app.py

import os
import time
import json
import shutil
import subprocess

idx=0
i=0
index=0
snykarray_name=[]
snykarray_loc=[]
banditarray_name=[]
banditarray_loc=[]
banditarray_line=[]
banditarray_file=[]
global pwd0
count =0

os.system('eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"')
url=input('Please Insert Git Clone URL: ')
api_key=input("Please INPUT GuardRail API KEY:")
pwd0 = subprocess.check_output("pwd")
pwd1 = pwd0.decode('utf-8').replace('\n','')
jwt_token=os.popen('curl --request POST --header "Content-Type: application/json" --data "{ \\"apiKey\\": \\"'+api_key+'\\" }" https://api.guardrails.io/v2/auth | jq -r ".jwtToken"').read()
jwt_token=str(jwt_token)

os.system('git clone '+url)
url_parse=url.split('/')
name=url_parse[-1]
name=name.replace('.git','')
os.system('cd '+pwd1+"/"+name+'&& snyk code test > snyk.txt')
os.system('bandit -r ./'+name+' -f json -o ./'+name+'/bandit.json')

with open(pwd1+"/"+name+"/snyk.txt",'r') as f:
   with open('result.txt','w') as file:
      
      while True:
         line = f.readline()
         count=count+1
         if not line:
            break
         if line.find("✗")==1:
            line= line.split("]")
            snykarray_name.append(line)
            file.write("Vulnerability Name :"+line[1])   
         elif line.find("Path:")!=-1:
            line=line.split(":")
            line=line[1].split("line")
            file.write("Vulnerability Path :"+line[0]+"\n")   
            file.write("Vulnerability line :"+line[1])   
            file.write("----------------------------------------------------\n")
         line = ""
         

      f.close()
   file.close()

with open(str(pwd1)+"/"+name+"/bandit.json") as json_file:
   with open("result.txt",'a') as file:
      
      json_data = json.load(json_file)
      json_array = json_data['results']   
      for result in json_array:
         banditarray_name.append(result["test_name"])   
         banditarray_loc.append(result["filename"])
         banditarray_line.append(result["line_range"])
         banditarray_file.append(result["code"])
      for i in banditarray_name:
         file.write("Vulnerability Name : "+banditarray_name[index]+"\n")
         file.write("Vulnerability Path : "+banditarray_loc[index]+"\n") 
         if(type(banditarray_line[index])==type([])):
            file.write("Vulnerability line : ")
            for x in banditarray_line[index]: 
               file.write(str(x)+" ")
            file.write("\n")
         else:
            file.write("Vulnerability line : "+str(banditarray_line[index])+"\n")
         file.write("----------------------------------------------------\n")
         index=index+1
         count=count+1
      file.close()
'''
      for idx in banditarray_loc:   
         with open(idx) as file:
            lineIdx = banditarray_line[i]
            line = file.readlines()
            if(type(lineIdx)==type([])):
               first_line = lineIdx[0]
               last_line = lineIdx[-1]
               banditarray_file.append(line[first_line:last_line+1])
               i=i+1
            elif(type(lineIdx)==type(1)):
               banditarray_file.append(line[lineIdx-1])
               i=i+1
            file.close()

'''
os.system('curl -o reposit_ID.json \
  --request GET \
  --header "Authorization: bearer '+str(jwt_token)+'" \
  --http1.1 "https://api.guardrails.io/v2/repositories?accountId=6944"')

reposit_ID_path = str(pwd1)+'/reposit_ID.json'
with open(reposit_ID_path, 'r', encoding="UTF-8") as json_file:
    repositID_json_data = json.load(json_file)
with open(reposit_ID_path, 'w', encoding='utf-8') as json_file:
    json.dump(repositID_json_data, json_file, indent='\t')

print('Select Project')
print('---------------------------------------')

for i in range(0, len(repositID_json_data['repositories'])):
    print(repositID_json_data['repositories'][i]['name'],':', repositID_json_data['repositories'][i]['idRepository'])

print('---------------------------------------')

reposit_ID = int(input('input Reposit_ID : '))
print(reposit_ID)

os.system('curl -o ruleid.json\
   --request GET \
   --header "Authorization: bearer '+jwt_token+'" \
   --http1.1 "https://api.guardrails.io/v2/findings?accountId=6944&repositoryIds='+str(reposit_ID)+'&status=VULNERABILITY,MARK_AS_VULNERABILITY"')


# Outputs a list of vulnerabilities in ruleid.json and stores the ruleid of each vulnerability in the list.
ruleid_list = []
rule_id_path = str(pwd1)+'/ruleid.json'
with open(rule_id_path, 'r') as json_file:
    ruleid_json_data = json.load(json_file)
with open(rule_id_path, 'w', encoding='utf-8') as json_file:
    json.dump(ruleid_json_data, json_file, indent='\t')
    
for i in range(0, len(ruleid_json_data['data'])):
    ruleid_list.append(ruleid_json_data['data'][i]['rule']['idRule'])
    print("Vulnerability list :" ,ruleid_json_data['data'][i]['rule']['title'])
print(ruleid_list)
# Download the detailed information of the vulnerability as a json file using the ruleid.
json_list = []
for i in range(0, len(ruleid_list)):
    os.system('curl -o '+str(ruleid_list[i])+'.json --request GET --header \"Authorization: bearer '+str(jwt_token)+'" --http1.1 "https://api.guardrails.io/v2/findings/'+str(ruleid_list[i])+'?accountId=6944&repositoryIds='+str(reposit_ID)+'&offset=0&limit=10&branchName=master&status=VULNERABILITY,MARK_AS_VULNERABILITY"')

# For all json files downloaded using ruleid, the vulnerability name, vulnerability path, and vulnerability line are printed.
for x in ruleid_list:
    Vulnerability_file_path = str(pwd1)+'/'+str(x)+'.json'
    with open(Vulnerability_file_path, "r") as json_file:
        Vulnerability_json_data = json.load(json_file)
        
    with open(Vulnerability_file_path, 'w', encoding='utf-8') as json_file:
        json.dump(Vulnerability_json_data, json_file, indent='\t')
    with open('result.txt','a') as file:
        
        for i in range(0, len(Vulnerability_json_data)):
        
            file.write('Vulnerability Name :'+ str(Vulnerability_json_data[i]['engineRule']['title'])+'\n')
            file.write('Vulnerability Path :'+ str(Vulnerability_json_data[i]["path"])+'\n')
            file.write('Vulnerability line :'+ str(Vulnerability_json_data[i]["lineNumber"])+'\n')
            file.write("-----------------------------------------------------------\n")
            count=count+1
    file.close()        
os.system("cat "+str(pwd1)+"/result.txt")
   
#commix --url="http://192.168.100.129/mutillidae/index.php?page=dns-lookup.php" --data="target_host=INJECT_HERE&dns-lookup-php-submit-button=Lookup+DNS" 
#sqlmap -u "http://127.0.0.1:5000/login" --method="post" --data="id=admin&pw=asd" -p "id,pw" -v 3 --dbs
#xsser --url http://192.168.100.129/mutillidae/index.php?page=dns-lookup.php -p "target_host=XSS&dns-lookup-php-submit-button=Lookup+DNS"
#xsrfprobe -u http://192.168.100.129/mutillidae/index.php?page=user-poll.php –crawl




pwd0 = subprocess.check_output("pwd")
pwd0 = pwd0.decode('ascii')
pwd0 = pwd0.split("\n")[0]
os.chdir(pwd0+"/"+name)

subprocess.run(['docker-compose','up','-d'])

comm = {"Command Injection":"commix","SQL Injection":"sqlmap","XSS":"xsser","csrf":"xsrfprobe","linux_commands_wildcard_injection":"commix","django_extra_used":"sqlmap","django_mark_safe":"xss","use_of_mako_templates":"xss","jinja2_insecure_listen":"xss"}
global report
report = "result.txt"
os.chdir(pwd0+"/")
pwd0 = subprocess.check_output("pwd").strip()

url =""
p = ""
    
class runthis():
    
    def __init__(self,thiscomm):
        self.thiscomm = thiscomm
    def inputurl(self,url):
        return url
    def inputp(self,p):
        return p
    
    #thiscomm = ""
    command1 = ()
    #command0 = ['-u',url]
    def makelog(self,run0):
        name = self.inputurl(url).split("/")[0]
        f = open(name+".txt",'w')
        f.write(str(run0))
        f.close()
    def findlog(self):
        whoami = subprocess.check_output('whoami')
        nameis = self.inputurl(url).split("/")[1:3][-1]
        login = "/home/"+whoami

        return nameis,login
    def makecomm(self):
        self.inputurl(url)
        command0 = ['-u',]
        command2 = list(self.command1)
        command2.append(comm[self.thiscomm])
        for i in command0:
            command2.append(i)
        command3 = tuple(command2)
        return command3
    def run(self,command3):
        
        run0 = subprocess.run(command3)
        self.makelog(run0)
    def commixlog0(self):
        nameis,login = self.findlog()
        commixlog = login + "/.commix/output/"+nameis
        shutil.copytree(commixlog,pwd0)
    def commix1(self):
        command1 = self.makecomm()    
        command2 = ('--data',self.inputp(p))
        command1 += command2
        self.run(command1)
        #self.commixlog0()
    def splita(self):
        p0 = self.inputp(p).split("&")
        return p0
    
    def sqlmap0(self):
        p0 = self.splita()
        p1 = ""
        if len(p0)>1:
            for i in range(0,len(p0)):
                p1 += p0[i]+","
            
            p1 +=p0[-1]
        else:
            p1 = p0[0]
        command1 = self.makecomm()
        method = input("method:")
        command2 ='--method',method,'--data',self.inputp(p),"-v","3","--dbs"
        command1 += command2
        
        self.run(command1)
        
    def xsser0(self):
        p0 = self.splita()
        if len(p0)>1:
            p3 = []
            for i in p0:
                p1 = i.split("=")
                if "submit" in p0[0]:
                    p2 = i
                else:
                    p2 = p1[0]+"=XSS"
                p3.append(p2)
            p4 = ""
            for i in range(0,len(p3)):
                p4 += p3[i]+"&"
            p4 += p3[-1]
        else:
            p1 = self.inputp(p).split("=")
            p4 = p1[0] + "=XSS"
        #command1 = self.makecomm()
        p2 = '-p "'+p4+'" '
        pwdxsser ="."
        os.chdir(pwdxsser)
        reportxxer = report + "xsser.xml"
        print(["python3",comm[self.thiscomm],"-u",self.inputurl(url),"-p",p4,"--xml",reportxxer])
        run0 = subprocess.run(["python3",comm[self.thiscomm],"-u",self.inputurl(url),"-p",p4,"--xml",reportxxer])
        
        self.makelog(run0)

        
    def xsrfprobe0(self):
        command1 = self.makecomm()
        command2 = list(command1)
        command2.append('--crawl')
        command3 = tuple(command2)
        self.run(command3)
        
def readthing(report):
    
    f = open(report,"r")
    re = f.readlines()
    f.close()
    return re

def readvuln():
    re = readthing(report)
    vuln = []
    vuln_path=[]
    vuln_line=[]
    index =0 
    for i in re:
        for ii in comm:
            if ii in i:
                vuln.append(ii)
                vuln_path.append(re[index+1])
                vuln_line.append(re[index+2])
        index = index+1


    print('\033[31m'+"The total number of vulnerabilities found in each analysis tool is "+str(int(count/4))+"\n"'\033[00m')
    print('\033[31m'+"Expect for false negative, a total of "+str(len(vuln))+" vulnerabilities were found("+str(round(len(vuln)/(count/4)*100,2))+"%)"'\033[00m')
    time.sleep(5)
    result = zip(vuln,vuln_path,vuln_line)
    result_list = list(result)
    return result_list

vuln = readvuln()
print(vuln)
for i in vuln:
    with open(pwd0+"/"+name+"/"+i[1].split(": ")[1].split(",")[0],'r',encoding='utf-8') as file:
        line ="a"
        idx=1
        while line!='' :
            line=file.readline()
            print(str(idx) +"  "+line+"\n",end='')
            idx=idx+1
    
    print("read file : "+i[1].split(": ")[1])
    print("exploit code  : "+i[2].split(": ")[1])
    if i[0] == "Command Injection":
        print(i[0],"가 있습니다 commix를 실행합니다.")
        execute0 = runthis(i[0])
        url = input("url: ")
        p = input("p: ")
        execute0.inputurl(url)
        execute0.inputp(p)
        execute0.commix1()
    elif i[0] == "SQL Injection":
        print(i[0],"가 있습니다 sqlmap을 실행합니다.")
        execute1 = runthis(i[0])
        url = input("url: ")
        p = input("p: ")
        execute1.inputurl(url)
        execute1.inputp(p)
        execute1.sqlmap0()
    elif i[0] == "XSS":
        print(i[0],"가 있습니다 xsser을 실행합니다.")
        execute2 = runthis(i[0])
        url = input("url: ")
        p = input("p: ")
        execute2.inputurl(url)
        execute2.inputp(p)
        execute2.xsser0()
    elif i[0] == "csrf":
        print(i[0],"가 있습니다 xsrfprobe를 실행합니다.")
        execute3 = runthis(i)
        url = input("url: ")
        p = input("p: ")
        execute3.inputurl(url)
        execute3.inputp(p)
        execute3.xsrfprobe0()
    else:
        print("err?")




os.chdir(pwd0+"/app/"+name+"/")
subprocess.run(['docker','compose','down',])
os.chdir("../")