phantomprobe 0.9.0__py3-none-any.whl

phantomprobe/__init__.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""
+PhantomProbe - Reconnaissance Scanner for Penetration Testing
+
+Public API. Optional integrations (dashboard, screenshots, Burp) are imported
+lazily so that the dependency-free core keeps working without extras installed.
+"""
+
+from .active import ActiveReconEngine
+from .aggressive import AggressiveScanner
+from .cli import main, print_banner
+from .cookies import CookieScanner
+from .constants import BROWSER_USER_AGENT, USER_AGENT, __version__
+from .cve import CVE, CVEMatcher
+from .dns_security import DnsSecurityScanner
+from .http_checks import HstsPreloadScanner, RedirectScanner, SecurityTxtScanner
+from .js import JSEngine, ScriptTagParser
+from .models import Finding, Severity
+from .passive import ReconEngine
+from .report import ReportGenerator
+from .screenshot import ScreenshotCapture
+from .takeover import TakeoverScanner
+from .waf import WafScanner, detect_waf
+
+__all__ = [
+    "__version__",
+    "USER_AGENT",
+    "BROWSER_USER_AGENT",
+    "Finding",
+    "Severity",
+    "ReconEngine",
+    "ActiveReconEngine",
+    "AggressiveScanner",
+    "CVE",
+    "CVEMatcher",
+    "ScreenshotCapture",
+    "TakeoverScanner",
+    "WafScanner",
+    "CookieScanner",
+    "DnsSecurityScanner",
+    "HstsPreloadScanner",
+    "RedirectScanner",
+    "SecurityTxtScanner",
+    "detect_waf",
+    "JSEngine",
+    "ScriptTagParser",
+    "ReportGenerator",
+    "BurpSuiteEngine",
+    "DashboardServer",
+    "main",
+    "print_banner",
+]
+
+
+def __getattr__(name):
+    """
+    Lazily expose optional components.
+
+    Importing them eagerly would make `import phantomprobe` fail (or pay the
+    import cost) when FastAPI / requests are not installed.
+    """
+    if name in ("DashboardServer", "FASTAPI_AVAILABLE"):
+        from . import dashboard
+        return getattr(dashboard, name)
+    if name in ("BurpSuiteEngine", "BURP_AVAILABLE"):
+        from . import burp
+        return getattr(burp, name)
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

phantomprobe/__main__.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+"""
+PhantomProbe - Entry point for `python -m phantomprobe`
+"""
+import sys
+
+from .cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

phantomprobe/active.py

@@ -0,0 +1,339 @@
+#!/usr/bin/env python3
+"""
+Phase 2: active reconnaissance (port scan, subdomain enumeration, fingerprinting).
+
+These checks send traffic directly to the target. Only run them against systems
+you are authorized to test.
+"""
+
+import concurrent.futures
+import socket
+import ssl
+from datetime import datetime
+from typing import List
+from urllib.request import Request
+
+from .http_client import safe_urlopen
+
+from .constants import USER_AGENT
+from .models import Finding, Severity
+
+
+class ActiveReconEngine:
+    """Phase 2: Active Reconnaissance"""
+
+    COMMON_PORTS = [
+        21, 22, 23, 25, 53, 80, 110, 143, 443, 445, 993, 995,
+        1433, 1521, 3306, 3389, 5432, 5900, 6379, 8080, 8443, 27017
+    ]
+
+    COMMON_SUBDOMAINS = [
+        # web front doors
+        'www', 'www2', 'web', 'app', 'apps', 'portal', 'secure', 'my',
+        'account', 'accounts', 'login', 'sso', 'auth', 'id', 'oauth',
+        # api and services
+        'api', 'apis', 'api-dev', 'api-staging', 'rest', 'graphql', 'grpc',
+        'gateway', 'service', 'services', 'ws', 'socket', 'rpc',
+        # environments
+        'dev', 'develop', 'development', 'staging', 'stage', 'stg', 'test',
+        'testing', 'qa', 'uat', 'sandbox', 'demo', 'beta', 'alpha', 'preview',
+        'preprod', 'prod', 'production', 'live', 'internal', 'int',
+        # mail
+        'mail', 'smtp', 'imap', 'pop', 'pop3', 'webmail', 'mx', 'mx1', 'mx2',
+        'email', 'exchange', 'autodiscover', 'mailgun', 'newsletter',
+        # infra and ops
+        'vpn', 'remote', 'gitlab', 'git', 'jenkins', 'ci', 'cd', 'build',
+        'deploy', 'monitor', 'monitoring', 'grafana', 'kibana', 'prometheus',
+        'status', 'health', 'metrics', 'logs', 'log', 'jira', 'confluence',
+        'wiki', 'nexus', 'registry', 'docker', 'k8s', 'kubernetes',
+        # data
+        'db', 'database', 'mysql', 'postgres', 'mongo', 'redis', 'sql',
+        'phpmyadmin', 'pma', 'adminer', 'backup', 'backups', 'ftp', 'sftp',
+        'files', 'file', 'share', 'drive', 'cloud', 's3', 'storage',
+        # content and cdn
+        'cdn', 'static', 'assets', 'media', 'img', 'images', 'image', 'video',
+        'download', 'downloads', 'uploads', 'content', 'cache', 'edge',
+        # sites and apps
+        'blog', 'news', 'shop', 'store', 'cart', 'checkout', 'pay', 'payment',
+        'billing', 'support', 'help', 'helpdesk', 'docs', 'documentation',
+        'kb', 'forum', 'community', 'events', 'careers', 'jobs', 'about',
+        # admin surfaces
+        'admin', 'administrator', 'adm', 'panel', 'cpanel', 'webadmin',
+        'dashboard', 'manage', 'management', 'console', 'control',
+        # network
+        'ns', 'ns1', 'ns2', 'ns3', 'dns', 'proxy', 'lb', 'router', 'firewall',
+        'gw', 'dmz', 'ipv4', 'ipv6', 'origin',
+        # regions and misc
+        'us', 'eu', 'uk', 'de', 'asia', 'east', 'west', 'mobile', 'm', 'wap',
+        'go', 'link', 'app1', 'app2', 'web1', 'web2', 'old', 'new', 'legacy',
+        'v1', 'v2', 'stats', 'analytics', 'track', 'ads', 'partner', 'partners',
+    ]
+
+    TECH_SIGNATURES = {
+        'nginx': ['nginx'],
+        'apache': ['apache', 'httpd'],
+        'cloudflare': ['cloudflare', 'cf-ray'],
+        'aws': ['amazon', 'aws', 'ec2', 's3'],
+        'google': ['gstatic', 'google', 'gws'],
+        'php': ['php', 'x-powered-by: php'],
+        'asp.net': ['asp.net', 'iis', '.net'],
+        'node.js': ['express', 'node'],
+        'python': ['python', 'django', 'flask', 'gunicorn'],
+        'ruby': ['ruby', 'rails', 'passenger'],
+        'java': ['java', 'tomcat', 'jsp'],
+        'wordpress': ['wordpress', 'wp-'],
+        'drupal': ['drupal'],
+        'joomla': ['joomla'],
+        'laravel': ['laravel'],
+    }
+
+    def __init__(self, target: str):
+        self.target = target
+        self.findings: List[Finding] = []
+        self.subdomain_candidates: List[str] = []
+        self.found_subdomains: List[str] = []
+
+    def scan_ports(self, ports: List[int] = None) -> List[Finding]:
+        """Scan common ports"""
+        findings = []
+        ports = ports or self.COMMON_PORTS
+        print(f"[*] Scanning {len(ports)} common ports...")
+
+        open_ports = []
+
+        def check_port(port):
+            try:
+                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+                    sock.settimeout(2)
+                    if sock.connect_ex((self.target, port)) == 0:
+                        return port
+            except OSError:
+                # Unreachable host, refused connection or exhausted sockets:
+                # treat as closed rather than aborting the whole sweep.
+                pass
+            return None
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
+            results = executor.map(check_port, ports)
+            open_ports = [p for p in results if p is not None]
+
+        for port in open_ports:
+            service = self._identify_service(port)
+            findings.append(Finding(
+                id=f"PORT-{port}",
+                title=f"Open Port: {port}",
+                description=f"Port {port} is open ({service})",
+                severity=Severity.INFORMATIONAL,
+                category="Port Scan",
+                evidence=f"Port {port}/{service} is accepting connections",
+                remediation="N/A - Information gathering",
+                references=["https://en.wikipedia.org/wiki/Port_scanner"],
+                discovered_at=datetime.now().isoformat(),
+                target=self.target
+            ))
+
+        print(f"[+] Port scan: {len(open_ports)} open ports")
+        return findings
+
+    def _identify_service(self, port: int) -> str:
+        """Identify common service by port"""
+        services = {
+            21: 'FTP', 22: 'SSH', 23: 'Telnet', 25: 'SMTP',
+            53: 'DNS', 80: 'HTTP', 110: 'POP3', 143: 'IMAP',
+            443: 'HTTPS', 445: 'SMB', 993: 'IMAPS', 995: 'POP3S',
+            1433: 'MSSQL', 1521: 'Oracle', 3306: 'MySQL',
+            3389: 'RDP', 5432: 'PostgreSQL', 5900: 'VNC',
+            6379: 'Redis', 8080: 'HTTP-Alt', 8443: 'HTTPS-Alt',
+            27017: 'MongoDB'
+        }
+        return services.get(port, 'Unknown')
+
+    def _resolve_cnames(self, hosts: List[str]) -> dict:
+        """CNAME target per host, resolved concurrently over DoH."""
+        from . import doh
+
+        def lookup(host):
+            targets = doh.records(host, "CNAME")
+            return host, (targets[0].rstrip(".").lower() if targets else None)
+
+        results = {}
+        if not hosts:
+            return results
+        with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
+            for host, cname in executor.map(lookup, hosts):
+                if cname:
+                    results[host] = cname
+        return results
+
+    def enumerate_subdomains(self, wordlist: List[str] = None) -> List[Finding]:
+        """Enumerate common subdomains"""
+        findings = []
+        wordlist = wordlist or self.COMMON_SUBDOMAINS
+        print(f"[*] Enumerating {len(wordlist)} common subdomains...")
+
+        found_subdomains = []
+
+        def check_subdomain(subdomain):
+            try:
+                full_domain = f"{subdomain}.{self.target}"
+                socket.getaddrinfo(full_domain, None)
+                return full_domain
+            except socket.gaierror:
+                return None
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
+            results = executor.map(check_subdomain, wordlist)
+            found_subdomains = [s for s in results if s is not None]
+
+        # Record every candidate tried, not only those that resolved: a
+        # dangling CNAME to a dead service has no A record, so the takeover
+        # check needs the full list to catch the NXDOMAIN takeovers.
+        self.subdomain_candidates = [f"{s}.{self.target}" for s in wordlist]
+        self.found_subdomains = found_subdomains
+
+        # Resolve where each hit points. A CNAME onto a third party is the
+        # interesting part of a subdomain finding: it names the cloud service
+        # or SaaS the host depends on, which is both recon context and the
+        # same signal the takeover check acts on. Only the hits are resolved,
+        # so the cost stays proportional to what was actually found.
+        cnames = self._resolve_cnames(found_subdomains)
+
+        for subdomain in found_subdomains:
+            cname = cnames.get(subdomain)
+            offsite = bool(cname) and not cname.endswith(self.target)
+            evidence = f"{subdomain} exists"
+            if cname:
+                evidence += f"\nCNAME: {cname}"
+                if offsite:
+                    evidence += " (third-party host)"
+            findings.append(Finding(
+                id=f"SUBDOMAIN-{subdomain.split('.')[0]}",
+                title=f"Subdomain Found: {subdomain}",
+                description=(
+                    f"Subdomain {subdomain} resolves"
+                    + (f" via CNAME to {cname}" if cname else "")
+                ),
+                severity=Severity.INFORMATIONAL,
+                category="Subdomain Enumeration",
+                evidence=evidence,
+                remediation="N/A - Information gathering",
+                references=["https://en.wikipedia.org/wiki/Subdomain"],
+                discovered_at=datetime.now().isoformat(),
+                target=self.target
+            ))
+
+        print(f"[+] Subdomain enumeration: {len(found_subdomains)} found")
+        return findings
+
+    def fingerprint_tech(self) -> List[Finding]:
+        """Technology fingerprinting"""
+        findings = []
+        print(f"[*] Fingerprinting technologies...")
+
+        detected_tech = set()
+
+        try:
+            ctx = ssl.create_default_context()
+            ctx.check_hostname = False
+            ctx.verify_mode = ssl.CERT_NONE
+
+            req = Request(f"https://{self.target}", method='GET')
+            req.add_header('User-Agent', USER_AGENT)
+
+            with safe_urlopen(req, context=ctx, timeout=10) as response:
+                headers_str = str(dict(response.headers)).lower()
+                content = response.read(5000).decode('utf-8', errors='ignore').lower()
+
+                combined = headers_str + content
+
+                for tech, signatures in self.TECH_SIGNATURES.items():
+                    for sig in signatures:
+                        if sig.lower() in combined:
+                            detected_tech.add(tech)
+                            break
+
+        except Exception as e:
+            findings.append(Finding(
+                id="TECH-Error",
+                title="Technology Fingerprinting Error",
+                description=f"Could not fingerprint: {str(e)}",
+                severity=Severity.INFORMATIONAL,
+                category="Technology",
+                evidence=str(e),
+                remediation="Check target accessibility",
+                references=[],
+                discovered_at=datetime.now().isoformat(),
+                target=self.target
+            ))
+
+        for tech in detected_tech:
+            findings.append(Finding(
+                id=f"TECH-{tech.replace('.', '').replace(' ', '')}",
+                title=f"Technology Detected: {tech}",
+                description=f"Target appears to use {tech}",
+                severity=Severity.INFORMATIONAL,
+                category="Technology",
+                evidence=f"{tech} signature detected",
+                remediation="N/A - Information gathering",
+                references=[],
+                discovered_at=datetime.now().isoformat(),
+                target=self.target
+            ))
+
+        print(f"[+] Technology fingerprinting: {len(detected_tech)} detected")
+        return findings
+
+    def check_takeovers(self) -> List[Finding]:
+        """
+        Check enumerated hosts for dangling-CNAME subdomain takeover.
+
+        Kept separate from the resolve-only enumeration because it reaches out
+        over DoH and HTTP to third-party services, which the rest of Phase 2
+        does not. Runs against every candidate, resolving or not, since a
+        NXDOMAIN takeover has no A record to have been found by.
+        """
+        from .takeover import TakeoverScanner
+
+        hosts = self.subdomain_candidates or self.found_subdomains
+        findings = TakeoverScanner(self.target).run(hosts)
+        self.findings.extend(findings)
+        return findings
+
+    def run(self, check_takeover: bool = True) -> List[Finding]:
+        """Run all Phase 2 active reconnaissance"""
+        print()
+        print("=" * 60)
+        print("PHASE 2: Active Reconnaissance")
+        print("=" * 60)
+        print()
+
+        # Port scanning
+        port_findings = self.scan_ports()
+        self.findings.extend(port_findings)
+
+        # Subdomain enumeration
+        subdomain_findings = self.enumerate_subdomains()
+        self.findings.extend(subdomain_findings)
+
+        # Technology fingerprinting
+        tech_findings = self.fingerprint_tech()
+        self.findings.extend(tech_findings)
+
+        # Subdomain takeover (uses the hosts enumerated just above)
+        if check_takeover:
+            self.check_takeovers()
+
+        print()
+        print("=" * 60)
+        print("PHASE 2 COMPLETE")
+        print("=" * 60)
+        print(f"Total findings: {len(self.findings)}")
+        print(f"  - Ports: {len([f for f in self.findings if f.category == 'Port Scan'])}")
+        print(f"  - Subdomains: {len([f for f in self.findings if f.category == 'Subdomain Enumeration'])}")
+        print(f"  - Technologies: {len([f for f in self.findings if f.category == 'Technology'])}")
+        print(f"  - Takeover: {len([f for f in self.findings if f.category == 'Subdomain Takeover'])}")
+        print()
+
+        return self.findings
+
+