diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 780ad1b26e..55fccf323f 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -7,24 +7,18 @@ assignees: ""
---
**Describe the bug**
-What happened?
-
-**Expected behavior**
-What was supposed to happen?
+What happened vs what was expected?
**BBOT Command**
Example: `bbot -m httpx -t evilcorp.com`
**OS, BBOT Installation Method + Version**
Example: `OS: Arch Linux, Installation method: pip, BBOT version: 1.0.3.545`
-Note: You can get the bbot version with `bbot --version`
-Note: Windows is **not** supported. We have successfully used BBOT on Docker Desktop in the past, however Windows is highly problematic so if you choose this path you are on your own.
+Note: You can get the BBOT version with `bbot --version`
+Note: BBOT is designed from the ground up to run on Linux. Windows and MacOS are not officially supported. If you are using one of these platforms, it's recommended to use Docker.
**BBOT Config**
-Attach your BBOT config (`bbot --current-config`).
-
-**Logs**
-If possible, produce the bug while `--debug` is enabled, and attach the relevant parts of `~/.bbot/logs/bbot.debug.log`
+Attach your full BBOT preset (to show it, add `--current-preset` to your BBOT command).
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
+**Logs/Screenshots**
+If possible, produce the bug while `--debug` is enabled, and attach the relevant parts of the output.
diff --git a/.github/workflows/distro_tests.yml b/.github/workflows/distro_tests.yml
index 21f40c8133..7cee967d7d 100644
--- a/.github/workflows/distro_tests.yml
+++ b/.github/workflows/distro_tests.yml
@@ -53,6 +53,8 @@ jobs:
python3.11 -m pipx ensurepath
pipx install poetry
"
+ - name: Set OS Environment Variable
+ run: echo "OS_NAME=${{ matrix.os }}" | sed 's|[:/]|_|g' >> $GITHUB_ENV
- name: Run tests
run: |
export PATH="$HOME/.local/bin:$PATH"
@@ -66,5 +68,5 @@ jobs:
if: always()
uses: actions/upload-artifact@v4
with:
- name: pytest-debug-logs-${{ matrix.os }}
- path: pytest_debug_${{ matrix.os }}.log
+ name: pytest-debug-logs-${{ env.OS_NAME }}
+ path: pytest_debug.log
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index c0443b350f..40a8c27287 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,4 +1,4 @@
-name: Tests (Python Versions)
+name: Tests
on:
push:
branches:
@@ -24,6 +24,8 @@ jobs:
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
+ - name: Set Python Version Environment Variable
+ run: echo "PYTHON_VERSION=${{ matrix.python-version }}" | sed 's|[:/]|_|g' >> $GITHUB_ENV
- name: Install dependencies
run: |
pip install poetry
@@ -39,8 +41,8 @@ jobs:
if: always()
uses: actions/upload-artifact@v4
with:
- name: pytest-debug-logs-${{ matrix.python-version }}
- path: pytest_debug_${{ matrix.python-version }}.log
+ name: pytest-debug-logs-${{ env.PYTHON_VERSION }}
+ path: pytest_debug.log
- name: Upload Code Coverage
uses: codecov/codecov-action@v5
with:
diff --git a/bbot/cli.py b/bbot/cli.py
index 943f7727ef..7f1e91c72e 100755
--- a/bbot/cli.py
+++ b/bbot/cli.py
@@ -161,8 +161,11 @@ async def _main():
all_modules = list(preset.module_loader.preloaded())
scan.helpers.depsinstaller.force_deps = True
succeeded, failed = await scan.helpers.depsinstaller.install(*all_modules)
- log.info("Finished installing module dependencies")
- return False if failed else True
+ if failed:
+ log.hugewarning(f"Failed to install dependencies for the following modules: {', '.join(failed)}")
+ return False
+ log.hugesuccess(f"Successfully installed dependencies for the following modules: {', '.join(succeeded)}")
+ return True
scan_name = str(scan.name)
@@ -180,13 +183,14 @@ async def _main():
if sys.stdin.isatty():
# warn if any targets belong directly to a cloud provider
- for event in scan.target.seeds.events:
- if event.type == "DNS_NAME":
- cloudcheck_result = scan.helpers.cloudcheck(event.host)
- if cloudcheck_result:
- scan.hugewarning(
- f'YOUR TARGET CONTAINS A CLOUD DOMAIN: "{event.host}". You\'re in for a wild ride!'
- )
+ if not scan.preset.strict_scope:
+ for event in scan.target.seeds.events:
+ if event.type == "DNS_NAME":
+ cloudcheck_result = scan.helpers.cloudcheck(event.host)
+ if cloudcheck_result:
+ scan.hugewarning(
+ f'YOUR TARGET CONTAINS A CLOUD DOMAIN: "{event.host}". You\'re in for a wild ride!'
+ )
if not options.yes:
log.hugesuccess(f"Scan ready. Press enter to execute {scan.name}")
diff --git a/bbot/core/helpers/depsinstaller/installer.py b/bbot/core/helpers/depsinstaller/installer.py
index aa7528ca64..5bea5f508a 100644
--- a/bbot/core/helpers/depsinstaller/installer.py
+++ b/bbot/core/helpers/depsinstaller/installer.py
@@ -96,7 +96,7 @@ def __init__(self, parent_helper):
self.ensure_root_lock = Lock()
async def install(self, *modules):
- self.install_core_deps()
+ await self.install_core_deps()
succeeded = []
failed = []
try:
@@ -386,13 +386,14 @@ def ensure_root(self, message=""):
else:
log.warning("Incorrect password")
- def install_core_deps(self):
+ async def install_core_deps(self):
to_install = set()
to_install_friendly = set()
playbook = []
self._install_sudo_askpass()
# ensure tldextract data is cached
self.parent_helper.tldextract("evilcorp.co.uk")
+ # install any missing commands
for command, package_name_or_playbook in self.CORE_DEPS.items():
if not self.parent_helper.which(command):
to_install_friendly.add(command)
@@ -400,6 +401,19 @@ def install_core_deps(self):
to_install.add(package_name_or_playbook)
else:
playbook.extend(package_name_or_playbook)
+ # install ansible community.general collection
+ if not self.setup_status.get("ansible:community.general", False):
+ log.info("Installing Ansible Community General Collection")
+ try:
+ command = ["ansible-galaxy", "collection", "install", "community.general"]
+ await self.parent_helper.run(command, check=True)
+ self.setup_status["ansible:community.general"] = True
+ log.info("Successfully installed Ansible Community General Collection")
+ except CalledProcessError as err:
+ log.warning(
+ f"Failed to install Ansible Community.General Collection (return code {err.returncode}): {err.stderr}"
+ )
+ # construct ansible playbook
if to_install:
playbook.append(
{
@@ -408,6 +422,7 @@ def install_core_deps(self):
"become": True,
}
)
+ # run playbook
if playbook:
log.info(f"Installing core BBOT dependencies: {','.join(sorted(to_install_friendly))}")
self.ensure_root()
diff --git a/bbot/core/helpers/regex.py b/bbot/core/helpers/regex.py
index 97d8cbe6ec..044684b83e 100644
--- a/bbot/core/helpers/regex.py
+++ b/bbot/core/helpers/regex.py
@@ -31,6 +31,10 @@ async def search(self, compiled_regex, *args, **kwargs):
self.ensure_compiled_regex(compiled_regex)
return await self.parent_helper.run_in_executor(compiled_regex.search, *args, **kwargs)
+ async def sub(self, compiled_regex, *args, **kwargs):
+ self.ensure_compiled_regex(compiled_regex)
+ return await self.parent_helper.run_in_executor(compiled_regex.sub, *args, **kwargs)
+
async def findall(self, compiled_regex, *args, **kwargs):
self.ensure_compiled_regex(compiled_regex)
return await self.parent_helper.run_in_executor(compiled_regex.findall, *args, **kwargs)
diff --git a/bbot/core/helpers/web/client.py b/bbot/core/helpers/web/client.py
index 28788e04d9..737a2f9dcb 100644
--- a/bbot/core/helpers/web/client.py
+++ b/bbot/core/helpers/web/client.py
@@ -83,6 +83,7 @@ def build_request(self, *args, **kwargs):
# TODO: re-enable this
if self._target.in_scope(str(request.url)):
for hk, hv in self._web_config.get("http_headers", {}).items():
+ hv = str(hv)
# don't clobber headers
if hk not in request.headers:
request.headers[hk] = hv
diff --git a/bbot/core/helpers/web/web.py b/bbot/core/helpers/web/web.py
index 8de7a64f17..23f7a8c607 100644
--- a/bbot/core/helpers/web/web.py
+++ b/bbot/core/helpers/web/web.py
@@ -232,7 +232,7 @@ async def download(self, url, **kwargs):
if success:
return filename
- async def wordlist(self, path, lines=None, **kwargs):
+ async def wordlist(self, path, lines=None, zip=False, zip_filename=None, **kwargs):
"""
Asynchronous function for retrieving wordlists, either from a local path or a URL.
Allows for optional line-based truncation and caching. Returns the full path of the wordlist
@@ -242,6 +242,9 @@ async def wordlist(self, path, lines=None, **kwargs):
path (str): The local or remote path of the wordlist.
lines (int, optional): Number of lines to read from the wordlist.
If specified, will return a truncated wordlist with this many lines.
+ zip (bool, optional): Whether to unzip the file after downloading. Defaults to False.
+ zip_filename (str, optional): The name of the file to extract from the ZIP archive.
+ Required if zip is True.
cache_hrs (float, optional): Number of hours to cache the downloaded wordlist.
Defaults to 720 hours (30 days) for remote wordlists.
**kwargs: Additional keyword arguments to pass to the 'download' function for remote wordlists.
@@ -259,6 +262,8 @@ async def wordlist(self, path, lines=None, **kwargs):
Fetching and truncating to the first 100 lines
>>> wordlist_path = await self.helpers.wordlist("/root/rockyou.txt", lines=100)
"""
+ import zipfile
+
if not path:
raise WordlistError(f"Invalid wordlist: {path}")
if "cache_hrs" not in kwargs:
@@ -272,6 +277,18 @@ async def wordlist(self, path, lines=None, **kwargs):
if not filename.is_file():
raise WordlistError(f"Unable to find wordlist at {path}")
+ if zip:
+ if not zip_filename:
+ raise WordlistError("zip_filename must be specified when zip is True")
+ try:
+ with zipfile.ZipFile(filename, "r") as zip_ref:
+ if zip_filename not in zip_ref.namelist():
+ raise WordlistError(f"File {zip_filename} not found in the zip archive {filename}")
+ zip_ref.extract(zip_filename, filename.parent)
+ filename = filename.parent / zip_filename
+ except Exception as e:
+ raise WordlistError(f"Error unzipping file {filename}: {e}")
+
if lines is None:
return filename
else:
@@ -336,6 +353,7 @@ async def curl(self, *args, **kwargs):
ignore_bbot_global_settings = kwargs.get("ignore_bbot_global_settings", False)
if ignore_bbot_global_settings:
+ http_timeout = 20 # setting 20 as a worse-case setting
log.debug("ignore_bbot_global_settings enabled. Global settings will not be applied")
else:
http_timeout = self.parent_helper.web_config.get("http_timeout", 20)
@@ -349,12 +367,12 @@ async def curl(self, *args, **kwargs):
for hk, hv in self.web_config.get("http_headers", {}).items():
headers[hk] = hv
- # add the timeout
- if "timeout" not in kwargs:
- timeout = http_timeout
+ # add the timeout
+ if "timeout" not in kwargs:
+ timeout = http_timeout
- curl_command.append("-m")
- curl_command.append(str(timeout))
+ curl_command.append("-m")
+ curl_command.append(str(timeout))
for k, v in headers.items():
if isinstance(v, list):
@@ -400,7 +418,7 @@ async def curl(self, *args, **kwargs):
if raw_body:
curl_command.append("-d")
curl_command.append(raw_body)
-
+ log.verbose(f"Running curl command: {curl_command}")
output = (await self.parent_helper.run(curl_command)).stdout
return output
diff --git a/bbot/modules/badsecrets.py b/bbot/modules/badsecrets.py
index dd5784ca29..c7ec6e9761 100644
--- a/bbot/modules/badsecrets.py
+++ b/bbot/modules/badsecrets.py
@@ -17,7 +17,7 @@ class badsecrets(BaseModule):
options_desc = {
"custom_secrets": "Include custom secrets loaded from a local file",
}
- deps_pip = ["badsecrets~=0.6.21"]
+ deps_pip = ["badsecrets~=0.9.29"]
async def setup(self):
self.custom_secrets = None
diff --git a/bbot/modules/deadly/ffuf.py b/bbot/modules/deadly/ffuf.py
index 0351fe93aa..e21aebe0cf 100644
--- a/bbot/modules/deadly/ffuf.py
+++ b/bbot/modules/deadly/ffuf.py
@@ -17,6 +17,7 @@ class ffuf(BaseModule):
"lines": 5000,
"max_depth": 0,
"extensions": "",
+ "ignore_case": False,
}
options_desc = {
@@ -24,6 +25,7 @@ class ffuf(BaseModule):
"lines": "take only the first N lines from the wordlist when finding directories",
"max_depth": "the maximum directory depth to attempt to solve",
"extensions": "Optionally include a list of extensions to extend the keyword with (comma separated)",
+ "ignore_case": "Only put lowercase words into the wordlist",
}
deps_common = ["ffuf"]
@@ -301,11 +303,12 @@ async def execute_ffuf(
]
if len(pre_emit_temp_canary) == 0:
yield found_json
+
else:
- self.warning(
- "Baseline changed mid-scan. This is probably due to a WAF turning on a block against you."
+ self.verbose(
+ f"Would have reported URL [{found_json['url']}], but baseline check failed. This could be due to a WAF turning on mid-scan, or an unusual web server configuration."
)
- self.warning(f"Aborting the current run against [{url}]")
+ self.verbose(f"Aborting the current run against [{url}]")
return
yield found_json
@@ -328,7 +331,8 @@ def generate_templist(self, prefix=None):
return self.helpers.tempfile(virtual_file, pipe=False), len(virtual_file)
def generate_wordlist(self, wordlist_file):
- wordlist = []
+ wordlist_set = set() # Use a set to avoid duplicates
+ ignore_case = self.config.get("ignore_case", False) # Get the ignore_case option
for line in self.helpers.read_file(wordlist_file):
line = line.strip()
if not line:
@@ -339,5 +343,7 @@ def generate_wordlist(self, wordlist_file):
if any(x in line for x in self.banned_characters):
self.debug(f"Skipping adding [{line}] to wordlist because it has a banned character")
continue
- wordlist.append(line)
- return wordlist
+ if ignore_case:
+ line = line.lower() # Convert to lowercase if ignore_case is enabled
+ wordlist_set.add(line) # Add to set to handle duplicates
+ return list(wordlist_set) # Convert set back to list before returning
diff --git a/bbot/modules/deadly/nuclei.py b/bbot/modules/deadly/nuclei.py
index d5370fff85..b973c714bc 100644
--- a/bbot/modules/deadly/nuclei.py
+++ b/bbot/modules/deadly/nuclei.py
@@ -15,7 +15,7 @@ class nuclei(BaseModule):
}
options = {
- "version": "3.3.8",
+ "version": "3.3.9",
"tags": "",
"templates": "",
"severity": "",
diff --git a/bbot/modules/ffuf_shortnames.py b/bbot/modules/ffuf_shortnames.py
index 23d6ac6e33..2a4cb8d9cb 100644
--- a/bbot/modules/ffuf_shortnames.py
+++ b/bbot/modules/ffuf_shortnames.py
@@ -9,7 +9,6 @@
class ffuf_shortnames(ffuf):
watched_events = ["URL_HINT"]
produced_events = ["URL_UNVERIFIED"]
- deps_pip = ["numpy"]
flags = ["aggressive", "active", "iis-shortnames", "web-thorough"]
meta = {
"description": "Use ffuf in combination IIS shortnames",
@@ -18,7 +17,6 @@ class ffuf_shortnames(ffuf):
}
options = {
- "wordlist": "", # default is defined within setup function
"wordlist_extensions": "", # default is defined within setup function
"max_depth": 1,
"version": "2.0.0",
@@ -26,11 +24,11 @@ class ffuf_shortnames(ffuf):
"ignore_redirects": True,
"find_common_prefixes": False,
"find_delimiters": True,
+ "find_subwords": False,
"max_predictions": 250,
}
options_desc = {
- "wordlist": "Specify wordlist to use when finding directories",
"wordlist_extensions": "Specify wordlist to use when making extension lists",
"max_depth": "the maximum directory depth to attempt to solve",
"version": "ffuf version",
@@ -38,21 +36,26 @@ class ffuf_shortnames(ffuf):
"ignore_redirects": "Explicitly ignore redirects (301,302)",
"find_common_prefixes": "Attempt to automatically detect common prefixes and make additional ffuf runs against them",
"find_delimiters": "Attempt to detect common delimiters and make additional ffuf runs against them",
+ "find_subwords": "Attempt to detect subwords and make additional ffuf runs against them",
"max_predictions": "The maximum number of predictions to generate per shortname prefix",
}
+ deps_pip = ["numpy"]
deps_common = ["ffuf"]
-
in_scope_only = True
- def generate_templist(self, prefix, shortname_type):
- virtual_file = []
+ supplementary_words = ["html", "ajax", "xml", "json", "api"]
- for prediction, score in self.predict(prefix, self.max_predictions, model=shortname_type):
- self.debug(f"Got prediction: [{prediction}] from prefix [{prefix}] with score [{score}]")
- virtual_file.append(prediction)
- virtual_file.append(self.canary)
- return self.helpers.tempfile(virtual_file, pipe=False), len(virtual_file)
+ def generate_templist(self, hint, shortname_type):
+ virtual_file = set() # Use a set to avoid duplicates
+
+ for prediction, score in self.predict(hint, self.max_predictions, model=shortname_type):
+ prediction_lower = prediction.lower() # Convert to lowercase
+ self.debug(f"Got prediction: [{prediction_lower}] from prefix [{hint}] with score [{score}]")
+ virtual_file.add(prediction_lower) # Add to set to ensure uniqueness
+
+ virtual_file.add(self.canary.lower()) # Ensure canary is also lowercase
+ return self.helpers.tempfile(list(virtual_file), pipe=False), len(virtual_file)
def predict(self, prefix, n=25, model="endpoint"):
predictor_name = f"{model}_predictor"
@@ -92,6 +95,7 @@ async def setup(self):
self.wordlist_extensions = await self.helpers.wordlist(wordlist_extensions)
self.ignore_redirects = self.config.get("ignore_redirects")
self.max_predictions = self.config.get("max_predictions")
+ self.find_subwords = self.config.get("find_subwords")
class MinimalWordPredictor:
def __init__(self):
@@ -116,10 +120,11 @@ def find_class(self, module, name):
return MinimalWordPredictor
return super().find_class(module, name)
- endpoint_model = await self.helpers.download(
+ self.info("Loading ffuf_shortnames prediction models, could take a while if not cached")
+ endpoint_model = await self.helpers.wordlist(
"https://raw.githubusercontent.com/blacklanternsecurity/wordpredictor/refs/heads/main/trained_models/endpoints.bin"
)
- directory_model = await self.helpers.download(
+ directory_model = await self.helpers.wordlist(
"https://raw.githubusercontent.com/blacklanternsecurity/wordpredictor/refs/heads/main/trained_models/directories.bin"
)
@@ -133,8 +138,24 @@ def find_class(self, module, name):
unpickler = CustomUnpickler(f)
self.directory_predictor = unpickler.load()
+ self.subword_list = []
+ if self.find_subwords:
+ self.debug("Acquiring ffuf_shortnames subword list")
+ subwords = await self.helpers.wordlist(
+ "https://raw.githubusercontent.com/nltk/nltk_data/refs/heads/gh-pages/packages/corpora/words.zip",
+ zip=True,
+ zip_filename="words/en",
+ )
+ with open(subwords, "r") as f:
+ subword_list_content = f.readlines()
+ self.subword_list = {word.lower().strip() for word in subword_list_content if 3 <= len(word.strip()) <= 5}
+ self.debug(f"Created subword_list with {len(self.subword_list)} words")
+ self.subword_list = self.subword_list.union(self.supplementary_words)
+ self.debug(f"Extended subword_list with supplementary words, total size: {len(self.subword_list)}")
+
self.per_host_collection = {}
self.shortname_to_event = {}
+
return True
def build_extension_list(self, event):
@@ -159,10 +180,20 @@ def find_delimiter(self, hint):
return None
async def filter_event(self, event):
+ if "iis-magic-url" in event.tags:
+ return False, "iis-magic-url URL_HINTs are not solvable by ffuf_shortnames"
if event.parent.type != "URL":
return False, "its parent event is not of type URL"
return True
+ def find_subword(self, word):
+ for i in range(len(word), 2, -1): # Start from full length down to 3 characters
+ candidate = word[:i]
+ if candidate in self.subword_list:
+ leftover = word[i:]
+ return candidate, leftover
+ return None, word # No match found, return None and the original word
+
async def handle_event(self, event):
filename_hint = re.sub(r"~\d", "", event.parsed_url.path.rsplit(".", 1)[0].split("/")[-1]).lower()
@@ -256,6 +287,31 @@ async def handle_event(self, event):
context=f'{{module}} brute-forced {ext.upper()} files with detected prefix "{ffuf_prefix}" and found {{event.type}}: {{event.data}}',
)
+ if self.config.get("find_subwords"):
+ subword, suffix = self.find_subword(filename_hint)
+ if subword:
+ if "shortname-directory" in event.tags:
+ tempfile, tempfile_len = self.generate_templist(suffix, "directory")
+ async for r in self.execute_ffuf(tempfile, root_url, prefix=subword, exts=["/"]):
+ await self.emit_event(
+ r["url"],
+ "URL_UNVERIFIED",
+ parent=event,
+ tags=[f"status-{r['status']}"],
+ context=f'{{module}} brute-forced directories with detected subword "{subword}" and found {{event.type}}: {{event.data}}',
+ )
+ elif "shortname-endpoint" in event.tags:
+ for ext in used_extensions:
+ tempfile, tempfile_len = self.generate_templist(suffix, "endpoint")
+ async for r in self.execute_ffuf(tempfile, root_url, prefix=subword, suffix=f".{ext}"):
+ await self.emit_event(
+ r["url"],
+ "URL_UNVERIFIED",
+ parent=event,
+ tags=[f"status-{r['status']}"],
+ context=f'{{module}} brute-forced {ext.upper()} files with detected subword "{subword}" and found {{event.type}}: {{event.data}}',
+ )
+
async def finish(self):
if self.config.get("find_common_prefixes"):
per_host_collection = dict(self.per_host_collection)
diff --git a/bbot/modules/generic_ssrf.py b/bbot/modules/generic_ssrf.py
index fb530a697d..6ccde510b9 100644
--- a/bbot/modules/generic_ssrf.py
+++ b/bbot/modules/generic_ssrf.py
@@ -154,6 +154,12 @@ class generic_ssrf(BaseModule):
produced_events = ["VULNERABILITY"]
flags = ["active", "aggressive", "web-thorough"]
meta = {"description": "Check for generic SSRFs", "created_date": "2022-07-30", "author": "@liquidsec"}
+ options = {
+ "skip_dns_interaction": False,
+ }
+ options_desc = {
+ "skip_dns_interaction": "Do not report DNS interactions (only HTTP interaction)",
+ }
in_scope_only = True
deps_apt = ["curl"]
@@ -163,7 +169,7 @@ async def setup(self):
self.interactsh_subdomain_tags = {}
self.parameter_subdomain_tags_map = {}
self.severity = None
- self.generic_only = self.config.get("generic_only", False)
+ self.skip_dns_interaction = self.config.get("skip_dns_interaction", False)
if self.scan.config.get("interactsh_disable", False) is False:
try:
@@ -191,6 +197,10 @@ async def handle_event(self, event):
await s.test(event)
async def interactsh_callback(self, r):
+ protocol = r.get("protocol").upper()
+ if protocol == "DNS" and self.skip_dns_interaction:
+ return
+
full_id = r.get("full-id", None)
subdomain_tag = full_id.split(".")[0]
@@ -204,24 +214,27 @@ async def interactsh_callback(self, r):
matched_severity = match[2]
matched_echoed_response = str(match[3])
- # Check if any SSRF parameter is in the DNS request
triggering_param = self.parameter_subdomain_tags_map.get(subdomain_tag, None)
description = f"Out-of-band interaction: [{matched_technique}]"
if triggering_param:
self.debug(f"Found triggering parameter: {triggering_param}")
description += f" [Triggering Parameter: {triggering_param}]"
- description += f" [{r.get('protocol').upper()}] Echoed Response: {matched_echoed_response}"
+ description += f" [{protocol}] Echoed Response: {matched_echoed_response}"
self.debug(f"Emitting event with description: {description}") # Debug the final description
+ event_type = "VULNERABILITY" if protocol == "HTTP" else "FINDING"
+ event_data = {
+ "host": str(matched_event.host),
+ "url": matched_event.data,
+ "description": description,
+ }
+ if protocol == "HTTP":
+ event_data["severity"] = matched_severity
+
await self.emit_event(
- {
- "severity": matched_severity,
- "host": str(matched_event.host),
- "url": matched_event.data,
- "description": description,
- },
- "VULNERABILITY",
+ event_data,
+ event_type,
matched_event,
context=f"{{module}} scanned {matched_event.data} and detected {{event.type}}: {matched_technique}",
)
@@ -241,7 +254,7 @@ async def cleanup(self):
async def finish(self):
if self.scan.config.get("interactsh_disable", False) is False:
- await self.helpers.sleep(2)
+ await self.helpers.sleep(5)
try:
for r in await self.interactsh_instance.poll():
await self.interactsh_callback(r)
diff --git a/bbot/modules/git.py b/bbot/modules/git.py
index 9a180bc11e..569aa0e489 100644
--- a/bbot/modules/git.py
+++ b/bbot/modules/git.py
@@ -5,7 +5,7 @@
class git(BaseModule):
watched_events = ["URL"]
- produced_events = ["FINDING"]
+ produced_events = ["FINDING", "CODE_REPOSITORY"]
flags = ["active", "safe", "web-basic", "code-enum"]
meta = {
"description": "Check for exposed .git repositories",
@@ -37,3 +37,10 @@ async def handle_event(self, event):
event,
context="{module} detected {event.type}: {description}",
)
+ await self.emit_event(
+ {"url": url.rstrip("config")},
+ "CODE_REPOSITORY",
+ event,
+ tags="git_directory",
+ context="{module} detected {event.type}: {description}",
+ )
diff --git a/bbot/modules/gitdumper.py b/bbot/modules/gitdumper.py
new file mode 100644
index 0000000000..ae977b2583
--- /dev/null
+++ b/bbot/modules/gitdumper.py
@@ -0,0 +1,270 @@
+import regex as re
+from pathlib import Path
+from subprocess import CalledProcessError
+from bbot.modules.base import BaseModule
+
+
+class gitdumper(BaseModule):
+ watched_events = ["CODE_REPOSITORY"]
+ produced_events = ["FILESYSTEM"]
+ flags = ["passive", "safe", "slow", "code-enum"]
+ meta = {
+ "description": "Download a leaked .git folder recursively or by fuzzing common names",
+ "created_date": "2025-02-11",
+ "author": "@domwhewell-sage",
+ }
+ options = {
+ "output_folder": "",
+ "fuzz_tags": False,
+ "max_semanic_version": 10,
+ }
+ options_desc = {
+ "output_folder": "Folder to download repositories to",
+ "fuzz_tags": "Fuzz for common git tag names (v0.0.1, 0.0.2, etc.) up to the max_semanic_version",
+ "max_semanic_version": "Maximum version number to fuzz for (default < v10.10.10)",
+ }
+
+ scope_distance_modifier = 2
+
+ async def setup(self):
+ self.urls_downloaded = set()
+ output_folder = self.config.get("output_folder")
+ if output_folder:
+ self.output_dir = Path(output_folder) / "git_repos"
+ else:
+ self.output_dir = self.scan.home / "git_repos"
+ self.helpers.mkdir(self.output_dir)
+ self.unsafe_regex = self.helpers.re.compile(r"^\s*fsmonitor|sshcommand|askpass|editor|pager", re.IGNORECASE)
+ self.ref_regex = self.helpers.re.compile(r"ref: refs/heads/([a-zA-Z\d_-]+)")
+ self.obj_regex = self.helpers.re.compile(r"[a-f0-9]{40}")
+ self.pack_regex = self.helpers.re.compile(r"pack-([a-f0-9]{40})\.pack")
+ self.git_files = [
+ "HEAD",
+ "description",
+ "config",
+ "COMMIT_EDITMSG",
+ "index",
+ "packed-refs",
+ "info/refs",
+ "info/exclude",
+ "refs/stash",
+ "refs/wip/index/refs/heads/master",
+ "refs/wip/wtree/refs/heads/master",
+ "logs/HEAD",
+ "objects/info/packs",
+ ]
+ self.info("Compiling fuzz list with common branch names")
+ branch_names = [
+ "bugfix",
+ "daily",
+ "dev",
+ "develop",
+ "development",
+ "feat",
+ "feature",
+ "fix",
+ "hotfix",
+ "integration",
+ "issue",
+ "main",
+ "master",
+ "ng",
+ "prod",
+ "production",
+ "qa",
+ "quickfix",
+ "release",
+ "stable",
+ "stage",
+ "staging",
+ "test",
+ "testing",
+ "wip",
+ ]
+ url_patterns = [
+ "logs/refs/heads/{branch}",
+ "logs/refs/remotes/origin/{branch}",
+ "refs/remotes/origin/{branch}",
+ "refs/heads/{branch}",
+ ]
+ for branch in branch_names:
+ for pattern in url_patterns:
+ self.git_files.append(pattern.format(branch=branch))
+ self.fuzz_tags = self.config.get("fuzz_tags", "10")
+ self.max_semanic_version = self.config.get("max_semanic_version", "10")
+ if self.fuzz_tags:
+ self.info("Adding symantec version tags to fuzz list")
+ for major in range(self.max_semanic_version):
+ for minor in range(self.max_semanic_version):
+ for patch in range(self.max_semanic_version):
+ self.verbose(f"{major}.{minor}.{patch}")
+ self.git_files.append(f"refs/tags/{major}.{minor}.{patch}")
+ self.verbose(f"v{major}.{minor}.{patch}")
+ self.git_files.append(f"refs/tags/v{major}.{minor}.{patch}")
+ else:
+ self.info("Adding symantec version tags to fuzz list (v0.0.1, 0.0.1, v1.0.0, 1.0.0)")
+ for path in ["refs/tags/v0.0.1", "refs/tags/0.0.1", "refs/tags/v1.0.0", "refs/tags/1.0.0"]:
+ self.git_files.append(path)
+ return await super().setup()
+
+ async def filter_event(self, event):
+ if event.type == "CODE_REPOSITORY":
+ if "git-directory" not in event.tags:
+ return False, "event is not a leaked .git directory"
+ return True
+
+ async def handle_event(self, event):
+ repo_url = event.data.get("url")
+ self.info(f"Processing leaked .git directory at {repo_url}")
+ repo_folder = self.output_dir / self.helpers.tagify(repo_url)
+ self.helpers.mkdir(repo_folder)
+ dir_listing = await self.directory_listing_enabled(repo_url)
+ if dir_listing:
+ urls = await self.recursive_dir_list(dir_listing)
+ result = await self.download_files(urls, repo_folder)
+ else:
+ result = await self.git_fuzz(repo_url, repo_folder)
+ if result:
+ await self.sanitize_config(repo_folder)
+ await self.git_checkout(repo_folder)
+ codebase_event = self.make_event({"path": str(repo_folder)}, "FILESYSTEM", tags=["git"], parent=event)
+ await self.emit_event(
+ codebase_event,
+ context=f"{{module}} cloned git repo at {repo_url} to {{event.type}}: {str(repo_folder)}",
+ )
+ else:
+ self.helpers.rm_rf(repo_folder)
+
+ async def directory_listing_enabled(self, repo_url):
+ response = await self.helpers.request(repo_url)
+ if "Index of" in getattr(response, "text", ""):
+ self.info(f"Directory listing enabled at {repo_url}")
+ return response
+ return None
+
+ async def recursive_dir_list(self, dir_listing):
+ file_list = []
+ soup = self.helpers.beautifulsoup(dir_listing.text, "html.parser")
+ links = soup.find_all("a")
+ for link in links:
+ href = link["href"]
+ if href == "../" or href == "/":
+ continue
+ if href.endswith("/"):
+ folder_url = self.helpers.urljoin(str(dir_listing.url), href)
+ response = await self.helpers.request(folder_url)
+ if getattr(response, "status_code", 0) == 200:
+ file_list.extend(await self.recursive_dir_list(response))
+ else:
+ file_url = self.helpers.urljoin(str(dir_listing.url), href)
+ # Ensure the file is in the same domain as the directory listing
+ if file_url.startswith(str(dir_listing.url)):
+ url = self.helpers.urlparse(file_url)
+ file_list.append(url)
+ return file_list
+
+ async def git_fuzz(self, repo_url, repo_folder):
+ self.info("Directory listing not enabled, fuzzing common git files")
+ url_list = []
+ for file in self.git_files:
+ url_list.append(self.helpers.urlparse(self.helpers.urljoin(repo_url, file)))
+ result = await self.download_files(url_list, repo_folder)
+ if result:
+ await self.download_current_branch(repo_url, repo_folder)
+ await self.download_git_objects(repo_url, repo_folder)
+ await self.download_git_packs(repo_url, repo_folder)
+ return True
+ else:
+ return False
+
+ async def download_current_branch(self, repo_url, repo_folder):
+ for branch in await self.regex_files(self.ref_regex, file=repo_folder / ".git/HEAD"):
+ await self.download_files(
+ [self.helpers.urlparse(self.helpers.urljoin(repo_url, f"refs/heads/{branch}"))], repo_folder
+ )
+
+ async def download_git_objects(self, url, folder):
+ for object in await self.regex_files(self.obj_regex, folder=folder):
+ await self.download_object(object, url, folder)
+
+ async def download_git_packs(self, url, folder):
+ url_list = []
+ for sha1 in await self.regex_files(self.pack_regex, file=folder / ".git/objects/info/packs"):
+ url_list.append(self.helpers.urlparse(self.helpers.urljoin(url, f"objects/pack/pack-{sha1}.idx")))
+ url_list.append(self.helpers.urlparse(self.helpers.urljoin(url, f"objects/pack/pack-{sha1}.pack")))
+ if url_list:
+ await self.download_files(url_list, folder)
+
+ async def regex_files(self, regex, folder=Path(), file=Path(), files=[]):
+ results = []
+ if folder:
+ if folder.is_dir():
+ for file_path in folder.rglob("*"):
+ if file_path.is_file():
+ results.extend(await self.regex_file(regex, file_path))
+ if files:
+ for file in files:
+ results.extend(await self.regex_file(regex, file))
+ if file:
+ results.extend(await self.regex_file(regex, file))
+ return results
+
+ async def regex_file(self, regex, file=Path()):
+ if file.exists() and file.is_file():
+ with file.open("r", encoding="utf-8", errors="ignore") as file:
+ content = file.read()
+ matches = await self.helpers.re.findall(regex, content)
+ if matches:
+ return matches
+ return []
+
+ async def download_object(self, object, repo_url, repo_folder):
+ await self.download_files(
+ [self.helpers.urlparse(self.helpers.urljoin(repo_url, f"objects/{object[:2]}/{object[2:]}"))], repo_folder
+ )
+ output = await self.git_catfile(object, option="-p", folder=repo_folder)
+ for obj in await self.helpers.re.findall(self.obj_regex, output):
+ await self.download_object(obj, repo_url, repo_folder)
+
+ async def download_files(self, urls, folder):
+ for url in urls:
+ git_index = url.path.find(".git")
+ file_url = url.geturl()
+ filename = folder / url.path[git_index:]
+ self.helpers.mkdir(filename.parent)
+ if hash(str(file_url)) not in self.urls_downloaded:
+ self.verbose(f"Downloading {file_url} to {filename}")
+ await self.helpers.download(file_url, filename=filename, warn=False)
+ self.urls_downloaded.add(hash(str(file_url)))
+ if any(folder.rglob("*")):
+ return True
+ else:
+ self.debug(f"Unable to download git files to {folder}")
+ return False
+
+ async def sanitize_config(self, folder):
+ config_file = folder / ".git/config"
+ if config_file.exists():
+ with config_file.open("r", encoding="utf-8", errors="ignore") as file:
+ content = file.read()
+ sanitized = await self.helpers.re.sub(self.unsafe_regex, r"# \g<0>", content)
+ with config_file.open("w", encoding="utf-8") as file:
+ file.write(sanitized)
+
+ async def git_catfile(self, hash, option="-t", folder=Path()):
+ command = ["git", "cat-file", option, hash]
+ try:
+ output = await self.run_process(command, env={"GIT_TERMINAL_PROMPT": "0"}, cwd=folder, check=True)
+ except CalledProcessError:
+ return ""
+
+ return output.stdout
+
+ async def git_checkout(self, folder):
+ self.verbose(f"Running git checkout to reconstruct the git repository at {folder}")
+ command = ["git", "checkout", "."]
+ try:
+ await self.run_process(command, env={"GIT_TERMINAL_PROMPT": "0"}, cwd=folder, check=True)
+ except CalledProcessError as e:
+ # Still emit the event even if the checkout fails
+ self.debug(f"Error running git checkout in {folder}. STDERR: {repr(e.stderr)}")
diff --git a/bbot/modules/internal/excavate.py b/bbot/modules/internal/excavate.py
index ada3bda796..69a1a32be3 100644
--- a/bbot/modules/internal/excavate.py
+++ b/bbot/modules/internal/excavate.py
@@ -9,7 +9,7 @@
import bbot.core.helpers.regexes as bbot_regexes
from bbot.modules.base import BaseInterceptModule
from bbot.modules.internal.base import BaseInternalModule
-from urllib.parse import urlparse, urljoin, parse_qs, urlunparse
+from urllib.parse import urlparse, urljoin, parse_qs, urlunparse, urldefrag
def find_subclasses(obj, base_class):
@@ -736,7 +736,7 @@ async def process(self, yara_results, event, yara_rule_settings, discovery_conte
continue
unescaped_url = html.unescape(m.group(1))
source_url = event.parsed_url.geturl()
- final_url = urljoin(source_url, unescaped_url)
+ final_url = urldefrag(urljoin(source_url, unescaped_url)).url
if not await self.helpers.re.search(self.full_url_regex_strict, final_url):
self.excavate.debug(
f"Rejecting reconstructed URL [{final_url}] as did not match full_url_regex_strict"
diff --git a/bbot/modules/telerik.py b/bbot/modules/telerik.py
index e437e08938..78874e303f 100644
--- a/bbot/modules/telerik.py
+++ b/bbot/modules/telerik.py
@@ -316,7 +316,7 @@ async def handle_event(self, event):
# The standard behavior for the spellcheck handler without parameters is a 500
if status_code == 500:
# Sometimes webapps will just return 500 for everything, so rule out the false positive
- validate_result, _ = await self.test_detector(base_url, self.helpers.rand_string())
+ validate_result, _ = await self.test_detector(base_url, f"{self.helpers.rand_string()}.axd")
self.debug(validate_result)
validate_status_code = getattr(validate_result, "status_code", 0)
if validate_status_code not in (0, 500):
diff --git a/bbot/modules/trufflehog.py b/bbot/modules/trufflehog.py
index 8a9076d4e4..a88b171946 100644
--- a/bbot/modules/trufflehog.py
+++ b/bbot/modules/trufflehog.py
@@ -1,4 +1,5 @@
import json
+from functools import partial
from bbot.modules.base import BaseModule
@@ -13,7 +14,7 @@ class trufflehog(BaseModule):
}
options = {
- "version": "3.88.3",
+ "version": "3.88.9",
"config": "",
"only_verified": True,
"concurrency": 8,
@@ -174,7 +175,7 @@ async def execute_trufflehog(self, module, path=None, string=None):
command.append("--delete-cached-data")
command.append("--token=" + self.github_token)
- stats_file = self.helpers.tempfile_tail(callback=self.log_trufflehog_status)
+ stats_file = self.helpers.tempfile_tail(callback=partial(self.log_trufflehog_status, path))
try:
with open(stats_file, "w") as stats_fh:
async for line in self.helpers.run_live(command, stderr=stats_fh):
@@ -200,7 +201,7 @@ async def execute_trufflehog(self, module, path=None, string=None):
finally:
stats_file.unlink()
- def log_trufflehog_status(self, line):
+ def log_trufflehog_status(self, path, line):
try:
line = json.loads(line)
except Exception:
@@ -209,4 +210,5 @@ def log_trufflehog_status(self, line):
message = line.get("msg", "")
ts = line.get("ts", "")
status = f"Message: {message} | Timestamp: {ts}"
- self.info(status)
+ self.verbose(f"Current scan target: {path}")
+ self.verbose(status)
diff --git a/bbot/presets/tech-detect.yml b/bbot/presets/tech-detect.yml
new file mode 100644
index 0000000000..5943dacae9
--- /dev/null
+++ b/bbot/presets/tech-detect.yml
@@ -0,0 +1,11 @@
+description: Detect technologies via Wappalyzer, Nuclei, and FingerprintX
+
+modules:
+ - nuclei
+ - wappalyzer
+ - fingerprintx
+
+config:
+ modules:
+ nuclei:
+ tags: tech
diff --git a/bbot/presets/web/dotnet-audit.yml b/bbot/presets/web/dotnet-audit.yml
index d80cafb396..993d6dd198 100644
--- a/bbot/presets/web/dotnet-audit.yml
+++ b/bbot/presets/web/dotnet-audit.yml
@@ -17,6 +17,9 @@ config:
modules:
ffuf:
extensions: asp,aspx,ashx,asmx,ascx
+ extensions_ignore_case: True
+ ffuf_shortnames:
+ find_subwords: True
telerik:
exploit_RAU_crypto: True
include_subdirs: True # Run against every directory, not the default first received URL per-host
diff --git a/bbot/test/conftest.py b/bbot/test/conftest.py
index f9807db819..ed9aec159d 100644
--- a/bbot/test/conftest.py
+++ b/bbot/test/conftest.py
@@ -8,6 +8,8 @@
from contextlib import suppress
from omegaconf import OmegaConf
from pytest_httpserver import HTTPServer
+import time
+import queue
from bbot.core import CORE
from bbot.core.helpers.misc import execute_sync_or_async
@@ -53,6 +55,12 @@ def silence_live_logging():
handler.setLevel(logging.CRITICAL)
+def stop_server(server):
+ server.stop()
+ while server.is_running():
+ time.sleep(0.1) # Wait a bit before checking again
+
+
@pytest.fixture
def bbot_httpserver():
server = HTTPServer(host="127.0.0.1", port=8888, threaded=True)
@@ -61,11 +69,7 @@ def bbot_httpserver():
yield server
server.clear()
- if server.is_running():
- server.stop()
-
- # this is to check if the client has made any request where no
- # `assert_request` was called on it from the test
+ stop_server(server) # Ensure the server is fully stopped
server.check_assertions()
server.clear()
@@ -84,11 +88,7 @@ def bbot_httpserver_ssl():
yield server
server.clear()
- if server.is_running():
- server.stop()
-
- # this is to check if the client has made any request where no
- # `assert_request` was called on it from the test
+ stop_server(server) # Ensure the server is fully stopped
server.check_assertions()
server.clear()
@@ -129,7 +129,7 @@ class Interactsh_mock:
def __init__(self, name):
self.name = name
self.log = logging.getLogger(f"bbot.interactsh.{self.name}")
- self.interactions = []
+ self.interactions = asyncio.Queue() # Use an asyncio queue for async access
self.correlation_id = "deadbeef-dead-beef-dead-beefdeadbeef"
self.stop = False
self.poll_task = None
@@ -138,7 +138,7 @@ def mock_interaction(self, subdomain_tag, msg=None):
self.log.info(f"Mocking interaction to subdomain tag: {subdomain_tag}")
if msg is not None:
self.log.info(msg)
- self.interactions.append(subdomain_tag)
+ self.interactions.put_nowait(subdomain_tag) # Add to the thread-safe queue
async def register(self, callback=None):
if callable(callback):
@@ -146,27 +146,32 @@ async def register(self, callback=None):
return "fakedomain.fakeinteractsh.com"
async def deregister(self, callback=None):
+ await asyncio.sleep(1)
self.stop = True
if self.poll_task is not None:
self.poll_task.cancel()
- with suppress(BaseException):
+ with suppress(asyncio.CancelledError):
await self.poll_task
async def poll_loop(self, callback=None):
while not self.stop:
data_list = await self.poll(callback)
if not data_list:
- await asyncio.sleep(1)
+ await asyncio.sleep(0.5)
continue
+ await asyncio.sleep(1)
+ await self.poll(callback)
async def poll(self, callback=None):
poll_results = []
- for subdomain_tag in self.interactions:
- result = {"full-id": f"{subdomain_tag}.fakedomain.fakeinteractsh.com", "protocol": "HTTP"}
- poll_results.append(result)
- if callback is not None:
- await execute_sync_or_async(callback, result)
- self.interactions = []
+ while not self.interactions.empty():
+ subdomain_tag = await self.interactions.get() # Get the first element from the asyncio queue
+ for protocol in ["HTTP", "DNS"]:
+ result = {"full-id": f"{subdomain_tag}.fakedomain.fakeinteractsh.com", "protocol": protocol}
+ poll_results.append(result)
+ if callback is not None:
+ await execute_sync_or_async(callback, result)
+ await asyncio.sleep(0.1)
return poll_results
diff --git a/bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py b/bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py
index fc666b64eb..8035316de7 100644
--- a/bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py
+++ b/bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py
@@ -1,3 +1,4 @@
+import asyncio
import re
from .base import ModuleTestBase
from werkzeug.wrappers import Response
@@ -171,7 +172,5 @@ def check(self, module_test, events):
if e.type == "VULNERABILITY" and "DotNetNuke Blind-SSRF (CVE 2017-0929)" in e.data["description"]:
dnn_dnnimagehandler_blindssrf = True
- assert self.interactsh_mock_instance.interactions == []
-
assert dnn_technology_detection, "DNN Technology Detection Failed"
assert dnn_dnnimagehandler_blindssrf, "dnnimagehandler.ashx Blind SSRF Detection Failed"
diff --git a/bbot/test/test_step_2/module_tests/test_module_excavate.py b/bbot/test/test_step_2/module_tests/test_module_excavate.py
index 1410b695ad..1e1e8db436 100644
--- a/bbot/test/test_step_2/module_tests/test_module_excavate.py
+++ b/bbot/test/test_step_2/module_tests/test_module_excavate.py
@@ -30,6 +30,7 @@ async def setup_before_prep(self, module_test):
<a href="/a_relative.txt">
<link href="/link_relative.txt">
<a href="mailto:bob@evilcorp.org?subject=help">Help</a>
+ <li class="toctree-l3"><a class="reference internal" href="miscellaneous.html#x50-uart-driver">16x50 UART Driver</a></li>
"""
expect_args = {"method": "GET", "uri": "/"}
respond_args = {"response_data": response_data}
@@ -103,6 +104,11 @@ def check(self, module_test, events):
for e in events
)
+ assert any(
+ e.type == "URL_UNVERIFIED" and "miscellaneous.html" in e.data and "x50-uart-driver" not in e.data
+ for e in events
+ )
+
class TestExcavate2(TestExcavate):
targets = ["http://127.0.0.1:8888/", "test.notreal", "http://127.0.0.1:8888/subdir/"]
diff --git a/bbot/test/test_step_2/module_tests/test_module_ffuf.py b/bbot/test/test_step_2/module_tests/test_module_ffuf.py
index b1296a5b9a..3df659e159 100644
--- a/bbot/test/test_step_2/module_tests/test_module_ffuf.py
+++ b/bbot/test/test_step_2/module_tests/test_module_ffuf.py
@@ -45,6 +45,30 @@ def check(self, module_test, events):
assert not any(e.type == "URL_UNVERIFIED" and "11111111" in e.data for e in events)
+class TestFFUF_ignorecase(TestFFUF):
+ test_wordlist = ["11111111", "Admin", "admin", "zzzjunkword2"]
+ config_overrides = {
+ "modules": {"ffuf": {"wordlist": tempwordlist(test_wordlist), "extensions": "php", "ignore_case": True}}
+ }
+
+ async def setup_before_prep(self, module_test):
+ expect_args = {"method": "GET", "uri": "/admin"}
+ respond_args = {"response_data": "alive admin page"}
+ module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+ expect_args = {"method": "GET", "uri": "/Admin"}
+ respond_args = {"response_data": "alive admin page"}
+ module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+ expect_args = {"method": "GET", "uri": "/"}
+ respond_args = {"response_data": "alive"}
+ module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
+ def check(self, module_test, events):
+ assert any(e.type == "URL_UNVERIFIED" and "admin" in e.data for e in events)
+ assert not any(e.type == "URL_UNVERIFIED" and "Admin" in e.data for e in events)
+
+
class TestFFUFHeaders(TestFFUF):
test_wordlist = ["11111111", "console", "junkword1", "zzzjunkword2"]
config_overrides = {
diff --git a/bbot/test/test_step_2/module_tests/test_module_ffuf_shortnames.py b/bbot/test/test_step_2/module_tests/test_module_ffuf_shortnames.py
index 8218eaa6a3..a10d8a1eae 100644
--- a/bbot/test/test_step_2/module_tests/test_module_ffuf_shortnames.py
+++ b/bbot/test/test_step_2/module_tests/test_module_ffuf_shortnames.py
@@ -8,6 +8,7 @@ class TestFFUFShortnames(ModuleTestBase):
"modules": {
"ffuf_shortnames": {
"find_common_prefixes": True,
+ "find_subwords": True,
"wordlist": tempwordlist(test_wordlist),
}
}
@@ -142,6 +143,16 @@ async def setup_after_prep(self, module_test):
tags=["shortname-endpoint"],
)
)
+
+ seed_events.append(
+ module_test.scan.make_event(
+ "http://127.0.0.1:8888/newpro~1.asp",
+ "URL_HINT",
+ parent_event,
+ module="iis_shortnames",
+ tags=["shortname-endpoint"],
+ )
+ )
module_test.scan.target.seeds.events = set(seed_events)
expect_args = {"method": "GET", "uri": "/administrator.aspx"}
@@ -172,6 +183,10 @@ async def setup_after_prep(self, module_test):
respond_args = {"response_data": "alive"}
module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+ expect_args = {"method": "GET", "uri": "/newproxy.aspx"}
+ respond_args = {"response_data": "alive"}
+ module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
def check(self, module_test, events):
basic_detection = False
directory_detection = False
@@ -180,6 +195,7 @@ def check(self, module_test, events):
directory_delimiter_detection = False
prefix_delimiter_detection = False
short_extensions_detection = False
+ subword_detection = False
for e in events:
if e.type == "URL_UNVERIFIED":
@@ -197,6 +213,8 @@ def check(self, module_test, events):
prefix_delimiter_detection = True
if e.data == "http://127.0.0.1:8888/short.pl":
short_extensions_detection = True
+ if e.data == "http://127.0.0.1:8888/newproxy.aspx":
+ subword_detection = True
assert basic_detection
assert directory_detection
@@ -205,3 +223,4 @@ def check(self, module_test, events):
assert directory_delimiter_detection
assert prefix_delimiter_detection
assert short_extensions_detection
+ assert subword_detection
diff --git a/bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py b/bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py
index 4502511da4..c0911fd661 100644
--- a/bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py
+++ b/bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py
@@ -1,4 +1,5 @@
import re
+import asyncio
from werkzeug.wrappers import Response
from .base import ModuleTestBase
@@ -23,15 +24,16 @@ def request_handler(self, request):
elif request.method == "POST":
subdomain_tag = extract_subdomain_tag(request.data.decode())
if subdomain_tag:
- self.interactsh_mock_instance.mock_interaction(
- subdomain_tag, msg=f"{request.method}: {request.data.decode()}"
+ asyncio.run(
+ self.interactsh_mock_instance.mock_interaction(
+ subdomain_tag, msg=f"{request.method}: {request.data.decode()}"
+ )
)
return Response("alive", status=200)
async def setup_before_prep(self, module_test):
self.interactsh_mock_instance = module_test.mock_interactsh("generic_ssrf")
- self.interactsh_mock_instance.mock_interaction("asdf")
module_test.monkeypatch.setattr(
module_test.scan.helpers, "interactsh", lambda *args, **kwargs: self.interactsh_mock_instance
)
@@ -41,6 +43,18 @@ async def setup_after_prep(self, module_test):
module_test.set_expect_requests_handler(expect_args=expect_args, request_handler=self.request_handler)
def check(self, module_test, events):
+ total_vulnerabilities = 0
+ total_findings = 0
+
+ for e in events:
+ if e.type == "VULNERABILITY":
+ total_vulnerabilities += 1
+ elif e.type == "FINDING":
+ total_findings += 1
+
+ assert total_vulnerabilities == 30, "Incorrect number of vulnerabilities detected"
+ assert total_findings == 30, "Incorrect number of findings detected"
+
assert any(
e.type == "VULNERABILITY"
and "Out-of-band interaction: [Generic SSRF (GET)]"
@@ -55,3 +69,20 @@ def check(self, module_test, events):
e.type == "VULNERABILITY" and "Out-of-band interaction: [Generic XXE] [HTTP]" in e.data["description"]
for e in events
), "Failed to detect Generic SSRF (XXE)"
+
+
+class TestGeneric_SSRF_httponly(TestGeneric_SSRF):
+ config_overrides = {"modules": {"generic_ssrf": {"skip_dns_interaction": True}}}
+
+ def check(self, module_test, events):
+ total_vulnerabilities = 0
+ total_findings = 0
+
+ for e in events:
+ if e.type == "VULNERABILITY":
+ total_vulnerabilities += 1
+ elif e.type == "FINDING":
+ total_findings += 1
+
+ assert total_vulnerabilities == 30, "Incorrect number of vulnerabilities detected"
+ assert total_findings == 0, "Incorrect number of findings detected"
diff --git a/bbot/test/test_step_2/module_tests/test_module_gitdumper.py b/bbot/test/test_step_2/module_tests/test_module_gitdumper.py
new file mode 100644
index 0000000000..ad8c237a6b
--- /dev/null
+++ b/bbot/test/test_step_2/module_tests/test_module_gitdumper.py
@@ -0,0 +1,385 @@
+from pathlib import Path
+from .base import ModuleTestBase
+
+
+class TestGitDumper_Dirlisting(ModuleTestBase):
+ targets = [
+ "http://127.0.0.1:8888/test",
+ ]
+
+ modules_overrides = ["git", "gitdumper", "httpx"]
+
+ index_html = """<html>
+ <head>
+ <title>Index of /.git
+
+
+ Index of /.git
+
+
+