souleyez 2.16.0__py3-none-any.whl → 2.26.0__py3-none-any.whl

souleyez/parsers/sqlmap_parser.py

@@ -80,15 +80,22 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
     current_method = 'GET'
     current_post_data = None
 
+    # Track POST form URLs separately to prevent GET URL testing from overwriting them
+    # This fixes bug where chain rules get wrong URL when SQLMap tests multiple URLs
+    last_post_form_url = None
+    last_post_form_data = None
+
     for i, line in enumerate(lines):
         line = line.strip()
 
-        # Extract URL being tested
-        if 'testing URL' in line:
-            url_match = re.search(r"testing URL '([^']+)'", line)
+        # Extract URL being tested (GET requests typically)
+        # Format variations: "testing URL 'http://...'" or 'testing URL "http://..."' or testing URL http://...
+        if 'testing URL' in line or 'testing url' in line.lower():
+            # Try single quotes first
+            url_match = re.search(r"testing URL ['\"]?([^'\"]+)['\"]?", line, re.IGNORECASE)
             if url_match:
-                current_url = url_match.group(1)
-                if current_url not in result['urls_tested']:
+                current_url = url_match.group(1).strip()
+                if current_url and current_url not in result['urls_tested']:
                     result['urls_tested'].append(current_url)
 
         # Extract POST/GET URLs from form testing (crawl mode)
@@ -100,6 +107,9 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
                 current_url = url_match.group(2)
                 if current_url not in result['urls_tested']:
                     result['urls_tested'].append(current_url)
+                # Save POST form URL separately for later use
+                if current_method == 'POST':
+                    last_post_form_url = current_url
 
         # Extract POST data (appears after "POST http://..." line)
         # Format: "POST data: username=&password=&submit=Login"
@@ -107,6 +117,8 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
             post_data_match = re.search(r'^POST data:\s*(.+)$', line)
             if post_data_match:
                 current_post_data = post_data_match.group(1).strip()
+                # Associate POST data with the POST form URL
+                last_post_form_data = current_post_data
 
         # Handle resumed injection points from stored session
         # Pattern: "sqlmap resumed the following injection point(s) from stored session:"
@@ -129,15 +141,23 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
                     else:
                         method = current_method  # Use current context
 
+                    # For POST parameters, use the saved POST form URL instead of current_url
+                    if method == 'POST' and last_post_form_url:
+                        effective_url = last_post_form_url
+                        effective_post_data = last_post_form_data or current_post_data
+                    else:
+                        effective_url = current_url or target
+                        effective_post_data = current_post_data if method == 'POST' else None
+
                     # Mark as confirmed injection
                     result['sql_injection_confirmed'] = True
                     result['injectable_parameter'] = param
-                    result['injectable_url'] = current_url or target
+                    result['injectable_url'] = effective_url
                     result['injectable_method'] = method
 
                     # Add vulnerability entry
                     result['vulnerabilities'].append({
-                        'url': current_url or target,
+                        'url': effective_url,
                         'parameter': param,
                         'vuln_type': 'sqli',
                         'injectable': True,
@@ -147,10 +167,10 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
 
                     # Collect injection point
                     injection_point = {
-                        'url': current_url or target,
+                        'url': effective_url,
                         'parameter': param,
                         'method': method,
-                        'post_data': current_post_data if method == 'POST' else None,
+                        'post_data': effective_post_data,
                         'techniques': []
                     }
                     if not any(
@@ -166,12 +186,19 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
                 if next_line.startswith('[') or next_line.startswith('back-end'):
                     break
 
-        # Extract DBMS type
-        if 'back-end DBMS:' in line:
-            # Pattern: "back-end DBMS: MySQL >= 5.0.12"
-            dbms_match = re.search(r"back-end DBMS:\s*([^\s]+)", line)
+        # Extract DBMS type with full version info
+        # Format variations:
+        # "back-end DBMS: MySQL >= 5.0.12"
+        # "back-end DBMS: Microsoft SQL Server 2019"
+        # "back-end DBMS: PostgreSQL"
+        if 'back-end DBMS:' in line or 'back-end dbms:' in line.lower():
+            dbms_match = re.search(r"back-end DBMS:\s*(.+)", line, re.IGNORECASE)
             if dbms_match and not result['dbms']:
-                result['dbms'] = dbms_match.group(1)
+                dbms_full = dbms_match.group(1).strip()
+                # Extract just the DBMS name for the main field (first word)
+                # but store full version in a separate field
+                result['dbms'] = dbms_full.split()[0] if dbms_full else None
+                result['dbms_full'] = dbms_full  # Keep full string
 
         # Extract web server OS
         if 'web server operating system:' in line.lower():
@@ -318,8 +345,17 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
                     )
 
                     if not already_added:
+                        # For POST parameters, use the saved POST form URL instead of current_url
+                        # This prevents bug where GET URL testing overwrites the correct POST form URL
+                        if param_method == 'POST' and last_post_form_url:
+                            effective_url = last_post_form_url
+                            effective_post_data = last_post_form_data or current_post_data
+                        else:
+                            effective_url = current_url or target
+                            effective_post_data = current_post_data if param_method == 'POST' else None
+
                         result['vulnerabilities'].append({
-                            'url': current_url or target,
+                            'url': effective_url,
                             'parameter': param,
                             'vuln_type': 'sqli',
                             'injectable': True,
@@ -332,17 +368,17 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
                         # Set confirmation flags
                         result['sql_injection_confirmed'] = True
                         result['injectable_parameter'] = param
-                        result['injectable_url'] = current_url or target
+                        result['injectable_url'] = effective_url
                         result['injectable_method'] = param_method  # GET, POST, etc.
-                        if param_method == 'POST' and current_post_data:
-                            result['injectable_post_data'] = current_post_data
+                        if param_method == 'POST' and effective_post_data:
+                            result['injectable_post_data'] = effective_post_data
 
                         # Collect ALL injection points for fallback
                         injection_point = {
-                            'url': current_url or target,
+                            'url': effective_url,
                             'parameter': param,
                             'method': param_method,
-                            'post_data': current_post_data if param_method == 'POST' else None,
+                            'post_data': effective_post_data,
                             'techniques': techniques
                         }
                         # Avoid duplicates
@@ -364,8 +400,18 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
             if param_match:
                 method = param_match.group(1) or current_method
                 param = param_match.group(2)
+
+                # For POST parameters, use the saved POST form URL instead of current_url
+                # This prevents bug where GET URL testing overwrites the correct POST form URL
+                if method == 'POST' and last_post_form_url:
+                    effective_url = last_post_form_url
+                    effective_post_data = last_post_form_data or current_post_data
+                else:
+                    effective_url = current_url or target
+                    effective_post_data = current_post_data if method == 'POST' else None
+
                 result['vulnerabilities'].append({
-                    'url': current_url or target,
+                    'url': effective_url,
                     'parameter': param,
                     'vuln_type': 'sqli',
                     'injectable': True,
@@ -376,17 +422,17 @@ def parse_sqlmap_output(output: str, target: str = "") -> Dict[str, Any]:
                 # Set confirmation flags
                 result['sql_injection_confirmed'] = True
                 result['injectable_parameter'] = param
-                result['injectable_url'] = current_url or target
+                result['injectable_url'] = effective_url
                 result['injectable_method'] = method
-                if method == 'POST' and current_post_data:
-                    result['injectable_post_data'] = current_post_data
+                if method == 'POST' and effective_post_data:
+                    result['injectable_post_data'] = effective_post_data
 
                 # Collect ALL injection points for fallback
                 injection_point = {
-                    'url': current_url or target,
+                    'url': effective_url,
                     'parameter': param,
                     'method': method,
-                    'post_data': current_post_data if method == 'POST' else None,
+                    'post_data': effective_post_data,
                     'techniques': []  # Technique details not available at this detection point
                 }
                 # Avoid duplicates

souleyez/parsers/theharvester_parser.py

@@ -67,18 +67,19 @@ def parse_theharvester_output(output: str, target: str = "") -> Dict[str, Any]:
             if target_match:
                 result['target'] = target_match.group(1)
 
-        # Detect section headers
-        elif '[*] ASNS found:' in line or 'ASNs found:' in line:
+        # Detect section headers (case-insensitive, multiple format variations)
+        line_lower = line.lower()
+        if any(x in line_lower for x in ['asns found', 'asn found', 'autonomous system']):
             current_section = 'asns'
-        elif '[*] Interesting Urls found:' in line or '[*] URLs found:' in line:
+        elif any(x in line_lower for x in ['urls found', 'interesting urls', 'url found']):
             current_section = 'urls'
-        elif '[*] IPs found:' in line:
+        elif any(x in line_lower for x in ['ips found', 'ip found', 'ip addresses']):
             current_section = 'ips'
-        elif '[*] Emails found:' in line or 'Email addresses found:' in line:
+        elif any(x in line_lower for x in ['emails found', 'email found', 'email addresses']):
             current_section = 'emails'
-        elif '[*] Hosts found:' in line or 'Hosts found:' in line:
+        elif any(x in line_lower for x in ['hosts found', 'host found', 'subdomains found', 'subdomain found']):
             current_section = 'hosts'
-        elif '[*] People found:' in line or '[*] No people found' in line:
+        elif any(x in line_lower for x in ['people found', 'no people found', 'linkedin']):
             current_section = 'people'  # We'll skip this for now
 
         # Skip separator lines and empty lines
@@ -117,18 +118,25 @@ def parse_theharvester_output(output: str, target: str = "") -> Dict[str, Any]:
         elif current_section == 'emails':
             # Email format: user@domain
             if '@' in line and '.' in line:
-                # Basic email validation
-                if re.match(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$', line):
-                    if line not in result['emails']:
-                        result['emails'].append(line)
+                # More permissive email validation (supports international domains)
+                # Pattern allows: standard emails, plus-addressing, dots, underscores
+                email = line.strip().lower()
+                # Remove any leading/trailing brackets or quotes
+                email = re.sub(r'^[\[\(<\'\"]+|[\]\)>\'\"]$', '', email)
+                if re.match(r'^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$', email):
+                    if email not in result['emails']:
+                        result['emails'].append(email)
 
         elif current_section == 'hosts':
             # Host format: subdomain.domain.tld
             if '.' in line and not line.startswith('http'):
                 # Clean and validate hostname
                 host = line.strip().lower()
-                # Basic validation: has at least one dot and no invalid chars
-                if re.match(r'^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$', host):
+                # Remove any leading/trailing brackets, quotes, or trailing dots
+                host = re.sub(r'^[\[\(<\'\"]+|[\]\)>\'\".]+$', '', host)
+                # More permissive validation: allows underscores (common in some hosts)
+                # and longer TLDs (some are 4+ chars)
+                if re.match(r'^[a-zA-Z0-9._-]+\.[a-zA-Z]{2,}$', host) and len(host) > 3:
                     if host not in result['hosts']:
                         result['hosts'].append(host)
 

souleyez/plugins/gobuster.py

@@ -154,6 +154,83 @@ class GobusterPlugin(PluginBase):
     category = "scanning"
     HELP = HELP
 
+    # Minimum required version (v3.x uses subcommands like 'dir', 'dns', 'vhost')
+    MIN_VERSION = "3.0.0"
+
+    def _check_version(self) -> tuple:
+        """
+        Check gobuster version meets minimum requirements.
+
+        Returns:
+            (meets_requirement: bool, version: str, error_msg: str or None)
+        """
+        try:
+            # Use -v flag (not 'version' subcommand) - works on v3.x
+            result = subprocess.run(
+                ["gobuster", "-v"],
+                capture_output=True,
+                text=True,
+                timeout=10
+            )
+            output = result.stdout + result.stderr
+
+            # Parse version from output like "gobuster version 3.8.2"
+            version_match = re.search(r'version\s+(\d+\.\d+\.\d+)', output, re.IGNORECASE)
+            if version_match:
+                version = version_match.group(1)
+                major = int(version.split('.')[0])
+                if major >= 3:
+                    return (True, version, None)
+                else:
+                    return (False, version, self._upgrade_message(version))
+
+            # Also try --version flag as fallback
+            result2 = subprocess.run(
+                ["gobuster", "--version"],
+                capture_output=True,
+                text=True,
+                timeout=10
+            )
+            output2 = result2.stdout + result2.stderr
+            version_match2 = re.search(r'version\s+(\d+\.\d+\.\d+)', output2, re.IGNORECASE)
+            if version_match2:
+                version = version_match2.group(1)
+                major = int(version.split('.')[0])
+                if major >= 3:
+                    return (True, version, None)
+                else:
+                    return (False, version, self._upgrade_message(version))
+
+            # If neither flag shows version info, check if v2.x by looking for subcommand error
+            # v2.x will show "Usage: gobuster [OPTIONS] ..." without subcommands
+            if "dir" not in output.lower() and "dns" not in output.lower():
+                return (False, "2.x", self._upgrade_message("2.x"))
+
+            # If we see dir/dns subcommands mentioned, assume v3.x
+            return (True, "3.x", None)
+
+        except FileNotFoundError:
+            return (False, None, "ERROR: gobuster not found. Install with: sudo apt install gobuster")
+        except subprocess.TimeoutExpired:
+            return (True, "unknown", None)  # Assume it works
+        except Exception as e:
+            return (True, "unknown", None)  # Assume it works
+
+    def _upgrade_message(self, current_version: str) -> str:
+        """Generate upgrade instructions for old gobuster versions."""
+        return (
+            f"ERROR: gobuster {current_version} is too old. Version 3.0.0+ required.\n\n"
+            f"Gobuster v2.x doesn't support the 'dir/dns/vhost' subcommands used by SoulEyez.\n\n"
+            f"UPGRADE OPTIONS:\n"
+            f"  Option 1 - Install from Go (recommended, gets latest):\n"
+            f"    go install github.com/OJ/gobuster/v3@latest\n\n"
+            f"  Option 2 - Download binary from GitHub:\n"
+            f"    https://github.com/OJ/gobuster/releases\n\n"
+            f"  Option 3 - On Kali Linux:\n"
+            f"    sudo apt update && sudo apt install gobuster\n\n"
+            f"After upgrading, verify with: gobuster version\n"
+        )
+
     def _preflight_check(self, base_url: str, timeout: float = 5.0, log_path: str = None) -> Dict[str, Optional[str]]:
         """
         Probe target with random UUID path to detect false positive responses.
@@ -225,7 +302,15 @@ class GobusterPlugin(PluginBase):
     def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
         """Build gobuster command for background execution with PID tracking."""
         args = args or []
-        
+
+        # Check gobuster version meets requirements (v3.x+ required for subcommands)
+        meets_req, version, error_msg = self._check_version()
+        if not meets_req:
+            if log_path:
+                with open(log_path, 'w') as f:
+                    f.write(error_msg)
+            return None
+
         # Detect the mode from args
         mode = None
         if 'dir' in args:
@@ -323,9 +408,17 @@ class GobusterPlugin(PluginBase):
 
     def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
         """Execute gobuster scan and write output to log_path."""
-        
+
         args = args or []
-        
+
+        # Check gobuster version meets requirements (v3.x+ required for subcommands)
+        meets_req, version, error_msg = self._check_version()
+        if not meets_req:
+            if log_path:
+                with open(log_path, 'w') as f:
+                    f.write(error_msg)
+            return 1
+
         # Detect the mode from args
         mode = None
         if 'dir' in args: