stackscan 2.2.0__tar.gz → 2.2.2__tar.gz

{stackscan-2.2.0 → stackscan-2.2.2}/.gitignore

@@ -132,4 +132,7 @@ frameworks.schema.json
 .Spotlight-V100
 .Trashes
 ehthumbs.db
-Thumbs.db
+Thumbs.db
+
+# stackscan genereted reports 
+stackscan-report.html

{stackscan-2.2.0 → stackscan-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackscan
-Version: 2.2.0
+Version: 2.2.2
 Summary: Full web stack, infrastructure, DNS, port, subdomain and CVE analyzer.
 Project-URL: Source, https://github.com/reekeer/stackscan
 Project-URL: Issues, https://github.com/reekeer/stackscan/issues
@@ -68,7 +68,7 @@ solicit and are opt-in. **Only scan systems you are authorized to test.**
 ## 📦 Installation
 
 ```bash
-pip install "stackscan @ git+https://github.com/reekeer/stackscan.git"
+pip install "stackscan"
 
 # optional extra
 pip install "stackscan[geo]"   # offline IP geolocation via geoip2 + a MaxMind .mmdb
@@ -170,9 +170,11 @@ Below are performance benchmarks conducted on two production targets using diffe
 | `--subdomains` | off | Enumerate subdomains (AXFR + wordlist + TLS SANs). |
 | `--subdomain-limit` | `5000` | Max ranked labels to resolve (`0` = full list). |
 | `--site-limit` | `20` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
-| `--default-creds` | off | Bounded default-credential / open-device check. |
+| `--default-creds` | off | Bounded default-credential / open-device check (prompts before brute-forcing). |
+| `--full-auto` | off | Auto-accept every brute prompt on discovered devices (enables default-cred checks). |
 | `--cred-limit` | `50` | Max default-credential pairs per device (`0` = full SecLists list). |
 | `--cve-online` | off | Also query NVD live for detected products. |
+| `--parse-social` | off | Extract social media and contact links from the page. |
 | `--workers` | `350` | Parallel workers for ports/subdomains/creds. |
 | `--concurrency` | `10` | Concurrent targets. |
 | `--sigdb` / `--no-builtin` / `--no-sources` | – | Signature database selection. |

{stackscan-2.2.0 → stackscan-2.2.2}/README.md

@@ -30,7 +30,7 @@ solicit and are opt-in. **Only scan systems you are authorized to test.**
 ## 📦 Installation
 
 ```bash
-pip install "stackscan @ git+https://github.com/reekeer/stackscan.git"
+pip install "stackscan"
 
 # optional extra
 pip install "stackscan[geo]"   # offline IP geolocation via geoip2 + a MaxMind .mmdb
@@ -132,9 +132,11 @@ Below are performance benchmarks conducted on two production targets using diffe
 | `--subdomains` | off | Enumerate subdomains (AXFR + wordlist + TLS SANs). |
 | `--subdomain-limit` | `5000` | Max ranked labels to resolve (`0` = full list). |
 | `--site-limit` | `20` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
-| `--default-creds` | off | Bounded default-credential / open-device check. |
+| `--default-creds` | off | Bounded default-credential / open-device check (prompts before brute-forcing). |
+| `--full-auto` | off | Auto-accept every brute prompt on discovered devices (enables default-cred checks). |
 | `--cred-limit` | `50` | Max default-credential pairs per device (`0` = full SecLists list). |
 | `--cve-online` | off | Also query NVD live for detected products. |
+| `--parse-social` | off | Extract social media and contact links from the page. |
 | `--workers` | `350` | Parallel workers for ports/subdomains/creds. |
 | `--concurrency` | `10` | Concurrent targets. |
 | `--sigdb` / `--no-builtin` / `--no-sources` | – | Signature database selection. |

{stackscan-2.2.0 → stackscan-2.2.2}/src/stackscan/__init__.py

@@ -2,4 +2,4 @@ from .core import StackscanSession
 from .utils import normalize_url
 
 __all__ = ["StackscanSession", "__version__", "normalize_url"]
-__version__ = "2.2.0"
+__version__ = "2.2.2"

{stackscan-2.2.0 → stackscan-2.2.2}/src/stackscan/analyzers/__init__.py

@@ -1,4 +1,4 @@
-from stackscan.analyzers.creds import check_default_creds
+from stackscan.analyzers.creds import brute_devices, detect_devices
 from stackscan.analyzers.cve import (
     extract_software,
     match_cves,
@@ -8,8 +8,10 @@ from stackscan.analyzers.cve import (
 )
 from stackscan.analyzers.exposure import ExposureProbe, analyze_exposure
 from stackscan.analyzers.infra import analyze_infra
+from stackscan.analyzers.osdetect import detect_os
 from stackscan.analyzers.security import analyze_security_headers
 from stackscan.analyzers.services import classify_services, port_category
+from stackscan.analyzers.social import parse_social
 from stackscan.analyzers.tech import TechAnalyzer
 
 __all__ = [
@@ -18,9 +20,12 @@ __all__ = [
     "analyze_exposure",
     "analyze_infra",
     "analyze_security_headers",
-    "check_default_creds",
+    "brute_devices",
+    "detect_devices",
+    "detect_os",
     "classify_services",
     "port_category",
+    "parse_social",
     "extract_software",
     "match_cves",
     "match_cves_online",

{stackscan-2.2.0 → stackscan-2.2.2}/src/stackscan/analyzers/creds.py

@@ -7,7 +7,7 @@ from functools import lru_cache
 
 import aiohttp
 
-from stackscan.types import CredFinding, PortScan
+from stackscan.types import BruteTarget, CredFinding, PortScan
 from stackscan.utils import db_dir
 
 _CREDS_URL = "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Default-Credentials/default-passwords.csv"
@@ -40,6 +40,27 @@ _DEVICE_KEYWORDS = (
     "network camera",
     "surveillance",
     "uc-httpd",
+    "go2rtc",
+    "rtsp",
+)
+_CAMERA_KEYWORDS = (
+    "camera",
+    "ipcam",
+    "netcam",
+    "webcam",
+    "dvr",
+    "nvr",
+    "cctv",
+    "hikvision",
+    "dahua",
+    "axis",
+    "foscam",
+    "vivotek",
+    "webcamxp",
+    "network camera",
+    "surveillance",
+    "go2rtc",
+    "rtsp",
 )
 _BUILTIN_CREDS: tuple[tuple[str, str], ...] = (
     ("admin", "admin"),
@@ -105,6 +126,9 @@ def load_default_creds() -> tuple[tuple[str, str], ...]:
     return tuple(combined)
 
 
+_RTSP_PORTS: frozenset[int] = frozenset({554, 8554})
+
+
 def _http_ports(scan: PortScan | None) -> list[tuple[int, bool]]:
     if scan is None:
         return []
@@ -113,7 +137,12 @@ def _http_ports(scan: PortScan | None) -> list[tuple[int, bool]]:
         service = (port.service or "").lower()
         if port.port in (443, 8443, 2083) or "https" in service or "ssl" in service:
             out.append((port.port, True))
-        elif "http" in service or port.port in (80, 8080, 8000, 8081, 8888, 9000, 631, 7547):
+        elif (
+            "http" in service
+            or port.port in (80, 8080, 8000, 8081, 8888, 9000, 631, 7547)
+            or port.port in _RTSP_PORTS
+            or "rtsp" in service
+        ):
             out.append((port.port, False))
     return out
 
@@ -123,45 +152,49 @@ def _looks_like_device(realm: str, server: str) -> bool:
     return any(keyword in blob for keyword in _DEVICE_KEYWORDS)
 
 
-async def check_default_creds(
+def _is_camera(realm: str, server: str) -> bool:
+    blob = f"{realm} {server}".lower()
+    return any(keyword in blob for keyword in _CAMERA_KEYWORDS)
+
+
+async def detect_devices(
     host: str,
     scan: PortScan | None,
     *,
     timeout: float = 6.0,
     insecure: bool = True,
     workers: int = 10,
-    cred_limit: int = 100,
-) -> list[CredFinding]:
+) -> tuple[list[CredFinding], list[BruteTarget]]:
     ports = _http_ports(scan)
     if not ports:
-        return []
-    creds = await asyncio.to_thread(load_default_creds)
-    if cred_limit > 0:
-        creds = creds[:cred_limit]
+        return ([], [])
     connector = aiohttp.TCPConnector(ssl=False, limit=max(workers, 1))
     client_timeout = aiohttp.ClientTimeout(total=timeout)
     semaphore = asyncio.Semaphore(max(workers, 1))
     findings: list[CredFinding] = []
+    candidates: list[BruteTarget] = []
     async with aiohttp.ClientSession(connector=connector, timeout=client_timeout) as session:
 
-        async def check(port: int, tls: bool) -> None:
+        async def probe(port: int, tls: bool) -> None:
             async with semaphore:
-                finding = await _check_endpoint(session, host, port, tls, creds)
-            if finding is not None:
-                findings.append(finding)
+                result = await _probe_endpoint(session, host, port, tls)
+            if isinstance(result, BruteTarget):
+                candidates.append(result)
+            elif result is not None:
+                findings.append(result)
 
-        await asyncio.gather(*(check(port, tls) for port, tls in ports))
-    findings.sort(key=lambda f: (f.kind != "default-creds", f.kind != "open-no-auth", f.target))
-    return findings
+        await asyncio.gather(*(probe(port, tls) for port, tls in ports))
+    findings.sort(key=lambda f: f.target)
+    candidates.sort(key=lambda c: (c.host, c.port))
+    return (findings, candidates)
 
 
-async def _check_endpoint(
+async def _probe_endpoint(
     session: aiohttp.ClientSession,
     host: str,
     port: int,
     tls: bool,
-    creds: tuple[tuple[str, str], ...],
-) -> CredFinding | None:
+) -> CredFinding | BruteTarget | None:
     scheme = "https" if tls else "http"
     url = f"{scheme}://{host}:{port}/"
     target = f"{host}:{port}"
@@ -172,7 +205,7 @@ async def _check_endpoint(
             realm = resp.headers.get("WWW-Authenticate", "")
     except (aiohttp.ClientError, TimeoutError, OSError):
         return None
-    device = _looks_like_device(realm, server)
+    device = _looks_like_device(realm, server) or port in _RTSP_PORTS
     if status != 401:
         if device or _looks_like_device("", server):
             return CredFinding(
@@ -184,25 +217,64 @@ async def _check_endpoint(
         return None
     if not device:
         return None
-    hit = await _try_defaults(session, url, creds)
-    if hit is not None:
-        username, password = hit
-        return CredFinding(
-            target=target,
-            service=f"{scheme} ({server or realm or 'device'})",
-            kind="default-creds",
-            detail="default credentials accepted via HTTP Basic auth",
-            username=username,
-            password=password,
-        )
-    return CredFinding(
-        target=target,
+    return BruteTarget(
+        host=host,
+        port=port,
+        tls=tls,
         service=f"{scheme} ({server or realm or 'device'})",
-        kind="auth-required",
-        detail="device auth required; no default credential matched",
+        is_camera=_is_camera(realm, server) or port in _RTSP_PORTS,
     )
 
 
+async def brute_devices(
+    targets: list[BruteTarget],
+    *,
+    timeout: float = 6.0,
+    insecure: bool = True,
+    workers: int = 10,
+    cred_limit: int = 100,
+) -> list[CredFinding]:
+    if not targets:
+        return []
+    creds = await asyncio.to_thread(load_default_creds)
+    if cred_limit > 0:
+        creds = creds[:cred_limit]
+    connector = aiohttp.TCPConnector(ssl=False, limit=max(workers, 1))
+    client_timeout = aiohttp.ClientTimeout(total=timeout)
+    semaphore = asyncio.Semaphore(max(workers, 1))
+    findings: list[CredFinding] = []
+    async with aiohttp.ClientSession(connector=connector, timeout=client_timeout) as session:
+
+        async def run(target: BruteTarget) -> None:
+            async with semaphore:
+                hit = await _try_defaults(session, target.url, creds)
+            if hit is not None:
+                username, password = hit
+                findings.append(
+                    CredFinding(
+                        target=target.target,
+                        service=target.service,
+                        kind="default-creds",
+                        detail="default credentials accepted via HTTP Basic auth",
+                        username=username,
+                        password=password,
+                    )
+                )
+            else:
+                findings.append(
+                    CredFinding(
+                        target=target.target,
+                        service=target.service,
+                        kind="auth-required",
+                        detail="device auth required; no default credential matched",
+                    )
+                )
+
+        await asyncio.gather(*(run(target) for target in targets))
+    findings.sort(key=lambda f: (f.kind != "default-creds", f.target))
+    return findings
+
+
 async def _try_defaults(
     session: aiohttp.ClientSession, url: str, creds: tuple[tuple[str, str], ...]
 ) -> tuple[str, str] | None:

{stackscan-2.2.0 → stackscan-2.2.2}/src/stackscan/analyzers/cve.py

@@ -12,6 +12,16 @@ from typing import Any, cast
 from stackscan.types import CveMatch, Headers, PortScan, Software
 
 CveEntry = dict[str, Any]
+_BACKPORT_DISTRO_RE = re.compile(
+    r"(0?ubuntu0?[._]\d[\d.]+)"
+    r"|\b(ubuntu|debian|centos|rhel|red\s*hat|fedora|amzn|amazon|rocky|almalinux|alpine|raspbian|suse|opensuse)\b"
+    r"|(\+deb\d+u?\d*)"
+    r"|(-\d+ubuntu\d+(?![\d._]))"
+    r"|(el\d+)"
+    r"|(\.fc\d+)"
+    r"|(~bpo\d+\+[\w]+)",
+    re.I,
+)
 CveDb = dict[str, list[CveEntry]]
 _NAME_MAP: dict[str, str] = {
     "nginx": "nginx",
@@ -109,6 +119,11 @@ def load_cve_db() -> CveDb:
     return cast("CveDb", products)
 
 
+def _distro_tag(text: str) -> str:
+    match = _BACKPORT_DISTRO_RE.search(text)
+    return match.group(0) if match else ""
+
+
 def _parse_version(value: str) -> tuple[tuple[int, str], ...]:
     parts: list[tuple[int, str]] = []
     for chunk in re.split("[.\\-_]", value.strip()):
@@ -140,10 +155,12 @@ def _in_range(version: str, rng: dict[str, str]) -> bool:
     return bool(rng)
 
 
-def _tokens(value: str, source: str, location: str) -> list[Software]:
+def _tokens(value: str, source: str, location: str, os: str = "") -> list[Software]:
     found: list[Software] = []
     for name, version in _TOKEN_RE.findall(value):
-        found.append(Software(name=name.lower(), version=version, source=source, location=location))
+        found.append(
+            Software(name=name.lower(), version=version, source=source, location=location, os=os)
+        )
     return found
 
 
@@ -159,7 +176,8 @@ def extract_software(headers: Headers, body: str, location: str = "") -> list[So
 
     server = headers.get("server")
     if server:
-        for item in _tokens(server, "header:server", location):
+        server_os = _distro_tag(server)
+        for item in _tokens(server, "header:server", location, os=server_os):
             add(item)
     powered = headers.get("x-powered-by")
     if powered:
@@ -197,7 +215,11 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
         if ssh:
             out.append(
                 Software(
-                    name="openssh", version=ssh.group(1), source="port-banner", location=location
+                    name="openssh",
+                    version=ssh.group(1),
+                    source="port-banner",
+                    location=location,
+                    os=port.os,
                 )
             )
             continue
@@ -208,6 +230,7 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
                     version=port.version,
                     source="port-banner",
                     location=location,
+                    os=port.os,
                 )
             )
     return out
@@ -218,19 +241,16 @@ _SEVERITY_RANK = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
 
 
 def _confidence(version: str, rng: dict[str, str], source: str) -> int:
-    score = 55
     comps = len([c for c in re.split("[.\\-_]", version) if c[:1].isdigit()])
-    if comps >= 3:
-        score += 20
-    elif comps >= 2:
-        score += 12
     bounded = ("start_incl" in rng or "start_excl" in rng) and (
         "end_incl" in rng or "end_excl" in rng
     )
-    score += 12 if bounded else 6
-    if source in _AUTHORITATIVE:
-        score += 12
-    return max(30, min(98, score))
+    authoritative = source in _AUTHORITATIVE
+    if authoritative and bounded and comps >= 3:
+        return 98
+    if (authoritative or bounded) and comps >= 2:
+        return 91
+    return 85
 
 
 @dataclass
@@ -245,6 +265,8 @@ class _CveAgg:
     url: str | None
     locations: set[str] = field(default_factory=set[str])
     sources: set[str] = field(default_factory=set[str])
+    unconfirmed: bool = False
+    caveat: str = ""
 
 
 def _match_entries(
@@ -256,13 +278,15 @@ def _match_entries(
     version = item.version
     if not version:
         return
+    backported = bool(item.os)
+    caveat = "distro backport likely — patchlevel not in banner" if backported else ""
     for entry in entries:
         ranges = cast("list[dict[str, str]]", entry.get("ranges") or [])
         hit_rng = next((r for r in ranges if _in_range(version, r)), None)
         if hit_rng is None:
             continue
         cve_id = str(entry["id"])
-        confidence = _confidence(version, hit_rng, item.source)
+        confidence = 40 if backported else _confidence(version, hit_rng, item.source)
         record = agg.get(cve_id)
         if record is None:
             record = _CveAgg(
@@ -274,13 +298,19 @@ def _match_entries(
                 confidence=confidence,
                 summary=str(entry.get("summary", "")),
                 url=entry.get("url"),
+                unconfirmed=backported,
+                caveat=caveat,
             )
             agg[cve_id] = record
         if item.location:
             record.locations.add(item.location)
         if item.source:
             record.sources.add(item.source)
-        if confidence > record.confidence:
+        if backported:
+            record.unconfirmed = True
+            record.caveat = caveat
+            record.confidence = min(record.confidence, 40)
+        elif confidence > record.confidence:
             record.confidence = confidence
             record.version = version
 
@@ -298,6 +328,8 @@ def _agg_to_matches(agg: dict[str, _CveAgg]) -> list[CveMatch]:
             url=r.url,
             locations=tuple(sorted(r.locations)),
             sources=tuple(sorted(r.sources)),
+            unconfirmed=r.unconfirmed,
+            caveat=r.caveat,
         )
         for r in agg.values()
     ]

stackscan-2.2.2/src/stackscan/analyzers/osdetect.py

@@ -0,0 +1,127 @@
+from __future__ import annotations
+
+from collections import Counter
+
+from stackscan.types import OsFinding, ScanReport
+
+_WINDOWS_SERVICES: frozenset[str] = frozenset(
+    {
+        "microsoft-iis",
+        "ms-sql",
+        "msrpc",
+        "netbios",
+        "ms-wbt",
+        "ms-wbt-server",
+        "wsman",
+    }
+)
+
+
+def _is_windows_service(service: str | None) -> bool:
+    if not service:
+        return False
+    lower = service.lower()
+    return lower in _WINDOWS_SERVICES or lower.startswith("ms-")
+
+
+def _normalize_os(name: str) -> str:
+    lower = name.lower()
+    if "win64" in lower or "win32" in lower or "windows" in lower:
+        return "Windows"
+    if "ubuntu" in lower:
+        return "Ubuntu"
+    if "debian" in lower:
+        return "Debian"
+    if "centos" in lower:
+        return "CentOS"
+    if "rhel/centos" in lower:
+        return "RHEL/CentOS"
+    if "rhel" in lower or "red hat" in lower:
+        return "Red Hat"
+    if "fedora" in lower:
+        return "Fedora"
+    if "amazon" in lower or "amzn" in lower:
+        return "Amazon Linux"
+    if "alpine" in lower:
+        return "Alpine"
+    if "rocky" in lower:
+        return "Rocky Linux"
+    if "alma" in lower:
+        return "AlmaLinux"
+    if "unix" in lower:
+        return "Unix"
+    return name.strip().title() if name else ""
+
+
+def _collect_votes(report: ScanReport) -> dict[str, list[tuple[str, str]]]:
+    votes: dict[str, list[tuple[str, str]]] = {}
+
+    def add(host: str, os: str, source: str) -> None:
+        if not host or not os:
+            return
+        normalized = _normalize_os(os)
+        if not normalized:
+            return
+        votes.setdefault(host, []).append((normalized, source))
+
+    primary_host = report.network.host if report.network else ""
+
+    for software in report.software:
+        if software.os:
+            add(primary_host, software.os, software.source)
+
+    if report.ports is not None:
+        for port in report.ports.ports:
+            if not port.host:
+                continue
+            if port.os:
+                add(port.host, port.os, f"port {port.port}")
+            if _is_windows_service(port.service):
+                add(port.host, "Windows", f"port {port.port}")
+
+    for site in report.site_findings:
+        from stackscan.utils import host_of
+
+        host = host_of(site.url)
+        for software in site.software:
+            if software.os:
+                add(host, software.os, software.source)
+
+    return votes
+
+
+def detect_os(report: ScanReport) -> list[OsFinding]:
+    votes = _collect_votes(report)
+    findings: list[OsFinding] = []
+    for host, pairs in votes.items():
+        if not pairs:
+            continue
+        counter = Counter(os for os, _ in pairs)
+        total = sum(counter.values())
+        if not total:
+            continue
+        winner, winner_count = counter.most_common(1)[0]
+        sources = ", ".join(sorted(set(src for os, src in pairs if os == winner)))
+        by_source: dict[str, list[str]] = {}
+        for os, src in pairs:
+            by_source.setdefault(src, []).append(os)
+        dominant_source = max(by_source, key=lambda s: len(by_source[s]))
+        if dominant_source == "port-banner" or dominant_source.startswith(("header:", "meta:", "script")):
+            category = "banner"
+        elif dominant_source.startswith("port "):
+            category = "network"
+        else:
+            category = "banner"
+        service = dominant_source
+        findings.append(
+            OsFinding(
+                host=host,
+                os=winner,
+                category=category,
+                service=service,
+                source=sources,
+                confidence=winner_count / total,
+            )
+        )
+    findings.sort(key=lambda f: (f.host, -f.confidence))
+    return findings