initstring · initstring · Apr 2, 2022 · Mar 29, 2022 · Mar 29, 2022 · Mar 30, 2022
diff --git a/.gitignore b/.gitignore
@@ -105,3 +105,6 @@ venv.bak/
 
 # vim swap files
 *.swp
+
+# vscode
+.vscode/
diff --git a/README.md b/README.md
@@ -70,19 +70,19 @@ optional arguments:
   -m MUTATIONS, --mutations MUTATIONS
                         Mutations. Default: enum_tools/fuzz.txt
   -b BRUTE, --brute BRUTE
-                        List to brute-force Azure container names. Default:
-                        enum_tools/fuzz.txt
+                        List to brute-force Azure container names. Default: enum_tools/fuzz.txt
   -t THREADS, --threads THREADS
                         Threads for HTTP brute-force. Default = 5
   -ns NAMESERVER, --nameserver NAMESERVER
                         DNS server to use in brute-force.
   -l LOGFILE, --logfile LOGFILE
                         Will APPEND found items to specified file.
+  -f FORMAT, --format FORMAT
+                        Format for log file (text,json,csv - defaults to text)
   --disable-aws         Disable Amazon checks.
   --disable-azure       Disable Azure checks.
   --disable-gcp         Disable Google checks.
   -qs, --quickscan      Disable all mutations and second-level scans
-
 ```
 
 # Thanks

diff --git a/cloud_enum.py b/cloud_enum.py
@@ -26,7 +26,6 @@
 
 '''
 
-LOGFILE = False
 
 def parse_arguments():
     """
@@ -68,7 +67,11 @@ def parse_arguments():
                         help='DNS server to use in brute-force.')
 
     parser.add_argument('-l', '--logfile', type=str, action='store',
-                        help='Will APPEND found items to specified file.')
+                        help='Appends found items to specified file.')
+    parser.add_argument('-f', '--format', type=str, action='store',
+                        default='text',
+                        help='Format for log file (text,json,csv)'
+                             ' - default: text')
 
     parser.add_argument('--disable-aws', action='store_true',
                         help='Disable Amazon checks.')
@@ -86,8 +89,7 @@ def parse_arguments():
 
     # Ensure mutations file is readable
     if not os.access(args.mutations, os.R_OK):
-        print("[!] Cannot access mutations file: {}"
-              .format(args.mutations))
+        print(f"[!] Cannot access mutations file: {args.mutations}")
         sys.exit()
 
     # Ensure brute file is readable
@@ -102,7 +104,7 @@ def parse_arguments():
             sys.exit()
 
         # Parse keywords from input file
-        with open(args.keyfile) as infile:
+        with open(args.keyfile, encoding='utf-8') as infile:
             args.keyword = [keyword.strip() for keyword in infile]
 
     # Ensure log file is writeable
@@ -121,23 +123,29 @@ def parse_arguments():
             print("[!] Cannot write to log file, exiting")
             sys.exit()
 
+        # Set up logging format
+        if args.format not in ('text', 'json', 'csv'):
+            print("[!] Sorry! Allowed log formats: 'text', 'json', or 'csv'")
+            sys.exit()
         # Set the global in the utils file, where logging needs to happen
-        utils.init_logfile(args.logfile)
+        utils.init_logfile(args.logfile, args.format)
 
     return args
 
+
 def print_status(args):
     """
     Print a short pre-run status message
     """
-    print("Keywords:    {}".format(', '.join(args.keyword)))
+    print(f"Keywords:    {', '.join(args.keyword)}")
     if args.quickscan:
         print("Mutations:   NONE! (Using quickscan)")
     else:
-        print("Mutations:   {}".format(args.mutations))
-    print("Brute-list:  {}".format(args.brute))
+        print(f"Mutations:   {args.mutations}")
+    print(f"Brute-list:  {args.brute}")
     print("")
 
+
 def check_windows():
     """
     Fixes pretty color printing for Windows users. Keeping out of
@@ -151,16 +159,18 @@ def check_windows():
             print("[!] Yo, Windows user - if you want pretty colors, you can"
                   " install the colorama python package.")
 
+
 def read_mutations(mutations_file):
     """
     Read mutations file into memory for processing.
     """
     with open(mutations_file, encoding="utf8", errors="ignore") as infile:
         mutations = infile.read().splitlines()
 
-    print("[+] Mutations list imported: {} items".format(len(mutations)))
+    print(f"[+] Mutations list imported: {len(mutations)} items")
     return mutations
 
+
 def clean_text(text):
     """
     Clean text to be RFC compliant for hostnames / DNS
@@ -171,6 +181,7 @@ def clean_text(text):
 
     return text_clean
 
+
 def build_names(base_list, mutations):
     """
     Combine base and mutations for processing by individual modules.
@@ -189,19 +200,20 @@ def build_names(base_list, mutations):
             mutation = clean_text(mutation)
 
             # Then, do appends
-            names.append("{}{}".format(base, mutation))
-            names.append("{}.{}".format(base, mutation))
-            names.append("{}-{}".format(base, mutation))
+            names.append(f"{base}{mutation}")
+            names.append(f"{base}.{mutation}")
+            names.append(f"{base}-{mutation}")
 
             # Then, do prepends
-            names.append("{}{}".format(mutation, base))
-            names.append("{}.{}".format(mutation, base))
-            names.append("{}-{}".format(mutation, base))
+            names.append(f"{mutation}{base}")
+            names.append(f"{mutation}.{base}")
+            names.append(f"{mutation}-{base}")
 
-    print("[+] Mutated results: {} items".format(len(names)))
+    print(f"[+] Mutated results: {len(names)} items")
 
     return names
 
+
 def main():
     """
     Main program function.

diff --git a/enum_tools/aws_checks.py b/enum_tools/aws_checks.py
@@ -38,31 +38,40 @@
                'eu-north-1.amazonaws.com',
                'sa-east-1.amazonaws.com']
 
+
 def print_s3_response(reply):
     """
     Parses the HTTP reply of a brute-force attempt
 
     This function is passed into the class object so we can view results
     in real-time.
     """
+    data = {'platform': 'aws', 'msg': '', 'target': '', 'access': ''}
+
     if reply.status_code == 404:
         pass
     elif 'Bad Request' in reply.reason:
         pass
     elif reply.status_code == 200:
-        utils.printc("    OPEN S3 BUCKET: {}\n"
-                     .format(reply.url), 'green')
+        data['msg'] = 'OPEN S3 BUCKET'
+        data['target'] = reply.url
+        data['access'] = 'public'
+        utils.fmt_output(data)
         utils.list_bucket_contents(reply.url)
     elif reply.status_code == 403:
-        utils.printc("    Protected S3 Bucket: {}\n"
-                     .format(reply.url), 'orange')
+        data['msg'] = 'Protected S3 Bucket'
+        data['target'] = reply.url
+        data['access'] = 'protected'
+        utils.fmt_output(data)
     elif 'Slow Down' in reply.reason:
         print("[!] You've been rate limited, skipping rest of check...")
         return 'breakout'
     else:
-        print("    Unknown status codes being received from {}:\n"
-              "       {}: {}"
-              .format(reply.url, reply.status_code, reply.reason))
+        print(f"    Unknown status codes being received from {reply.url}:\n"
+              "       {reply.status_code}: {reply.reason}")
+
+    return None
+
 
 def check_s3_buckets(names, threads):
     """
@@ -78,7 +87,7 @@ def check_s3_buckets(names, threads):
 
     # Take each mutated keyword craft a url with the correct format
     for name in names:
-        candidates.append('{}.{}'.format(name, S3_URL))
+        candidates.append(f'{name}.{S3_URL}')
 
     # Send the valid names to the batch HTTP processor
     utils.get_url_batch(candidates, use_ssl=False,
@@ -88,11 +97,14 @@ def check_s3_buckets(names, threads):
     # Stop the time
     utils.stop_timer(start_time)
 
+
 def check_awsapps(names, threads, nameserver):
     """
     Checks for existence of AWS Apps
     (ie. WorkDocs, WorkMail, Connect, etc.)
     """
+    data = {'platform': 'aws', 'msg': 'AWS App Found:', 'target': '', 'access': ''}
+
     print("[+] Checking for AWS Apps")
 
     # Start a counter to report on elapsed time
@@ -106,26 +118,29 @@ def check_awsapps(names, threads, nameserver):
 
     # Take each mutated keyword craft a domain name to lookup.
     for name in names:
-        candidates.append('{}.{}'.format(name, APPS_URL))
+        candidates.append(f'{name}.{APPS_URL}')
 
     # AWS Apps use DNS sub-domains. First, see which are valid.
     valid_names = utils.fast_dns_lookup(candidates, nameserver,
                                         threads=threads)
 
     for name in valid_names:
-        utils.printc("    App Found: https://{}\n" .format(name), 'orange')
+        data['target'] = f'https://{name}'
+        data['access'] = 'protected'
+        utils.fmt_output(data)
 
     # Stop the timer
     utils.stop_timer(start_time)
 
+
 def run_all(names, args):
     """
     Function is called by main program
     """
     print(BANNER)
 
     # Use user-supplied AWS region if provided
-    #if not regions:
+    # if not regions:
     #    regions = AWS_REGIONS
     check_s3_buckets(names, args.threads)
     check_awsapps(names, args.threads, args.nameserver)