secator 0.5.1__tar.gz → 0.6.0__tar.gz

{secator-0.5.1 → secator-0.6.0}/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.6.0](https://github.com/freelabz/secator/compare/v0.5.2...v0.6.0) (2024-07-25)
+
+
+### Features
+
+* add duplicate finder to mongodb hooks ([#409](https://github.com/freelabz/secator/issues/409)) ([fb0e11c](https://github.com/freelabz/secator/commit/fb0e11cd2b64bf51bc862f47243c8c0602d3d5e9))
+* basic helm chart ([#408](https://github.com/freelabz/secator/issues/408)) ([6b2f84f](https://github.com/freelabz/secator/commit/6b2f84f61bd8eccf2cdd61b6ffdc2eb4489240bc))
+
+
+### Bug Fixes
+
+* Dockerfile broken apt install ([#407](https://github.com/freelabz/secator/issues/407)) ([c023279](https://github.com/freelabz/secator/commit/c02327968ecea816004636801684b336735df439))
+* **tasks:** duplicate meta opt entry ([#401](https://github.com/freelabz/secator/issues/401)) ([ae56aa6](https://github.com/freelabz/secator/commit/ae56aa62f5a18936a1787547e37bbe636e6e43c3))
+
+## [0.5.2](https://github.com/freelabz/secator/compare/v0.5.1...v0.5.2) (2024-05-07)
+
+
+### Bug Fixes
+
+* **nuclei,katana:** add -sr flag and write http responses and screenshot to correct folder ([#395](https://github.com/freelabz/secator/issues/395)) ([1a51790](https://github.com/freelabz/secator/commit/1a51790c9231f593631c2780b6d5e0fa89f1aa55))
+
 ## [0.5.1](https://github.com/freelabz/secator/compare/v0.5.0...v0.5.1) (2024-05-06)
 
 

{secator-0.5.1 → secator-0.6.0}/Dockerfile

@@ -22,8 +22,7 @@ RUN apt update -y && \
     jq \
     openssl \
 	proxychains \
-	proxychains-ng \
-	&& rm -rf /var/lib/apt/lists/*
+	proxychains-ng
 
 # Install Metasploit framework
 RUN curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
@@ -43,5 +42,8 @@ RUN secator install addons mongodb
 RUN secator install addons redis
 RUN secator install addons dev
 
+# Cleanup
+RUN rm -rf /var/lib/apt/lists/*
+
 # Set entrypoint
 ENTRYPOINT ["secator"]

{secator-0.5.1 → secator-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: secator
-Version: 0.5.1
+Version: 0.6.0
 Summary: The pentester's swiss knife.
 Project-URL: Homepage, https://github.com/freelabz/secator
 Project-URL: Issues, https://github.com/freelabz/secator/issues
@@ -19,7 +19,7 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Requires-Python: >=3.8
-Requires-Dist: bs4<1
+Requires-Dist: beautifulsoup4<=5
 Requires-Dist: celery<6
 Requires-Dist: cpe<2
 Requires-Dist: dotmap<2

secator-0.6.0/helm/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

secator-0.6.0/helm/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: Secator
+description: A Secator Helm chart for Kubernetes
+
+type: application
+version: 0.1.0
+appVersion: "0.5.2"

secator-0.6.0/helm/templates/redis-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.redis.name }}
+  namespace: {{ .Values.namespace }}
+spec:
+  type: ClusterIP
+  ports:
+  - port: {{ .Values.redis.port }}
+    name: client
+  selector:
+    app: redis

secator-0.6.0/helm/templates/redis.yaml

@@ -0,0 +1,22 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ .Values.redis.name }}
+  namespace: {{ .Values.namespace }}
+spec:
+  selector:
+    matchLabels:
+      app: redis
+  serviceName: {{ .Values.redis.name }}
+  replicas: {{ .Values.redis.replicas }}
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - name: {{ .Values.redis.name }}
+        image: {{ .Values.redis.image }}
+        ports:
+        - containerPort: {{ .Values.redis.port }}
+          name: client

secator-0.6.0/helm/templates/secator-manager.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ .Values.secatorManager.name }}
+  namespace: {{ .Values.namespace }}
+  labels:
+    name: secator-manager
+spec:
+  containers:
+  - name: secator-manager
+    image: {{ .Values.secatorManager.image }}
+    command: ["tail"]
+    args: ["-F", "anything"]
+    env:
+    - name: SECATOR_CELERY_BROKER_URL
+      value: "redis://{{ .Values.redis.name }}:6379/0"
+    - name: SECATOR_CELERY_RESULT_BACKEND
+      value: "redis://{{ .Values.redis.name }}:6379/0"

secator-0.6.0/helm/templates/secator-worker.yaml

@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.secatorWorker.name }}
+  namespace: {{ .Values.namespace }}
+spec:
+  selector:
+    matchLabels:
+      app: secator-worker
+  template:
+    metadata:
+      labels:
+        app: secator-worker
+    spec:
+      containers:
+      - name: {{ .Values.secatorWorker.name }}
+        image: {{ .Values.secatorWorker.image }}
+        command: ["secator"]
+        args: ["worker"]
+        env:
+        - name: SECATOR_CELERY_BROKER_URL
+          value: "redis://{{ .Values.redis.name }}:6379/0"
+        - name: SECATOR_CELERY_RESULT_BACKEND
+          value: "redis://{{ .Values.redis.name }}:6379/0"

secator-0.6.0/helm/values.yaml

@@ -0,0 +1,34 @@
+# Default values for Secator
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+namespace: secator
+
+secatorManager:
+  name: secator-manager
+  image: "freelabz/secator"
+
+  # Empty if using default repository
+  repository:
+  # Empty if using tag "latest"
+  tag:
+
+secatorWorker:
+  name: secator-worker
+  image: "freelabz/secator"
+
+  # Empty if using default repository
+  repository:
+  # Empty if using tag "latest"
+  tag:
+
+redis:
+  name: redis
+  image: "redis"
+
+  # Empty if using default repository
+  repository:
+  # Empty if using tag "latest"
+  tag:
+  replicas: 1
+  port: 6379

{secator-0.5.1 → secator-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "secator"
-version = "0.5.1"
+version = "0.6.0"
 authors = [{ name = "FreeLabz", email = "sales@freelabz.com" }]
 readme = "README.md"
 description = "The pentester's swiss knife."
@@ -30,7 +30,7 @@ classifiers = [
   "Programming Language :: Python :: 3.11",
 ]
 dependencies = [
-  "bs4 < 1",
+  "beautifulsoup4 <= 5",
   'celery < 6',
   "cpe < 2",
   "dotmap < 2",

{secator-0.5.1 → secator-0.6.0}/secator/hooks/mongodb.py

@@ -206,6 +206,6 @@ MONGODB_HOOKS = {
 		'on_item': [update_finding],
 		'on_duplicate': [update_finding],
 		'on_iter': [update_runner],
-		'on_end': [update_runner]
+		'on_end': [update_runner, find_duplicates]
 	}
 }

{secator-0.5.1 → secator-0.6.0}/secator/output_types/progress.py

@@ -8,7 +8,7 @@ from secator.utils import rich_to_ansi
 @dataclass
 class Progress(OutputType):
 	duration: str
-	percent: int
+	percent: int = 0
 	errors: list = field(default_factory=list)
 	extra_data: dict = field(default_factory=dict)
 	_source: str = field(default='', repr=True)

{secator-0.5.1 → secator-0.6.0}/secator/tasks/_categories.py

@@ -44,7 +44,7 @@ OPTS_HTTP = [
 ]
 
 OPTS_HTTP_CRAWLERS = OPTS_HTTP + [
-	DEPTH, MATCH_REGEX, MATCH_SIZE, MATCH_WORDS, FILTER_REGEX, FILTER_CODES, FILTER_SIZE, FILTER_WORDS, FOLLOW_REDIRECT,
+	DEPTH, MATCH_REGEX, MATCH_SIZE, MATCH_WORDS, FILTER_REGEX, FILTER_CODES, FILTER_SIZE, FILTER_WORDS,
 	MATCH_CODES
 ]
 

{secator-0.5.1 → secator-0.6.0}/secator/tasks/httpx.py

@@ -31,6 +31,7 @@ class httpx(Http):
 		'cdn': {'is_flag': True, 'default': False, 'help': 'CDN detection'},
 		'debug_resp': {'is_flag': True, 'default': False, 'help': 'Debug response'},
 		'vhost': {'is_flag': True, 'default': False, 'help': 'Probe and display server supporting VHOST'},
+		'store_responses': {'is_flag': True, 'short': 'sr', 'default': CONFIG.http.store_responses, 'help': 'Save HTTP responses'},  # noqa: E501
 		'screenshot': {'is_flag': True, 'short': 'ss', 'default': False, 'help': 'Screenshot response'},
 		'system_chrome': {'is_flag': True, 'default': False, 'help': 'Use local installed Chrome for screenshot'},
 		'headless_options': {'is_flag': False, 'short': 'ho', 'default': None, 'help': 'Headless Chrome additional options'},
@@ -55,6 +56,7 @@ class httpx(Http):
 		THREADS: 'threads',
 		TIMEOUT: 'timeout',
 		USER_AGENT: OPT_NOT_SUPPORTED,
+		'store_responses': 'sr',
 	}
 	opt_value_map = {
 		DELAY: lambda x: str(x) + 's' if x else None,
@@ -71,15 +73,10 @@ class httpx(Http):
 		debug_resp = self.get_opt_value('debug_resp')
 		if debug_resp:
 			self.cmd = self.cmd.replace('-silent', '')
-		if CONFIG.http.store_responses:
-			self.output_response_path = f'{self.reports_folder}/response'
-			self.output_screenshot_path = f'{self.reports_folder}/screenshot'
-			os.makedirs(self.output_response_path, exist_ok=True)
-			os.makedirs(self.output_screenshot_path, exist_ok=True)
-			self.cmd += f' -sr -srd {self.reports_folder}'
-
-		# Remove screenshot bytes and body bytes when screenshot
 		screenshot = self.get_opt_value('screenshot')
+		store_responses = self.get_opt_value('store_responses')
+		if store_responses or screenshot:
+			self.cmd += f' -srd {self.reports_folder}/.outputs'
 		if screenshot:
 			self.cmd += ' -esb -ehb'
 
@@ -98,8 +95,15 @@ class httpx(Http):
 
 	@staticmethod
 	def on_end(self):
-		if CONFIG.http.store_responses:
-			if os.path.exists(self.output_response_path + '/index.txt'):
-				os.remove(self.output_response_path + '/index.txt')
-			if os.path.exists(self.output_screenshot_path + '/index.txt'):
-				os.remove(self.output_screenshot_path + '/index_screenshot.txt')
+		store_responses = self.get_opt_value('store_responses')
+		response_dir = f'{self.reports_folder}/.outputs'
+		if store_responses:
+			index_rpath = f'{response_dir}/response/index.txt'
+			index_spath = f'{response_dir}/screenshot/index_screenshot.txt'
+			index_spath2 = f'{response_dir}/screenshot/screenshot.html'
+			if os.path.exists(index_rpath):
+				os.remove(index_rpath)
+			if os.path.exists(index_spath):
+				os.remove(index_spath)
+			if os.path.exists(index_spath2):
+				os.remove(index_spath2)

{secator-0.5.1 → secator-0.6.0}/secator/tasks/katana.py

@@ -29,7 +29,8 @@ class katana(HttpCrawler):
 	opts = {
 		'headless': {'is_flag': True, 'short': 'hl', 'help': 'Headless mode'},
 		'system_chrome': {'is_flag': True, 'short': 'sc', 'help': 'Use local installed chrome browser'},
-		'form_extraction': {'is_flag': True, 'short': 'fx', 'help': 'Detect forms'}
+		'form_extraction': {'is_flag': True, 'short': 'fx', 'help': 'Detect forms'},
+		'store_responses': {'is_flag': True, 'short': 'sr', 'default': CONFIG.http.store_responses, 'help': 'Store responses'}
 	}
 	opt_key_map = {
 		HEADER: 'headers',
@@ -50,7 +51,8 @@ class katana(HttpCrawler):
 		RETRIES: 'retry',
 		THREADS: 'concurrency',
 		TIMEOUT: 'timeout',
-		USER_AGENT: OPT_NOT_SUPPORTED
+		USER_AGENT: OPT_NOT_SUPPORTED,
+		'store_responses': 'sr'
 	}
 	opt_value_map = {
 		DELAY: lambda x: int(x) if isinstance(x, float) else x
@@ -107,14 +109,16 @@ class katana(HttpCrawler):
 		debug_resp = self.get_opt_value('debug_resp')
 		if debug_resp:
 			self.cmd = self.cmd.replace('-silent', '')
-		if CONFIG.http.store_responses:
-			self.cmd += f' -sr -srd {self.reports_folder}'
+		store_responses = self.get_opt_value('store_responses')
+		if store_responses:
+			self.cmd += f' -srd {self.reports_folder}/.outputs'
 
 	@staticmethod
 	def on_item(self, item):
 		if not isinstance(item, Url):
 			return item
-		if CONFIG.http.store_responses and os.path.exists(item.stored_response_path):
+		store_responses = self.get_opt_value('store_responses')
+		if store_responses and os.path.exists(item.stored_response_path):
 			with open(item.stored_response_path, 'r', encoding='latin-1') as fin:
 				data = fin.read().splitlines(True)
 				first_line = data[0]
@@ -126,5 +130,7 @@ class katana(HttpCrawler):
 
 	@staticmethod
 	def on_end(self):
-		if CONFIG.http.store_responses and os.path.exists(self.reports_folder + '/index.txt'):
-			os.remove(self.reports_folder + '/index.txt')
+		store_responses = self.get_opt_value('store_responses')
+		index_rpath = f'{self.reports_folder}/.outputs/index.txt'
+		if store_responses and os.path.exists(index_rpath):
+			os.remove(index_rpath)

{secator-0.5.1 → secator-0.6.0}/tests/integration/outputs.py

@@ -59,7 +59,7 @@ OUTPUTS_TASKS = {
             _source='dnsx'
 		),
         Record(
-            name='v=spf1 include:wikimedia.org ~all',
+            name='v=spf1 include:_cidrs.wikimedia.org ~all',
             type='TXT',
             host='wikipedia.org',
             _source='dnsx'
@@ -217,7 +217,7 @@ OUTPUTS_TASKS = {
     ],
     'wpscan': [
         Tag(
-            name='Wordpress theme - twentytwentyfour 1.1',
+            name='Wordpress theme - twentytwentyfour 1.2',
             match='http://localhost:8000/',
             _source='wpscan'),
         Vulnerability(