forensic-cli 1.2.5__py3-none-any.whl

core/email/header_analysis.py

@@ -0,0 +1,87 @@
+import os
+import json
+import csv
+import re
+from datetime import datetime
+
+SPF_REGEX = re.compile(r"spf=(pass|fail|softfail|neutral)", re.IGNORECASE)
+DKIM_REGEX = re.compile(r"dkim=(pass|fail|none)", re.IGNORECASE)
+DMARC_REGEX = re.compile(r"dmarc=(pass|fail|none)", re.IGNORECASE)
+IP_REGEX = re.compile(r"\b\d{1,3}(?:\.\d{1,3}){3}\b")
+
+def extract_ips_from_received(received_headers):
+    ips = []
+    if not received_headers:
+        return ips
+    if isinstance(received_headers, str):
+        received_headers = [received_headers]
+    for header in received_headers:
+        found_ips = IP_REGEX.findall(header)
+        ips.extend(found_ips)
+    return list(set(ips))
+
+def analyze_email_headers(email_data):
+    headers_to_check = ["received", "authentication-results", "spf", "dkim", "dmarc"]
+
+    result = {
+        "subject": email_data.get("subject"),
+        "from": email_data.get("from"),
+        "to": email_data.get("to"),
+        "date": email_data.get("date"),
+        "message_id": email_data.get("message_id"),
+        "spf": "Desconhecido",
+        "dkim": "Desconhecido",
+        "dmarc": "Desconhecido",
+        "origin_ips": [],
+    }
+
+    received_headers = email_data.get("received", [])
+    if received_headers:
+        result["origin_ips"] = extract_ips_from_received(received_headers)
+
+    auth_results = email_data.get("authentication_results", "")
+    if auth_results:
+        spf_match = SPF_REGEX.search(auth_results)
+        dkim_match = DKIM_REGEX.search(auth_results)
+        dmarc_match = DMARC_REGEX.search(auth_results)
+        if spf_match:
+            result["spf"] = spf_match.group(1).lower()
+        if dkim_match:
+            result["dkim"] = dkim_match.group(1).lower()
+        if dmarc_match:
+            result["dmarc"] = dmarc_match.group(1).lower()
+
+    return result
+
+def analyze_emails_from_json(json_file):
+    with open(json_file, "r", encoding="utf-8") as f:
+        emails = json.load(f)
+
+    analyzed_results = []
+    for email_data in emails:
+        analyzed_results.append(analyze_email_headers(email_data))
+    return analyzed_results
+
+def export_analysis(results, prefix="email_header_analysis"):
+    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+    json_file = f"{prefix}_{timestamp}.json"
+    csv_file = f"{prefix}_{timestamp}.csv"
+
+    with open(json_file, "w", encoding="utf-8") as f:
+        json.dump(results, f, indent=4, ensure_ascii=False)
+
+    headers = ["subject", "from", "to", "date", "message_id", "spf", "dkim", "dmarc", "origin_ips"]
+    with open(csv_file, "w", newline="", encoding="utf-8") as f:
+        writer = csv.DictWriter(f, fieldnames=headers)
+        writer.writeheader()
+        for r in results:
+            r_copy = r.copy()
+            r_copy["origin_ips"] = ", ".join(r_copy["origin_ips"])
+            writer.writerow(r_copy)
+
+    print(f"\n✅ Análise de cabeçalhos salva em JSON: {json_file} e CSV: {csv_file}")
+
+if __name__ == "__main__":
+    json_input = input("Digite o caminho do JSON gerado pelo email_parser: ").strip()
+    results = analyze_emails_from_json(json_input)
+    export_analysis(results)

core/models/orm.py

@@ -0,0 +1,48 @@
+from sqlalchemy import Column, String, Text, ForeignKey, DateTime, Integer
+from sqlalchemy.orm import relationship
+from datetime import datetime
+import uuid
+from core.db.db import Base
+
+class Module(Base):
+    __tablename__ = "modules"
+
+    id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
+    name = Column(String, unique=True, index=True)
+    description = Column(Text)
+    functionalities = relationship("Functionality", back_populates="module")
+
+class Functionality(Base):
+    __tablename__ = "functionalities"
+
+    id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
+    module_id = Column(String, ForeignKey("modules.id"))
+    name = Column(String)
+    description = Column(Text)
+
+    module = relationship("Module", back_populates="functionalities")
+    executions = relationship("Execution", back_populates="functionality")
+
+class Execution(Base):
+    __tablename__ = "executions"
+
+    id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
+    functionality_id = Column(String, ForeignKey("functionalities.id"))
+    network = Column(String, nullable=False)
+    status = Column(String, default="started")
+    started_at = Column(DateTime, default=datetime.utcnow)
+    finished_at = Column(DateTime, nullable=True)
+    cli_version = Column(String, nullable=True)
+
+    functionality = relationship("Functionality", back_populates="executions")
+    result = relationship("Result", back_populates="execution", uselist=False)
+
+class Result(Base):
+    __tablename__ = "results"
+
+    id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
+    execution_id = Column(String, ForeignKey("executions.id"))
+    data = Column(Text)
+    created_at = Column(DateTime, default=datetime.utcnow)
+
+    execution = relationship("Execution", back_populates="result")

core/models/schemas.py

@@ -0,0 +1,76 @@
+from pydantic import BaseModel
+from typing import List, Optional, Any
+from datetime import datetime
+
+class ReportBase(BaseModel):
+    file_path: str
+
+class ReportCreate(ReportBase):
+    result_id: str
+
+class Report(ReportBase):
+    id: str
+    created_at: str
+
+    class Config:
+        orm_mode = True
+
+class ResultBase(BaseModel):
+    data: str
+
+class ResultCreate(ResultBase):
+    execution_id: str
+
+class Result(ResultBase):
+    id: str
+    created_at: datetime
+
+    class Config:
+        orm_mode = True
+
+class ExecutionBase(BaseModel):
+    network: str
+    cli_version: Optional[str] = None
+
+class ExecutionCreateSchema(ExecutionBase):
+    func_id: str
+    data: Optional[Any] = None
+
+class ExecutionSchema(ExecutionBase):
+    id: str
+    functionality_id: str
+    status: str
+    started_at: datetime
+    finished_at: Optional[datetime]
+    result: Optional[Result] = None
+
+    class Config:
+        orm_mode = True
+
+class FunctionalityBase(BaseModel):
+    name: str
+    description: Optional[str]
+
+class FunctionalityCreate(FunctionalityBase):
+    module_id: str
+
+class Functionality(FunctionalityBase):
+    id: str
+    executions: List[ExecutionSchema] = []
+
+    class Config:
+        orm_mode = True
+
+class ModuleBase(BaseModel):
+    name: str
+    description: Optional[str]
+
+class ModuleCreate(ModuleBase):
+    pass
+
+class Module(ModuleBase):
+    id: str
+    functionalities: List[Functionality] = []
+
+    class Config:
+        orm_mode = True

core/network/arp_scan.py

@@ -0,0 +1,16 @@
+from scapy.all import ARP, Ether, srp
+import typer
+
+def arp_scan(network_ips):
+    active_hosts = []
+
+    typer.echo(f"[+] Iniciando ARP scan ({len(network_ips)} IPs)...")
+    with typer.progressbar(network_ips, label="ARP Scan") as progress:
+        for ip in network_ips:
+            pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(pdst=ip)
+            ans, _ = srp(pkt, timeout=1, verbose=0)
+            if ans:
+                active_hosts.append(ip)
+            progress.update(1)
+
+    return active_hosts

core/network/dns_recon.py

@@ -0,0 +1,90 @@
+import socket
+import typer
+import json
+import csv
+from pathlib import Path
+
+COMMON_SUBDOMAINS = [
+    "www", "mail", "ftp", "webmail", "smtp", "imap", "pop", "vpn",
+    "portal", "intranet", "extranet", "remote", "login", "sso", "admin",
+    "test", "dev", "staging", "qa", "demo", "beta", "preprod",
+    "api", "api1", "api2", "graphql",
+    "db", "database", "mysql", "postgres", "mongo", "redis", "mssql",
+    "files", "ftp", "storage", "cdn", "download", "uploads",
+    "secure", "firewall", "monitor", "logs", "siem",
+    "ns1", "ns2", "ns3", "dns1", "dns2",
+    "cloud", "aws", "azure", "gcp",
+    "shop", "store", "payment", "support", "helpdesk", "status"
+]
+
+def reverse_dns(ip: str):
+    try:
+        hostname, _, _ = socket.gethostbyaddr(ip)
+
+        return {"ip": ip, "hostname": hostname}
+    except socket.herror:
+        return {"ip": ip, "hostname": "N/A"}
+
+def dns_lookup(domain: str):
+    try:
+        host, _, ips = socket.gethostbyname_ex(domain)
+
+        return {"domain": domain, "ips": ips}
+    except socket.gaierror:
+        return {"domain": domain, "ips": []}
+
+def brute_subdomains(domain: str):
+    found = []
+    for sub in COMMON_SUBDOMAINS:
+        subdomain = f"{sub}.{domain}"
+        try:
+            host, _, ips = socket.gethostbyname_ex(subdomain)
+            found.append({"domain": subdomain, "ips": ips})
+        except socket.gaierror:
+            continue
+
+    return found
+
+def save_results(results: list, output_dir: str, filename: str = "dns_recon"):
+    Path(output_dir).mkdir(parents=True, exist_ok=True)
+
+    json_file = Path(output_dir) / f"{filename}.json"
+    csv_file = Path(output_dir) / f"{filename}.csv"
+
+    with open(json_file, "w", encoding="utf-8") as jf:
+        json.dump(results, jf, indent=4, ensure_ascii=False)
+
+    with open(csv_file, "w", newline="", encoding="utf-8") as cf:
+        writer = csv.writer(cf)
+        writer.writerow(["domain", "ips", "hostname", "ip"])
+        for item in results:
+            writer.writerow([
+                item.get("domain", ""),
+                ", ".join(item.get("ips", [])),
+                item.get("hostname", ""),
+                item.get("ip", "")
+            ])
+
+    return {"json_file": str(json_file), "csv_file": str(csv_file)}
+
+def dns_recon(ips_or_domains: list[str], output_dir: str = None, with_subdomains: bool = False):
+    results = []
+
+    typer.echo(f"[+] Iniciando DNS Recon ({len(ips_or_domains)} alvos)...")
+    with typer.progressbar(ips_or_domains, label="DNS Recon") as progress:
+        for target in progress:
+            if target.count(".") == 3 and all(x.isdigit() for x in target.split(".")):
+                results.append(reverse_dns(target))
+            else:
+                result = dns_lookup(target)
+                results.append(result)
+
+                if with_subdomains:
+                    subs = brute_subdomains(target)
+                    results.extend(subs)
+
+    if output_dir:
+        files = save_results(results, output_dir)
+        typer.echo(f"[+] Resultados salvos em {files['json_file']} e {files['csv_file']}")
+
+    return results

core/network/fingerprinting.py

@@ -0,0 +1,117 @@
+import subprocess
+import platform
+import re
+import typer
+from concurrent.futures import ThreadPoolExecutor, as_completed
+import threading
+
+SERVER_PORTS = [21, 22, 23, 25, 53, 80, 443, 139, 445, 3306, 3389]
+SERVER_TYPE_MAP = {
+    21: "FTP",
+    22: "SSH",
+    23: "Telnet",
+    25: "SMTP",
+    53: "DNS",
+    80: "Web HTTP",
+    443: "Web HTTPS",
+    139: "SMB",
+    445: "SMB",
+    3306: "MySQL",
+    3389: "RDP"
+}
+
+VERSION_ALERTS = {
+    "ftp": ["vsftpd 2.3.4"],
+    "ssh": ["OpenSSH 5.3"],
+    "smb": ["Samba 3.0"],
+    "mysql": ["MySQL 5.5"]
+}
+
+lock = threading.Lock()
+
+def extract_service_version(banner: str):
+    if not banner:
+        return None
+    match = re.search(r"([a-zA-Z]+)[ /]?([0-9]+\.[0-9]+(?:\.[0-9]+)?)", banner)
+    if match:
+        return f"{match.group(1)} {match.group(2)}"
+    return banner.strip()
+
+def detect_os_single(ip: str):
+    os_estimate = "Desconhecido"
+    try:
+        ping_cmd = ["ping", "-c", "1", "-W", "1", ip] if platform.system() != "Windows" else ["ping", "-n", "1", "-w", "1000", ip]
+        ping_proc = subprocess.run(ping_cmd, capture_output=True, text=True)
+        output = ping_proc.stdout
+        ttl_line = next((line for line in output.splitlines() if "ttl=" in line.lower()), None)
+        if ttl_line:
+            ttl = int(ttl_line.lower().split("ttl=")[1].split()[0])
+            if ttl <= 64:
+                os_estimate = "Linux/Unix"
+            elif ttl <= 128:
+                os_estimate = "Windows"
+    except Exception:
+        os_estimate = "Host inatingível"
+    return os_estimate
+
+def detect_os(ip: str, ports=None, mac_vendor=None):
+    os_estimate = detect_os_single(ip)
+    host_type = "Desconhecido"
+    services = []
+    alerts = []
+
+    if ports:
+        for p in ports:
+            banner = p.get("banner", "").lower()
+            service_name = SERVER_TYPE_MAP.get(p["port"], f"Port {p['port']}")
+            services.append(service_name)
+
+            if any(x in banner for x in ["microsoft", "windows"]):
+                os_estimate = "Windows"
+            elif any(x in banner for x in ["linux", "ubuntu", "debian", "centos", "red hat"]):
+                os_estimate = "Linux/Unix"
+
+            for key, vulnerable_versions in VERSION_ALERTS.items():
+                if key in banner:
+                    for v in vulnerable_versions:
+                        if v.lower() in banner:
+                            alerts.append(f"{service_name} vulnerável ({v})")
+
+            version = extract_service_version(p.get("banner"))
+            if version:
+                p["version"] = version
+
+    if mac_vendor:
+        vendor = mac_vendor.lower()
+        if any(x in vendor for x in ["cisco", "huawei", "juniper", "mikrotik"]):
+            os_estimate = "Dispositivo de rede"
+            host_type = "Roteador/Switch"
+
+    if ports and host_type == "Desconhecido":
+        port_numbers = [p["port"] for p in ports]
+        server_ports = [p for p in SERVER_PORTS if p in port_numbers]
+        host_type = "Servidor" if server_ports else "Desktop"
+
+    return {
+        "os": os_estimate,
+        "host_type": host_type,
+        "services": services,
+        "alerts": alerts
+    }
+
+def detect_os_with_progress(ip_ports_list):
+    results = []
+    with typer.progressbar(ip_ports_list, label="Fingerprinting") as progress:
+        with ThreadPoolExecutor(max_workers=50) as executor:
+            futures = {executor.submit(detect_os, ip_ports['ip'], ip_ports.get('ports'), ip_ports.get('mac')): ip_ports for ip_ports in ip_ports_list}
+
+            for future in as_completed(futures):
+                ip_ports = futures[future]
+                try:
+                    res = future.result()
+                    with lock:
+                        results.append({"ip": ip_ports['ip'], "fingerprint": res})
+                except Exception:
+                    pass
+                progress.update(1)
+    return results

core/network/ip_info.py

@@ -0,0 +1,29 @@
+import typer
+import ipwhois
+
+def ip_info_lookup(ip):
+    try:
+        obj = ipwhois.IPWhois(ip)
+        res = obj.lookup_rdap()
+
+        return {
+            "ip": ip,
+            "asn": res.get("asn"),
+            "asn_country": res.get("asn_country_code"),
+            "network_name": res.get("network", {}).get("name"),
+            "org": res.get("network", {}).get("org"),
+            "cidr": res.get("network", {}).get("cidr")
+        }
+    except Exception:
+        return {"ip": ip, "error": "Não foi possível obter informações"}
+
+def ip_info_batch(ips):
+    results = []
+
+    typer.echo(f"[+] Iniciando IP Info Lookup ({len(ips)} IPs)...")
+    with typer.progressbar(ips, label="IP Info") as progress:
+        for ip in ips:
+            results.append(ip_info_lookup(ip))
+            progress.update(1)
+
+    return results

core/network/network_map.py

@@ -0,0 +1,120 @@
+import os
+import json
+import csv
+from datetime import datetime
+import threading
+import typer
+
+from core.network.ping_sweep import ping_sweep
+from core.network.arp_scan import arp_scan
+from core.network.port_scanner import scan_host
+from core.network.utils import get_mac, get_vendor, get_hostname
+from core.network.fingerprinting import detect_os
+from core.network.traceroute import traceroute_host
+from core.network.snmp_scan import snmp_scan
+from core.network.dns_recon import dns_recon
+from core.network.smb_scan import smb_scan
+from core.network.ip_info import ip_info_lookup
+
+lock = threading.Lock()
+
+def build_network_map(network):
+    hosts = ping_sweep(network)
+    if not hosts:
+        hosts = arp_scan(network)
+
+    results = []
+
+    typer.echo(f"[+] Iniciando varredura da rede ({len(hosts)} hosts)...")
+
+    with typer.progressbar(hosts, label="Network Map") as progress:
+        for host in hosts:
+            open_ports = scan_host(host)
+
+            try:
+                mac = get_mac(host)
+                vendor = get_vendor(mac) if mac else None
+            except Exception:
+                mac = None
+                vendor = None
+
+            hostname = get_hostname(host)
+            os_info = detect_os(host, ports=open_ports, mac_vendor=vendor)
+
+            hops = traceroute_host(host)
+
+            snmp_info = snmp_scan(host)
+
+            dns_info = dns_recon([host])
+
+            smb_info = smb_scan([host])
+
+            ip_info = ip_info_lookup(host)
+
+            host_data = {
+                "host": host,
+                "hostname": hostname,
+                "mac": mac,
+                "vendor": vendor,
+                "open_ports": open_ports,
+                "os_info": os_info,
+                "traceroute": hops,
+                "snmp": snmp_info,
+                "dns": dns_info[0] if dns_info else {},
+                "smb": smb_info[0] if smb_info else {},
+                "ip_info": ip_info
+            }
+
+            with lock:
+                results.append(host_data)
+
+            progress.update(1)
+
+    return results
+
+def save_network_map(results, output_dir: str, prefix="network_map"):
+    os.makedirs(output_dir, exist_ok=True)
+    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+
+    json_file = os.path.join(output_dir, f"{prefix}_{timestamp}.json")
+    csv_file = os.path.join(output_dir, f"{prefix}_{timestamp}.csv")
+
+    with open(json_file, "w", encoding="utf-8") as f:
+        json.dump(results, f, indent=4, ensure_ascii=False)
+
+    with open(csv_file, "w", newline="", encoding="utf-8") as f:
+        fieldnames = ["host", "hostname", "mac", "vendor", "os_type", "host_type",
+                      "open_ports_count", "traceroute_hops", "snmp_sys_name", "dns_hostname",
+                      "smb_shares_count", "vulnerabilities_count", "asn", "network_name"]
+        writer = csv.DictWriter(f, fieldnames=fieldnames)
+        writer.writeheader()
+
+        for row in results:
+            writer.writerow({
+                "host": row["host"],
+                "hostname": row["hostname"],
+                "mac": row["mac"],
+                "vendor": row["vendor"],
+                "os_type": row["os_info"].get("os"),
+                "host_type": row["os_info"].get("host_type"),
+                "open_ports_count": len(row["open_ports"]),
+                "traceroute_hops": len(row["traceroute"]),
+                "snmp_sys_name": row["snmp"].get("sys_name"),
+                "dns_hostname": row["dns"].get("hostname"),
+                "smb_shares_count": len(row["smb"].get("shares", [])),
+                "asn": row["ip_info"].get("asn"),
+                "network_name": row["ip_info"].get("network_name"),
+            })
+
+    return json_file, csv_file
+
+def run(network: str, output_dir: str, prefix="network_map"):
+    results = build_network_map(network)
+    json_file, csv_file = save_network_map(results, output_dir, prefix)
+
+    typer.echo(f"[+] Network map salvo em: {json_file} e {csv_file}")
+    return {
+        "results": results,
+        "json_file": json_file,
+        "csv_file": csv_file,
+    }

core/network/ping_sweep.py

@@ -0,0 +1,53 @@
+import platform
+import subprocess
+from scapy.all import conf, ARP, Ether, srp
+from concurrent.futures import ThreadPoolExecutor, as_completed
+import threading
+import typer
+
+conf.verb = 0
+lock = threading.Lock()
+
+def parse_network(network: str):
+    if "-" in network:
+        base_ip = network.rsplit(".", 1)[0]
+        start, end = network.rsplit(".", 1)[1].split("-")
+        return [f"{base_ip}.{i}" for i in range(int(start), int(end)+1)]
+    else:
+        return [network]
+
+def ping_host(ip: str) -> bool:
+    try:
+        if platform.system() == "Windows":
+            output = subprocess.run(
+                ["ping", "-n", "1", "-w", "500", ip],
+                capture_output=True,
+                text=True
+            )
+            return "TTL=" in output.stdout.upper()
+        else:
+            pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(pdst=ip)
+            ans, _ = srp(pkt, timeout=1, verbose=0)
+            return bool(ans)
+    except Exception:
+        return False
+
+def ping_sweep(network: str):
+    ips = parse_network(network)
+    hosts = []
+
+    with typer.progressbar(ips, label="Ping Sweep") as progress:
+        with ThreadPoolExecutor(max_workers=50) as executor:
+            futures = {executor.submit(ping_host, ip): ip for ip in ips}
+
+            for future in as_completed(futures):
+                ip = futures[future]
+                try:
+                    if future.result():
+                        with lock:
+                            hosts.append(ip)
+                except Exception:
+                    pass
+                progress.update(1)
+
+    return hosts