feat(workflows): improvements #4

secator/configs/workflows/exploit_search.yaml

@@ -0,0 +1,24 @@
+type: workflow
+name: exploit_search
+alias: exploitsearch
+description: Search known exploits from vulnerabilities
+tags: [exploit, cve]
+input_types:
+  - vulnerability
+
+tasks:
+  _group:
+    msfconsole/cve_search:
+      description: Search for CVEs in Metasploit
+      execute_command_:
+        - type: vulnerability
+          field: 'search cve:{id}'
+          condition: item.id.startswith("CVE")
+
+    searchsploit:
+      description: Search for related exploits
+      targets_:
+      - type: port
+        field: '{host}~{service_name}'
+        condition: item.service_name
+

secator/configs/workflows/ftp_exploit.yaml

@@ -0,0 +1,36 @@
+type: workflow
+name: ftp_exploit
+alias: ftpexploit
+description: Exploit FTP vulnerabilities
+tags: [exploit, network, ftp]
+input_types:
+  - host
+input_from_report:
+  - type: port
+    field: host
+    condition: item.port == 21 or 'ftp' in item.service_name
+
+tasks:
+  _group/ftp:
+    nmap:
+      description: Run nmap ftp-* scripts
+      scripts: 'ftp-*'
+      skip_host_discovery: True
+      version_detection: True
+
+    msfconsole/ftp_version:
+      description: Run FTP scanners
+      execute_command: 'use auxiliary/scanner/ftp/ftp_version; run'
+
+    msfconsole/ftp_anon:
+      description: Check any FTP server for anonymous access
+      execute_command: "use auxiliary/scanner/ftp/anonymous; exploit"
+
+    msfconsole/ftp_backdoor:
+      description: Check for FTP backdoor (version 2.3.4)
+      execute_command: "use exploit/unix/ftp/vsftpd_234_backdoor; run"
+
+    msfconsole/proftp_backdoor:
+      description: Check for ProFTPD backdoor
+      execute_command: "use unix/ftp/proftpd_133c_backdoor; run"
+

secator/configs/workflows/host_recon.yaml

@@ -15,23 +15,37 @@ tasks:
     version_detection: True
     targets_: port.host
     ports_: port.port
-  httpx:
-    description: Probe HTTP services on open ports
-    targets_:
-      - type: port
-        field: '{host}:{port}'
-        condition: item._source.startswith('nmap')
-  _group:
+  _group/ports:
+    httpx:
+      description: Probe HTTP services on open ports
+      targets_:
+        - type: port
+          field: '{host}:{port}'
+          condition: item._source.startswith('nmap')
+    # msfconsole:
+    #   description: Check any FTP server for anonymous access
+    #   execute_command: "use auxiliary/scanner/ftp/anonymous; exploit"
+    #   targets_:
+    #     - type: port
+    #       field: host
+    #       condition: item.port == 21
+  _group/nuclei:
     nuclei/network:
       description: Scan network and SSL vulnerabilities
       tags: [network, ssl]
-    nuclei/url:
-      description: Search for vulnerabilities on alive HTTP services
-      exclude_tags: [network, ssl, file, dns, osint, token-spray, headers]
-      targets_:
-        - type: url
-          field: url
-          condition: item.status_code != 0
+  #   nuclei/url:
+  #     description: Search for vulnerabilities on alive HTTP services
+  #     exclude_tags: [network, ssl, file, dns, osint, token-spray, headers]
+  #     targets_:
+  #       - type: url
+  #         field: url
+  #         condition: item.status_code != 0
+  msfconsole/cve_search:
+    description: Search for CVEs in Metasploit
+    execute_command_:
+      - type: vulnerability
+        field: 'search cve:{id}'
+        condition: item.id.startswith("CVE")
 results:
   - type: port
     condition: item._source.startswith('nmap')

secator/configs/workflows/ssh_exploit.yaml

@@ -0,0 +1,36 @@
+type: workflow
+name: ftp_exploit
+alias: ftpexploit
+description: Exploit FTP vulnerabilities
+tags: [exploit, network, ftp]
+input_types:
+  - host
+input_from_report:
+  - type: port
+    field: host
+    condition: item.port == 22 or 'ssh' in item.service_name
+
+tasks:
+  _group/ftp:
+    nmap:
+      description: Run nmap ftp-* scripts
+      scripts: 'ftp-*'
+      skip_host_discovery: True
+      version_detection: True
+
+    msfconsole/ftp_version:
+      description: Run FTP scanners
+      execute_command: 'use auxiliary/scanner/ftp/ftp_version; run'
+
+    msfconsole/ftp_anon:
+      description: Check any FTP server for anonymous access
+      execute_command: "use auxiliary/scanner/ftp/anonymous; exploit"
+
+    msfconsole/ftp_backdoor:
+      description: Check for FTP backdoor (version 2.3.4)
+      execute_command: "use exploit/unix/ftp/vsftpd_234_backdoor; run"
+
+    msfconsole/proftp_backdoor:
+      description: Check for ProFTPD backdoor
+      execute_command: "use unix/ftp/proftpd_133c_backdoor; run"
+

secator/tasks/cariddi.py

@@ -16,6 +16,7 @@ class cariddi(HttpCrawler):
 	cmd = 'cariddi -info -s -err -e -ext 1'
 	input_type = URL
 	input_flag = OPT_PIPE_INPUT
+	input_chunk_size = 10
 	output_types = [Url, Tag]
 	file_flag = OPT_PIPE_INPUT
 	json_flag = '-json'