wyvern.ipynb

{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "provenance": []
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    },
    "language_info": {
      "name": "python"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "source": [
        "Welcome to **wyvern**\n",
        "\n",
        "**Features**\n",
        "*   Shodan CVE discovery (look up via org filter)\n",
        "*   ipinfo (ASN)\n",
        "*   Google Public DNS Resolver (A, MX and TXT)\n",
        "*   OpenAI ChatGPT 3.5 Analysis of artifacts\n",
        "\n",
        "\n",
        "**APIs**\n",
        "\n",
        "* [Shodan Membership](https://account.shodan.io/billing/member)\n",
        "* [ipinfo free tier](https://ipinfo.io/signup)\n",
        "* [OpenAI](https://platform.openai.com/signup)\n",
        "\n",
        "**Scoping**\n",
        "\n",
        "In order to get the best possible results it is recommended you use shodan.io's org: filter (org:companyname) on the website to scope then set the name in the `company_name` variable. Set the `domain` variable then execute the script. You can specify if you wish to exclude shodan from the report by setting the `noShodan` variable to `True` and OpenAI by setting `noOpenAI` variable to `True`\n",
        "\n",
        "**First time setup**\n",
        "\n",
        "If your running this script for the first time please run pip to install the required dependencies.\n",
        "\n",
        "**Output**\n",
        "\n",
        "The report should take less than a minute to compile. upon completetion a docx file will be saved containing the full report.\n",
        "\n",
        "**Found a bug?**\n",
        "\n",
        "File a bug report at our [GitHub](https://github.com/kittymagician/wyvern)"
      ],
      "metadata": {
        "id": "etXtiXOPan3H"
      }
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "P_X4sgx5amm2"
      },
      "outputs": [],
      "source": [
        "!pip install python-docx requests pendulum shodan openai"
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "import requests\n",
        "import docx\n",
        "from docx.shared import Cm, Pt\n",
        "from docx.enum.table import WD_TABLE_ALIGNMENT\n",
        "from docx.enum.text import WD_ALIGN_PARAGRAPH\n",
        "from docx.oxml import OxmlElement\n",
        "from docx.oxml.ns import qn\n",
        "import pendulum\n",
        "from datetime import datetime\n",
        "import shodan\n",
        "import openai\n",
        "\n",
        "# Define timezone\n",
        "utc = pendulum.timezone('UTC')\n",
        "\n",
        "# Define the domain to query\n",
        "domain = \"domain goes here\"\n",
        "# Define company name for Shodan\n",
        "company_name = \"company name goes here\"\n",
        "# Disable Shodan\n",
        "noShodan = False\n",
        "# Disable OpenAI\n",
        "noOpenAI = False\n",
        "# Define the DNS record types to query\n",
        "record_types = [\"A\", \"MX\", \"TXT\"]\n",
        "\n",
        "# Query the DNS records using Google DNS over HTTPS\n",
        "results = {}\n",
        "spf_records = []\n",
        "dmarc_records = []\n",
        "for record_type in record_types:\n",
        "    url = f\"https://dns.google/resolve?name={domain}&type={record_type}\"\n",
        "    response = requests.get(url).json()\n",
        "    if \"Answer\" in response:\n",
        "        if record_type == \"TXT\":\n",
        "            for answer in response[\"Answer\"]:\n",
        "                if answer[\"data\"].startswith(\"v=spf1\"):\n",
        "                    spf_records.append(answer[\"data\"])\n",
        "                if answer[\"data\"].startswith(\"v=DMARC1\"):\n",
        "                    dmarc_records.append(answer[\"data\"])\n",
        "                else:\n",
        "                  if \"TXT\" not in results:\n",
        "                    results[\"TXT\"] = []\n",
        "                  results[\"TXT\"].append(answer[\"data\"])\n",
        "\n",
        "        else:\n",
        "          if record_type not in results:\n",
        "            results[record_type] = []\n",
        "          results[record_type].extend([answer[\"data\"] for answer in response[\"Answer\"]])\n",
        "\n",
        "# Define your OpenAI API token\n",
        "openai.api_key = \"\"\n",
        "\n",
        "# Define your ipinfo.io API token\n",
        "ipinfo_api_token = \"\"\n",
        "\n",
        "# Define your Shodan API key\n",
        "shodan_api_key = \"\"\n",
        "api = shodan.Shodan(shodan_api_key)\n",
        "\n",
        "# Get ASN details for A Records\n",
        "if \"A\" in results:\n",
        "    asn_details = []\n",
        "    for ip in results[\"A\"]:\n",
        "        response = requests.get(f\"https://ipinfo.io/{ip}?token={ipinfo_api_token}\").json()\n",
        "        asn = response.get(\"org\", \"N/A\")\n",
        "        asn_details.append(asn)\n",
        "\n",
        "# Get IP information for MX Records\n",
        "if \"MX\" in results:\n",
        "    mx_info = []\n",
        "    for mx in results[\"MX\"]:\n",
        "        mx_domain = mx.split()[-1]\n",
        "        response = requests.get(f\"https://dns.google/resolve?name={mx_domain}&type=A\").json()\n",
        "        if \"Answer\" in response:\n",
        "            ip = response[\"Answer\"][0][\"data\"]\n",
        "            response = requests.get(f\"https://ipinfo.io/{ip}?token={ipinfo_api_token}\").json()\n",
        "            ip_info = response.get(\"org\", \"N/A\")\n",
        "            mx_info.append((mx, ip, ip_info))\n",
        "\n",
        "# Try to obtain Shodan Data\n",
        "vulnerable_hosts = []\n",
        "try:\n",
        "    query = f'org:\"{company_name}\"'\n",
        "    shodan_results = api.search(query)\n",
        "    if shodan_results['total'] == 0:\n",
        "        print(f\"No hosts found for {company_name}.\")\n",
        "        noShodan = True\n",
        "    else:\n",
        "        for result in shodan_results['matches']:\n",
        "            host_ip = result['ip_str'] if 'ip_str' in result else 'N/A'\n",
        "            hostnames = result['hostnames'][0] if 'hostnames' in result and result['hostnames'] else 'N/A'\n",
        "            cve_list = result['vulns'] if 'vulns' in result else {}\n",
        "            cve_text = \"\\n\".join([f\"{cve}: {cve_info['summary']}\" for cve, cve_info in cve_list.items()])\n",
        "            if cve_text:\n",
        "                vulnerable_hosts.append({'ip': host_ip, 'hostname': hostnames, 'cves': cve_text})\n",
        "except shodan.APIError as e:\n",
        "    print(f\"Error: {e}\")\n",
        "\n",
        "# Function to add table borders\n",
        "def add_table_borders(cell):\n",
        "    tc = cell._element.tcPr\n",
        "    tcBorders = OxmlElement('w:tcBorders')\n",
        "    for border_type in ['top', 'bottom', 'left', 'right']:\n",
        "        border = OxmlElement(f\"w:{border_type}\")\n",
        "        border.set(qn('w:val'), 'single')\n",
        "        border.set(qn('w:sz'), '2')\n",
        "        border.set(qn('w:space'), '0')\n",
        "        border.set(qn('w:color'), '000000')\n",
        "        tcBorders.append(border)\n",
        "    tc.append(tcBorders)\n",
        "\n",
        "# Create a new Word document\n",
        "doc = docx.Document()\n",
        "\n",
        "# Add a title page\n",
        "doc.add_heading(f\"DNS Records for {domain}\", 0)\n",
        "dt = datetime.now(utc)\n",
        "doc.add_paragraph(f\"{dt}\")\n",
        "\n",
        "# Add a page break\n",
        "doc.add_page_break()\n",
        "\n",
        "doc.add_paragraph(f\"The following DNS records were retrieved for {domain}:\")\n",
        "for record_type in record_types:\n",
        "    p = doc.add_paragraph()\n",
        "    p.style = \"List Bullet\"\n",
        "    p.add_run(f\"{record_type} Records\").bold = True\n",
        "\n",
        "doc.add_page_break()\n",
        "\n",
        "# Add record types to ToC\n",
        "doc.add_heading(\"Table of Contents\", level=1)\n",
        "toc = doc.add_paragraph()\n",
        "for record_type in [\"A\", \"MX\", \"CNAME\", \"TXT\"]:\n",
        "    if record_type in results:\n",
        "        toc.add_run(f\"{record_type} Records\\n\")\n",
        "        toc.add_run(\"\\n\")\n",
        "\n",
        "# Add the DNS records to the document\n",
        "doc.add_page_break()\n",
        "\n",
        "for record_type, values in results.items():\n",
        "    doc.add_heading(f\"{record_type} Records\", level=1)\n",
        "    if len(values) > 0:\n",
        "        if record_type == \"A\":\n",
        "            table = doc.add_table(rows=len(values), cols=2)\n",
        "            table.alignment = WD_TABLE_ALIGNMENT.CENTER\n",
        "            for i, value in enumerate(values):\n",
        "                cell = table.cell(i, 0)\n",
        "                cell.text = value\n",
        "                cell.width = Cm(15)\n",
        "                cell.vertical_alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "                add_table_borders(cell)\n",
        "                cell = table.cell(i, 1)\n",
        "                cell.text = asn_details[i]\n",
        "                cell.width = Cm(15)\n",
        "                cell.vertical_alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "                add_table_borders(cell)\n",
        "            doc.add_paragraph(f\"A Records are IP Addresses that point to a domain name.\")\n",
        "        elif record_type == \"MX\" and mx_info:\n",
        "            table = doc.add_table(rows=len(mx_info), cols=3)\n",
        "            table.alignment = WD_TABLE_ALIGNMENT.CENTER\n",
        "            for i, (mx, ip, ip_info) in enumerate(mx_info):\n",
        "                cell = table.cell(i, 0)\n",
        "                cell.text = mx\n",
        "                cell.width = Cm(15)\n",
        "                cell.vertical_alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "                add_table_borders(cell)\n",
        "                cell = table.cell(i, 1)\n",
        "                cell.text = ip\n",
        "                cell.width = Cm(15)\n",
        "                cell.vertical_alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "                add_table_borders(cell)\n",
        "                cell = table.cell(i, 2)\n",
        "                cell.text = ip_info\n",
        "                cell.width = Cm(15)\n",
        "                cell.vertical_alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "                add_table_borders(cell)\n",
        "            doc.add_paragraph(f\"MX Records specify the mail servers responsible for accepting email messages on behalf of a domain name.\")\n",
        "        else:\n",
        "            table = doc.add_table(rows=len(values), cols=1)\n",
        "            table.alignment = WD_TABLE_ALIGNMENT.CENTER\n",
        "            for i, value in enumerate(values):\n",
        "              cell = table.cell(i, 0)\n",
        "              cell.text = value\n",
        "              cell.width = Cm(15)\n",
        "              cell.vertical_alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "              add_table_borders(cell)\n",
        "\n",
        "# Add SPF record data if available\n",
        "if spf_records:\n",
        "    doc.add_heading(\"SPF Record\", level=1)\n",
        "    table = doc.add_table(rows=1, cols=1)\n",
        "    table.style = 'Table Grid'\n",
        "    cell = table.cell(0, 0)\n",
        "    cell.text = spf_records[0]\n",
        "    cell.vertical_alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "    cell.paragraphs[0].alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "    cell.width = Cm(16)\n",
        "    cell.height = Cm(1.5)\n",
        "\n",
        "# Add DMARC record data if available\n",
        "if dmarc_records:\n",
        "    doc.add_heading(\"DMARC Record\", level=1)\n",
        "    table = doc.add_table(rows=1, cols=1)\n",
        "    table.style = 'Table Grid'\n",
        "    cell = table.cell(0, 0)\n",
        "    cell.text = dmarc_records[0]\n",
        "    cell.vertical_alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "    cell.paragraphs[0].alignment = WD_ALIGN_PARAGRAPH.CENTER\n",
        "    cell.width = Cm(16)\n",
        "    cell.height = Cm(1.5)\n",
        "doc.add_page_break()\n",
        "# Add Shodan data if there are vulnerable hosts\n",
        "if vulnerable_hosts:\n",
        "    doc.add_heading(\"Shodan Data\", level=1)\n",
        "    table = doc.add_table(rows=len(vulnerable_hosts) + 1, cols=3)\n",
        "    table.alignment = WD_TABLE_ALIGNMENT.CENTER\n",
        "    # Add header row\n",
        "    header_row = table.rows[0]\n",
        "    header_row.cells[0].text = \"IP Address\"\n",
        "    header_row.cells[1].text = \"Hostname\"\n",
        "    header_row.cells[2].text = \"Vulnerabilities\"\n",
        "    add_table_borders(header_row.cells[0])\n",
        "    add_table_borders(header_row.cells[1])\n",
        "    add_table_borders(header_row.cells[2])\n",
        "\n",
        "    # Add data rows\n",
        "    for i, host in enumerate(vulnerable_hosts):\n",
        "        row = table.rows[i+1]\n",
        "        row.cells[0].text = host['ip']\n",
        "        row.cells[1].text = host['hostname'] if 'hostname' in host else 'N/A'\n",
        "        row.cells[2].text = host['cves']\n",
        "        add_table_borders(row.cells[0])\n",
        "        add_table_borders(row.cells[1])\n",
        "        add_table_borders(row.cells[2])\n",
        "    doc.add_page_break()\n",
        "\n",
        "# OpenAI Summery\n",
        "def generate_summary(prompt, token):\n",
        "    response = openai.Completion.create(\n",
        "        engine=\"text-davinci-003\",\n",
        "        prompt=prompt,\n",
        "        max_tokens=token,\n",
        "        n=1,\n",
        "        stop=None,\n",
        "        temperature=0.7,\n",
        "    )\n",
        "\n",
        "    message = response.choices[0].text.strip()\n",
        "    return message\n",
        "\n",
        "report_text = f\"DNS Records for {domain}\\n\\n\"\n",
        "for record_type, values in results.items():\n",
        "    report_text += f\"{record_type} Records:\\n\"\n",
        "    if len(values) > 0:\n",
        "        for value in values:\n",
        "            report_text += f\"{value}\\n\"\n",
        "    report_text += \"\\n\"\n",
        "if vulnerable_hosts:\n",
        "    report_text += \"Shodan Data:\\n\"\n",
        "    for host in vulnerable_hosts:\n",
        "        report_text += f\"IP: {host['ip']}\\nHostname: {host['hostname']}\\nVulnerabilities:\\n{host['cves']}\\n\\n\"\n",
        "print(report_text)\n",
        "if noShodan is False and noOpenAI is False:\n",
        "  prompt = f\"Please provide an overview of the findings for the following DNS records and Shodan data in 200 words or less include CVEs and provide recommendations on how to remediate:\\n{report_text}\"\n",
        "  summary = generate_summary(prompt, 300)\n",
        "  doc.add_heading(\"Findings Overview (OpenAi Experimental)\", level=1)\n",
        "  doc.add_paragraph(summary)\n",
        "  doc.add_page_break()\n",
        "  doc.add_heading(\"Remmediation Plan (OpenAi Experimental)\", level=1)\n",
        "  prompt = f\"write a remmediation plan in 500 words or less.\\n{report_text}\"\n",
        "  remmediation = generate_summary(prompt, 500)\n",
        "  if spf_records:\n",
        "    doc.add_paragraph(remmediation)\n",
        "    prompt2 = f\"look at the txt records for SPF, Configured securely? if not explain best practice:{spf_records[0]}\"\n",
        "    remmediation_2 = generate_summary(prompt2, 1500)\n",
        "    doc.add_paragraph(remmediation_2)\n",
        "  doc.add_page_break()\n",
        "# Save the document\n",
        "doc.save(f\"wyvern_{domain}_{dt}.docx\")"
      ],
      "metadata": {
        "id": "J7bl7V8ib6sp"
      },
      "execution_count": null,
      "outputs": []
    }
  ]
}