souleyez 2.43.34__py3-none-any.whl → 3.0.0__py3-none-any.whl

souleyez/__init__.py

@@ -1 +1 @@
-__version__ = "2.43.34"
+__version__ = "3.0.0"

souleyez/core/tool_chaining.py

@@ -113,6 +113,96 @@ SERVICE_GROUPS = {
 }
 
 
+def should_test_url_for_sqli(endpoint_url: str) -> bool:
+    """
+    Determine if a URL should be tested for SQL injection.
+
+    This filters out URLs that are unlikely to have injectable parameters,
+    while allowing URLs that might have forms or query parameters.
+
+    Args:
+        endpoint_url: The URL to evaluate
+
+    Returns:
+        True if the URL should be tested, False if it should be skipped
+
+    Examples:
+        >>> should_test_url_for_sqli("http://example.com/payroll_app.php")
+        True  # Dynamic page, might have forms
+        >>> should_test_url_for_sqli("http://example.com/index.php")
+        False  # Common default page, rarely injectable
+        >>> should_test_url_for_sqli("http://example.com/search.php?q=test")
+        True  # Has query parameters
+        >>> should_test_url_for_sqli("http://example.com/phpinfo.php")
+        False  # phpinfo output, not injectable
+        >>> should_test_url_for_sqli("http://example.com/cgi-bin/")
+        False  # Directory, not a script
+        >>> should_test_url_for_sqli("http://example.com/")
+        False  # No path, no params
+    """
+    from urllib.parse import urlparse
+
+    path_lower = endpoint_url.lower()
+    has_params = "?" in endpoint_url
+
+    # URLs with query params should generally be tested - they have injection points
+    # But still skip known non-injectable apps even with params
+    if has_params:
+        # Even with params, skip known non-injectable applications
+        hard_skip = [
+            "/phpmyadmin/",   # phpMyAdmin - DB admin tool, not a target
+            "/phpmyadmin?",   # phpMyAdmin with params
+        ]
+        if any(pattern in path_lower for pattern in hard_skip):
+            return False
+        # Skip static files with version/cache-busting params
+        # These are not injectable: /jquery.js?v=1.2.3, /style.css?ver=5.0
+        if ".js?" in path_lower or ".css?" in path_lower:
+            return False
+        # Has params and not in hard skip - test it
+        return True
+
+    # No query params - apply stricter filtering
+    # Skip known non-injectable paths (only when no params)
+    skip_patterns = [
+        "/twiki/",        # TWiki wiki - not SQLi vulnerable
+        "/phpmyadmin/",   # phpMyAdmin - DB admin, not SQLi target
+        "/phpmyadmin.",   # phpMyAdmin CSS/JS files
+        "/phpinfo",       # phpinfo() output - no injection
+        "/cgi-bin/",      # Base CGI dir without script - no injection
+        "/misc/",         # Drupal/CMS static assets directory
+        "/modules/",      # Drupal modules directory (static files)
+    ]
+    if any(pattern in path_lower for pattern in skip_patterns):
+        return False
+
+    # No params - require dynamic extension that might have forms
+    dynamic_extensions = (".php", ".asp", ".aspx", ".jsp", ".do", ".action", ".cgi")
+    is_dynamic = any(path_lower.endswith(ext) for ext in dynamic_extensions)
+
+    if not is_dynamic:
+        # No params and not a dynamic page - skip
+        return False
+
+    # Skip common default/utility pages that rarely have injectable forms
+    useless_dynamic_pages = [
+        "/index.php", "/index.asp", "/index.aspx", "/index.jsp",
+        "/default.php", "/default.asp", "/default.aspx",
+        "/home.php", "/home.asp",
+        "/info.php", "/test.php",
+    ]
+    if not has_params:
+        # Only check this list for pages without params
+        try:
+            parsed = urlparse(endpoint_url)
+            if parsed.path.lower() in useless_dynamic_pages:
+                return False
+        except Exception:
+            pass
+
+    return True
+
+
 def classify_os_device(os_string: str, services: list) -> dict:
     """
     Classify OS and device type from nmap output.
@@ -1502,23 +1592,15 @@ class ToolChaining:
                     ],
                     description="WordPress detected, scanning for vulnerabilities with WPScan",
                 ),
-                # phpMyAdmin → SQLMap (common SQLi target)
-                ChainRule(
-                    trigger_tool="gobuster",
-                    trigger_condition="finding:phpmyadmin",
-                    target_tool="sqlmap",
-                    priority=8,
-                    args_template=[
-                        "-u",
-                        "{target}",
-                        "--batch",
-                        "--forms",
-                        "--level=2",
-                        "--risk=2",
-                        "--threads=5",
-                    ],
-                    description="phpMyAdmin found, testing for SQL injection",
-                ),
+                # phpMyAdmin → SQLMap - DISABLED
+                # phpMyAdmin is a database management tool with proper authentication.
+                # It doesn't have SQLi in its login form. Use nuclei/searchsploit instead.
+                # ChainRule(
+                #     trigger_tool="gobuster",
+                #     trigger_condition="finding:phpmyadmin",
+                #     target_tool="sqlmap",
+                #     ...
+                # ),
                 # === END WordPress-specific chains ===
                 # Dalfox - Deep XSS scan if nuclei hints at XSS
                 ChainRule(
@@ -1677,9 +1759,11 @@ class ToolChaining:
                     description="Domain member detected, scanning subnet for Domain Controller",
                 ),
                 # Kerbrute chains - enumerate users via Kerberos when domain discovered
+                # IMPORTANT: Require port 88 (Kerberos) to be open - not just "has:domains"
+                # Samba workgroups report as "domains" but are NOT Active Directory
                 ChainRule(
                     trigger_tool="enum4linux",
-                    trigger_condition="has:domains",
+                    trigger_condition="has:domains & port:88",
                     target_tool="kerbrute",
                     priority=6,
                     args_template=[
@@ -1690,11 +1774,11 @@ class ToolChaining:
                         "{dc_ip}",
                         "data/wordlists/ad_users.txt",
                     ],
-                    description="Domain discovered via SMB - enumerating users via Kerberos",
+                    description="Active Directory detected (Kerberos port 88 open) - enumerating users",
                 ),
                 ChainRule(
                     trigger_tool="crackmapexec",
-                    trigger_condition="has:domains",
+                    trigger_condition="has:domains & port:88",
                     target_tool="kerbrute",
                     priority=6,
                     args_template=[
@@ -1705,7 +1789,7 @@ class ToolChaining:
                         "{dc_ip}",
                         "data/wordlists/ad_users.txt",
                     ],
-                    description="Domain discovered via SMB - enumerating users via Kerberos",
+                    description="Active Directory detected (Kerberos port 88 open) - enumerating users",
                 ),
             ]
         )
@@ -1981,9 +2065,10 @@ class ToolChaining:
                     description="Domain discovered - enumerating all objects to find hidden users",
                 ),
                 # Kerbrute user enumeration (works even when anonymous LDAP is blocked)
+                # IMPORTANT: Require port 88 (Kerberos) - LDAP alone doesn't mean AD
                 ChainRule(
                     trigger_tool="ldapsearch",
-                    trigger_condition="has:domains",
+                    trigger_condition="has:domains & port:88",
                     target_tool="kerbrute",
                     priority=6,
                     args_template=[
@@ -1994,7 +2079,7 @@ class ToolChaining:
                         "{dc_ip}",
                         "data/wordlists/ad_users.txt",
                     ],
-                    description="Domain discovered via LDAP - enumerating users via Kerberos",
+                    description="Active Directory detected (Kerberos port 88 open) - enumerating users",
                 ),
             ]
         )
@@ -2175,49 +2260,28 @@ class ToolChaining:
             )
         )
 
-        # Gobuster discovered PHP files → crawl base URL once to find parametrized URLs
-        # NOTE: Special handling in auto_chain() limits to ONE crawl per base URL
-        self.rules.append(
-            ChainRule(
-                trigger_tool="gobuster",
-                trigger_condition="has:php_files",
-                target_tool="sqlmap",
-                priority=7,
-                args_template=[
-                    "-u",
-                    "{target}",
-                    "--batch",
-                    "--crawl=2",
-                    "--risk=2",
-                    "--level=3",
-                    "--forms",
-                    "--threads=5",
-                ],
-                description="PHP files discovered, crawling site to find parametrized pages and forms",
-            )
-        )
+        # Gobuster discovered PHP files → crawl base URL - DISABLED
+        # Reason: katana→sqlmap handles this better by targeting specific parametrized URLs.
+        # Crawling the base URL with SQLMap is slow and often wasteful.
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="gobuster",
+        #         trigger_condition="has:php_files",
+        #         target_tool="sqlmap",
+        #         ...
+        #     )
+        # )
 
-        # Gobuster discovered ASP/ASPX files → crawl base URL once to find parametrized URLs
-        # Same logic as PHP files - ASP is common in Windows/IIS environments
-        self.rules.append(
-            ChainRule(
-                trigger_tool="gobuster",
-                trigger_condition="has:asp_files",
-                target_tool="sqlmap",
-                priority=7,
-                args_template=[
-                    "-u",
-                    "{target}",
-                    "--batch",
-                    "--crawl=2",
-                    "--risk=2",
-                    "--level=3",
-                    "--forms",
-                    "--threads=5",
-                ],
-                description="ASP/ASPX files discovered, crawling site to find parametrized pages and forms",
-            )
-        )
+        # Gobuster discovered ASP/ASPX files → crawl base URL - DISABLED
+        # Reason: katana→sqlmap handles this better by targeting specific parametrized URLs.
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="gobuster",
+        #         trigger_condition="has:asp_files",
+        #         target_tool="sqlmap",
+        #         ...
+        #     )
+        # )
 
         # SMART API DISCOVERY CHAIN
         # Replaced broken direct SQLMap rules with intelligent two-step approach
@@ -2885,37 +2949,44 @@ class ToolChaining:
         )
 
         # ffuf found parameters → test with SQLMap (skip for LFI scans)
-        self.rules.append(
-            ChainRule(
-                trigger_tool="ffuf",
-                trigger_condition="has:parameters_found & !is:lfi_scan",
-                target_tool="sqlmap",
-                priority=9,
-                args_template=["-u", "{target}", "--batch", "--level=2", "--risk=2"],
-                description="Parameters discovered, testing for SQL injection",
-            )
-        )
+        # DISABLED: This rule passes {target} (original ffuf target) to sqlmap,
+        # which is useless - we need actual discovered endpoints with parameters.
+        # The smart chain (rule #-1) in auto_chain() handles ffuf → sqlmap properly
+        # by parsing ffuf output and testing discovered endpoints.
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="ffuf",
+        #         trigger_condition="has:parameters_found & !is:lfi_scan",
+        #         target_tool="sqlmap",
+        #         priority=9,
+        #         args_template=["-u", "{target}", "--batch", "--level=2", "--risk=2"],
+        #         description="Parameters discovered, testing for SQL injection",
+        #     )
+        # )
 
         # ffuf found parameters → test with Nuclei XSS (skip for LFI scans)
-        self.rules.append(
-            ChainRule(
-                trigger_tool="ffuf",
-                trigger_condition="has:parameters_found & !is:lfi_scan",
-                target_tool="nuclei",
-                priority=8,
-                args_template=[
-                    "-tags",
-                    "xss,rxss",
-                    "-severity",
-                    "critical,high,medium",
-                    "-rate-limit",
-                    "50",
-                    "-c",
-                    "10",
-                ],
-                description="Parameters discovered, testing for XSS",
-            )
-        )
+        # DISABLED: Same issue as above - uses {target} instead of discovered parameters.
+        # Running XSS scans on bare directories like /cgi-bin/ is useless.
+        # Smart chains in auto_chain() handle ffuf → nuclei properly.
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="ffuf",
+        #         trigger_condition="has:parameters_found & !is:lfi_scan",
+        #         target_tool="nuclei",
+        #         priority=8,
+        #         args_template=[
+        #             "-tags",
+        #             "xss,rxss",
+        #             "-severity",
+        #             "critical,high,medium",
+        #             "-rate-limit",
+        #             "50",
+        #             "-c",
+        #             "10",
+        #         ],
+        #         description="Parameters discovered, testing for XSS",
+        #     )
+        # )
 
         # Gobuster found API endpoints → parameter fuzzing with ffuf
         self.rules.extend(
@@ -3135,27 +3206,17 @@ class ToolChaining:
             )
         )
 
-        # Custom PHP → SQLMap standard crawl
-        self.rules.append(
-            ChainRule(
-                trigger_tool="gobuster",
-                trigger_condition="category:custom_php",
-                target_tool="sqlmap",
-                priority=7,
-                args_template=[
-                    "-u",
-                    "{target}",
-                    "--batch",
-                    "--crawl=2",
-                    "--forms",
-                    "--level=2",
-                    "--risk=2",
-                    "--smart",
-                    "--threads=5",
-                ],
-                description="Custom PHP app detected, scan forms for SQL injection",
-            )
-        )
+        # Custom PHP → SQLMap standard crawl - DISABLED
+        # Reason: katana→sqlmap handles this better by targeting specific parametrized URLs.
+        # The "custom_php" category is too broad (default for unrecognized paths).
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="gobuster",
+        #         trigger_condition="category:custom_php",
+        #         target_tool="sqlmap",
+        #         ...
+        #     )
+        # )
 
         # === END Directory Category Chain Rules ===
 
@@ -8544,6 +8605,11 @@ class ToolChaining:
 
                         # === SQLMap for testable endpoints ===
                         # Skip SQLMap if this was an LFI fuzz scan - results are LFI payloads, not SQLi targets
+
+                        # Use helper function to filter non-injectable URLs
+                        if not should_test_url_for_sqli(endpoint_url):
+                            continue
+
                         if (
                             not is_lfi_scan
                             and status_code in testable_statuses
@@ -9190,6 +9256,43 @@ class ToolChaining:
                         ):
                             continue
 
+                        # Skip external URLs - only test URLs on the original target host
+                        try:
+                            from urllib.parse import urlparse
+                            parsed_url = urlparse(url)
+                            parsed_target = urlparse(target)
+                            if parsed_url.netloc and parsed_target.netloc:
+                                if parsed_url.netloc.lower() != parsed_target.netloc.lower():
+                                    logger.debug(f"  Skipping external URL: {url}")
+                                    continue
+                        except Exception:
+                            pass
+
+                        # Skip non-injectable paths (TWiki, phpMyAdmin, Apache dir params)
+                        skip_patterns = [
+                            "/twiki/",        # TWiki wiki - not SQLi vulnerable
+                            "/phpmyadmin/",   # phpMyAdmin - DB admin, not SQLi
+                            "/phpmyadmin.",   # phpMyAdmin CSS/JS files
+                            "?c=d", "?c=s", "?c=m", "?c=n",  # Apache dir listing sort params
+                            "?o=a", "?o=d",   # Apache dir listing order params
+                            ";o=a", ";o=d",   # Apache dir listing (semicolon variant)
+                            "/misc/",         # Drupal/CMS static assets directory
+                            "/modules/",      # Drupal modules directory (static files)
+                        ]
+                        # Also skip static files with version/cache-busting params
+                        # These are not injectable: /jquery.js?v=1.2.3, /style.css?ver=5.0
+                        if ".js?" in path_lower or ".css?" in path_lower:
+                            logger.debug(f"  Skipping static file with cache param: {url}")
+                            continue
+                        if any(pattern in path_lower for pattern in skip_patterns):
+                            logger.debug(f"  Skipping non-injectable path: {url}")
+                            continue
+
+                        # Skip URLs without real parameters (just base URL or path)
+                        if "?" not in url and url not in forms_found:
+                            logger.debug(f"  Skipping URL without parameters: {url}")
+                            continue
+
                         # Determine if this is a form (POST) or URL param (GET)
                         is_form = url in forms_found
 
@@ -10571,74 +10674,7 @@ class ToolChaining:
                     except Exception as e:
                         logger.debug(f"Evil-WinRM chain check failed: {e}")
 
-                # === Hydra credentials found → SSH shell access (Linux) ===
-                if credentials:
-                    from souleyez.engine.background import enqueue_job
-                    from souleyez.storage.hosts import HostManager
-                    from souleyez.log_config import get_logger
-
-                    logger = get_logger(__name__)
-
-                    try:
-                        host_manager = HostManager()
-                        target_host = target.split(":")[0] if ":" in target else target
-
-                        host = host_manager.get_host_by_ip(engagement_id, target_host)
-                        if host:
-                            services = host_manager.get_host_services(host["id"])
-                            ssh_svc = next(
-                                (s for s in services if s.get("port") == 22), None
-                            )
-
-                            if ssh_svc:
-                                # SSH is available - create SSH command execution job
-                                for cred in credentials:  # Process all credentials
-                                    username = cred.get("username")
-                                    password = cred.get("password")
-
-                                    if username and password:
-                                        # Check if SSH chain already ran for this user
-                                        from souleyez.storage.database import Database
-
-                                        try:
-                                            db = Database()
-                                            existing = db.execute(
-                                                """SELECT id FROM jobs WHERE engagement_id = ?
-                                                   AND tool = 'nxc' AND args LIKE '%ssh%'
-                                                   AND args LIKE ? AND status != 'killed' LIMIT 1""",
-                                                (engagement_id, f'%-u", "{username}%'),
-                                            )
-                                            if existing:
-                                                continue
-                                        except Exception:
-                                            pass
-
-                                        # Use nxc (netexec) to test SSH shell access
-                                        ssh_job_id = enqueue_job(
-                                            tool="nxc",
-                                            target=target_host,
-                                            args=[
-                                                "ssh",
-                                                target_host,
-                                                "-u",
-                                                username,
-                                                "-p",
-                                                password,
-                                                "-x",
-                                                "whoami && id && hostname",
-                                            ],
-                                            label="hydra",
-                                            engagement_id=engagement_id,
-                                            parent_id=job.get("id"),
-                                            reason=f"Auto-triggered by hydra: Testing SSH shell access with {username}",
-                                            rule_id=-28,  # Smart chain: hydra → nxc ssh (shell)
-                                        )
-                                        job_ids.append(ssh_job_id)
-                                        logger.info(
-                                            f"  nxc SSH job #{ssh_job_id} for {username}"
-                                        )
-                    except Exception as e:
-                        logger.debug(f"SSH shell chain check failed: {e}")
+                # NOTE: SSH shell chain removed - spawn shell directly from Hydra job via [s] option
 
                 return job_ids
 

souleyez/docs/README.md

@@ -1,7 +1,7 @@
 # SoulEyez Documentation
 
-**Version:** 2.43.34
-**Last Updated:** January 26, 2026
+**Version:** 3.0.0
+**Last Updated:** January 29, 2026
 **Organization:** CyberSoul Security
 
 Welcome to the SoulEyez documentation! This documentation covers architecture, development, user guides, and operational information for the SoulEyez penetration testing platform.

souleyez/handlers/hydra_handler.py

@@ -261,6 +261,7 @@ class HydraHandler(BaseToolHandler):
                 "port": parsed.get("port"),
                 "credentials_found": len(parsed.get("credentials", [])),
                 "credentials_added": creds_added,
+                "credentials": parsed.get("credentials", []),  # Include actual creds for smart chains
                 "usernames_found": len(parsed.get("usernames", [])),
                 "usernames": parsed.get("usernames", []),
                 "usernames_added": usernames_added,

souleyez/handlers/msf_auxiliary_handler.py

@@ -165,6 +165,7 @@ class MsfAuxiliaryHandler(BaseToolHandler):
                 credential_summaries.append(
                     {
                         "username": cred.get("username", ""),
+                        "password": cred.get("password", ""),
                         "service": cred.get("service", "unknown"),
                         "port": cred.get("port"),
                     }

souleyez/handlers/nxc_handler.py

@@ -77,10 +77,51 @@ class NxcHandler(BaseToolHandler):
                 hostname = banner_match.group(1)
                 domain = banner_match.group(2)
 
-            # Check for Pwn3d
+            # Check for Pwn3d (SMB admin access)
             if re.search(self.PWNED_PATTERN, log_content):
                 is_pwned = True
 
+            # Check for SSH Shell access (Linux)
+            # Format: [+] leia_organa:help_me_obiwan  Linux - Shell access!
+            has_shell_access = False
+            if "Shell access!" in log_content:
+                has_shell_access = True
+                # Parse SSH credentials
+                ssh_cred_pattern = r"\[\+\]\s+([^:\s]+):(\S+)\s+.*Shell access!"
+                for match in re.finditer(ssh_cred_pattern, log_content):
+                    username = match.group(1)
+                    password = match.group(2)
+                    cred = {
+                        "username": username,
+                        "password": password,
+                        "domain": "",
+                        "service": "ssh",
+                        "status": "valid",
+                    }
+                    credentials.append(cred)
+
+                    # Store in database
+                    if credentials_manager and host_manager:
+                        try:
+                            host = host_manager.get_host_by_ip(engagement_id, target)
+                            if host:
+                                credentials_manager.add_credential(
+                                    engagement_id=engagement_id,
+                                    host_id=host["id"],
+                                    username=username,
+                                    password=password,
+                                    service="ssh",
+                                    port=22,
+                                    credential_type="password",
+                                    tool="nxc",
+                                    status="valid",
+                                )
+                                logger.warning(
+                                    f"SSH SHELL ACCESS: {username}:{password} on {target}"
+                                )
+                        except Exception as e:
+                            logger.debug(f"Could not store SSH credential: {e}")
+
             # Parse valid credentials
             # Format: [+] baby2.vl\Carl.Moore:Carl.Moore
             for match in re.finditer(self.VALID_CRED_PATTERN, log_content):
@@ -231,6 +272,8 @@ class NxcHandler(BaseToolHandler):
 
             if credentials:
                 status = STATUS_DONE
+            elif has_shell_access:
+                status = STATUS_DONE  # SSH shell access without parsed creds
             elif expired_credentials:
                 status = STATUS_WARNING  # Expired creds need attention
             elif shares:
@@ -255,6 +298,8 @@ class NxcHandler(BaseToolHandler):
                 )
             if is_pwned:
                 summary_parts.append("PWNED!")
+            if has_shell_access:
+                summary_parts.append("SHELL ACCESS!")
             if shares:
                 summary_parts.append(
                     f"{len(shares)} shares ({len(readable_shares)} readable, {len(writable_shares)} writable)"
@@ -273,6 +318,7 @@ class NxcHandler(BaseToolHandler):
                 "credentials": credentials,
                 "expired_credentials": expired_credentials,
                 "is_pwned": is_pwned,
+                "has_shell_access": has_shell_access,
                 "summary": summary,
             }
 

souleyez/main.py

@@ -185,7 +185,7 @@ def _check_privileged_tools():
 
 
 @click.group()
-@click.version_option(version="2.43.34")
+@click.version_option(version="3.0.0")
 def cli():
     """SoulEyez - AI-Powered Pentesting Platform by CyberSoul Security"""
     from souleyez.log_config import init_logging