theHarvester/discovery/s3_scanner.py

import cprint as cprint
import requests
import re
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning) 

class s3_scanner:
    def __init__(self, host):
        self.host = host
        self.results = ""
        self.totalresults = ""
        self.fingerprints = ["www.herokucdn.com/error-pages/no-such-app.html","<title>Squarespace - No Such Account</title>","<p> If you're trying to publish one, <a href=\"https://help.github.com/pages/\">read the full documentation</a> to learn how to set up <strong>GitHub Pages</strong> for your repository, organization, or user account. </p>","<p> If you\'re trying to publish one, <a href=\"https://help.github.com/pages/\">read the full documentation</a> to learn how to set up <strong>GitHub Pages</strong> for your repository, organization, or user account. </p>","<span class=\"title\">Bummer. It looks like the help center that you are trying to reach no longer exists.</span>","<head> <title>The page you\'re looking for could not be found (404)</title> <style> body { color: #666; text-align: center; font-family: \"Helvetica Neue\", Helvetica, Arial, sans-serif; margin: 0; width: 800px; margin: auto; font-size: 14px; } h1 { font-size: 56px; line-height: 100px; font-weight: normal; color: #456; } h2 { font-size: 24px; color: #666; line-height: 1.5em; } h3 { color: #456; font-size: 20px; font-weight: normal; line-height: 28px; } hr { margin: 18px 0; border: 0; border-top: 1px solid #EEE; border-bottom: 1px solid white; } </style> </head>"]

    def __check_http(self, bucket_url):
        check_response = self.session.head(
            S3_URL, timeout=3, headers={"Host": bucket_url})

#       if not ARGS.ignore_rate_limiting\
#              and (check_response.status_code == 503 and check_response.reason == "Slow Down"):
#            self.q.rate_limited = True
            # add it back to the bucket for re-processing
 #           self.q.put(bucket_url)
        if check_response.status_code == 307:  # valid bucket, lets check if its public
            new_bucket_url = check_response.headers["Location"]
            bucket_response = requests.request(
                "GET" if ARGS.only_interesting else "HEAD", new_bucket_url, timeout=3)

            if bucket_response.status_code == 200\
                    and (not ARGS.only_interesting or
                             (ARGS.only_interesting and any(keyword in bucket_response.text for keyword in KEYWORDS))):
                cprint("Found bucket '{}'".format(new_bucket_url), "green", attrs=["bold"])
                self.__log(new_bucket_url)
     
    def do_s3(self):
        try:
            print("\t Searching takeovers for "  + self.host)
            r = requests.get('https://' + self.host, verify=False)
            for x in self.fingerprints:
                take_reg = re.compile(x)
                self.temp = take_reg.findall(r.text)
                if self.temp != []:
                        print("\t\033[91m Takeover detected! - " + self.host + "\033[1;32;40m ")
        except Exception as e:
                print(e)

      
    def process(self):
        self.do_take()
Converted more code to python3 shodan works for the most part. 2018-11-21 01:04:57 +08:00			`import cprint as cprint`
			`import requests`
			`import re`
			`from requests.packages.urllib3.exceptions import InsecureRequestWarning`
			`requests.packages.urllib3.disable_warnings(InsecureRequestWarning)`

			`class s3_scanner:`
			`def __init__(self, host):`
			`self.host = host`
			`self.results = ""`
			`self.totalresults = ""`
			self.fingerprints = ["www.herokucdn.com/error-pages/no-such-app.html","<title>Squarespace - No Such Account</title>","<p> If you're trying to publish one, <a href=\"https://help.github.com/pages/\">read the full documentation</a> to learn how to set up <strong>GitHub Pages</strong> for your repository, organization, or user account. </p>","<p> If you\'re trying to publish one, <a href=\"https://help.github.com/pages/\">read the full documentation</a> to learn how to set up <strong>GitHub Pages</strong> for your repository, organization, or user account. </p>","<span class=\"title\">Bummer. It looks like the help center that you are trying to reach no longer exists.</span>","<head> <title>The page you\'re looking for could not be found (404)</title> <style> body { color: #666; text-align: center; font-family: \"Helvetica Neue\", Helvetica, Arial, sans-serif; margin: 0; width: 800px; margin: auto; font-size: 14px; } h1 { font-size: 56px; line-height: 100px; font-weight: normal; color: #456; } h2 { font-size: 24px; color: #666; line-height: 1.5em; } h3 { color: #456; font-size: 20px; font-weight: normal; line-height: 28px; } hr { margin: 18px 0; border: 0; border-top: 1px solid #EEE; border-bottom: 1px solid white; } </style> </head>"]

			`def __check_http(self, bucket_url):`
			`check_response = self.session.head(`
			`S3_URL, timeout=3, headers={"Host": bucket_url})`

			`# if not ARGS.ignore_rate_limiting\`
			`# and (check_response.status_code == 503 and check_response.reason == "Slow Down"):`
			`# self.q.rate_limited = True`
			`# add it back to the bucket for re-processing`
			`# self.q.put(bucket_url)`
			`if check_response.status_code == 307: # valid bucket, lets check if its public`
			`new_bucket_url = check_response.headers["Location"]`
			`bucket_response = requests.request(`
			`"GET" if ARGS.only_interesting else "HEAD", new_bucket_url, timeout=3)`

			`if bucket_response.status_code == 200\`
			`and (not ARGS.only_interesting or`
			`(ARGS.only_interesting and any(keyword in bucket_response.text for keyword in KEYWORDS))):`
			`cprint("Found bucket '{}'".format(new_bucket_url), "green", attrs=["bold"])`
			`self.__log(new_bucket_url)`

			`def do_s3(self):`
			`try:`
			`print("\t Searching takeovers for " + self.host)`
			`r = requests.get('https://' + self.host, verify=False)`
			`for x in self.fingerprints:`
			`take_reg = re.compile(x)`
			`self.temp = take_reg.findall(r.text)`
			`if self.temp != []:`
			`print("\t\033[91m Takeover detected! - " + self.host + "\033[1;32;40m ")`
			`except Exception as e:`
			`print(e)`


			`def process(self):`
Fix 2018-04-16 15:36:20 +08:00			`self.do_take()`