stackscan 2.6.0__tar.gz → 2.6.3__tar.gz

{stackscan-2.6.0 → stackscan-2.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackscan
-Version: 2.6.0
+Version: 2.6.3
 Summary: Full web stack, infrastructure, DNS, port, subdomain and CVE analyzer.
 Project-URL: Source, https://github.com/reekeer/stackscan
 Project-URL: Issues, https://github.com/reekeer/stackscan/issues

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/__init__.py

@@ -2,4 +2,4 @@ from .core import StackscanSession
 from .utils import normalize_url
 
 __all__ = ["StackscanSession", "__version__", "normalize_url"]
-__version__ = "2.6.0"
+__version__ = "2.6.3"

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/analyzers/creds.py

@@ -42,6 +42,29 @@ _DEVICE_KEYWORDS = (
     "uc-httpd",
     "go2rtc",
     "rtsp",
+    "mikrotik",
+    "routeros",
+    "webfig",
+    "openwrt",
+    "dd-wrt",
+    "pfsense",
+    "opnsense",
+    "ubnt",
+    "ubiquiti",
+    "unifi",
+    "tp-link",
+    "tplink",
+    "d-link",
+    "dlink",
+    "netgear",
+    "zyxel",
+    "huawei",
+    "tenda",
+    "asuswrt",
+    "idrac",
+    "ilo",
+    "ipmi",
+    "supermicro",
 )
 _CAMERA_KEYWORDS = (
     "camera",
@@ -199,31 +222,45 @@ async def _probe_endpoint(
     url = f"{scheme}://{host}:{port}/"
     target = f"{host}:{port}"
     try:
-        async with session.get(url, allow_redirects=False) as resp:
+        async with session.get(url, allow_redirects=True) as resp:
             status = resp.status
             server = resp.headers.get("Server", "")
             realm = resp.headers.get("WWW-Authenticate", "")
+            body = ""
+            if status < 400:
+                body = (await resp.content.read(20000)).decode("utf-8", "replace")
     except (aiohttp.ClientError, TimeoutError, OSError):
         return None
-    device = _looks_like_device(realm, server) or port in _RTSP_PORTS
-    if status != 401:
-        if device or _looks_like_device("", server):
-            return CredFinding(
-                target=target,
-                service=f"{scheme} ({server or 'device'})",
-                kind="open-no-auth",
-                detail=f"HTTP {status} without authentication",
+
+    if status == 401:
+        if _looks_like_device(realm, server) or port in _RTSP_PORTS:
+            return BruteTarget(
+                host=host,
+                port=port,
+                tls=tls,
+                service=f"{scheme} ({server or realm or 'device'})",
+                is_camera=_is_camera(realm, server) or port in _RTSP_PORTS,
+                login="basic",
             )
         return None
-    if not device:
-        return None
-    return BruteTarget(
-        host=host,
-        port=port,
-        tls=tls,
-        service=f"{scheme} ({server or realm or 'device'})",
-        is_camera=_is_camera(realm, server) or port in _RTSP_PORTS,
-    )
+
+    blob = f"{server} {realm} {body}".lower()
+    if "mikrotik" in blob or "routeros" in blob:
+        return BruteTarget(host=host, port=port, tls=tls, service="RouterOS", login="mikrotik")
+    if "unifi" in server.lower() or ("unifi" in blob and "login" in blob):
+        return BruteTarget(host=host, port=port, tls=tls, service="UniFi", login="unifi")
+    if status == 200 and 'type="password"' in blob and "<form" in blob:
+        return BruteTarget(
+            host=host, port=port, tls=tls, service=f"{scheme} login form", login="form"
+        )
+    if _looks_like_device("", server):
+        return CredFinding(
+            target=target,
+            service=f"{scheme} ({server or 'device'})",
+            kind="open-no-auth",
+            detail=f"HTTP {status} without authentication",
+        )
+    return None
 
 
 async def brute_devices(
@@ -247,7 +284,7 @@ async def brute_devices(
 
         async def run(target: BruteTarget) -> None:
             async with semaphore:
-                hit = await _try_defaults(session, target.url, creds)
+                hit = await _brute_login(session, target, creds)
             if hit is not None:
                 username, password = hit
                 findings.append(
@@ -255,7 +292,7 @@ async def brute_devices(
                         target=target.target,
                         service=target.service,
                         kind="default-creds",
-                        detail="default credentials accepted via HTTP Basic auth",
+                        detail=f"default credentials accepted ({target.login} login)",
                         username=username,
                         password=password,
                     )
@@ -275,6 +312,18 @@ async def brute_devices(
     return findings
 
 
+async def _brute_login(
+    session: aiohttp.ClientSession, target: BruteTarget, creds: tuple[tuple[str, str], ...]
+) -> tuple[str, str] | None:
+    if target.login == "mikrotik":
+        return await _try_mikrotik(session, target.url, creds)
+    if target.login == "unifi":
+        return await _try_unifi(session, target.url, creds)
+    if target.login == "form":
+        return await _try_form(session, target.url, creds)
+    return await _try_defaults(session, target.url, creds)
+
+
 async def _try_defaults(
     session: aiohttp.ClientSession, url: str, creds: tuple[tuple[str, str], ...]
 ) -> tuple[str, str] | None:
@@ -288,3 +337,70 @@ async def _try_defaults(
             return None
         await asyncio.sleep(0.05)
     return None
+
+
+async def _try_mikrotik(
+    session: aiohttp.ClientSession, base_url: str, creds: tuple[tuple[str, str], ...]
+) -> tuple[str, str] | None:
+    url = base_url.rstrip("/") + "/rest/system/resource"
+    for username, password in creds:
+        try:
+            async with session.get(
+                url, auth=aiohttp.BasicAuth(username, password), allow_redirects=False
+            ) as resp:
+                if resp.status == 200:
+                    return (username, password)
+                if resp.status == 404:
+                    return None
+        except (aiohttp.ClientError, TimeoutError, OSError):
+            return None
+        await asyncio.sleep(0.05)
+    return None
+
+
+async def _try_unifi(
+    session: aiohttp.ClientSession, base_url: str, creds: tuple[tuple[str, str], ...]
+) -> tuple[str, str] | None:
+    endpoints = ("/api/login", "/api/auth/login")
+    for username, password in creds:
+        payload = {"username": username, "password": password}
+        for endpoint in endpoints:
+            url = base_url.rstrip("/") + endpoint
+            try:
+                async with session.post(url, json=payload, allow_redirects=False) as resp:
+                    if resp.status == 200:
+                        return (username, password)
+            except (aiohttp.ClientError, TimeoutError, OSError):
+                continue
+        await asyncio.sleep(0.05)
+    return None
+
+
+_FORM_ENDPOINTS = ("/login", "/", "/admin/login", "/api/login", "/j_security_check")
+
+
+async def _try_form(
+    session: aiohttp.ClientSession, base_url: str, creds: tuple[tuple[str, str], ...]
+) -> tuple[str, str] | None:
+    for username, password in creds:
+        data = {
+            "username": username,
+            "password": password,
+            "user": username,
+            "pass": password,
+            "j_username": username,
+            "j_password": password,
+        }
+        for endpoint in _FORM_ENDPOINTS:
+            url = base_url.rstrip("/") + endpoint
+            try:
+                async with session.post(url, data=data, allow_redirects=False) as resp:
+                    location = resp.headers.get("Location", "").lower()
+                    if resp.status in (301, 302, 303) and not any(
+                        marker in location for marker in ("login", "error", "denied", "auth")
+                    ):
+                        return (username, password)
+            except (aiohttp.ClientError, TimeoutError, OSError):
+                continue
+        await asyncio.sleep(0.05)
+    return None

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/analyzers/cve.py

@@ -106,12 +106,26 @@ _CORE_COMMIT_RE = re.compile(
 )
 
 
+def _cve_bytes() -> bytes | None:
+    from stackscan.config.sources import SourceStore
+
+    override = SourceStore().resolve_cve()
+    if override is not None:
+        try:
+            return override.read_bytes()
+        except OSError:
+            pass
+    try:
+        return resources.files("stackscan.data").joinpath("cve.json.gz").read_bytes()
+    except (FileNotFoundError, ModuleNotFoundError, OSError):
+        return None
+
+
 @lru_cache(maxsize=1)
 def load_cve_db() -> CveDb:
     empty: CveDb = {}
-    try:
-        raw = resources.files("stackscan.data").joinpath("cve.json.gz").read_bytes()
-    except (FileNotFoundError, ModuleNotFoundError, OSError):
+    raw = _cve_bytes()
+    if raw is None:
         return empty
     try:
         data = cast("dict[str, Any]", json.loads(gzip.decompress(raw)))

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/analyzers/osdetect.py

@@ -106,7 +106,9 @@ def detect_os(report: ScanReport) -> list[OsFinding]:
         for os, src in pairs:
             by_source.setdefault(src, []).append(os)
         dominant_source = max(by_source, key=lambda s: len(by_source[s]))
-        if dominant_source == "port-banner" or dominant_source.startswith(("header:", "meta:", "script")):
+        if dominant_source == "port-banner" or dominant_source.startswith(
+            ("header:", "meta:", "script")
+        ):
             category = "banner"
         elif dominant_source.startswith("port "):
             category = "network"

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/analyzers/services.py

@@ -163,6 +163,15 @@ def _service_from_tech(tech: Technology) -> ServiceFinding | None:
             evidence=" ".join(tech.evidence) or f"tech: {tech.name}",
             severity=_SEVERITY["database"],
         )
+    categories = {category.lower() for category in tech.categories}
+    for kind in ("admin-panel", "database"):
+        if kind in categories:
+            return ServiceFinding(
+                name=tech.name,
+                kind=kind,
+                evidence=" ".join(tech.evidence) or f"tech: {tech.name}",
+                severity=_SEVERITY[kind],
+            )
     return None
 
 

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/analyzers/social.py

@@ -37,10 +37,14 @@ def _social_link(raw: str, base_url: str) -> SocialLink | None:
     low = value.lower()
     if low.startswith("mailto:"):
         addr = value[7:].split("?", 1)[0].strip()
-        return SocialLink("Email", "mailto:" + addr, addr) if addr else None
+        if addr and "@" in addr and "." in addr.split("@", 1)[-1]:
+            return SocialLink("Email", "mailto:" + addr, addr)
+        return None
     if low.startswith("tel:"):
         num = value[4:].strip()
-        return SocialLink("Phone", value, num) if num else None
+        if sum(char.isdigit() for char in num) >= 6:
+            return SocialLink("Phone", value, num)
+        return None
     if low.startswith("//"):
         value = "https:" + value
     elif not low.startswith(("http://", "https://")):

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/analyzers/tech.py

@@ -40,17 +40,51 @@ def _script_srcs(html: str) -> list[str]:
 _CLASS_ATTR_RE = re.compile(r'\bclass\s*=\s*"([^"]*)"|\bclass\s*=\s*\'([^\']*)\'', re.I)
 
 
-_CSS_UTILITY_EXACT: frozenset[str] = frozenset({
-    "container", "flex", "grid", "block", "inline", "inline-block", "hidden",
-    "table", "table-cell", "table-row", "flow-root", "contents",
-    "float-left", "float-right", "float-none", "clear-left", "clear-right",
-    "clear-both", "clear-none", "isolate", "isolation-auto",
-    "object-contain", "object-cover", "object-fill", "object-none", "object-scale-down",
-    "overflow-auto", "overflow-hidden", "overflow-visible", "overflow-scroll",
-    "overscroll-auto", "overscroll-contain", "overscroll-none",
-    "visible", "invisible", "collapse",
-    "static", "fixed", "absolute", "relative", "sticky",
-})
+_CSS_UTILITY_EXACT: frozenset[str] = frozenset(
+    {
+        "container",
+        "flex",
+        "grid",
+        "block",
+        "inline",
+        "inline-block",
+        "hidden",
+        "table",
+        "table-cell",
+        "table-row",
+        "flow-root",
+        "contents",
+        "float-left",
+        "float-right",
+        "float-none",
+        "clear-left",
+        "clear-right",
+        "clear-both",
+        "clear-none",
+        "isolate",
+        "isolation-auto",
+        "object-contain",
+        "object-cover",
+        "object-fill",
+        "object-none",
+        "object-scale-down",
+        "overflow-auto",
+        "overflow-hidden",
+        "overflow-visible",
+        "overflow-scroll",
+        "overscroll-auto",
+        "overscroll-contain",
+        "overscroll-none",
+        "visible",
+        "invisible",
+        "collapse",
+        "static",
+        "fixed",
+        "absolute",
+        "relative",
+        "sticky",
+    }
+)
 # Tailwind-style utilities: px-4, w-full, bg-red-500, my-auto, backdrop-blur, etc.
 _CSS_UTILITY_RE = re.compile(
     r"^[a-z]+(-[a-z]+)?-(\d+|auto|full|screen|px|sm|md|lg|xl|2xl|3xl|4xl|5xl|6xl|7xl|8xl|9xl|none|hidden|visible|inherit|current|transparent|black|white|blur|opacity|saturate|sepia|grayscale|contrast|brightness|invert|drop-shadow|hue-rotate|shadow|sm|md|lg|xl)$",
@@ -118,7 +152,9 @@ def _confidence(evidence: list[str]) -> int:
 
 
 _VERSION_RE = re.compile(r"(\d+\.\d+(?:\.\d+)?(?:[-+.]?[a-zA-Z0-9]+)?)")
-_CORE_COMMIT_RE = re.compile(r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE)
+_CORE_COMMIT_RE = re.compile(
+    r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE
+)
 
 
 def _version_key(version: str) -> tuple[int, int, int, int]:
@@ -274,9 +310,7 @@ class TechAnalyzer:
             self._add(acc, matcher.match(result.body), "body")
             self._add(acc, matcher.match(result.url), "url")
             for token in _framework_tokens(result.body):
-                self._add(
-                    acc, matcher.match_search({"framework": token}), f"framework:{token}"
-                )
+                self._add(acc, matcher.match_search({"framework": token}), f"framework:{token}")
         self._curated(acc, result)
         by_name: dict[str, _Hit] = {}
         for hit in acc.values():
@@ -336,4 +370,9 @@ class TechAnalyzer:
                 add(name, "service", f"body:{name} Core ({commit})", version=commit)
 
         for tech in extract_generic_tech(result.body):
-            add(tech.name, tech.categories[0] if tech.categories else "service", tech.evidence[0], tech.version)
+            add(
+                tech.name,
+                tech.categories[0] if tech.categories else "service",
+                tech.evidence[0],
+                tech.version,
+            )

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/cli.py

@@ -17,7 +17,13 @@ from rich.table import Table
 
 from stackscan import __version__, theme
 from stackscan.analyzers import TechAnalyzer, brute_devices, summarize_edge
-from stackscan.config import NoSignaturesError, SourceError, SourceStore, build_matchers
+from stackscan.config import (
+    DEFAULT_SOURCE_URL,
+    NoSignaturesError,
+    SourceError,
+    SourceStore,
+    build_matchers,
+)
 from stackscan.net import GeoProvider, nmap_available
 from stackscan.render import render_banner, render_reports
 from stackscan.scan import ScanOptions, StageLog, scan_target, stage_total
@@ -61,7 +67,6 @@ def _build_scan_parser() -> argparse.ArgumentParser:
 
     parser.add_argument("targets", nargs="*", help="Target URLs or hostnames.")
     parser.add_argument("-f", "--file", dest="file", type=Path, help="File with targets, one/line.")
-    parser.add_argument("--sigdb", dest="sigdb", help="Explicit .sigdb path (overrides default).")
     parser.add_argument("--timeout", type=float, default=DEFAULT_TIMEOUT, help="Request timeout.")
     parser.add_argument("--user-agent", dest="user_agent", default=DEFAULT_USER_AGENT)
     parser.add_argument("--insecure", action="store_true", help="Disable TLS verification.")
@@ -386,7 +391,7 @@ async def _run_scans(args: argparse.Namespace) -> list[ScanReport]:
         return []
     targets = _dedupe([normalize_url(target) for target in raw_targets])
     matchers = build_matchers(
-        args.sigdb, use_sources=not args.no_sources, use_builtin=not args.no_builtin
+        None, use_sources=not args.no_sources, use_builtin=not args.no_builtin
     )
     analyzer = TechAnalyzer(matchers)
     geo = GeoProvider(args.geoip_db)
@@ -445,7 +450,7 @@ async def _run_scans(args: argparse.Namespace) -> list[ScanReport]:
     ) -> ScanReport:
         nonlocal completed
         if args.verbose == 1:
-            err_console.print(f"[{theme.MUTED}][*] Starting scan of {target}...[/]")
+            err_console.print(f"[{theme.MUTED}]{_glyphs().run} Starting scan of {target}...[/]")
 
         stage_log: StageLog | None = None
         if staged and progress_obj is not None and task_id is not None:
@@ -485,7 +490,7 @@ async def _run_scans(args: argparse.Namespace) -> list[ScanReport]:
         summary_str = ", ".join(findings)
         if args.verbose == 1:
             err_console.print(
-                f"[{theme.SUCCESS}][+][/] [{completed}/{total_targets}] Finished {target} in {_fmt_elapsed(report.elapsed or 0)} ({summary_str})",
+                f"[{theme.SUCCESS}]{_glyphs().ok}[/] [{completed}/{total_targets}] Finished {target} in {_fmt_elapsed(report.elapsed or 0)} ({summary_str})",
                 highlight=False,
             )
 
@@ -746,17 +751,39 @@ def _brute_subject(cameras: int, devices: int) -> str:
     return " and ".join(parts) if parts else "device(s)"
 
 
+def _prompt_line(console: Console) -> str | None:
+    console.print("> ", end="")
+    try:
+        console.file.flush()
+    except Exception:
+        pass
+    tty = None
+    try:
+        tty = open("/dev/tty", encoding="utf-8", errors="replace")
+    except OSError:
+        tty = None
+    stream = tty if tty is not None else sys.stdin
+    try:
+        line = stream.readline()
+    except (OSError, EOFError, KeyboardInterrupt):
+        line = ""
+    finally:
+        if tty is not None:
+            tty.close()
+    return line if line else None
+
+
 def _prompt_brute(cameras: int, devices: int, console: Console) -> bool:
     console.print(
-        f"[{theme.WARN}][?][/] Parser found {_brute_subject(cameras, devices)}."
-        " Try to brute? Y(Yes)/N(No)",
+        f"[{theme.WARN}]{_glyphs().ask}[/] Parser found {_brute_subject(cameras, devices)}."
+        " Try to brute? [Y]es / [N]o",
         highlight=False,
     )
     while True:
-        try:
-            answer = input("> ").strip().lower()
-        except (EOFError, KeyboardInterrupt):
+        answer = _prompt_line(console)
+        if answer is None:
             return False
+        answer = answer.strip().lower()
         if answer in ("y", "yes"):
             return True
         if answer in ("n", "no", ""):
@@ -902,11 +929,21 @@ def _sigdb_command(argv: list[str]) -> int:
         "-h", "--help", action=_HelpAction, nargs=0, help="Show this help message and exit."
     )
     sub = parser.add_subparsers(dest="action", required=True)
-    add_p = sub.add_parser("add", help="Add a signature source (http URL or git repo).")
-    add_p.add_argument("url", help="Source URL: .sigdb, rules JSON, or a git repository.")
+    add_p = sub.add_parser("add", help="Add a signature source (local path, web URL, or git repo).")
+    add_p.add_argument(
+        "url",
+        nargs="?",
+        help="Source: a database base URL/dir/git repo (with sigdb/ and stackscan/),"
+        " or a direct .sigdb/rules path or manifest.json."
+        f" Defaults to {DEFAULT_SOURCE_URL}.",
+    )
     sub.add_parser("list", help="List configured sources.")
     remove_p = sub.add_parser("remove", help="Remove a source by id or url.")
     remove_p.add_argument("key", help="Source id or url.")
+    enable_p = sub.add_parser("enable", help="Enable a source by id or url.")
+    enable_p.add_argument("key", help="Source id or url.")
+    disable_p = sub.add_parser("disable", help="Disable a source without removing it.")
+    disable_p.add_argument("key", help="Source id or url.")
     update_p = sub.add_parser("update", help="Re-fetch and recompile a source (or all).")
     update_p.add_argument("key", nargs="?", help="Source id or url; omit to update all.")
     args = parser.parse_args(argv)
@@ -914,9 +951,13 @@ def _sigdb_command(argv: list[str]) -> int:
     console = Console()
     try:
         if args.action == "add":
-            source = store.add(args.url)
+            url = args.url or DEFAULT_SOURCE_URL
+            source = store.add(url)
+            extras = [name for name, val in (("cve", source.cve), ("subdomains", source.subdomains)) if val]
+            suffix = f" (+{', '.join(extras)})" if extras else ""
             console.print(
-                f"[green]Added[/green] {args.url} ([cyan]{source.kind}[/cyan], id={source.id}) -> {source.path}"
+                f"[green]Added[/green] {url} ([cyan]{source.kind}[/cyan], id={source.id})"
+                f" -> {source.path}{suffix}"
             )
             return 0
         if args.action == "list":
@@ -927,11 +968,17 @@ def _sigdb_command(argv: list[str]) -> int:
             table = Table(title="Signature Sources")
             table.add_column("ID", style="cyan")
             table.add_column("Kind")
+            table.add_column("State")
             table.add_column("URL", overflow="fold")
             table.add_column("Added")
             for source in sources:
                 added = datetime.fromtimestamp(source.added, UTC).strftime("%Y-%m-%d")
-                table.add_row(source.id, source.kind, source.url, added)
+                state = (
+                    f"[{theme.SUCCESS}]enabled[/]"
+                    if source.enabled
+                    else f"[{theme.MUTED}]disabled[/]"
+                )
+                table.add_row(source.id, source.kind, state, source.url, added)
             console.print(table)
             return 0
         if args.action == "remove":
@@ -941,6 +988,13 @@ def _sigdb_command(argv: list[str]) -> int:
                 return 0
             console.print(f"[yellow]No source matched[/yellow] {args.key}")
             return 1
+        if args.action in ("enable", "disable"):
+            enabled = args.action == "enable"
+            if store.set_enabled(args.key, enabled):
+                console.print(f"[green]{args.action.title()}d[/green] {args.key}")
+                return 0
+            console.print(f"[yellow]No source matched[/yellow] {args.key}")
+            return 1
         if args.action == "update":
             refreshed = store.update(args.key)
             if not refreshed:

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/config/__init__.py

@@ -5,10 +5,11 @@ from stackscan.config.sigdb_loader import (
     builtin_sigdb_path,
     resolve_sigdb_paths,
 )
-from stackscan.config.sources import Source, SourceError, SourceStore
+from stackscan.config.sources import DEFAULT_SOURCE_URL, Source, SourceError, SourceStore
 
 __all__ = [
     "DEFAULT_SIGDB_PATH",
+    "DEFAULT_SOURCE_URL",
     "NoSignaturesError",
     "Source",
     "SourceError",

{stackscan-2.6.0 → stackscan-2.6.3}/src/stackscan/config/sigdb_loader.py

@@ -69,6 +69,7 @@ def build_matchers(
     paths = resolve_sigdb_paths(explicit, use_sources=use_sources, use_builtin=use_builtin)
     if not paths:
         raise NoSignaturesError(
-            f"No signature database found. Provide --sigdb PATH, install one at {DEFAULT_SIGDB_PATH}, or add a source with 'stackscan sigdb add <url>'."
+            "No signature database found. Add one with 'stackscan sigdb add'"
+            " (defaults to https://db.imalive.lol/sigdb)."
         )
     return [_load_matcher(path) for path in paths]