Skip to content

Commit b098750

Browse files
asluppiterasluppiter
authored
DoH
1 parent 1327fa9 commit b098750

File tree

1 file changed

+130
-84
lines changed

1 file changed

+130
-84
lines changed

‎main.py

Lines changed: 130 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -17,17 +17,11 @@ def clear_screen():
1717

1818
def check_ip(ip):
1919
pattern = r"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"
20-
if re.match(pattern, ip):
21-
return True
22-
else:
23-
return False
20+
return bool(re.match(pattern, ip))
2421

2522
def check_url(url):
2623
pattern = r'https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)'
27-
if re.match(pattern, url):
28-
return True
29-
else:
30-
return False
24+
return bool(re.match(pattern, url))
3125

3226
def known_IP():
3327
urls = [
@@ -47,7 +41,7 @@ def known_IP():
4741
for file in saved_files:
4842
with open(file, 'r') as f:
4943
lines = f.readlines()
50-
for i in range(5):
44+
for _ in range(5):
5145
randomIP = random.choice(lines)
5246
if check_ip(randomIP):
5347
sampleIP.append(randomIP)
@@ -62,16 +56,25 @@ def known_IP():
6256
result = sock.connect_ex((ip, port))
6357
if result == 0:
6458
current_time = time.strftime("%X")
65-
resultUP = "Timestamp:"+str(current_time)+" IP:"+str(ip)+ " : Port:"+ str(port)+ " test SUCCESSFUL\n"
59+
resultUP = (
60+
f"Timestamp:{str(current_time)} IP:{str(ip)} : Port:{str(port)}"
61+
+ " test SUCCESSFUL\n"
62+
)
6663
myFile.write(resultUP)
6764
else:
6865
current_time = time.strftime("%X")
69-
resultDOWN = "Timestamp:"+str(current_time)+" IP:"+str(ip)+ " : Port:"+ str(port)+ " test FAILED\n"
66+
resultDOWN = (
67+
f"Timestamp:{str(current_time)} IP:{str(ip)} : Port:{str(port)}"
68+
+ " test FAILED\n"
69+
)
7070
myFile.write(resultDOWN)
7171
sock.close()
7272
except Exception as e:
7373
current_time = time.strftime("%X")
74-
resultDOWN = "Timestamp:" + str(current_time) + " IP:" + str(ip) + " : Port:" + str(port) + " test FAILED\n"
74+
resultDOWN = (
75+
f"Timestamp:{str(current_time)} IP:{str(ip)} : Port:{str(port)}"
76+
+ " test FAILED\n"
77+
)
7578
myFile.write(resultDOWN)
7679
continue
7780
for file_name in saved_files:
@@ -93,7 +96,7 @@ def known_phish():
9396
for file in saved_files:
9497
with open(file, 'r') as f:
9598
lines = f.readlines()
96-
for i in range(15):
99+
for _ in range(15):
97100
randomURL = random.choice(lines)
98101
if check_url(randomURL):
99102
sampleURL.append(randomURL)
@@ -104,11 +107,14 @@ def known_phish():
104107
response = requests.get(url, timeout=5)
105108
if response.status_code == 200:
106109
current_time = time.strftime("%X")
107-
resultUP = "Timestamp:" + str(current_time) + " URL:" + str(url) + " test SUCCESSFUL\n"
110+
resultUP = (
111+
f"Timestamp:{str(current_time)} URL:{str(url)}"
112+
+ " test SUCCESSFUL\n"
113+
)
108114
myFile.write(resultUP)
109115
else:
110116
current_time = time.strftime("%X")
111-
resultDOWN = "Timestamp:" + str(current_time) + " URL:" + str(url) + " test FAILED\n"
117+
resultDOWN = f"Timestamp:{str(current_time)} URL:{str(url)}" + " test FAILED\n"
112118
myFile.write(resultDOWN)
113119
except Exception as e:
114120
continue
@@ -131,7 +137,7 @@ def known_TOR():
131137
for file in saved_files:
132138
with open(file, 'r') as f:
133139
lines = f.readlines()
134-
for i in range(15):
140+
for _ in range(15):
135141
randomIP = random.choice(lines)
136142
if check_ip(randomIP):
137143
sampleTOR.append(randomIP)
@@ -146,19 +152,25 @@ def known_TOR():
146152
result = sock.connect_ex((ip, port))
147153
if result == 0:
148154
current_time = time.strftime("%X")
149-
resultUP = "Timestamp:" + str(current_time) + " IP:" + str(ip) + " : Port:" + str(
150-
port) + " test SUCCESSFUL\n"
155+
resultUP = (
156+
f"Timestamp:{str(current_time)} IP:{str(ip)} : Port:{str(port)}"
157+
+ " test SUCCESSFUL\n"
158+
)
151159
myFile.write(resultUP)
152160
else:
153161
current_time = time.strftime("%X")
154-
resultDOWN = "Timestamp:" + str(current_time) + " IP:" + str(ip) + " : Port:" + str(
155-
port) + " test FAILED\n"
162+
resultDOWN = (
163+
f"Timestamp:{str(current_time)} IP:{str(ip)} : Port:{str(port)}"
164+
+ " test FAILED\n"
165+
)
156166
myFile.write(resultDOWN)
157167
sock.close()
158168
except Exception as e:
159169
current_time = time.strftime("%X")
160-
resultDOWN = "Timestamp:" + str(current_time) + " IP:" + str(ip) + " : Port:" + str(
161-
port) + " test FAILED\n"
170+
resultDOWN = (
171+
f"Timestamp:{str(current_time)} IP:{str(ip)} : Port:{str(port)}"
172+
+ " test FAILED\n"
173+
)
162174
myFile.write(resultDOWN)
163175
continue
164176
for file_name in saved_files:
@@ -174,13 +186,13 @@ def known_dist():
174186
response = requests.get(baseURL)
175187
json_response = response.json()
176188
counter = 0
177-
for x in tqdm(json_response["urls"], desc="Getting samples list"):
189+
for _ in tqdm(json_response["urls"], desc="Getting samples list"):
178190
status = json_response["urls"][counter]["url_status"]
179191
if status == "online":
180192
liveURL = json_response["urls"][counter]["url"]
181193
urlsIndex.append(liveURL)
182194
counter = counter + 1
183-
for i in range(20):
195+
for _ in range(20):
184196
randomSample = random.choice(urlsIndex)
185197
randomUrlsIndex.append(randomSample)
186198
myFile = open("Malware_Results.txt", mode="a+")
@@ -189,15 +201,14 @@ def known_dist():
189201
downloader = requests.get(x, timeout=5)
190202
if downloader.status_code == 200:
191203
current_time = time.strftime("%X")
192-
result = "Timestamp:" + str(current_time) + " URL:" + str(x) + " test SUCCESFULL\n"
193-
myFile.write(result)
204+
result = f"Timestamp:{str(current_time)} URL:{str(x)}" + " test SUCCESFULL\n"
194205
else:
195206
current_time = time.strftime("%X")
196-
result = "Timestamp:" + str(current_time) + " URL:" + str(x) + " test FAILED\n"
197-
myFile.write(result)
207+
result = f"Timestamp:{str(current_time)} URL:{str(x)}" + " test FAILED\n"
208+
myFile.write(result)
198209
except Exception as e:
199210
current_time = time.strftime("%X")
200-
result = "Timestamp:" + str(current_time) + " URL:" + str(x) + " test FAILED\n"
211+
result = f"Timestamp:{str(current_time)} URL:{str(x)}" + " test FAILED\n"
201212
myFile.write(result)
202213
continue
203214
aprint("random")
@@ -217,7 +228,7 @@ def known_crypto():
217228
for file in saved_files:
218229
with open(file, 'r') as f:
219230
lines = f.readlines()
220-
for i in range(15):
231+
for _ in range(15):
221232
randomIP = random.choice(lines)
222233
sampleMining.append(randomIP)
223234
sampleMining = [x.strip() for x in sampleMining]
@@ -227,15 +238,14 @@ def known_crypto():
227238
downloader = requests.get(x, timeout=5)
228239
if downloader.status_code == 200:
229240
current_time = time.strftime("%X")
230-
result = "Timestamp:" + str(current_time) + " URL:" + str(x) + " test SUCCESFULL\n"
231-
myFile.write(result)
241+
result = f"Timestamp:{str(current_time)} URL:{str(x)}" + " test SUCCESFULL\n"
232242
else:
233243
current_time = time.strftime("%X")
234-
result = "Timestamp:" + str(current_time) + " URL:" + str(x) + " test FAILED\n"
235-
myFile.write(result)
244+
result = f"Timestamp:{str(current_time)} URL:{str(x)}" + " test FAILED\n"
245+
myFile.write(result)
236246
except Exception as e:
237247
current_time = time.strftime("%X")
238-
result = "Timestamp:" + str(current_time) + " URL:" + str(x) + " test FAILED\n"
248+
result = f"Timestamp:{str(current_time)} URL:{str(x)}" + " test FAILED\n"
239249
myFile.write(result)
240250
continue
241251
for file_name in saved_files:
@@ -246,11 +256,11 @@ def known_crypto():
246256
def generate_DGA():
247257
tld_list = ['xyz', 'top', 'zone', 'info', 'biz', 'gq', 'tk', 'club'] #https://trends.netcraft.com/cybercrime/tlds
248258
sampleDGA = []
249-
for i in range(1, 15):
259+
for _ in range(1, 15):
250260
tld = random.choice(tld_list)
251261
domain_length = random.randint(5, 15)
252262
domain_name = ''.join(random.choices(string.ascii_lowercase, k=domain_length))
253-
dga = domain_name + '.' + tld
263+
dga = f'{domain_name}.{tld}'
254264
sampleDGA.append(dga)
255265
myFile = open("DGA_Results.txt", mode="a+")
256266
ports = [80, 443]
@@ -262,19 +272,25 @@ def generate_DGA():
262272
result = sock.connect_ex((ip, port))
263273
if result == 0:
264274
current_time = time.strftime("%X")
265-
resultUP = "Timestamp:" + str(current_time) + " IP:" + str(ip) + " : Port:" + str(
266-
port) + " tested (Actual DGA generated by script, so the domain even may not exist BUT look if your FW or IPS detected the request and tagged it)\n"
275+
resultUP = (
276+
f"Timestamp:{str(current_time)} IP:{str(ip)} : Port:{str(port)}"
277+
+ " tested (Actual DGA generated by script, so the domain even may not exist BUT look if your FW or IPS detected the request and tagged it)\n"
278+
)
267279
myFile.write(resultUP)
268280
else:
269281
current_time = time.strftime("%X")
270-
resultDOWN = "Timestamp:" + str(current_time) + " IP:" + str(ip) + " : Port:" + str(
271-
port) + " tested (Actual DGA generated by script, so the domain even may not exist BUT look if your FW or IPS detected the request and tagged it)\n"
282+
resultDOWN = (
283+
f"Timestamp:{str(current_time)} IP:{str(ip)} : Port:{str(port)}"
284+
+ " tested (Actual DGA generated by script, so the domain even may not exist BUT look if your FW or IPS detected the request and tagged it)\n"
285+
)
272286
myFile.write(resultDOWN)
273287
sock.close()
274288
except Exception as e:
275289
current_time = time.strftime("%X")
276-
resultDOWN = "Timestamp:" + str(current_time) + " IP:" + str(ip) + " : Port:" + str(
277-
port) + " tested (Actual DGA generated by script, so the domain even may not exist BUT look if your FW or IPS detected the request and tagged it)\n"
290+
resultDOWN = (
291+
f"Timestamp:{str(current_time)} IP:{str(ip)} : Port:{str(port)}"
292+
+ " tested (Actual DGA generated by script, so the domain even may not exist BUT look if your FW or IPS detected the request and tagged it)\n"
293+
)
278294
myFile.write(resultDOWN)
279295
continue
280296
aprint("random")
@@ -300,20 +316,17 @@ def test_RAT():
300316
'instance-ra153n-relay.screenconnect.com',
301317
'gotoassist.com'
302318
]
303-
if platform.system() == 'Windows':
304-
ping_args = '-n'
305-
else:
306-
ping_args = '-c'
319+
ping_args = '-n' if platform.system() == 'Windows' else '-c'
307320
myFile = open("RAT_Results.txt", mode="a+")
308321
for url in tqdm(urls,desc="Testing URLs from known Remote Desktop tools, results saved to RAT_Results.txt"):
309322
try:
310323
subprocess.check_output(['ping', ping_args, '1', url])
311324
current_time = time.strftime("%X")
312-
result = "Timestamp:" + str(current_time) + " URL:" + str(url) + " test DONE\n"
325+
result = f"Timestamp:{str(current_time)} URL:{str(url)}" + " test DONE\n"
313326
myFile.write(result)
314327
except subprocess.CalledProcessError:
315328
current_time = time.strftime("%X")
316-
result = "Timestamp:" + str(current_time) + " URL:" + str(url) + " test DONE\n"
329+
result = f"Timestamp:{str(current_time)} URL:{str(url)}" + " test DONE\n"
317330
myFile.write(result)
318331
aprint("random")
319332
clear_screen()
@@ -332,52 +345,85 @@ def known_badAgents():
332345
for file in saved_files:
333346
with open(file, 'r') as f:
334347
lines = f.readlines()
335-
for i in tqdm(range(15),desc='Downloading Samples'):
348+
for _ in tqdm(range(15),desc='Downloading Samples'):
336349
randomAgent = random.choice(lines)
337350
sampleAgent.append(randomAgent)
338351
sampleAgent = [x.strip() for x in sampleAgent]
339352
myFile = open("Agent_Results.txt", mode="a+")
353+
url = 'https://google.com'
340354
for agent in tqdm(sampleAgent,desc='Sending HTTPS request to Google with known bad User-Agent'):
341-
url = 'https://google.com'
342355
headers = {'User-Agent': agent}
343356
response = requests.get(url, headers=headers)
344-
if response.status_code == 200:
345-
current_time = time.strftime("%X")
346-
result = "Timestamp:" + str(current_time) + " URL:" + str(agent) + " test DONE\n"
347-
myFile.write(result)
348-
else:
349-
current_time = time.strftime("%X")
350-
result = "Timestamp:" + str(current_time) + " URL:" + str(agent) + " test DONE\n"
351-
myFile.write(result)
357+
current_time = time.strftime("%X")
358+
result = f"Timestamp:{str(current_time)} URL:{str(agent)}" + " test DONE\n"
359+
myFile.write(result)
352360
for file_name in saved_files:
353361
os.remove(file_name)
354362
aprint("random")
355363
clear_screen()
364+
def dns_HTTPS():
365+
print("Unmanaged DNS using encryption protocols like TLS/HTTPS/QUIC is a risk given the fact that you lose visibility over trafic (requests), if you use a managed DoH/DoT (EX: Umbrella, Zscaler,etc), you should allowlist only those services and block the category of DoH/DoT\n")
366+
367+
domains = ['google.com','example.com','bing.com','cloudflare.com','apple.com']
368+
myFile = open("DoH_Results.txt", mode="a+")
369+
x=0
370+
headers = {
371+
'accept': 'application/dns-json',
372+
}
373+
for _ in tqdm(domains,desc="Generating requests"):
374+
dns_params = {
375+
'name': domains[x],
376+
'type': 'A'
377+
}
378+
y=0
379+
doh_servers = [
380+
'https://dns.google/resolve',
381+
'https://cloudflare-dns.com/dns-query',
382+
]
383+
for _ in doh_servers:
384+
try:
385+
response = requests.get(doh_servers[y], params=dns_params,headers=headers)
386+
dns_response = response.content
387+
current_time = time.strftime("%X")
388+
if doh_servers[y] == "https://dns.google/resolve":
389+
result = f'Timestamp:{str(current_time)} Google response for {domains[x]} is : {dns_response}\n'
390+
myFile.write(result)
391+
elif doh_servers[y] == "https://cloudflare-dns.com/dns-query":
392+
result = f'Timestamp:{str(current_time)} Cloudflare response for {domains[x]} is : {dns_response}\n'
393+
myFile.write(result)
394+
y=y+1
395+
except Exception as e:
396+
result = f'Timestamp:{str(current_time)} Error response for {domains[x]}\n'
397+
myFile.write(result)
398+
x=x+1
399+
aprint("random")
400+
clear_screen()
356401
#Main
357-
Art=text2art("Somnium: NetSec testing script","rand")
402+
Art=text2art("Somnium","rand")
358403
print(Art)
359404
loopEnd = False
360-
while(loopEnd == False):
361-
choice = input("#1 Test connection with known bad IPs.\n#2 Test connection with known Phishing URLs.\n#3 Test connection to TOR Exits Nodes.\n#4 Test connection to live Malware distribution Urls\n#5 Test connection to known Cryptomining domains.\n#6 Test connection to Domain-Generated-Algorithm Domains.\n#7 Test connection to Remote Desktop Management.(Anydesk,etc.)\n#8 Test connection using known bad user agents.\n#0 Exit.\nChoice:")
362-
if int(choice) == 1:
363-
known_IP()
364-
elif int(choice) == 2:
365-
known_phish()
366-
elif int(choice) == 3:
367-
known_TOR()
368-
elif int(choice) == 4:
369-
known_dist()
370-
elif int(choice) == 5:
371-
known_crypto()
372-
elif int(choice) == 6:
373-
generate_DGA()
374-
elif int(choice) == 7:
375-
test_RAT()
376-
elif int(choice) == 8:
377-
known_badAgents()
378-
else:
379-
print("-----")
380-
clear_screen()
381-
exit()
382-
383-
405+
while not loopEnd:
406+
choice = input("#1 Test connection with known bad IPs.\n#2 Test connection with known Phishing URLs.\n#3 Test connection to TOR Exits Nodes.\n#4 Test connection to live Malware distribution Urls\n#5 Test connection to known Cryptomining domains.\n#6 Test connection to Domain-Generated-Algorithm Domains.\n#7 Test connection to Remote Desktop Management.(Anydesk,etc.)\n#8 Test connection using known bad user agents.\n#9 Generate DNS queries using DoH\n#0 Exit.\nChoice:")
407+
if int(choice) == 1:
408+
known_IP()
409+
elif int(choice) == 2:
410+
known_phish()
411+
elif int(choice) == 3:
412+
known_TOR()
413+
elif int(choice) == 4:
414+
known_dist()
415+
elif int(choice) == 5:
416+
known_crypto()
417+
elif int(choice) == 6:
418+
generate_DGA()
419+
elif int(choice) == 7:
420+
test_RAT()
421+
elif int(choice) == 8:
422+
known_badAgents()
423+
elif int(choice) == 9:
424+
dns_HTTPS()
425+
##
426+
else:
427+
print("-----")
428+
clear_screen()
429+
exit()

0 commit comments

Comments
 (0)