Pentester-Toolkit.py

#!/usr/bin/env python
# Under MIT License
# Free & Open Source , Feel Free to Redistribute it
# Don't Try to Change Author's Name
# Copyright (c) Muhammad Adeel - 2014
# Version 1.0 (stable release)
# Chaudhary1337@gmail.com

import requests,re,os,sys,time,urllib,urllib2,socket

try:
	from termcolor import *
except:
	print " -- install termcolor By using: 'sudo easy_install termcolor' -- "
	
def banner():
	os.system('clear')
	cprint('''
    ____             __            __                ______            ____ __ _ __ 
   / __ \___  ____  / /____  _____/ /____  _____    /_  __/___  ____  / / //_/(_) /_
  / /_/ / _ \/ __ \/ __/ _ \/ ___/ __/ _ \/ ___/_____/ / / __ \/ __ \/ / ,<  / / __/
 / ____/  __/ / / / /_/  __(__  ) /_/  __/ /  /_____/ / / /_/ / /_/ / / /| |/ / /_  
/_/    \___/_/ /_/\__/\___/____/\__/\___/_/        /_/  \____/\____/_/_/ |_/_/\__/  
                                                       ''', 'green', attrs=['bold'])

banner()
cprint(' -- UrduSecurity WebApp Header Analysis Tool Kit --', "green", attrs=['bold'])
print colored("+++", "green") * 16
cprint(' -- Version: 1.0--', "green", attrs=['bold'])
print colored("+++", "green") * 16
print " -- Blog: " + colored("http://urdusecurity.blogspot.com", "green") + " -- "
print colored("+++", "green") * 16
print " -- Author: " + colored("Muhammad Adeel", "green") + " --"
print colored("+++", "green") * 16
print " -- PlatForm: " + colored("{0}", "green").format(sys.platform) + " -- " 
print colored("+++", "green") * 16
print " -- Usage: " + colored("python {0}","green").format(sys.argv[0]) + " -- "
print colored("+++", "green") * 16
print " -- Scan Started at:" + colored(" {0}", "green").format(time.ctime()) + " -- "
print colored("+++", "green") * 16
print """
[!] Check for Both 'http' & 'https' For Better Results

[+] 1.  Get Server Info
[+] 2.  Check For HttpOnly Flag
[+] 3.  Check For XFrame-Options
[+] 4.  Check For X-XSS-Protection
[+] 5.  Check For X-Content-Type options
[+] 6.  Check For SSL/TLS Security
[+] 7.  Check For Content Secret Policey
[+] 8.  Check For Access Control flaws
[+] 9.  Check For X-Download Options
[+] 10. Check For Cache Control Options
[+] 11. Check For Dns MisConfiguration
[+] 12. Check For All Attacks."""
print colored("+++", "green") * 16

def input():
	global select_mode
	global target_url
	select_mode = raw_input(colored('\n(Select)> ', 'green'))
	target_url = raw_input(colored('(Url)> ', 'green'))
input()

def CheckServer():
	print colored("+++", "green") * 16
	print colored("-- Getting Server Info --", "green")
	print colored("+++", "green") * 16
	s_check = requests.post(target_url)
	regex = '''<meta name="generator" content="(.+?)" />'''
	check_regex = re.findall(regex, s_check.content)
	try:
		if s_check.raw.headers.has_key('server'):
			print "[+] Server Header is Present"
			ser = s_check.raw.getheader('server')
			print "[+] Target is using Following Server: " + colored("{0}", "green").format(ser)
		if s_check.raw.headers.has_key('x-content-encoded-by'):
			script = s_check.raw.getheader('x-content-encoded-by')
			print "[+] Web Based on: " + colored("{0}", "green").format(script)
		if s_check.raw.headers.has_key('x-powered-by'):
			xx = s_check.raw.getheader('x-powered-by')
			print "[+] PHP: " + colored("{0}","green").format(xx)
		if check_regex:
			print "[+] Web Based on:" + colored(" {0}", "green").format(check_regex)
		else:
			print "[-] Unable to Find Web Script"
	except:
		print "-- Exception Catched --"

def HttpOnly():
	print colored("+++", "green") * 16
	print colored("-- Checking for HttpOnly Flag --", "green")
	print colored("+++", "green") * 16
	checkfor = requests.post(target_url)
	var = checkfor.raw.headers.has_key('set-cookie')
	var2 = 'HttpOnly'
	if var:
		print "[+] Set-Cookie Found..\n[+] Trying for HttpOnly..."
		try:
			if var2 in checkfor.raw.headers.viewvalues():
				print "[+] HttpOnly Flg is:" + colored(" Present", "green")
			else:
				print "[-] HttpOnly Flag is:" + colored(" Not Present", "green")
		except:
			print "-- Exception catched --"
			pass
	else:
		print "[-] Set-Cookie Not Found."	
	
def XframeOptions():
	print colored("+++", "green") * 16
	print colored("-- Checking For X-Frame-Options --", "green")
	print colored("+++", "green") * 16
	checkforxframe = requests.post(target_url)
	if checkforxframe.raw.headers.has_key('x-frame-options'):
		print "[+] X-Frame-Options is Present.\n[+] Checking For Methods.."
		list_Method = ['DENY', 'SAMEORIGIN', 'ALLOW-FROM', 'Deny', 'SameOrigin', 'Allow-From', 'deny', 'sameorigin', 'allow-from']
		for x in range(0, 9):
			if list_Method[x] in checkforxframe.raw.getheader('x-frame-options'):
				print "[+] Following XFrame Option Found:" + colored(" {0}", "green").format(list_Method[x])
			else:
				print "[-] Not Found:" + colored(" {0}", "green").format(list_Method[x])
	else:
		print "[-] X-Frame-Options Not Found. Client May be Vulnerable to: " + colored("Click Jacking", "green")

def XxssPro():
	print colored("+++", "green") * 16
	print colored(" -- Checking for X-XSS-Protection -- ", "green")
	print colored("+++", "green") * 16
	checkxsspro = requests.post(target_url)
	try:
		if checkxsspro.raw.headers.has_key('x-xss-protection'):
			print "[+] X-XSS Protection is Present.\n[+] Checking Value.."
			x_value = ['0','1','1; mode=block']
			if x_value[0] in checkxsspro.raw.getheader('x-xss-protection'):
				print "[+] X-XSS-Protection value is: " + colored("{0}", "green").format(x_value[0])
			elif x_value[2] in checkxsspro.raw.getheader('x-xss-protection'):
				print "[+] X-XSS-Protection value is: " + colored("{0}", "green").format(x_value[2])
			else:
				print "[+] X-XSS-Protection value is: " + colored("{0}", "green").format(x_value[1])
		else:
			print "[-] X-XSS-Protection Header Not Found. Client May be Vulnerable to: " + colored("Cross Site Scripting", "green")
	except:
		print "-- Exception Cacthed --"

def xContentType():
	print colored("+++", "green") * 16
	print colored(" -- Checking for X-Content-Type -- ", "green")
	print colored("+++", "green") * 16
	xcon = requests.post(target_url)
	if xcon.raw.headers.has_key('x-content-type-options'):
		ch = 'nosniff'
		if ch in xcon.raw.getheader('x-content-type-options'):
			print "[+] MIME Sniffing is Protected: " + colored("{0}", "green").format(ch)
		else:
			print "[-] Unknown response!"
	else:
		print "[-] Client Could be Vulnerable to: " + colored("MIME Sniffing", "green")

def SSLTLS():
	print colored("+++", "green") * 16
	print colored(" -- Checking for SSL/TLS Security -- ", "green")
	print colored("+++", "green") * 16
	ssltls = requests.post(target_url)
	if ssltls.raw.headers.has_key('strict-transport-security'):
		print "[+] Strict Transport Security is Added."
	else:
		print "[-] Strict Transport Security is not Added, Client May be Vulnerable to: " + colored("Session Information Leakage", "green")
	
def secPol():
	print colored("+++", "green") * 16
	print colored(" -- Checking for x-content-security-policy -- ", "green")
	print colored("+++", "green") * 16
	sec = requests.post(target_url)
	if sec.raw.headers.has_key('x-content-security-policy'):
		print "[+] X-Content-Sec_Policy is Added"
	else:
		print "[-] Client Can be Vulnerable to: " + colored("Cross-Site Scripting and Injection Attacks.", "green")

def AccessControl():
	print colored("+++", "green") * 16
	print colored(" -- Checking for Access-Control-Allow-Origin -- ", "green")
	print colored("+++", "green") * 16
	acc = requests.post(target_url)
	if acc.raw.headers.has_key('access-control-allow-origin'):
		print "[+] Access-Control-Allow-Origin is Added"
	else:
		print "[-] Access-Control-Allow-Origin is not Available, Client May be vulnerable to: " + colored("Cross-Domain Scripting Attacks.", "green")

def Xdownload():
	print colored("+++", "green") * 16
	print colored(" -- Checking for X-Download-Options -- ", "green")
	print colored("+++", "green") * 16
	xdo = requests.post(target_url)
	if xdo.raw.headers.has_key('x-download-options'):
		xdd = 'noopen'
		if xdd in xdo.raw.getheader('x-download-options'):
			print "[+] File Download and Open Restriction are Added"
		else:
			print "[-] X-Download-Options Not Available, Client May be Vulnerable to: " + colored("Browser File Execution Attacks", "green")
	else:
		print "[-] X-Download-Options Not Available, Client May be Vulnerable to: " + colored("Browser File Execution Attacks", "green")
		
def cache():
	print colored("+++", "green") * 16
	print colored(" -- Checking for Cache Control -- ", "green")
	print colored("+++", "green") * 16
	cac = requests.post(target_url)
	if cac.raw.headers.has_key('cache-control'):
		print "[+] Private Content Cacheing is Added"
	else:
		print "[-] Private Content Cacheing is Not Found, client May be Vulnerable to: " + colored("Content Caching Attacks", "green")

#def crawler():
#	print colored("+++", "green") * 16
#	print colored("-- Crawling URLs --", "green")
#	print colored("+++", "green") * 16
#	try:
#		textfile = file('Pentester.txt','wt')
#		myurl = input('Enter url: ')
#		for i in re.findall('''href=["'](.[^"']+)["']''', urllib.urlopen(myurl).read(), re.I):
#			print i 
#			for ee in re.findall('''href=["'](.[^"']+)["']''', urllib.urlopen(i).read(), re.I):
#				print ee
 #               textfile.write(ee+'\n')
	#	textfile.close()
	#	print "[+] Check 'Pentester.txt' For URLs."	
	#except:
	#	print "-- Exception Catched --"

def DNSMiscon():
	print colored("+++", "green") * 16
	print colored(" -- Checking for DNS-Misconfiguration -- ", "green")
	print colored("+++", "green") * 16
	try:
		ip_address = socket.gethostbyaddr("localhost." + target_url )
		if ip_address[0] == "localhost":
			print "[-] Vulnerable to: " + colored("DNS Misconfiguration.","green") 
	except socket.error:
		print "[+] Not Vulnerable to: " + colored("DNS Misconfiguration", "green")
		print "-- Exception Catched --"

def Attack():
	if select_mode == '1':
		try:
			CheckServer()
			input()
		except:
			print "-- Exception Catched --\n"
			input()
	elif select_mode == '2':
		try:
			HttpOnly()
			input()
		except:
			print "-- Exception Catched --"
			input()
	elif select_mode == '3':
		try:
			XframeOptions()
			input()
		except:
			print "-- Exception Catched --"
			input()
	elif select_mode == '4':
		try:
			XxssPro()
			input()
		except:
			print "-- Exception Catched --"
			input()
	#elif select_mode == 'x':
	#	try:
	#		crawler()
	#		input()
	#	except:
	#		print "-- Exception Catched --"
	#		input()
	elif select_mode == '5':
		try:
			xContentType()
			input()
		except:
			print "-- Exception Catched --\n"
			input()
	elif select_mode == '6':
		try:
			SSLTLS()
			input()
		except:
			print "-- Exception Catched --\n"
			input()
	elif select_mode == '7':
		try:
			secPol()
			input()
		except:
			print "-- Exception Catched --\n"
			input()
	elif select_mode == '8':
		try:
			AccessControl()
			input()
		except:
			print "-- Exception Catched --\n"
			input()
	elif select_mode == '9':
		try:
			Xdownload()
			input()
		except:
			print "-- Exception Catched --\n"
			input()
	elif select_mode == '10':
		try:
			cache()
			input()
		except:
			print "-- Exception Catched --\n"
			input()
	elif select_mode == '11':
		try:
			DNSMiscon()
			input()
		except:
			print "-- Exception Catched --"
			input()
	elif select_mode == '12':
		try:
			CheckServer()
			HttpOnly()
			XframeOptions()
			XxssPro()
			xContentType()
			SSLTLS()
			secPol()
			AccessControl()
			Xdownload()
			cache()
			DNSMiscon()
			#crawler()
			input()
		except:
			print "-- Exception Catched --"
			input()
	else:
		print "[-] Invalid Choice!\n"
		input()
 
while select_mode > 0:
	Attack()

def main():
	if __name__ == '__main__':
		main()