From fa3347307c8b9537874d61a4b75b90cf42cb9ce2 Mon Sep 17 00:00:00 2001 From: edoardottt Date: Mon, 24 May 2021 17:00:11 +0200 Subject: [PATCH] update --- Makefile | 4 +-- crawler/colly.go | 66 ++++++++++++++++++++++++++++++++------------ input/flags.go | 24 ++++++++++------ main.go | 32 ++++++++++++++------- scanner/endpoints.go | 5 ++++ 5 files changed, 93 insertions(+), 38 deletions(-) diff --git a/Makefile b/Makefile index 6c81d3d..7c950d5 100644 --- a/Makefile +++ b/Makefile @@ -17,11 +17,11 @@ update: linux: @go build -o ./cariddi - mv ./cariddi /usr/bin/ + sudo mv ./cariddi /usr/bin/ echo "Done." unlinux: - rm -rf /usr/bin/cariddi + sudo rm -rf /usr/bin/cariddi echo "Done." test: diff --git a/crawler/colly.go b/crawler/colly.go index 37fb8e6..90aef99 100644 --- a/crawler/colly.go +++ b/crawler/colly.go @@ -25,6 +25,7 @@ package crawler import ( "net/url" "regexp" + "strings" "time" "github.com/edoardottt/cariddi/input" @@ -33,13 +34,15 @@ import ( ) //Crawler -func Crawler(target string, delayTime int, concurrency int, secrets bool, secretsFile string, plain bool, dataPost map[string]string) ([]string, []scanner.SecretMatched) { +func Crawler(target string, delayTime int, concurrency int, secrets bool, secretsFile string, plain bool, endpoints bool, endpointsFile string) ([]string, []scanner.SecretMatched, []scanner.EndpointMatched) { //clean target input target = input.RemoveHeaders(target) var Finalresult []string var Finalsecrets []scanner.SecretMatched + var Finalendpoints []scanner.EndpointMatched + // Instantiate collector c := colly.NewCollector( colly.AllowedDomains(target), @@ -76,13 +79,18 @@ func Crawler(target string, delayTime int, concurrency int, secrets bool, secret c.OnRequest(func(r *colly.Request) { // HERE SCAN FOR SECRETS if secrets { - secretsSlice := huntSecrets(secretsFile, r.URL.String(), dataPost) + secretsSlice := huntSecrets(secretsFile, r.URL.String()) for _, elem := range secretsSlice { secretFound := scanner.SecretMatched{Secret: elem, Url: r.URL.String()} Finalsecrets = append(Finalsecrets, secretFound) } } + // HERE SCAN FOR ENDPOINTS + if endpoints { + endpointsSlice := huntEndpoints(endpointsFile, r.URL.String()) + Finalendpoints = append(Finalendpoints, endpointsSlice...) + } Finalresult = append(Finalresult, r.URL.String()) }) @@ -90,13 +98,13 @@ func Crawler(target string, delayTime int, concurrency int, secrets bool, secret c.Visit("http://" + target) c.Visit("https://" + target) c.Wait() - return Finalresult, Finalsecrets + return Finalresult, Finalsecrets, Finalendpoints } //huntSecrets -func huntSecrets(secretsFile string, target string, data map[string]string) []scanner.Secret { +func huntSecrets(secretsFile string, target string) []scanner.Secret { if secretsFile == "" { - body := RetrieveBody(target, data) + body := RetrieveBody(target) secrets := SecretsMatch(body) return secrets } @@ -106,19 +114,6 @@ func huntSecrets(secretsFile string, target string, data map[string]string) []sc return scanner.GetRegexes() } -//RetrieveBody -func RetrieveBody(target string, data map[string]string) string { - sb, err := GetRequest(target) - if err == nil && sb != "" { - return sb - } - sb, err = PostRequest(target, data) - if err == nil && sb != "" { - return sb - } - return "" -} - //SecretsMatch func SecretsMatch(body string) []scanner.Secret { var secrets []scanner.Secret @@ -130,6 +125,41 @@ func SecretsMatch(body string) []scanner.Secret { return secrets } +//huntEndpoints +func huntEndpoints(endpointsFile string, target string) []scanner.EndpointMatched { + if endpointsFile == "" { + body := RetrieveBody(target) + endpoints := EndpointsMatch(body, target) + return endpoints + } + + // HERE ---> ELSE SECRETS FILE ! + + return nil +} + +//EndpointsMatch +func EndpointsMatch(body string, target string) []scanner.EndpointMatched { + var endpoints []scanner.EndpointMatched + matched := []string{} + for _, parameter := range scanner.GetJuicyParameters() { + if strings.Contains(body, parameter) { + matched = append(matched, parameter) + } + endpoints = append(endpoints, scanner.EndpointMatched{Parameters: matched, Url: target}) + } + return endpoints +} + +//RetrieveBody +func RetrieveBody(target string) string { + sb, err := GetRequest(target) + if err == nil && sb != "" { + return sb + } + return "" +} + //isLinkOkay func isLinkOkay(input string) bool { _, err := url.Parse(input) diff --git a/input/flags.go b/input/flags.go index 135c51a..e2e0046 100644 --- a/input/flags.go +++ b/input/flags.go @@ -28,7 +28,7 @@ import ( //Input type Input struct { - Verbose bool + //Verbose bool Version bool Delay int Concurrency int @@ -37,16 +37,18 @@ type Input struct { Plain bool Html string Txt string - DataPost string - Secrets bool - SecretsFile string + //DataPost string + Secrets bool + SecretsFile string + Endpoints bool + EndpointsFile string } //ScanFlag defines all the switches taken //as input and return them. func ScanFlag() Input { - verbosePtr := flag.Bool("v", false, "Verbose mode.") + //verbosePtr := flag.Bool("v", false, "Verbose mode.") versionPtr := flag.Bool("version", false, "Print the version.") delayPtr := flag.Int("d", 0, "Delay between a page crawled and another.") concurrencyPtr := flag.Int("c", 20, "Concurrency level (20 is default).") @@ -55,14 +57,18 @@ func ScanFlag() Input { plainPtr := flag.Bool("plain", false, "Print only the results.") outputHtmlPtr := flag.String("oh", "", "Write the output into an HTML file.") outputTxtPtr := flag.String("ot", "", "Write the output into a TXT file.") - dataPostPtr := flag.String("post", "", "Set the data to perform the POST requests.") + //dataPostPtr := flag.String("post", "", "Set the data to perform the POST requests.") + secretsPtr := flag.Bool("s", false, "Hunt for secrets.") secretsFilePtr := flag.String("sf", "", "Use an external file (txt, one per line) to use custom regexes for secrets hunting.") + endpointsPtr := flag.Bool("e", false, "Hunt for juicy endpoints.") + endpointsFilePtr := flag.String("ef", "", "Use an external file (txt, one per line) to use custom parameters for endpoints hunting.") + flag.Parse() result := Input{ - *verbosePtr, + //*verbosePtr, *versionPtr, *delayPtr, *concurrencyPtr, @@ -71,9 +77,11 @@ func ScanFlag() Input { *plainPtr, *outputHtmlPtr, *outputTxtPtr, - *dataPostPtr, + //*dataPostPtr, *secretsPtr, *secretsFilePtr, + *endpointsPtr, + *endpointsFilePtr, } return result diff --git a/main.go b/main.go index 00184b9..440dc64 100644 --- a/main.go +++ b/main.go @@ -23,7 +23,6 @@ along with this program. If not, see http://www.gnu.org/licenses/. package main import ( - "fmt" "os" "github.com/edoardottt/cariddi/crawler" @@ -38,9 +37,11 @@ func main() { targets := input.ScanTargets() flags := input.ScanFlag() - fmt.Println("FLAGS:") - fmt.Println(flags) - fmt.Println("--------------") + /* + fmt.Println("FLAGS:") + fmt.Println(flags) + fmt.Println("--------------") + */ if flags.Version { output.Beautify() @@ -59,18 +60,17 @@ func main() { output.Beautify() - // ----------- TODO: check flags.dataPost -------------- - data, _ := input.CheckDataPost(flags.DataPost) - // ----------- TODO: check ALL input ------------------- input.CheckFlags(flags) var finalResult []string var finalSecret []scanner.SecretMatched + var finalEndpoints []scanner.EndpointMatched for _, inp := range targets { - result, secrets := crawler.Crawler(inp, flags.Delay, flags.Concurrency, flags.Secrets, flags.SecretsFile, flags.Plain, data) + result, secrets, endpoints := crawler.Crawler(inp, flags.Delay, flags.Concurrency, flags.Secrets, flags.SecretsFile, flags.Plain, flags.Endpoints, flags.EndpointsFile) finalResult = append(finalResult, result...) finalSecret = append(finalSecret, secrets...) + finalEndpoints = append(finalEndpoints, endpoints...) } // IF TXT OUTPUT @@ -83,14 +83,26 @@ func main() { output.HtmlOutput(flags, finalResult, finalSecret) } + // if needed print urls + if !flags.Plain { + output.PrintSimpleOutput(finalResult) + } + // if needed print secrets if !flags.Plain { for _, elem := range finalSecret { output.EncapsulateCustomGreen(elem.Secret.Name, "Found in "+elem.Url+" "+elem.Secret.Regex+" matched!") } } - // if needed print urls + + // if needed print secrets if !flags.Plain { - output.PrintSimpleOutput(finalResult) + for _, elem := range finalEndpoints { + finalString := "" + for _, parameter := range elem.Parameters { + finalString += parameter + } + output.EncapsulateCustomGreen(finalString, " Found in "+elem.Url+" matched!") + } } } diff --git a/scanner/endpoints.go b/scanner/endpoints.go index 986b2dd..e72703e 100644 --- a/scanner/endpoints.go +++ b/scanner/endpoints.go @@ -22,6 +22,11 @@ along with this program. If not, see http://www.gnu.org/licenses/. package scanner +type EndpointMatched struct { + Parameters []string + Url string +} + //GetJuicyParameters func GetJuicyParameters() []string { var juicyParameters = []string{