gyntoolkit 2.1.1__tar.gz → 2.2.0__tar.gz

{gyntoolkit-2.1.1 → gyntoolkit-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gyntoolkit
-Version: 2.1.1
+Version: 2.2.0
 Summary: Canivete suíço de pentest — recon, port scan, CVE lookup e brute force.
 Author: PH, Fl4vs
 License-Expression: MIT
@@ -49,7 +49,7 @@ Dynamic: license-file
  ██████╗██╗   ██╗███╗   ██╗    ████████╗ ██████╗  ██████╗ ██╗     ██╗  ██╗██╗████████╗
 ██╔════╝╚██╗ ██╔╝████╗  ██║    ╚══██╔══╝██╔═══██╗██╔═══██╗██║     ██║ ██╔╝██║╚══██╔══╝
 ██║  ███╗╚████╔╝ ██╔██╗ ██║       ██║   ██║   ██║██║   ██║██║     █████╔╝ ██║   ██║
-██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.1
+██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.2
 ╚██████╔╝  ██║   ██║ ╚████║       ██║   ╚██████╔╝╚██████╔╝███████╗██║  ██╗██║   ██║   by: PH,Fl4vs
  ╚═════╝   ╚═╝   ╚═╝  ╚═══╝       ╚═╝    ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝   ╚═╝
 ```
@@ -124,23 +124,30 @@ Dynamic: license-file
 | 9 | **HIBP Breach Check** | Domain → known breaches via Have I Been Pwned |
 | 10 | **MAC Vendor Lookup** | `api.macvendors.com` — OUI → vendor |
 | 11 | **Traceroute (TCP)** | `scapy` — hops + RTT (needs privilege) |
+| 12 | **DNS Zone Transfer (AXFR)** | `dnspython` — tries AXFR against each authoritative NS |
+| 13 | **Web Content Discovery** | `aiohttp` — robots.txt / sitemap / security.txt + built-in path wordlist |
+| 14 | **Shodan Host** | Full `api.shodan.io` host lookup (ports, CPEs, CVEs, tags) — needs `api_keys.shodan`; falls back to InternetDB hint without a key |
 
 ### `[2]` Brute Force
 
 | # | Module | Details |
 |---|--------|---------|
-| 1 | **CUPP wordlist** | Wrapper for `cupp.py -i` — custom wordlist generator |
-| 2 | **SSH brute** | `paramiko`, async via `asyncio.to_thread`, concurrency `Semaphore`, delay |
-| 3 | **HTTP brute** | `aiohttp` — Basic Auth or form POST with configurable `fail_signature` |
+| 1 | **Native wordlist** | Built-in CUPP-style generator (offline, no external clone) — case/leet variants, years, suffixes, term combos |
+| 2 | **CUPP wordlist** | Optional wrapper for `cupp.py -i` |
+| 3 | **SSH brute** | `paramiko`, async via `asyncio.to_thread`, concurrency `Semaphore`, delay |
+| 4 | **HTTP brute** | `aiohttp` — Basic Auth or form POST with configurable `fail_signature` |
 
-> Every attack requires typing `AUTORIZO` to confirm — no silent bypass.
+> Every attack requires typing the authorization word (`AUTHORIZE` / `AUTORIZO`)
+> to confirm — no silent bypass.
 
 ### `[3]` Advanced Scanning
 
 - **Port scan** — fast (Top 21 common ports) or full (1–65535)
 - **SYN scan** (stealth) when privileged, automatic fallback to **TCP connect**
 - **Banner grabbing** — async, parallel
-- **CVE analysis** per service via **NVD API v2.0**
+- **CVE analysis** per service via **NVD API v2.0** — parses product + version
+  from the banner and matches by **CPE** (`virtualMatchString`), falling back to
+  keyword search; rate-limited and deduplicated per banner
 - **Host discovery** (ARP scan) by CIDR — e.g. `192.168.0.0/24`
 - Automatic risk classification based on CVEs found
 
@@ -203,6 +210,46 @@ An interactive dark CLI opens with a numbered menu. Commands are entered at the
 
 ---
 
+## Non-interactive CLI (scriptable)
+
+Pass a subcommand to run a single action and print the result as JSON on stdout
+(pipe-friendly) — no menu. Omit the subcommand to open the interactive menu.
+
+```bash
+gyntoolkit recon dns example.com --type MX        # DNS lookup
+gyntoolkit recon axfr example.com                 # zone transfer attempt
+gyntoolkit recon webscan http://example.com       # web content discovery
+gyntoolkit recon shodan 1.1.1.1                   # Shodan host (needs api_keys.shodan)
+gyntoolkit recon ssl example.com --port 443       # TLS cert
+gyntoolkit scan 127.0.0.1 --type fast             # port scan + CVEs
+gyntoolkit scan 192.168.0.0/24                    # host discovery (CIDR)
+gyntoolkit utils hash "text" --algo sha1
+gyntoolkit utils jwt <token>
+gyntoolkit wordlist --terms alice,fluffy,acme --years 1990,2020 --leet --save wl.txt
+```
+
+Global flags (place after the subcommand): `-o/--output DIR` saves a report,
+`-f/--format {json,html,csv,md}` picks its format, `-q/--quiet` silences stdout,
+`--lang {en,pt}` overrides the language.
+
+```bash
+gyntoolkit scan scanme.example.com -o reports -f md     # also save a Markdown report
+gyntoolkit recon geo 1.1.1.1 -o reports -f csv -q       # CSV only, no stdout
+```
+
+Active attacks are available but require explicit authorization:
+
+```bash
+gyntoolkit brute ssh HOST --users users.txt --passwords pass.txt --authorize
+gyntoolkit brute http URL  --users admin --passwords pass.txt --mode form \
+  --user-field user --pass-field pass --fail-signature "Invalid" --authorize
+```
+
+Without `--authorize`, brute subcommands abort — you confirm you have **written
+authorization** for the target.
+
+---
+
 ## Example
 
 Target: the **local security lab** (never a third-party system).
@@ -256,8 +303,8 @@ Full walkthrough: [`docs/security-lab.md`](docs/security-lab.md) and
 
 ## Reports
 
-After scans and recon lookups, the CLI offers to export results as **JSON** or a
-dark-themed **HTML report**. Files are written to
+After scans and recon lookups, the CLI offers to export results as **JSON**, a
+dark-themed **HTML report**, **CSV** or **Markdown**. Files are written to
 `reports/<module>-<timestamp>.<fmt>` (configurable via `export.dir`; set
 `export.auto: true` to export without prompting). Details in
 [`docs/reports.md`](docs/reports.md).

{gyntoolkit-2.1.1 → gyntoolkit-2.2.0}/README.md

@@ -6,7 +6,7 @@
  ██████╗██╗   ██╗███╗   ██╗    ████████╗ ██████╗  ██████╗ ██╗     ██╗  ██╗██╗████████╗
 ██╔════╝╚██╗ ██╔╝████╗  ██║    ╚══██╔══╝██╔═══██╗██╔═══██╗██║     ██║ ██╔╝██║╚══██╔══╝
 ██║  ███╗╚████╔╝ ██╔██╗ ██║       ██║   ██║   ██║██║   ██║██║     █████╔╝ ██║   ██║
-██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.1
+██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.2
 ╚██████╔╝  ██║   ██║ ╚████║       ██║   ╚██████╔╝╚██████╔╝███████╗██║  ██╗██║   ██║   by: PH,Fl4vs
  ╚═════╝   ╚═╝   ╚═╝  ╚═══╝       ╚═╝    ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝   ╚═╝
 ```
@@ -81,23 +81,30 @@
 | 9 | **HIBP Breach Check** | Domain → known breaches via Have I Been Pwned |
 | 10 | **MAC Vendor Lookup** | `api.macvendors.com` — OUI → vendor |
 | 11 | **Traceroute (TCP)** | `scapy` — hops + RTT (needs privilege) |
+| 12 | **DNS Zone Transfer (AXFR)** | `dnspython` — tries AXFR against each authoritative NS |
+| 13 | **Web Content Discovery** | `aiohttp` — robots.txt / sitemap / security.txt + built-in path wordlist |
+| 14 | **Shodan Host** | Full `api.shodan.io` host lookup (ports, CPEs, CVEs, tags) — needs `api_keys.shodan`; falls back to InternetDB hint without a key |
 
 ### `[2]` Brute Force
 
 | # | Module | Details |
 |---|--------|---------|
-| 1 | **CUPP wordlist** | Wrapper for `cupp.py -i` — custom wordlist generator |
-| 2 | **SSH brute** | `paramiko`, async via `asyncio.to_thread`, concurrency `Semaphore`, delay |
-| 3 | **HTTP brute** | `aiohttp` — Basic Auth or form POST with configurable `fail_signature` |
+| 1 | **Native wordlist** | Built-in CUPP-style generator (offline, no external clone) — case/leet variants, years, suffixes, term combos |
+| 2 | **CUPP wordlist** | Optional wrapper for `cupp.py -i` |
+| 3 | **SSH brute** | `paramiko`, async via `asyncio.to_thread`, concurrency `Semaphore`, delay |
+| 4 | **HTTP brute** | `aiohttp` — Basic Auth or form POST with configurable `fail_signature` |
 
-> Every attack requires typing `AUTORIZO` to confirm — no silent bypass.
+> Every attack requires typing the authorization word (`AUTHORIZE` / `AUTORIZO`)
+> to confirm — no silent bypass.
 
 ### `[3]` Advanced Scanning
 
 - **Port scan** — fast (Top 21 common ports) or full (1–65535)
 - **SYN scan** (stealth) when privileged, automatic fallback to **TCP connect**
 - **Banner grabbing** — async, parallel
-- **CVE analysis** per service via **NVD API v2.0**
+- **CVE analysis** per service via **NVD API v2.0** — parses product + version
+  from the banner and matches by **CPE** (`virtualMatchString`), falling back to
+  keyword search; rate-limited and deduplicated per banner
 - **Host discovery** (ARP scan) by CIDR — e.g. `192.168.0.0/24`
 - Automatic risk classification based on CVEs found
 
@@ -160,6 +167,46 @@ An interactive dark CLI opens with a numbered menu. Commands are entered at the
 
 ---
 
+## Non-interactive CLI (scriptable)
+
+Pass a subcommand to run a single action and print the result as JSON on stdout
+(pipe-friendly) — no menu. Omit the subcommand to open the interactive menu.
+
+```bash
+gyntoolkit recon dns example.com --type MX        # DNS lookup
+gyntoolkit recon axfr example.com                 # zone transfer attempt
+gyntoolkit recon webscan http://example.com       # web content discovery
+gyntoolkit recon shodan 1.1.1.1                   # Shodan host (needs api_keys.shodan)
+gyntoolkit recon ssl example.com --port 443       # TLS cert
+gyntoolkit scan 127.0.0.1 --type fast             # port scan + CVEs
+gyntoolkit scan 192.168.0.0/24                    # host discovery (CIDR)
+gyntoolkit utils hash "text" --algo sha1
+gyntoolkit utils jwt <token>
+gyntoolkit wordlist --terms alice,fluffy,acme --years 1990,2020 --leet --save wl.txt
+```
+
+Global flags (place after the subcommand): `-o/--output DIR` saves a report,
+`-f/--format {json,html,csv,md}` picks its format, `-q/--quiet` silences stdout,
+`--lang {en,pt}` overrides the language.
+
+```bash
+gyntoolkit scan scanme.example.com -o reports -f md     # also save a Markdown report
+gyntoolkit recon geo 1.1.1.1 -o reports -f csv -q       # CSV only, no stdout
+```
+
+Active attacks are available but require explicit authorization:
+
+```bash
+gyntoolkit brute ssh HOST --users users.txt --passwords pass.txt --authorize
+gyntoolkit brute http URL  --users admin --passwords pass.txt --mode form \
+  --user-field user --pass-field pass --fail-signature "Invalid" --authorize
+```
+
+Without `--authorize`, brute subcommands abort — you confirm you have **written
+authorization** for the target.
+
+---
+
 ## Example
 
 Target: the **local security lab** (never a third-party system).
@@ -213,8 +260,8 @@ Full walkthrough: [`docs/security-lab.md`](docs/security-lab.md) and
 
 ## Reports
 
-After scans and recon lookups, the CLI offers to export results as **JSON** or a
-dark-themed **HTML report**. Files are written to
+After scans and recon lookups, the CLI offers to export results as **JSON**, a
+dark-themed **HTML report**, **CSV** or **Markdown**. Files are written to
 `reports/<module>-<timestamp>.<fmt>` (configurable via `export.dir`; set
 `export.auto: true` to export without prompting). Details in
 [`docs/reports.md`](docs/reports.md).

{gyntoolkit-2.1.1 → gyntoolkit-2.2.0}/gyntoolkit/__init__.py

@@ -5,7 +5,7 @@ Este ``__init__`` re-exporta a API pública para manter compatibilidade com
 ``import gyntoolkit as g`` (usado pelo lab E2E) e pelo entry point do pyproject.
 """
 
-__version__ = "2.1.1"
+__version__ = "2.2.0"
 
 from . import i18n, ui
 from .brute import (
@@ -29,7 +29,7 @@ from .core import (
     sanitize_input,
     show_menu,
 )
-from .export import export_html, export_json, save_report
+from .export import export_csv, export_html, export_json, export_md, save_report
 from .recon import (
     DNS_TYPES,
     TECH_SIGNATURES,
@@ -41,20 +41,25 @@ from .recon import (
     internetdb_lookup,
     mac_vendor,
     reverse_dns,
+    shodan_host,
     ssl_inspect,
     subdomain_enum,
     traceroute,
     whois_lookup,
+    zone_transfer,
 )
 from .scan import (
     check_vulnerabilities,
     connect_scan,
     get_banner,
     network_discovery,
+    parse_service,
     perform_scan,
     syn_scan,
 )
 from .utils import b64_decode, b64_encode, hash_file, hash_text, jwt_decode
+from .web import COMMON_PATHS, web_discovery
+from .wordlist import generate_wordlist
 
 __all__ = [
     "__version__",
@@ -63,18 +68,24 @@ __all__ = [
     "clear_screen", "is_admin_windows", "sanitize_input", "show_menu",
     # scan
     "syn_scan", "connect_scan", "get_banner", "check_vulnerabilities",
-    "network_discovery", "perform_scan",
+    "parse_service", "network_discovery", "perform_scan",
     # recon
     "whois_lookup", "dns_lookup", "geo_ip", "reverse_dns", "subdomain_enum",
     "ssl_inspect", "http_fingerprint", "internetdb_lookup", "hibp_breaches",
-    "mac_vendor", "traceroute", "escolher_tipo_dns", "DNS_TYPES", "TECH_SIGNATURES",
+    "mac_vendor", "traceroute", "zone_transfer", "shodan_host",
+    "escolher_tipo_dns", "DNS_TYPES", "TECH_SIGNATURES",
+    # web discovery
+    "web_discovery", "COMMON_PATHS",
+    # wordlist
+    "generate_wordlist",
     # brute
     "print_ethical_warning", "load_wordlist", "cupp_generate",
     "ssh_bruteforce", "http_bruteforce",
     # utils
     "hash_text", "hash_file", "b64_encode", "b64_decode", "jwt_decode",
     # config / export / ui
-    "CONFIG", "DEFAULTS", "load_config", "save_report", "export_json", "export_html", "ui", "i18n",
+    "CONFIG", "DEFAULTS", "load_config", "save_report",
+    "export_json", "export_html", "export_csv", "export_md", "ui", "i18n",
     # cli
     "main_flow", "main_entry",
 ]

{gyntoolkit-2.1.1 → gyntoolkit-2.2.0}/gyntoolkit/brute.py

@@ -21,7 +21,9 @@ def print_ethical_warning(action: str) -> bool:
     print(f"{Fore.RED}{i18n.t('brute.warn_crime')}{Style.RESET_ALL}")
     print(f"{Fore.RED}{'=' * 60}{Style.RESET_ALL}")
     confirm = input(f"{Fore.YELLOW}{i18n.t('brute.confirm')}{Style.RESET_ALL}").strip()
-    return confirm == "AUTORIZO"
+    # Aceita a palavra localizada (en/pt) e o legado "AUTORIZO" como alias.
+    accepted = {i18n.t("brute.confirm_word").strip().upper(), "AUTORIZO"}
+    return confirm.upper() in accepted
 
 
 def load_wordlist(path: str) -> list[str]:
@@ -158,7 +160,9 @@ async def http_bruteforce(
                     if mode == "basic":
                         auth = aiohttp.BasicAuth(u, p)
                         async with session.get(url, auth=auth) as r:
-                            ok = r.status not in (401, 403)
+                            # Basic Auth: sucesso = 2xx. 401/403 = falha; 404/5xx
+                            # NÃO são credencial válida (evita falso-positivo).
+                            ok = 200 <= r.status < 300
                     else:
                         payload = {user_field: u, pass_field: p}
                         async with session.post(url, data=payload, allow_redirects=False) as r:

{gyntoolkit-2.1.1 → gyntoolkit-2.2.0}/gyntoolkit/cli.py

@@ -29,13 +29,17 @@ from .recon import (
     internetdb_lookup,
     mac_vendor,
     reverse_dns,
+    shodan_host,
     ssl_inspect,
     subdomain_enum,
     traceroute,
     whois_lookup,
+    zone_transfer,
 )
 from .scan import network_discovery, perform_scan
 from .utils import b64_decode, b64_encode, hash_file, hash_text, jwt_decode
+from .web import web_discovery
+from .wordlist import generate_wordlist
 
 # Valores canônicos de scan_type (DATA, usados por perform_scan). Neutros de
 # idioma; entradas localizadas (en/pt) são mapeadas por _normalize_scan_type.
@@ -113,6 +117,9 @@ async def main_flow():
                 i18n.t("menu.info.hibp"),
                 i18n.t("menu.info.macvendor"),
                 i18n.t("menu.info.traceroute"),
+                i18n.t("menu.info.axfr"),
+                i18n.t("menu.info.webscan"),
+                i18n.t("menu.info.shodan"),
             ])
 
             if sub_choice == 1:
@@ -266,17 +273,84 @@ async def main_flow():
                     _offer_export({"target": target, "dport": dport, "hops": hops},
                                   f"traceroute-{target}", f"Traceroute {target}")
 
+            elif sub_choice == 12:
+                domain = sanitize_input(input(_cyan("prompt.root_domain")), r"[A-Za-z0-9.-]")
+                with ui.status(i18n.t("status.axfr", d=domain)):
+                    r = zone_transfer(domain)
+                if "erro" in r:
+                    ui.error(r["erro"])
+                else:
+                    if r.get("vulnerable"):
+                        ui.error(i18n.t("msg.axfr_vulnerable"))
+                    else:
+                        ui.success(i18n.t("msg.axfr_safe"))
+                    ui.print_kv(i18n.t("label.axfr", d=domain), r["nameservers"])
+                    _offer_export(r, f"axfr-{domain}", f"Zone Transfer {domain}")
+
+            elif sub_choice == 13:
+                url = input(f"\n{Fore.CYAN}{i18n.t('prompt.url_http')}{Style.RESET_ALL}").strip()
+                with ui.status(i18n.t("status.webscan", u=url)):
+                    r = await web_discovery(url)
+                if "erro" in r:
+                    ui.error(r["erro"])
+                elif not r["found"]:
+                    ui.notice(i18n.t("msg.webscan_none", u=url))
+                else:
+                    rows = [
+                        (f["status"], f["path"], f["length"], f.get("location") or "—")
+                        for f in r["found"]
+                    ]
+                    ui.print_table(i18n.t("label.webscan", u=r["base"], n=r["total"]),
+                                   i18n.t("table.webscan").split("|"), rows)
+                    _offer_export(r, f"webscan-{url}", f"Web Discovery {url}")
+
+            elif sub_choice == 14:
+                target = sanitize_input(input(_cyan("prompt.ip_or_domain")), r"[A-Za-z0-9.:-]")
+                key = CONFIG.get("api_keys", {}).get("shodan", "")
+                with ui.status(i18n.t("status.shodan", t=target)):
+                    info = shodan_host(target, api_key=key)
+                if "erro" in info:
+                    ui.error(info["erro"])
+                elif "info" in info:
+                    ui.notice(info["info"])
+                else:
+                    ui.print_kv(i18n.t("label.shodan", t=target), info)
+                    _offer_export(info, f"shodan-{target}", f"Shodan {target}")
+
         elif choice == 2:  # Brute Force
             b = CONFIG["brute"]
             sub_choice = show_menu(i18n.t("menu.brute.title"), [
                 i18n.t("menu.brute.cupp"),
                 i18n.t("menu.brute.ssh"),
                 i18n.t("menu.brute.http"),
+                i18n.t("menu.brute.genwl"),
             ])
 
             if sub_choice == 1:
                 cupp_generate()
 
+            elif sub_choice == 4:
+                terms_raw = input(f"\n{Fore.CYAN}{i18n.t('prompt.wl_terms')}{Style.RESET_ALL}")
+                terms = [t for t in terms_raw.split(",") if t.strip()]
+                if not terms:
+                    ui.error(i18n.t("msg.wl_empty"))
+                    _pause()
+                    continue
+                years_raw = input(f"{Fore.CYAN}{i18n.t('prompt.wl_years')}{Style.RESET_ALL}")
+                years = [y for y in years_raw.split(",") if y.strip()]
+                leet = input(f"{Fore.CYAN}{i18n.t('prompt.wl_leet')}{Style.RESET_ALL}").strip().lower() in ("y", "s")
+                save = input(f"{Fore.CYAN}{i18n.t('prompt.wl_save')}{Style.RESET_ALL}").strip()
+                words = generate_wordlist(terms, years=years, use_leet=leet)
+                ui.success(i18n.t("msg.wl_generated", n=len(words)))
+                if save:
+                    try:
+                        Path(save).expanduser().write_text("\n".join(words) + "\n", encoding="utf-8")
+                        ui.success(i18n.t("msg.wl_saved", path=save))
+                    except OSError as e:
+                        ui.error(i18n.t("msg.export_fail", err=e))
+                else:
+                    print("\n".join(words))
+
             elif sub_choice == 2:
                 if not print_ethical_warning("Brute-force SSH"):
                     ui.error(i18n.t("msg.auth_not_confirmed"))
@@ -371,9 +445,13 @@ async def main_flow():
                 targets = [target]
 
             report = {}
+            scan_concurrency = CONFIG["scan"].get("concurrency", 100)
+            nvd_key = CONFIG.get("api_keys", {}).get("nvd", "")
             for host in targets:
                 with ui.status(i18n.t("status.scanning", h=host)):
-                    results = await perform_scan(host, scan_type)
+                    results = await perform_scan(
+                        host, scan_type, concurrency=scan_concurrency, nvd_api_key=nvd_key
+                    )
                 report[host] = results
                 rows = [
                     (port, _scan_service_label(data["service"]), _scan_risk_label(data["risco"]),
@@ -437,8 +515,18 @@ async def main_flow():
 
 
 def main_entry() -> None:
-    """Entry point CLI (usado por pyproject scripts)."""
-    i18n.set_lang(i18n.resolve_lang(CONFIG.get("ui", {}).get("lang")))
+    """Entry point CLI (usado por pyproject scripts).
+
+    Com subcomando (``gyntoolkit recon dns ...``) roda a CLI não-interativa e
+    sai. Sem subcomando, abre o menu interativo clássico.
+    """
+    from . import commands
+
+    rc = commands.run()
+    if rc != -1:  # subcomando executado (ou erro) → não abre o menu
+        sys.exit(rc)
+
+    # Sem subcomando: menu interativo. i18n já foi resolvido em commands.run().
     try:
         if os.name == 'posix' and os.geteuid() != 0:
             print(f"\n{Fore.RED}{i18n.t('warn.need_root')}{Style.RESET_ALL}")