souleyez 2.43.29__py3-none-any.whl → 2.43.34__py3-none-any.whl

souleyez/plugins/dalfox.py

@@ -25,11 +25,11 @@ HELP = {
         "Dalfox works best when given URLs with parameters to test. Chain it after "
         "directory discovery (Gobuster/ffuf) to test discovered endpoints.\n"
     ),
-    "usage": "souleyez jobs enqueue dalfox <url> --args \"url <target>\"",
+    "usage": 'souleyez jobs enqueue dalfox <url> --args "url <target>"',
     "examples": [
         "souleyez jobs enqueue dalfox 'http://example.com/search?q=test' --args \"url 'http://example.com/search?q=test'\"",
-        "souleyez jobs enqueue dalfox http://example.com --args \"url http://example.com/page?id=1 --deep-domxss\"",
-        "souleyez jobs enqueue dalfox http://example.com --args \"url http://example.com/form?name=test --waf-evasion\"",
+        'souleyez jobs enqueue dalfox http://example.com --args "url http://example.com/page?id=1 --deep-domxss"',
+        'souleyez jobs enqueue dalfox http://example.com --args "url http://example.com/form?name=test --waf-evasion"',
     ],
     "flags": [
         ["url <url>", "Target URL with parameters (required)"],
@@ -47,76 +47,128 @@ HELP = {
             {
                 "name": "Quick XSS Scan",
                 "args": ["url", "<target>", "--format", "json", "--skip-bav"],
-                "desc": "Fast XSS scan on target URL"
+                "desc": "Fast XSS scan on target URL",
             },
             {
                 "name": "Parameter Discovery",
                 "args": ["url", "<target>", "--only-discovery", "--format", "json"],
-                "desc": "Find parameters without attacking"
-            }
+                "desc": "Find parameters without attacking",
+            },
         ],
         "comprehensive": [
             {
                 "name": "Deep Scan",
                 "args": ["url", "<target>", "--deep-domxss", "--format", "json"],
-                "desc": "Include DOM XSS analysis"
+                "desc": "Include DOM XSS analysis",
             },
             {
                 "name": "WAF Bypass",
                 "args": ["url", "<target>", "--waf-evasion", "--format", "json"],
-                "desc": "Use WAF evasion techniques"
+                "desc": "Use WAF evasion techniques",
             },
             {
                 "name": "Full Scan",
-                "args": ["url", "<target>", "--deep-domxss", "--waf-evasion", "--format", "json"],
-                "desc": "All techniques enabled"
-            }
+                "args": [
+                    "url",
+                    "<target>",
+                    "--deep-domxss",
+                    "--waf-evasion",
+                    "--format",
+                    "json",
+                ],
+                "desc": "All techniques enabled",
+            },
         ],
         "stealth": [
             {
                 "name": "Slow Scan",
                 "args": ["url", "<target>", "--delay", "1000", "--format", "json"],
-                "desc": "1 second delay between requests"
+                "desc": "1 second delay between requests",
             }
-        ]
+        ],
     },
     "presets": [
-        {"name": "Quick XSS Scan", "args": ["url", "<target>", "--format", "json", "--skip-bav"], "desc": "Fast XSS scan on target URL"},
-        {"name": "Parameter Discovery", "args": ["url", "<target>", "--only-discovery", "--format", "json"], "desc": "Find parameters without attacking"},
-        {"name": "Deep Scan", "args": ["url", "<target>", "--deep-domxss", "--format", "json"], "desc": "Include DOM XSS analysis"},
-        {"name": "WAF Bypass", "args": ["url", "<target>", "--waf-evasion", "--format", "json"], "desc": "Use WAF evasion techniques"},
-        {"name": "Full Scan", "args": ["url", "<target>", "--deep-domxss", "--waf-evasion", "--format", "json"], "desc": "All techniques enabled"},
-        {"name": "Slow Scan", "args": ["url", "<target>", "--delay", "1000", "--format", "json"], "desc": "1 second delay between requests"},
+        {
+            "name": "Quick XSS Scan",
+            "args": ["url", "<target>", "--format", "json", "--skip-bav"],
+            "desc": "Fast XSS scan on target URL",
+        },
+        {
+            "name": "Parameter Discovery",
+            "args": ["url", "<target>", "--only-discovery", "--format", "json"],
+            "desc": "Find parameters without attacking",
+        },
+        {
+            "name": "Deep Scan",
+            "args": ["url", "<target>", "--deep-domxss", "--format", "json"],
+            "desc": "Include DOM XSS analysis",
+        },
+        {
+            "name": "WAF Bypass",
+            "args": ["url", "<target>", "--waf-evasion", "--format", "json"],
+            "desc": "Use WAF evasion techniques",
+        },
+        {
+            "name": "Full Scan",
+            "args": [
+                "url",
+                "<target>",
+                "--deep-domxss",
+                "--waf-evasion",
+                "--format",
+                "json",
+            ],
+            "desc": "All techniques enabled",
+        },
+        {
+            "name": "Slow Scan",
+            "args": ["url", "<target>", "--delay", "1000", "--format", "json"],
+            "desc": "1 second delay between requests",
+        },
     ],
     "help_sections": [
         {
             "title": "What is Dalfox?",
             "color": "cyan",
             "content": [
-                {"title": "Overview", "desc": "Dalfox (XSS Finder) is a fast, powerful parameter analysis and XSS scanner written in Go. It's designed specifically for finding XSS vulnerabilities."},
-                {"title": "Use Cases", "desc": "Perfect for testing web applications", "tips": [
-                    "Test form inputs for XSS",
-                    "Analyze URL parameters",
-                    "Find DOM-based XSS",
-                    "Bypass WAF protections",
-                    "Detect blind XSS opportunities"
-                ]}
-            ]
+                {
+                    "title": "Overview",
+                    "desc": "Dalfox (XSS Finder) is a fast, powerful parameter analysis and XSS scanner written in Go. It's designed specifically for finding XSS vulnerabilities.",
+                },
+                {
+                    "title": "Use Cases",
+                    "desc": "Perfect for testing web applications",
+                    "tips": [
+                        "Test form inputs for XSS",
+                        "Analyze URL parameters",
+                        "Find DOM-based XSS",
+                        "Bypass WAF protections",
+                        "Detect blind XSS opportunities",
+                    ],
+                },
+            ],
         },
         {
             "title": "Best Practices",
             "color": "green",
             "content": [
-                {"title": "Workflow", "desc": "1. Run Gobuster/ffuf to find endpoints\n2. Identify URLs with parameters\n3. Run Dalfox on each parameterized URL\n4. Review findings for exploitability"},
-                {"title": "Tips", "desc": "Maximize XSS detection", "tips": [
-                    "Use --deep-domxss for JavaScript-heavy apps",
-                    "Enable --waf-evasion for protected sites",
-                    "Check --blind for delayed XSS detection",
-                    "Use --delay to avoid rate limiting"
-                ]}
-            ]
-        }
-    ]
+                {
+                    "title": "Workflow",
+                    "desc": "1. Run Gobuster/ffuf to find endpoints\n2. Identify URLs with parameters\n3. Run Dalfox on each parameterized URL\n4. Review findings for exploitability",
+                },
+                {
+                    "title": "Tips",
+                    "desc": "Maximize XSS detection",
+                    "tips": [
+                        "Use --deep-domxss for JavaScript-heavy apps",
+                        "Enable --waf-evasion for protected sites",
+                        "Check --blind for delayed XSS detection",
+                        "Use --delay to avoid rate limiting",
+                    ],
+                },
+            ],
+        },
+    ],
 }
 
 
@@ -128,11 +180,13 @@ class DalfoxPlugin(PluginBase):
 
     def _ensure_url_scheme(self, target: str) -> str:
         """Ensure target has http:// or https:// scheme."""
-        if not target.startswith(('http://', 'https://')):
-            return f'http://{target}'
+        if not target.startswith(("http://", "https://")):
+            return f"http://{target}"
         return target
 
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build dalfox command for background execution."""
         args = args or []
 
@@ -140,24 +194,23 @@ class DalfoxPlugin(PluginBase):
         target = self._ensure_url_scheme(target)
 
         # If no mode specified, add 'url' mode with target
-        if 'url' not in args and 'file' not in args and 'pipe' not in args:
-            args = ['url', target] + args
+        if "url" not in args and "file" not in args and "pipe" not in args:
+            args = ["url", target] + args
 
         # Replace <target> placeholder (also ensure scheme in placeholder)
         processed_args = [arg.replace("<target>", target) for arg in args]
 
         # Add JSON output format if not specified
-        if '--format' not in processed_args and '-format' not in processed_args:
-            processed_args.extend(['--format', 'json'])
+        if "--format" not in processed_args and "-format" not in processed_args:
+            processed_args.extend(["--format", "json"])
 
         cmd = ["dalfox"] + processed_args
 
-        return {
-            'cmd': cmd,
-            'timeout': 1800  # 30 minutes
-        }
+        return {"cmd": cmd, "timeout": 1800}  # 30 minutes
 
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute dalfox scan and write output to log_path."""
         args = args or []
 
@@ -165,21 +218,23 @@ class DalfoxPlugin(PluginBase):
         target = self._ensure_url_scheme(target)
 
         # If no mode specified, add 'url' mode with target
-        if 'url' not in args and 'file' not in args and 'pipe' not in args:
-            args = ['url', target] + args
+        if "url" not in args and "file" not in args and "pipe" not in args:
+            args = ["url", target] + args
 
         # Replace <target> placeholder (also ensure scheme in placeholder)
         processed_args = [arg.replace("<target>", target) for arg in args]
 
         # Add JSON output format if not specified
-        if '--format' not in processed_args and '-format' not in processed_args:
-            processed_args.extend(['--format', 'json'])
+        if "--format" not in processed_args and "-format" not in processed_args:
+            processed_args.extend(["--format", "json"])
 
         cmd = ["dalfox"] + processed_args
 
         if not log_path:
             try:
-                proc = subprocess.run(cmd, capture_output=True, timeout=1800, check=False)
+                proc = subprocess.run(
+                    cmd, capture_output=True, timeout=1800, check=False
+                )
                 return proc.returncode
             except Exception:
                 return 1
@@ -191,7 +246,9 @@ class DalfoxPlugin(PluginBase):
                 fh.write(f"Args: {processed_args}\n")
                 if label:
                     fh.write(f"Label: {label}\n")
-                fh.write(f"Started: {time.strftime('%Y-%m-%d %H:%M:%S UTC', time.gmtime())}\n")
+                fh.write(
+                    f"Started: {time.strftime('%Y-%m-%d %H:%M:%S UTC', time.gmtime())}\n"
+                )
                 fh.write(f"Command: {' '.join(cmd)}\n")
                 fh.write("=" * 60 + "\n\n")
                 fh.flush()
@@ -202,11 +259,13 @@ class DalfoxPlugin(PluginBase):
                     stderr=subprocess.STDOUT,
                     timeout=1800,
                     check=False,
-                    text=True
+                    text=True,
                 )
 
                 fh.write(proc.stdout)
-                fh.write(f"\n=== Completed: {time.strftime('%Y-%m-%d %H:%M:%S UTC', time.gmtime())} ===\n")
+                fh.write(
+                    f"\n=== Completed: {time.strftime('%Y-%m-%d %H:%M:%S UTC', time.gmtime())} ===\n"
+                )
                 fh.write(f"Exit Code: {proc.returncode}\n")
 
                 return proc.returncode
@@ -219,7 +278,9 @@ class DalfoxPlugin(PluginBase):
         except FileNotFoundError:
             with open(log_path, "a", encoding="utf-8", errors="replace") as fh:
                 fh.write("\nERROR: dalfox not found in PATH\n")
-                fh.write("Install with: go install github.com/hahwul/dalfox/v2@latest\n")
+                fh.write(
+                    "Install with: go install github.com/hahwul/dalfox/v2@latest\n"
+                )
             return 127
 
         except Exception as e:

souleyez/plugins/dns_hijack.py

@@ -31,14 +31,97 @@ HELP = {
     "usage": "souleyez jobs enqueue dns_hijack <router_ip>",
     "examples": [
         "souleyez jobs enqueue dns_hijack 192.168.1.1",
-        "souleyez jobs enqueue dns_hijack 192.168.1.1 --args \"--domains google.com,microsoft.com\"",
+        'souleyez jobs enqueue dns_hijack 192.168.1.1 --args "--domains google.com,microsoft.com"',
     ],
     "flags": [
         ["--domains DOMAINS", "Comma-separated test domains"],
     ],
     "presets": [
         {"name": "Quick Check", "args": [], "desc": "Test with common domains"},
-        {"name": "Extended", "args": ["--domains", "google.com,microsoft.com,apple.com,facebook.com,amazon.com"], "desc": "Test multiple major sites"},
+        {
+            "name": "Extended",
+            "args": [
+                "--domains",
+                "google.com,microsoft.com,apple.com,facebook.com,amazon.com",
+            ],
+            "desc": "Test multiple major sites",
+        },
+    ],
+    "help_sections": [
+        {
+            "title": "What is DNS Hijacking?",
+            "color": "cyan",
+            "content": [
+                (
+                    "Overview",
+                    [
+                        "DNS hijacking redirects DNS queries to attacker-controlled servers",
+                        "Compromised routers may modify DNS to redirect traffic",
+                        "This tool compares router DNS responses to known-good DNS (8.8.8.8)",
+                    ],
+                ),
+                (
+                    "Common Attack Goals",
+                    [
+                        "Redirect users to phishing sites (fake banking, email)",
+                        "Inject ads into web pages for profit",
+                        "Monitor browsing activity and steal credentials",
+                        "Block security updates to maintain access",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Usage & Examples",
+            "color": "green",
+            "content": [
+                (
+                    "Basic Usage",
+                    [
+                        "souleyez jobs enqueue dns_hijack 192.168.1.1",
+                        "  → Tests router DNS against Google DNS (8.8.8.8)",
+                    ],
+                ),
+                (
+                    "Custom Domains",
+                    [
+                        'souleyez jobs enqueue dns_hijack 192.168.1.1 --args "--domains google.com,bank.com"',
+                        "  → Tests specific domains you're concerned about",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Understanding Results",
+            "color": "yellow",
+            "content": [
+                (
+                    "Result Indicators",
+                    [
+                        "[OK] - DNS responses match the reference server",
+                        "[WARN] - Partial match, some IPs differ (investigate)",
+                        "[ALERT] - No matching IPs, likely hijacked!",
+                    ],
+                ),
+                (
+                    "NXDOMAIN Test",
+                    [
+                        "Tests if router returns IPs for fake domains",
+                        "If yes: Router hijacks typos to show ads/search pages",
+                        "Common ISP 'feature' but can mask real hijacking",
+                    ],
+                ),
+                (
+                    "Next Steps if Hijacked",
+                    [
+                        "Change router DNS to 8.8.8.8 or 1.1.1.1 manually",
+                        "Check router for firmware compromise",
+                        "Look for unauthorized admin accounts",
+                        "Consider factory reset if malware suspected",
+                    ],
+                ),
+            ],
+        },
     ],
 }
 
@@ -49,7 +132,9 @@ class DNSHijackPlugin(PluginBase):
     category = "vulnerability_analysis"
     HELP = HELP
 
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build dig commands for DNS hijack detection."""
         args = args or []
 
@@ -57,39 +142,37 @@ class DNSHijackPlugin(PluginBase):
             target = validate_target(target)
         except ValidationError as e:
             if log_path:
-                with open(log_path, 'w') as f:
+                with open(log_path, "w") as f:
                     f.write(f"ERROR: Invalid target: {e}\n")
             return None
 
         # Parse domains to test
-        domains = ['google.com', 'microsoft.com', 'example.com']
+        domains = ["google.com", "microsoft.com", "example.com"]
         i = 0
         while i < len(args):
-            if args[i] == '--domains' and i + 1 < len(args):
-                domains = [d.strip() for d in args[i + 1].split(',')]
+            if args[i] == "--domains" and i + 1 < len(args):
+                domains = [d.strip() for d in args[i + 1].split(",")]
                 i += 2
             else:
                 i += 1
 
         # We'll build a shell script that compares responses
         # This is stored and executed
-        return {
-            'domains': domains,
-            'target': target,
-            'timeout': 120
-        }
+        return {"domains": domains, "target": target, "timeout": 120}
 
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute DNS hijack detection."""
         cmd_spec = self.build_command(target, args, label, log_path)
         if cmd_spec is None:
             return 1
 
-        domains = cmd_spec['domains']
-        reference_dns = '8.8.8.8'  # Google DNS as reference
+        domains = cmd_spec["domains"]
+        reference_dns = "8.8.8.8"  # Google DNS as reference
 
         if log_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write(f"# DNS Hijack Detection on {target}\n")
                 f.write(f"# Reference DNS: {reference_dns}\n")
                 f.write(f"# Test domains: {', '.join(domains)}\n")
@@ -99,7 +182,7 @@ class DNSHijackPlugin(PluginBase):
 
         try:
             for domain in domains:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n{'='*60}\n")
                     f.write(f"Testing: {domain}\n")
                     f.write(f"{'='*60}\n\n")
@@ -107,32 +190,40 @@ class DNSHijackPlugin(PluginBase):
                 # Query target router
                 try:
                     router_result = subprocess.run(
-                        ['dig', '+short', f'@{target}', domain, 'A'],
+                        ["dig", "+short", f"@{target}", domain, "A"],
                         capture_output=True,
                         text=True,
-                        timeout=10
+                        timeout=10,
+                    )
+                    router_ips = (
+                        set(router_result.stdout.strip().split("\n"))
+                        if router_result.stdout.strip()
+                        else set()
                     )
-                    router_ips = set(router_result.stdout.strip().split('\n')) if router_result.stdout.strip() else set()
                 except subprocess.TimeoutExpired:
                     router_ips = set()
-                    with open(log_path, 'a') as f:
+                    with open(log_path, "a") as f:
                         f.write(f"  Router DNS (@{target}): TIMEOUT\n")
 
                 # Query reference DNS
                 try:
                     ref_result = subprocess.run(
-                        ['dig', '+short', f'@{reference_dns}', domain, 'A'],
+                        ["dig", "+short", f"@{reference_dns}", domain, "A"],
                         capture_output=True,
                         text=True,
-                        timeout=10
+                        timeout=10,
+                    )
+                    ref_ips = (
+                        set(ref_result.stdout.strip().split("\n"))
+                        if ref_result.stdout.strip()
+                        else set()
                     )
-                    ref_ips = set(ref_result.stdout.strip().split('\n')) if ref_result.stdout.strip() else set()
                 except subprocess.TimeoutExpired:
                     ref_ips = set()
-                    with open(log_path, 'a') as f:
+                    with open(log_path, "a") as f:
                         f.write(f"  Reference DNS (@{reference_dns}): TIMEOUT\n")
 
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"  Router DNS (@{target}):\n")
                     for ip in sorted(router_ips):
                         f.write(f"    {ip}\n")
@@ -149,50 +240,64 @@ class DNSHijackPlugin(PluginBase):
                             f.write(f"    Router only: {router_ips - ref_ips}\n")
                             f.write(f"    Reference only: {ref_ips - router_ips}\n")
                         else:
-                            f.write(f"\n  [ALERT] No matching IPs - possible DNS hijack!\n")
+                            f.write(
+                                f"\n  [ALERT] No matching IPs - possible DNS hijack!\n"
+                            )
                             hijack_detected = True
                     elif router_ips and not ref_ips:
-                        f.write(f"\n  [WARN] Router returned IPs but reference didn't\n")
+                        f.write(
+                            f"\n  [WARN] Router returned IPs but reference didn't\n"
+                        )
                     elif ref_ips and not router_ips:
-                        f.write(f"\n  [WARN] Reference returned IPs but router didn't\n")
+                        f.write(
+                            f"\n  [WARN] Reference returned IPs but router didn't\n"
+                        )
 
             # Test NXDOMAIN hijacking
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 f.write(f"\n{'='*60}\n")
                 f.write("Testing NXDOMAIN hijacking (nonexistent domain):\n")
                 f.write(f"{'='*60}\n\n")
 
-            fake_domain = 'thisisafakedomainthatdoesnotexist12345.com'
+            fake_domain = "thisisafakedomainthatdoesnotexist12345.com"
 
             try:
                 nxdomain_result = subprocess.run(
-                    ['dig', '+short', f'@{target}', fake_domain, 'A'],
+                    ["dig", "+short", f"@{target}", fake_domain, "A"],
                     capture_output=True,
                     text=True,
-                    timeout=10
+                    timeout=10,
                 )
                 nxdomain_ips = nxdomain_result.stdout.strip()
 
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     if nxdomain_ips:
-                        f.write(f"  [ALERT] Router returns IPs for nonexistent domain!\n")
-                        f.write(f"  This indicates NXDOMAIN hijacking (likely ads/search redirect)\n")
+                        f.write(
+                            f"  [ALERT] Router returns IPs for nonexistent domain!\n"
+                        )
+                        f.write(
+                            f"  This indicates NXDOMAIN hijacking (likely ads/search redirect)\n"
+                        )
                         f.write(f"  Returned IPs: {nxdomain_ips}\n")
                         hijack_detected = True
                     else:
-                        f.write(f"  [OK] Router correctly returns no IPs for nonexistent domain\n")
+                        f.write(
+                            f"  [OK] Router correctly returns no IPs for nonexistent domain\n"
+                        )
             except subprocess.TimeoutExpired:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"  [WARN] NXDOMAIN test timed out\n")
 
             # Summary
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 f.write(f"\n{'='*60}\n")
                 f.write("SUMMARY\n")
                 f.write(f"{'='*60}\n\n")
                 if hijack_detected:
                     f.write("  [!] POTENTIAL DNS HIJACKING DETECTED\n")
-                    f.write("  Investigate the router for malware or misconfiguration.\n")
+                    f.write(
+                        "  Investigate the router for malware or misconfiguration.\n"
+                    )
                 else:
                     f.write("  [OK] No obvious DNS hijacking detected\n")
 
@@ -200,7 +305,7 @@ class DNSHijackPlugin(PluginBase):
 
         except Exception as e:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n\n# ERROR: {e}\n")
             return 1