stackscan 2.1.0__py3-none-any.whl

stackscan/analyzers/services.py

@@ -0,0 +1,285 @@
+from __future__ import annotations
+
+from stackscan.types import ScanReport, ServiceFinding, Technology
+
+_DB_PORTS: dict[int, str] = {
+    3306: "MySQL",
+    5432: "PostgreSQL",
+    6379: "Redis",
+    27017: "MongoDB",
+    9200: "Elasticsearch",
+    1433: "Microsoft SQL Server",
+    1521: "Oracle Database",
+    11211: "Memcached",
+    5984: "CouchDB",
+    9042: "Cassandra",
+    7474: "Neo4j",
+}
+
+_REMOTE_PORTS: dict[int, str] = {
+    22: "SSH",
+    23: "Telnet",
+    3389: "RDP",
+    5900: "VNC",
+}
+
+_CAMERA_PORTS: dict[int, str] = {
+    554: "RTSP",
+    8554: "RTSP",
+}
+
+_MESSAGE_PORTS: dict[int, str] = {
+    25: "SMTP",
+    465: "SMTPS",
+    587: "Submission",
+    110: "POP3",
+    995: "POP3S",
+    143: "IMAP",
+    993: "IMAPS",
+    1883: "MQTT",
+    5672: "AMQP",
+}
+
+_ADMIN_TECHS: dict[str, str] = {
+    "phpmyadmin": "phpMyAdmin",
+    "adminer": "Adminer",
+    "webmin": "Webmin",
+    "cpanel": "cPanel",
+    "plesk": "Plesk",
+    "directadmin": "DirectAdmin",
+    "jenkins": "Jenkins",
+    "gitlab": "GitLab",
+    "gitea": "Gitea",
+    "grafana": "Grafana",
+    "zabbix": "Zabbix",
+    "kibana": "Kibana",
+    "kubernetes-dashboard": "Kubernetes Dashboard",
+    "rabbitmq": "RabbitMQ Management",
+    "solr": "Apache Solr Admin",
+    "hadoop": "Hadoop Admin",
+    "swagger": "Swagger UI",
+    "postman": "Postman",
+    "horde": "Horde Webmail",
+    "roundcube": "Roundcube Webmail",
+    "squirrelmail": "SquirrelMail",
+    "zimbra": "Zimbra Web Client",
+    "icewarp": "IceWarp WebMail",
+    "mdaemon": "MDaemon Webmail",
+    "atmail": "Atmail",
+    "open-xchange": "Open-Xchange",
+    "postfixadmin": "PostfixAdmin",
+    "vestacp": "Vesta CP",
+    "hestiacp": "Hestia CP",
+    "cyberpanel": "CyberPanel",
+    "froxlor": "Froxlor",
+    "ispconfig": "ISPConfig",
+    "ajenti": "Ajenti",
+    "cockpit": "Cockpit",
+    "portainer": "Portainer",
+    "rancher": "Rancher",
+    "traefik": "Traefik Dashboard",
+    "nomad": "Nomad",
+    "consul": "Consul",
+    "vault": "Vault",
+    "argocd": "Argo CD",
+    "octopus deploy": "Octopus Deploy",
+    "teamcity": "TeamCity",
+    "bamboo": "Bamboo",
+    "youtrack": "YouTrack",
+    "redmine": "Redmine",
+    "confluence": "Confluence",
+    "jira": "Jira",
+    "bitbucket": "Bitbucket",
+    "nagios": "Nagios",
+    "icinga": "Icinga",
+    "prometheus": "Prometheus",
+    "thanos": "Thanos",
+    "elasticsearch": "Elasticsearch",
+    "logstash": "Logstash",
+    "graylog": "Graylog",
+    "splunk": "Splunk",
+    "nexus": "Sonatype Nexus",
+    "artifactory": "JFrog Artifactory",
+    "harbor": "Harbor",
+    "gogs": "Gogs",
+    "sourcegraph": "Sourcegraph",
+    "phabricator": "Phabricator",
+}
+
+_DB_TECHS: dict[str, str] = {
+    "mysql": "MySQL",
+    "mariadb": "MariaDB",
+    "postgresql": "PostgreSQL",
+    "redis": "Redis",
+    "mongodb": "MongoDB",
+    "elasticsearch": "Elasticsearch",
+    "microsoft sql server": "Microsoft SQL Server",
+    "sqlite": "SQLite",
+    "cassandra": "Cassandra",
+    "couchdb": "CouchDB",
+    "neo4j": "Neo4j",
+}
+
+_SECURITY_TECHS: dict[str, str] = {
+    "imperva incapsula": "Imperva Incapsula",
+    "sucuri": "Sucuri WAF",
+    "cloudflare": "Cloudflare",
+    "akamai": "Akamai",
+    "fortinet": "Fortinet",
+}
+
+_SEVERITY: dict[str, str] = {
+    "database": "CRITICAL",
+    "admin-panel": "HIGH",
+    "remote-access": "HIGH",
+    "camera": "HIGH",
+    "messaging": "MEDIUM",
+    "service": "INFO",
+}
+
+
+def _tech_name(tech: Technology) -> str:
+    return tech.name.lower().strip()
+
+
+def _service_from_tech(tech: Technology) -> ServiceFinding | None:
+    name = _tech_name(tech)
+    if name in _ADMIN_TECHS:
+        return ServiceFinding(
+            name=_ADMIN_TECHS[name],
+            kind="admin-panel",
+            evidence=" ".join(tech.evidence) or f"tech: {tech.name}",
+            severity=_SEVERITY["admin-panel"],
+        )
+    if name in _DB_TECHS:
+        return ServiceFinding(
+            name=_DB_TECHS[name],
+            kind="database",
+            evidence=" ".join(tech.evidence) or f"tech: {tech.name}",
+            severity=_SEVERITY["database"],
+        )
+    if name in _SECURITY_TECHS:
+        return ServiceFinding(
+            name=_SECURITY_TECHS[name],
+            kind="service",
+            evidence=" ".join(tech.evidence) or f"tech: {tech.name}",
+            severity=_SEVERITY["service"],
+        )
+    for category in tech.categories or ():
+        if category in {"database", "service", "infrastructure", "security"}:
+            return ServiceFinding(
+                name=tech.name,
+                kind=category if category != "service" else "service",
+                evidence=" ".join(tech.evidence) or f"category: {category}",
+                severity=_SEVERITY.get(category, "INFO"),
+            )
+    return None
+
+
+def _service_from_port(port: int) -> ServiceFinding | None:
+    if port in _DB_PORTS:
+        return ServiceFinding(
+            name=_DB_PORTS[port],
+            kind="database",
+            evidence=f"port {port}/tcp",
+            severity=_SEVERITY["database"],
+        )
+    if port in _REMOTE_PORTS:
+        return ServiceFinding(
+            name=_REMOTE_PORTS[port],
+            kind="remote-access",
+            evidence=f"port {port}/tcp",
+            severity=_SEVERITY["remote-access"],
+        )
+    if port in _CAMERA_PORTS:
+        return ServiceFinding(
+            name=_CAMERA_PORTS[port],
+            kind="camera",
+            evidence=f"port {port}/tcp",
+            severity=_SEVERITY["camera"],
+        )
+    if port in _MESSAGE_PORTS:
+        return ServiceFinding(
+            name=_MESSAGE_PORTS[port],
+            kind="messaging",
+            evidence=f"port {port}/tcp",
+            severity=_SEVERITY["messaging"],
+        )
+    return None
+
+
+_WEB_PORTS: frozenset[int] = frozenset(
+    {80, 443, 3000, 2082, 2083, 631, 7547, 8000, 8080, 8081, 8443, 8888, 9000, 9200}
+)
+_WINDOWS_PORTS: frozenset[int] = frozenset({111, 135, 139, 445, 5985})
+
+
+def port_category(port: int, service: str | None) -> tuple[str, str]:
+
+    if port in _DB_PORTS:
+        return ("database", _SEVERITY["database"])
+    if port in _REMOTE_PORTS or port == 2222:
+        return ("remote-access", _SEVERITY["remote-access"])
+    if port in _CAMERA_PORTS:
+        return ("camera", _SEVERITY["camera"])
+    if port in _MESSAGE_PORTS:
+        return ("mail", _SEVERITY["messaging"])
+    if port in _WEB_PORTS:
+        return ("web", "INFO")
+    if port == 53:
+        return ("dns", "INFO")
+    if port == 21:
+        return ("file-transfer", "MEDIUM")
+    if port in _WINDOWS_PORTS:
+        return ("windows/rpc", "MEDIUM")
+    svc = (service or "").lower()
+    if "http" in svc:
+        return ("web", "INFO")
+    if "ssh" in svc or "telnet" in svc or "vnc" in svc or "rdp" in svc:
+        return ("remote-access", "HIGH")
+    if "rtsp" in svc:
+        return ("camera", "HIGH")
+    if any(k in svc for k in ("smtp", "imap", "pop", "mqtt")):
+        return ("mail", "MEDIUM")
+    if any(k in svc for k in ("mysql", "postgres", "redis", "mongo", "sql")):
+        return ("database", "CRITICAL")
+    if "ftp" in svc:
+        return ("file-transfer", "MEDIUM")
+    return ("other", "INFO")
+
+
+def classify_services(report: ScanReport) -> list[ServiceFinding]:
+    seen: set[tuple[str, str]] = set()
+    findings: list[ServiceFinding] = []
+
+    for tech in report.all_technologies():
+        finding = _service_from_tech(tech)
+        if finding is None:
+            continue
+        key = (finding.name.lower(), finding.kind)
+        if key in seen:
+            continue
+        seen.add(key)
+        findings.append(finding)
+
+    scan = report.ports
+    if scan is not None:
+        for port in scan.ports:
+            finding = _service_from_port(port.port)
+            if finding is None:
+                continue
+            key = (finding.name.lower(), finding.kind)
+            if key in seen:
+                continue
+            seen.add(key)
+            findings.append(finding)
+
+    findings.sort(key=lambda f: (_severity_rank(f.severity), f.kind, f.name.lower()))
+    return findings
+
+
+_SEVERITY_RANK = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3, "INFO": 4}
+
+
+def _severity_rank(severity: str) -> int:
+    return _SEVERITY_RANK.get(severity.upper(), 99)

stackscan/analyzers/tech.py

@@ -0,0 +1,178 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING
+
+from stackscan.types import FetchResult, Technology
+from stackscan.utils import host_of
+
+if TYPE_CHECKING:
+    from sigdb.core import SigDBMatcher
+    from sigdb.types import SigDBMatchResult
+_META_RE = re.compile("<meta\\b([^>]*)>", re.IGNORECASE)
+_SCRIPT_SRC_RE = re.compile("<script\\b[^>]*\\bsrc\\s*=\\s*[\\\"']?([^\\\"'\\s>]+)", re.IGNORECASE)
+_ATTR_RE = re.compile(
+    "([a-zA-Z_:][\\w:.-]*)\\s*=\\s*(?:\\\"([^\\\"]*)\\\"|'([^']*)'|([^\\s\\\"'=<>`]+))"
+)
+
+
+def _meta_pairs(html: str) -> list[tuple[str, str]]:
+    pairs: list[tuple[str, str]] = []
+    for match in _META_RE.finditer(html):
+        attrs: dict[str, str] = {}
+        for attr in _ATTR_RE.finditer(match.group(1)):
+            name = attr.group(1).lower()
+            value = attr.group(2) or attr.group(3) or attr.group(4) or ""
+            attrs[name] = value
+        key = attrs.get("name") or attrs.get("http-equiv") or attrs.get("property")
+        content = attrs.get("content")
+        if key and content:
+            pairs.append((key.lower(), content))
+    return pairs
+
+
+def _script_srcs(html: str) -> list[str]:
+    return [match.group(1) for match in _SCRIPT_SRC_RE.finditer(html)]
+
+
+@dataclass
+class _Hit:
+    name: str
+    category: str | None = None
+    evidence: list[str] = field(default_factory=list[str])
+
+
+_HEADER_TECH: tuple[tuple[str, str | None, str, str], ...] = (
+    ("x-powered-by", "php", "PHP", "backend"),
+    ("x-powered-by", "asp.net", "ASP.NET", "backend"),
+    ("x-powered-by", "express", "Express", "backend"),
+    ("x-powered-by", "next.js", "Next.js", "frontend"),
+    ("x-powered-by", "nuxt", "Nuxt.js", "frontend"),
+    ("x-powered-by", "servlet", "Java Servlet", "backend"),
+    ("x-powered-by", "plesk", "Plesk", "infrastructure"),
+    ("x-aspnet-version", None, "ASP.NET", "backend"),
+    ("x-aspnetmvc-version", None, "ASP.NET MVC", "backend"),
+    ("x-drupal-cache", None, "Drupal", "cms"),
+    ("x-drupal-dynamic-cache", None, "Drupal", "cms"),
+    ("x-generator", "drupal", "Drupal", "cms"),
+    ("x-shopify-stage", None, "Shopify", "ecommerce"),
+    ("x-shopid", None, "Shopify", "ecommerce"),
+    ("x-magento-cache-debug", None, "Magento", "ecommerce"),
+    ("x-wix-request-id", None, "Wix", "cms"),
+    ("x-jenkins", None, "Jenkins", "ci"),
+    ("x-turbo-charged-by", "litespeed", "LiteSpeed", "proxy"),
+    ("x-litespeed-cache", None, "LiteSpeed Cache", "cms"),
+    ("x-varnish", None, "Varnish", "proxy"),
+    ("x-envoy-upstream-service-time", None, "Envoy", "proxy"),
+    ("x-vercel-id", None, "Vercel", "infrastructure"),
+    ("x-nextjs-cache", None, "Next.js", "frontend"),
+    ("fastly-io-info", None, "Fastly", "cdn"),
+)
+_COOKIE_TECH: tuple[tuple[str, str, str], ...] = (
+    ("phpsessid", "PHP", "backend"),
+    ("laravel_session", "Laravel", "backend"),
+    ("ci_session", "CodeIgniter", "backend"),
+    ("csrftoken", "Django", "backend"),
+    ("django_language", "Django", "backend"),
+    ("jsessionid", "Java", "backend"),
+    ("asp.net_sessionid", "ASP.NET", "backend"),
+    (".aspxauth", "ASP.NET", "backend"),
+    ("wordpress_", "WordPress", "cms"),
+    ("wp-settings", "WordPress", "cms"),
+    ("_shopify", "Shopify", "ecommerce"),
+    ("prestashop", "PrestaShop", "ecommerce"),
+    ("connect.sid", "Express", "backend"),
+    ("incap_ses", "Imperva Incapsula", "security"),
+    ("visid_incap", "Imperva Incapsula", "security"),
+)
+
+
+class TechAnalyzer:
+    def __init__(self, matchers: list[SigDBMatcher]) -> None:
+        self._matchers = matchers
+
+    def _add(self, acc: dict[str, _Hit], match: SigDBMatchResult, evidence: str) -> None:
+        if not match.result or match.item is None:
+            return
+        key = match.item.key
+        headers = getattr(match.item, "headers", {}) or {}
+        hit = acc.get(key)
+        if hit is None:
+            hit = _Hit(name=headers.get("_name") or key, category=headers.get("_category"))
+            acc[key] = hit
+        if evidence not in hit.evidence:
+            hit.evidence.append(evidence)
+
+    def detect(self, result: FetchResult) -> list[Technology]:
+        acc: dict[str, _Hit] = {}
+        location = host_of(result.url) if result.url else ""
+        for matcher in self._matchers:
+            for name, value in result.headers.items():
+                if name == "_raw":
+                    continue
+                self._add(acc, matcher.match_group("headers", value, name=name), f"header:{name}")
+            for raw_cookie in result.cookies:
+                segment = raw_cookie.split(";", 1)[0].strip()
+                if "=" not in segment:
+                    continue
+                cname, _, cvalue = segment.partition("=")
+                cname = cname.strip().lower()
+                self._add(
+                    acc, matcher.match_group("headers", cvalue, name=cname), f"cookie:{cname}"
+                )
+            for key, content in _meta_pairs(result.body):
+                self._add(acc, matcher.match_group("meta", content, name=key), f"meta:{key}")
+            for src in _script_srcs(result.body):
+                self._add(acc, matcher.match_group("script_src", src), "script_src")
+                self._add(acc, matcher.match(src), "script_src")
+            self._add(acc, matcher.match_html(result.body), "html")
+            self._add(acc, matcher.match(result.body), "body")
+            self._add(acc, matcher.match(result.url), "url")
+        self._curated(acc, result)
+        by_name: dict[str, _Hit] = {}
+        for hit in acc.values():
+            existing = by_name.get(hit.name.lower())
+            if existing is None:
+                by_name[hit.name.lower()] = hit
+            else:
+                for ev in hit.evidence:
+                    if ev not in existing.evidence:
+                        existing.evidence.append(ev)
+                existing.category = existing.category or hit.category
+        technologies = [
+            Technology(
+                name=hit.name,
+                categories=(hit.category,) if hit.category else (),
+                evidence=tuple(hit.evidence),
+                location=location,
+            )
+            for hit in by_name.values()
+        ]
+        technologies.sort(key=lambda tech: tech.name.lower())
+        return technologies
+
+    def _curated(self, acc: dict[str, _Hit], result: FetchResult) -> None:
+
+        def add(name: str, category: str, evidence: str) -> None:
+            key = f"curated:{name.lower()}"
+            hit = acc.get(key)
+            if hit is None:
+                hit = _Hit(name=name, category=category)
+                acc[key] = hit
+            if evidence not in hit.evidence:
+                hit.evidence.append(evidence)
+
+        for header, needle, name, category in _HEADER_TECH:
+            value = result.headers.get(header)
+            if value is None:
+                continue
+            if needle is None or needle in value.lower():
+                add(name, category, f"header:{header}")
+        for raw_cookie in result.cookies:
+            cname = raw_cookie.split("=", 1)[0].split(";", 1)[0].strip().lower()
+            if not cname:
+                continue
+            for prefix, name, category in _COOKIE_TECH:
+                if cname.startswith(prefix):
+                    add(name, category, f"cookie:{cname}")