mirror of
https://github.com/j3ssie/osmedeus.git
synced 2026-09-13 05:07:45 +02:00
Complete rewrite and re-architecture Osmedeus Engine in v5
This commit is contained in:
j3ssie
@@ -0,0 +1,76 @@
|
||||
# HTTP Probing Module (Test Style)
|
||||
# This is a test-style workflow using simple commands for testing purposes.
|
||||
# In production, replace echo commands with real tools like httpx, httprobe, etc.
|
||||
|
||||
name: http-probe
|
||||
kind: module
|
||||
description: Simulated HTTP probing for testing
|
||||
tags: test, recon, http
|
||||
|
||||
params:
|
||||
- name: threads
|
||||
value: "20"
|
||||
- name: timeout
|
||||
value: "10"
|
||||
|
||||
steps:
|
||||
# Step 1: Setup directories
|
||||
- name: setup-directories
|
||||
type: bash
|
||||
commands:
|
||||
- mkdir -p {{Output}}/http/probed
|
||||
- mkdir -p {{Output}}/http/categorized
|
||||
exports:
|
||||
http_dir: "{{Output}}/http"
|
||||
|
||||
# Step 2: Simulate HTTP probing
|
||||
- name: probe-hosts
|
||||
type: bash
|
||||
command: |
|
||||
# Simulate httpx-style output
|
||||
echo "http://{{Target}} [200] [Example Domain] [text/html]" > {{http_dir}}/probed/results.txt
|
||||
echo "https://{{Target}} [200] [Example Domain] [text/html]" >> {{http_dir}}/probed/results.txt
|
||||
echo "http://www.{{Target}} [301] [Redirect] [text/html]" >> {{http_dir}}/probed/results.txt
|
||||
echo "https://api.{{Target}} [200] [API Server] [application/json]" >> {{http_dir}}/probed/results.txt
|
||||
echo "https://admin.{{Target}} [403] [Forbidden] [text/html]" >> {{http_dir}}/probed/results.txt
|
||||
sleep 0.5
|
||||
timeout: 120
|
||||
exports:
|
||||
probe_results: "{{http_dir}}/probed/results.txt"
|
||||
|
||||
# Step 3: Extract live hosts
|
||||
- name: extract-live-hosts
|
||||
type: bash
|
||||
command: |
|
||||
awk '{print $1}' {{probe_results}} > {{http_dir}}/live-hosts.txt
|
||||
exports:
|
||||
live_hosts: "{{http_dir}}/live-hosts.txt"
|
||||
|
||||
# Step 4: Categorize by status code using function
|
||||
- name: categorize-results
|
||||
type: function
|
||||
function: |
|
||||
log_info("Categorizing HTTP responses by status code");
|
||||
// In real workflow, would parse and categorize responses
|
||||
log_info("Categories: 200 OK, 301 Redirect, 403 Forbidden");
|
||||
return true;
|
||||
|
||||
# Step 5: Filter successful responses
|
||||
- name: filter-successful
|
||||
type: bash
|
||||
command: |
|
||||
grep '\[200\]' {{probe_results}} | awk '{print $1}' > {{http_dir}}/categorized/success-200.txt || true
|
||||
grep '\[301\]\|\[302\]' {{probe_results}} | awk '{print $1}' > {{http_dir}}/categorized/redirects.txt || true
|
||||
grep '\[403\]\|\[401\]' {{probe_results}} | awk '{print $1}' > {{http_dir}}/categorized/auth-required.txt || true
|
||||
exports:
|
||||
success_hosts: "{{http_dir}}/categorized/success-200.txt"
|
||||
redirect_hosts: "{{http_dir}}/categorized/redirects.txt"
|
||||
auth_hosts: "{{http_dir}}/categorized/auth-required.txt"
|
||||
|
||||
# Step 6: Generate summary
|
||||
- name: generate-summary
|
||||
type: bash
|
||||
commands:
|
||||
- cp {{live_hosts}} {{Output}}/http-hosts.txt
|
||||
- echo "HTTP probe completed at $(date)" > {{Output}}/http-stats.txt
|
||||
- "wc -l {{live_hosts}} | awk '{print \"Live hosts: \" $1}' >> {{Output}}/http-stats.txt"
|
||||
@@ -0,0 +1,69 @@
|
||||
# Port Scanning Module (Test Style)
|
||||
# This is a test-style workflow using simple commands for testing purposes.
|
||||
# In production, replace echo commands with real tools like nmap, masscan, etc.
|
||||
|
||||
name: port-scan
|
||||
kind: module
|
||||
description: Simulated port scanning for testing
|
||||
tags: test, recon, ports
|
||||
|
||||
params:
|
||||
- name: threads
|
||||
value: "10"
|
||||
- name: ports
|
||||
value: "80,443,8080,8443,22,21"
|
||||
|
||||
steps:
|
||||
# Step 1: Setup directories
|
||||
- name: setup-directories
|
||||
type: bash
|
||||
commands:
|
||||
- mkdir -p {{Output}}/ports/quick
|
||||
- mkdir -p {{Output}}/ports/detailed
|
||||
exports:
|
||||
ports_dir: "{{Output}}/ports"
|
||||
|
||||
# Step 2: Quick port scan simulation
|
||||
- name: quick-scan
|
||||
type: bash
|
||||
command: |
|
||||
echo "{{Target}}:80 open" > {{ports_dir}}/quick/scan.txt
|
||||
echo "{{Target}}:443 open" >> {{ports_dir}}/quick/scan.txt
|
||||
echo "{{Target}}:22 open" >> {{ports_dir}}/quick/scan.txt
|
||||
sleep 1
|
||||
timeout: 60
|
||||
exports:
|
||||
quick_results: "{{ports_dir}}/quick/scan.txt"
|
||||
|
||||
# Step 3: Create target list for detailed scan
|
||||
- name: prepare-targets
|
||||
type: bash
|
||||
command: |
|
||||
awk -F: '{print $1":"$2}' {{quick_results}} > {{ports_dir}}/targets.txt
|
||||
exports:
|
||||
scan_targets: "{{ports_dir}}/targets.txt"
|
||||
|
||||
# Step 4: Detailed scan using foreach
|
||||
- name: detailed-scan
|
||||
type: foreach
|
||||
input: "{{scan_targets}}"
|
||||
variable: target_port
|
||||
threads: "{{threads}}"
|
||||
step:
|
||||
name: scan-single-port
|
||||
type: bash
|
||||
command: |
|
||||
HOST=$(echo "[[target_port]]" | cut -d: -f1)
|
||||
PORT=$(echo "[[target_port]]" | cut -d: -f2)
|
||||
echo "$HOST:$PORT http/https (simulated service)" >> {{ports_dir}}/detailed/services.txt
|
||||
sleep 0.2
|
||||
timeout: 30
|
||||
|
||||
# Step 5: Aggregate results
|
||||
- name: aggregate-results
|
||||
type: bash
|
||||
parallel_commands:
|
||||
- cat {{ports_dir}}/detailed/*.txt 2>/dev/null | sort -u > {{Output}}/all-ports.txt
|
||||
- echo "Port scan completed at $(date)" > {{Output}}/port-stats.txt
|
||||
- "wc -l {{Output}}/all-ports.txt | awk '{print \"Open ports found: \" $1}' >> {{Output}}/port-stats.txt"
|
||||
|
||||
@@ -0,0 +1,110 @@
|
||||
# Screenshot Capture Module (Test Style)
|
||||
# This is a test-style workflow using simple commands for testing purposes.
|
||||
# In production, replace touch commands with real tools like gowitness, eyewitness, etc.
|
||||
|
||||
name: screenshot
|
||||
kind: module
|
||||
description: Simulated screenshot capture for testing
|
||||
tags: test, recon, visual
|
||||
|
||||
params:
|
||||
- name: threads
|
||||
value: "5"
|
||||
- name: timeout
|
||||
value: "30"
|
||||
|
||||
steps:
|
||||
# Step 1: Setup directories
|
||||
- name: setup-directories
|
||||
type: bash
|
||||
commands:
|
||||
- mkdir -p {{Output}}/screenshots/full
|
||||
- mkdir -p {{Output}}/screenshots/thumbnails
|
||||
exports:
|
||||
screenshots_dir: "{{Output}}/screenshots"
|
||||
|
||||
# Step 2: Create sample target list
|
||||
- name: create-target-list
|
||||
type: bash
|
||||
command: |
|
||||
echo "http://{{Target}}" > {{screenshots_dir}}/targets.txt
|
||||
echo "https://{{Target}}" >> {{screenshots_dir}}/targets.txt
|
||||
echo "http://www.{{Target}}" >> {{screenshots_dir}}/targets.txt
|
||||
echo "https://api.{{Target}}" >> {{screenshots_dir}}/targets.txt
|
||||
exports:
|
||||
screenshot_targets: "{{screenshots_dir}}/targets.txt"
|
||||
|
||||
# Step 3: Simulate screenshot capture with foreach
|
||||
- name: capture-screenshots
|
||||
type: foreach
|
||||
input: "{{screenshot_targets}}"
|
||||
variable: url
|
||||
threads: "{{threads}}"
|
||||
step:
|
||||
name: capture-single
|
||||
type: bash
|
||||
command: |
|
||||
# Simulate screenshot by creating placeholder file
|
||||
FILENAME=$(echo "[[url]]" | sed 's/[^a-zA-Z0-9]/_/g')
|
||||
touch {{screenshots_dir}}/full/${FILENAME}.png
|
||||
echo "[[url]] -> ${FILENAME}.png" >> {{screenshots_dir}}/capture-log.txt
|
||||
sleep 0.3
|
||||
timeout: "{{timeout}}"
|
||||
|
||||
# Step 4: Generate thumbnails (simulated)
|
||||
- name: generate-thumbnails
|
||||
type: bash
|
||||
command: |
|
||||
# Simulate thumbnail generation
|
||||
for f in {{screenshots_dir}}/full/*.png; do
|
||||
if [ -f "$f" ]; then
|
||||
BASENAME=$(basename "$f")
|
||||
touch {{screenshots_dir}}/thumbnails/thumb_${BASENAME}
|
||||
fi
|
||||
done
|
||||
sleep 0.2
|
||||
timeout: 60
|
||||
|
||||
# Step 5: Generate HTML index
|
||||
- name: generate-index
|
||||
type: bash
|
||||
command: |
|
||||
cat > {{Output}}/screenshots-index.html << 'HTMLEOF'
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head><title>Screenshots - {{Target}}</title></head>
|
||||
<body>
|
||||
<h1>Screenshot Gallery for {{Target}}</h1>
|
||||
<p>Generated at $(date)</p>
|
||||
<ul>
|
||||
HTMLEOF
|
||||
|
||||
for f in {{screenshots_dir}}/full/*.png; do
|
||||
if [ -f "$f" ]; then
|
||||
BASENAME=$(basename "$f")
|
||||
echo "<li><a href='screenshots/full/${BASENAME}'>${BASENAME}</a></li>" >> {{Output}}/screenshots-index.html
|
||||
fi
|
||||
done
|
||||
|
||||
cat >> {{Output}}/screenshots-index.html << 'HTMLEOF'
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
HTMLEOF
|
||||
exports:
|
||||
screenshots_index: "{{Output}}/screenshots-index.html"
|
||||
|
||||
# Step 6: Count and log results
|
||||
- name: count-results
|
||||
type: bash
|
||||
commands:
|
||||
- ls -1 {{screenshots_dir}}/full/*.png 2>/dev/null | wc -l > {{Output}}/screenshot-count.txt
|
||||
- echo "Screenshot capture completed at $(date)" >> {{Output}}/screenshot-stats.txt
|
||||
- "cat {{Output}}/screenshot-count.txt | xargs -I{} echo \"Screenshots captured: {}\" >> {{Output}}/screenshot-stats.txt"
|
||||
|
||||
# Step 7: Log completion
|
||||
- name: log-completion
|
||||
type: function
|
||||
function: |
|
||||
log_info("Screenshot capture completed for {{Target}}");
|
||||
return true;
|
||||
@@ -0,0 +1,106 @@
|
||||
# Subdomain Enumeration Module (Test Style)
|
||||
# This is a test-style workflow using simple commands for testing purposes.
|
||||
# In production, replace echo commands with real tools like subfinder, amass, etc.
|
||||
|
||||
name: subdomain-enum
|
||||
kind: module
|
||||
description: Simulated subdomain enumeration for testing
|
||||
tags: test, recon, subdomain
|
||||
|
||||
params:
|
||||
- name: threads
|
||||
value: "5"
|
||||
- name: wordlist
|
||||
value: "{{Data}}/wordlists/sample-subdomains.txt"
|
||||
|
||||
steps:
|
||||
# Step 1: Setup directories
|
||||
- name: setup-directories
|
||||
type: bash
|
||||
commands:
|
||||
- mkdir -p {{Output}}/subdomains/sources
|
||||
- mkdir -p {{Output}}/subdomains/resolved
|
||||
exports:
|
||||
subdomain_dir: "{{Output}}/subdomains"
|
||||
sources_dir: "{{Output}}/subdomains/sources"
|
||||
|
||||
# Step 2: Validate target using function
|
||||
- name: validate-target
|
||||
type: function
|
||||
function: |
|
||||
log_info("Starting subdomain enumeration for: {{Target}}");
|
||||
if (isEmpty("{{Target}}")) {
|
||||
log_error("Target is empty");
|
||||
return false;
|
||||
}
|
||||
log_info("Target validation passed");
|
||||
return true;
|
||||
|
||||
# Step 3: Simulate passive enumeration with parallel steps
|
||||
- name: passive-enumeration
|
||||
type: parallel-steps
|
||||
parallel_steps:
|
||||
- name: simulate-subfinder
|
||||
type: bash
|
||||
command: |
|
||||
echo "www.{{Target}}" > {{sources_dir}}/subfinder.txt
|
||||
echo "api.{{Target}}" >> {{sources_dir}}/subfinder.txt
|
||||
echo "admin.{{Target}}" >> {{sources_dir}}/subfinder.txt
|
||||
sleep 0.5
|
||||
timeout: 30
|
||||
|
||||
- name: simulate-amass
|
||||
type: bash
|
||||
command: |
|
||||
echo "mail.{{Target}}" > {{sources_dir}}/amass.txt
|
||||
echo "dev.{{Target}}" >> {{sources_dir}}/amass.txt
|
||||
echo "staging.{{Target}}" >> {{sources_dir}}/amass.txt
|
||||
sleep 0.5
|
||||
timeout: 30
|
||||
|
||||
- name: simulate-assetfinder
|
||||
type: bash
|
||||
command: |
|
||||
echo "blog.{{Target}}" > {{sources_dir}}/assetfinder.txt
|
||||
echo "shop.{{Target}}" >> {{sources_dir}}/assetfinder.txt
|
||||
sleep 0.5
|
||||
timeout: 30
|
||||
|
||||
# Step 4: Merge and deduplicate results
|
||||
- name: merge-results
|
||||
type: bash
|
||||
command: "cat {{sources_dir}}/*.txt | sort -u > {{subdomain_dir}}/all-subdomains.txt"
|
||||
exports:
|
||||
all_subdomains: "{{subdomain_dir}}/all-subdomains.txt"
|
||||
|
||||
# Step 5: Count results using function
|
||||
- name: count-results
|
||||
type: function
|
||||
function: |
|
||||
var count = fileLength("{{all_subdomains}}");
|
||||
log_info("Found " + count + " unique subdomains");
|
||||
return count;
|
||||
exports:
|
||||
subdomain_count: "{{Result}}"
|
||||
|
||||
# Step 6: Simulate DNS resolution with foreach
|
||||
- name: resolve-subdomains
|
||||
type: foreach
|
||||
input: "{{all_subdomains}}"
|
||||
variable: subdomain
|
||||
threads: "{{threads}}"
|
||||
step:
|
||||
name: resolve-single
|
||||
type: bash
|
||||
command: |
|
||||
echo "[[subdomain]] -> 127.0.0.1" >> {{subdomain_dir}}/resolved/dns-results.txt
|
||||
sleep 0.1
|
||||
timeout: 10
|
||||
|
||||
# Step 7: Final aggregation
|
||||
- name: final-output
|
||||
type: bash
|
||||
commands:
|
||||
- cat {{subdomain_dir}}/resolved/*.txt 2>/dev/null | sort -u > {{Output}}/final-subdomains.txt
|
||||
- echo "Enumeration completed at $(date)" >> {{Output}}/stats.txt
|
||||
- "wc -l {{subdomain_dir}}/all-subdomains.txt | awk '{print \"Total subdomains: \" $1}' >> {{Output}}/stats.txt"
|
||||
@@ -0,0 +1,109 @@
|
||||
# Vulnerability Scanning Module (Test Style)
|
||||
# This is a test-style workflow using simple commands for testing purposes.
|
||||
# In production, replace echo commands with real tools like nuclei, nikto, etc.
|
||||
|
||||
name: vuln-scan
|
||||
kind: module
|
||||
description: Simulated vulnerability scanning for testing
|
||||
tags: test, vuln, security
|
||||
|
||||
params:
|
||||
- name: threads
|
||||
value: "10"
|
||||
- name: severity
|
||||
value: "critical,high,medium"
|
||||
- name: timeout
|
||||
value: "1800"
|
||||
|
||||
steps:
|
||||
# Step 1: Setup directories
|
||||
- name: setup-directories
|
||||
type: bash
|
||||
commands:
|
||||
- mkdir -p {{Output}}/vulns/raw
|
||||
- mkdir -p {{Output}}/vulns/processed
|
||||
exports:
|
||||
vulns_dir: "{{Output}}/vulns"
|
||||
|
||||
# Step 2: Validate inputs
|
||||
- name: validate-inputs
|
||||
type: function
|
||||
function: |
|
||||
log_info("Starting vulnerability scan for: {{Target}}");
|
||||
log_info("Severity filter: {{severity}}");
|
||||
log_info("Thread count: {{threads}}");
|
||||
return true;
|
||||
|
||||
# Step 3: Simulate nuclei scan
|
||||
- name: nuclei-scan
|
||||
type: bash
|
||||
command: |
|
||||
# Simulate nuclei-style JSON output
|
||||
cat > {{vulns_dir}}/raw/nuclei-results.json << 'EOF'
|
||||
{"template":"cve-2021-44228","severity":"critical","host":"{{Target}}","matched":"log4j","info":{"name":"Log4j RCE","description":"Apache Log4j2 RCE"}}
|
||||
{"template":"xss-reflected","severity":"medium","host":"{{Target}}","matched":"<script>","info":{"name":"Reflected XSS","description":"Cross-site scripting vulnerability"}}
|
||||
{"template":"open-redirect","severity":"low","host":"{{Target}}","matched":"redirect=","info":{"name":"Open Redirect","description":"URL redirect vulnerability"}}
|
||||
EOF
|
||||
sleep 1
|
||||
timeout: "{{timeout}}"
|
||||
exports:
|
||||
nuclei_results: "{{vulns_dir}}/raw/nuclei-results.json"
|
||||
|
||||
# Step 4: Simulate additional scanner
|
||||
- name: additional-scan
|
||||
type: bash
|
||||
command: |
|
||||
# Simulate additional vulnerability findings
|
||||
cat > {{vulns_dir}}/raw/additional-results.txt << 'EOF'
|
||||
[HIGH] SQL Injection potential at /api/search?q=
|
||||
[MEDIUM] Missing security headers: X-Frame-Options
|
||||
[LOW] Server version disclosure: nginx/1.18.0
|
||||
EOF
|
||||
sleep 0.5
|
||||
timeout: 300
|
||||
|
||||
# Step 5: Process and categorize results
|
||||
- name: process-results
|
||||
type: bash
|
||||
parallel_commands:
|
||||
- grep '"severity":"critical"' {{nuclei_results}} > {{vulns_dir}}/processed/critical.json 2>/dev/null || true
|
||||
- grep '"severity":"high"' {{nuclei_results}} > {{vulns_dir}}/processed/high.json 2>/dev/null || true
|
||||
- grep '"severity":"medium"' {{nuclei_results}} > {{vulns_dir}}/processed/medium.json 2>/dev/null || true
|
||||
- grep '"severity":"low"' {{nuclei_results}} > {{vulns_dir}}/processed/low.json 2>/dev/null || true
|
||||
exports:
|
||||
critical_vulns: "{{vulns_dir}}/processed/critical.json"
|
||||
high_vulns: "{{vulns_dir}}/processed/high.json"
|
||||
|
||||
# Step 6: Generate summary report
|
||||
- name: generate-summary
|
||||
type: bash
|
||||
command: |
|
||||
echo "=== Vulnerability Scan Summary ===" > {{Output}}/vuln-summary.txt
|
||||
echo "Target: {{Target}}" >> {{Output}}/vuln-summary.txt
|
||||
echo "Scan completed at: $(date)" >> {{Output}}/vuln-summary.txt
|
||||
echo "" >> {{Output}}/vuln-summary.txt
|
||||
echo "Findings by severity:" >> {{Output}}/vuln-summary.txt
|
||||
echo " Critical: $(grep -c 'critical' {{nuclei_results}} 2>/dev/null || echo 0)" >> {{Output}}/vuln-summary.txt
|
||||
echo " High: $(grep -c 'high' {{nuclei_results}} 2>/dev/null || echo 0)" >> {{Output}}/vuln-summary.txt
|
||||
echo " Medium: $(grep -c 'medium' {{nuclei_results}} 2>/dev/null || echo 0)" >> {{Output}}/vuln-summary.txt
|
||||
echo " Low: $(grep -c 'low' {{nuclei_results}} 2>/dev/null || echo 0)" >> {{Output}}/vuln-summary.txt
|
||||
exports:
|
||||
vuln_summary: "{{Output}}/vuln-summary.txt"
|
||||
|
||||
# Step 7: Merge all results
|
||||
- name: merge-results
|
||||
type: bash
|
||||
commands:
|
||||
- cat {{vulns_dir}}/raw/*.json > {{Output}}/all-vulns.json 2>/dev/null || true
|
||||
- cat {{vulns_dir}}/raw/*.txt >> {{Output}}/all-vulns.txt 2>/dev/null || true
|
||||
exports:
|
||||
all_vulns: "{{Output}}/all-vulns.json"
|
||||
|
||||
# Step 8: Log completion with statistics
|
||||
- name: log-completion
|
||||
type: function
|
||||
function: |
|
||||
var summary = readFile("{{vuln_summary}}");
|
||||
log_info("Vulnerability scan completed");
|
||||
log_info(summary);
|
||||
return true;
|
||||
Reference in New Issue
Block a user