diff --git a/check_s3_bucket.py b/check_s3_bucket.py deleted file mode 100644 index 512ff764..00000000 --- a/check_s3_bucket.py +++ /dev/null @@ -1,72 +0,0 @@ -#!/usr/bin/env python3 -import requests -import sys -from urllib.parse import urlparse -import xml.etree.ElementTree as ET - -def check_s3_bucket(bucket_name): - """Check if an S3 bucket is publicly accessible and list its contents if possible.""" - # Remove any s3.amazonaws.com suffix if present - if '.' in bucket_name: - parsed = urlparse('http://' + bucket_name) - bucket_name = parsed.netloc.split('.')[0] - - urls = [ - f"https://{bucket_name}.s3.amazonaws.com", - f"https://s3.amazonaws.com/{bucket_name}" - ] - - for url in urls: - print(f"Checking {url}") - try: - response = requests.get(url, timeout=10) - print(f"Status code: {response.status_code}") - - if response.status_code == 200: - print("Bucket is publicly accessible!") - - # Try to parse XML response to list bucket contents - try: - root = ET.fromstring(response.content) - ns = {'s3': 'http://s3.amazonaws.com/doc/2006-03-01/'} - - print("\nContents:") - for content in root.findall('.//s3:Contents', ns): - key = content.find('s3:Key', ns) - size = content.find('s3:Size', ns) - last_modified = content.find('s3:LastModified', ns) - - if key is not None: - print(f"File: {key.text}", end=" ") - if size is not None: - print(f"(Size: {size.text} bytes)", end=" ") - if last_modified is not None: - print(f"Last Modified: {last_modified.text}", end="") - print() - except Exception as e: - print(f"Error parsing bucket listing: {e}") - print("Raw response:") - print(response.text[:1000]) # Print first 1000 chars - elif response.status_code == 403: - print("Bucket exists but access is forbidden") - elif response.status_code == 404: - print("Bucket not found") - else: - print(f"Unexpected response with status code {response.status_code}") - - except requests.exceptions.RequestException as e: - print(f"Error: {e}") - - # Try alternate spelling as mentioned in the request - alt_url = f"https://trainingaliasrobotics.s3.amazonnaws.com" - print(f"\nChecking alternate spelling: {alt_url}") - try: - response = requests.get(alt_url, timeout=10) - print(f"Status code: {response.status_code}") - print(f"Response text: {response.text[:1000]}") - except requests.exceptions.RequestException as e: - print(f"Error: {e}") - -if __name__ == "__main__": - bucket_name = "trainingaliasrobotics" - check_s3_bucket(bucket_name) diff --git a/check_terrapin.py b/check_terrapin.py deleted file mode 100644 index cb337e1e..00000000 --- a/check_terrapin.py +++ /dev/null @@ -1,46 +0,0 @@ -import socket -import ssl -import sys - -def check_terrapin(hostname, port=443): - """ - Basic check for Terrapin vulnerability (CVE-2023-45866) - This is a simplified check and may not be 100% accurate - """ - try: - # Create socket and wrap with SSL - context = ssl.create_default_context() - context.check_hostname = False - context.verify_mode = ssl.CERT_NONE - - # Check if supports TLS 1.2 (Terrapin affects TLS 1.2 and below) - context.maximum_version = ssl.TLSVersion.TLSv1_2 - - with socket.create_connection((hostname, port), timeout=10) as sock: - with context.wrap_socket(sock, server_hostname=hostname) as ssock: - cipher = ssock.cipher() - if cipher and cipher[0]: - cipher_name = cipher[0] - print(f"Connected using: {cipher_name}") - - # Check if using CBC cipher (Terrapin affects CBC ciphers) - if 'CBC' in cipher_name: - print(f"[POTENTIALLY VULNERABLE] {hostname} might be vulnerable to Terrapin") - print(f"Using CBC cipher: {cipher_name}") - return True - else: - print(f"[LIKELY SAFE] {hostname} is using non-CBC cipher: {cipher_name}") - return False - except ssl.SSLError as e: - print(f"SSL Error: {e}") - except socket.error as e: - print(f"Socket Error: {e}") - except Exception as e: - print(f"Error checking {hostname}: {e}") - - return None - -if __name__ == "__main__": - hostname = "aliasrobotics.com" - print(f"Checking {hostname} for potential Terrapin vulnerability...") - check_terrapin(hostname) diff --git a/check_vulns.py b/check_vulns.py deleted file mode 100644 index a710f9c2..00000000 --- a/check_vulns.py +++ /dev/null @@ -1,87 +0,0 @@ -import subprocess -import json -import sys -import socket -import ssl -import requests -from urllib.parse import urlparse - -def check_terrapin(hostname, port=443): - print(f"[*] Checking {hostname}:{port} for Terrapin vulnerability (CVE-2023-48618)") - try: - # Create a socket and wrap it with SSL - context = ssl.create_default_context() - with socket.create_connection((hostname, port)) as sock: - with context.wrap_socket(sock, server_hostname=hostname) as ssock: - # Check if server supports TLS 1.3 - version = ssock.version() - print(f"[*] Server SSL/TLS version: {version}") - - # Terrapin affects TLS 1.3 implementation with specific configurations - if 'TLSv1.3' in version: - print("[!] Server supports TLS 1.3, which may be vulnerable to Terrapin attack") - print("[!] Note: Detailed testing requires specialized tools, as this is a downgrade attack") - print("[!] The vulnerability allows attackers to force downgrade to CBC ciphers in TLS 1.2") - else: - print("[*] Server does not use TLS 1.3, not directly affected by Terrapin") - except Exception as e: - print(f"[-] Error checking for Terrapin: {e}") - -def check_s3_bucket(bucket_name): - print(f"[*] Checking S3 bucket: {bucket_name}") - - # Clean up the bucket name if needed - if bucket_name.startswith("http://") or bucket_name.startswith("https://"): - parsed = urlparse(bucket_name) - bucket_name = parsed.netloc - - if ".s3.amazonaws" in bucket_name: - bucket_name = bucket_name.split(".s3.amazonaws")[0] - - # Direct URL - url = f"http://{bucket_name}.s3.amazonaws.com" - try: - response = requests.get(url) - print(f"[*] Bucket URL: {url}") - print(f"[*] Response status: {response.status_code}") - - if response.status_code == 200: - print("[!] Bucket is publicly accessible") - print("[*] Response content:") - # Print the first 1000 characters of the response content - print(response.text[:1000]) - elif response.status_code == 403: - print("[!] Bucket exists but access is forbidden (listing denied)") - print("[*] This could mean the bucket exists but is not publicly listable") - elif response.status_code == 404: - print("[*] Bucket not found") - else: - print(f"[*] Unexpected response: {response.status_code}") - except Exception as e: - print(f"[-] Error checking bucket: {e}") - - # Try to list bucket objects with aws cli - try: - print("[*] Attempting to list bucket objects with AWS CLI...") - result = subprocess.run( - ["aws", "s3", "ls", f"s3://{bucket_name}", "--no-sign-request"], - capture_output=True, - text=True - ) - if result.returncode == 0 and result.stdout: - print("[!] Bucket is listable without authentication!") - print("[*] Bucket contents:") - print(result.stdout) - else: - print("[*] Bucket is not listable without authentication") - if result.stderr: - print(f"[*] Error: {result.stderr}") - except Exception as e: - print(f"[-] Error using AWS CLI: {e}") - -if __name__ == "__main__": - # Check for Terrapin vulnerability - check_terrapin("aliasrobotics.com") - - # Check for exposed S3 bucket - check_s3_bucket("trainingaliasrobotics") diff --git a/hello_world.py b/hello_world.py deleted file mode 100644 index 09907203..00000000 --- a/hello_world.py +++ /dev/null @@ -1 +0,0 @@ -print('Hello, World!') diff --git a/helloworld.py b/helloworld.py deleted file mode 100644 index 09907203..00000000 --- a/helloworld.py +++ /dev/null @@ -1 +0,0 @@ -print('Hello, World!') diff --git a/hola_mundo.py b/hola_mundo.py deleted file mode 100644 index a500c2f4..00000000 --- a/hola_mundo.py +++ /dev/null @@ -1 +0,0 @@ -print("¡Hola Mundo!") diff --git a/nmap_results b/nmap_results deleted file mode 100644 index e69de29b..00000000 diff --git a/terrapin_check.py b/terrapin_check.py deleted file mode 100644 index 5c52e13e..00000000 --- a/terrapin_check.py +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/bin/env python3 -import socket -import ssl -import sys - -def check_terrapin(hostname, port=443): - try: - context = ssl.create_default_context() - with socket.create_connection((hostname, port), timeout=10) as sock: - with context.wrap_socket(sock, server_hostname=hostname) as ssock: - cipher = ssock.cipher() - print(f"Connected to {hostname}:{port}") - print(f"Cipher: {cipher}") - - # Check for server features that might indicate Terrapin vulnerability - # Note: This is a simplified check and not a complete test - if cipher[0].startswith(('TLS_RSA_', 'RSA-')): - print(f"[!] Potentially vulnerable to Terrapin: {hostname} uses RSA key exchange") - else: - print(f"[+] Not likely vulnerable to Terrapin: {hostname} doesn't use RSA key exchange") - - except Exception as e: - print(f"Error connecting to {hostname}:{port} - {str(e)}") - -if __name__ == "__main__": - check_terrapin("aliasrobotics.com") diff --git a/terrapin_test.py b/terrapin_test.py deleted file mode 100644 index b144c718..00000000 --- a/terrapin_test.py +++ /dev/null @@ -1,32 +0,0 @@ -#!/usr/bin/env python3 -import socket -import ssl -import sys -import re - -def test_terrapin(hostname, port=443): - context = ssl.create_default_context() - - print(f"Testing {hostname}:{port} for Terrapin vulnerability...") - - try: - with socket.create_connection((hostname, port), timeout=10) as sock: - with context.wrap_socket(sock, server_hostname=hostname) as ssock: - # Get cipher info - cipher = ssock.cipher() - print(f"Connected using: {cipher}") - - # Check if using CBC cipher (vulnerable to Terrapin) - if "CBC" in cipher[0]: - print("WARNING: Server is using CBC cipher which may be vulnerable to Terrapin attacks!") - return True - else: - print("Server is not using CBC ciphers, likely not vulnerable to Terrapin.") - return False - except Exception as e: - print(f"Error: {e}") - return None - -if __name__ == "__main__": - hostname = "aliasrobotics.com" - test_terrapin(hostname)