Init commit

Signed-off-by: j3ssie <jeromej3m@gmail.com>

.gitignore

@@ -0,0 +1,7 @@
+.DS_STORE
+.goreleaser.yml
+dist
+out
+old-out
+http-out
+test-sign

LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2019 j3ssie
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

Makefile

@@ -0,0 +1,14 @@
+TARGET   ?= jaeles
+PACKAGES ?= core libs
+GO       ?= go
+GOFLAGS  ?= 
+
+run:
+	$(GO) $(GOFLAGS) run *.go
+
+fmt:
+	$(GO) $(GOFLAGS) fmt ./...; \
+	echo "Done."
+
+test:
+	$(GO) $(GOFLAGS) test ./... -v

README.md

@@ -0,0 +1,52 @@
+
+<p align="center">
+  <img alt="Jaeles" src="https://image.flaticon.com/icons/svg/1432/1432425.svg" height="140" />
+  <p align="center">
+    <a href=""><img alt="Software License" src="https://img.shields.io/badge/license-MIT-brightgreen.svg?style=flat-square"></a>
+    <a href="https://github.com/jaeles-project/jaeles"><img alt="Release" src="https://img.shields.io/badge/version-beta%20v0.1-red.svg"></a>
+  </p>
+</p>
+
+**Jaeles** is a powerful, flexible and easily extensible framework written in Go for building your own Web Application Scanner.
+
+![Architecture](https://github.com/jaeles-project/jaeles-plugins/blob/master/imgs/jaeles-architecture.png?raw=true)
+
+## Installation
+
+```
+go get -u github.com/jaeles-project/jaeles
+```
+
+Please visit the [Official Documention](https://jaeles-project.github.io/) for more details.
+
+Checkout [Signature Repo](https://github.com/jaeles-project/jaeles-signatures) for base signature.
+
+## Usage
+More usage [here](https://jaeles-project.github.io/usage/)
+
+Example commands.
+```
+jaeles scan -u http://example.com
+
+jaeles scan -s signatures/common/phpdebug.yaml -U /tmp/list_of_urls.txt
+
+jaeles scan --retry 3 --verbose -s "signatures/cves/jira-*" -U /tmp/list_of_urls.txt
+
+jaeles --verbose server -s sqli
+```
+
+## Showcases
+More showcase [here](https://jaeles-project.github.io/showcases/)
+
+[![asciicast](https://asciinema.org/a/281205.svg)](https://asciinema.org/a/281205)
+<p align="center">
+Detect Jira SSRF CVE-2019-8451
+</p>
+
+## Contribute
+
+If you have some new idea about this project, issue, feedback or found some valuable tool feel free to open an issue for just DM me via @j3ssiejjj.
+
+## License
+
+`Jaeles` is made with ♥  by [@j3ssiejjj](https://twitter.com/j3ssiejjj) and it is released under the MIT license.

cmd/config.go

@@ -0,0 +1,126 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+
+	"github.com/jaeles-project/jaeles/core"
+	"github.com/jaeles-project/jaeles/database"
+	"github.com/jaeles-project/jaeles/libs"
+	"github.com/spf13/cobra"
+)
+
+var configCmd *cobra.Command
+
+func init() {
+	// byeCmd represents the bye command
+	var configCmd = &cobra.Command{
+		Use:   "config",
+		Short: "Configuration CLI",
+		Long:  `Do some Configuration for db and signatures`,
+		RunE:  runConfig,
+	}
+	configCmd.Flags().Bool("clean", false, "Force continued operation when wildcard found")
+	configCmd.Flags().Int16P("level", "l", 1, "Provide custom header seperate by ';'")
+	configCmd.Flags().StringP("action", "a", "select", "Action")
+	configCmd.Flags().StringP("sign", "s", "", "Select signature")
+	// load signature
+	configCmd.Flags().StringP("signFolder", "F", "", "Signature Folder")
+	// used for cred action
+	configCmd.Flags().String("user", "", "Username")
+	configCmd.Flags().String("pass", "", "Password")
+	configCmd.Flags().Bool("hh", false, "More helper")
+	// used for cred action
+	configCmd.Flags().String("secret", "", "Secret of Burp Collab")
+	configCmd.Flags().String("collab", "", "List of Burp Collab File")
+
+	RootCmd.AddCommand(configCmd)
+
+}
+
+func runConfig(cmd *cobra.Command, args []string) error {
+	// print more help
+	helps, _ := cmd.Flags().GetBool("hh")
+	if helps == true {
+		HelperConfig()
+		os.Exit(1)
+	}
+
+	// DB connect
+	dbPath := path.Join(options.RootFolder, "sqlite.db")
+	db, err := database.InitDB(dbPath)
+	if err != nil {
+		panic("err open databases")
+	}
+	defer db.Close()
+
+	action, _ := cmd.Flags().GetString("action")
+
+	// update plugins and signatures
+	if action == "update" {
+		core.UpdatePlugins(options)
+		core.UpdateSignature(options)
+	}
+
+	// clean all the things
+	if action == "clean" {
+		database.CleanSigns()
+		database.CleanRecords()
+		database.CleanScans()
+	}
+
+	// create or update user
+	if action == "cred" {
+		// Create new user
+		username, _ := cmd.Flags().GetString("user")
+		password, _ := cmd.Flags().GetString("pass")
+		database.CreateUser(username, password)
+		libs.GoodF("Create new credentials %v:%v \n", username, password)
+	}
+
+	// load oob
+	if action == "oob" {
+		secret, _ := cmd.Flags().GetString("secret")
+		collabFile, _ := cmd.Flags().GetString("collab")
+		collabs := core.ReadingFile(collabFile)
+		for _, collab := range collabs {
+			database.ImportCollab(secret, collab)
+		}
+	}
+
+	// reload signature
+	if action == "reload" {
+		database.CleanSigns()
+		// select folder to load signature
+		SignFolder, _ := filepath.Abs(path.Join(options.RootFolder, "base-signatures"))
+		signFolder, _ := cmd.Flags().GetString("signFolder")
+		if signFolder != "" && core.FolderExists(signFolder) {
+			SignFolder = signFolder
+		}
+
+		allSigns := core.GetFileNames(SignFolder, ".yaml")
+		if allSigns != nil {
+			libs.InforF("Load Signature from: %v", SignFolder)
+			for _, signFile := range allSigns {
+				database.ImportSign(signFile)
+			}
+		}
+	}
+
+	libs.GoodF("Done the config")
+	return nil
+}
+
+// HelperConfig more helper message for config command
+func HelperConfig() {
+	h := "Config Command example:\n"
+	h += "jaeles config -a clean\n"
+	h += "jaeles config -a update\n"
+	h += "jaeles config -a reload\n"
+	h += "jaeles config -a reload -F /tmp/custom-signatures/\n"
+	h += "jaeles config -a cred --user sample --pass not123456\n"
+	h += "jaeles config -a oob --secret SomethingSecret --collab list_of_collabs.txt\n"
+	fmt.Printf(h)
+}

cmd/root.go

@@ -0,0 +1,132 @@
+package cmd
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+
+	"github.com/jaeles-project/jaeles/core"
+	"github.com/jaeles-project/jaeles/database"
+	"github.com/jaeles-project/jaeles/libs"
+	"github.com/mitchellh/go-homedir"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+var options = libs.Options{}
+var config struct {
+	defaultSign  string
+	secretCollab string
+	port         string
+}
+
+// RootCmd represents the base command when called without any subcommands
+var RootCmd = &cobra.Command{
+	Use:   "jaeles",
+	Short: "Jaeles Scanner",
+	Long:  fmt.Sprintf(`Jaeles - The Swiss Army knife for automated Web Application Testing %v by %v`, libs.VERSION, libs.AUTHOR),
+}
+
+// Execute main function
+func Execute() {
+	if err := RootCmd.Execute(); err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+}
+
+func init() {
+	cobra.OnInitialize(initConfig)
+
+	RootCmd.PersistentFlags().StringVar(&options.ConfigFile, "config", "", "config file (default is $HOME/.jaeles/config.yaml)")
+	RootCmd.PersistentFlags().StringVar(&options.SignFolder, "signDir", "~/.jaeles/signatures-base/", "signFolder")
+	RootCmd.PersistentFlags().StringVar(&options.RootFolder, "rootDir", "~/.jaeles/", "root Project")
+	RootCmd.PersistentFlags().StringVar(&options.ScanID, "scanID", "", "Scan ID")
+
+	RootCmd.PersistentFlags().StringVar(&options.Proxy, "proxy", "", "proxy")
+	RootCmd.PersistentFlags().IntVar(&options.Timeout, "timeout", 20, "timeout")
+	RootCmd.PersistentFlags().IntVar(&options.Retry, "retry", 2, "retry")
+
+	RootCmd.PersistentFlags().BoolVar(&options.SaveRaw, "save-raw", false, "save raw request")
+	RootCmd.PersistentFlags().BoolVar(&options.NoOutput, "no-output", false, "Do not store raw output")
+	RootCmd.PersistentFlags().BoolVarP(&options.Verbose, "verbose", "v", false, "Verbose")
+	RootCmd.PersistentFlags().BoolVar(&options.Debug, "debug", false, "Debug")
+	RootCmd.PersistentFlags().IntVar(&options.Refresh, "refresh", 10, "Refresh")
+
+	RootCmd.PersistentFlags().IntVarP(&options.Concurrency, "concurrency", "c", 20, "concurrency")
+	RootCmd.PersistentFlags().StringVarP(&options.Output, "output", "o", "out", "output folder name")
+}
+
+// initConfig reads in config file and ENV variables if set.
+func initConfig() {
+	fmt.Printf("Jaeles %v by %v\n", libs.VERSION, libs.AUTHOR)
+
+	if options.Debug {
+		options.Verbose = true
+	}
+
+	options.RootFolder, _ = homedir.Expand(options.RootFolder)
+	if !core.FolderExists(options.RootFolder) {
+		libs.InforF("Init new config at %v", options.RootFolder)
+		os.MkdirAll(options.RootFolder, 0750)
+		// cloning default repo
+		core.UpdatePlugins(options)
+		core.UpdateSignature(options)
+	}
+
+	// DB connect
+	var username, password string
+	dbPath := path.Join(options.RootFolder, "sqlite.db")
+	if _, err := os.Stat(dbPath); os.IsNotExist(err) {
+		db, err := database.InitDB(dbPath)
+		if err != nil {
+			panic("err open databases")
+		}
+		defer db.Close()
+		// Create new user
+		username = "jaeles"
+		password = core.GenHash(core.GetTS())[:6]
+		database.CreateUser(username, password)
+		libs.GoodF("Create new credentials %v:%v", username, password)
+
+		// reload signature
+		SignFolder, _ := filepath.Abs(path.Join(options.RootFolder, "base-signatures"))
+		libs.GoodF("Load Credentials from %v", SignFolder)
+		allSigns := core.GetFileNames(SignFolder, ".yaml")
+		if allSigns != nil {
+			for _, signFile := range allSigns {
+				database.ImportSign(signFile)
+			}
+		}
+		database.InitConfigSign()
+	}
+
+	configPath := path.Join(options.RootFolder, "config.yaml")
+	v := viper.New()
+	v.AddConfigPath(options.RootFolder)
+	v.SetConfigName("config")
+	v.SetConfigType("yaml")
+	if !core.FileExists(configPath) {
+		libs.InforF("Write new config to: %v", configPath)
+		// save default config if not exist
+		v.SetDefault("defaultSign", "*")
+		v.SetDefault("username", username)
+		v.SetDefault("password", password)
+		v.SetDefault("port", "5000")
+		v.WriteConfigAs(configPath)
+
+	} else {
+		if options.Debug {
+			libs.InforF("Load config from: %v", configPath)
+		}
+		b, _ := ioutil.ReadFile(configPath)
+		v.ReadConfig(bytes.NewBuffer(b))
+
+	}
+	config.defaultSign = fmt.Sprintf("%v", v.Get("defaultSign"))
+	config.port = fmt.Sprintf("%v", v.Get("port"))
+
+}