reconforge 1.0.0__py3-none-any.whl

reconforge/__init__.py

@@ -0,0 +1,29 @@
+"""ReconForge - AI-assisted recon toolkit for bug bounty hunters."""
+
+__version__ = "1.0.0"
+__author__ = "Feras"
+__license__ = "MIT"
+
+from .cache import ReconCache, get_cache
+from .cli import cli
+from .config import Config, get_config
+from .logger import ReconForgeLogger, get_logger
+from .portscan import scan_port, scan_ports
+from .scopecheck import check_targets
+from .subdomains import fetch_subdomains
+from .techdetect import detect_technologies
+
+__all__ = [
+    "cli",
+    "ReconCache",
+    "get_cache",
+    "Config",
+    "get_config",
+    "ReconForgeLogger",
+    "get_logger",
+    "scan_port",
+    "scan_ports",
+    "check_targets",
+    "fetch_subdomains",
+    "detect_technologies",
+]

reconforge/analyzer.py

@@ -0,0 +1,309 @@
+"""Advanced analysis and filtering utilities for ReconForge findings."""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional
+
+
+class FindingsAnalyzer:
+    """Analyze and filter recon findings for insights."""
+
+    def __init__(self, findings: Dict[str, Any]):
+        """Initialize analyzer with findings."""
+        self.findings = findings
+        self.subdomains = findings.get("subdomains", [])
+        self.ports = findings.get("ports", {})
+        self.technologies = findings.get("technologies", {})
+
+    def get_open_ports_summary(self) -> Dict[str, Any]:
+        """Get summary of open ports across all hosts."""
+        open_ports = {}
+        port_count = {}
+
+        for host, results in self.ports.items():
+            for result in results:
+                if result.get("status") == "open":
+                    port = result.get("port")
+                    if port not in open_ports:
+                        open_ports[port] = []
+                        port_count[port] = 0
+                    open_ports[port].append(host)
+                    port_count[port] += 1
+
+        return {
+            "open_ports": open_ports,
+            "port_count": port_count,
+            "total_open": sum(port_count.values()),
+            "unique_ports": len(open_ports),
+        }
+
+    def get_technology_summary(self) -> Dict[str, Any]:
+        """Get summary of detected technologies."""
+        tech_count = {}
+        tech_hosts = {}
+
+        for url, result in self.technologies.items():
+            for tech in result.get("technologies", []):
+                if tech not in tech_count:
+                    tech_count[tech] = 0
+                    tech_hosts[tech] = []
+                tech_count[tech] += 1
+                tech_hosts[tech].append(url)
+
+        # Sort by frequency
+        sorted_techs = sorted(tech_count.items(), key=lambda x: x[1], reverse=True)
+
+        return {
+            "technology_count": dict(sorted_techs),
+            "technology_hosts": tech_hosts,
+            "unique_technologies": len(tech_count),
+            "most_common": sorted_techs[0][0] if sorted_techs else None,
+        }
+
+    def find_interesting_ports(self) -> List[Dict[str, Any]]:
+        """Find potentially interesting open ports."""
+        interesting = {
+            80: "HTTP",
+            443: "HTTPS",
+            8080: "HTTP Alt",
+            8443: "HTTPS Alt",
+            3000: "Node.js",
+            5000: "Flask/Dev",
+            8000: "Django/Dev",
+            9000: "SonarQube",
+            27017: "MongoDB",
+            6379: "Redis",
+            5432: "PostgreSQL",
+            3306: "MySQL",
+            1433: "MSSQL",
+            22: "SSH",
+            21: "FTP",
+            25: "SMTP",
+            110: "POP3",
+            143: "IMAP",
+        }
+
+        found = []
+        for host, results in self.ports.items():
+            for result in results:
+                if result.get("status") == "open":
+                    port = result.get("port")
+                    if port in interesting:
+                        found.append({
+                            "host": host,
+                            "port": port,
+                            "service": interesting[port],
+                            "banner": result.get("banner", ""),
+                        })
+
+        return sorted(found, key=lambda x: x["port"])
+
+    def find_security_headers(self) -> Dict[str, Any]:
+        """Analyze security headers across all URLs."""
+        security_headers = {
+            "Strict-Transport-Security": "HSTS",
+            "Content-Security-Policy": "CSP",
+            "X-Content-Type-Options": "X-Content-Type-Options",
+            "X-Frame-Options": "Clickjacking Protection",
+            "X-XSS-Protection": "XSS Protection",
+            "Referrer-Policy": "Referrer Policy",
+            "Permissions-Policy": "Permissions Policy",
+        }
+
+        found = {}
+        missing = {}
+
+        for url, result in self.technologies.items():
+            headers = result.get("headers", {})
+            for header, name in security_headers.items():
+                if header in headers:
+                    if name not in found:
+                        found[name] = []
+                    found[name].append(url)
+                else:
+                    if name not in missing:
+                        missing[name] = []
+                    missing[name].append(url)
+
+        return {
+            "found": found,
+            "missing": missing,
+            "coverage": len(found) / len(security_headers) if security_headers else 0,
+        }
+
+    def find_potential_vulnerabilities(self) -> List[Dict[str, Any]]:
+        """Find potential vulnerability indicators."""
+        vulnerabilities = []
+
+        # Check for outdated technologies
+        outdated_patterns = {
+            "Apache/2.2": "Outdated Apache",
+            "nginx/1.0": "Outdated nginx",
+            "PHP/5": "Outdated PHP",
+            "jQuery/1": "Outdated jQuery",
+        }
+
+        for url, result in self.technologies.items():
+            headers = result.get("headers", {})
+            server = headers.get("Server", "")
+
+            for pattern, vuln in outdated_patterns.items():
+                if pattern.lower() in server.lower():
+                    vulnerabilities.append({
+                        "url": url,
+                        "type": "Outdated Software",
+                        "finding": vuln,
+                        "severity": "Medium",
+                    })
+
+        # Check for missing security headers
+        security_check = self.find_security_headers()
+        for header, urls in security_check["missing"].items():
+            if urls:
+                vulnerabilities.append({
+                    "url": urls[0] if urls else "Unknown",
+                    "type": "Missing Security Header",
+                    "finding": f"Missing {header}",
+                    "severity": "Low",
+                    "affected_urls": len(urls),
+                })
+
+        return vulnerabilities
+
+    def get_subdomain_statistics(self) -> Dict[str, Any]:
+        """Get statistics about discovered subdomains."""
+        subdomain_patterns = {}
+        for subdomain in self.subdomains:
+            parts = subdomain.split(".")
+            if len(parts) > 2:
+                prefix = parts[0]
+                if prefix not in subdomain_patterns:
+                    subdomain_patterns[prefix] = 0
+                subdomain_patterns[prefix] += 1
+
+        return {
+            "total_subdomains": len(self.subdomains),
+            "unique_prefixes": len(subdomain_patterns),
+            "common_prefixes": sorted(
+                subdomain_patterns.items(), key=lambda x: x[1], reverse=True
+            )[:10],
+        }
+
+    def get_risk_assessment(self) -> Dict[str, Any]:
+        """Get overall risk assessment."""
+        score = 0
+        findings = []
+
+        # Check for open ports
+        open_summary = self.get_open_ports_summary()
+        if open_summary["total_open"] > 5:
+            score += 20
+            findings.append(f"Many open ports detected ({open_summary['total_open']})")
+
+        # Check for common vulnerable ports
+        vulnerable_ports = [3306, 27017, 6379, 5432, 1433]
+        for port in vulnerable_ports:
+            if port in open_summary["open_ports"]:
+                score += 15
+                findings.append(f"Potentially exposed database port: {port}")
+
+        # Check for missing security headers
+        security = self.find_security_headers()
+        if security["coverage"] < 0.5:
+            score += 25
+            findings.append("Missing multiple security headers")
+
+        # Check for outdated software
+        vulns = self.find_potential_vulnerabilities()
+        if vulns:
+            score += 10 * len(vulns)
+            findings.append(f"Found {len(vulns)} potential vulnerability indicators")
+
+        # Normalize score to 0-100
+        score = min(score, 100)
+
+        risk_level = "Low" if score < 30 else "Medium" if score < 70 else "High"
+
+        return {
+            "risk_score": score,
+            "risk_level": risk_level,
+            "findings": findings,
+            "recommendations": self._get_recommendations(risk_level),
+        }
+
+    def _get_recommendations(self, risk_level: str) -> List[str]:
+        """Get recommendations based on risk level."""
+        recommendations = []
+
+        if risk_level == "High":
+            recommendations.extend([
+                "Conduct thorough security assessment",
+                "Review exposed services and ports",
+                "Implement security headers",
+                "Update outdated software",
+                "Consider WAF deployment",
+            ])
+        elif risk_level == "Medium":
+            recommendations.extend([
+                "Review security configuration",
+                "Add missing security headers",
+                "Update software to latest versions",
+                "Implement additional monitoring",
+            ])
+        else:
+            recommendations.extend([
+                "Continue security monitoring",
+                "Keep software updated",
+                "Maintain security headers",
+            ])
+
+        return recommendations
+
+    def generate_summary_report(self) -> str:
+        """Generate a text summary of findings."""
+        report = []
+        report.append("=" * 60)
+        report.append("RECONFORGE ANALYSIS SUMMARY")
+        report.append("=" * 60)
+        report.append("")
+
+        # Subdomain stats
+        subdomain_stats = self.get_subdomain_statistics()
+        report.append(f"Subdomains: {subdomain_stats['total_subdomains']}")
+        report.append(f"Unique Prefixes: {subdomain_stats['unique_prefixes']}")
+        report.append("")
+
+        # Open ports
+        port_summary = self.get_open_ports_summary()
+        report.append(f"Open Ports: {port_summary['total_open']}")
+        report.append(f"Unique Ports: {port_summary['unique_ports']}")
+        report.append("")
+
+        # Technologies
+        tech_summary = self.get_technology_summary()
+        report.append(f"Technologies Detected: {tech_summary['unique_technologies']}")
+        if tech_summary["most_common"]:
+            report.append(f"Most Common: {tech_summary['most_common']}")
+        report.append("")
+
+        # Risk assessment
+        risk = self.get_risk_assessment()
+        report.append(f"Risk Score: {risk['risk_score']}/100")
+        report.append(f"Risk Level: {risk['risk_level']}")
+        report.append("")
+
+        if risk["findings"]:
+            report.append("Key Findings:")
+            for finding in risk["findings"]:
+                report.append(f"  - {finding}")
+            report.append("")
+
+        if risk["recommendations"]:
+            report.append("Recommendations:")
+            for rec in risk["recommendations"]:
+                report.append(f"  - {rec}")
+
+        report.append("")
+        report.append("=" * 60)
+
+        return "\n".join(report)

reconforge/api.py

@@ -0,0 +1,196 @@
+"""Programmatic API for ReconForge - use ReconForge in your Python code."""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional
+
+from .cache import get_cache
+from .config import get_config
+from .logger import get_logger
+from .portscan import scan_ports
+from .report import generate_report as _generate_report
+from .scopecheck import check_targets
+from .subdomains import fetch_subdomains
+from .techdetect import detect_technologies
+
+
+class ReconForgeAPI:
+    """Main API class for ReconForge."""
+
+    def __init__(self, use_cache: bool = True, log_file: Optional[str] = None):
+        """Initialize ReconForge API.
+        
+        Args:
+            use_cache: Enable result caching
+            log_file: Optional log file path
+        """
+        self.cache = get_cache() if use_cache else None
+        self.config = get_config()
+        self.logger = get_logger(log_file=log_file)
+
+    def discover_subdomains(self, domain: str, timeout: Optional[float] = None) -> Dict[str, Any]:
+        """Discover subdomains for a domain.
+        
+        Args:
+            domain: Target domain
+            timeout: Request timeout (uses config default if None)
+        
+        Returns:
+            Dictionary with subdomains and errors
+        """
+        timeout = timeout or self.config.get("timeout", 10.0)
+        
+        # Check cache
+        if self.cache:
+            cache_key = f"subdomains:{domain}"
+            cached = self.cache.get(cache_key)
+            if cached:
+                self.logger.info(f"Returning cached subdomains for {domain}")
+                return cached
+        
+        self.logger.info(f"Discovering subdomains for {domain}")
+        subdomains, errors = fetch_subdomains(domain, timeout=timeout)
+        
+        result = {
+            "domain": domain,
+            "subdomains": subdomains,
+            "errors": errors,
+            "count": len(subdomains),
+        }
+        
+        # Cache result
+        if self.cache:
+            self.cache.set(cache_key, result)
+        
+        return result
+
+    def scan_ports(
+        self,
+        host: str,
+        ports: Optional[List[int]] = None,
+        timeout: Optional[float] = None,
+        concurrent: Optional[bool] = None,
+    ) -> Dict[str, Any]:
+        """Scan ports on a host.
+        
+        Args:
+            host: Target host
+            ports: List of ports to scan (uses defaults if None)
+            timeout: Socket timeout (uses config default if None)
+            concurrent: Use concurrent scanning (uses config default if None)
+        
+        Returns:
+            Dictionary with scan results
+        """
+        timeout = timeout or self.config.get("port_scan_timeout", 2.0)
+        concurrent = concurrent if concurrent is not None else self.config.get("concurrent_scanning", True)
+        
+        self.logger.info(f"Scanning ports on {host}")
+        result = scan_ports(host, ports=ports, timeout=timeout, concurrent=concurrent)
+        
+        return result
+
+    def detect_technologies(self, url: str, timeout: Optional[float] = None) -> Dict[str, Any]:
+        """Detect technologies on a URL.
+        
+        Args:
+            url: Target URL
+            timeout: Request timeout (uses config default if None)
+        
+        Returns:
+            Dictionary with detected technologies
+        """
+        timeout = timeout or self.config.get("timeout", 10.0)
+        
+        self.logger.info(f"Detecting technologies on {url}")
+        result = detect_technologies(url, timeout=timeout)
+        
+        return result
+
+    def check_scope(self, targets_file: str, scope_file: str) -> Dict[str, Any]:
+        """Check if targets are in scope.
+        
+        Args:
+            targets_file: Path to targets file
+            scope_file: Path to scope file
+        
+        Returns:
+            Dictionary with in-scope and out-of-scope targets
+        """
+        self.logger.info(f"Checking scope for targets in {targets_file}")
+        result = check_targets(targets_file, scope_file)
+        
+        return result
+
+    def generate_report(
+        self,
+        domain: str,
+        output: str,
+        timeout: Optional[float] = None,
+        max_hosts: Optional[int] = None,
+        concurrent: Optional[bool] = None,
+    ) -> Dict[str, Any]:
+        """Generate a comprehensive recon report.
+        
+        Args:
+            domain: Target domain
+            output: Output file path
+            timeout: Request timeout (uses config default if None)
+            max_hosts: Maximum hosts to scan
+            concurrent: Use concurrent scanning (uses config default if None)
+        
+        Returns:
+            Dictionary with report generation results
+        """
+        timeout = timeout or self.config.get("timeout", 10.0)
+        concurrent = concurrent if concurrent is not None else self.config.get("concurrent_scanning", True)
+        
+        self.logger.info(f"Generating report for {domain}")
+        result = _generate_report(domain, output, timeout=timeout, max_hosts=max_hosts, concurrent=concurrent)
+        
+        return result
+
+    def get_cache_stats(self) -> Dict[str, Any]:
+        """Get cache statistics."""
+        if not self.cache:
+            return {"cache_enabled": False}
+        
+        return self.cache.get_stats()
+
+    def clear_cache(self) -> None:
+        """Clear all cached results."""
+        if self.cache:
+            self.cache.clear()
+            self.logger.info("Cache cleared")
+
+    def cleanup_expired_cache(self) -> int:
+        """Remove expired cache entries.
+        
+        Returns:
+            Number of deleted entries
+        """
+        if not self.cache:
+            return 0
+        
+        count = self.cache.cleanup_expired()
+        self.logger.info(f"Cleaned up {count} expired cache entries")
+        return count
+
+
+# Convenience functions for quick access
+def discover_subdomains(domain: str) -> Dict[str, Any]:
+    """Quick function to discover subdomains."""
+    api = ReconForgeAPI()
+    return api.discover_subdomains(domain)
+
+
+def scan_ports_quick(host: str) -> Dict[str, Any]:
+    """Quick function to scan ports."""
+    api = ReconForgeAPI()
+    return api.scan_ports(host)
+
+
+def detect_technologies_quick(url: str) -> Dict[str, Any]:
+    """Quick function to detect technologies."""
+    api = ReconForgeAPI()
+    return api.detect_technologies(url)