From 816857ca4dc4a448621079867a7b0559697a16fc Mon Sep 17 00:00:00 2001 From: 6abd <81784387+6abd@users.noreply.github.com> Date: Sun, 30 Jun 2024 00:39:41 -0400 Subject: [PATCH 1/3] Added Falcon; analyze packets --- .DS_Store | Bin 8196 -> 0 bytes etc/.DS_Store | Bin 6148 -> 0 bytes etc/init/.DS_Store | Bin 6148 -> 0 bytes etc/skeleton/.DS_Store | Bin 6148 -> 0 bytes horus.py | 11 ++++ src/.DS_Store | Bin 8196 -> 0 bytes src/main.py | 19 +++--- src/modules/.DS_Store | Bin 6148 -> 0 bytes src/modules/falcon.py | 121 ++++++++++++++++++++++++++++++++++++++ src/modules/var/.DS_Store | Bin 6148 -> 0 bytes videos/.DS_Store | Bin 6148 -> 0 bytes 11 files changed, 144 insertions(+), 7 deletions(-) delete mode 100644 .DS_Store delete mode 100644 etc/.DS_Store delete mode 100644 etc/init/.DS_Store delete mode 100644 etc/skeleton/.DS_Store delete mode 100644 src/.DS_Store delete mode 100644 src/modules/.DS_Store create mode 100644 src/modules/falcon.py delete mode 100644 src/modules/var/.DS_Store delete mode 100644 videos/.DS_Store diff --git a/.DS_Store b/.DS_Store deleted file mode 100644 index 1346858e362bf6de518c3a51e284e1d848193721..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8196 zcmeHM!EVz)5S?w(#-Re`08%eVmbgYCrL(?T$VBW@h(!V|yGT63tP#PP9fu9vbV)D!NOA$GOeP zlCiL}fIl6^vKz!QzL90UI)1AKq* z(O5T(o@lLZ9q3dE09}Mx369mPKeW#V=!Ve~tzm%(?Fy}3g()$FsT_oM$9TiwCt7QF z5-Ky|n9RadD8dvT!dGw-4Xs`87;p^CGr+Zbk!o~I5v5lBzKgNiUnR{ zl)mIcEFD`RO7x5lX^#%*1-0lPk0vJSM~0|-91(4R93L>nE+$z+lhmi!@@0myzGXT> zmR;JX=g>8Hgn17|Le`_gMA0X#B~nLyoF&M{D@*CKeObkKD`Nr3!KEZ-vlvt`9-f*{ zJimg|I2xw)`fssRC@!y*ypp%-y=$GwaVzblqhYf%c*AEeu~mZUaVK~c^~UYW{XLna zoha!IltUEu0D1d5NiOV{iI&?pKfej zT$H^Bj~?$FwLixFM1I5iAi_K;=&nAW^}K$wn(3Bcs4<qXmk&$xefNdkRK(HzjQ#O-e3_%@ta86`|W=SO`)vCp?q%+@%sNrU+Mp^Nm@w(De$ipux|IX+ww_OTNjV>THEN)bk8}{-8c^lhbYIy jD92oQIlhmi%xga9{!ln42A%Ps6ZJFTy2zx!Un}qp4UHPB diff --git a/etc/init/.DS_Store b/etc/init/.DS_Store deleted file mode 100644 index 38734ca2de71d90578b12a191d5ff30a57f26d5c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHKJ8Hu~5S@u#2;8`IxmU;y7U7)02atb(6aoc8igc=cE+5TrJ{W}TCXgn)ftj~E znx|!7q0xwlw%_Mhk+q04a6`FRn43K}pV>=h6bQ#VPI7>M$h&m2>c}_IdtuEgkdX>d0V;4;z`hR!Zden?K>u_g_y_=8 zBJGB?&l13531Cee1CfDgP=P_!95FQL$d|0EiDO{UMRWMjJXv!>Q9m8;FJ3NM0~x6R z6__fpi0#_?{~P?t{68geM+KA!1r*gxx&q`b_#;GW1zQV hY^)t`yeR65t?|4jj)6``-swR8445u7D)83|+yF)|6_)@2 diff --git a/etc/skeleton/.DS_Store b/etc/skeleton/.DS_Store deleted file mode 100644 index db68ea847f89393c4901bc02cff897f79d77c45a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHKJ8AYqoFR*dikegyW2p9EXqn`F$MEP4@Qz>0 z&$kU46`%rCfC^9nDloeOSz_1Ev!BcZsQ?xD>k8QSp}-Am;uPqg4h-G`0G9~6VeY*I zuvh?C6Q@8#U>a0lP&Hc&4Laf_^J?N07`>Hi$N9z6MQb2ODnJDu6?lr} z#_Ino{D=Pkk;D}hpaTC&0bTZQeTOGyZEYTBwYI=_aLc*D%`kTg1~11zFUMF|Io^6w biGvE;K6e+X{REt!@>6 diff --git a/horus.py b/horus.py index beefc2b..9fdc7aa 100755 --- a/horus.py +++ b/horus.py @@ -24,6 +24,7 @@ import src.modules.bankindex as bankindex import src.modules.exif as exif import src.modules.ytd as ytd +import src.modules.falcon as falcon # CASE-GEN. # SDB. # Loki. @@ -63,6 +64,7 @@ ap.add_argument('-cryptotrace', help='Transaction information, & crypto-wallet tracing.', action="store_true") #ap.add_argument('-Dischook', help='\n', action="store_true") ap.add_argument('-ytd', help='\n', action="store_true") +ap.add_argument('-falcon', help='\n', action="store_true") #ap.add_argument('-Leverage', help='\n', action="store_true") # CASE-GEN. #ap.add_argument('-Casegenerate', help='\n', action="store_true") @@ -206,6 +208,15 @@ def __exit__(self, *args): print(f">_ {Fore.RED}FAILURE{Fore.WHITE}: {error}\n") os._exit(0) +if args['falcon']: # Runs the mactrace program. + while True: + try: + falcon.falcon() + os._exit(0) + except Exception as error: + print(f">_ {Fore.RED}FAILURE{Fore.WHITE}: {error}\n") + os._exit(0) + if __name__ == '__main__': try: banner.banner() diff --git a/src/.DS_Store b/src/.DS_Store deleted file mode 100644 index eec63fbca5586b6e9abc6ab369d944ae832fa45a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8196 zcmeHMU2GIp6u#fIr89J(Q&^y`lwGJwEGxA9R4O3bKd^$d>2B#3kY#sggbA}VWoLJb zR)Gka$lW9TXA9gHI=1soLdtZ2iKBz!Yf&XO%`12u32bXbQP6_EfI;iuu z03>V4>@_;4eSjAe^<~_bQ$l*7G^f}-zz>DL#efJWf0Pd=8TaLskRqHxgfsY8hQC9B zcXf)3dczswLI!#i4@5Dr<9m9*A8IoYwUD;8bTx$a0TI@z_lJr-TNrt`=VMPAUlYQu2)pq00s2SpHi?AX}rGD>#-l zugUWsFRidhx(m#?2YFZrb~I(Jiox<{hR{P?``^ zl6EFlG~{CtX^vm?EaGR5Vvf9wa=7&<=Httm(>#mB|{GFmS{Ahy z#*n&ER#G`9pQlB;!nQfwEo*1wz5K%4Gj4Hk+^{Q4+8pke`8W#y~<9r_t|Ic8}>c>iTw^hLLFwI0U@*?f+&`v z4J&X1R$>GC(2p$`#%}DvUZkNT4;$k+gfi~M6prG4Jb*{>7#_zHcoxs&1)RVucnfdi z9lVQ=@ddubIedqo@e6*HAkCIS(gJCr6p^CRGO1PSlx~#b(txx>8Wii6Dij;5Wa!&d zB&&HuAO1Lxq~|WpqsZ1xE5=`uB<)e%pGdfjqTXAwt)x*`^d zXcAFVsO=pQRjVQ5DPHWl7^(1;uA5X3(f&Iq* zAZX9Ud^BS@+R=%P1mqnULIO#Q5SaHNi<}2&hu~a*i@R|TLHa%d^)VdBLwFdE;3+(f zXFOn^z)8G_m+(4H;SIcr_i!2?;0!**NB9(9<6E4c0pRV^0gNB30bEWLY|F9tlcxgv z=|NYPRwL4B=KKHt%YXmBvXTz62`Ug&U|I!G+n4C;A=Bj^dJ_4fbnK&pH$HAkNH2ss rK7`x7?KsH`e;Cqv)c3`GIVB`{sQu#~0{+VH=-~Yyy#GCvUU}W0`r%<= diff --git a/src/main.py b/src/main.py index 63d0211..127e63f 100755 --- a/src/main.py +++ b/src/main.py @@ -30,6 +30,7 @@ import src.modules.bankindex as bankindex import src.modules.exif as exif import src.modules.ytd as ytd +import src.modules.falcon as falcon # FORENSICS. @@ -132,7 +133,7 @@ def section(text): command(Fore.GREEN, "Vt | Connect to the virus-total API to scan, or screen files, links, etc.") command(Fore.RED, - "Netjack | Crack a capture file using Netjack!") + "Falcon | Packet analysis; sniff for your own in the terminal or use a capture file!") print(f"\n{notice} Remember; run `apicon` command to configure the API database.") option = input(f"{prompt}") @@ -188,31 +189,35 @@ def section(text): # FORENSICS. # Loki. - if option == "lokigen".lower(): + if option.lower() == "lokigen": loki_keygen.loki_keygen() os._exit(0) - if option == "lokidiscovery".lower(): + if option.lower() == "lokidiscovery": loki_discovery.loki_discovery() os._exit(0) - if option == "lokiencrypt".lower(): + if option.lower() == "lokiencrypt": loki_encrypt.loki_encrypt() os._exit(0) - if option == "lokidecrypt".lower(): + if option.lower() == "lokidecrypt": loki_decrypt.loki_decrypt() os._exit(0) # FORENSICS. # API config. - if option == "apicon".lower(): + if option.lower() == "apicon": apicon.apicon() os._exit(0) - if option == "exif".lower(): + if option.lower() == "exif": exif.exif() os._exit(0) + if option.lower() == "falcon": + falcon.falcon() + os._exit(0) + except KeyboardInterrupt: print(f'\n{Fore.YELLOW}You interrupted the program.{Fore.WHITE}') diff --git a/src/modules/.DS_Store b/src/modules/.DS_Store deleted file mode 100644 index ea1e44d184c931f0965d69937be1dc76626cad32..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHKPfNov6i>G4I)>1L!j1v212^Xe!%La-3s}*E%53e>Vr@p-t%ot_S-+5<#Lwe< zNeT`J-bCDcko;cWpEUVFlRU;4AI*aV;Vf`-UZ*&t}%=&G3DDj>%>(wQGgA4c!~ z%=rE~;M%Kf!914u`PcPFVVZS1AG}hn?d;aAy4AGq+$Wj4nU~Gek(b=y=u*naFLlqq z3a9zR-anIZ=7sSzQ3+u%g^=6pFb-rslJhu7Rj#WYR>Nvc?ACJG?GM|cH|Ve0VmUnS zw8cqpuv#^&gTtfKi^+5J63bUjCkM8b>=`WK4HUDRAbp5@SRJ~IY2hYuB;!Z0loOzr zgcu+Ohyh|?%NQ`1fYscxebaV{0b<~12Jn0k&=4Jig+_IBK&MIoz#5p9fR42U<_Lq1 z!9pW=K)6l?)T!K*7+j}=U6?q>V4+c`Gj56xZoXU=FI;^c<`*iQaYrNd!~ij{&H&cF zAU59r=kUvHEb>(db;JNM@Lw6=wXr)M!S2l6`fZb0Km`Q!wMPI9@EmC= er}hifA_{Fore.WHITE}]: ") # Always asks for a command on a new line. + +# Pre-run. +os.system("clear") + +# Hide tracebacks - change to 1 for dev mode. +sys.tracebacklimit = 0 + +# API. +# Example, uncomment lines 30-32 if API required. +#with open('var/pipes/api_config.json') as f: +# data = json.load(f) +# #{api_name} = data["{api_name}"] + +def get_packet_info(packet): + info = "" + if 'HTTP' in packet: + if hasattr(packet.http, 'request_method'): + info = f"HTTP {packet.http.request_method} {packet.http.host}{packet.http.request_uri}" + if hasattr(packet.http, 'user_agent'): + info += f"\nUser-Agent: {packet.http.user_agent}" + if hasattr(packet.http, 'content_type'): + info += f"\nContent-Type: {packet.http.content_type}" + elif hasattr(packet.http, 'response_code'): + info = f"HTTP {packet.http.response_code} {packet.http.response_phrase}" + if hasattr(packet.http, 'content_type'): + info += f"\nContent-Type: {packet.http.content_type}" + elif 'DNS' in packet: + if hasattr(packet.dns, 'qry_name'): + info = f"DNS Query: {packet.dns.qry_name}" + elif hasattr(packet.dns, 'a'): + info = f"DNS Response: {packet.dns.a}" + elif 'TCP' in packet: + info = f"TCP {packet.tcp.srcport} -> {packet.tcp.dstport}" + elif 'UDP' in packet: + info = f"UDP {packet.udp.srcport} -> {packet.udp.dstport}" + else: + info = f"{packet.highest_layer} packet" + return info + +def analysis(cap): + for pkt in cap: + print(f"\nPacket #{pkt.number}") + print(f"{response} Protocol: {pkt.highest_layer}") + print(f"{response} Length: {pkt.length} bytes") + print(f"{response} Time: {pkt.sniff_time}") + + if hasattr(pkt, 'ip'): + print(f"{response} Source IP: {pkt.ip.src}") + print(f"{response} Destination IP: {pkt.ip.dst}") + else: + print(f"{notice} Source IP: N/A") + print(f"{notice} Destination IP: N/A") + + if hasattr(pkt, 'tcp'): + print(f"{response} Source Port: {pkt.tcp.srcport}") + print(f"{response} Destination Port: {pkt.tcp.dstport}") + print(f"{response} TCP Flags: {pkt.tcp.flags}") + elif hasattr(pkt, 'udp'): + print(f"{response} Source Port: {pkt.udp.srcport}") + print(f"{response} Destination Port: {pkt.udp.dstport}") + else: + print(f"{notice} Source Port: N/A") + print(f"{notice} Destination Port: N/A") + + # Display additional protocol-specific information + if hasattr(pkt, 'http'): + if hasattr(pkt.http, 'host'): + print(f"{response} HTTP Host: {pkt.http.host}") + elif hasattr(pkt, 'dns'): + if hasattr(pkt.dns, 'qry_name'): + print(f"{response} DNS Query Name: {pkt.dns.qry_name}") + + print(f"{response} Info: {get_packet_info(pkt)}") + +# Program. +def falcon(): + option = input(f"{question} (1) Sniff for packets or (2) use saved capture file: ") + if option == "1": + inter = input(f"{question} Enter an interface: ") + filter = input(f"{question} Enter a BPF filter if you would like (Press enter if not): ") + sniff_secs = int(input(f"{question} How long (secs) to sniff for packets? ")) + + cap = pyshark.LiveCapture(interface=inter, bpf_filter=filter) + cap.sniff(sniff_secs) + + analysis(cap) + + if option == "2": + print() + path = input(f"{question} Enter a capture file path: ") + filter = input(f"{question} Enter a display filter if you would like (Press enter if not): ") + cap = pyshark.FileCapture(path, display_filter=filter) + + analysis(cap) + + +# Run module_name module. +if __name__ == '__main__': + falcon() diff --git a/src/modules/var/.DS_Store b/src/modules/var/.DS_Store deleted file mode 100644 index 94bbabb3b74e2acc2a60dd0bee1edfffd53a0b65..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHKUrPc(5TEr=o=D(BfsYHl3TdVwy&Ps=po@B_Fs~Ckx^BhOd=TND>kIWs`aI3- zu9BE<5g{`$`&n|n<(Mzn}47Gy3Jd%9_tMMJJ zJZ57v+LGw2H;y9}57Bvf(CP#>m;q*h8Q3WX>@DY%b}B1Qh8bW6euDwJA0#TFYcVyb zuMQk^3xG(!ky_BEUV>tzMb~0#5O+|72}Lxa!nPQ~gyXujey+vTpa}=Xkc*Y&y`Ov%>PjpV4-O4J8b p67ow8u0qhzr5Jsw6jxBS;JPFO(Y2Tw#1$0&5zsX7zzqB;179r>Q_TPX diff --git a/videos/.DS_Store b/videos/.DS_Store deleted file mode 100644 index 67d6ea470b11a78a0baf78fb650d281b6ed96df2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHKJxc>Y5PhR50yZfv_YW8l1TF8*L=e=-1+6tPMd0*;8pZDZuD?Rx?5xG%6{$pY z2Ik((?96_=ko^E4#rkd^7y#%~6-A8>(Qs$eR!SBkm3@p+V1hFQ9Cvi|8$&wxlCz!Q z0_Uyy*I40}E6H(>cRXT=dGrIW87tXRVu2UN7kH(&N1f8v%o=Mv(Lae+Me7n3tKVp; zopZFD&#HRH`Rb3AQ->c>Xt_88&VV!E z3^)UuGa#1Q-`TvxGo1lv;GZy{`$M2AW(ga^xOMOop8&)j!%=AK^;By@!YpB9$QFuN zDbY$LJu$?}84oEhOV}7%IV3$kB#r#_c#$|d`wuZ4k{SBf8E^*L3~ZY_(DQ%Hzf9*N zzg^;ZegpHy0 TqVZTx^ou|w#6Ql!4>0fvIiW97 From 6ec5a11222247d3cae767806a92898ad4c28e4dd Mon Sep 17 00:00:00 2001 From: 6abd <81784387+6abd@users.noreply.github.com> Date: Sun, 30 Jun 2024 00:43:41 -0400 Subject: [PATCH 2/3] Update requirements.txt --- requirements.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/requirements.txt b/requirements.txt index d00e1e6..90d8447 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4,3 +4,4 @@ Requests==2.32.2 shodan==1.31.0 pytest==8.1.1 pillow==10.3.0 +pyshark==0.6 From 44facc973c9da4a9f672a9f65ac02ceaed2cd2d2 Mon Sep 17 00:00:00 2001 From: 6abd <81784387+6abd@users.noreply.github.com> Date: Sun, 30 Jun 2024 00:44:55 -0400 Subject: [PATCH 3/3] Update requirements.txt --- requirements.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 90d8447..40e8003 100644 --- a/requirements.txt +++ b/requirements.txt @@ -3,5 +3,6 @@ cryptography==42.0.5 Requests==2.32.2 shodan==1.31.0 pytest==8.1.1 -pillow==10.3.0 +exif==1.6.0 +pytube==15.0.0 pyshark==0.6