Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/PeterMosmans/security-scripts

A collection of security related Python and Bash shell scripts. Analyze hosts on generic security vulnerabilities. Wrapper around popular tools like nmap (portscanner), nikto (webscanner) and testssl.sh (SSL/TLS scanner)
https://github.com/PeterMosmans/security-scripts

nikto nmap python security security-scanner security-tools ssl testssl

Last synced: 5 days ago
JSON representation

Host: GitHub
URL: https://github.com/PeterMosmans/security-scripts
Owner: PeterMosmans
License: gpl-3.0
Created: 2013-12-22T02:40:01.000Z (almost 11 years ago)
Default Branch: master
Last Pushed: 2023-12-05T10:28:32.000Z (11 months ago)
Last Synced: 2024-10-26T21:22:53.316Z (16 days ago)
Topics: nikto, nmap, python, security, security-scanner, security-tools, ssl, testssl
Language: Shell
Homepage:
Size: 481 KB
Stars: 261
Watchers: 33
Forks: 79
Open Issues: 2
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE

Awesome Lists containing this project

README

# security-scripts

A collection of security related Python and Bash shell scripts, mainly revolving
around testing hosts for security vulnerabilities. For the shell scripts no
fancy programming framework is required, all that is needed is a Bash shell.

Note that it is highly recommended to use `analyze_hosts.py` as it is the most
recent version. No new features will be added to the Bash version
`analyze_hosts.sh`.

`analyze_hosts` is also available as Docker image, including the open source
scanners `droopescan`, `nmap`, `Nikto` and `testssl.sh`. Build it yourself using
the supplied Dockerfile, or grab the image from Docker Hub

```
docker run --rm gofwd/analyze_hosts
```

You can also run the included tools that way; just override the entrypoint. As
an example, run `testssl.sh`:

```
docker run --rm --entrypoint 'testssl.sh' gofwd/analyze_hosts
```

## analyze_hosts.py

The main objectives for the script is to make it as easy as possible to perform
generic security tests, without any heavy prerequisites, make the output as
informative as possible, and use open source tools. It can easily be used as
scheduled task, or be implemented in Continuous Integration environments.

The only requirements are `nmap` and `Python3`.

As the scan output can be written to a JSON file it can be used to generate
deltas (differences) between scans, or to use the output for further inspection.

### Installation

Note that you can also run `analyze_hosts` straight from a Docker image:

```
docker run --rm gofwd/analyze_hosts
```

One-time installation steps without virtualenv (all required Python libraries
are specified in the `requirements.txt` file):

```
git clone https://github.com/PeterMosmans/security-scripts && \
cd security-script && \
pip3 install -r requirements.txt
```

### Usage

```
usage: analyze_hosts.py [-h] [--version] [--dry-run] [-i INPUTFILE] [-o OUTPUT_FILE] [--compact] [--queuefile QUEUEFILE] [--resume] [--settings SETTINGS]
[--exit-code] [--force] [--debug] [-v] [-q] [--allports] [-n] [-p PORT] [--up] [--udp] [--framework] [--http] [--compression]
[--headers] [--trace] [--redirect] [--force-ssl] [--json JSON] [--ssl] [--nikto] [--sslcert] [-w] [--proxy PROXY]
[--timeout TIMEOUT] [--threads THREADS] [--user-agent USER_AGENT] [--password PASSWORD] [--username USERNAME] [--maxtime MAXTIME]
[target]

analyze_hosts - scans one or more hosts for security misconfigurations

Copyright (C) 2015-2022 Peter Mosmans [Go Forward]
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

positional arguments:
target [TARGET] can be a single (IP) address, an IP range, or multiple comma-separated addressess

optional arguments:
-h, --help show this help message and exit
--version Show version and exit
--dry-run Only show commands, don't actually do anything
-i INPUTFILE, --inputfile INPUTFILE
A file containing targets, one per line
-o OUTPUT_FILE, --output-file OUTPUT_FILE
output file containing all scanresults (default analyze_hosts.output)
--compact Only log raw logfiles and alerts to file
--queuefile QUEUEFILE
the queuefile
--resume Resume working on the queue
--settings SETTINGS Name of settings file to use (default analyze_hosts.yml)
--exit-code When supplied, return exit code 1 when alerts are discovered
--force Ignore / overwrite the queuefile
--debug Show debug information
-v, --verbose Be more verbose
-q, --quiet Do not show scan outputs on the console
--allports Run a full-blown nmap scan on all ports
-n, --no-portscan Do NOT run a nmap portscan
-p PORT, --port PORT Specific port(s) to scan
--up Assume host is up (do not rely on ping probe)
--udp Check for open UDP ports as well
--framework Analyze the website and run webscans
--http Check for various HTTP vulnerabilities (compression, headers, trace)
--compression Check for webserver compression
--headers Check for various HTTP headers
--trace Check webserver for HTTP TRACE method
--redirect Check for insecure redirect
--force-ssl Enforce SSL/TLS check on all open ports
--json JSON Save output in JSON file
--ssl Check for various SSL/TLS vulnerabilities
--nikto Run a nikto scan
--sslcert Download SSL certificate
-w, --whois Perform a whois lookup
--proxy PROXY Use proxy server (host:port)
--timeout TIMEOUT Timeout for requests in seconds (default 10)
--threads THREADS Maximum number of threads (default 5)
--user-agent USER_AGENT
Custom User-Agent to use (default analyze_hosts)
--password PASSWORD Password for HTTP basic host authentication
--username USERNAME Username for HTTP basic host authentication
--maxtime MAXTIME Timeout for scans in seconds (default 600)
```

The script `analyze_hosts` automatically execute other scans (based on their
fingerprint or open ports):

```
droopescan
nikto
testssl.sh
WPscan
```

You can use the following environment variables (all uppercase) to specify the
tools if they cannot be found in the standard paths:

CURL, DROOPESCAN, NIKTO, OPENSSL, TESTSSL, WPSCAN

### Suppressing false positives

A settings file can be used (`--settings`) to configure or tweak scan parameters
per host / port combination. This allows you to suppress false positives in scan
results. Currently the Nikto `Plugins`, `Tuning` and `output` parameters are
supported, as well as a list of allowed / expected open ports, and testssl
parameters:

Example settings file:

```
targets:
127.0.0.1:
allowed_ports: [22, 80, 443]
ports:
- port: 80
nikto_plugins: "@@ALL"
nikto_tuning: "x1"
nikto_output: "report.html"
- port: 443
testssl_untrusted: true
testssl:
- "--ccs-injection"
- "--ticketbleed"
- "--robot"

```

This will supply the `-Plugins '@@ALL' -Tuning 'x1' -output 'report.html'
parameters to Nikto, when port 80 is scanned.

Furthermore, it will not generate an alert when an open port other than port 22,
80 or 443 is found. By default, an alert will be generated if an open port other
than 80 or 443 is found.

There will no alert be generated if the SSL/TLS endpoint on port 443 contains an
untrusted (self-signed) certificate. And instead of all default tests, only
three SSL/TLS tests will be performed.

### JSON format

```
{
"arguments": {
"target": "1.2.3.1/30",
"version": false,
"dry_run": false,
"inputfile": "0frnfb4e",
"output_file": "output.txt,
"compact": true,
"queuefile": "analyze_hosts.queue",
"resume": false,
"force": false,
"debug": false,
"verbose": false,
"quiet": false,
"allports": false,
"no_portscan": false,
"port": null,
"up": false,
"udp": false,
"framework": false,
"http": true,
"json": "results.json",
"ssl": true,
"nikto": true,
"sslcert": false,
"trace": false,
"whois": false,
"proxy": null,
"timeout": true,
"threads": 5,
"user_agent": "analyze_hosts",
"password": null,
"username": null,
"maxtime": 1200,
"testssl.sh": true,
"curl": false,
"wpscan": true,
"droopescan": true,
"nmap": true,
"nmap_arguments": "-sV --open -sS --script=banner,dns-nsid,dns-recursion,http-cisco-anyconnect,http-php-version,http-title,http-trace,ntp-info,ntp-monlist,nbstat,rdp-enum-encryption,rpcinfo,sip-methods,smb-os-discovery,smb-security-mode,smtp-open-relay,ssh2-enum-algos,vnc-info,xmlrpc-methods,xmpp-info"
},
"date_start": "2020-05-26 31:33:06"
"results": {
"1.2.3.1": {
"ports": [
53
]
},
"1.2.3.2": {
"ports": []
},
"1.2.3.3": {
"ports": [
80,
443
],
"alerts": [
":443 LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches"
]
},
"1.2.3.4": {
"ports": [
80,
443
],
"alerts": [
":443 + OSVDB-3092: /download/: This might be interesting...",
":443 + OSVDB-3092: /status/: This might be interesting...",
":443 + OSVDB-4231: /DHrPp.xml: Coccoon from Apache-XML project reveals file system path in error messages.",
":443 + OSVDB-3092: /upgrade.php: upgrade.php was found."
]
}
},
"date_finish": "2020-05-26 31:33:07"
}
```

## display_results.py

A little helper script that formats the scan results nicely, so that scan
results can easily be reviewed.

```
usage: display_results.py [-h] [--info] [--version] [inputfile]

display_results version 0.0.1 - displays scan results nicely

positional arguments:
inputfile A JSON file containing scan results

optional arguments:
-h, --help show this help message and exit
--info Show also informational items
--version Show version and exit

```

## analyze-hosts.sh

A simple wrapper script around several open source security tools to simplify
scanning of hosts for network vulnerabilities. The script lets you analyze one
or several hosts for common misconfiguration vulnerabilities and weaknesses. The
main objectives for the script is to make it as easy as possible to perform
generic security tests, without any heavy prerequisites, make the output as
informative as possible, and use open source tools....

- [cipherscan](https://github.com/jvehent/cipherscan)
- curl
- nmap
- [openssl-1.0.2-chacha](https://github.com/PeterMosmans/openssl/tree/1.0.2-chacha/)
- [whatweb](https://github.com/urbanadventurer/WhatWeb)

* whois

### Examples

#### SSL certificates

```
./analyze_hosts.sh --sslcert www.google.com
```

Shows details of a certificate, like the issuer and subject. It warns when
certificate is expired or when the certificate is a certificate authority.

Example output:

```
trying to retrieve SSL x.509 certificate on www.google.com:443... received
issuer=
countryName = US
organizationName = Google Inc
commonName = Google Internet Authority G2
subject=
countryName = US
stateOrProvinceName = California
localityName = Mountain View
organizationName = Google Inc
commonName = www.google.com
OK: certificate is valid between 16-07-2014 and 14-10-2014
```

#### SSL/TLS ciphers

```
./analyze_hosts.sh --ssl --sslports 443 -v www.microsoft.com
```

Checks which ciphers are allowed. It warns when insecure ciphers are being used.
By default the ports 443, 465, 993, 995 and 3389 and are checked. You can
specify the ports by using --sslports The -v flag outputs all results, regardles
of the message type.

Example output:

```
prio ciphersuite protocols pfs_keysize
1 RC4-MD5 SSLv3,TLSv1
2 RC4-SHA SSLv3,TLSv1
3 DES-CBC3-SHA SSLv3,TLSv1
4 AES256-SHA TLSv1
5 AES128-SHA TLSv1

Certificate: UNTRUSTED, 2048 bit, sha1WithRSAEncryption signature
trying to retrieve SSL x.509 certificate on www.microsoft.com:443... received
issuer=
domainComponent = com
domainComponent = microsoft
domainComponent = corp
domainComponent = redmond
commonName = MSIT Machine Auth CA 2
subject=
countryName = US
stateOrProvinceName = WA
localityName = Redmond
organizationName = Microsoft Corporation
organizationalUnitName = MSCOM
commonName = www.microsoft.com
OK: certificate is valid between 12-01-2013 and 12-01-2015

### usage

```
./analyze_hosts.sh [OPTION]... [HOST]

Scanning options:
-a, --all perform all basic scans
--max perform all advanced scans (more thorough)
-b, --basic perform basic scans (fingerprint, ssl, trace)
results of HOST matches regexp FILTER
--dns test for recursive query and version string
-f perform web fingerprinting (all webports)
--fingerprint perform all web fingerprinting methods
-h, --header show webserver headers (all webports)
-n, --nikto nikto webscan (all webports)
-p nmap portscan (top 1000 TCP ports)
--ports nmap portscan (all ports, TCP and UDP)
--redirect test for open secure redirect
-s check SSL configuration
--ssl perform all SSL configuration checks
--sslcert show details of SSL certificate
--timeout=SECONDS change timeout for tools (default 60)
--ssh perform SSH configuration checks
-t check webserver for HTTP TRACE method
--trace perform all HTTP TRACE method checks
-w, --whois perform WHOIS lookup for (hostname and) IP address
-W confirm WHOIS results before continuing scan
--filter=FILTER only proceed with scan of HOST if WHOIS
--wordlist=filename scan webserver for existence of files in filename

Port selection (comma separated list):
--webports=PORTS use PORTS for web scans (default 80,443,8080)
--sslports=PORTS use PORTS for ssl scans (default 443,465,993,995,3389)

Logging and input file:
-d, --directory=DIR location of temporary files (default /tmp)
-i, --inputfile=FILE use a file containing hostnames
-l, --log log each scan in a separate logfile
--nocolor don't use fancy colors in screen output
-o, --output=FILE concatenate all OK and WARNING messages into FILE
-q, --quiet quiet
-v, --verbose show server responses

Default programs:
--cipherscan=FILE location of cipherscan (default cipherscan)
--openssl=FILE location of openssl (default openssl)

-u update this script (if it's a cloned repository)
--update force update (overwrite all local modifications)
--version print version information and exit

BLUE: INFO, status messages
GREEN: OK, secure settings
RED: WARNING, possible vulnerabilities

[HOST] can be a single (IP) address, an IP range, eg. 127.0.0.1-255
or multiple comma-separated addressess
```

### history

- since 0.88: preliminary support for starttls xmpp

## test_ssl_handhake.sh

A script to test TLS/SSL handshakes with. Several bugtests are included:

- 128 cipherlimit when using tls1_2 protocol
- aRSA cipher order
- version intolerant server

\$ ./test_ssl_handshake.sh

```
(c) 2014 Peter Mosmans [Go Forward]
Licensed under the GPL 3.0

tests SSL/TLS handshakes (for known bugs)

usage: ./test_ssl_handshake.sh target[:port] [start]

[start] number of ciphers to start with (default 125)
--ciphers=FILE a file containing a list which ciphers to use
--cipherstring=CIPHERSTRING
cipherstring (default )
-f | --force continue even though the error has been detected
--iterate iterate through all the ciphers instead of adding
--openssl=FILE location of openssl (default )
-v | --verbose be more verbose, please

tests:
--128 test for 128 cipherlimit
--intolerant test for version intolerant server
--rsa test for RSA order sensitivity

by default, all tests will be performed
```