pentool 0.1.0__py3-none-any.whl

pentool/api/scanner_api.py

@@ -0,0 +1,266 @@
+"""ScannerAPI — публичный интерфейс Scanner для TUI и CLI."""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Callable
+
+from pentool.core.utils import run_async_sync
+
+from pentool.core.logging import get_logger
+from pentool.modules.scanner.base import BaseCheck, Finding
+from pentool.modules.scanner.checks import (
+    InfoLeakCheck,
+    LFICheck,
+    MissingSecurityHeadersCheck,
+    OpenRedirectCheck,
+    PathTraversalCheck,
+    HeaderInjectionCheck,
+    RCECheck,
+    SQLiCheck,
+    SSTICheck,
+    SSRFCheck,
+    XSSCheck,
+    XXECheck,
+    CORSCheck,
+    BrokenAuthCheck,
+    JWTNoneCheck,
+    NoSQLInjectionCheck,
+    GraphQLCheck,
+    PrototypePollutionCheck,
+    DOMXSSCheck,
+    OAuthCheck,
+    SensitiveDataCheck,
+)
+from pentool.modules.scanner.checks.header_injection import HostHeaderInjectionCheck
+from pentool.modules.scanner.checks.sqli import SQLiUnionCheck
+from pentool.modules.scanner.engine import ScanEngine
+from pentool.modules.scanner.passive import PassiveScanner
+from pentool.modules.scanner.report import (
+    generate_csv_report,
+    generate_html_report,
+    generate_json_report,
+)
+
+logger = get_logger(__name__)
+
+__all__ = ["ScannerAPI", "Finding", "BaseCheck"]
+
+
+class ScannerAPI:
+
+    def __init__(self, db_path: str = "", http_client=None) -> None:
+        self._db_path = db_path
+        self._http_client = http_client
+        self._engine: ScanEngine | None = None
+        self._passive: PassiveScanner | None = None
+        self._active_task: asyncio.Task | None = None
+        self._scan_id: str | None = None
+
+    def _get_engine(self) -> ScanEngine:
+        if self._engine is None:
+            self._engine = ScanEngine(
+                db_path=self._db_path,
+                http_client=self._http_client,
+            )
+            self._engine.register_checks([
+                MissingSecurityHeadersCheck(),
+                InfoLeakCheck(),
+                SQLiCheck(),
+                XSSCheck(),
+                SSTICheck(),
+                LFICheck(),
+                PathTraversalCheck(),
+                HeaderInjectionCheck(),
+                HostHeaderInjectionCheck(),
+                RCECheck(),
+                OpenRedirectCheck(),
+                SSRFCheck(),
+                XXECheck(),
+                CORSCheck(),
+                BrokenAuthCheck(),
+                JWTNoneCheck(),
+                NoSQLInjectionCheck(),
+                GraphQLCheck(),
+                PrototypePollutionCheck(),
+                DOMXSSCheck(),
+                OAuthCheck(),
+                SensitiveDataCheck(),
+                SQLiUnionCheck(),
+            ])
+        return self._engine
+
+    async def start_active_scan(
+        self,
+        targets: list[str],
+        check_names: list[str] | None = None,
+        on_finding: Callable[[Finding | None, None]] = None,
+        on_progress: Callable[[int, int | None, None]] = None,
+        on_request: Callable[[str, str | None, None]] = None,
+        concurrency: int = 5,
+        request_delay: float = 0.0,
+    ) -> str:
+        import uuid
+        self._scan_id = str(uuid.uuid4())
+        engine = self._get_engine()
+        engine._concurrency = concurrency
+        engine._request_delay = request_delay
+
+        async def _run() -> None:
+            findings = await engine.run_active(
+                targets,
+                check_names=check_names,
+                on_finding=on_finding,
+                on_progress=on_progress,
+                on_request=on_request,
+            )
+            await engine.save_findings(findings)
+
+        self._active_task = asyncio.create_task(_run())
+        return self._scan_id
+
+    async def stop_scan(self) -> None:
+        if self._active_task and not self._active_task.done():
+            self._active_task.cancel()
+            try:
+                await self._active_task
+            except asyncio.CancelledError:
+                pass
+        self._active_task = None
+
+    def is_scanning(self) -> bool:
+        return bool(self._active_task and not self._active_task.done())
+
+    async def get_findings(self, limit: int = 200) -> list[Finding]:
+        return await self._get_engine().get_findings(limit)
+
+    async def mark_false_positive(self, finding_id: str) -> None:
+        await self._get_engine().mark_false_positive(finding_id)
+
+    async def attach_passive(self, proxy_api=None) -> None:
+        engine = self._get_engine()
+        self._passive = PassiveScanner(engine)
+        self._passive.attach_bus()
+        logger.info("Passive scanner attached via EventBus")
+
+    async def detach_passive(self) -> None:
+        if self._passive:
+            self._passive.detach_bus()
+        self._passive = None
+
+    def set_passive_callback(self, callback: Callable[[Finding], None]) -> None:
+        if self._passive:
+            self._passive.on_finding = callback
+
+    async def generate_report(self, path: str, fmt: str = "html") -> None:
+        findings = await self.get_findings(limit=10000)
+        fmt = fmt.lower()
+        if fmt == "html":
+            generate_html_report(findings, path)
+        elif fmt == "json":
+            generate_json_report(findings, path)
+        elif fmt == "csv":
+            generate_csv_report(findings, path)
+        else:
+            raise ValueError(f"Unknown report format: {fmt}")
+        logger.info("Report generated: %s (%s)", path, fmt)
+
+    def register_check(self, check: BaseCheck) -> None:
+        self._get_engine().register_check(check)
+
+    def get_registered_checks(self) -> list[BaseCheck]:
+        return self._get_engine().get_registered_checks()
+
+    # ── Project persistence ────────────────────────────────────────────────────
+
+    def export_project_data(self) -> dict:
+        try:
+            findings = run_async_sync(self.get_findings(limit=10_000), timeout=10)
+        except Exception as exc:
+            logger.warning("export_project_data: %s", exc)
+            findings = []
+        return {"findings": [f.to_dict() for f in (findings or [])]}
+
+    def import_project_data(self, data: dict) -> int:
+        findings_data = data.get("findings", [])
+        if not findings_data:
+            return 0
+
+        findings = []
+        for fd in findings_data:
+            try:
+                findings.append(Finding.from_dict(fd))
+            except Exception as exc:
+                logger.warning("ScannerAPI.import_project_data: skip finding: %s", exc)
+
+        if not findings:
+            return 0
+
+        # Пишем в SQLite через save_findings (нужен async контекст)
+        engine = self._get_engine()
+        try:
+            run_async_sync(engine.save_findings(findings), timeout=15)
+            return len(findings)
+        except Exception as exc:
+            logger.warning("import_project_data save_findings: %s", exc)
+            return 0
+
+    async def get_stats(self) -> dict:
+        return await self._get_engine().get_stats()
+
+    async def get_host_count(self) -> int:
+        try:
+            from pentool.storage.http_storage import HttpStorage
+            storage = HttpStorage()
+            await storage.init_db(self._db_path)
+            try:
+                return await storage.count_distinct_hosts()
+            finally:
+                await storage.close()
+        except Exception as exc:
+            logger.debug("ScannerAPI.get_host_count: %s", exc)
+            return 0
+
+    async def get_history_requests(
+        self,
+        scope_host: str = "",
+        limit: int = 500,
+    ) -> list:
+        from pentool.storage.http_storage import HttpStorage
+        from pentool.utils.parser import ParsedRequest
+        import re as _re
+
+        storage = HttpStorage()
+        try:
+            await storage.init_db(self._db_path)
+            entries = await storage.export_all_requests(limit=limit)
+        finally:
+            await storage.close()
+
+        seen: set[str] = set()
+        result: list[ParsedRequest] = []
+
+        for entry in entries:
+            url: str = entry.get("url", "") or ""
+            method: str = (entry.get("method", "GET") or "GET").upper()
+            if not url:
+                continue
+            if scope_host and scope_host not in url:
+                continue
+            # Дедупликация по (method, path без значений параметров)
+            path_tmpl = _re.sub(r"=[^&]*", "=", url.split("?")[0])
+            dedup_key = f"{method}:{path_tmpl}"
+            if dedup_key in seen:
+                continue
+            seen.add(dedup_key)
+
+            headers: dict = entry.get("request_headers", {}) or {}
+            body: str = entry.get("request_body", "") or ""
+            result.append(ParsedRequest(
+                method=method,
+                url=url,
+                headers=headers,
+                body=body,
+            ))
+
+        return result

pentool/api/sequencer_api.py

@@ -0,0 +1,17 @@
+"""SequencerAPI — публичный интерфейс Sequencer для TUI."""
+
+from __future__ import annotations
+
+from pentool.modules.sequencer import (  # noqa: F401
+    Sequencer,
+    SequencerReport,
+    token_entropy,
+    charset_size,
+)
+
+__all__ = [
+    "Sequencer",
+    "SequencerReport",
+    "token_entropy",
+    "charset_size",
+]

pentool/api/spider_api.py

@@ -0,0 +1,106 @@
+"""SpiderAPI — публичный интерфейс Spider-модуля для TUI и CLI."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Callable
+
+from pentool.core.logging import get_logger
+from pentool.modules.spider import (
+    AsyncSpider,
+    SpiderEndpoint,
+    SpiderForm,
+    SpiderResult,
+    is_playwright_available,
+)
+
+logger = get_logger(__name__)
+
+# Реэкспорт типов — TUI использует их отсюда
+__all__ = [
+    "SpiderAPI", "SpiderResult", "SpiderForm", "SpiderEndpoint", "SpiderConfig",
+    "is_playwright_available",
+]
+
+
+@dataclass
+class SpiderConfig:
+    """Конфигурация краулера."""
+    max_depth: int = 3
+    max_pages: int = 100
+    concurrency: int = 5
+    timeout: float = 10.0
+    user_agent: str = "pentool/1.0"
+    respect_scope: bool = False
+    js_render: bool = False  # Playwright JS-рендеринг (если установлен)
+
+
+class SpiderAPI:
+
+    def __init__(self, config: SpiderConfig | None = None) -> None:
+        self._config = config or SpiderConfig()
+        self._spider: AsyncSpider | None = None
+        self._stop_requested = False
+
+    @classmethod
+    def from_params(
+        cls,
+        max_depth: int = 3,
+        max_pages: int = 100,
+        concurrency: int = 5,
+        timeout: float = 10.0,
+    ) -> "SpiderAPI":
+        """Удобный фабричный метод."""
+        return cls(SpiderConfig(
+            max_depth=max_depth,
+            max_pages=max_pages,
+            concurrency=concurrency,
+            timeout=timeout,
+        ))
+
+    async def crawl(
+        self,
+        url: str,
+        on_page: Callable[[str], None] | None = None,
+        on_progress: Callable[[int, int], None] | None = None,
+        extra_headers: dict | None = None,
+    ) -> SpiderResult:
+        self._stop_requested = False
+        cfg = self._config
+        self._spider = AsyncSpider(
+            max_depth=cfg.max_depth,
+            max_pages=cfg.max_pages,
+            concurrency=cfg.concurrency,
+            respect_scope=cfg.respect_scope,
+            js_render=cfg.js_render,
+            extra_headers=extra_headers or {},
+        )
+        if on_page:
+            self._spider.on_page = on_page
+        if on_progress:
+            self._spider.on_progress = on_progress
+
+        try:
+            result = await self._spider.crawl(url)
+            logger.info(
+                "SpiderAPI.crawl: %s → %d pages, %d forms, %d endpoints",
+                url, len(result.pages), len(result.forms), len(result.endpoints),
+            )
+            return result
+        except Exception as exc:
+            logger.warning("SpiderAPI.crawl error for %s: %s", url, exc)
+            return SpiderResult(pages=[], forms=[], endpoints=[], js_files=[], errors=[str(exc)])
+
+    def stop(self) -> None:
+        """Запросить остановку краулинга."""
+        self._stop_requested = True
+        if self._spider is not None:
+            try:
+                self._spider._stop_requested = True
+            except Exception:
+                pass
+
+    @property
+    def config(self) -> SpiderConfig:
+        """Текущая конфигурация краулера (max_depth, max_pages, concurrency)."""
+        return self._config

pentool/api/target_api.py

@@ -0,0 +1,87 @@
+"""TargetAPI — публичный интерфейс Target/SiteMap для TUI и CLI."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from pentool.core.logging import get_logger
+from pentool.modules.target import SiteMap, SiteNode
+
+if TYPE_CHECKING:
+    from pentool.utils.parser import ParsedRequest
+
+logger = get_logger(__name__)
+
+__all__ = ["TargetAPI", "SiteNode", "SiteMap"]
+
+
+class TargetAPI:
+
+    def __init__(self, db_path: str = "") -> None:
+        self._db_path = db_path
+        self._sitemap = SiteMap(db_path=db_path)
+
+    @property
+    def sitemap(self) -> SiteMap:
+        """Прямой доступ к объекту SiteMap."""
+        return self._sitemap
+
+    async def load(self) -> None:
+        await self._sitemap.load()
+
+    async def save(self) -> None:
+        await self._sitemap.save()
+
+    def add_request(self, req: "ParsedRequest") -> None:
+        self._sitemap.add_request(req)
+
+    async def get_tree(self) -> dict[str, list[SiteNode]]:
+        return self._sitemap.get_tree()
+
+    def get_hosts(self) -> list[str]:
+        return self._sitemap.get_hosts()
+
+    def get_paths(self, host: str) -> list[SiteNode]:
+        return self._sitemap.get_paths(host)
+
+    async def set_in_scope(self, host: str, in_scope: bool) -> None:
+        """Задать scope-флаг для хоста.
+
+        Args:
+            host: Имя хоста.
+            in_scope: True — хост в scope, False — вне scope.
+        """
+        self._sitemap.set_in_scope(host, in_scope)
+
+    async def get_scope(self) -> list[str]:
+        return self._sitemap.get_scope()
+
+    async def clear(self) -> None:
+        self._sitemap.clear()
+
+    async def export_json(self, path: str) -> None:
+        data = self._sitemap.export_json()
+        Path(path).write_text(json.dumps(data, indent=2, default=str), encoding="utf-8")
+        logger.info("SiteMap exported to %s", path)
+
+    # ── Project persistence ────────────────────────────────────────────────────
+
+    def export_project_data(self) -> dict:
+        return {"sitemap": self._sitemap.export_json()}
+
+    def import_project_data(self, data: dict) -> int:
+        from pentool.modules.target import SiteNode
+        sitemap_data = data.get("sitemap", {})
+        self._sitemap.clear()
+        loaded = 0
+        for host, nodes in sitemap_data.items():
+            for node_dict in nodes:
+                try:
+                    node = SiteNode.from_dict(node_dict)
+                    self._sitemap._nodes.setdefault(host, {})[node.path] = node
+                    loaded += 1
+                except Exception as exc:
+                    logger.warning("TargetAPI.import_project_data: skip node: %s", exc)
+        return loaded

pentool/cli/__init__.py

@@ -0,0 +1 @@
+"""Пакет cli: команды Click."""

pentool/cli/main.py

@@ -0,0 +1,98 @@
+"""Главная группа CLI-команд."""
+
+from __future__ import annotations
+
+import click
+
+from pentool.core.config import get_config
+from pentool.core.logging import setup_logging
+
+
+@click.group()
+@click.version_option(package_name="pentool")
+@click.option("--config", "config_path", default=None, help="Путь к файлу конфигурации.")
+@click.option("--verbose", "-v", is_flag=True, default=False, help="Подробный вывод (DEBUG).")
+@click.pass_context
+def cli(ctx: click.Context, config_path: str | None, verbose: bool) -> None:
+    """Pentool — консольный инструмент для пентестинга веб-приложений.
+
+    Запустите без аргументов для открытия TUI:
+
+        pentool
+
+    Или используйте команды ниже для работы из командной строки.
+    """
+    ctx.ensure_object(dict)
+
+    cfg = get_config()
+    if config_path:
+        from pentool.core.config import Config
+        cfg = Config.load(config_path)
+
+    log_level = "DEBUG" if verbose else cfg.log_level
+    setup_logging(cfg.log_file, log_level)
+
+    ctx.obj["config"] = cfg
+
+
+# Импорт и регистрация групп команд
+from pentool.cli.project import project  # noqa: E402
+
+cli.add_command(project)
+
+
+from pentool.cli.proxy import proxy  # noqa: E402
+
+cli.add_command(proxy)
+
+
+@cli.group()
+def repeater() -> None:
+    """Модуль Repeater: ручная отправка запросов."""
+
+
+@repeater.command("send")
+@click.option("--request-file", required=True, type=click.Path(exists=True), help="Файл с HTTP-запросом.")
+def repeater_send(request_file: str) -> None:
+    click.echo(f"Repeater send {request_file} — not implemented yet.")
+
+
+@cli.group()
+def intruder() -> None:
+    """Модуль Intruder: автоматизированные атаки."""
+
+
+@intruder.command("run")
+@click.option("--request", "request_file", required=True, type=click.Path(exists=True))
+@click.option("--payloads", required=True, type=click.Path(exists=True))
+@click.option("--attack", default="sniper", show_default=True,
+              type=click.Choice(["sniper", "battering_ram", "pitchfork", "cluster_bomb"]))
+def intruder_run(request_file: str, payloads: str, attack: str) -> None:
+    click.echo(f"Intruder run [{attack}] — not implemented yet.")
+
+
+from pentool.cli.scan import scan  # noqa: E402
+
+cli.add_command(scan)
+
+
+@cli.command("decode")
+@click.argument("operation", type=click.Choice([
+    "url_encode", "url_decode",
+    "base64_encode", "base64_decode",
+    "base64url_encode", "base64url_decode",
+    "html_encode", "html_decode",
+    "hex_encode", "hex_decode",
+    "unicode_escape", "unicode_unescape",
+    "md5", "sha1", "sha256",
+]))
+@click.argument("text")
+def decode_cmd(operation: str, text: str) -> None:
+    """Кодировать/декодировать/хэшировать текст."""
+    from pentool.utils.coder import apply_operation
+    try:
+        result = apply_operation(operation, text)
+        click.echo(result)
+    except ValueError as exc:
+        click.echo(f"Error: {exc}", err=True)
+        raise SystemExit(1) from exc

pentool/cli/project.py

@@ -0,0 +1,88 @@
+"""CLI-команды для управления проектами."""
+
+from __future__ import annotations
+
+import asyncio
+import os
+from pathlib import Path
+
+import click
+
+from pentool.core.config import Config, get_config
+from pentool.core.database import init_db
+from pentool.core.logging import get_logger
+
+logger = get_logger(__name__)
+
+
+@click.group()
+def project() -> None:
+    """Управление проектами: инициализация, список, открытие."""
+
+
+@project.command("init")
+@click.option("--name", default="default", show_default=True, help="Имя проекта.")
+@click.option(
+    "--path",
+    default=None,
+    help="Директория проекта (по умолчанию: ~/.config/pentool/projects/<name>).",
+)
+def project_init(name: str, path: str | None) -> None:
+    cfg = get_config()
+
+    if path is None:
+        project_dir = Path.home() / ".config" / "pentool" / "projects" / name
+    else:
+        project_dir = Path(path) / name
+
+    project_dir.mkdir(parents=True, exist_ok=True)
+
+    db_path = str(project_dir / "pentool.db")
+    log_file = str(project_dir / "pentool.log")
+    cert_dir = str(project_dir / "certs")
+    plugins_dir = str(project_dir / "plugins")
+
+    # Обновить и сохранить конфиг проекта
+    project_cfg = Config(
+        proxy_host=cfg.proxy_host,
+        proxy_port=cfg.proxy_port,
+        cert_dir=cert_dir,
+        db_path=db_path,
+        log_file=log_file,
+        log_level=cfg.log_level,
+        plugins_dir=plugins_dir,
+    )
+    config_path = project_dir / "config.yaml"
+    project_cfg.save(config_path)
+
+    # Создать таблицы БД
+    try:
+        asyncio.run(init_db(db_path))
+        click.echo(f"Project '{name}' initialized:")
+        click.echo(f"  Directory : {project_dir}")
+        click.echo(f"  Database  : {db_path}")
+        click.echo(f"  Config    : {config_path}")
+        click.echo(f"  Log file  : {log_file}")
+        logger.info("Project '%s' initialized at %s", name, project_dir)
+    except Exception as exc:
+        click.echo(f"Error initializing database: {exc}", err=True)
+        logger.error("Failed to initialize project '%s': %s", name, exc)
+        raise SystemExit(1) from exc
+
+
+@project.command("list")
+def project_list() -> None:
+    projects_dir = Path.home() / ".config" / "pentool" / "projects"
+    if not projects_dir.exists():
+        click.echo("No projects found.")
+        return
+
+    entries = [d for d in projects_dir.iterdir() if d.is_dir()]
+    if not entries:
+        click.echo("No projects found.")
+        return
+
+    click.echo(f"{'Name':<20} {'Path'}")
+    click.echo("-" * 60)
+    for entry in sorted(entries):
+        click.echo(f"{entry.name:<20} {entry}")