moriarty-project 0.1.6__py3-none-any.whl

moriarty/modules/email_check.py

@@ -0,0 +1,98 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import List, Optional
+
+from email_validator import EmailNotValidError, validate_email
+
+from ..net.dns_client import DNSClient, DNSLookupResult
+from ..net.smtp_client import SMTPClient, SMTPProbeResult
+
+
+@dataclass(slots=True)
+class EmailCheckOptions:
+    check_dns: bool = True
+    check_smtp: bool = False
+    from_address: str = "postmaster@localhost"
+    retries: int = 1
+    wait: float = 1.0
+
+
+@dataclass(slots=True)
+class EmailCheckResult:
+    input_email: str
+    normalized_email: str
+    local_part: str
+    domain: str
+    dns: Optional[DNSLookupResult]
+    smtp: Optional[SMTPProbeResult]
+    warnings: List[str]
+
+
+class EmailCheckService:
+    """Run DNS and SMTP probes for an email address."""
+
+    def __init__(self, email: str, options: EmailCheckOptions, timeout: float = 8.0) -> None:
+        self._raw_email = email
+        self._options = options
+        self._timeout = timeout
+
+    async def run(self) -> EmailCheckResult:
+        normalized = self._normalize_email(self._raw_email)
+        domain = normalized["domain"]
+        local_part = normalized["local_part"]
+        warnings: List[str] = []
+
+        dns_result: Optional[DNSLookupResult] = None
+        if self._options.check_dns:
+            dns_client = DNSClient(timeout=self._timeout)
+            dns_result = await dns_client.lookup_domain(domain)
+            if not dns_result.mx:
+                warnings.append("Domain has no MX records; falling back to A/AAAA for SMTP.")
+
+        smtp_result: Optional[SMTPProbeResult] = None
+        if self._options.check_smtp:
+            smtp_client = SMTPClient(timeout=self._timeout, wait=self._options.wait, retries=self._options.retries)
+            hosts: List[str] = []
+            if dns_result and dns_result.mx:
+                hosts = [record.exchange.rstrip('.') for record in dns_result.mx]
+            elif dns_result and (dns_result.a or dns_result.aaaa):
+                hosts = [domain]
+            else:
+                hosts = [domain]
+                warnings.append("No DNS information available; SMTP probe will target the domain directly.")
+
+            smtp_result = await smtp_client.probe(
+                email=normalized["email"],
+                from_address=self._options.from_address,
+                hosts=hosts,
+            )
+
+        return EmailCheckResult(
+            input_email=self._raw_email,
+            normalized_email=normalized["email"],
+            local_part=local_part,
+            domain=domain,
+            dns=dns_result,
+            smtp=smtp_result,
+            warnings=warnings,
+        )
+
+    @staticmethod
+    def _normalize_email(raw_email: str) -> dict[str, str]:
+        try:
+            validated = validate_email(raw_email, check_deliverability=False)
+        except EmailNotValidError as exc:
+            raise ValueError(f"Invalid email address: {exc}") from exc
+
+        normalized_attr = getattr(validated, "normalized", None)
+        normalized_email = (normalized_attr or validated.email).lower()
+        local_part, domain = normalized_email.split("@", 1)
+        return {
+            "email": normalized_email,
+            "local_part": local_part,
+            "domain": domain,
+        }
+
+
+__all__ = ["EmailCheckOptions", "EmailCheckResult", "EmailCheckService"]

moriarty/modules/email_investigate.py

@@ -0,0 +1,267 @@
+from __future__ import annotations
+
+import asyncio
+import hashlib
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional
+
+import httpx
+import structlog
+
+from ..models.entity import Entity
+from ..models.types import EntityKind
+
+logger = structlog.get_logger(__name__)
+
+
+@dataclass(slots=True)
+class SocialProfile:
+    """Perfil encontrado em uma plataforma."""
+
+    platform: str
+    url: str
+    username: Optional[str] = None
+    user_id: Optional[str] = None
+    display_name: Optional[str] = None
+    avatar_url: Optional[str] = None
+    bio: Optional[str] = None
+    verified: bool = False
+    confidence: float = 0.5
+    metadata: Dict[str, Any] = None
+
+    def __post_init__(self) -> None:
+        if self.metadata is None:
+            self.metadata = {}
+
+
+@dataclass(slots=True)
+class EmailInvestigationResult:
+    """Resultado de uma investigação profunda de email."""
+
+    email: str
+    normalized_email: str
+    domain: str
+    local_part: str
+    
+    # Gravatar
+    gravatar_hash: str
+    gravatar_profile: Optional[Dict[str, Any]] = None
+    gravatar_avatar: Optional[str] = None
+    
+    # Social profiles
+    social_profiles: List[SocialProfile] = None
+    
+    # Breaches
+    breached: bool = False
+    breach_count: int = 0
+    breaches: List[Dict[str, Any]] = None
+    
+    # Linked data
+    phone_numbers: List[str] = None
+    websites: List[str] = None
+    usernames: List[str] = None
+    
+    # Metadata
+    total_platforms_found: int = 0
+    search_timestamp: str = ""
+
+    def __post_init__(self) -> None:
+        if self.social_profiles is None:
+            self.social_profiles = []
+        if self.breaches is None:
+            self.breaches = []
+        if self.phone_numbers is None:
+            self.phone_numbers = []
+        if self.websites is None:
+            self.websites = []
+        if self.usernames is None:
+            self.usernames = []
+
+
+class EmailInvestigator:
+    """Investiga email em múltiplas fontes."""
+
+    def __init__(self, timeout: float = 8.0, user_agent: Optional[str] = None) -> None:
+        self._timeout = timeout
+        self._user_agent = user_agent or "Moriarty/0.1.0 (OSINT Client)"
+
+    async def investigate(self, email: str) -> EmailInvestigationResult:
+        """Executa investigação completa."""
+        from datetime import datetime, timezone
+        from email_validator import validate_email
+        
+        # Normaliza
+        validated = validate_email(email, check_deliverability=False)
+        normalized = validated.normalized or validated.email
+        local_part, domain = normalized.lower().split("@", 1)
+        
+        # Gera hash Gravatar
+        gravatar_hash = hashlib.md5(normalized.encode("utf-8")).hexdigest()
+        
+        # Executa investigações em paralelo
+        tasks = [
+            self._check_gravatar(gravatar_hash),
+            self._check_social_profiles_smart(email, local_part),
+            self._check_breaches_anon(email),
+        ]
+        
+        gravatar_data, social_profiles, breach_data = await asyncio.gather(*tasks, return_exceptions=True)
+        
+        # Processa Gravatar
+        gravatar_profile = None
+        gravatar_avatar = None
+        if isinstance(gravatar_data, dict):
+            gravatar_profile = gravatar_data
+            gravatar_avatar = f"https://www.gravatar.com/avatar/{gravatar_hash}?s=200&d=404"
+        
+        # Processa social
+        profiles: List[SocialProfile] = []
+        if isinstance(social_profiles, list):
+            profiles = social_profiles
+        
+        # Processa breaches
+        breached = False
+        breach_count = 0
+        breaches = []
+        if isinstance(breach_data, dict):
+            breached = breach_data.get("breached", False)
+            breach_count = breach_data.get("count", 0)
+            breaches = breach_data.get("breaches", [])
+        
+        # Extrai dados agregados
+        usernames = list(set(p.username for p in profiles if p.username))
+        websites = list(set(p.metadata.get("website") for p in profiles if p.metadata.get("website")))
+        
+        result = EmailInvestigationResult(
+            email=email,
+            normalized_email=normalized,
+            domain=domain,
+            local_part=local_part,
+            gravatar_hash=gravatar_hash,
+            gravatar_profile=gravatar_profile,
+            gravatar_avatar=gravatar_avatar,
+            social_profiles=profiles,
+            breached=breached,
+            breach_count=breach_count,
+            breaches=breaches,
+            phone_numbers=[],
+            websites=websites,
+            usernames=usernames,
+            total_platforms_found=len(profiles),
+            search_timestamp=datetime.now(timezone.utc).isoformat(),
+        )
+        
+        return result
+
+    async def _check_gravatar(self, gravatar_hash: str) -> Optional[Dict[str, Any]]:
+        """Verifica perfil Gravatar."""
+        url = f"https://www.gravatar.com/{gravatar_hash}.json"
+        
+        try:
+            async with httpx.AsyncClient(timeout=self._timeout, follow_redirects=False) as client:
+                response = await client.get(url)
+                
+                if response.status_code == 200:
+                    data = response.json()
+                    return data.get("entry", [{}])[0] if data.get("entry") else None
+        except Exception:
+            pass
+        
+        return None
+
+    async def _check_social_profiles_smart(
+        self, email: str, local_part: str
+    ) -> List[SocialProfile]:
+        """Busca inteligente em redes sociais usando templates."""
+        from ..dsl.loader import TemplateLoader
+        from ..modules.template_executor import TemplateExecutor
+        
+        profiles: List[SocialProfile] = []
+        
+        # Carrega templates
+        loader = TemplateLoader()
+        loader.load_builtin()
+        
+        # Filtra apenas templates habilitados
+        templates = [t for t in loader.list_templates() if t.enabled and not t.require_headless]
+        
+        if not templates:
+            return profiles
+        
+        # Executa templates usando local_part como username
+        executor = TemplateExecutor(timeout=self._timeout, user_agent=self._user_agent)
+        
+        # Limita a 20 sites mais relevantes para não demorar muito
+        relevant_templates = templates[:20]
+        
+        semaphore = asyncio.Semaphore(10)  # Max 10 paralelas
+        
+        async def check_site(template: Any) -> Optional[SocialProfile]:
+            async with semaphore:
+                try:
+                    result = await executor.execute(template, {"username": local_part})
+                    
+                    if result.exists and result.confidence > 0.5:
+                        # Extrai dados relevantes
+                        profile = SocialProfile(
+                            platform=template.site,
+                            url=result.url,
+                            username=local_part,
+                            display_name=result.extracted.get("name"),
+                            bio=result.extracted.get("bio"),
+                            avatar_url=result.extracted.get("avatar"),
+                            confidence=result.confidence,
+                            metadata={
+                                "website": result.extracted.get("website"),
+                                "location": result.extracted.get("location"),
+                                "followers": result.extracted.get("followers"),
+                            },
+                        )
+                        return profile
+                except Exception:
+                    pass
+            
+            return None
+        
+        tasks = [check_site(t) for t in relevant_templates]
+        results = await asyncio.gather(*tasks, return_exceptions=True)
+        
+        # Filtra resultados válidos
+        for result in results:
+            if isinstance(result, SocialProfile):
+                profiles.append(result)
+        
+        return profiles
+
+    async def _check_breaches_anon(self, email: str) -> Dict[str, Any]:
+        """Verifica breaches usando HIBP k-anonymity."""
+        # HIBP k-anonymity: hash SHA-1, envia apenas primeiros 5 chars
+        sha1_hash = hashlib.sha1(email.encode("utf-8")).hexdigest().upper()
+        prefix = sha1_hash[:5]
+        suffix = sha1_hash[5:]
+        
+        url = f"https://api.pwnedpasswords.com/range/{prefix}"
+        
+        try:
+            async with httpx.AsyncClient(timeout=self._timeout) as client:
+                response = await client.get(url, headers={"User-Agent": self._user_agent})
+                
+                if response.status_code == 200:
+                    # Procura pelo suffix na resposta
+                    lines = response.text.split("\n")
+                    for line in lines:
+                        if line.startswith(suffix):
+                            count = int(line.split(":")[1])
+                            logger.warning("breach.found", email=email, count=count)
+                            return {
+                                "breached": True,
+                                "count": count,
+                                "breaches": [{"source": "HIBP", "occurrences": count}],
+                            }
+        except Exception as exc:
+            logger.debug("breach.check.error", error=str(exc))
+        
+        return {"breached": False, "count": 0, "breaches": []}
+
+
+__all__ = ["EmailInvestigator", "EmailInvestigationResult", "SocialProfile"]

moriarty/modules/email_security.py

@@ -0,0 +1,274 @@
+"""Validações avançadas de segurança de email."""
+import asyncio
+import hashlib
+import ssl
+from dataclasses import dataclass
+from typing import List, Optional
+
+import aiodns
+import httpx
+import structlog
+
+logger = structlog.get_logger(__name__)
+
+
+@dataclass
+class TLSARecord:
+    """Registro TLSA (DANE)."""
+    usage: int
+    selector: int
+    matching_type: int
+    certificate_data: str
+
+
+@dataclass
+class ARCResult:
+    """Resultado da validação ARC."""
+    present: bool
+    chain_valid: bool
+    instances: int
+    sealer: Optional[str] = None
+
+
+@dataclass
+class TLSGrade:
+    """Avaliação TLS do servidor."""
+    protocol: str  # TLSv1.2, TLSv1.3
+    cipher: str
+    grade: str  # A+, A, B, C, D, F
+    supports_tls13: bool
+    forward_secrecy: bool
+    vulnerabilities: List[str]
+
+
+@dataclass
+class GreylistingStatus:
+    """Status de greylisting."""
+    detected: bool
+    retry_after: Optional[int] = None  # segundos
+    temp_fail_code: Optional[int] = None
+
+
+class EmailSecurityChecker:
+    """Verifica recursos avançados de segurança de email."""
+    
+    def __init__(self, timeout: float = 10.0):
+        self._timeout = timeout
+        self._resolver = aiodns.DNSResolver(timeout=timeout)
+    
+    async def check_tlsa(self, domain: str, port: int = 25) -> List[TLSARecord]:
+        """
+        Verifica registros TLSA (DANE - DNS-based Authentication of Named Entities).
+        
+        Ex: _25._tcp.mail.example.com
+        """
+        tlsa_domain = f"_{port}._tcp.{domain}"
+        
+        try:
+            logger.info("email.security.tlsa.check", domain=tlsa_domain)
+            result = await self._resolver.query(tlsa_domain, "TLSA")
+            
+            if not isinstance(result, list):
+                return []
+            
+            records = []
+            for record in result:
+                # Formato TLSA: usage selector matching_type certificate_data
+                try:
+                    usage = getattr(record, 'usage', 0)
+                    selector = getattr(record, 'selector', 0)
+                    matching_type = getattr(record, 'matching_type', 0)
+                    cert_data = getattr(record, 'cert', '')
+                    
+                    records.append(TLSARecord(
+                        usage=usage,
+                        selector=selector,
+                        matching_type=matching_type,
+                        certificate_data=cert_data,
+                    ))
+                except Exception as e:
+                    logger.warning("email.security.tlsa.parse_error", error=str(e))
+            
+            logger.info("email.security.tlsa.found", domain=tlsa_domain, count=len(records))
+            return records
+            
+        except aiodns.error.DNSError:
+            logger.debug("email.security.tlsa.not_found", domain=tlsa_domain)
+            return []
+    
+    async def check_arc(self, mx_host: str) -> ARCResult:
+        """
+        Verifica suporte a ARC (Authenticated Received Chain).
+        
+        ARC é usado para preservar autenticação através de intermediários.
+        Checamos via headers SMTP ou via consulta ao servidor.
+        """
+        # Simulação - em produção, faria uma conexão SMTP real
+        # e verificaria os headers de uma mensagem test
+        logger.info("email.security.arc.check", mx_host=mx_host)
+        
+        # Por agora, retorna placeholder
+        # TODO: Implementar verificação real via SMTP
+        return ARCResult(
+            present=False,
+            chain_valid=False,
+            instances=0,
+            sealer=None,
+        )
+    
+    async def grade_tls(self, mx_host: str, port: int = 25) -> TLSGrade:
+        """
+        Avalia a qualidade da configuração TLS do servidor SMTP.
+        
+        Verifica:
+        - Versão do protocolo (TLS 1.2, 1.3)
+        - Cipher suites
+        - Forward secrecy
+        - Vulnerabilidades conhecidas
+        """
+        logger.info("email.security.tls_grade.start", mx_host=mx_host, port=port)
+        
+        vulnerabilities = []
+        
+        try:
+            # Cria contexto SSL
+            context = ssl.create_default_context()
+            
+            # Tenta conexão TLS
+            reader, writer = await asyncio.wait_for(
+                asyncio.open_connection(mx_host, port, ssl=context),
+                timeout=self._timeout
+            )
+            
+            # Obtém informações SSL
+            ssl_object = writer.get_extra_info('ssl_object')
+            if ssl_object:
+                protocol = ssl_object.version()
+                cipher = ssl_object.cipher()
+                
+                supports_tls13 = protocol == 'TLSv1.3'
+                
+                # Verifica forward secrecy (PFS)
+                cipher_name = cipher[0] if cipher else ""
+                forward_secrecy = any(fs in cipher_name for fs in ['ECDHE', 'DHE'])
+                
+                # Determina grade
+                if supports_tls13 and forward_secrecy:
+                    grade = "A+"
+                elif protocol == 'TLSv1.2' and forward_secrecy:
+                    grade = "A"
+                elif protocol == 'TLSv1.2':
+                    grade = "B"
+                elif protocol == 'TLSv1.1':
+                    grade = "C"
+                    vulnerabilities.append("TLS 1.1 deprecated")
+                else:
+                    grade = "F"
+                    vulnerabilities.append("Insecure TLS version")
+                
+                # Verifica cipher fraco
+                if cipher_name and ('RC4' in cipher_name or 'DES' in cipher_name):
+                    vulnerabilities.append("Weak cipher detected")
+                    grade = "F"
+                
+                writer.close()
+                await writer.wait_closed()
+                
+                logger.info("email.security.tls_grade.complete", mx_host=mx_host, grade=grade, protocol=protocol)
+                
+                return TLSGrade(
+                    protocol=protocol,
+                    cipher=cipher_name,
+                    grade=grade,
+                    supports_tls13=supports_tls13,
+                    forward_secrecy=forward_secrecy,
+                    vulnerabilities=vulnerabilities,
+                )
+            
+            writer.close()
+            await writer.wait_closed()
+            
+        except Exception as e:
+            logger.warning("email.security.tls_grade.error", mx_host=mx_host, error=str(e))
+        
+        # Fallback: sem TLS
+        return TLSGrade(
+            protocol="None",
+            cipher="",
+            grade="F",
+            supports_tls13=False,
+            forward_secrecy=False,
+            vulnerabilities=["No TLS support detected"],
+        )
+    
+    async def detect_greylisting(self, mx_host: str, sender: str, recipient: str) -> GreylistingStatus:
+        """
+        Detecta se o servidor usa greylisting.
+        
+        Greylisting temporariamente rejeita emails desconhecidos
+        com código 4xx, esperando retry.
+        """
+        logger.info("email.security.greylisting.check", mx_host=mx_host)
+        
+        try:
+            # Faz tentativa SMTP inicial
+            reader, writer = await asyncio.wait_for(
+                asyncio.open_connection(mx_host, 25),
+                timeout=self._timeout
+            )
+            
+            # Lê banner
+            banner = await reader.read(1024)
+            
+            # EHLO
+            writer.write(b"EHLO moriarty.local\r\n")
+            await writer.drain()
+            ehlo_response = await reader.read(1024)
+            
+            # MAIL FROM
+            writer.write(f"MAIL FROM:<{sender}>\r\n".encode())
+            await writer.drain()
+            mail_response = await reader.read(1024)
+            
+            # RCPT TO
+            writer.write(f"RCPT TO:<{recipient}>\r\n".encode())
+            await writer.drain()
+            rcpt_response = await reader.read(1024)
+            
+            writer.write(b"QUIT\r\n")
+            await writer.drain()
+            writer.close()
+            await writer.wait_closed()
+            
+            # Analisa resposta
+            rcpt_str = rcpt_response.decode('utf-8', errors='ignore')
+            
+            # Códigos 4xx indicam erro temporário (greylisting comum)
+            if rcpt_str.startswith('4'):
+                # Extrai código
+                parts = rcpt_str.split()
+                code = int(parts[0]) if parts else 450
+                
+                # Greylisting detectado
+                logger.info("email.security.greylisting.detected", mx_host=mx_host, code=code)
+                return GreylistingStatus(
+                    detected=True,
+                    temp_fail_code=code,
+                    retry_after=300,  # Típico: 5 minutos
+                )
+            
+            logger.info("email.security.greylisting.not_detected", mx_host=mx_host)
+            return GreylistingStatus(detected=False)
+            
+        except Exception as e:
+            logger.warning("email.security.greylisting.error", mx_host=mx_host, error=str(e))
+            return GreylistingStatus(detected=False)
+
+
+__all__ = [
+    "EmailSecurityChecker",
+    "TLSARecord",
+    "ARCResult",
+    "TLSGrade",
+    "GreylistingStatus",
+]