https://github.com/Adversis/PandorasBox

Security tool to quickly audit Public Box files and folders.
https://github.com/Adversis/PandorasBox

bugbounty cloud-security penetration-testing security-tools

Last synced: 28 days ago
JSON representation

Security tool to quickly audit Public Box files and folders.

• Host: GitHub
• URL: https://github.com/Adversis/PandorasBox
• Owner: Adversis
• License: bsd-3-clause
• Created: 2019-03-09T02:37:23.000Z (almost 6 years ago)
• Default Branch: master
• Last Pushed: 2019-09-29T21:20:37.000Z (about 5 years ago)
• Last Synced: 2024-02-15T10:35:19.218Z (10 months ago)
• Topics: bugbounty, cloud-security, penetration-testing, security-tools
• Language: Python
• Size: 44.9 KB
• Stars: 55
• Watchers: 5
• Forks: 24
• Open Issues: 4
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• cybersecurity-golang-security - PandorasBox - Security tool to quickly audit Public Box files and folders. (General Post Exploitation)
• awesome-go-security - PandorasBox - Security tool to quickly audit Public Box files and folders. (General Post Exploitation)

README

        
# PandorasBox

#### Pandoras Box is a tool to find Enterprise Box accounts and enumerate for shared files and folders

#### Writeup can be found here: [adversis.io](https://adversis.io/research/pandorasbox)

#### [@adversis_io](https://twitter.com/adversis_io)

 

## Pre-Requisites

Non-Standard Python Libraries:

* requests

* argparse

* xmltodict

Created with Python 3.6

### Install with virtualenv

```virtualenv-3.6 venv

source venv/bin/activate

pip install -r requirements.txt

```

## General

This tool can be used to enumerate for companies that currently have a Box enterprise account, and then to brute force files and folders inside those account that are shared publicly. 

  `-l` : Feed a line delimited target list to check for a Box account and begin enumeration.

  

  `-w` : Feed a word list to brute force documents in the identified target Box account.

  `-t` switch, you can set the number of threads you want to use. Be careful here, Box does enforce rate limiting and your IP may get blocked. 

  `-v` : Verbose logging

  

  `-s` : By supplying a Slack WebHook URL, you can send results to Slack.

  `-c` : You can give the tool a known shared Box file. This allows the tool to verify access to Box, if access to the known Box is denied, then Box is rate limiting your requests and you will need to change you IP. The defaul Box belongs to Dell and was found by a Google Dork. If this Box file gets taken down, a new Box file will have to be supplied. A work around would be to simply put google.com here. 

The example worlist is an exact copy of: https://github.com/first20hours/google-10000-english/blob/master/google-10000-english.txt

## Usage:

    usage: pandoras_box.py [-h] -l TARGETLIST [-w WORDLIST] [-v] [-t THREADS]

                           [-s WEBHOOK_URL] [-c LOCKOUT_CHECK]

    optional arguments:

      -h, --help        show this help message and exit

      -l TARGETLIST     Provide a list of targets to check Box accounts for.

      -w WORDLIST       Provide a wordlist for the file/folder bruteforce.

      -v                Output all webrequests to logfile. Caution size!

      -t THREADS        Number of threads.

      -s WEBHOOK_URL    Slack Web Hook URL

      -c LOCKOUT_CHECK  URL of known shared Box account to verify you are not

                        being blocked.