp_scan import arp_scan
-from core.network.port_scanner import scan_host
-from core.network.utils import get_mac, get_vendor, get_hostname
-from core.network.fingerprinting import detect_os
-from core.network.traceroute import traceroute_host
-from core.network.snmp_scan import snmp_scan
-from core.network.dns_recon import dns_recon
-from core.network.smb_scan import smb_scan
-from core.network.ip_info import ip_info_lookup
-
-lock = threading.Lock()
-
-def build_network_map(network):
-    hosts = ping_sweep(network)
-    if not hosts:
-        hosts = arp_scan(network)
-
-    results = []
-
-    typer.echo(f"[+] Iniciando varredura da rede ({len(hosts)} hosts)...")
-
-    with typer.progressbar(hosts, label="Network Map") as progress:
-        for host in hosts:
-            open_ports = scan_host(host)
-
-            try:
-                mac = get_mac(host)
-                vendor = get_vendor(mac) if mac else None
-            except Exception:
-                mac = None
-                vendor = None
-
-            hostname = get_hostname(host)
-            os_info = detect_os(host, ports=open_ports, mac_vendor=vendor)
-
-            hops = traceroute_host(host)
-
-            snmp_info = snmp_scan(host)
-
-            dns_info = dns_recon([host])
-
-            smb_info = smb_scan([host])
-
-            ip_info = ip_info_lookup(host)
-
-            host_data = {
-                "host": host,
-                "hostname": hostname,
-                "mac": mac,
-                "vendor": vendor,
-                "open_ports": open_ports,
-                "os_info": os_info,
-                "traceroute": hops,
-                "snmp": snmp_info,
-                "dns": dns_info[0] if dns_info else {},
-                "smb": smb_info[0] if smb_info else {},
-                "ip_info": ip_info
-            }
-
-            with lock:
-                results.append(host_data)
-
-            progress.update(1)
-
-    return results
-
-def save_network_map(results, output_dir: str, prefix="network_map"):
-    os.makedirs(output_dir, exist_ok=True)
-    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
-
-    json_file = os.path.join(output_dir, f"{prefix}_{timestamp}.json")
-    csv_file = os.path.join(output_dir, f"{prefix}_{timestamp}.csv")
-
-    with open(json_file, "w", encoding="utf-8") as f:
-        json.dump(results, f, indent=4, ensure_ascii=False)
-
-    with open(csv_file, "w", newline="", encoding="utf-8") as f:
-        fieldnames = ["host", "hostname", "mac", "vendor", "os_type", "host_type",
-                      "open_ports_count", "traceroute_hops", "snmp_sys_name", "dns_hostname",
-                      "smb_shares_count", "vulnerabilities_count", "asn", "network_name"]
-        writer = csv.DictWriter(f, fieldnames=fieldnames)
-        writer.writeheader()
-
-        for row in results:
-            writer.writerow({
-                "host": row["host"],
-                "hostname": row["hostname"],
-                "mac": row["mac"],
-                "vendor": row["vendor"],
-                "os_type": row["os_info"].get("os"),
-                "host_type": row["os_info"].get("host_type"),
-                "open_ports_count": len(row["open_ports"]),
-                "traceroute_hops": len(row["traceroute"]),
-                "snmp_sys_name": row["snmp"].get("sys_name"),
-                "dns_hostname": row["dns"].get("hostname"),
-                "smb_shares_count": len(row["smb"].get("shares", [])),
-                "asn": row["ip_info"].get("asn"),
-                "network_name": row["ip_info"].get("network_name"),
-            })
-
-    return json_file, csv_file
-
-def run(network: str, output_dir: str, prefix="network_map"):
-    results = build_network_map(network)
-    json_file, csv_file = save_network_map(results, output_dir, prefix)
-
-    typer.echo(f"[+] Network map salvo em: {json_file} e {csv_file}")
-    return {
-        "results": results,
-        "json_file": json_file,
-        "csv_file": csv_file,
-    }

forensic_cli-1.2.13/src/core/network/port_scanner.py

@@ -1,93 +0,0 @@
-import socket
-from concurrent.futures import ThreadPoolExecutor, as_completed
-import threading
-import typer
-
-COMMON_TCP_PORTS = [
-    21, 22, 23, 25, 53, 80, 110, 139, 143, 443, 445,
-    3389, 3306, 8080, 8443, 5900, 135, 995, 993, 1723
-]
-COMMON_UDP_PORTS = [53, 67, 68, 69, 123, 161, 162, 500, 514]
-
-PORT_ALERTS = {
-    21: "FTP",
-    22: "SSH",
-    23: "Telnet",
-    25: "SMTP",
-    53: "DNS",
-    80: "HTTP",
-    443: "HTTPS",
-    445: "SMB",
-    3306: "MySQL",
-    3389: "RDP"
-}
-
-lock = threading.Lock()
-
-def scan_tcp(ip, port):
-    result = None
-    try:
-        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-            s.settimeout(1)
-            if s.connect_ex((ip, port)) == 0:
-                banner = ""
-                try:
-                    if port in [21, 22, 25, 80, 443, 3306]:
-                        s.send(b"HEAD / HTTP/1.0\r\n\r\n")
-                        banner = s.recv(1024).decode(errors="ignore").strip()
-                except (socket.timeout, ConnectionResetError):
-                    pass
-
-                result = {
-                    "port": port,
-                    "protocol": "TCP",
-                    "status": "open",
-                    "banner": banner if banner else "sem banner",
-                    "alert": PORT_ALERTS.get(port)
-                }
-    except (socket.timeout, OSError):
-        pass
-    return result
-
-def scan_udp(ip, port):
-    result = None
-    try:
-        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
-            s.settimeout(1)
-            s.sendto(b"", (ip, port))
-            try:
-                data, _ = s.recvfrom(1024)
-                banner = data.decode(errors="ignore").strip()
-                status = "open"
-            except socket.timeout:
-                banner = "sem resposta"
-                status = "open|filtered"
-            result = {
-                "port": port,
-                "protocol": "UDP",
-                "status": status,
-                "banner": banner,
-                "alert": PORT_ALERTS.get(port)
-            }
-    except (OSError, socket.timeout):
-        pass
-    return result
-
-def scan_host(ip, tcp_ports=None, udp_ports=None):
-    tcp_ports = tcp_ports or COMMON_TCP_PORTS
-    udp_ports = udp_ports or COMMON_UDP_PORTS
-    all_ports = tcp_ports + udp_ports
-    results = []
-
-    with typer.progressbar(all_ports, label=f"Scanning {ip}") as progress:
-        with ThreadPoolExecutor(max_workers=100) as executor:
-            futures = {executor.submit(scan_tcp if port in tcp_ports else scan_udp, ip, port): port for port in all_ports}
-
-            for future in as_completed(futures):
-                res = future.result()
-                if res:
-                    with lock:
-                        results.append(res)
-                progress.update(1)
-
-    return results