pax_global_header00006660000000000000000000000064150535763570014532gustar00rootroot0000000000000052 comment=864b8b58e95e690931edecd4418071e049dddc12 faraday_plugins-1.26.0/000077500000000000000000000000001505357635700147705ustar00rootroot00000000000000faraday_plugins-1.26.0/.flake8000066400000000000000000000004111505357635700161370ustar00rootroot00000000000000[flake8] ignore = W391, E722, E303, E701, W291, E222, E241, E225, E115, E117, E122, E123, E124, E501, E261, E127, E265, F401, W292, W293, W605, E231, E221, E222, F841, E128, W504, E202, F811, E251, E226, E203, E262, E225, E305, E302, E305 exclude= report-collectionfaraday_plugins-1.26.0/.gitignore000066400000000000000000000035771505357635700167740ustar00rootroot00000000000000# Created by .ignore support plugin (hsz.mobi) ### Python template # Byte-compiled / optimized / DLL files __pycache__/ *.py[cod] *$py.class # C extensions *.so # Distribution / packaging .Python build/ develop-eggs/ dist/ downloads/ eggs/ .eggs/ lib/ lib64/ parts/ sdist/ var/ wheels/ pip-wheel-metadata/ share/python-wheels/ *.egg-info/ .installed.cfg *.egg MANIFEST # PyInstaller # Usually these files are written by a python script from a template # before PyInstaller builds the exe, so as to inject date/other infos into it. *.manifest *.spec # Installer logs pip-log.txt pip-delete-this-directory.txt # Unit test / coverage reports htmlcov/ .tox/ .nox/ .coverage .coverage.* .cache nosetests.xml coverage.xml *.cover .hypothesis/ .pytest_cache/ # Translations *.mo *.pot # Django stuff: *.log local_settings.py db.sqlite3 db.sqlite3-journal # Flask stuff: instance/ .webassets-cache # Scrapy stuff: .scrapy # Sphinx documentation docs/_build/ # PyBuilder target/ # Jupyter Notebook .ipynb_checkpoints # IPython profile_default/ ipython_config.py # pyenv .python-version # pipenv # According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control. # However, in case of collaboration, if having platform-specific dependencies or dependencies # having no cross-platform support, pipenv may install dependencies that don't work, or not # install all needed dependencies. #Pipfile.lock # celery beat schedule file celerybeat-schedule # SageMath parsed files *.sage.py # Environments .env .venv env/ venv/ ENV/ env.bak/ venv.bak/ # Spyder project settings .spyderproject .spyproject # Rope project settings .ropeproject # mkdocs documentation /site # mypy .mypy_cache/ .dmypy.json dmypy.json # Pyre type checker .pyre/ .idea /report-collection/ #project settings *.project # extras for testing report-collection #vscode .vscode/ # Macos files .DS_Store faraday_plugins-1.26.0/.gitlab-ci.yml000066400000000000000000000103631505357635700174270ustar00rootroot00000000000000variables: VAULT_SERVER_URL: https://tluav-lb.faradaysec.com VAULT_AUTH_ROLE: python-sast-readonly VAULT_AUTH_PATH: jwt include: - local: .gitlab/ci/get-secrets.yml stages: - SAST - pre_testing - testing - post_testing - publish before_script: - apt-get update -qy - pip install pip -U workflow: rules: - if: $CI_MERGE_REQUEST_ID when: never - when: always .parse-secrets: &parse-secrets - DEVSECOPS_WORKSPACE=$(cat $DEVSECOPS_WORKSPACE) - FARADAY_PASSWORD=$(cat $FARADAY_PASSWORD) - FARADAY_URL=$(cat $FARADAY_URL) - FARADAY_USER=$(cat $FARADAY_USER) .install_faraday_venv: &install_faraday_venv - pip3 install virtualenv - virtualenv -p python3 faraday_venv - source faraday_venv/bin/activate - pip3 install pytest pytest-xdist pytest-cov - git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/faradaysec/faraday.git - cd faraday - pip3 install $PIP_FLAGS . - pip uninstall faraday-plugins -y # we need to install fardaysec for marshmallow schemas, we remove plugins from pypi - cd .. .clone_reports: &clone_reports - git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/faradaysec/support/report-collection.git - cd report-collection - | SUFFIX="${CI_COMMIT_BRANCH#*_}" MATCH_BRANCH=$(git branch -r --list "*_reports_for_${SUFFIX}" | sed 's|origin/||' | head -n 1 | xargs) if [ -n "$MATCH_BRANCH" ]; then echo "Using branch from report-collection: $MATCH_BRANCH" REPORT_REF="$MATCH_BRANCH" else echo "Can't find branch *_reports_for_${SUFFIX}, will use master" REPORT_REF="master" fi git checkout "$REPORT_REF" - cd .. bandit: stage: SAST image: python:3.11 tags: - faradaytests extends: - .get-secrets script: - pip3 install virtualenv - virtualenv -p python3 faraday_venv - source faraday_venv/bin/activate - pip3 install bandit - mkdir /results - "bandit -r ${CI_PROJECT_DIR}/faraday-plugins -o /results/output.xml -f xml --skip B101,B104,B405,B314" - if [[ $(grep -c testcase /results/output.xml) -gt 0 ]]; then (cat /results/output.xml); fi after_script: - *parse-secrets - apt update && apt-get install lsb-release gpg wget -y - apt-get install software-properties-common -y - wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg - gpg --no-default-keyring --keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg --fingerprint - echo "deb [ signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg ] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/hashicorp.list - apt update && apt install vault -y - setcap cap_ipc_lock= /usr/bin/vault - pip3 install faraday-cli - if [[ $(grep -c testcase /results/output.xml) -gt 0 ]]; then (faraday-cli auth -f $FARADAY_URL -u $FARADAY_USER -p $FARADAY_PASSWORD && faraday-cli tool report /results/output.xml -w $DEVSECOPS_WORKSPACE --vuln-tag $CI_PROJECT_NAME --vuln-tag $CI_COMMIT_REF_NAME); else (echo 'no vulns detected' && exit 0); fi rules: - when: on_success flake8: image: python:3.11 stage: pre_testing before_script: - pip install flake8 # Help flake8 to find the Python files without .py extension. - find . -name '*.py' >> files.txt - sort -u files.txt | tee files.processed script: - python -m flake8 --statistics --count $(cat files.processed) --verbose after_script: - wc -l files.processed .test_base: stage: testing coverage: '/TOTAL\s+\d+\s+\d+\s+(\d+%)/' script: - *clone_reports - *install_faraday_venv - pip3 install $PIP_FLAGS . - pytest tests --capture=sys -v --cov=faraday_plugins --color=yes --disable-warnings $PYTEST_FLAGS tests: extends: .test_base image: python:3.11 test_performance: extends: .test_base image: python:3.11 stage: post_testing allow_failure: true variables: PYTEST_FLAGS: --performance rules: - if: '$CI_COMMIT_BRANCH == "dev"' when: on_success publish_pypi: image: python:3.11 stage: publish script: - pip install twine - python setup.py sdist bdist_wheel - twine upload -u $PYPI_USER -p $PYPI_PASS dist/* --verbose rules: - if: '$CI_COMMIT_TAG' when: on_success faraday_plugins-1.26.0/.gitlab/000077500000000000000000000000001505357635700163105ustar00rootroot00000000000000faraday_plugins-1.26.0/.gitlab/ci/000077500000000000000000000000001505357635700167035ustar00rootroot00000000000000faraday_plugins-1.26.0/.gitlab/ci/fetch-secrets.yml000066400000000000000000000015531505357635700221710ustar00rootroot00000000000000.get_secrets: script: - export VAULT_TOKEN="$(vault write -field=token auth/jwt/login role=python-sast-readonly jwt=$CI_JOB_JWT)"; if [ -z "$VAULT_TOKEN" ]; then exit 1; fi - if [ -z "$DEVSECOPS_WORKSPACE" ]; then export DEVSECOPS_WORKSPACE="$(vault kv get -field=DEVSECOPS_WORKSPACE secrets/gitlab/SAST)"; fi; if [ -z "$DEVSECOPS_WORKSPACE" ]; then exit 1; fi - if [ -z "$FARADAY_PASSWORD" ]; then export FARADAY_PASSWORD="$(vault kv get -field=FARADAY_PASSWORD secrets/gitlab/SAST)"; fi; if [ -z "$FARADAY_PASSWORD" ]; then exit 1; fi - if [ -z "$FARADAY_URL" ]; then export FARADAY_URL="$(vault kv get -field=FARADAY_URL secrets/gitlab/SAST)"; fi; if [ -z "$FARADAY_URL" ]; then exit 1; fi - if [ -z "$FARADAY_USER" ]; then export FARADAY_USER="$(vault kv get -field=FARADAY_USER secrets/gitlab/SAST)"; fi; if [ -z "$FARADAY_USER" ]; then exit 1; fi faraday_plugins-1.26.0/.gitlab/ci/get-secrets.yml000066400000000000000000000005541505357635700216570ustar00rootroot00000000000000.get-secrets: id_tokens: VAULT_ID_TOKEN: aud: https://gitlab.com secrets: DEVSECOPS_WORKSPACE: vault: gitlab/SAST/DEVSECOPS_WORKSPACE@secrets FARADAY_PASSWORD: vault: gitlab/SAST/FARADAY_PASSWORD@secrets FARADAY_URL: vault: gitlab/SAST/FARADAY_URL@secrets FARADAY_USER: vault: gitlab/SAST/FARADAY_USER@secrets faraday_plugins-1.26.0/.pre-commit-config.yaml000066400000000000000000000012531505357635700212520ustar00rootroot00000000000000default_stages: [commit] repos: - repo: https://github.com/pre-commit/pre-commit-hooks rev: v3.1.0 hooks: - id: trailing-whitespace - id: end-of-file-fixer - id: check-json - id: check-yaml args: [ --unsafe ] - id: debug-statements - repo: https://github.com/pycqa/flake8 rev: 3.8.3 hooks: - id: flake8 additional_dependencies: [flake8-typing-imports==1.9.0] - repo: https://github.com/ikamensh/flynt/ rev: '0.56' hooks: - id: flynt args: [ -df ] - repo: https://github.com/asottile/pyupgrade rev: v2.29.0 hooks: - id: pyupgrade args: [ --py3-plus , --py36-plus] faraday_plugins-1.26.0/CHANGELOG/000077500000000000000000000000001505357635700162575ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.10.0/000077500000000000000000000000001505357635700167745ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.10.0/293.md000066400000000000000000000000461505357635700176330ustar00rootroot00000000000000[ADD] Add new acunetix360 plugin #293 faraday_plugins-1.26.0/CHANGELOG/1.10.0/date.md000066400000000000000000000000171505357635700202310ustar00rootroot00000000000000Jan 31th, 2023 faraday_plugins-1.26.0/CHANGELOG/1.11.0/000077500000000000000000000000001505357635700167755ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.11.0/292.md000066400000000000000000000001211505357635700176250ustar00rootroot00000000000000[FIX] Change syhunt´s and trivy´s plugins to export cvss vector correctly #292 faraday_plugins-1.26.0/CHANGELOG/1.11.0/294.md000066400000000000000000000001571505357635700176400ustar00rootroot00000000000000[ADD] Add force flag to process-command to process the output of the command regardless of the exit code. #294 faraday_plugins-1.26.0/CHANGELOG/1.11.0/296.md000066400000000000000000000000751505357635700176410ustar00rootroot00000000000000[MOD] The accunetix plugin now search for CVSS and cvss #296 faraday_plugins-1.26.0/CHANGELOG/1.11.0/297.md000066400000000000000000000000371505357635700176400ustar00rootroot00000000000000[ADD] Add semgrep plugin. #297 faraday_plugins-1.26.0/CHANGELOG/1.11.0/298.md000066400000000000000000000001261505357635700176400ustar00rootroot00000000000000[FIX] Fix inviti's plugin, check remedial procedures before parsing it with b4f. #298 faraday_plugins-1.26.0/CHANGELOG/1.11.0/date.md000066400000000000000000000000161505357635700202310ustar00rootroot00000000000000Apr 3rd, 2023 faraday_plugins-1.26.0/CHANGELOG/1.12.0/000077500000000000000000000000001505357635700167765ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.12.0/299.md000066400000000000000000000000351505357635700176410ustar00rootroot00000000000000[ADD] Add Sarif plugin. #299 faraday_plugins-1.26.0/CHANGELOG/1.12.0/date.md000066400000000000000000000000171505357635700202330ustar00rootroot00000000000000May 24th, 2023 faraday_plugins-1.26.0/CHANGELOG/1.12.1/000077500000000000000000000000001505357635700167775ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.12.1/302.md000066400000000000000000000000411505357635700176200ustar00rootroot00000000000000[FIX] Fix Appscan's pluign. #302 faraday_plugins-1.26.0/CHANGELOG/1.12.1/date.md000066400000000000000000000000171505357635700202340ustar00rootroot00000000000000July 7th, 2023 faraday_plugins-1.26.0/CHANGELOG/1.13.0/000077500000000000000000000000001505357635700167775ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.13.0/305.md000066400000000000000000000001141505357635700176240ustar00rootroot00000000000000[FIX] If severity id in an appscan item is greater than 4 set it to 4. #305 faraday_plugins-1.26.0/CHANGELOG/1.13.0/306.md000066400000000000000000000002241505357635700176270ustar00rootroot00000000000000[FIX] Update Naabu plugin for the latest version, Semgrep create a new service for each vuln, fix Arachni bug in case the report has no vulns. #306 faraday_plugins-1.26.0/CHANGELOG/1.13.0/310.md000066400000000000000000000000541505357635700176230ustar00rootroot00000000000000[ADD] Add Terrascan and TFSec plugins. #310 faraday_plugins-1.26.0/CHANGELOG/1.13.0/311.md000066400000000000000000000001021505357635700176160ustar00rootroot00000000000000[FIX] Use cvss_score to calculate severity in nessus plugin. #311 faraday_plugins-1.26.0/CHANGELOG/1.13.0/date.md000066400000000000000000000000171505357635700202340ustar00rootroot00000000000000Aug 24th, 2023 faraday_plugins-1.26.0/CHANGELOG/1.13.2/000077500000000000000000000000001505357635700170015ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.13.2/307.md000066400000000000000000000001101505357635700176240ustar00rootroot00000000000000[ADD] Extract response and request info in qualyswebapp's plugins. #307 faraday_plugins-1.26.0/CHANGELOG/1.13.2/315.md000066400000000000000000000000571505357635700176350ustar00rootroot00000000000000[ADD] Create Plugin for windows defender. #315 faraday_plugins-1.26.0/CHANGELOG/1.13.2/date.md000066400000000000000000000000161505357635700202350ustar00rootroot00000000000000Sep 6th, 2023 faraday_plugins-1.26.0/CHANGELOG/1.14.0/000077500000000000000000000000001505357635700170005ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.14.0/318.md000066400000000000000000000000451505357635700176340ustar00rootroot00000000000000[ADD] Add Crowdstrike's plugin. #318 faraday_plugins-1.26.0/CHANGELOG/1.14.0/date.md000066400000000000000000000000171505357635700202350ustar00rootroot00000000000000Oct 10th, 2023 faraday_plugins-1.26.0/CHANGELOG/1.15.0/000077500000000000000000000000001505357635700170015ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.15.0/303.md000066400000000000000000000000401505357635700176220ustar00rootroot00000000000000[ADD] Add PopEye's plugin. #303 faraday_plugins-1.26.0/CHANGELOG/1.15.0/304.md000066400000000000000000000000451505357635700176300ustar00rootroot00000000000000[ADD] Add Ping Castle's plugin. #304 faraday_plugins-1.26.0/CHANGELOG/1.15.0/320.md000066400000000000000000000000431505357635700176240ustar00rootroot00000000000000[ADD] Add Kubescape's plugin. #320 faraday_plugins-1.26.0/CHANGELOG/1.15.0/322.md000066400000000000000000000000501505357635700176240ustar00rootroot00000000000000[ADD] Add AWS Inspector's plugins. #322 faraday_plugins-1.26.0/CHANGELOG/1.15.0/date.md000066400000000000000000000000171505357635700202360ustar00rootroot00000000000000Dec 12th, 2023 faraday_plugins-1.26.0/CHANGELOG/1.15.1/000077500000000000000000000000001505357635700170025ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.15.1/323.md000066400000000000000000000000531505357635700176310ustar00rootroot00000000000000[FIX] Filter \x00 in nuclei response. #323 faraday_plugins-1.26.0/CHANGELOG/1.15.1/date.md000066400000000000000000000000171505357635700202370ustar00rootroot00000000000000Dec 22th, 2023 faraday_plugins-1.26.0/CHANGELOG/1.16.0/000077500000000000000000000000001505357635700170025ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.16.0/314.md000066400000000000000000000000341505357635700176300ustar00rootroot00000000000000[ADD] Add Snyk plugin. #314 faraday_plugins-1.26.0/CHANGELOG/1.16.0/322.md000066400000000000000000000000471505357635700176330ustar00rootroot00000000000000[MOD] Mod AWS Inspector's plugins. #322faraday_plugins-1.26.0/CHANGELOG/1.16.0/324.md000066400000000000000000000000451505357635700176330ustar00rootroot00000000000000[ADD] Add faraday_json plugins. #324 faraday_plugins-1.26.0/CHANGELOG/1.16.0/328.md000066400000000000000000000001741505357635700176420ustar00rootroot00000000000000[ADD] Update prowler plugin to support the latest tool output format. Also rename the oldest plugin to prowler_legacy. #328 faraday_plugins-1.26.0/CHANGELOG/1.16.0/date.md000066400000000000000000000000161505357635700202360ustar00rootroot00000000000000Feb 8th, 2024 faraday_plugins-1.26.0/CHANGELOG/1.17.0/000077500000000000000000000000001505357635700170035ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.17.0/321.md000066400000000000000000000000631505357635700176310ustar00rootroot00000000000000[ADD] Add hotspots logic for sonarqube plugin #321 faraday_plugins-1.26.0/CHANGELOG/1.17.0/date.md000066400000000000000000000000171505357635700202400ustar00rootroot00000000000000Mar 12th, 2024 faraday_plugins-1.26.0/CHANGELOG/1.18.0/000077500000000000000000000000001505357635700170045ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.18.0/331.md000066400000000000000000000001251505357635700176320ustar00rootroot00000000000000[FIX] Fix key error when `packageVulnerabilityDetails` key was not in the file. #331 faraday_plugins-1.26.0/CHANGELOG/1.18.0/333.md000066400000000000000000000002141505357635700176330ustar00rootroot00000000000000[FIX] Addressed a bug where Burp plugin output would display null data in cases of encountering a malformed XML token from the report. #333 faraday_plugins-1.26.0/CHANGELOG/1.18.0/336.md000066400000000000000000000003121505357635700176350ustar00rootroot00000000000000[FIX] Previously, CSV files edited in tools like Mac Numbers would transform boolean values to uppercase. This issue has been addressed within the faraday_csv plugin, ensuring accurate comparison. #336 faraday_plugins-1.26.0/CHANGELOG/1.18.0/date.md000066400000000000000000000000171505357635700202410ustar00rootroot00000000000000May 22th, 2024 faraday_plugins-1.26.0/CHANGELOG/1.18.1/000077500000000000000000000000001505357635700170055ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.18.1/339.md000066400000000000000000000001621505357635700176440ustar00rootroot00000000000000[MOD] Naabu reports changed their JSON structure, so new keys were added to detect the new report structure. #339 faraday_plugins-1.26.0/CHANGELOG/1.18.1/date.md000066400000000000000000000000171505357635700202420ustar00rootroot00000000000000Jul 11th, 2024 faraday_plugins-1.26.0/CHANGELOG/1.18.2/000077500000000000000000000000001505357635700170065ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.18.2/343.md000066400000000000000000000001221505357635700176340ustar00rootroot00000000000000[FIX] Added validations for empty lines and multiple fields including lists. #343 faraday_plugins-1.26.0/CHANGELOG/1.18.2/date.md000066400000000000000000000000171505357635700202430ustar00rootroot00000000000000Jul 24th, 2024 faraday_plugins-1.26.0/CHANGELOG/1.19.0/000077500000000000000000000000001505357635700170055ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.19.0/100.md000066400000000000000000000000511505357635700176230ustar00rootroot00000000000000[ADD] Added owasp dependency check. #100 faraday_plugins-1.26.0/CHANGELOG/1.19.0/341.md000066400000000000000000000001701505357635700176340ustar00rootroot00000000000000[FIX] Nessus plugin crashed when parsing tenableio reports without vulnerabilities, so a check for that was added. #341 faraday_plugins-1.26.0/CHANGELOG/1.19.0/342.md000066400000000000000000000000421505357635700176330ustar00rootroot00000000000000[ADD] Added gitleaks plugin. #342 faraday_plugins-1.26.0/CHANGELOG/1.19.0/date.md000066400000000000000000000000171505357635700202420ustar00rootroot00000000000000Aug 23rd, 2024 faraday_plugins-1.26.0/CHANGELOG/1.19.1/000077500000000000000000000000001505357635700170065ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.19.1/349.md000066400000000000000000000001571505357635700176520ustar00rootroot00000000000000[MOD] Updated the SSLyze JSON parser to support and correctly process scan results from SSLyze version 6. #349 faraday_plugins-1.26.0/CHANGELOG/1.19.1/350.md000066400000000000000000000000571505357635700176410ustar00rootroot00000000000000[FIX] Crowdstrike IP resolution for asset #350 faraday_plugins-1.26.0/CHANGELOG/1.19.1/351.md000066400000000000000000000003041505357635700176350ustar00rootroot00000000000000[FIX] Corrected a hostname resolution issue that was causing traceback errors and malfunctioning of the plugin. This fix ensures proper hostname resolution and stabilizes plugin performance. #351 faraday_plugins-1.26.0/CHANGELOG/1.19.1/date.md000066400000000000000000000000171505357635700202430ustar00rootroot00000000000000Sep 20th, 2024 faraday_plugins-1.26.0/CHANGELOG/1.20.0/000077500000000000000000000000001505357635700167755ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.20.0/354.md000066400000000000000000000001021505357635700176230ustar00rootroot00000000000000[FIX] Duplicate detection vulnerability in the Burp plugin. #354 faraday_plugins-1.26.0/CHANGELOG/1.20.0/date.md000066400000000000000000000000171505357635700202320ustar00rootroot00000000000000Nov 21st, 2024 faraday_plugins-1.26.0/CHANGELOG/1.21.0/000077500000000000000000000000001505357635700167765ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.21.0/353.md000066400000000000000000000000561505357635700176330ustar00rootroot00000000000000[ADD] Added Saint CSV report processor. #353 faraday_plugins-1.26.0/CHANGELOG/1.21.0/date.md000066400000000000000000000000161505357635700202320ustar00rootroot00000000000000Jan 6th, 2025 faraday_plugins-1.26.0/CHANGELOG/1.22.0/000077500000000000000000000000001505357635700167775ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.22.0/355.md000066400000000000000000000000631505357635700176340ustar00rootroot00000000000000[ADD] Added support for cvss4 in faraday cvs. #355 faraday_plugins-1.26.0/CHANGELOG/1.22.0/361.md000066400000000000000000000000631505357635700176310ustar00rootroot00000000000000[FIX] Fixed description and CI Bandit update. #361 faraday_plugins-1.26.0/CHANGELOG/1.22.0/date.md000066400000000000000000000000171505357635700202340ustar00rootroot00000000000000Jan 30th, 2025 faraday_plugins-1.26.0/CHANGELOG/1.23.0/000077500000000000000000000000001505357635700170005ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.23.0/360.md000066400000000000000000000000551505357635700176320ustar00rootroot00000000000000[ADD] Added DNSX Multiline JSON Plugin. #360 faraday_plugins-1.26.0/CHANGELOG/1.23.0/362.md000066400000000000000000000001111505357635700176250ustar00rootroot00000000000000[ADD] Added extra DirSearch plugin compatible with dirsearch 0.4.3. #362 faraday_plugins-1.26.0/CHANGELOG/1.23.0/363.md000066400000000000000000000001011505357635700176250ustar00rootroot00000000000000[FIX] Fixed Qualys WebAPP to accept vulns with no evidence. #363 faraday_plugins-1.26.0/CHANGELOG/1.23.0/364.md000066400000000000000000000000431505357635700176330ustar00rootroot00000000000000[ADD] Added Subfinder Plugin. #364 faraday_plugins-1.26.0/CHANGELOG/1.23.0/date.md000066400000000000000000000000171505357635700202350ustar00rootroot00000000000000Mar 13th, 2025 faraday_plugins-1.26.0/CHANGELOG/1.24.0/000077500000000000000000000000001505357635700170015ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.24.0/365.md000066400000000000000000000000651505357635700176410ustar00rootroot00000000000000[ADD] Added Tenable IO JSON Vuln Export Plugin. #365 faraday_plugins-1.26.0/CHANGELOG/1.24.0/date.md000066400000000000000000000000171505357635700202360ustar00rootroot00000000000000Apr 24th, 2025 faraday_plugins-1.26.0/CHANGELOG/1.24.1/000077500000000000000000000000001505357635700170025ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.24.1/345.md000066400000000000000000000000431505357635700176340ustar00rootroot00000000000000[FIX] CVSS3 in openvas plugin. #345faraday_plugins-1.26.0/CHANGELOG/1.24.1/date.md000066400000000000000000000000171505357635700202370ustar00rootroot00000000000000May 19th, 2025 faraday_plugins-1.26.0/CHANGELOG/1.25.0/000077500000000000000000000000001505357635700170025ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.25.0/367.md000066400000000000000000000000511505357635700176370ustar00rootroot00000000000000[FIX] CVSS values in nessus plugin. #367 faraday_plugins-1.26.0/CHANGELOG/1.25.0/372.md000066400000000000000000000000631505357635700176360ustar00rootroot00000000000000[ADD] Security Score Card Support CSV Plugin. #372 faraday_plugins-1.26.0/CHANGELOG/1.25.0/date.md000066400000000000000000000000171505357635700202370ustar00rootroot00000000000000Jul 16th, 2025 faraday_plugins-1.26.0/CHANGELOG/1.26.0/000077500000000000000000000000001505357635700170035ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.26.0/371.md000066400000000000000000000000521505357635700176340ustar00rootroot00000000000000[ADD] Added severity range filtering. #371faraday_plugins-1.26.0/CHANGELOG/1.26.0/date.md000066400000000000000000000000171505357635700202400ustar00rootroot00000000000000Aug 27th, 2025 faraday_plugins-1.26.0/CHANGELOG/1.3.0/000077500000000000000000000000001505357635700167165ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.3.0/add_appspider.md000066400000000000000000000000251505357635700220340ustar00rootroot00000000000000ADD plugin AppSpider faraday_plugins-1.26.0/CHANGELOG/1.3.0/add_cli_tests.md000066400000000000000000000000401505357635700220330ustar00rootroot00000000000000Add tests to faraday-plugins clifaraday_plugins-1.26.0/CHANGELOG/1.3.0/add_default_plugin_version.md000066400000000000000000000000451505357635700246160ustar00rootroot00000000000000add a default value to plugin_versionfaraday_plugins-1.26.0/CHANGELOG/1.3.0/add_output_file_to_faraday-plugins_command.md000066400000000000000000000000761505357635700277600ustar00rootroot00000000000000Add --output-file parameter to faraday-plugins process commandfaraday_plugins-1.26.0/CHANGELOG/1.3.0/add_prowler.md000066400000000000000000000000231505357635700215350ustar00rootroot00000000000000Add plugins prowlerfaraday_plugins-1.26.0/CHANGELOG/1.3.0/add_ssl_labs.md000066400000000000000000000000241505357635700216460ustar00rootroot00000000000000Add plugins ssl labsfaraday_plugins-1.26.0/CHANGELOG/1.3.0/add_tenableio_support.md000066400000000000000000000000321505357635700236010ustar00rootroot00000000000000Add support for tenable iofaraday_plugins-1.26.0/CHANGELOG/1.3.0/date.md000066400000000000000000000000151505357635700201510ustar00rootroot00000000000000Sep 2nd, 2020faraday_plugins-1.26.0/CHANGELOG/1.3.0/delete_old_methods.md000066400000000000000000000000351505357635700230610ustar00rootroot00000000000000delete old deprecated methodsfaraday_plugins-1.26.0/CHANGELOG/1.3.0/fix_Arachni.md000066400000000000000000000001021505357635700214440ustar00rootroot00000000000000Bug fix: Arachni Plugin 'NoneType' object has no attribute 'find' faraday_plugins-1.26.0/CHANGELOG/1.3.0/fix_Openvas.md000066400000000000000000000000761505357635700215240ustar00rootroot00000000000000Bug fix: Openvas Plugin - Import xml from OpenVas doesnt work faraday_plugins-1.26.0/CHANGELOG/1.3.0/fix_QualysWebapp.md000066400000000000000000000001011505357635700225130ustar00rootroot00000000000000Bug fix: QualysWebApp Plugin, error in get info OPERATING_SYSTEM faraday_plugins-1.26.0/CHANGELOG/1.3.0/fix_hydra_to_resolve_ip.md000066400000000000000000000000461505357635700241460ustar00rootroot00000000000000Fix Hydra plugin to resolve ip addressfaraday_plugins-1.26.0/CHANGELOG/1.3.0/fix_nessus.md000066400000000000000000000000451505357635700214250ustar00rootroot00000000000000Fix Nessus mod severity HIGH for Low faraday_plugins-1.26.0/CHANGELOG/1.3.0/fix_prowler.md000066400000000000000000000000441505357635700215760ustar00rootroot00000000000000Bug Fix: Detect plugins AWS Prowler faraday_plugins-1.26.0/CHANGELOG/1.3.0/fix_xml_nmap.md000066400000000000000000000000361505357635700217200ustar00rootroot00000000000000Fix broken xml on nmap plugin faraday_plugins-1.26.0/CHANGELOG/1.3.0/new_rdpscan_plugin.md000066400000000000000000000000271505357635700231200ustar00rootroot00000000000000Add new rdpscan plugin faraday_plugins-1.26.0/CHANGELOG/1.3.0/update_appscan.md000066400000000000000000000000341505357635700222240ustar00rootroot00000000000000UPDATE xml report to appscanfaraday_plugins-1.26.0/CHANGELOG/1.3.0/update_readme.md000066400000000000000000000000151505357635700220330ustar00rootroot00000000000000Update Readmefaraday_plugins-1.26.0/CHANGELOG/1.3.0/update_zap.md000066400000000000000000000000331505357635700213700ustar00rootroot00000000000000Fix how ZAP genereate vulnsfaraday_plugins-1.26.0/CHANGELOG/1.4.0/000077500000000000000000000000001505357635700167175ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.0/date.md000066400000000000000000000000171505357635700201540ustar00rootroot00000000000000Dec 23rd, 2020 faraday_plugins-1.26.0/CHANGELOG/1.4.0/update_nuclei_fields.md000066400000000000000000000000741505357635700234110ustar00rootroot00000000000000Update the fields of the nuclei output used to create a vulnfaraday_plugins-1.26.0/CHANGELOG/1.4.0b1/000077500000000000000000000000001505357635700171425ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.0b1/add_multilinejson_format.md000066400000000000000000000000561505357635700245410ustar00rootroot00000000000000Add new plugin base class, for multi line jsonfaraday_plugins-1.26.0/CHANGELOG/1.4.0b1/add_ncrack.md000066400000000000000000000000221505357635700215270ustar00rootroot00000000000000New ncrack plugin faraday_plugins-1.26.0/CHANGELOG/1.4.0b1/add_nuclei.md000066400000000000000000000000211505357635700215440ustar00rootroot00000000000000New nuclei pluginfaraday_plugins-1.26.0/CHANGELOG/1.4.0b1/add_sslyze_json.md000066400000000000000000000000261505357635700226540ustar00rootroot00000000000000New sslyze json pluginfaraday_plugins-1.26.0/CHANGELOG/1.4.0b1/add_whatweb.md000066400000000000000000000000221505357635700217270ustar00rootroot00000000000000New WhatWeb pluginfaraday_plugins-1.26.0/CHANGELOG/1.4.0b1/date.md000066400000000000000000000000161505357635700203760ustar00rootroot00000000000000Dec 14th, 2020faraday_plugins-1.26.0/CHANGELOG/1.4.0b1/fix_arachni_ip_missing.md000066400000000000000000000000461505357635700241600ustar00rootroot00000000000000Fix missing ip in some arachni reportsfaraday_plugins-1.26.0/CHANGELOG/1.4.0b1/fix_netsparker.md000066400000000000000000000000511505357635700225040ustar00rootroot00000000000000Fix change name vuln in Netsparker pluginfaraday_plugins-1.26.0/CHANGELOG/1.4.0b1/fix_whois.md000066400000000000000000000000611505357635700214600ustar00rootroot00000000000000Fix whois plugin, command whois IP not parse datafaraday_plugins-1.26.0/CHANGELOG/1.4.0b1/modify_json_reports_detection.md000066400000000000000000000001111505357635700256110ustar00rootroot00000000000000Change the way we detect json reports when they are lists of dictionariesfaraday_plugins-1.26.0/CHANGELOG/1.4.0b2/000077500000000000000000000000001505357635700171435ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.0b2/date.md000066400000000000000000000000161505357635700203770ustar00rootroot00000000000000Dec 15th, 2020faraday_plugins-1.26.0/CHANGELOG/1.4.0b2/fix_nuclei.md000066400000000000000000000000461505357635700216120ustar00rootroot00000000000000Fix nuclei plugin bug when url is Nonefaraday_plugins-1.26.0/CHANGELOG/1.4.1/000077500000000000000000000000001505357635700167205ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.1/add_microsoft_baseline.md000066400000000000000000000000601505357635700237150ustar00rootroot00000000000000ADD microsoft baseline security analyzer plugin faraday_plugins-1.26.0/CHANGELOG/1.4.1/add_nextnet.md000066400000000000000000000000231505357635700215320ustar00rootroot00000000000000ADD nextnet plugin faraday_plugins-1.26.0/CHANGELOG/1.4.1/add_openscap.md000066400000000000000000000000251505357635700216570ustar00rootroot00000000000000ADD openscap plugin faraday_plugins-1.26.0/CHANGELOG/1.4.1/date.md000066400000000000000000000000171505357635700201550ustar00rootroot00000000000000Feb 26th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.4.1/fix_nessus_plugin.md000066400000000000000000000000501505357635700230010ustar00rootroot00000000000000FIX old versions of Nessus plugins bugs faraday_plugins-1.26.0/CHANGELOG/1.4.2/000077500000000000000000000000001505357635700167215ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.2/date.md000066400000000000000000000000171505357635700201560ustar00rootroot00000000000000Mar 10th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.4.2/fix_bug_in_sslyze_output_file.md000066400000000000000000000000401505357635700253760ustar00rootroot00000000000000Fix bug with sslyze output file faraday_plugins-1.26.0/CHANGELOG/1.4.2/fix_sslyze_plugin.md000066400000000000000000000000421505357635700230140ustar00rootroot00000000000000FIX change id sslyze for JSON/XML faraday_plugins-1.26.0/CHANGELOG/1.4.3/000077500000000000000000000000001505357635700167225ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.3/date.md000066400000000000000000000000171505357635700201570ustar00rootroot00000000000000Mar 17th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.4.3/new_ignore_info_option.md000066400000000000000000000000561505357635700240040ustar00rootroot00000000000000Add Ignore information vulnerabilities option faraday_plugins-1.26.0/CHANGELOG/1.4.4/000077500000000000000000000000001505357635700167235ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.4/csv_plugin_dont_user_ignore_info.md000066400000000000000000000000571505357635700260600ustar00rootroot00000000000000Faraday CSV Plugin do not consider ignore_info faraday_plugins-1.26.0/CHANGELOG/1.4.4/date.md000066400000000000000000000000171505357635700201600ustar00rootroot00000000000000Mar 30th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.4.5/000077500000000000000000000000001505357635700167245ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.5/add_bandit_plugin.md000066400000000000000000000000221505357635700226670ustar00rootroot00000000000000Add Bandit plugin faraday_plugins-1.26.0/CHANGELOG/1.4.5/change_burp_fields.md000066400000000000000000000001031505357635700230430ustar00rootroot00000000000000Use background for description and detail for data en Burp plugin. faraday_plugins-1.26.0/CHANGELOG/1.4.5/date.md000066400000000000000000000000171505357635700201610ustar00rootroot00000000000000Apr 15th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.4.5/fix_appscan.md000066400000000000000000000000271505357635700215400ustar00rootroot00000000000000Rewrite Appscan Plugin faraday_plugins-1.26.0/CHANGELOG/1.4.5/parse_nmap_vulnes.md000066400000000000000000000000371505357635700227670ustar00rootroot00000000000000Parse Nmap vulners script data faraday_plugins-1.26.0/CHANGELOG/1.4.6/000077500000000000000000000000001505357635700167255ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.6/add-attribute_command_for_plugins_of_all_command.md000066400000000000000000000002031505357635700311120ustar00rootroot00000000000000- add attribute "command" for the pluggins of each command - adding test in test_command - change some regex in self._command_regexfaraday_plugins-1.26.0/CHANGELOG/1.4.6/add_hostnames_to_cached_host.md000066400000000000000000000000561505357635700251070ustar00rootroot00000000000000[FIX] add hostnames if host is already cached faraday_plugins-1.26.0/CHANGELOG/1.4.6/add_naabu_plugin.md000066400000000000000000000000211505357635700225140ustar00rootroot00000000000000Add Naabu plugin faraday_plugins-1.26.0/CHANGELOG/1.4.6/add_sonarqube.md000066400000000000000000000000251505357635700220530ustar00rootroot00000000000000Add Sonarqube plugin faraday_plugins-1.26.0/CHANGELOG/1.4.6/change_list_plugins.md000066400000000000000000000000521505357635700232650ustar00rootroot00000000000000Add version and change list_plugins style faraday_plugins-1.26.0/CHANGELOG/1.4.6/clean_code.md000066400000000000000000000001031505357635700213150ustar00rootroot00000000000000FIX unused import, innecesary list compression and unused variablesfaraday_plugins-1.26.0/CHANGELOG/1.4.6/date.md000066400000000000000000000000171505357635700201620ustar00rootroot00000000000000May 14th, 2021 error_when_import_report_of_metasploit_with_faraday_plugins.md000066400000000000000000000000621505357635700335350ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.6FIX metasploit report when the web-site-id is nullfaraday_plugins-1.26.0/CHANGELOG/1.4.6/fix_nmap_port_status.md000066400000000000000000000000271505357635700235160ustar00rootroot00000000000000Fix port stats in nmap faraday_plugins-1.26.0/CHANGELOG/1.4.6/fixup_sslyze.md000066400000000000000000000000471505357635700220140ustar00rootroot00000000000000fixup ssylze sacar unknown de version= faraday_plugins-1.26.0/CHANGELOG/1.4.6/issue_in_netsparker.md000066400000000000000000000000321505357635700233160ustar00rootroot00000000000000ADD remedy into resolutionfaraday_plugins-1.26.0/CHANGELOG/1.4.6/update_nuclei.md000066400000000000000000000000311505357635700220620ustar00rootroot00000000000000Support for nuclei 2.3.0 faraday_plugins-1.26.0/CHANGELOG/1.4.6/when_import_report_of_nessus_we_can_get_more_data.md000066400000000000000000000002031505357635700314420ustar00rootroot00000000000000ADD cve, cvss3_base_score, cvss3_vector, exploit_available when import nessus and change the structure of external_id to NESSUS-XXXwhen_import_reports_of_owasp_and_zap_we_might_get_more_data.md000066400000000000000000000001211505357635700334210ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.4.6ADD more data like attack, params, uri, method, WASC, CWE and format externail_idfaraday_plugins-1.26.0/CHANGELOG/1.5.0/000077500000000000000000000000001505357635700167205ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.0/add_nipper_plugin.md000066400000000000000000000000221505357635700227170ustar00rootroot00000000000000Add Nipper Plugin faraday_plugins-1.26.0/CHANGELOG/1.5.0/add_shodan_plugin.md000066400000000000000000000000221505357635700226760ustar00rootroot00000000000000add shodan plugin faraday_plugins-1.26.0/CHANGELOG/1.5.0/date.md000066400000000000000000000000171505357635700201550ustar00rootroot00000000000000Jun 28th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.5.0/fix_acunetix_url_parser.md000066400000000000000000000000301505357635700241570ustar00rootroot00000000000000fix acunetix url parser faraday_plugins-1.26.0/CHANGELOG/1.5.0/fix_netsparker_multihost.md000066400000000000000000000000311505357635700243700ustar00rootroot00000000000000FIX netsparker multi-hostfaraday_plugins-1.26.0/CHANGELOG/1.5.0/fixup_ssylyze_desc_data.md000066400000000000000000000001441505357635700241650ustar00rootroot00000000000000Add vuln details for Certificate Mismatch and move unique details to data, now vulns can be grupped faraday_plugins-1.26.0/CHANGELOG/1.5.0/many-error-when-parse_the_xml_of_arachni_and_w3af.md000066400000000000000000000000511505357635700310330ustar00rootroot00000000000000ADD more data to plugins arachni and w3affaraday_plugins-1.26.0/CHANGELOG/1.5.0/run_date_utc.md000066400000000000000000000000241505357635700217120ustar00rootroot00000000000000Use run_date in UTC faraday_plugins-1.26.0/CHANGELOG/1.5.0/we_can_get_more_data_of_the_reports_of_openvas.md000066400000000000000000000000641505357635700306710ustar00rootroot00000000000000ADD cvss_base, cpe, threat, severity into referencesfaraday_plugins-1.26.0/CHANGELOG/1.5.1/000077500000000000000000000000001505357635700167215ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.1/add_nuclei_fields.md000066400000000000000000000001031505357635700226520ustar00rootroot00000000000000cwe, capec, references, tags, impact, resolution, easeofresolution faraday_plugins-1.26.0/CHANGELOG/1.5.1/add_os_openvas.md000066400000000000000000000000161505357635700222240ustar00rootroot00000000000000add os openvasfaraday_plugins-1.26.0/CHANGELOG/1.5.1/date.md000066400000000000000000000000171505357635700201560ustar00rootroot00000000000000Jul 27th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.5.1/fix_csv_big_fields_error.md000066400000000000000000000000501505357635700242570ustar00rootroot00000000000000[FIX] Fix improt of CSV with big fields faraday_plugins-1.26.0/CHANGELOG/1.5.1/fixx_sslyze_json_bug.md000066400000000000000000000000361505357635700235170ustar00rootroot00000000000000Fix sslyze json bug with port faraday_plugins-1.26.0/CHANGELOG/1.5.1/only_show_report_name.md000066400000000000000000000000461505357635700236570ustar00rootroot00000000000000Only show report name in command data faraday_plugins-1.26.0/CHANGELOG/1.5.10/000077500000000000000000000000001505357635700170015ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.10/Nuclei_metadata.md000066400000000000000000000000421505357635700223760ustar00rootroot00000000000000support cve,cwe,cvss and metadata faraday_plugins-1.26.0/CHANGELOG/1.5.10/date.md000066400000000000000000000000171505357635700202360ustar00rootroot00000000000000Jan 13th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.5.2/000077500000000000000000000000001505357635700167225ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.2/date.md000066400000000000000000000000161505357635700201560ustar00rootroot00000000000000Aug 9th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.5.2/new_structure_acunetix.md000066400000000000000000000000331505357635700240510ustar00rootroot00000000000000add new structure acunetix faraday_plugins-1.26.0/CHANGELOG/1.5.3/000077500000000000000000000000001505357635700167235ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.3/command_support_nuclei.md000066400000000000000000000001011505357635700240060ustar00rootroot00000000000000Adding support for running nuclei through command / faraday-cli faraday_plugins-1.26.0/CHANGELOG/1.5.3/date.md000066400000000000000000000000161505357635700201570ustar00rootroot00000000000000Sep 7th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.5.3/fix_mising_references.md000066400000000000000000000000411505357635700235750ustar00rootroot00000000000000Fix missing references in nuclei faraday_plugins-1.26.0/CHANGELOG/1.5.4/000077500000000000000000000000001505357635700167245ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.4/date.md000066400000000000000000000000171505357635700201610ustar00rootroot00000000000000Oct 19th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.5.4/nuclei_updates.md000066400000000000000000000000251505357635700222470ustar00rootroot00000000000000Update nuclei parser faraday_plugins-1.26.0/CHANGELOG/1.5.5/000077500000000000000000000000001505357635700167255ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.5/date.md000066400000000000000000000000171505357635700201620ustar00rootroot00000000000000Oct 21st, 2021 faraday_plugins-1.26.0/CHANGELOG/1.5.5/merge_from_github.md000066400000000000000000000000251505357635700227300ustar00rootroot00000000000000Merge PR from github faraday_plugins-1.26.0/CHANGELOG/1.5.6/000077500000000000000000000000001505357635700167265ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.6/date.md000066400000000000000000000000171505357635700201630ustar00rootroot00000000000000Nov 10th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.5.6/fix_acunetix_issue.md000066400000000000000000000000401505357635700231400ustar00rootroot00000000000000FIX issue with acunetix plugin faraday_plugins-1.26.0/CHANGELOG/1.5.6/fix_nikto_typo.md000066400000000000000000000000311505357635700223070ustar00rootroot00000000000000FIX typo in nikto plugin faraday_plugins-1.26.0/CHANGELOG/1.5.7/000077500000000000000000000000001505357635700167275ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.7/date.md000066400000000000000000000000171505357635700201640ustar00rootroot00000000000000Nov 19th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.5.7/fix_netsparker.md000066400000000000000000000000431505357635700222720ustar00rootroot00000000000000FIX extrainfo of netsparker plugin faraday_plugins-1.26.0/CHANGELOG/1.5.7/nuclei_legacy.md000066400000000000000000000000311505357635700220460ustar00rootroot00000000000000Add nuclei_legacy plugin faraday_plugins-1.26.0/CHANGELOG/1.5.8/000077500000000000000000000000001505357635700167305ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.8/Add CVE to plugins.md000066400000000000000000000002371505357635700224070ustar00rootroot00000000000000Add CVE to plugins - acunetix - appscan - burp - metasploit - nessus - netsparker - nexpose - nikto - nipper - nmap - openscap - qualysguard - retina - shodan faraday_plugins-1.26.0/CHANGELOG/1.5.8/Add_support_for_Sslyze_5.md000066400000000000000000000000431505357635700241760ustar00rootroot00000000000000Add support for Sslyze 5.0 resportsfaraday_plugins-1.26.0/CHANGELOG/1.5.8/Fix appscan plugin.md000066400000000000000000000000601505357635700226610ustar00rootroot00000000000000Fix errors while creating hosts with wrong regexfaraday_plugins-1.26.0/CHANGELOG/1.5.8/add_masscan_support.md000066400000000000000000000000431505357635700233000ustar00rootroot00000000000000ADD masscan support to nmap plugin faraday_plugins-1.26.0/CHANGELOG/1.5.8/date.md000066400000000000000000000000171505357635700201650ustar00rootroot00000000000000Dec 13th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.5.8/fix openvas.md000066400000000000000000000000311505357635700214660ustar00rootroot00000000000000Fix bug in openvas pluginfaraday_plugins-1.26.0/CHANGELOG/1.5.9/000077500000000000000000000000001505357635700167315ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.5.9/add_cve_in_faraday_csv_plugin.md000066400000000000000000000000351505357635700252440ustar00rootroot00000000000000Add cve in faraday_csv pluginfaraday_plugins-1.26.0/CHANGELOG/1.5.9/add_grype.md000066400000000000000000000000211505357635700212020ustar00rootroot00000000000000ADD Grype plugin faraday_plugins-1.26.0/CHANGELOG/1.5.9/date.md000066400000000000000000000000171505357635700201660ustar00rootroot00000000000000Dec 27th, 2021 faraday_plugins-1.26.0/CHANGELOG/1.6.0/000077500000000000000000000000001505357635700167215ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.6.0/add_packaging.md000066400000000000000000000000521505357635700217740ustar00rootroot00000000000000Add packaging to requierments in setup.py faraday_plugins-1.26.0/CHANGELOG/1.6.0/add_severity_to_shodan.md000066400000000000000000000000531505357635700237610ustar00rootroot00000000000000Add severity to shodan's plugins using cvssfaraday_plugins-1.26.0/CHANGELOG/1.6.0/date.md000066400000000000000000000000161505357635700201550ustar00rootroot00000000000000Feb 3rd, 2022 faraday_plugins-1.26.0/CHANGELOG/1.6.0/fix_cve.md000066400000000000000000000000431505357635700206630ustar00rootroot00000000000000check if cve exist on cve-id field faraday_plugins-1.26.0/CHANGELOG/1.6.0/fix_fortify.md000066400000000000000000000000251505357635700215700ustar00rootroot00000000000000Fix Fortify's plugin faraday_plugins-1.26.0/CHANGELOG/1.6.0/fix_to_qualysguard.md000066400000000000000000000001151505357635700231510ustar00rootroot00000000000000Change qualysguard's plugin severity_dict to refer level 2 severities as low faraday_plugins-1.26.0/CHANGELOG/1.6.1/000077500000000000000000000000001505357635700167225ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.6.1/add_references_to_burp.md000066400000000000000000000000361505357635700237260ustar00rootroot00000000000000Add references tu burp plugin faraday_plugins-1.26.0/CHANGELOG/1.6.1/date.md000066400000000000000000000000171505357635700201570ustar00rootroot00000000000000Mar 18th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.6.1/fix_burp_plugin.md000066400000000000000000000000431505357635700224350ustar00rootroot00000000000000Move item.detail from data to desc faraday_plugins-1.26.0/CHANGELOG/1.6.1/update_open_status.md000066400000000000000000000000231505357635700231450ustar00rootroot00000000000000update open status faraday_plugins-1.26.0/CHANGELOG/1.6.2/000077500000000000000000000000001505357635700167235ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.6.2/add_line_indicator_to_appscan.md000066400000000000000000000001121505357635700252410ustar00rootroot00000000000000Now Appscan plugin saves line and highlight of the vulns in desc and data faraday_plugins-1.26.0/CHANGELOG/1.6.2/date.md000066400000000000000000000000161505357635700201570ustar00rootroot00000000000000Apr 4th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.6.3/000077500000000000000000000000001505357635700167245ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.6.3/add_zap_json.md000066400000000000000000000000251505357635700216760ustar00rootroot00000000000000Add Zap Json plugin. faraday_plugins-1.26.0/CHANGELOG/1.6.3/date.md000066400000000000000000000000171505357635700201610ustar00rootroot00000000000000Apr 19th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.6.4/000077500000000000000000000000001505357635700167255ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.6.4/add_location_as_param.md000066400000000000000000000000501505357635700235250ustar00rootroot00000000000000Add location as params in burp's plugin faraday_plugins-1.26.0/CHANGELOG/1.6.4/date.md000066400000000000000000000000171505357635700201620ustar00rootroot00000000000000Apr 21th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.6.4/fix_custom_field_regex.md000066400000000000000000000001131505357635700237570ustar00rootroot00000000000000Now the faraday_csv custom_fields regex match any no whitespace character. faraday_plugins-1.26.0/CHANGELOG/1.6.5/000077500000000000000000000000001505357635700167265ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.6.5/date.md000066400000000000000000000000171505357635700201630ustar00rootroot00000000000000Apr 28th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.6.5/set_severity.md000066400000000000000000000000771505357635700220010ustar00rootroot00000000000000Now Openvas's plugin set severity to Critical when cvss >= 9.0 faraday_plugins-1.26.0/CHANGELOG/1.6.6/000077500000000000000000000000001505357635700167275ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.6.6/add_hostname_resolution_parameter.md000066400000000000000000000000611505357635700262170ustar00rootroot00000000000000Add hostname_resolution parameter within plugins faraday_plugins-1.26.0/CHANGELOG/1.6.6/date.md000066400000000000000000000000171505357635700201640ustar00rootroot00000000000000May 20th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.6.6/fix_openvas_external_id.md000066400000000000000000000000301505357635700241410ustar00rootroot00000000000000Fix openvas external ID faraday_plugins-1.26.0/CHANGELOG/1.6.7/000077500000000000000000000000001505357635700167305ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.6.7/change_hostname_resolution.md000066400000000000000000000001551505357635700246610ustar00rootroot00000000000000Change hostname_restolution to dont_resolve_hostname for process-report and now test dosent resovle hostname faraday_plugins-1.26.0/CHANGELOG/1.6.7/date.md000066400000000000000000000000161505357635700201640ustar00rootroot00000000000000Jun 2nd, 2022 faraday_plugins-1.26.0/CHANGELOG/1.6.7/fix_qualyswebapp.md000066400000000000000000000001131505357635700226300ustar00rootroot00000000000000Now QualysWebApp's plugin will diferenciate vulns from differents urlpaths faraday_plugins-1.26.0/CHANGELOG/1.6.8/000077500000000000000000000000001505357635700167315ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.6.8/add_appscancsv.md000066400000000000000000000000201505357635700222140ustar00rootroot00000000000000Add appscan csv faraday_plugins-1.26.0/CHANGELOG/1.6.8/add_ignore_info_to_faradaycsv.md000066400000000000000000000000641505357635700252660ustar00rootroot00000000000000Now faraday_csv's plugin uses ignore_info parameter faraday_plugins-1.26.0/CHANGELOG/1.6.8/add_syhunt.md000066400000000000000000000000221505357635700214070ustar00rootroot00000000000000Add syhunt plugin faraday_plugins-1.26.0/CHANGELOG/1.6.8/date.md000066400000000000000000000000171505357635700201660ustar00rootroot00000000000000Jul 25th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.6.8/fix_appscan.md000066400000000000000000000000671505357635700215510ustar00rootroot00000000000000Add cve and data fields to desc for avoid duplications faraday_plugins-1.26.0/CHANGELOG/1.6.8/fix_nuclei.md000066400000000000000000000000641505357635700214000ustar00rootroot00000000000000Now nuclei resolve hostname if the field ip is None faraday_plugins-1.26.0/CHANGELOG/1.7.0/000077500000000000000000000000001505357635700167225ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.7.0/add_cwe.md000066400000000000000000000004711505357635700206340ustar00rootroot00000000000000Add CWE to PluginBase. The plugins that have this implemented are the following: "Acunetix", "Acunetix_Json", "AppSpider", "Appscan", "Arachni", "Burp", "Checkmarx", "Metasploit", "Nessus", "Netsparker", "NetsparkerCloud", "Openvas", "QualysWebapp", "W3af", "Wapiti", "Zap", "Zap_Json", "nuclei", "nuclei_legacy" faraday_plugins-1.26.0/CHANGELOG/1.7.0/add_support_cvss.md000066400000000000000000000003241505357635700226250ustar00rootroot00000000000000Now the nexts pluggins extracts cvss from reports: - Acunetix - Acunetix_Json - Appscan - Nessus - Netsparker - NexposeFull - Nipper - Nmap - Openvas - QualysWebapp - Qualysguard - Retina - shodan - whitesource faraday_plugins-1.26.0/CHANGELOG/1.7.0/add_tags_arguments.md000066400000000000000000000001341505357635700230750ustar00rootroot00000000000000Add arguments for add tags for vulns, services and host. Add test for tags and ignore_info faraday_plugins-1.26.0/CHANGELOG/1.7.0/add_trivy_plugin.md000066400000000000000000000000301505357635700226000ustar00rootroot00000000000000Add trivy's json plugin faraday_plugins-1.26.0/CHANGELOG/1.7.0/add_wpscan_command_support.md000066400000000000000000000000521505357635700246360ustar00rootroot00000000000000Add command support for the wpscan plugin faraday_plugins-1.26.0/CHANGELOG/1.7.0/change_ref_structure.md000066400000000000000000000001441505357635700234440ustar00rootroot00000000000000[MOD] Now refs field is a list of dictionary with the format: {'name': string, 'type': string}, faraday_plugins-1.26.0/CHANGELOG/1.7.0/date.md000066400000000000000000000000161505357635700201560ustar00rootroot00000000000000Sep 5th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.7.0/fix_accunetix.md000066400000000000000000000000461505357635700220750ustar00rootroot00000000000000Fix for acunetix_json when host is ip faraday_plugins-1.26.0/CHANGELOG/1.7.0/fix_appscan_csv_duplicate_assets.md000066400000000000000000000001231505357635700260220ustar00rootroot00000000000000[FIX] - Asset duplicated on same file with multiple entries for Appscan_csv plugin.faraday_plugins-1.26.0/CHANGELOG/1.7.0/fix_for_python3.10.md000066400000000000000000000001541505357635700226030ustar00rootroot00000000000000[FIX] Change import dateutil to from dateutil.parser import parse for compatibility issues with python 3.10 faraday_plugins-1.26.0/CHANGELOG/1.7.0/fix_netsparker.md000066400000000000000000000001271505357635700222700ustar00rootroot00000000000000[FIX] Add case for Netsparker plugins, when the url has a number inside a parenthesis. faraday_plugins-1.26.0/CHANGELOG/1.7.0/fix_syhunt.md000066400000000000000000000000441505357635700214420ustar00rootroot00000000000000Add *args **kwargs to syhunt plugin faraday_plugins-1.26.0/CHANGELOG/1.7.0/minor_fix_for_grype.md000066400000000000000000000000621505357635700233100ustar00rootroot00000000000000fix bug when grype report has no arifact/metadata faraday_plugins-1.26.0/CHANGELOG/1.7.0/mod_prowler.md000066400000000000000000000001361505357635700215750ustar00rootroot00000000000000[MOD] Now prowler plugin returns CAF Epic as policy violation and remove [check#] from tittle faraday_plugins-1.26.0/CHANGELOG/1.8.0/000077500000000000000000000000001505357635700167235ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.8.0/add_invicti.md000066400000000000000000000000311505357635700215140ustar00rootroot00000000000000[Add] Add invicti plugin faraday_plugins-1.26.0/CHANGELOG/1.8.0/add_nessus_sc_plugin.md000066400000000000000000000000331505357635700234340ustar00rootroot00000000000000[Add] Add nessus_sc plugin faraday_plugins-1.26.0/CHANGELOG/1.8.0/fix_nexpose_full.md000066400000000000000000000000631505357635700226150ustar00rootroot00000000000000[FIX] Remove cvss_vector from refs in nexpose_full faraday_plugins-1.26.0/CHANGELOG/1.8.0/fix_nikto.md000066400000000000000000000000471505357635700212400ustar00rootroot00000000000000Add new identifier_tag to nikto plugin faraday_plugins-1.26.0/CHANGELOG/1.8.0/fix_plugins.md000066400000000000000000000000751505357635700215760ustar00rootroot00000000000000[FIX] Now plugins check if ref field is already a dictionary faraday_plugins-1.26.0/CHANGELOG/1.8.0/mod_grype.md000066400000000000000000000003101505357635700212240ustar00rootroot00000000000000[MOD] Improve grype plugin for dockers images and change report_belong_to method for json plugins to check if json_keys is a list, in that case iterate the list and try if any of them create a match. faraday_plugins-1.26.0/CHANGELOG/1.8.1/000077500000000000000000000000001505357635700167245ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.8.1/add_check_cwe_nuclei.md000066400000000000000000000001551505357635700233310ustar00rootroot00000000000000[FIX] Nuclei's plugin check if the cwe is null and add retrocompability for newer versions for wpscan plugin faraday_plugins-1.26.0/CHANGELOG/1.8.1/add_enrichment.md000066400000000000000000000000601505357635700222060ustar00rootroot00000000000000[ADD] Add cvss2/3 and cwe to faraday_csv plugin faraday_plugins-1.26.0/CHANGELOG/1.8.1/add_severity.md000066400000000000000000000000701505357635700217250ustar00rootroot00000000000000[Add] Now nexpose_full plugin use severity from reports faraday_plugins-1.26.0/CHANGELOG/1.8.1/check_if_refs_is_empty.md000066400000000000000000000000541505357635700237300ustar00rootroot00000000000000[FIX] Now plugins check if the ref is empty faraday_plugins-1.26.0/CHANGELOG/1.8.1/date.md000066400000000000000000000000171505357635700201610ustar00rootroot00000000000000Nov 28th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.9.0/000077500000000000000000000000001505357635700167245ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.9.0/add_check_protocol.md000066400000000000000000000000771505357635700230600ustar00rootroot00000000000000[FIX] Now all plugins check that service protocol is not empty faraday_plugins-1.26.0/CHANGELOG/1.9.0/add_pentera.md000066400000000000000000000001431505357635700215120ustar00rootroot00000000000000[ADD] New pentera plugin and now json plugins can have filter_key to filter reports with that keys faraday_plugins-1.26.0/CHANGELOG/1.9.0/change_table_view_list_plugins.md000066400000000000000000000000651505357635700254710ustar00rootroot00000000000000[MOD] Change table format for list-plugins to github faraday_plugins-1.26.0/CHANGELOG/1.9.0/date.md000066400000000000000000000000171505357635700201610ustar00rootroot00000000000000Dic 15th, 2022 faraday_plugins-1.26.0/CHANGELOG/1.9.1/000077500000000000000000000000001505357635700167255ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/1.9.1/add_cis_plugin.md000066400000000000000000000000311505357635700222050ustar00rootroot00000000000000[ADD] Add new CIS plugin faraday_plugins-1.26.0/CHANGELOG/1.9.1/date.md000066400000000000000000000000161505357635700201610ustar00rootroot00000000000000Jan 3rd, 2023 faraday_plugins-1.26.0/CHANGELOG/current/000077500000000000000000000000001505357635700177415ustar00rootroot00000000000000faraday_plugins-1.26.0/CHANGELOG/current/.keep000066400000000000000000000000001505357635700206540ustar00rootroot00000000000000faraday_plugins-1.26.0/COPYING000066400000000000000000001045151505357635700160310ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . faraday_plugins-1.26.0/MANIFEST.in000066400000000000000000000000571505357635700165300ustar00rootroot00000000000000include faraday_plugins/plugins/port_mapper.txtfaraday_plugins-1.26.0/README.md000066400000000000000000000115161505357635700162530ustar00rootroot00000000000000## Install ```shell script pip install faraday-plugins ``` ## Commands ### List Plugins List all plugins and if its compatible with command or/and report Optional params: - -cpf / --custom-plugins-folder PATH: If given will also look for custom plugins on that path ```shell script faraday-plugins list-plugins ``` ### Test autodetect plugin from command ```shell script faraday-plugins detect-command "ping -c 4 www.google.com" Faraday Plugin: ping ``` ### Test process command with plugin Optional params: - --plugin_id PLUGIN_ID: Dont detect the plugin, use this one - -cpf / --custom-plugins-folder PATH: If given will also look for custom plugins on that path - -dr / --dont-run: Dont run, just show the generated command - -o / --output-file PATH: send json outout to file instead of stdout - -sh / --show-output: show the output of the command ```shell script faraday-plugins process-command "ping -c4 www.google.com" { "hosts": [ { "ip": "216.58.202.36", "os": "unknown", "hostnames": [ "www.google.com" ], "description": "", "mac": null, "credentials": [], "services": [], "vulnerabilities": [], "tags": [] } ], "command": { "tool": "ping", "command": "ping", "params": "-c4 www.google.com", "user": "user", "hostname": "", "start_date": "2020-06-19T17:02:37.982293", "duration": 39309, "import_source": "shell" } } ``` ### Test autodetect plugin from report ```shell script faraday-plugins detect-report /path/to/report.xml Faraday Plugin: Nmap ``` ### Test report with plugin Optional params: - --plugin_id PLUGIN_ID: Dont detect the plugin, use this one - -cpf / --custom-plugins-folder PATH: If given will also look for custom plugins on that path ```shell script faraday-plugins process-report /path/to/nmap_report.xml { "hosts": [ { "ip": "192.168.66.1", "os": "unknown", "hostnames": [], "description": "", "mac": "00:00:00:00:00:00", "credentials": [], "services": [ { "name": "domain", "protocol": "tcp", "port": 53, "status": "open", "version": "", "description": "domain", "credentials": [], "vulnerabilities": [], "tags": [] }, { "name": "netbios-ssn", "protocol": "tcp", "port": 139, "status": "open", "version": "", "description": "netbios-ssn", "credentials": [], "vulnerabilities": [], "tags": [] } ], "vulnerabilities": [], "tags": [] } ], "command": { "tool": "Nmap", "command": "Nmap", "params": "/path/to/nmap_report.xml", "user": "user", "hostname": "", "start_date": "2020-06-19T17:22:11.608134", "duration": 1233, "import_source": "report" } } ``` ## Plugin Logger To use it you must call `self.logger.debug("some message")` ```shell script export PLUGIN_DEBUG=1 faraday-plugins proces-report /path/to/report.xml 2019-11-15 20:37:03,355 - faraday.faraday_plugins.plugins.manager - INFO [manager.py:113 - _load_plugins()] Loading Native Plugins... 2019-11-15 20:37:03,465 - faraday.faraday_plugins.plugins.manager - DEBUG [manager.py:123 - _load_plugins()] Load Plugin [acunetix] 2019-11-15 20:37:03,495 - faraday.faraday_plugins.plugins.manager - DEBUG [manager.py:123 - _load_plugins()] Load Plugin [amap] 2019-11-15 20:37:03,549 - faraday.faraday_plugins.plugins.manager - DEBUG [manager.py:123 - _load_plugins()] Load Plugin [appscan] 2019-11-15 20:37:03,580 - faraday.faraday_plugins.plugins.manager - DEBUG [manager.py:123 - _load_plugins()] Load Plugin [arachni] 2019-11-15 20:37:03,613 - faraday.faraday_plugins.plugins.manager - DEBUG [manager.py:123 - _load_plugins()] Load Plugin [arp_scan] 2019-11-15 20:37:03,684 - faraday.faraday_plugins.plugins.manager - DEBUG [manager.py:123 - _load_plugins()] Load Plugin [beef] 2019-11-15 20:37:03,714 - faraday.faraday_plugins.plugins.manager - DEBUG [manager.py:123 - _load_plugins()] Load Plugin [brutexss] 2019-11-15 20:37:03,917 - faraday.faraday_plugins.plugins.manager - DEBUG [manager.py:123 - _load_plugins()] Load Plugin [burp] 2019-11-15 20:37:03,940 - faraday.faraday_plugins.plugins.manager - DEBUG [manager.py:123 - _load_plugins()] Load Plugin [dig] ... ``` More documentation here https://docs.faradaysec.com/Basic-plugin-development/ faraday_plugins-1.26.0/RELEASE.md000066400000000000000000000276521505357635700164060ustar00rootroot000000000000001.26.0 [Aug 27th, 2025]: --- * [ADD] Added severity range filtering. #371 1.25.0 [Jul 16th, 2025]: --- * [ADD] Security Score Card Support CSV Plugin. #372 * [FIX] CVSS values in nessus plugin. #367 1.24.1 [May 19th, 2025]: --- * [FIX] CVSS3 in openvas plugin. #345 1.24.0 [Apr 24th, 2025]: --- * [ADD] Added Tenable IO JSON Vuln Export Plugin. #365 1.23.0 [Mar 13th, 2025]: --- * [ADD] Added DNSX Multiline JSON Plugin. #360 * [ADD] Added extra DirSearch plugin compatible with dirsearch 0.4.3. #362 * [ADD] Added Subfinder Plugin. #364 * [FIX] Fixed Qualys WebAPP to accept vulns with no evidence. #363 1.22.1 [Jan 30th, 2025]: --- * [FIX] Remove release history from setup. #999 1.22.0 [Jan 30th, 2025]: --- * [ADD] Added support for cvss4 in faraday cvs. #355 * [FIX] Fixed description and CI Bandit update. #361 1.21.0 [Jan 6th, 2025]: --- * [ADD] Added Saint CSV report processor. #353 1.20.0 [Nov 21st, 2024]: --- * [FIX] Duplicate detection vulnerability in the Burp plugin. #354 1.19.1 [Sep 20th, 2024]: --- * [MOD] Updated the SSLyze JSON parser to support and correctly process scan results from SSLyze version 6. #349 * [FIX] Crowdstrike IP resolution for asset. #350 * [FIX] Corrected a hostname resolution issue that was causing traceback errors and malfunctioning of the plugin. This fix ensures proper hostname resolution and stabilizes plugin performance. #351 1.19.0 [Aug 23rd, 2024]: --- * [ADD] Added owasp dependency check. #100 * [ADD] Added gitleaks plugin. #342 * [FIX] Nessus plugin crashed when parsing tenableio reports without vulnerabilities, so a check for that was added. #341 1.18.2 [Jul 24th, 2024]: --- * [FIX] Added validations for empty lines and multiple fields including lists. #343 1.18.1 [Jul 11th, 2024]: --- * [MOD] Naabu reports changed their JSON structure, so new keys were added to detect the new report structure. #339 1.18.0 [May 22th, 2024]: --- * [FIX] Fix key error when `packageVulnerabilityDetails` key was not in the file. #331 * [FIX] Addressed a bug where Burp plugin output would display null data in cases of encountering a malformed XML token from the report. #333 * [FIX] Previously, CSV files edited in tools like Mac Numbers would transform boolean values to uppercase. This issue has been addressed within the faraday_csv plugin, ensuring accurate comparison. #336 1.17.0 [Mar 12th, 2024]: --- * [ADD] Add hotspots logic for sonarqube plugin #321 1.16.0 [Feb 8th, 2024]: --- * [ADD] Add Snyk plugin. #314 * [MOD] Mod AWS Inspector's plugins. #322 * [ADD] Add faraday_json plugins. #324 * [ADD] Update prowler plugin to support the latest tool output format. Also rename the oldest plugin to prowler_legacy. #328 1.15.1 [Dec 22th, 2023]: --- * [FIX] Filter \x00 in nuclei response. #323 1.15.0 [Dec 12th, 2023]: --- * [ADD] Add PopEye's plugin. #303 * [ADD] Add Ping Castle's plugin. #304 * [ADD] Add Kubescape's plugin. #320 * [ADD] Add AWS Inspector's plugins. #322 1.14.0 [Oct 10th, 2023]: --- * [ADD] Add Crowdstrike's plugin. #318 1.13.2 [Sep 6th, 2023]: --- * [ADD] Extract response and request info in qualyswebapp's plugins. #307 * [ADD] Create Plugin for windows defender. #315 1.13.0 [Aug 24th, 2023]: --- * [FIX] If severity id in an appscan item is greater than 4 set it to 4. #305 * [FIX] Update Naabu plugin for the latest version, Semgrep create a new service for each vuln, fix Arachni bug in case the report has no vulns. #306 * [ADD] Add Terrascan and TFSec plugins. #310 * [FIX] Use cvss_score to calculate severity in nessus plugin. #311 1.12.1 [July 7th, 2023]: --- * [FIX] Fix Appscan's pluign. #302 1.12.0 [May 24th, 2023]: --- * [ADD] Add Sarif plugin. #299 1.11.0 [Apr 3rd, 2023]: --- * [FIX] Change syhunt´s and trivy´s plugins to export cvss vector correctly #292 * [ADD] Add force flag to process-command to process the output of the command regardless of the exit code. #294 * [MOD] The accunetix plugin now search for CVSS and cvss #296 * [ADD] Add semgrep plugin. #297 * [FIX] Fix inviti's plugin, check remedial procedures before parsing it with b4f. #298 1.10.0 [Jan 31th, 2023]: --- * [ADD] Add new acunetix360 plugin #293 1.9.1 [Jan 3rd, 2023]: --- * [ADD] Add new CIS plugin 1.9.0 [Dic 15th, 2022]: --- * [FIX] Now all plugins check that service protocol is not empty * [ADD] New pentera plugin and now json plugins can have filter_key to filter reports with that keys * [MOD] Change table format for list-plugins to github 1.8.1 [Nov 28th, 2022]: --- * [FIX] Nuclei's plugin check if the cwe is null and add retrocompability for newer versions for wpscan plugin * [ADD] Add cvss2/3 and cwe to faraday_csv plugin * [Add] Now nexpose_full plugin use severity from reports * [FIX] Now plugins check if the ref is empty 1.8.0: --- * [Add] Add invicti plugin * [Add] Add nessus_sc plugin * [FIX] Remove cvss_vector from refs in nexpose_full * Add new identifier_tag to nikto plugin * [FIX] Now plugins check if ref field is already a dictionary * [MOD] Improve grype plugin for dockers images and change report_belong_to method for json plugins to check if json_keys is a list, in that case iterate the list and try if any of them create a match. 1.7.0 [Sep 5th, 2022]: --- * Add CWE to PluginBase. The plugins that have this implemented are the following: "Acunetix", "Acunetix_Json", "AppSpider", "Appscan", "Arachni", "Burp", "Checkmarx", "Metasploit", "Nessus", "Netsparker", "NetsparkerCloud", "Openvas", "QualysWebapp", "W3af", "Wapiti", "Zap", "Zap_Json", "nuclei", "nuclei_legacy" * Now the nexts pluggins extracts cvss from reports: - Acunetix - Acunetix_Json - Appscan - Nessus - Netsparker - NexposeFull - Nipper - Nmap - Openvas - QualysWebapp - Qualysguard - Retina - shodan - whitesource * Add arguments for add tags for vulns, services and host. Add test for tags and ignore_info * Add trivy's json plugin * Add command support for the wpscan plugin * [MOD] Now refs field is a list of dictionary with the format: {'name': string, 'type': string}, * Fix for acunetix_json when host is ip * [FIX] - Asset duplicated on same file with multiple entries for Appscan_csv plugin. * [FIX] Change import dateutil to from dateutil.parser import parse for compatibility issues with python 3.10 * [FIX] Add case for Netsparker plugins, when the url has a number inside a parenthesis. * Add *args **kwargs to syhunt plugin * fix bug when grype report has no arifact/metadata * [MOD] Now prowler plugin returns CAF Epic as policy violation and remove [check#] from tittle 1.6.8 [Jul 25th, 2022]: --- * Add appscan csv * Now faraday_csv's plugin uses ignore_info parameter * Add syhunt plugin * Add cve and data fields to desc for avoid duplications * Now nuclei resolve hostname if the field ip is None 1.6.7 [Jun 2nd, 2022]: --- * Change hostname_restolution to dont_resolve_hostname for process-report and now test dosent resovle hostname * Now QualysWebApp's plugin will diferenciate vulns from differents urlpaths 1.6.6 [May 20th, 2022]: --- * Add hostname_resolution parameter within plugins * Fix openvas external ID 1.6.5 [Apr 28th, 2022]: --- * Now Openvas's plugin set severity to Critical when cvss >= 9.0 1.6.4 [Apr 21th, 2022]: --- * Add location as params in burp's plugin * Now the faraday_csv custom_fields regex match any no whitespace character. 1.6.3 [Apr 19th, 2022]: --- * Add Zap Json plugin. 1.6.2 [Apr 4th, 2022]: --- * Now Appscan plugin saves line and highlight of the vulns in desc and data 1.6.1 [Mar 18th, 2022]: --- * Add references tu burp plugin * Move item.detail from data to desc * update open status 1.6.0 [Feb 3rd, 2022]: --- * Add packaging to requierments in setup.py * Add severity to shodan's plugins using cvss * check if cve exist on cve-id field * Fix Fortify's plugin * Change qualysguard's plugin severity_dict to refer level 2 severities as low 1.5.10 [Jan 13th, 2022]: --- * support cve,cwe,cvss and metadata 1.5.9 [Dec 27th, 2021]: --- * Add cve in faraday_csv plugin * ADD Grype plugin 1.5.8 [Dec 13th, 2021]: --- * Add CVE to plugins - acunetix - appscan - burp - metasploit - nessus - netsparker - nexpose - nikto - nipper - nmap - openscap - qualysguard - retina - shodan * Add support for Sslyze 5.0 resports * Fix errors while creating hosts with wrong regex * ADD masscan support to nmap plugin * Fix bug in openvas plugin 1.5.7 [Nov 19th, 2021]: --- * FIX extrainfo of netsparker plugin * Add nuclei_legacy plugin 1.5.6 [Nov 10th, 2021]: --- * FIX issue with acunetix plugin * FIX typo in nikto plugin 1.5.5 [Oct 21st, 2021]: --- * Merge PR from github 1.5.4 [Oct 19th, 2021]: --- * Update nuclei parser 1.5.3 [Sep 7th, 2021]: --- * Adding support for running nuclei through command / faraday-cli * Fix missing references in nuclei 1.5.2 [Aug 9th, 2021]: --- * add new structure acunetix 1.5.1 [Jul 27th, 2021]: --- * cwe, capec, references, tags, impact, resolution, easeofresolution * add os openvas * [FIX] Fix improt of CSV with big fields * Fix sslyze json bug with port * Only show report name in command data 1.5.0 [Jun 28th, 2021]: --- * Add Nipper Plugin * add shodan plugin * fix acunetix url parser * FIX netsparker multi-host * Add vuln details for Certificate Mismatch and move unique details to data, now vulns can be grupped * ADD more data to plugins arachni and w3af * Use run_date in UTC * ADD cvss_base, cpe, threat, severity into references 1.4.6 [May 14th, 2021]: --- * - add attribute "command" for the pluggins of each command - adding test in test_command - change some regex in self._command_regex * [FIX] add hostnames if host is already cached * Add Naabu plugin * Add Sonarqube plugin * Add version and change list_plugins style * FIX unused import, innecesary list compression and unused variables * FIX metasploit report when the web-site-id is null * Fix port stats in nmap * fixup ssylze sacar unknown de version= * ADD remedy into resolution * Support for nuclei 2.3.0 * ADD cve, cvss3_base_score, cvss3_vector, exploit_available when import nessus and change the structure of external_id to NESSUS-XXX * ADD more data like attack, params, uri, method, WASC, CWE and format externail_id 1.4.5 [Apr 15th, 2021]: --- * Add Bandit plugin * Use background for description and detail for data en Burp plugin. * Rewrite Appscan Plugin * Parse Nmap vulners script data 1.4.4 [Mar 30th, 2021]: --- * Faraday CSV Plugin do not consider ignore_info 1.4.3 [Mar 17th, 2021]: --- * Add Ignore information vulnerabilities option 1.4.2 [Mar 10th, 2021]: --- * Fix bug with sslyze output file * FIX change id sslyze for JSON/XML 1.4.1 [Feb 26th, 2021]: --- * ADD microsoft baseline security analyzer plugin * ADD nextnet plugin * ADD openscap plugin * FIX old versions of Nessus plugins bugs 1.4.0 [Dec 23rd, 2020]: --- * Update the fields of the nuclei output used to create a vuln 1.4.0b2 [Dec 15th, 2020]: --- * Fix nuclei plugin bug when url is None 1.4.0b1 [Dec 14th, 2020]: --- * Add new plugin base class, for multi line json * New ncrack plugin * New nuclei plugin * New sslyze json plugin * New WhatWeb plugin * Fix missing ip in some arachni reports * Fix change name vuln in Netsparker plugin * Fix whois plugin, command whois IP not parse data * Change the way we detect json reports when they are lists of dictionaries 1.3.0 [Sep 2nd, 2020]: --- * ADD plugin AppSpider * Add tests to faraday-plugins cli * add a default value to plugin_version * Add --output-file parameter to faraday-plugins process command * Add plugins prowler * Add plugins ssl labs * Add support for tenable io * delete old deprecated methods * Bug fix: Arachni Plugin 'NoneType' object has no attribute 'find' * Bug fix: Openvas Plugin - Import xml from OpenVas doesnt work * Bug fix: QualysWebApp Plugin, error in get info OPERATING_SYSTEM * Fix Hydra plugin to resolve ip address * Fix Nessus mod severity HIGH for Low * Bug Fix: Detect plugins AWS Prowler * Fix broken xml on nmap plugin * Add new rdpscan plugin * UPDATE xml report to appscan * Update Readme * Fix how ZAP genereate vulns faraday_plugins-1.26.0/default.nix000066400000000000000000000007251505357635700171400ustar00rootroot00000000000000with import {}; pkgs.python38Packages.buildPythonPackage rec { name = "env"; env = buildEnv { name = name; paths = buildInputs; }; buildInputs = [ (python38.buildEnv.override { ignoreCollisions = true; extraLibs = with python38Packages; [ requests click simplejson requests lxml html2text beautifulsoup4 pytz python-dateutil colorama ]; }) ]; } faraday_plugins-1.26.0/doc/000077500000000000000000000000001505357635700155355ustar00rootroot00000000000000faraday_plugins-1.26.0/doc/development.md000066400000000000000000000022631505357635700204040ustar00rootroot00000000000000## Write you own plugins > XML report plugin ```python class XXXPLugin(PluginXMLFormat): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) # Tags to be compared with the xml mail tag, can be a list or a string self.identifier_tag = ["tag1", "tag2"] self.id = 'SOME_PLUGIN_ID' # Can't be repeated self.name = 'Some plugin name' self.plugin_version = 'X.X' # The extension is optional, only if its different than xml self.extension = ".xxx" ``` > JSON report plugin ```python class XXXPLugin(PluginJsonFormat): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) # keys of the json that identify the report # you don't need to put all the keys, just some of them # it must be a set and will be compared as a subset of the json report keys self.json_keys = {"target_url", "effective_url", "interesting_findings"} self.id = 'SOME_PLUGIN_ID' # Can't be repeated self.name = 'Some plugin name' self.plugin_version = 'X.X' # The extension is optional, only if its different than json self.extension = ".xxx" ``` faraday_plugins-1.26.0/faraday_plugins/000077500000000000000000000000001505357635700201405ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/__init__.py000066400000000000000000000000301505357635700222420ustar00rootroot00000000000000__version__ = '1.26.0' faraday_plugins-1.26.0/faraday_plugins/__main__.py000066400000000000000000000001171505357635700222310ustar00rootroot00000000000000from faraday_plugins.commands import cli if __name__ == "__main__": cli() faraday_plugins-1.26.0/faraday_plugins/commands.py000066400000000000000000000242641505357635700223230ustar00rootroot00000000000000import getpass import io import json import logging import os import shlex import subprocess # nosec import sys from pathlib import Path import click from tabulate import tabulate from faraday_plugins import __version__ from faraday_plugins.plugins.manager import PluginsManager, ReportAnalyzer, CommandAnalyzer from faraday_plugins.plugins.plugin import PluginByExtension from faraday_plugins.plugins.plugins_utils import VulnerabilitySeverity root_logger = logging.getLogger("faraday") if not root_logger.handlers: PLUGIN_DEBUG = os.environ.get("PLUGIN_DEBUG", "0") if PLUGIN_DEBUG == "1": out_hdlr = logging.StreamHandler(sys.stdout) out_hdlr.setFormatter(logging.Formatter('%(asctime)s - %(name)s - %(levelname)s [%(filename)s:%(lineno)s - %(funcName)s()] %(message)s')) out_hdlr.setLevel(logging.DEBUG) root_logger.addHandler(out_hdlr) root_logger.setLevel(logging.DEBUG) CONTEXT_SETTINGS = dict(help_option_names=['-h', '--help']) @click.group(context_settings=CONTEXT_SETTINGS) @click.version_option(__version__, '-v', '--version') def cli(): pass @cli.command() @click.option('-cpf', '--custom-plugins-folder', type=str) def list_plugins(custom_plugins_folder): plugins_manager = PluginsManager(custom_plugins_folder) click.echo(click.style(f"Faraday Plugins v{__version__}", fg="cyan")) click.echo(click.style("Available Plugins :", fg="cyan")) loaded_plugins = 0 plugins_data = [] for plugin_id, plugin in plugins_manager.get_plugins(): console_enabled = plugin._command_regex is not None console_enabled_color = "green" if console_enabled else "red" console_enabled_text = click.style(f"{'Yes' if console_enabled else 'No'}", fg=console_enabled_color) report_enabled = isinstance(plugin, PluginByExtension) report_enabled_color = "green" if report_enabled else "red" report_enabled_text = click.style(f"{'Yes' if report_enabled else 'No'}", fg=report_enabled_color) plugins_data.append({"Name": plugin.name, "ID": plugin.id, "Command": console_enabled_text, "Report": report_enabled_text}) click.echo(tabulate( plugins_data, headers="keys", tablefmt="github", )) click.echo(click.style(f"Loaded Plugins: {len(plugins_data)}", fg="cyan")) @cli.command() @click.argument('report_file') @click.option('--plugin_id', type=str) @click.option('-cpf', '--custom-plugins-folder', type=str) @click.option('--summary', is_flag=True) @click.option('-o', '--output-file', type=click.Path(exists=False)) @click.option('--ignore-info', is_flag=True, help="Ignore information vulnerabilities") @click.option('-drh', '--dont-resolve-hostname', is_flag=True, help="Dont resolve hostname", default=False) @click.option('--vuln-tag', help="Vuln tag", default=None) @click.option('--service-tag', help="Service tag", default=None) @click.option('--host-tag', help="Host tag", default=None) @click.option('--summary-file', help="summary file to create", default=None, type=str) @click.option('--min-severity', help="Minimum severity to process the output", type=click.Choice([s.name for s in VulnerabilitySeverity], case_sensitive=False), default=None) @click.option('--max-severity', help="Maximum severity to process the output", type=click.Choice([s.name for s in VulnerabilitySeverity], case_sensitive=False), default=None) def process_report(report_file, plugin_id, custom_plugins_folder, summary, output_file, ignore_info, dont_resolve_hostname, vuln_tag, service_tag, host_tag, summary_file, min_severity, max_severity): if not os.path.isfile(report_file): click.echo(click.style(f"File {report_file} Don't Exists", fg="red"), err=True) else: plugins_manager = PluginsManager(custom_plugins_folder, ignore_info=ignore_info, hostname_resolution=not dont_resolve_hostname, vuln_tag=vuln_tag, service_tag=service_tag, host_tag=host_tag, min_severity=min_severity, max_severity=max_severity) analyzer = ReportAnalyzer(plugins_manager) if plugin_id: plugin = plugins_manager.get_plugin(plugin_id) if not plugin: click.echo(click.style(f"Invalid Plugin: {plugin_id}", fg="red"), err=True) return else: plugin = analyzer.get_plugin(report_file) if not plugin: click.echo(click.style(f"Failed to detect report: {report_file}", fg="red"), err=True) return plugin.processReport(Path(report_file), getpass.getuser()) if summary: if not summary_file: click.echo(json.dumps(plugin.get_summary(), indent=4)) else: with click.open_file(summary_file, "w") as f: click.echo(json.dumps(plugin.get_summary(), indent=4), file=f) else: if output_file: with open(output_file, "w") as f: json.dump(plugin.get_data(), f) else: click.echo(json.dumps(plugin.get_data(), indent=4)) @cli.command() @click.argument('command') @click.option('--plugin_id', type=str) @click.option('-cpf', '--custom-plugins-folder', type=str) @click.option('-dr', '--dont-run', is_flag=True) @click.option('--summary', is_flag=True) @click.option('-o', '--output-file', type=click.Path(exists=False)) @click.option('-sh', '--show-output', is_flag=True) @click.option('--ignore-info', is_flag=True, help="Ignore information vulnerabilities") @click.option('--hostname-resolution', is_flag=True, help="Resolve hostname") @click.option('--vuln-tag', help="Vuln tag", default=None) @click.option('--service-tag', help="Service tag", default=None) @click.option('--host-tag', help="Host tag", default=None) @click.option('--force', help="Process the output of the command regardless of the result", is_flag=True) @click.option('--min-severity', help="Minimum severity to process the output", type=click.Choice([s.name for s in VulnerabilitySeverity], case_sensitive=False), default=None) @click.option('--max-severity', help="Maximum severity to process the output", type=click.Choice([s.name for s in VulnerabilitySeverity], case_sensitive=False), default=None) def process_command(command, plugin_id, custom_plugins_folder, dont_run, summary, output_file, show_output, ignore_info, hostname_resolution, vuln_tag, service_tag, host_tag, force, min_severity, max_severity): plugins_manager = PluginsManager(custom_plugins_folder, ignore_info=ignore_info, hostname_resolution=hostname_resolution, vuln_tag=vuln_tag, service_tag=service_tag, host_tag=host_tag, min_severity=min_severity, max_severity=max_severity) analyzer = CommandAnalyzer(plugins_manager) if plugin_id: plugin = plugins_manager.get_plugin(plugin_id) if not plugin: click.echo(click.style(f"Invalid Plugin: {plugin_id}", fg="red"), err=True) return else: plugin = analyzer.get_plugin(command) if not plugin: click.echo(click.style(f"Failed to detect command: {command}", fg="red"), err=True) return current_path = os.path.abspath(os.getcwd()) modified_command = plugin.processCommandString(getpass.getuser(), current_path, command) if modified_command: command = modified_command if dont_run: color_message = click.style("Command: ", fg="green") click.echo(f"{color_message} {command}") else: p = subprocess.Popen(shlex.split(command), stdout=subprocess.PIPE, stderr=subprocess.PIPE) # nosec output = io.StringIO() while True: retcode = p.poll() line = p.stdout.readline().decode('utf-8') if show_output: sys.stdout.write(line) output.write(line) if retcode is not None: extra_lines = map(lambda x: x.decode('utf-8'), p.stdout.readlines()) if show_output: sys.stdout.writelines(line) output.writelines(extra_lines) break output_value = output.getvalue() if retcode == 0 or force: plugin.processOutput(output_value) if summary: click.echo(json.dumps(plugin.get_summary(), indent=4)) else: if output_file: with open(output_file, "w") as f: json.dump(plugin.get_data(), f) else: click.echo(json.dumps(plugin.get_data(), indent=4)) else: click.echo(click.style("Command execution error!!", fg="red"), err=True) @cli.command() @click.argument('report_file') @click.option('-cpf', '--custom-plugins-folder', type=str) def detect_report(report_file, custom_plugins_folder): if not os.path.isfile(report_file): click.echo(click.style(f"File {report_file} Don't Exists", fg="red")) else: plugins_manager = PluginsManager(custom_plugins_folder) analyzer = ReportAnalyzer(plugins_manager) plugin = analyzer.get_plugin(report_file) if plugin: click.echo(click.style(f"Faraday Plugin: {plugin.id}", fg="cyan")) else: click.echo(click.style(f"Failed to detect report: {report_file}", fg="red"), err=True) @cli.command() @click.argument('command') @click.option('-cpf', '--custom-plugins-folder', type=str) def detect_command(command, custom_plugins_folder): plugins_manager = PluginsManager(custom_plugins_folder) analyzer = CommandAnalyzer(plugins_manager) plugin = analyzer.get_plugin(command) if plugin: click.echo(click.style(f"Faraday Plugin: {plugin.id}", fg="cyan")) else: click.echo(click.style(f"Failed to detect command: {command}", fg="red"), err=True) faraday_plugins-1.26.0/faraday_plugins/plugins/000077500000000000000000000000001505357635700216215ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/__init__.py000066400000000000000000000000001505357635700237200ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/manager.py000066400000000000000000000250121505357635700236050ustar00rootroot00000000000000import csv import json import logging import os import pkgutil import re import sys import traceback import xml.etree.ElementTree as ET import zipfile from importlib import import_module from importlib.machinery import SourceFileLoader from io import StringIO from . import repo logger = logging.getLogger("faraday").getChild(__name__) class ReportAnalyzer: def __init__(self, plugin_manager): self.plugin_manager = plugin_manager def get_plugin(self, report_path): plugin = None if not os.path.isfile(report_path): logger.error("Report [%s] don't exists", report_path) return plugin else: file_name = os.path.basename(report_path) plugin = self._get_plugin_by_name(file_name) if not plugin: # Was unable to detect plugin from report file name logger.debug("Plugin by name not found") plugin = self._get_plugin_by_file_type(report_path) if not plugin: logger.debug("Plugin by file not found") if not plugin: logger.debug("Plugin for file (%s) not found", report_path) return plugin def _get_plugin_by_name(self, file_name_base): plugin_id = None plugin_name_regex = r".*_faraday_(?P.+)\..*$" match = re.match(plugin_name_regex, file_name_base) if match: plugin_id = match.groupdict()['plugin_name'].lower() logger.debug("Plugin name match: %s", plugin_id) plugin = self.plugin_manager.get_plugin(plugin_id) if plugin: logger.debug("Plugin by name Found: %s", plugin.id) return plugin else: logger.debug("Invalid plugin from file name: %s", plugin_id) return None else: logger.debug("Could not extract plugin_id from filename: %s", file_name_base) return plugin_id def _get_plugin_by_file_type(self, report_path): plugin = None file_name = os.path.basename(report_path) file_name_base, file_extension = os.path.splitext(file_name) file_extension = file_extension.lower() main_tag = None main_tag_attributes = {} file_csv_headers = set() file_json_keys = set() files_in_zip = set() logger.debug("Analyze report File") # Try to parse as xml try: report_file = open(report_path, "rb") except Exception as e: logger.error("Error reading report content [%s]", e) else: try: for event, elem in ET.iterparse(report_file, ('start',)): prefix, has_namespace, postfix = elem.tag.partition("}") if has_namespace: main_tag = postfix else: main_tag = elem.tag try: main_tag_attributes = elem.attrib except AttributeError: pass break logger.debug("Found XML content on file: %s - Main tag: %s Attributes: %s", report_path, main_tag, main_tag_attributes) except Exception as e: logger.debug("Non XML content [%s] - %s", report_path, e) try: report_file.seek(0) json_data = json.load(report_file) if isinstance(json_data, list): if len(json_data) > 0: file_json_keys = set(json_data[0].keys()) else: file_json_keys = set(json_data.keys()) logger.debug("Found JSON content on file: %s - Keys: %s", report_path, file_json_keys) except Exception as e: logger.debug("Non JSON content [%s] - %s", report_path, e) try: report_file.seek(0) reader_file_string = StringIO(report_file.read().decode('utf-8')) reader = csv.DictReader(reader_file_string) file_csv_headers = set(reader.fieldnames) logger.debug("Found CSV content on file: %s - Keys: %s", report_path, file_json_keys) except Exception as e: logger.debug("Non CSV content [%s] - %s", report_path, e) try: file_zip = zipfile.ZipFile(report_path, "r") files_in_zip = set(file_zip.namelist()) logger.debug("List of files found in ZIP %s", file_zip) except Exception as e: logger.debug("Non ZIP content [%s] - %s", report_path, e) finally: report_file.close() for _plugin_id, _plugin in self.plugin_manager.get_plugins(): logger.debug("Try plugin: %s", _plugin_id) try: if _plugin.report_belongs_to(main_tag=main_tag, main_tag_attributes=main_tag_attributes, report_path=report_path, extension=file_extension, file_json_keys=file_json_keys, file_csv_headers=file_csv_headers, files_in_zip=files_in_zip): plugin = _plugin logger.debug("Plugin by File Found: %s", plugin.id) break except Exception as e: logger.error("Error in plugin analysis: (%s) %s", _plugin_id, e) return plugin class CommandAnalyzer: def __init__(self, plugin_manager): self.plugin_manager = plugin_manager def get_plugin(self, command_string): plugin = None logger.debug("Look plugin for command: %s", command_string) for _plugin_id, _plugin in self.plugin_manager.get_plugins(): logger.debug("Try plugin: %s", _plugin_id) try: if _plugin.canParseCommandString(command_string): plugin = _plugin except Exception as e: logger.error("Error in plugin analysis: (%s) %s", _plugin_id, e) return plugin class PluginsManager: def __init__(self, custom_plugins_folder=None, **kwargs): self.kwargs = kwargs self.plugins = {} self.plugin_modules = {} self._load_plugins(custom_plugins_folder) def _load_plugins(self, custom_plugins_folder): logger.info("Loading Native Plugins...") if not self.plugins: for _, name, _ in filter(lambda x: x[2], pkgutil.iter_modules(repo.__path__)): try: plugin_module = import_module(f"faraday_plugins.plugins.repo.{name}.plugin") if hasattr(plugin_module, "createPlugin"): plugin_instance = plugin_module.createPlugin() plugin_id = plugin_instance.id.lower() if not plugin_instance.auto_load: logger.debug("Skip load plugin [%s]", plugin_id) continue if plugin_id not in self.plugin_modules: self.plugin_modules[plugin_id] = plugin_module logger.debug("Load Plugin [%s]", name) else: logger.debug("Plugin already loaded [%s]", plugin_id) else: logger.error("Invalid Plugin [%s]", name) except Exception as e: logger.error("Cant load plugin module: %s [%s]", name, e) if custom_plugins_folder: if os.path.isdir(custom_plugins_folder): logger.info("Loading Custom Plugins...") dir_name_regexp = re.compile(r"^[\d\w\-\_]+$") for name in os.listdir(custom_plugins_folder): if dir_name_regexp.match(name) and name != "__pycache__": module_path = os.path.join(custom_plugins_folder, name) module_filename = os.path.join(module_path, "plugin.py") try: sys.path.append(module_path) file_ext = os.path.splitext(module_filename)[1] if file_ext.lower() == '.py': if name not in self.plugin_modules: loader = SourceFileLoader(name, module_filename) plugin_module = loader.load_module() plugin_instance = plugin_module.createPlugin() plugin_id = plugin_instance.id.lower() if not plugin_instance.auto_load: logger.info("Skip load plugin [%s]", plugin_id) continue if plugin_id not in self.plugin_modules: self.plugin_modules[plugin_id] = plugin_module else: logger.debug("Plugin with same name already loaded [%s]", name) logger.debug("Load Plugin [%s]", name) except Exception as e: logger.debug("An error ocurred while loading plugin %s.\n%s", module_filename, traceback.format_exc()) logger.warning(e) else: logger.warning("Invalid custom plugins folder [%s]", custom_plugins_folder) logger.info("%s plugins loaded", len(self.plugin_modules)) def get_plugin(self, plugin_id): plugin = None plugin_id = plugin_id.lower() if plugin_id in self.plugin_modules: plugin = self.plugin_modules[plugin_id].createPlugin(**self.kwargs) else: logger.debug("Unknown Plugin: %s", plugin_id) return plugin def get_plugins(self): for plugin_id, plugin_module in self.plugin_modules.items(): logger.debug("Instance Plugin: %s", plugin_id) yield plugin_id, plugin_module.createPlugin(**self.kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/plugin.py000066400000000000000000001011151505357635700234700ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ # Standard library imports import hashlib import logging import os import re import shutil import tempfile import uuid import zipfile from collections import defaultdict from datetime import datetime from pathlib import Path import socket from typing import List # Related third party imports import pytz import simplejson as json # Local application imports from faraday_plugins.plugins.plugins_utils import its_cve, its_cwe, VulnerabilitySeverity logger = logging.getLogger("faraday").getChild(__name__) VALID_SERVICE_STATUS = ("open", "closed", "filtered") VULN_SKIP_FIELDS_TO_HASH = ['run_date'] class PluginBase: # TODO: Add class generic identifier class_signature = "PluginBase" def __init__(self, *args, **kwargs): # Must be unique. Check that there is not # an existent plugin with the same id. # TODO: Make script that list current ids. self.ignore_info = kwargs.get("ignore_info", False) self.min_severity = kwargs.get("min_severity", None) self.max_severity = kwargs.get("max_severity", None) self.hostname_resolution = kwargs.get("hostname_resolution", True) self.vuln_tag = kwargs.get("vuln_tag", None) self.host_tag = kwargs.get("host_tag", None) self.service_tag = kwargs.get("service_tag", None) self.default_vuln_tag = None self.id = None self.auto_load = True self._rid = id(self) self.version = None self.name = None self.description = "" self._command_regex = None self.command = None self._output_file_path = None self._use_temp_file = False self._delete_temp_file = False self._temp_file_extension = "tmp" self._current_path = None self.framework_version = None self._completition = {} self._new_elems = [] self._settings = {} self.command_id = None self._cache = {} self._hosts_cache = {} self._service_cache = {} self._vulns_cache = {} self.start_date = datetime.utcnow() self.logger = logger.getChild(self.__class__.__name__) self.open_options = {"mode": "r", "encoding": "utf-8"} self.plugin_version = "0.0" self.vulns_data = {"hosts": [], "command": {"tool": "", "command": "", "params": "", "user": "", "hostname": "", "start_date": self.start_date.isoformat(), "duration": 0, "import_source": "report"}} def __str__(self): return f"Plugin: {self.id}" def _get_temp_file(self, extension="tmp"): temp_dir = tempfile.gettempdir() temp_filename = f"{self.id}_{next(tempfile._get_candidate_names())}.{extension}" temp_file_path = os.path.join(temp_dir, temp_filename) return temp_file_path def resolve_hostname(self, hostname): if not self.hostname_resolution: return hostname if not hostname: self.logger.error(f"Hostname provided is None or Empty {hostname}, using 0.0.0.0 as ip") return "0.0.0.0" try: socket.inet_aton(hostname) # is already an ip return hostname except OSError: pass try: ip_address = socket.gethostbyname(hostname) except Exception as e: return hostname else: return ip_address @staticmethod def get_utctimestamp(date): if date is not None: try: utc_date = date.astimezone(pytz.UTC) return utc_date.timestamp() except Exception as e: logger.error(f"Error generating timestamp: {e}") return None else: return date @staticmethod def normalize_severity(severity): if severity is not None: severity = str(severity).lower() else: severity = "" def align_string_based_vulns(severity): severities = ['info', 'low', 'med', 'high', 'critical'] for sev in severities: if severity[0:3] in sev: return sev return severity severity = align_string_based_vulns(severity) # Transform numeric severity into desc severity numeric_severities = {"0": "info", "1": "low", "2": "med", "3": "high", "4": "critical"} if severity not in numeric_severities.values(): severity = numeric_severities.get(severity, 'unclassified') return severity # Caches def get_from_cache(self, cache_id): return self._cache.get(cache_id, None) def save_host_cache(self, host): cache_id = self.get_host_cache_id(host) if cache_id not in self._hosts_cache: obj_uuid = self.save_cache(host) self.vulns_data["hosts"].append(host) self._hosts_cache[cache_id] = obj_uuid else: obj_uuid = self._hosts_cache[cache_id] if host['hostnames']: chached_host = self.get_from_cache(obj_uuid) chached_host['hostnames'] = list(set(chached_host['hostnames'] + host['hostnames'])) return obj_uuid def save_service_cache(self, host_id, service): cache_id = self.get_host_service_cache_id(host_id, service) if cache_id not in self._service_cache: obj_uuid = self.save_cache(service) host = self.get_from_cache(host_id) host["services"].append(service) self._service_cache[cache_id] = obj_uuid else: obj_uuid = self._service_cache[cache_id] return obj_uuid def _should_ignore_check(self, vuln): # Ignore Info if self.ignore_info and vuln['severity'] == 'info': return True # Severity Range check if self.min_severity and VulnerabilitySeverity[vuln['severity'].upper()].value < VulnerabilitySeverity[self.min_severity.upper()].value: return True if self.max_severity and VulnerabilitySeverity[vuln['severity'].upper()].value > VulnerabilitySeverity[self.max_severity.upper()].value: return True return False def save_service_vuln_cache(self, host_id, service_id, vuln): if self._should_ignore_check(vuln): return None cache_id = self.get_service_vuln_cache_id(host_id, service_id, vuln) if cache_id not in self._vulns_cache: obj_uuid = self.save_cache(vuln) service = self.get_from_cache(service_id) service["vulnerabilities"].append(vuln) self._vulns_cache[cache_id] = obj_uuid else: obj_uuid = self._vulns_cache[cache_id] return obj_uuid def save_host_vuln_cache(self, host_id, vuln): if self._should_ignore_check(vuln): return None cache_id = self.get_host_vuln_cache_id(host_id, vuln) if cache_id not in self._vulns_cache: obj_uuid = self.save_cache(vuln) host = self.get_from_cache(host_id) host["vulnerabilities"].append(vuln) self._vulns_cache[cache_id] = obj_uuid else: obj_uuid = self._vulns_cache[cache_id] return obj_uuid @staticmethod def _get_dict_hash(d, keys): return hash(frozenset(map(lambda x: (x, d.get(x, None)), keys))) @classmethod def get_host_cache_id(cls, host): cache_id = cls._get_dict_hash(host, ['ip']) return cache_id @classmethod def get_host_service_cache_id(cls, host_id, service): service_copy = service.copy() service_copy.update({"host_cache_id": host_id}) cache_id = cls._get_dict_hash(service_copy, ['host_cache_id', 'protocol', 'port']) return cache_id @classmethod def get_service_vuln_cache_id(cls, host_id, service_id, vuln): vuln_copy = vuln.copy() vuln_copy.update({"host_cache_id": host_id, "service_cache_id": service_id}) cache_id = cls._get_dict_hash(vuln_copy, ['host_cache_id', 'service_cache_id', 'name', 'desc', 'website', 'path', 'pname', 'method']) return cache_id @classmethod def get_host_vuln_cache_id(cls, host_id, vuln): vuln_copy = vuln.copy() vuln_copy.update({"host_cache_id": host_id}) cache_id = cls._get_dict_hash(vuln_copy, ['host_cache_id', 'name', 'desc', 'website', 'path', 'pname', 'method']) return cache_id def save_cache(self, obj): obj_uuid = uuid.uuid1() self._cache[obj_uuid] = obj return obj_uuid def report_belongs_to(self, **kwargs): return False def has_custom_output(self): return bool(self._output_file_path) def get_custom_file_path(self): return self._output_file_path def set_actions_queue(self, _pending_actions): """ We use plugin controller queue to add actions created by plugins. Plugin controller will consume this actions. :param controller: plugin controller :return: None """ self._pending_actions = _pending_actions def setCommandID(self, command_id): self.command_id = command_id def getSettings(self): for param, (param_type, value) in self._settings.items(): yield param, value def get_ws(self): # TODO Borrar return "" def getSetting(self, name): setting_type, value = self._settings[name] return value def addSetting(self, param, param_type, value): self._settings[param] = param_type, value def updateSettings(self, new_settings): for name, value in new_settings.items(): if name in self._settings: setting_type, curr_value = self._settings[name] self._settings[name] = setting_type, setting_type(value) def canParseCommandString(self, current_input): """ This method can be overridden in the plugin implementation if a different kind of check is needed """ if (self._command_regex is not None and self._command_regex.match(current_input.strip()) is not None): self.command = self.get_command(current_input) return True def get_command(self, current_input: str) -> str: command = self._command_regex.findall(current_input)[0] if isinstance(command, tuple): return "".join(command).strip() return command.strip() def processCommandString(self, username, current_path, command_string): """ With this method a plugin can add additional arguments to the command that it's going to be executed. """ self._current_path = current_path if command_string.startswith(("sudo", "python", "python3")): params = " ".join(command_string.split()[2:]) else: params = " ".join(command_string.split()[1:]) self.vulns_data["command"]["params"] = params if not self.ignore_info else f"{params} (Info ignored)" self.vulns_data["command"]["user"] = username self.vulns_data["command"]["import_source"] = "shell" if self._use_temp_file: self._delete_temp_file = True self._output_file_path = self._get_temp_file(extension=self._temp_file_extension) return None def getCompletitionSuggestionsList(self, current_input): """ This method can be overridden in the plugin implementation if a different kind of check is needed """ words = current_input.split(" ") cword = words[len(words) - 1] options = {} for k, v in self._completition.items(): if re.search(str("^" + cword), k, flags=re.IGNORECASE): options[k] = v return options def processOutput(self, command_output): if self.has_custom_output(): self._parse_filename(Path(self.get_custom_file_path())) else: self.parseOutputString(command_output) def _parse_filename(self, filename: Path): with filename.open(**self.open_options) as output: self.parseOutputString(output.read()) if self._delete_temp_file: try: if filename.is_file(): os.remove(filename) elif filename.is_dir(): shutil.rmtree(filename) except Exception as e: self.logger.error(f"Error on delete file: ({filename}) [{e}]") def processReport(self, filepath: Path, user="faraday"): if isinstance(filepath, str): # TODO workaround for compatibility, remove in the future filepath = Path(filepath) if filepath.is_file(): self.vulns_data["command"]["params"] = filepath.name if not self.ignore_info else f"{filepath.name} (Info ignored)" self.vulns_data["command"]["user"] = user self.vulns_data["command"]["import_source"] = "report" self._parse_filename(filepath) else: raise FileNotFoundError(filepath) def parseOutputString(self, output): """ This method must be implemented. This method will be called when the command finished executing and the complete output will be received to work with it Using the output the plugin can create and add hosts, interfaces, services, etc. """ raise NotImplementedError('This method must be implemented.') def createAndAddHost(self, name, os="unknown", hostnames=None, mac=None, description="", tags=None): if not hostnames: hostnames = [] if not isinstance(hostnames, list): hostnames = [hostnames] # Some plugins sends a list with None, we filter empty and None values. hostnames = [hostname for hostname in hostnames if hostname] if os is None: os = "unknown" if tags is None: tags = [] if isinstance(tags, str): tags = [tags] if self.host_tag: if isinstance(self.host_tag, list): tags += self.host_tag else: tags.append(self.host_tag) host = {"ip": name, "os": os, "hostnames": hostnames, "description": description, "mac": mac, "credentials": [], "services": [], "vulnerabilities": [], "tags": tags} host_id = self.save_host_cache(host) return host_id def createAndAddServiceToHost(self, host_id, name, protocol="tcp", ports=None, status="open", version="", description="", tags=None): if ports: if isinstance(ports, list): ports = int(ports[0]) elif isinstance(ports, str): ports = int(ports) if not protocol: protocol = "tcp" if status not in VALID_SERVICE_STATUS: status = 'open' if tags is None: tags = [] if isinstance(tags, str): tags = [tags] if self.service_tag: if isinstance(self.service_tag, list): tags += self.service_tag else: tags.append(self.service_tag) service = {"name": name, "protocol": protocol, "port": ports, "status": status, "version": version, "description": description, "credentials": [], "vulnerabilities": [], "tags": tags} service_id = self.save_service_cache(host_id, service) return service_id @staticmethod def modify_refs_struct(ref: List[str]) -> List[dict]: """ Change reference struct from list of strings to a list of dicts with the form of {name, type} """ if not ref: return [] refs = [] for r in ref: if isinstance(r, dict): refs.append(r) else: if r.strip(): refs.append({'name': r.strip(), 'type': 'other'}) return refs def createAndAddVulnToHost(self, host_id, name, desc="", ref=None, severity="", resolution="", data="", external_id=None, run_date=None, impact=None, custom_fields=None, status="", policyviolations=None, easeofresolution=None, confirmed=False, tags=None, cve=None, cwe=None, cvss2=None, cvss3=None, cvss4=None): ref = self.modify_refs_struct(ref) if status == "": status = "open" if impact is None: impact = {} if policyviolations is None: policyviolations = [] if custom_fields is None: custom_fields = {} if tags is None: tags = [] if isinstance(tags, str): tags = [tags] if self.vuln_tag: if isinstance(self.vuln_tag, list): tags += self.vuln_tag else: tags.append(self.vuln_tag) if self.default_vuln_tag: if isinstance(self.default_vuln_tag, list): tags += self.default_vuln_tag else: tags.append(self.default_vuln_tag) if cve is None: cve = [] elif type(cve) is str: cve = [cve] cve = its_cve(cve) if cwe is None: cwe = [] elif type(cwe) is str: cwe = [cwe] cwe = its_cwe(cwe) if cvss2 is None: cvss2 = {} if cvss3 is None: cvss3 = {} if cvss4 is None: cvss4 = {} vulnerability = {"name": name, "desc": desc, "severity": self.normalize_severity(severity), "refs": ref, "external_id": external_id, "type": "Vulnerability", "resolution": resolution, "data": data, "custom_fields": custom_fields, "status": status, "impact": impact, "policyviolations": policyviolations, "cve": cve, "cvss3": cvss3, "cvss2": cvss2, "confirmed": confirmed, "easeofresolution": easeofresolution, "tags": tags, "cwe": cwe, "cvss4": cvss4 } if run_date: vulnerability["run_date"] = self.get_utctimestamp(run_date) vulnerability_id = self.save_host_vuln_cache(host_id, vulnerability) return vulnerability_id def createAndAddVulnToService(self, host_id, service_id, name, desc="", ref=None, severity="", resolution="", data="", external_id=None, run_date=None, custom_fields=None, policyviolations=None, impact=None, status="", confirmed=False, easeofresolution=None, tags=None, cve=None, cwe=None, cvss2=None, cvss3=None, cvss4=None): ref = self.modify_refs_struct(ref) if status == "": status = "open" if impact is None: impact = {} if policyviolations is None: policyviolations = [] if custom_fields is None: custom_fields = {} if tags is None: tags = [] if isinstance(tags, str): tags = [tags] if self.vuln_tag: if isinstance(self.vuln_tag, list): tags += self.vuln_tag else: tags.append(self.vuln_tag) if self.default_vuln_tag: if isinstance(self.default_vuln_tag, list): tags += self.default_vuln_tag else: tags.append(self.default_vuln_tag) if cve is None: cve = [] elif type(cve) is str: cve = [cve] cve = its_cve(cve) if cwe is None: cwe = [] elif type(cwe) is str: cwe = [cwe] cwe = its_cwe(cwe) if cvss2 is None: cvss2 = {} if cvss3 is None: cvss3 = {} if cvss4 is None: cvss4 = {} vulnerability = {"name": name, "desc": desc, "severity": self.normalize_severity(severity), "refs": ref, "external_id": external_id, "type": "Vulnerability", "resolution": resolution, "data": data, "custom_fields": custom_fields, "status": status, "impact": impact, "policyviolations": policyviolations, "cve": cve, "cvss3": cvss3, "cvss2": cvss2, "easeofresolution": easeofresolution, "confirmed": confirmed, "tags": tags, "cwe": cwe, "cvss4": cvss4 } if run_date: vulnerability["run_date"] = self.get_utctimestamp(run_date) vulnerability_id = self.save_service_vuln_cache(host_id, service_id, vulnerability) return vulnerability_id def createAndAddVulnWebToService(self, host_id, service_id, name, desc="", ref=None, severity="", resolution="", website="", path="", request="", response="", method="", pname="", params="", query="", category="", data="", external_id=None, confirmed=False, status="", easeofresolution=None, impact=None, policyviolations=None, status_code=None, custom_fields=None, run_date=None, tags=None, cve=None, cvss2=None, cvss3=None, cvss4=None, cwe=None): if params is None: params = "" if method is None: method = "" if pname is None: pname = "" if query is None: query = "" if website is None: website = "" if path is None: path = "" if request is None: request = "" if response is None: response = "" ref = self.modify_refs_struct(ref) if status == "": status = "open" if impact is None: impact = {} if policyviolations is None: policyviolations = [] if custom_fields is None: custom_fields = {} if tags is None: tags = [] if isinstance(tags, str): tags = [tags] if self.vuln_tag: if isinstance(self.vuln_tag, list): tags += self.vuln_tag else: tags.append(self.vuln_tag) if self.default_vuln_tag: if isinstance(self.default_vuln_tag, list): tags += self.default_vuln_tag else: tags.append(self.default_vuln_tag) if cve is None: cve = [] elif type(cve) is str: cve = [cve] cve = its_cve(cve) if cwe is None: cwe = [] elif type(cwe) is str: cwe = [cwe] cwe = its_cwe(cwe) if cvss2 is None: cvss2 = {} if cvss3 is None: cvss3 = {} if cvss4 is None: cvss4 = {} vulnerability = {"name": name, "desc": desc, "severity": self.normalize_severity(severity), "refs": ref, "external_id": external_id, "type": "VulnerabilityWeb", "resolution": resolution, "data": data, "website": website, "path": path, "request": request, "response": response, "method": method, "pname": pname, "params": params, "query": query, "category": category, "confirmed": confirmed, "status": status, "easeofresolution": easeofresolution, "impact": impact, "policyviolations": policyviolations, "cve": cve, "cvss3": cvss3, "cvss2": cvss2, "status_code": status_code, "custom_fields": custom_fields, "tags": tags, "cwe": cwe, "cvss4": cvss4} if run_date: vulnerability["run_date"] = self.get_utctimestamp(run_date) vulnerability_id = self.save_service_vuln_cache(host_id, service_id, vulnerability) return vulnerability_id def createAndAddNoteToHost(self, host_id, name, text): return None def createAndAddNoteToService(self, host_id, service_id, name, text): return None def createAndAddNoteToNote(self, host_id, service_id, note_id, name, text): return None def createAndAddCredToService(self, host_id, service_id, username, password): credential = {"name": "credential", "username": username, "password": password} service = self.get_from_cache(service_id) service["credentials"].append(credential) credential_id = self.save_cache(credential) return credential_id def get_data(self): self.vulns_data["command"]["tool"] = self.id self.vulns_data["command"]["command"] = self.command if self.command else self.id self.vulns_data["command"]["duration"] = (datetime.utcnow() - self.start_date).microseconds return self.vulns_data def get_json(self): self.logger.debug("Generate Json") return json.dumps(self.get_data()) def get_summary(self): plugin_json = self.get_data() summary = {'hosts': len(plugin_json['hosts']), 'services': 0, 'hosts_vulns': sum(list(map(lambda x: len(x['vulnerabilities']), plugin_json['hosts']))), 'services_vulns': 0, 'severity_vulns': defaultdict(int), 'vuln_hashes': [] } hosts_with_services = filter(lambda x: len(x['services']) > 0, plugin_json['hosts']) host_services = list(map(lambda x: x['services'], hosts_with_services)) summary['services'] = sum(map(lambda x: len(x), host_services)) services_vulns = 0 for host in plugin_json['hosts']: for vuln in host['vulnerabilities']: summary['severity_vulns'][vuln['severity']] += 1 for services in host_services: for service in services: services_vulns += len(service['vulnerabilities']) for vuln in service['vulnerabilities']: summary['severity_vulns'][vuln['severity']] += 1 summary['services_vulns'] = services_vulns for obj_uuid in self._vulns_cache.values(): vuln = self.get_from_cache(obj_uuid) vuln_copy = vuln.copy() for field in VULN_SKIP_FIELDS_TO_HASH: vuln_copy.pop(field, None) dict_hash = hashlib.sha1(json.dumps(vuln_copy).encode()).hexdigest() # nosec summary['vuln_hashes'].append(dict_hash) return summary # TODO Borrar class PluginTerminalOutput(PluginBase): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) def processOutput(self, term_output): try: self.parseOutputString(term_output) except Exception as e: self.logger.error(e) # TODO Borrar class PluginCustomOutput(PluginBase): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) def processOutput(self, term_output): # we discard the term_output since it's not necessary # for this type of plugins self.processReport(Path(self._output_file_path)) class PluginByExtension(PluginBase): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.extension = [] def report_belongs_to(self, extension="", **kwargs): match = False if isinstance(self.extension, str): match = (self.extension == extension) elif isinstance(self.extension, list): match = (extension in self.extension) self.logger.debug(f"Extension Match: [{extension} =/in {self.extension}] -> {match}") return match class PluginXMLFormat(PluginByExtension): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.identifier_tag = [] self.identifier_tag_attributes = {} self.extension = ".xml" self.open_options = {"mode": "rb"} def report_belongs_to(self, main_tag="", main_tag_attributes={}, **kwargs): match = False if super().report_belongs_to(**kwargs): if isinstance(self.identifier_tag, str): match = (main_tag == self.identifier_tag) elif isinstance(self.identifier_tag, list): match = (main_tag in self.identifier_tag) if self.identifier_tag_attributes: match = self.identifier_tag_attributes.issubset(main_tag_attributes) self.logger.debug(f"Tag Match: [{main_tag} =/in {self.identifier_tag}] -> {match}") return match class PluginJsonFormat(PluginByExtension): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.json_keys = set() self.filter_keys = set() self.extension = ".json" def report_belongs_to(self, file_json_keys=None, **kwargs): match = False if super().report_belongs_to(**kwargs): if file_json_keys is None: file_json_keys = set() if self.filter_keys & file_json_keys: return match if isinstance(self.json_keys, list): for jk in self.json_keys: match = jk.issubset(file_json_keys) self.logger.debug(f"Json Keys Match: [{file_json_keys} =/in {jk}] -> {match}") if match: break else: match = self.json_keys.issubset(file_json_keys) self.logger.debug(f"Json Keys Match: [{file_json_keys} =/in {self.json_keys}] -> {match}") return match class PluginMultiLineJsonFormat(PluginByExtension): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.json_keys = set() self.extension = ".json" def report_belongs_to(self, file_json_keys=None, **kwargs): match = False report_path = kwargs.get("report_path", "") if super().report_belongs_to(**kwargs): with open(report_path) as f: try: json_lines = list(map(lambda x: json.loads(x), f.readlines())) if len(json_lines) > 0: matched_lines = list(filter(lambda json_line: self.json_keys.issubset(json_line.keys()), json_lines)) match = len(matched_lines) == len(json_lines) self.logger.debug(f"Json Keys Match: [{json_lines[0].keys()} =/in {self.json_keys}] -> {match}") except ValueError: return False return match class PluginCSVFormat(PluginByExtension): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.extension = ".csv" self.csv_headers = set() def report_belongs_to(self, file_csv_headers=None, **kwargs): match = False if file_csv_headers is None: file_csv_headers = set() if super().report_belongs_to(**kwargs): if isinstance(self.csv_headers, list): match = bool(list(filter(lambda x: x.issubset(file_csv_headers), self.csv_headers))) else: match = self.csv_headers.issubset(file_csv_headers) self.logger.debug(f"CSV Headers Match: [{file_csv_headers} =/in {self.csv_headers}] -> {match}") return match class PluginZipFormat(PluginByExtension): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.extension = ".zip" self.files_list = set() def _parse_filename(self, filename): file = zipfile.ZipFile(filename, "r") self.parseOutputString(file) def report_belongs_to(self, files_in_zip=None, **kwargs): match = False if super().report_belongs_to(**kwargs): if files_in_zip is None: files_in_zip = set() match = bool(self.files_list & files_in_zip) self.logger.debug(f"Files List Match: [{files_in_zip} =/in {self.files_list}] -> {match}") return match faraday_plugins-1.26.0/faraday_plugins/plugins/plugins_utils.py000066400000000000000000000076151505357635700251050ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (https://www.faradaysec.com/) See the file 'doc/LICENSE' for the license information """ # Standard library imports import logging import os import re from urllib.parse import urlsplit from bs4 import BeautifulSoup from markdown import markdown from enum import Enum SERVICE_MAPPER = None CVE_regex = re.compile(r'CVE-\d{4}-\d{4,7}') CWE_regex = re.compile(r'CWE-\d{1,4}') logger = logging.getLogger(__name__) CVSS_RANGE = [(0.0, 0.1, 'info'), (0.1, 4.0, 'low'), (4.0, 7.0, 'med'), (7.0, 9.0, 'high'), (9.0, 10.1, 'critical')] class VulnerabilitySeverity(Enum): """ Enumeration for vulnerability severity levels. This Enum defines a set of standardized severity levels for vulnerabilities, ranging from unclassified to critical. Each level is associated with an integer value, facilitating comparison and ordering. Attributes: UNCLASSIFIED (int): Represents a vulnerability whose severity has not yet been determined. INFO (int): Represents a finding that does not pose a direct security risk but provides useful information. LOW (int): Represents a vulnerability with a low impact or difficulty to exploit. MED (int): Represents a vulnerability with a moderate impact and/or ease of exploitation. HIGH (int): Represents a vulnerability with a high impact and/or ease of exploitation. CRITICAL (int): Represents a vulnerability with a very high impact, often leading to severe consequences. """ UNCLASSIFIED = 0 INFO = 1 LOW = 2 MED = 3 HIGH = 4 CRITICAL = 5 def get_vulnweb_url_fields(url): """Given a URL, return kwargs to pass to createAndAddVulnWebToService.""" parse = urlsplit(url) return { "website": f"{parse.scheme}://{parse.netloc}", "path": parse.path, "query": parse.query } def filter_services(): global SERVICE_MAPPER if not SERVICE_MAPPER: logger.debug("Load service mappers") filename = os.path.join(os.path.dirname(__file__), "port_mapper.txt") with open(filename, encoding='utf-8') as fp: SERVICE_MAPPER = list(map(lambda x: x.strip().split('\t'), list(filter(len, fp.readlines())))) return SERVICE_MAPPER def get_all_protocols(): protocols = [ 'ip', 'tcp', 'udp', 'icmp', 'sctp', 'hopopt', 'igmp', 'ggp', 'ip-encap', 'st', 'egp', 'igp', 'pup', 'hmp', 'xns-idp', 'rdp', 'iso-tp4', 'dccp', 'xtp', 'ddp', 'idpr-cmtp', 'ipv6', 'ipv6-route', 'ipv6-frag', 'idrp', 'rsvp', 'gre', 'ipsec-esp', 'ipsec-ah', 'skip', 'ipv6-icmp', 'ipv6-nonxt', 'ipv6-opts', 'rspf cphb', 'vmtp', 'eigrp', 'ospfigp', 'ax.25', 'ipip', 'etherip', 'encap', 'pim', 'ipcomp', 'vrrp', 'l2tp', 'isis', 'fc', 'udplite', 'mpls-in-ip', 'hip', 'shim6', 'wesp', 'rohc', 'mobility-header' ] yield from protocols def get_severity_from_cvss(cvss): try: if not isinstance(cvss, float): cvss = float(cvss) for (lower, upper, severity) in CVSS_RANGE: if lower <= cvss < upper: return severity except ValueError: return 'unclassified' def its_cve(cves: list): r = [cve for cve in cves if CVE_regex.match(cve)] return r def its_cwe(cwes: list): r = [cwe for cwe in cwes if CWE_regex.match(cwe)] return r def markdown2text(text): html = markdown(text) text = ''.join(BeautifulSoup(html, features="lxml").findAll(text=True)) return text faraday_plugins-1.26.0/faraday_plugins/plugins/port_mapper.txt000066400000000000000000001250011505357635700247110ustar00rootroot000000000000001/tcp tcpmux 7/tcp echo 7/udp echo 9/tcp discard 9/udp discard 11/tcp systat 13/tcp daytime 13/udp daytime 15/tcp netstat 17/tcp qotd 18/tcp msp 18/udp msp 19/tcp chargen 19/udp chargen 20/tcp ftp-data 21/tcp ftp 21/udp fsp 22/tcp ssh 22/udp ssh 23/tcp telnet 25/tcp smtp 37/tcp time 37/udp time 39/udp rlp 42/tcp nameserver 43/tcp whois 49/tcp tacacs 49/udp tacacs 50/tcp re-mail-ck 50/udp re-mail-ck 53/tcp domain 53/udp domain 57/tcp mtp 65/tcp tacacs-ds 65/udp tacacs-ds 67/tcp bootps 67/udp bootps 68/tcp bootpc 68/udp bootpc 69/udp tftp 70/tcp gopher 70/udp gopher 77/tcp rje 79/tcp finger 80/tcp http 80/udp http 87/tcp link 88/tcp kerberos 88/udp kerberos 95/tcp supdup 101/tcp hostnames 102/tcp iso-tsap 104/tcp acr-nema 104/udp acr-nema 105/tcp csnet-ns 105/udp csnet-ns 107/tcp rtelnet 107/udp rtelnet 109/tcp pop2 109/udp pop2 110/tcp pop3 110/udp pop3 111/tcp sunrpc 111/udp sunrpc 113/tcp auth 115/tcp sftp 117/tcp uucp-path 119/tcp nntp 123/tcp ntp 123/udp ntp 129/tcp pwdgen 129/udp pwdgen 135/tcp loc-srv 135/udp loc-srv 137/tcp netbios-ns 137/udp netbios-ns 138/tcp netbios-dgm 138/udp netbios-dgm 139/tcp netbios-ssn 139/udp netbios-ssn 143/tcp imap2 143/udp imap2 161/tcp snmp 161/udp snmp 162/tcp snmp-trap 162/udp snmp-trap 163/tcp cmip-man 163/udp cmip-man 164/tcp cmip-agent 164/udp cmip-agent 174/tcp mailq 174/udp mailq 177/tcp xdmcp 177/udp xdmcp 178/tcp nextstep 178/udp nextstep 179/tcp bgp 179/udp bgp 191/tcp prospero 191/udp prospero 194/tcp irc 194/udp irc 199/tcp smux 199/udp smux 201/tcp at-rtmp 201/udp at-rtmp 202/tcp at-nbp 202/udp at-nbp 204/tcp at-echo 204/udp at-echo 206/tcp at-zis 206/udp at-zis 209/tcp qmtp 209/udp qmtp 210/tcp z3950 210/udp z3950 213/tcp ipx 213/udp ipx 220/tcp imap3 220/udp imap3 345/tcp pawserv 345/udp pawserv 346/tcp zserv 346/udp zserv 347/tcp fatserv 347/udp fatserv 369/tcp rpc2portmap 369/udp rpc2portmap 370/tcp codaauth2 370/udp codaauth2 371/tcp clearcase 371/udp clearcase 372/tcp ulistserv 372/udp ulistserv 389/tcp ldap 389/udp ldap 406/tcp imsp 406/udp imsp 427/tcp svrloc 427/udp svrloc 443/tcp https 443/udp https 444/tcp snpp 444/udp snpp 445/tcp microsoft-ds 445/udp microsoft-ds 464/tcp kpasswd 464/udp kpasswd 465/tcp urd 487/tcp saft 487/udp saft 500/tcp isakmp 500/udp isakmp 554/tcp rtsp 554/udp rtsp 607/tcp nqs 607/udp nqs 610/tcp npmp-local 610/udp npmp-local 611/tcp npmp-gui 611/udp npmp-gui 612/tcp hmmp-ind 612/udp hmmp-ind 623/udp asf-rmcp 628/tcp qmqp 628/udp qmqp 631/tcp ipp 631/udp ipp 512/tcp exec 512/udp biff 513/tcp login 513/udp who 514/tcp shell 514/udp syslog 515/tcp printer 517/udp talk 518/udp ntalk 520/udp route 525/udp timed 526/tcp tempo 530/tcp courier 531/tcp conference 532/tcp netnews 533/udp netwall 538/tcp gdomap 538/udp gdomap 540/tcp uucp 543/tcp klogin 544/tcp kshell 546/tcp dhcpv6-client 546/udp dhcpv6-client 547/tcp dhcpv6-server 547/udp dhcpv6-server 548/tcp afpovertcp 548/udp afpovertcp 549/tcp idfp 549/udp idfp 556/tcp remotefs 563/tcp nntps 563/udp nntps 587/tcp submission 587/udp submission 636/tcp ldaps 636/udp ldaps 655/tcp tinc 655/udp tinc 706/tcp silc 706/udp silc 749/tcp kerberos-adm 765/tcp webster 765/udp webster 873/tcp rsync 873/udp rsync 989/tcp ftps-data 990/tcp ftps 992/tcp telnets 992/udp telnets 993/tcp imaps 993/udp imaps 994/tcp ircs 994/udp ircs 995/tcp pop3s 995/udp pop3s 1080/tcp socks 1080/udp socks 1093/tcp proofd 1093/udp proofd 1094/tcp rootd 1094/udp rootd 1194/tcp openvpn 1194/udp openvpn 1099/tcp rmiregistry 1099/udp rmiregistry 1214/tcp kazaa 1214/udp kazaa 1241/tcp nessus 1241/udp nessus 1352/tcp lotusnote 1352/udp lotusnote 1433/tcp ms-sql-s 1433/udp ms-sql-s 1434/tcp ms-sql-m 1434/udp ms-sql-m 1524/tcp ingreslock 1524/udp ingreslock 1525/tcp prospero-np 1525/udp prospero-np 1645/tcp datametrics 1645/udp datametrics 1646/tcp sa-msg-port 1646/udp sa-msg-port 1649/tcp kermit 1649/udp kermit 1677/tcp groupwise 1677/udp groupwise 1701/tcp l2f 1701/udp l2f 1812/tcp radius 1812/udp radius 1813/tcp radius-acct 1813/udp radius-acct 1863/tcp msnp 1863/udp msnp 1957/tcp unix-status 1958/tcp log-server 1959/tcp remoteping 2000/tcp cisco-sccp 2000/udp cisco-sccp 2010/tcp search 2010/tcp pipe-server 2049/tcp nfs 2049/udp nfs 2086/tcp gnunet 2086/udp gnunet 2101/tcp rtcm-sc104 2101/udp rtcm-sc104 2119/tcp gsigatekeeper 2119/udp gsigatekeeper 2135/tcp gris 2135/udp gris 2401/tcp cvspserver 2401/udp cvspserver 2430/tcp venus 2430/udp venus 2431/tcp venus-se 2431/udp venus-se 2432/tcp codasrv 2432/udp codasrv 2433/tcp codasrv-se 2433/udp codasrv-se 2583/tcp mon 2583/udp mon 2628/tcp dict 2628/udp dict 2792/tcp f5-globalsite 2792/udp f5-globalsite 2811/tcp gsiftp 2811/udp gsiftp 2947/tcp gpsd 2947/udp gpsd 3050/tcp gds-db 3050/udp gds-db 3130/tcp icpv2 3130/udp icpv2 3260/tcp iscsi-target 3306/tcp mysql 3306/udp mysql 3493/tcp nut 3493/udp nut 3632/tcp distcc 3632/udp distcc 3689/tcp daap 3689/udp daap 3690/tcp svn 3690/udp svn 4031/tcp suucp 4031/udp suucp 4094/tcp sysrqd 4094/udp sysrqd 4190/tcp sieve 4369/tcp epmd 4369/udp epmd 4373/tcp remctl 4373/udp remctl 4353/tcp f5-iquery 4353/udp f5-iquery 4500/udp ipsec-nat-t 4569/tcp iax 4569/udp iax 4691/tcp mtn 4691/udp mtn 4899/tcp radmin-port 4899/udp radmin-port 5002/udp rfe 5002/tcp rfe 5050/tcp mmcc 5050/udp mmcc 5060/tcp sip 5060/udp sip 5061/tcp sip-tls 5061/udp sip-tls 5190/tcp aol 5190/udp aol 5222/tcp xmpp-client 5222/udp xmpp-client 5269/tcp xmpp-server 5269/udp xmpp-server 5308/tcp cfengine 5308/udp cfengine 5353/tcp mdns 5353/udp mdns 5432/tcp postgresql 5432/udp postgresql 5556/tcp freeciv 5556/udp freeciv 5671/tcp amqps 5672/tcp amqp 5672/udp amqp 5672/sctp amqp 5688/tcp ggz 5688/udp ggz 6000/tcp x11 6000/udp x11 6001/tcp x11-1 6001/udp x11-1 6002/tcp x11-2 6002/udp x11-2 6003/tcp x11-3 6003/udp x11-3 6004/tcp x11-4 6004/udp x11-4 6005/tcp x11-5 6005/udp x11-5 6006/tcp x11-6 6006/udp x11-6 6007/tcp x11-7 6007/udp x11-7 6346/tcp gnutella-svc 6346/udp gnutella-svc 6347/tcp gnutella-rtr 6347/udp gnutella-rtr 6444/tcp sge-qmaster 6444/udp sge-qmaster 6445/tcp sge-execd 6445/udp sge-execd 6446/tcp mysql-proxy 6446/udp mysql-proxy 7000/tcp afs3-fileserver 7000/udp afs3-fileserver 7001/tcp afs3-callback 7001/udp afs3-callback 7002/tcp afs3-prserver 7002/udp afs3-prserver 7003/tcp afs3-vlserver 7003/udp afs3-vlserver 7004/tcp afs3-kaserver 7004/udp afs3-kaserver 7005/tcp afs3-volser 7005/udp afs3-volser 7006/tcp afs3-errors 7006/udp afs3-errors 7007/tcp afs3-bos 7007/udp afs3-bos 7008/tcp afs3-update 7008/udp afs3-update 7009/tcp afs3-rmtsys 7009/udp afs3-rmtsys 7100/tcp font-service 7100/udp font-service 8080/tcp http-alt 8080/udp http-alt 9101/tcp bacula-dir 9101/udp bacula-dir 9102/tcp bacula-fd 9102/udp bacula-fd 9103/tcp bacula-sd 9103/udp bacula-sd 9667/tcp xmms2 9667/udp xmms2 10809/tcp nbd 10050/tcp zabbix-agent 10050/udp zabbix-agent 10051/tcp zabbix-trapper 10051/udp zabbix-trapper 10080/tcp amanda 10080/udp amanda 11112/tcp dicom 11371/tcp hkp 11371/udp hkp 13720/tcp bprd 13720/udp bprd 13721/tcp bpdbm 13721/udp bpdbm 13722/tcp bpjava-msvc 13722/udp bpjava-msvc 13724/tcp vnetd 13724/udp vnetd 13782/tcp bpcd 13782/udp bpcd 13783/tcp vopied 13783/udp vopied 17500/tcp db-lsp 22125/tcp dcap 22128/tcp gsidcap 22273/tcp wnn6 22273/udp wnn6 1/ddp rtmp 2/ddp nbp 4/ddp echo 6/ddp zip 750/udp kerberos4 750/tcp kerberos4 751/udp kerberos-master 751/tcp kerberos-master 752/udp passwd-server 754/tcp krb-prop 760/tcp krbupdate 901/tcp swat 1109/tcp kpop 2053/tcp knetd 2102/udp zephyr-srv 2103/udp zephyr-clt 2104/udp zephyr-hm 2105/tcp eklogin 2111/tcp kx 2121/tcp iprop 871/tcp supfilesrv 1127/tcp supfiledbg 98/tcp linuxconf 106/tcp poppassd 106/udp poppassd 775/tcp moira-db 777/tcp moira-update 779/udp moira-ureg 783/tcp spamd 808/tcp omirr 808/udp omirr 1001/tcp customs 1001/udp customs 1178/tcp skkserv 1210/udp predict 1236/tcp rmtcfg 1300/tcp wipld 1313/tcp xtel 1314/tcp xtelw 1529/tcp support 2003/tcp cfinger 2121/tcp frox 2150/tcp ninstall 2150/udp ninstall 2600/tcp zebrasrv 2601/tcp zebra 2602/tcp ripd 2603/tcp ripngd 2604/tcp ospfd 2605/tcp bgpd 2606/tcp ospf6d 2607/tcp ospfapi 2608/tcp isisd 2988/tcp afbackup 2988/udp afbackup 2989/tcp afmbackup 2989/udp afmbackup 4224/tcp xtell 4557/tcp fax 4559/tcp hylafax 4600/tcp distmp3 4949/tcp munin 5051/tcp enbd-cstatd 5052/tcp enbd-sstatd 5151/tcp pcrd 5354/tcp noclog 5354/udp noclog 5355/tcp hostmon 5355/udp hostmon 5555/udp rplay 5666/tcp nrpe 5667/tcp nsca 5674/tcp mrtd 5675/tcp bgpsim 5680/tcp canna 6514/tcp syslog-tls 6566/tcp sane-port 6667/tcp ircd 8021/tcp zope-ftp 8081/tcp tproxy 8088/tcp omniorb 8088/udp omniorb 8990/tcp clc-build-daemon 9098/tcp xinetd 9359/udp mandelspawn 9418/tcp git 9673/tcp zope 10000/tcp webmin 10081/tcp kamanda 10081/udp kamanda 10082/tcp amandaidx 10083/tcp amidxtape 11201/tcp smsqp 11201/udp smsqp 15345/tcp xpilot 15345/udp xpilot 17001/udp sgi-cmsd 17002/udp sgi-crsd 17003/udp sgi-gcd 17004/tcp sgi-cad 20011/tcp isdnlog 20011/udp isdnlog 20012/tcp vboxd 20012/udp vboxd 24554/tcp binkp 27374/tcp asp 27374/udp asp 30865/tcp csync2 57000/tcp dircproxy 60177/tcp tfido 60179/tcp fido 1027/udp Native IPv6 behind IPv4-to-IPv4 NAT Customer Premises Equipment (6a44) 1058/tcp nim, IBM AIX Network Installation Manager (NIM) 1058/udp nim, IBM AIX Network Installation Manager (NIM) 1059/tcp nimreg, IBM AIX Network Installation Manager (NIM) 1059/udp nimreg, IBM AIX Network Installation Manager (NIM) 1080/tcp SOCKS proxy 1080/udp SOCKS proxy 1085/tcp WebObjects 1085/udp WebObjects 1098/tcp rmiactivation, Java remote method invocation (RMI) activation 1098/udp rmiactivation, Java remote method invocation (RMI) activation 1099/tcp rmiregistry, Java remote method invocation (RMI) registry 1099/assigned rmiregistry, Java remote method invocation (RMI) registry 1119/tcp Battle.net chat/game protocol, used by Blizzard's games 1119/udp Battle.net chat/game protocol, used by Blizzard's games 1167/udp Cisco IP SLA (Service Assurance Agent) 1167/tcp Cisco IP SLA (Service Assurance Agent) 1194/udp OpenVPN 1194/tcp OpenVPN 1198/udp The cajo project Free dynamic transparent distributed computing in Java 1198/tcp The cajo project Free dynamic transparent distributed computing in Java 1214/udp Kazaa 1214/tcp Kazaa 1234/udp Infoseek search agent 1234/tcp Infoseek search agent 1241/udp Nessus Security Scanner 1241/tcp Nessus Security Scanner 1270/udp Microsoft System Center Operations Manager (SCOM) (formerly Microsoft Operations Manager (MOM)) agent 1270/tcp Microsoft System Center Operations Manager (SCOM) (formerly Microsoft Operations Manager (MOM)) agent 1293/udp Internet Protocol Security (IPSec) 1293/tcp Internet Protocol Security (IPSec) 1311/udp Windows RxMon.exe 1311/tcp Windows RxMon.exe 1341/udp Qubes (Manufacturing Execution System) 1341/tcp Qubes (Manufacturing Execution System) 1344/udp Internet Content Adaptation Protocol 1344/tcp Internet Content Adaptation Protocol 1352/udp IBM Lotus Notes/Domino (RPC) protocol 1352/tcp IBM Lotus Notes/Domino (RPC) protocol 1360/udp Mimer SQL 1360/tcp Mimer SQL 1414/udp IBM WebSphere MQ (formerly known as MQSeries) 1414/tcp IBM WebSphere MQ (formerly known as MQSeries) 1417/udp Timbuktu Service 1 Port 1417/tcp Timbuktu Service 1 Port 1418/udp Timbuktu Service 2 Port 1418/tcp Timbuktu Service 2 Port 1419/udp Timbuktu Service 3 Port 1419/tcp Timbuktu Service 3 Port 1420/udp Timbuktu Service 4 Port 1420/tcp Timbuktu Service 4 Port 1433/udp Microsoft SQL Server database management system (MSSQL) server 1433/tcp Microsoft SQL Server database management system (MSSQL) server 1434/udp Microsoft SQL Server database management system (MSSQL) monitor 1434/tcp Microsoft SQL Server database management system (MSSQL) monitor 1512/udp Microsoft's Windows Internet Name Service (WINS) 1512/tcp Microsoft's Windows Internet Name Service (WINS) 1521/udp nCUBE License Manager 1521/tcp nCUBE License Manager 1524/udp ingreslock, ingres 1524/tcp ingreslock, ingres 1527/udp Oracle Net Services, formerly known as SQL*Net 1527/tcp Oracle Net Services, formerly known as SQL*Net 1533/udp IBM Sametime Virtual Places Chat 1533/tcp IBM Sametime Virtual Places Chat 1547/udp Laplink 1547/tcp Laplink 1581/udp MIL STD 2045-47001 VMF 1581/tcp MIL STD 2045-47001 VMF 1589/udp Cisco VLAN Query Protocol (VQP) 1589/tcp Cisco VLAN Query Protocol (VQP) 1628/udp LonTalk normal 1628/tcp LonTalk normal 1629/udp LonTalk urgent 1629/tcp LonTalk urgent 1677/udp Novell GroupWise clients in client/server access mode 1677/tcp Novell GroupWise clients in client/server access mode 1701/udp Layer 2 Forwarding Protocol (L2F) 1701/tcp Layer 2 Forwarding Protocol (L2F) 1701/udp Layer 2 Tunneling Protocol (L2TP) 1701/assigned Layer 2 Tunneling Protocol (L2TP) 1707/udp Windward Studios games (vdmplay) 1707/tcp Windward Studios games (vdmplay) 1719/udp H.323 registration and alternate communication 1719/tcp H.323 registration and alternate communication 1720/udp H.323 call signaling 1720/tcp H.323 call signaling 1755/udp Microsoft Media Services (MMS, ms-streaming) 1755/tcp Microsoft Media Services (MMS, ms-streaming) 1801/udp Microsoft Message Queuing 1801/tcp Microsoft Message Queuing 1812/udp RADIUS authentication protocol, radius 1812/tcp RADIUS authentication protocol, radius 1813/udp RADIUS accounting protocol, radius-acct 1813/tcp RADIUS accounting protocol, radius-acct 1863/udp Microsoft Notification Protocol (MSNP), used by the Microsoft Messenger service and a number of instant messaging Messenger clients 1863/tcp Microsoft Notification Protocol (MSNP), used by the Microsoft Messenger service and a number of instant messaging Messenger clients 1883/udp MQTT (formerly MQ Telemetry Transport) 1883/tcp MQTT (formerly MQ Telemetry Transport) 1900/udp Simple Service Discovery Protocol (SSDP), discovery of UPnP devices 1900/assigned Simple Service Discovery Protocol (SSDP), discovery of UPnP devices 1935/udp Macromedia Flash Communications Server MX, the precursor to Adobe Flash Media Server before Macromedia's acquisition by Adobe on December 3, 2005 1935/tcp Macromedia Flash Communications Server MX, the precursor to Adobe Flash Media Server before Macromedia's acquisition by Adobe on December 3, 2005 1970/udp Netop Remote Control 1970/tcp Netop Remote Control 1972/udp InterSystems Cache 1972/tcp InterSystems Cache 1984/udp Big Brother 1984/tcp Big Brother 1985/udp Cisco Hot Standby Router Protocol (HSRP) 1985/assigned Cisco Hot Standby Router Protocol (HSRP) 1998/udp Cisco X.25 over TCP (XOT) service 1998/tcp Cisco X.25 over TCP (XOT) service 2000/udp Cisco Skinny Client Control Protocol (SCCP) 2000/tcp Cisco Skinny Client Control Protocol (SCCP) 2080/udp Autodesk NLM (FLEXlm) 2080/tcp Autodesk NLM (FLEXlm) 2083/udp Secure RADIUS Service (radsec) 2083/tcp Secure RADIUS Service (radsec) 2086/udp GNUnet 2086/tcp GNUnet 2102/udp Zephyr Notification Service server 2102/tcp Zephyr Notification Service server 2103/udp Zephyr Notification Service serv-hm connection 2103/tcp Zephyr Notification Service serv-hm connection 2104/udp Zephyr Notification Service hostmanager 2104/tcp Zephyr Notification Service hostmanager 2123/udp GTP control messages (GTP-C) 2123/tcp GTP control messages (GTP-C) 2142/udp TDMoIP (TDM over IP) 2142/tcp TDMoIP (TDM over IP) 2152/udp GTP user data messages (GTP-U) 2152/tcp GTP user data messages (GTP-U) 2159/udp GDB remote debug port 2159/tcp GDB remote debug port 2181/udp EForward-document transport system 2181/tcp EForward-document transport system 2210/udp NOAAPORT Broadcast Network 2210/tcp NOAAPORT Broadcast Network 2211/udp EMWIN 2211/tcp EMWIN 2222/udp EtherNet/IP implicit messaging for IO data 2222/tcp EtherNet/IP implicit messaging for IO data 2261/udp CoMotion master 2261/tcp CoMotion master 2262/udp CoMotion backup 2262/tcp CoMotion backup 2266/udp M-Files 2266/tcp M-Files 2399/udp FileMaker Data Access Layer (ODBC/JDBC) 2399/tcp FileMaker Data Access Layer (ODBC/JDBC) 2401/udp CVS version control system password-based server 2401/tcp CVS version control system password-based server 2404/udp IEC 60870-5-104, used to send electric power telecontrol messages between two systems via directly connected data circuits 2404/tcp IEC 60870-5-104, used to send electric power telecontrol messages between two systems via directly connected data circuits 2427/udp Media Gateway Control Protocol (MGCP) media gateway 2427/tcp Media Gateway Control Protocol (MGCP) media gateway 2447/udp ovwdb OpenView Network Node Manager (NNM) daemon 2447/tcp ovwdb OpenView Network Node Manager (NNM) daemon 2483/udp Oracle database listening for insecure client connections to the listener, replaces port 1521 2483/tcp Oracle database listening for insecure client connections to the listener, replaces port 1521 2484/udp Oracle database listening for SSL client connections to the listener 2484/tcp Oracle database listening for SSL client connections to the listener 2535/udp Multicast Address Dynamic Client Allocation Protocol (MADCAP). All standard messages are UDP datagrams. 2535/tcp Multicast Address Dynamic Client Allocation Protocol (MADCAP). All standard messages are UDP datagrams. 2541/udp LonTalk/IP 2541/tcp LonTalk/IP 2546/udp EVault data protection services 2546/tcp EVault data protection services 2547/udp EVault data protection services 2547/tcp EVault data protection services 2548/udp EVault data protection services 2548/tcp EVault data protection services 2638/udp SQL Anywhere database server 2638/tcp SQL Anywhere database server 2727/udp Media Gateway Control Protocol (MGCP) media gateway controller (call agent) 2727/tcp Media Gateway Control Protocol (MGCP) media gateway controller (call agent) 2809/udp corbaloc:iiop URL, per the CORBA 3.0.3 specification 2809/tcp corbaloc:iiop URL, per the CORBA 3.0.3 specification 2811/udp gsi ftp, per the GridFTP specification 2811/tcp gsi ftp, per the GridFTP specification 2944/udp Megaco text H.248 2944/tcp Megaco text H.248 2945/udp Megaco binary (ASN.1) H.248 2945/tcp Megaco binary (ASN.1) H.248 2947/udp gpsd, GPS daemon 2947/tcp gpsd, GPS daemon 2948/udp WAP push Multimedia Messaging Service (MMS) 2948/tcp WAP push Multimedia Messaging Service (MMS) 2949/udp WAP push secure (MMS) 2949/tcp WAP push secure (MMS) 2967/udp Symantec System Center agent (SSC-AGENT) 2967/tcp Symantec System Center agent (SSC-AGENT) 3020/udp Common Internet File System (CIFS). See also port 445 for Server Message Block (SMB), a dialect of CIFS. 3020/tcp Common Internet File System (CIFS). See also port 445 for Server Message Block (SMB), a dialect of CIFS. 3050/udp gds-db (Interbase/Firebird databases) 3050/tcp gds-db (Interbase/Firebird databases) 3052/udp APC PowerChute Network 3052/tcp APC PowerChute Network 3074/udp Xbox LIVE and Games for Windows Live 3074/tcp Xbox LIVE and Games for Windows Live 3225/udp Fibre Channel over IP (FCIP) 3225/tcp Fibre Channel over IP (FCIP) 3233/udp WhiskerControl research control protocol 3233/tcp WhiskerControl research control protocol 3260/udp iSCSI 3260/tcp iSCSI 3268/udp msft-gc, Microsoft Global Catalog (LDAP service which contains data from Active Directory forests) 3268/tcp msft-gc, Microsoft Global Catalog (LDAP service which contains data from Active Directory forests) 3269/udp msft-gc-ssl, Microsoft Global Catalog over SSL (similar to port 3268, LDAP over SSL) 3269/tcp msft-gc-ssl, Microsoft Global Catalog over SSL (similar to port 3268, LDAP over SSL) 3283/udp Net Assistant, a predecessor to Apple Remote Desktop 3283/tcp Net Assistant, a predecessor to Apple Remote Desktop 3305/udp Odette File Transfer Protocol (OFTP) 3305/tcp Odette File Transfer Protocol (OFTP) 3386/udp GTP' 3GPP GSM/UMTS CDR logging protocol 3386/tcp GTP' 3GPP GSM/UMTS CDR logging protocol 3389/udp Microsoft Terminal Server (RDP) officially registered as Windows Based Terminal (WBT) 3389/tcp Microsoft Terminal Server (RDP) officially registered as Windows Based Terminal (WBT) 3396/udp Novell NDPS Printer Agent 3396/tcp Novell NDPS Printer Agent 3412/udp xmlBlaster 3412/tcp xmlBlaster 3455/udp Resource Reservation Protocol (RSVP) 3455/tcp Resource Reservation Protocol (RSVP) 3478/udp STUN, a protocol for NAT traversal 3478/tcp STUN, a protocol for NAT traversal 3478/udp TURN, a protocol for NAT traversal (extension to STUN) 3478/tcp TURN, a protocol for NAT traversal (extension to STUN) 3478/udp STUN Behavior Discovery. See also port 5349. 3478/tcp STUN Behavior Discovery. See also port 5349. 3493/udp Network UPS Tools (NUT) 3493/tcp Network UPS Tools (NUT) 3516/udp Smartcard Port 3516/tcp Smartcard Port 3645/udp Cyc 3645/tcp Cyc 3659/udp Apple SASL, used by Mac OS X Server Password Server 3659/tcp Apple SASL, used by Mac OS X Server Password Server 3667/udp Information Exchange 3667/tcp Information Exchange 3690/udp Subversion (SVN) version control system 3690/tcp Subversion (SVN) version control system 3702/udp Web Services Dynamic Discovery (WS-Discovery), used by various components of Windows Vista and later 3702/tcp Web Services Dynamic Discovery (WS-Discovery), used by various components of Windows Vista and later 3724/udp Some Blizzard games 3724/tcp Some Blizzard games 3725/udp Netia NA-ER Port 3725/tcp Netia NA-ER Port 3768/udp RBLcheckd server daemon 3768/tcp RBLcheckd server daemon 3804/udp Harman Professional HiQnet protocol 3804/tcp Harman Professional HiQnet protocol 3826/udp WarMUX game server 3826/tcp WarMUX game server 3830/udp System Management Agent, developed and used by Cerner to monitor and manage solutions 3830/tcp System Management Agent, developed and used by Cerner to monitor and manage solutions 3880/udp IGRS 3880/tcp IGRS 3999/udp Norman distributed scanning service 3999/tcp Norman distributed scanning service 4018/udp Protocol information and warnings 4018/tcp Protocol information and warnings 4089/udp OpenCORE Remote Control Service 4089/tcp OpenCORE Remote Control Service 4090/udp Kerio 4090/tcp Kerio 4093/udp PxPlus Client server interface ProvideX 4093/tcp PxPlus Client server interface ProvideX 4096/udp Ascom Timeplex Bridge Relay Element (BRE) 4096/tcp Ascom Timeplex Bridge Relay Element (BRE) 4105/udp Shofar (ShofarNexus) 4105/tcp Shofar (ShofarNexus) 4116/udp Smartcard-TLS 4116/tcp Smartcard-TLS 4172/udp Teradici PCoIP 4172/tcp Teradici PCoIP 4303/udp Simple Railroad Command Protocol (SRCP) 4303/tcp Simple Railroad Command Protocol (SRCP) 4486/udp Integrated Client Message Service (ICMS) 4486/tcp Integrated Client Message Service (ICMS) 4500/udp IPSec NAT Traversal (RFC 3947, RFC 4306) 4500/assigned IPSec NAT Traversal (RFC 3947, RFC 4306) 4662/udp OrbitNet Message Service 4662/tcp OrbitNet Message Service 4730/udp Gearman's job server 4730/tcp Gearman's job server 4739/udp IP Flow Information Export 4739/tcp IP Flow Information Export 4753/udp SIMON (service and discovery) 4753/tcp SIMON (service and discovery) 4840/udp OPC UA Connection Protocol (TCP) and OPC UA Multicast Datagram Protocol (UDP) for OPC Unified Architecture from OPC Foundation 4840/tcp OPC UA Connection Protocol (TCP) and OPC UA Multicast Datagram Protocol (UDP) for OPC Unified Architecture from OPC Foundation 4843/udp OPC UA TCP Protocol over TLS/SSL for OPC Unified Architecture from OPC Foundation 4843/tcp OPC UA TCP Protocol over TLS/SSL for OPC Unified Architecture from OPC Foundation 4847/udp Web Fresh Communication, Quadrion Software & Odorless Entertainment 4847/tcp Web Fresh Communication, Quadrion Software & Odorless Entertainment 4894/udp LysKOM Protocol A 4894/tcp LysKOM Protocol A 4950/udp Cylon Controls UC32 Communications Port 4950/tcp Cylon Controls UC32 Communications Port 5010/udp Registered to: TelePath (the IBM FlowMark workflow-management system messaging platform). The TCP port is now used for: IBM WebSphere MQ Workflow 5010/tcp Registered to: TelePath (the IBM FlowMark workflow-management system messaging platform). The TCP port is now used for: IBM WebSphere MQ Workflow 5011/udp TelePath (the IBM FlowMark workflow-management system messaging platform) 5011/tcp TelePath (the IBM FlowMark workflow-management system messaging platform) 5025/udp scpi-raw Standard Commands for Programmable Instruments 5025/tcp scpi-raw Standard Commands for Programmable Instruments 5060/udp Session Initiation Protocol (SIP) 5060/tcp Session Initiation Protocol (SIP) 5062/udp Localisation access 5062/tcp Localisation access 5064/udp EPICS Channel Access server 5064/tcp EPICS Channel Access server 5065/udp EPICS Channel Access repeater beacon 5065/tcp EPICS Channel Access repeater beacon 5084/udp EPCglobal Low Level Reader Protocol (LLRP) 5084/tcp EPCglobal Low Level Reader Protocol (LLRP) 5085/udp EPCglobal Low Level Reader Protocol (LLRP) over TLS 5085/tcp EPCglobal Low Level Reader Protocol (LLRP) over TLS 5099/udp SafeNet, Inc Sentinel LM, Sentinel RMS, License Manager, server-to-server 5099/tcp SafeNet, Inc Sentinel LM, Sentinel RMS, License Manager, server-to-server 5150/udp ATMP Ascend Tunnel Management Protocol 5150/tcp ATMP Ascend Tunnel Management Protocol 5154/udp BZFlag 5154/tcp BZFlag 5190/udp AOL Instant Messenger protocol. The chat app is defunct as of 15 December 2017. 5190/tcp AOL Instant Messenger protocol. The chat app is defunct as of 15 December 2017. 5298/udp Extensible Messaging and Presence Protocol (XMPP) 5298/tcp Extensible Messaging and Presence Protocol (XMPP) 5310/udp Outlaws (1997 video game). Both UDP and TCP are reserved, but only UDP is used 5310/tcp Outlaws (1997 video game). Both UDP and TCP are reserved, but only UDP is used 5353/udp Multicast DNS (mDNS) 5353/assigned Multicast DNS (mDNS) 5355/udp Link-Local Multicast Name Resolution (LLMNR), allows hosts to perform name resolution for hosts on the same local link (only provided by Windows Vista and Server 2008) 5355/tcp Link-Local Multicast Name Resolution (LLMNR), allows hosts to perform name resolution for hosts on the same local link (only provided by Windows Vista and Server 2008) 5402/udp Multicast File Transfer Protocol (MFTP) 5402/tcp Multicast File Transfer Protocol (MFTP) 5405/udp NetSupport Manager 5405/tcp NetSupport Manager 5412/udp IBM Rational Synergy (Telelogic Synergy) (Continuus CM) Message Router 5412/tcp IBM Rational Synergy (Telelogic Synergy) (Continuus CM) Message Router 5413/udp Wonderware SuiteLink service 5413/tcp Wonderware SuiteLink service 5417/udp SNS Agent 5417/tcp SNS Agent 5421/udp NetSupport Manager 5421/tcp NetSupport Manager 5556/udp Freeciv, Oracle WebLogic Server Node Manager 5556/tcp Freeciv, Oracle WebLogic Server Node Manager 5568/udp Session Data Transport (SDT), a part of Architecture for Control Networks (ACN) 5568/tcp Session Data Transport (SDT), a part of Architecture for Control Networks (ACN) 5722/udp Microsoft RPC, DFSR (SYSVOL) Replication Service 5722/tcp Microsoft RPC, DFSR (SYSVOL) Replication Service 5741/udp IDA Discover Port 1 5741/tcp IDA Discover Port 1 5742/udp IDA Discover Port 2 5742/tcp IDA Discover Port 2 5900/udp Remote Frame Buffer protocol (RFB) 5900/tcp Remote Frame Buffer protocol (RFB) 5931/udp AMMYY admin Remote Control 5931/tcp AMMYY admin Remote Control 5984/udp CouchDB database server 5984/tcp CouchDB database server 6000/udp X11-used between an X client and server over the network 6000/tcp X11-used between an X client and server over the network 6001/udp X11-used between an X client and server over the network 6001/tcp X11-used between an X client and server over the network 6002/udp X11-used between an X client and server over the network 6002/tcp X11-used between an X client and server over the network 6003/udp X11-used between an X client and server over the network 6003/tcp X11-used between an X client and server over the network 6004/udp X11-used between an X client and server over the network 6004/tcp X11-used between an X client and server over the network 6005/udp X11-used between an X client and server over the network 6005/tcp X11-used between an X client and server over the network 6006/udp X11-used between an X client and server over the network 6006/tcp X11-used between an X client and server over the network 6007/udp X11-used between an X client and server over the network 6007/tcp X11-used between an X client and server over the network 6008/udp X11-used between an X client and server over the network 6008/tcp X11-used between an X client and server over the network 6009/udp X11-used between an X client and server over the network 6009/tcp X11-used between an X client and server over the network 6010/udp X11-used between an X client and server over the network 6010/tcp X11-used between an X client and server over the network 6011/udp X11-used between an X client and server over the network 6011/tcp X11-used between an X client and server over the network 6012/udp X11-used between an X client and server over the network 6012/tcp X11-used between an X client and server over the network 6013/udp X11-used between an X client and server over the network 6013/tcp X11-used between an X client and server over the network 6014/udp X11-used between an X client and server over the network 6014/tcp X11-used between an X client and server over the network 6015/udp X11-used between an X client and server over the network 6015/tcp X11-used between an X client and server over the network 6016/udp X11-used between an X client and server over the network 6016/tcp X11-used between an X client and server over the network 6017/udp X11-used between an X client and server over the network 6017/tcp X11-used between an X client and server over the network 6018/udp X11-used between an X client and server over the network 6018/tcp X11-used between an X client and server over the network 6019/udp X11-used between an X client and server over the network 6019/tcp X11-used between an X client and server over the network 6020/udp X11-used between an X client and server over the network 6020/tcp X11-used between an X client and server over the network 6021/udp X11-used between an X client and server over the network 6021/tcp X11-used between an X client and server over the network 6022/udp X11-used between an X client and server over the network 6022/tcp X11-used between an X client and server over the network 6023/udp X11-used between an X client and server over the network 6023/tcp X11-used between an X client and server over the network 6024/udp X11-used between an X client and server over the network 6024/tcp X11-used between an X client and server over the network 6025/udp X11-used between an X client and server over the network 6025/tcp X11-used between an X client and server over the network 6026/udp X11-used between an X client and server over the network 6026/tcp X11-used between an X client and server over the network 6027/udp X11-used between an X client and server over the network 6027/tcp X11-used between an X client and server over the network 6028/udp X11-used between an X client and server over the network 6028/tcp X11-used between an X client and server over the network 6029/udp X11-used between an X client and server over the network 6029/tcp X11-used between an X client and server over the network 6030/udp X11-used between an X client and server over the network 6030/tcp X11-used between an X client and server over the network 6031/udp X11-used between an X client and server over the network 6031/tcp X11-used between an X client and server over the network 6032/udp X11-used between an X client and server over the network 6032/tcp X11-used between an X client and server over the network 6033/udp X11-used between an X client and server over the network 6033/tcp X11-used between an X client and server over the network 6034/udp X11-used between an X client and server over the network 6034/tcp X11-used between an X client and server over the network 6035/udp X11-used between an X client and server over the network 6035/tcp X11-used between an X client and server over the network 6036/udp X11-used between an X client and server over the network 6036/tcp X11-used between an X client and server over the network 6037/udp X11-used between an X client and server over the network 6037/tcp X11-used between an X client and server over the network 6038/udp X11-used between an X client and server over the network 6038/tcp X11-used between an X client and server over the network 6039/udp X11-used between an X client and server over the network 6039/tcp X11-used between an X client and server over the network 6040/udp X11-used between an X client and server over the network 6040/tcp X11-used between an X client and server over the network 6041/udp X11-used between an X client and server over the network 6041/tcp X11-used between an X client and server over the network 6042/udp X11-used between an X client and server over the network 6042/tcp X11-used between an X client and server over the network 6043/udp X11-used between an X client and server over the network 6043/tcp X11-used between an X client and server over the network 6044/udp X11-used between an X client and server over the network 6044/tcp X11-used between an X client and server over the network 6045/udp X11-used between an X client and server over the network 6045/tcp X11-used between an X client and server over the network 6046/udp X11-used between an X client and server over the network 6046/tcp X11-used between an X client and server over the network 6047/udp X11-used between an X client and server over the network 6047/tcp X11-used between an X client and server over the network 6048/udp X11-used between an X client and server over the network 6048/tcp X11-used between an X client and server over the network 6049/udp X11-used between an X client and server over the network 6049/tcp X11-used between an X client and server over the network 6050/udp X11-used between an X client and server over the network 6050/tcp X11-used between an X client and server over the network 6051/udp X11-used between an X client and server over the network 6051/tcp X11-used between an X client and server over the network 6052/udp X11-used between an X client and server over the network 6052/tcp X11-used between an X client and server over the network 6053/udp X11-used between an X client and server over the network 6053/tcp X11-used between an X client and server over the network 6054/udp X11-used between an X client and server over the network 6054/tcp X11-used between an X client and server over the network 6055/udp X11-used between an X client and server over the network 6055/tcp X11-used between an X client and server over the network 6056/udp X11-used between an X client and server over the network 6056/tcp X11-used between an X client and server over the network 6057/udp X11-used between an X client and server over the network 6057/tcp X11-used between an X client and server over the network 6058/udp X11-used between an X client and server over the network 6058/tcp X11-used between an X client and server over the network 6059/udp X11-used between an X client and server over the network 6059/tcp X11-used between an X client and server over the network 6060/udp X11-used between an X client and server over the network 6060/tcp X11-used between an X client and server over the network 6061/udp X11-used between an X client and server over the network 6061/tcp X11-used between an X client and server over the network 6062/udp X11-used between an X client and server over the network 6062/tcp X11-used between an X client and server over the network 6063/udp X11-used between an X client and server over the network 6063/tcp X11-used between an X client and server over the network 6110/udp softcm, HP Softbench CM 6110/tcp softcm, HP Softbench CM 6111/udp spc, HP Softbench Sub-Process Control 6111/tcp spc, HP Softbench Sub-Process Control 6112/udp dtspcd, execute commands and launch applications remotely 6112/tcp dtspcd, execute commands and launch applications remotely 6346/udp gnutella-svc, gnutella (FrostWire, Limewire, Shareaza, etc.) 6346/tcp gnutella-svc, gnutella (FrostWire, Limewire, Shareaza, etc.) 6347/udp gnutella-rtr, Gnutella alternate 6347/tcp gnutella-rtr, Gnutella alternate 6350/udp App Discovery and Access Protocol 6350/tcp App Discovery and Access Protocol 6444/udp Sun Grid Engine Qmaster Service 6444/tcp Sun Grid Engine Qmaster Service 6445/udp Sun Grid Engine Execution Service 6445/tcp Sun Grid Engine Execution Service 6464/udp Port assignment for medical device communication in accordance to IEEE 11073-20701 6464/tcp Port assignment for medical device communication in accordance to IEEE 11073-20701 6515/udp Elipse RPC Protocol (REC) 6515/tcp Elipse RPC Protocol (REC) 6619/udp odette-ftps, Odette File Transfer Protocol (OFTP) over TLS/SSL 6619/tcp odette-ftps, Odette File Transfer Protocol (OFTP) over TLS/SSL 6622/udp Multicast FTP 6622/tcp Multicast FTP 6679/udp Osorno Automation Protocol (OSAUT) 6679/tcp Osorno Automation Protocol (OSAUT) 6888/udp MUSE 6888/tcp MUSE 6969/udp acmsoda 6969/tcp acmsoda 7262/udp CNAP (Calypso Network Access Protocol) 7262/tcp CNAP (Calypso Network Access Protocol) 7272/udp WatchMe - WatchMe Monitoring 7272/tcp WatchMe - WatchMe Monitoring 7400/udp RTPS (Real Time Publish Subscribe) DDS Discovery 7400/tcp RTPS (Real Time Publish Subscribe) DDS Discovery 7401/udp RTPS (Real Time Publish Subscribe) DDS User-Traffic 7401/tcp RTPS (Real Time Publish Subscribe) DDS User-Traffic 7402/udp RTPS (Real Time Publish Subscribe) DDS Meta-Traffic 7402/tcp RTPS (Real Time Publish Subscribe) DDS Meta-Traffic 7542/udp Saratoga file transfer protocol 7542/tcp Saratoga file transfer protocol 7547/udp CPE WAN Management Protocol (CWMP) Technical Report 069 7547/tcp CPE WAN Management Protocol (CWMP) Technical Report 069 7624/udp Instrument Neutral Distributed Interface 7624/tcp Instrument Neutral Distributed Interface 8008/udp Alternative port for HTTP. See also ports 80 and 8080. 8008/tcp Alternative port for HTTP. See also ports 80 and 8080. 8074/udp Gadu-Gadu 8074/tcp Gadu-Gadu 8080/udp Alternative port for HTTP. See also ports 80 and 8008. 8080/tcp Alternative port for HTTP. See also ports 80 and 8008. 8243/udp HTTPS listener for Apache Synapse 8243/tcp HTTPS listener for Apache Synapse 8280/udp HTTP listener for Apache Synapse 8280/tcp HTTP listener for Apache Synapse 8883/udp Secure MQTT (MQTT over TLS) 8883/tcp Secure MQTT (MQTT over TLS) 9001/udp ETL Service Manager 9001/tcp ETL Service Manager 9080/udp glrpc, Groove Collaboration software GLRPC 9080/tcp glrpc, Groove Collaboration software GLRPC 9101/udp Bacula Director 9101/tcp Bacula Director 9102/udp Bacula File Daemon 9102/tcp Bacula File Daemon 9103/udp Bacula Storage Daemon 9103/tcp Bacula Storage Daemon 9119/udp MXit Instant Messenger 9119/tcp MXit Instant Messenger 9389/udp adws, Microsoft AD DS Web Services, Powershell uses this port 9389/tcp adws, Microsoft AD DS Web Services, Powershell uses this port 9418/udp git, Git pack transfer service 9418/tcp git, Git pack transfer service 9535/udp mngsuite, LANDesk Management Suite Remote Control 9535/tcp mngsuite, LANDesk Management Suite Remote Control 9536/udp laes-bf, IP Fabrics Surveillance buffering function 9536/tcp laes-bf, IP Fabrics Surveillance buffering function 9800/udp WebDAV Source 9800/tcp WebDAV Source 10000/udp Network Data Management Protocol 10000/tcp Network Data Management Protocol 10050/udp Zabbix agent 10050/tcp Zabbix agent 10051/udp Zabbix trapper 10051/tcp Zabbix trapper 10110/udp NMEA 0183 Navigational Data. Transport of NMEA 0183 sentences over TCP or UDP 10110/tcp NMEA 0183 Navigational Data. Transport of NMEA 0183 sentences over TCP or UDP 11001/udp metasys ( Johnson Controls Metasys java AC control environment ) 11001/tcp metasys ( Johnson Controls Metasys java AC control environment ) 11112/udp ACR/NEMA Digital Imaging and Communications in Medicine (DICOM) 11112/tcp ACR/NEMA Digital Imaging and Communications in Medicine (DICOM) 11371/udp OpenPGP HTTP key server 11371/tcp OpenPGP HTTP key server 13720/udp Symantec NetBackup-bprd (formerly VERITAS) 13720/tcp Symantec NetBackup-bprd (formerly VERITAS) 13721/udp Symantec NetBackup-bpdbm (formerly VERITAS) 13721/tcp Symantec NetBackup-bpdbm (formerly VERITAS) 13724/udp Symantec Network Utility-vnetd (formerly VERITAS) 13724/tcp Symantec Network Utility-vnetd (formerly VERITAS) 13782/udp Symantec NetBackup-bpcd (formerly VERITAS) 13782/tcp Symantec NetBackup-bpcd (formerly VERITAS) 13783/udp Symantec VOPIED protocol (formerly VERITAS) 13783/tcp Symantec VOPIED protocol (formerly VERITAS) 13785/udp Symantec NetBackup Database-nbdb (formerly VERITAS) 13785/tcp Symantec NetBackup Database-nbdb (formerly VERITAS) 13786/udp Symantec nomdb (formerly VERITAS) 13786/tcp Symantec nomdb (formerly VERITAS) 15345/udp XPilot Contact 15345/tcp XPilot Contact 17500/udp Dropbox LanSync Protocol (db-lsp); used to synchronize file catalogs between Dropbox clients on a local network. 17500/tcp Dropbox LanSync Protocol (db-lsp); used to synchronize file catalogs between Dropbox clients on a local network. 19813/udp 4D database Client Server Communication 19813/tcp 4D database Client Server Communication 24465/udp Tonido Directory Server for Tonido which is a Personal Web App and P2P platform 24465/tcp Tonido Directory Server for Tonido which is a Personal Web App and P2P platform 24554/udp BINKP, Fidonet mail transfers over TCP/IP 24554/tcp BINKP, Fidonet mail transfers over TCP/IP 26000/udp id Software's Quake server 26000/tcp id Software's Quake server 27000/udp FlexNet Publisher's License server (from the range of default ports) 27000/tcp FlexNet Publisher's License server (from the range of default ports) 27001/udp FlexNet Publisher's License server (from the range of default ports) 27001/tcp FlexNet Publisher's License server (from the range of default ports) 27002/udp FlexNet Publisher's License server (from the range of default ports) 27002/tcp FlexNet Publisher's License server (from the range of default ports) 27003/udp FlexNet Publisher's License server (from the range of default ports) 27003/tcp FlexNet Publisher's License server (from the range of default ports) 27004/udp FlexNet Publisher's License server (from the range of default ports) 27004/tcp FlexNet Publisher's License server (from the range of default ports) 27005/udp FlexNet Publisher's License server (from the range of default ports) 27005/tcp FlexNet Publisher's License server (from the range of default ports) 27006/udp FlexNet Publisher's License server (from the range of default ports) 27006/tcp FlexNet Publisher's License server (from the range of default ports) 27007/udp FlexNet Publisher's License server (from the range of default ports) 27007/tcp FlexNet Publisher's License server (from the range of default ports) 27008/udp FlexNet Publisher's License server (from the range of default ports) 27008/tcp FlexNet Publisher's License server (from the range of default ports) 27009/udp FlexNet Publisher's License server (from the range of default ports) 27009/tcp FlexNet Publisher's License server (from the range of default ports) 33434/udp traceroute 33434/tcp traceroute 40000/udp SafetyNET p a real-time Industrial Ethernet protocol 40000/tcp SafetyNET p a real-time Industrial Ethernet protocol 44818/udp EtherNet/IP explicit messaging 44818/tcp EtherNet/IP explicit messaging 47808/udp BACnet Building Automation and Control Networks (4780810 = BAC016) 47808/tcp BACnet Building Automation and Control Networks (4780810 = BAC016) 49151/udp Reserved 49151/tcp Reserved faraday_plugins-1.26.0/faraday_plugins/plugins/repo/000077500000000000000000000000001505357635700225665ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/__init__.py000066400000000000000000000002341505357635700246760ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2019 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix/000077500000000000000000000000001505357635700244065ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix/DTO.py000066400000000000000000000171471505357635700254200ustar00rootroot00000000000000from typing import List import re class Technicaldetails: def __init__(self, node): self.node = node @property def request(self) -> str: if self.node in ('', None): return '' return self.node.findtext('Request', '') @property def response(self) -> str: if self.node in ('', None): return '' return self.node.findtext('Response', '') class Cve: def __init__(self, node): self.node = node @property def text(self) -> str: if self.node in ('', None): return '' return self.node.text class CVEList: def __init__(self, node): self.node = node @property def cve(self) -> Cve: if self.node is None: return '' return Cve(self.node.find('CVE')) class Cwe: def __init__(self, node): self.node = node @property def id_attr(self) -> str: return self.node.attrib.get('id', '') @property def text(self) -> str: return self.node.text class Cwelist: def __init__(self, node): self.node = node @property def cwe(self) -> Cwe: return Cwe(self.node.find('CWE')) class Cvss: def __init__(self, node): self.node = node @property def descriptor(self) -> str: return self.node.findtext('Descriptor', '') @property def score(self) -> str: if self.node is None: return '' return self.node.findtext('Score') @property def av(self) -> str: return self.node.findtext('AV', '') @property def ac(self) -> str: return self.node.findtext('AC', '') @property def au(self) -> str: return self.node.findtext('Au', '') @property def c(self) -> str: return self.node.findtext('C', '') @property def i(self) -> str: return self.node.findtext('I', '') @property def a(self) -> str: return self.node.findtext('A', '') @property def e(self): return self.node.find('E') @property def rl(self): return self.node.find('RL') @property def rc(self): return self.node.find('RC') class Cvss3: def __init__(self, node): self.node = node @property def descriptor(self) -> str: return self.node.findtext('Descriptor', '') @property def score(self) -> str: return self.node.findtext('Score') @property def tempscore(self): return self.node.find('TempScore') @property def envscore(self): return self.node.find('EnvScore') @property def av(self) -> str: return self.node.find('AV', '') @property def ac(self) -> str: return self.node.find('AC', '') @property def pr(self) -> str: return self.node.find('PR', '') @property def ui(self) -> str: return self.node.find('UI', '') @property def s(self) -> str: return self.node.find('S', '') @property def c(self) -> str: return self.node.find('C', '') @property def i(self) -> str: return self.node.findtext('I', '') @property def a(self) -> str: return self.node.findtext('A', '') @property def e(self): return self.node.find('E') @property def rl(self): return self.node.find('RL') @property def rc(self): return self.node.find('RC') class Reference: def __init__(self, node): self.node = node @property def database(self) -> str: return self.node.findtext('Database', '') @property def url(self) -> str: return self.node.findtext('URL', '') class References: def __init__(self, node): self.node = node @property def reference(self) -> List[Reference]: return [Reference(i) for i in self.node.findall('Reference', [])] class Reportitem: def __init__(self, node): self.node = node @property def id_attr(self) -> str: return self.node.findtext('id', '') @property def color_attr(self) -> str: return self.node.findtext('color', '') @property def name(self) -> str: return self.node.findtext('Name', '') @property def modulename(self) -> str: return self.node.findtext('ModuleName', '') @property def details(self) -> str: return self.node.findtext('Details', '') @property def affects(self) -> str: return self.node.findtext('Affects', '') @property def parameter(self) -> str: return self.node.findtext('Parameter') @property def aop_sourcefile(self): return self.node.find('AOP_SourceFile') @property def aop_sourceline(self): return self.node.find('AOP_SourceLine') @property def aop_additional(self): return self.node.find('AOP_Additional') @property def isfalsepositive(self): return self.node.find('IsFalsePositive') @property def severity(self) -> str: return self.node.findtext('Severity', '') @property def type(self) -> str: return self.node.findtext('Type', '') @property def impact(self) -> str: return self.node.findtext('Impact', '') @property def description(self) -> str: return self.node.findtext('Description', '') @property def recommendation(self) -> str: return self.node.findtext('Recommendation', '') @property def technicaldetails(self) -> Technicaldetails: return Technicaldetails(self.node.find('TechnicalDetails')) @property def cwelist(self) -> Cwelist: return Cwelist(self.node.find('CWEList')) @property def cvelist(self): return CVEList(self.node.find('CVEList')) @property def cvss(self) -> Cvss: cvss = self.node.find('CVSS') if not cvss: cvss = self.node.find('cvss') return Cvss(cvss) @property def cvss3(self) -> Cvss3: cvss = self.node.find('CVSS3') if not cvss: cvss = self.node.find('cvss3') return Cvss3(cvss) @property def references(self) -> References: return References(self.node.find('References')) class Reportitems: def __init__(self, node): self.node = node @property def reportitem(self) -> List[Reportitem]: return [Reportitem(i) for i in self.node.findall('ReportItem', [])] class Crawler: def __init__(self, node): self.node = node @property def start_url_attr(self) -> str: return self.node.get('StartUrl', '') class Scan: def __init__(self, node): self.node = node @property def reportitems(self) -> Reportitems: return Reportitems(self.node.find('ReportItems')) @property def start_url(self) -> str: return self.node.findtext("StartURL", "") @property def crawler(self) -> Crawler: return Crawler(self.node.find('Crawler')) @property def os(self) -> str: if not self.node.findtext("Os", "unknown"): return "unknown" return self.node.findtext("Os", "unknown") @property def banner(self) -> str: if not self.node.findtext('Banner'): return None return self.node.findtext("Banner") @property def start_url_new(self) -> str: return self.node.findtext("", "") class Acunetix: def __init__(self, node): self.node = node @property def exportedon_attr(self) -> str: return self.node.get('ExportedOn') @property def scan(self) -> List[Scan]: return [Scan(i) for i in self.node.findall('Scan', [])] faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix/__init__.py000066400000000000000000000002351505357635700265170ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix/plugin.py000066400000000000000000000137231505357635700262640ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from re import findall from urllib.parse import urlsplit from lxml import etree from faraday_plugins.plugins.plugin import PluginXMLFormat from faraday_plugins.plugins.repo.acunetix.DTO import Acunetix, Scan __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class AcunetixXmlParser: """ The objective of this class is to parse an xml file generated by the acunetix tool. TODO: Handle errors. TODO: Test acunetix output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param acunetix_xml_filepath A proper xml generated by acunetix """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) self.acunetix = Acunetix(tree) @staticmethod def parse_xml(xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: parser = etree.XMLParser(recover=True) tree = etree.fromstring(xml_output, parser=parser) except SyntaxError as err: print(f"SyntaxError: {err}. {xml_output}") return None return tree class AcunetixPlugin(PluginXMLFormat): """ Example plugin to parse acunetix output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "ScanGroup" self.id = "Acunetix" self.name = "Acunetix XML Output Plugin" self.plugin_version = "0.0.1" self.version = "9" self.framework_version = "1.0.0" self.options = None self._current_output = None self.target = None def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ parser = AcunetixXmlParser(output) for site in parser.acunetix.scan: url_data = self.get_domain(site) if not url_data: continue if url_data.hostname: self.old_structure(url_data, site) else: self.new_structure(site) def new_structure(self, site): for item in site.reportitems.reportitem: if not item.technicaldetails.request: self.logger.warning("No request data") continue request_host = findall('Host: (.*)', item.technicaldetails.request) if request_host: host = request_host[0] url = f'http://{host}' url_data = urlsplit(url) site_ip = self.resolve_hostname(host) h_id = self.createAndAddHost(site_ip, site.os, hostnames=[host]) s_id = self.createAndAddServiceToHost( h_id, "http", "tcp", ports=['443'], version=site.banner, status='open') self.create_vul(item, h_id, s_id, url_data) else: self.logger.warning("No host in request") def old_structure(self, url_data, site: Scan): site_ip = self.resolve_hostname(url_data.hostname) if url_data.hostname: hostnames = [url_data.hostname] else: hostnames = None port = url_data.port or (443 if url_data.scheme == "https" else 80) h_id = self.createAndAddHost(site_ip, site.os, hostnames=hostnames) s_id = self.createAndAddServiceToHost( h_id, "http", "tcp", ports=[port], version=site.banner, status='open') for item in site.reportitems.reportitem: self.create_vul(item, h_id, s_id, url_data) def create_vul(self, item, h_id, s_id, url_data): description = item.description cvss3 = {} if item.cvss3.node is not None: cvss3['vector_string'] = item.cvss3.descriptor cvss2 = {} if item.cvss.node is not None: cvss2['vector_string'] = item.cvss.descriptor if item.affects: description += f'\nPath: {item.affects}' if item.parameter: description += f'\nParameter: {item.parameter}' try: cve = [item.cvelist.cve.text if item.cvelist.cve else ""] except Exception: cve = [] try: cwe = [item.cwelist.cwe.text if item.cwelist.cwe else ""] except: cwe = [] self.createAndAddVulnWebToService( h_id, s_id, item.name, description, website=url_data.hostname, severity=item.severity, resolution=item.recommendation, path=item.affects, params=item.parameter, request=item.technicaldetails.request, response=item.technicaldetails.response, ref=[i.url for i in item.references.reference], cve=cve, cwe=cwe, cvss2=cvss2, cvss3=cvss3) @staticmethod def get_domain(scan: Scan): url = scan.start_url if not url.startswith('http'): url = f'http://{url}' url_data = urlsplit(url) if not url_data.scheme: url_data = urlsplit(scan.crawler.start_url_attr) return url_data def createPlugin(*args, **kwargs): return AcunetixPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix360/000077500000000000000000000000001505357635700246375ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix360/DTO.py000066400000000000000000000114421505357635700256410ustar00rootroot00000000000000from typing import List import re import bs4 CLEAN = re.compile("<.*?>") def clean_external_references(external_ref) -> List[str]: data = bs4.BeautifulSoup(external_ref).find_all("a") refs = [] for i in data: refs.append(i.get("href")) return refs class Classification: def __init__(self, node): self.node = node @property def iso(self) -> str: iso = self.node.get('Iso27001', "") if iso: return "Iso27001-" + iso else: return "" @property def capec(self) -> str: capec = self.node.get('Capec', "") if capec: return "Capec-" + capec else: return "" @property def cvss(self) -> str: if self.node.get('Cvss'): return self.node.get('Cvss').get("Vector", "") return "" @property def cvss31(self) -> str: if self.node.get('Cvss31'): return self.node.get('Cvss31').get("Vector", "") return "" @property def cwe(self) -> str: cwe = self.node.get('Cwe', "") if cwe: return "CWE-" + cwe else: return "" @property def hipaa(self) -> str: hippa = self.node.get('Hipaa', "") if hippa: return "Hipaa-" + hippa else: return "" @property def owasp(self) -> str: owasp = self.node.get('Owasp', "") if owasp: return "Owasp-" + owasp else: return "" @property def pci(self) -> str: pci = self.node.get('Pci32', "") if pci: return "Pci32-" + pci else: return "" @property def wasc(self) -> str: wasc = self.node.get('Wasc', "") if wasc: return "Wasc-" + wasc else: return "" @property def asvs(self) -> str: asvs = self.node.get('Asvs40', "") if asvs: return "Asvs40-" + asvs else: return "" @property def nistsp(self) -> str: nistsp = self.node.get('Nistsp80053', "") if nistsp: return "Nistsp80053-" + nistsp else: return "" @property def disastig(self) -> str: disastig = self.node.get('DisaStig', "") if disastig: return "DisaStig-" + disastig else: return "" class Request: def __init__(self, node): self.node = node @property def method(self) -> str: return self.node.get("Method", "") @property def content(self) -> str: return self.node.get("Content", "") class Vulnerability: def __init__(self, node): self.node = node @property def name(self) -> str: return self.node.get('Name', "") @property def confirmed(self) -> bool: return self.node.get('Confirmed', False) @property def description(self) -> str: return CLEAN.sub("", self.node.get('Description', "The tool did not provide a description")) @property def remedial_procedure(self) -> str: return CLEAN.sub("", self.node.get("RemedialProcedure","")) @property def severity(self) -> str: return self.node.get('Severity', "unclassified") @property def impact(self) -> str: return CLEAN.sub("", self.node.get('Impact', "")) @property def tags(self) -> List[str]: return self.node.get("Tags", []) @property def classification(self) -> Classification: return Classification(self.node.get("Classification", {})) @property def external_id(self) -> str: return self.node.get("LookupId", "") @property def remedial_actions(self) -> str: return CLEAN.sub("", self.node.get('RemedialActions', "")) @property def proof_of_concept(self) -> str: return CLEAN.sub("", self.node.get('ProofOfConcept', "")) @property def external_references(self) -> List[str]: return clean_external_references(self.node.get('ExternalReferences', "")) @property def request(self) -> Request: return Request(self.node.get('Request', {})) @property def response(self) -> str: return self.node.get('Response', {}).get("Content", "") @property def url(self) -> str: return self.node.get('Url', "") class Target: def __init__(self, node): self.node = node @property def url(self) -> str: return self.node.get('Url', "") class Acunetix360JsonParser: def __init__(self, node): self.node = node @property def target(self) -> Target: return Target(self.node.get('Target', {})) @property def vulnerabilities(self) -> List[Vulnerability]: return [Vulnerability(vuln) for vuln in self.node.get('Vulnerabilities', [])] faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix360/__init__.py000066400000000000000000000000001505357635700267360ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix360/plugin.py000066400000000000000000000066371505357635700265230ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from urllib.parse import urlsplit import ipaddress from lxml import etree from faraday_plugins.plugins.plugin import PluginJsonFormat from faraday_plugins.plugins.repo.acunetix.DTO import Acunetix, Scan from json import loads __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Gonzalo Martinez"] __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmartinez@infobytesec.com" __status__ = "Development" from faraday_plugins.plugins.repo.acunetix360.DTO import Acunetix360JsonParser class Acunetix360Plugin(PluginJsonFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Acunetix360" self.name = "Acunetix360 Output Plugin" self.plugin_version = "0.1" self.version = "9" self.json_keys = {'Target', "Vulnerabilities", "Generated"} self.framework_version = "1.0.0" self._temp_file_extension = "json" def parseOutputString(self, output): parser = Acunetix360JsonParser(loads(output)) h_id = self.createAndAddHost(self.resolve_hostname(parser.target.url)) for vuln in parser.vulnerabilities: s_id = self.createAndAddServiceToHost( host_id=h_id, ports="443", name="/"+vuln.url.split('/')[1] ) references = [ ] if vuln.classification.iso: references.append(vuln.classification.iso) if vuln.classification.capec: references.append(vuln.classification.capec) if vuln.classification.hipaa: references.append(vuln.classification.hipaa) if vuln.classification.pci: references.append(vuln.classification.pci) if vuln.classification.wasc: references.append(vuln.classification.wasc) if vuln.classification.asvs: references.append(vuln.classification.asvs) if vuln.classification.nistsp: references.append(vuln.classification.nistsp) if vuln.classification.disastig: references.append(vuln.classification.disastig) resolution = vuln.remedial_actions + "\n" + vuln.remedial_procedure data = vuln.impact + "\n POC: " + vuln.proof_of_concept cvss3 = {} if vuln.classification.cvss31: cvss3['vector_string'] = vuln.classification.cvss31 elif vuln.classification.cvss: cvss3['vector_string'] = vuln.classification.cvss self.createAndAddVulnWebToService( host_id=h_id, service_id=s_id, name=vuln.name, desc=vuln.description, ref=references, severity=vuln.severity, resolution=resolution, data=data, external_id="Acunetix360-"+vuln.external_id, tags=vuln.tags, method=vuln.request.method, request=vuln.request.content, response=vuln.response, cwe=vuln.classification.cwe, cvss3=cvss3 ) def createPlugin(*args, **kwargs): return Acunetix360Plugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix_json/000077500000000000000000000000001505357635700254375ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix_json/DTO.py000066400000000000000000000064631505357635700264500ustar00rootroot00000000000000from typing import List class InfoVul: def __init__(self, node): self.node = node @property def vt_id(self) -> str: if not self.node: return '' return self.node.get('vt_id', '') @property def request(self) -> str: if not self.node: return '' return self.node.get('request', '') class Vulnerabilities: def __init__(self, node): self.node = node @property def info(self) -> InfoVul: return InfoVul(self.node.get('info')) @property def response(self) -> str: if not self.node: return '' return self.node.get('response', '') class VulnerabilityTypes: def __init__(self, node): self.node = node @property def vt_id(self) -> str: if not self.node: return '' return self.node.get('vt_id', '') @property def name(self) -> str: if not self.node: return '' return self.node.get('name', '') @property def description(self) -> str: if not self.node: return '' return self.node.get('description', '') @property def severity(self) -> int: return self.node.get('severity', '') @property def recommendation(self) -> str: if not self.node: return '' return self.node.get('recommendation', '') @property def app_id(self) -> str: if not self.node: return '' return self.node.get('app_id', '') @property def use_ssl(self) -> bool: if not self.node: return '' return self.node.get('use_ssl', '') @property def tags(self) -> list: if not self.node: return [''] return self.node.get('tags', ['']) def cvss_score(self) -> str: return self.node.get('cvss_score') @property def cvss2_vector(self) -> str: return self.node.get('cvss2', '') @property def cvss3_vector(self) -> str: return self.node.get('cvss3', '') class Info: def __init__(self, node): self.node = node @property def host(self) -> str: if not self.node: return '' return self.node.get('host', '') @property def start_url(self) -> str: if not self.node: return '' return self.node.get('start_url', '') class Scan: def __init__(self, node): self.node = node @property def info(self) -> Info: return Info(self.node.get('info')) @property def vul_types(self) -> List[VulnerabilityTypes]: return [VulnerabilityTypes(i) for i in self.node.get('vulnerability_types', [])] @property def vulnerabilities(self) -> List[Vulnerabilities]: return [Vulnerabilities(i) for i in self.node.get('vulnerabilities', [])] class Export: def __init__(self, node): self.node = node @property def scans(self) -> List[Scan]: return [Scan(i) for i in self.node.get('scans', [])] @property def lang(self) -> str: if not self.node: return '' return self.node.get('scans', '') class AcunetixJsonParser: def __init__(self, node): self.node = node @property def export(self) -> Export: return Export(self.node.get('export')) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix_json/__init__.py000066400000000000000000000002351505357635700275500ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/acunetix_json/plugin.py000066400000000000000000000110471505357635700273120ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from urllib.parse import urlsplit import ipaddress from lxml import etree from faraday_plugins.plugins.plugin import PluginJsonFormat from faraday_plugins.plugins.repo.acunetix.DTO import Acunetix, Scan from json import loads __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" from faraday_plugins.plugins.repo.acunetix_json.DTO import AcunetixJsonParser, Vulnerabilities, \ VulnerabilityTypes from faraday_plugins.plugins.plugins_utils import its_cwe class AcunetixXmlParser: """ The objective of this class is to parse an xml file generated by the acunetix tool. TODO: Handle errors. TODO: Test acunetix output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param acunetix_xml_filepath A proper xml generated by acunetix """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) self.acunetix = Acunetix(tree) @staticmethod def parse_xml(xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: parser = etree.XMLParser(recover=True) tree = etree.fromstring(xml_output, parser=parser) except SyntaxError as err: print("SyntaxError: %s. %s", err, xml_output) return None return tree class AcunetixJsonPlugin(PluginJsonFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Acunetix_Json" self.name = "Acunetix JSON Output Plugin" self.plugin_version = "0.1" self.version = "9" self.json_keys = {'export'} self.framework_version = "1.0.0" self._temp_file_extension = "json" """ Example plugin to parse acunetix output. """ def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ parser = AcunetixJsonParser(loads(output)) for site in parser.export.scans: self.new_structure(site) def new_structure(self, site: Scan): start_url = site.info.host if site.info.start_url: start_url = site.info.start_url url_data = urlsplit(start_url) site_ip = self.resolve_hostname(url_data.hostname) ports = '443' if (url_data.scheme == 'https') else '80' vulnerability_type = {i.vt_id: i for i in site.vul_types} h_id = self.createAndAddHost(site_ip, None, hostnames=[url_data.hostname]) s_id = self.createAndAddServiceToHost( h_id, "http", "tcp", ports=[ports], version=None, status='open') for i in site.vulnerabilities: vul_type = vulnerability_type[i.info.vt_id] cwe = its_cwe(vul_type.tags) self.create_vul(i, vul_type, h_id, s_id, url_data, cwe) def create_vul(self, vul: Vulnerabilities, vul_type: VulnerabilityTypes, h_id, s_id, url_data, cwe): cvss3 = { 'vector_string': vul_type.cvss3_vector } cvss2 = { 'vector_string': vul_type.cvss2_vector } self.createAndAddVulnWebToService( h_id, s_id, vul_type.name, vul_type.description, website=url_data.hostname, severity=vul_type.severity, resolution=vul_type.recommendation, request=vul.info.request, response=vul.response, cwe=cwe, cvss3=cvss3, cvss2=cvss2 ) @staticmethod def get_domain(scan: Scan): url = scan.start_url if not url.startswith('http'): url = f'http://{url}' url_data = urlsplit(url) if not url_data.scheme: url_data = urlsplit(scan.crawler.start_url_attr) return url_data def createPlugin(*args, **kwargs): return AcunetixJsonPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/amap/000077500000000000000000000000001505357635700235045ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/amap/__init__.py000066400000000000000000000002351505357635700256150ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/amap/plugin.py000066400000000000000000000102001505357635700253450ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import argparse import re import shlex import socket from faraday_plugins.plugins.plugin import PluginBase class AmapPlugin(PluginBase): """ Example plugin to parse amap output.""" def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Amap" self.name = "Amap Output Plugin" self.plugin_version = "0.0.3" self.version = "5.4" self.options = None self._current_output = None self._command_regex = re.compile(r'^(amap|sudo amap)\s+.*?') self._use_temp_file = True self._hosts = [] self.args = None def parseOutputString(self, output): services = {} for line in output.split('\n'): if line.startswith('#'): continue fields = self.get_info(line) if len(fields) < 6: continue address = fields[0] port = fields[1] protocol = fields[2] port_status = fields[3] identification = fields[5] printable_banner = fields[6] if port in services.keys(): if identification != 'unidentified': services[port][5] += ', ' + identification else: services[port] = [ address, port, protocol, port_status, None, identification, printable_banner, None] if address != self.args.m: hostnames = [self.args.m] else: hostnames = None h_id = self.createAndAddHost(address, hostnames=hostnames) for key in services: service = services.get(key) self.createAndAddServiceToHost( h_id, service[5], service[2], ports=[service[1]], status=service[3], description=service[6]) return True file_arg_re = re.compile(r"^.*(-o \s*[^\s]+\s+(?:-m|)).*$") def get_info(self, data): if self.args.__getattribute__("6"): f = re.search( r"^\[(.*)\]:(.*):(.*):(.*):(.*):(.*):(.*):(.*)", data) return [ f.group(1), f.group(2), f.group(3), f.group(4), f.group(5), f.group(6), f.group(7), f.group(8)] if f else [] else: return data.split(':') def get_ip_6(self, host, port=0): alladdr = socket.getaddrinfo(host, port) ip6 = list(filter( lambda x: x[0] == socket.AF_INET6, alladdr)) return ip6[0][4][0] def processCommandString(self, username, current_path, command_string): """ Adds the -m parameter to get machine readable output. """ super().processCommandString(username, current_path, command_string) arg_match = self.file_arg_re.match(command_string) parser = argparse.ArgumentParser() parser.add_argument('-6', action='store_true') parser.add_argument('-o') parser.add_argument('-m') if arg_match is None: final = re.sub( r"(^.*?amap)", r"\1 -o %s -m " % self._output_file_path, command_string) else: final = re.sub( arg_match.group(1), r"-o %s -m " % self._output_file_path, command_string) cmd = shlex.split(re.sub(r'\-h|\-\-help', r'', final)) if "-6" in cmd: cmd.remove("-6") cmd.insert(1, "-6") if len(cmd) > 4: try: self.args, unknown = parser.parse_known_args(cmd) except SystemExit: pass return final def createPlugin(*args, **kwargs): return AmapPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/appscan/000077500000000000000000000000001505357635700242135ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/appscan/__init__.py000066400000000000000000000002351505357635700263240ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2017 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/appscan/plugin.py000066400000000000000000000317131505357635700260700ustar00rootroot00000000000000from urllib.parse import urlparse from faraday_plugins.plugins.plugin import PluginXMLFormat import xml.etree.ElementTree as ET __author__ = "Nicolas Rebagliati" __copyright__ = "Copyright (c) 2021, Infobyte LLC" __credits__ = ["Nicolas Rebagliati"] __license__ = "" __version__ = "1.0" __maintainer__ = "Nicolas Rebagliati" __status__ = "Development" class AppScanParser: def __init__(self, xml_output): tree = self.parse_xml(xml_output) if tree: self.scan_type = tree.attrib['technology'] self.issue_types = self.get_issue_types(tree.find('issue-type-group')) if self.scan_type == "SAST": self.fixes = self.get_fixes(tree.find("fix-group-group")) self.issues = self.get_sast_issues(tree.find("issue-group")) elif self.scan_type == "DAST": self.hosts = self.get_hosts(tree.find('scan-configuration/scanned-hosts')) self.remediations = self.get_remediations(tree.find('remediation-group')) self.entities = self.get_entity_groups(tree.find('entity-group')) self.issues = self.get_dast_issues(tree.find("issue-group")) @staticmethod def parse_xml(xml_output): try: tree = ET.fromstring(xml_output) except SyntaxError as err: print(f'SyntaxError In xml: {err}. {xml_output}') return None return tree @staticmethod def get_fixes(tree): fixes = {} for item in tree: fix_id = item.attrib['id'] library = item.find("LibraryName").text if item.find("LibraryName") else "" location = item.find("Location").text if item.find("Location") else "" fixes[fix_id] = {"library": library, "location": location} return fixes @staticmethod def get_issue_types(tree): issue_types = {} for item in tree: type_id = item.attrib['id'] name = item.find("name").text issue_types[type_id] = name cve = item.find("cve") if cve and cve.text: issue_types[f"{type_id}_cve"] = cve.text return issue_types @staticmethod def get_remediations(tree): remediations = {} for item in tree: remediation_id = item.attrib['id'] name = item.find("name").text remediations[remediation_id] = name return remediations @staticmethod def get_hosts(tree): hosts = {} for item in tree: host = item.find("host").text port = item.find("port").text operating_system = item.find("operating-system").text if "unknown" in operating_system.lower(): operating_system = "unknown" web_server = item.find("web-server").text application_server = item.find("application-server").text service_name = f"{web_server} ({application_server})" host_key = f"{host}-{port}" hosts[host_key] = {"host": host, "port": port, "os": operating_system, "service_name": service_name} return hosts @staticmethod def get_entity_groups(tree): entity_groups = {} for item in tree: entity_id = item.attrib['id'] name = item.find("name").text url = item.find("url-name").text type = item.find("entity-type").text url_data = urlparse(url) website = f"{url_data.scheme}://{url_data.netloc}" host = url_data.netloc.split(":")[0] if url_data.port: port = url_data.port else: if url_data.scheme == "http": port = 80 elif url_data.scheme == "https": port = 443 path = url_data.path entity_groups[entity_id] = {"name": name, "host": host, "port": port, "url": url, "type": type, "website": website, "path": path} return entity_groups def get_dast_issues(self, tree): dast_issues = [] for item in tree: if not self.entities: entity = list(self.hosts.values())[0] host = entity.get("host").replace('\\', '/') port = entity.get("port") else: entity = self.entities[item.find("entity/ref").text] host = entity["host"].replace('\\','/') port = entity["port"] name = self.issue_types[item.find("issue-type/ref").text] severity = 0 if item.find("severity-id") is None else int(item.find("severity-id").text) if severity > 4: severity = 4 resolution = self.remediations[item.find("remediation/ref").text] description = "" if item.find("variant-group/item/reasoning") is None \ else item.find("variant-group/item/reasoning").text request = "" if item.find("variant-group/item/test-http-traffic") is None \ else item.find("variant-group/item/test-http-traffic").text response = "" if item.find("variant-group/item/issue-information/testResponseChunk") is None \ else item.find("variant-group/item/issue-information/testResponseChunk").text cvss2 = item.find('cvss-score').text if item.find("cvss-score") is not None else None cvss2_base_vector = item.find('cvss-vector/base-vector').text if item.find('cvss-vector/base-vector') \ is not None else None cvss_temporal_vector = None if item.find('cvss-vector/temporal-vector') is None \ else f"CVSS-temporal-vector: {item.find('cvss-vector/temporal-vector').text}" cvss_environmental_vector = None if item.find('cvss-vector/environmental-vector') is None \ else f"CVSS-environmental-vector: {item.find('cvss-vector/environmental-vector').text}" cwe = None if item.find("cwe") is None else item.find('cwe').text if item.attrib.get("cve"): cve = None if item.find("variant-group/item/issue-information/display-name") is None \ else item.find('variant-group/item/issue-information/display-name').text if "CVE" not in cve: cve = f"CVE-{cve}" cve_url = item.attrib["cve"] else: cve = None cve_url = None if cve is None: cve = self.issue_types.get(f"{item.find('issue-type/ref').text}_cve", None) host_key = f"{host}-{port}" issue_data = { "host": host, "port": port, "os": self.hosts[host_key]["os"], "service_name": self.hosts[host_key]["service_name"], "name": name, "severity": severity, "desc": description, "ref": [], "resolution": resolution, "request": request, "response": response, "website": entity.get('website'), "path": entity.get('path'), "cve": [], "cwe": [], "cvss2": {} } if cve: issue_data["cve"].append(cve) issue_data["desc"] += cve if cve_url: issue_data["ref"].append(cve_url) if cwe: issue_data["cwe"].append(f"CWE-{cwe}") if cvss2_base_vector: issue_data["cvss2"]["vector_string"] = cvss2_base_vector if cvss_temporal_vector: issue_data["ref"].append(cvss_temporal_vector) if cvss_environmental_vector: issue_data["ref"].append(cvss_environmental_vector) dast_issues.append(issue_data) return dast_issues def get_sast_issues(self, tree): sast_issues = [] for item in tree: name = self.issue_types[item.find("issue-type/ref").text] source_file = item.attrib["filename"].replace('\\', '/') severity = 0 if item.find("severity-id") is None else int(item.find("severity-id").text) if severity > 4: severity = 4 description = "No description provided" \ if item.find("fix/item/general/text") is None else item.find("fix/item/general/text").text resolution = "" if item.find("variant-group/item/issue-information/fix-resolution-text") is None \ else item.find("variant-group/item/issue-information/fix-resolution-text").text fix_id = item.attrib.get("fix-group-id") if fix_id: fix = self.fixes[fix_id] resolution = f"{resolution}\nLibrary: {fix['library']}\nLocation: {fix['location']}" cvss2 = item.find('cvss-score').text if item.find("cvss-score") else None cvss2_base_vector = None if item.find('cvss-vector/base-vector') is None \ else item.find('cvss-vector/base-vector').text cvss_temporal_vector = None if item.find('cvss-vector/temporal-vector') is None \ else f"CVSS-temporal-vector: {item.find('cvss-vector/temporal-vector').text}" cvss_environmental_vector = None if item.find('cvss-vector/environmental-vector') is None \ else f"CVSS-environmental-vector: {item.find('cvss-vector/environmental-vector').text}" cwe = None if item.find("cwe/ref") is None else item.find('cwe/ref').text if item.attrib.get("cve"): cve = None if item.find("variant-group/item/issue-information/display-name") is None \ else item.find('variant-group/item/issue-information/display-name').text if cve and "CVE" not in cve: cve = f"CVE-{cve}" cve_url = item.attrib["cve"] else: cve = None cve_url = None issue_data = { "source_file": source_file, "name": name, "severity": severity, "desc": description, "ref": [], "resolution": resolution, "cve": [], "cwe": [], "cvss2": {} } if cve_url: issue_data["ref"].append(cve_url) if cwe: issue_data["cwe"].append(f"CWE-{cwe}") if cvss2_base_vector: issue_data["cvss2"]['vector_string'] = cvss2_base_vector if cvss_temporal_vector: issue_data["ref"].append(cvss_temporal_vector) if cvss_environmental_vector: issue_data["ref"].append(cvss_environmental_vector) if cve: issue_data["cve"].append(cve) issue_data["desc"] += f"\nCVE: {cve}" # Build data data = [] if item.attrib.get("caller"): data.append(f"Caller: {item.attrib.get('caller')}") if item.find("variant-group/item/issue-information/method-signature") is not None: data.append(f"Method: {item.find('variant-group/item/issue-information/method-signature').text}") if item.find("variant-group/item/issue-information/method-signature2") is not None: data.append(f"Location: {item.find('variant-group/item/issue-information/method-signature2').text}") issue_data['data'] = "\n".join(data) issue_data['desc'] += "\n".join(data) sast_issues.append(issue_data) return sast_issues class AppScanPlugin(PluginXMLFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "xml-report" self.id = 'Appscan' self.name = 'Appscan XML Plugin' self.plugin_version = '0.0.1' self.version = '1.0.0' self.framework_version = '1.0.0' def parseOutputString(self, output): parser = AppScanParser(output) scan_type = parser.scan_type if scan_type == 'DAST': for issue in parser.issues: host = issue.pop("host") port = issue.pop("port") service_name = issue.pop("service_name") ip = self.resolve_hostname(host) host_os = issue.pop("os") host_id = self.createAndAddHost(ip, hostnames=host, os=host_os) service_id = self.createAndAddServiceToHost(host_id, service_name, ports=port) self.createAndAddVulnWebToService(host_id=host_id, service_id=service_id, **issue) elif scan_type == 'SAST': for issue in parser.issues: source_file = issue.pop('source_file') host_id = self.createAndAddHost(source_file) self.createAndAddVulnToHost(host_id=host_id, **issue) def createPlugin(*args, **kwargs): return AppScanPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/appscan_csv/000077500000000000000000000000001505357635700250665ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/appscan_csv/__init__.py000066400000000000000000000002341505357635700271760ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2017 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/appscan_csv/plugin.py000066400000000000000000000064501505357635700267430ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginCSVFormat from itertools import islice import csv from dateutil.parser import parse __author__ = "Erodriguez" __copyright__ = "Copyright (c) 2019, Infobyte LLC" __credits__ = ["Erodriguez"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Erodriguez" __email__ = "erodriguez@infobytesec.com" __status__ = "Development" class Appscan_CSV_Plugin(PluginCSVFormat): """ Example plugin to parse Appscan output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.csv_headers = {'HCL AppScan on Cloud'} self.id = "Appscan_CSV" self.name = "Appscan CSV Output Plugin" self.plugin_version = "0.0.1" self.version = "0.0.1" self.framework_version = "1.0.1" def _parse_filename(self, filename): with open(filename) as output: self.parseOutputString(islice(output, 15, None)) def parseOutputString(self, output): try: reader = csv.DictReader(output) except: print("Error parser output") return None for row in reader: #Skip Fix Group if row["Issue Id"] == "Fix Group Attributes:": break path = row['Source File'] if path == "": path = row['Location'] try: run_date = parse(row['Date Created']) except: run_date = None name = row["Issue Type Name"] references = [] if row["Cwe"]: references.append(f"CWE-{row['Cwe']}") if row["Cve"]: references.append(row["Cve"]) data = [] if row['Security Risk']: data.append(f"Security Risk: {row['Security Risk']}") desc = [row['Description']] if row['Cve']: desc.append(f"Cve: {row['Cve']}") if row['Line']: desc.append(f"Line: {row['Line']}") if row['Cause']: desc.append(f"Cause: {row['Cause']}") if row['Remediation']: desc.append(f"Resolution: {row['Resolution']}") if row['Threat Class']: desc.append(f"Threat Class: {row['Threat Class']}") if row['Security Risk']: desc.append(f"Security Risk: {row['Security Risk']}") if row['Calling Method']: desc.append(f"Calling Method: {row['Calling Method']}") if row['Location']: desc.append(f"Vulnerability Line: {row['Location']}") h_id = self.createAndAddHost(name=path) self.createAndAddVulnToHost( h_id, name=name, desc=" \n".join(desc), resolution=row['Remediation'], external_id=row['Issue Id'], cve=row['Cve'], run_date=run_date, severity=row["Severity"], ref=references, data=" \n".join(data) ) def createPlugin(*args, **kwargs): return Appscan_CSV_Plugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/appspider/000077500000000000000000000000001505357635700245555ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/appspider/__init__.py000066400000000000000000000000001505357635700266540ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/appspider/plugin.py000066400000000000000000000101701505357635700264240ustar00rootroot00000000000000#!/usr/bin/env python """ Faraday Penetration Test IDE Copyright (C) 2016 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import xml.etree.ElementTree as ET from datetime import datetime from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = 'Blas Moyano' __copyright__ = 'Copyright 2020, Faraday Project' __credits__ = ['Blas Moyano'] __license__ = '' __version__ = '1.0.0' __status__ = 'Development' class AppSpiderParser: def __init__(self, xml_output): self.tree = self.parse_xml(xml_output) if self.tree: self.vuln_list = self.tree.find('VulnList') self.name_scan = self.tree.findtext('ScanName') else: self.tree = None @staticmethod def parse_xml(xml_output): try: tree = ET.fromstring(xml_output) except SyntaxError as err: print(f'SyntaxError In xml: {err}. {xml_output}') return None return tree class AppSpiderPlugin(PluginXMLFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = ["VulnSummary"] self.id = 'AppSpider' self.name = 'AppSpider XML Output Plugin' self.plugin_version = '1.0.0' self.version = '1.0.0' self.framework_version = '1.0.0' self.options = None self.protocol = None self.port = '80' self.address = None def parseOutputString(self, output): parser = AppSpiderParser(output) websites = [] websites_ip = [] for vuln in parser.vuln_list: websites.append(vuln.find('WebSite').text) websites_ip.append(vuln.find('WebSiteIP').text) url = set(websites) ip = set(websites_ip) if None in ip: ip.remove(None) host_id = self.createAndAddHost(name=sorted(list(ip))[0], hostnames=sorted(list(url)), description=parser.name_scan) data_info = [] for vulns in parser.vuln_list: vuln_name = vulns.findtext('VulnType') vuln_desc = vulns.findtext('Description') vuln_ref = vulns.findtext('VulnUrl') severity = vulns.findtext('AttackScore') vuln_resolution = vulns.findtext('Recommendation') vuln_external_id = vulns.findtext('DbId') vuln_run_date = vulns.findtext('ScanDate') data_info.append(vulns.findtext('AttackClass')) cwe = ["CWE-" + vulns.findtext('CweId')] if vulns.findtext('CweId') else [] data_info.append(vulns.findtext('CAPEC')) data_info.append(vulns.findtext('DISSA_ASC')) data_info.append(vulns.findtext('OWASP2007')) data_info.append(vulns.findtext('OWASP2010')) data_info.append(vulns.findtext('OWASP2013')) data_info.append(vulns.findtext('OVAL')) data_info.append(vulns.findtext('WASC')) if severity == '1-Informational': severity = 0 elif severity == '2-Low': severity = 1 elif severity == '3-Medium': severity = 2 elif severity == '4-High': severity = 3 else: severity = 10 str_data = f'AttackClass: {data_info[0]}, CAPEC: {data_info[1]}, ' \ f'DISSA_ASC: {data_info[2]}, OWASP2007: {data_info[3]}, OWASP2010: {data_info[4]}, ' \ f'OWASP2013: {data_info[5]}, OVAL: {data_info[6]}, WASC: {data_info[7]}' if vuln_run_date is None: vuln_run_date = None else: vuln_run_date = datetime.strptime(vuln_run_date, '%Y-%m-%d %H:%M:%S') self.createAndAddVulnToHost(host_id=host_id, name=vuln_name, desc=vuln_desc, ref=[vuln_ref], severity=severity, resolution=vuln_resolution, run_date=vuln_run_date, external_id=vuln_external_id, data=str_data, cwe=cwe) def createPlugin(*args, **kwargs): return AppSpiderPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/arachni/000077500000000000000000000000001505357635700241735ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/arachni/__init__.py000066400000000000000000000002351505357635700263040ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/arachni/plugin.py000077500000000000000000000427331505357635700260570ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2016 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import os import re import xml.etree.ElementTree as ET from urllib.parse import urlparse from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = 'Ezequiel Tavella' __copyright__ = 'Copyright 2016, Faraday Project' __credits__ = ['Ezequiel Tavella', 'Matías Ariel Ré Medina', 'Conrad Stein K'] __license__ = '' __version__ = '1.0.2' __status__ = 'Development' class ArachniXmlParser: def __init__(self, xml_output): self.tree = self.parse_xml(xml_output) if self.tree: self.issues = self.getIssues(self.tree) self.plugins = self.getPlugins(self.tree) self.system = self.getSystem(self.tree) else: self.system = None self.issues = None self.plugins = None def parse_xml(self, xml_output): try: tree = ET.fromstring(xml_output) except SyntaxError as err: return None return tree def getIssues(self, tree): # Get vulnerabilities. issues_tree = tree.find('issues') for self.issue_node in issues_tree: yield Issue(self.issue_node) def getPlugins(self, tree): # Get info about plugins executed in scan. plugins_tree = tree.find('plugins') return Plugins(plugins_tree) def getSystem(self, tree): system_tree = tree.find('system') if system_tree is None: return System(tree, False) else: return System(system_tree, True) class Issue: def __init__(self, issue_node): self.node = issue_node self.name = self.getDesc('name') self.severity = self.getDesc('severity') self.cwe = self.getDesc('cwe') self.remedy_guidance = self.getDesc('remedy_guidance') self.description = self.getDesc('description') self.var = self.getChildTag('vector', 'affected_input_name') self.url = self.getChildTag('vector', 'url') self.method = self.getChildTag('vector', 'method') self.references = self.getReferences() self.parameters = self.getParameters() self.request = self.getRequest() self.response = self.getResponse() self.data = self.getData() def getData(self): name = self.node.findtext('check/name', '') description = self.node.findtext('check/description', '') author = self.node.findtext('check/description', '') data = "" if name: data += f'\nname: {name}' if description: data += f'\ndescription: {description}' if author: data += f'\nauthor: {author}' return data def getDesc(self, tag): # Get value of tag xml description = self.node.find(tag) if description is not None and description.text is not None: return description.text else: return 'None' def getChildTag(self, main_tag, child_tag): # Get value of tag child xml main_entity = self.node.find(main_tag) if not main_entity: return 'None' result = main_entity.find(child_tag) if result is not None and result.text is not None: return result.text else: return 'None' def getReferences(self): """ Returns current issue references on this format {'url': 'http://www.site.com', 'name': 'WebSite'}. """ result = [] references = self.node.find('references') if not references: return result for tag in references.findall('reference'): url = tag.get('url') result.append(url) return result def getParameters(self): # Get parameters of query result = [] try: parameters = self.node.find('vector').find('inputs') for param in parameters.findall('input'): name = param.get('name') result.append(name) except: parameters = '' return ' - '.join(result) def getRequest(self): # Get data about request. try: request = self.node.find('page/request') raw_data = request.find('raw') data = raw_data.text if not data: data = self.contruct_request(request) return data except: return 'None' @staticmethod def contruct_request(request): data = request.findtext("method", "").upper() data += f" {request.findtext('url', '')}" for h in request.findall('headers/header'): data += f"\n{h.get('name')}: {h.get('value')}" if request.findtext('body',""): data += f"\n{request.findtext('body','')}" return data @staticmethod def construct_response(request): data = "" if request.findtext("code", ""): data += f'\ncode: {request.findtext("code", "")}' if request.findtext("ip_address", ""): data += f'\nip_address: {request.findtext("ip_address", "")}' if request.findtext("time", ""): data += f'\ntime: {request.findtext("time", "")}' if request.findtext("return_code", ""): data += f'\nreturn_code: {request.findtext("return_code", "")}' if request.findtext("return_message", ""): data += f'\nreturn_message: {request.findtext("return_message", "")}' return data def getResponse(self): try: request = self.node.find('page/response') raw_data = request.find('raw_headers') data = raw_data.text if not data: data = self.contruct_request(request) data += self.construct_response(request) return data except: return 'None' class System: def __init__(self, node, tag_exists): self.node = node if not tag_exists: self.user_agent = 'Arachni' self.url = self.getUrl() self.modules = '' self.version = self.node.find('version') self.start_time = self.node.find('start_datetime') self.finish_time = self.node.find('finish_datetime') else: self.user_agent = None self.url = None self.audited_elements = None self.modules = '' self.cookies = None self.getOptions() self.version = self.getDesc('version') self.start_time = self.getDesc('start_datetime') self.finish_time = self.getDesc('finish_datetime') self.note = self.getNote() def getUrl(self): sitemap = self.node.find("sitemap/entry") #Fix for the case when no vulns in the report if not sitemap: return self.node.find("options").text.split("url:")[-1].strip(" \n") return sitemap.get('url') def getOptions(self): # Get values of options scan try: options = self.node.find('options') except: options = False if options: options_string = options.text else: options_string = None try: self.user_agent = self.node.find('user_agent').text except: self.user_agent = None self.url = self.node.find('url').text tags_audited_elements = self.node.find('audited_elements') element_text = [] for element in tags_audited_elements: element_text.append(element.text) self.audited_elements = element_text tag_module = self.node.find('modules') module_text = [] for module in tag_module: module_text.append(module.attrib['name']) self.modules = module_text self.cookies = self.node.find('cookies').text def getDesc(self, tag): # Return value of tag description = self.node.find(tag) if description and description.text: return description.text else: return None def getNote(self): result = ('Scan url:\n {} \nUser Agent:\n {} \nVersion Arachni:\n {} \nStart time:\n {} \nFinish time:\n {}' '\nAudited Elements:\n {} \nModules:\n {} \nCookies:\n {}').format(self.url, self.user_agent, self.version, self.start_time, self.finish_time, self.audited_elements, self.modules, self.cookies) return result class Plugins: """ Support: WAF (Web Application Firewall) Detector (waf_detector) Healthmap (healthmap) """ def __init__(self, plugins_node): self.plugins_node = plugins_node self.healthmap = self.getHealthmap() self.waf = self.getWaf() try: self.ip = plugins_node.find('resolver').find('results') \ .find('hostname').get('ipaddress') except Exception: self.ip = None @staticmethod def get_value(name, node): x = node.find(name) if x: return x.text else: return "" def getHealthmap(self): # Get info about healthmap healthmap_tree = self.plugins_node.find('healthmap') if not healthmap_tree: return 'None' # Create urls list. list_urls = [] map_results = healthmap_tree.find('results').find('map') for url in map_results: if url.tag == 'with_issues': list_urls.append(f"With Issues: {url.text}") else: list_urls.append(f"Without Issues: {url.text}") try: plugin_name = self.get_value('name', healthmap_tree) description = self.get_value('description', healthmap_tree) results = self.get_value('results', healthmap_tree) total = self.get_value('total', results) with_issues = self.get_value('with_issues', results) without_issues = self.get_value('without_issues', results) issue_percentage = self.get_value('issue_percentage', results) urls = '\n'.join(list_urls) result = (f"Plugin Name: {plugin_name}\nDescription: {description}\nStatistics:\nTotal: {total}" f"\nWith Issues: {with_issues}\nWithout Issues: {without_issues}" f"\nIssues percentage: {issue_percentage}\nResults Map:\n {urls}") return result except: return 'None' def getWaf(self): # Get info about waf plugin. waf_tree = self.plugins_node.find('waf_detector') try: plugin_name = self.get_value('name', waf_tree) description = self.get_value('description', waf_tree) results = waf_tree.find('results') message = self.get_value('message', results) status = self.get_value('status', results) result = (f"Plugin Name: {plugin_name}\nDescription: {description}\nResults:" f"\nMessage: {message}\nStatus: {status}") return result except: return 'None' class ArachniPlugin(PluginXMLFormat): # Plugin that parses Arachni's XML report files. def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = ["report", "arachni_report"] self.id = 'Arachni' self.name = 'Arachni XML Output Plugin' self.plugin_version = '1.0.1' self.version = '1.3.2' self.framework_version = '1.0.0' self.options = None self._command_regex = re.compile(r'^(arachni|\.\/arachni)\s+.*?') self.protocol = None self.hostname = None self.port = '80' self.address = None self._use_temp_file = True self._temp_file_extension = ["afr", "xml"] def report_belongs_to(self, **kwargs): if super().report_belongs_to(**kwargs): report_path = kwargs.get("report_path", "") with open(report_path) as f: output = f.read() return re.search("/Arachni/arachni/", output) is not None return False def _parse_filename(self, filename): """ This plugin gets a dict of files, not just one file if it runs the command. We just need the xml. """ if isinstance(filename, dict): filename = filename['xml'] with open(filename, **self.open_options) as output: self.parseOutputString(output.read()) if self._delete_temp_file: if isinstance(filename, dict): for _file in filename.values(): try: os.remove(_file) except Exception as e: self.logger.error("Error on delete file: (%s) [%s]", _file, e) else: try: os.remove(filename) except Exception as e: self.logger.error("Error on delete file: (%s) [%s]", filename, e) def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. """ parser = ArachniXmlParser(output) # Check xml parsed ok... if not parser.system: return self.hostname = self.getHostname(parser.system.url) if parser.plugins.ip: self.address = self.resolve_hostname(parser.plugins.ip) else: self.address = self.resolve_hostname(self.hostname) # Create host and interface host_id = self.createAndAddHost(self.address, hostnames=[self.hostname]) # Create service service_id = self.createAndAddServiceToHost( host_id, self.protocol, 'tcp', ports=[self.port], status='open', version='', description='') # Create issues. for issue in parser.issues: description = str(issue.description) resol = str(issue.remedy_guidance) references = issue.references cwe = [] if issue.cwe != 'None': cwe.append('CWE-' + str(issue.cwe)) if resol == 'None': resol = '' self.createAndAddVulnWebToService( host_id, service_id, name=issue.name, desc=description, data=issue.data, resolution=resol, ref=references, severity=issue.severity, website=self.hostname, path=issue.url, method=issue.method, pname=issue.var, params=issue.parameters, request=issue.request, response=issue.response, cwe=cwe ) return def processCommandString(self, username, current_path, command_string): """ Use bash to run sequentialy arachni and arachni_reporter """ # Dont call the parent beacuse this plugin needs a different implementation if command_string.startswith("sudo"): params = " ".join(command_string.split()[2:]) else: params = " ".join(command_string.split()[1:]) self.vulns_data["command"]["params"] = params self.vulns_data["command"]["user"] = username self._output_file_path = {} self._delete_temp_file = True for ext in self._temp_file_extension: self._output_file_path[ext] = self._get_temp_file(extension=ext) afr_file_path = self._output_file_path['afr'] xml_file_path = self._output_file_path['xml'] report_arg_re = r"^.*(--report-save-path[=\s][^\s]+).*$" arg_match = re.match(report_arg_re, command_string) if arg_match is None: main_cmd = re.sub(r"(^.*?arachni)", r"\1 --report-save-path=%s" % afr_file_path, command_string) else: main_cmd = re.sub(arg_match.group(1), r"--report-save-path=%s" % afr_file_path, command_string) # add reporter cmd_prefix_match = re.match(r"(^.*?)arachni ", command_string) cmd_prefix = cmd_prefix_match.group(1) reporter_cmd = "{}{} --reporter=\"xml:outfile={}\" \"{}\"".format(cmd_prefix, "arachni_reporter", xml_file_path, afr_file_path) return "/usr/bin/env -- bash -c '{} 2>&1 && if [ -e \"{}\" ];then {} 2>&1;fi'".format(main_cmd, afr_file_path, reporter_cmd) def getHostname(self, url): # Strips protocol and gets hostname from URL. url_parse = urlparse(url) self.protocol = url_parse.scheme self.hostname = url_parse.netloc if self.protocol == 'https': self.port = 443 elif self.protocol == 'http': if not self.port: self.port = 80 return self.hostname def createPlugin(*args, **kwargs): return ArachniPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/arp_scan/000077500000000000000000000000001505357635700243545ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/arp_scan/__init__.py000077500000000000000000000002351505357635700264700ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/arp_scan/plugin.py000066400000000000000000000035261505357635700262320ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginBase import re __author__ = "Federico Kirschbaum" __copyright__ = "Copyright 2013, Faraday Project" __credits__ = ["Federico Kirschbaum"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Federico Kirschbaum" __email__ = "fedek@infobytesec.com" __status__ = "Development" class CmdArpScanPlugin(PluginBase): """ This plugin handles arp-scan command. Basically inserts into the tree the ouput of this tool """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "arp-scan" self.name = "arp-scan network scanner" self.plugin_version = "0.0.2" self.version = "1.8.1" self.framework_version = "1.0.0" self.options = None self._current_output = None self._command_regex = re.compile(r'^(sudo arp-scan|\.\/arp-scan|arp-scan)\s+.*?') self._host_ip = None def parseOutputString(self, output): host_info = re.search( r"(\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)", output) host_mac_addr = re.search(r"([\dA-F]{2}(?:[-:][\dA-F]{2}){5})", output, re.IGNORECASE) if host_info is None: self.logger.info("No hosts detected") else: for line in output.split('\n'): vals = line.split("\t") if len(vals) == 3: if len(vals[0].split(".")) == 4: host = vals[0] h_id = self.createAndAddHost(host, mac=vals[1]) return True def createPlugin(*args, **kwargs): return CmdArpScanPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/aws_inspector/000077500000000000000000000000001505357635700254465ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/aws_inspector/__init__.py000066400000000000000000000000001505357635700275450ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/aws_inspector/plugin.py000066400000000000000000000075551505357635700273320ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file "doc/LICENSE" for the license information """ from faraday_plugins.plugins.plugin import PluginJsonFormat from json import loads __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Gonzalo Martinez"] __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmartinez@infobytesec.com" __status__ = "Development" class AWSInspectorJsonPlugin(PluginJsonFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "AWSInspector_Json" self.name = "AWS Inspector JSON Output Plugin" self.plugin_version = "1" self.version = "9" self.json_keys = {"findings"} self.framework_version = "1.0.0" self._temp_file_extension = "json" def parseOutputString(self, output): # Useful docs about aws finding struct: https://docs.aws.amazon.com/inspector/v2/APIReference/API_Finding.html data = loads(output) for finding in data["findings"]: cve = [] refs = [] cvss2 = {} cvss3 = {} status = finding.get("status", "ACTIVE") # AWS possible status are ACTIVE | SUPPRESSED | CLOSED if status != 'ACTIVE': continue name = finding.get("title", "") description = finding.get("description", "") severity = finding.get('severity', 'unclassified').lower().replace("untriaged", "unclassified") vulnerability_details = finding.get("packageVulnerabilityDetails") if vulnerability_details: cve = vulnerability_details.get("vulnerabilityId", None) if cve != name: name = name.replace(f"{cve} - ", "") refs = vulnerability_details.get("referenceUrls", []) source_url = vulnerability_details.get("sourceUrl", "") if isinstance(source_url, str): refs.append(source_url) elif isinstance(source_url, list): refs += source_url if "inspectorScoreDetails" in finding and "adjustedCvss" in finding["inspectorScoreDetails"]: version = finding["inspectorScoreDetails"]["adjustedCvss"].get("version") if version: vector_string = finding["inspectorScoreDetails"]["adjustedCvss"]["scoringVector"] if "3" in version: cvss3 = { "vector_string": vector_string } elif "2" in version: cvss2 = { "vector_string": vector_string } vulnerability = { "name": name, "desc": description, "ref": refs, "severity": severity, "cve": cve, "cvss2": cvss2, "cvss3": cvss3, } for resource in finding.get("resources", []): resource_name = f"{finding.get('awsAccountId', '')} | {resource.get('id', '')}" hostnames = [] resource_details = resource.get("details", {}) if "awsEc2Instance" in resource_details: for hostname in resource_details["awsEc2Instance"].get("ipV4Addresses", []): hostnames.append(hostname) host_id = self.createAndAddHost( name=resource_name, hostnames=hostnames ) self.createAndAddVulnToHost( host_id=host_id, **vulnerability ) def createPlugin(*args, **kwargs): return AWSInspectorJsonPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/bandit/000077500000000000000000000000001505357635700240275ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/bandit/__init__.py000066400000000000000000000000001505357635700261260ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/bandit/plugin.py000066400000000000000000000040371505357635700257030ustar00rootroot00000000000000from faraday_plugins.plugins.plugin import PluginXMLFormat import xml.etree.ElementTree as ET import re class BanditPlugin(PluginXMLFormat): """ Example plugin to parse bandit output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = 'testsuite' self.extension = ".xml" self.id = "Bandit" self.name = "Bandit XML Output Plugin" self.plugin_version = "0.0.1" def report_belongs_to(self, **kwargs): if super().report_belongs_to(**kwargs): report_path = kwargs.get("report_path", "") with open(report_path) as f: output = f.read() return re.search("testsuite name=\"bandit\"", output) is not None return False def parseOutputString(self, output): bp = BanditParser(output) for vuln in bp.vulns: host_id = self.createAndAddHost(vuln['path']) self.createAndAddVulnToHost( host_id=host_id, name=vuln['name'], desc=vuln['issue_text'], ref=vuln['references'], severity=vuln['severity'], ) return True class BanditParser: """ Parser for bandit on demand """ def __init__(self, xml_output): self.vulns = self._parse_xml(xml_output) def _parse_xml(self, xml_output): vulns = [] tree = ET.fromstring(xml_output) testcases = tree.findall('testcase') for testcase in testcases: error = testcase.find('error') name = testcase.attrib['name'] path = testcase.attrib['classname'] severity = error.attrib['type'] issue_text = error.text more_info = error.attrib['more_info'] ref = [more_info] vulns.append({'name': name, 'path': path, 'references': ref, 'issue_text': issue_text, 'severity': severity}) return vulns def createPlugin(*args, **kwargs): return BanditPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/beef/000077500000000000000000000000001505357635700234675ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/beef/__init__.py000066400000000000000000000002351505357635700256000ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/beef/plugin.py000066400000000000000000000071771505357635700253530ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginBase import re from urllib.request import urlopen import json __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class BeefPlugin(PluginBase): """ Example plugin to parse beef output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Beef" self.name = "BeEF Online Service Plugin" self.plugin_version = "0.0.1" self.version = "0.4.4.9-alpha" self.framework_version = "1.0.0" self.options = None self._current_output = None self.target = None self._command_regex = re.compile(r'^(beef|sudo beef|\.\/beef)\s+.*?') self.addSetting("Host", str, "http://127.0.0.1:3000/") self.addSetting( "Authkey", str, "c818c7798ae1da38b45a6406c8dd0d6d4d007098") self.addSetting("Enable", str, "0") def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ try: f = urlopen(self.getSetting("Host") + "/api/hooks?token=" + self.getSetting("Authkey")) # nosec data = json.loads(f.read()) except Exception: self.logger.info("[BeEF] - Connection with api") return if "hooked-browsers" in data: for t in ["online", "offlne"]: for h in data["hooked-browsers"][t]: name = str(data["hooked-browsers"][t][h]['name']) version = str(data["hooked-browsers"][t][h]['version']) os = str(data["hooked-browsers"][t][h]['os']) platform = str(data["hooked-browsers"][t][h]['platform']) session = str(data["hooked-browsers"][t][h]['session']) ip = str(data["hooked-browsers"][t][h]['ip']) domain = str(data["hooked-browsers"][t][h]['domain']) port = str(data["hooked-browsers"][t][h]['port']) page_uri = str(data["hooked-browsers"][t][h]['page_uri']) desc = "Client ip:" + ip + \ " has been injected with BeEF using the url:" + page_uri + "\n" desc += "More information:" desc += "\ntype:" + t desc += "\nname:" + name desc += "\nversion:" + version desc += "\nos:" + os desc += "\nplatform:" + platform desc += "\nsession:" + session desc += "\nip:" + ip desc += "\ndomain:" + domain desc += "\nport:" + port desc += "\npage_uri:" + page_uri h_id = self.createAndAddHost(ip) v_id = self.createAndAddVulnToHost( h_id, "BeEF injected " + t + " session:" + session, desc=desc, ref=["http://http://beefproject.com/"], severity=3) def createPlugin(*args, **kwargs): return BeefPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/brutexss/000077500000000000000000000000001505357635700244455ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/brutexss/__init__.py000066400000000000000000000002341505357635700265550ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2018 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/brutexss/plugin.py000066400000000000000000000046521505357635700263240ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2018 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re from urllib.parse import urlparse __author__ = "Roberto Focke" __copyright__ = "Copyright (c) 2017, Infobyte LLC" __license__ = "" __version__ = "1.0.0" from faraday_plugins.plugins.plugin import PluginBase class brutexss (PluginBase): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "brutexss" self.name = "brutexss" self.plugin_version = "0.0.2" self.version = "1.0.0" self.protocol ='tcp' self._command_regex = re.compile(r'^(sudo brutexss|brutexss|sudo brutexss\.py|brutexss\.py|python brutexss\.py|' r'\.\/brutexss\.py)\s+.*?') def parseOutputString(self, output): lineas = output.split("\n") parametro = [] found_vuln = False for linea in lineas: if linea.find("is available! Good!") > 0: url = re.findall(r'(?:[-\w.]|(?:%[\da-fA-F]{2}))+', linea)[0] port = 80 if urlparse(url).scheme == 'https': port = 443 netloc_splitted = urlparse(url).netloc.split(':') if len(netloc_splitted) > 1: port = netloc_splitted[1] if linea.find("Vulnerable") > 0 and "No" not in linea: vuln_list = re.findall(r"\w+", linea) if vuln_list[2] == "Vulnerable": parametro.append(vuln_list[1]) found_vuln = len(parametro) > 0 address = self.resolve_hostname(url) host_id = self.createAndAddHost(url, hostnames=[url]) service_id = self.createAndAddServiceToHost(host_id, self.protocol, 'tcp', ports=[port], status='Open', version="", description="") if found_vuln: self.createAndAddVulnWebToService(host_id, service_id, name="xss", desc="XSS", ref='', severity='med', website=url, path='', method='', pname='', params=''.join(parametro), request='', response='') def createPlugin(*args, **kwargs): return brutexss(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/burp/000077500000000000000000000000001505357635700235365ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/burp/__init__.py000066400000000000000000000002351505357635700256470ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/burp/burp-2.0-SNAPSHOT.jar000066400000000000000000016456121505357635700267550ustar00rootroot00000000000000PK 1N META-INF/PK ^)NMETA-INF/MANIFEST.MFMLK-. K-*ϳR03PK \JMETA-INF/maven/PK \J-META-INF/maven/net.portswigger.burp.extender/PK \J?META-INF/maven/net.portswigger.burp.extender/burp-extender-api/PK \JÖvMMETA-INF/maven/net.portswigger.burp.extender/burp-extender-api/pom.properties5ʱ 0=OqйBgQp/3dڷn?|s!&J~#6\ n\H֔yB;XL\5LLjK])FT)>JHM/cA֗dPK y\J}p FMETA-INF/maven/net.portswigger.burp.extender/burp-extender-api/pom.xmlWn8}NȻHݢ*4!k$b FeI;Hju@ 0zpJ'VZoa^_lU BZeSE Rd-ygxv,{nwxlvI]ރcK3.dxRr)NH>gŻٻޛꢀy++ǴZv*XIm͎5 eb:'s5--U[eT$Zg Ӛxg<:6/|mLЖΠM1H*!Ώ~$'T̔+wqAV"L3h m@o*CcZj7DD 9IC / y gg6h,!Uk}3-QtaY\ʖP<9 fXP,os6R0 zPǤhŕ.L3o :'mI0T~;Q89 z34d8F×7Iigk5j 溑K39 ^I?ܞ钝֛9a73!ep+8f7苓1SY32w=$SWrJ"4',Oef=vSkU|1D^OugmP@*~N?Ʉ%  PK \Jburp/PK \Jm()burp/IBurpCollaboratorClientContext.classQMK1}ukG֣(a"h7o5]SB"i_GUv{^&oz6i` -,w⎿(ḩ Kˤ2e~`:IGR|!g3jNL CׯVlrT4דӁBS_R{vPՏeM"uC ktã|5lPDkoRP^Mwқe>PK \J=G'burp/IBurpCollaboratorInteraction.class}MjA_u#d& YP\(b`N34CK=5W"PbM=^}C þ,'G٫JrE WL?a} ;VV饦pJ*ք}lm:O}Ź^j׋˥Vex^;Ѭr1}dI oWls-j^vTWPK \Jtͅburp/IBurpExtender.class;o>CNvvvFɢ"׊Լ"ĜbF Ң}O' !o_Zꖙ P/+,(i#HN?'1/]?)+5YX@,V PK \JI2)o7͛7 {s+}٧ʋJ>B l˕%'u*lUɖ.+$,,>AQX8/ \v~ޗ a+Eex4| K^ub~>K |[--%n oC ),״y)Rp ={X72 êg1fXh`<=59L!\t)؍eY=14dwYdC#fd&7qo;IGMW 'T$KwBi3`u-65&3`ȐЕͺeH-laG4uz$H뒔H<$9!MӉVaM{colFDQCmR1}=8)W %f<ҡa0D8>PWxӛ`ui(C!Lxݾb &))6䜰 FUf (!.)D1㘏1m9F]k&**jhq<``#x=#?qS}ćdGa,W8osUneoy6 ydNO)h+$#宋~tq~taӶZk?N tFRMf A >=lk<Ӟp% ڼZκYQʚmIx\1#aFn'M_3jk&4,M%3]Yq0x/fpK })wyzߣpߊv$lHl4nٔ1ĭ{ sdHܢV a,ڬ`K+dǮ#IEǫ;/ZMYl%5W"kY6ڦDk軏Gԯu 'wLVNwxTN_yVpg.=1OFlѝO`NUhۊ#+fOp gX~yGn:#aI4xh+[lf귘YŮf]RufkJdrQdɺ"%2sznԝc>n*]{Qg[FǓv#I{btBgV,NSUFgc90F*\OC$JDfeUl;D_GO[ A7S}m_2FƪL!j,LJuaʝ6C~r[߭}k{4~/?>F~Ə @"?cqxrf #068ǕIw)fOSߩwL(p}~PML#"N1jsJ~L/h_R\fVM?Ӣ|IPa闐\ɯL5 O*L@PU2`zM:\gj k` -OԃuE m ϲ.(9䟇E?x+UG cqx ϰ9/@wYDWkxC}߀ovX|y6|-|~~?Uϙ~W0 [1l I?PK \J_'burp/IContextMenuFactory.classAn0DӔ4aQnjN *EN`, 9 v|Z=@UՉ@Bb_h4oF)9Yy-Y + 6OZ8}dNI6/e-R6(M!J^k$ڣ;qyGl^^&r'Tk׍9'FFf[kCa(!< 1QzPK \J !burp/IContextMenuInvocation.classu]S@ Bm@bv^**;xdj6Q,%^ycwO>"ԋ@^rnSp\ϥ ьXD8~4,ip75H]+KeEM9gz] jOG=vMv禾\ 680 "oڽlAGT.8ˬ'A =8v;،Ἡs8U洅_͂~vmS-句b$Qt*C;Էʒ7k!!PF,r:#P5WwQOE|m (Q5&d8*abRW~Od\OpO$ΰe8NҤ"PFkGH!?[WbOyQe/ԗrn5$2@HAh%O7 ~M-w os_@f UᕎDSx[x:PK \JFpburp/ICookie.classEK @D%񇈇ЍK? 0ĉ1#a"ͅPbG"z?f;:X٥dlxNpr`{"ĭWF(N%[Uw|QWܑBl;0EN%t7 cZMKVbXWa""j( D|խWm5t>PK \J|&i burp/IExtensionHelpers.classS]S@-P-(~BBQDZ3v!c}On6rlmhc^N9d4a@2 c ;z罊/DOW\at`nfTD޷;XmՒKvQn/pê&,Z~D9@N`C gO+eV)ͬ#g|Îk6$MX(Jjfφf$o/oKh2穷c6u;c7$HSYiѪF 0m N=ZQ|a;퉪9Ӵ-FQEPoqQ^|lRӌKp3P<Ǯ7L*p-&g׌GU¯7.C4IdnN2AԒҥ_١!7d]vL { m dtro;0~rWd}"@` guPxUcJa)@V *891-‚޿7p <+r))׷`Uokj>uPʰ1<oɷmV PK \Jgς"burp/IExtensionStateListener.class;o>CNvvvFԊԼмĔFf 0FҢT̜TFOWĒTb 7H/+,(TZTC #H~Nb^RVjr ##0-d`X$PK \J<burp/IHttpListener.class;o>CNvvvFb_ ȠTZT J-,M-. J-.+N cd /-JNu+,.IK-J,K " 02sRK@b`L lPK \J; burp/IHttpRequestResponse.classmN@ETZ"Vmka#q&F&&銒 P@fǹQ7hJ27o.&. ^&ԓxmT 3Nah@YWdj%]pJ6IT$eŪ+S}t/Ru,M ΗmSG2 8pzWm Ҵ]Row`vy\D =s} ZcO02z3Jd8OPK \J,Rx%(burp/IHttpRequestResponsePersisted.class}OJP=֤ϕණ1v%((ߤ%N8~%NV]cf>\$aǂ *_akcE;}UZu`}q{n,C`KLZ2E]WCſJ~SevޟL L؜aܐ78̬0PK \JI"z8*burp/IHttpRequestResponseWithMarkers.class;o>C>vnvv^FԒĢԢbF! MIJDҒ}kFĒҢTF1 6ўv@EB`ӊ Sq%exz@m) ,ɀ* TTZTO@-#9yIY% 8u12020130XXX<6@Y`PK \J'burp/IHttpService.classM @ESsJ[IZ/aE~\>fjQo.ý@$D87&Usd%vh_ઍ$-F'DTWm32s+e[=16K)!" - PK \JM3#burp/IInterceptedProxyMessage.classuMO@g-_("~'x+%Tf[_GُϷw p`K{lWaug gPKGȾQ2ٛ۽:Db vﷸ`u*Zf'I) tvӶZצyJ3W&|eEyqh#dt(`P7qZ§18{Ke*Bb4Pjd}*0X(}<:ώ;U2;^=ph ^RLt1u|ڳa' ^^'G;OI>?&@#d>,-`-&O yB3B5b׉72\"p9z8P܆4NxI<4A5iPK \Jcburp/IIntruderAttack.classU P;fZQuZDBdV/D3ǵIͅs/z?fe-RF4fxo.無V]|)s%flOÒEJǼJsc0,DW' 0h WEllB 6` mPK \Ja$burp/IIntruderPayloadGenerator.classu;PEwHObb!'*!`ѭYe|[{&<_fgUrz:k<9'k_Npa0 BS`]{{Ky~I0Z.3-wE\)#D\aXy~C 4Pe&.Z!nPK \J0#s+burp/IIntruderPayloadGeneratorFactory.class}K @DkF+fcp'rDO;Ws<8QP< - Mv2cÖ$ ڳBϷt %k m|Qh( |v"Bz7]Ҍ6GήryΧv2(9 v>іJ(TQ([E) ^PK \J7z$burp/IIntruderPayloadProcessor.class;o>CnvNv.FԒ"TF MIJDļt̼tkFʜF.h'ԌvrKS2s&yzAm TTZTSY'e&120201 #3 fe`028PK \Jx"+burp/IMenuItemHandler.class]J@ikU }z1(@B/=mҡllfևJ7*Tp0MakmgՓo b>Tb%+q͢IHVrnڶޯ U]/0.[2n L8.t_&+^VEDOM?) s)CW4 10{o.CGwPK \J`3<burp/IMessageEditor.classUN0E@)7$"CDŢvC*U(i*b|s4pIQ1aPrso[gU=mԻGf*b-(͖al|fNWÚpf P^Ϲu`}"L8[j뙊{z͏s>h\}Q誩a~R̟WqBG "@q NL.0PK \Jv#burp/IMessageEditorController.classu@ 1.H4M4&2:6B8;|82ء_k|:pxQzu)&~OYxApxkJl?8/ 'St#Ȕ7yiJ/r%*-EY-6?ajaWYxL Nu@-&X.z:-7PK \J`eburp/IMessageEditorTab.classeMN0KHh?@3$"ZD"]9\;]C!$ypq })/gqhqm+ke^Viy0 ۣhdo.UvyY!NWedYZ.^}"UQ4[MISva*| ! Q5wLٶkqj Nng+LK\QܶM0]ܘE&8 x>C_ӄ~PK \J(#burp/IMessageEditorTabFactory.class;o>CNvvvFĒTrϼļTF+ Ң}OTה̒""(Ml BKS2s&bpKL2*؍*bd)IKOJM.acd`d`bFFfH21PK \Jչ?.burp/IParameter.classMNPEϡ@yZL$I-FG `!_sQsR:]µ 2\!m P|̖'Q*qH_Y֓^.-b1V]nA]sd:}[!mXݯ ;ZN;Ƃ}Ã?C(Q Lg "1m 'ꆣ׊ 0_R>dǽF%gFhm& oim"1H'*cAXp q55z w2 2zpaGzigByTPK \J$1burp/IProxyListener.class;o>CNvvvFႢ•J_ #1=AY#'@3$(9$5Yf#Wp~)P-3E,Y\ZX" IKOJM.acd`d`bFFfH21PK \J&֝burp/IRequestInfo.classmN@g)AAA<5&%V˖@pEVYnM|5/|JֈEM?3۝!`+e 5ZmMiQ*)lٱ=lq,KXͺRhY?SMPk1SCMU t.: ߂R cK_S.U.6{fiw$1t-\5e;]@iɚ Lffw9ݑ,bs#a |/Ԡi蝎io_%C#->e\Y=JyΟ| 8,ԾGD w=~/E`$#%A91t3@F8<)| ĝOC1 ̆9BXD^2 5XэPK \JQnburp/IResponseInfo.classmOJ@=Skc6vcp]qaA T H0fD诹(f\s&c?'{OIJr&ae.\JcXEb+M %EV"ҀcoU_e!+p0E [2 c愅Rϒ֕.èw%gM~ۧi6A=)Uaa)m+߂zK~.]Ƈ:{8xyOpz2t PK \J A}_burp/IResponseKeywords.classeJPԘ"Gdcp]qP ꢫo 7fnťĩUfv93k "E 3匲__*jDZmTٔ4<"tsSXiekfǥE3хgv_+o0Yz^)O a<%3QʻRf+迆m ]Z/9$:N u G{|,c'?7PK \Jiburp/IResponseVariations.classmJPϴ1Ul +. ` .xK 7s\}(qZA8̜l??`4ˆpQi.3=3gdRz6u:7-O TVwpYZ*V;9H@f7݈3~PI5ɒ0͋blƋCR4_{3Sefm[;7J0{,Wz!îG | C(C d CɌpWNPK \Jp<.burp/IScanIssue.classUN@gRE=y.&TN26[^̓Ce+e||~57`Ѐ3Nf zpkH4t21hQ-:'B^XrQB&MF2pIpJ 6nS&(c r p./u*.hX￷$?=>9-FdOY_6nBzhs)Ҽ3Tf,˪fY6IOmK L_{@IL>z$jzQ )pw?PK \JTu(burp/IScannerCheck.classJ1'mjx.]<+ CjjHͤE"4?>Na^Hs%Q6 UDz/\86q=%z[IB=[Msn.h~K`J٪H;;q&ԇ ~8]HPh^hmf m_poPK \J`Ct!burp/IScannerInsertionPoint.classmn@gCɩ!z=RojQM 9rlj+Ջ>@Zծ^ç"|(G a:{N4P; Sw&4a6 XN#ɣ}9Y"76cKrPK \JpR]B)burp/IScannerInsertionPointProvider.classj@Eh)B7v)]Jb`>H3o8~8. [  `aڲ,g'ښFCNvvvFCNvvvFTļFf 0FҢT̜TFI`Լ"IJD\RiQ>6  %9@A}6FF&`dZb1I&6PK \JQ!burp/ISessionHandlingAction.class} @g5,|m Dxw,|JFfafo^}]= aMˍ2a4/.LċJeXꜫk%,&c / )v|+Y"o'T1aZ@Sfi5bVn3B~nM@hChom[|PK \JwXAburp/ITab.classEA 0Dڊx\,zRR d 4E"'Zμ.qR+BZ;~eR;kYJ(GX~=~wǽWz^z@X_N4.!"b1sB8&PK \JVburp/ITempFile.classEM @ _JvcqJAn\Mk*#uZùJL]h 0ECC:]I=qʖ K a+WMG)ύɬ:37psQwʜLYYļҩ<ȃ% 1±u 9@WMiW\-Q9X9PK \J8U2burp/ITextEditor.classMN@`(3j0!ѸquHi:SX>N,~səϯk,\\3rnnk$aw-waYeIo?16lHK߆ c|2,xp "^_P2TtfiWj_V\k0̽jN?D/ٰO<n~p(rFV<v3)# ^ 2bcr 9HŸR9Z'.G{vs&/m< :XAiL( GrmŒgDBӽhF-F;~1GFɟ ƒW˻@dZԭ{~w!XѫߺE#ȴ>kdSNՏAE21G2>~bRE.Vdp?6fnkL,~:q3td;wPK N[Mfeign/PK N[M feign/gson/PK N[M]t,feign/gson/DoubleToIntMapTypeAdapter$1.classRJ1=iǎV"mG]KA|0ꢥ w4Ӥd?˅.?J3vF,!ss._NG+XXfc!gdT=bwGZ9:X؈ITҴ(uJ%nQ_]Np=x(|rh%WJ,Q$(1iwMR;#7Q;O܉ 6I|cB毓6-BGǡ'.e"{OQ ڿP^#*x-̃(b"llL޿1T)Ɛ{إhBXI"6f)j#C (4^oȼPAl.nc E,i4[(2S_y dS IPK N[MFӐnV0- h鸏R+9,jXҰ,`& fhW7}KL&n%/X|usUs۷@K;_h;wXf|h&K]HN`:dl':]ٰr~j?@868/tW-c;Lik̕57gMϖ@m2ȬY -$ ܴ3Z>M?x=;D{4RR2[7pR#]KtF*ԣۮSkЗ*VFtr6t2x|cʩJ6 e3Pa|(_o$t#^XLV{~iKXcI(oU7ڳ ,eݴ^;xznYm#vRiqwטm,X|ղսͤ4tm1ќYсXZv;MNF̨yT]a S 9~({]f P.yV(Ôz'hC2%ZXɿU WbY YGCNT}IEj.q&л9D&e彌]Ӊ cO]]Dv. Oet㿠k'BXOU)D90 4k ~a/r%iFUD10pZ%ڭFʞ|{mt XlG<\ƙzF0U#{[3RP,gG`c%DO4yB*!PtD[PK N[M;,Lfeign/gson/GsonDecoder.classVSU= 6. D EP($EiZj0-je!ݨ~B;c EgyoC!0w{sww? `U}1:cºq9q Kbﶆtt#aY(haEêM\Tb+}CFAW֩8daLJ)l,ۙ Bܢ ^p*JmwřD9b]TmWpe; M"GʨY4$W_;N)1ląŐ#Z,1`̠d]Ehљ`⬫(UM%kUۙ&Z*V I2cM;g !,sȯβ#  zZ E5H j&"nK}3TZ`ZU)O4|ᮆ5z#Q_ske/9H=M Æ~ho3|.bb <_,Ev@ (I 'RdDɳm? P,'ϊJO:p5cC(xE'9`Q UZ#^%@Z ]mpwޤ5Dh;':Dԧ-h^8D ?Q3t+59s!Aɼ:$\7ďգtjw?s(<hq~qACg59<ogY "<R&Hݢ,))qL,siYH<^ j$V4tayٻd ;*k0 LQW_PK N[Mfeign/gson/GsonEncoder.classT]OA=SjW| *nQl"l4|.C]vkҟE@|wk[ahܹs3NV6 99 dhᾆ ҍf3LZNo6 SW42w*ågMHv6Ql;!oxگpK1Zc{vuLG&Ô+܆z;DdޱHPI_? ʙQ-W1W#3v d-"k1Tt!r/#E^˼ '*eBQJɔb[mώ:ꨬ:e=iK Y䄊bFj)^ Z#6]Y葾-K^ :⑎ajXeaF *:ᩎgXF&??}V <Ͱi;Q.N(ԍ?̍Urb*-)K](Z=$BoTP~6jQ ,3=f(*&<}Geo$M1 )ЪFsQ:;FCH#Wb 0hr(id(8JhF)J':FPaz:נ.W6֑1fl8g!c& wsUF9\9?҉4%+2#hG~8mH"5:.iWq\Ѐ  \0 IW :ω&:IQ lO+K * .Wzm$y8z^_LF)Yld)<ݗ%#BGLZV!RKUyyeYi @=rU)C!2ˉ\mUGi_+Pq־4+m"e`#1e 7FtZ.DZ \0KeT JpV_ Jjщ9#:عP&`׺,kCk-_"h)\7pD7M܂mbncw1kbxt0ÆzXR%rܚ lU4(Z /rlkcU4bۖ@d!Pȶ$8Dz. wz53x,âzoCM/5S'A7~]S"^U;{ Tϔ-X%>?ל@(zB_4qfS7lgkdM6$ׁU$AGI{d);0Vц*s}S9(ű*6vEyͯ9~dp8{rEdc9bnrgh5>4DKAKPDu7*~_7ߐ50ՑXQ~cا)KPK 4[M.META-INF/maven/io.github.openfeign/feign-core/PK 4[MאּZ`<META-INF/maven/io.github.openfeign/feign-core/pom.properties1 W8hԑ89PRk\E vGVJv FTx IA-|/_zQ2bIμPK ;~[Mf 5META-INF/maven/io.github.openfeign/feign-core/pom.xmlUo6~_q3ePd 7u0=κ>If"*I6;#Y6~xf_p%/C6X%BfU& ^sʃh05W(2 n6:1J T2A Pܜ>0~opPRY a 9c, "$Ī(sev5n|j.锶Qg<nǸcʔܣL8]Ni@l=Fh h\ MnK i;j;-,I{Fv5B"bSَP 3H..?YlՇlugߗ7k8,ֳ p\g`gwg$} BDE-#& VyRIc2Y3LQHJJԅ0u1 K ܺKEi R[-PJsoJP{"b?|o ]lF0|E ilʈss;b!boo ѹQB%7mqر՝3.FNqUUΒH(Qa S%ʴqxPHyl]Öca6uuX#?ݗMEYK>[M W4 łFm8_8ZhmrL m'ZRDHӮ\灑"MQ\qP$yY]Q⧣'+?b|>U]x/Zn*$=C#r/L,GF 2e0>u!Mi餚Zqݳt<[Z?10yFWv=O'igrg=Sn,jZdwL 0H!gy跱|l:m*MWmٓ[>ۘ\TW6kk.:)syB<Oh iOըVעPK ,[M3|0feign/Body.classN@g BDAtTDr ,Es#(x (nVHs_c\*S0a~*0ʦڦ8+o}E8 BO _Y9tf?Ib$ غ@aߎz:b'(a{ I)==wPNmP5"tWɔG8M\ 9k<4E5}{(-btjblaPK ,[M9oh feign/Client$Default.classW |Sg6MK R`T(,-@R-0 ̂^ڌt-msʦn86@en|;us:~? &)I};＾^.+ aܫ>*|؃}0O <`#>,|?>uV |8GtI~ʋOq5p؋QE}Ə#x̏[Yx‹>I%{̋>܌//zqLe~I1_VW< f>\o nŷ|wi{R ~ Ї0Q ؏S=+į|xVU;W4'T*Nmk"k'uWEvDv5-ݝ݉mVU0~ F+sQ˳0ڋTKXF+UѸzh+>%FLug7IFuEhJ`Y[#C1[`vV2R&wnp,j,6]Vm37kh"N,:!+en별 c JLfhB.ӊywIɅɷ{0%M[xSʸn;һ+202TE(%rҽkƚ) 8uѢ}u N5e ޲nv_*zP6ϔWSZ$ĦmV_{$56U&P9{ ŔE2Ô .%,UIؔ6 ܔnH;rw*9p@ԫMY#kR s7&P`*s8C2^eXQ]_?LtqP<NUC"rǗ JY(zp\Id26/0㣒e(sqcYn55X~0 93c+1#Wa ŰrKˉ0 5W|w?)oHȫRFQ'PEb3djPv}UNc0<|9ţ|?˷DWY>|41ƽ3k<{1=`Fc4?<7{]+ϥcPqQ#5M^DpqS UԸ1. T¥L 9z7ƫ ̂Ԇ|#nݡ'%dDE:>"iWk=pY{9XtkxۍX,+= eNbf0 3BOc gK*5 *#&-B$2\-mHJ';5)}-p :فZ F70>*#x+oy?$y4q!qͩ1H'~\l/!|ЎK}vWکS: w.ZzoD+d\ϕd"nKNro&!Ծf~qT@iK&9Z l0ǀM7<@ L88Z L7pkZ-mr<[iI] $![gZF_^xyZLrM GSY,)~{\<ϒXz˞8p!|+r5 x@WN- ccpg׬Q]uH//Ǖ#'@qTGBa3d@++di i\]0;Je+Lv7f|fL`67^܎}c|ErX(OɃxm<]>ʚ}{Iv3cY'YiѲq-,}_6-_LEkݴe-)z9]%&C>k΂1_w1ZbŇu( uf{fnP {x pYǕKxPK ,[M,kcfeign/Client.classmj1թ \Φ,m 0` W5uP׎sN?{/)tK]@hMjً;Ί }tLD~}-٬\<篂}Hq| &Ogo9!4w@3/˄vyt)/{Tc*NkD^&ƧO( GLOsB*]#*85ԅB̦8-+hNf_葤zGPK ,[M9 > feign/CollectionFormat.classVSW]݄ >PBS-k4 _Xlb}|~ә~Йt uS?so&if{sܻ?ƗA(0B8!Ƅ%q:gjqgkq p}0q<4&ä)[UL03*:T\SGEDEFL]*bS"G7F%'-{ʍųc=;3 ;)Fpbx`PƆC3 V̛^yɌ9;3N~>ڟgG \2U`X|NX I۵q+whC ]謎'i5*)!];(Ri4(\)#:]̥g;+r.v66ˋKBŢ-:_2CrҶ Daz r/΄E?B2j<[t %DU<_-qO :3N9qrĊX7pj]'N2|:b u!4tgbKa.kxW4lG*U>C> g@ۦsp 喆_{KVl#m9 jU WBwiaU~<*U^jN;Yk %lc * }-.j/'۲r!6 eOiH%`rKT-ݳ29HR# i"UuC(cS޴ԋ%t>j.=o>B =p>j7b1Hz;JWrfrk`TÊ*RmJuT_ I9R}Xgy7Ryl0Ryl2R|[;`s7؀lq3q;hm9a* PK ,[M[9 q!feign/Contract$BaseContract.classX |TOx#†,Xts!Ba Dclv@jֳժhG=R-Z[öV[kE$H3fLB725ûݸ}. p/p _W4|UR~͍<{Ѐ\쿡ᛲ%԰WRG6wcrO{.|_N͓l~(?3DzIs.z~Ƣ,GmwfS;adkٯkLX񡀶FԪ@E G12Az_S5yQ`DeD[#$XG쇧@s9sPGp Rl9֡hX`eXE΅5]Vw[4 M!y:I%5h/1=tx/clϢJcDn:ru4=/05ǩ@"=d0"A?Ye]ubF=10l6;WpDgu)Jb?rir@q 3k]Hdw2hvyB# 7V@oOy)+gN(~jo__ܛx"{y4B{gcji!s0x\Ysb^YF_ԩOհ `"idIćtv-uFMc3VA\5+W hv-j qP3:lc[hC{8T,&s*Qp`'46(lt탓v~wzՕk.̒[0*Nh55zy^Gm^QX%;sp`qEנUAxc|2&XԊfڰ 8lڏ{QەD(ɘľ uyl+p >L q%&,ƝX{Ј,,3~8 TQc 7OEF>F]_Ey` Ζ6eւ\ŔFQ(;pjhѰLC>4t$ F.CEPzB)$-f/+13NKwFi2D<9EV‚Z[urGLZS]YY50ee+a O㩸:(I>w^ױ>Y۠UT4a~z31`,hA`ghp-;P]^Wۍl>U{XATpα>[+)t~԰d8̜':Ԧt 7L+}Tn[_}sbgARsG01ӠA,go-Bɶپ< ~#"\DE0q)ˉ Nva}}}x18D-[E6PT"1Fq8 2Q`C*ʑF[/B8:48C$ &FM_zm'̷%\ xv%(#Q(k)3jkDw0yL8Bws>R$&J70=8JyڬN y J "Ym*dŊ0U[ ijt!VS3W*,U*|ZrVڳ4*L| Kc)ϗj[cXz*DzXǥeX Gfa]* =Kd͵Miin .+ͯPeULS=MCnJep{tZA+.7 Ʒ-=w<{׋~ŭty_pA~9σ}5W<?e0|~*L~&K{Tc^~7~)% 7~7^To=~/AfIϢSL?_7w{ƋgqXs2xލ}ыZ!/)/Oi(o=hī2xC| xG<(xaچֶ[.^aM ߴIۦU&B᪘ޥoZ%z,RKpՅ"B=Pv4کF6"zK=֦uy j XH֤#eF7 [q5mC]H"!x|I$MhP42b#mz;_SKha-UeP֊¹ݺ֩+#m;zXZP)X6fœ0&P'ź~%dgkrOs,zPn!qx +ք :9l荱НL<s+Զ1}j0Dzc^= ԲDЗFҬ%z,% kGs; y[΀rω?~x[#;V *8F4$l*->⃺aBb?=*?C82¢n}{-;0zzߐ̶CH$zҵvYjCJjyOiZ4 8Q Bq Ka(R hXĻLD(˕\|D8^wa4{Z<$E%7YLgF`OXab]IRه섀P8Kx' jaI|b@XGTȥBn_—U!B^ARUʥ if ]UE>ĩh'H[V%3D) TaBcTKTx”Mٛ]Z`Bo{L #3)Mƹ' / %ypE[۪mz#CJh";&4(TYT2*Qi)S*S3PoRiN ۄi2Oi2v؍F=[ ,jüS*̥jIo>WhQT:*HŴkuR=-%K+ÙGn/OVOTj\`}yKcY\Ż=b<F.ŴM8OΖwJ%/(Pxay`FyYJ-RU|~"LP䀯cÑ hF106HeUt񓑞Y.ZJ;Va>>rJlN38۴p/WՂ@Y#i1ο@Y6+ײ<`G7ePh!]Y_ ;6YNF mXXA'%aV&C&::i, dԞhK蔱-tZYj=j8h[n-*Ezq=14^D 4hd9[8Q^+,ZȈKܓ+7չñ54B KԃleuM:>&硨9Æj&͒RպX/@d@19]6ܳ~dk98ѝBXJ`8r9ގur22e1>G:h#E~:(J0ǸO$ffDɟzXqB֠Wa:kH3laT9V0fy X/1ˆsXqX 3Ed^etl4kG٪pko軰υlYLQ(`QP\ُ1җQ8h={@s?}[0n'&o|Մ}+;k~Ly.<(MrSϞ%vֵd7J̵~Lki~g}B!E1䠜ض>ć0@HE&[s;$Wa _c$ћ:8x-81~z.Q\bN`/0zп@}l8"d{On*'|q|5qF܂⌲匎z9"l9*FvHvPsoܳƽБe\t3gA BU ^L'@5|Sȱ@͉Z|‚M[.*W;* WJRE>@UMs|q}5yc`,]e-3ZYwc4q9!kyGQ \ H/{QcgkTٺǒ cg&® Ujn\X$^,l/ٍb^ھ4s2!N='(pܛ[  ;c"Ơb6CϏ4M&4R!n"ASqi2Mx*UpMd\12l'q,3\ %8f%S &8Jih@gjvy jRL_L "F`Bd|/:xZ@+tbmbc?9ߏ3r@Bjc.l,ppv.(~+l؉|@z>gLη.%}hCK?V2sОSwWܗ 46T dZRarL 9CSJ)+Jf$4 & _5k`;q:isfĽNNZ;+=vS Ys;;]d^@o~~cG 4oN\hN1*M\9|VO5w*PK ,[M1hNfeign/Contract.classePN@}~!C9 2< 1aưpJ`bK)ޞ'IҋaXy,==Gwwk妗]+ҨJ#,i UdfZIgnuxX@L e\gy '+D 7W{M MSGkFu^Sm[B 769Z 60:-/tc;{~j~8b* J㉌=S)pU׷̓U^Y`奏yeSpo@dP~XLk#}BUdW-ΏxH0 x}xdm+ۧ>LN :z:uػפ`3 ts>Kq%tb k1E+F 7=Zb 5CJuS\$^痈Zs`= )b b>ZZ)B4ktCh4twR*B tdnoN9}~fUqܢtew`k#; \"ݪ&5ҸOJ9~p4us{ fWǗhY*Oa3x/PK ,[M,%J&feign/ExceptionPropagationPolicy.classRoP= ] ݜn-Sp lY0X,~ztv)RE+g4}2q:sϹxXS0 0F*% ($~]lGuKu؞{'ˣOϱ͏~.ޮZ &*5L#!4CzQx.֍!c kqx_hY+[t5֬gΉ1(##n)Z"/uKH(bC6岄_F,/! |l v,)HE*GT;EҀnЁ3*ϪCC4:Uܣ$ULht℆yNgRW4,p:Ob5o [*ķEr|?+r\#*U񘆕FƟj?S5xB/4/UJzZoT<6/3N+a!3q]FX"i z#M-m]&g[/tamhiHyЌRI*;-˴;"F˂ǹ4i~|g )'k zznǾ<~ Fl5c@12"%E A+sM߂w̑/+kİFZ;9#\j0a^ƒ47a$))a?7m>t䷲n(Mt27(Xw 1Reې3ЛQC=LYT#`F#"yh[Pi-z+_C@Z~᥃Ĭ͙q+4jGX|35C{}4d[3q1UUԩ& 8؋ת8Kuxr )sgKt<x*xANjxI2o~TIrCaa[P_*?UP.+6a7∮(8*E{.dbS$8RGM0q0/r̆,?ttoex(LNr$&bKhh*Ib)eIJCm@Kxծ"Xa` s81Dz`c`ّQ|)1RVmj;3#V ZhLB;l)AS=.q]&_ur` J]&|H]@SxU!ص>`N6]&Ys@>`"$nDfn$0Wn6}L v l7E [&-Q aπV!NoT$%t-"} }Ӂ?G&lҏDpk]'1]v/^`\`_%}>`" Clk 4G3 Ȋ dL E6%lW h;8΢r7a.VJ,g9Ro?\"s,H?J<9%TI***i+I]EE/Z/b857{Yeǩ>A))=6-^,sA 1( A9;;g;'x\V۽)!&Z&&qf""؃c!'ZijiOȏE &^",Ɵ>ʪcW2yFVgYk=@HDCo6^pER3ȘK].I`/53}7Wzso\"rs/83o/\NٯFe4Bu9ꂉ$_,L0y}PL)5t-PPe⡅\ Wea; lx/r $h-ޝ/{8Wi4# #jzM6k e0zgmr:9 hjJ*C TEֱ%@ fc/[%3,*v>CtB j@{` 6n&3n1s4GlU`_PK ,[MS/'feign/Feign.classU[WUL2ʽj[P'!!Z+ZB ZIV:C:Ю;|vٵ_|~g%Ҭ>쳯{\Ǯa0GYaБ¬n*2#[|cYPEzG%E쮎!4|aEC^ܺתn]Ze#=#[pz]0#dTx7ytd$2HL4™hJFCJ?l?U $tEpXqw#`y2&.c,0`1 HLRz7Q ) i a S`J( ?*N00X6ښbÖ5 ,:i}plE҄VL(BxKty3Qlsx[#Rz7JnGqEqKl" Q,fYJQ㞆.GE4'lXfc3eqM˝3K!S*A/-WXQ.DԌ!llO s{ i"wuY4-٩ZfvM lǥ۲-&A)l;)yM.5Kh֮ZׄZ^%64Dlߜ[,/1 'u:5tBUɺ#Y+9|bxQ+8n`R:m(1[Wq@ kb۠o{e8lCZ' 2X7q#<69~ވoCӱ!ɝtDǧ>`H3l,v㈭{Wzk+[\wznızȡjڎpoe1Fwيwbk۷U]P koTe ;S2G0}}3P3&@&r^3|I/+7t;ς=5, +>Oe>z߂8Q5{RAM$Z|WcG7\qͶMě̿l6}zRztDnx/>K8̷ZΣ9\ʁE,=\D2 {e8Z{a%({fH"^:q RJ$%)6\ 61-5uFZ?W*KI^!"#FԅMA\a_b-I"z|0 F~>ĥ=) 誅y2ԕ^KFT6Lx+^GwO~eb{B*|bϱW2q'D&yt'&ERPMt?!d 1aC7ƩfS[m ؊GXz 4J@7x|~eg7Bg08=&gC>uQ54Mq&1.K 򉱃/PK ,[M4ӦL,feign/InvocationHandlerFactory$Default.classQOAۖ^{TRUķ#@I&Bm{v _ϢO$Pٻ^nffwp1 U9 J[=!;TcR7\uC<0>M>h 1~N {wć~#CP*L"gXJ]9r lY8jaڪm#aQwriV;T4 ߣ:$&4ON?;l(ցhJ{ia8(9xư>ʱhZW!',ΰ=۽bw3:azeaejc .rP*94*Zydٹ`_Kk1 pJ"YKˊ?6O鋝 ?POtׄ`ߖq'ɻ^c#(G:Ȯ@ysbrx/PK ,[Mu+3S2feign/InvocationHandlerFactory$MethodHandler.class}NjA6_YOB"-GQ-qeFf7j~-? ΀ /UT@(P!ޚ/&<=Lr+De4Ye!oTqbcwGR/C2c>IFxx[)g+8/fOdrJ_7$4.ʚfo!?'< x1ss(0.1(PK ,[MxS`#$feign/InvocationHandlerFactory.classJ@5kj7zQsb)Z<ILY6|>(V]f~ : [ mJʕvfRJBk(_k NݣA*yfx0)Gu4x5,jI\7"af 3U#g+~W؇O76Mkn'F_mXz};; \5 nxUæ[º_n|VA PK ,[Myfeign/Logger$ErrorLogger.classSn@=qZ6mIҦ@*@UilܭloqO GC@(Ĭ Kޙ9̬׷㡍VVmdbƚac,,2cl~ĐS=0ۖx1 :BOr[uĵ4I0!CJ 쇡{>%}!MSG[D+Q}qDZ^|TeDtQ\쪰/ԈP#Ϥ體18`` 3<I'&v͐]  Kk:07:D@C jWD /":VCNLd=u&|0a_$0_K$vSn6[|ɀ"\L s5?`V'9K' <)VSV 7gm}mz-cc_O1|#oK1eW2YbH,oPK ,[M{0feign/Logger$JavaLogger$1.class}SmOP~.+(ɋ8PM  _$#$Owݥ\ҵm1@_2!c[ޞ{svċXPX'jfC>9quDŽ`培P 0 q,bLH?le r8^P& XT8aޕx7u:ᝀ4e7xpʕJCgPGYա" î^5Hd  C_|^{pҶEFR#D_jL;(OIl~[P1D1y<ڨacl̡IeZPs!Ħ-lhXxl wl^?GiP&<}vO-nCFs+D]Er,`ⰎՈT>=AvX^ϊE=<(0I /)Dk05ʴ.e(JѻH)T?a|50[%,sXIQAVaT&瘅PK ,[MD- feign/Logger$JavaLogger.classVkSU= Ðb4j1& ( 5]&f6yh|7يViY)PRFY擯cy̰frݧOnxO0bD(hHa0^ "JIL֠aXkmF.kxRuN.WU ox[C3ޑwP1"]8mԸi\N e QV<3\_`3@mzTwv( :`wʴxqq^Ƽœ65>C7Q T7nvq3nj|d+.ؙI1_f;) y.P0C F[ݳ] ,#_is (zvZ= :2Tp&ζ&毉tڬ.Gps 3yag!Sf7c.vƒ%y4$%p@]-L84 )E@!pF:1HFłT\aaQQu8WG'u$^ĹDIK8z@ _&wMҾU4ϲ$ZJhr2kVm:г$?y u\,?(_L?e^EAϸO?.H*@!,/VVa,tq8PK ,[M앚g;feign/Logger$Level.class}RMoa~^Xe-ZVhiF $nۄxYd 5M(/@dfyfv~: !HVdd,;˃}砙1Ce7ꎝbuPDZ _C;sol/x;qbPrġ5~퀇(2iKu nz% * 3O2KR ~{b0*w[NSqk>S.)igT|Vr>> 9S6b7[ Kr.a/fyh2֐A_"=d>*9<|]cZO7ݝLK@$&ad2fF!N7o,+eM0ūu<bG:Go CZ5Ivɘ=* "yg/^@&L=m/Y1uv\ +xUgUWqY{2geGFL̤S .l]_?wGae;8 ̙)4F:cFc J42$mYBӺi;U $xHo)'p⩦<@:z0̊=mX_Sg&o=e>`%d:6fx)B ;EYSRoJ~tLZք̼З0{Gx#Lv(1ÑH]T;՟9?\R6j MAM~j^<9Z9(i"ZLsʺή~RA3>s'ls{@ StVsߴ 5UؑQ`VMqn3vLS!ښ{MT휛1kumM?a5DZ9ԔਗwwnRex԰25V& !Y2JǕ㄰gЕ{pny]XxZ.a.仧Cq]E%rڰىau)\ Iɀ 020D) 1R} u Iƣ(;fq~vg.&9'sbt1Ea4$tzrqݓ8*.fjsDq;%gμ5`"(rMՅ-~2%ndY?bNй"0!fӀ  `BZZA*X5X f:Je.܉dNl/Fuyr~,؇@(pY-TƩEayM}9ݥwnDc^4-, |<%' e Q Q1`ZH윏Qqq-H:XH"HnV[`N'+daJ"QȊD!+VCKe+ +W1dΜ Aetg8 2GPvJ`{qqRfDD*&eMNzMzJRX@:b,@[LSRBMke¹}q!EKh2[4#GO{\Re.Tiw̪4lVIB*d}<³B 0pDz) q)9g"R0 3*̒#sPBLL$$THR<`aWDc|Hǥ^վyќ \^-Q;>wQsqp';獉BݛN;fm|f=߷|Fymz5b =W' ڰَ͎3a]gn4M7Gy UmoUMZܥ?Q0&벤M}ߡs'/|RSgГj<-8#ahhk" , I=Io$A:)4|( I I&/ H0h]BBgf I$[B/@AKI$11I)=\dO$%$qdV$Ht!$<\9I^HH7fN kgȟ!IR\;C/1+ Iҭ<I\Ǣh  k蛆 H/R*}sB/Td}BnR-ö+ݝagwZ=#$ٝs> yo]g밟g)>N#-JݎPK ,[MAdfeign/Param$Expander.class]M; @n~G4v)EAr5>CB\eųYx%&i b0̼?O*}$L\UX(CI:V\L/7:+{ey$Yj6Gl*K. Q&`BE+/PK ,[MDߛRR"feign/Param$ToStringExpander.class}Q]KQ=׏]]232{Ђ 2z`@7ލu~VGEBE/sΜ3 ;RXBIdžM\*_0$.CÊ-{C Q1? C}O#W1J Df 9Txw$"ϸp5n{#Xi$EzƝihhS/d= h&4&QcZP+~XGs\y.6GHEhQQ"d799,ِħw,Hd(_a$UelioPK ,[M漣8feign/Param.classQNP=WR|!liLW2rK k.?8D.y7Ӱa[Î@tgܓM@J)ktBX*kO/+Tʗ 3i̍1vLX*2]uA2t#UiHOvĢDa/>m{z0f0T#emj JV#@醞EÆɁ( .پX_mRQۊPc[/YyU&KLu(`d\w˞KUZMH}˂wyx"ޙh8UͿރ~RENe曐\40na`Yr[@X* X{b`L2a3j\㳉OPK ,[Mc1feign/QueryMap.class?OAp  cƂh5vV$(V1\,{Hj~?qP;{|}|Ƒ}> >$]^ SNg*7Γ,'| 9W=5LR:=7CkƂpPdl?#ر- T&lh?3:YI^^H8\S5 x&L>,jlyR#*5<Kc)֤ - !5v.¶ܭ_PK ,[MZHqXfeign/QueryMapEncoder.class;o>~vv^v>FvԴҜFϼ"bFԼTFe IJDļt}kMPiIfob5#gpfz^bIiP'a6H*K2ҭ1 /-JNu,XZT v[H #hZ*r}4IFtd*U##08 f`\@f faPK ,[MVRfeign/ReflectiveFeign$1.class;o>nvvvNFҢT̜TFԴ̲T<IJDF~׼̼tԒv.F4 }4* lɺ+fj/hpgȵ*@3$j}Y\'.4lδy}8^rP7Mp+DHb ʼp@9n eq4љ ȩ ,/X#VM$A -Űo"`-)(%nZM+oUF٪ 8شH빏^*"+Pyi}dj"4vv02ۇ%_ E$8a#+ Yb1tI%蘜琂}+[A9#: F%ϡ+#:^N~%h=/SDR?%2MtgfR,;sȲ#,ckƇnM 76Q^} 'YPK ,[Mz/J <feign/ReflectiveFeign$BuildFormEncodedTemplateFromArgs.classV[WWN2Ʉdֶ!^K(PCM&q2åW{{mW+V?]3. >d={_~pƕ p $pB!!%qas3 L!LaZƌ.u|wd2hA&fd\FNL1 "rzLl3!Gg_tcT,FTҪfUSW(oXXUK[ iD1qu!ObFO&d.ieKgF R^5Q,92QFty\=_y1e>,-(Trch3N`/˔M*2.bn6P Y6C1ai"^C4O}mhWw}OP@ߢWd~ N48M̰I̱)Jln5I!nw~e/' H:I`ztiz=kWo:'I :Vm8Y] mUE} ;<7d4'd4Mo5`2'z*s:l`0d\HøDq=lG1?J02ȃ ס_k EhPK ,[M33e X8feign/ReflectiveFeign$BuildTemplateByResolvingArgs.classY |SyYろ @-\B#!'`HB%J5Mleow[Bl #%}8}+m nmnk ;Jd HW9q'^> 3[Ąƻ#hD;'?D{BWh(R<8E&5t-8~Z)FEև"8 f4c| O ϧ"39"k|^_/ %y|Yj|E_be(M܀(6yq÷DrE?G|Wߓǿh|_ w$GfS!;d~;=]wWABhvCI'1>y!Cɬ׸xrݘά8wդ3)sfLP =L2;?TSd>9(wigµ5cd -$Etgw'eӼ=JfNӲ6Э$N:s٭RUL=lNB} Y'X'6_;dtfh=2I:͇B.3oxg?cM֫/VĺãEwҦf涌A}]"'[I@sƿi#5B5e"wv# NX>/~elrDsN.'O{ɪtx23VCۍD7+,s\o-_d<71,9+ے˘}s{]W5hmU2}UG8T rI:7Aq)BۀikaX{eeBv>T߱n/"s՞LP4U[5a w?)9NR cƎ*HɄڇ7&̷#h)jtrySj%tX>چjj@Qa2bYsLb{A?_S1XT6cbmC,r7=Uz\Qǽ‹\ꩡqNC]oߡk^ X>eoKKhFp'Ǐ\oݖ,VnnCmU?_o (E ?4^8g켌Yfn Z rh^ñƪn)fj *~YIyGgg*X)@eQR!_E,U)g} X&ÂZ K-P jTZ$fK-V-jGUZb*f4V;ZFpXxl*"~WN. /D9/~ Zjj|>yXj.PZ*j^j:_ȶ_3VoKXUYxujsvk&]֊"]b͹q1{ꤡBCLpt,hneN:{efe;¸[bJh`/j@0(ӫi9m[S^fndUT)\_chisynuԯH٥w Ëx1[4Q͐sx;=t6Ò:`'t٫ wM]S:Xwu?ot,0_.T.$قtks4+rARZX;a :o!,9WjP튚i#bůu{igk0B:%w},"h-X h@`-Ґ,ݙgIa>ӹ3c|#ȓO?SG ux8t$B3X!4 GpX0v N g㗷ci,uPjDMcI)SXrzbcTxaC,h\C#$28kp=8^FNS iʙa|?GQ 1MtÈ`o T{H7rwux ~0\J w\_!=K4nHj#9,HR@iMPKX/Q>aI\v+v3QbS׊h Xa \V%xv'q=^/13a}P^\@1dcbݣcz$A6}pYlGB'0⭡XȻuPDOxm,hfNw%Nbf< `?kg,3WG*b (SgNc?|E _((BTMTݎ#O P;{~v+I4[985P7'v*IO6?`e>Pq]RRh6,u|A"Ƥ~Lű/PxT,ZJ"/%J3e,Yk t 3,x`w]i\Oxj0%Jҽ1~g4hǽw 70/{xWoE2Q2qkMRi$9v $V :W0zT(.\#Sov!r?DH6*F4?p:w/ <_a)]5[ʺg~Ok=XaS,0NR̫W hG zZMd0M-N Ƴ`,X:KT"čdMjB;#թ[ئm{RT y cj9ެ.cLU `=8[VB~~fOؓv.8\i2ؓ6 !r2mS^iu+wej/3E,{QX%&~p~>Y ?nic$i K@k:yM'L],m A4&b&\3$.MY&LedvB!&:85N:k~Du[Q}R] 1%>Ae#bAe8:VB'HmqOMl,l gMQħ+ђ\'KwBβ!c1mcR\2ܬd;r_cIDknWC0 _rl<ջ$fxX* Ն ƆdxNsM;/ۛ*ԌSqsƴ)wRAVWP !8nYp4#005p1יWD&_ǔ </ͨ*ب ,7Rق޵]M *o᨜ΐ,Z91R?BOD?Ah-/D DgF^1q5.d;NN$OI(§$ΓꜳT%ɻD+n1lms$F_h_и+xohwpbJ((ѓu6;؊vy⿢u%ũї `4z{-8T !>q,a9L”Sq05Ip *SRg<>9`+"}q_Lv\%/D/-5kT%Dst&v;ǘ#oo3X]!{PKo$:>\1|$ɚ|JM~QW|Gj&Y뿿OYk aĒEPK ,[MO=/feign/ReflectiveFeign$ParseHandlersByName.classWWG-$DD4H+@ZT(bvI͆Uk>>**~;$$);s;w~Ν>71/e+yՎZɁx|HaCA^ 3C Py1(>>s*䀁0k,@0@8Pw {4%!sPVԺH ESC e*-~)# !2˪Gʺ1zڢ\tr\Cu][jeɆHw#]R-n۶d_y|tĴG؄ވ險C]Ӽ%ʘ&Y5)bpݕ I~g®`i)NEÁY4Rܩy$+ Z B9Ky*CDQ6Cnuf*9h!4wX&Pb*LTB\jPoTH0aW72|DIXےj~I5tr6ˉ$ kHaf"dO%[ʾ G=rT"3jD<"VbhŖ4s_0t(SD3&+8c EIbn:,q E|3"O"y_sopᢈoq;Y]Qȉn׵@8T WqM,d\aavq6#pIď.gP5&.-fvA2P8yJWDt^; Y]/.~;Km':O wkFwOfWgj6N?T+UM"S+DwMU6k:&3*A _+y_IqrLkR;Iq&= hp0M z (Qqy5c#ⴌD\P`uZb Tryel v:d3>p lWk,˓ŋx8*|[-xKK_!}4d q_MrbԞEa>2Mo E% eܦ>=q- c (\ TƨzD;^0:ؒ lDױ )r'B7Ki$*ےd>BCvhe(-Y V0Ev.TS6 M}=B#xWP ClяM/sEvDklPK ,[MdB<feign/ReflectiveFeign.classWYsU:ܙI$0*dhTI dƈڙtI;RHi죯>`UV,= P5vssw=%2F3n[bF#b@2b7"X =! LD0 C`Kp j1)hYZZd`IARZ܀2#S.}[[SZ6Sf2=%LJ^+=u5A{q$zTEq时ֳԴaN+XS9ҭ얙mJx@AcnL}t:F̋p֬ NKxJOƴ@Х@kI;m0^^WKn-K/Vv/P6mݣ@C򡂹!~rSFS|ROԐf>oOٓFkM>3kkfpXj߯Mk)͜~t?U%YަkC'cP$7SM0B+L1m*W%LRP =g%.i2BbY e\ cH=8j,NLf>!ˋN$zdH%*ĠmqGBY3PBcw >ΰm-y8<(<* ƒDE6t't'*>g*>/}[.RRQR Ǒn V:rdm.3vg&-83iǧZDj5mGqcQp@4Ơoh G 3B[ }Ň8 GCǰ49,ѐwkxKsOhp镯m}Y+}`4`?&qs8K!DlB%h(Ξ={4;X nyl"{]djs-g;э\=ڌ,sy[q %s 7j>뜌w#{7"usFbf[^C~%V N/}>L. b;;:'@cƎj.l8B 4 t~ = _4 U#: ,S7?nbك - \nHZs\ȏfJm37D2PK +[MPZ feign/Request$Body.classT[WUNL2ҖʥI!kՂRU@6)LM'jE}!U.ˮG\r3L 2g=|߷/ϟo܁) [*>Ü$>WiP<  Yc|+\aY@tLzA f9ʦl W|j>7s]ɕͪky6*{+ֳY׊O,{y'WI۱)I}p9nS*Il]GvgVu('UYy8޶0$yqLt]=ْzJ;)0:w=[0w&2ğ.?"׵sm>tߖMg+Uo_//ۭ}OKdk[z">?M98&[#5b^!-fH[{ FY9@/GPj*| bD}S~R9Hf.ҦC8N 쒜G$8J0I2ii ;rv픢K%PV]PaOp0q1FrM%ZSg<)9EZ Ebss1> 8 :/IE(aA'"kW׉Ißbm0/ӸAJT:PK +[M(dPfeign/Request$HttpMethod.class}SmOP=ڕc(6Qtl 2 NGGY21 s/B䜜} HX Q/U# `@`9^)aR0xEc]Aqk " &gL2~-qM/ PӮar;XT<:gw-{ϙ۰>֭#7 Q!oPI_ѳzQ 򹜞%9_(f9CLQWHSiDM"*?6+uP4vQJUw,mY۱rmV4+" ]ylULgopkݕ3ʖYY*/䘇]]}CLlv6M0kITx_٫;å{\Q֪ͺ<,KHQ Y -5<# 0`0q &1,z˕CtFcWoXemցū'/_tJ<1O7~5G<xGDG)EF/:3~Q5#:xMҤێNwϽ{瞻.xH<-AnJ=,i2zAYAVeq8 y ÃJD<~]°gr]׎՞'dގµ=V4W̤6s j4MիkQjcrwZҕ"jf9 5P3 t2Թ3*Vv!,w{kfQAwtoe<9<*8 Ex5/b/+x*G$A44QFg^&4Λy 1W|ܩ^UpG$L(x8NԬ\jlh(x'dMTN)x;2ޥ{F{L@'TR7r[i1z%U#N15*mK_lk(M ]9zG*Վ\3 QST^ 6Jbԩg}'F"Z*5s9-c}#W+V)Ap:NReA[F/ަ M~W dy lLSϔTSNCyVTGr@ \/&F˦ruLK:%8Nxҁ;H._>>$+dw4;bf|su9!86U媫V\|hq=^Gn"-5`Ð@4K ҿ@WTvaџG?&f$],l9xnkhqR7 ˛`x-0& F/Er%t1 8 PL, %Bɢls+ifoȬ-p BwкX(; 2]zSsyQq TS(8VFkV>P{&R+66Jm -&fj\|q9@`q[ZVA%%dyqBs\Hdjc<#[F[bclAkKֆ!L*sy ~{/ |=u۰QQ[[6:3TJ ͵t*.USj1D62_q~_DD iY#81CBifirL\4y(Ƴ׮v ub'őܞ;xh+#'؏_p$~˞nXO"%@7a܈.M*eTtd;h2Y0 j9t`65?{? uG_PK ,[MQ4feign/RequestInterceptor.class;o>NvvvFĂJF) <⒐܂ĒTk0FҢT̜TFq ϼT`AI~^VbY"# H  9yIY%l L b1I&6PK ,[M6ԨQCfeign/RequestLine.classQNApQ|G\y2Fi\2*̚k?0GtdžUk 'e&,UzR5lvmG25thmӱsG%eD(68}"aݵ_ VYv ">F,5t^zX|h!a' B5rx7g4e쀝%nJ+6:z\gs ?͑J'!l-rd YOט4 _crkN ̣(qS7 Ve|PK ,[M#feign/RequestTemplate$Factory.classmN= P=L jlk(\!jkzMg_kgCx{<_VL FXLX̎A"MES¡(sw|\S>8UQ_A&¤?E(A0dT%a¸5!ЁoյBUgX_PK ,[MTDl7Ofeign/RequestTemplate.class[ |Tչs'd0$B!$,A" @2&ZkU]\Z[R[* ZEm}ݬmjV;̝ɝ|?ͽ{o۹7WJqYǫ=5|/[rq+B*nV+_re sk;_;n;v(<̳̼Sw{4>ɭ3^|s_=_7 yxƷO\h#U~c7{qO3/~%+W:I?d;?:!&~p㟽r~x<Ǘwr^_t Y0 Ddh)}9|Ў/nGb<Ԛ"h8^ Z{eݺ[ׯoZe5!vv*{x=rM(ǣi]x'F5]Ns=JK]`>v͉x$>a{W&]ݝDr--wzqګW[)X.;pOsw 7!x{lL啻‰X.Dw|F z%w^kG(3 Fbּ0׶X^]V Hkir/[cmfRn5nMDbxWvզaD"tڨb Gޮm$ж0K.GYuQ@l⹻tx}Yh$Mfs֝&Ʌ.Fb.;..Uj˸f6M, wíO &"] Ѹ4%BI{M9*c4 Ly.!8tmL!C֎pɃW45K@QlcÞʶ`=3Ƽg&"L!sGZc3@0 W[a@owU-޹ E.",,љ{Y:.9p )9/'AKv-zjbp(* ~yѕ}"(MEo^*ZZ$(ԓiu.v=n6V<4K˼("!P+4Y(x,2g)>6r$ͼPu( O~$bf_Zwt8<}xk͗XlBBw(A1՟TdCD7$lVtȁWW4E:ޭH" Z3|a48LDZ34^kR'Ӽ}xv1 ffci[nߜVPcRٜ5<9]J>'4t_)S̫)^L2ȐNNM sTKfP&F;֐T[#;;@#)ϷR/.\E70 5vFT.MK8zVJ]kBq/ YfyLȞΈIM %;m=3"iGhޕ2M#^`$˻P׶PJ \^ꌦa2]P+WC<0}jaUƗFuND/煵ahCJӜ.~aXIfHLgvG R/#Eo9\^ک <ͱxkxyߨ4<71rW x^D(tgmeccp̀|9e3tҀgk|_I34JjxkR@usXl%,ɔmqWoӤH+m#z $R) Q#j \XHXuX/''Yb6J?fxBj2G.#=n"qVNBN#Z+A;}]"jfh\JiVm, U4%jg8]o;Az#,9^fO\TaR|~q!> nfb>en͆Eć6w'>l爏vC!4]B}B]KօtV59/⠸}?~O!ʵJ/xӮ&~FRnEii3GUbڏtx@\JgXܘrv|5@+;+/r9݉讻jMeuȚ#=ufgvwobig'S ZugS,cVßB [a)UNY5Nay>JiIC]9t<$픖QR%(!fxCo m%0OTQC;r]IH(Qk{ŧ5g eX=YZO/F;W'njS9O܎q7d#s]&^")~f,x`r#ջT:z󱞖eeZ)}LiJ d0$r knʁ)ٝ2k *@zE~g Iq9~LKY!cRٿ؏rYpw+TO`sYT 1!5)" ,L:_ׅ)7*QYY{i[B.2NwtcYyK/L? Vh2}Lt$JKׅZ JhNH<ԁsk|vweh 0{x^ޤa₷ !͙gZf`42tl hGQ$0L% _bs%<Š 9"?e\W>ccH{L\xwwx 7، \k l&WaxKt Q8ɇHtwlgAS9ڞ<vtq? _qgyϥ^ zN(;S: Yfvv'}rseoPWI3&]B] @>3. 0@,YAD sWo|ۤۉ"7ugʂ'!$*Nˆxlς;a9axDP WJZX[w+`'l<3PX"-T| +DҽS!"{#v $(@aV 'wS:@n! 'Sz鿯y,s?~Kjj2NWp&^ŵcl &׸^HGi_dn%tvibZ-p 7>;Iw4.. m6!nObZo`xQ[doR6ag5MN0$pIס0e Y^h yɮ]&]߲g9(ּMTatf/z8d|f ,6GXV +9?%,>wL6waMzEEKΚBBXѿ,}F>aOO,Ef$< ` [# Co[.9*Ky~XN0Lh<+6*_IIx )cν0]a/^H7[aW@xz#eTeIhSXAlaEGb _qM-/A%~."|j_ ،?*#BkVk,q]ʬ('! )$/r|TS焂TFŴO5 R絜w`a,Mҧ*r bGid`"DCm-RtWY2;Պ-ƐxOlIIп MԽh fFQHQꆹ*9cR?[@eΏchFȍg`F)00Wo,Woay2Qobk= m(|y*9>lg޽}^y r!_` cS@LDC52dܨOUZQfQ͞QJ,z8 3"avZ/(~hr@/&K@j prq X?aJ=S#-SlkۜNkҰz.I櫔5ڌ<\iim'r,e|-e$tjiio ;|b%P(t`rE T2)E"wKl\ҼȓBn 0[ؓn"s)*UD&"Х]ԃ ;$\WQ6)I"ub!)$-tlhRd(<#I1/!a!uB' DZ6x,=J< ?T\ݥV- idL@BFA{{tH|&-n!KmKKKA 7GaxE}0mp6#)"B}P.ȝn;"w rgFq \TϨݣrXeK@BBQ(ɀ|B0En l!G>E~&F٬Jv Iz/^M/ŵTCCXYbPH 's]XV.ޟb?m` &B$ %:reS/Km:'V2 TVaX1ϐnIo KNt{maWJ[8ݡVIwpڞJ%Yj LOJwN K?UJW釛傡xͳxͣX)Xi[7]@7?=4n}Ϣ|`3Yjc^UyԼ3p[*p*#cGSdT_0 UZ%k3`6fi2myVUFe-ܲy:x8б$NTuyЖe'suTJ|{&2ܘؒLɸ:b~Fy̕RVBU|\nV)w-BiQZ= (V\hP5m5lVZ С.*A aEJdg.LzP|MVa ·ץBZnn?YƥB9C߅炷LI_{(u͵j);N Tw1`>.In|T? |SAܬfPqkmiaBv i1vAr"2ղfVE*S,e.Qe,jtOL.Ze8O(XUಅE(ԊHM8 Q(1GjcEJJtm7ѮJmu4XJ-\&ia6Q+Hf*xg3ͣu'1tǁm-'X+l˛?ض|}D"h4M1 i [\! Vku^mFZ#6U$XQTq>Æ_Og5s{8C9S0Q|I25Z@4I!1ȍeD* 5VѸE() 玕i?h\'SIuFkm֌뭬H@ ,t9w 9성&/@2H r הOU!7)p=#[s^?|XUn6.:JWHfCd=^Z-M1Lrqr@**i:eE_"<톧 <$_s@xLcT< ʼn_h#i_.r}'\.9aq5!pSk\%g5a/ -|- "t#t%cDjPK ,[Mq~-"feign/Response$Body.classmPMO@}G {؋7n6RRRMw1<Qa6̛7oq$#"zV~tO1gZ$L(G2m欞]s{/!g6Nq1 ԔSK ݃ai!Õ [?(pO7O7ywvM&F|sqF=ri'\ܤWBDk΃DÆ?]90HRz}6B뷑C ՊX :p#ahaZ; mzzts_PK ,[MZHs feign/Response$Builder.classWa[V~S*6HW"Cf)`AQ`eZ!4-6RHRO>_xYOgk/ =0}RcM0I2T07$ZWԛxA(8yw>ϔ >&K:EÞg؟Hnwt6oklA_;7t'@t? t=DՖFeSy: HPK ,[MhOc "feign/Response$ByteArrayBody.class}TkSV=ؖ-dNJꤤƐi؁B 呔6đIiSڙNJ$k{v}pBE  jk}]C]*3geʹgbUCaƛma:YKϸmuw !U>pCez-+u8>/fWghq/Qܨ Ϗt5믟𽠄Jvˋun֊kmo1 rn?KF]&;a|`j.̚Q6Y0]Q69h*ޓͽv`5\&+#չ}]&ǫ¦CA'%]rK;MVTq&fHKSgY2M5abސN9)4\ yT0f4 ኂ ciE0 ճJ讂5l⅂- ?ghx_ &N #])pE 9tqvF1-7-2'޲ar #WK*å.J#k3Js }Ĝop ]^\I_VS5J^$"y v(-7Pv.6_a 8BSj~$vxNYNr(Stj&@KWZʑb>JoPGDE11DU$86{*2OpEc;n!1ϽP[Ҥ,KirA6asqdͤ y_SVc6`ӡ/tR`2Dk EF&#gh2RK! -+JinQ>מ(>Af=Li0B:}6ЂJ?6^6pSDy<޵*u)uwL$w1.wKp T`1"áJSpݻc>-qu=OP!Վ^Wp=PK ,[M-;tp$feign/Response$InputStreamBody.classTYsV=W%[V`@/@B`B:rBHr>eN_P8BQto[GRE-X+8! N0*㬂s*ϫ &G íoztӫlqwևnmקM24)줳J-3G ܽ/X[[wt#Egwmڶ;iɠҺͶݼŽc{|4A:LϲH3T8a'#ŁY_7^׻QZj4ӻŻ\CLvȺ7¦>Z%Nr"wf1RXM]pH1W"-cSU0g!gk)S9RBV6а40a .3~eڄ)(p axBxg-Vlǯ,~h=7p0\04)&F R!0)7w{ 7ejFg?kV2i'~YkT[ ųY(fʢEa-C{ xL}9O1ei}O~$ODH%a[$ܰ$IPňDn/>T[z| yLg0LvC?!'J@2΀d:@BMڅ\K7B(f]"#cJ}-6p˲)nғ%d=QdN5y!e`)U ތ*>(7(vwE* H#Aq?yE~G !*!?1jq+aj2+aK=%.k Aw7:1KR-ma&}N7<[ d|Gw=狴T#\fث')0h, ~(0]Sp^U;^GTi.ݴ V`:C;!b*꩖bvŨp9 .aLV7jiJ_!P5,m}'u&9 _[ m!jf]{Q) Pé_[KaH(>fPsYXq뎋]7=z!m$YLGE ^IMyW;K5h{ƟÓ$=Egy]t:2}0OE]%/ځcǰ8ʦ7Uh϶NJ XD,k$/a>w3Ek%ys$KyeӬ55ӛUKh_8 BH=ci ' NQz=8M=fQvw  i<F  iarU"_BڗP-C{eA<ڏ/|`'d!BirC%iGYv ShGcW$h^NvvvFF+ _Q=^7|NeSZUoƈdŒvtŜy<цZjXBXb2CGZm9̱\`Y 6៦yf72IOyFfx1D|_^;-+ %OspuJ jC/ ryЊtAi<5BSMB^P,>|O<%O!_5EQ{>Q~zsp6aLdj^qhLsJ^?G?G7Q:hD+EC I a FHvR/ˈˈˈ(MJV6Z݆XI !@w+'ZvpRAYOW2⪒L)Cs*90TO_N@ d!KdU Ct΅PK ,[M\feign/Retryer$1.classuRN0=nS%@{x/hQ؀PH@ػ)]9.  QEr>s㼼>>Zcǒe+ C{RIϐ.n T悷"L6uȣKnӦgeRJFXPYn^ Q3aͽ0 SVV81Fx[/WBûPj׹aY?FZ\ 4#:VW~cs78n o9"}CET^v!&1Eg%JY5CpΏ=zX5#ݛGR5LY"XXKI# 5Pw((2c"%P9sM)e%AZ8ȭ_bNS5hrYwgc.G+$X~*PK ,[MT(feign/Retryer$Default.class}U]oW=)!lh(CR(Mbb:p m&Ypv͚_P/}ᱪ'*JEUU=8*${gΜ9{׿,j14øIQ0я+&0(⪈I %Sfb3\1kb ܐnd0q |._X0pGÁu{jlhJ5;2S4_ΆйQU`gjeuQ ١ oYiv\5[__RTwګ۶9R0jŮW*'ƆrVM?]bTIT꾯`YWxnu5_jLy4S`\ݬ$s/IhW nXfWmw5__jy&[ؕ3v-UYjUKKOvhݼn}U6 t$]5-= ഈA ǐqG-Q0b`BX8/U kp4{sO, Uqi\xw> ݯ02! rVtVjDX"a9ՉbYCzls"vg\-8ˏ6qh9_@2LX$+sVU}|e1~Cv~y?YZH:cg`LP$m++L LB'³A$OstR~E =ԵMj̢ C8ŝf:zvFrϥ`o!m!ӷ`E=v$R0hFIUZÝT'?㋗~nfkxğgX/#3$Bl6?qRmtѩ Zd\ |JSW!Oq0zqpLe-2LV!记gՋ '(э q˘v %Y?.e +;KY^u_Cð>.O;I=I7ۺJOR/pҭi|{ {N|*ǚτs >GP#Xw/HzI"c!Kyew[&j.0EzI<-bqH_n^ qmRjPK ,[MPCJfeign/Retryer.classeP]KA=WVVR)Ahl"vmVݨ=~TtǢfǜ{8ƞ,63H`@)MdRt=XB ׳}m[{$P;U-@U誈eT$PoʱGֽCU9H:Wj41;*7<748oHkz혂f^QЙ p&$WhLQ2EN 'P#-Oi?[`uggp"Ni-{<ސ84(1>b' 1zF G.0dc Ud893X(͕XPK ,[M\U&feign/SynchronousMethodHandler$1.class}LK 0}* (]@] Vj.<S=y/[L$Su(",EmشdGəVwI9Ɩ@@n9]mwZZ,!b-9/J a$@[ȱC]<B PK ,[Mɯ  ,feign/SynchronousMethodHandler$Factory.classV[SFK IjJhhH !/FDYfS;'u[zyZV1d{|ߞsG=)O"*2 XMuYRqZWT (-UC *)#51>TQX' Ӷ3t7Ut&g{Ar+0ݪ+U^{&/Wao;dշɼUN:iW=0d6քFdyN,ym`{Qp/eX.)F[W6SܲQ4|une2 }*5"i˱(M5s*]eJ]yV 4kY=P-R 'wssZ-pp 6E$QϞ xI7|`CA/ɵ '"jX1"Wh E^ᥲMEy 3so^T9yװg.(c# eLT Czjمy-]tNkM$jppJ<#Цu(9?][r٭R[ t4HmKm8ɥmn 4X&. NQGPig3BKO=i'q')ILBLYi-\%,fqUbbSľ0;ޥ纔xAZ×3_ %:pOԭPK ,[M_Oˇ"$feign/SynchronousMethodHandler.classYy|\u47˓l=Njlc$dE^%Ŗ0ѓ4x<#b,$l@KbcBIiI4IMڴ4m4IC4}f4Ŀ=s=s{o~E}48- w |MB_"څ1 g.WO.(_ _s P"Ӆ2cEj~g^xa ?7~wÏ_y0oxïyE]M\-0DȖԃpK8=l sxIܸ^) L(S3,R5dZhdZhӤʋ3P5 YE\SxD Yj2C{OCj mlS)+eȕHk8N$s:;ҳP֖C=mZMPޜxzO8V:N}V?aY3N[iAEVb戻t&IM376XԊO٬9b$trJ emf&c+ndR2h=RJ Xs oj1k7G\i[1AY'SDcpjM&nIӺK TgvLG|R]cY%kEXVF}FlJV2Hn'2aLֶzjf2K-}- &2`G"0l9 eW7Ff`~z䇼 ʅ̏H1˸} u%'VfjV*լVժYY+WvnW*ݮ.,ZO"Ìh*^0*"&l+L/ CVrFsbMlHEKS9;&n,j)'T&b8ʄ.R7fT'8cD dT6V|D ʎ9YD/O/&VrEs ;*M3Ux5z &,&މL5qjއV֙^M2ͧFSɁ<5vl6VHٝfӯ:o<*ߋ. e=EXK ?{Əvַ[iP1Ȁ9ҙHwfb|MxZ69#IK\WҚ)S$ۏ$xJ] 5S_j.bk]LQ-۽e ήN>ݴ/ڿجչG=/)DG4SJz5xu8g%sEu gۊ2  a0/V_AQҡsvM,TVT&i:Y̚YdAŊ?*3&1h'fd,jft>:Ъ=h[' s@Xz)~Q 9jn?c|/>=x/BDI*u/=(hQ8i)S21_p>0S񬞷w\R9{G=©NDZ79ƆThz;yfOkxx!tXT9*bwZ%Vn4EIG`+|%Se>7KzgѮ{VA~|VԺg{g{gE۳=RQT<) =PpEKp\2h{Pϛ4Q 8|yiØ fq}Ø 8}aTovw0;wBo~w0Boaw0y%èiҐ|Ba,)ٶb5Z!5hD;6`762J OZ->SF"B-wQw!|XEuExhJETS*MhiJ۩)9T]RwkJߣ)^M05\S**S]'s%n|F 6sW;` :HFAt>E] Ʋ@Z~W>o @92+ϠQIV(V>~Y.љZ,Ri6no;%:)EOn+ape`ިr=73?OЩ!'):zG!P[ {qॖO3ʪp2~fassxW(r‡yh{qX]Վ`UGC:kԱե|+YUPckGno]yϝA#T:lXtq& &W:Gӷm~ Տ_N£>ڀFE f49 [}sJ׸*8>A5zD=Jt |shה=3hYIC$;YpORɁ'ha(ًEg)iaۓs Vd:=Gx @C8%_c"^2MR%MúS~RTT^S)O qudO'4,!Pk HVT5@p:Nx"PR' D" bz?o^% ~ı~w2? C2tU\KבIz'>*p܄aɏ>OI4>%=0SO>z32o㤼u52Ax\K>K:] >7W ܛkQ/F) -X/r_VsP/8.;%ƥQqTO^$BpB,yRA5籌E2u+r 8@aSS >0ƜOf^@cީB/a[!ʂT <{w(# / j:z9y})y%Y*@7x[@e6Ӗp,`bO)Nwԝx=NgВc_ֶJum3y}!.030J"Ҵ$gVtdP{.6Uj?櫄2x;3`jO7 >S*m#U]ː]ːzeH]ː]ːzѮeHkR/ٵ ٵ ?kR/۵ ?kRkEso%Op&Q:݅C,n淟N_`qq7;]-7n9RMr}PK ,[M3؏ feign/Target$EmptyTarget.classVsUmfJ0bG XiT&Kml6@}*3~p:;#@<蟤w7{9;s6} cPY ȉA0E"΋ Af![]H% Pe =X $KlVa(0SirI}qDITjbW-:h>rcԕ2G}糶tjf J @h'5]T+,8WJKc{WZE@dl+9ZTm)]W-DU c9ScQ5R&\xGzܙq5'1,fԼ=6yg:OuObt= xdM5nk 4yZ%݊iV$ꕪZsj,ѝx\9vkYRB@שּׂ䗧ӭi(%*dknR ҰEnqꜘ42\T*E?)rjjx ۆ7*jpXO4kTzRcqE}TF fWdX76ݏAa`1$]k)&ǫZRaWqMudeLG iÏJ4 V 3j)fq.asDЇDQ&NV܊dAMѶMG܊H\bB7B(UmnI;9vtT'3'Sx/$GNSđYOCErsFe.j~yڰ%ڞnS=rM+3iuuOꅦ½^^FݦNK;{@izA>s%h96di @nt!j/Ч CD?*7ehuAuL+w|;GB=YHH;zF__ %IA>rЅuKxey<0=D ϯ7UæuDozB\kNGvL9 p׏%Cv:/RH6îitӷjv| Ɇg3 S ltp'yI\lnYG&}R a㨋i=\,S@tk V3|`ă^O?%'_c^pmu{HH#DV |i؉ӘlHcܻ)"~u+\5t#6$Oq8ptnv8~J~զzJԟ+_ٗP!"64f eU)}-&FPK ,[M "feign/Target$HardCodedTarget.classV[WWLHPB2bJ UiDZd $˯U]vշ=3I`{?\ 0FE܉ !}{a02XQ|X5/E|lw Ke"K 04fU?|uadcL+ЙIZ&}r*ށ38Ck,igi7aGy^luƾbBAftɩX ~+r5±Oy^ f]]ƃub!e5iܱ$/}O:Mud:-u|LQ\rJGK'd+ 6[4 LqLp_a~B:=g pO(_nPumAJu{@C1)Q4bc9 2DRwC.'vBW*/rԟ¥[ qWG| 6zB&)jKb'ہm/œs@u IC 6dӻiQ v44O0qQŤ+?v?v gԱlqx!PGP͙;;7s{ M L\dLW 4j*yC癫p Ec ]ff ]]G<ˏB1<&AM3R1Vq[/dh,%>uug!r$\ oT}3/\{',\<Œaof[qMݼ4MOV6xSd`au -jn v%%[k 6p& PK ,[Mq&feign/Types$GenericArrayTypeImpl.classT[OAf[eBPj P!!QcPvq٭ۭ&/~/f;Sg(p!id=ХI?O(b܁``|zo_z&N4!)[_lgLгF] p, / P%{i졯]Ĥ`[c(M őPK ,[MAL 'feign/Types$ParameterizedTypeImpl.classVmSW~nɆe^LҐXkQSKnu klfS:~_;S3t7:Mo{=Ϲ<S1\1@hq?\F\F/qEA5F$0`wx1[\P3z\unp;;2^*d쓬.J,h?hfzm'^9+ RơaNu oWF pJNv]2ʁa9*@3LdyM ^Ό ʻaZEmG}C&y-"dr9t#eg:bКGK>в2 4tg$5sv7a#]L!-"]=Un_Dgqa;[ ٮ[mh߶@ V8̌cVJ~W+AA\$bF9\L&o'7Dq<*q:tWaNm7M=[msE8KFr0(i &A,aOz(7}M9S ,k2nȦg9܈T 碗'؁O^ʀx{/\g+$lYmjBpI/.'Y3mX9B{<1)Ke3g YҰ[CoLMSt+- 9s#+ 5L4g Pp3ܫ1kx&t4G9Zo'5 `V0^"tmMsHYxX4\[20c#1f-/lz6+a&}:"BR t3 Ʒu{+5kSUb~y]|0 <7"׃ݬP/>J> l(wˏPnNgR HG"2&#CV?MʵID$03h>B!L#Bۈ{/1A_5.}\op=EߡHC˜rz]?prww>(B~]*:Z@\,.-5g/? Yύ> uzʸWB1[fhR3+qZ2O YcBFÁ %'I=vdhh UY⿿KY(Cbt_)~K[q22r --r]WمBVo>$lcc4DZ8)wkh_"D:V7QeTF@C?GoOdS9QG0PK ,[MZUAَK!feign/Types.classW xTufyZGblI3#*`" qacy4bqicnfs&rġ9)vEmRM vqNlNۀ!"iiOsYY RI/S28c epzᑥ'œB/8W*|Ճ… <{Og0?'W}ӋoἼ>/^(C-^ωe e=^2}/q2<+)e^1 tx݋ ċpLߐeGxbG4{?ֹ?`v&Dd` 6P{Kt:r OIG2ܺ+V]f݆-nٰ7ܢuGdo-Ic;hM8(ƓrGsfԎBEW<ܳ=lOp+$6Gqy]qްkg,ޗ"(lWPDlhmZ?V+ESF:{-d"-&:z2xo{2u~%kdܞsZ. .$hrN(qBID8Qvl,ZaG@H}Bwb!F%"ntҎo#2M Ǿ|`,m9ZdѸA?d_f7dXD%QqVp"$F4E)3 Ljcl KJ8iµŖ UzJ Knē;bThn.wjxpЊZJJ]yt|Ү.)I[cMXUg?zSV*)%syn2 :`7t֥~6c<5&'œbdlѕ־ߕ=ܢe$SNIW#2E{;#>7KJ + (r (ַwoUvԡ4.aGHXu!C [ɫ\:AJzO1EUְ>߬E2՜51бxBa;VXNe6{♸Z d̘;w.hʼ/奡*-gi4a7Eޞ`:[f&ßx-61s1;Д'L$b}D6-7Mh̛ "s7ML _(Oa` cH&&+R[ZW !Vi~ D<8[t`FL`JC'my >H H ʥ}&nWx2 435sT:iE{QzBu,SM aS4ݦjR eGAJg\K+LiJ]wuc~G7~Q+dj|~˞l+)ocMml8"7!^ID,jp|U䪍@XGX9B@"WOŧ+x㜔`G/L81ݜcaK׎kppt]0օ $Jd!I=2^(t O`lV ]])!T4$ f OCMDO`2S8 w '/  Ԡ iXYXĕK2܆؊UЦpnYHLFzK3ME-6a3s3%ƙ" .h#|n-L36">ZiOFU%wsI7CGr ^z,1ǃp9ׅ8tOԪS:PX{U+69 YJTH-et RVe)J(5e-[NW;_FY"Bdj3LQ`VN}@5II-@?43hzMAމ؏(BHЇǸ{7؃O#GS|>4^^Fb/~}xU |qPNV ON%<})eL >k1<}\{3y;Ss7g $tLl$_Heѧr)oy_ioa= usa*[ oa WF#{0; 7 K4G'0{0ֳ.:>Qqӑ,@p58! Wg?Pu%J~gd֜ҪyZ<~3f0 ?AZCT}c-qE}wx7[)izjz#==Sjp᠄އG85gwqV} rmMe^ՀR2 RuS.径Z7)Ȫbh)L595/lxP al::W ؙ[k~\Yg0كpT9VO>CVXVN s|Z6m%eK:[^Ui40(| x%U{v0 ];a!XP0$a} !mKes,_'B9pkdX[ȀφeJ;ˆ2B^.Ż1uaC`]YrX=pau3Mu8!tN(agо:F]O,$ÂkrPn : Gom'JFR>|az~>f8琇rCϠPo*7"iapD-# nq~˶8+{sG1>ߕs _}䟅^"*_ceϲ|Doq<+/ !~"{k/|yaš*^:!ǏIR?&^gBE5R5ᒚT?o`j-WJuQ9TB^V(Cݯ<L=&oHb.fՔIm|s\aw=wv3N$̪1,eR]K~/y?LK{#sߏ'vbE'>]7d6`5:T7Y>K)٩]cL miiALie;V.1ۀwZZ-F{CXxKބ"\WpzEJD^m-b̹X㓴C]^ۃE,f7ubKGw4n`XfNXk~a87APp1JDezԨhP6Ӱ@!ͤkH汹z(Wu\BP nN*\T8MB%ĪlRa-kWHH/[Yʫ?T: $9* ğ9 Yu\XbU|nr9F_lWk`> V x&*5~ͦ_h}@#iaQ#"s]\rmi1QДbR5Ä~lJPO繟קEa5?&ϵ\LPK +[M7vfeign/Util$1.classm]O0_!i9ƾG]4-ڴ+@ܠNuݐƝLkS ~7\!mv5q6j>ys~;B2!!C=b0L0,wbWWY똔Iʜ!nk-c\P9roV!ϻʖMN e׹ ;4g!c414ŻWÖ#m*?4asګpճ܊"ptgq>-%dم7`7xi\X$?` +dV6ߎav=C6*7!b}L~W-jf _&cWxY~?ROJsڗiPK +[M'feign/Util.classX{|[}+]Yc;A $$ ;ز)1N(FEd-)- %І8ZXuJu}v{l]]I쏙{w?OD@o_n Fo?nrm7Q]Ѿ'2nZȶRz⣔R ;f]*)%*,RJi/e\QʕX*7Ws,QKUMkxťTU+T^&hnrӏMjLFA뢟֧r6қbЌq.[n^\{7_Ɨy=opQoTy[J`+EYTPS.{ܴիU)Hoе|B^TݴW(1 lC坢 OIbF+'FiaW l ]T{~Poі`*1-ǒ)=ڭGӆw1-tox7SΡ}=.m{.'=n19vzmdZ[cz"iZ2-p6n\iZ&W箞}An&ۉ\T1/){vuʴ$O15©Б ;TٔNE-}JјJ' + W(J[{7L6=63=6H?jzt9";b@]`/3:q#bj鵽3ቄLF1mb#'0!c|"yQ4XA"$!L0&Ț.O(vCHQֆB+ɦXP]"n`q~BI*n"*$#z: G\)i}Fj,>[;eߊbD BWw]H(8$u$sg֙=x#a2oAOB{$ - c8m#h8 |d%Nɟi\DYL3 {ǣD2fuYB=Џ^9c6Z^" eYUy{fV8ɽ8ƌj*ޑѧ5=_FȀ+bE#XviYt̜-ȄI[7&45g:>O{ͳIf =oS/j>͈%qtEIpQmǥ(Cs=AWO (d$Jދ3k#"F 0ʄqVLO 3M b.$b Qwv‹gX<>6&@gZs(IH?4+ݢ7+*筝>l$c-ft#Qq+ 4dE]þ_VgBr=>]S*_>/x瑔aBMmNrl"D>x`Or[V$f <95X$AAe${.0R:R񔎛qlOXsgo`b<54wQTEFD*t"lDJq чL+``3G%7q[綋c Ab'd9dP90CE*h$b$4Q8G*s(C7L hqcxB|nbCeH26JC{}n3 cG[AZtlC)!EA.U`A} q ut;A${*'Np^Ƅ`ydY}UtdY:_NbZ&Lg*g%MHJ罖bQ)EƆ}@Ja[hnQ3Ogs&Q4/.U9N藞&IROMn|t Z!@uO[F l]d{\oLr0c00s N9^dڷKu;G PY۪*78U*ǣXT9׵prk͢[a۝|MgiDUJsrm 0WS_J !7eMLW݂H%BZG??:Uҟ[ 5k__u1)hJM*H/ ҏ'q`J {Hb!7EW 0ʦ^/±Zh'tm E)<4메tmmF+ѮBVVJbN8G?_}ÅbpaN[ўWqe +ۼQ'IZkW9NU+w'/iK5Px+je Bkh* \ &IH_~ a5 ^o@lKURޡ2~| MԋlUl= 4uI)GQRa#!v!i{h"jD{=d(eY i"sHgSž2d(CQT䑂2! qL6jV)JsbNYA-y@{g+m^ lߐ"=GCJf@ 8E;Q}v٧hYӠW_+*GMˎ?;Eg?E) X"NGJبdn`EIwb8WSXF^`f !Ies5o%PK ,[M feign/auth/PK ,[M: feign/auth/Base64.class_lSǿ'׾׾q/Kh &i0MB T8I vlBKN[7aJyhҢiZII{=e/]Y.%F|x@7NA zc豭^}1``  ΦC춵_Pp)ڱt65Q>*D3zrxB8W:v%\p$> u3s2pm/+V {pL~-α+|]W: Mnao[7}IPx*x3H_y'T >'>npJ^o&Tod7a|my3\+r[n1b/he.x2|K.6V6>B2G yi{4`2}\tG~LN<+/Vʦ,qvf2L{h{njyE_]uظ^>o l]Qca۞.)[]%{n]FùX)ոj*|Ԯ`}p}1L Axj&TJ0h}p_=X!}w~?u?#SՌ7a9B›O,M}Q]*s,feign/auth/BasicAuthRequestInterceptor.classTmS@~$(X|(bi J T)0|`ѐȯ(0:Q{IDCn_noٽF؂ t`@ Wu$4\39[uPQ% :4B˄ۘqG]SjpHY5-q&⹗ Yg9 cI+zOCt]t9sx %n/qRvʲUeH^k,gjHk*g)H#Hz*]C[i<jPap8jylRG6Y6hIxYvDOL!o2zMtᤆ&z;.-W/ȫaD vƱoe1Sȯ^[f$TRY^͹rfSL ozMU8DE8QEc.Ɇׅ:<^ϑIDЎT3L6ҨƜD7eb@_\q]QO4gʑ!i&U> HK8 %(#nҚ)sd>H:"q}y-qc GB=Mjܤ-±ICTdJ-]#PSA==.Z2K AgHXj?j~j3$I2Q,ũx

#3ؙ٦,:UE%p_g1r<#( ?BivԘS*gkΐfxzVwcG9^˭⍰smp-'6b30eoPK ,[M͌h!feign/codec/Decoder$Default.classT]OP~v0dɒ)Q`*xsVΰXٞ?wy腷&({6y?}i,Ўp> WE R L(j`2$fmזs 1#Sb/zhqm,U^vS,o+=2+;`ЖDɠ\WAbE[iQQ\Qto&Y#|*"WopwE4WUr,Nu~Ɛ>^HDdXzWRY*m**+^ͷC[9h)UN t\ :fpS-ahk#Y ta^},i yawE0؞YX>ytvZp u 4Gӿ&m;UY/q&+ YV/{ubc{WK%PM;rf;Z w=A=ۥK2NG@BK48#:9twM'H՛)LTf&wB2XwFOkvH+h H6&&{hkPb,l6!,?^uLeb(~a43h(J,qry$zmD/PK ,[Mw݅tfeign/codec/Decoder.classmAN0EnCBc6x.(*U\*Dqj,8BLZUlko  g #pf6&3zp&md<|ڼ_3Ƕ/%7{`=%D:¹…B"s,Os' dU6vBk$alƫ=֐zhpгG;:mV4z1PR!" GG»2{PK ,[Mu!2!feign/codec/EncodeException.class}RMo@}$u0)443Ip RZC\8m%⮑"$g~b֎Jh",yv7oO)chxhq{.၇DZ#':2×/tDXۏLb#!3m}NL6fk"\kX'b2#ɃzT';'++ƭ`T$Lea*r2On^f$ERmi?XCm\qR_OUBIA.涶9<[w]Z*rAdi obS{BWᏏ:W+/q 9B T(D/Yu4g7sj!6qLw V;{ a-&3FN΄]VvfvPK +[MN@O!feign/codec/Encoder$Default.class}SS@-MA R b :LAꘆk &WG!|<帗fTl徻 LJRq d%LW0#fU0B ۵mx6ΐX69CvN%],Y7}[#cBlf }cR װ(eu%wyhbX˖ͷnxT(ey!QmB1⁨c ^^*vcHռ]qKDFb+ zlFP^˷=[9ɡ ·݆y\SaK jQ3d:[vś\TہzB7uAlzzmWk n`YMla˭׮a(+[gkh^ PΠܱ^Vm k.6'."D(;&EOsڭuI1BZO d=Ӈ`udh`V!ҴlO_7AXI??@'1?lzdGt*qVpW'))ؠ3bb ϑ ,%UjsȄJ8QC.`x:!xXNG]F/PK +[MélIfeign/codec/Encoder.classuQMO@} XE^ƄP4$ T=RRR Ro(b ag7;ow??beY*SPP ٱ hߧaH@y=[Nbp1VgT̉hF9n=ϩ! I] 'ifzb #sώqt+o?94ܙ* NL [OR+W0]tHe=FY8t&NmljrPz ?_壭`Ȃ\Ofא#2+ΈƕqM8+2r1Y+2/irJ`;9%(7PK ,[MʻQT &feign/codec/ErrorDecoder$Default.classVmSU~. \,(EQM*B0mbyQHT[MwoZwEQ;~?x& '{{v&#GZCnr6Y̵b^#Ǘ}cQ1R̻AJZ-pEpjDp9drtnpD.ւ4}Ѷ;k'<0wf뜊S -3m4C(`ҒiRaKc"J5 5syL93JdxEFI S]㩑 {'.]IUքWtlO5"YQcH[Aȼ}W(0 n<(S, {A6 (HIVrΐ }]ٽe臃w zr])YÍX^qukWdUBPL=ulO3Wi3YDz]v&IGY Lf:[:l4q(N͊Sݣv) (x3$޼uwu|tǔ)_j1 ytb; RP,u8H8=QaQF!Qx\,g]P,7mbXF-KoԙMG ͇0lP`i;B. 3v'oOJ“e$նuBKY\ 9ݩ>3:V]癪+1^$Nֱaڞ?Ă]@BQ#nMoP'VUMo]+tR5`}y>U3}We(U[6DgmZ)?c4%^ yoh~N&4ځctNтfڧG踒͉#cvt8~ 蛣Gh'n.F<=SFJC|~%W H` y9ߙ3Cwpd;#%~5$"׉ c&Z-~=D 3݄W|_WKp^CwdsO eتAwaing*6i?) xC)!M ڽPK ,[M80feign/codec/ErrorDecoder$RetryAfterDecoder.classUmSU~.IvKxVR mZm!XĐ$Tۺl.&,3~3;깛:{=T27٦V\f(F* 0]@*r,/LGۇ`eU!|gܙۑA`㖊eq[U4 +*t0JӡMzBD qUZk 'THQwmAQ "ZS_d6LZ^?-qcw4:LiuIA%Ǻj[ 'VQ.M33B ߢ[!eIE%ycxGj.,! Wb6U$|nOhYzh-MVzË4H? 'n Yh~J!.*nlwxp$ :b <4~D ݕj˒/^lwjhܼͮUaTs8ydV$c؆L?ERxm!m[_J.Mdg[FÄwYW%t!O)]qمI?F >t/W5e}SƷ G h53^ɚ6IR"J:G~xOvx8z8s:%Kzv%\ vm{/|.*{5^?n%PK ,[Mb]feign/codec/ErrorDecoder.classuNA c'`nzD?EcD TP 4CVAkP6d@B/ Q PK ,[MEnfeign/codec/StringDecoder.classuT[S@- M"4` 3f(2>m!IO߀/:3&ls_łT\u4y a\&LcZ"*TpK Cvv!C(3d`*ۮXnTƫy e:mi'L˛rMb-TH/B-Z2 nUu DsMGX[bJu'a ljd*%!^mW,hŠ-=F:*QQ 'E>XڄQp-܎iNt)aw)c{p%1|1U@Bn=h^eSZA`| c9đ؞Ҕhg+(qYd󋯨21L" F=d?),I]$19чeq$%yC (.E;L|:ysHA^P@ Wt5mh|CQ]PK ,[Mfeign/optionals/PK ,[M3+Tv%feign/optionals/OptionalDecoder.classUYSP.- aiYĢR\KDWpAEkE-K&).'^pƥor<7 ԢN瞜_bAF;2 8(ڠʴiF 2FpVF8 bsQ¥f(,R$K"*CdB[R x9燞CKh : 4z S8EOt}Zr }H I"6B]'+mD#DDF ڣIABcm+lf-;~D rJhB N0dNPK ,[Mfeign/querymap/PK ,[ME<feign/querymap/BeanQueryMapEncoder$ObjectParamMetadata.classVSEmrq -ZhjŶAJ R\z5ܥw|Џ~:ڙ~"q0ܳ=n7.#˭Wu1񩎘LZ&q]0n`Ji3ن!(( iw]"]ߒOķ"Wrhy~uڰ_u%hx8_rqgVw-'3 ڔSE˖5.2i)µ|W-}'D.\9'}Q`0 -ݩDY. HS03 N RNt+U%r*s2ԊCkC;&OLRT>gƈeoa z|UYIhVIҬln#܁ "?"SMi=R4 `&8CcdI< ]9D '׈l#^B Л蘖~ĕvj7!٥QK?kϡE0{c4﯑XF J h,Pwh,ʒ$Q{Uߧך@\ قH 2knf1A!0$ R\ad@-Hv$GR1"accv?Fw9_D0$u%ޅ/PK ,[M/k: (feign/querymap/BeanQueryMapEncoder.classVmSW~nY "5ڐDZ$HB|br +$qAi/?ӯvi/LR}nu{sy=ٿ_+*vkF؋Jr)D܆+liLaᚆa̴ajpSgnvݸk,p_]W9tdapt>aYs./K%$#V3`#,Sȩd1#:m.X-;z툿Kk!f&Oxv4H srVd~gm ѭWbw o;a?O*/, t7w&JLe'g\0Umz;C?n$,-}1Cx :L<ұ,olX6;_/:t(Xh"7d~,3Jjq6a]*U5ĆxeRHAW%$S=|AywPQQrWhAOu S+/Ӽ>h6pl'\Ño~ͩ¬xMG@lA׆Wt:-p9ݶfIͽz U=A(KY ۖ^!IcW[_KxV:NA u8優,T,3.C]j`J&9[;@ɨvW!?#pkM?">_Y at[`qڠ-qx9W&_@[Cp0\C7Vhn4?h1ĞH(-:(ՎHh ;pWyFݷv'W]pwW彋d8h'wǑF w&P»!*e1⎢gN38>TIZYVO%}> 4> hثiF ݕ9JkUԇ? XÞs; ݉Ly⤟3ϔJD)tߡ{訟UQ`5C@Q~'W1T0-T)wU(s[~xٕPK ,[M%ihh=feign/querymap/FieldQueryMapEncoder$ObjectParamMetadata.classT[SP&BEzAZo-thO1RLRG>+(x|g8n*c8m g 1d@J $q^яyrQǨ<I;E_A`J`;{eA U|;̝xPLȺiOTMWŲ]~2?˽{l!>\`}B_7OKwx,`roa ty{l!tWhSla-PawL IE^kY`*"+-D%Vww"&+ևڙO5P踤㲎1WL01C`l6V3%k782o̔+^Obr,&ਉf؇qWML`pƘEQ5\7q7M܂eb uL+G*f;[/fU^At>c)RM͍me/;o]:Tr._#]kmWya/n4ɽ ?&f˟p=yݪ& QV$+v*'z8Fb=ql%-6tO$#$R+~@LLAc0qu8N@~ѷI2m< CzhWPgO FԘz b--5⚺t\#Tڷ/h|^DT (tD-n?$nb<, "]MѳI!'|>AiQ4}:u$q5 t1djG,gHh, y4%°}!R OҟgqAPK ,[M}, )feign/querymap/FieldQueryMapEncoder.classVmWE~,$k)[mxI_m("6 !,t`?-EQ?џ>B `9agg<޹swz/!G4Gэi%ٌ] C0y5|Ԑ` 5n?4dO4,kX8md۲(siÖҖ|>o-Y*%-mmPʶir')М17. w'ܥ%1Dd20lNl4;jE|n!3߄7IOxhY;M"e捅rn(.5T!+eY4պ"[&< p8\fɡ<4>Vq]!,w]4Yy$ ;dX*,elJk*5JGYc6 yr1)}8ws8v g좙Lև%cj8v4հ*:̿:ͧv4샢M" =~7K*+u{:Jd b֘5SUu\BTr9'K[鸀:S7>p_RĚ,X='T:6Ķ@UE&p W\5oJb/ 9r2v!(S/3N/)yVyWrZ Qv&֦slc/ q[3GI%ՇZKHƬ*󥒶%K #G΢j0<ɗ0\#\5*כvʴw{ gX*VM)(ƧSWo9/^J&5م]x~>砶Z.۴A["NFzdwKW-DCC@Y[\U3o$Tw}ߡc$ -AZ=X#Oh}#_+6zU<#d rj&r0 w2b#Db1'9rM H|D7F/=¨;2yVz%r5L]A]7+.*(.j0a|o4$ACG#y)l >f|CKSxpJG@sO;⨛ǔJD7P?dVӬ :0$&H(7+#V{pi Btϻ= o=PK ,[M feign/stream/PK ,[M$w:feign/stream/StreamDecoder$IteratorParameterizedType.classkO@Ӯ[)U.^ _0&CB#&&eXtdv*_?x:+"3t>sNgN~yUԆp3pXrk-f7ӱ\U|3x*&k,93*~a  hpK" s UA|˸~| s&*Y Zx'\:\߰co9& 5FʩăMl8g~ .Ϭ/-+(T%pIIp*۷NKCgNt0eiܰ/PK ,[My? feign/stream/StreamDecoder.classVSGlspQTV-hj +.xwQ{/@3-̴kRӷwIB0}{׿0UX+:qZg؁LI\Pp ad\RюlbJeWpU5L6h`V%[ >R1n+D WܵK#Q\ Z4=apCy l}y͔S8McJ4.fuS\./ :3HZyn.ǁ0Ʌڂ/r^SeuF+vSLG >O,l1oA&-pZ`CG=c$x& {%eW7RFZ@49FKv\_@S=0/JN(iyեM5_+> GܯQրv^L^kI o`Ne8 mhe Cq. P"Y/WЃ5>:Rɲ]2^޲hZ^ yGhGQ:{^Ø a0 7g~@?q` %4ؠ1nY.)޵ N{n)kbasoC =s0,GJRHg= ʈ̕\u'JNRID>g5;&:`[oZJlV$}<%\4WuBT+sé8w!I!7+pƯd8pSf ݞ&u㋽s1ȭj/XV(v2>SiZ$gJsÙZsGP}334O=a:e[xT{) 0tEz"m=> ìe-K W"7 p|*l+5zm n9J~ZV<:kH~䯀4z`"aM"D&#+B.$U'ъS8B7qzCg+&롛[|YGdv;f)h\E*591mv2bXG:aw/tGO޽ݑv-DЮhvv|BٯY=TraRxoc/cV!gS42>I1Rҕ@{£IH|" +;~BҟyIÃU.·_fB/;oWd88\EYև֞dxDS"ZDw ֳ% הPGلyӘCD :6M<•FibC~plLG#oy/ME40E?f/#0>cAc^`JDMRqXN#kXM6}0dA Ų"19mcʻyB3-YoZ>&I~(bX]/]Re)m+Wރ_PK ,[Me feign/template/Expression.classU[sD8upICH)&/ihM8p04\7V"KBB: >3)3< ob8+Ɏ x=:w՟? 8x#7q=K,t4nb%[x_ićb]M,֏XmXwe|"!n6ClUfIl3)a:\PGvEM[Fj5 Z4SM ? KcF9xqw$T\o۶\ttς̬e5\$ M^ fz"mj-NiNFT!+a:[uv]Ԃ-`:3sK'xI%]* ;Pny恄(A$l\1jb56=ʚh0 i4j.iܦs4gj"Z̎HJolh6w*Xp:F>uŜ*Kͺ"*0Lj=IʢX }st81lF/Jh`<@..hcwvΧL*t9j޷R$ !a]_.A@Ntq.!QPv] P^ sR'bbœVBB^xģLyp9k>^E4iGF-¼w?PK ,[MMd3feign/template/Expressions$ReservedExpression.classSmOP~֭v0"ހ2G4!l%qR2ۂ.lMs9=iLT L4((cVۼa^kJR] =~mm|鶗2U wU;!HR=aݕb!^v9*]v-ukq}Oq+:@GbA =z¯:<awB][+a|jWJ% qsW{lIEv 8kГnblx~KH={cyMЏd?|lrz&_(ʳˏ-\eඅ;3pa0`x`a-\ǘq1ԐTK(5g_}rQܚ4]KV/{vpUbT0SqTpcBZW&9.Pq> pQ.T (i#,Cg2+3aJ,* gWCe# G&U=aV&1چI2(cٴ`7iXb*(Id6m}YKðXəl!g 16aY3u&p9H|ÍIUl Lt6JyI~ˋ"&Vu3/ӭtieBS<Š{|H:J>y0#AemKg:%L0–ye'-W)ᆣv7B@{]=u8>99RDt6oĸ!o1 %! !%CC ]d.c5UJ !ÁZ򣶭hBp@R򨘆(spKmܑ] phA)29jg+rR"zM䟕50EYDYR]ZE}5p_Ȼ|!?:ʺ7C[}*Ly )7kS)NU":Vͩ2!tjљWO2t<-#H-#XI] ؆>i4>9fzÁ.mOInTty%3lq;"o#_]F xr|,Δ(^BXަLhv4/2v9kX Hō<&}Vބ\NoBΈڤW^$JThEFecr*ro "c i/0 <BJOF!"%7# QI4:ʰh/5X-h}* =Β[6=1$J`O(t O8Ϡ.8~ a=^GRah_ľ )`ncx腰"m#NhT>/cP":E˹^ 2$D&aΊwAzNSm. {4և_;|H<'Ď IJMUnJq {TuCeRpy0% iy>1EIsaVUKnz43x_6ےyJrn'ȏ<5iu&PK ,[Mm+ feign/template/Expressions.classWWB#8 ㄸ$Ptر iX\uCIMt]%NZa6qIi# .5>o޷i[ox7F sa l38b>aV.^hÇa6\IJl0f"߆vT<+{[F'0N(aJB쟗d\ >%i!|JŧU|FAGL1q` 1mҲ=n#STʴO]Wd5^UК2m`zwbj68(' "a)VQgǰL1 ɕT>gtېb]2}8D\UU8rmʎƷPAˊn=[* Bci| é|NL]G=J4<>S46i"Gl1G˶ݺջ^ųEaƐ/i2 _hX>0-ܥ|iov[UW5|=|_U;ĬGrc^T O'~*Ui9~`q-2_*P+\y 5 o5\Ǎ*XE,q޹sC'Oc#x񆂡mWjпB\(uX[Tk?jHtU}6HNy/+ݼ,m͙T>,SJ7 b|B2p|:H7:(wƷ릙2x;TQп~ւNb?Yhᘯ$\IWط$֠Dek|eߊX9ZZ&FxU츍\e ^uQEo8lkb)~WѢ\;hZG; pÝ#-HPQj EC%ZE, ]½#h÷ A?Qog.k^/3v1Ё8viA"$AGQ;i1FEc9ℇּG<^(G1x1;<85WSK ? QHC?ς[em￫):cRx*fZArUѮS΍<?ʼHdIDvg=}%]E{"(@'$4:A~jPsn4ve-(۝`HM;7@3]Ln&=ݾpY}Ȳ<2kmέ7}7H:jr/=ws}ݍ I(9 g<(H# o#VƛȔ<, PK ,[ML{r#feign/template/HeaderTemplate.classWiWW~n (((jbEU B h KU;$LfdBv߭Zs~j־wfIp8ݞw_l%%/@"DtE~Q>@ 8G ds\"(\fPɎ0*%c ҜX1'i0(8oTJ<*Җ"f(ClM&j>XwD.'|. LE/0|U?ꥠ7j.D1￴oP@cuCv%/?]!]Bgʋi諟0 ?i Jb %_'X\JWPVW Q~l DcO+o!D݄Do.[ݴ;fQ@|"hIM.Iv $ T҉õ6mRKEnj gKsS83HѨeKb)0*&l=XAq N`5k{r@"V`j vۻjvNۻDwQ=3| >94uw Y,V!/5.x5f>Zwc5zz v {cwRO'c+^{B.خH.w::vN`yQE蹇 B#rJPR*REq.HHq?P.1PK ,[M{2feign/template/Literal.classuRn@=qbB y 3T(a3wWеaAmë kUܴqmG`h#P%22DpE{k!Wb2(H%Q^ikGYŋt2GehX~$c3,/bڗsֆ@ڸP e-us4 SpsMZL墉pq(!$a:~Әgɹ7Lަ pg/"P w~P1r=cGk֫ևdtEp,uHVOv{'('eX%z,(ApLmJ.FjvzO|0ElDӫIд2(,aд ! ~QBM_+%Z+gfPK ,[M)"feign/template/QueryTemplate.classW&N\n6Z!HTtA0IYfgSbVmbmmb[H)o~??wg&Hfs}=o} F;}ȄF8\3ruA>I|wqp/Gd|T}!400X>.:<(!}XO#!,gXϊ: w_q|I }TfbP+!|_ фxk9 I5TeGZVDQS;MmS<#JgdhQMp*xcfV2lf0rZy~^P"N8`32f9_z+ai".tzI.8G1V0ph V๗v55MuJ ~W!  6`w: ɭ k8 :URkiRkFoi<Űia{=aV+{eFm(1}v>7=#$F[9-J>p.*Hk.^1]W/lgI,aCReLC~?Oi_whlSQ~K[O:}iT~\OQM ՙT6AWn )`"ɨ=}: Fa.touIqH>#Oy9.鸤2V"LrB:6֛JUAbCl_1hqZTpe<̫ bgtGV ACgb3j3} tkH%72O+^(kzf8jz*"X2Iƿag%(2K趯ZsōlksKuy괭 oTjXC)2"<FC2ސ,NCh&]h}&zlAmfy%e-X[fPsZl 7 \[,űվ=!^Ƕ&}<ɀ?x<?Hλ'>͢hYk0e5 }82E,9 ̢I D#~R"f,;wsፈi<}sX:UcS+aGk8Wt&:fB76?Ȧ?,nx'D8F̂Îvu؉Ԓ0~r/iKi71wL|+A~;pMth(c 0D ϐ';e# i踈g%.W2j0 ưVawaF̑G )xA )7b7ֶw^箋w5?G27j([H|4Zb*~ciuTmiuX/r.#sT Lq]Fw~7vl ݏWlJ}B|8o jH FPk8(.*.2 j_ӯ8,ь<>IyRqL!Qw׍b8%:¥sxDJ[.bE82up_; Le+>`4 SbMe@5 IBxMA:`8uֵN.ϡ~7Nr=ٷSj AEW|F=PhK6ʰdj'KO-r6"{0_i1ּ?z5i =tP䡞 ">K7ЃPK ,[M feign/template/Template.classX |nf;$%P!! "k6qwCjo`+=顕C m}߷VofvM&޼wMhPB،5| .A>CA|8>" 2|"AܣJqwT7>i8D8ƍ_V`C! tq& 0xPxH>F9=>>Y>'2>O$ӲZ?7-yDP'"ia=9}~p~,ODOe3Y\!4#2'ïM!ig Wo!OO "Y )Lm3םg&Wi=4- #13 ʼnTok7V^do}I|-ۯ޹M뺻[t*DGIMF6k<̚} #k*DA]49}H^563~GA:f2ᙰ袞{#1y5Vݫoqf򜚓iMF)aeMف4,cɷ96ݣ5f+ieW+,oՎ;&V*m\i4;vncWvQ*n$2Җ<+#^@+o$H:+km4#/cr^^6x2[J B]tlx.f:zpK1:^CaވD5ҽq?kBEN*+S6fa~Vخc^c 2\":>Œ *\Št-*R~n2QƄpXi:*[V aŭlUFWe͸2{Fxg9dfJV -M*,.k +]WST(xJqXSe|Pta 媂ԥT6MTOXUfN]E,Mu^Ҹ}~\Uj5PW B]ըZކ@XiU:^jMSuZ^\T]ej o3V  %źZV^#F]5ѮUZHdž01F[D]U/裫KU fMskkve@sU)̜x#kiJK*< ak{LyJTi{V#t}սrERy\A}͜)np&7%#h&x9+:6]؜ؚRuvk'T̳UR0l߀nk1P5>6K!uvjS$F.H; d\~Ҋ;ߌ PV"+ZU39IT6B괹 jS'հS`l2\fxw%)j/lJR/q灍d5# +ן=Qir|=[]]Sɩ+A 5Y c(J229|io"~*j߆lms&%ţq:D:zR{\N.=Xۛb"I-۟lS 0ޔ1[Du+MǾ-wRҨD9L 2_̝~<>5QWj"ǻqK.YsYF;&ې|dF4Ů#7{r6.9J|B/mUeڴ?:kTs  Ztjt`3 fI,8Ggӝqg6̞ !oQL(B1KbCP3mB)=)g)pl)csN$v)bSǢSynq2(B/%s\?jPL 1+PF,C{HQj SJL+1^y~{%,kаA) IȀy<ȽyӦigPJ64)t.>tGPEQ#h ,Qy3|h,?h ZLAlԸ'9o7juQmsLҔB_Zdzq1jݻSq* HWvWb[/Hi 1gn`s36:.:}t'RBW5r't&؇ Ԁbv|Npr%QӯnO]ϕg%S_4 n8@lh(Pa3C3*溺)h.T :y84O=_y89L*)2+U*TWnُ "@VO+ggLwݷO_/PK ,[Mdi>"feign/template/TemplateChunk.classUQ F:O#b#ۮY uWs}8 , )prr\oFhhh8τ`78#YJ6&4W/RYΚ'g?^'=ƞD$W63E9k\L߱$?q_nj*(TC#aFOPK ,[Mt} 5 feign/template/UriTemplate.class[oAn.k[kjA.[ohM$1iK|)LaͲes $6gvR$;3;~bxE {rH1+1MGpW0fnXn51vfhv3Qrz%̶m۷(̠Vz-b.WM[|v/s/-ҬV{MnչcJ9P'i)!dgؼ"BBMjfA5hTv:[2 "Cjsi7m x.:Mװr+Ӂy_fXдZ‘}E؀#CPw<ݞcX^E1YǠǥK­LSjBP6NJ@T,BHzDhO\]$FLk VhMnxU#])7XɃn`I{v!XԘk(cF!FR?.yIbأ}EiTJ/(j8톩y'Tީx4%dK$[RHqvPK ,[M$feign/template/UriUtils.classVsVky 6v! l#`0F ?(S,)@BH$iZJp6hi;/?dBV g錽޳|{V荷<lrTXIp)rdhb3)dq\WPp2|U 83 PUs V5(xVs +o(o o^#L+{4B!8H,?ŋ qQX>/d/(g2.I;8džbXxt_W+:IՎk Y!2Ne--ejɜ.aՁ}W|A5JAYF2bͲt3EpN#eX%F%xIXgnkI]DNhQ4z#+tc:LRȈiYF6JtRBu;$mM J)fO EG2ґČffu+u%~iK6;tKՑT6ɤMK%jDBXFZ[9dicZƥ,ѬW$T<͓ B}Ȧ9j$3g&d}e.guėd?OM:V̂#yV3YW2ERoA{oHNڊ>#5mI/'L.u@%JQ2^2cڙH}J̄c+:q;TlG8WTJ*~}*F0W"*zqU{%ѰvPSˎL3ҲKk³wƲ2*as*WX3޸y;ָySnp۸]lsr6m1nO;ҽ6WUh"q.QAoU7TqS<~ \QTV1b5>Gkzh]ܒPzZ~w,Rv[SKณM–K t^TB_hvt֞MϑqMile-uSim;YzBqf,10!C&J/ȥ3 2`lńޕd)^.;+^BoW { {Md]Pooe2h\tt.C׶_rbĝrmu(ihr"=QK~GEb+$A%ۊ*Ϝܫq`𹓧WN 7!no 5:k95Jm:<<^" Di" s!d] ]'6!z\DpU\~m_brN) _ ylHE>>gybPK sF%META-INF/maven/com.github.zafarkhaja/PK sF1META-INF/maven/com.github.zafarkhaja/java-semver/PK sF0qu?META-INF/maven/com.github.zafarkhaja/java-semver/pom.properties ˱ 0ِt zXLʙ7?|dBWɦZqF2ꔆ]Ba ]iV7m$KIt-2e?PK sF>8META-INF/maven/com.github.zafarkhaja/java-semver/pom.xmlVO0_:nM[EL&6 ތ.mN ;Na<)J0jZĸ'[&Q?\S4G|0|vhw\KeG IRǃi~P^6a@mfK̈́u Z꼩!/2RĘ 'K#ֹSo>V8}:L@g&=j]w艬_ %a==Q#CIE #AzVo\fqr W끅`!W]W\)FV8vn){7su2abRPuqKB{*AӰF)?-Zbh$U8U7 &hؖuQ177SxŞNz[`KI V;('ebd`h=:GDpg\ ?2Q,y_g5f"K<{6 ar]T=Mu3vr6^p8=EVC2c]q{[^M&{wiRߌiă[m1)pwL!%oؘoMDzo@;7[[f9~fhluO$ɹSbY;wuyqa>E;juh$}]׏bƓNI:)#=4|_ CB$U5e1 EBӧR_j;ȍF8f.b&p9dXq~oPK sF(O 2com/github/zafarkhaja/semver/MetadataVersion.classV[sS~d%+ [ 6+Rx-nS"u5Y4 $ 0:Rں;B[Fzq{Q?i<=ߗ4tN߷wx}}W>*~<:"b!X1#C:ȝ 9䢣h Xy9Oʡ 4VCYZtTtu<@۞J>?j{V[v#U(H*tZ`K:Sp\eur嬣V_ٞk!kX={$g Y8swO:X#Ok$gTw]<KB$8ϷAEh(!㸖ojѣlʧ^Z|Jm~{݉ MeGY_ŚEhCjlP:Cz&7.!rȜEm *Dp !8Ï\8ǍxJ!MCZu*>+`l`}mU~G]G;wo6?;a6m~9 CDf;]]E7 _ʗ/7P]o+ BGdoC(#ϋX6]PX3Y!+޿A9,Zh:Ikֿuv8g51緦)V kLkD3f;v" h~mұ ~Qm6Ap"s(r윧~uTZޥ/uY3VNDa 4Ȇ@Iɘ;^'K-HX5*S*&i\3sZbJF_q9XRA6wzM?BtJjDB՘cXbRt%LU~,~frZwwwa5%z!YyBx48M{!22 De9JwcLjKC ) Dv'b{ѹްX75k^M::XkEyU&z2{/SZbJPK sF?a! 0com/github/zafarkhaja/semver/NormalVersion.classU[oEk{mw5P'd8i I IHx gbojuMBj+Q@ogӲ=Q!qI4z ʥ= 8a RlCt:^5Pk:^70LZ^iO5 ρAᵦɐɕ,& g02 0`EbnhT=*"]CjSA*YeHKQ`8t=DdWob={i} :E$)e uW09&kDd-d%&%i5C'x)|n|H<i r8G]Yԙ_g4w &:*;v#R(P}OiFs ×*9i^Ӓ518SLf4kR%k<|EE&7m( Js^J!U)I &${, UM>jT*IBF??$/b0HFZ/ܟPK sF`1com/github/zafarkhaja/semver/ParseException.classSRQ=7ۄaX K7pcRD)X>^&d &!_%Ti<w2H`ev=_C}ХIER4i*".( ӘbVt)6Cd-w!'6BKՂ`Zxըl '7˔e&/opǒ %05hƦvoq.*;1VS˻V0 -Í2ƺXv1#+QWaóW~cݚ0]QX*q&oԩ0DjKà$}-/9Vgv׼z.A]6SXrJj9iᾆyd4,2C \t*IJR0Ik ۵*>&.KAJѿhQgT6+k5ahi;-ᩔ߱ O QdcIC8Ȫt7 4ંk )qHTRtFG&5 PK sFWsX)com/github/zafarkhaja/semver/Parser.class;o>#v.vnFւĢTF5 IJDļt̼tkM$!kFĒ"&qlBB4lB0ua3+8(9-3h"w9Ez u %IUiEYũeE 膲120201# #3 1119PK sF N/o ?com/github/zafarkhaja/semver/UnexpectedCharacterException.classVmSSG~$ފ }+ҪZEĚ6 M&YMFLFA?ؙN?7u:=y5R&N=g9yϳ.FW¸C8pMs$n1f'-,qhƐ40TҒឆ%pj"Étod[&9`꘮YXȖDI`S%2w0\^O竕dt7|7y'QvrM]#챖 ̚1[f9bYT.>ʋtw&_ȷi{JNثc&]x4C=3<uXa" 1b9m"ɉF/* F8=59湩y!M\Qݑ?AdJ8G!8aHQ%30_x 0`3$zPK sF@w@:com/github/zafarkhaja/semver/Version$BuildAwareOrder.classT[OAf[Xn"*Z7-"%MĄ i;҅KƟb>1h|0>yğcgMqa37'{!1 T-!|TQRa(3Ϛ]ӫ1IJC|n VS8kiPnqSa.}j=Xqa],Xu-{X74 nbkG8FC8iw3TT&a%)F5*ȠTƢ%zr[#[K|;$c<[;ܰxwXinW$T("{0$V.|IU{e,rvf1Qڪ;-qϔmMIա# 1*1f2Q28f^>Df8k6C.x%\7S)5: [osq q0l$^g(Wp~89d$ H@yIAHѮ8aLDqBqZ) o/C_MbO{UIwj]y.ӧ|| Fk:2$HKPC|@Ej'PK sFv),2com/github/zafarkhaja/semver/Version$Builder.classOAƿm(Ż"Bm75$bj$1fڎ6[MYx& F}o23ӥ sfΜo̴?~}.iъt-lj8 ieD}S:N㌎0C]rbhXwy\fsL{A/;⪰wC8W1-0md&eBͶLs¹sR[Yr;C޼2h#%m g+h"=/3s7_eܹ3xŻd%_N¥VWxSjoB5_ӵ2 /p3$4ש[ͺy;Hg1qӲDA f\*ϔ*N^P04Ўbh3E6q1lk@ bҗ20F ₆1p_*O^w% D^. л6.g+U]t@HnD4w\%,;YnQJkluEfcŲwOYJAP/ Fٸ<6j8YF6\F V' DzF5;)cu H>!Ji&QH[>IL)b/!)^r/Y qL aֹ>,\{D `qò_tcD2eD^Hץ/|TN9^LlNDj gl^T@jD'>-=.+G}(Gٚ>c >$/A)>|)|>ͦa}~,~=>_`vi|M`'<$|XltpыKL2$s^\fui=_-g}hė\S𜂯HPѨntDx\K(k GFڎjk膂JPP7$EcƄM4ͱᦻÚqdLךĴn4eǢ-|ޯGt-Kh\X[7 } };::xgp/ Ƶi)EGL#%EhԢ"j`[g5mF;:%T[8Sf8 ͌U<jA8[].FXQk86Jhǃ :b#D+{&uc6љb!Za6s,L\5 _QY^.=su2m %@B}]0g mݢ)A*⠊PCHŏ<ýCO3\/؋_b\ůf}8KX!ULS~AE QQ"^^o;K{hSG/OnŃ)LfTR[Vн&'+8 /On:=X'h9ot1 Z[8$D$ n<.[;9,׺^\`qA&Lإ~9q}χolU4;}d $4gcny[.DCˤ7S3D(xĤyWRjEE%#(~Ji7僉v!:[_rkQuXM (B+Y_j=mъ-f+e6ǼXey;w :N|T@R@.@9x󕯣{%x ӨZ ^$q;b!z?W|6R]9BϡB%_4o'7JTm{U*^t#,7/[U m bZ K) B Wqޡ(Z7TjR1 v $'!ȀTWvH☃0=ɘ58BF{h$x/(f+/C7`k(E =Y!Q&Jv*gtF,ɝA2߸7࿂r3)p8k[C<&b¶VƜ㿈Y,v~G IO8deT̡rZ +C88:={BBh!U.\9X x?q| Ǒ8.q+Ǒ8.qܡ3@]; g2@7} !W`&'QKNYy Pvԝ:WWuۿ;rmŘ+%&~<ԺbTL{P&Fs^) ˨x;ط(mjUCYëYԞNVfk=.!똜"Pr=P!TP+G|A6AKmx (| ޺`i 7ÿ$xm. l() &ydqXibH4Ja~zfMtYIz:vWb(Lv`'* jPlA{6w֋dV.;8/މr-w!iMOfUNzK\ >|j/?PK sF=U ;com/github/zafarkhaja/semver/VersionParser$CharType$1.classRkA&ݤikj&nk-E"M Rr6LnvP%/<7?J|;P!{+Gx9hX6q#)i6 ZsOoc^à7ž`kzx=v<]"~K/٧A=vj\S$B6|ENvN8^쎺;~܎DH#d>?(ôx츢a|Iwb!k Jsv̝?N+.z'V(v8x婷Uzr$y8~R-a/wX= ypaR(1l]⪉ ~"?YKz!h#D[+7*" Sh@~UĪTWgOgՠ `Ӵo#!{SڸzLa= y6V b{Lİ#7¿Ќbg1J97hg(:jDd]Y]1KsN ٵH"u wh PK sF& ;com/github/zafarkhaja/semver/VersionParser$CharType$2.classRkA&nҭMRSZGiqkF$1U($*d3f7M=/xA Qu Alfޛ7o7/_l^`UXpM Ssg K?˽ ;axdr]۾NOjh;޲=:yB\N-lОc}fO7\B7 sNe#z$R|EnE8v^N{TNO ="Püux,\9x~̰v$XF &\PyϰЍ8ìiqR%K/}_um% $ɋ@aDJud&nڸ +3mqѹ0Qf#Y{xHz!/ ImVZ `w}Sh@Z`>>E0O-KdY"}sdKӦ[`kӔ.[LI:DK{) 4-c`/a7YQ2zF־A;>G V#$45,l[ tFPK sF_x)j;com/github/zafarkhaja/semver/VersionParser$CharType$4.classRMo@}mhI)|$8@JJ DNZ;ʯ%.E‸!HEJ;;Wq аjB3X3qe֐p'$JAoF}Cb< {y[˃.~zΜz19'B6ǂnh {r'!,A)?3q''Vכq7^e\O23u~Vq8PB)ttŖW]wyQLJEE}&ڸ KSmq0Qf8E ~$?qB%.$^i2TIwO CiYWZ[c>>EjEv,KRtl3ڤv\GDѥ`5;1MwX"س\3+>%RFQ嫵oЎOQk>Ո&:`*MѰp(ZPK sF |;com/github/zafarkhaja/semver/VersionParser$CharType$5.classRAkA&lmlMZ[4YqRYlE.\9w Fr<^ x yr3os.=>N,FB:]!c? _s YR٩3q''NV֛q7^}àd(Og$=lYWp Dc~ֿ꺗&$C7bR-/[бaa[(΅Qaؾ@ ~}}&E0K dY*} dw(2RD{4-b`/gf5X)Qs휪XA9:GV!4 VȪ4WF  tFPK sF\;com/github/zafarkhaja/semver/VersionParser$CharType$6.classRMo@}84$R>M*)H*ng8vY;… H7$~b5HA]iwfg޼?|p7(`ĥ2 ll  v; D8vq= h$ +]?{P}1 زڍ\ {f4Ϗ Vj-v' j"%{uhěwPSOL١T@؏WBRmfz$,qO$'Gώ'MqMjn&]O ~"iOdWONhr?+Wuu' < S=xFk ޵ j7qsP7>4pA#OCߺY@0gؤϠPs2-,KJwXXaa?70 cTƐj5 Y-=btCl3+q\}!cGD":Y{yjЮێU\b Urk3Y.v`=p&lP.O]GR3t螙]6430]bHھCedaX, ~u Vrx| ĴS)̛*]GrRY7m4!F5)t ѥsQA D|p1@ *%ext+ L*c4񤂱ƔS S/+l|EAwn^ 0.'!B!SMc<۳Q ]W!5s5|8Wrr./^.omxHS@F0޶<aH{x;c>^qDŽ>&9F{"$ \E3^BxBÕ&#i|O*sD^"_Qiia}h I Ѿ:ħo01כ:p ~ Jp9$mŵ\߯퟼*gh!ۿ3e馻i#N'g5vIr"'G7 ׉+((*q 9sT*N+O-c$l X: PG z2\ǩ6"u_COXG_ 63Rgk8~%*=- K7"UXEnHUӍ(- 5=o~g/k:5}`p*p:Fo~XJ"WK^}T}QqkkPK sFk 0com/github/zafarkhaja/semver/VersionParser.classX xT,yK! 2 (!C2uh6V_G`23PKn*֥XT1m][k[[-Ŧ}23Il~ w߹g}0bg;nxp\ ;+n(ptd͡_rGұSp(8,#rxH{Q1ʝ~ ~GnrxB<)7IYx:Y 9ˇ(n $^d^+ ^uRrįIZ~uх7X{\7嫷ܨr/ *wޑ 7u~-#n-ܺ3 8;V#SeD{wi[nmV{vި/oug@zТa2j6mV]ëk/$2]np;)k荽=zUks'!MaSnp@3@8F%QPh9ݯ(oI@fKTޠL8 M 9$eTrB =dI-z42Μ`֍ؑp)9KhRѠGN-%CIݦk%%VZTa ɢv 4y)cE5>G sHvt hiFg,tc((O$+*@nq^)jP%T tjN"A .<4C"Y@o6:5[Ki(ό7ojj#D)2% ߑdA3;e ªRp#[ؾ>Z'u߬D^_;W  Ew3_;MD@Ôm fwF&dHXɮCEcz uj/ܮuv[&ڷQ>?zsl1i+ru{zü/a^.eh^1߯wipW0 zY1*2"E}`Hq!mT…*U ғ(h@Bh9**cTlU"!†^SYUq*rprMYiBa;KոBp J]96n#SY4[mЦjam,*. lb-8Cy҉#Yb&en,7ʀ1[5BUrV{5Ws\UPYTQc*v( UH$?IBvecU԰u+"*`aEz,YƄ?ЏRbZ"U,裡IF:X,@M/<'KbK}lX#R3ͼOz+m>IO <(.ͬ՛Ƭ]%[FMCA"2ּ;-UDQFA6Ozڝ#5X%i&׃MZ*4="ztlx&j_J3x^Ź{Wn[[{7P0bDzSDdWɩLӋNtD]Df]{*ϥ䤯`շ$q|w"C4-4Tt֒^c[\lꖇeɕn-h~c oJ'Z>lhAgTճp-<=-n`)[[V)\f(C8bso4܊| `xp*9WvlARj!)ڰ [!\}!(*hܝ +CNq HkRogg'oZ@BK6p):?FYOP*kYmd5m=JI♅nr"84]܆c~vO(=sH/+xG 3g$7ya^I+/1Na+e4|%oSQżn.x31*iXJ!wɿʴtΠf 8c|ExM1N(3d-~I4t\xx t+̅L͊bR,-T,W_*ֶe@'bl ]|%9& J\U&M14@]'u'ʂ~ƛT-;h&EFrMllcC҇}Ŏ{L `ϒ6T6Gzp d c(x4k)lw_,Q/<);ɎuصՏm2lȵM<[򓬰$bI;Z,+̈#R{IR1KڭoYv!v~B.u.?PK sF"com/github/zafarkhaja/semver/expr/PK sFZ1կD+com/github/zafarkhaja/semver/expr/And.classR]OA=,?a}Pi!lB"hSLx!ehdm_/&̶jws=l7v<=く>| x=u l7uLp#eB„o`@vW:l+f5) 9UaGRm$5O^SO騠T2U?fʌe 1x2ݐa*wbx Mj (g+G2P(hCK#`W=jk_.nԚhK8WB̎]5D} N} V61>cs^J0,4",Ü'4'Ė8K,}~e]xWe }AIPK sFl: Bcom/github/zafarkhaja/semver/expr/CompositeExpression$Helper.class]S@mKk (mjK aIRii8x/? W0Qmi^={4gsOi(1ALP0 ESS3TaV3Z\ H-(xI] SԂ ӆe3hl 1άaJ)Ϝz;]Ycr2Xds%bNeg w>꛺~Kֵ2+1Gcv-cv9rٰgls",g#]M0יsA>@"[| W7G;6 b.,r$to >c|"HՇ7',|?>qܯ<?D!+\?Z'8$x#HxqM).8:$R͋QIʑRGW#-8H8J9R^WRG&!H{q6%ObA;com/github/zafarkhaja/semver/expr/CompositeExpression.classNA-,U?P4543mvqnDŏ k}7YX|wΜ93~`Wu$0Aǜ :bȨBFN# $1⢊ S%n !yqW aD#/ԚQv81 J{hFƋ[ȧ7w i7hF-7y D{(pg#T:B݊Pлw Kt` w|XCTB PK sF\u-com/github/zafarkhaja/semver/expr/Equal.classKO@ (VFyj^4-biq[3y1xx0f7;әgv?>#k!2d`Ux+_\Մ2lW^nʠիosP(a,]1sk cJ0$N] ^wȓz Ը9#AKTo*ReJ7Da F{ֹS QZ5ڼc0i1l`agBa I6z[4Hɴ +ܚ#ҹ/8Z)=-yfT![{+X &F,´aSde/ NKbn<1b H-(@cIAPK sF[$2com/github/zafarkhaja/semver/expr/Expression.class}= @Ř=qZ+B{ dc~d ,<S 3߼?5a !ҵs3b b6ʴͻD=sNbZԛLΤӥfкrUpτ#R%י:$6 <8Ow =_PK sF>w:com/github/zafarkhaja/semver/expr/ExpressionParser$1.classTkOP~nF QQ**%,XҊgݑJK ?g512g-Is.ymr ,p%\&堂Rܐ0$ApS°Qyz֜?М`_qkzY{_pwCj LqDoCl{!=x#[ B]R},B=6{[#sr^ S]qW10g:wec=C #V\ "a$q,﬉Z5( wUt✊ U$C˦%H/ T6Y6]6Y6]Mݛ6=E"bȵ^/ P<{b{L6Lr.}͌ngOH6gK&+AXq}5Zz,SZ_ToKImq~$Lò5dh)c;)S d&ɐFrϓC >~D샼⟐HCICH&R!j4I-3$m%k~2Ac s8%w"/UrQ^T$B(0'9H%]gڮvS**J& Zm;ەjWt6[חٮ*>wIsI{={~g~Kkx^s~‡'bOS:cA)Ş4Q?sx^//*<ež_(U]=K_W TW EVFwJTEnF׾VY|_?(_+Q [~ ?R ?V?U3?S%z]K _TBoq-okXD_|~)lRfJPk4HW;]wcto4'/Z2dy?Yѭ tb;Hz:I3S%x4=4uR,@cU[֪x,V$Tv5_sb,恾fr[tw/gfD]h2cgҗ+ `B`RD|K4lY7Sh{n{a; 1[V*jEzR>FX(!Gbx@Z-7-&J’4lbjN'R9>9#/łrKD2g'C0dj-IfF,N%tQNƺ #Ģ-ֻ'å//AJⱸ〈tWOfws4i3{\LD =%vivֻXj;&8Խk|QKSbM{̌YFLUR̢t)or4ٕ6fqm@_#ġ~V(.h{jZ Y:ے;ԙShyf, 6&zC{K媥3i[tN9ؠN-McY)1dkLF -%h'`2MKa&N/%~ Mζgf@@ Z \ͅՑn,wimhv̓iȟN@Xm~&)Zvi[U-f;:;վ{6h_jd1btdzL0p6wMl a!L1p : X!S#xԐiR̐K!:3ː*97@!suؐy6k..]%);f|-ݪanS샊%+ߐ=ʺZ6bYlHHA ޯXXA%y) )6dTpDCn SB(Tra|Ԑs!+e!\AƲZg(4H!kd-!W.N$ iVAj1d\.W ԏoqa M@ ,, xnT_z2fQP]HaOO0}Llil|4v؉?DF<-=TY2*,4#&~ :%s -Hm4mm<^̟՛^. x.?R)z&W o 8iJ`=#F6𻙻5b|X[mV+%ѝ "'ZDZǼAk3mƕFx{Ӕȿt0NnŻV\Ɯy}jߢO/w>&6wl٤$f2І㚼o#VP(Ϯ'})+DS2=gw S?zw ;шuΉvי9 Us34EVUwRexœl| (pwDb9b5>4x1J?kc9~U.--I7(pA|6_X9k!=J,M+b~Vg?I~nuw5'n;}#j9}Nm9SZƩ#8U$kkAY9 )__a* u܄oMFƷ|y~whhҔZ}/kaJikx.vb?6*Ga9(}? 9+%:~cycnU9XISeL[ܜXeћWMZ7ƞ ?"c'O鷟^9 ,B` !bļՃCvCm֌xfC7yC(޷,|0|O-/"UEU>Ruugpf3=VʤďYNJwL2G xFfER?J.K-R%A\˧[`ez)x1zs"sY4/6j ܯϛ66ꈹ7}:܌859GZF1A ހ#Gq֞n}5TEIq<6ci]#n,Mkxx.sh_])VA<::OUjtuGϜULd/fIwNa+T\a?0%vfyObI@-[+oGmF bȑޑc!; ]NO8M7nmX'w0U)wDMl11;'r xyun9W TaEOP0[vg+!Gd=>.^(oPK sFR}o/com/github/zafarkhaja/semver/expr/Greater.classN0w!$M)rAnNk6B<$C!M(7(<|||Ê,Ld0ma X`ȷ E"T(a\ ZN]F^u Wop'PNR0t }1ln ֲYa5P(K_wZPWmRfTy•qD J][9gJH(eJ?]3+.S5 y܆E ,X18Q qܯ;nCTI'dDkKok\T z}gAFs\~F 29N) V,=#ثɎ M!u"Ot\Mki*1y0R H-D>$1jW?PK sF,X|6com/github/zafarkhaja/semver/expr/GreaterOrEqual.classKO@ hm-*EcѫA/D޶gb#CP^oxx}Cґ´j0a!*P=RoZu:mۺW\];@4;BYq>dxİߖ Cد Yi UKlɯr•8 0-e*CU]K /M~[UʼnLnnBǢ #L,#PT*DIJ\խs!$xJzJݮsF\׿p/PJc4ё$h0(3J Qȿ州x֘dǐ$k@;vhWMk@׋210f[G$FFB(j[PK sFl,com/github/zafarkhaja/semver/expr/Less.classNAfqdQq_ưG\$ -4 񙼘$|X G0tU,ıh"%,X1j`!*P=݊w =~w\7yہGcXXcuHO\:PU.o׸:caS ⡫2eJ/D_ F֍Sڀ-IXO@FUMg! v{ i M@WтiÐhS[=lӋAoE3o4aQeVUz+_yhh:,?T^4 ;bfOc6(s25?/PK sF-Cx3com/github/zafarkhaja/semver/expr/LessOrEqual.classNAfqw=zu89H8xku񙼘$|X#ᤘNWUof! Züm}٨J+e,սVݩ{q%-ՕGyG #U)Vn*CkHryU"jE&K^]8UUGD`+ΗwmK˺pi3H2K3,PGf] XIaY$hpy֔u7@(=\8ҍac:TV xX$ɰ+1&,ѩH~`g{9)㈓اɛΦ w Vوy1b/?teQ&IFMPK sFO)8com/github/zafarkhaja/semver/expr/Lexer$Token$Type.classWW[z# N℘BxȆX,F,! #"$'.III8Y=u۬m??hߝ{{y& 'a< T<ǟ1/<%۞,ï97Jk2gex/11d2_a2f*_cg8 oq8 '69.b0Ns3\<cx12,s\a#.~0 ?U/=fI+@kK&tsœf8#S-<Ȏo7yXSߚM!kJW3|WGKgD5 =wGgdX` VLJ3P0V0+Z XasTAt+$K6 w,.nzyZ"pWl9mtXiա!ӟ5nrSZX[v%Cf"ovr&ӣ&%xNX9 *lw)hHq8'k+MDs'ғ3iNY|{^(ºx2Ws<%{8݉Kw2$Ol aSPwLMXMl.j+Svere_^JpƌM)ye9rЊeVK sxy\E5e%3{}`2;UW.tm9U"}*t6vy1G ʓBC Ր\qk7eQ+ͧRj;TTjGT|k|aq 38BSbͷC(^ԙ4܉kXcH^!6jRO;5s$E6Sz }}4 }sΆ4 k0s#Fri+S9t3UƄ\8/<R(NZj kC|{jCV0\f*e%GM6Ȟ~JDV_fޏFuʿqg~d:RXCN(Šq="J#KMDʥYav:5+yvyuҡo%ܝN$|! .it~%Mj~Q8: eWt#cA?Fv'Pv!2܍{OoQf:9Y{q4g`% > gX0V'JNcW zUqke\+hש:A+ WwUߨ3/x7ncߢ{o|^d$o5V:wˌzoԋM7%FAw麱[V-<Fz{qX:m\Xlp5n ¶A٨#XfFA n`= (/e7 VB鰖*[Qm؃[n:A3ts4*v q 7_4)4+kТ(kk~< A2` K(mKi\EsrPK sFmFs3com/github/zafarkhaja/semver/expr/Lexer$Token.classT]oE=n̶I&)1]IBhJI%*tnMݰ |@|<(j%R*$WZr6ڋbIī "o_]9*QyxJCXs+b]xM.{4ekQAZ0HOi8l3TK)`6BsAn-Xl*JQ]4/8~7h 쫥z^) 6E0CUm$栻N` Ŵ!FGI-X 0F9Wq?Hy9EzBnspaPotpYxY;( juPF:[LJ[(^0oy^3UU0߃] ?XPkzjrZͶaIÐ[Yy͗%R '-tޅ×l 5/ ~G0 VlA/;[ pLȻ{~0F r"CD})_dTdGHv"~Ֆq<(u#]A޿Q"8*O㬞½NrӪwPK sF->6com/github/zafarkhaja/semver/expr/LexerException.classR[KA&I\KsxDj^#>( BA80HR GIxCa\;߹ÿ?jBnXL`B$\Ib %QR+y-O ,oTW@xAfʧnF\<2t+ XTr ZNCn%/ٔWP뚴cq#}sRa0+)*: ڥ#eR|7xX1[`%~WyuA=˻M$u |dhJݡ'h8.m[okG|?´Z4f3c߈1s|P3<3'_D KM/!"૏c[ۣ1lPK sFia+com/github/zafarkhaja/semver/expr/Not.classRN@=k+۸n1 5QPGL 1~?ƍwwb̽,H`Ɓ aƼ m)B^UƵvŻ\x{hvtwHAD "Ю dǰlW!U8i7+B]JRF+q⚌s͑A,M+ ճu`wzam&7Ǽꞇm#0)y'`) Icau0nwZ ms#[ |ti& z-.1#֌{_`Q5PK sFʰB*com/github/zafarkhaja/semver/expr/Or.classRN@=cy@B+U( KZZJV,@`NI2yhDUnB*$ ߹=kͿw RXNc+:fbź h ; - ;orm?.HA 2 ?0)j1Q2g\ml:Y= |Udou=Q{uas 2"AZ{0_PK sF ^ @com/github/zafarkhaja/semver/expr/UnexpectedTokenException.classURA=Ma4wܢ "p hUMh@2IL,ɯo*Ғo,owB2ܭg~ È7،WKj3 Pø̑ E)J#aڌq\H1˶\*ɬ'SEi37m[:cye0bY|y|) gq^,ӕ11rI:m~!1zQ lMXpز-/07@ٳZ<,HK-eeɳP42V#_"i˖¬tl$t1+±Ծ*{%`xjWY)YQv -=rIJl)*M ќDp.ѱG@zEEOtl-B^19cK- ;gV uEN'qnCXvrR?Q`Mp#г0 ~kZ)Ct1Xݍ3Zu>ÁQ]-[9`,cD:` tbZ ] [j+{7_?"_/sx;另JMtQUTZ$ m{-ET~>w#(J%i;zjc E{78xbc3 }[!Q3o`>M4UT]0?#MDO`]e;|i?4^B1$_AAW'q8^W[kt|4G*\Ќvb\*f5ډ JQFJcҬ[j4* 5:3&=H4 B[~W|AYQj$].Ӽd9lZKIsw3NXR$"E2fqN" D*\X >0 2 dԦS nUyZMT[ pVb[ ʪU YJ^؛<_&Pyyۆ<{FEcP3)2g^ c3e>ϼ,ںh8 X|/p}oWĚs$}Y6BwE;u"fZvk_ 7N\*8e/tUuʐܽNNMz٪fqM8%H*11Cx0"Zru.0tCUǰLf^Z# U)"χ!t:fu!dΦq!luQJ]gZ ~~ckLhTpA wv`4<K' (?GܠkhܝLp*MUZGP(& W(o6IAI7g}{pA25(ÒL{!')M=պ8HvHSAn_zu"y_NQ:(B]wC?PK sF?Dd:com/github/zafarkhaja/semver/util/Stream$ElementType.classNN@ v4i8 Q )Smϑ§Q(9 hfv?.08"De;er"ējֹzWgBf!x,وMrkݕaL&e 8&\fF-W6oWZibTgZm#I-h;[=Qk15/ܿ=CC;6vqC#/PK sF,0.com/github/zafarkhaja/semver/util/Stream.classV]s[W]W,;NY*ǤJ+v>ꦢvH4uDUIP?xL݇ۗN_0x$stu-Yk3s{l݇~ ` :pY WB؇!|5`6tf !Eڰe m*gܝ ٜU*%'N߰nYxΔgVRzun[\ 4ƳlyBAw:Kt7+vqZqkXZ^2tYM\ϖW*׬exsźa%J-lh[L1q;2Nd eDFq*b}lenX0-:(yDأukyZeK.(#K N2/ 87ZUkخ"H8(;L*HϥR{;a5 *3,OtK-g< KoJ.gʿj˞b(k\Qp4v^v=.Dw`)YR(ϗM{CM G9G{UQ^3t-@lS}MhO^c+;E뎐`Ns_*=de2vttddDA|D =Ḉ0e"TyynGg_:b~1+Zu[yaD8xˆ0rX (R0 frv.n"Bv,1PUѝz*xb;-ͼ(8eRݙfK3V9b/jOδZr\!wiіq w.,_bFkْN"ŵ lךOqs/^lޅ?_l݇r/E1MC:0:Wl4r  ށ&4eCbuEF7hʄ:pa~u{S&ph)p7ufu3308 o&UR35S]ḩ>[>6jۏEC"AW9y 暟2zYA)S%RO3Ágij^@1ՠ5u'8*_Z:%q(%H:޻xj体qg8 #])M? 7:ϺqY#@\SzZCH̽ʖ %Ssyp5Wxe4gaַ}քWsxtqާPA|hfxsŸTMo æ:"dժUPny%ɫ+e" a C@U³:Y 9Ryu;E(EܟW YB hIݟ4LLc4u` :18~v|OCbg'IÄO풆=]"RB:5xv\ 9A /q)y. }.)Ce]`ӕ 67S<~~mG(l:ላOzmW`Ca8 \C_s|QF&q퓓I:ä򭵾~I$r9 &ULaZ-"r5 0%7D 6F[ci}S F1]n1m[ UQ!e {G8 7Q1-oor{gos]akVk ^;b&JfgLgs(6mZcXԻs+/oEںWzU˼mSa2 c{G2,"2aVj%*K(s L/ r2a=C!Y @%gftMn:V3T&Wћ>"oW@gSt,4BRi i8TTNq7պ$H3 v_] E, D= akXJN( k@IW _DYYC+ ޑ[$SO,WTMMUO,mҝ hWbn׸+$Io4ED'AZ6B"7~ "} FRRVI:&⁺EFSb9Z'_4Ghʾˎ!=pvb 40Cy &yHmKb2% a .[i N4 ~Цh L՞Y8lqх M2d4bkaFi-"C)#^?7P_c EZڑ}z}Hq8݈KӸC0B(T?0 9n"PRb#|. eYaXPK MxG com/google/PK MxGcom/google/gson/PK MxG"oa,com/google/gson/DefaultDateTypeAdapter.classW_~$0  퀐d 'N혀bL+6=iKV}wrDC[5}fVHl̾Όȵ&(( [4y1, m1 B /yЎelƧ<|ZgT|փ.|΃n|^<*A^,V_iW51|݃^0-V]!PŏUT*^4-T^nG=O/e,\l&y nU$Qr9=TpnvszJOjowNR-:-wht+xBjft$mOўݱ;bhGඁ%<}jOk(}񝓃aO\89ι?.wCnhXE۽ WWHmtq;}Ιe&0Y?`KVpA\z7\ž~w~׽&u7 QʹΝKܝ2w+9*Fyh 9ci x׽PޡU1)vCH[hmk|e]JF\_0:J_FI~Io7xJ8X!_%.z5QzKYY"qٹ~8HO|U} :Źs`003hhg&|>|ђ+ȮRÔQ6h FLW*)k7\Ő !ceי{~:CSY. AY<0NqV(uAxRvNG r&e)j1ȹ{*vO,(&j(~ޡF d4֯{$:\TRcE;%yu!R3 WZ.pm!b݉1\qA,2(c}Te4{MtEh"ZS$K?PwPʨbPX&\q!O##PK MxGloD#'com/google/gson/ExclusionStrategy.class;o>#^vnvFҜԜF \T<}cIIQfRiIjfFbF IJDļt}X!gpfz^bIiQ*#8-;*ҢT21׊ĒJ=6FEta(dd@\L, , @ (e8,.PK MxG&%com/google/gson/FieldAttributes.classTMSG}2?;VX(G iX be]%sKCR8.\]jBJƯٞ^[:踋 N PUKeeVt+)2hkXcݑj3\??N;0ZdH[K C e-uiFwo[-m'WwLnmrWșw0S7rq:(w</<"v:¿/L@β==S(N4e~ץ"i{2>d{DuO= GNjێ} y/|E:aL Л.:?&ZT⫕‰ dN#U^v,՞P␭({b{kN[Ҥ46Z ^jgk|?"v ַRվG.Bs fuGSB54+|iRb7kO'5ú q$4|k".xW 41c>?Ӱi7O >gr­L`xU3pjz-tksk8~kY <Ь [ jPah#yW [C;PaaPÁ5ܤg4Ko+ :Z iZlyT?5dsH'{ 2ɇi8@@4io:x70^ HC w$#.1F'"MTT`fpX2c`thꠙpQ8s/0R1 'L\5WDy iU\TNDv"$y = w<)}{ͅP~ZwShV>=4VnF/Cq; )1O=O`6PK MxGM*s)com/google/gson/FieldNamingPolicy$1.classRMK1}i *ZEWIE EAEPm 쮂J/ (qvۃh$3y3;C0b9 cerm5סDR U7-PnH-[][E L}tdPt2fv&i J_G`ddܹs;s}M,xg!ژuќy eT^}"dQ+%ko%a<<8ќil*ȕ[^y Bt`( wL8+C1|Zߗ7d ShQJm*Ze-M%)a^ !A=4+񼅐稊<$#1Fwb WhG]5gw<Z3ÈGs#xQ-PK MxG x)com/google/gson/FieldNamingPolicy$3.classR]OA=Z"(*HV!1`x2d:.&+}Q?e탱vw=;ѭR3e= ʨ%"$a*D#Bu%a~<88il,H'j~2BoLw2 062L2k=%@8{U,"4TL\=ST*OqhԝK!=Oc֔.K}mbm3va-Csml# !De0C{K 'x]6.XfY{#E iwj&WXo1,ɼγɾx0PK MxGz_)com/google/gson/FieldNamingPolicy$4.classSn0=^C2:1֍veK;& * h y x>BܤNԒ}s= .6,ܲd➍U7fCdZ?U< ^(:#c_Â/#E+T|pucN#= Ӊ"+$~nu&:rP.PZs0f(c.m0HG]O̓@$ImE*LQ1S}T*7(<;۹/ T$Pf}2ljnׂI"ksKAc@j`_sCc[s P&pqsBg*0_.y#'"p3WDȕ.P̀{G/PK MxGUK)com/google/gson/FieldNamingPolicy$5.classSao0}^Cuet c[7ڕ-$$ 4ilP)THE^"IA+@|BډFrw~l}-kaLϜࡅ50}P{G(N/(p;P%ÂF;8UxDa揃Fz& v'd|DHr<_@@I'HtRb@ejkO]4QD*iv/噒~:Jurʵ) VOc_ꄆ,zJ'~#sݷQBc6S]u48vl4=8 3la(;6 '>hӛȾ9%Xz1P k4Ww9¦&nLaqKBg*0_$9OudX* x`bsdPK MxGQr 'com/google/gson/FieldNamingPolicy.classVSg-lXVQT (jHKAFx]% &VkUZq 0eO}{δs6 xI109߷9O~ @~ bIP!M1EDBB- %HHJ &) i|vII&3ӌ 䌈.IX#\> Vg/ąF ">uI/E|!@u5L(鴚lX&d c8'D&[ݒoBy*yD4\!|s;Y) OMa@S(|]l:L; NB^[kC+&h>Qk'xIkK%m?amk"zYxJqc#.PR.5ѽ&N6գo.۴@lS7lB- aG1ˣmKz/{!*+t1* {);EwPN2Sf%@)ffD^&kWQkur ?nQ&F)w{8h }䯝basz zI{GQ(  aybq*ހS2:@/:2l+)6~D ~|"70sûiWYkUAݜCݤjU[ZgEZa _w(lnޛw,F*X& HY+ff`?0 !DVr)s4`eSjBgx*SX5xSX33x9~fxj)'p 1bGy8bGe8p9 8@xGsåaVefUINИg;>JīJ=qvP?rs2jkZPK MxGM㷝)com/google/gson/FieldNamingStrategy.classm 0ﯵQAptwA;}XchIH9>EΆ{[0AΪՄrרV9#>[]EYڞՏSP;&Jr{LpmaQVt?(a]8QJ ? YdoPK MxGLccom/google/gson/Gson$1.classOAǿKԊ*Xj[>ZҗZS K}2Qw>3;?} .ʸa5k`u q"8*xAMMdaXiK  Tt2i E}dҬ˦(H 2AB|10? D"QF^%b"T$\A*F |{(S;1ʼn\S&? NNQh E0Ze2{2Vs5Cl 7'j#wyaX,PjYzbP XbN@XVXuuvU[e,cS Ī[#`3h-PK MxG=scom/google/gson/Gson$2.classNAƿik]W`Rܢ4*m.2d:Cv1a4QHx(eq'{v~s3Xpq 4%+ $NszN`l{Pkzn"5 .f{^U ʎ6ZʯXu=۪o[b\;l*N3=oCWVUv7fQ~1W~b= u˭J^ 0WOa-0X޺ՈȚ+lm'0\ӗ̎VǸf+浂DtԪDvA nUDhs'2$k-$P*6Rj~;E6owR zZqtں {UIbMF$Fq@Yb6%>'p_b %cSH"B:W/UCZ'< Jk^x2(/{T,ډG̖i('0<]nɓt\: ܐzgvK #ͯgK=;_dt5õw˴l[5y/W\IgͧI^i^"uKi(p)-b`g~C01A.Pok!K@(i4.ei,+!#IiPpLհK53X~yUGu-2K9۵ytJnK Jʵ7_*e:[o}1 ++EǬ%33+pA=~.ԑl|aӭʎg]g0LkoլE\嗖5ַ~ݕ˶RgQif%LVkЉ4uK˪t_9œ{l;1MoO ;Mk*s`8,F8IĢN-lTizELK$Lt5[$ęM˒uށS/2j3xonJ֥g!&y¯s]&1(50K@()4f)+]8BgBR8B =]\y1snIhh)R4eap^"-<}X7e&'9c:;3B3C'f;WZ o`2|LM=ZpJ`/PK MxG}ZFcom/google/gson/Gson$5.classU[SP- *TDQ"AH_E9c  t|p|s'2:=~gO_#dCbBk2Vhd )a\&$|`N0 i{3iW GwMkvF7u1yeѲ3m<&-cYΚ\mKs$IF%.y%7ȇ;n@?USO*  5iW蹀<{9װIώ},$Kn{ fk eݻ!k<&>i#kn!V%(9s?^JyRid!g/hzfi +}{OBJ!&aF,$+X%,C`k|ĆMl)hǶGhb]go92u14xp.!~Ci[bBi5Os!EPidNʐFztsr2t&Jxoڇ"|puKWew`* K '%o>QwKWgVlR?4M%/LW,v}ȉk]≫T|JwIG__%=4`x@J kwsR*POkDHW|H&/ {o}E0;"gI,Z6r4{,9AC!?^Ji缷U6Z<Z@-Re40KAB,Ew#=_>+ӹH*N aJ"=}Q})ױh}D“zч^x%VPK MxG<com/google/gson/Gson$6.classTO@V֭V8Eq (|e@2GD]׌ȘmzsߟtbRA{*Sy&cZƌbB/D3'#+%Cס ;ܵr%7=˚Ź嘚U᮶ bY۵ytK"K&l\wMo[uh )-uuMo+s,+ OS*<ۧT|ZC]5glZ. CwW}6P) RJI%`P>os"İ76G>Mv/SG讥7&g# rcw4|mC-ruꑤ+ ,ۮB-^ su4!4\۵LdR9]H Xb+*n⡊{aHaTŢ_P-뜡 Nkb[o$^r/XySal:\0a&T#<;n8L n0ȚB^@Ɍ}#FR#wN*l(CJ K lBBdx j8QB!q;Obw. G2}RS kOc(GgPNc [w9Q!dN,CtWZ( qC)U?AOUG 1k0A}OPK MxG com/google/gson/Gson$7.classUkSU~Na!,˥---BmHK0v,f7n6C_;k vt}7){rs_p<&x F$5D yb'>Q559~2Ac`pSq\=N#kI&#%pjM5LJԜ;m FӶ6h:o[^ T *Fv'1;H°BvIw%FN'lM5cp<(#/-KwL5ש{mzu piA&ylt +-lK+8nQյ> q 0艓`SnFo\c`5@zO+P7ꔚ+{_kV^{DPmR ŤϰXNNTL#O~4AIW9@](xepoV:ʌb#1TC'PꭟYZ5fqUw!o}͜TD*>#*8gMe5\}ɸvްSS2 20ᢂKXDVA9_QSGVqpyي\ûiKR 6QZ@ }-PG|o|醨6?+RaG3;'%N9 4@wqq'C\5,7%=mXq%t0a {ȟIw9ef Mvz|u+UFDt~(]FO뮇u +FЯir`(^$G=<+I \ s ~@'3D&|?RχzWQ ]tR[6뜍8pHiPjk'p/*B~O^E `=}4 Dʃ2EvVԑ0$,V(puBM&I}"s͓ME:gYDpң|v|uۨ/eҰ&^l34.m 4b46Z8SGgcI 2EȐzbbĀ"&, "pϙPK MxG@],com/google/gson/Gson$FutureTypeAdapter.class[OQ۲]\ĭTnB LDK{Rf'kDFDye]be̙f:_~0L 1LGŌ1Hq-Exܐ1'&Ck/wmM˶垕RA/Y`nEKw+ht7-,RBKư wAd/JMd ߫lq'oyCΰ(3tVbMueͲl2+u,1THD='(M6YOk2woK#nmm|W/ TE:\/0_/>m}WL*j[<wȰffۣS:2HmB;dIti,#I}Nz]tVЍsd'qTZ{N6DlzDWSPH Kޠ[zIT})q'b N>%/O.c<)x"r(^! );BzOHjpG% 8>N1dqLk K2H3ֿGxgt1$F1$8I+ K&OIrWOS<{viPK MxGBL/Ocom/google/gson/Gson.class; xTYHH@@  Y A1# $3a2aZuK]`VZDIQAmjmu_jҽZEϹ͛7$Xj;{~=yt5x=-Ax◛y-xw+[Rq7{H; .z` /p=nͽ@졞G0_#n/c%W9wq MELo9 }$,04U1{ &{Ln禀Bnfy`(y1w.1#N1G,p<)#=bXEc>MKr~pJ%G"G98ӻqu!t˵V'[\8[] "DU\.Rn.rn+Uq?V7Uq ת:Z<&,E.~F1c©ߢ`14}I7 Cz=7jٹQ7]*fVz9Q$:OU* L[?JC=%a aY;dl8GsPutҬ`Np ۴a|a|뵍` [a qW;3S o RRw*H>,UŝdCba xr bT=}-^U'~ժ'W~F:yU< TWM K >vڜ@ߧ"HZZQ琊Y8F?RExHGT,ѫX+apS$6m97g(*x&M+D˱e[qcUxRO14C0S?c-Fà'wjΝQyT c:<آ URJ/EK1=8!c 5>Gܪ߈*wx a̶`m>=7P#UZ,㪔isxG x"%Q۲H㢺cػbvWh27P^0:ܘG*78[F7RBW`Y yRf& wH* FW_H+j6/Rх۠"Sü3RV"ꌴqVRe& Oߛ:=n:u u4Lg_TTWԐ2[*K#š;m.}mmDgkx%I}d0%*LBڥQGV6V,,(K+ -2WRNm /-> hFoF6,rUXWSU'VCt X8?(մeâa%MUJkʒ-eU5ƛAޚ-#,mj**k-7bڊƖT54TX!nurJ1<ԖE#-1(f>aKGմƪҚQG#wN1HR˪Kʘ7CD㟶Q_9~4?vanF:mTɹSw\,k?tTVוҚwjpPg8yOEQ_A'8l|f۶ڥru4#oTd7sl.##X.%Đ'txT]~ɊY#_WhjDJZq~4Mԫm]i!ς7ױS`7%:)wt܅Lc]z%D# #&v,(Z;ˋa\$JH pe*^&vxT EzkȆoA:oK2bJ&Ep:;;]O|H_譑8Czflno?8%RE< </ߤ| ,`o' 7;<}rTS qFQL#h3<Yi.샱i?@f:Lt p!Xzs& X)`ujt(8= Έ93S'/=ߛz c ge(wv;7(8/ Ώ ƒps2[zâ(8 K٧ӬJÒ\eQ< VD(4 .UQpy\`MuQpeӛoGdWMƸUQ,_ȯ}ЬwyՃmo8G! =08f%0C)(cC3S Ovx.K;zRhQ?F4KoSKϿۧK˘xs5,ױ&^ ě]?9+? ']?xscQk pT\ W! _E@ }S(3JH6 qʱK 8)QH%X/ԦsM=3(mc"0!UO?'S&XEOڸ]3:N+g3M>z;!qS"Kdf4:K΢NMdZL785hpRP5Rv_aG.mQ&07?}5:?a΃Yx""L'v#& qk~4λXN8@^ .,,@DCQD#BAQ͟xJ?t*B(f bUHFDBzRXGA!>gtRG}F*UPVS8 Q ۏZ{ᓐeαSwdb8NbgayεQ:{8_E(V!8aHs/(vy]yk6(v{O\Kn]azR~̴E^ϾǾoɭ{õSNK9Lj{(kq|ڥrC0x@^"tRXx%TUVp6pekp܄7Ýx ܃x;R<{qm1o y4♔y8覌}*z12*Q`:Xf|(P;f'Ë8If ؏iC:E )L! :ީ:^66= g6T1QP03L<  &P`p cTy9,Tp잉4):}鵳k\kB+2n$fvpy np3::dW^';<)']FT$AfQ|x{uoC -(?A5N?4.╍넹Ll\tICx"ظ<ؤ88Hф4Xp%fpMS -Η.u7P͛.oDS-m2& Q4pIOoŔU`?Y}yWUp]x%T tj:.S )1M8edoPze2B&HLb$3dd$t*F3]?Kq 2,7(aEbsE/\gv@N$*XD2ifŊJB}DFihU$rmqVip;; HoܫIB.+u$Y&X/iL&lpWZrǁ19 IrFaORـLmp- ]TM;i!y*NUkVjkdɆbmwKJ#C}XoSlb-p!BJV{z߲{N/pWaf:y@Bbbxݤ mOUm|65fZNq!i"%.&\ĥ faN߄q kajWA3Ug5S[Ln!VKa k F7>~:Lc ؎X.nV)V -u+h`5F@5,aP5V Vo*>=ڔn46ZBڑHH2g{fKK޻Rkn>1pݑdX}F}0^L#5)]F̸ڙ &c 9l=3|P !m*m-jw ?,0\ N۩C*!K<T!_(䳐;ɂ1ROJL2n# \O&㩀^`SǓ#d>_i5Lӊ22^EtȇS~ ۭ0Ů !xz0V< 't+-^EX,~ TVP=~T2RaG74z=`EO;\ƌ^M9ըfmZb#3 |_wQ2&%'}`CGv~߲Ȍ2Y̐6* FҀR0.M͍tȅI6/+$zg&5yg#mvpڜ0Ҧˌ(c6nii$71fnrtJg۝5ۓ>3|GT^,Z˨p&B-8d|$lŠ|]7.BxHZ =!rM'aY״דbu8 ^#ZvSi=Wu0En5wf=ch #˜~8\L`Zci9,̜;ӉFؖX2g+ f鶥Pd2}}̸t#2ٸOR&?br*.QpG]st};Fu^B l!s3qN*O=꩜[*pVCmk!vd΄ɶug; f'{l&:`3fh/MN8CʃT' L^T&"JHw[M۪[@B Fld#4jlbp#u8d"=J =^@-jWFM_~pa|d|k:( [ci""7F១ۼ~xӜ hlPMVnjDm?3چv?a/MVP7&|N&<G-dst^GrA,μ}[% 0$u| I\%Ź~I%i;ɧ~An9E>?lYg<3g?PK MxG u, !com/google/gson/GsonBuilder.classX X\AHdhC1 ڗ 38HnڽjۤU[ĥӦںk[jMVjϹ1 ]z=^8&Qz|1_|4|܌[xtk> ES56(0'suwp?anx nn4&EKgm<s*VnB<Wnla|l'df%jE'0T/*xIWT*xML(¥ ("GBQE/ T2B(Rrc*YT|܊_n쥒L12JOMbѼ6IOFƏ7JZm-}]tݲpj@[@v{RMT˝n½E ǢƉ98T)A']"Oۄxﰤc,ϼ+)M׍()|9s=sjow9"K27%5.v *eoxx!.OSqEՄx T5⽔lM+,DID$> fĭ b 9w%Ųd$8w&FTP[r^jC=~ waQƅI]X( OiFQSMGkܓyFˑO݅ZqŽX'GxA\$FP L;CRI|!}?jEI1V爊EwlC )B(Ox0Wk cǬ'4UidZզdGwä-2[iI#ўBx,sXC:%-7b~+ #,+|fCf~8':*>zR"ER|+?SavUS8BWN?:6t\7&SBEsUUrbZծԷa7z"c:],!k1RJN"h:1N. rnjjyPd4Ψ̙ƙiMu+/>W=] X:k\XjBk5]#Z#J*,$c܀RoJHDV2[$dHxK.9+n$PK MxG`˗.%com/google/gson/InstanceCreator.class;o>#v.vnFĒTϼļTF IJDļtԴʂTkM$ ,5#gpfz^bIiP,n!!@6!Vfa3+8(9-3hu 402')cd@7YX|V !,v0 PK MxG*Ycom/google/gson/JsonArray.classWsWVSqNRMUBIl9N%孼uIʣGxWg Mۤ6Mg`:0t `f|J,e&Gw=|={:x3.b !\hC 1^hWv| _o7e[m6:]Q/ie"~(G"~,'"~*p .EBs"~)⒈_߈x^e/E$踪!je9+4:m.kgSvЖ39-- U{\<8\^nclwq 3C;SvJ禭1s:˙)'mfy[Ɉ;kԖ(y˚O84 6TR!q[bR>s؜Wi/0̌Y39N2s#аβxaSĬ7ӮWҥO jxKg GJNJ9۵,!8*;>-"q1n0pJVOᚁe>f`F>sc[ӲY+cfن]ٴ5N,lq@srp 1y bYOq?%`e^4YU Bŧᦚ^Iu杺\J%3YZOu SsS='pԱd uSLhw#%:8-NU%]V(}fqn;Cm%8_N!܁3y)Ǚ19-AZA¯"rUiIA `'"@'q o=o)m-4:5 "5mQ 6 KZD"K=| AQ']d}9 vs~(^}Q aGѥc}Agcg_}l-uоK\N\-)Qzх w#︎ 1>0&b 1` 0Jd#7`C}& A >T 3x&H7uL^ ܥaGc&6`@w@H+*1P BD8i e<ƾaKF6"](MxPw*!O᣾}>v%=!\^e|v bru(˸9T::|#DnS- Nj7vf6իz|[\Ԫcnўcki:js]G-8ū۷g;gtS]_q{暽F3|RP)BΊqlCK,FZ%<(V\\,OpS*hg'\++Gmy_s{Y&[G{~&S{goUBlrjVF% 3k޾&ZHEYE<"PK MxGJ)&&com/google/gson/JsonDeserializer.classJ1Sǎmm܋17ZRP@O4)TͅC(/KI )Rl! `5LU}iYwF9gQ+]O-QO ZCWkƻK"/cvr{?FF菖/*.71ӱ4<y~[wP"xI6@&txG]fQB@"ݦtwJϪ=xPK MxGxAwf&!com/google/gson/JsonElement.class[WWGQ "I7kKXhm^Nd<o}tJ///3 19Xdwg= |)xM`AAFA,* ^WƵ0b^!e 530l1xC#.*:q] =b*zqK +*nM!^V𖂷UDwrư ,C9P^ )3w. &IRvF7t%a]2 }gm;kx`[)M;^<+ (+WW4_63.y?w7՗M}@]utg3ק|`Dɏ:omAW:F90_F'l^xy0tcYMK" h@):VҘ]E4Fw&L[w=vO$S dU&*$ʱO.鎞q$No5adxo9]oT(N<+ 5ʥ%J]V>\v ϙ.bإ`rAY[*kCp=]e`̝orvV]öFPNO"ƻ+dXhx1J}s2z̤B JLIYݤrypՉ(OFTzv&s:}| 5\BB# bf"gmyGp\(I -QfU( |qIG Τc|S w@!K*޽8] គ5|/)&< 7=-8wfJIi]#E][+/5έ;e9$M@'[%{dM>縰 TK<4xU"1K7Gt'o) -_Lņ(ͅ> & zhnHaOa5_1 !3Q~ B1qSRRPsRRj)xd@kU|p74_2Ak*va6y]4k_f͓.§(~.bmk-g D |W-$NI{||ǷI7 Ɵƈ}|w {ok&O蜧-Vw UwM0K0 R5IE1̆Xc?qL4K9-LRU6Gy0I1Әi *|c>)^l 3$Ťq1I)RFtl=;?GBVb Տ]QY{X]l l6(;y~V=̓Ql&njU ~x'z?PK MxGlp|%com/google/gson/JsonIOException.classN@寊 +c[ BDe?I)\|(BA]sswN3_FE-[Z @pݵ&d B]eSsyOtg7x~h{IX8zҿ=;+e`;JRVvi3,K>q%ԦdչYEl]:A؛QCߒx2X@FK^:a#TM\ ??C8BE`9Ƿ-Yip/gVF3[bFK\r)`Z̎ioM*T`1YiIj#̈Y:F PK MxG(com/google/gson/JsonNull.class}OPǿwR:S& )*D3g}nb;??h&&GXP99s_p%&Sp ˸iSrKEZ}Va(T=uR2tQ~A+ zELEmm>otJ U\Q0OD/<0hPFF|wg'4Kwӎ:~86+K{T|V>^ =L#tM ңU'$ͣ@:ѶXv&[LxYGHEYJfwh/a|E0(y-.PK MxG,x com/google/gson/JsonObject.classWWe e{Z.e*h P5,27ggI^vOc~휎_`t:s_9]~0,,l<<{Y~/:uu(0jp1^_@%dDpYed@VB㪰2R2SF1f b&cNyK2SQ6e\.B.׳fdt|H^Ѧ MV]Bcz*EC0YYeuVl*>fz6յ Ѳf ֳyB}B/7MuE:a(TgG7gte-iEpZ} 0.~{WYKFOMvESOǙ^KKdahbڔм2̹R^`L5y0$mVO/EɃy# sNy9K1`ךHV 2Y*»?Ʊ+՘j4Vy!6?˥55k7z%DQ 5i:!4y)ihT=+bjv"FMDfU\/F'SB͐6koAzF7uCU35.TaUjˀu.]O OUΔZjQMa,cX{qJ]aT-;<+Im@nDhZVvK^98#=↌x;<cܐP_^/5SЎ a* +_*M8Z"[ 9#)a[6+Z8/FI\Y,+nWܟ%6HfO5j)ZKyKHڐ{g56Ä=ze(L&FO5q#Epă^#VIwH25U=[`v8(uIJ rçAb,"@ڡCIv~E$8na8ͣ~{V|>OkmOdfq8Ymd#jDC2N#;A "X<ωTs}ΎM4d:bvZR.t;>{BY|c3kqAprlǁFfX"H4X@KZ%G\q~z/T@VqTIzǮjV6aPK MxG/ (com/google/gson/JsonParseException.classIKA_g{4}CLѓ. ".wflt,zQb$ш5U{3 `Y1edȌY s Á%V=v0Urֹ[5tĐٖJ|voqڧ/RgH 0TJE͆xãN2dGv3^ʀajzvCcb!ebH6׀~393:0Qs5{#Ҥ/Nfч~#cF KT$Rlvb)keC=tKIɍt:%̔ʏ` i6QU) cFaXcmVI:Ry Zڌa /Ն*[l[Oj"ѰX 'PK MxGl0; com/google/gson/JsonParser.classVWSG-.A%W6̏xaڹ,Ͼ7 ImWj@~&ǖء(G%`>a&t8ud&)toM蔔 =3> ۗ 4ÕbqQqJf5tV l>T2YALr\E*+|'tѥo?~.AtxQ`.fmg3ù!ܚl_cFCYDRLKRv[J jUФsΆ/\/NG&sTwqRQv*j3>|ZZxG_`Iȴ=چ%Ѡ{h.WE)2xL?W3<''8HE"8%uܢ_NȏLZo.D2Ok^CVN]&h4%geDkQس,|ǜbމP>f1kE9I}TH,x4E/h&whv5 =w#rӻ%pFFB?8.ЉbPAa:)d1BbvTY='NB"C>m$(# %nTqG8LGnA$+}G`>Xf=Y\e=whYG.5eNj JpAir;4J ͊UET+% †p.c|S*a' o>Bg|9C Q|oU_FxTY8`TEVpNU,c|t^R|W |Ep{wCe5 7U_xRS ಂo*i٢f)o67xƆ|W|!eGcsckc[[[6<4U!=UUc5 ._+W '~=G3z2H$kNi z:V#$"~=ԦG[NCI?StU]Hj+5-`O0 05U aTXz/ 'kuV}qi 4j1I'q&dpv sʯI3b Y׬Jj]dVV ;zo/f:JGf&k6/٥)T|JC%bRkm M /]` =zj|l7.UrGT!qaSM)lM#QCSLhLhm<7\Ȑ-fM )OS13ۣ JYn,;hg>Ms3z1|f|^;Л8}U?\uvn<3!3p{t *ұF$Re#1p'ۘX2f ¼8CtlT_/4EeI\cҰvo4'RqgHna o= ~ q~ѠC~G3< ,ߊQ4Ё= t&LoA= ݔ Y~MKwRFk ~yܡw?ࠆ?OC4wi6^_ ‡54'M? :tByLs,͢Ə7Irbj#I0[()E$ҡӆ5V=֧_xލ9%GO$L(頋ve:%j|ge8ES+i${8iRE*ƴJ(R%ܦ54ƳdA9/Dw yQmJA{$S['hoet`$]O b1~"&~]%s6l c&N.Q}IvVw"zO6O4nϠ^V"㴐lz쨂 D_y4 h!,\A+ s;׍YKuq̛&1w^7V¼0&|= 1[ flǤ%1+߄62.&nӛc4mT\ya}wg9Y @}v\ Zۄ/UA馚N"/e97I'NV[W6;ᘑee }':"ԡx{-:M\5_4bH!󽣘ҏ)i>{ 9C&!F*!o`Z`%mB䞉SR@Zږ8$s }w?Gn<ć2lj@?dkQAFQ -Ow'IoW/ rLq|vNH _PCZPGxϦ'V^PK MxGt$com/google/gson/JsonSerializer.class;o>#v.vnFԢĜ̪TFb IJDļt}k$Դ~HeAOr~~z~~zN~zq~X真WZQbUkNjnj^5y%E@hJ +La 12p%e'lcjH=#>w12, ,@>+;PK MxG=2  &com/google/gson/JsonStreamParser.classUmWG~BP)"F7-U!(%% a!M7ľ_T)4CIQ;swνs;o )GqDn Lh64%p[Q:wᖉ  bjIzsyq\e>Ve?57! v_CY|9+:Tk׶'G,6/1osd`@uysWS6YXN_] jPmi;X~٣b|Buظ/=wo0mie嘭jkk-V&jT3B?"j8kX!G_E|Bي?wp"Op@xJM57 }rҘEauy/|=JK:0a #c_Kx\xjlEx"E_+W 4OZsяy=^#47vJb|9*:p癠rɲۅ4؜eDv±*^݉ \NSg6hhu/lI*+7] 5)Jנ)r!n1'GFnOēS|ݑא|C:խS۩.( y9/u*V#h͏cҾ2Nӈє2yfrf/Ͷ(џ!+hZ[{anx8_1t*_ڷjf)׼EW[ZC>+/xYb η I\##0XA3v~j>=z[{&!]j# 5>50"5(uc1i}JghqP"@pUn\w%r$anx{m-Tٚ 1$<⇉5Ȝ\ %$_bT |szr:hsgHp|; 3GyG㙆,z}9sP]sНȓ_͈c61a#F* a%kRD. 0B09νߛ;;XPF+C.޺h0?I- w@q,:n4=s!fCѠ))&'ҞGNv)S@k)02 6&V"S+IO6Ót@zð,|}%Bg. :NdfD⋴6GKHp(Ks"$'L%XUԿf؜bawRvֵ:;ưqJD%O XBӎMP }H``rGk<3dnb[Eor=nawQ"^#Q>Yv*XPK MxGK-com/google/gson/LongSerializationPolicy.classTOP+a(p6 6YX Y:KdUv qmKι|;OYPE&F&%IXQ0d$<)۠Ɉ+Pr jsᚍ`6[.Cly5yU֫ eW l:H7헔/Cm?G~";ap{U;K'Oa5Y>4L5yU7uWs=tMs@fÝXʥ>e7?8kplN@H3[klޤ…nz4 KdXI, }P0y u)V-׈H1Vݲ1 EӘQqC&aMc.CdK:֝.݆tb$])<LC$m?X<\b3(H J#)BǗ;qNp"t/yV(.SuPK MxG%'com/google/gson/TreeTypeAdapter$1.class1 @Eh41 WEo `!z5kºQjClaz?Ct^˔יfP2/N& IuQ["&S{ZY(gNf.Z:ǎuBKsZZ |h5{j >PK MxGR 7com/google/gson/TreeTypeAdapter$SingleTypeFactory.classV[SUfw؁.B IȅdY0.F A@@a]x}諩c첁Eʗs̟ >h˜fa[n L讈))0-bF}0M xK:kLRW,n.qL֊g.e=.[N;cV=X}`,MF,ORf/ږgzŇE]ϚN&>5ynky˳ͬ)8abl nRN{nÆ{.T5* ڎ]H*tgn\%@li;OmǺ9yMiAp^RE;Ol'QMDZ<߱E@D)w ϛ+ #Bcx fzϷ= &ke`P D)EҞexh $+HSXI_}0 T*L yIOOSj ]+OD<ƔꥭQ[*d<:E0ЎӼ}8aހ-h5pmN$+@l,XFo V̙*$JWATIeOUM-+ᨤvxog]g.خClYY1YW,[.>>Db G=xH#2Jk-*Z{ОhЧhŕ'\P~7ټ^E.ΐO&|֭U40֧<V&&3pwOLBP}f/`Kg0V< ^5 23(嵗&l5 r)S eHCFfi.8zM݂ȷ"ˬNhUGǫ)%TRBuIQ!I`:nh@ׇ]cPK MxG”"5d%com/google/gson/TreeTypeAdapter.classWwF'RƉ8NmYbN L ICybO"K4NZڲvaK[vJ '=hoc3=y{{7N|F;Φсs)LHS,ͤ\L*iT1i\t r'~-cY?#Ms9ϧц?xAqT*EZvih _\!]*Y* XLX\&[ hHLU, " cԪ!ti4=! Y4=`T3⊮h˪ͪac`X;jN:V[VZEktmKf~Ad;{5|huװ}5X%9d MM*"GZrY˨$COEpy8bvhMX%q٘w¹/.X].UuV^**\rR"RŰϬF>"3K8۰-;8 .s L,Y$2[g̴'fѐiOBM;vBgASWo;]nAz>z;zzF2Mx,/5f_p\e q .빊垿#}*vYf{4\$+H2&EfiF&[v)*OC( nJSt ϣbMߡQ=W1d7[ΉFńV^GNB_%j'aetBhbf\xw !jxXsw'CF?&ݔ6'ۧǚSyXw z dn,Z7gLnw:w.qnڢڏ<cA/XfEF11>bԐwҀ4-i:sws}q< "a n(&Qc&n 8DŽ >w(Fz3y{[+vZl[ZU˝) p*w.pKuuN:2v^7WuC.XwfM\(JlOJ1\'O+-׷d 3wtԭcW\3ܧp;Yɝ"\RU2%װwYhn!_,U  F4<#MR20H<ШiLH' Q1J4gMlXEn0 vbTqɏ*fȏY1bin8K = p-,*_x㉋v7m,]=:&J[ Ɣ9{[m!¥L>ס X|]B* 6;΁M3P`Ohy'1!Z}>C:p`c"[#A 5"^xm}xBM~K +"yeځ/~%CFޮE 2"2Z!M]5mQݸBgE ઴hp'ҭ B [AlO*G`??)_Ttvp<b:Q#_,/ t=(HSVUPK MxGo !com/google/gson/TypeAdapter.classW[WU &$K%%K^Z R(Tv04dRZw}T ._ ոx >g>gg8OU ME VUENV nPp *ao*(T`脥`KE'lEp[*ං; YV,EI4)@jd!8m 9JV dY9.Agݠ[VELgl״-G'zkҞ=aa4Cϝf諰L?.6ض%.c?W)M.VA6O[HQڠqs?0O6,UɆͧv'5wj|;+|gc ;W]m>HW㭮w܈qzQSxGg]'g.78} 63:yr 25B U 證z"r 3VF. w`v !|(أWg19B y?:>׈,qh.( {RIa?GB;?!z%L%$%Ejx>L bRIMKMRa T»B!h$"4(E]EA7_F.Db'HNr?э<)}H&#nvNv.FĒTF \T<}w a!Z\RYg$瘒XPZdXRZ&'+,Q?'1/]?) hٖۄXwD #Wp~iQr[fH K*@bdPcT%#@g؀,v0PK MxGcom/google/gson/annotations/PK MxGQMC (com/google/gson/annotations/Expose.classJA%qQ<sq'!ą=Sg, GPb t-UoαaÎ]B%VF2xqlrm~VqEQĿMg!wLmgc5W~;=/!27*|8΢ ByL*[kt׿tr@"vB,'9XL9a?J0ތ:BA^vBPBYɊCxRXS&Dk^gl`,|1PK MxG/'%-com/google/gson/annotations/JsonAdapter.classMK1ֵZ$h?=#Caص>۰К=L8'ʋ)XT Q_2vܻ)K/ l?|M>oM쿛 srE|i~@_?P( pWB;ְ˹ha8B,}PK MxGњ'com/google/gson/annotations/Since.classJ@ƿM_Փz(zqWO) CزٕfSy|(q҃<7oa '1z1b DKej\] t]i 59R W]陡;kW^;[ ' #T'ۨ[?ӗlmnԢ zbdlA Eq2mʞ+e\aHmc% Zٜۧr/pqR{@!C*:j.&PK MxG''com/google/gson/annotations/Until.classJ@ƿM_Փz(zq' UKL CزJ)<>8\v۝|[8 q,Iwu zHffVJ4UЫ}YZe%044̥KȄLٚ0=X଻$U˜P Fxƒ۔=/2[ܐ+Jn跶eN༳Sǧ>C&{ja{|GAPK MxGcom/google/gson/internal/PK MxGxN|2com/google/gson/internal/$Gson$Preconditions.classRMo@}IZ R$8U%BZ)qVSgrl_JT"G$~TY%.<Ο^3`h:q9p^ 8ų?Ao&@ G8Kv ] 5PשőBGRf%+ D2*Y!{5։Ҹ d-uО`оXo-{Џv4 &DYy?%z?_PK MxG\^57 @com/google/gson/internal/$Gson$Types$ParameterizedTypeImpl.classV[pUN閶 RkR R[-ZHv ݒl_(Hɠ2^2<:tl6mRDs//4 oP"z|pׇ]><=>ca/y؇GOD_ 2WAC|p1s/5}(!l^^zqXD\DBPhjP=(úlq*VKZĸKv%G)ayPT(>ɵ#ѩ Jlo{R[%z,Ҕx9U?!"t5V9.qL##:1|N%֨bcp,aa Cu[hY-uyQH!ТHPmGm5I$9Vb%ewvnRmФ:0D7xW8N3=xLZNi q^1wXN 4^gE%Q {!CwU#jnzd\Q7kX$q6g cxTQ'񔈧% KLXF.Ϟs Ͱ<H؈E$a+^? Ub_sɊ&uMMMov4/IIK| .r#U@D-!6VcO} ] 8EK$[)2J>L 4a}y0X5GPnkې2{Au3\"Y:l#UzHng1k+a\4*_hOW^08<(!LpOJ90t`"¹0d;{x#69͑ ]F8JS(ܶ?% $"mG%6c ymOrUqFPf"}),@M3&Pu>䯞HnvjB%&#="_ khdAG!#'ϨgE ;8sXJ6D(QC;s|;JFHD48w<{*0X#PK MxGȑ| ;com/google/gson/internal/$Gson$Types$WildcardTypeImpl.classVSUdɆPr+$-\ آKH$.1lۣ}s3:2:2;2@jL\Ͽ~>0F ¸c DE E3`V'vрD(va!|`EAVBpp)`Jh]x}Mʧu/δ?/]װi  r=4kPHݗp;UEՍĚ9cr W /wvLZ,:Q84/-ޞR놹kή?0%ŝ.'Ȃn7y:Vڰ"T<*ѦmZ.[Ŷ(UQ8Kߞl/0tɩP3H_Լ@ݩ"$R%PrMjoX;dցDuuE1bȰXd7z݂c 8,ShGN&G  LH;BE+,֪+j7ɟъ "Y[eGY+jJ"#GCm%B<%%qcľE0[S"o;tߗ@e#]VxU"LC$ްMŊi46v1ٟUH4~+l/hx+c\K'o BvHѿ"*t*G#$6 ɦIWUD&(i▟0_^PK MxGm6 **com/google/gson/internal/$Gson$Types.classZ x\ufFo4z־x$-hd26dX^Mǣ<0eLHi KR@v(T@b ҤАImҖ!{hFw߳;Q  o񦁟z[rH;~A>~_)e\U?_E9~cl.xO5{[S ~8}[J8 qyP7ܒͧq%G==̔\$VǻC7\ V+XŒ3 S ow gmxs @j%Le1[c!>2A1MĶ N0TF LraQH(ڕOv_ EѮ1dƸ`m "8Z:j;'Z2/C<['KIҥ0 qEXt}$ԝZ;@^ npQL3\::ڹ=1" חtzF`ƋdxҬv^^06X<WZcBi)?mJf!La s]<O$R'Rܶ%"5-EjWpLŤVs0hsH v/zcjg/\s.M?hM>55;~jd-7Vg\`),TMc—E]VXTpQuEQK%v$:Cap(xck,9'm+π&xAfy19F˂ZiŃ aeׁO&^&cۢ =x"FҺ? X4MQ=%{I!n_J '`lldMl6%,iu8;SK) r7FG(MY(LFłMY"L\v$MY* YfrYmaCVJVF.0E"udkf DA;Gck(M\:U1(fꥅ 6e&MFi7ehl7g);xrr:SbvҊ%‘tb ̰*ª.(;MS0 z!;M|כ>|?0e\g|xz}k/߮R!im2<kh'ird=Qka͸3½6GVZ׌UiQUT\[LYHZ*Gƨ.{S\˷& 8|B[\8рʢ.\U41b5iUvc{DR,@n]@j5s3 rLsTȷ,O*r;a”Z3Xc*bY'ypGCo!,%f O{-u'Qp%J_v PDOYrIX|3HXܢ{%-(IU~e*o|T5fG13g*J5?eЧTpj8:܅FWp7=^lp}p շh`/%/JY\gjORVG5ďk i9 nmno[xr_1^U1:RXZBԾ]NE0B*ṱp6J9`_i:-u|< c@&zAq_[}nPu~}Rzu;)cMIk:UV4 X'$WQzey*HhGɣ*ɣJR<lk|@crȻp?O9F7:AsT/0_I%t)h3tϯNN֞Y 8^:|Oo5WYLěxoxdV|Jc4[QJWciĞh{>1{ӞػOPfU:)w>ۨ,S_xU|g s <ğ~輍fOeShʙeܯf)SmjwF\mGiM62˔Hp_>8?g0.pOYkgrpi6''(6W:9,r:K]Rg8r9u~5pCX2x)' FC]Q1򥩵-brzk[N?) 7)ho3(,A~IZ80e>y}2ҟc<Jr+G(wb|=yct9\Bֱª(0 vkLи 2#yX+VWt^A%rPdHYYJ '#+b|!y>/*L3:Al_^ܒ)R>eQIJ ٖ%VUsRsJ<9vuA)VZ!/?TfY+O;T˥".+1i_>O2Xz?JCX,g?2P5T#q5eAʰeAFbRg~ 68nXηV9TR"84% ܞQJUN6TgNRV+ )z\B W [3-tV&ղq~Ea-龬&7Oij:WFhrVP$N1hoq\t㫫šMzou|jkC`Yz&6N8z5~mJ>ʗV5'\pjܢl &ñ5,beR8(u7GaZi('o2Ռ~hRi6eU^cGeYZip%cR9nl=o6@ץhƕqhiS8ìC)(ܮf݆K-hh);[EtGv#rnqƽI^ H',!|]1'w5ُIo x["xsgտ&M/ )>2SNI,òAnl[% r;WѦ 8Y v V՗NBV{vh+5ۓ}3Yua=Ū n/=\!FzuFuyj6]f+mt9ל&"_T5sA:a#mBH:{vle ci{J[ 4}a f}z w]s z195J ~b`PsH~s8s^q[eU<*>1v%49NJD/W/'#r1|p}ȑO2/⣍PK MxGB|o7com/google/gson/internal/ConstructorConstructor$1.classTQo0f B[FcP ͺ Ҧ ԁТ2R%$H<QsJJ5*+s~ 3t(a]OELdꓐۭ9NhZ5жg>=uDQ]$:rID}5 u6H6!lQth.x4/ @i^F&VhO = |*Fs[964Vq'wq5i*PK MxG5o8com/google/gson/internal/ConstructorConstructor$10.classSn1=NҤ KMض[Rxhģu7;zA>3gƗ?οV WC+xPC1lTF2ml3b3c%$5: Ff3vmSu¹R U6 CEr\ | R*{*7vj aX SG$z=<)G2efOXO/3CYjG&x!^\湎IN D#"jx̰kʜTug Kawb_-3Ds2lj8rc;io7YXqH8 I9j`fc*_B:4Hg <*y$pk4Np^ѷgZ_P|{KLgisn4Vq۸CXC PK MxGt;I8com/google/gson/internal/ConstructorConstructor$11.classSMo1}NlR>Gi$T%T)CTuѮĿBQY7HDZ{fx;خaw➇u Tfͧ ~lQbLDdFGR[jљMؚtvv!CgR_j2D:#EJ\ y*2Zx ZΫl)Z aX #uChnp0 '=ѥ(Cx!c='湎ɤN=5D"j>bXv9Vh q' ;Wqp ?C4(æo+?(1r+u̔='Et9nClPT5E]oJqP.zuǹJc |5צ~KXUDc:#Kc3ʯQy)7ɿL#: Tnn\:ePK MxG8com/google/gson/internal/ConstructorConstructor$12.classSn1}NlJi-4$H,zKKQ)C ݸ8vWp@@nBjyO_q%ܬ[nWQ-0D&G LȘH J"\=5!}25r{7  y:xGվ Xf9XReqO$˫\mS°hO(D6HsƤh$[ O1zd8OevͿ0<ѡ2ѡ3p>QQ= Sj O&|_#2 ANQ->NQ8ij+ sMY`^Rv EZ¢rMM1牊e_սRPxXI/$3 gy8꓆`8_~ȷrYJ!chĈ/# ?!i 0qzq5}Fj@n'ʐ* #W׬Ct#*}>`tN "28<1E99 n R;ĥo uPa$xM$Pdxj&yҌ[VItڒ%s%[Qw}QCׁ8%l (c{j2޵qC6ច6~6.  :p吻ܔIPmKJQ[ oImH8R;!pg>T30,.Z8\:ߩ INl9w.GSOqӈŮXO W'7d JHr|Ǚ]h?)_Bӓ(i>gؚd*QDNy7QwY9 uLuU~OhbԻ*ב9_ F{_J;1OAܦKpZIRrM3 ~K{R>TבjYn@t5d$[c um\GF emTaaӆ3s_ Cre ! ~z&WiqtyLP &v3s\;[OZ I$5~9zio\ pׇ`n{1D· ]Hh/e ZK@^F6a}IxTs;Grz G ;.4Vp/dT-U/PK MxGO7com/google/gson/internal/ConstructorConstructor$3.classVmWE,дX+J^ķ Ri 6&elp=~GyMb>dfv;sox?N>'inb la$s=lN⾞iV6/`W6P={0XܨGJ.깫TR^\XXa}U%{% UI7~b9@573eVaC5ptdͤD<]n+~KlqMEK| R%$)/>%s3&ء6酎 R- 0xGtOj8~@*[8hJ`WDŊ[Ud H\._\'Y:ulPKwKm;: #{Gb:<ێgpo5Lk&ઉ|c౉' dϊ>IC^ a@;Tl ے: ʚ[=fNNT3 HlЉyڇlx mvؕ,07\Ϯ@iL:~ˎ;^.VhQ{(4DN_ ^X,ť܈)j)ɖZ0 rj Sc%a K~@q3|!p9݃g6$߬ x\=yP| Q &~oqLظrtxoJwHP Q)DϕWH_`23EZKΘ\w1Sطxݶ A)2[oWiCGC|#,( PK MxG5D7com/google/gson/internal/ConstructorConstructor$4.classSn1=N&,4-\ʥ)JR[*xHģuzAkUnBh̜Ǘo^ YCBܮ\wBlPqG2kyE O=.Ѹ6[2"oi/=s>Hgis ZkkNsXGM PK MxG=7com/google/gson/internal/ConstructorConstructor$5.classTn@6 ur@9 pR}P (R"į .:r\!HrHb Pz"˳3>8B8$0hN!!t|Qǒ`zBN8m`C.Ճ`\wqY1 G%:fhWzáWWeq(ΛKcL$?9q5mQkqD5+T-'Cziv¶r2-]X::ml-hFkgv5XkIJ h{)n%N#펌; ;.};X n5}g0OzÅhCjxqsyZ{kǺt~aJhH ayJsj`(!:f$O!=Ȭ? /aZGN\ܤT'PK MxGd]T7com/google/gson/internal/ConstructorConstructor$6.classS]o0=nf 16`| VP[$ҩ/ĤxtS/p)q@O4 $~? q sǗoV K죊+(5[3TT ;ؘX0N"\=Sd5ɂ!]2NեCڷ?P8i=8Cogg}8G{{%WG|<郋s<*skn4Wp ;=N?PK MxG@ 7com/google/gson/internal/ConstructorConstructor$7.classS]o0=nv uc1"HnQ.JS#_q_T}ah.1sj2li煲#%&B[nѿ^3ľ"xHtfpw%:BgQ !6Pk6é Y]Z;}3XOsxs4M 8[y ܓ8ů:T.Rp™FZu .. tztY2~PK MxG&:7com/google/gson/internal/ConstructorConstructor$8.classS]kA=I6~ԏ~DFp $*>4D|l)2;/ ?J;aٙ;gν;3|1QbUZ Uw }~bqjLDfFR;a5WqA眧+\UDc-bB"Kc+oNPx&)B̺A $Vgx?|X•Zõ|n0T݁L[b3c%$5: Ff3vcJ y6;E\zVT+*S Ibr(bS2ehDXO GQCX sGcW_D>Rp̙GZ̭u\E\@ PK MxGST G5com/google/gson/internal/ConstructorConstructor.classXWF,r4؀!f vapf,Ʋl!d;Ntu&mm%iӦ8&qֿ |~ofdp}ﾻ;wO~C8, _Q!WUT)dOkr7TT*o3*xV9 xQE^T4e @EPG**Z$O.!O~/?xEEܾ* WV%#*o`,fCQ=0 #DR!ГqS=JF}OAE0ɔi(ɽQ=ƉJƞ1C@8G@8* PvY$I(mWOҤHMM71xpf^~`31;'dJJԠNIx ֣+=+:r_EޖvWv OrÒcɅP ~G]]V_nF|v/pژ2rhkS.ϴ͢d{+(uz먚׻PR뾂W9xzˮKγ+< .Mn˧Qu/补OK` c 8 FIzl?2q!}-iAePä҂tSfTǙ Ub8@-JeLddLfdLfd8J_"?_Qc_Z)MTqurѩk-V>*gQ5>K(owϢf ?>=<7RNT7YVX%SZy{%|7p7w|-v3aUbd\YO +S.+SoMM_83 ١ElЭTcǬ/ 5u,pMP)Ll\eT<!3MPmʭ=உ-VtnX5%/"ȯb9 Ӯ=oi(Nk84$܎bSnke sx*;FY3 ǣxGûx¯6:8;02om}4=/䀁tI]l}w/U&y[3e{)mUxI)$&'&$ %JLm JpMf-P tpDU,(,e:b)@d^,IeUh#Dcp77AB1)HD'GOcSđQE dV瞗O )ǶU8*nK foVaHCt0L!S <ǽ>'^Rk *X9bS PK MxG*I0 'com/google/gson/internal/Excluder.classX |Ue{`M`|9c ƐvWJYVT4(%E&bbf)Gi&1p~}y}}Nr}-:ny-yp6d ?v!OeS]:v0wxܫcEnp:0Su<$t܏r<"YRGc:~C'xexJǯ>{9y'Oe88[DuQK:^`4E"f!͸Z,m_C fƓ[O\4<ƹ`ZѡaBg(."g5 !3_Ah2aI}$Md"ñNۇH '->PpS8:Vc暰ّi1ۢHS ٫ $YP28D*S 4/hS#D)]^IRrE6E"|qkkS9;hZ5lkdydP;BX2#V,9R|^m4>_0+:2+ QF'dB*$Ixʻƒfyfd'*覌ͬt^ZܸQXǾ8Hh;/X?v̠ld35&ocٿB }m[C$") 2ɒI98]o *#429k%2fr$C5rua+ZX^7?U0g !˫Fk(sfX ,+ ,a9n` ]2,3dd1Dڿ No,2wX,+ !z9a5 ? | C9uS[ b{ w T3=|xO =?Uwdx_XQRD 6H aaCp%5H\Bs+pr4@xa-<:T>N/ v$ޔs3bJMJ􅒵+DAc-,6DV=^`*/kr,ls;;q};sL,MuQ=Ãr sVE.y3}3HZ|M5OFkM*ȚFwfNtYCFqJn( %4 [ ODMqgÝzOuZV.fô5!XZJ5Y-A5[5?_l]o}& 0u}/SQ  nJgVn5>%Zͧ34-V--^g6 KI@?hwKwAxv!7pvgMVeȑx0~L|&m1,XdHWŹ~v4ňU(xPѩ{>ieg3\9yZ8tJE_dcmU\? gxK#v*X#^GK Df| /e;knlwlx: WTq{=7;cn;\LKڶ#L1Yl&bB,:JD P4j)ͦJJ82D\G0 9::uϾ3kXDzW8U>h,#jELgt+h*=\Zlh/&:3n K={Q2~bzX]X1>{߯K=OfIdД>DLn;1}MVbαH{T6I)фnՠ(!*rG%85Μ-jn23x+؋1+OU1vJLP61#r$1 -ig|%LR) 7Oz !p7^At|QK/q5Er8L/UQzx=eټUEeq~US1OH?!E>r W+(ރ)#$ysP b^IlccLrn/*0åJ =a &S@~T))tmG^poOB͌>ܵ,1|n`yfz 0"r'.gA`+6؅؍яC؃"Z#C*y^?üJnYqRۯq|@et\:.>hrY#D&wSޭ@UCGl|Q.O/!+eb.*C#8d<ʾ,O2!2b>M>(ϋa%7͹ fh2L9R܊J:;Ŝf*p:q t6x)g9?UVǧo˝r"2Z=}j*UiA؂l杸jNCPxq^kA'^ۂ}9 0 [-;b,?~sv:Wtf=9ܝJա$ ^*YƧ+:.DRvlxNA4ڼ^vOD⫤~1op41 cӂeTouOϺc*~Mw.ߒ^@nj4-YIFvޥٴNQ/\+1^mUb6$7)uBPK MxG37com/google/gson/internal/JsonReaderInternalAccess.classAKAfiZA]:4TG#10d8l#32F_SСЇnAt0g?^\⠆"Z>>*`2Hژֆab &UΈߑWbpzR$2 Cs:cv#mTM<"Y)p::ئ*ڙ;Nn6xjjk'vن/ţ ghf<&Rɔ#mpm;F`Cմb(^vb9Q]V61Dvyt'PK MxG0z01com/google/gson/internal/LazilyParsedNumber.classTksU~Nn,ۆPjZIh%B 6]ݚl ~U/3Zq+?qF{y}2HpJkx]:N㌆:xS.r^".(Ⲇ[Ê@-y;[˯MۭH]?'̺@쒷Iplvcj27EUMglrX,WFy5Z]j/g7f "@et!s{>Iok6LUk۷=PA5߬~T1 V ϭX  D=^Yj|/(̨4mZj {ز>Ζ&zP΄qtZCel׭&y[ѯyf*ٲU{1ᚁ2*sQU M&JGψ]#b#jM8@Y/rqy$" )FN7$ޓGv(6 IHgQ{q/ox0O)f<^ >i 1u(Pa:D4ӄPPiLRL(ay@_b Ej̓$.tk]3}*+Aq4$w݊'ij>!`-u~G⏳>ƏKCb8#,~bWaJrxrbwTJ3Ĵ:2%IoِB6 N1xU$ >_cbhov2VYFn3;l]6}TaeƗR/A:r֢ğJIN)PK MxG+2com/google/gson/internal/LinkedHashTreeMap$1.classRMo@}/CC?7m&j!U¡Qglqw+Wq̏B:TF̾}fgv ys^'p@'PJ( 5xTJ*þVÇ><&#1C6MJ@&#>e^``"{,fSL8VlLdOR6r KjLe gfJ㣇FǺz'hȈfG&̜.nLry9⍛l>75AM;"Q; 3lSK69Vi%- 9]-ٳ2em2 8Έ[Ö}FH l{ XTxRf|QdT2nyGwز`boܦ,;ikٺ]fs.*XVxPQL*6|L8]cse$;i'Sդ.o۔I @q(:"DkpO%xHX/i݀eɔaq ل9f6Ð@h&Psg. (vY|7L'w3,ї?eoΰ_eo[ͯR@-!\NW/awxpf#k{y<X`#KڤӸ`6a ݶk% 4nHx Д#FA@&zW8 ~\Y>ȃEQ GDqAGQd>Z<IN–ȸҞVY՞{^D9eW+uZ$)LJ? zuN-Ika}Nꏄ9VZsa`9 uuou46ewXMܦLFSus._T^E-f6*`7^zitt&]B.yz/J4}3fsL_C ׸J}t 7;ܤ@?Aׅ~'QO?h_E+];7"Ï3UOeqDY0vh0n2! L8V@LEz+ʸ2n*"ZS-h1^·!Ԯ_L׺'R/QNp0-.`y/Eg=Y ;OuERN:֢YSl1B?-U;U.w>_Pٶ_ PK MxGyf<com/google/gson/internal/LinkedHashTreeMap$AvlIterator.classT[OAfR"%چHL>})cYXv@k _4̶>X69gΞ}3_>| "\A^ҏ U6KVA)Zk!d¾ch3+֖Z!j2UtmjMvOl! ZmBv2W9 >WZΖ,0xb2:Qll 歊f5[VPquZ6hX6ÍntTCvkngQ-auD׶,л"suݴU;x.?MA;o7mM54_'[GldgjqW5xbڴ, a\G82s 1Cq8 j:5&*xW&.Gĝ"g[$zޒAV rg70ACG"Ðy\ֲ' QVHӟMށ }xo~KVcw̘A7˷Gu'(W!"G[@7BMr.vp;?Ώ((~P5uDyܢE+؇O~% }|AMII7ߦK[%K??B?F?!Oψs/1E_ank0ҡAq#dZ4#C  pJ\Mo(yAC}d!PK MxGSA m;com/google/gson/internal/LinkedHashTreeMap$EntrySet$1.classYo@Ipi葖##@7 WUՊ4<$7]%.DH|>b9m@u,;V'ý\㡂G 1k"C|Gxi{ ٶ .jmkX\븶LqGV3;~pM}$7D0m2'"Z m3L4,Zmj)ň$r 9}zz2" S ڑzii#A # ]vFl雤=7԰ ^L|?A{`oC/屬&CK6滦@,lvD۲]St׵U#ľ!WL3Fgpt_3|I"IwLV^ 0Tͭ#U2ExȏV(4Ah'.  Gzd4.͛ GcG\ &?\l-@d+>< [;zd Oh!9wG OH1DXLhI(:6Q/ln?|-\Rc@G~pR{W#J<'H$ IB/BZQa1a%^@.ȅ R ]Zl1W3 ɍNGzg&5z ^9c?jh$>(E[@cPK MxGvA9com/google/gson/internal/LinkedHashTreeMap$KeySet$1.classT]oA= bXb@CkMienWTM|w-2޹܏93?~~`/2HA,faG rsXgx8 FL$#+F]ĀAԢ3!y$FB]@mhqz"C*P,4$)A J[$#ˬQ fO`_D$r&G$7qsDK\ՌeW=a$~fTtw.Ѫ{WH2"y Yʐ~KIYi*/a PK MxG{o7com/google/gson/internal/LinkedHashTreeMap$KeySet.classUOPVZc &A}(|AD}2us ۞{99n2r L˘fH̉˼,İ#M(sA-6w,G~s 3%9jSV[3mni%>{_q9)`ڦ e$fw5g3$hoՏܭU<%Э]5\Wf;g~ h&[dK2ҁ~kuߴbllݯ5~i(Bqñ}ݴiˣV5mz ?}AՅ%GΉh7˾n=fۤDW/OkkצL]dV$ LXH2O1 *ca>4QvrEKaNu Zm FZԗ NVXL0 L<z!!"Y4CD(`o|YHF2FNp@htbVE\s효Dzb-;;ESvʏةs S}NbMr R)4"I[ Egv Ä۸s x5O_I!5)$;ES$IC$*)TUttb?=K E:IZe1PK MxGf[ Fcom/google/gson/internal/LinkedHashTreeMap$LinkedTreeMapIterator.classVrT]GRUcuҐ ߰ZNZRSǁ[,yd> xf23\>q>Ͽz(iA06 7X}b+J*GfPxȠX|UQUnsbY)` kՖwlc|g`[yrcfjXOx>6ηP`׍C zxXh4 %Q#N,f>omrX!v*C6E pK d&QU) {{i{&YUM17*"AQ,?NtvaT__ܙ(F5 L2z 9BQ#-'SA>{z,<{S%Ty6^D!a!2bvTϛ=&Jeft["u{}C`~''njXXi1.k 'X5>luL㖻}װ-ԉKٶZCǡszFK.cWO&&>#;q6zѻ.+C߻`\osJkwy_cDãj*(SBͦkHҩ=uńLh7EVR yA>$!tL"fP}!?7i l9(K_X!F)g-q|E슇>ҋ艉 ?zvTa|dw#t@I2jƇ~A#{WHSkazY:㳐%~8 TA”,#&+XC&aܔ#^#@?)ח+gE:ه!s~ ׈X)*g)U7  &'j(E" T9<%9e2rb1z ?i膟REҙ# <MR#VQX}n7p+AHkwPK MxGC 5com/google/gson/internal/LinkedHashTreeMap$Node.classUse}M6IZڴ@JRm!"Rڂ!^,]6u0>uZFqEf|/6 /3胢xMx6|;o`q$p>̲c4 gX\`qQ-9X{QKq< =y~X,)%@dIw , -.m K/\J:_,-#/i ֭i/ Ra1}ibf7{~|njl.36A8e\"bam\ǒc\-:/WFLBA~BpU*odh#R0<ȸi 3t[ve\79}28H1[1yr߻`Tӕeyfpo55=&t$ox6MA85A2^-TنpѢC/Wt栻NBáInϭR64 HZgznݦP<\ҐNҥ%[8[vL;_g/N|?m7}eۍLkA`yuwXg&ǧ(6QojTbLv=uviFT<*v`H6lV10vb] ؏*qTAIDmWfb5(+WT<*9VlV` ,@Gm]h`iԗ zzٱ_챇~m_M$$I׬֬j֭;z\*{kӗvFI3 i!4IV4-y7i3]${'ŧ&>GiO@&jt-IDCޥg{ݐ#+h7q)q`/L }2IyY/WDk ķD.wC?`ѥ75j\qeWZ݄p.F2H>L ȏ_h-H7"l?U3\Wϰރ}lFkaia=**pkm'~EXFj$[=뼒W*JflcMv^p}m;8.6yU{.*l\uQeȡ. $HT)C R$Q4M1 ,5]n8}7@ NwQz{ȐZFUzwv6="VQXEWͤIU&qƟi=Mh#qfCzGnYnk,@Ԕ^H}h6[R5x ?nL\4iՃx^+I.]w(ToGq5 iKD{";D;k|8 O/^]HOPK MxGN:I60com/google/gson/internal/LinkedHashTreeMap.classYy|\ulof4ecyly clI^-1&ci,hd@(KnBHX2lԄYۦٓIm4 ;yEsι{wνz/>`M$ƥզO K0,;EH/ q bIyP*¨ YR#ZLҾhX&K֦Xe"ʤVks3-e0fW ˙2Ggl ]Œ:e6WxlPyn tB-aY,im|KD7g2nԢIǚ-YFhKVqJKVJc eckyXoIk"K6^6ZJnłT^ifSɾT 6%3ٽ͹T-ۚO rLwW26F|=])Ay͗mZqś֬$|{}I3I&9+9NfwzwuZHtg jKS7l`J&X}#ݝ';?d|{}{-ݐqD\vr`O*i4p+/{ 2ciZӟ則{r==]N9-8o, ,]AyE􁽎%;l%yxwlߚLZ"(Vs&ɷusPYO T{]fۜ6t&$sm; ~ 5bun8H~N)';rY(aɥ)R:jݭvv]g^Tgi]#VMeW%R bLgO6d6(hy<3oo?ZZb ߟ­\*WSUKhilN%()CgB:% Km8߹'~[IIP=F'u;RT_ Ki>]& Q2ƾ";V9 ֖4jF^4NL71 '*JolMUس\׾)e$G>bE1ܷd7x\\R63ftOK+IvѺRdzcVEaVG 1pY0uu31ܝJק2Qov E9Sa%5.)cՔzV4n=!:ow*O>jY7ʥv%i.)l46MT4 7[)֤4)U^(L,t g!5p0X1{D`{c?>}zzz32_G<݈0X74_DQ@!+Nr򊮞~dg&OO׍=A;~ɐmc'*cuD`6u3̸wcY趤CpR珑C1eb*o;74[JG\"xlL+ܡϒh͝ac՗%;Y=顋Н9q᎞\gŒv4O"؎+#uZ#؍=d؁+Ǩ"]\\@̭F6}Ia*v͔峲4%vK.5lS'0?"qC4psDdGO+3Fj_/bd#dw;dWD:+=kʬL߬lO~Vڲu"Ԯd\^nJI6"=,7"H.g]tʈL+ wе\'ݡ.O 9v"EE`/׺,03~D${//ٯ{uF8Zy-.o|y$\Ȅ%kM*ugs*Xr)d0,^ΞIO%ƨ&,l.}ҫ>S%xnU\l]L.ns>;h( ,D.`˜*;;Y2TNTjti {zy#b)0Xqe?[9&A ^gZp-k{ FW^G} 1xA'`%Zďz A╕D8?nwLEb*"Ũ@+c#ޅh\lDl/5[ŇFvvrzςg5XxAB5v WSpsS)*F@z'i?pQ'Oh ,0&q]P[hC"T;ci]oD gNm>w>08}{+EPS3 G<w/- =3,ʏbkՄc|2 ab{kDy7AX+IQ4,j@Zlt:ӑJkJttl/x/|F.\iT8 >˜3B{GPe;֣vk mLEu[}ne & m`WDi8<|ʉ 5ĂZE8p|k#XC K &N|̈#bEFOӣ˞vW0~G_x;a G*D]G'?%?{%/Xhyc $o x St XbuG1ՃLhH8i^, FGYDC XYo50N?4ML$I!)Y2w:' Qjji~mҮLreJ2veR$%JIIU\^+\ Z1qMFY{+wI׸뤆»7H('u/#?e83 ͒|׹S#mm 4<*]?$S|*N (UE s>؂=A G8vJ\] 1ĸՏ$[r[(yB.-?h`l!Zn7$n$rtAn>Ikwc5>!Q?_#PIk\ko;$G4\Sa}qqXKfԩZXq*Gdǝ1WlJuv5y/XOGC\H M܃2Mi?0u3,;% RGi12YjdhG}#A2-.Q!M06͔T*,X+Caxwg,+ sF~s7P?iw~ڝ'o'{ WV5] X_5gVpV_̸(>wiW8LNsÅe ije#HkIy DG0^Y0lgc-}bP hf0A.miߩK7-4ja/}jZ c,35 'F7 ȤAmtF >0n UgX$[Lal:\%W!+;/I$.=ge <$8.e;ҋ_J> K_ɵ2[rHrXrMe kfJnr;$'.cO񎱎W6\;d*lheYؖ⛆9R|P|c(~I5%*g%X u 6ƕj.;`{+Qwvwi-gڕSlIҮ$ ZiwZk1akmՌBV0O䠷"N3Xa7Tb>9k47@SF?QRh}G.iB^  '`4[;7ZPM8\ㅣ VFLahG '~Aa|r;f w*>.l5_5bL_ؗ'܍d^.~4*<<.#H< !X8[,5TD^o40b%ullDc~(ÂmzV'& (y&J˩6yh&MP&e6(m1㴉hO&\xf6&kB'=y|i]?cXK)[<ia~y?4j;XUnsGeKR,* rX_X_Mz^GS#g<3eYPty#LG9ڹWQI{vn?5m*~&}OyӇ7&.kYCB/62iʵt[ tSPySOchpchҥҔ"Bb~z&M;p>BtghH\g{#Ӏg)F=M4cg9xVzVag5<ҳkفANÿss956~]?a ƺo?\wABQ1,e_,^A0߈nIL70ӨlhBkMļ7%i Wٗ{mn5: ?byW4 9 ׵W` 4T >6_Laȃ0T/ÐUN=\th^~/yhfmS8 [9wY׋BPK MxG}E.com/google/gson/internal/LinkedTreeMap$1.classRMO@}/q@(&եPHB9q8+E_K/Uu)Jagf߾y36*x"Yxn- ^XxI*#B:'f$ r(Á'sdBE "v3oH׏veE9RA`1J,6cUоMѤJ'm$|8$<wG3kO|+iHlG\>3Гj:ٮ$Ifv* 4?V0=_*GG\43;W{7(ҼŪp )kR)^6 PK MxG'G/^H7com/google/gson/internal/LinkedTreeMap$EntrySet$1.classUYo@jgzД!$"EQ"E%»YGJ=>GU5GCJ+cޙ7?}`zq}LF6Istqԗ$uXV,}F}ܧgTq,$)i2IwLv2e]X+oy/M#%/ƮVCFwq/Xר\Қ\ qH+VI*jwTk[oc7PK MxGcT 5com/google/gson/internal/LinkedTreeMap$EntrySet.classUmOP~n׭(xqι1+]!4!oeY(- |&&Fho2s2 mi{{9ys~0H`(& DK ~o 0,9(.dY3gjժ^e/jz![,;jŶ+V;fE7W]_v 3iX!_wPnA7uWv6tgU0rh5sMs ENa _ic̉:&WV BbxEln4(Lsmes-m_S\T;%biCQQa\ɐV1Rma ɬmjVE}Bn\KV&@\a!(xWkNc2F˦94!f6]R$JSXТtc&Jq R0y x j O}2yӨ{tOT)^A0:V58W ] eusk}Xk+ZjEhPh }Do#X'-vϓB?.ѺBVV x&<=^DޞV=l?>`w)\qs}wr$))Wpl=5)RFsCH!DJViiM:M*H+ {r*33A46{籥O'庖 wa{t-qk&!lamFiAvǜadȽ9tȳuG30=[3"wP_PNm/MO1@sX-G{pLaG|$wٖ0GR!ߍ EvC'f[-Bڥ8rMU=w[;Ɵ5( 9o kXGtU<ձt wxЊl.TASCc!s*o1\SKqVYILV"aP1!dm@8CO%-.l1.NwJ $HKл dYT?UgHH~"W9)B@IHIja,,U@9C_!vW [_2nN(I.BZ)ҋR4G%fhit_PK MxG"U3com/google/gson/internal/LinkedTreeMap$KeySet.classU]OP~VZc }@."j\@ܲD/LrҒ#/4AL4 =]7bli{m뉖+[vl,UB_\eȌ CCE2CnK&QSщ ;i;&YUM17eb 'T(Ci\VνOE\9 }昑Qr.B!n3\z%9hR9C3 ʄ Os/vqD#!GtWK`[:.|*5m +=oV'liP:kZaO RNK<5ZXTX; j*!")Y9|ysgHa܍蹆m1d]ʶ8ӫ33Zt]8.bWy GOE<TD_qȰ4+ rWmALv>SѡH+q5:|'f0M_C~F+gO@<.%A BhihpMGpio<@w CG1\q),]7pӛG-Y!K,I!'(_ J><9=y&zҏ<0d[X! OI2Jj·BC\zWHSGiUzYm et e8Aac/O{^Nc佾dNefLf)~ ׈۸SU" ^TeQJ5 M??igLE(b&fyiEk#.wy^AԤ$OZX!þE顇XO ^ Nu,9>bNPK MxG)b 1com/google/gson/internal/LinkedTreeMap$Node.classUse}M6M7zZ.%IKAE(/tIM$ <9/>8}ghu}8*x4^ƒ|=߹|2ȇЍc-L`2dɃLR nE4#̝PhacXfd N 4K7Kœ.nkŢ^N'B6'ł4̒nZ>9i܌S{LYS+- љŐI䷌lY>,o^?'>yJ;%M=gJvF˗uR$rE0jFiS]qяO֌69z!Se*RΠt>;gbMje͹7c>:{ecR tc AR e+2Xf+{aPFlR*0Vؤ ۰]n~2IT` 0sJARW@. oF HZć٘v8Y\L9}f;$gsE^xs<#wmpkG ]R|R:NIaX>gMI; {NHS<e}?/@H|ig{=V]CvXE<-rE:z&xI چ^ ,UyZ+Ic8mȋ}|(l_A_C`PjT1QٓO{զq]miƽ[w++J-) .Q$ŷN+4OWUt JCⰸ+H޼. %_*H[eq -~~з@ @^nس$L{ⓉKz !]SWe/BCFw aqJ:/BU/^ ıxVJסP[vWq&vgvg#ؒ Iݖh rS8bG(sXK ž@˟PK MxG\qH+,com/google/gson/internal/LinkedTreeMap.classXy|\u>GYv6<Fexe ғ403#aiÒhJK܂CBЅ66miD޼I_{Y|sYK|h4?m4oɪx1]?H;2}iޕ~A/~hя}z_^ꡟn0y}$~%ͯe݈4'evGcL1C/."i;qɰ[cG >a~e]Re\zS +یmFIoN&D,12LlZf4b ēW҆=ۜ5ұl*lMuLw}jƖ+.ڹeN-WcIJͩޘZJƲ}i--MĒ]} czULsSGvmSkT fYW*Օ0ueRe$OhdLg}dmbK :66b1VLUBf49кwTUkSV//JgdfK<#':Md |i?;X)$7  y9̕p*#Sp qv9{F~AG4v>to\3B.0J +' A HZc=!kH)ICVГMCLM3Oolpb6/5먝:4ƍt)\@#\^&G1HNi\c3L ąO 7W:F{>ޖH+VRja#L:Vu&TQ\{iZje#91٩+tr&eq>Px|O(Of0BڔZvhuS)]?()0@%ԜV PF e}f}^!L)qB'cN/.82[2K,-J bkieoaC.<_c*BaF`Fg~Ag*s\r @9`WYjjPT9Px)3`o+FtX(q|4Cmt'*:RYYҴ<^g9p"?p'>tj#`^&Zs`lh!rr"`|ZMq7i!Zxf9Fs\sayCtͯE3D/a>JôQ rtv9Ѩ45CAsqJP˟̍4Au877o`> ;n4}w'.8_ĉBx?cf\x!*;&amUQ [݉.8`sy(, f%1 {-_?`DNni+%(GE{ )m9ب"-yP֞f,Tap19o Pm,c+[BtZ[#y Q qZ^^νa:~Uvyi 9.itENmo ۅB/2DaTCTpASԠ-;݃$Rh𘼅<ŭ# lj՟-~U?G (> k "$C81zKqv ;i]87GoN" uԹ $D%# k-MbTe8V~^LzK>`a6}=kJt>jʉl<6(xt4=JxO$Fh1.+yn!]`zCH}>$\9@nI>E,XFLUv 2_E>PQz$$Zű@?O=y p&|R =EQ5FV !=!<+NA<65Iy4τ: 9R[ o{ҟl؅:ncN{}^њE5QМIt8 z_F|b˪QKHPtɻ+ b/5^y}A^yw4JK'=PzQC e@ôRʡz}<.4E;'9Q%DV+L;hks"B2 x"2)>"䁉?"N80z{ޅB\&P7u> rDIB}nLBz[ ގi(;Unxh7_9|)Η"C|Gx;x#㘹'8ͫ qTzp*AOe~T}[PpD^ŐxÊ-P<(ų}P<(tTET]v(t:rj0%_C\ۮCu ?Wh]D]DgSLM&-ӖӼBx*Eo1_l-'ʭ; a7zG`@S:󓄌ٸ^"ߨMQOI%۷E{8fB[| [=%"P&7q?`Z~4|7fo Vgi/߆Czs6[_\8 n}W~Ss㲫ɣyDmQGˮO6FmڽRc׊L eO,NPG>k)Z>I>Q| N_izD=p/_|Lw'O|>eĽC'O<x>q>'>1p>q>Ҫn>< sZc԰'4L9>8' /ͱÅgec\=wOF'Zzs{P5V#Z=QяUk'u^ZXjkjm/xxzZQI([rM^/^K췔Lo pR UӴdGNnu_Mk<,hy37cy3slݍB7PK MxG.0com/google/gson/internal/ObjectConstructor.classmA 0EhmmuBH=̽s37/=@A2XƊ7G\[U7JXƦG y|"3\~.[2BY.u˸S¶"PvuRni}~+:ίn6 = N=S Ut L[ȴuuO'ZMP5V=m9V0K3܂ɹXM/mZ2gqJVpwSE-fNrst;]+LxBa.q$іf-NTv'Gxy؉؎É=4ShU<=y:-Zb:?ܶM#H$"q> ]2ݺp?!a$|-j,=g Gr,*:tvJ1n A4=Dn)GGڰ+L9wC(#ʑ憞a.X zj {GRZԇˮ*X3a"c0b ɁZ+__0y+︮mꎊfx:!Comv`zdg\plD5hpYw_Ek ԢirH7MҼ2ּD3bN[-tLw#Y$ůF4v`9mVĊ&eO,6zkϹ6(FOk[UGα#6ޡ߬׆3AFɾ`K榕$&T^m9b qO`qB^/إn$b''@<+-\7I`2fᎀLF(@h]IAѪhFG)ߤx((J>N$_ ?Tm;u*BT!%q$JrhQW`}KS>0 CɌAvYkr/G?!$^"=CVfi`NKJVc7 v> a/^{ ߼DfosZ&9.=\*WmNUPE;hoh*y03N !պ6]=h4ԣ kԗiJy2Ki?,PW:t"ԿB)/I@ Kb7Vx3|( sPK MxG@ (com/google/gson/internal/Streams$1.classA 0EZ{" zQp!.zؒ&Dx(1Ea{OL98DŽ+7fu$j]2wVQ0,vN:8+yNF@yHܒ ?LYai 3SE갾PPK MxG]Dcom/google/gson/internal/Streams$AppendableWriter$CurrentWrite.classkPǿiV?ZnU*Fŷp@mzI3ӛ&AA(MEsr|9I}r 5`*Lll@=m<`0WCg^2η wPө`XRP{|P5JCs*Xgqfc9:roT R '<usB)!2rs/J(^ҋ%a'8WϳdrZ;9Mڌt(8. o 萿^e̒\APxejvԨ$No߄_OEHs< OBFGb@Nw 8ydu}" t[e., +d]O*~F-} +zkdmMw/%^Tnfٶn%KARۙqI1/{3&nڻMNI"" (gw+?PK MxGo57com/google/gson/internal/Streams$AppendableWriter.classSkS@=G%@-ł"V,EI A+t@!lK4$8#à3M)E`*==w&8:WQH |;E&0N[;b⾊ ml6_{ ZqW >m5N `/7>m8Uh@\tVmW}-[~:2ͲĨX2 dO[f .[VZRXh욆lx׃`Ӣ N8'9]+JBfC.ܷuId'/C_ T[LīACz00p) HjĐfH s* ggFY~97gimCIS+0ܖ"u~qN-SsíB"H h.ҬPZ>ڽ_=Bs_nDWE<7 $/i\&Uy`\ WB^)."M9!qN!N*͊XG[ +B]TmxCoH.7DX]eYBô c%\@8)_iM:4Mlv"C5-O L u2뭁@`'tZؤ$z8<ѸB6&e^!Ґ9A%jd0PK MxGQ> &com/google/gson/internal/Streams.classV[WWN9dB!"CZ[,4@\,PYOP֒}oR 0B ,۷oĶ$9T00RXTr,q,= 9G?(ho+(pR; Cer.mC7Jjaɒfj,s٧t*m5.l枷Dwi^}>-i:sj=[Tm!hzM S޸aq i  A~0,c!4$ހd_D!>yKmRӹ9v -8L8VwB;poiRFd%ka0SdifffIs4zf"Uܤ t+ pD1r3ncnw4q,Bw2cJ)]|$##?ϴ!y[rST0[rx츕4Sޜzct:c]4Qrq_{@6֚4Aҧ2K7qPK MxGK,m0com/google/gson/internal/UnsafeAllocator$1.classSmoP~.  |W ~d ӥ:ۥ-JM(enH<ghCu,7I[!=CnY!v`<1_PK MxGú?[0com/google/gson/internal/UnsafeAllocator$2.classSkOA=C [bÊd_AClRC+ Ӱ 2K[12] ;sι瞹??~X^,y0e^aQF &zf,Fk@ځԞ@J;֒@wC% xY`º8) dW-f)|^6UԐ=Е|;~StVJ ML l/ @^3ԶciotSnA@2\3jWR.$]n6},lțis ̛x'˗Z,X`4Iy8GndgXK7%Xl r:zy NlKm?cG.XAz.tg0?0?XLpg ~\Ek Be2~7d>" p5SA sI\B}H1nD(-g<ȺI"!N,#+CLđ PK MxG?ՃM% .com/google/gson/internal/UnsafeAllocator.classV[WUN LB)4 ҋ-!rє@k! LfdR/o/}Tgo.w>{?^ƘAȏ WN1iw; >tihƌY?ڹ `ZSW~Y Pх|D ŘEP4=a, 4%uSwR h^7a-K֌nʹJiI9uɠ&4ȫkJ#ѬRhYEC&eL#mS5fY]AoDzGMe,;z$Tj>͓59 N} GLESu*6:d.7r5[虨W<'^\@\ڧA>i]U7GMn&}جtV-( Fı+Zs<7vQX-YGg όgis;A%+)W^F!|̘*ws_b) $zF d촩6^_0!Vj:~*V tu&yOEi`gaxehqI hg-9bsj$Q, Ֆ^ q%dY:&ev" nj}td мzuƎxb'|G0"}1%u{nyGp3yըHrSO`v`O{9YRP6ƶ!~9\)/:P}X*F+-| ` +Mܯh}[hsl2 }#Ph[0Fhs&|>ܺom&F.L] c o%iٸkZEa6:젫%"v0z ۸C|`;#~yY@'ꖆ÷MGAڇ~7tq).BGø ~!Ppe0$o7dcGqF0F5']Y#V8N7Il; rz鬏4C^~?Jga: iu%6D(bDKP JBnUDPK MxG 䫯 4com/google/gson/internal/bind/ArrayTypeAdapter.classW[wUN.6@KPʥ-)iږ`H-"L!(|A^A&kZt4Phʙ}ξ{=ӟOÈ|C+e<$^Kꈆ!aDn%w'`R!LIIC%Sr;#T3[B F5z̶M?cf^@O9Hq3;vdl6gM9t縳(sl$[`iqڈd ;QV)S7jm+x36KyJ~ZAskz,zqdAF~g,[(d'Mw̘dYIqõt-m˦D&-{*CDb1#K^w<9rMcJ`Byld?0 O2Sg)q ,[_xaL+O` yBNА@s8-#֐@s)3Y}θǨwWM=)Z)3 ^)DMƴ4r C,$p=LP@tުխ OӡQAKv[ӃU@Bz'ާ5R=+8JulfѦጎpN+xUk{5RBx oM;<>w5}|C|c|ST9:O]-~[aX'VWM>~FsXN$6\Jy2CsCo/[4gZiֵcΌ)gڇ`P<^P\(d2I3m}MSRM!=UR si^MI6skSWIMOܼW2Vy|T+OqLmXFR0㥉T3bRv~Eɘ,obTsR-Fmp}yvu|kԑWnnBO ͝!@rQ"u }H^Kx BM,Mw%4wn 2?w]ÀJKA}Xh6L.gPQKL2 fT-v_CdzJc= l Ƣ|r׈`ßrIT6Q 9K + mL^ڔob@kSZ­7 *dWcy?W(u00q;=,1#D8>QFdb/DR"gk"626QbWU"+,أ$ZBDPt!~g_ˢ$HTQ6ZGP(o-9JA)PK MxGr)%kOHcom/google/gson/internal/bind/CollectionTypeAdapterFactory$Adapter.classWYsV;Q" HÖV1Amf!I$eil #p$WЅn^+ڙN:ӟ:Lwe(@y{Φ?7o8"#SQA)8f#C' Ž3(H,?V |(tqpNޒ e\qQB^tәE趄2k.QRYOh8NI6Jl] Xj"ˬ:vXT_r0)ljT^pFyy9 %-Qsrb*ylXfI[0 gPIRe,%lJyJZEnM0lm.3Z̝UʳmvU u4u{U:-o>oņ84< o/fUf#aC0 "{X Oইe%nuJslZQBjTksI)7FMjf-E`uxb= JW,2HNªiG+\n& =B`sZBb^U:Ȩ 5`ʸ %k澊 ξ |⚸q]|opa^0&uqM񽄑?U`X)&(PT9 V-3¾kS|8luQdJ2T=4{H4Qn9`b>b ,h~Sz0m[c9j2ҧH"'h~inA,1 `V+J;赹 mk2a8╊|Uڂ.y[]mMJ~+Νh)+ZNC±.0]"?nNUW].78n7АS! EIm(Uwzy"\~]Gtkn~F}tHnEFɮwn=zmj B:X :1EG1DF߇i}'0Ywwv}#0w m]> u\)u>Dt!k^⯈|2+}tqZ 7Mf+송'|o=r > =irg XPy\ {%F[!N2']O{=E*BCDdCO#?9,>^юWTU[06+͵}Ru6Ϸ;ºo4Sȍ{!@Dvޭ#de ]95nzPK MxG g @com/google/gson/internal/bind/CollectionTypeAdapterFactory.classV WT~.M{!͐uEV-ɦk;s6Gf 'ISe;z?&mWHS'>W 4pgp]F e1T8nXG2>ƚYQMPؐ'9>j2(mpy0;-w)r]wԦ4-Cmz6ؚV^)3*m +.l3HUg`xnfkopڎE;kֶbޔLbPWcڻϲ 7lh τͺkh>=ڼAC9 @U5].DdzTI쑯+`;P _CN GM4yH$qӴa{U7Qf!{e1> ww]G25 F7*Fy&,OP) y1@ضЙ-_ӟBu;-ik~%?WCuSay`2v5SznP\*Ǧ qU9)-oZ=uFD4Ƕ/@C-Rt3潞F3H0IXa/n$H%v$;#;KGm ee$ oMXL~/WB5,1,Ô:bXz귡h`0I BK`wM 5ҊBU?%wu~sne>o) ʎIgVO͝:;'(e'HB&Sۨ:6ô鼯؜:{ƫ0{zX c6 c:XW( V# Jup9z 63Ӭhu,4#=Q;dɜk(t,i(RNNIgIϯ}F}WX0Hklݐ d*a[ Jj"!ȶ)=q+DsXpHЯ73ԓ?PK MxG, 3com/google/gson/internal/bind/DateTypeAdapter.classVkWG~@ PRIF)B I}IƸ즛_8圶zNTOߙ,! 켙y/{g5$* -LiRHS*0YʼG T4Cch*>BCҢ0(Ȋ+x"}N,z X|$=5Н+mLl+^xVϻ3 2ܚ-Ί2'zn>i0n p|C MIŕEEvZjNw ۬w4a0K7c+zY}Vb$ϐiK]Ôȼΰap2 =AVGW3<UPp: 2zw"E0\媀 ;I-HCKQ $o !$tg,L3QO+)u'DC+|@""uDK~F$Gh9m]BIEp )Ƞt^r9(Uiɚ d.(_D/_hGk4 vr}Գqz}b- =-)- ⓪6YS"p4q4FIi$(|t;nJ2(7A' o~ҫ ZE1ѿe7&ޘDFlL4zHqS*Meh"%Oe A ׯaKZ){˷[Ruq`];^t j'n!j_ԠwIDpW!gpYݗF1&tL,PK MxGb}Q Kcom/google/gson/internal/bind/JsonAdapterAnnotationTypeAdapterFactory.classVmSU~.$,MТ)U !}J؈@D,uqelj7@G)3swCHI8={Ͻ.A?C: n(F!nFu#Hrx69wF(Xĝz`YE.{n9́(pilj%)YV*;fڞں4uI tdLWGN=&q6 E6*آSԭ55wU3 U0 6U }m;eTs*/1H7h]e=M; ;=`SEԑOwK'ηH6-Fr=iKʐo,cDW=莾rE t%[*.#=u풶\x(+I~f4V?|Q2h ǭn~ }u\XzLװYam(X*|_99d֧qD^IzPΤ4<AdT-TdթEcΔ*bD]qF<>bfdM>W1Ku/+_ _g`[,[9T4loI :ͺ<LlV^`$"'7` װƄG}-]_pwsh9 ܱeg׹&6J\]ayبځ\,[-lr#5tP`L+v-(7(wdl[$e8SOǪvw/Y,1yj<7|_sh$A$~EOjCSU}taok Y *ᘌ=B|v _6E6-B>N̷c)ak>V2RĻHIJ0D(3vfa]  F0*I [I_{PC8xh:wAT܎EfѱNcwz$ FINw4^gRӼ{ b9균&F2&EHV(}:qѧCJXa'D.ע]F NօQ09\m0}PK MxG\ũ4com/google/gson/internal/bind/JsonTreeReader$1.classQ[k1=ٙjZ|.Ծ*,+JidHfV|*((d t sNN}'G6 EN x']gƚ@[nG7[j\RY\ʛ?zTZ*(wp(,*gVrlD~DO'Hz,[k`+D{ф;T|͋\)+_/N*n|o.w{YGV>^`o{e~|藏(B9ARxDV uHB=*c*4ܩq~B{Rŷ=U8"BR3q9a.^Nj*~ (#1^GW+ԝєBg O3Ln}x"yt'DO4|T8#n.k(B)'CSFcGzMӔ2\S+Ѱ<֓iN]] _HHό\(is-'hDܬ)r$'Eu2IU&klHy/e @8Ƞ'h?)hN;Ye27[ɾVV5iʘ)j6ַԯgNjL1iUemd"T5&8d4e,YLcIvPMim+a^& KUP}569Rͬ%ZÄ́TՆ栿>dqFКX|*{nwTf]qj+83%OF -\mȭDZ\fjtA#bZNm%:]W(Y5¸WɵZhGǢycq{ɺJ¦˱:ly쎅iټB7G.*dƐw(XC:k@9\'r\J?ry ~ Zg7XsHI8J-ćCs֕RG!x>eu.u-O:ZEW AM֕|+"Z5[k:1\Rj2Kft4rw8Q(UI Qr*\AWb*iЦ"à]Z pB|h|݁6c5TvBۍ=VƉ؂|f|F£61W[ [*Gʼn`;}(k|;dJFɢC(9rWiN.@f!QFARn=JHEBm6V6$kyr/)T;iy4k^](D>ⱐ.c.5*G{eZ%6UZ`bm62I j|17?w"=f A\Ǩ\nj3{o0D2㳤W #]("ոnwZ!gYϑ~r_L2exg|̱.N->,>1^Jqd*>){91m|MZQmX1`eh^f}]Uvx]}=-nv{۹kFtnxb8ieHޏ3ZZb߳H}rWyᔀ Qs}|PK MxG>`84com/google/gson/internal/bind/JsonTreeWriter$1.classQ]k@=75]`]SeY!~EN#LPA;[Q L'9<`#p'B'+=Boƒ0?TZG&Ib/3YMTIZK/:|8F?uM93Y%.soss}/Hgz:5pon{.XC~3PK MxG}v 52com/google/gson/internal/bind/JsonTreeWriter.classW {~\fw2\`Pۄ,tP.A[d'a`%RK*V[Cj%\ *X-X{?&.“3g]̧ _BFfdU4aXV(xGU* ~!(5|]/+ oMokXo8aU;z$4[F&cfTnk$KacY޴5ӭ vcݑX8z`k+ܡ`y/5Hfh Jsؙ5lLE&kV"2YnͥM)[J*'A3mdJČAq'@+:Eԡt**XzSu *XI+{{oMũtnJ`6zTc-.gY$q4V%DJmi,0 my[%0& &-x馧śTaSXXRRL6l$r&ZkXɶt8X3ٴi ښ<* G~qI2Ji}PJ%ɞtT&;]~nL˓v75M's )Xݴ)E6;Dxm o⌓l/{0O2K2Է/֕ʥm$RmqJU::;פ)Lي*Tmx@u(9(HF5X+X85x9+7 Gh3H%X@o.xt9븀13".eMAG:&0=vaB@Xut>踊:x-禝QŇ::Qt\':OH496EtbF,`$+/ѶfO_T]~C?u 1|@qm$IC 3k⩾ ܝtU~,dI:w Φ4RX,H-5̸lN"S|9ZP}E!TCr)d3![ȻflYR0i %J![,c7mn ٩erK,1qz[^ [gٓ}E5/2Y *Ry}krz 6aZhTtw셂Qq >b hRUaacRHmr;: ґk붬$]v׫zخfP3S-`zW,iᮾR饮lC`~p ~GrkQPzUfry"C4`NU4P~iT )Xres}T#u5]G?7[;v3{=oaۋ 9_ϊܛE?ѻl=ќx|ц 4hyįKX> {y*8b6ӌZhp(0A+/I ;Y|=haôlTϱ,s x,dm.įZIR򃥸*M62*Kr3p%a,\\1Wqr(x\=N WO~nz"O)@.R/?#ҧi"}8%Ђ,mǒ#L4F暩yrM|^|>~6˕= *si9}㋬×X/P.eW"q/ʛ䗆U 31_Aֺ뚬z_S WՅBU %<5/{-] k|+IA|u`s$R ?H/PhV]d~j2;3|k|E-hI mP+\c& XJ^ST@?菔 vnLs(Z֪C؝:1ytqL'4VVuKJ+Է2P/: 84` ->ُV Xk#IX(@D}*)Ŝ&Q'x;R;*<pޯ*'[-L0&w|onyGIUU|Nnf>ys*>|ɒS+<j@Ko}5. DoHctO+;ݎL٩,`ܴ/~NN:`2U^Wg5wWV,-[!rieVS8X>vвr\H/{{7ϔh϶~ĉSʽhsOM|ar$麲ixDC6] Vd>3BnVal̎tIM{bq4GߧJM7[BزWX z~ q7+y ft m6 IUݺ~<5,={ AߨU ;wɏLIs-s(7 7i3ėsW vB,s卺1 8O7n* ^>k>륙nŽZ|{˹zk7Ey[ y[ r[glqkW^&cǁprb0~\\ |HR4NƩ=; >*JQ =Ӟ+.{N8ϋQU1iUt?1NQ*7CWӖVy=s<{ec0{aVIm"of3=s8r/Ů׃Ywݎ9v jȹ,C:6Ш0XA[&rYц&afL ĵEFz 荘0 7܂JJl$&f8[pG؆K;}'qgwyE܇WqUR^ jZRIΜ=(aFN1*v1:1N&ɬ0UE7+jjRDE审ܳ^dX  ++Tvgw|IG3 촑6vs+0 Tj c0GN c8PWqlc| 8nJ/ہ6AbGҙFST&Cc1M乷cRjs<w;&_ Nih#뇷b1 Z>ݕR; 7qdS4 38cTj/rI[ǃ UvMISlmE$eF(^Nbn&R< Ƨr>f=t ifb{=7u{f\1>5XFiuYbϴZҰRF yO38?ΙӮ2ʈ꿘gQkϴ宊Iɸ$.uszbK`0 XDbK8-'ʼnLgl@&l{Pje$ѭ$?rkGqZҊb~Jcv+2)cmm(Vqcf>;qMf/8ۍC^&u2T0t'.$D\oD"SSji:4}܋~'c Of?Lvïr6/m-R[oT+JQxRأQћ_Kz&U:y~wl>)#.PK MxG8J:9com/google/gson/internal/bind/MapTypeAdapterFactory.classW[WWNn Bh0^ hmmBjR*ڪ0Ƒa&N&/}*vvu!3gg}&N(₄Lٌ$9 y|*aD sbk\qCn܌ |*84[>f'MS TJ e:=j08ZKe -](YfZ7ɀMdhK*ym%ٺbGLv!23pg2Ƭaϔnjy+IbS A{UrnX󺹐&w+EqEP8\ivln꤅:( asfkaeYIYXFV]:%*WWgnlmQ[1f 13~mIqjMU'`yfzElT6uLXĆ a2oc^+ +I!>sY㈯٪Ү"N:'L)ye(ۃ/k4|%.4m¨'8ZΉybƫV*u 0_>=z`BUUm\TpUFH`Q~9 K0eX(Rrhʎn<*9JbݑQƲQɸ NJxP?b 鱌'HQyQ24RWd8 j:JG@}. ဏ=`moyvDpק/嵶wZmK#8tmkMOPwӤv wWt_Os7wŽݟmj9!H:[fKoxl,m~0\o&viAu!-Ggf΍L/ONO`;~I1A"yi|H#H=U}L&Jrh4iEIypGw&`;@E7= Uho+M΄bx/ђ /D}H* YKiI ݕsV xK<=).=ucw!L{ ogsOķnXEZX*isRz(0I WЇ8i&aM#BOo0?ARR2nS$< {fYԬejֲ5kCd i89>Gn%GGW բ'R#XO>Cgl44J |GZ8[MQ(1׉w'8y0BaNVi_jdB݅=|p%FD܋NPK MxGEw7com/google/gson/internal/bind/ObjectTypeAdapter$1.classSn@=q&%FH)X`X<4"k3Q;Ǿt<9럜>NQeizsTIrdtN5> Fʘ>䥃it^^\%寰gG:dd EPX3 *dcFD+Zs4WIWTqy.7tL2$Fo`PK MxGIA7com/google/gson/internal/bind/ObjectTypeAdapter$2.classmoA zXk[ ൡa֘-9?c ~,`g~w3;?ƽq9I\IwU5 dPdYaEúQN{#F[ʶ'v_F? {7"%#s}7|bE eA7=z3Sx*rr zdH pĎUG oz"PGx;!!&uLᜎ[б aQۦ- e tVa[JQr [tLuSy{f[ zEPx/ qQ82d~Me Tl kdj KɠR9žUlP FdcW V jt%r9d5 !iɞ'(yv%~D,V}! 'ƨǘ Ƙ$L1EECIbX2Vɮ_}񄬅gmQP{ap4BkVs Q9Cl%;7j@ HWihIH'~PK MxG}5d 5com/google/gson/internal/bind/ObjectTypeAdapter.classW[e.00y\x B A 3GZYVZvHiZteO=K@=v|ޙux~~ǟ,Чۊ]#x CNh2&ÂD^] v@S-`1L 7K[o m }دqQ)8%T1fe4f3*>YT|/e|<^4ϊH6bsۇ f;pX %cp| ;ڑ97g1]< V< t5B=F?Vv8 @n9J%kĵZDZ=%('Wisw 9)O(-);_sy[A~E,<sI\\ :p:u K(lm2u|)=ḡ WPB+Ȗz*3)=/ 3"eLrvwgDOi/ֽeY VhZҍXnAhXxp X z9pn)=6b6o?+>dRw;:urMr--(X*cUh7 O(Mb1'Cg;yX3/_1k%!3RWCܑtyr;\"@Ě_Kb6h~G lA;Uy;\Ldj*` -t"@[P]s Rnn=t<(;EB\w<@#LbJ:qCua˺ōGi!݈PK MxG$K Bcom/google/gson/internal/bind/ReflectiveTypeAdapterFactory$1.classSUǿ'de[(-`ZAؒ x+rRT@laaw7xy𹏾]}8_o8I \~_p㸀)Lh͌f0tVU,h5hX԰e| VժUghv |"k1Ϛn>sݜ9u# %+A َɼa۰M À5BU[2$f7m#mN.uAzZ,ݹx=Ņz{kX!lX~hEc5ɦKXi \oԣc ?EjKg9L~)I0(n8k9|_޲fӓY4óļPqbg{gk Mq|e;4m}),FxV@C] #:T k3"^7RC-ƕצXHǴU̞DH6G{r]0挂:^B6#:ECLqIEV:TEXt+/V=P XB|SŖ~1[G^t5?K2L[tkՓ,7=PI3cj%Bhmj 쩦ɞʚ䑭B]x<;D~,ջJDJ%{TKlT_{Tjvd v 2"ը,M^'y5r$ %c!,G}4TiM>"G|wh 1Їۿs0ѡ $`I ҷl:#K|o&V[wFcYX5K"ct HTIBՁaH UKjz&~boEl 1"'s}CU~~R!;/"寉IYPK@d Ip`nC4aܒG22& (K4PK MxGBWHcom/google/gson/internal/bind/ReflectiveTypeAdapterFactory$Adapter.classWipxwGO`l- -,2Xcf-9 $\6`nDq Aʡ*sR#IU "E$G._u'??\!T#*!d&6؎n#'  ʑ?UF ;CD~ 70 _B_n){K09|EJU^5r!W_ w Lw=Mn6D-7=ǰ̈́<ȽF axSm֬|8fdeɴ#-;yh}\@oukt$M٭m8hYNj6(n9fsMf\4zybH+C˚, 99T)hvrLObF&MvYr#m}r \2r[3{2w*Xe>Xxĺ`4zs<ĬȖ0=*t#5&U-*Rjfʰ;|77%^r3g]"aL%#pj1JiRNv$5IM2U %P3!SvzOL'Wlt(^THJ݌?˨{agͷj'vjTrqI29, ֭Hb#ymx:܌0[,Y`iTc)r[b,Qppp=:AIއO#xTc:pZf58{WX&IG}.\c$u繞:~(gDدဎ"WA!ֱMr8J\%EX?/0\s4߅73{p-/j>9[҈lXΟj?] ,}8.#e7R#GP;H!TKAW8 Aix`¬>ZeʕTXp]P)p5+k*V4JƔP4\ib JbF%-+9yh8 P pU E  F0%T^p3^j\~|sӚy$fwD;fp<~N^G ,-6}x-6◈W=o5oxoS;8]X,ʇD;7o$3 #WrK#rGާ̿(tʟ+fmGqc*3zBʳ<( q *v-))_?1ʔcH`0fƴ(49JYҜy5*JQQ:q#5v|PK MxGP_Kcom/google/gson/internal/bind/ReflectiveTypeAdapterFactory$BoundField.classS]OA=.]XV ~R]7XcLM# L6!әfw<Q;+JH;g=ޛ/_O>x5Ԧ0knYsw{a}yN<:i2xH%WX(Ty,̟0\w:}01ϴ/HxW&jOA'-3}j:ޒBZggĘD0ɌE RxDCw1rޤ2*lw٠ͷ=u"a},Oi/XT(,54V}GÇIS|Ls0li2TW0W@҄Cd WQ$l$\>ʜ 2gb.V>pv %c`mR8D9XyOx 3d+"#e~N(< * j)pVkN ,aX#{gAltYgPK MxG;з E#@com/google/gson/internal/bind/ReflectiveTypeAdapterFactory.classY |1eD rX@$ hew6qwamUMUڊVh[hmke[{Rd݄p}}^<>E<ۋ9{\;ةI92lFrab4rM /}I 8LxYҘ;%4oL\z ̠fld.Y;M?6j f@[fA,CZO k\2g~)Bç iW%3nvfzWIJ%Բd3* LN}R]ONzn.8$;ڟf狸vHh{I`^:L)!-cՉܼyK=Ί̝8b|cvE"9؍ŵ.떆/x[PTj`yhhjN*%7aLtJt!DIHaty!ǡ>4's_7oc ۬Ф:==Ϯ+UR {Y[O|ܟ-"8/ N_.zqdzy6qD5i]UubIœIELvpMy!Xp{{]];4i0JƸp&fSD;b}ʟΟ1?#ALumslRGA&+-rLj{Q˸twSN٤!Zt+fz3^V+Aէ%8DlAW6XJ^4D1[O`+eފ=a?Joq_WJt7܋ӃU+U{ `^~^,TߡԽh^)3Lig9m*&x E ?RYbF߶#G-i73)|ç\6j3t;6bjd}^Z>'ʃ,c)>{v2_xp ^llG%ϟi:z%O89yft-$9\}%wίVrd&2u%ٌrJ7An/j3;8RY)XtP CiZMZ3'̜N#èVpal9Pܣ^1p +GPG10{D_)߇ư8m&at0?‰ay"y(\ ~&6֑0N4C? vHH2c\5Ui- pS$Q"/̒YL)/0^`= Y]UdJ+㒶7Ks?S*2!WH7)?0qkDs]k7pS'2h_5?PK MxG~d 6com/google/gson/internal/bind/SqlDateTypeAdapter.classVkSF=k-@I E@Bi -Ԇ;P-ȒeAW҇)3me?]aS9f˜RJ%` ^K* Z(_.) Y쿖7*hǔD{Δˢ'2 Yd.j.B+mKld^/™sl1_NQw:b՞鮘ΥƸa?[dLyВ4,1W). '/tҖs;|h "cXDMmٰZzݔ>#'P5*r(Lq ͩT*ODOTy8 *V`XEDL 6GI:*1vjx2T[ZŕL*T3aC$>9|KѦ]ћx^YNT^mK2!LȾա<%iKwX9)1j.}㔽k;% zy'5ZdJ7j4RNb!Ö{hWܐ`!9s$ӨCPK MxG5com/google/gson/internal/bind/TimeTypeAdapter$1.classSn@=qZ\%I TQD 7n묃!x*QMBEwf̜_z6*y,cƪ<,Tl\qM\C*6ulK*t㝐R+ycGʄD)oMPe8&6N&F i@tӻwp'*pumi'긲|;ľؒvGD(*n-`yq3'Cs Ou3S$bX(>`Xİ׹Ҹ>o5PFN< w0MO3C?vgHsH2S`@k΀5i- ps$ΡD^:8&%PL)ů^b, YݐUGdZ+c[$Rj!I)?q KDshWq$h_73?PK MxG^@[ 3com/google/gson/internal/bind/TimeTypeAdapter.classUmWE~&Ll R@b BE"I$ӰM7^A+ 97GwB2{3ss6?`;ncIO50A;>"RJeA"85| Hr8ihĪ<\%%9Њ-w3s#,ENϤV =7r++Y7kf|g=w3%6mŮo<1}1ƄX$C0[eq1a9b_^\i9fL{,YoXD8Grcƺdk',Peѧ1O vz񅭀u"`h:>(bFw*B]6xrRXC2Hffk,`z TϒLkƱ&0dnɿN٘|mvI,ecaM'g,olѫPi(OdrEV1GLkDUDAK%/#f-[-U]/uN*iV`Ӗ&|~XTGVs X:6ѩc 6G^ ~GA xzWLXr-K&%}|ӝZ3.:\ˌnz0RZ1T\ץMAxI߳Ck4QZqwxآ+.Ց)wKȉL% vċ%ۦF⛀ZE* kA4nݡ>'|Y>u-SyJԆȫI%S \H=K JGR+TEPGG}Z DI!Iҏ-Ѓ%4$K ʗ?!BRA=Ih GhH@?č}Ә;DD8Q$8 (4øb''J;EhW,Rz?5 |hHH%޾K4H4Ʉ+2Eyluⲍ($1Bys c9PSFMӔЉ2BqޭzJA|T*G{DZ^ҪIt+F@ZӇhoK0V#g+S"w0]58PK MxG|Fil Acom/google/gson/internal/bind/TypeAdapterRuntimeTypeWrapper.classV]SW~N$RRQi ~ЀbBRv3evzozџ 9!2:swwy_>atzg |%uaJsafk!aIrXpOêwl| eN8,;y˴@Y4 g o=.[F3]V6]ílgr4uƞ,v!E3)kZg,˱,餸=l1ٌe˻;36D2N(%ʀw* \oHg?6MުOk{֎)5Q*)j ;`Tm k[o$P^ ; qXϲ.[ |Q,yc5 N-ZS-]6bT˔FCh]ʯe {FqWQ }l4?%Ԑ=M/LKkfKfڶ7c'q,Nǩ\!}ag]7o.X- }EfENG7":zЫC븄SR7:ֱ[{ ?pZZk縏Gj$}ѶMwhfYG \h)3@#~~8rr+y$aLRhxzPO9x"F\m"E\#C5;JJ;#c9g~(rUױISJT|@ه>^Gu(]jz }cx pC׋B${0+A@I2P$2j?TQJ\VVB_Ÿ8@ZIA"J Jc|2Bt|WӍR,U҉ 2rk`@4 姘vT[5BO-?CtRԏ'~ʲ Wy^x,j I qǏ&^E]&*cJjU3PR~/qϼP_P7]/ǁ䟏:j+?1tCȀ0CpPK MxG)O2com/google/gson/internal/bind/TypeAdapters$1.classUmSU~nam!Tt ؆f)ֶRK ^oNeswgVDV?;~sx&[f&9ys=OsL|{>3pD swz՞Bz-B]ϖ $`yD0\FתL],G?M yYw`|@>$(3$[$"wlBLvC\K$cXSYqHR9^}L{,nb4LBšTѵ/EG_dH;.A7Zcr$K6+`۱6‘10M,q&:Z"|zNLqMƦ;'q1G$ f~7[:$,8uH.7 ︰PK MxGc~A 3com/google/gson/internal/bind/TypeAdapters$10.classV[Sg~dÆuQBUC,VP1'ٯKʇ>\>bj8yTUX CkTόr+ڜ]k8oCʾW0ӷFT;sk3,^|[4JWr,xa廦cnј^]FiAש,YzA2h\y<4oF9ๅ[nhhh^G|\zծD*qLdTݼf8RBs)%l tn}p S/O _-  Sع ?#XK <S,3"97bƵu%\퐊g6MƬd;uDX+[`nN`2"'oZw^PmK}xAK]4 2!ڔW e[fqo}OKmQxƬpc.hG@3s>wq E:<,1:>K-*)袌Ԫ+\A#ʠP\u,cNP:V%;Bŗҝt H2qHˤ@,v4jlF{H۞ TzF9j,\¼UݑtP`Z |w(s~QOLPHz^d45ӧ|oY䓖[P!dRcMdf$c"6s{`mwnusZ_ BRk?Q (:pgʀ.d"5z+P%Qn Ù>D2Omo ~壞yÏ4׾ Jl5~D5{bx쫠nB!i]bF3ER.EtM@H[t8ƠEVd0*0.QnI$ц]8\у4OWK S:)Nvon=͹Љ U=09ihGZ8&4t`ڧ890Dmi -Ɂ7 3nQ0tee1?hZ[Vnq!DrOݻUQǯ>LTrvIZ~գFPxcɓDܪWSW.U<0# [e)+TG]xc :K,Ǣ%`z+VmI܋Rt/9^鸁n\`D֑@íc鞡IN,k/՜::ġ+ Пh&&];,_&C(pRlU MӕSб嚛_zOI.KY=&d/jr6kDM5F#=E(YLyS`Ɉ4Qd8C^ Y)yQJDbdmZ۾"wC8wSbH`S4:Yl;^ Q\GȯKLxWiR8J^Ha&3e=6׃ssGS$CUuvECzBa'/;8]hhM [ 2HPK MxGl)O3com/google/gson/internal/bind/TypeAdapters$12.classT[S@ƈ"rS{Qe 8ZaIS}@g4ꔒ99\7`k*4U$0&%cJ4fT<Ĭ+x౤s oO k)iO;9Ӊ2)JL"tAZ%tm#ڟ8A7 L\BǤ xo*ˡm!v<.IA=O-b$6Տ& $O%J<!+^A 4@dJLTKqƄ|zA8_f>ڬy,:<{z=ʧPK MxGlK"Q3com/google/gson/internal/bind/TypeAdapters$13.classT[S@-  ^M7-EG'm6$EC>rǶ̒0CUM6|c ZݲNr]=.\+`ٮ)J۷ 2:Щ`^3,(x5D%,+XѰW ^k@VC/k; cC&z,g7Ϩj=Hwya$lvrv E>6cj]cojYt|R]堟?scM,3is>/P 4ȧ^V$}"%8QidEVs@7dI% !7ҧ}F#bE m_=׍桲:Yqcl]EJ UYaJzߺUeev.(7Hg P`",VO%`p3Cej*=SfǢu|Ǐ`ti PK MxGD3com/google/gson/internal/bind/TypeAdapters$14.classVWG ylQJA6/XQ*PZbãT$s2n6AbSi;993w}k&*&.a|4&fLMD1g஁y&bBSۗ&3M 㾁-X2q2RuW ˍݒx%P+sww`˩3XR ]({v󪮰uOڎ /kYjbkī''&d0Ѭi׾O$#|͟pjG2\?6C|nkގ k4 )-k:h+ ~YǓu = (w|/~ OpkT:+mQGQTE*y DB%fkeqQ]uAƕ<5,^ݑ%lyX+X(bC ؠXvbܯJGx~Ou82P<?,=ױm8.,(7JHmx {S r EcdeiA\=LbV[=L5>I)}mb`B&k7c(0ݤB07[83d5q,Ĺ&sL>R,@5004DD:9`ב$D |94 -N8D%#K(oΆ"a"~rh:4ENGjP$}`pew rPCOd;ڱm'Il.4q_̣h7qKI|ݦ]ZC֑ PK MxGi 3com/google/gson/internal/bind/TypeAdapters$15.classUSU$d i4-&!ti4RM D W$²l;:>{+!t,`gsϞ{|_~p LcVpoMYܑCXޖ!1{{WF2bXP= KMݙe'K U Zen/je$тUь%dP휡5jb5˪\5-SMۦfeݬ<[$kܼ!;6ת Ӊ'}ZWtIV M54ꚭU& P$gغYO'KVYnJ f72>uD,LW"~3A74Ec]Ix0y˫␋cKzԜM'X(LW].Y-ꢩ;8B8gV I5NݪJXRp| *+ >C*@gCWYsNK7(] 6+]xr ʨ(@ziq*Q&mgp֠/pxeG1D! -q)͎`[ͧ`l#8Am(8[Ʃ8EF!} }SkD7oq}) ($+JbHc#e:mCAT~~HȤُ{%ps}RK'VM\ځ&\Ќ̧(yѭz;$ggB8S1ƙ^UۢuտW]:)k^rOD'/PK MxGK9L3com/google/gson/internal/bind/TypeAdapters$16.classT[OQCE+ (j)w-hiUPߖ,goxI4< 㳿,+K 4Μ|3N⮁M `wZ{gw97Ё!K \BH 9 l}Bb̫H患d17#i{Hg+}w: &GN`N(%1׮%/BٛWuU{rT }e֌*5{9/ \ig=WsM2FcmZS*'9phVMYVioV*vLvyvҮ geY OF ɧ(η@|3u=`rOl*SJ3e9o}QOO9Ue Y 6eYqC͔15hAmYZWe׫3~R\5хq>װudLn 2Q"JM;$ېp ]-%t0֐Ye]rAY پ=QW(ڔ|KRa|HhQs!ֿ1.i g:_ж쪘V]-1{%RžŖt4:AzKl(8#M|F|i EW7\Wt2#TBaƎ<k8~Rj$+D^(h'st$hI*}FUd_b_Od? q۫]!;d}.D}!Zevaȏ] ~Qj-wXy} z{:==F$WoPK MxG[3com/google/gson/internal/bind/TypeAdapters$18.classU[SPІE ZDA-EC{DBIS}QFqOX0lw ⱊ&`WpUJ\됊0PpSEI#q[cȈi(.P?)mb4/Ycb͑3gk@Y-%mNXF$UO%8K腒c 6,}޴jQ"JI #OHwy!r{jGYA4kl+ٵ]Q|dG^:e7'LIj\>I;g9%.dLhY] RpO}4<@3^H"-2}Gو+V2ش HIЅsK55F8'k:zj*1x>cQEBwfE!s?84&t$\-Ve1\>l>x5_+Z6oJ2.β`V *h'15Lyfb,鼒&6@oX(?#RI[8ƲV1@ NJEl%_uޢ5,&s,E6e6ۀ}c864DieG 16v#w];EWH9HwgXV=T@=+,L*TzqU~ B?d? qޯ]al .~^eva$] =AA7Do8\<ԝ{篗py &~PK MxGQ&S3com/google/gson/internal/bind/TypeAdapters$19.classUYOQn)㰕M6eSKYA@P"ǡ)L3"!} fⳉ*4{{9Y>Pe `0,}AeTP0. %L2&tSwk Y+* nji"q+k 8zAY0MnZ.iS֎L2UtmjiuUO,r]ccs-0-9t.~F6oijhfFM:nff!N|Y CyRZ+EK[fNC;*Ӻ0/LIoKh(f)jㅌW7,aa[)"^.QT3mJtN\X$e 'h١n4sfʰr̝M+-aFA*%*x9 ੂT24\L"c\2 ڑPPweh.R4Cn +C~iΗ+=1޵, ]bjms.2"L<:J |I _*k5E bÎu9?F> }7/HTLhcG`|5$ "cԠ$DV™Oh9-QF(#P>]2 U_ tdUh& E =4^]~A {C5j vq*c.jGY7 $t!c.nx ebT_!/YVD=!Td!<ݮ} =E{OkA`nPK MxG{J 2com/google/gson/internal/bind/TypeAdapters$2.classWsUfMJ+BA @ MyV mXЊ"Mti7( 2 8(~PG8O2~wL˴3{;瞛7X5Dѭ;ʱrէ {d?Zǰ[q#^I`_EREJa'iI4T cF3RmH G=)+?sx#/U ,^e2fwZٕ7FN'idz גE X9öMwKL~w&Dq39v²=ӵL߲SfKȒH3iMPyJl庛2sqH=+ly=G G0awچfֳ3hٲӽF&'wCߠHe ,b!T,:a(AӖ ,)Gř=fd};*xM!eS@ky4| I!w(e h7EE;y79 oo&%6TQ[cm˻ y+%M41fz4-sJ^Ɍc7l3X∎gp,t<x+u&tNj:^ /K ^N84^X2E۲&㳔 =cDjfޜ26uHp(r1R܈;Gjv'o#:଎7pRVjT[:x[;wu{ eCH :Z&`\ 2X PU>rK8~< xYjne(];;;¶9u3n5 umn%j P9hy(UըT"Vǘ)+C~˰:lrq2aȚ䍢{[fv iP8k97;76QI:٬iXu3 )FtS۽LIL*f<ŪL٬fZ1y/MPƴMG:&+c[oE A>fBrk/C\ 1Ґ܍R ZRe(G.!9ʹRą+6~fۨT+ _\By2K?A&೐3AUC l2tPuk*Q]W0~++Fp[uds/J=077xT B~/0,rf|X@bO$#;`b143ڃ 8{ru<C)\a|#;?NWo>`X}N XuUTwYbj=60p7k4V_a#X{)YYJEPq_I(sSŦMUE_X7 o3‡ӼFO~S,HzG_yQ|>EDBxJ\~[Hk 8x*8r^/8jiza g}w& !S7BjNcUkLZƹ$&TtWjcH2(.~ ,jmv忷~ JɆ*PK MxGgk(N3com/google/gson/internal/bind/TypeAdapters$20.classUYOQn eYMm2`Q $!> 3t|D㛉?Ds K)M{w{f ^ @/#Xe_\b*i5cIugM3(Ӧ C9mdT5[MPWt3.񱌖#]wxleF<m3 bumKS ̪)xau|^CysZΫDN[f^#+[wH?Z4eadh*8$P-(P%\#3H|٣PK MxG^3com/google/gson/internal/bind/TypeAdapters$22.classTmSU~re"-mQnKTAoNز܍ ??_th9ornV i2{ٳ99oAEGBbQIt|eOuİq㞎|:s#(ȱʱ]/2қ e& ݊V!MV-gl*#d0R oٱMAfu׭;¬7]ib˚Y~K5Ad#tᱵgRzu)ٲ`_KͶ,A!Zݖ2:3jrZjxkзVy,>E;NG>^[JAX8xQ䶼kIʖtEVI=. ۭq ba`[1f`hdqe74Y ]"# ;ne`o"G ,](cHuga4p]vwv2'B0LƧuβÕ^ԥJfKO⇖)>tS3}S_'> Ri9s0]I_?=4 <$3< h* L Y)?p;{W8Iv@k1~s!~P|%P24:QI/SAa$$ƵQd1LJ}EC0E*2P$O"#8~ x]0Ҥi:Oa]{ܟ|N bhK1h$z\HA 1RI$ڧGX"gB4W]z wVg6얞^ vD~'c:{>;i}3[5=/PK MxGg^0g3com/google/gson/internal/bind/TypeAdapters$23.classU[SPNZ#w j) KEb) >L '$EC >3(uO#f/_⹆04FnvS4h-y A]i)USq!h '%b.9EНW4m圂io%Ccmy zV.٦q5rlds9°]aƶ%  ټٹ4,2'"=U_ws4,bG %@`8ᛅ5֡--o9Skd_l+#q~B 3*Q6S0)hm >,_Q}&aW] .6.>kN-'zo"LZeQ5v*B%≎XёEU<ӑÚ1\iS~j4{U9_Ϛ%?z7˴I]xGiz黩T:4$'RFe}5 I&אdIR!94y#"'->=x}4e]U({bKm|z0LJ HF$d;Tj!:_SjZIW FjT}L6hBޒ_Q1NPyO6=JzL؆X7ib,dǹDsS̓oq@ d Si:S j PK MxGu+#>3com/google/gson/internal/bind/TypeAdapters$24.classUYSPnZÎR%V" 8=BIS?:>89RMT` t&|99|gKVA 4CxVM#cLqqL2BNx!c!4eXK bYP2,ZOsgCOiLCʠcԤeqg NZ*ck9Ι\lK3,;njij|6IW &(,XgGwdÝDojW?еkfr%b蹁/CͺgV_pyװ~b*I\D40`k@7DV1|2oSrZzg\"y厢u#gnW lS&be.:h7|PXӂ-X.Vn;vV+1b 2UIԩX²VTb k*Zp~x0pdhP"CaZrlam.C2nZesV-Mu6pu3bIբi<9Z%،j^6GJ뗜>*}&ů.4li$ƾ@gH(4VKh]LlY gD>PY #z5"HơHqJ&-%?@Oq#%g EYHb;v]tPSh ׈pUPߑU9஢ߠ9QtT-$]-(M-+Ru;.-d 47yFgPmH"!\U zaXKbaKda4{FpaJ0b C1ͭa_aQ$?Q*B ;xW2Rt\k>J{LNG ųY/1]P3pv6Y`_huZڙz>[I1HVSN.)EPGҟ忉o&1|A>[ϐM IL6M,LՑk*S#ޡ'U&g&Fq7VkTާ351KVkIx[g8#ě, _ N4c:?xl'8~ց8fPK MxGy6F5com/google/gson/internal/bind/TypeAdapters$26$1.classU[S@6- RJ5 >hhHW'M9iV۩n6g97XꀎIjT\WqCCnja3aVms};ș̼+Y 'p:u Fu45'FU K#} uCAiS 6c9V0+:blS7'Ӗ# ˘6YznִM1Y "1F9D=ingT0i|XXz1 mdP$rOl\0xXq,ҹTmmVu|wxl*1;yӍFR".+aԯm- (3 dkV1G&uL#ѳD%/+Y<=mq#_+7cwuѧ :$R]:T=:.2G%:u-& \n PK^Rp2eOCK dmPٛ_E!.SL'dhyxtu=iF~-@Aɑ]djJ3"9Gi# +RЗAk  $?ACtm+ؓh@>AcT)tY2P 4,)8GVOQq~N dQWT P wɫʋVʪaÜ;͒!*G|1JOޕX>47=ĉUkq+8U#}pq hck=@/zfN7PK MxGhB3com/google/gson/internal/bind/TypeAdapters$26.classTR@6- -@墶DK;8(3AMH*#>b&sos`O3HNwqOE^E!"Ud¬9ykÃ@ C"_`H.{u0X]jԄoCp˦zy#t+\vCk[׍ݦx^MS %B5}C#P2 =8l Q(s*u0vIբXmǎ T:Mrez+Ր;yږÖO/eYᮥ׶ ih욋d^7Ŋq,5/]kU[^],W<*̃n d8)GY,1)w`Of/0 ]Xf 0 [90\:,wiin{|>xֿW@x ̣3"FBUhSϨ)}˃Ԧ"Cr܀ahԓ]W$Fghoa{Zr=k?z_=GIS*U};hʦ_l8.#'1GqW K#p kN!Z=^dM`R-be߄t{3y%KK)ij׳X`Y_%!{.^56i#R`׵+عS4^[8$2;J2w$W$ה>IJ q!z t=6 %SQG\0@=SBVtXJ~g8~8q;a#vłG[C%属M6l.]DNvIvU5ȳ\`7pħ}ax>q!!CJ8@[ƀ,b͹&2}s wL6QĹi>#J~j=xDqX?&T|PpL5XlssЛ?W<&KsX;Ps@q-h ςZPUUWTͫq|:_"mK6<#>cl}_MAx O]ӣGଆA1{ W4d {yd)VaP5\eAG?Cߩ^e0\8vp(LG=dgdY2t>B3t&Sh&~%O.$]LѲ+R=5:.Z$sVŒ Kl+21ZRvD6{DJWk ї0@N+]R8^$F5ke2Ii`LVlGKDI m=z."6dC!6+!CMzNOѸDpڶ6.Dxg FJʿb|m|터.#R'nqqiX#ǟ[0Y.vjEl\EjG;$ tF "-;H #IǞ [A^_?jC9ql5ӻ}b; P/4}Cq\7]u΃O)> nk341@D%[iu^G`%uyD %1Q}>[ug$L>PK MxG3com/google/gson/internal/bind/TypeAdapters$29.classX `Mf3;g@!VAEB4#k$;.63,!Jm؋ڻ himRbE\n&Dys0Ch*C[6]ŭ >UC'T'Y|)f?g pTYƒMKŵ>|Q%~lfL}E*Jx |U|N~|{&?췙Se>S? w ~lg~؎[ `~<+fLu)ح؋_3~cQ/?ϴLg\>ee-Fl%IQݤGW13Ze`Ķ#Q#Vд#f`i+[Jxٌ9U'fa}Vj .&zaXՔ>-吮|5-n7nE N̴"4bzE9T$&G✰,$448z%z:J@J1vc꘶W[2-f:ؚ=A,h-cn rd TWk91r(Ϸ njLee;\#)I==Ggg%G*d^ߨh* =V ՃFn̈;g^-=*d)(WDXdo,5m%+:,V{ j#R?sB_p5Uߒo5X{%7{Q+UW` m;j薻Z/̌6쥷P._s'ry?JD cs7 5R VhDLYYxz"Jv߰©W}PËqIqZjƻO6Px-ʻ/82hɲ(b8սs}x(pu4K%{MA]`3I[eɜYᙘٹR~pz<ahy)AI?K)LvSV[l7f>.4πtf,HKcBFe3 ag@"dcvhg;|2kNsTeL"O< z`c{"\N?ɣA_< K+ v!,b њ@-{PXMRV.HIIo'~T4VѸA&3"o )KX5SPuG  C3t IU>Jx΃2 (g1^AKi (!Xt°j72w+`eњ3#sWTN0P Q{\| q mRHn1;qK>PK MxG[)Ix2com/google/gson/internal/bind/TypeAdapters$3.classUsUnfR UAB$]0ZjbjZ&?8D}oG9~w;==|ߞs6q+xckZ7 MemvAkĢw|sEt.)07Jg]wi9Ui'Ƒ USkvw\eB߳/RgVV틶Zjmk%  #ڵQߠ JCmײnlR'pǫY7+9XZ3 P|8;ٱ !03<mvfsA ;Ja>LX_. \8J1O=*MQmVVvO ;8}]+dB_t)-`ÿtn}L\ds=잭Kk;I.kNxNZֿQ>c.,J pk&6~iK/%e}~E ƩLP< c8%1_7 {bnXk/8G},^5Ne2[+&dnqlrk>WGƓ6~"Y_br1!Kv\GQ\" Wd ?t@]3 <3%yDS1 s?1zd?|_\,,~78B7/PK MxGIĸ3com/google/gson/internal/bind/TypeAdapters$30.classTNA=ö,r+XE"^iƤ`bnDzmv*o $>1~3- dg9߭A#H #咖ˌ#wtq=k9VȠ% U,z#6Ւd&wMnorϒ2lY>Co/H4[5*[Q]ǰ@x唍nMytl0=|hLola 'li!1O'` Ǡ{-7lT U$:V0yQ[bf0NfӇB͝u^S:Qlq6g,Q̑[Ldͽl9SY[q?(uЏډK^ !ڧѶ}@g:}B7A>@0@[BX[Ơ ƴM5i)!. $\ 62?dAquaT%9Fqu-$1Q䯃^IoPK MxG"U3com/google/gson/internal/bind/TypeAdapters$31.classTnA( jTZoB4j/4ƻamtY}[M&^>*U/v}ag}}fp5%3FAYc 71x`n<E,!MRB'PK MxGl3com/google/gson/internal/bind/TypeAdapters$32.classTYSA& l pxqI ! J"%> ݸY@b*,{6 agz{#Xi@2@#➂aďr#1. ?&>`Jc =9В{`3p=6wY"͛FJ%qes*!"ZEH'ReM|E(R1lRmsն4#(j#jZiɜ[ʻ:(i捴n{Y؛fF9 Us9ad)ibP( X CAYN@; ^ANq4hX4vO/2JyI.L[_+'h|W`*XRI:H!ޓRG$+]bhl^F^cԇN $ţK!+2}[iKaeqt &7PK MxGo[3com/google/gson/internal/bind/TypeAdapters$33.classUR@+j)Ԫx x+2:?Z!餩ʣ_23>8MFs\sٳ/>~pKe\(z0$R*Q1(z7"nJ:bN-:_psjWГ]/xV)9cJ%!-|^ɻeqˮp,vRŶj p3 ӱvP kd!4c5,P]+' &Iz%r CQaXp@"|ɂacVe #Kc[vsS讇W٥O!)cu:wcPR%O͑6 T7V:kr.WyUqG]7g,V *lp_,PT柛YϩeGӎvu iH.%hή:3dCzatӮp{װ}2`AŢx@j5]5̢1]s\wmg<) i֍z iHJm& 'Z4OJn:kn ?ϋn; ~:e%&㻎W훳慄~ü\=XpC柼D!~s9(r>B$CeІѾ&X|lm&BIކAZd Ea5e8d%^XGjh_H?Amo%CmEC=hWJr#KNzю`Ⱥ>M!t$*FU!r/DO~BH 2vַjRCWkػӠz)+864i/Eyƽ/-yFPK MxGT?;f3com/google/gson/internal/bind/TypeAdapters$34.classUR@)MA.(B UAV8ضk )3:L$hmx=g;=''؉9bFZE&.DqQl p9+QlW%bNu7/`-U2YIVK3R]%Wŕ2:f؟+Y+eU ,3U&HF7u'0 &³VX]E$}9čEnr Β^cn@$|ncO5l|^%-X0),e lA1A<:5ɽ9kPPPHg mwae+ҳy^uAUTq;u<)D:rjѭwlݬ0'd[u$tِ?&iخ%êprװ 2⎆Gj 5S׍1]sXcy5G lZ7Ž \>ѐ_M.COkir m^S,{n8z՛JR~%itJ\>'5poݤ]?ժ0t>ΟyE {O={PzzD|JH!!eBhbr,1P"%;0LkG&yB܏Q p$Kkdd=+41"[1RG"'GP tʤ׷ۆmv@ JYǨI~) N'q-4Pҋ[jPK MxG7 .D5com/google/gson/internal/bind/TypeAdapters$35$1.classUSU=/ l.B ZDBbmDi6m"-xI۸qOδagr&C o޽so,x I|8F0>ւ^>c,h"G Q|K)q|eGWMLq7"PV~+rY.9u gL0XR ?|"P6]aOڎT—ܵ+t ҳ4ؼ#qo5W#ډ#Js"2I*w׸gV0swA\(_ uIurGTU!S:M30ڭ+5fU4*C%WMBa҃\3<G@n _M 4XRz(1L@[|ov]⒣6ZMԒ^zQ^faX8Nd/,7-L㴉5 q8짠iH7Z0JʧLKJ-m6) iKܢF*MσW7|KS0~@0q<{yCVWw0eZzΥaβwWHS~ũNQ/ؗQqe(.D9g&I⍆tV;m:]|f]A3q&#]&_C>#! JLOb G$$SOd`<[1A=J> Ґ~tFrj'ʵ8̫SjA:%Yom~lkϓ!$}b*#mz1Z(G;f]Fl} ,A/BQm C[3(L9֠L~sƯj!'gEti{䉂ѳ=ޥuƌ}LV|ca(PK MxG83com/google/gson/internal/bind/TypeAdapters$35.classUksF=k9cQ!ByĘR6iC <~[GH$>w0LDgf&ӻU x]{s]Ӹ53q*8YUT2Hᜊ 8rQ:g8/_Ҹ Nj*U\RqA8› aM?z0R͝F) (3 Ku pj6lQjS2޻iEb9V00]_bHιuAY#[3M^%#c2XR rvirI'%G< [Ko0p D0 &0[D]Z%=ĩ*1]!=T)nj7/f Y -<gV_[G)3ZYNag.EcLmydKFEpLF.: ⪆Pհ vcXP~hIp1%yeuyF]˖g`%Zo2_50d{HGԨ]=Ba(|~f򶀍^*7Oʎus@M`g}_¼JwQv7©ڎ=RUE*zVF+q>2:~$YyЇH^#~A" &^&_"Q؀L 3EPkra|42a0ϐ06Fr3 H.7?b2VdЕBB#—#88\T7To:J/˓@4;*&0R$:bQ7"q'^#}{zvk/a]i]-(+y5E{Y |a RPK MxGBƲ|3com/google/gson/internal/bind/TypeAdapters$36.classkOAߡۖ"Qo]XmBvkڂ1|vSfw&YM12S4mF3{!Hqb@f% 1,,#,,c,,,,W$LIP&+0vrzM6}U۔~Ng:m[kEö+Xo 3nZ˦W6d]C7ubY tck0-/u0W,]zZ3S?Zu -3"᪄k ѓ, ~ޢغSU4X7vV,Ӯz [,YXY,e9)Br>:yĚ^}B]&Q`~(-v/~6hZSoITj:14v'a'顋dg$zO '}_3{70BD0(aqdKtsKx%9@1* ч!ҳ#G *H^cx/_ ޒp~q ehјEC ghqø@:M#N't# PK MxG3c,V2com/google/gson/internal/bind/TypeAdapters$4.classU[SPN[TRJ%(`D (sr2vmVd,`w_Y44#`VCڇ#j/<釰 SGhwHI2iM@ aϸZgJɽ#/l lG=oQOZY] zx-*>Rn-RE(:H =>6 X'"-;(}DQwĩz_IquBbdj u%k zsP5R\GDq?AVbg?Ӊ>gXh؇Vm"Xt&<~$=yޝN9/#PK MxGk j2com/google/gson/internal/bind/TypeAdapters$5.classTsUn&BSPD@(P Mc_Rmki $q\ҥfυ:Ψ3(/8~wS2{Ξ{}?Cnc&niJ%& q>3pKLk9#1+@jpJ` 7"J`xjrlw0KYn'5j~UV{*lZuUjݤ5z4s=GQAq~j[5NL&Y(qQ ;۬f'pG*][_ɬ%1'0,pB"{G)(B?}* scGȡ\^}jaǁLixvXյ,]o})Mho55 ϮjrƢ ļ,%4J &F"M,aY➉x pnv {+ly*U9<4qdf61KL> @*-w?8'bߎ$6Z͍낪ÄKe Ifv]ՒF%Nѷl!Q/?&3Fu2e3=QWm r7 fQ mͿxN%S78=O)tsKK;HPKmw|Rۋ?!M%204S8 r; +Eq#<4.HkgqGK$ qI/rKb9^؁텍("tv1$.JD䈍{ ;MJ1UJ)'l!438ύZ#?^{9\ G5'6otPK MxGc0O2com/google/gson/internal/bind/TypeAdapters$6.classTRA=%CExBdQDh%Q%2lWg-R*E²gX1EڙIO9gz7F@ (ZSy0q㒁 ᲁ渢#"Ctax}Q 2YY,;2^v۾Ʀ`)3i)?岠h= X@vYGܓ)%{ΧvB&֢u#Tof~d[-֪@`hƸ/R^ǓHM0f;0aQ) TcS3mtuF}Q!Ndrɹ|wϞz'sXĤ878oo)\^⢅,L bFG_,fn 5%0XZj|T  =?qE^S.j9m6NSz3Ў#jwV<]s*j6kN*&0HlFI4eݨR<)yV9hU^jo 6U?hzՠ&qFC6pU⚍"۸!%,J,XO'h}bsC;Qg6B0 dv#iA^x I).IퟂgGpJ fǺuA%XSf~NC_J% h-|_@=Td71nx {9 p]Y fzfV.sL1+u;SZwaa/>jo>.L1$^~- { = k7\?|D|p=gV|PK MxGd@ (2com/google/gson/internal/bind/TypeAdapters$8.classU[OA.,[QDڛ,**  ,ng $(튍&ms9{wsٟ~pM$1e61{&bo EWqq]!Qx dstX&;sPf7p3:[}d0O$nGNi&Ugw"~ vvi7Ţ1꧑ ,rỻ4-FPK MxGK؜M2com/google/gson/internal/bind/TypeAdapters$9.classTmOA~-=8Ny A" XBD ȷuS\w_闒hb2^l0ۙy晝OXa㱅,r6ț` fm5˜+B ʐdRJBwZ^9 pI^|)}("gSJ^q-VܭFJBjJ/pBV/|-^.LȽ EGa1[:N} S0L^f~OuНēXrff(]l^dƚ;FJiM#N&̩ ~$iOgH}1cl06J6[HKlH&IB= 13M1AČm{}cpo#i8sDܺȺt g6q( /BNѾEdSƣxo֡8np\Y_PK MxGRŭ2@com/google/gson/internal/bind/TypeAdapters$EnumTypeAdapter.classW[WWr0* ؆RD$* h%Jv#4xj[%u-SVѾ3CHR!s/>L~pEFp<-Jψ*cQaˡ#2FB!+E Q<+ƄH ɒQ8R8&>qy/E¾$/sxaksi$-հRB}j)(T8/\LK_kqV7b[|G{fr#RM.)؎^0qY:cιgXPC_hfgG,K:Y~Qe#%ݽ)Pa_j_o(CdXWȶIhc+dg%3j.p;fLeh*J3q]՟v[k(Qd)Qc"Nf" 5N2^;͋1΢14^:wo/ʹQ?Q,%J ^ ˽b-}.wl*Dw{I 7 ״X8 UZ~bo$ZlVbTR=Jps\!jLH.kVpO7Z"qMv?xVao=q~5hbF+iÖ0 )G2ZhC9p<h4k1bONE &]1]'hF@%2^JHbĖT}ˊp˯jB5LjY8Z>sUhtD"/ ;l ;'4 4J4V7,/LTF0h$j'2ğ8Hm4>4QT;23̋M4'.CQl"f)yП($Z:ZwWt FpN#1#d"]x2;Mh ҶLvbrw9;:SmuMFTPK MxGƥ &0com/google/gson/internal/bind/TypeAdapters.classYi`T$%G,*&(N N *q2LLdQZjmy ZUBjZnwyt^ȹ~ιԿ Vō4F*\BSK{)C Jd?,+_n᫅ޜ˦u""6QƤ+*&#V.j&Ǚ˺.kꏾQ.ѱ Ne{Ahp͚$/Nl]Ӽ$嗅P]P*"]`ᅆ+ĴGήx"n$#| ;Do/ ,azp 1JfIW94|,:ϫ9n7skr5܆_9.e5ᔋMp93K[5J8<Ų5ԕW'v8e:DΌ7,LpSC5#l˔ S9]MhW0N>pFzڃˆ:(!a`gr 8650hc'qEtL KP>5|䘎cǓ8?A @'mq~ƺ{5"O[,ض~0c2.݂lh)L./Ť)OU֡Cs ?wEObSߑw:/_c]hCL_܀hqK>؃;$͆X3;帻lvwH|g~ k}߆?Ȇ?#4 I g$ moYKr6_k6w.7l%mYG?߷w??[XT?wĿ4(?y׬eXjSv @̿_%p$r7b5Ƿ, ##ƪrO`-dr&C5 Ŀo᭠MY#WJ(GأܾL{JEѠcO1K{q bv`|wd [è@L*ii:=*gT^(F-'4ӫL'(qbN81pv_53C2}h; L`|p{b $cj 06Pt%)pLg!q9Rcz0@)eqy#RgG0^:**M|Xȭt TsFG:nݐB9%`E:IX1]Zb8Əqjq u-)` 2ئc;2\n`QX &7I:&4:VWWX):ֺOMaNtm/>3>y  :^4%ˊo%_5fj7{X_;=xEOjǫ鉶V;~^W?Vž57uO ?3s:/ 2n-/u/W:~o[wo,3pNǘ!0D$z8XGM).C$W 5LSvCA`K_@%M'Z Ay[&EӹԐ%0;:woj{rTKwڝI[^L'sg[&ν[ik5ݗԑX4#:TљMf2-L&ZL%Yhe_2ϟٱmpgչ=hN0ab9kEc)q. g\ J DtЪ*)9`*uU&%3y顢[ lg0S;i|Vz,eEo^^A> (7[7L:Kx~p*RR֊eqG8uF<(LP9~T:Esn/d;[r[{g(`̝ėv(&̟,+ԺP>1Ɏ~O4'ɛ,L 5lYd~ ~]*tRI"ejRbY":Yy0VAwGB:x2$wHm'+!xa(I&정J=LWo% X Pads$Hڱʤ7OQJ?;kO}e,U@66WژTU9)!&v:b(xrDQ\1h%2tu 2MsM!3n毹9GY2_US)!5u/Y 8DIMTI!L|M9̙N>⌠K5%]2<ٔZ3e"SK)K=3ȔKdGpăxH`J6IPMD<1VMF+G8Q`} ڦ&xE"`GpqIYMHڍ2/:` %&eБV#;NE %z;\WM$#j#*о"˺q(miE&z)箨sFc[tHNfܤ9A=[xSf eS)UNF𜕰1cr0۱l{Ic{͖W)6>6ipaGWؼ{8 m'ybX(@T0#TF=Hp]͋^槢=ܵ$\jn0F ;ΪC( x9ӱWQ0M4|s4|SBf*bZo$Hv ,8@)qzH7}Tzt^ŵE5Z_[ȃFPv݇pMIWF1'&jb\A0pE*:(#yw"悚1Y/~*Xv4Q@B"%2Χ+pf~wAWmb'8_kB{(m-:Q\.׸9jj>"諉W `20{{aTrGz" ._~g$b9G</BչPl #O@,:@="{Qs #X֖"Q,ɗF!޿.\He@\xv,WbH_ڟy + cdޕ\ [VMhSX| #XT##A#?(z_6+>+]͝0'E0 Q&xA.B3" EE7#بv\QpzӸu$6B8#儻x/ E8pwa^ 0n}#C<(gCx 1g8F9,NEoiqस S³2x^6gZ|N×$/K?^|UnV|]>o܃o|[wy|W>C^G&~* ͅissm-Rۃ_i1ZۏhCA}hw]^91i'DӞIqjψK{QqkωxץL 9Kc"̡l6iz}=~#=C}q|q1R|-젟wmbvObv]{Ԇ{aFQ5&6Α >G5v-6MZfԢy!KjOLd% ǔ2)*϶v'?,qhأ9{t'u!ijP] :fǠiRǹ^n<.ݶD9WuL`8M+ڙgVa#gcLuR| JbZ1Vv a|i:VWaph,fV)= 1Awډˆ}j巰jlp'(pA W[L{Jb\:^uG`TUyv;Tv5GRu!2~(„ \U3AW.{kS$jsx칠37ӄFsfK3YҊKe R\<#e9o|Y°87"\-=N{TaQW͌zܮZf_U<JV1Iށ,xz$e}r9U+s0Vuü96[+0wtb^ERj9Qq[+'fhQOvCIY9&P֕I1Oܮka"P3^Q@s8/lU(OQ{JI#.8JAQCstN͵MP`o kķ>h't܃!ba ~y>*c2</~)O+T>t>2<' E̽.[^qU^/~'Sq@1 xCqP?7uQ^pIkXCѢhS`"1U> &\>m\C'aip(Y-)ZL[I)mH4VY͕"p][ˊp!3ŋb``<"I{ru$aP)kjW7%b6bkQSZ*}uLNַ!Dp2m+ DJ. P$]78+b>9OA}2Z8ت 5SDpS/bΠʪfϦswxeV #YP΋ZxG"­p(>KۢHKxY$Yh,LFbф{SY@Uʻw$AC:ߙc6%iB%SdMjK4Tg7LƬ9X4UfpxMiS-i&}: e(t7q\"x=wI{JYГ4頤Sng)P} & *)ԴMx$ڔ nuSYtױIåˀ\ܵmAr7'N$`d|f-Ҽhx}+WLs<{tp\Ҟ#K9+oVPUv,'&֛ugXԕdv긑:e9aFl7*B;uP Ga%^qͬ(k!LL;R)KW~U3?~3IMU,P ʌ>@QKqenŹ੏Cyi24QgahgY:6p.d`wx8+f]\*q>vU3V31ZaSm*zY ,V/o VoD"_ SJ.~a 8X= GijډB/vgY]?͔VՔ8cleV%˚bV&۰[w>㸌$Z4h1sr&x-Td*Dh?+Do"3%6gq.aXZSKֵ579;IF(E#|#4L藏-`Ba1>탪GZ2| PWhka濪Fqh-/+ ?`*3oJhzYB;&߶K8#{EףXkypz}n $!Iqef$h`kk8ʞa\.TFVk9g'\y#PWq M!P) BIӼ3+g7s8 %iY $yJ8e4>vB: }w±N}\) q:u@ZN+chg>g S#|.1yY;O'B-]C-(jM)\7AKsr%uMl`,GA; vc@c(|ؿEPLN(jOse)zoeʕ2S%-Pd|F2K)H5yrLCtj2#E Av8s[ 0- 08jϣZV3+jjRI%.n]߁A[3ʙ S]cmQjkWZ'ٿr$1;P$(f1/n i܉f-z1&mK;J,Qo'Coݴ܃F[qA}QĈS@K t2r •F*L<5ĵXxUئ`d&4@w%#fr-UV`%X#sī=ͼ;eލ&˝ΈWiLiN:"\.Ұ8BWSZrer(]I5-zϾ5۠c3+;P;pfK߯>Qk̈́^*Po-D:ysapA7~ CGkaf6L֚SR&O&EãX뵫Uׁm^{{7cQOqyp{]Qގ}(]8Y.pk˱[Mz]Pa򍺶^?Љ1[ɦf2 8PJkdȦ1C<'֏Gc8 < %yzY3Li/0+^:k +>xޠV݈+c4s8fe]BsۉXt 6Wɇzuq-/A6 ^zrp(LO'+hߴe2]@mªw`0cQ) WZ;E>\ѴC4e^kh"Vy Lo*QoOon(q#F+qL9U_7:7[msgx^~Cʏ}{atzbn Ft=5J&Po]HZHwZ -hG]% ; Gvi< c4 _c'uN6\bߌR9r3uv_\a:OTک |11Ёvbrw/Q*&l(4ZMrͭpQIB̳&B78oMK|Rp#$NEt̑r oS?H-P$Ȩ(9;(X0u8%ڠȟ,~p dPfBmmfWԾ9a\5L֯HRb))ڈ}{;HލQi4U/KG.M+XF\EIn9puіiiGree)wnp"˚{74٦`VYm}?Pߡi)KQoMfTz_PK MxGcom/google/gson/stream/PK MxG|tp)com/google/gson/stream/JsonReader$1.classUwGFpv(+D%b\w`  o2lrOڇo}slO,Xzbp|{wW'>@^R ,O4|:>SBU7t)qKu;1а.avp!]h0D ^K2$˶+NSutI=K8 `1ċ+#z=I楲u̶i{k_Y"-EKK{/Uёu!>}wRan֥QdHaWDw$!Ԓܞ{d׼oM[m&)1x=mWd.8"pwc6m})_!G8 y#ܶYt ?N=jO޷LO dK7F8؊*Me2 5mUt~%JtFWd58t;t%4dWQ-KNl,nKuL|~*T82ÕIRU.]R,fGK5 hW}ێ{]=}G,+ilq嫵ea&fy7 KryKѠ֧!VF8,fH~ LJ0pV#̓[q";"Dq|-t|-JD.5u/ˤ⡭'thdžv99@,}bxn$tJxot(|j>->oJL$Y w䛘w1/a"/cWƫ(-TCx|BCB(t 3W,OD%ɿDE)G..Pg„PK MxGP$V(/P'com/google/gson/stream/JsonReader.class{`TU97=PfdBCGC$ HgHL{Æn,QA(.uuWQ׶,U?羗7oG}{O?'=Ŏ.H".&qQb r1sEv4.\;L.fq縠<<ߎ!;.pA,q`%?̵\v_tƹ\N㢞 \,|.Vpq" x18R~_xW*Ɓr:.w*сkց\ob?ovŨ.nqFfxt6.qw2~8Ύfp^69>p w<p} G(11rq>'O9i>3vĦj) #h4Pa"7L$` yC%-N&oԼ< x-K~5yԊKkB^qYXQ\]vFWYayT1G|l|iŸ1'B1VQvŻULP0Uv#tnky%y< [RgiKU\Z2҈;&LN/zSvTs ]eKQ֮ ˉ }X{'L//$2$)8w<ڭCr/!#t%Sáp({M8RHf"4,\CPj$ZMjrTG% eP j*WE$zC_P,-&;bur~PdZT.e*}dBRgm($yFaFWGccird!*VlUZPSE+C5Bu6:j٣2lhtQMxhd@}.Z6&=SԓCr1y;@NJ[ ɇpVכ]JlkAxQu$.tIdU2\&aH1-W.X$(NhK+x;&ٿ@yti8BUE?1+QsVo1sRu~֚ǨUֲyd8VCV#|!5r刄7,"֐,,Խ(^NUX}aD2p7ꄬB5L|$-Zcy!=!ېhF77E5PuqCM1k|AQdXIaYQ"\ O /^A؇*=Ыϯ0YLAb`|頁p#5p u@k[ ctea]eцj֬8;W*g_x79a<'F<}Oq4znx^xv/.Q% d~LVGHLՑ1c"4H?y `&vE8-^ Z,lYgLBfZ2,K䗵!u~>˃F:Qk/gbYb aږEŞH߄nF&lB:io= L$,O+|__x7xX\w5NqRQ0^*l z|@޼O&ěezp$M>3fR*RǏs?2'gw̬rda2@ь8d+* -ЃG?M,- W1m-߭$TWgJBB&R?Q,At1`bxVbD-`0{ ɒRox#/+ <؅v";k@!,#RZe|Ʋ iZڼUWԇ,5zaaΊE(Ʋ;v?y ;_19Ҳ\xip{c“ ִ5pm׊m>+&ĕ6jEQkռx US/;TKTu hMYFnnp;&Y$y.by`X"btSkPvlC 蒤W95yACUgN:tZRU/ 빓;xH6>|5(Y$e Xtʓ<$o)"/׏n*ȁ.luR:Rj`iڷX}ڛ-ۨ}}ﴴP{-iiڿ}}7ﱴv}ﷴ.K{7ÖjMϾ$O#Iy4>X}~@tueBvzs.Si>l)65M|觀\_ G*_@4lAe؃TxLn9pqÅf=H >LCLu>5R=Ƽ9!t9{nר18D/#7 L! E2 ,T^6>*I&_e@5;e TK y-' ù'- lwd]xπ57D{ Ɲ8Y 04Nt0h @m@P==ijR*e>Bfp/t gq}({[zw.Cӓ^{}PA0N8L脳'Ά8 q<5XJ)SROi&' |dIڷBO)Tj.bγDńv5N]Ch/LQ9X1fA|S>=MhW&no\n>%H/"/&/^F(^N*+a^cADoKFczW$m \Mgbٯo|p7ktߛ7n\ ōdUnqWDT" H&§$:&k2ovT>U0,ƽP8\G_hI,$j& 8G1Y%L'#|.Ҥ<:J( ƹcJ?%B}EOA̞AL&"FrCoc+<^yV-鹄A-HxI|zzx7zdB $D&u:`& Ylk8J2EBr%lMk5c6tpPحQߜ" Ds$!{37QΌ6;s|vqMKOa~nJ :<,zn1OE222I:'kIzIoCbtJϩ`s@dd[&]$V"J+_%7S<L`:,0߇0~u7?c?&< %< |OX8jx( A`‰ESkD*FE; qD'-:~|Ad;" ?߈ӱY6-<"(BP K"&rbJ׊b+63m"OQ v(OI(/RA;"\MPcb HC5,v12OF0S\>ʫ6"d2mJz4M0m86lFhwm]e}0.<ÛLAqw!>m|BWFX )Np[!-`rG.9a~B?.x%MDі B?T6;C` z_bBX Q / QC2%"0QDHdqz&·b,eBB\ k%]\ ;q%$&5%y#GF7QT%"st9z9:ķT1K isQ@w/ik嚾v6SM R!ns'pZw?Z CD)2727cUcT%צڕ\ 3)=9sn9 a594s& nyJzqg0sgDKGe {L o I/@Lt {< 0$I4g.no/6BWqC?m0Rl1b'%u JݰR ׋&X-~X/[.]-!F)Apxv8 <%38L!Cx?%8?WPW!^T=[%.9=\"Lj،11(>;ŧx8Jn3|J|ϋc䒾\ n}GR7iR8}5? $f%JOqi 8AkUQT v'׃RJ픊y-h<)/@ZU1CحSJMm؝0Ie1[)䳏9֩F[I;͋KO?hKp_Wכ8 \cSwA FDֈo0͵Fvu`DjkOsEƛ)MjRF^x5u +K `X7eܨJB#G˥>oJѼɍ{=4jW)]o'\Y3rroY]&#! d@:(] J& Vh% f(R\:cI@;/6k#5}[moRwu(J#@Mդa25]qj>&5wN+5o{|0;9{FM*30D^/%݌聞}0sгxc%g&(==C=ĞaĞĞĞĞQĞ0NP Y0_Ƀ8PɇUJ4*lxY)"3leM$k}2C}gn:8 {f^h-]_gTmIm)bcJ5#֘LeTf@{e&tRfAoe6d+s`2* _XTZǵ&\`8;.˶#A"OnK[X'Iŵ!w-]GW(l|X\`3bY}Z F 0R!dE"S̶0em]T` M%NURsLIAi'ޔH MliKRlLd$2[:?Ss[G0/56Ô>a> mq`I%~CҚE> ]]z51bUr#W֑0K)27pr čpr+k>71Ei~5ꟗ >"Ep+lEP]H'(PhMGI@? QAUU{a~Đ]>wVbҽP3=yFBȚgu[B4\aa:\y5+ ז+(13HQ w%d*_AOkb7oaaO(W~ fq# pY/-doWlQUhR5xPWSJE%+UUƵSfpd%utlo\e'HŎNRޅ>mq?@w _@8i;4ڊƍ͖f۬3ruFnmj#Yg6f۬6rFnmV:#Yg6 25<ހq+6etapZc!aDdRђ -h5%8$_< @hNwlx{pPϪ0:^WGG(R _cGu,4xND (=C.2@ q̛&X.:'PI(Ps  I YKUgJS3}v(훹R!|3IXj;ݲ:Ӱk 4::JAS:j9dU=鐭 Au RgB: F,usa:faJZ *a3J1l.KTwS햛jwvoʘFCX:c 0Pd 2 7tV:ɢak [chCаU14lak [eh*Cа514l |J$M+w)yة֑_J2xQ'իHWǥO/~Sbhf zN6ť%A[hFdFcؔސ2Dl/Dh!#^%IaU׌ \TEAU<|1*5Rz=8՛!U[z3䩷BX [b9W;`VKwzQ&#z| MpTPwSݍՇqG{LuNPc^p{ܦ4AX f5/3ںSLGq4,qnbfd͘k* rL <+*^uZ ^8/Wk4HQC,tV|@Ǻ4Q qq%*mKv#ӿY-8Yt]#zkBتo);Sdgwٙ`u&蕤sS:0,nSd^*yȥ>M K}NWJ. gP~EP\p~ԏOaz6pz<}O_-)ĉʭ2?B LKms;܎]Z,ksMnC Mgi+Uٗ?췇Yc|J\_'`NwQ'Raq" "[3PI7hh6>3‹D0@6nDd/$=!yz w! j|qw劤n?u_rA.)h1VlI@={3 g3d;{_ehr2'ᚇgT,c9A\!S@PKQZCj>XuΰV4?ܮui;$gP$]x$;e&`/'wy1=3,Uzեl-da-Pž͈SRMt&Og&:ifݥG䐈KRU HBǀK ^,Z> GBN"J0U+EZ),ѦyZ,bѦtبK<hs`68UZ|-"R[ jY?7EѭbV-Lb]kbP hWpJı8N˴kFot̑D 6H HZ #W~3͟ªkVwH; ^şt }s8n.%([?ڒ_T\R좵5`BvEq,14 ;7wk|7_<˵Q2e6^~CZɢ5;g[#+D@S0TFkw™e[lm;Lv@OOёNeAC'Mo ih`=1 |̫vjNeXf 22Sġ p#' ?!,=9_>PT^֚`v'UEh|/!|>3,' >l J[]zrVyϓ FŰ gh8!8HtU֯0Mn46R&P_ dn:sJ?u ?"(Ѽsxw@FHШ"6@*OA4t֞b9iSgX1eƮ6=g\ߝ@PՄ| \_;fЁSpXY/M oP;OR4Y٠.lS6޳zGY( [Go6FoԳ9b 'ѯf;l2ǐ 25bY5FXD6ypU^|9XD<}p1g&W3nf<$R# eg:&j4y=MZ&\% @R)٢E<1pMP-վOxY~ϵp\;;j'1O'ϱ ,i867ζ<[;\`56l3<WIW]ʕ`#>wp%5I8x42틁q&Y;n%80u#-?;|PE>F6j$6zі/'||:hdZR,h?K֫1B* IDmxm 6΀\[.چAէFbPs- j_-wP^mAK c S+'!ge~y* kvc4 dHB~2m.NM!tW5$>햮 {ఝ$fy7H1EFq?PK MxGSCjd&com/google/gson/stream/JsonScope.classN@# ~[ kjLT)$qe:1P|/W&.|xLNۯO'+ jgM/]"⑀G 8xO<4slED0B*N̏ށ#%p0,m?T࿀.9)3 wFh{a~la!zu4&^Z??@)=hBWJatK#ũRT)NKѧIqF}sRj0bLJ:ԡ[PR:ڥzR^vp.iK1:GDcD48@"J8Aگi5 C?` 9ǜ=wΙ%b_"WЉ5/+:.;ߐߔvlo۲\]ߓu@:~$ŏDOExS?[r?yWe YR_z;,Ã_R{1ߔxG*:\)I@#4]8hQS.]BxtHX]byOG{hᗫ*t1Fcu1Nx]T{1у]tQI~ 01.;kI$N!+tX}HGcO}p4I>n4l1sIר֒Q4#Z2۟LvY.V]`?T:̓:eg54Dē k 🐎)d9[c @= H0$g5ޜi,-}2jׄ֯KgAVUYѴ4L *I±@X "R% NW`̚s [:KxD!e9eCu$YlEJdEB]bXdΚ5#ӰFHgfd@ld3vl$Xi}ؙm}AY1g,5ډ mz0zYFR0wôaR,op"dbVc=.g~+dʼ\GxCr}E>/̘Tť2&԰ h,D%Lc .me!s:<*(r[pJao덨0}9+?f+& PJ|UJ`m$ZGL@fPu®8To_s=CЂe:,s4 :Cq%QnzP|98<ҁ{X^'`9<`N fq/gVwŇ@v= }N<߃8G 8Ʌri͌A/(Σ4r7alp<>~c?K9XjXjEXl,UQūF~#՝V~!a|̖ՠϡ셬(c'b|8\o$wW@|xA @ O"Jɂ@@"'^<5 ; M{.P9Rՠ' vXEfZT K50Z1wL It"Gy$Dx}0nLI@4P2N.--ˋ>lXKK#͠ e{3dZ8 )P.>#7<fh=8ӊϐS(ODycr{;LEy" eZ| /i8CghaYT;m_Xn+ *̙<Kte+ R|L% (㚺{o1ݝLAB72gHho2ߡE{]lwٕ+U>G zFRK]˪(&\,! O\E.AZ.@xgX,$ ~ ]r?n|" P k7-~oEv wvۙ ˎaA43Uè3Qz\8c fK'.D05 5hNH_n"U0gTFO*Yf)* n(eY Vӓ/o'{vZms'H*f2"Kzȇx"CZ$4js|=Fd`eU&Т<>ׇ'.@㔼'E, VU4X,_&y.<~ Vs>:3s5𚫛%OlmT]'QXAqnw9Z|%ZNShTf*ZtL҂f0ѬRYX5b6أ5֌Exncז9mlCj) t!Qg2ݚ | /_W)|^ T6POeyp1{êd;%ӭ_dOFUҫ(6J!wl=a{h+ "e[i8gEUO21sPN!Arت Uе5Pz.{Q;grNE1%ۼ}9t4rs~$2E*wYށ=CX;V-MjQ݉*Sm#9'$E9B*x lc|Rb|^HVvNeYg3 |UjLj4Ak3FmszvGfkZ"|-m/ڴ6iئN :ѣpPjvjvǴOl4?>l^\VK.:^{UXT@LGI/XXXY6L T/# #t 7l)$mfUwZ7U5ܪj&Al;b9Yb.UO5ê^dR4#4p|+r*:>jD5}Ƿ m4C'}|~1qIŤ /-i"f?W+PK MxGk3F3com/google/gson/stream/MalformedJsonException.classMO@߉C$ZWZ\@iloR$ٍK#aw3h߻{XbU`2X&L2Q"l$U:z@GѦLY[]9GGl0[o}7EY`gM(6$T,t p#ZёhRiHExH^#glsDi`O<D0ݭJ# "ՇWOu7}e}o]x=kb´xܧVm4E7[Clʩo]K&1FMz9Ǘ3Q 0(WxS-̂Ew6-U?z<^pu,AXs8TH/i0L O()CRcT0͎{Ὀ̴ϣ=.CţSI#.z"~ ̍i'w[GSw'#a'HcYeVL\ibU1̫; /0B֕y Ò:=:Uc0[4Yx4Ҹ}wDbXK s4)2%eW|L{mzu`Xj]~hxkV8 ܢv-HHTp4[(ξ?briwО 1O89F0?>Ho$X U԰I CCBv (<)sPa,(XUy ?PK 0N)}burp/faraday/Workspace.class_kPƟӤImι9L,N ʼLiki:;y`f$H<=IKxUXuPS5 F[DGɋP`{&?hJA]Tr:EɡO{;d£E/?P;9\ d#JAt.y˓t;z' 7,*M'KS dZ_A071sSЍ :1`)ʈjF%uʔlix0WDʱhdU49<2^KǗ82 \#7Vy:eo( {tJ~F{{hCCڣ/ I϶g;d=6 e1fL"˸BVP0afY\#qq R C'& yI% ~9GJEDQk()ؕF7sҮ7+8^c)GtJnLzK{$0.RΧLÿE|1sUTnqKsuokM6N& ᤨ\ǦI;}5G#\kP9g9HS$-0rwzGߊ}F[ۺ/PK 0N}[=X:burp/faraday/exceptions/ObjectAlreadyExistsException.classN@-J`^4&A}[V\RZ.J2N[0v?@6LTȡjB***ݸcn^0t,{XI8~#O 1ﮩ:c(@ &ր"+Cy=2OJzH%R4NvsONN<_E4v6]In.7[}"OT2laQ8PwG`-1TE0\5@.ޤ2iAA-Z(7mG0SM.%#>)en8h2&Os ~+b58aaO\oPK 0N}oS3burp/faraday/exceptions/ServerTooOldException.classN@g$t\CJʂ"Q}!.vEPJ]itivpmSrLh-fЏM流D9'ئ/ؙB|2+-;MT/Kci k_™\nL]>#x.' [s)Fh!Yũ ]-~~IE[PK 0N_7burp/faraday/exceptions/ObjectNotCreatedException.classPN@ }nBUّ؀ ԥj NrU!W]/> PP'g[ bta/B^{t<'c[hB?5Տv Ss9gg`V4Rݱ_~йY?v.&?KB|cki6<]'#aW%WW!:&HRv TˁU"%|NJPK 0Nse9burp/faraday/exceptions/InvalidCredentialsException.classPN@M;C" *MR$~mp8Gg;JDQyJYi?^cF8S{ B0+ M13+NZlM˿Š7$TgrM*5w+y]hW)!.KfM>&(N'hII`(Lu `ew㛝+PK 0N2bV4burp/faraday/exceptions/CookieExpiredException.classN@gc(rt (T (>`cQ!x(T4IOlb3V1!z{HV ՙWЋDaױ|}FJ>PK 0Na^5k;burp/faraday/exceptions/SecondFactorRequiredException.classPN@M!|T@5 PD*]> PQRp+vfg|{pQ>l$Sl=&wf̗0̭3}a(\8ؖQ}kh\]syf^[jjwuåyhl0 !&h3mΟ;~ #lbw~Ul'iII`,Lu쿂^!;q+ٗAXڍul PK 0Nburp/faraday/exceptions/http/PK 0N8burp/faraday/exceptions/http/UnauthorizedException.classPMK@}ӮMMyk{0 ŋ(7JVj6l78< ̼yfmlx'tt1=%15"#]6U6霙drH $Jk[\>>SӦ\sUxUG| mNujWލ?B9t?b8%E qpu;{OCx/غthH!P߸ Ɵ 7ZmzاVbS5lRjVEv fäP`aLA B#u{^`'Mf! Yp20*HXLXL4 HXĈy$O&3 E[^۪+]6QZf}[}o0~w}ws}ʇǣ<}GDOe?}IiHOR%}Co-/}[ߑUbO)HO~(ҏDH?5?ig^ ~_ѯeod^ ?zO2FJ_eo^Cf/=*?WOyjb y'uyOr=TT/7x Ӽ<37!~t ۛNvv&6W 5Rnnvtr ^c9O/Fv)4 ]Xm[CĦ~g1M)t /j^5t_><]Lʝjکd~aFM6hfjF:MTT1JƨF4n$@<ƍiPġ/̡bg-aMG?_J4FYK|݉I)1~sVeR*A`Ci+A|t|Үά91 d6?)M[Q3eaٛXhV";.9 )j*±TϚiIֶk[ #Mcӊ+M2u6G͘e8ٕ^#sےip2XN $^aEV5ЉO4lم:-L[&'ǪBW*+96Ld +aeα Sl2W7tr_2FG[YN%@ euJk:Lo6Ns<2@oOCy9x*yNkZ&:B;uq(&SfBM|!S /Zz].;E"],.="'fFt4u/xMtyS&#nTҶ2~xw2Pܰmke*RyQ'Xő23.v9\7(O+xW>g|աh`:z(ECd7+Ʀxb:na\VG \vw҆t&EwO`yD[TW ^>%W1)E!8:v-Z iu?:٤d:~tㄱؽ[АfpcNrdž_7ÙQA[q=F32#LGf8'U`2rc㞾=/2p۶(X&@2TL9.u@wL'yL7$[:L Жq4%,^[[k,f*n qZYAdlH߾6ЭM.bLja *o7FNY8yCp>)?݌a½4'%Qj:;he`Qs)nxPNPT$Q(ըR]I]ܞ,^339͗)ew/uvu@/+ ^ev^n<:b1(s̉zԅ9a_`@S4Rt ! rAՄ Y&tOY@ct-u":n^Z|/U7&IU_G/\҃qӋGM_[$Gm9ڎԞTX EsH646YLQE/*sM2zre*^Iq#TW@ @ !(Ce+@D īO. j4.P7 ^):z=v皝_biLʆ@:xSK w=""%5|#b#UM=q!^7EѬA߮L ќtZH=J/nVsP f'bp.SE@Hs;LDw!P++Kb^RT-tmn VK'hb4#9:K sHދstv!;iA$Ж%θ{ ^E/vQ.U+#DC^Z@(Ӣ >6Jn0Z~ToԠ\—Zz+V' 9Vt4!> B&R碨TXvԝ8ߝXNhEKz0Y#hLvʴHR.AࡪXGn9A+ >pm;Boϭ }z[jMC$NiU]th}`C`6.«|1/g.k!y,Gku}hbQI.G+oCʷ9Z,Qծw,(\^3DG=]t4v9t|=g)! %E^R>GKUKF܌# s3@`˅ +a#|W.~K>Qf901P8 KxlmxN\x(t)x"%d}B5"4ʃx4{ô8qiUUw{jcW(1noWS/VWc " !8#+p]}B|OSv4D_~~UT:Z'*R$+ɉl=_ ݷ !n4jT4QsԎF9:} Zjk=HEZ9CWyķ!%طL1}Gz:U"]αzǕ/F~i(! zЅ~z0yxMڹs ztgvqC5ywL`@> ;*4b#yVpq2 ϑ17:ܤ>PK 1Nu/<#burp/faraday/FaradayServerAPI.classT]OAWȷ bQ`5&4&> lw֙B51(Rm}s9ޙwx [x 25^U1ȭʁyUhQM^Wt h|4:D,u"9=ɓHR<땂_PK 1NXa!YK%burp/faraday/FaradayExtensionUI.class[ |T?Id a0@C¦,B` Ƀ Lf̄ťZZVE ZVZk[Vkk뾶͒I@_1w{ow>DDS}X' M>YS9UӤ9]3|^,e';[s|;WΓһ@zJ"ǗһL}|_)tZkSYr3o}/ߤ>kq7/uovw|&ذ5sW-^G&yO;uw ?$J}X8xˏ˿[)=gY/^|ئһOXywgҼ$Ҽ"v4yo2oG7oO/x{^~_x,>Uz#/'>!|^B_z+yx[/QEҰW)]i^<W*WzUb "iv4~iK*!jTY!=FH3OjtG+Mt5֧SJ'zUZi Z&~)^uXfSt]ΧT3Tf6#|4RSe\?y>ՠ :ثjW&=iEj:T-񓡖ru<\W+4@%/G cc TAiVM6k/TZ-hֈ;iNWayѩ>z]u84&#q]%tխd4F"f>8X=iY,ܘ`ִ6>6!YSPp{vX$iڐcC4n3\8}Ͷh}~-9Kx"N$L 0kBV ) 3 jRKW\XD{;ܧ6] EB 3`8*ضٴ;U8mƄiԒB#(),1m/q&jg LE#f"~:f8^ې >K 7IkήhČ$30̂Gf55*u`LC3%f΍nD 417ԁ]7:'B, EBYL'TVٍ"P3y1T-ݝ0FMQX`,$Π'snQ 7YX!hwW5"hijR1.RȀ&ߓg836̲"^[ˬ0֭nm.2aːH%Z ˻Ñxj0{;dSP1ԢbQ3L.-:aa1&&BV!jѶu.G1y01gjfv%xmcd}0j1 `mjZ<;{ѱV3ތ&u(g=[52)S!VoZ]gѼlg|vi4(A/eRb5DFlo#D9a3>ʆ4ER "G80 AR[yw":7[H'y6۾\t-d:릮Vf' V<8qZ0+Az4Eh$v@fAa,JLe!7邅@ *}&;;逊>(-,td/fgjuA(4oP]Sn*Zݱ6s~H\hhl`68GCy{ЧAgЗqA'G5$CHlSP".6k}+2}:M3 u~5y]](#bu.$_sQsGq̨mKԥBI"@"pġ uPWL؀]6-iG0}v4_􎡮zC]#peNYoZ\8#]ҠлNXe |A4qDrO@sD< v5h{(_]_̑"]P7 su=L!} YtnSV\ jE@1+Y5ND;T7s7(Pw_nuU[ u2r8Q6&,_X "_כNgQ $dx+^XĮ!m3vP;.+yi*AxP4@(0;,&SXz+񪇱,iezG@3wfmL1cp:!~~1g5r xȯeҥf@VX5ZgU]Yah"k SzPOp^?{*A8O  n$Ƌ-M(Q=)Y6t`BC0x L"!ˬEi %I*}zG,@0`^%cdh4 #UfP# w"h|`q е,>X ppYPl}-wzI=#NYvm(J⫻ã>d}~u3%MOlⅆzNA]26velǟ nWLuXi@}>#C},|"j(>W_|8@jp4I\xT@W5$ӳh$ !K |-+ H5kyxi0}i.`Mp 3%_  n"=Db[Ih _)v&?\l4D 3iQYC"amF| .㠮y @Zf@x!-mZ6`ćCz"߫X+1!PCxV0ȇ(moy0ZFkھZQ/X(~wHapZ8 i_嫡UJ=8Rn m'r[Or꣬ [iu=fK*m^ck o/M]iY=89@ ]fxƘٞl{baZG>ιcQԗgx5f}=zff=VmB U!9S'*ĖF+j qG"Y n=e:{^&>vzáȺ+*Md.JI3fkH~[2KCnϡzuA* 6}YmI*r-p@{5f T-HRXl}`>XޒOj|\d_,6cNY7b_*>K5#C`˙Lݗ^Ck"eZ?eiÒR++݃ycR wNdg4=%MXI$0IQ^Hi-CL5(sR.Ks!zӊSǝR6( r孨:]]]Qj%r/ Ea y_tAx9Kȸ+E # 0ռH=-侷پ^KsTnjȱu^01KR3x< S кFeٕ|pXL(.E 4;E>d>ZMF I65=ˬ&wwZ.#z7:R2?3BSJt(H>BgJ/0#ݤ>ayq uɳ]o@P8!fzNSH`u(>?'>Z` H٧Zj2m`Wig<[Ὁ= aaT?q :i黦y %onK?.gϡui|6__6MV:ߣ$(sˢ}U0Y(TYsi4MI_8ts֝~~9c ϊzIc]{Y~0n;YAWd?it(Rᰕd@~"j5*Wt!JX/L*}Zv Ӽ7xӑ߻u,9b\?I;u-v9?IpbQ`9H.NZzܡAtJI :ok|xӈ*پ5h̪WG[LC1xG Np1|v檗 ^aLcxGIs$/6x5ѵzC༔"jf":y -L|*7N$Ϥ;up066d8B޳ZCCΡNmfIӘ$X2)][Vhz"P1)~I翝]>}`=?>x ƿo;)_=]r UVm%OeVʫJW"mT|pEFƌ<Ѐ5 c5huEl5P=uy[^ ;zZW扝sBնL෡=',0z#/N*Ge1? zmک.rs1z!NzG/S^8 wFF&D ' g9яx/#S@:t>6:Wc|> B.bFe|]*~~/ѵ:]o6C7<ԡtn8W?i#8,U~4Z`.$Y̅)wthA;N&˽^3<;r.˷%r1`8eB "c~U6zPO`I Oiz^+,LH?G~fG$9}/F濵͂>!<f1aiq.6([fqL:ieIxY,O}\ _KhR?VÐjW7PC$=%+$z7@42e0I= (Vٌf9\yGҧD*mʓwD@"ių"#y՘8w II+=bx?W%TǑi GmFmY|%iKȩȪ(&CC D39(nݦF_|!3$!;C6UPjUWP۽}m52* ulHK-ܿFHPHG.iC9:Dlpel6. ζ6,OŸZGRzJ;; e&?D2P) 1n4ĵ< B 0\FMP2I+!#9@G>d򾴎)cC@\E7 ok6D҃<- \ʱCHG*r1؇a ~)K#)k*թk!:;^Pk ;9g$W}=46:L4ѥ)~b])jrY\΢"ȷ ΂||i4/rGcOy}0MFȻfq3d`F-H9ȁa'DǮ&'yJmBqb*Eǎx^PY ,xxVRhj> 99 q; 3YfUB8='EV혎BA#*Kdk]սEv(ĵ@Ը;'hv1 Yl@tD x:E|\Tp{ZZ[k;!)eW'"V`Ijw0_"/U|.sH\dM ZzXi Hw-T0AAAWgs(·\@SBxEHKeŗbu͎{ ;' jʽ\(vQ"]升T/_n7ׁ H7 OZiZpGC9䎔g׆Wڦ6ʃP{vx4|W&#Ma8$FyuS2-SYKVl%A)q SGTI?P\*6SZoA &r[ݎ*!eRy `BErvHn'.H#3=Ba~ C0GQ8EjG[@;Bg89ei_B\Pϳe"AUZy1'CwlV "?Kx:^K]{-Yʽl[= +vDF%|wJ>gǯa.t1 d#wON̗!~+N47rsZgu!y5 ً8!7(p(`A*U&e@IZXP 7izW=LԳ vX?"Î~)y?sh={ CPM3'_bSxgAU6ڕ-(&Lw(FZBLi@;*تg;YL+KŪB9w(/)t6yR֏MV!&t~تAi݉GN`ƿenYW I 5 UDT1 VTL j/GPfQ9`h7m'ڱ.cy9fQ> v*$I_.+$:V ~-*lʩPIF@qBE1ĕ@OXLcėiTT{GZ՟X䓉D>8[Ulr d3ʜ~뤩zZL=5͘kSgxjvsL3Jvڀg@0#4_Bx o߽*{RGQľ2:_S5:枋bӐ3\ɟD󁴞V~;'UiȞ,XYMφjsab^äoNl%SyNd*YV?1dgEwf4o/v)- k93-/AKz#[f٨$VЋT@%>OoHR6z)"z# MKQGQ \4,]TiN/?LlWnOCX",r8 \ *_k٨9gn &pbH/v.qJyn ݳ<7R/h-q7(8|ص :oNM9l&:09ނ?IrJm˸G| "l<0_Amo|o?$1 ~ԗOw0QQ*}ڡ=j>e5 /՛y0!ZlPɓTͬ`*u:?ok0J'v}yt 5'0L$7q=X6L\Q.6l\Aažvΰ[V.`2TNT N.t/Dhѕ*ec> U`H%4,'0 i,Se\T٢n@NxLVU`_Q aiBX;1Y qsL4r LUeM\ naFU PK 0Nburp/faraday/models/PK 0Ni3 +burp/faraday/models/ExtensionSettings.classSWǿY`*ؤm(h5j bbE m%"EL'5A_`g8CۙMˊkt==7V|*tZ 1u%,My)ys^pZ$wUҥҌ,Ҙ^YI<лZNӛD6xVg+i_פv<)6Iu Z2'KW6ֳLjXȧ39ݫg# ̒ϥZʔ\nk=ġd>Me6dZm$gw-TUolT;]˙^IV6RMfglP Re4z*eH0G!jj\@69Y(',mY[6sEGsv돞b6PNcIM.H{UYK{LvŷmCRՃR1ڊoZ^rKEk[ eWmJeZܫ:YϘսfC2AUSёzhJO9;G_s)5Y_NM(fN9rJSNݻ!YK*KU;gG4KƓ)55ZJY^RD8@u<Џj!*Rl]w49OޝɹbQ7 ([*,;xdɬa]DQb]>:M %P#PvKa=ߩFT(ɪ/wf^UzK%ԎWgWkH;jj]}tYh6\e.xItԐM{Hh~l:Hzئt4N>&2\/'4'OIE o-@SPpQ3=ZG5?&zD1]a=`88 f(RMd/oK~K ֣Z!S6dĂ`TO}%E;I tX}E~g1ljuX'awN8XY'/b :xXuֻXևS άI1>9u3̘͚!1L+vŕ7ȫ6䰅&hΪgRƒZJ7e:>MT\`oC7fe *!79y`梍Jj< Nt`sƠ{ ֪CP2k!6e-Mf8 iyjMׅg[+7>@[.gvJ@j$'+@eJ-<],1_PK 0Nb /burp/faraday/models/responses/SessionInfo.class_sDW,ɎHSI0- @ CЦ& qHebdHrg ep@Ű+rxjn'x K밖YCFSwII|Fb]4`MMҟRQ~C]_ _ j-ǺfVGkxaun-5&[,=ö\*:1qmKӇZ9n߳e*X7L4I SMD]$y0.Oq1@a9- (w0p&s&nHϡS10i;=m_wDbBF5.[mppQYjy)ymRc9L`y(nd]g!-T q݋6}R.%/eeAM[  }bo1n m'L"PE s$r$I,xQ<\`6Ntomʑ?D/T5<"ͬ^#\%G] Mdܫ[dŭThaܫ^m_/)6`XFE{=fX]lع-aj+? 6cF@1pQߛ. 8NtD}=Ph}= KWP <ϕQQ1c-5p5/pBJ*H #gJYiriZ2s?ڀXE +@)"G2f# O@V"'cE]IE-Lҷ7oQwd<} .hQ+~_"Dwmx^ -7R33),BFH"r >$g A>q%.U> AqAqU.ȇ|dd 2| w K|)g6G, ס .26"A#@7`đA, {x&EWCy !?^eTCx-38T#dHFӁC!She!LO03Ƅ!j O^wPK 0N7ZA1-7burp/faraday/models/responses/CreatedObjectEntity.classmkAkشĶwjA@hHWɭ]B/4?JIHٙoO`XB5;Y6F5;U2eQϢk1_Fn(+s3BJ v}o`ڞg;´54mv/# c;`HQ'ҕ!zAkzVѠ'W1^;]Nb'ZNAC-I8`H"0ࡰNz9sj-QEزiN=\uB_6j>gtk)]7:^őT  ZKp0ϫ>:Vm\r6nqF2yń&1nʸP{ֺo?@D2D$~G E·"-џHMc:DcHz{!uݸ=9gMK ?&o 7:z'3k~59xC,]VdA>;<.wmina9y.2,e^dT30dȺ4CQ*JzÐ:4ZlIKîpsH=nv8(>Jhu}gd!AwDD6NlbWo3kG82>%Nc(̼{m amwzP E<4AACi׾4JdK_4<Î2 jT~+ P}==g؊F*"J->kn(4KD.T搡#H]L{yl<!EKiaySg|Q46ϑh4ϑ@ /E9PAVñRE%*R?Jķ1x:H.r|;WIpx?P%Za!ߓax ~ V%Z!P%f d:J d˹0J@~Zk X PK 0NV-,(burp/faraday/models/FaradayEdition.classT[SPI4D.)-E \,p>%`b/8: _}U:::>;>{N#å3Μva #UС6\52a7TTL&LhW1i3ܽ ?7B7f\7% u)'gkajݮEwA;@S3dZf,X Fz6擙JvC]JKetV??y i۵UZ1=QC7Ŝ鬚%zȲ+8m׮L0iJ[+ly׬TK76Jjmx=ՍRPP3a8Nj7:siGr1ALZY6 ,:N+ڡczs:0#::qZ H3$Į8uJ`/Iw%C9.{S,1SoH9y 0G7/$/;HCX"Hu=G H,C5»(& (\ LWk& 6F[D3 (v]wВY yvd5FȫxPK 0N]V0burp/faraday/models/FaradayConnectorStatus.classSkOP~zt:vsnt:ܖ`1!𡌄9`u5&Wle)d,}=__  X c] 61j4DKs7n)H|%#ˠB\6 UȰVjs4ZcZh{}˻NAIU˦YT980GeyWzgZ ǫn0RKg{Wyå7rPr°* n;5xx]bv5;-|Uvh~QvCsQ*S¡4ar~$zqTIf{~wwn:Zб #7:`Y,b:愉 @a HN<8$y{ .trw}Ustgo. CLYR%b˄bi} hSi'`E(xŤDn ЭdAqs"+*l"L3kD/.㩐 <';rNUPD2=ɀLE2-'-K}LXHV=Ǵuv4+lt:^ `7PK w1N"burp/faraday/models/vulnerability/PK w1NӞ 5burp/faraday/models/vulnerability/Vulnerability.class|\E5ww?򣗦\zRkK*IiK6mCi}$ܥi- R%)  Jufwe3O#37;{t#- * ߡ!H|ML?$ HďIm s`4p:uvFk^\?6M:rثep˔jBULv(8nޜ{|iX( =; ҈hr퍽Pz0f1@aå60hii`᧢ ]a01ng V.7 F4u^ܩN z쌛*fvv2:p\;?q'!X,'Pմ)VumNP-L+\tZ38V@vwV(1[Ki>inMcx"Ϋ(wM21K]jHƦlJjv3ˆ:rc01c\ 4u Kܺë[9 :U"aoW' . ˀj ~2$8GȶԯC}ªsuM-ڬ,ZWSix&JX W12U1w Y1w0$f~CףL:ًl)UvԭZ-"^{ĭWɼ+#"iTz >V8/:[:unJоI-<;3 9YV2X-J*#b>mu4fYD

9Az`=l[ɢf̒1Fܠ{bƠNkHbN;H 좞E=ԳI'M" d`):ʢқ2pwe~AX͉ -1 S9Q~[BF(G 9=-PXJ8FAn]@-D>db6' ٦A}s&UMqI u&[v EV[k"nVDh*8-&>3"dX(FŠ :ߺ1 {A̦*e9RU5ikM˭0^Ԋ|*?ŒbZ{ :0^?f*M2a?m+pM`7؈Xu ]vp+mƉ- 8UynSvvq+; poṋ3x;NXʠ3HDVmjTۯZGUGCx=?. ^DYͨ;'Od<0dQjM '&Z5_'FBN<(+<jPA! (a*́'C3K` g jC@ 0 t [ &fB99w*h= G ^F+LVjeJ΂\ăT NsȻXb  AF^6r fx r !d}> F0RiU˂?d4 E6=IzDYG3I9> Ҩ\‚|iA.E|@:l:,ȕ|:s#f#AbA>G$\>lU ײ A:us61F8R܈>7lW W :-,5LA A& x¨r-|_hYOg mr}? ul/:^d*ϲG3U4Su!]hn`#2My<i:ȣ"6":, Oϓ> *"7 uXx:H<˂|<> d edҫ@‚A^aAnAf q~r 2[1 vdb!hT8 ,$̂Ajd9ȂLA& _A& 2d:ɀ$ti,>e HB }@*m|b@ sYp72W9A/gHh ~'I')0/>_*xD`$a.6#xXjC~/%VJ=e(_a+|ڀ'T>?PK 0N5 ,burp/faraday/models/vulnerability/Host.classodǿNbLKvk7mؚB׭2ryJN*{^D:?BV8΄PNdg^'q&{,?3IPƑe|!orǗq<1Z2ϵZm$YNtGӰ3.JCwjI,:.Z?zCP mޤӅ"m[ ]ؾaꇝnh V]k>l}c̠xZnl(D)4MjFhw+ ?K+O5j! 쮐nB13plrI 9"˃#I9Wpx,s fD#bfmy9$]w OWLxG9y(X%EӬ]ǬkwfC?J^W'ԛRw7+qTl)Qхvr.%[RrXI*\߮t\IZ-ݤV |F-liKimk4%BRccS)Ar/id$ i}dbV} ADXJjo Zg(0RC~Y,/ yHr5E!܅H+?O@nQ*P Ai:3fA`]d'/jq cM](e2I!C)K{)awޤӜVrt7gɍ0K>U CAp3 $Y! 9N|+# P; ! s~GnACAA lACA V( R!YA>bA@BA9  p^G~?=_H>y+oD"@*3 MZf{3A&<3\ d?ާܗ$/^qOo PK w1N9 e /burp/faraday/models/vulnerability/Service.classoSUƟMviRM[!!D*P JmЅw78':c3~!9swI 7{s9gz6~H2ұ(جZ#^7*}^$YZҎZӁ0\CA_׊[5ŇZJyw 60$7ONm8c=/a-y'5/}'x)%o8 j.Ztإ)V$&h+id\5zw޷iq:Ocq6yL(taնMT |6cS=#bV,8{1e8LP.H&ŬCϻ2juο`GW@Uk=Jƍzݴ7dc e/|瀤[}5h$xd>OJQGGG>í+u[apͅ+PxbiW8 F 2=M z2&E V9$чcC!) Z(Z{ Zθ0"/spXmB/ ǚH@0ATj@@tB]!$UFHq$ 4ąL'EtJpT99 =^FAnJAA(ʹ$|O$ _# RiqQΧ]@| f% zTy)(GA). v/^0xIOva]r}C\z%ʋD\roHl)nőNġZ9hc ^jσ5II9< 鈎V=S"laƬ]! kSfX'6Qch ɰpZá\^^*շ[FI_hbZ g*{t*dM2V)"T6[z&СJUk*(LT鷁53S)LIEcuzgK5 _r9}ȁN2 }&]izS z 9[Qs?QV].A4G(U>< 7!PK 0NdP3'burp/faraday/models/requests/User.classR]oA=. -PT>JIM탍>5imėFfpwD?xgvUƐ{=g=x+  rؒƝ,tT ܕ u ifH!R甿Gw!1aR3h1~0 BaWG3q瘻C>vIU"@73tSWRVXH)+J*MP}3V_"jc5łyZ,CrmfS1hTx.mkjWpBh!`s$KJ F)4F3r`/r`SMUPK 1NP0#burp/faraday/FaradayConnector.class[ |џYKZyD!& Ӑ#$^"dV8 z}mJJz7'ƅ@O wS +YWN%}̼7 xhrFROJ/ks)+\!"DLe]3T.ר+GeUu= ysxhZ_Ƨ ^"q 2ZeTxQHRRyF*QWkשܨQԢ^׈s˨7IqSlj AA|/4mB4Lǃ.;TԨ n{4P}{M5%*oרK *TRe _!;Zz$Fw x5z4zcbJwk4q9!G45_%,'[ {4 GU[F>*~uBU~o7-*qŰ~c_e%̾di1魉i5ōTL1Uv_iq[_r8:һW{ȸ҈=fZX2HɴTvLjƒѭV,a_llA倣@isVmHIe^+rƍ`ۆA ki+ޚfc/mY&fMZS#F4'˛:;/lm}SǦ-]VN0hS2;f cP_U#0lX:/2vMXK x]m[,avwV&%6ÊogRŠiJbPHK :ՑJW DT|E]b~V:/RuW͔c ۔4SIڊI{:2q3;Q7mvcDNfv63Glǽ!ӀG 874+}#.Lo +2.v2N2ãQ¢R{m3!d5"@02 ̰㔝iY1zx  $Ӊ:=GcL O {TGL+Op,-fS0c Vi:gm~ Q e @0͊w#Xp].} nO:ަQINO  wpޑڜi͎j܁FU)bZ5m3et߾6OkJ$j3(hp|p#^hi_112i\旁 ۴D5)4LteJ(㜈-<ޛy{+   P4cqlψTQD3R%۰pnjM* SP+BJ2 )*Vva(#949#,YXHhKy~XěK T=Дrɠ6G91dS;NmqsZLDeΠj/ /(F1Eo,&N $fohrQʫOyK83 t5U(I fb}`nIq鷓"2/S;;`Z3JFq;'w]{䨸C6(kZϻ&~xQHӅx*:mvuʅTc+l Dj1q8?/ VpބN!;=CFBI ޗZW'R?RyOH-fs^$^r s S8{ -ꌈxQCތI'늬M~#h8Lz}7Z7EzTu }+#+ls1BkN8 [K.;)'"8tm5.HH3Ɋ^dzeU9J{_*7L4 2{MVGD90es4?ys[Eu~cG-Say~aX:U{8)qp1d^z@UBRݣӟ/2[?ueB:^@7)=؃m\+8 O~<@Іj)\\.;UPz%+tvhwTynt 3uR21=-t=iC+$V]|n&n{%#}1Fy )xϭ;B\RW/E[ ๞|Ji-9TE9ރY "- {nw#/#!*#A*##}f`|*&r#4sB"Z:Fh#T: O  JtԻΤ6ZFt6u@.jV&U;JeUHbR#Dk~| hgI9Js1t+4N3=H"PAZ a&UC:vR-] /Q%U%JJUЇRG>ϭy/"&87kƹq $Z }*2bٱϠ^ge.QiJKXROx?\/e7YV1F+*_"m,:\E.ljkzg'+xI%E;{V3$}b泏asBuwҜL{YG2#:+uPmXzw̺&|Of6( .xD?S[*}&z3 ap-a0p#{}%»ÿ %ڣK|.@F6}Hv ,ñ.+]5/RP :(6#0 /3_UEj1dǑmo@Ӑof@g9LYҗz׈t+cVxO>EDMTs洨 "vҳNI¡{ @8OжGqD!xo#li": *"πA,hկ,zh?O#u#eB=z"{W%z@ (P#q).,D"~qAM. :E@V)!ȥB!!x&&:R3F^ /\B.%&*  JJ4.j0 O,B(欒+<LetjY%r Q5WEaU.,Sr.^7QOK'Qo!E2#_+b!H^He|&U"90*WPWh7,χL&5B4:F&k<$YмAV-ߢoD7ˊ NΟ˼](V|Ds d%d&~&şR=<,T' u?&>ѕc;C>7NZ?Hs:\$}* d=F ꉫ0j(qC}P(:3!9n(B5LJkQwRo˹Fy;v>~) x.eȏL1H `E\5~B?H((ghz0Td/_bIeETˈzLϨ,:Td4erx[ڈa9s}.5r.N9N8],0n $&1؍sMRLkMĤ73{HZ-O;}7| /X/Oia,r5_Tׂx _ 5 _ ;A¯insj=5A&~KA9~/W?P?T|__V?QBT=Lß_jZ  {xE?J __Z^ (k# NW~Яp5DBP.3D Bf(VzPj6J UlRy̯F,ƳP=irSU$$tLA5y&+4Y͚"voO[wcOm[6\ &,F=jF_"p[6 D#*LXyuSuJ>ܨ.[7kҠI#+cNfZO* ZJg1D6~5ݦ`7XF~9R|z5ְcoJ-6+Jh#&@ᑵk4ieH.Y,Mzev}VleH%7OEAG Â׵)ב=;~ZFMel֥E6eI3V\Ǔ8F04wdIבs^pMa]V]lS\iӶ!sSch8e;aVbM8``ХΕ*fIm'HQY6eIG9vN*N%|p&mã XX¹]97ii ȝc&ۀK.Kv(ar=iCkwmlVkjd t٭{r73>6ܟGӀNb -p-{t+ObL\;L"[.¦1yսnW^5Q~-tG*2cxzf['gjrHf][t9*1y\Nל xب_} 2eA5:vv=lwy+ ]2%)]&,8u#u2)9[u9#o~]..V˻=<>nϬBwq]>(Q2w:XHO)J=Rݗ)Mgno"6+Ȣ'nڒ6l=BӞ,4L OPdyVEva# ؞3!{:.RD"Ũ<=,h+%5PmXu~LilOkƶ˂$f ة!= \3ʪ{M:2Oj4>5W a4\,NϦtGJƽUޟt1*9ZkTW J`Tk*twG['j.RIR%s7,_n^a~!kݞXa[pܧ_̬e9E]:/z|gu\O㓺 }]õ9QoỲq]S|VqO#[qopPΩM+,Cc%T56]&@\ƌ-elAix ;SQ.\]]薕8B JZ[+[p@vAٍ}r}ҏ)'1 *ڙZ!Lɫ.NgwڂMh ): Ru!GxUCdQ јuP@J&?c؜/Z*VZ ,_x/GjrJΝy-L-]/-v_Ey0MƱ}SłƦuՂ1JW==L F5_F -l >=~rRT\TF\F!W|~"U[S~C*~ O+O4|bF87Q̓8qJlɶl5M^ _e>_ iQN"<6[s5ELl,VzTוS/,)fW]]Mݭzjv=x^bZ;7]qburp/IBurpCollaboratorClientContext.classPK \J=G'burp/IBurpCollaboratorInteraction.classPK \Jtͅburp/IBurpExtender.classPK \JMETA-INF/maven/io.github.openfeign/feign-gson/pom.propertiesPK F~[M!/5>META-INF/maven/io.github.openfeign/feign-gson/pom.xmlPK N[MAAfeign/PK N[M A Bfeign/gson/PK N[M]t,KBfeign/gson/DoubleToIntMapTypeAdapter$1.classPK N[MF ifeign/CollectionFormat.classPK ,[M[9 q!xnfeign/Contract$BaseContract.classPK ,[M ք {feign/Contract$Default.classPK ,[M1hN"feign/Contract.classPK ,[M{ Jfeign/DefaultMethodHandler.classPK ,[M,%J&Gfeign/ExceptionPropagationPolicy.classPK ,[MC ,feign/Feign$Builder.classPK ,[M4(feign/Feign$ResponseMappingDecoder.classPK ,[MS/'+feign/Feign.classPK ,[M]| Zfeign/FeignException.classPK ,[M%|feign/HeaderMap.classPK ,[M'f*feign/Headers.classPK ,[M4ӦL,`feign/InvocationHandlerFactory$Default.classPK ,[Mu+3S2feign/InvocationHandlerFactory$MethodHandler.classPK ,[MxS`#$feign/InvocationHandlerFactory.classPK ,[Myfeign/Logger$ErrorLogger.classPK ,[M{0Ifeign/Logger$JavaLogger$1.classPK ,[MD- }feign/Logger$JavaLogger.classPK ,[M앚g;feign/Logger$Level.classPK ,[MbJ<feign/Logger$NoOpLogger.classPK ,[M a lfeign/Logger.classPK ,[Msfeign/MethodMetadata.classPK ,[MAdWfeign/Param$Expander.classPK ,[MDߛRR"2feign/Param$ToStringExpander.classPK ,[M漣8feign/Param.classPK ,[Mc1zfeign/QueryMap.classPK ,[Mq#feign/QueryMapEncoder$Default.classPK ,[MZHqXfeign/QueryMapEncoder.classPK ,[MVRfeign/ReflectiveFeign$1.classPK ,[MDdb_ 8feign/ReflectiveFeign$BuildEncodedTemplateFromArgs.classPK ,[Mz/J <feign/ReflectiveFeign$BuildFormEncodedTemplateFromArgs.classPK ,[M33e X8Cfeign/ReflectiveFeign$BuildTemplateByResolvingArgs.classPK ,[M|-y 2-feign/ReflectiveFeign$FeignInvocationHandler.classPK ,[MO=/:feign/ReflectiveFeign$ParseHandlersByName.classPK ,[MdB<.feign/ReflectiveFeign.classPK +[MPZ feign/Request$Body.classPK +[M(dPfeign/Request$HttpMethod.classPK +[Mr}feign/Request$Options.classPK +[Mc_# feign/Request.classPK ,[MQ4feign/RequestInterceptor.classPK ,[M6ԨQC|feign/RequestLine.classPK ,[M#feign/RequestTemplate$Factory.classPK ,[MTDl7Ofeign/RequestTemplate.classPK ,[M(~_4feign/Response$1.classPK ,[Mq~-")5feign/Response$Body.classPK ,[MZHs 6feign/Response$Builder.classPK ,[MhOc "g;feign/Response$ByteArrayBody.classPK ,[M-;tp$?feign/Response$InputStreamBody.classPK ,[MĚCfeign/Response.classPK ,[M. Lfeign/ResponseMapper.classPK ,[MVV UMfeign/RetryableException.classPK ,[M\Pfeign/Retryer$1.classPK ,[MT(Rfeign/Retryer$Default.classPK ,[MPCJ}Wfeign/Retryer.classPK ,[M\U&Xfeign/SynchronousMethodHandler$1.classPK ,[Mɯ  ,Yfeign/SynchronousMethodHandler$Factory.classPK ,[M_Oˇ"$^feign/SynchronousMethodHandler.classPK ,[M3؏ nfeign/Target$EmptyTarget.classPK ,[M "Ttfeign/Target$HardCodedTarget.classPK ,[M]`yfeign/Target.classPK ,[Mq&zfeign/Types$GenericArrayTypeImpl.classPK ,[MAL '}feign/Types$ParameterizedTypeImpl.classPK ,[Mya[9*"feign/Types$WildcardTypeImpl.classPK ,[MZUAَK!nfeign/Types.classPK +[M7v+feign/Util$1.classPK +[M'feign/Util.classPK ,[M Afeign/auth/PK ,[M: Gfeign/auth/Base64.classPK ,[Mg>*s,%feign/auth/BasicAuthRequestInterceptor.classPK ,[M Afeign/codec/PK ,[M]m 2!ŵfeign/codec/DecodeException.classPK ,[M͌h!feign/codec/Decoder$Default.classPK ,[Mw݅tfeign/codec/Decoder.classPK ,[Mu!2!feign/codec/EncodeException.classPK +[MN@O!feign/codec/Encoder$Default.classPK +[MélInfeign/codec/Encoder.classPK ,[MʻQT &feign/codec/ErrorDecoder$Default.classPK ,[M80feign/codec/ErrorDecoder$RetryAfterDecoder.classPK ,[Mb] feign/codec/ErrorDecoder.classPK ,[MEn%feign/codec/StringDecoder.classPK ,[MAfeign/optionals/PK ,[M3+Tv%*feign/optionals/OptionalDecoder.classPK ,[MAfeign/querymap/PK ,[ME<feign/querymap/BeanQueryMapEncoder$ObjectParamMetadata.classPK ,[M/k: (hfeign/querymap/BeanQueryMapEncoder.classPK ,[M%ihh=feign/querymap/FieldQueryMapEncoder$ObjectParamMetadata.classPK ,[M}, )tfeign/querymap/FieldQueryMapEncoder.classPK ,[M A:feign/stream/PK ,[M$w:gfeign/stream/StreamDecoder$IteratorParameterizedType.classPK ,[My? feign/stream/StreamDecoder.classPK ,[MAfeign/template/PK ,[M ]!Afeign/template/BodyTemplate.classPK ,[Me feign/template/Expression.classPK ,[MMd3feign/template/Expressions$ReservedExpression.classPK ,[Mi 1feign/template/Expressions$SimpleExpression.classPK ,[Mm+ feign/template/Expressions.classPK ,[ML{r#,feign/template/HeaderTemplate.classPK ,[M{2 feign/template/Literal.classPK ,[M)" feign/template/QueryTemplate.classPK ,[MgfU+,feign/template/Template$ChunkTokenizer.classPK ,[M feign/template/Template.classPK ,[Mdi>"R&feign/template/TemplateChunk.classPK ,[Mt} 5 L'feign/template/UriTemplate.classPK ,[M$)feign/template/UriUtils.classPK sF%A1META-INF/maven/com.github.zafarkhaja/PK sF1A1META-INF/maven/com.github.zafarkhaja/java-semver/PK sF0qu?:2META-INF/maven/com.github.zafarkhaja/java-semver/pom.propertiesPK sF>83META-INF/maven/com.github.zafarkhaja/java-semver/pom.xmlPK sFAT6com/PK sF Ax6com/github/PK sFA6com/github/zafarkhaja/PK sFA6com/github/zafarkhaja/semver/PK sFkDF7com/github/zafarkhaja/semver/MetadataVersion$NullMetadataVersion.classPK sF(O 29com/github/zafarkhaja/semver/MetadataVersion.classPK sF?a! 0@com/github/zafarkhaja/semver/NormalVersion.classPK sF`1Ecom/github/zafarkhaja/semver/ParseException.classPK sFWsX)Hcom/github/zafarkhaja/semver/Parser.classPK sF N/o ?Icom/github/zafarkhaja/semver/UnexpectedCharacterException.classPK sFW%֩,Ncom/github/zafarkhaja/semver/Version$1.classPK sF@w@:Ocom/github/zafarkhaja/semver/Version$BuildAwareOrder.classPK sFv),2Qcom/github/zafarkhaja/semver/Version$Builder.classPK sFK, *wUcom/github/zafarkhaja/semver/Version.classPK sFX2_com/github/zafarkhaja/semver/VersionParser$1.classPK sF=U ;`com/github/zafarkhaja/semver/VersionParser$CharType$1.classPK sF& ;bcom/github/zafarkhaja/semver/VersionParser$CharType$2.classPK sF ;necom/github/zafarkhaja/semver/VersionParser$CharType$3.classPK sF_x)j;gcom/github/zafarkhaja/semver/VersionParser$CharType$4.classPK sF |;)jcom/github/zafarkhaja/semver/VersionParser$CharType$5.classPK sF\;lcom/github/zafarkhaja/semver/VersionParser$CharType$6.classPK sFgzZG);ncom/github/zafarkhaja/semver/VersionParser$CharType$7.classPK sF[YT 9rcom/github/zafarkhaja/semver/VersionParser$CharType.classPK sFk 0vcom/github/zafarkhaja/semver/VersionParser.classPK sF"Acom/github/zafarkhaja/semver/expr/PK sFZ1կD+Pcom/github/zafarkhaja/semver/expr/And.classPK sFl: BHcom/github/zafarkhaja/semver/expr/CompositeExpression$Helper.classPK sF>ObA;}com/github/zafarkhaja/semver/expr/CompositeExpression.classPK sF\u-8com/github/zafarkhaja/semver/expr/Equal.classPK sF[$2com/github/zafarkhaja/semver/expr/Expression.classPK sF>w:com/github/zafarkhaja/semver/expr/ExpressionParser$1.classPK sFָѳ&8com/github/zafarkhaja/semver/expr/ExpressionParser.classPK sFR}o/com/github/zafarkhaja/semver/expr/Greater.classPK sF,X|6tcom/github/zafarkhaja/semver/expr/GreaterOrEqual.classPK sFl,Dcom/github/zafarkhaja/semver/expr/Less.classPK sF-Cx3com/github/zafarkhaja/semver/expr/LessOrEqual.classPK sFO)8çcom/github/zafarkhaja/semver/expr/Lexer$Token$Type.classPK sFmFs3com/github/zafarkhaja/semver/expr/Lexer$Token.classPK sFh[w -Dzcom/github/zafarkhaja/semver/expr/Lexer.classPK sF->6com/github/zafarkhaja/semver/expr/LexerException.classPK sFia+com/github/zafarkhaja/semver/expr/Not.classPK sF|zP0Tcom/github/zafarkhaja/semver/expr/NotEqual.classPK sFʰB*9com/github/zafarkhaja/semver/expr/Or.classPK sF ^ @1com/github/zafarkhaja/semver/expr/UnexpectedTokenException.classPK sF"A!com/github/zafarkhaja/semver/util/PK sF+V0ccom/github/zafarkhaja/semver/util/Stream$1.classPK sF?Dd:ycom/github/zafarkhaja/semver/util/Stream$ElementType.classPK sF,0.com/github/zafarkhaja/semver/util/Stream.classPK sFIRh}B0com/github/zafarkhaja/semver/util/UnexpectedElementException.classPK MxG A.com/google/PK MxGAYcom/google/gson/PK MxG"oa,com/google/gson/DefaultDateTypeAdapter.classPK MxGloD#'com/google/gson/ExclusionStrategy.classPK MxG&%com/google/gson/FieldAttributes.classPK MxGM*s)com/google/gson/FieldNamingPolicy$1.classPK MxGnLŞ;)com/google/gson/FieldNamingPolicy$2.classPK MxG x)ucom/google/gson/FieldNamingPolicy$3.classPK MxGz_)vcom/google/gson/FieldNamingPolicy$4.classPK MxGUK)com/google/gson/FieldNamingPolicy$5.classPK MxGQr 'com/google/gson/FieldNamingPolicy.classPK MxGM㷝)com/google/gson/FieldNamingStrategy.classPK MxGLccom/google/gson/Gson$1.classPK MxG=scom/google/gson/Gson$2.classPK MxGucom/google/gson/Gson$3.classPK MxG#com/google/gson/Gson$4.classPK MxG}ZFscom/google/gson/Gson$5.classPK MxG<com/google/gson/Gson$6.classPK MxG com/google/gson/Gson$7.classPK MxG@],( com/google/gson/Gson$FutureTypeAdapter.classPK MxGBL/Oc com/google/gson/Gson.classPK MxG u, !,com/google/gson/GsonBuilder.classPK MxG`˗.%8com/google/gson/InstanceCreator.classPK MxG*Y9com/google/gson/JsonArray.classPK MxG#0Acom/google/gson/JsonDeserializationContext.classPK MxGJ)&&Ccom/google/gson/JsonDeserializer.classPK MxGxAwf&!9Dcom/google/gson/JsonElement.classPK MxGlp|%Icom/google/gson/JsonIOException.classPK MxG(Kcom/google/gson/JsonNull.classPK MxG,x Mcom/google/gson/JsonObject.classPK MxG/ (Tcom/google/gson/JsonParseException.classPK MxGl0; Ucom/google/gson/JsonParser.classPK MxGuZ #[com/google/gson/JsonPrimitive.classPK MxG^-.ecom/google/gson/JsonSerializationContext.classPK MxGt$fcom/google/gson/JsonSerializer.classPK MxG=2  &gcom/google/gson/JsonStreamParser.classPK MxGȤ9)>mcom/google/gson/JsonSyntaxException.classPK MxGav~/ocom/google/gson/LongSerializationPolicy$1.classPK MxGY|l/pcom/google/gson/LongSerializationPolicy$2.classPK MxGK-rcom/google/gson/LongSerializationPolicy.classPK MxG%'ucom/google/gson/TreeTypeAdapter$1.classPK MxGR 7vcom/google/gson/TreeTypeAdapter$SingleTypeFactory.classPK MxG”"5d%{com/google/gson/TreeTypeAdapter.classPK MxG.#,com/google/gson/TypeAdapter$1.classPK MxGo !Mcom/google/gson/TypeAdapter.classPK MxG(com/google/gson/TypeAdapterFactory.classPK MxGA com/google/gson/annotations/PK MxGQMC (Fcom/google/gson/annotations/Expose.classPK MxG/'%-com/google/gson/annotations/JsonAdapter.classPK MxGd50com/google/gson/annotations/SerializedName.classPK MxGњ'com/google/gson/annotations/Since.classPK MxG''com/google/gson/annotations/Until.classPK MxGA.com/google/gson/internal/PK MxGxN|2gcom/google/gson/internal/$Gson$Preconditions.classPK MxG)?com/google/gson/internal/$Gson$Types$GenericArrayTypeImpl.classPK MxG\^57 @com/google/gson/internal/$Gson$Types$ParameterizedTypeImpl.classPK MxGȑ| ;pcom/google/gson/internal/$Gson$Types$WildcardTypeImpl.classPK MxGm6 **ecom/google/gson/internal/$Gson$Types.classPK MxGB|o7com/google/gson/internal/ConstructorConstructor$1.classPK MxG5o8com/google/gson/internal/ConstructorConstructor$10.classPK MxGt;I8Fcom/google/gson/internal/ConstructorConstructor$11.classPK MxG8|com/google/gson/internal/ConstructorConstructor$12.classPK MxG7}8com/google/gson/internal/ConstructorConstructor$13.classPK MxG:8com/google/gson/internal/ConstructorConstructor$14.classPK MxGn"7com/google/gson/internal/ConstructorConstructor$2.classPK MxGO7Rcom/google/gson/internal/ConstructorConstructor$3.classPK MxG5D7@com/google/gson/internal/ConstructorConstructor$4.classPK MxG=7ucom/google/gson/internal/ConstructorConstructor$5.classPK MxGd]T7com/google/gson/internal/ConstructorConstructor$6.classPK MxG@ 7Bcom/google/gson/internal/ConstructorConstructor$7.classPK MxG&:7zcom/google/gson/internal/ConstructorConstructor$8.classPK MxG7com/google/gson/internal/ConstructorConstructor$9.classPK MxGST G5com/google/gson/internal/ConstructorConstructor.classPK MxGPm% )1com/google/gson/internal/Excluder$1.classPK MxG*I0 'hcom/google/gson/internal/Excluder.classPK MxG37com/google/gson/internal/JsonReaderInternalAccess.classPK MxG0z01ecom/google/gson/internal/LazilyParsedNumber.classPK MxG+2com/google/gson/internal/LinkedHashTreeMap$1.classPK MxGe. ;com/google/gson/internal/LinkedHashTreeMap$AvlBuilder.classPK MxGyf<com/google/gson/internal/LinkedHashTreeMap$AvlIterator.classPK MxGSA m;com/google/gson/internal/LinkedHashTreeMap$EntrySet$1.classPK MxG)SPZB9com/google/gson/internal/LinkedHashTreeMap$EntrySet.classPK MxGvA9{ com/google/gson/internal/LinkedHashTreeMap$KeySet$1.classPK MxG{o7com/google/gson/internal/LinkedHashTreeMap$KeySet.classPK MxGf[ F@com/google/gson/internal/LinkedHashTreeMap$LinkedTreeMapIterator.classPK MxGC 5com/google/gson/internal/LinkedHashTreeMap$Node.classPK MxGN:I60ucom/google/gson/internal/LinkedHashTreeMap.classPK MxG}E.3com/google/gson/internal/LinkedTreeMap$1.classPK MxG'G/^H75com/google/gson/internal/LinkedTreeMap$EntrySet$1.classPK MxGcT 5p8com/google/gson/internal/LinkedTreeMap$EntrySet.classPK MxGoP55<com/google/gson/internal/LinkedTreeMap$KeySet$1.classPK MxG"U3>com/google/gson/internal/LinkedTreeMap$KeySet.classPK MxGlk BAcom/google/gson/internal/LinkedTreeMap$LinkedTreeMapIterator.classPK MxG)b 1Fcom/google/gson/internal/LinkedTreeMap$Node.classPK MxG\qH+,Kcom/google/gson/internal/LinkedTreeMap.classPK MxG.0^com/google/gson/internal/ObjectConstructor.classPK MxG|w )_com/google/gson/internal/Primitives.classPK MxG@ (dcom/google/gson/internal/Streams$1.classPK MxG]Decom/google/gson/internal/Streams$AppendableWriter$CurrentWrite.classPK MxGo573hcom/google/gson/internal/Streams$AppendableWriter.classPK MxGQ> &Qkcom/google/gson/internal/Streams.classPK MxGK,m0ocom/google/gson/internal/UnsafeAllocator$1.classPK MxGú?[0Mrcom/google/gson/internal/UnsafeAllocator$2.classPK MxG(0tcom/google/gson/internal/UnsafeAllocator$3.classPK MxGZ';0[wcom/google/gson/internal/UnsafeAllocator$4.classPK MxG?ՃM% .ycom/google/gson/internal/UnsafeAllocator.classPK MxGAi~com/google/gson/internal/bind/PK MxG0%6~com/google/gson/internal/bind/ArrayTypeAdapter$1.classPK MxG 䫯 4 com/google/gson/internal/bind/ArrayTypeAdapter.classPK MxGr)%kOH!com/google/gson/internal/bind/CollectionTypeAdapterFactory$Adapter.classPK MxG g @com/google/gson/internal/bind/CollectionTypeAdapterFactory.classPK MxGiX5'com/google/gson/internal/bind/DateTypeAdapter$1.classPK MxG, 3com/google/gson/internal/bind/DateTypeAdapter.classPK MxGb}Q Kcom/google/gson/internal/bind/JsonAdapterAnnotationTypeAdapterFactory.classPK MxG\ũ4com/google/gson/internal/bind/JsonTreeReader$1.classPK MxG& +2com/google/gson/internal/bind/JsonTreeReader.classPK MxG>`84com/google/gson/internal/bind/JsonTreeWriter$1.classPK MxG}v 52com/google/gson/internal/bind/JsonTreeWriter.classPK MxGRAP oAcom/google/gson/internal/bind/MapTypeAdapterFactory$Adapter.classPK MxG8J:9com/google/gson/internal/bind/MapTypeAdapterFactory.classPK MxGEw7ecom/google/gson/internal/bind/ObjectTypeAdapter$1.classPK MxGIA7com/google/gson/internal/bind/ObjectTypeAdapter$2.classPK MxG}5d 5hcom/google/gson/internal/bind/ObjectTypeAdapter.classPK MxG$K Bcom/google/gson/internal/bind/ReflectiveTypeAdapterFactory$1.classPK MxGBWHcom/google/gson/internal/bind/ReflectiveTypeAdapterFactory$Adapter.classPK MxGP_Khcom/google/gson/internal/bind/ReflectiveTypeAdapterFactory$BoundField.classPK MxG;з E#@com/google/gson/internal/bind/ReflectiveTypeAdapterFactory.classPK MxGJN"8com/google/gson/internal/bind/SqlDateTypeAdapter$1.classPK MxG~d 6_com/google/gson/internal/bind/SqlDateTypeAdapter.classPK MxG5com/google/gson/internal/bind/TimeTypeAdapter$1.classPK MxG^@[ 3com/google/gson/internal/bind/TimeTypeAdapter.classPK MxG|Fil A4com/google/gson/internal/bind/TypeAdapterRuntimeTypeWrapper.classPK MxG)O2com/google/gson/internal/bind/TypeAdapters$1.classPK MxGc~A 3 com/google/gson/internal/bind/TypeAdapters$10.classPK MxGrF3Ocom/google/gson/internal/bind/TypeAdapters$11.classPK MxGl)O3com/google/gson/internal/bind/TypeAdapters$12.classPK MxGlK"Q3*com/google/gson/internal/bind/TypeAdapters$13.classPK MxGD3fcom/google/gson/internal/bind/TypeAdapters$14.classPK MxGi 3com/google/gson/internal/bind/TypeAdapters$15.classPK MxGK9L3 com/google/gson/internal/bind/TypeAdapters$16.classPK MxGt<+W3q$com/google/gson/internal/bind/TypeAdapters$17.classPK MxG[3(com/google/gson/internal/bind/TypeAdapters$18.classPK MxGQ&S3+com/google/gson/internal/bind/TypeAdapters$19.classPK MxG{J 23Dcom/google/gson/internal/bind/TypeAdapters$24.classPK MxGz 73$Hcom/google/gson/internal/bind/TypeAdapters$25.classPK MxGy6F5Kcom/google/gson/internal/bind/TypeAdapters$26$1.classPK MxGhB3Ncom/google/gson/internal/bind/TypeAdapters$26.classPK MxG{ 3Qcom/google/gson/internal/bind/TypeAdapters$27.classPK MxG%Xo 3Wcom/google/gson/internal/bind/TypeAdapters$28.classPK MxG3E\com/google/gson/internal/bind/TypeAdapters$29.classPK MxG[)Ix2]ecom/google/gson/internal/bind/TypeAdapters$3.classPK MxGIĸ3%icom/google/gson/internal/bind/TypeAdapters$30.classPK MxG"U3.lcom/google/gson/internal/bind/TypeAdapters$31.classPK MxGl3ncom/google/gson/internal/bind/TypeAdapters$32.classPK MxGo[3)rcom/google/gson/internal/bind/TypeAdapters$33.classPK MxGT?;f3ucom/google/gson/internal/bind/TypeAdapters$34.classPK MxG7 .D5ycom/google/gson/internal/bind/TypeAdapters$35$1.classPK MxG83}com/google/gson/internal/bind/TypeAdapters$35.classPK MxGBƲ|3com/google/gson/internal/bind/TypeAdapters$36.classPK MxG3c,V2com/google/gson/internal/bind/TypeAdapters$4.classPK MxGk j2com/google/gson/internal/bind/TypeAdapters$5.classPK MxGc0O2com/google/gson/internal/bind/TypeAdapters$6.classPK MxGT2Ucom/google/gson/internal/bind/TypeAdapters$7.classPK MxGd@ (2com/google/gson/internal/bind/TypeAdapters$8.classPK MxGK؜M2Vcom/google/gson/internal/bind/TypeAdapters$9.classPK MxGRŭ2@Bcom/google/gson/internal/bind/TypeAdapters$EnumTypeAdapter.classPK MxGƥ &0Mcom/google/gson/internal/bind/TypeAdapters.classPK MxG#A@com/google/gson/internal/bind/util/PK MxGe"O5com/google/gson/internal/bind/util/ISO8601Utils.classPK MxGAcom/google/gson/reflect/PK MxG‚l 'ؽcom/google/gson/reflect/TypeToken.classPK MxGAcom/google/gson/stream/PK MxG|tp))com/google/gson/stream/JsonReader$1.classPK MxGP$V(/P'com/google/gson/stream/JsonReader.classPK MxGSCjd&com/google/gson/stream/JsonScope.classPK MxG'C 3 &-com/google/gson/stream/JsonToken.classPK MxGa& '}com/google/gson/stream/JsonWriter.classPK MxGk3F3 com/google/gson/stream/MalformedJsonException.classPK 1N Aburp/faraday/PK 1NtT k'burp/faraday/FaradayExtensionUI$2.classPK 0N)}lburp/faraday/Workspace.classPK 1Nh&N7burp/faraday/FaradayConnector$FaradayErrorDecoder.classPK 0NAWburp/faraday/exceptions/PK 0NMQk;burp/faraday/exceptions/InvalidFaradayServerException.classPK 0N}[=X:burp/faraday/exceptions/ObjectAlreadyExistsException.classPK 0N}oS3{burp/faraday/exceptions/ServerTooOldException.classPK 0N_7burp/faraday/exceptions/ObjectNotCreatedException.classPK 0Nse9burp/faraday/exceptions/InvalidCredentialsException.classPK 0N2bV4burp/faraday/exceptions/CookieExpiredException.classPK 0Na^5k;Lburp/faraday/exceptions/SecondFactorRequiredException.classPK 0NA burp/faraday/exceptions/http/PK 0N8 burp/faraday/exceptions/http/UnauthorizedException.classPK 0NV4"burp/faraday/exceptions/http/ConflictException.classPK 0N.D%0#burp/faraday/exceptions/http/HTTPException.classPK w1N=;&+%burp/faraday/VulnerabilityMapper.classPK 1Nu/<#3burp/faraday/FaradayServerAPI.classPK 1NXa!YK%6burp/faraday/FaradayExtensionUI.classPK 1N{'cXburp/faraday/FaradayExtensionUI$1.classPK 0NAZburp/faraday/models/PK 0Ni3 +Zburp/faraday/models/ExtensionSettings.classPK 0NA,`burp/faraday/models/responses/PK 0NpG/j`burp/faraday/models/responses/LoginStatus.classPK 0Nb /kbburp/faraday/models/responses/SessionInfo.classPK 0N7ZA1-7gburp/faraday/models/responses/CreatedObjectEntity.classPK 0Nb*8iburp/faraday/models/responses/ExistingObjectEntity.classPK 0Nf0̅V.kburp/faraday/models/responses/ServerInfo.classPK 0NV-,(nburp/faraday/models/FaradayEdition.classPK 0N]V0rburp/faraday/models/FaradayConnectorStatus.classPK w1N"Atburp/faraday/models/vulnerability/PK w1NӞ 5tburp/faraday/models/vulnerability/Vulnerability.classPK 0N5 ,Kburp/faraday/models/vulnerability/Host.classPK w1N9 e /burp/faraday/models/vulnerability/Service.classPK 0NAburp/faraday/models/requests/PK 0N</burp/faraday/models/requests/SecondFactor.classPK 0NdP3'burp/faraday/models/requests/User.classPK 1NP0#hburp/faraday/FaradayConnector.classPK 1NQWW@G$burp/BurpExtender.classPK 1NY~ExtensionTest.classPK/Efaraday_plugins-1.26.0/faraday_plugins/plugins/repo/burp/plugin.py000066400000000000000000000216641505357635700254170ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import base64 import distutils.util # pylint: disable=import-error from urllib.parse import urlsplit import lxml.etree as ET from bs4 import BeautifulSoup, Comment from faraday_plugins.plugins.plugin import PluginXMLFormat from faraday_plugins.plugins.plugins_utils import CVE_regex, CWE_regex __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato", "Micaela Ranea Sanchez", "Dante Acosta"] __license__ = "" __version__ = "1.1.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class BurpXmlParser: """ The objective of this class is to parse an xml file generated by the burp tool. TODO: Handle errors. TODO: Test burp output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param burp_xml_filepath A proper xml generated by burp """ def __init__(self, xml_output): self.target = None self.port = "80" self.host = None tree = self.parse_xml(xml_output) if tree is not None: self.items = [data for data in self.get_items(tree)] else: self.items = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: parser = ET.XMLParser(recover=True) tree = ET.fromstring(xml_output, parser=parser) except ET.XMLSyntaxError as err: print(f"XMLSyntaxError: {err}. {xml_output}") return None return tree def get_items(self, tree): """ @return items A list of Host instances """ for node in tree.findall('issue'): yield Item(node) def get_attrib_from_subnode(xml_node, subnode_xpath_expr, attrib_name): """ Finds a subnode in the item node and the retrieves a value from it @return An attribute value """ node = xml_node.find(subnode_xpath_expr) if node is not None: return node.get(attrib_name) return None class Item: """ An abstract representation of a Item @param item_node A item_node taken from an burp xml tree """ def __init__(self, item_node): self.node = item_node name = item_node.find('name').text host_node = item_node.find('host') path = item_node.find('path').text location = item_node.find('location').text severity = item_node.find('severity').text external_id = item_node.find('type').text request = self.decode_binary_node(item_node.find('./requestresponse/request')) response = self.decode_binary_node(item_node.find('./requestresponse/response')) detail = self.do_clean(item_node.find('issueDetail')) remediation = self.do_clean(item_node.find('remediationBackground')) background = self.do_clean(item_node.find('issueBackground')) self.references = self.do_clean(item_node.find('references')) self.vuln_class = self.do_clean(item_node.find('vulnerabilityClassifications')) self.cve = [] if background: cve = CVE_regex.search(background) if cve: self.cve = [cve.group()] self.url = host_node.text url_data = urlsplit(self.url) self.protocol = url_data.scheme self.host = url_data.hostname # Use the port in the URL if it is defined, or 80 or 443 by default self.port = url_data.port or (443 if url_data.scheme == "https" else 80) self.name = name self.path = path loc = re.search(r"(?<=\[).+?(?=\])", location.replace(self.path, "")) self.location = loc.group().split(" ")[0] if loc else "" self.ip = host_node.get('ip') self.url = self.node.get('url') self.severity = severity self.request = request self.response = response self.detail = detail self.remediation = remediation self.background = background self.external_id = external_id @staticmethod def do_clean(value): myreturn = "" if value is not None: myreturn = value.text return myreturn def decode_binary_node(self, node): """ Finds a subnode matching `path` and returns its inner text if it has no base64 attribute or its base64 decoded inner text if it has it. """ if node is not None: encoded = distutils.util.strtobool(node.get('base64', 'false')) if encoded: res = base64.b64decode(node.text).decode('utf-8', errors="backslashreplace") else: res = node.text return "".join([ch for ch in res if ord(ch) <= 128]) return "" def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: return sub_node.text return None class BurpPlugin(PluginXMLFormat): """ Example plugin to parse burp output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "issues" self.id = "Burp" self.name = "Burp XML Output Plugin" self.plugin_version = "0.0.2" self.version = "1.6.05 BurpPro" self.framework_version = "1.0.0" self.options = None self._current_output = None self.target = None def parseOutputString(self, output): parser = BurpXmlParser(output) for item in parser.items: h_id = self.createAndAddHost(item.ip, hostnames=[item.host]) s_id = self.createAndAddServiceToHost( h_id, item.protocol, "tcp", ports=[str(item.port)], status="open") desc = "" if item.background: desc += item.background desc = self.removeHtml(desc) data = "" if item.detail: data = self.removeHtml(item.detail) ref = [] if item.references: ref += self.get_url(item.references) cwe = [] if item.vuln_class: for cwe_ref in self.get_ref(item.vuln_class): if CWE_regex.search(cwe_ref): cwe.append(CWE_regex.search(cwe_ref).group()) resolution = self.removeHtml(item.remediation) if item.remediation else "" self.createAndAddVulnWebToService( h_id, s_id, item.name, desc=desc, data=data, severity=item.severity, website=item.host, path=item.path, request=item.request, response=item.response, resolution=resolution, ref=ref, params=item.location, external_id=item.external_id, cve=item.cve, cwe=cwe ) del parser def removeHtml(self, markup): soup = BeautifulSoup(markup, "html.parser") # Replace line breaks and paragraphs for new lines for tag in soup.find_all(["br", "p"]): tag.append("\n") tag.unwrap() # Replace lists for * and new lines for tag in soup.find_all(["ul", "ol"]): for item in tag.find_all("li"): item.insert_before("* ") item.append("\n") item.unwrap() tag.unwrap() # Remove all other HTML tags for tag in soup.find_all(): tag.unwrap() # Remove all comments for child in soup.children: if isinstance(child, Comment): child.extract() return str(soup) def get_ref(self, markup): soup = BeautifulSoup(markup, "html.parser") for tag in soup.find_all("ul"): for item in tag.find_all("li"): for a in item.find_all("a"): a.unwrap() item.unwrap() tag.unwrap() ref = str(soup).strip().split("\n") return ref def get_url(self, markup): soup = BeautifulSoup(markup, "html.parser") ref = [] for tag in soup.find_all("ul"): for item in tag.find_all("li"): for a in item.find_all("a"): ref += [a['href'].strip()] return ref def createPlugin(*args, **kwargs): return BurpPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/checkmarx/000077500000000000000000000000001505357635700245335ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/checkmarx/__init__.py000066400000000000000000000002351505357635700266440ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/checkmarx/plugin.py000077500000000000000000000114021505357635700264040ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2016 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import xml.etree.ElementTree as ET from urllib.parse import urlparse from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = 'Blas Moyano' __copyright__ = 'Copyright 2020, Faraday Project' __credits__ = ['Blas Moyano'] __license__ = '' __version__ = '1.0.0' __status__ = 'Development' class CheckmarxXmlParser: def __init__(self, xml_output): self.tree = self.parse_xml(xml_output) if self.tree: self.cx_xml_results_attribs = self.tree.attrib self.query = self.getQuery(self.tree) else: self.query = None def parse_xml(self, xml_output): try: tree = ET.fromstring(xml_output) except SyntaxError as err: print(f'SyntaxError In xml: {err}. {xml_output}') return None return tree def getQuery(self, tree): for self.query_node in tree: yield Querys(self.query_node) class Querys(): def __init__(self, query_node): self.query_attrib = query_node.attrib self.result, self.path, self.path_node = self.get_Result(query_node.findall('Result')) def get_Result(self, result): result_atr = [] path = [] path_node = [] for r in result: self.result_attrib = r.attrib self.path_attrib = r.find('Path').attrib self.path_node = self.get_path_node_info(r.find('Path').findall('PathNode')) result_atr.append(self.result_attrib) path.append(self.path_attrib) path_node.append(self.path_node) return result_atr, path, path_node def get_path_node_info(self, path_node): lista = [] for pn in path_node: lista_v = [] for info_pn in pn: if info_pn.tag == 'Snippet': valor = ( 'Number', info_pn.find('Line').find('Number').text, 'Code', info_pn.find('Line').find('Code').text) else: valor = (info_pn.tag, info_pn.text) lista_v.append(valor) lista.append(lista_v) return lista class CheckmarxPlugin(PluginXMLFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = ["CxXMLResults"] self.id = 'Checkmarx' self.name = 'Checkmarx XML Output Plugin' self.plugin_version = '1.0.0' self.version = '1.0.0' self.framework_version = '1.0.0' self.options = None def parseOutputString(self, output): parser = CheckmarxXmlParser(output) if not parser.query: self.logger.warning('Error in xml report... Exiting...') return url = urlparse(parser.cx_xml_results_attribs['DeepLink']) port = url.port if not port: if url.scheme == 'https': port = 443 elif url.scheme == 'http': port = 80 else: port = 0 project_name = 'ProjectName' in parser.cx_xml_results_attribs host_id = self.createAndAddHost(url.hostname, hostnames=[url.hostname, url.netloc]) service_to_interface = self.createAndAddServiceToHost(host_id, name=url.scheme, ports=port) for vulns in parser.query: refs = [] categories = 'categories' in vulns.query_attrib vuln_desc = '' if categories: vuln_desc = vulns.query_attrib['categories'] vuln_name = vulns.query_attrib['name'] vuln_severity = vulns.query_attrib['Severity'] vuln_external_id = vulns.query_attrib['id'] cwe = [f'CWE-{vulns.query_attrib["cweId"]}'] data = '' for files_data in vulns.path_node: for file_data in files_data: data += 60 * '-' + '\n' for row_data in file_data: data += ' '.join([data for data in row_data if data]) + '\n' for v_result in vulns.result: refs.append(v_result['DeepLink']) refs.append(v_result['FileName']) self.createAndAddVulnToHost(host_id, vuln_name, severity=vuln_severity, resolution=data, external_id=vuln_external_id, cwe=cwe) self.createAndAddVulnWebToService(host_id, service_to_interface, vuln_name, desc=vuln_desc, severity=vuln_severity, resolution=data, ref=refs, cwe=cwe) def createPlugin(*args, **kwargs): return CheckmarxPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/cis/000077500000000000000000000000001505357635700233445ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/cis/__init__.py000066400000000000000000000000001505357635700254430ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/cis/plugin.py000066400000000000000000000054161505357635700252220ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginXMLFormat from faraday_plugins.plugins.plugins_utils import CVE_regex, CWE_regex from xml.etree import ElementTree as ET __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Gonzalo Martinez"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmartinez@infobytesec.com" __status__ = "Development" class CisPlugin(PluginXMLFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.ns = { "scap-con": "{http://scap.nist.gov/schema/scap/constructs/1.2}", "arf": "{http://scap.nist.gov/schema/asset-reporting-format/1.1}", "dsc": "{http://scap.nist.gov/schema/scap/source/1.2}", "ai": "{http://scap.nist.gov/schema/asset-identification/1.1}", "xccdf": "{http://checklists.nist.gov/xccdf/1.2}" } self.identifier_tag = "asset-report-collection" self.id = "CIS" self.name = "CIS XML Output Plugin" self.plugin_version = "1.0.0" def parseOutputString(self, output): root = ET.fromstring(output) rules = {} for rule in root.findall(f".//{self.ns['xccdf']}Rule"): rules[rule.attrib['id']] = { "title": rule[0].text, "description": rule[1][0].text } reports = root.findall(f".//{self.ns['arf']}reports") for report in reports: target_address = report.find(f".//{self.ns['xccdf']}target-address").text rules_results = report.findall(f".//{self.ns['xccdf']}rule-result") h_id = self.createAndAddHost(target_address) for rule_result in rules_results: result = rule_result.find(f"{self.ns['xccdf']}result").text if result != "pass": severity = rule_result.attrib.get("severity","unclassified") rule_id = rule_result.attrib['idref'] references = [] for ident in rule_result.findall(f"{self.ns['xccdf']}ident"): text = ident.text if isinstance(text, str) and len(text) > 10: references.append(text) self.createAndAddVulnToHost( h_id, name=rules[rule_id]["title"], desc=rules[rule_id]["description"], severity=severity, ref=references ) def createPlugin(*args, **kwargs): return CisPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/cobalt/000077500000000000000000000000001505357635700240325ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/cobalt/__init__.py000066400000000000000000000002351505357635700261430ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2016 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/cobalt/plugin.py000066400000000000000000000066741505357635700257170ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginCSVFormat from urllib.parse import urlparse import csv import io from dateutil.parser import parse __author__ = "Blas" __copyright__ = "Copyright (c) 2019, Infobyte LLC" __credits__ = ["Blas"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Blas" __email__ = "bmoyano@infobytesec.com" __status__ = "Development" class CobaltParser: """ The objective of this class is to parse an CSV file generated by the Cobalt tool. TODO: Handle errors. TODO: Test Cobalt output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param Cobalt_filepath A proper simple report generated by Cobalt """ def __init__(self, output): reader = csv.DictReader(io.StringIO(output)) self.headers = reader.fieldnames self.rows = [] for row in reader: for k, v in row.items(): if v.startswith("'"): row[k] = v[1:] self.rows.append(row) class CobaltPlugin(PluginCSVFormat): """ Example plugin to parse Cobalt output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.csv_headers = [{'Token'}, {'Tag'}] self.id = "Cobalt" self.name = "Cobalt CSV Output Plugin" self.plugin_version = "0.0.1" self.version = "0.0.1" self.framework_version = "1.0.1" def parseOutputString(self, output): try: parser = CobaltParser(output) except: print("Error parser output") return None for row in parser.rows: url = row['BrowserUrl'] if not url: continue url_data = urlparse(url) scheme = url_data.scheme port = url_data.port try: run_date = parse(row['CreatedAt']) except: run_date = None if url_data.port is None: if scheme == 'https': port = 443 elif scheme == 'http': port = 80 else: port = url_data.port name = self.resolve_hostname(url_data.netloc) references = [] if row['RefKey']: references.append(row['RefKey']) if row['ResearcherUrl']: references.append(row['ResearcherUrl']) references.append(row['ReportUrl']) request = row['HttpRequest'] if row['HttpRequest'] else row['BrowserUrl'] h_id = self.createAndAddHost(name=name, hostnames=[url_data.netloc]) s_id = self.createAndAddServiceToHost(h_id, scheme, "tcp", ports=port, status="open") self.createAndAddVulnWebToService(h_id, s_id, name=row['Title'], desc=row['Description'], ref=references, resolution=row['SuggestedFix'], website=url_data.netloc, request=request, pname=url_data.params, category=row['Type'], path=url_data.path, data=row['StepsToReproduce'], external_id=row['Tag'], run_date=run_date) def createPlugin(*args, **kwargs): return CobaltPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/crowdstrike/000077500000000000000000000000001505357635700251265ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/crowdstrike/__init__.py000066400000000000000000000002341505357635700272360ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/crowdstrike/plugin.py000066400000000000000000000055001505357635700267760ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from urllib.parse import urlsplit import ipaddress from lxml import etree from faraday_plugins.plugins.plugin import PluginJsonFormat from faraday_plugins.plugins.repo.acunetix.DTO import Acunetix, Scan from json import loads __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Gonzalo Martinez"] __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmarintez@faradaysec.com" __status__ = "Development" class Crowdstrike(PluginJsonFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Crowdstrike_Json" self.name = "Crowdstrike JSON Output Plugin" self.plugin_version = "1" self.version = "1" self.json_keys = {'host_id', 'host_type'} self.framework_version = "1.0.0" self._temp_file_extension = "json" def parseOutputString(self, output): parser = loads(output) for site in parser: site_name = site.get('local_ip') hostname = site.get('hostname') host_tags = site.get('host_tags') os_version = site.get('os_version') host_id = self.createAndAddHost( name=site_name, os=os_version, hostnames=hostname, tags=host_tags ) cve = site.get('cve_id') severity = site.get('severity').lower() cvss_vector = site.get('vector') references = [site.get('references')] vuln = site.get('cve_description') remedations = [] for rr in site.get('recommended_remediations', []): remedations.append(rr.get('detail')) cvss3 = {} cvss2 = {} if float(site.get('cvss_version', '0')) > 2: cvss3['vector_string'] = cvss_vector else: cvss2['vector_string'] = cvss_vector evaluation_logic = '' for evaluation in site.get('evaluation_logic', []): result = [] for item in evaluation.get('items', []): result.append(item.get('comparison_result')) evaluation_logic += f'Evalutaion: {evaluation.get("title")}\n\tResults: {" ".join(result)}\n' self.createAndAddVulnToHost( host_id=host_id, name=vuln[:50], desc=vuln, severity=severity, cve=cve, cvss3=cvss3, cvss2=cvss2, ref=references, data=evaluation_logic ) def createPlugin(*args, **kwargs): return Crowdstrike(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dig/000077500000000000000000000000001505357635700233315ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dig/__init__.py000066400000000000000000000002341505357635700254410ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dig/plugin.py000066400000000000000000000135041505357635700252040ustar00rootroot00000000000000""" Updated by Mike Zhong, 25 Oct 2017. Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re __author__ = "Andres Tarantini" __copyright__ = "Copyright (c) 2015 Andres Tarantini" __credits__ = ["Andres Tarantini"] __license__ = "MIT" __version__ = "0.0.1" __maintainer__ = "Andres Tarantini" __email__ = "atarantini@gmail.com" __status__ = "Development" from faraday_plugins.plugins.plugin import PluginBase class DigPlugin(PluginBase): """ Handle DiG (http://linux.die.net/man/1/dig) output """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "dig" self.name = "DiG" self.plugin_version = "0.0.1" self.version = "9.9.5-3" self._command_regex = re.compile(r'^(dig)\s+.*?') def parseOutputString(self, output): # Ignore all lines that start with ";" parsed_output = [line for line in output.splitlines() if line and line[ 0] != ";"] if not parsed_output: return True # Parse results results = [] answer_section_columns = ["domain", "ttl", "class", "type", "data"] for line in parsed_output: line_split = line.split() # the first 4 elements are domain, ttl, class, type; everything else data results.append(dict(zip(answer_section_columns, line_split[:4] + [line_split[4:]] ))) # Create hosts is results information is relevant try: for result in results: relevant_types = ["A", "AAAA", "MX", "NS", "SOA", "TXT"] # TODO implement more types from https://en.wikipedia.org/wiki/List_of_DNS_record_types if result.get("type") in relevant_types: # get domain domain = result.get("domain") # get IP address (special if type "A") if result.get("type") == "A": # A = IPv4 address from dig ip_address = result.get("data")[0] else: # if not, from socket ip_address = self.resolve_hostname(domain) # Create host host_id = self.createAndAddHost(ip_address, hostnames=[domain]) # all other TYPES that aren't 'A' and 'AAAA' are dealt here: if result.get("type") == "MX": # Mail exchange record mx_priority = result.get("data")[0] mx_record = result.get("data")[1] service_id = self.createAndAddServiceToHost( host_id=host_id, name=mx_record, protocol="SMTP", ports=[25], description="E-mail Server") text = "Priority: " + mx_priority self.createAndAddNoteToService( host_id=host_id, service_id=service_id, name="priority", text=text.encode('ascii', 'ignore')) elif result.get("type") == "NS": # Name server record ns_record = result.get("data")[0] self.createAndAddServiceToHost( name=ns_record, protocol="DNS", ports=[53], description="DNS Server") elif result.get("type") == "SOA": # Start of Authority Record ns_record = result.get("data")[0] # primary namer server responsible_party = result.get("data")[1] # responsible party of domain timestamp = result.get("data")[2] refresh_zone_time = result.get("data")[3] retry_refresh_time = result.get("data")[4] upper_limit_time = result.get("data")[5] negative_result_ttl = result.get("data")[6] service_id = self.createAndAddServiceToHost( host_id=host_id, name=ns_record, protocol="DNS", ports=[53], description="Authority Record") text = ( "Responsible Party: " + responsible_party + "\nTimestep: " + timestamp + "\nTime before zone refresh (sec): " + refresh_zone_time + "\nTime before retry refresh (sec): " + retry_refresh_time + "\nUpper Limit before Zone is no longer authoritive (sec): " + upper_limit_time + "\nNegative Result TTL: " + negative_result_ttl) self.createAndAddNoteToService( host_id=host_id, service_id=service_id, name="priority", text=text.encode('ascii', 'ignore')) elif result.get("type") == "TXT": # TXT record text = " ".join(result.get("data")[:]) self.createAndAddNoteToHost( host_id=host_id, name="TXT Information", text=text.encode('ascii', 'ignore')) except Exception as ex: print("some part of the dig plug-in caused an error! Please check repo/dig/plugin.py") return False return True def createPlugin(*args, **kwargs): return DigPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dirb/000077500000000000000000000000001505357635700235065ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dirb/__init__.py000066400000000000000000000002341505357635700256160ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2016 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dirb/plugin.py000066400000000000000000000074351505357635700253670ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re __author__ = "Federico Fernandez - @q3rv0" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __license__ = "" __version__ = "1.0.0" __maintainer__ = "Federico Fernandez" __email__ = "fede.merlo26@gmail.com" __status__ = "Development" from faraday_plugins.plugins.plugin import PluginBase class dirbPlugin(PluginBase): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "dirb" self.name = "Dirb" self.plugin_version = "0.0.1" self.version = "2.22" self.regexpUrl = r'((http[s]?)\:\/\/([\w\.]+)[.\S]+)' self._command_regex = re.compile(r'^(sudo dirb|dirb|\.\/dirb|sudo \.\/dirb)\s+.*?') self.text = [] def getPort(self, host, proto): p = re.search(r"\:([0-9]+)\/", host) if p is not None: return p.group(1) elif proto == 'https': return 443 else: return 80 def getIP(self, host): try: ip = self.resolve_hostname(host) except Exception: # nosec pass return ip def state(self, output): if output.find('COULDNT CONNECT') != -1: return "close" else: return "open" def pathsDirListing(self, output): data = [] r = re.findall(self.regexpUrl + r"[\-\._\w\*\s]+\s+\(!\) WARNING: Directory IS LISTABLE", output) for u in r: data.append(u[0]) paths = "\n".join(data) return paths def note(self, output): dirs = re.findall(r"==> DIRECTORY: "+self.regexpUrl, output) files = re.findall(r"\+ " + self.regexpUrl + r" \(.+\)", output) for d in dirs: self.text.append("DIRECTORY: " + d[0]) for f in files: self.text.append("FILE: " + f[0]) self.text = '\n'.join(self.text) def parseOutputString(self, output): url = re.search(r"URL_BASE: " + self.regexpUrl, output) paths = self.pathsDirListing(output) status = self.state(output) self.note(output) if output.find('END_TIME') != -1 and url is not None: proto = url.group(2) domain = url.group(3) ip = self.getIP(domain) puerto = self.getPort(url.group(1), proto) host_id = self.createAndAddHost(ip) serv_id = self.createAndAddServiceToHost(host_id, proto, protocol=proto, ports=[puerto], status=status) if len(self.text) > 0: self.createAndAddVulnWebToService(host_id, serv_id, 'Url Fuzzing', severity=0, desc=self.text, website=domain) if len(paths) > 0: self.createAndAddVulnWebToService(host_id, serv_id, "Directory Listing", severity="med", website=domain, request=paths, method="GET") return True def processCommandString(self, username, current_path, command_string): """ Adds the -oX parameter to get xml output to the command string that the user has set. """ super().processCommandString(username, current_path, command_string) no_stop_on_warn_msg_re = r"\s+-w" arg_search = re.search(no_stop_on_warn_msg_re,command_string) extra_arg = "" if arg_search is None: extra_arg +=" -w" silent_mode_re = r"\s+-S" arg_search = re.search(silent_mode_re,command_string) if arg_search is None: extra_arg +=" -S" return f"{command_string}{extra_arg}" def createPlugin(*args, **kwargs): return dirbPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dirsearch/000077500000000000000000000000001505357635700245325ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dirsearch/__init__.py000066400000000000000000000002351505357635700266430ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dirsearch/plugin.py000066400000000000000000000124361505357635700264100ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import json import shlex import argparse import urllib.parse as urlparse from faraday_plugins.plugins.plugin import PluginBase from faraday_plugins.plugins.plugins_utils import get_vulnweb_url_fields __author__ = "Matías Lang" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Matías Lang"] __license__ = "" __version__ = "0.0.1" __maintainer__ = "Matías Lang" __email__ = "matiasl@infobytesec.com" __status__ = "Development" status_codes = { 200: "OK", 201: "Created", 202: "Accepted", 203: "Non-Authoritative Information", 204: "No Content", 205: "Reset Content", 206: "Partial Content", 207: "Multi-Status", 208: "Already Reported", 226: "IM Used", 300: "Multiple Choices", 301: "Moved Permanently", 302: "Found", 303: "See Other", 304: "Not Modified", 305: "Use Proxy", 306: "Switch Proxy", 307: "Temporary Redirect", 308: "Permanent Redirect", 400: "Bad Request", 401: "Unauthorized", 402: "Payment Required", 403: "Forbidden", 404: "Not Found", 405: "Method Not Allowed", 406: "Not Acceptable", 407: "Proxy Authentication Required", 408: "Request Timeout", 409: "Conflict", 410: "Gone", 411: "Length Required", 412: "Precondition Failed", 413: "Payload Too Large", 414: "URI Too Long", 415: "Unsupported Media Type", 416: "Range Not Satisfiable", 417: "Expectation Failed", 418: "I'm a teapot", 421: "Misdirected Request", 422: "Unprocessable Entity", 423: "Locked", 424: "Failed Dependency", 426: "Upgrade Required", 428: "Precondition Required", 429: "Too Many Requests", 431: "Request Header Fields Too Large", 451: "Unavailable For Legal Reasons", 500: "Internal Server Error", 501: "Not Implemented", 502: "Bad Gateway", 503: "Service Unavailable", 504: "Gateway Timeout", 505: "HTTP Version Not Supported", 506: "Variant Also Negotiates", 507: "Insufficient Storage", 508: "Loop Detected", 510: "Not Extended", 511: "Network Authentication Required", } class DirsearchPlugin(PluginBase): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "dirsearch" self.name = "old-dirsearch" # Plugin for old Dirsearch output self.plugin_version = "0.0.1" self.version = "0.0.1" self._command_regex = re.compile(r'^(sudo )?(python[0-9\.]? )?(dirsearch\.py)\s+?') self.addSetting("Ignore 403", str, "1") self._use_temp_file = True self._temp_file_extension = "json" def parseOutputString(self, output): self.parse_json(output) @property def should_ignore_403(self): val = self.getSetting('Ignore 403') if not val or not int(val): return False return True def parse_json(self, contents): try: data = json.loads(contents) except ValueError: self.logger.error('Error parsing report. Make sure the file has valid ' 'JSON', 'ERROR') return for (base_url, items) in data.items(): base_split = urlparse.urlsplit(base_url) ip = self.resolve_hostname(base_split.hostname) h_id = self.createAndAddHost(ip, hostnames=[base_split.hostname]) s_id = self.createAndAddServiceToHost( h_id, base_split.scheme, 'tcp', [base_split.port], status="open") for item in items: self.parse_found_url(base_url, h_id, s_id, item) def parse_found_url(self, base_url, h_id, s_id, item): if self.should_ignore_403 and item['status'] == 403: return url = urlparse.urlsplit(urlparse.urljoin(base_url, item['path'])) response = "HTTP/1.1 {} {}\nContent-Length: {}".format( item['status'], status_codes.get(item['status'], 'unknown'), item['content-length']) redirect = item.get('redirect') if redirect is not None: response += f'\nLocation: {redirect}' self.createAndAddVulnWebToService( h_id, s_id, name=f'Path found: {item["path"]} ({item["status"]})', desc=f"Dirsearch tool found the following URL: {url.geturl()}", severity="info", method='GET', response=response, **get_vulnweb_url_fields(url.geturl())) def processCommandString(self, username, current_path, command_string): parser = argparse.ArgumentParser(conflict_handler='resolve') parser.add_argument('-h', '--help', action='store_true') parser.add_argument('--json-report') args, unknown = parser.parse_known_args(shlex.split(command_string)) if args.help: return None if args.json_report: # The user already defined a path to the JSON report self._output_file_path = args.json_report return None else: super().processCommandString(username, current_path, command_string) return f'{command_string} --json-report {self._output_file_path}' def createPlugin(*args, **kwargs): return DirsearchPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dirsearchjson/000077500000000000000000000000001505357635700254245ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dirsearchjson/__init__.py000066400000000000000000000002321505357635700275320ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2025 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dirsearchjson/plugin.py000066400000000000000000000110741505357635700272770ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2025 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import json from math import floor from faraday_plugins.plugins.plugin import PluginJsonFormat __author__ = "Dante Acosta" __copyright__ = "Copyright (c) 2025, Infobyte LLC" __credits__ = ["Dante Acosta"] __version__ = "1.0.0" __maintainer__ = "Dante" __email__ = "dacosta@infobytesec.com" __status__ = "Development" code_map = { 200: "OK", 201: "Created", 202: "Accepted", 203: "Non-Authoritative Information", 204: "No Content", 205: "Reset Content", 206: "Partial Content", 207: "Multi-Status", 208: "Already Reported", 226: "IM Used", 300: "Multiple Choices", 301: "Moved Permanently", 302: "Found", 303: "See Other", 304: "Not Modified", 305: "Use Proxy", 306: "Switch Proxy", 307: "Temporary Redirect", 308: "Permanent Redirect", 400: "Bad Request", 401: "Unauthorized", 402: "Payment Required", 403: "Forbidden", 404: "Not Found", 405: "Method Not Allowed", 406: "Not Acceptable", 407: "Proxy Authentication Required", 408: "Request Timeout", 409: "Conflict", 410: "Gone", 411: "Length Required", 412: "Precondition Failed", 413: "Payload Too Large", 414: "URI Too Long", 415: "Unsupported Media Type", 416: "Range Not Satisfiable", 417: "Expectation Failed", 418: "I'm a teapot", 421: "Misdirected Request", 422: "Unprocessable Entity", 423: "Locked", 424: "Failed Dependency", 426: "Upgrade Required", 428: "Precondition Required", 429: "Too Many Requests", 431: "Request Header Fields Too Large", 451: "Unavailable For Legal Reasons", 500: "Internal Server Error", 501: "Not Implemented", 502: "Bad Gateway", 503: "Service Unavailable", 504: "Gateway Timeout", 505: "HTTP Version Not Supported", 506: "Variant Also Negotiates", 507: "Insufficient Storage", 508: "Loop Detected", 510: "Not Extended", 511: "Network Authentication Required", } class DirsearchPluginJSON(PluginJsonFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "dirsearchjson" self.name = "dirsearch Plugin for JSON output" self.plugin_version = "0.4.3" self.version = "1.0.0" self.json_keys = {'results', 'info'} self._temp_file_extension = "json" def parseOutputString(self, output): json_report = json.loads(output) if not json_report: return None regex_map = {} data_regroup = {} for result in json_report.get('results', []): loc = result.get('url', None) if loc is None: continue status = result.get('status', None) if status is None: continue status_round = floor(status / 100) * 100 if status_round == 400: continue if loc not in regex_map: regex_res = re.findall("((?:http|https):\\/\\/(\\S*?)(?::[0-9]*|)(?:\\/|$))", loc) if (isinstance(regex_res, list) and len(regex_res) > 0 and isinstance(regex_res[0], tuple) and len(regex_res[0]) == 2 and regex_res[0][1]): regex_map[loc] = regex_res[0][1] if not regex_map[loc] in data_regroup: data_regroup[regex_map[loc]] = {} if status_round not in data_regroup[regex_map[loc]]: data_regroup[regex_map[loc]][status_round] = ( f"One or more endpoints returned **{int(status_round/100)}xx** :\n" ) cl = result.get('content-length', None) ct = result.get('content-type', None) red = result.get('redirect') or None data_regroup[regex_map[loc]][status_round] += ( f"- [{status}] **{loc}**{(' with content type *'+ct+'*') if ct is not None else ''}" f"{(' ('+str(cl)+' bytes)') if cl is not None else ''}" f"{(' redirects to ['+red+']('+red+')') if red is not None else ''}\n" ) for host in data_regroup: h = self.createAndAddHost(host, hostnames=[host]) for code in data_regroup[host]: self.createAndAddVulnToHost( h, f"Returned {int(code/100)}xx", desc=data_regroup[host][code], severity="info", confirmed=True ) def createPlugin(*args, **kwargs): return DirsearchPluginJSON(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsenum/000077500000000000000000000000001505357635700242375ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsenum/__init__.py000066400000000000000000000002351505357635700263500ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsenum/plugin.py000066400000000000000000000113451505357635700261130ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import xml.etree.ElementTree as ET from faraday_plugins.plugins.plugin import PluginBase __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class DnsenumXmlParser: """ The objective of this class is to parse an xml file generated by the dnsenum tool. TODO: Handle errors. TODO: Test dnsenum output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param dnsenum_xml_filepath A proper xml generated by dnsenum """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) if tree: self.items = [data for data in self.get_items(tree)] else: self.items = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: tree = ET.fromstring(xml_output) except SyntaxError as err: print(f"SyntaxError: {err}. {xml_output}") return None return tree def get_items(self, tree): """ @return items A list of Host instances """ node = tree.findall('testdata')[0] for hostnode in node.findall('host'): yield Item(hostnode) def get_attrib_from_subnode(xml_node, subnode_xpath_expr, attrib_name): """ Finds a subnode in the item node and the retrieves a value from it @return An attribute value """ node = xml_node.find(subnode_xpath_expr) if node is not None: return node.get(attrib_name) return None class Item: """ An abstract representation of a Item TODO: Consider evaluating the attributes lazily TODO: Write what's expected to be present in the nodes TODO: Refactor both Host and the Port clases? @param item_node A item_node taken from an dnsenum xml tree """ def __init__(self, item_node): self.node = item_node self.hostname = self.get_text_from_subnode('hostname') self.ip = self.node.text def do_clean(self, value): myreturn = "" if value is not None: myreturn = re.sub("\n", "", value) return myreturn def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: return sub_node.text return None class DnsenumPlugin(PluginBase): """ Example plugin to parse dnsenum output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Dnsenum" self.name = "Dnsenum XML Output Plugin" self.plugin_version = "0.0.1" self.version = "1.2.2" self.options = None self._current_output = None self._use_temp_file = True self._temp_file_extension = "txt" self._command_regex = re.compile( r'^(sudo dnsenum|dnsenum|sudo dnsenum\.pl|dnsenum\.pl|perl dnsenum\.pl|\.\/dnsenum\.pl)\s+.*?') self.xml_arg_re = re.compile(r"^.*(-o\s*[^\s]+).*$") def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ parser = DnsenumXmlParser(output) for item in parser.items: self.createAndAddHost(item.ip, hostnames=[item.hostname]) del parser def processCommandString(self, username, current_path, command_string): """ Adds the -oX parameter to get xml output to the command string that the user has set. """ super().processCommandString(username, current_path, command_string) arg_match = self.xml_arg_re.match(command_string) if arg_match is None: return re.sub(r"(^.*?dnsenum(\.pl)?)", r"\1 -o %s" % self._output_file_path, command_string) else: return re.sub(arg_match.group(1), r"-o %s" % self._output_file_path, command_string) def createPlugin(*args, **kwargs): return DnsenumPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsmap/000077500000000000000000000000001505357635700240505ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsmap/__init__.py000066400000000000000000000002351505357635700261610ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsmap/plugin.py000066400000000000000000000110001505357635700257100ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re from collections import defaultdict from faraday_plugins.plugins.plugin import PluginBase __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class DnsmapParser: """ The objective of this class is to parse an xml file generated by the dnsmap tool. TODO: Handle errors. TODO: Test dnsmap output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param dnsmap_filepath A proper simple report generated by dnsmap """ def __init__(self, output): self.items = defaultdict(list) if "\n\n" in output: self.parse_txt(output) else: self.parse_csv(output) def parse_txt(self, output): hosts = self.split_output_lines(output) for host_data in hosts: if len(host_data) == 2: ip = self.clean_ip(host_data[1]) hostname = host_data[0] self.add_host_info_to_items(ip, hostname) elif len(host_data) > 2: hostname = host_data.pop(0) for ip_address in host_data: ip = self.clean_ip(ip_address) self.add_host_info_to_items(ip, hostname) def parse_csv(self, output): hosts = list(filter(None, output.splitlines())) for host in hosts: host_data = host.split(",", 1) if host_data[1].count(',') == 0: ip = host_data[1] hostname = host_data[0] self.add_host_info_to_items(ip, hostname) else: hostname = host_data.pop(0) ips = host_data[0].split(",") for ip_address in ips: self.add_host_info_to_items(ip_address, hostname) def split_output_lines(self, output): splitted = output.splitlines() hosts_list = [] aux_list = [] for i in range(0, len(splitted)): if not splitted[i]: hosts_list.append(aux_list) aux_list = [] continue else: aux_list.append(splitted[i]) return hosts_list def clean_ip(self, item): ip = item.split(':', 1) return ip[1].strip() def add_host_info_to_items(self, ip_address, hostname): self.items[ip_address].append(hostname) class DnsmapPlugin(PluginBase): """Example plugin to parse dnsmap output.""" def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Dnsmap" self.name = "Dnsmap Output Plugin" self.plugin_version = "0.3" self.version = "0.30" self.options = None self._current_output = None self._command_regex = re.compile(r'^(sudo dnsmap|dnsmap|\.\/dnsmap)\s+.*?') self.xml_arg_re = re.compile(r"^.*(-r\s*[^\s]+).*$") self._use_temp_file = True self._temp_file_extension = "txt" def canParseCommandString(self, current_input): if self._command_regex.match(current_input.strip()): self.command = self.get_command(current_input) return True else: return False def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. """ parser = DnsmapParser(output) for ip_address, hostnames in parser.items.items(): h_id = self.createAndAddHost(ip_address, hostnames=hostnames) return True def processCommandString(self, username, current_path, command_string): """ Adds the parameter to get output to the command string that the user has set. """ super().processCommandString(username, current_path, command_string) arg_match = self.xml_arg_re.match(command_string) if arg_match is None: return f"{command_string} -r {self._output_file_path} \\n" else: return re.sub(arg_match.group(1), r"-r %s" % self._output_file_path, command_string) def createPlugin(*args, **kwargs): return DnsmapPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsrecon/000077500000000000000000000000001505357635700244015ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsrecon/__init__.py000066400000000000000000000002351505357635700265120ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsrecon/plugin.py000066400000000000000000000147321505357635700262600ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import xml.etree.ElementTree as ET from faraday_plugins.plugins.plugin import PluginBase __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class DnsreconXmlParser: """ The objective of this class is to parse an xml file generated by the dnsrecon tool. TODO: Handle errors. TODO: Test dnsrecon output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param dnsrecon_xml_filepath A proper xml generated by dnsrecon """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) if tree: self.hosts = [host for host in self.get_hosts(tree)] else: self.hosts = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: tree = ET.fromstring(xml_output) except SyntaxError as err: print(f"SyntaxError: {err}. {xml_output}") return None return tree def get_hosts(self, tree): """ @return items A list of Host instances """ for item_node in tree.findall('record'): yield Item(item_node) def get_attrib_from_subnode(xml_node, subnode_xpath_expr, attrib_name): """ Finds a subnode in the item node and the retrieves a value from it @return An attribute value """ node = xml_node.find(subnode_xpath_expr) if node is not None: return node.get(attrib_name) return None class Item: """ An abstract representation of a Item TODO: Consider evaluating the attributes lazily TODO: Write what's expected to be present in the nodes TODO: Refactor both Host and the Port clases? @param item_node A item_node taken from an dnsrecon xml tree """ def __init__(self, item_node): self.node = item_node self.type = self.do_clean(self.node.get('type')) self.zonetransfer = self.do_clean(self.node.get('zone_transfer')) self.ns_server = self.do_clean(self.node.get('ns_server')) self.address = self.do_clean(self.node.get( 'address')) if not self.type == "info" else self.ns_server self.target = self.do_clean(self.node.get('target')) self.name = self.do_clean(self.node.get('name')) self.exchange = self.do_clean(self.node.get('exchange')) print("GENERATION:" + self.type, self.address, self.zonetransfer) def do_clean(self, value): myreturn = '' if value is not None: myreturn = re.sub(" |\n", "", value) return myreturn def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: return sub_node.text return None class DnsreconPlugin(PluginBase): """ Example plugin to parse dnsrecon output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Dnsrecon" self.name = "Dnsrecon XML Output Plugin" self.plugin_version = "0.0.2" self.version = "0.8.7" self.framework_version = "1.0.0" self.options = None self._current_output = None self._command_regex = re.compile( r'^(sudo dnsrecon|dnsrecon|sudo dnsrecon\.py|dnsrecon\.py|python dnsrecon\.py|\.\/dnsrecon\.py)\s+.*?') self._use_temp_file = True self._temp_file_extension = "xml" def validHosts(self, hosts): valid_records = ["NS", "CNAME", "A", "MX", "info"] hosts = list(filter(lambda h: h.type in valid_records, hosts)) return hosts def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ parser = DnsreconXmlParser(output) for host in self.validHosts(parser.hosts): print(host.type, host.name, host.zonetransfer) hostname = host.target if host.type == "MX": hostname = host.exchange elif host.type == "A": hostname = host.name h_id = self.createAndAddHost(host.address, hostnames=[hostname]) if host.type == "info": s_id = self.createAndAddServiceToHost( h_id, "domain", protocol="tcp", ports=["53"], status="open") if host.zonetransfer == "success": self.createAndAddVulnToService( h_id, s_id, name="Zone transfer", desc="A Dns server allows unrestricted zone transfers", ref=["CVE-1999-0532"]) del parser def _isIPV4(self, ip): if len(ip.split(".")) == 4: return True else: return False xml_arg_re = re.compile(r"^.*(--xml\s*[^\s]+).*$") def processCommandString(self, username, current_path, command_string): """ Adds the -oX parameter to get xml output to the command string that the user has set. """ super().processCommandString(username, current_path, command_string) arg_match = self.xml_arg_re.match(command_string) if arg_match is None: return re.sub(r"(^.*?dnsrecon(\.py)?)", r"\1 --xml %s" % self._output_file_path, command_string) else: return re.sub(arg_match.group(1), r"--xml %s" % self._output_file_path, command_string) def createPlugin(*args, **kwargs): return DnsreconPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnswalk/000077500000000000000000000000001505357635700242315ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnswalk/__init__.py000066400000000000000000000002351505357635700263420ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnswalk/plugin.py000066400000000000000000000065621505357635700261120ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re from faraday_plugins.plugins.plugin import PluginBase __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class DnswalkParser: """ The objective of this class is to parse an xml file generated by the dnswalk tool. TODO: Handle errors. TODO: Test dnswalk output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param dnswalk_filepath A proper simple report generated by dnswalk """ def __init__(self, output, resolve_hostName): lists = output.split("\n") self.items = [] self.resolve_hostName = resolve_hostName for line in lists: mregex = re.search(r"WARN: ([\w\.]+) ([\w]+) ([\w\.]+):", line) if mregex is not None: item = { 'host': mregex.group(1), 'ip': mregex.group(3), 'type': mregex.group(2)} self.items.append(item) mregex = re.search( r"Getting zone transfer of ([\w\.]+) from ([\w\.]+)\.\.\.done\.", line) if mregex is not None: ip = self.resolve_hostname(mregex.group(2)) item = { 'host': mregex.group(1), 'ip': ip, 'type': 'info'} self.items.append(item) class DnswalkPlugin(PluginBase): """ Example plugin to parse dnswalk output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Dnswalk" self.name = "Dnswalk XML Output Plugin" self.plugin_version = "0.0.1" self.version = "2.0.2" self.options = None self._current_output = None self._command_regex = re.compile( r'^(sudo dnswalk|dnswalk|\.\/dnswalk)\s+.*?') def canParseCommandString(self, current_input): if self._command_regex.match(current_input.strip()): self.command = self.get_command(current_input) return True else: return False def parseOutputString(self, output): """ output is the shell output of command Dnswalk. """ parser = DnswalkParser(output, self.resolve_hostname) for item in parser.items: if item['type'] == "A": h_id = self.createAndAddHost(item['ip'], hostnames=[item['host']]) elif item['type'] == "info": h_id = self.createAndAddHost(item['ip'], hostnames=[item['host']]) s_id = self.createAndAddServiceToHost( h_id, "domain", "tcp", ports=['53']) self.createAndAddVulnToService( h_id, s_id, "Zone transfer", desc="A Dns server allows unrestricted zone transfers", ref=["CVE-1999-0532"]) return True def createPlugin(*args, **kwargs): return DnswalkPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsx/000077500000000000000000000000001505357635700235425ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsx/__init__.py000066400000000000000000000000001505357635700256410ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/dnsx/plugin.py000066400000000000000000000047441505357635700254230ustar00rootroot00000000000000 import json from faraday_plugins.plugins.plugin import PluginMultiLineJsonFormat __author__ = "six2dez" __version__ = "0.0.1" __maintainer__ = "six2dez" __email__ = "six2dez@gmail.com" __status__ = "Development" class DNSXPlugin(PluginMultiLineJsonFormat): """ Plugin to parse dnsx JSON output (one JSON object per line). """ def __init__(self, ignore_info=False, hostname_resolution=True, vuln_tag=None, service_tag=None, host_tag=None): super().__init__(ignore_info=ignore_info) self.id = "dnsx" self.name = "DNSX Multiline JSON Plugin" self.plugin_version = "1.2.2" self.json_keys = {"host", "ttl", "timestamp"} self.vuln_tag = vuln_tag self.service_tag = service_tag self.host_tag = host_tag def parseOutputString(self, output, debug=False): lines = output.strip().splitlines() for line in lines: line = line.strip() if not line: continue try: data = json.loads(line) except json.JSONDecodeError: continue host = data.get("host", "") if not host: continue a_records = data.get("a", []) aaaa_records = data.get("aaaa", []) # If no IPs are returned, record the hostname-only host if not a_records and not aaaa_records: h_id = self.createAndAddHost(name=host) if self.host_tag: self.createAndAddNoteToHost(h_id, name="Host Tag", text=self.host_tag) else: # For each IP, create a host and add the hostname as a host alias for ip_addr in a_records + aaaa_records: h_id = self.createAndAddHost(name=ip_addr, hostnames=[host]) if self.host_tag: self.createAndAddNoteToHost(h_id, name="Host Tag", text=self.host_tag) if self.service_tag: self.createAndAddNoteToHost(h_id, name="Service Tag", text=self.service_tag) if self.vuln_tag: self.createAndAddNoteToHost(h_id, name="Vulnerability Tag", text=self.vuln_tag) def createPlugin(ignore_info=False, hostname_resolution=True, vuln_tag=None, service_tag=None, host_tag=None, *args, **kwargs): return DNSXPlugin(ignore_info=ignore_info, hostname_resolution=hostname_resolution, vuln_tag=vuln_tag, service_tag=service_tag, host_tag=host_tag) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/faraday_csv/000077500000000000000000000000001505357635700250505ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/faraday_csv/__init__.py000066400000000000000000000002341505357635700271600ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/faraday_csv/plugin.py000066400000000000000000000355231505357635700267300ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (https://www.faradaysec.com/) See the file 'doc/LICENSE' for the license information """ # Standard library imports import sys import re import csv from ast import literal_eval # Local application imports from faraday_plugins.plugins.plugin import PluginCSVFormat class CSVParser: def __init__(self, csv_output, logger): self.logger = logger self.host_data = [ "host_description", "os", "mac", "hostnames", "host_tags" ] self.service_data = [ "service_name", "service_description", "version", "service_status", "service_tags" ] self.vuln_data = [ "name", "desc", "refs", "severity", "resolution", "data", "external_id", "confirmed", "status", "easeofresolution", "impact_confidentiality", "impact_integrity", "impact_availability", "impact_accountability", "policyviolations", "cve", "custom_fields", "website", "path", "cwe", "cvss2_base_score", "cvss2_vector_string", "cvss3_base_score", "cvss3_vector_string", "cvss4_base_score", "cvss4_vector_string", "request", "response", "method", "pname", "params", "query", "status_code", "tags" ] self.items = self.parse_csv(csv_output) def parse_csv(self, output): items = [] csv.field_size_limit(sys.maxsize) reader = csv.DictReader(output, delimiter=',') obj_to_import = self.check_objects_to_import(reader.fieldnames) if not obj_to_import: return items if 'ip' in reader.fieldnames and 'target' not in reader.fieldnames: index = reader.fieldnames.index('ip') reader.fieldnames[index] = "target" custom_fields_names = self.get_custom_fields_names(reader.fieldnames) for row in reader: self.data = { 'row_with_service': False, 'row_with_vuln': False } # verify at least one field has data if not any(row.values()): self.logger.warning("Row with empty data found. Skipping...") continue self.build_host(row) if "service" in obj_to_import: if row['port'] and row['protocol']: self.data['row_with_service'] = True self.build_service(row) else: self.data['row_with_service'] = False if "vuln" in obj_to_import: if row['name'] and row['desc']: self.data['row_with_vuln'] = True self.build_vulnerability(row, custom_fields_names) else: self.data['row_with_service'] = False items.append(self.data) return items def check_objects_to_import(self, headers): obj_to_import = [] # From valid_headers, Faraday will define which objects to import valid_headers = [ "ip", "port", "protocol", "name", "desc", "target" ] matching_headers = set(valid_headers) & set(headers) if "ip" not in matching_headers and "target" not in matching_headers: self.logger.error("No host specified. Please, specify at least one host.") return None if "ip" in matching_headers: # Remove ip field to leave only target field matching_headers.remove("ip") if "target" not in matching_headers: matching_headers.add("target") obj_to_import.append('host') if "port" in matching_headers or "protocol" in matching_headers: port = True if "port" in matching_headers else False protocol = True if "protocol" in matching_headers else False if (port and not protocol) or (protocol and not port): self.logger.error( "Missing columns in CSV file. " "In order to import services, you need to add a column called port " " and a column called protocol." ) return None else: obj_to_import.append('service') if "name" in matching_headers or "desc" in matching_headers: vuln_name = True if "name" in matching_headers else False vuln_desc = True if "desc" in matching_headers else False if (vuln_name and not vuln_desc) or (vuln_desc and not vuln_name): self.logger.error( "Missing columns in CSV file. " "In order to import vulnerabilities, you need to add a " "column called name and a column called desc." ) return None else: obj_to_import.append('vuln') return obj_to_import @staticmethod def get_custom_fields_names(headers): custom_fields_names = [] for header in headers: match = re.match(r"cf_(\S+)", header) if match: custom_fields_names.append(match.group(1)) return custom_fields_names def build_host(self, row): self.data['target'] = row['target'] for item in self.host_data: if item == "hostnames": self.data[item] = self.build_hostnames_list(row) continue if item in row: if item == "host_tags": self.data[item] = literal_eval(row[item] if row[item] else '[]') else: self.data[item] = row[item] else: self.data[item] = None def build_service(self, row): self.data['port'] = row['port'] self.data['protocol'] = row['protocol'] for item in self.service_data: if item in row: if item == 'service_status': if row[item] == '': # If status is not specified, set it as 'open' self.data[item] = "open" continue elif item == 'service_tags': self.data[item] = literal_eval(row[item]) continue self.data[item] = row[item] else: self.data[item] = None def build_vulnerability(self, row, custom_fields_names): self.data['vuln_name'] = row['name'] self.data['vuln_desc'] = row['desc'] impact_dict = { "accountability": False, "confidentiality": False, "availability": False, "integrity": False, } if "web_vulnerability" in row: self.data['web_vulnerability'] = True if row['web_vulnerability'].capitalize() == "True" else False else: self.data['web_vulnerability'] = False for item in self.vuln_data: if item in row: if "impact_" in item: impact = re.match(r"impact_(\w+)", item).group(1) impact_dict[impact] = True if row[item].capitalize() == "True" else False elif item in ["refs", "policyviolations", "cve", "tags"]: self.data[item] = literal_eval(row[item] if row[item] else '[]') elif "confirmed" in item: self.data[item] = True if row[item].capitalize() == "True" else False else: self.data[item] = row[item] else: self.data[item] = None self.data['impact'] = impact_dict self.data['custom_fields'] = self.parse_custom_fields(row, custom_fields_names) def build_hostnames_list(self, row): hostnames = [] if "hostnames" in row: try: hostnames = literal_eval(row['hostnames']) except (ValueError, SyntaxError): self.logger.error("Hostname not valid. Faraday will set it as empty.") return hostnames @staticmethod def parse_vuln_impact(impact): impacts = [ "accountability", "confidentiality", "availability", "integrity" ] for item in impacts: if item in impact: return item @staticmethod def parse_custom_fields(row, custom_fields_names): if not row: return {} custom_fields = {} for cf_name in custom_fields_names: cf_value = row["cf_" + cf_name] try: custom_fields[cf_name] = literal_eval(cf_value) except (ValueError, SyntaxError): custom_fields[cf_name] = cf_value return custom_fields class FaradayCSVPlugin(PluginCSVFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "faraday_csv" self.name = "Faraday CSV Plugin" self.plugin_version = "1.0" self.csv_headers = [{'ip'}, {'target'}] def _parse_filename(self, filename): with open(filename, **self.open_options) as output: self.parseOutputString(output) def parseOutputString(self, output): parser = CSVParser(output, self.logger) for item in parser.items: h_id = self.createAndAddHost( name=item['target'], os=item['os'], hostnames=item['hostnames'], mac=item['mac'], description=item['host_description'] or "", tags=item['host_tags'] ) s_id = None if item['row_with_service']: s_id = self.createAndAddServiceToHost( h_id, name=item['service_name'], protocol=item['protocol'], ports=item['port'], status=item['service_status'] or None, version=item['version'], description=item['service_description'], tags=item['service_tags'] ) if item['row_with_vuln']: cvss2 = { "base_score": item['cvss2_base_score'], } if item['cvss2_vector_string']: cvss2["vector_string"]= item['cvss2_vector_string'] cvss3 = { "base_score": item['cvss3_base_score'], } if item['cvss3_vector_string']: cvss3["vector_string"]= item['cvss3_vector_string'] cvss4 = { "base_score": item['cvss4_base_score'], } if item['cvss4_vector_string']: cvss4["vector_string"]= item['cvss4_vector_string'] if not item['web_vulnerability'] and not s_id: self.createAndAddVulnToHost( h_id, name=item['vuln_name'], desc=item['vuln_desc'], ref=item['refs'], severity=item['severity'], resolution=item['resolution'], data=item['data'], external_id=item['external_id'], confirmed=item['confirmed'], status=item['status'] or "", easeofresolution=item['easeofresolution'] or None, impact=item['impact'], policyviolations=item['policyviolations'], cve=item['cve'], cwe=item['cwe'], cvss2=cvss2, cvss3=cvss3, cvss4=cvss4, custom_fields=item['custom_fields'], tags=item['tags'] ) if not item['web_vulnerability'] and s_id: self.createAndAddVulnToService( h_id, s_id, name=item['vuln_name'], desc=item['vuln_desc'], ref=item['refs'], severity=item['severity'], resolution=item['resolution'], data=item['data'], external_id=item['external_id'], confirmed=item['confirmed'], status=item['status'] or "", easeofresolution=item['easeofresolution'] or None, impact=item['impact'], policyviolations=item['policyviolations'], cve=item['cve'], cwe=item['cwe'], cvss2=cvss2, cvss3=cvss3, cvss4=cvss4, custom_fields=item['custom_fields'], tags=item['tags'] ) elif item['web_vulnerability']: self.createAndAddVulnWebToService( h_id, s_id, name=item['vuln_name'], desc=item['vuln_desc'], ref=item['refs'], severity=item['severity'], resolution=item['resolution'], website=item['website'], path=item['path'], request=item['request'], response=item['response'], method=item['method'], pname=item['pname'], params=item['params'], query=item['query'], data=item['data'], external_id=item['external_id'], confirmed=item['confirmed'], status=item['status'] or "", easeofresolution=item['easeofresolution'] or None, impact=item['impact'], policyviolations=item['policyviolations'], cve=item['cve'], cwe=item['cwe'], cvss2=cvss2, cvss3=cvss3, cvss4=cvss4, status_code=item['status_code'] or None, custom_fields=item['custom_fields'], tags=item['tags'] ) def createPlugin(*args, **kwargs): return FaradayCSVPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/faraday_json/000077500000000000000000000000001505357635700252265ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/faraday_json/__init__.py000066400000000000000000000000011505357635700273260ustar00rootroot00000000000000 faraday_plugins-1.26.0/faraday_plugins/plugins/repo/faraday_json/plugin.py000066400000000000000000000040241505357635700270760ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2020 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import json from faraday_plugins.plugins.plugin import PluginJsonFormat __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2020, Infobyte LLC" __credits__ = ["Gonzalo Martinez"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmartinez@faradaysec.com" __status__ = "Development" class FaradayJsonPlugin(PluginJsonFormat): ''' This is a plugin for Faraday's Pluin output ''' def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Faraday_JSON" self.name = "Faraday Json" self.plugin_version = "1.0.0" self.json_keys = {'hosts', 'command'} def parseOutputString(self, output): parser = json.loads(output) for host in parser.pop('hosts'): services = host.pop('services', []) vulns = host.pop('vulnerabilities', []) host['name'] = host.pop('ip', '') host.pop('credentials', '') host_id = self.createAndAddHost(**host) for vuln in vulns: vuln['ref'] = vuln.pop('refs', '') vuln.pop('type', '') vuln.pop('run_date', '') self.createAndAddVulnToHost(host_id=host_id, **vuln) for service in services: vulns = service.pop('vulnerabilities', []) service['ports'] = service.pop('port', '') service.pop('credentials', '') service_id = self.createAndAddServiceToHost(host_id=host_id, **service) for vuln in vulns: vuln['ref'] = vuln.pop('refs', '') vuln.pop('type', '') vuln.pop('run_date', '') self.createAndAddVulnWebToService(host_id=host_id, service_id=service_id, **vuln) def createPlugin(*args, **kwargs): return FaradayJsonPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/fierce/000077500000000000000000000000001505357635700240235ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/fierce/__init__.py000066400000000000000000000002351505357635700261340ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/fierce/plugin.py000066400000000000000000000126751505357635700257060ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re from faraday_plugins.plugins.plugin import PluginBase __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" valid_records = ["NS", "CNAME", "A"] class FierceParser: """ The objective of this class is to parse an shell output generated by the fierce tool. TODO: Handle errors. TODO: Test fierce output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param fierce_filepath A proper simple report generated by fierce """ def __init__(self, output): self.target = None self.items = [] regex = re.search( "DNS Servers for ([\\w\\.-]+):\n([^$]+)Trying zone transfer first...", output) if regex is not None: self.target = regex.group(1) mstr = re.sub("\t", "", regex.group(2)) self.dns = list(filter(None, mstr.splitlines())) regex = re.search( "Now performing [\\d]+ test\\(s\\)...\n([^$]+)\nSubnets found ", output) if regex is not None: hosts_list = regex.group(1).splitlines() for i in hosts_list: if i != "": mstr = i.split("\t") host = mstr[1] record = "A" ip = mstr[0] self.add_host_info_to_items(ip, host, record) self.isZoneVuln = False output = output.replace('\\$', '') regex = re.search( "Whoah, it worked - misconfigured DNS server found:([^$]+)\nThere isn't much point continuing, " "you have everything.", output) if regex is not None: self.isZoneVuln = True dns_list = regex.group(1).splitlines() for i in dns_list: if i != "": mstr = i.split() if (mstr and mstr[0] != "" and len(mstr) > 3 and mstr[3] in valid_records): host = mstr[0] record = mstr[3] ip = mstr[4] self.add_host_info_to_items(ip, host, record) def add_host_info_to_items(self, ip_address, hostname, record): data = {} exists = False for item in self.items: if ip_address in item['ip']: item['hosts'].append(hostname) exists = True if not exists: data['ip'] = ip_address data['hosts'] = [hostname] data['record'] = record self.items.append(data) class FiercePlugin(PluginBase): """ Example plugin to parse fierce output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Fierce" self.name = "Fierce Output Plugin" self.plugin_version = "0.0.1" self.version = "0.9.9" self.options = None self._current_output = None self._command_regex = re.compile( r'^(sudo fierce|fierce|sudo fierce\.pl|fierce\.pl|perl fierce\.pl|\.\/fierce\.pl)\s+.*?') def resolveCNAME(self, item, items): for i in items: if (item['ip'] in i['hosts']): item['ip'] = i['ip'] return item try: item['ip'] = self.resolve_hostname(item['ip']) except: # nosec pass return item def resolveNS(self, item, items): try: item['hosts'][0] = item['ip'] item['ip'] = self.resolve_hostname(item['ip']) except: # nosec pass return item def parseOutputString(self, output): parser = FierceParser(output) for item in parser.items: item['isResolver'] = False item['isZoneVuln'] = False if item['record'] == "CNAME": self.resolveCNAME(item, parser.items) if item['record'] == "NS": self.resolveNS(item, parser.items) item['isResolver'] = True item['isZoneVuln'] = parser.isZoneVuln for item2 in parser.items: if item['ip'] == item2['ip'] and item != item2: item2['isResolver'] = item['isResolver'] item2['isZoneVuln'] = item['isZoneVuln'] item['ip'] = '' for item in parser.items: if item['ip'] == "127.0.0.1" or item['ip'] == '': continue h_id = self.createAndAddHost( item['ip'], hostnames=item['hosts']) if item['isResolver']: s_id = self.createAndAddServiceToHost( h_id, "domain", "tcp", ports=['53']) if item['isZoneVuln']: self.createAndAddVulnToService( h_id, s_id, "Zone transfer", desc="A Dns server allows unrestricted zone transfers", ref=["CVE-1999-0532"]) def createPlugin(*args, **kwargs): return FiercePlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/fortify/000077500000000000000000000000001505357635700242505ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/fortify/__init__.py000066400000000000000000000000001505357635700263470ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/fortify/plugin.py000066400000000000000000000357261505357635700261350ustar00rootroot00000000000000import base64 import io import re import html from zipfile import ZipFile import html2text from lxml import objectify from faraday_plugins.plugins.plugin import PluginByExtension class FortifyPlugin(PluginByExtension): """ Example plugin to parse nmap output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Fortify" self.name = "Fortify XML Output Plugin" self.plugin_version = "0.0.1" self.extension = ".fpr" self.open_options = {"mode": "rb"} def _process_fvdl_vulns(self, fp): for host in fp.hosts.keys(): fp.hosts[host] = self.createAndAddHost(host) for vuln_key, vuln in fp.vulns.items(): self.createAndAddVulnToHost( host_id=fp.hosts[vuln['host']], name=vuln['name'], desc=fp.format_description(vuln_key), ref=fp.descriptions[vuln['class']]['references'], severity=vuln['severity'], resolution="", data="", external_id=vuln_key.text ) def _process_webinspect_vulns(self, fp): for vuln_data in fp.sast_vulns: host_id = self.createAndAddHost( vuln_data['host'] or vuln_data['website']) service_name = vuln_data['service'].get('name', 'unknown') protocol_name = 'line number' if vuln_data['service']['port'] == '443': service_name = 'https' protocol_name = 'tcp' if vuln_data['service']['port'] == '80': service_name = 'http' protocol_name = 'tcp' service_id = self.createAndAddServiceToHost( host_id, service_name, protocol=protocol_name, ports=[vuln_data['service']['port']]) self.createAndAddVulnWebToService( host_id, service_id, vuln_data['name'], website=vuln_data['website'] or '', path=vuln_data['path'] or '', query=vuln_data['query'] or '', method=vuln_data['method'] or '', request=vuln_data['request'] or '', ref=vuln_data['references'], response=vuln_data['response'] or '', desc=vuln_data['description'], #resolution=vuln_data[''], severity=vuln_data['severity'] ) def parseOutputString(self, output): fp = FortifyParser(output) if fp.fvdl is not None: self._process_fvdl_vulns(fp) if fp.webinspect is not None: self._process_webinspect_vulns(fp) return True class FortifyParser: """ Parser for fortify on demand """ def __init__(self, output): self.vulns = {} self.sast_vulns = [] self.hosts = {} self.fvdl = None self.webinspect = None self.audit = None self.suppressed = [] self.vuln_classes = [] self.descriptions = {} self._uncompress_fpr(output) self._extract_vulns() self._prepare_description_templates() # regexes used in format_description self.remove_extra_chars = re.compile(r'&(\w*);') self.replacements_idx = re.compile(r'') self.replacements_holders = re.compile(r'') self.replacements_idx2 = re.compile(r'') def _uncompress_fpr(self, output): with ZipFile(io.BytesIO(output)) as fprcontent: try: self.fvdl = objectify.fromstring(fprcontent.read('audit.fvdl')) except KeyError: pass try: self.webinspect = objectify.fromstring(fprcontent.read('webinspect.xml')) except KeyError: pass try: self.audit = objectify.fromstring(fprcontent.read('audit.xml')) except KeyError: pass def _process_fvdl(self): for vuln in self.fvdl.Vulnerabilities.iterchildren(): vulnID = vuln.InstanceInfo.InstanceID if vulnID in self.suppressed: continue self.vulns[vulnID] = {} # the last children of Primary (Entry tags) always contains vuln filename ,path and line _last_entry = None for _last_entry in vuln.AnalysisInfo.Unified.Trace.Primary.iterchildren(): pass path = _last_entry.Node.SourceLocation.get('path') self.vulns[vulnID]['host'] = path self.vulns[vulnID]['name'] = "{} {}".format(vuln.ClassInfo.Type, getattr(vuln.ClassInfo, "Subtype", "")) self.vulns[vulnID]['class'] = vuln.ClassInfo.ClassID self.vulns[vulnID]['replacements'] = {} self.vulns[vulnID]['severity'] = self.calculate_severity(vuln) # placeholder for storing hosts ids when created in main plugin method if path not in self.hosts.keys(): self.hosts[path] = None if vuln.ClassInfo.ClassID not in self.vuln_classes: self.vuln_classes.append(vuln.ClassInfo.ClassID) # fortify bug that when it has no replacements, shows blank in fortify dashboard if not hasattr(vuln.AnalysisInfo.Unified, "ReplacementDefinitions"): self.vulns[vulnID]['replacements'] = None continue try: getattr(vuln.AnalysisInfo.Unified, "ReplacementDefinitions") for repl in vuln.AnalysisInfo.Unified.ReplacementDefinitions.iterchildren( tag="{xmlns://www.fortifysoftware.com/schema/fvdl}Def"): repl_val = repl.get('key') if repl.get('link'): repl_val = repl.get('link') self.vulns[vulnID]['replacements'][repl_val] = repl.get('value') except AttributeError: self.vulns[vulnID]['replacements'] = None def _process_webinspect(self): for session in self.webinspect.getchildren(): hostname = session.Host.text port = session.Port.text service_data = {} if port: service_data['port'] = port path = session.Request.Path.text query = session.Request.FullQuery.text method = session.Request.Method.text request = '' if session.RawRequest.text: request = base64.b64decode(session.RawRequest.text) response = '' if session.RawResponse.text: response = base64.b64decode(session.RawResponse.text) status_code = session.Response.StatusCode.text for issues in session.Issues: for issue_data in issues.getchildren(): params = '' check_type = issue_data.CheckTypeID if check_type.text.lower() != 'vulnerability': # TODO: when plugins accept tags, we should this as a tag. pass name = issue_data.Name.text external_id = issue_data.VulnerabilityID.text faraday_severities = { 0: 'info', 1: 'low', 2: 'med', 3: 'high', 4: 'critical' } severity = faraday_severities[issue_data.Severity] references = [] try: classifications = issue_data.Classifications.getchildren() except AttributeError: classifications = [] for classification in classifications: references.append(classification.text) # Build description description = '' for report_section in issue_data.findall('./ReportSection'): description += f'{report_section.Name.text} \n' description += f'{report_section.SectionText.text} \n' description += f'{issue_data.get("id")} \n' h = html2text.HTML2Text() description = h.handle(description) for repro_step in issue_data.findall('./ReproSteps'): step = repro_step.ReproStep if step is not None: try: params = step.PostParams.text except AttributeError: pass if not hostname: # This seems to be a mobile app hostname = session.URL.text if not port: service_data['name'] = step.Url.text service_data['port'] = step.sourceline self.sast_vulns.append({ "host": hostname, "severity": severity, "service": service_data, "name": name, "description": description, "external_id": external_id, "references": references, "method": method, "query": query, "response": response, "request": request.decode('utf-8'), "path": path, "params": params, "status_code": status_code, "website": session.URL.text }) def _extract_vulns(self): # make list of false positives try: issue_list = self.audit.IssueList.iterchildren() except AttributeError: issue_list = [] for issue in issue_list: if issue.get('suppressed', 'false').lower() == 'true': self.suppressed.append(issue.get('instanceId')) if self.fvdl is not None: self._process_fvdl() if self.webinspect is not None: self._process_webinspect() def calculate_severity(self, vuln): severity = None # ["critical", "high", "medium", "low", "informational", "unclassified"] rulepath = objectify.ObjectPath("FVDL.EngineData.RuleInfo.Rule") impact = None probability = None accuracy = None # XML path /FVDL/EngineData/RuleInfo/Rule (many)/MetaInfo/Group (many) the attribute "name" # are keys for vuln properties for rule in rulepath(self.fvdl): if rule.get('id') == vuln.ClassInfo.ClassID: for group in rule.MetaInfo.iterchildren(): if group.get('name') == "Probability": probability = group if group.get('name') == "Impact": impact = group if group.get('name') == "Accuracy": accuracy = group likelihood = (accuracy * vuln.InstanceInfo.Confidence * probability) / 25 if impact and probability: if impact >= 2.5 and likelihood >= 2.5: severity = 'critical' elif impact >= 2.5 > likelihood: severity = 'high' elif impact < 2.5 <= likelihood: severity = 'medium' elif impact < 2.5 and likelihood < 2.5: severity = 'low' else: print("missing severity") # print("{}:{}:{}".format(vuln.InstanceInfo.InstanceID, vuln.InstanceInfo.InstanceSeverity, severity)) return severity def concat_vuln_name(self, vuln): return "{} {} {}:{}".format(vuln.ClassInfo.Type, vuln.ClassInfo.Subtype, self.vulns[vuln.InstanceInfo.InstanceID]['filename'], self.vulns[vuln.InstanceInfo.InstanceID]['line']) def _prepare_description_templates(self): if self.fvdl is None: return for description in self.fvdl.Description: class_id = description.get("classID") self.descriptions[class_id] = {} if class_id not in self.vuln_classes: continue if hasattr(description, 'Tips'): tips = "\n".join(map(lambda x: x.text, description.Tips.getchildren())) else: tips = "" text = f"Summary:\n{description.Abstract}\n\nExplanation:\n{description.Explanation}\n\nRecommendations:\n{description.Recommendations}\n\nTips:{tips}" self.descriptions[description.get("classID")]['text'] = html.unescape(text) # group vuln references references = [] if hasattr(description, "References"): references_elements = description.References.getchildren() for reference in references_elements: for children in reference.getchildren(): name = children.tag.split("}")[1] value = children.text references.append(f"{name}: {value}") self.descriptions[description.get("classID")]['references'] = references def format_description(self, vulnID): text = self.descriptions[self.vulns[vulnID]['class']]['text'] replacements = self.vulns[vulnID]['replacements'] if not replacements: return text # special chars that must shown as-is, have the hmtlentity value duplicated text = self.remove_extra_chars.sub(r"&\1;", text) for placeholder in self.replacements_holders.findall(text, re.MULTILINE): torepl = '' match = self.replacements_idx2.search(placeholder) replace_with = "" if match: idx = match.group(1) if match.group(3): idx = match.group(3) _filekey = f"{idx}.file" _linekey = f"{idx}.line" text = text.replace(placeholder, "").replace( torepl.format(_filekey), replacements[_filekey]).replace( torepl.format(_linekey), replacements[_linekey]) continue try: replace_with = replacements[idx] except KeyError: # Nothing to replace, use empty string text = text.replace(placeholder, "") text = text.replace(placeholder, replace_with) text += f'{text}\n Instance ID: {vulnID} \n' h = html2text.HTML2Text() return text def createPlugin(*args, **kwargs): return FortifyPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ftp/000077500000000000000000000000001505357635700233575ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ftp/__init__.py000077500000000000000000000002351505357635700254730ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ftp/plugin.py000066400000000000000000000043551505357635700252360ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import os from faraday_plugins.plugins.plugin import PluginBase __author__ = "Javier Victor Mariano Bruno" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Javier Victor Mariano Bruno"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Javier Victor Mariano Bruno" __email__ = "mbruno@infobytesec.com" __status__ = "Development" class CmdFtpPlugin(PluginBase): """ This plugin handles ftp command. Basically detects if user was able to connect to a device """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "ftp" self.name = "Ftp" self.plugin_version = "0.0.1" self.version = "0.17" self.framework_version = "1.0.0" self.options = None self._current_output = None self._command_regex = re.compile(r'^ftp\s+.*?') self._host_ip = None self._port = "21" self._info = 0 self._version = None def parseOutputString(self, output): host_info = re.search(r"Connected to (.+)\.", output) banner = re.search(r"220?([\w\W]+)$", output) if re.search("Connection timed out", output) is None and host_info is not None: hostname = host_info.group(1) ip_address = self.resolve_hostname(hostname) self._version = banner.groups(0) if banner else "" h_id = self.createAndAddHost(ip_address, hostnames=[hostname]) s_id = self.createAndAddServiceToHost( h_id, "ftp", "tcp", ports=[self._port], status="open") return True def processCommandString(self, username, current_path, command_string): """ """ super().processCommandString(username, current_path, command_string) count_args = command_string.split() c = count_args.__len__() self._port = "21" if re.search(r"[\d]+", count_args[c - 1]): self._port = count_args[c - 1] def createPlugin(*args, **kwargs): return CmdFtpPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/gitleaks/000077500000000000000000000000001505357635700243715ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/gitleaks/__init__.py000066400000000000000000000000001505357635700264700ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/gitleaks/plugin.py000066400000000000000000000032301505357635700262370ustar00rootroot00000000000000""" Faraday Plugins Copyright (c) 2021 Faraday Security LLC (https://www.faradaysec.com/) See the file 'doc/LICENSE' for the license information """ import json from faraday_plugins.plugins.plugin import PluginJsonFormat class GitleaksPlugin(PluginJsonFormat): """ Parse gitleaks JSON output """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = 'gitleaks' self.name = 'Gitleaks' self.plugin_version = '0.1' self.version = '1.0.0' self.json_keys = {'Match', 'Secret', 'Commit', 'Author', 'Email', 'Date', 'RuleID', 'Fingerprint', 'File', 'Description'} def parseOutputString(self, output, debug=False): json_output = json.loads(output) for leak in json_output: description = f"Match: {leak.get('Match')}\n" \ f"Secret: {leak.get('Secret')}\n" \ f"Commit: {leak.get('Commit')}\n" \ f"Author: {leak.get('Author')}\n" \ f"Email: {leak.get('Email')}\n" \ f"Date: {leak.get('Date')}\n" \ f"RuleID: {leak.get('RuleID')}\n" \ f"Fingerprint: {leak.get('Fingerprint')}\n" host_id = self.createAndAddHost( name=leak.get('File'), ) self.createAndAddVulnToHost( host_id, name=leak.get('Description'), desc=description, severity='informational', status='open', ) def createPlugin(*args, **kwargs): return GitleaksPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/goohost/000077500000000000000000000000001505357635700242505ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/goohost/__init__.py000066400000000000000000000002351505357635700263610ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/goohost/plugin.py000066400000000000000000000107411505357635700261230ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import os from faraday_plugins.plugins.plugin import PluginBase __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class GoohostParser: """ The objective of this class is to parse an xml file generated by the goohost tool. TODO: Handle errors. TODO: Test goohost output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param goohost_scantype You could select scan type ip, mail or host """ def __init__(self, output, goohost_scantype, resolve_hostname): self.items = [] self.resolve_hostname = resolve_hostname lines = list(filter(None, output.split('\n'))) for line in lines: if goohost_scantype == 'ip': data = line.split() item = {'host': data[0], 'ip': data[1]} self.add_host_info_to_items(item['ip'], item['host']) elif goohost_scantype == 'host': data = line.strip() item = {'host': data, 'ip': self.resolve_hostname(data)} self.add_host_info_to_items(item['ip'], item['host']) else: item = {'data': line} def add_host_info_to_items(self, ip_address, hostname): data = {} exists = False for item in self.items: if ip_address in item['ip']: item['hosts'].append(hostname) exists = True if not exists: data['ip'] = ip_address data['hosts'] = [hostname] self.items.append(data) class GoohostPlugin(PluginBase): """ Example plugin to parse goohost output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Goohost" self.name = "Goohost XML Output Plugin" self.plugin_version = "0.0.1" self.version = "v.0.0.1" self.options = None self._command_regex = re.compile(r'^(sudo goohost\.sh|goohost\.sh|sh goohost\.sh|\.\/goohost\.sh)\s+.*?') self.host = None self._command_string = None def parseOutputString(self, output): """ This method will check if the import was made through the console or by importing a Goohost report. Import from Console:The method will take the path of the report generated by Goohost from the output the shell sends and will read the information from the txt where it expects it to be present. Import from Report: The method receives the output of the txt report as parameter. self.scantype defines the method used to generate the Goohost report """ scantype = self.define_scantype_by_output(output) parser = GoohostParser(output, scantype, self.resolve_hostname) if scantype == 'host' or scantype == 'ip': for item in parser.items: h_id = self.createAndAddHost(item['ip'], hostnames=item['hosts']) del parser def define_scantype_by_command(self, command): method_regex = re.compile(r'-m (mail|host|ip)') method = method_regex.search(command) if method: return method.group(1) return 'host' def define_scantype_by_output(self, output): lines = output.split('\n') line = lines[0].split(' ') if len(line) == 1: return 'host' elif len(line) == 2: return 'ip' def get_report_path_from_output(self, command_output): report_name = re.search(r"Results saved in file (\S+)", command_output) if not report_name: return False else: self._output_file_path = os.path.join(self._current_path, report_name.group(1)) if not os.path.exists(self._output_file_path): return False else: self._delete_temp_file = True def processOutput(self, command_output): self.get_report_path_from_output(command_output) if self.has_custom_output(): self._parse_filename(self.get_custom_file_path()) else: self.parseOutputString(command_output) def createPlugin(*args, **kwargs): return GoohostPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/grype/000077500000000000000000000000001505357635700237145ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/grype/__init__.py000066400000000000000000000000001505357635700260130ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/grype/plugin.py000066400000000000000000000111321505357635700255620ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import json import re from faraday_plugins.plugins.plugin import PluginJsonFormat __author__ = "Joachim Bauernberger" __license__ = "MIT" __version__ = "1.0.0" __maintainer__ = "Joachim Bauernberger" __email__ = "joachim.bauernberger@protonmail.com" __status__ = "Development" class GrypePlugin(PluginJsonFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = 'grype' self.name = 'Grype JSON Plugin' self.plugin_version = '1.0.0' self._command_regex = re.compile(r'^grype\s+.*') self._use_temp_file = True self._temp_file_extension = "json" self.json_keys = [{"source", "matches", "descriptor"}, {"matches", "image"}] def parseOutputString(self, output, debug=True): grype_json = json.loads(output) if "userInput" in grype_json.get("source", {"target": ""}).get("target"): name = grype_json["source"]["target"]["userInput"] host_type = grype_json['source']['type'] elif "tags" in grype_json.get("image", {}): name = " ".join(grype_json["image"]["tags"]) host_type = "Docker Image" else: name = grype_json["source"]["target"] host_type = grype_json['source']['type'] host_id = self.createAndAddHost(name, description=f"Type: {host_type}") for match in grype_json['matches']: name = match.get('vulnerability').get('id') cve = name references = [] if match.get("relatedVulnerabilities"): description = match["relatedVulnerabilities"][0].get('description') references.append(match["relatedVulnerabilities"][0]["dataSource"]) related_vuln = match["relatedVulnerabilities"][0] severity = related_vuln["severity"].lower().replace("negligible", "info") if related_vuln.get("links"): for url in related_vuln["links"]: references.append(url) else: for url in related_vuln["urls"]: references.append(url) else: description = match.get('vulnerability').get('description', "Issues provided no description") severity = match.get('vulnerability').get('severity').lower().replace("negligible", "info") if match.get('vulnerability').get("links"): for url in match.get('vulnerability')["links"]: references.append(url) else: for url in match.get('vulnerability')["urls"]: references.append(url) if not match['artifact'].get('metadata'): data = f"Artifact: {match['artifact']['name']}" \ f"Version: {match['artifact']['version']} " \ f"Type: {match['artifact']['type']}" else: if "Source" in match['artifact']['metadata']: data = f"Artifact: {match['artifact']['name']} [{match['artifact']['metadata']['Source']}] " \ f"Version: {match['artifact']['version']} " \ f"Type: {match['artifact']['type']}" elif "VirtualPath" in match['artifact']['metadata']: data = f"Artifact: {match['artifact']['name']} [{match['artifact']['metadata']['VirtualPath']}] " \ f"Version: {match['artifact']['version']} " \ f"Type: {match['artifact']['type']}" else: data = f"Artifact: {match['artifact']['name']}" \ f"Version: {match['artifact']['version']} " \ f"Type: {match['artifact']['type']}" self.createAndAddVulnToHost(host_id, name=name, desc=description, ref=references, severity=severity, data=data, cve=cve) def processCommandString(self, username, current_path, command_string): super().processCommandString(username, current_path, command_string) command_string += f" -o json --file {self._output_file_path}" return command_string def createPlugin(*args, **kwargs): return GrypePlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/hping3/000077500000000000000000000000001505357635700237565ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/hping3/__init__.py000066400000000000000000000002351505357635700260670ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/hping3/plugin.py000066400000000000000000000050311505357635700256250ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2017 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginBase import re __author__ = "Roberto Focke" __copyright__ = "Copyright (c) 2017, Infobyte LLC" __license__ = "" __version__ = "1.0.0" class hping3(PluginBase): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Hping3" self.name = "hping3" self.plugin_version = "0.0.1" self.version = "1.0.0" self.srv = {'21': ' ftp', '80': 'http', '143': 'imap', '1433': 'mssql', '3306': 'mysql', '524': 'ncp', '119': 'nntp', '5631': 'pcanywhere', '110': 'pop3', '5432': 'postgres', '512': 'rexec', '513': 'rlogin', '514': 'rsh', '25': 'smtp', '161': 'snmp', '22': 'ssh', '3690': 'svn', '23': 'telnet', '5900': 'vnc'} self._command_regex = re.compile(r'^(sudo hping3|hping3)\s+.*$') def parseOutputString(self, output): regex_ipv4 = re.search(r"(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}" r"|2[0-4][0-9]|25[0-5])\)\:", output) if regex_ipv4: ip_address = regex_ipv4.group(0).rstrip("):") # Regex pls else: # Exit plugin, ip address not found. bad output self.logger.warning("Abort plugin: Ip address not found", "INFO") return hostname = output.split(" ")[1] host_id = self.createAndAddHost(ip_address, hostnames=[hostname]) if re.match("HPING", output): sport = re.search(r"sport=(\d{1,6})", output) ssport = [sport.group(1)] reci = re.search(r"flags=(\w{2,3})", output) service = self.srv[sport.group(1)] if reci.group(1) == "SA": s_id = self.createAndAddServiceToHost( host_id, service, protocol="tcp", ports=ssport, status="open") lineas = output.split("\n") for linea in lineas: if (re.match(" ", linea)): list = re.findall(r"\w+", linea) service = list[1] port = [list[0]] if list[2] == "S" and list[3] == "A": s_id = self.createAndAddServiceToHost( host_id, service, protocol="tcp", ports=port, status="open") def createPlugin(*args, **kwargs): return hping3(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/hydra/000077500000000000000000000000001505357635700236755ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/hydra/__init__.py000066400000000000000000000002351505357635700260060ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/hydra/plugin.py000066400000000000000000000077311505357635700255550ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginBase import re from collections import defaultdict __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class HydraParser: """ The objective of this class is to parse an xml file generated by the hydra tool. @param hydra_filepath A proper simple report generated by hydra """ def __init__(self, xml_output): lines = xml_output.splitlines() self.items = [] for line in lines: reg = re.search( r"\[([^$]+)\]\[([^$]+)\] host: ([^$]+) login: ([^$]+) password: ([^$]+)", line) if reg: item = { 'port': reg.group(1), 'plugin': reg.group(2), 'ip': reg.group(3), 'login': reg.group(4), 'password': reg.group(5)} self.items.append(item) class HydraPlugin(PluginBase): """ Example plugin to parse hydra output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Hydra" self.name = "Hydra XML Output Plugin" self.plugin_version = "0.0.1" self.version = "7.5" self.options = None self._command_regex = re.compile(r'^(sudo hydra|sudo \.\/hydra|hydra|\.\/hydra)\s+.*?') self.host = None self._use_temp_file = True self._temp_file_extension = "txt" self.xml_arg_re = re.compile(r"^.*(-o\s*[^\s]+).*$") def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ parser = HydraParser(output) hosts = defaultdict(list) service = '' port = '' for item in parser.items: service = item['plugin'] port = item['port'] hosts[item['ip']].append([item['login'], item['password']]) for k, v in hosts.items(): ip = self.resolve_hostname(k) if ip != k: hostnames = [k] else: hostnames = None h_id = self.createAndAddHost(ip, hostnames=hostnames) s_id = self.createAndAddServiceToHost( h_id, service, ports=[port], protocol="tcp", status="open") for cred in v: self.createAndAddCredToService( h_id, s_id, cred[0], cred[1]) self.createAndAddVulnToService( h_id, s_id, "Weak Credentials", f"[hydra found the following credentials]\nuser:{cred[0]}\npass:{cred[1]}", severity="high") del parser def processCommandString(self, username, current_path, command_string): super().processCommandString(username, current_path, command_string) arg_match = self.xml_arg_re.match(command_string) if arg_match is None: return re.sub(r"(^.*?hydra?)", r"\1 -o %s" % self._output_file_path, command_string) else: return re.sub(arg_match.group(1), r"-o %s" % self._output_file_path, command_string) def _isIPV4(self, ip): if len(ip.split(".")) == 4: return True else: return False def createPlugin(*args, **kwargs): return HydraPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/impact/000077500000000000000000000000001505357635700240435ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/impact/__init__.py000066400000000000000000000002351505357635700261540ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/impact/plugin.py000066400000000000000000000224251505357635700257200ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import xml.etree.ElementTree as ET from faraday_plugins.plugins.plugin import PluginXMLFormat from faraday_plugins.plugins.plugins_utils import CVE_regex __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class ImpactXmlParser: """ The objective of this class is to parse an xml file generated by the impact tool. TODO: Handle errors. TODO: Test impact output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param impact_xml_filepath A proper xml generated by impact """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) if tree: self.items = self.get_items(tree) else: self.items = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: tree = ET.fromstring(xml_output) except SyntaxError as err: return None return tree def get_items(self, tree): """ @return items A list of Host instances """ for node in tree.findall("entity/[@class='host']"): yield Item(node, tree) class Item: """ An abstract representation of a Item @param item_node A item_node taken from an impact xml tree """ def __init__(self, item_node, parent=None): self.node = item_node self.arch = self.get_text_from_subnode("property/[@key='arch']") self.host = self.get_text_from_subnode( "property/[@key='display_name']") self.ip = self.get_text_from_subnode("property/[@key='ip']") self.os = self.get_text_from_subnode( "property/[@key='os']/property/[@key='entity name']") self.ports = [] self.services = [] self.process_ports(item_node) self.process_services(item_node) self.agent = False for node in parent.findall("entity/[@class='agent']"): self.node = node agentip = node.get('name').split("/")[1] if self.ip == agentip: self.agentip = agentip self.ipfrom = self.get_text_from_subnode( "property/[@key='Connection Properties']/property/[@key='ip']") or agentip self.agentype = node.get("type") self.agentport = self.get_text_from_subnode( "property/[@key='Connection Properties']//property/[@key='port']") or "" self.agentsubtype = self.get_text_from_subnode( "property/[@key='Connection Properties']//property/[@key='subtype']") or "" self.agentcon = self.get_text_from_subnode( "property/[@key='Connection Properties']//property/[@key='type']") or "" self.agent = True break self.results = self.getResults(item_node) def process_ports(self, item_node): for p in item_node.findall("property/[@key='tcp_ports']/property/[@type='port']"): self.ports.append({'port': p.get('key'), 'protocol': "tcp", 'status': "open" if p.text == "listen" else p.text}) for p in item_node.findall("property/[@key='udp_ports']/property/[@type='port']"): self.ports.append({'port': p.get('key'), 'protocol': "udp", 'status': "open" if p.text == "listen" else p.text}) def process_services(self, item_node): for service in item_node.findall("property/[@key='services']/property"): service_name = service.get("key") port, protocol = service.findall('property')[0].get('key').split('-') self.services.append({ "name": service_name, "protocol": protocol, "port": port }) def getResults(self, tree): """ :param tree: """ for self.issues in tree.findall("property/[@key='Vulnerabilities']/property/[@type='container']"): yield Results(self.issues) # 2017R1 compatibility for self.issues in tree.findall("property/[@key='exposures']/property/[@type='container']"): yield Results(self.issues) def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: return sub_node.text return None class Results: def __init__(self, issue_node): self.node = issue_node match = CVE_regex.match(issue_node.get("key", "")) if match: self.ref = [] self.cve = [match.group()] else: self.ref = [issue_node.get("key")] self.cve = [] self.severity = "" self.port = "Unknown" self.service_name = "n/a" self.protocol = "tcp?" vuln = issue_node.find("property/property") if not vuln: # 2017R1 compatibility self.ref = [] vuln = issue_node.find("property") self.name = self.get_text_from_subnode("property/[@key='title']") self.desc = self.get_text_from_subnode("property/[@key='description']") self.severity = self.get_text_from_subnode("property/[@key='severity']") self.service_name = self.get_text_from_subnode("property/[@key='service']") else: # 2013R3 xml version self.name = vuln.get("key") self.node = vuln self.desc = self.get_text_from_subnode("property/[@key='description']") self.port = self.get_text_from_subnode("property/[@key='port']") def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: return sub_node.text return None class ImpactPlugin(PluginXMLFormat): """ Example plugin to parse impact output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "entities" self.id = "CoreImpact" self.name = "Core Impact XML Output Plugin" self.plugin_version = "0.0.2" self.version = "Core Impact 2013R1/2017R2" self.framework_version = "1.0.0" self.options = None def parseOutputString(self, output): parser = ImpactXmlParser(output) mapped_services = {} mapped_ports = {} for item in parser.items: os_string = f"{item.os} {item.arch}" h_id = self.createAndAddHost(item.ip, os=os_string, hostnames=[item.host]) for service in item.services: s_id = self.createAndAddServiceToHost( h_id, service['name'], service['protocol'], ports=[service['port']], status='open') mapped_services[service['name']] = s_id mapped_ports[service['port']] = s_id if item.agent: desc = "Agent Type: " + item.agentype desc += "\nConn from:" + item.ipfrom desc += "\nPort:" + item.agentport desc += "\nProtocol:" + item.agentsubtype desc += "\nConn:" + item.agentcon self.createAndAddVulnToHost( h_id, "Core Impact Agent", desc=desc, severity="HIGH") for v in item.results: if v.service_name == "n/a" and v.port == "Unknown": self.createAndAddVulnToHost( h_id, v.name, desc=v.desc, severity=v.severity, ref=v.ref, cve=v.cve) else: s_id = mapped_services.get(v.service_name) or mapped_ports.get(v.port) self.createAndAddVulnToService( h_id, s_id, v.name, desc=v.desc, severity=v.severity, ref=v.ref, cve=v.cve) for p in item.ports: s_id = self.createAndAddServiceToHost( h_id, p['port'], p['protocol'], ports=[p['port']], status=p['status']) del parser def createPlugin(*args, **kwargs): return ImpactPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/invicti/000077500000000000000000000000001505357635700242335ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/invicti/DTO.py000066400000000000000000000063461505357635700252440ustar00rootroot00000000000000from typing import List class Cvss3: def __init__(self, node): self.node = node @property def vector(self) -> str: return self.node.find('vector').text class Reference: def __init__(self, node): self.node = node @property def owasp(self) -> str: return self.node.find('owasp').text @property def wasc(self) -> str: return self.node.find('wasc').text @property def cwe(self) -> str: return self.node.find('cwe').text @property def capec(self) -> str: return self.node.find('capec').text @property def pci32(self) -> str: return self.node.find('pci32').text @property def hipaa(self) -> str: return self.node.find('hipaa').text @property def owasppc(self) -> str: return self.node.find('owasppc').text @property def cvss3(self) -> Cvss3: return Cvss3(self.node.find("cvss31")) class Request: def __init__(self, node): self.node = node @property def method(self) -> str: return self.node.find("method").text @property def content(self) -> str: return self.node.find("content").text class Response: def __init__(self, node): self.node = node @property def content(self) -> str: return self.node.find("content").text class Vulnerability: def __init__(self, node): self.node = node @property def look_id(self) -> str: return self.node.find('LookupId').text @property def url(self) -> str: return self.node.find("url").text @property def name(self) -> str: return self.node.find('name').text @property def severity(self) -> str: sv = self.node.find('severity').text if sv == "BestPractice": sv = "Information" return sv @property def confirmed(self) -> str: return self.node.find('confirmed').text @property def description(self) -> str: return self.node.find('description').text @property def http_request(self) -> Request: return Request(self.node.find("http-request")) @property def http_response(self) -> Response: return Response(self.node.find("http-response")) @property def impact(self) -> str: return self.node.find("impact").text @property def remedial_actions(self) -> str: return self.node.find("remedial-actions").text @property def remedial_procedure(self) -> str: return self.node.find("remedial-procedure").text @property def classification(self) -> Reference: return Reference(self.node.find("classification")) class Target: def __init__(self, node): self.node = node @property def scan_id(self) -> str: return self.node.find("scan-id").text @property def url(self) -> str: return self.node.find("url").text class Invicti: def __init__(self, node): self.node = node @property def target(self) -> Target: return Target(self.node.find('target')) @property def vulnerabilities(self) -> List[Vulnerability]: return [Vulnerability(i) for i in self.node.findall('vulnerabilities/vulnerability')] faraday_plugins-1.26.0/faraday_plugins/plugins/repo/invicti/__init__.py000066400000000000000000000000001505357635700263320ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/invicti/plugin.py000066400000000000000000000113441505357635700261060ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from urllib.parse import urlsplit from bs4 import BeautifulSoup from lxml import etree from faraday_plugins.plugins.plugin import PluginXMLFormat from faraday_plugins.plugins.repo.invicti.DTO import Invicti __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Gonzalo Martinez"] __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmartinez@infobytesec.com" __status__ = "Development" class InvictiXmlParser: """ The objective of this class is to parse a xml file generated by the acunetix tool. @param invicti_xml_filepath A proper xml generated by acunetix """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) self.invicti = Invicti(tree) @staticmethod def parse_xml(xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: parser = etree.XMLParser(recover=True) tree = etree.fromstring(xml_output, parser=parser) except SyntaxError as err: print(f"SyntaxError: {err}. {xml_output}") return None return tree class InvictiPlugin(PluginXMLFormat): """ Example plugin to parse invicti output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "invicti-enterprise" self.id = "Invicti" self.name = "Invicti XML Output Plugin" self.plugin_version = "1.0.0" self.version = "9" self.framework_version = "1.0.0" self.options = None self._current_output = None self.target = None def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ parser = InvictiXmlParser(output) url = urlsplit(parser.invicti.target.url) ip = self.resolve_hostname(url.netloc) h_id = self.createAndAddHost(ip) s_id = self.createAndAddServiceToHost(h_id, url.scheme, ports=433) for vulnerability in parser.invicti.vulnerabilities: vuln = { "name": vulnerability.name, "severity": vulnerability.severity, "confirmed": vulnerability.confirmed, "desc": BeautifulSoup(vulnerability.description, features="lxml").text, "path": vulnerability.url.replace(parser.invicti.target.url, ""), "external_id": vulnerability.look_id } if vulnerability.remedial_procedure: vuln["resolution"] = BeautifulSoup(vulnerability.remedial_procedure, features="lxml").text if vulnerability.classification: references = [] if vulnerability.classification.owasp: references.append("OWASP" + vulnerability.classification.owasp) if vulnerability.classification.wasc: references.append("WASC" + vulnerability.classification.wasc) if vulnerability.classification.cwe: vuln["cwe"] = "CWE-" + vulnerability.classification.cwe if vulnerability.classification.capec: references.append("CAPEC" + vulnerability.classification.capec) if vulnerability.classification.pci32: references.append("PCI32" + vulnerability.classification.pci32) if vulnerability.classification.hipaa: references.append("HIPAA" + vulnerability.classification.hipaa) if vulnerability.classification.owasppc: references.append("OWASPPC" + vulnerability.classification.owasppc) if vulnerability.classification.cvss3.node is not None: vuln["cvss3"] = {"vector_string": vulnerability.classification.cvss3.vector} vuln["ref"] = references if vulnerability.http_response.node is not None: vuln["response"] = vulnerability.http_response.content if vulnerability.http_request.node is not None: vuln["request"] = vulnerability.http_request.content self.createAndAddVulnWebToService(h_id, s_id, **vuln) def createPlugin(*args, **kwargs): return InvictiPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ip360/000077500000000000000000000000001505357635700234275ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ip360/__init__.py000066400000000000000000000002341505357635700255370ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2018 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ip360/plugin.py000066400000000000000000000063651505357635700253110ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2018 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import csv from io import StringIO from faraday_plugins.plugins.plugin import PluginBase def calculate_severity(number): if number is None: return "info" number = float(number) # Based in CVSS V2 if 0 <= number < 4.0: return "low" elif 4.0 <= number < 7.0: return "med" elif 7.0 <= number <= 10: return "high" class Ip360Parser: def __init__(self, csv_content): self.csv_content = StringIO(csv_content.decode('ascii', 'ignore')) self.csv_reader = csv.DictReader(self.csv_content, delimiter=',', quotechar='"') def parse(self): result = [] for row in self.csv_reader: host = { "name": row.get("IP"), "os": row.get("OS") } interface = { "name": row.get("IP"), "hostname_resolution": [row.get("NetBIOS Name")], "network_segment": row.get("NetBIOS Domain"), } service = {"port": row.get("Port")} vulnerability = { "name": row.get("Vulnerability"), "description": row.get("Description"), "resolution": row.get("Remediation"), "ref": [ row.get("CVE"), "Vuln ID: " + row.get("Vulnerability ID"), "Risk: " + row.get("Risk"), "Skill: " + row.get("Skill"), "CVSS V2: " + row.get("CVSS V2"), "CVSS V3: " + row.get("CVSS V3")], "severity": row.get("CVSS V2") } result.append((host, interface, service, vulnerability)) return result class Ip360Plugin(PluginBase): """ Example plugin to parse Ip360 output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Ip360" self.name = "Ip360 CSV Output Plugin" self.plugin_version = "0.0.1" self.options = None def parseOutputString(self, output): parser = Ip360Parser(output) for host, interface, service, vulnerability in parser.parse(): h_id = self.createAndAddHost(host.get("name"), host.get("os"), hostnames=interface.get("hostname_resolution")) if service.get("port") == "-": port = "0" protocol = "unknown" else: port = service.get("port").split("/")[0] protocol = service.get("port").split("/")[1] s_id = self.createAndAddServiceToHost( h_id, service.get("port"), protocol=protocol, ports=[port]) self.createAndAddVulnToService( h_id, s_id, vulnerability.get("name"), desc=vulnerability.get("description"), resolution=vulnerability.get("resolution"), severity=calculate_severity(vulnerability.get("severity")), ref=vulnerability.get("ref")) def createPlugin(*args, **kwargs): return Ip360Plugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/junit/000077500000000000000000000000001505357635700237175ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/junit/__init__.py000066400000000000000000000002351505357635700260300ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/junit/plugin.py000066400000000000000000000104411505357635700255670ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import os from lxml import etree from faraday_plugins.plugins.plugin import PluginXMLFormat current_path = os.path.abspath(os.getcwd()) __author__ = "Thierry Beauquier" __license__ = "" __version__ = "1.0.0" __maintainer__ = "Thierry Beauquier" __email__ = "thierry.beauquier@ericsson.com" __status__ = "Development" """ This plugin has been designed to be used with python-unittest2/paramiko script to perform security compliancy verification. It enables to have displayed both security scans results (nmap, nessus, ..) and security verification compliancy (CIS-CAT, compagny's product security requirement) by Faraday-IPE This plugin requires that a element "host" is added to (sed -i 's/ """ class JunitXmlParser: """ The objective of this class is to parse an xml file generated by the junit. @param junit_xml_filepath A proper xml generated by junit """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) if tree: self.items = [data for data in self.get_items(tree)] else: self.items = [] def parse_xml(self, xml_output): """ Open and parse an xml file. @return xml_tree An xml tree instance. None if error. """ try: tree = etree.fromstring(xml_output) except SyntaxError as err: print(f"SyntaxError: {err}. {xml_output}") return None return tree def get_items(self, tree): """ @return items A list of Failure instances """ for node in tree.findall('testsuite/testcase/failure'): yield Testsuite(node) class Testsuite: def __init__(self, testsuite_node): self.node = testsuite_node self.parent = self.node.getparent() self.name = self.parent.get('name') self.host = self.parent.get('host') if self.host is None: print('host element is missing') self.host = '' self.message = self.get_text_from_subnode('message') def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.get(subnode_xpath_expr) if sub_node is not None: return sub_node return None class JunitPlugin(PluginXMLFormat): """ Example plugin to parse junit output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Junit" self.name = "Junit XML Output Plugin" self.plugin_version = "0.0.1" self.version = "" self.framework_version = "1.0.0" self.options = None self._current_output = None def parseOutputString(self, output): parser = JunitXmlParser(output) for item in parser.items: h_id = self.createAndAddHost(item.host, os="Linux") self.createAndAddVulnToHost(h_id, name=item.name, desc=item.message, ref=[], severity="High") del parser def createPlugin(*args, **kwargs): return JunitPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/kubescape/000077500000000000000000000000001505357635700245305ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/kubescape/__init__.py000066400000000000000000000000011505357635700266300ustar00rootroot00000000000000 faraday_plugins-1.26.0/faraday_plugins/plugins/repo/kubescape/plugin.py000066400000000000000000000064731505357635700264120ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2020 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import json from faraday_plugins.plugins.plugin import PluginJsonFormat __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2023, Infobyte LLC" __credits__ = ["Gonzalo Martinez"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmartinez@faradaysec.com" __status__ = "Development" SCORE_KUBESCAPE_RANGE = [(0, 1, 'info'), (1, 4, 'low'), (4, 7, 'med'), (7, 9, 'high'), (9, 10.1, 'critical')] class KubescapePlugin(PluginJsonFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Kubescape_JSON" self.name = "Kubescape Json" self.plugin_version = "1.0.0" self.version = "2.9" self.json_keys = {'clusterAPIServerInfo', 'generationTime', 'results'} self._use_temp_file = True self._temp_file_extension = "json" @staticmethod def get_severity_from_score(score): try: if not isinstance(score, float): score = float(score) for (lower, upper, severity) in SCORE_KUBESCAPE_RANGE: if lower <= score < upper: return severity except ValueError: return 'unclassified' def parseOutputString(self, output): data = json.loads(output) resources_ids = {} for resource in data['resources']: object_data = resource["object"] if 'name' in object_data: name = object_data.get('name') else: name = object_data.get('metadata', {}).get('name') resources_ids[resource['resourceID']] = name controls = data['summaryDetails']['controls'] for result in data['results']: for control in result['controls']: if not control.get('status', {}).get('status', '') == 'failed': continue h_id = self.createAndAddHost(name=resources_ids[result['resourceID']]) desc = 'Control\' Rules:\n' for rule in control['rules']: desc += f'Rule Name: {rule["name"]}\n' desc += f'Rule status: {rule["status"]}\n' if 'paths' in rule: desc += 'Paths:\n' for path in rule.get('paths', []): if 'failedPath' in path: desc += f'Failed Path: {path["failedPath"]}\n' if 'fixPath' in path: desc += f'Fix Path: {path["fixPath"]["path"]}\n' desc += f'Value: {path["fixPath"]["value"]}\n' severity = self.get_severity_from_score( controls[control['controlID']]['scoreFactor'] ) self.createAndAddVulnToHost( host_id=h_id, name=control['name'], desc=desc, severity=severity, external_id=control['controlID'], ) def createPlugin(*args, **kwargs): return KubescapePlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/lynis/000077500000000000000000000000001505357635700237245ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/lynis/__init__.py000066400000000000000000000002351505357635700260350ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2017 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/lynis/plugin.py000066400000000000000000000275571505357635700256140ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2017 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import os from collections import defaultdict from faraday_plugins.plugins.plugin import PluginByExtension from faraday_plugins.plugins.plugins_utils import filter_services, get_all_protocols class LynisLogDataExtracter(): def __init__(self, output): self.services = defaultdict(list) self.rawcontents = output def _svcHelper(self, ip, port, protocol, name): self.services[ip].append({'port': port, 'protocol': protocol, 'name': name}) def hostname(self): hostname_match = re.search('^hostname=(.+)$', self.rawcontents, re.MULTILINE) hostname = hostname_match.group(1).strip() domain_match = re.search('^domainname=(.+)$', self.rawcontents, re.MULTILINE) if domain_match: domain = domain_match.group(1).strip() return f"{hostname}.{domain}" else: return hostname def osfullname(self): name_match = re.search('^os_name=(.+)$', self.rawcontents, re.MULTILINE) name = name_match.group(1).strip() version_match = re.search('^os_version=(.+)$', self.rawcontents, re.MULTILINE) version = version_match.group(1).strip() return " ".join([name, version]) def ipv4(self): ipv4s = re.findall(r'^network_ipv4_address\[\]=(.+)$', self.rawcontents, re.MULTILINE) ipv4addrs = self.ipv4_filter(ipv4s) return ipv4addrs def ipv6(self): ipv6s = re.findall(r'^network_ipv6_address\[\]=(.+)$', self.rawcontents, re.MULTILINE) ipv6addrs = self.ipv6_filter(ipv6s) return ipv6addrs def ipv4_filter(self, ips): ip_list = [] for ip in ips: if not ip == "127.0.0.1": ip_list.append(ip) return ip_list def ipv6_filter(self, ips): ip_list = [] for ip in ips: if not ip.startswith('fe80') and not ip.startswith('::1'): ip_list.append(ip) return ip_list def kernelVersion(self): versions_dict = {} version = re.search('^os_kernel_version=(.+)$', self.rawcontents, re.MULTILINE) if version: versions_dict['Kernel Version'] = version.group(1).strip() version_full = re.search('^os_kernel_version_full=(.+)$', self.rawcontents, re.MULTILINE) if version_full: versions_dict['Kernel Version Full'] = version_full.group(1).strip() return versions_dict def listeningservices(self): line = re.findall(r'^network_listen_port\[\]=(.+)$', self.rawcontents, re.MULTILINE) # To avoid local services, we will create the following list local_services = ['*', 'localhost'] for combo in line: elements = self.clean_services(combo, local_services) if elements is not None: self._svcHelper(elements['ip'], elements['port'], elements['protocol'], elements['name']) return self.services def clean_services(self, combo, local_services): add = False if combo.count("|") > 1: # Service with url, protocol and perhaps name items_service = combo.split('|') if not self.local_service(items_service, local_services): # self.aux_items will be an auxiliar list. We will use it... # ...for poping the url and the protocol so that the last element... # ... of the list, will be the name of the service self.aux_items = list(filter(None, items_service)) elements_ip_port, count = self.get_ip_and_port(self.aux_items, remove_from_list=True) protocol = self.get_protocol() name = self.aux_items[0] add = True if name == '-': details = self.search_service(elements_ip_port[1]) name = details['name'] elif combo.count('|') == 1: # Service only with url items_service = combo.split('|') if not self.local_service(items_service, local_services): elements_ip_port, count = self.get_ip_and_port(items_service) details = self.search_service(elements_ip_port[1]) protocol = details['protocol'] name = details['name'] add = True else: items_service = combo count = items_service.count(':') elements_ip_port = items_service.split(':') details = self.search_service(elements_ip_port[1]) protocol = details['protocol'] name = details['name'] add = True if add: ip, port = self.colon_count(count, elements_ip_port, items_service) elements_dict = { "ip":ip, "port": port, "protocol": protocol, "name": name } return elements_dict else: return None def local_service(self, service_data, local_services): ip = self.get_ip_and_port(service_data)[0][0] local = True if ip not in local_services and not ip.startswith(':'): local = False return local def get_ip_and_port(self, service_data, remove_from_list=False): url_data = [url for url in service_data if ':' in url][0] count = url_data.count(':') ip_port = url_data.split(':') if remove_from_list: self.aux_items.remove(url_data) return ip_port, count def get_protocol(self): # network_listen_port variables are different in .log and .dat reports # .log: tcp4|127.0.0.1:5985|zabbix_age| # .dat: 127.0.0.1:5985|tcp4|zabbix_age| # This method will check if the protocol (from the function get_all_protocols()) # matches with the protocol that network_listen_port contains protocols = get_all_protocols() for item in protocols: protocol = [p for p in self.aux_items if item in p.lower()] if protocol: self.aux_items.remove(protocol[0]) return protocol[0] def search_service(self, port): srv = filter_services() details_dict = { 'name': 'Unknown', 'protocol': 'Unknown' } for item in srv: service_tuple = item[0].split('/') parsed_port = service_tuple[0] if parsed_port == port: details_dict['name'] = item[1] details_dict['protocol'] = service_tuple[1] return details_dict return details_dict def colon_count(self, count, elements_ip_port, items_service): #Ipv4 if count == 1: ip, port = elements_ip_port #Ipv6 elif count == 3: port = elements_ip_port[3] ip = '::' #Ipv6 elif count == 5: port = elements_ip_port[5] ip = items_service[0].replace(f':{port}', '') return ip, port def parse_suggestions(self): sugs = {} m = re.findall(r'^suggestion\[\]=(.+)$', self.rawcontents, re.MULTILINE) for combo in m: x = combo.split('|') sugs[x[0]] = x[1] return sugs def parse_warnings(self): warns = {} m = re.findall(r'^warning\[\]=(.+)$', self.rawcontents, re.MULTILINE) for combo in m: x = combo.split('|') warns[x[0]] = x[1] return warns class LynisPlugin(PluginByExtension): """ Simple example plugin to parse lynis' lynis-report.dat file.""" def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Lynis" self.name = "Lynis DAT Output Plugin" self.plugin_version = "0.4" self.version = "2.7.1" self.options = None self._command_regex = re.compile(r'^(lynis|\.\/lynis|)\s+.*?') self._hosts = [] self.extension = [".dat", ".log"] def report_belongs_to(self, **kwargs): if super().report_belongs_to(**kwargs): report_path = kwargs.get("report_path", "") with open(report_path) as f: output = f.read() return output.startswith("# Lynis Report") return False def parseOutputString(self, output): """ Lynis does not have a means to specify the location for the DAT file, which by default goes to /var/log/lynis-report.dat or /tmp/lynis-report.dat, depending on privileges. Because of that, we will extract the DAT location off lynis' output via parseOutputString(). """ lde = LynisLogDataExtracter(output) hostname = lde.hostname() ipv4s = lde.ipv4() ipv6s = lde.ipv6() kernel_versions = lde.kernelVersion() services = lde.listeningservices() suggestions = lde.parse_suggestions() warnings = lde.parse_warnings() for ipv4 in ipv4s: h_id = self.createAndAddHost(name=ipv4, os=lde.osfullname(), hostnames=[hostname]) self.create_services(h_id, services, ipv4) self.create_vulns_with_kernel(h_id, kernel_versions) self.create_vulns_with_suggestions(h_id, suggestions) self.create_vulns_with_warns(h_id, warnings) for ipv6 in ipv6s: h_id = self.createAndAddHost(name=ipv6, os=lde.osfullname(), hostnames=[hostname]) self.create_services(h_id, services, ipv6) self.create_vulns_with_kernel(h_id, kernel_versions) self.create_vulns_with_suggestions(h_id, suggestions) self.create_vulns_with_warns(h_id, warnings) def create_services(self, host_id, parsed_services, ip_version): for service_data in parsed_services[ip_version]: self.createAndAddServiceToHost(host_id=host_id, name=service_data['name'], protocol=service_data['protocol'], ports=[service_data['port']]) if '0.0.0.0' in parsed_services: for service_data in parsed_services['0.0.0.0']: self.createAndAddServiceToHost(host_id=host_id, name=service_data['name'], protocol=service_data['protocol'], ports=[service_data['port']]) def create_vulns_with_kernel(self, host_id, kernel_versions): for kernel, version in kernel_versions.items(): self.createAndAddVulnToHost( host_id=host_id, name=kernel, severity='info', desc=version ) def create_vulns_with_suggestions(self, host_id, sugs): for sug in sugs: self.createAndAddVulnToHost( host_id=host_id, name=sug, severity='med', desc=sugs[sug] ) def create_vulns_with_warns(self, host_id, warns): for warn in warns: self.createAndAddVulnToHost( host_id=host_id, name=warn, severity='high', desc=warns[warn] ) def processOutput(self, command_output): m = re.search(r'(\/.+\.dat)$', command_output, re.MULTILINE) file_path = m.group(0).strip() self._parse_filename(file_path) def createPlugin(*args, **kwargs): return LynisPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/maltego/000077500000000000000000000000001505357635700242165ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/maltego/__init__.py000066400000000000000000000002351505357635700263270ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/maltego/plugin.py000077500000000000000000000507071505357635700261020ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2015 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import xml.etree.ElementTree as ET import zipfile from faraday_plugins.plugins.plugin import PluginZipFormat __author__ = "Ezequiel Tavella" __copyright__ = "Copyright (c) 2015, Infobyte LLC" __credits__ = ["Ezequiel Tavella"] __license__ = "" __version__ = "1.0.1" __maintainer__ = "Ezequiel Tavella" __status__ = "Development" def readMtgx(mtgl_file): maltego_file_graph = "Graphs/Graph1.graphml" xml_graph = ET.parse(mtgl_file.open(maltego_file_graph)) mtgl_file.close() return xml_graph def readMtgl(mtgl_file): try: maltego_file_company = "Entities/maltego.Company.entity" maltego_file_dns = "Entities/maltego.DNSName.entity" maltego_file_domain = "Entities/maltego.Domain.entity" maltego_file_email = "Entities/maltego.EmailAddress.entity" maltego_file_ipv4 = "Entities/maltego.IPv4Address.entity" maltego_file_location = "Entities/maltego.Location.entity" maltego_file_mxrecord = "Entities/maltego.MXRecord.entity" maltego_file_nsrecord = "Entities/maltego.NSRecord.entity" maltego_file_organization = "Entities/maltego.Organization.entity" maltego_file_person = "Entities/maltego.Person.entity" maltego_file_number = "Entities/maltego.PhoneNumber.entity" maltego_file_website = "Entities/maltego.Website.entity" check_files = {} if maltego_file_company in mtgl_file.namelist(): xml_company = ET.parse(mtgl_file.open(maltego_file_company)) check_files.update({"company": xml_company}) if maltego_file_dns in mtgl_file.namelist(): xml_dns = ET.parse(mtgl_file.open(maltego_file_dns)) check_files.update({"domain": xml_dns}) if maltego_file_domain in mtgl_file.namelist(): xml_domain = ET.parse(mtgl_file.open(maltego_file_domain)) check_files.update({"domain": xml_domain}) if maltego_file_email in mtgl_file.namelist(): xml_email = ET.parse(mtgl_file.open(maltego_file_email)) check_files.update({"email": xml_email}) if maltego_file_ipv4 in mtgl_file.namelist(): xml_ipv4 = ET.parse(mtgl_file.open(maltego_file_ipv4)) check_files.update({"ipv4": xml_ipv4}) if maltego_file_location in mtgl_file.namelist(): xml_location = ET.parse(mtgl_file.open(maltego_file_location)) check_files.update({"location": xml_location}) if maltego_file_mxrecord in mtgl_file.namelist(): xml_mxrecord = ET.parse(mtgl_file.open(maltego_file_mxrecord)) check_files.update({"mxrecord": xml_mxrecord}) if maltego_file_nsrecord in mtgl_file.namelist(): xml_nsrecord = ET.parse(mtgl_file.open(maltego_file_nsrecord)) check_files.update({"nsrecord": xml_nsrecord}) if maltego_file_organization in mtgl_file.namelist(): xml_organization = ET.parse(mtgl_file.open(maltego_file_organization)) check_files.update({"organization": xml_organization}) if maltego_file_person in mtgl_file.namelist(): xml_person = ET.parse(mtgl_file.open(maltego_file_person)) check_files.update({"person": xml_person}) if maltego_file_number in mtgl_file.namelist(): xml_number = ET.parse(mtgl_file.open(maltego_file_number)) check_files.update({"number": xml_number}) if maltego_file_website in mtgl_file.namelist(): xml_web = ET.parse(mtgl_file.open(maltego_file_website)) check_files.update({"web": xml_web}) except zipfile.BadZipFile: return None mtgl_file.close() return check_files class Host: def __init__(self): self.ip = "" self.node_id = "" self.dns_name = set() self.website = "" self.netblock = "" self.location = "" self.mx_record = "" self.ns_record = "" class MaltegoParser: def __init__(self, xml_file, extension, resolve_hostname): self.resolve_hostname = resolve_hostname if extension == '.mtgx': self.xml = readMtgx(xml_file) self.nodes = self.xml.findall( "{http://graphml.graphdrawing.org/xmlns}graph/" "{http://graphml.graphdrawing.org/xmlns}node") self.edges = self.xml.findall( "{http://graphml.graphdrawing.org/xmlns}graph/" "{http://graphml.graphdrawing.org/xmlns}edge") self.list_hosts = [] self.relations = {} elif extension == '.mtgl': self.xml = readMtgl(xml_file) def getRelations(self): """ Get relations between nodes. Two ways: Source-> Target Source <- Target """ for edge in self.edges: source = edge.get("source") target = edge.get("target") if source not in self.relations: self.relations.update({source: [target]}) if target not in self.relations: self.relations.update({target: [source]}) values = self.relations[source] values.append(target) self.relations.update({source: values}) values = self.relations[target] values.append(source) self.relations.update({target: values}) def getIpAndId(self, node): # Find node ID and maltego entity node_id = node.get("id") entity = node.find( "{http://graphml.graphdrawing.org/xmlns}data/" "{http://maltego.paterva.com/xml/mtgx}MaltegoEntity") # Check if is IPv4Address if entity.get("type") not in ("maltego.IPv4Address", "maltego.Domain", "maltego.Website"): return None # Get IP value value = entity.find( "{http://maltego.paterva.com/xml/mtgx}Properties/" "{http://maltego.paterva.com/xml/mtgx}Property/" "{http://maltego.paterva.com/xml/mtgx}Value") if entity.get("type") in ("maltego.Domain", "maltego.Website"): ip = self.resolve_hostname(value.text) hostname = value.text else: ip = value.text hostname = None return {"node_id": node_id, "ip": ip, "hostname": hostname} def getNode(self, node_id): # Get node, filter by id for node in self.nodes: if node.get("id") == node_id: return node def getType(self, node): # Get type of this node entity = node.find( "{http://graphml.graphdrawing.org/xmlns}data/" "{http://maltego.paterva.com/xml/mtgx}MaltegoEntity") return entity.get("type") def getWebsite(self, target_node): # Parse Website Entity result = {"name": "", "ssl_enabled": "", "urls": ""} props = target_node.find( "{http://graphml.graphdrawing.org/xmlns}data/" "{http://maltego.paterva.com/xml/mtgx}MaltegoEntity/" "{http://maltego.paterva.com/xml/mtgx}Properties") for prop in props: name_property = prop.get("name") value = prop.find( "{http://maltego.paterva.com/xml/mtgx}Value").text if name_property == "fqdn": result["name"] = value elif name_property == "website.ssl-enabled": result["ssl_enabled"] = value elif name_property == "URLS": result["urls"] = value return result def getNetBlock(self, target_node): # Parse Netblock Entity result = {"ipv4_range": "", "network_owner": "", "country": ""} props = target_node.find( "{http://graphml.graphdrawing.org/xmlns}data/" "{http://maltego.paterva.com/xml/mtgx}MaltegoEntity/" "{http://maltego.paterva.com/xml/mtgx}Properties") for prop in props: name_property = prop.get("name") value = prop.find( "{http://maltego.paterva.com/xml/mtgx}Value").text if name_property == "ipv4-range": result["ipv4_range"] = value elif name_property == "description": result["network_owner"] = value elif name_property == "country": result["country"] = value return result def getLocation(self, target_node): # Parse Location Entity result = {"name": "", "area": "", "country_code": "", "longitude": "", "latitude": "", "area_2": ""} # Get relations with other nodes node_relations = self.relations[target_node.get("id")] # Find location node based in relation with netblock node. located = False for node_id in node_relations: target_node = self.getNode(node_id) if self.getType(target_node) == "maltego.Location": located = True break if not located: return None # Get properties and update data props = target_node.find( "{http://graphml.graphdrawing.org/xmlns}data/" "{http://maltego.paterva.com/xml/mtgx}MaltegoEntity/" "{http://maltego.paterva.com/xml/mtgx}Properties") for prop in props: name_property = prop.get("name") value = prop.find( "{http://maltego.paterva.com/xml/mtgx}Value").text if name_property == "location.name": result["name"] = value elif name_property == "location.area": result["area"] = value elif name_property == "countrycode": result["country_code"] = value elif name_property == "longitude": result["longitude"] = value elif name_property == "latitude": result["latitude"] = value elif name_property == "area": result["area_2"] = value return result def getValue(self, target_node): # Parse Entity result = {"value": ""} value = target_node.find( "{http://graphml.graphdrawing.org/xmlns}data/" "{http://maltego.paterva.com/xml/mtgx}MaltegoEntity/" "{http://maltego.paterva.com/xml/mtgx}Properties/" "{http://maltego.paterva.com/xml/mtgx}Property/" "{http://maltego.paterva.com/xml/mtgx}Value") result["value"] = value.text return result def parse(self): self.getRelations() for node in self.nodes: # Get IP Address if not continue with other node... result = self.getIpAndId(node) if not result: continue # Create host with values by default host = Host() host.ip = result.get("ip") host.node_id = result.get("node_id") if result.get("hostname"): host.dns_name.add(result.get("hostname")) # Get relations with other nodes node_relations = self.relations[host.node_id] for node_id in node_relations: # Get target node and type of node. target_node = self.getNode(node_id) target_type = self.getType(target_node) # Check type of node y add data to host... if target_type in ("maltego.DNSName", "maltego.Domain"): host.dns_name.add(self.getValue(target_node)['value']) elif target_type == "maltego.Website": host.website = self.getWebsite(target_node) elif target_type == "maltego.Netblock": host.netblock = self.getNetBlock(target_node) # Get location based in relation: netblock -> location host.location = self.getLocation(target_node) elif target_type == "maltego.MXRecord": host.mx_record = self.getValue(target_node) elif target_type == "maltego.NSRecord": host.ns_record = self.getValue(target_node) self.list_hosts.append(host) return self.list_hosts def getInfoMtgl(self, xml, name): sample_value = xml.findall(f'Properties/Fields/Field[@name="{name}"]') for data in sample_value: mtgl_data = data.find('SampleValue').text return mtgl_data class MaltegoPlugin(PluginZipFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "maltego" self.id = "Maltego" self.name = "Maltego MTGX & MTGL Output Plugin" self.plugin_version = "1.0.1" self.version = "Maltego 3.6" self.framework_version = "1.0.0" self.extension = [".mtgl", ".mtgx"] self.files_list = {"Graphs/Graph1.graphml", "Entities/maltego.Company.entity", "Entities/maltego.DNSName.entity", "Entities/maltego.Domain.entity", "Entities/maltego.EmailAddress.entity", "Entities/maltego.IPv4Address.entity", "Entities/maltego.Location.entity", "Entities/maltego.MXRecord.entity", "Entities/maltego.Organization.entity", "Entities/maltego.NSRecord.entity", "Entities/maltego.Person.entity", "Entities/maltego.PhoneNumber.entity", "Entities/maltego.Website.entity", "Entities/maltego.Hash.entity", "Entities/maltego.hashtag.entity", "Entities/maltego.TwitterUserList.entity"} def parseOutputString(self, output): if 'Graphs/Graph1.graphml' in output.namelist(): maltego_parser = MaltegoParser(output, self.extension[1], resolve_hostname=self.resolve_hostname) hosts = maltego_parser.parse() if not hosts: self.logger.warning("No hosts data found in maltego report") pass else: for host in hosts: if host.ip is None: ip = '0.0.0.0' self.logger.warning("Unknown IP") else: ip = host.ip host_id = self.createAndAddHost(ip, hostnames=list(host.dns_name)) # Create note with NetBlock information if host.netblock: try: text = f'Network owner:\n {host.netblock["network_owner"]} ' \ f'Country:\n {host.netblock["country"]}' except TypeError: text = "unknown" self.createAndAddNoteToHost(host_id=host_id, name="Netblock Information", text=text.encode('ascii', 'ignore')) # Create note with host location if host.location: try: text = f'Location:\n {host.location["name"]} \nArea:\n {host.location["area"]} ' \ f'\nArea 2:\n {host.location["area_2"]} ' \ f'\nCountry_code:\n {host.location["country_code"]} ' \ f'\nLatitude:\n {host.location["latitude"]} \nLongitude:\n {host.location["longitude"]}' except TypeError: text = "unknown" self.createAndAddNoteToHost(host_id=host_id, name="Location Information", text=text.encode('ascii', 'ignore')) # Create service web server if host.website: try: description = f'SSL Enabled: {host.website["ssl_enabled"]}' except TypeError: description = "unknown" service_id = self.createAndAddServiceToHost(host_id=host_id, name=host.website["name"], protocol="TCP:HTTP", ports=[80], description=description) try: text = f'Urls: \n {host.website["urls"]}' self.createAndAddNoteToService(host_id=host_id, service_id=service_id, name="URLs", text=text.encode('ascii', 'ignore')) except TypeError: pass if host.mx_record: self.createAndAddServiceToHost(host_id=host_id, name=host.mx_record["value"], protocol="SMTP", ports=[25], description="E-mail Server") if host.ns_record: self.createAndAddServiceToHost(host_id=host_id, name=host.ns_record["value"], protocol="DNS", ports=[53], description="DNS Server") else: maltego_parser = MaltegoParser(output, self.extension[0], resolve_hostname=self.resolve_hostname) if not maltego_parser.xml.get('domain') or not maltego_parser.xml.get('ipv4'): return if maltego_parser.xml.get('domain'): hostnames = maltego_parser.getInfoMtgl(maltego_parser.xml['domain'], 'fqdn') else: hostnames = None if maltego_parser.xml.get('ipv4'): host_ip = maltego_parser.getInfoMtgl(maltego_parser.xml['ipv4'], 'ipv4-address') host_id = self.createAndAddHost(name=host_ip, hostnames=hostnames) else: host_ip = '0.0.0.0' host_id = self.createAndAddHost(name=host_ip, hostnames=hostnames) if maltego_parser.xml.get('location'): location_name = maltego_parser.getInfoMtgl(maltego_parser.xml['location'], 'location.name') location_area = maltego_parser.getInfoMtgl(maltego_parser.xml['location'], 'location.area') location_country = maltego_parser.getInfoMtgl(maltego_parser.xml['location'], 'countrycode') location_longitude = maltego_parser.getInfoMtgl(maltego_parser.xml['location'], 'longitude') location_latitude = maltego_parser.getInfoMtgl(maltego_parser.xml['location'], 'latitude') text = f'Location:\n {location_name} \n Area:\n {location_area} \nCountry_code:\n {location_country} ' \ f'\nLatitude:\n {location_latitude} \nLongitude:\n {location_longitude}' self.createAndAddNoteToHost(host_id=host_id, name="Location Information", text=text.encode('ascii', 'ignore')) else: self.createAndAddNoteToHost(host_id=host_id, name="Location Information", text="unknown") if maltego_parser.xml.get('web'): web_name = maltego_parser.getInfoMtgl(maltego_parser.xml['web'], 'fqdn') text = f'Urls: \n {web_name}' web_port = maltego_parser.getInfoMtgl(maltego_parser.xml['web'], 'ports') if web_port is None: web_port = 80 web_ssh = maltego_parser.getInfoMtgl(maltego_parser.xml['web'], 'website.ssl-enabled') description = f'SSL Enabled: {web_ssh}' service_id = self.createAndAddServiceToHost(host_id=host_id, name=web_name, protocol="TCP:HTTP", ports=web_port, description=description) self.createAndAddNoteToService(host_id=host_id, service_id=service_id, name="URLs", text=text.encode('ascii', 'ignore')) if maltego_parser.xml.get('mxrecord'): mx_name = maltego_parser.getInfoMtgl(maltego_parser.xml['mxrecord'], 'fqdn') self.createAndAddServiceToHost(host_id=host_id, name=mx_name, protocol="SMTP", ports=[25], description="E-mail Server") if maltego_parser.xml.get('nsrecord'): ns_name = maltego_parser.getInfoMtgl(maltego_parser.xml['nsrecord'], 'fqdn') self.createAndAddServiceToHost(host_id=host_id, name=ns_name, protocol="DNS", ports=[53], description="DNS Server") def createPlugin(*args, **kwargs): return MaltegoPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/mbsa/000077500000000000000000000000001505357635700235105ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/mbsa/__init__.py000066400000000000000000000000001505357635700256070ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/mbsa/plugin.py000066400000000000000000000076711505357635700253730ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2015 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginByExtension import re from datetime import datetime __author__ = "Blas Moyano" __copyright__ = "Copyright (c) 2020, Infobyte LLC" __credits__ = ["Blas Moyano"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Blas Moyano" __status__ = "Development" class MbsaParser: def __init__(self, log_output): self.computer_name = re.search('(Computer name:) (.*[A-Z])', log_output) self.ip = re.search(r'(IP address:) ([0-9]+(?:\.[0-9]+){3})', log_output) self.scan_date = re.search('(Scan date:) (.*[0-9])', log_output) self.issues = re.findall(r'Issue: .*', log_output) self.score = re.findall(r'Score: .*', log_output) self.result = re.findall(r'Result: .*', log_output) class MbsaPlugin(PluginByExtension): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "MBSA" self.name = "Microsoft Baseline Security Analyzer" self.plugin_version = "1.0.1" self.version = "MBSA 1.0" self.framework_version = "1.0.0" self.extension = ".log" def parseOutputString(self, output): parser = MbsaParser(output) detail = '' i = 0 issues_top = len(parser.issues) ip = '0.0.0.0' hostname = [] run_date = None if parser.ip is not None: ip = parser.ip.group(2) if parser.computer_name is not None: hostname.append(parser.computer_name.group(2)) if parser.scan_date is not None: run_date = datetime.strptime(parser.scan_date.group(2), '%Y/%m/%d %H:%M') host_id = self.createAndAddHost( ip, 'Windows', hostnames=hostname) for issue in parser.issues: test = re.search(parser.issues[i], output) if i+1 != issues_top: test_issue = re.search(parser.issues[i+1], output) else: end = None try: start = test.end() end = test_issue.start() except: start = None if start is not None: if end is None: result_info = output[start:] else: result_info = output[start:end] result_info.rstrip('\n') result_info = result_info.replace(parser.score[i], '') result_info = result_info.replace(parser.result[i], '') result_info = result_info.strip() if result_info: detail = re.search('(Detail:)', result_info) if not None: detail = result_info result_info = parser.result[i] else: detail = '' result_info = parser.result[i] score = parser.score[i].replace('Score: ', '').strip() if score != 'Check passed': if score == 'Best practice' or score == 'Unable to scan': severity = "info" elif score == 'Check failed (non-critical)': severity = 'med' elif score == 'Check failed': severity = 'high' else: severity = 'info' self.createAndAddVulnToHost( host_id, issue.replace('Issue: ', '').strip(), desc=result_info.replace('Result: ', '').strip(), ref=None, severity=severity, data=detail, run_date=run_date ) i += 1 def createPlugin(*args, **kwargs): return MbsaPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/medusa/000077500000000000000000000000001505357635700240445ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/medusa/__init__.py000066400000000000000000000002351505357635700261550ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/medusa/plugin.py000066400000000000000000000106251505357635700257200ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re from faraday_plugins.plugins.plugin import PluginBase __author__ = "Francisco Amato" __copyright__ = "Copyright 2013, Faraday Project" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class MedusaParser: """ The objective of this class is to parse an xml file generated by the medusa tool. @param medusa_filepath A proper simple report generated by medusa """ def __init__(self, xml_output, resolve_hostname): self.resolve_hostname = resolve_hostname self.srv = { 'ftp': '21', 'http': '80', 'imap': '143', 'mssql': '1433', 'mysql': '3306', 'ncp': '524', 'nntp': '119', 'pcanywhere': '5631', 'pop3': '110', 'postgres': '5432', 'rexec': '512', 'rlogin': '513', 'rsh': '514', 'smbnt': 'smbnt', 'smtp': '25', 'smtp-vrfy': 'smtp-vrfy', 'snmp': '161', 'ssh': '22', 'svn': '3690', 'telnet': '23', 'vmauthd': 'vmauthd', 'vnc': '5900', 'web-form': 'web-form', 'wrapper': 'wrapper' } lines = xml_output.splitlines() self.items = [] for line in lines: reg = re.search(r"ACCOUNT FOUND: \[([^$]+)\] Host: ([^$]+) User: ([^$]+) Password: ([^$]+) \[SUCCESS\]", line) if reg: item = { 'service': reg.group(1), 'host': reg.group(2), 'user': reg.group(3), 'pass': reg.group(4) } item['ip'] = resolve_hostname(item['host']) item['port'] = self.srv[item['service']] self.items.append(item) class MedusaPlugin(PluginBase): """ Example plugin to parse medusa output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Medusa" self.name = "Medusa Output Plugin" self.plugin_version = "0.0.1" self.version = "2.1.1" self.options = None self._command_regex = re.compile(r'^(sudo medusa|sudo \.\/medusa|medusa|\.\/medusa)\s+.*?') self.host = None self.port = "" self._use_temp_file = True self._temp_file_extension = "txt" self.xml_arg_re = re.compile(r"^.*(-O\s*[^\s]+).*$") def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ parser = MedusaParser(output, resolve_hostname=self.resolve_hostname) for item in parser.items: h_id = self.createAndAddHost(item['ip'], hostnames=[item['host']]) port = self.port if self.port else item['port'] s_id = self.createAndAddServiceToHost( h_id, item['service'], ports=[port], protocol="tcp", status="open") self.createAndAddCredToService( h_id, s_id, item['user'], item['pass']) self.createAndAddVulnToService(h_id, s_id, "Weak Credentials", f"[medusa found the following credentials]\nuser:{item['user']}\npass:{item['pass']}", severity="high") del parser def processCommandString(self, username, current_path, command_string): super().processCommandString(username, current_path, command_string) self.port = "" arg_match = self.xml_arg_re.match(command_string) mreg = re.search(r"\-n( |)([\d]+)", command_string) if mreg: self.port = mreg.group(2) if arg_match is None: return re.sub(r"(^.*?medusa?)", r"\1 -O %s" % self._output_file_path, command_string) else: return re.sub(arg_match.group(1), r"-O %s" % self._output_file_path, command_string) def _isIPV4(self, ip): if len(ip.split(".")) == 4: return True else: return False def createPlugin(*args, **kwargs): return MedusaPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/metasploit/000077500000000000000000000000001505357635700247475ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/metasploit/__init__.py000066400000000000000000000002351505357635700270600ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/metasploit/plugin.py000066400000000000000000000316121505357635700266220ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import xml.etree.ElementTree as ET from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class MetasploitXmlParser: """ The objective of this class is to parse an xml file generated by the metasploit tool. TODO: Handle errors. TODO: Test metasploit output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param metasploit_xml_filepath A proper xml generated by metasploit """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) if tree: servicesByWebsite = {} for site in tree.findall('web_sites/web_site'): servicesByWebsite[site.find('id').text] = site.find('service-id').text webVulnsByService = {} for v in [data for data in self.get_vulns(tree, servicesByWebsite)]: if v.service_id not in webVulnsByService: webVulnsByService[v.service_id] = [] webVulnsByService[v.service_id].append(v) self.hosts = [data for data in self.get_items( tree, webVulnsByService)] else: self.hosts = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: tree = ET.fromstring(xml_output) except SyntaxError as err: print(f"SyntaxError: {err}. {xml_output}") return None return tree def get_items(self, tree, webVulns): """ @return items A list of Host instances """ for node in tree.findall('hosts/host'): yield Host(node, webVulns) def get_vulns(self, tree, services): """ @return items A list of WebVuln instances """ for node in tree.findall('web_vulns/web_vuln'): yield WebVuln(node, services) def get_attrib_from_subnode(xml_node, subnode_xpath_expr, attrib_name): """ Finds a subnode in the item node and the retrieves a value from it @return An attribute value """ node = xml_node.find(subnode_xpath_expr) if node is not None: return node.get(attrib_name) return None class Host: def __init__(self, item_node, webVulnsByService): self.node = item_node self.id = self.get_text_from_subnode('id') self.host = self.get_text_from_subnode('name') self.ip = self.get_text_from_subnode('address') self.os = self.get_text_from_subnode('os-name') self.services = [] self.vulnsByService = {} self.vulnsByHost = [] self.notesByService = {} self.credsByService = {} for s in self.node.findall('services/service'): service = {'id': None, 'port': None, 'proto': None, 'state': None, 'name': None, 'info': None} for attr in service: service[attr] = s.find(attr).text if not service['name']: service['name'] = 'unknown' if not service['state']: service['state'] = 'unknown' if not service['info']: service['info'] = 'unknown' self.services.append(service) self.vulnsByService[service['id']] = [] self.notesByService[service['id']] = [] if service['id'] in webVulnsByService: self.vulnsByService[service['id']] += webVulnsByService[service['id']] for v in self.node.findall('vulns/vuln'): vuln = HostVuln(v) if vuln.service_id: self.vulnsByService[vuln.service_id].append(vuln) else: self.vulnsByHost.append(vuln) for n in self.node.findall('notes/note'): note = HostNote(n) key = self.id + "_" + note.service_id if key not in self.notesByService: self.notesByService[key] = [] self.notesByService[key].append(note) for c in self.node.findall('creds/cred'): cred = HostCred(c) key = cred.port if key not in self.credsByService: self.credsByService[key] = [] self.credsByService[key].append(cred) def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: if sub_node.text is not None: return sub_node.text return None class WebVuln: def __init__(self, item_node, services): self.node = item_node self.name = self.get_text_from_subnode('name') self.desc = self.get_text_from_subnode('description') self.host = self.get_text_from_subnode('vhost') self.port = self.get_text_from_subnode('port') self.ip = self.get_text_from_subnode('host') self.path = self.get_text_from_subnode('path') self.method = self.get_text_from_subnode('method') self.params = self.get_text_from_subnode('params') self.pname = self.get_text_from_subnode('pname') self.risk = self.get_text_from_subnode('risk') self.confidence = self.get_text_from_subnode('confidence') self.query = self.get_text_from_subnode('query') self.request = self.get_text_from_subnode('request') self.category = self.get_text_from_subnode('category-id') web_id = self.get_text_from_subnode('web-site-id') self.service_id = None if web_id: self.service_id = services[web_id] self.isWeb = True def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: if sub_node.text is not None: return sub_node.text return "" class HostNote: """ An abstract representation of a HostNote @param item_node A item_node taken from an metasploit xml tree """ def __init__(self, item_node): self.node = item_node self.service_id = self.get_text_from_subnode( 'service-id') if not None else "" self.host_id = self.get_text_from_subnode('host-id') self.ntype = self.get_text_from_subnode('ntype') self.data = self.get_text_from_subnode('data') def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: if sub_node.text is not None: return sub_node.text return "" class HostCred: """ An abstract representation of a HostNote @param item_node A item_node taken from an metasploit xml tree """ def __init__(self, item_node): self.node = item_node self.port = self.get_text_from_subnode('port') self.user = self.get_text_from_subnode('user') self.passwd = self.get_text_from_subnode('pass') self.ptype = self.get_text_from_subnode('ptype') self.sname = self.get_text_from_subnode('sname') def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: if sub_node.text is not None: return sub_node.text return "" class HostVuln: """ An abstract representation of a HostVuln @param item_node A item_node taken from an metasploit xml tree """ def __init__(self, item_node): self.node = item_node self.service_id = self.get_text_from_subnode('service-id') self.name = self.get_text_from_subnode('name') self.desc = self.get_text_from_subnode('info') self.refs = [] self.cve = [] self.cwe = [] for r in self.node.findall('refs/ref'): if r.text.startswith('CVE'): self.cve.append(r.text) elif r.text.startswith('CWE'): self.cwe.append(r.text) else: self.refs.append(r.text) self.exploited_date = self.get_text_from_subnode('exploited-at') self.exploited = (self.exploited_date is not None) self.isWeb = False def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: if sub_node.text is not None: return sub_node.text return "" class MetasploitPlugin(PluginXMLFormat): """ Example plugin to parse metasploit output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = ["MetasploitV4", "MetasploitV5"] self.id = "Metasploit" self.name = "Metasploit XML Output Plugin" self.plugin_version = "0.0.1" self.version = "4.7.2" self.framework_version = "1.0.0" self.options = None self.target = None def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. """ parser = MetasploitXmlParser(output) for item in parser.hosts: self.hostnames = [] if item.host: self.hostnames = [item.host] h_id = self.createAndAddHost(item.ip, os=item.os, hostnames=self.hostnames) if item.id + "_" in item.notesByService: for n in item.notesByService[item.id + "_"]: self.createAndAddNoteToHost(h_id, n.ntype, n.data) for v in item.vulnsByHost: self.createAndAddVulnToHost( h_id, v.name, v.desc, ref=v.refs, cve=v.cve) for s in item.services: s_id = self.createAndAddServiceToHost(h_id, s['name'], protocol=s['proto'], ports=[s['port']], status=s['state'], description=s['info']) if item.id + "_" + s['id'] in item.notesByService: for n in item.notesByService[item.id + "_" + s['id']]: self.createAndAddNoteToService( h_id, s_id, n.ntype, n.data) if s['port'] in item.credsByService: for c in item.credsByService[s['port']]: self.createAndAddCredToService( h_id, s_id, c.user, c.passwd) self.createAndAddVulnToService(h_id, s_id, "Weak Credentials", "[metasploit found the following credentials]\nuser:{}\npass:{}".format( c.user, c.passwd), severity="high") for v in item.vulnsByService[s['id']]: if v.isWeb: self.createAndAddVulnWebToService(h_id, s_id, v.name, v.desc, severity=v.risk, website=v.host, path=v.path, request=v.request, method=v.method, pname=v.pname, params=v.params, query=v.query, category=v.category) else: self.createAndAddVulnToService( h_id, s_id, v.name, v.desc, ref=v.refs, cve=v.cve, cwe=v.cwe) del parser @staticmethod def _isIPV4(ip): if len(ip.split(".")) == 4: return True else: return False def createPlugin(*args, **kwargs): return MetasploitPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/naabu/000077500000000000000000000000001505357635700236545ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/naabu/__init__.py000066400000000000000000000000001505357635700257530ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/naabu/plugin.py000066400000000000000000000046011505357635700255250ustar00rootroot00000000000000""" Faraday Plugins Copyright (c) 2021 Faraday Security LLC (https://www.faradaysec.com/) See the file 'doc/LICENSE' for the license information """ import socket import json import re from faraday_plugins.plugins.plugin import PluginMultiLineJsonFormat __author__ = 'Emilio Couto' __copyright__ = 'Copyright (c) 2021, Faraday Security LLC' __credits__ = ['Emilio Couto'] __license__ = '' __version__ = '0.0.1' __maintainer__ = 'Emilio Couto' __email__ = 'ecouto@faradaysec.com' __status__ = 'Development' class NaabuPlugin(PluginMultiLineJsonFormat): """ Parse Naabu (from Project Discovery) scanner JSON output """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = 'naabu' self.name = 'Naabu' self.plugin_version = '0.1' self.version = '2.0.3' self.json_keys = {'tls', 'protocol', 'host', 'ip', 'port'} self._command_regex = re.compile(r'^(sudo naabu|naabu|\.\/nmap)\s+.*?') def parseOutputString(self, output, debug=False): for host_json in filter(lambda x: x != '', output.split('\n')): host_dict = json.loads(host_json) host = host_dict.get('host') ip = host_dict.get('ip') port = host_dict.get('port') try: if isinstance(port, dict): port = port.get("Port") service = socket.getservbyport(port) except OSError: service = 'Unknown service on port ' + str(port) host_id = self.createAndAddHost( name=ip, hostnames=[host]) self.createAndAddServiceToHost( host_id, name=service, ports=port, protocol='tcp', status='open', version='', description='') def processCommandString(self, username, current_path, command_string): """ Adds the -oX parameter to get xml output to the command string that the user has set. """ super().processCommandString(username, current_path, command_string) if " -json" not in command_string: command_string += " -json" if " -silent" not in command_string: command_string += " -silent" return command_string def createPlugin(*args, **kwargs): return NaabuPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ncrack/000077500000000000000000000000001505357635700240275ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ncrack/__init__.py000066400000000000000000000000001505357635700261260ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ncrack/plugin.py000066400000000000000000000105141505357635700257000ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2020 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import xml.etree.ElementTree as ET from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = "Blas Moyano" __copyright__ = "Copyright (c) 2020, Infobyte LLC" __credits__ = ["Blas Moyano"] __license__ = "" __version__ = "1.0" __maintainer__ = "Blas Moyano" __status__ = "Development" class NcrackParser: def __init__(self, xml_output): self.tree = self.parse_xml(xml_output) if self.tree: scanner = self.tree.attrib.get('scanner', None) args = self.tree.attrib.get('args', None) start = self.tree.attrib.get('start', None) start_str = self.tree.attrib.get('start_str', None) service_data = None if self.tree.find('service') is None else \ self.get_service(self.tree.findall('service')) self.ncrack_info = { "scanner_name": scanner, "args": args, "date": start, "date_str": start_str, "info_service": service_data } else: self.tree = None def parse_xml(self, xml_output): try: tree = ET.fromstring(xml_output) except SyntaxError as err: print(f'SyntaxError In xml: {err}. {xml_output}') return None return tree def get_service(self, tree): list_service_info = [] for service in tree: address = service.find('address') port = service.find('port') credential = service.find('credentials') if address is not None: addr = address.attrib.get('addr', None) addr_type = address.attrib.get('addrtype', None) else: addr = None addr_type = None if port is not None: protocol = port.attrib.get('protocol', None) port_number = port.attrib.get('portid', None) port_name = port.attrib.get('name', None) else: protocol = None port_number = None port_name = None if credential is not None: user = credential.attrib.get('username', None) passw = credential.attrib.get('password', None) else: user = None passw = None service_info = { "addr": addr, "addr_type": addr_type, "protocol": protocol, "port_number": port_number, "port_name": port_name, "user": user, "passw": passw } list_service_info.append(service_info) return list_service_info class NcrackPlugin(PluginXMLFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "ncrackrun" self.id = 'ncrack' self.name = 'ncrack XML Plugin' self.plugin_version = '0.0.1' self.version = '1.0.0' self.framework_version = '1.0.0' def parseOutputString(self, output): parser = NcrackParser(output) data = parser.ncrack_info for service_vuln in data['info_service']: host_id = self.createAndAddHost(service_vuln['addr'], description=f"{data['scanner_name']} - args: {data['args']}") service_id = self.createAndAddServiceToHost(host_id, service_vuln['addr'], ports=service_vuln['port_number'], protocol=service_vuln['protocol'], description=service_vuln['port_name']) if service_vuln['user'] is not None or service_vuln['passw'] is not None: self.createAndAddCredToService(host_id, service_id, username=service_vuln['user'], password=service_vuln['passw']) def createPlugin(*args, **kwargs): return NcrackPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ndiff/000077500000000000000000000000001505357635700236545ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ndiff/__init__.py000066400000000000000000000002351505357635700257650ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2016 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ndiff/plugin.py000066400000000000000000000106561505357635700255340ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2016 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginBase import re import xml.etree.ElementTree as ET __author__ = 'Ezequiel Tavella' __copyright__ = 'Copyright (c) 2016, Infobyte LLC' __credits__ = ['Ezequiel Tavella'] __license__ = '' __version__ = '1.0.0' __email__ = "ezequieltbh@infobytesec.com" __status__ = "Development" class NdiffXmlParser: """ The objective of this class is to parse an xml file generated by the ndiff tool. """ def __init__(self, xmlOutput): self.tree = self.parse_xml(xmlOutput) if self.tree: self.hostDiff = self.getHostsDiffs(self.tree) else: self.hostDiff = [] def parse_xml(self, xmlOutput): # Open and parse an xml output try: return ET.fromstring(xmlOutput) except SyntaxError as err: print(f"SyntaxError: {err}") return None def getHostsDiffs(self, tree): """ @return hosts A list of HostDiff instances """ for node in tree.findall('scandiff/hostdiff'): yield HostDiff(node) class HostDiff(): # Abstraction of a Hosts Diff # Search for a new host in the second scan and new ports opened or changed # of status... def __init__(self, hostDiff): self.isNewHost = False self.hostXml = self.getHostXml(hostDiff) self.ip = self.getIp() self.ports = self.getPorts() def getHostXml(self, hostDiff): host = hostDiff.find('host') if host is not None: return host else: self.isNewHost = True return hostDiff.find('b/host') def getIp(self): if self.hostXml is None: return None return self.hostXml.find('address').get('addr') def getPorts(self): ports = [] if self.hostXml is None: return ports if self.isNewHost: for port in self.hostXml.find('ports').findall('port'): ports.append( [port.get('portid'), port.find('state').get('state')]) return ports else: for port in self.hostXml.find('ports').findall('portdiff'): if port.find('b/port'): ports.append([port.find('b/port').get('portid'), port.find('b/port/state').get('state')]) return ports class CmdNdiffPlugin(PluginBase): """ This plugin handles ndiff command. Add a new vuln INFO if detect a new host or a new port .. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Ndiff" self.name = "ndiff" self.plugin_version = "0.0.1" self.version = "1.0.0" self._command_regex = re.compile(r'^(sudo ndiff|ndiff)\s+.*?') def parseOutputString(self, output): parser = NdiffXmlParser(output) for host in parser.hostDiff: if host.ip is None: continue if host.isNewHost: hostId = self.createAndAddHost(host.ip, '') description = f'{host.ip} is a NEW host active.\n' for port in host.ports: description += f'Port: {port[0]}/{port[1]}\n' self.createAndAddVulnToHost( hostId, 'New host active', description, ['Ndiff tool'], 'INFO' ) else: if host.ports == []: continue hostId = self.createAndAddHost(host.ip, '') description = 'New service/s found.\n' for port in host.ports: description += f'Port: {port[0]}/{port[1]}\n' self.createAndAddVulnToHost( hostId, 'New ports actives', description, ['Ndiff tool'], 'INFO' ) def processCommandString(self, username, current_path, command_string): super().processCommandString(username, current_path, command_string) if command_string.find('--xml') < 0: return f"{command_string} --xml " def createPlugin(*args, **kwargs): return CmdNdiffPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nessus/000077500000000000000000000000001505357635700241065ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nessus/DTO.py000066400000000000000000000224251505357635700251130ustar00rootroot00000000000000from typing import List class Attachment: def __init__(self, node): self.node = node @property def name_attr(self): return self.node.get("name") @property def type_attr(self): return self.node.get("type") @property def text(self): return self.node.text class ReportItem: def __init__(self, node): self.node = node @property def port_attr(self): return self.node.get("port") @property def svc_name_attr(self): return self.node.get("svc_name") @property def protocol_attr(self): return self.node.get("protocol") @property def severity_attr(self): return self.node.get("severity") @property def plugin_id_attr(self): plugin_id = self.node.get("pluginID") if plugin_id: plugin_id = f'NESSUS-{plugin_id}' return plugin_id @property def plugin_name_attr(self): return self.node.get("pluginName") @property def plugin_family_attr(self): return self.node.get("pluginFamily") @property def agent(self): return self.node.findtext("agent") @property def description(self): return self.node.findtext("description", "Not Description") @property def fname(self): return self.node.findtext("fname") @property def plugin_modification_date(self): return self.node.findtext("plugin_modification_date") @property def plugin_name(self): plugin_name = self.node.findtext("plugin_name") if not plugin_name: plugin_name = self.plugin_name_attr return plugin_name @property def plugin_publication_date(self): return self.node.findtext("plugin_publication_date") @property def plugin_type(self): return self.node.findtext("plugin_type") @property def risk_factor(self): risk_factor = self.node.findtext("risk_factor") if risk_factor == 'None' or risk_factor is None: risk_factor = self.severity_attr # I checked several external id and most of them were info return risk_factor @property def script_version(self): return self.node.findtext("script_version") @property def see_also(self): return self.node.findtext("see_also") @property def solution(self): return self.node.findtext("solution", '') @property def synopsis(self): return self.node.findtext("synopsis") @property def plugin_output(self): return self.node.findtext("plugin_output", "") @property def always_run(self): return self.node.findtext("always_run") @property def asset_inventory(self): return self.node.findtext("asset_inventory") @property def canvas_package(self): return self.node.findtext("canvas_package") @property def cvss3_base_score(self): return self.node.findtext("cvss3_base_score") @property def cvss3_temporal_score(self): return self.node.findtext("cvss3_temporal_score") @property def cpe(self): return self.node.findtext("cpe") @property def cvss3_temporal_vector(self): return self.node.findtext("cvss3_temporal_vector") @property def cvss3_vector(self): return self.node.findtext("cvss3_vector") @property def cvss2_base_score(self): return self.node.findtext("cvss_base_score") @property def cvss_score_rationale(self): return self.node.findtext("cvss_score_rationale") @property def cvss_score_source(self): return self.node.findtext("cvss_score_source") @property def cvss_temporal_score(self): return self.node.findtext("cvss_temporal_score") @property def cvss_temporal_vector(self): return self.node.findtext("cvss_temporal_vector") @property def cvss_vector(self): cvss_vector = self.node.findtext("cvss_vector") if cvss_vector: cvss_vector = cvss_vector.replace("CVSS2#", "") return cvss_vector @property def exploit_available(self): exploit_avalible = self.node.findtext("exploit_available", "") if exploit_avalible: exploit_avalible = f"Exploit available: {exploit_avalible.capitalize()}\n" return exploit_avalible @property def exploit_framework_canvas(self): return self.node.findtext("exploit_framework_canvas") @property def exploit_framework_core(self): return self.node.findtext("exploit_framework_core") @property def exploit_framework_d2_elliot(self): return self.node.findtext("exploit_framework_d2_elliot") @property def exploit_framework_metasploit(self): return self.node.findtext("exploit_framework_metasploit") @property def exploitability_ease(self): return self.node.findtext("exploitability_ease") @property def exploited_by_malware(self): return self.node.findtext("exploited_by_malware") @property def exploited_by_nessus(self): return self.node.findtext("exploited_by_nessus") @property def hardware_inventory(self): return self.node.findtext("hardware_inventory") @property def iava(self): return self.node.findtext("iava") @property def iavb(self): return self.node.findtext("iavb") @property def iavt(self): return self.node.findtext("iavt") @property def in_the_news(self): return self.node.findtext("in_the_news") @property def metasploit_name(self): return self.node.findtext("metasploit_name") @property def os_identification(self): return self.node.findtext("os_identification") @property def owasp(self): return self.node.findtext("owasp") @property def patch_publication_date(self): return self.node.findtext("patch_publication_date") @property def stig_severity(self): return self.node.findtext("stig_severity") @property def d2_elliot_name(self): return self.node.findtext("d2_elliot_name") @property def unsupported_by_vendor(self): return self.node.findtext("unsupported_by_vendor") @property def vuln_publication_date(self): return self.node.findtext("vuln_publication_date") @property def msft(self): return self.node.findtext("msft") @property def cert(self) -> list: return self.node.findall("cert") @property def bid(self) -> list: return self.node.findall("bid") @property def cve(self) -> list: return [i.text for i in self.node.findall("cve")] @property def cwe(self) -> list: return ["CWE-"+i.text for i in self.node.findall("cwe")] @property def edb_id(self) -> list: return self.node.findall("edb-id") @property def mskb(self) -> list: return self.node.findall("mskb") @property def xref(self) -> str: return self.node.findtext("xref") @property def attachment(self) -> Attachment: attachment = self.node.find("attachment") return Attachment(attachment) if attachment else None def get_data(self): item_tags = {} for i in self.node: item_tags.setdefault(i.tag, i.text) return item_tags class Tag: def __init__(self, node): self.node = node @property def name_attr(self) -> str: return self.node.get("name") @property def text(self) -> str: return self.node.text class HostProperties: def __init__(self, node): self.node = node @property def tag(self) -> list: return [Tag(i) for i in self.node.findall('tag')] @property def host_end(self) -> str: _dict = self.dict_tags return _dict.get("HOST_END") @property def mac_address(self) -> str: _dict = self.dict_tags return _dict.get("mac-address", "") @property def operating_system(self) -> str: _dict = self.dict_tags return _dict.get("operating-system", None) @property def host_ip(self) -> str: _dict = self.dict_tags return _dict.get("host-ip", None) @property def host_fqdn(self) -> str: _dict = self.dict_tags return _dict.get("host-fqdn", None) @property def host_rdns(self) -> str: _dict = self.dict_tags return _dict.get("host-rdns", None) @property def dict_tags(self): host_tags = {} for t in self.node: host_tags.setdefault(t.attrib.get('name'), t.text) return host_tags class ReportHost: def __init__(self, node): self.node = node @property def name(self) -> str: return self.node.get("name") @property def host_properties(self) -> HostProperties: return HostProperties(self.node.find("HostProperties")) @property def report_items(self) -> List[ReportItem]: return [ReportItem(i) for i in self.node.findall("ReportItem")] class Report: def __init__(self, node): self.node = node @property def name_attr(self) -> str: return self.node.get("name") @property def report_hosts(self) -> List[ReportHost]: return [ReportHost(i) for i in self.node.findall('ReportHost')] faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nessus/__init__.py000066400000000000000000000002351505357635700262170ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nessus/plugin.py000066400000000000000000000223351505357635700257630ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import xml.etree.ElementTree as ET from dateutil.parser import parse from faraday_plugins.plugins.plugin import PluginXMLFormat from faraday_plugins.plugins.plugins_utils import CVE_regex from faraday_plugins.plugins.plugins_utils import get_severity_from_cvss __author__ = "Blas" __copyright__ = "Copyright (c) 2019, Infobyte LLC" __credits__ = ["Blas", "Nicolas Rebagliati"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Blas" __email__ = "bmoyano@infobytesec.com" __status__ = "Development" from faraday_plugins.plugins.repo.nessus.DTO import ReportHost, Report, ReportItem class NessusParser: """ The objective of this class is to parse an xml file generated by the nessus tool. TODO: Handle errors. TODO: Test nessus output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param nessus_filepath A proper simple report generated by nessus """ def __init__(self, output): self.tree = ET.fromstring(output) self.report = [] if self.tree: self.report = self.__get_report() def __get_report(self) -> Report: report = self.tree.find('Report') return Report(report) if report else None class NessusPlugin(PluginXMLFormat): """ Example plugin to parse nessus output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.extension = ".nessus" self.identifier_tag = "NessusClientData_v2" self.id = "Nessus" self.name = "Nessus XML Output Plugin" self.plugin_version = "0.0.1" self.version = "5.2.4" self.framework_version = "1.0.1" self.options = None @staticmethod def parse_compliance_data(data: dict): compliance_data = {} for key, value in data.items(): if 'compliance-' in key: compliance_name = key.split("}")[-1] compliance_data[compliance_name] = value return compliance_data def map_properties(self, host: ReportHost): if self.hostname_resolution: name = host.host_properties.host_ip if host.host_properties.host_ip else host.name else: name = host.name hostnames = [host.host_properties.host_fqdn] if host.host_properties.host_rdns and host.host_properties.host_rdns not in hostnames: hostnames.append(host.host_properties.host_rdns) return { "name": name, "hostnames": hostnames, "mac": host.host_properties.mac_address, "os": host.host_properties.operating_system } @staticmethod def map_item(host_id, run_date, plugin_name, item: ReportItem) -> dict: data = item.plugin_output data += f'{item.exploit_available}' return { "host_id": host_id, "name": plugin_name, "severity": item.risk_factor, "data": data, "external_id": item.plugin_id_attr, "run_date": run_date, "desc": item.description, "resolution": item.solution, "ref": [], } def map_policy_general(self, kwargs, item: ReportItem): kwargs.update({"policyviolations": []}) if item.plugin_family_attr == 'Policy Compliance': data = item.get_data() bis_benchmark_data = kwargs["desc"].split('\n') compliance_data = self.parse_compliance_data(data) compliance_info = compliance_data.get('compliance-info', '') if compliance_info and not kwargs["desc"]: kwargs["desc"] = compliance_info compliance_reference = compliance_data.get( 'compliance-reference', '').replace('|', ':').split(',') compliance_result = compliance_data.get('compliance-result', '') for reference in compliance_reference: kwargs["ref"].append(reference) compliance_check_name = compliance_data.get('compliance-check-name', '') compliance_solution = compliance_data.get('compliance-solution', '') if compliance_solution and not kwargs["resolution"]: kwargs["resolution"] = compliance_solution policy_item = f'{compliance_check_name} - {compliance_result}' for policy_check_data in bis_benchmark_data: if 'ref.' in policy_check_data: kwargs["ref"].append(policy_check_data) if 'compliance-see-also' in compliance_data: kwargs["ref"].append(compliance_data.get('compliance-see-also')) # We used this info from tenable: https://community.tenable.com/s/article/Compliance-checks-in-SecurityCenter kwargs["policyviolations"].append(policy_item) kwargs["name"] = f'{kwargs["name"]}: {policy_item}' return kwargs def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ try: parser = NessusParser(output) except Exception as e: self.logger.error(str(e)) return None if not parser.report: self.logger.error('Parser did not find any reports') return 1 # this value is used to exit the execution of the executor. Can't use False or None because if this function doesn't fail, it returns none report_hosts = parser.report.report_hosts if report_hosts: for host in report_hosts: run_date = host.host_properties.host_end if run_date: run_date = parse(run_date) website = host.host_properties.host_fqdn host_id = self.createAndAddHost(**self.map_properties(host)) for item in host.report_items: vulnerability_name = item.plugin_name if not vulnerability_name: continue item_name = item.svc_name_attr main_data = self.map_item( host_id, run_date, vulnerability_name, item) main_data = self.map_add_ref(main_data, item) if item_name == 'general': main_data = self.map_policy_general(main_data, item) self.createAndAddVulnToHost(**main_data) else: main_data["service_id"] = self.createAndAddServiceToHost( host_id, name=item_name, protocol=item.protocol_attr, ports=item.port_attr) if item_name == 'www' or item_name == 'http': main_data.update({"website": website}) self.createAndAddVulnWebToService(**main_data) else: self.createAndAddVulnToService(**main_data) @staticmethod def map_add_ref(main_data, item: ReportItem): main_data["cvss2"] = {} main_data["cvss3"] = {} found_cves = set() if item.cve: if isinstance(item.cve, str): cves_in_item_cve_field = CVE_regex.findall(item.cve) found_cves.update(cves_in_item_cve_field) elif isinstance(item.cve, list): for c_val in item.cve: if isinstance(c_val, str): found_cves.add(c_val) if item.see_also: main_data["ref"].append(item.see_also) # Extract CVEs from see_also string cves_from_see_also = CVE_regex.findall(item.see_also) found_cves.update(cves_from_see_also) if found_cves: main_data["cve"] = sorted(list(found_cves)) if item.cpe: main_data["ref"].append(item.cpe) if item.cwe: main_data["cwe"] = item.cwe if item.cvss3_vector: cvss3_vector_string = item.cvss3_vector # Prepend "CVSS:3.0/" if no "CVSS:3.x" prefix exists, similar to Nessus SC plugin if not cvss3_vector_string.startswith("CVSS:3."): cvss3_vector_string = "CVSS:3.0/" + cvss3_vector_string main_data["cvss3"]["vector_string"] = cvss3_vector_string if item.cvss3_base_score: main_data["cvss3"]["base_score"] = item.cvss3_base_score main_data["severity"] = get_severity_from_cvss(item.cvss3_base_score) if item.cvss_vector: main_data["cvss2"]["vector_string"] = item.cvss_vector if item.cvss2_base_score: main_data["cvss2"]["base_score"] = item.cvss2_base_score # If CVSSv3 score is not present, use CVSSv2 score for severity if not item.cvss3_base_score: main_data["severity"] = get_severity_from_cvss(item.cvss2_base_score) return main_data def createPlugin(*args, **kwargs): return NessusPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nessus_sc/000077500000000000000000000000001505357635700245735ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nessus_sc/__init__.py000066400000000000000000000002341505357635700267030ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2017 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nessus_sc/plugin.py000066400000000000000000000052351505357635700264500ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginCSVFormat import csv import io __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2019, Infobyte LLC" __credits__ = ["Gonzalo Martinez"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmartinez@infobytesec.com" __status__ = "Development" class NessusScPlugin(PluginCSVFormat): """ Example plugin to parse Nessus Sc output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.csv_headers = [{'Plugin', 'Plugin Name'}] self.id = "Nessus_sc" self.name = "Nessus Sc Output Plugin" self.plugin_version = "1.0.0" self.version = "1.0.0" self.framework_version = "1.0.0" def parseOutputString(self, output): try: reader = csv.DictReader(io.StringIO(output)) except: print("Error parser output") return None for row in reader: ip = row['IP Address'] hostname = row['DNS Name'] h_id = self.createAndAddHost(name=ip, hostnames=hostname) protocol = row['Protocol'] port = row['Port'] s_id = self.createAndAddServiceToHost(h_id, name=port, protocol=protocol, ports=port, status="open") name = row['Plugin Name'] severity = row['Severity'] description = row['Description'] vuln = {"name": name, "severity": severity, "desc": description} solution = row['Solution'] if solution: vuln["resolution"] = solution cvss3_vector = row['CVSS V3 Vector'] if cvss3_vector: if not cvss3_vector.startswith("CVSS:3.0/"): cvss3_vector = "CVSS:3.0/"+cvss3_vector vuln["cvss3"] = {"vector_string": cvss3_vector} cvss2_vector = row['CVSS V2 Vector'] if cvss2_vector: vuln["cvss2"] = {"vector_string": cvss2_vector} external_ref = row["See Also"] cross_ref = row["Cross References"] references = [] if external_ref: references.append(external_ref) if cross_ref: references.append(cross_ref) vuln["ref"] = references cve = row['CVE'] if cve: vuln["cve"] = cve self.createAndAddVulnToService(h_id, s_id, **vuln) def createPlugin(*args, **kwargs): return NessusScPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/netdiscover/000077500000000000000000000000001505357635700251135ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/netdiscover/__init__.py000066400000000000000000000002341505357635700272230ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2016 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/netdiscover/plugin.py000066400000000000000000000025241505357635700267660ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginBase import re __author__ = "Federico Fernandez - @q3rv0" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __license__ = "" __version__ = "1.0.0" __maintainer__ = "Federico Fernandez" __email__ = "fede.merlo26@gmail.com" __status__ = "Development" class NetdiscoverPlugin(PluginBase): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Netdiscover" self.name = "netdiscover" self.plugin_version = "0.0.1" self.version = "1.0.0" self._command_regex = re.compile(r'^(sudo netdiscover|netdiscover)\s+.*?') def parseOutputString(self, output): #regexp get ip, mac and hostname reg = re.findall(r"(([0-9]+\.?){4})\s+(([0-9a-f]+\:?){6})((\s+[0-9]+){2})(.*)", output) if output.find('Finished!') != -1 and len(reg) > 0: for stdout in reg: ip_address = stdout[0] mac = stdout[2] hostname = stdout[6].strip() h_id = self.createAndAddHost(ip_address, hostnames=[hostname]) return True def createPlugin(*args, **kwargs): return NetdiscoverPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/netsparker/000077500000000000000000000000001505357635700247445ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/netsparker/__init__.py000066400000000000000000000002351505357635700270550ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/netsparker/plugin.py000066400000000000000000000217251505357635700266230ustar00rootroot00000000000000"""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import sys import re import xml.etree.ElementTree as ET from bs4 import BeautifulSoup from faraday_plugins.plugins.plugin import PluginXMLFormat from faraday_plugins.plugins.plugins_utils import CVE_regex __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class NetsparkerXmlParser: """ The objective of this class is to parse an xml file generated by the netsparker tool. TODO: Handle errors. TODO: Test netsparker output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param netsparker_xml_filepath A proper xml generated by netsparker """ def __init__(self, xml_output, plugin): self.filepath = xml_output self.plugin = plugin tree = self.parse_xml(xml_output) if tree: self.items = [data for data in self.get_items(tree)] else: self.items = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: tree = ET.fromstring(xml_output) except SyntaxError as err: self.plugin.logger.error(f"SyntaxError: {err}. {xml_output}") return None return tree def get_items(self, tree): """ @return items A list of Host instances """ for node in tree.findall("vulnerability"): yield Item(node) class Item: """ An abstract representation of a Item @param item_node A item_node taken from an netsparker xml tree """ def __init__(self, item_node): self.node = item_node self.url = self.get_text_from_subnode("url") host = re.search( r"(http|https|ftp)\://([a-zA-Z0-9\.\-]+(\:[a-zA-Z0-9\.&%\$\-]+)*@)*((25[0-5]|2[0-4][0-9]|[0-1]{1}[0-9]" r"{2}|[1-9]{1}[0-9]{1}|[1-9])\.(25[0-5]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[1-9]{1}[0-9]{1}|[1-9]|0)\.(25[0-5]|2" r"[0-4][0-9]|[0-1]{1}[0-9]{2}|[1-9]{1}[0-9]{1}|[1-9]|0)\.(25[0-5]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[1-9]{1}[0-9]" r"{1}|[0-9])|localhost|([a-zA-Z0-9\-]+\.)*[a-zA-Z0-9\-]+\.(com|edu|gov|int|mil|net|org|biz|arpa|info|name|" "pro|aero|coop|museum|[a-zA-Z]{2}))[\\:]*([0-9]+)*([/]*($|[\\(\\)a-zA-Z0-9\\.\\,\\?\'\\\\+&%\\$#\\=~_\\-]+)).*?$", self.url) self.protocol = host.group(1) self.hostname = host.group(4) self.port = 80 if self.protocol == 'https': self.port = 443 if host.group(11) is not None: self.port = host.group(11) self.name = self.get_text_from_subnode("type") self.name_title = self.get_text_from_subnode("title") self.desc = self.get_text_from_subnode("description") self.severity = self.re_map_severity(self.get_text_from_subnode("severity")) self.certainty = self.get_text_from_subnode("certainty") self.method = self.get_text_from_subnode("vulnerableparametertype") self.param = self.get_text_from_subnode("vulnerableparameter") self.paramval = self.get_text_from_subnode("vulnerableparametervalue") self.reference = self.get_text_from_subnode("externalReferences") remedy = self.get_text_from_subnode("remedy") self.resolution = self.get_text_from_subnode("actionsToTake") + remedy if remedy else "" self.request = self.get_text_from_subnode("rawrequest") self.response = self.get_text_from_subnode("rawresponse") self.kvulns = [] self.cve = [] for v in self.node.findall("knownvulnerabilities/knownvulnerability"): self.node = v recheck = CVE_regex.search(v.find('title').text) if recheck: self.cve.append(recheck.group()) self.kvulns.append(self.get_text_from_subnode( "severity") + "-" + self.get_text_from_subnode("title")) self.extra = [] for v in item_node.findall("extrainformation/info"): name_tag = v.find('name') value_tag = v.find('value') if name_tag is not None: self.extra.append(f"{name_tag.text}:{value_tag.text}") self.node = item_node self.node = item_node.find("classification") self.owasp = self.get_text_from_subnode("OWASP") self.wasc = self.get_text_from_subnode("WASC") self.cwe = self.get_text_from_subnode("CWE") self.capec = self.get_text_from_subnode("CAPEC") self.pci = self.get_text_from_subnode("PCI") self.pci2 = self.get_text_from_subnode("PCI2") self.node = item_node.find("classification/CVSS") self.cvss_full_vector = self.get_text_from_subnode("vector") self.cvss_score = self.get_text_from_subnode("score[1]/value") if self.get_text_from_subnode("score[1]/value") else None self.cvss3 = {} self.ref = [] if self.cwe: self.cwe = ["CWE-" + self.cwe] if self.owasp: self.ref.append("OWASP-" + self.owasp) if self.reference: self.ref.extend(sorted(set(re.findall(r'https?://(?:[-\w.]|(?:%[\da-fA-F]{2}))+', self.reference)))) if self.cvss_full_vector: self.cvss3["vector_string"] = self.cvss_full_vector self.data = "" self.data += "\nKnowVulns: " + \ "\n".join(self.kvulns) if self.kvulns else "" self.data += "\nWASC: " + self.wasc if self.wasc else "" self.data += "\nCertainty: " + self.certainty if self.certainty else "" self.data += "\nPCI: " + self.pci if self.pci else "" self.data += "\nPCI2: " + self.pci2 if self.pci2 else "" self.data += "\nCAPEC: " + self.capec if self.capec else "" self.data += "\nPARAM: " + self.param if self.param else "" self.data += "\nPARAM VAL: " + \ repr(self.paramval) if self.paramval else "" self.data += "\nExtra: " + "\n".join(self.extra) if self.extra else "" @staticmethod def re_map_severity(severity): if severity == "Important": return "high" return severity def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ if self.node: sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: return sub_node.text return None class NetsparkerPlugin(PluginXMLFormat): """ Example plugin to parse netsparker output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "netsparker" self.id = "Netsparker" self.name = "Netsparker XML Output Plugin" self.plugin_version = "0.0.1" self.version = "Netsparker 3.1.1.0" self.framework_version = "1.0.0" self.options = None def parseOutputString(self, output): parser = NetsparkerXmlParser(output, self) host_names_resolve = {} for i in parser.items: if i.hostname not in host_names_resolve: ip = self.resolve_hostname(i.hostname) host_names_resolve[i.hostname] = ip else: ip = host_names_resolve[i.hostname] h_id = self.createAndAddHost(ip, hostnames=[i.hostname]) s_id = self.createAndAddServiceToHost(h_id, str(i.port), protocol = str(i.protocol), ports=[str(i.port)], status="open") if i.resolution is not None: resolution = BeautifulSoup(i.resolution, "lxml").text else: resolution = "" if i.desc is not None: desc = BeautifulSoup(i.desc, "lxml").text else: desc = "" if i.name_title is None: name = i.name else: name = i.name_title self.createAndAddVulnWebToService(h_id, s_id, name, ref=i.ref, website=i.hostname, severity=i.severity, desc=desc, path=i.url, method=i.method, request=i.request, response=i.response, resolution=resolution, pname=i.param, data=i.data, cve=i.cve, cwe=i.cwe, cvss3=i.cvss3) del parser def createPlugin(*args, **kwargs): return NetsparkerPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/netsparkercloud/000077500000000000000000000000001505357635700257735ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/netsparkercloud/__init__.py000066400000000000000000000002351505357635700301040ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/netsparkercloud/plugin.py000066400000000000000000000166411505357635700276530ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import xml.etree.ElementTree as ET from urllib.parse import urlparse from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" def get_urls(string): if isinstance(string, bytes): string_decode = string.decode("utf-8") urls = re.findall(r'(?:(?:https?|ftp):\/\/)?[\w/\-?=%.]+\.[\w/\-?=%.]+', string_decode) else: urls = re.findall(r'(?:(?:https?|ftp):\/\/)?[\w/\-?=%.]+\.[\w/\-?=%.]+', string) return urls class NetsparkerCloudXmlParser: """ The objective of this class is to parse an xml file generated by the netsparkercloud tool. TODO: Handle errors. TODO: Test netsparkercloud output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param netsparkercloud_xml_filepath A proper xml generated by netsparkercloud """ def __init__(self, xml_output): self.filepath = xml_output tree = self.parse_xml(xml_output) if tree: self.items = self.get_items(tree) else: self.items = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: tree = ET.fromstring(xml_output) except SyntaxError as err: self.logger.error(f"SyntaxError: {err}. {xml_output}") return None return tree def get_items(self, tree): """ @return items A list of Host instances """ for node in tree.findall("vulnerabilities/vulnerability"): yield Item(node) class Item: """ An abstract representation of a Item @param item_node A item_node taken from an netsparkercloud xml tree """ def re_map_severity(self, severity): if severity == "Important": return "high" return severity def __init__(self, item_node, encoding="ascii"): self.node = item_node self.url = urlparse(self.get_text_from_subnode("url")) self.protocol = self.url.scheme self.hostname = self.url.netloc self.port = self.url.port if self.port is None: self.port = '80' self.type = self.get_text_from_subnode("type") self.name = self.get_text_from_subnode("name") self.severity = self.re_map_severity(self.get_text_from_subnode("severity")) self.certainty = self.get_text_from_subnode("certainty") self.node = item_node.find("http-request") self.method = self.get_text_from_subnode("method") self.request = self.get_text_from_subnode("content") self.param = "" self.paramval = "" for p in self.node.findall("parameters/parameter"): self.param = p.get('name') self.paramval = p.get('value') self.node = item_node.find("http-response") self.response = self.get_text_from_subnode("content") self.extra = [] for v in item_node.findall("extra-information/info"): self.extra.append(v.get('name') + ":" + v.get('value')) self.node = item_node.find("classification") self.owasp = self.get_text_from_subnode("owasp") self.wasc = self.get_text_from_subnode("wasc") self.cwe = self.get_text_from_subnode("cwe") self.capec = self.get_text_from_subnode("capec") self.pci = self.get_text_from_subnode("pci31") self.pci2 = self.get_text_from_subnode("pci32") self.hipaa = self.get_text_from_subnode("hipaa") self.ref = [] if self.cwe: self.cwe = [f"CWE-{self.cwe}"] if self.owasp: self.ref.append(f"OWASP-{self.owasp}") self.node = item_node self.remedyreferences = self.get_text_from_subnode("remedy-references") self.externalreferences = self.get_text_from_subnode("external-references") if self.remedyreferences: for u in get_urls(self.remedyreferences): self.ref.append(u) if self.externalreferences: for u in get_urls(self.externalreferences): self.ref.append(u) self.impact = self.get_text_from_subnode("impact") self.remedialprocedure = self.get_text_from_subnode("remedial-procedure") self.remedialactions = self.get_text_from_subnode("remedial-actions") self.exploitationskills = self.get_text_from_subnode("exploitation-skills") self.proofofconcept = self.get_text_from_subnode("proof-of-concept") self.resolution = "Remerdial Procedure: {} \nRemedial Actions: {}".format(self.remedialprocedure, self.remedialactions) self.desc = self.get_text_from_subnode("description") self.desc = "\nImpact: {} \nExploitation Skills: {} \nProof of concept: {} \nWASC: {} \nPCI31: {} \nPCI32: {}" \ " \nCAPEC: {} \nHIPA: {} \nExtra: {}".format(self.impact, self.exploitationskills, self.proofofconcept, self.wasc, self.pci, self.pci2, self.capec, self.hipaa, self.extra) def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ if self.node: sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: return sub_node.text return None class NetsparkerCloudPlugin(PluginXMLFormat): """ Example plugin to parse netsparkercloud output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "netsparker-cloud" self.id = "NetsparkerCloud" self.name = "NetsparkerCloud XML Output Plugin" self.plugin_version = "0.0.1" self.version = "NetsparkerCloud" self.framework_version = "1.0.0" self.options = None def parseOutputString(self, output): parser = NetsparkerCloudXmlParser(output) first = True for i in parser.items: if first: ip = self.resolve_hostname(i.hostname) h_id = self.createAndAddHost(ip, hostnames=[i.hostname]) s_id = self.createAndAddServiceToHost(h_id, i.protocol, ports=[i.port], status="open") first = False v_id = self.createAndAddVulnWebToService(h_id, s_id, i.name, ref=i.ref, website=i.hostname, severity=i.severity, desc=i.desc, path=i.url.path, method=i.method, request=i.request, response=i.response, resolution=i.resolution, pname=i.param, cwe=i.cwe) del parser def createPlugin(*args, **kwargs): return NetsparkerCloudPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nexpose_full/000077500000000000000000000000001505357635700252715ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nexpose_full/__init__.py000066400000000000000000000002351505357635700274020ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nexpose_full/plugin.py000066400000000000000000000320071505357635700271430ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import xml.etree.ElementTree as ET from faraday_plugins.plugins.plugin import PluginXMLFormat from faraday_plugins.plugins.plugins_utils import CVE_regex __author__ = "Micaela Ranea Sanchez" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato", "Federico Kirschbaum", "Micaela Ranea Sanchez", "German Riera"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Micaela Ranea Sanchez" __email__ = "mranea@infobytesec.com" __status__ = "Development" class NexposeFullXmlParser: """ The objective of this class is to parse Nexpose's XML 2.0 Report. TODO: Handle errors. TODO: Test nexpose output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param xml_filepath A proper xml generated by nexpose """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) self.vulns = self.get_vuln_definitions(tree) if tree: self.items = self.get_items(tree, self.vulns) else: self.items = [] @staticmethod def get_severity_from_report(score): try: if not isinstance(score, float): score = float(score) cvss_ranges = [(0.0, 3.4, 'med'), (3.5, 7.4, 'high'), (7.5, 10.1, 'critical')] for (lower, upper, severity) in cvss_ranges: if lower <= score < upper: return severity except ValueError: return 'unclassified' @staticmethod def parse_xml(xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: tree = ET.fromstring(xml_output) except SyntaxError as err: return None return tree def parse_html_type(self, node: ET.Element) -> str: """ Parse XML element of type HtmlType @return ret A string containing the parsed element """ ret = "" tag: str = node.tag.lower() if tag == 'containerblockelement': if len(list(node)) > 0: for child in list(node): ret += self.parse_html_type(child) else: ret += node.text.strip() if node.text else "" if tag == 'listitem': if len(list(node)) > 0: for child in list(node): ret += self.parse_html_type(child) else: ret = node.text.strip() if node.text else "" if tag == 'orderedlist': i = 1 for item in list(node): ret += "\t" + str(i) + " " + self.parse_html_type(item) + "\n" i += 1 if tag == 'paragraph': if len(list(node)) > 0: for child in list(node): ret += self.parse_html_type(child) else: ret += node.text.strip() if node.text else "" if tag == 'unorderedlist': for item in list(node): ret += "\t" + "* " + self.parse_html_type(item) + "\n" if tag == 'urllink': if node.get('text'): ret += node.text.strip() + " " last = "" for attr in node.attrib: if node.get(attr) and node.get(attr) != node.get(last): ret += node.get(attr) + " " last = attr return ret def parse_tests_type(self, node, vulnsDefinitions): """ Parse XML element of type TestsType @return vulns A list of vulnerabilities according to vulnsDefinitions """ vulns = list() for tests in node.findall('tests'): for test in tests.iter('test'): if test.get('id').lower() in vulnsDefinitions: vuln = vulnsDefinitions[test.get('id').lower()].copy() key = test.get('key', '') vuln['pci'] = test.get('pci-compliance-status') vuln['vulnerable_since'] = test.get('vulnerable-since') vuln['scan_id'] = test.get('scan-id') if key.startswith('/'): # It has the path where the vuln was found # Example key: "/comments.asp||content" vuln['path'] = key[:key.find('|')] for desc in list(test): vuln['desc'] += self.parse_html_type(desc) vulns.append(vuln) return vulns def get_vuln_definitions(self, tree): """ @returns vulns A dict of Vulnerability Definitions """ vulns = dict() for vulnsDef in tree.iter('VulnerabilityDefinitions'): for vulnDef in vulnsDef.iter('vulnerability'): vid = vulnDef.get('id').lower() vector = vulnDef.get('cvssVector') vuln = { 'desc': "", 'name': vulnDef.get('title'), 'refs': [], 'resolution': "", 'severity': self.get_severity_from_report(vulnDef.get('severity')), 'tags': list(), 'is_web': vid.startswith('http-'), 'risk': vulnDef.get('riskScore'), 'CVE': [], 'cvss2': { "vector_string": vector.replace("(", "").replace(")", "") if vector else None } } for item in list(vulnDef): if item.tag == 'description': for htmlType in list(item): vuln['desc'] += self.parse_html_type(htmlType) if item.tag == 'exploits': for exploit in list(item): if exploit.get('title') and exploit.get('link') and exploit.get('type') \ and exploit.get('skillLevel'): title = exploit.get('title').strip() link = exploit.get('link').strip() type = exploit.get('type').strip() skillLevel = exploit.get('skillLevel').strip() vuln['refs'].append(" ".join([title, link, type, skillLevel])) if item.tag == 'malware': for names in item.findall("name"): nameMalware = names.text vuln['refs'].append(nameMalware) if item.tag == 'references': for ref in list(item): if not ref.text: continue source = "" if "source" in ref.attrib: source = ref.attrib['source'] + ": " rf = ref.text.strip() check = CVE_regex.search(rf.upper()) if check: vuln["CVE"].append(check.group()) else: if rf.isnumeric(): rf = source + rf vuln['refs'].append(rf) if item.tag == 'solution': for htmlType in list(item): vuln['resolution'] += self.parse_html_type(htmlType) """ # there is currently no method to register tags in vulns if item.tag == 'tags': for tag in list(item): vuln['tags'].append(tag.text.lower()) """ vulns[vid] = vuln return vulns def get_items(self, tree, vulns): """ @return hosts A list of Host instances """ hosts = list() for nodes in tree.iter('nodes'): for node in nodes.iter('node'): host = dict() host['name'] = node.get('address') host['mac'] = node.get('hardware-address') host['hostnames'] = list() host['os'] = "" host['services'] = list() host['vulns'] = self.parse_tests_type(node, vulns) for names in node.iter('names'): for name in list(names): host['hostnames'].append(name.text) for fingerprints in node.iter('fingerprints'): for os_data in fingerprints.iter('os'): os_name = os_data.get('product') if os_name: host['os'] = os_name for endpoints in node.iter('endpoints'): for endpoint in list(endpoints): svc = { 'protocol': endpoint.get('protocol'), 'port': endpoint.get('port'), 'status': endpoint.get('status'), } for services in endpoint.iter('services'): for service in list(services): svc['name'] = service.get('name') svc['vulns'] = self.parse_tests_type( service, vulns) for configs in service.iter('configurations'): for config in list(configs): if "banner" in config.get('name'): svc['version'] = config.get('name') host['services'].append(svc) hosts.append(host) return hosts class NexposeFullPlugin(PluginXMLFormat): """ Example plugin to parse nexpose output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "NexposeReport" self.id = "NexposeFull" self.name = "Nexpose XML 2.0 Report Plugin" self.plugin_version = "0.0.1" self.version = "Nexpose Enterprise 5.7.19" self.framework_version = "1.0.0" self.options = None def parseOutputString(self, output): parser = NexposeFullXmlParser(output) for item in parser.items: pattern = '([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$' if not item['mac']: item['mac'] = '0000000000000000' match = re.search(pattern, item['mac']) if match: mac = item['mac'] else: mac = ':'.join(item['mac'][i:i + 2] for i in range(0, 12, 2)) h_id = self.createAndAddHost(item['name'], item['os'], hostnames=item['hostnames'], mac=mac) for v in item['vulns']: v['data'] = {"vulnerable_since": v['vulnerable_since'], "scan_id": v['scan_id'], "PCI": v['pci']} self.createAndAddVulnToHost( h_id, v['name'], v['desc'], v['refs'], v['severity'], v['resolution'], cve=v.get('CVE'), cvss2=v.get('cvss2') ) for s in item['services']: version = s.get("version", "") s_id = self.createAndAddServiceToHost( h_id, s['name'], s['protocol'], ports=[str(s['port'])], status=s['status'], version=version) for v in s['vulns']: if v['is_web']: self.createAndAddVulnWebToService( h_id, s_id, v['name'], v['desc'], v['refs'], v['severity'], v['resolution'], cve=v.get('CVE'), path=v.get('path', ''), cvss2=v.get('cvss2') ) else: self.createAndAddVulnToService( h_id, s_id, v['name'], v['desc'], v['refs'], v['severity'], v['resolution'], cve=v.get('CVE'), cvss2=v.get('cvss2') ) del parser def createPlugin(*args, **kwargs): return NexposeFullPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nextnet/000077500000000000000000000000001505357635700242535ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nextnet/__init__.py000066400000000000000000000000001505357635700263520ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nextnet/plugin.py000066400000000000000000000037411505357635700261300ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2020 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import json from faraday_plugins.plugins.plugin import PluginBase __author__ = "Blas Moyano" __copyright__ = "Copyright (c) 2020, Infobyte LLC" __credits__ = ["Blas Moyano"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Blas Moyano" __email__ = "bmoyano@infobytesec.com" __status__ = "Development" class CmdNextNetin(PluginBase): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "nextnet" self.name = "nextnet" self.plugin_version = "0.0.1" self.version = "5.0.20" self.framework_version = "1.0.0" self.options = None self._current_output = None self._command_regex = re.compile(r'^[.]*?[/]*?nextnet\s+.*?') self._host_ip = None self._info = 0 def parseOutputString(self, output): output_lines = output.split('\n') output_lines = output_lines[:-1] for line in output_lines: json_line = json.loads(line) info_data = json_line.get("info", None) desc = "" mac = None if info_data is not None: desc = f'Domain Tag: {info_data.get("domain", "Not tag info")}' mac = info_data.get("hwaddr") h_id = self.createAndAddHost( json_line.get("host", "0.0.0.0"), os=json_line.get("name", "unknown"), hostnames=json_line.get("nets"), mac=mac ) self.createAndAddServiceToHost( h_id, name=json_line.get("probe", "unknown"), protocol=json_line.get("proto", "tcp"), ports=json_line.get("port", None), description=desc ) return True def createPlugin(*args, **kwargs): return CmdNextNetin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nikto/000077500000000000000000000000001505357635700237125ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nikto/__init__.py000066400000000000000000000002351505357635700260230ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nikto/plugin.py000066400000000000000000000241741505357635700255720ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import xml.etree.ElementTree as ET from html.parser import HTMLParser from faraday_plugins.plugins import plugins_utils from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Facundo de Guzmán", "Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class NiktoXmlParser: """ The objective of this class is to parse an xml file generated by the nikto tool. TODO: Handle errors. TODO: Test nikto output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param nikto_xml_filepath A proper xml generated by nikto """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) if tree: self.hosts = self.get_hosts(tree) else: self.hosts = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: tree = ET.fromstring(xml_output) except SyntaxError as err: print(f"SyntaxError: {err}. {xml_output}") return None return tree def get_hosts(self, tree): """ @return items A list of Host instances """ if tree.find('niktoscan'): for host_node in tree.find('niktoscan').findall('scandetails'): yield Host(host_node) else: for host_node in tree.findall('scandetails'): yield Host(host_node) def get_attrib_from_subnode(xml_node, subnode_xpath_expr, attrib_name): """ Finds a subnode in the item node and the retrieves a value from it @return An attribute value """ node = xml_node.find(subnode_xpath_expr) if node is not None: return node.get(attrib_name) return None class Item: """ An abstract representation of a Item TODO: Consider evaluating the attributes lazily TODO: Write what's expected to be present in the nodes TODO: Refactor both Host and the Port clases? @param item_node A item_node taken from an nikto xml tree """ def __init__(self, item_node): self.node = item_node self.osvdbid = [ "OSVDB-ID: " + self.node.get('osvdbid')] if self.node.get('osvdbid', "0") != "0" else [] self.namelink = self.get_text_from_subnode('namelink') self.iplink = self.get_text_from_subnode('iplink') self.id_nikto = self.node.get('id') self.osvdblink = self.node.get('osvdbidlink') self.method = self.node.get('method') self.uri = self.get_uri() self.desc = self.get_desc() self.params = self.get_params(self.uri) self.CVE = self.get_cve(self.desc) def get_uri(self): try: uri = self.get_text_from_subnode('uri') h = HTMLParser.HTMLParser() return h.unescape(uri) except Exception as e: return uri def get_desc(self): desc = self.get_text_from_subnode('description') try: uri_present = desc.split(': ', 1)[0] h = HTMLParser.HTMLParser() if uri_present == h.unescape(self.uri): name = desc.split(': ', 1)[1] if name is not None and name != '': return name return desc except Exception as e: return desc def get_params(self, uri): """Return the paramethers as a string""" try: params = uri.split('?')[1].replace('&', ',') except Exception as e: params = '' return params def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None: return sub_node.text return None def get_cve(self, desc): match = plugins_utils.CVE_regex.search(desc) if match: return [match.group()] return [] class Host: """ An abstract representation of a Host @param host_node A host_node taken from an nmap xml tree """ def __init__(self, host_node): self.node = host_node self.targetip = self.node.get('targetip') self.targethostname = self.node.get('targethostname') self.port = self.node.get('targetport') self.targetbanner = self.node.get('targetbanner') self.starttime = self.node.get('starttime') self.sitename = self.node.get('sitename') self.siteip = self.node.get('hostheader') self.items = self.get_items() def get_items(self): """ @return items A list of Host instances """ for item_node in self.node.findall('item'): yield Item(item_node) class NiktoPlugin(PluginXMLFormat): """ Example plugin to parse nikto output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = ["niktoscan", "niktoscans"] self.id = "Nikto" self.name = "Nikto XML Output Plugin" self.plugin_version = "0.0.2" self.version = "2.1.5" self.options = None self.parent = None self._use_temp_file = True self._temp_file_extension = "xml" self.xml_arg_re = re.compile(r"^.*(-output\s*[^\s]+).*$") self._command_regex = re.compile( r'^(sudo nikto|nikto|sudo nikto\.pl|nikto\.pl|perl nikto\.pl|\.\/nikto\.pl|\.\/nikto)\s+.*?') self._completition = { "": "", "-ask+": "Whether to ask about submitting updates", "-Cgidirs+": 'Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/"', "-config+": "Use this config file", "-Display+": "Turn on/off display outputs:", "-dbcheck": "Check database and other key files for syntax errors", "-evasion+": "Encoding technique:", "-Format+": "Save file (-o) format:", "-Help": "Extended help information", "-host+": "Target host", "-IgnoreCode": "Ignore Codes--treat as negative responses", "-id+": "Host authentication to use, format is id:pass or id:pass:realm", "-key+": "Client certificate key file", "-list-plugins": "List all available plugins, perform no testing", "-maxtime+": "Maximum testing time per host", "-mutate+": "Guess additional file names:", "-mutate-options": "Provide information for mutates", "-nointeractive": "Disables interactive features", "-nolookup": "Disables DNS lookups", "-nossl": "Disables the use of SSL", "-no404": "Disables nikto attempting to guess a 404 page", "-output+": "Write output to this file ('.' for auto-name)", "-Pause+": "Pause between tests (seconds, integer or float)", "-Plugins+": "List of plugins to run (default: ALL)", "-port+": "Port to use (default 80)", "-RSAcert+": "Client certificate file", "-root+": "Prepend root value to all requests, format is /directory", "-Save": "Save positive responses to this directory ('.' for auto-name)", "-ssl": "Force ssl mode on port", "-Tuning+": "Scan tuning:", "-timeout+": "Timeout for requests (default 10 seconds)", "-Userdbs": "Load only user databases, not the standard databases", "-until": "Run until the specified time or duration", "-update": "Update databases and plugins from CIRT.net", "-useproxy": "Use the proxy defined in nikto.conf", "-Version": "Print plugin and database versions", "-vhost+": "Virtual host (for Host header)", } def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ parser = NiktoXmlParser(output) for host in parser.hosts: h_id = self.createAndAddHost( host.targetip, hostnames=[host.targethostname] ) s_id = self.createAndAddServiceToHost( h_id, "http", "tcp", ports=[host.port], status="open" ) for item in host.items: self.createAndAddVulnWebToService( h_id, s_id, name=item.desc, ref=item.osvdbid, method=item.method, params=', '.join(item.params), cve=item.CVE, **plugins_utils.get_vulnweb_url_fields(item.namelink) ) del parser def processCommandString(self, username, current_path, command_string): """ Adds the -oX parameter to get xml output to the command string that the user has set. """ super().processCommandString(username, current_path, command_string) arg_match = self.xml_arg_re.match(command_string) if arg_match is None: return re.sub(r"(^.*?nikto(\.pl)?)", r"\1 -output %s -Format XML" % self._output_file_path, command_string) else: data = re.sub(r" \-Format XML", "", command_string) return re.sub(arg_match.group(1), r"-output %s -Format XML" % self._output_file_path, data) def createPlugin(*args, **kwargs): return NiktoPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nipper/000077500000000000000000000000001505357635700240635ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nipper/__init__.py000066400000000000000000000000001505357635700261620ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nipper/plugin.py000066400000000000000000000157161505357635700257450ustar00rootroot00000000000000import xml.etree.ElementTree as ET from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = "@rfocke and @pasta <3" __copyright__ = "Copyright (c) 2021, Faradaysec LLC" __credits__ = ["Roberto Focke", "Javier Aguinaga"] __license__ = "GPL" __version__ = "0.8" __mantainer__ = "@rfocke" __status__ = "Development" class VulnSoftNipper: def __init__(self, **kwargs): self.name = '' self.data = '' self.device = '' self.cvss2 = {} self.refs = [] class VulnerabilityNipper: def __init__(self, **kwargs): self.name = '' self.rating = '' self.recommendation = '' self.affected_devices = [] self.section = '' self.name2 = '' self.data = '' self.recommendation2 = '' class NipperParser: def __init__(self, output, debug=False): self.vulns_first = [] self.vulns_audit = [] self.vulns_thirds = [] self.debug = debug self.tree = ET.fromstring(output) self.report_tree = self.tree.find( "report/part/[@index='2']/section/[@title='Recommendations']/table/[@title='Security Audit recommendations list']/tablebody") self.process_xml() def process_xml(self): if not self.report_tree: return for tablerow in self.report_tree: for i, tablecell in enumerate(tablerow.findall('tablecell')): if len(tablecell.findall('item')) == 1: if i == 0: # Item vuln = VulnerabilityNipper() vuln.name = tablecell.find('item').text elif i == 1: # Rating vuln.rating = tablecell.find('item').text elif i == 2: # Recommendations vuln.recommendation = tablecell.find('item').text elif i == 3: # Affected devices (with 1 element only) vuln.affected_devices = [] vuln.affected_devices.append(tablecell.find('item').text) elif i == 4: # Section subdetail = tablecell.find('item').text vuln.section = subdetail path = "./report/part/[@index='2']/section/[@index='" + subdetail + "']" for detail in self.tree.findall(path): # nombre de la vuln vuln.name2 = detail.attrib.get('title') if vuln.name2 != vuln.name: pass path = "./report/part/[@index='2']/section/[@index='" + subdetail + "']/section/[@index='" + subdetail + ".2']" for detail in self.tree.findall(path): # data de la vuln vuln.data = detail.find('text').text path = "./report/part/[@index='2']/section/[@index='" + subdetail + "']/section/[@index='" + subdetail + ".5']" for detail in self.tree.findall(path): # recomendacion de la vuln vuln.recommendation2 = detail.find('text').text self.vulns_first.append(vuln) # <- GUARDADO elif len(tablecell.findall('item')) > 1 and i == 3: # affected devices vuln.affected_devices = [] for item in tablecell.findall('item'): vuln.affected_devices.append(item.text) # parseo vuln de software report_tree = self.tree.find("./report/part/[@title='Vulnerability Audit']") for itemv in report_tree: vuln_soft = VulnSoftNipper() # nombre de la vuln vuln_soft.name = itemv.attrib.get('title') cvss2_vector = itemv.find('infobox/infodata/[@label="CVSSv2 Base"]') vuln_soft.cvss2["vector_string"] = cvss2_vector.text.split(' ')[0] if cvss2_vector is not None else None for itemvv in itemv: if itemvv.attrib.get('title') == 'Summary': for i in itemvv: # data de la vuln vuln_soft.data = i.text if itemvv.attrib.get('title') == 'Affected Device': for i in itemvv: # data del device aux = i.text.split('The')[1] vuln_soft.device = aux.split(' may be affected by this security vulnerability')[0] if itemvv.attrib.get('title') == 'References': # referencias de la vuln vuln_soft.refs = [] for texto in itemvv.findall('list/listitem/weblink'): vuln_soft.refs.append(texto.text) self.vulns_audit.append(vuln_soft) class NipperPlugin(PluginXMLFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.extension = ".xml" self.identifier_tag = "document" self.identifier_tag_attributes = {'nipperstudio'} self.id = "Nipper" self.name = "Nipper XML Output Plugin" self.plugin_version = "0.9" self.version = "0.9" self.framewor_version = "1.0.1" self.options = None def parseOutputString(self, output): parser = NipperParser(output, debug=False) for vuln in parser.vulns_first: for device in vuln.affected_devices: ip = self.resolve_hostname(device) h_id = self.createAndAddHost(ip, hostnames=device) self.createAndAddVulnToHost(h_id, name=vuln.name, desc=vuln.data, severity=vuln.rating, resolution=vuln.recommendation, data=vuln.data, ref=[], policyviolations=[], cve=[vuln.name] ) for vuln in parser.vulns_audit: if vuln.data: ip = self.resolve_hostname(device) h_id = self.createAndAddHost(ip, hostnames=vuln.device) self.createAndAddVulnToHost(h_id, name=vuln.name, desc=vuln.data, severity='', resolution='', data=vuln.data, ref=vuln.refs, cve=[vuln.name], cvss2=vuln.cvss2 ) def createPlugin(*args, **kwargs): return NipperPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nmap/000077500000000000000000000000001505357635700235215ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nmap/__init__.py000066400000000000000000000002351505357635700256320ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nmap/plugin.py000066400000000000000000000450431505357635700253770ustar00rootroot00000000000000import os import re from io import BytesIO """ Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from lxml import etree from lxml.etree import XMLParser from faraday_plugins.plugins.plugin import PluginXMLFormat current_path = os.path.abspath(os.getcwd()) class NmapXmlParser: """ The objective of this class is to parse an xml file generated by the nmap tool. TODO: Handle errors. TODO: Test nmap output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param nmap_xml_filepath A proper xml generated by nmap """ def __init__(self, xml_output): tree = self.parse_xml(xml_output) if tree: self.hosts = [host for host in self.get_hosts(tree)] else: self.hosts = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: magical_parser = XMLParser(recover=True) return etree.parse(BytesIO(xml_output), magical_parser) except SyntaxError as err: # logger.error("SyntaxError: %s." % (err)) return None def get_hosts(self, tree): """ @return hosts A list of Host instances """ for host_node in tree.findall('host'): yield Host(host_node) def get_attrib_from_subnode(xml_node, subnode_xpath_expr, attrib_name): """ Finds a subnode in the host node and the retrieves a value from it @return An attribute value """ node = xml_node.find(subnode_xpath_expr) if node is not None: return node.get(attrib_name) return None class Host: """ An abstract representation of a Host TODO: Consider evaluating the attributes lazily TODO: Write what's expected to be present in the nodes TODO: Refactor both Host and the Port clases? @param host_node A host_node taken from an nmap xml tree """ def __init__(self, host_node): self.node = host_node self.hostnames = [hostname[0] for hostname in self.get_hostnames()] if len(self.hostnames) != 0: self.hostname = self.hostnames[0] else: self.hostname = 'unknown' self.hostnames = list(set(self.hostnames)) self.status = self.get_status() self.ipv4_address = self.get_ipv4_address() self.ipv6_address = self.get_ipv6_address() self.mac_address = self.get_mac_address() self.os_guesses = [os_guess for os_guess in self.get_os_guesses()] self.os = self.top_os_guess() self.ports = [port for port in self.get_ports()] self.vulns = [vuln for vuln in self.get_scripts()] if self.os != 'unknown': for p in self.ports: if p.service is not None: if p.service.ostype: self.os = p.service.ostype break def get_hostnames(self): """ Expects to find one or more '' in the host node. @return A list of (hostname, hostname_type) or None """ for hostname in self.node.findall('hostnames/hostname'): yield (hostname.attrib["name"], hostname.attrib["type"]) def get_attrib_from_subnode(self, subnode_xpath_expr, attrib_name): """ Finds a subnode in the host node and the retrieves a value from it @return An attribute value """ return get_attrib_from_subnode( self.node, subnode_xpath_expr, attrib_name) def get_status(self): """ Expects to find '' in the node TODO: Use 'reason' @return An status or 'unknown' """ status = self.get_attrib_from_subnode('status', 'state') return status if status else 'unknown' def get_ipv4_address(self): """ Expects to find '

' in the node @return ip_address or 'unknown' """ ip_address = self.get_attrib_from_subnode( "address[@addrtype='ipv4']", 'addr') return ip_address if ip_address else 'unknown' def get_ipv6_address(self): """ Expects to find '
' in the node @return ip_address or 'unknown' """ ip_address = self.get_attrib_from_subnode( "address[@addrtype='ipv6']", 'addr') return ip_address if ip_address else 'unknown' def get_mac_address(self): """ Expects to find '
' in the node @return mac_address or 'unknown' """ mac_address = self.get_attrib_from_subnode( "address[@addrtype='mac']", 'addr') return mac_address if mac_address else 'unknown' def get_os_guesses(self): """ Expects to find '....' in the node @return A list of (os_vendor_family_gen, accuracy) """ # OS information about host with great acurracy. osclasses = self.node.findall('os/osclass') if osclasses == []: osclasses = self.node.findall('os/osmatch/osclass') for osclass in osclasses: os_vendor = osclass.get("vendor", "unknown") os_family = osclass.get("osfamily", "unknown") os_gen = osclass.get("osgen", "unknown") accuracy = osclass.get("accuracy", "unknown") yield (f"{os_vendor} {os_family} {os_gen}", accuracy) # Os information in services, bad acurracy. if osclasses == []: services = self.node.findall("ports/port/service") for service in services: ostype = service.get("ostype", "unknown") yield (f"{ostype}", 0) def top_os_guess(self): """ @return The most accurate os_guess_id or 'unknown'. """ return self.os_guesses[0][0] if len(self.os_guesses) != 0 else 'unknown' def get_scripts(self): # Expects to find a scripts in the node. for s in self.node.findall('hostscript/script'): yield Script(s) def get_ports(self): """ Expects to find one or more '...' in the node. @return A list of Port instances or None """ for port in self.node.findall('ports/port'): yield Port(port) def is_up(self): """ Returns True if the host is up else False. """ if self.status == 'up': return True else: return False def __str__(self): ports = [] for port in self.ports: var = f" {port}" ports.append(var) ports = "\n".join(ports) return f"{self.hostnames}, {self.status}, {self.ipv4_address} [{self.mac_address}], {self.os}\n{ports}" class Port: """ An abstract representation of a Port. @param port_node A port_node taken from an nmap xml tree """ PORT_STATUS_FIX = {"filtered": "closed", "open|filtered": "closed"} def __init__(self, port_node): self.node = port_node self.protocol = self.node.get("protocol") self.number = self.node.get("portid") self.state, self.reason, self.reason_ttl = self.get_state() self.service = self.get_service() self.vulns = [vuln for vuln in self.get_scripts()] def get_attrib_from_subnode(self, subnode_xpath_expr, attrib_name): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ return get_attrib_from_subnode( self.node, subnode_xpath_expr, attrib_name) def get_state(self): """ Expects to find a '' in the node. @return (state, reason, reason_ttl) or ('unknown','unknown','unknown') """ state = self.PORT_STATUS_FIX.get(self.get_attrib_from_subnode('state', 'state'), self.get_attrib_from_subnode('state', 'state')) reason = self.get_attrib_from_subnode('state', 'reason') reason_ttl = self.get_attrib_from_subnode('state', 'reason_ttl') return (state if state else 'unknown', reason if reason else 'unknown', reason_ttl if reason_ttl else 'unknown') def get_service(self): """ Expects to find a service in the node. """ service_node = self.node.find('service') if service_node is not None: return Service(service_node) return None def get_scripts(self): """ Expects to find a scripts in the node. """ for s in self.node.findall('script'): if s.get("id") == 'vulners': for service_table in s.findall('table'): for vulnerability_table in service_table.findall('table'): yield ScriptVulners(s, service_table, vulnerability_table) else: yield Script(s) def __str__(self): return f"{self.number}, {self.state}, Service: {self.service}" class ScriptVulners: """ An abstract representation of a script table when script is 'vulners'. https://nmap.org/nsedoc/scripts/vulners.html '' @param script_node The reference to the node of the 'vulners' script @param service_table The outer table taken from an nmap 'vulners' script xml tree @param vulnerability_table The inner table taken from an nmap 'vulners' script xml tree """ def __init__(self, script_node, service_table, vulnerability_table): self.node = script_node self.table = {} for e in vulnerability_table.findall('elem'): self.table[e.get("key")] = str(e.text) self.name = self.table["id"] self.desc = script_node.get("id") + "-" + self.table["id"] if self.table["is_exploit"] == 'true': self.desc += " *EXPLOIT*" self.refs = ["https://vulners.com/" + self.table["type"] + "/" + self.table["id"]] self.response = "" self.web = "" self.cvss2 = {} def __str__(self): return f"{self.name}, {self.product}, {self.version}" class Script: """ An abstract representation of a Script. '' @param script_node A script_node taken from an nmap xml tree """ def parse_output(self, output): block_re = re.compile('^\\s{4}References:((?:.|[\r\n])+[\r\n](?:\\s{4}\\w|\\s*$))', re.MULTILINE) m1 = block_re.findall(output) if len(m1) > 0: links_re = re.compile('[ \t]+([^ \t\n\r]+)[ \t]*') m2 = links_re.findall(m1[0]) return m2 return [] def __init__(self, script_node): self.node = script_node self.name = script_node.get("id") self.desc = script_node.get("output") self.refs = self.parse_output(self.desc) self.response = "" for k in script_node.findall("elem"): self.response += "\n" + str(k.get('key')) + ": " + str(k.text) self.web = re.search("(http-|https-)", self.name) self.cvss2 = {} def __str__(self): return f"{self.name}, {self.product}, {self.version}" class Service: """ An abstract representation of a Service. '' @param service_node A service_node taken from an nmap xml tree """ def __init__(self, service_node): self.node = service_node name = service_node.get("name") self.name = name if name else 'unknown' self.tunnel = service_node.get("tunnel") if self.tunnel == "ssl": if self.name == "http": self.name = "https" elif self.name == 'imap': self.name = 'imaps' elif self.name == 'pop3': self.name = 'pop3s' product = service_node.get("product") self.product = product if product else 'unknown' version = service_node.get("version") self.version = version if version else 'unknown' self.method = service_node.get("method") self.conf = service_node.get("conf") self.ostype = self.node.get("ostype") def __str__(self): return f"{self.name}, {self.product}, {self.version}" class NmapPlugin(PluginXMLFormat): """ Example plugin to parse nmap output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "nmaprun" self.id = "Nmap" self.name = "Nmap XML Output Plugin" self.plugin_version = "0.0.3" self.version = "6.40" self.framework_version = "1.0.0" self.options = None self._current_output = None self._command_regex = re.compile(r'^(sudo nmap|nmap|\.\/nmap|sudo masscan|masscan)\s+.*?') self._use_temp_file = True self._temp_file_extension = "xml" self.xml_arg_re = re.compile(r"^.*(-oX\s*[^\s]+).*$") self.addSetting("Scan Technique", str, "-sS") def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. NOTE: if 'debug' is true then it is being run from a test case and the output being sent is valid. """ parser = NmapXmlParser(output) for host in parser.hosts: # if not host.is_up(): # continue if host.mac_address == 'unknown': host.mac_address = "00:00:00:00:00:00" if host.ipv4_address != 'unknown': minterfase = host.ipv4_address else: minterfase = host.ipv6_address h_id = self.createAndAddHost(minterfase, host.os, mac=host.mac_address, hostnames=host.hostnames) for v in host.vulns: desc = v.desc desc += "\nOutput: " + v.response if v.response else "" v_id = self.createAndAddVulnToHost( h_id, v.name, desc=v.desc, ref=v.refs, severity=0, cve=[v.name] ) for port in host.ports: srvname = str(port.number) srvversion = "unknown" if port.service is not None: srvname = port.service.name srvversion = port.service.product if port.service.product != "unknown" else "" srvversion += " " + port.service.version if port.service.version != "unknown" else "" s_id = self.createAndAddServiceToHost( h_id, srvname, port.protocol, ports=[port.number], status=port.state, version=srvversion, description=srvname) for v in port.vulns: desc = v.desc refs = v.refs if hasattr(v, 'severity'): severity = v.severity else: severity = "info" if re.search(r"(?= version.parse("2.5.3") else: return False except Exception as e: return False def createPlugin(*args, **kwargs): return NucleiPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nuclei_legacy/000077500000000000000000000000001505357635700253715ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nuclei_legacy/__init__.py000066400000000000000000000000001505357635700274700ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/nuclei_legacy/plugin.py000066400000000000000000000141731505357635700272470ustar00rootroot00000000000000import subprocess # nosec import re import json from packaging import version from urllib.parse import urlparse from dateutil.parser import parse from faraday_plugins.plugins.plugin import PluginMultiLineJsonFormat __author__ = "Emilio Couto" __copyright__ = "Copyright (c) 2021, Faraday Security" __credits__ = ["Emilio Couto"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Emilio Couto" __email__ = "ecouto@infobytesec.com" __status__ = "Development" class NucleiLegacyPlugin(PluginMultiLineJsonFormat): """ Handle the Nuclei tool. Detects the output of the tool and adds the information to Faraday. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "nuclei_legacy" self.name = "Nuclei" self.plugin_version = "1.0.0" self.version = "2.5.2" self._command_regex = re.compile(r'^(sudo nuclei|nuclei|\.\/nuclei|^.*?nuclei)\s+.*?') self.xml_arg_re = re.compile(r"^.*(-o\s*[^\s]+).*$") self._use_temp_file = True self._temp_file_extension = "json" self.json_keys = {"matched", "templateID", "host"} def parseOutputString(self, output, debug=False): for vuln_json in filter(lambda x: x != '', output.split("\n")): vuln_dict = json.loads(vuln_json) host = vuln_dict.get('host') url_data = urlparse(host) ip = vuln_dict.get("ip", self.resolve_hostname(url_data.hostname)) host_id = self.createAndAddHost( name=ip, hostnames=[url_data.hostname]) port = url_data.port if not port: if url_data.scheme == 'https': port = 443 else: port = 80 service_id = self.createAndAddServiceToHost( host_id, name=url_data.scheme, ports=port, protocol="tcp", status='open', version='', description='web server') matched = vuln_dict.get('matched') matched_data = urlparse(matched) reference = vuln_dict["info"].get('reference', []) if not reference: reference = [] else: if isinstance(reference, str): if re.match('^- ', reference): reference = list(filter(None, [re.sub('^- ', '', elem) for elem in reference.split('\n')])) else: reference = [reference] references = vuln_dict["info"].get('references', []) if references: if isinstance(references, str): if re.match('^- ', references): references = list(filter(None, [re.sub('^- ', '', elem) for elem in references.split('\n')])) else: references = [references] else: references = [] cwe = vuln_dict['info'].get('cwe', []) capec = vuln_dict['info'].get('capec', []) refs = sorted(list(set(reference + references + capec))) tags = vuln_dict['info'].get('tags', []) if isinstance(tags, str): tags = tags.split(',') impact = vuln_dict['info'].get('impact') resolution = vuln_dict['info'].get('resolution', '') easeofresolution = vuln_dict['info'].get('easeofresolution') request = vuln_dict.get('request', '') if request: method = request.split(" ")[0] else: method = "" data = [f"Matched: {vuln_dict.get('matched', '')}", f"Tags: {vuln_dict['info'].get('tags', '')}", f"Template ID: {vuln_dict.get('templateID', '')}"] name = vuln_dict["info"].get("name") run_date = vuln_dict.get('timestamp') if run_date: run_date = parse(run_date) self.createAndAddVulnWebToService( host_id, service_id, name=name, desc=vuln_dict["info"].get("description", name), ref=refs, severity=vuln_dict["info"].get('severity'), tags=tags, impact=impact, resolution=resolution, easeofresolution=easeofresolution, website=host, request=request, response=vuln_dict.get('response', ''), method=method, query=matched_data.query, params=matched_data.params, path=matched_data.path, data="\n".join(data), external_id=f"NUCLEI-{vuln_dict.get('templateID', '')}", run_date=run_date, cwe=cwe ) def processCommandString(self, username, current_path, command_string): super().processCommandString(username, current_path, command_string) arg_match = self.xml_arg_re.match(command_string) if arg_match is None: return re.sub(r"(^.*?nuclei)", r"\1 --json -irr -o %s" % self._output_file_path, command_string) else: return re.sub(arg_match.group(1), r"--json -irr -o %s" % self._output_file_path, command_string) def canParseCommandString(self, current_input): can_parse = super().canParseCommandString(current_input) if can_parse: try: proc = subprocess.Popen([self.command, '-version'], stderr=subprocess.PIPE) # nosec output = proc.stderr.read() match = re.search(r"Current Version: ([0-9.]+)", output.decode('UTF-8')) if match: nuclei_version = match.groups()[0] return version.parse(nuclei_version) <= version.parse("2.5.2") else: return False except Exception as e: return False def createPlugin(*args, **kwargs): return NucleiLegacyPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/openscap/000077500000000000000000000000001505357635700243765ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/openscap/__init__.py000066400000000000000000000000001505357635700264750ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/openscap/plugin.py000066400000000000000000000164041505357635700262530ustar00rootroot00000000000000#!/usr/bin/env python """ Faraday Penetration Test IDE Copyright (C) 2020 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import ipaddress from datetime import datetime from lxml import etree from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = 'Blas Moyano' __copyright__ = 'Copyright 2020, Faraday Project' __credits__ = ['Blas Moyano'] __license__ = '' __version__ = '1.0.0' __status__ = 'Development' class OpenScapParser: def __init__(self, xml_output): self.tree = self.parse_xml(xml_output) if self.tree is not None: self.rule_date = self.get_parser_rule(self.tree.findall('Rule', self.tree.nsmap)) self.result_data = self.get_parser_result(self.tree.findall('TestResult', self.tree.nsmap)) self.tree = None def parse_xml(self, xml_output): try: parser = etree.XMLParser(recover=True) tree = etree.fromstring(xml_output, parser=parser) except SyntaxError as err: print(f'SyntaxError In xml: {err}. {xml_output}') return None return tree def get_parser_rule(self, tree): list_rules = [] for rule in tree: title = rule.find('title', self.tree.nsmap) ident = rule.find('ident', self.tree.nsmap) check = rule.find('check', self.tree.nsmap) check_ref = rule.find('check/check-content-ref', self.tree.nsmap) try: ident_result = ident.text except AttributeError: ident_result = "" json_rule = { "rule_id": rule.attrib.get('id', None), "rule_sev": rule.attrib.get('severity', None), "rule_title": title.text, "rule_ident": ident_result, "rule_check": check.attrib.get('system', None), "rule_ref_name": check_ref.attrib.get('name', None), "rule_ref_href": check_ref.attrib.get('href', None) } list_rules.append(json_rule) return list_rules def get_parser_result(self, tree): list_result = [] list_ip = [] list_mac = [] list_data = [] for result in tree: title = result.find('title', self.tree.nsmap) target = result.find('target', self.tree.nsmap) ips = result.findall('target-address', self.tree.nsmap) target_facts = result.findall('target-facts/fact', self.tree.nsmap) rule_result = result.findall('rule-result', self.tree.nsmap) for ip in ips: list_ip.append(ip.text) for mac in target_facts: fact_name = mac.attrib.get('name', None) if fact_name == 'urn:xccdf:fact:ethernet:MAC': list_mac.append(mac.text) for data in rule_result: list_ident = [] idents = data.findall('ident', self.tree.nsmap) check = data.find('check', self.tree.nsmap) check_ref = data.find('check/check-content-ref', self.tree.nsmap) for ident in idents: json_ident = { "system": data.attrib.get('system', None), "text": ident.text } list_ident.append(json_ident) json_data = { "id": data.attrib.get('idref', None), "time": data.attrib.get('time', None), "severity": data.attrib.get('severity', None), "ident": list_ident, "check": check.attrib.get('system', None), "ref_name": check_ref.attrib.get('name', None), "ref_href": check_ref.attrib.get('href', None) } status = data.find('result', self.tree.nsmap) if status.text == 'fail': list_data.append(json_data) json_result = { "id": result.attrib.get('id', None), "start_time": result.attrib.get('start-time', None), "end_time": result.attrib.get('end-time', None), "result_title": title.text, "target": target.text, "ips": list_ip, "mac": list_mac, "rule_result": list_data } list_result.append(json_result) return list_result class OpenScapPlugin(PluginXMLFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = "Benchmark" self.id = 'OpenScap' self.name = 'OpenScap XML Output Plugin' self.plugin_version = '1.0.0' self.version = '1.0.0' self.framework_version = '1.0.0' self.options = None self.protocol = None self.port = '80' def parseOutputString(self, output): parser = OpenScapParser(output) ips = [] for ip in parser.result_data[0]['ips']: len_start_port = ip.find(":") if len_start_port > -1: ip = ip[:len_start_port] try: ipaddress.ip_address(ip) ips.append(ip) except ValueError: pass for ip in ips: if ip != '127.0.0.1': ip = ip ips.remove(ip) break list_mac = parser.result_data[0]['mac'] for mac in list_mac: if mac != '00:00:00:00:00:00': mac_address = mac list_mac.remove(mac_address) break description = f'Title: {parser.result_data[0]["result_title"]} ' \ f'Ips: {ips} ' \ f'Macs: {list_mac}' host_id = self.createAndAddHost( name=ip, hostnames=[parser.result_data[0]['target']], description=description, mac=mac_address ) rules_fail = parser.result_data[0]['rule_result'] if rules_fail: info_rules = parser.rule_date severity = 0 for rule in rules_fail: vuln_run_date = datetime.strptime( rule['time'].replace('T', ' '), '%Y-%m-%d %H:%M:%S') if rule['severity'] == 'low': severity = 1 elif rule['severity'] == 'medium': severity = 2 elif rule['severity'] == 'high': severity = 3 desc = f'name: {rule["ref_name"]} - link: {rule["ref_href"]}' for info in info_rules: if rule['id'] == info['rule_id']: vuln_name = info['rule_title'] vuln_data = info['rule_check'] vuln_cve = info['rule_ident'] self.createAndAddVulnToHost( host_id, vuln_name, desc=desc, severity=severity, data=vuln_data, external_id=rule['id'], run_date=vuln_run_date, cve=[vuln_cve]) def createPlugin(*args, **kwargs): return OpenScapPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/openvas/000077500000000000000000000000001505357635700242415ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/openvas/__init__.py000066400000000000000000000002351505357635700263520ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/openvas/plugin.py000066400000000000000000000414211505357635700261130ustar00rootroot00000000000000import re from collections import defaultdict from copy import copy """ Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginXMLFormat from faraday_plugins.plugins.plugins_utils import filter_services import xml.etree.ElementTree as ET __author__ = "Francisco Amato" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Francisco Amato"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class OpenvasXmlParser: """ The objective of this class is to parse an xml file generated by the openvas tool. TODO: Handle errors. TODO: Test openvas output version. Handle what happens if the parser doesn't support it. TODO: Test cases. @param openvas_xml_filepath A proper xml generated by openvas """ def __init__(self, xml_output, logger): self.target = None self.port = "80" self.host = None self.logger = logger tree = self.parse_xml(xml_output) if tree: self.hosts = self.get_hosts(tree) self.items = list(self.get_items(tree, self.hosts)) else: self.items = [] def parse_xml(self, xml_output): """ Open and parse an xml file. TODO: Write custom parser to just read the nodes that we need instead of reading the whole file. @return xml_tree An xml tree instance. None if error. """ try: tree = ET.fromstring(xml_output) except SyntaxError as err: self.logger.error("SyntaxError: %s. %s", err, xml_output) return None return tree def get_items(self, tree, hosts): """ @return items A list of Host instances """ try: report = tree.find('report') if report: results = report.findall('results') if results: nodes = report.findall('results')[0] else: nodes = tree.findall('result') else: nodes = tree.findall('result') for node in nodes: try: yield Item(node, hosts) except Exception as e: self.logger.error(f"Error generating Iteem from {node.attrib} [{e}]") except Exception as e: self.logger.error(f"Tag not found: {e}") def get_hosts(self, tree): # Hosts are located in: /report/report/host # hosts_dict will contain has keys its details and its hostnames hosts = tree.findall('report/host') hosts_dict = {} for host in hosts: ip = self.do_clean(host.find('ip').text) details = self.get_data_from_detail(host.findall('detail')) hosts_dict[ip] = details return hosts_dict def get_data_from_detail(self, details): data = {} details_data = defaultdict(list) hostnames = [] for item in details: name = self.do_clean(item.find('name').text) value = self.do_clean(item.find('value').text) if "EXIT" in name: continue if name == 'hostname': hostnames.append(value) else: details_data[name].append(value) data['details'] = details_data data['hostnames'] = hostnames return data def do_clean(self, value): myreturn = "" if value is not None: myreturn = re.sub(r"\s+", " ", value) return myreturn.strip() def get_attrib_from_subnode(xml_node, subnode_xpath_expr, attrib_name): """ Finds a subnode in the item node and the retrieves a value from it @return An attribute value """ node = xml_node.find(subnode_xpath_expr) if node is not None: return node.get(attrib_name) return None class Item: """ An abstract representation of a Item @param item_node A item_node taken from an openvas xml tree """ def __init__(self, item_node, hosts): self.node = item_node self.host = self.get_text_from_subnode('host') self.threat = self.get_text_from_subnode('threat') self.subnet = self.get_text_from_subnode('subnet') if self.subnet == '': self.subnet = self.host self.port = None self.severity = self.severity_mapper() self.severity_nr = self.get_text_from_subnode("severity") self.service = "Unknown" self.protocol = "" details = self.node.findall("detection/result/details/detail") self.cpe = details[0].findtext("value") if details else None port_string = self.get_text_from_subnode('port') info = port_string.split("/") if len(info) < 2: info = details[1].findtext("value").split("/") if details else ["", ""] self.protocol = "".join(filter(lambda x: x.isalpha() or x in ("-", "_"), info[1])) self.port = "".join(filter(lambda x: x.isdigit(), info[0])) or None if not self.port: self.service = info[0] else: if hosts: host_details = hosts[self.host].get('details') self.service = self.get_service(port_string, self.port, host_details) else: self.service = "Not Service" self.nvt = self.node.findall('nvt')[0] self.node = self.nvt self.id = self.node.get('oid') self.cvss_base = self.get_text_from_subnode("cvss_base") self.name = self.get_text_from_subnode('name') self.cve = self.get_text_from_subnode('cve') if self.get_text_from_subnode('cve') != "NOCVE" else "" self.bid = self.get_text_from_subnode('bid') if self.get_text_from_subnode('bid') != "NOBID" else "" self.xref = self.get_text_from_subnode('xref') if self.get_text_from_subnode('xref') != "NOXREF" else "" self.cwe = [] if "URL:https://cwe.mitre.org/data/definitions/" in self.xref: self.cwe.append("CWE-"+self.xref.split("URL:https://cwe.mitre.org/data/definitions/")[1] .replace("html", "")) self.description = '' self.resolution = '' self.cvss_vector = '' self.cvss3_vector = '' self.tags = self.get_text_from_subnode('tags') self.data = self.get_text_from_subnode('description') self.data += f'\n\nid {item_node.attrib.get("id")}' if self.tags: tags_data = self.get_data_from_tags(self.tags) self.description = tags_data['description'] self.resolution = tags_data['solution'] if "CVSS:3" in tags_data['cvss_base_vector']: self.cvss3_vector = tags_data['cvss_base_vector'] else: self.cvss_vector = tags_data['cvss_base_vector'] if tags_data['impact']: self.data += f'\n\nImpact: {tags_data["impact"]}' def get_text_from_subnode(self, subnode_xpath_expr): """ Finds a subnode in the host node and the retrieves a value from it. @return An attribute value """ sub_node = self.node.find(subnode_xpath_expr) if sub_node is not None and sub_node.text is not None: return sub_node.text.strip() return '' def severity_mapper(self): severity = self.get_text_from_subnode('threat') if severity == 'Alarm': severity = 'Critical' return severity def get_service(self, port_string, port, details_from_host): # details_from_host: # name: name of detail # value: list with the values associated with the name details_from_host_copy = copy(details_from_host) services = details_from_host_copy.pop("Services", None) if services: service_detail = self.get_service_from_details("Services", services, port) if service_detail: return service_detail for name, value in details_from_host_copy.items(): service_detail = self.get_service_from_details(name, value, port) if service_detail: return service_detail # if the service is not in details_from_host, we will search it in # the file port_mapper.txt services_mapper = filter_services() for service in services_mapper: if service[0] == port_string: return service[1] return "Unknown" def do_clean(self, value): myreturn = "" if value is not None: myreturn = re.sub(r"\s+", " ", value) return myreturn.strip() def get_service_from_details(self, name, value_list, port): # detail: # name: name of detail # value_list: list with the values associated with the name res = None priority = 0 if name == 'Services': for value in value_list: value_splited = value.split(',') if value_splited[0] == port: res = value_splited[2] break else: for value in value_list: if '/' in value: auxiliar_value = value.split('/')[0] if auxiliar_value == port: res = name priority = 2 elif value.isdigit() and priority == 0: if value == port: res = name priority = 1 elif '::' in value and priority == 0: aux_value = value.split('::')[0] if aux_value == port: res = name return res def get_data_from_tags(self, tags_text): clean_text = self.do_clean(tags_text) tags = clean_text.split('|') summary = '' insight = '' data = { 'solution': '', 'cvss_base_vector': '', 'description': '', 'impact': '' } for tag in tags: splited_tag = tag.split('=', 1) if splited_tag[0] in data.keys(): data[splited_tag[0]] = splited_tag[1] elif splited_tag[0] == 'summary': summary = splited_tag[1] elif splited_tag[0] == 'insight': insight = splited_tag[1] data['description'] = ' '.join([summary, insight]).strip() return data class OpenvasPlugin(PluginXMLFormat): """ Example plugin to parse openvas output. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = ["report", "get_results_response"] self.id = "Openvas" self.name = "Openvas XML Output Plugin" self.plugin_version = "0.3" self.version = "9.0.3" self.framework_version = "1.0.0" self.options = None def report_belongs_to(self, **kwargs): if super().report_belongs_to(**kwargs): report_path = kwargs.get("report_path", "") with open(report_path) as f: output = f.read() return re.search("OpenVAS", output) is not None \ or re.search('', output) is not None \ or re.search('', output) is not None return False def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the xml where it expects it to be present. """ parser = OpenvasXmlParser(output, self.logger) ids = {} # The following threats values will not be taken as vulns self.ignored_severities = ['Log', 'Debug'] for ip, values in parser.hosts.items(): # values contains: ip details and ip hostnames os_report = values['details'].get('best_os_txt') h_id = self.createAndAddHost( ip, os_report[0] if os_report else '', hostnames=values['hostnames'] ) ids[ip] = h_id for item in parser.items: if item.name is not None: ref = [] cve = [] cvss2 = {} cvss3 = {} if item.cve: cves = item.cve.split(',') for i in cves: cve.append(i.strip()) if item.bid: bids = item.bid.split(',') for bid in bids: ref.append(f"BID-{bid.strip()}") if item.xref: ref.append(item.xref) if item.tags and item.cvss_vector: cvss2["vector_string"] = item.cvss_vector if item.tags and item.cvss3_vector: cvss3["vector_string"] = item.cvss3_vector if item.cpe: ref.append(f"{item.cpe}") if item.severity_nr: if float(item.severity_nr) >= 9.0: item.threat = "Critical" item.severity = "Critical" ref.append(f"SEVERITY NUMBER: {item.severity_nr}") if item.threat: ref.append(f"THREAT: {item.threat}") if item.subnet in ids: h_id = ids[item.host] else: h_id = self.createAndAddHost( item.subnet, hostnames=[item.host]) ids[item.subnet] = h_id if not item.port: if item.severity not in self.ignored_severities: v_id = self.createAndAddVulnToHost( h_id, item.name, desc=item.description, severity=item.severity, resolution=item.resolution, ref=ref, external_id=f"OPENVAS-{item.id}", data=item.data, cve=cve, cwe=item.cwe, cvss2=cvss2, cvss3=cvss3 ) else: if item.service: web = re.search( r'^(www|http)', item.service) else: web = item.port in ('80', '443', '8080') if item.subnet + "_" + item.port in ids: s_id = ids[item.subnet + "_" + item.port] else: s_id = self.createAndAddServiceToHost( h_id, item.service, item.protocol, ports=[str(item.port)] ) ids[item.subnet + "_" + item.port] = s_id if web: if item.severity not in self.ignored_severities: v_id = self.createAndAddVulnWebToService( h_id, s_id, item.name, desc=item.description, website=item.host, severity=item.severity, ref=ref, resolution=item.resolution, external_id=f"OPENVAS-{item.id}", data=item.data, cve=cve, cwe=item.cwe, cvss2=cvss2, cvss3=cvss3 ) elif item.severity not in self.ignored_severities: self.createAndAddVulnToService( h_id, s_id, item.name, desc=item.description, severity=item.severity, ref=ref, resolution=item.resolution, external_id=f"OPENVAS-{item.id}", data=item.data, cve=cve, cwe=item.cwe, cvss2=cvss2, cvss3=cvss3 ) del parser @staticmethod def _isIPV4(ip): if len(ip.split(".")) == 4: return True else: return False def createPlugin(*args, **kwargs): return OpenvasPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/owasp/000077500000000000000000000000001505357635700237175ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/owasp/__init__.py000066400000000000000000000002351505357635700260300ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/owasp/plugin.py000066400000000000000000000045621505357635700255760ustar00rootroot00000000000000import csv import io import re from collections import defaultdict from copy import copy """ Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginCSVFormat severity_map = { 'CRITICAL': 'critical', 'HIGH': 'high', 'MEDIUM': 'medium', 'LOW': 'low' } class owaspDependencyCheckPlugin(PluginCSVFormat): """ Parses OWASP Dependency Check reports in CSV format. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "owaspDependencyCheck" self.name = "OWASP Dependency Check Plugin" self.plugin_version = "1.0.0" self.version = "1.0.0" self.framework_version = "1.0.0" self.csv_headers = {"Project", "ScanDate", "DependencyName", "DependencyPath", "Description"} def parseOutputString(self, output): try: reader = csv.DictReader(io.StringIO(output)) except Exception as e: print(f"Error parsing output: {e}") return None for row in reader: ip = row.get("Project") description = row.get("Description") dep_name = row.get('DependencyName') dep_path = row.get('DependencyPath') cve = row.get('CVE') cwe = row.get('CWE') severity = row.get('CVSSv3_BaseSeverity') cvss3 = row.get('CVSSv3') cvss2 = row.get('CVSSv2') vulnerability_name = row.get('Vulnerability') # Create host host_id = self.createAndAddHost(name=ip) # Create vulnerability self.createAndAddVulnToHost(host_id, name=vulnerability_name, desc=f"{description}\nDependencyName: {dep_name}\nDependencyPath: {dep_path}", severity=severity_map.get(severity, 'info'), cve=cve, cwe=cwe, cvss3={"vector_string": cvss3}, cvss2={"vector_string": cvss2}, ) def createPlugin(*args, **kwargs): return owaspDependencyCheckPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pasteanalyzer/000077500000000000000000000000001505357635700254505ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pasteanalyzer/__init__.py000066400000000000000000000002351505357635700275610ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pasteanalyzer/plugin.py000066400000000000000000000051551505357635700273260ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ # Author: @EzequielTBH from faraday_plugins.plugins.plugin import PluginBase import json import re __author__ = "@EzequielTBH" __copyright__ = "Copyright 2015, @EzequielTBH" __credits__ = "@EzequielTBH" __license__ = "GPL v3" __version__ = "1.0.0" class pasteAnalyzerPlugin(PluginBase): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "pasteAnalyzer" self.name = "pasteAnalyzer JSON Output Plugin" self.plugin_version = "1.0.0" self.command_string = "" self._command_regex = re.compile( r'^(pasteAnalyzer|python pasteAnalyzer.py|\./pasteAnalyzer.py|sudo python pasteAnalyzer.py|sudo \./pasteAnalyzer.py)\s+.*?') def parseOutputString(self, output): # Generating file name with full path. indexStart = self.command_string.find("-j") + 3 fileJson = self.command_string[ indexStart:self.command_string.find(" ", indexStart)] fileJson = self._current_path + "/" + fileJson try: with open(fileJson) as fileJ: results = json.loads(fileJ.read()) except Exception as e: return if results == []: return # Configuration initial. hostId = self.createAndAddHost("pasteAnalyzer") serviceId = self.createAndAddServiceToHost( hostId, "Web", "TcpHTTP", ['80'] ) # Loading results. for i in range(0, len(results), 2): data = results[i + 1] description = "" for element in data: # Is Category if isinstance(element, str): #TODO bte arrray decode description += element + ": " # Is a list with results! else: for element2 in element: description += "\n" + element2 self.createAndAddVulnWebToService( hostId, serviceId, results[i], description ) def processCommandString(self, username, current_path, command_string): super().processCommandString(username, current_path, command_string) if command_string.find("-j") < 0: command_string += " -j JSON_OUTPUT " self.command_string = command_string return command_string def createPlugin(*args, **kwargs): return pasteAnalyzerPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/peepingtom/000077500000000000000000000000001505357635700247355ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/peepingtom/__init__.py000066400000000000000000000002351505357635700270460ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/peepingtom/plugin.py000066400000000000000000000047401505357635700266120ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re from os import path from urllib.parse import urlparse __author__ = "Andres Tarantini" __copyright__ = "Copyright (c) 2015 Andres Tarantini" __credits__ = ["Andres Tarantini"] __license__ = "MIT" __version__ = "0.0.1" __maintainer__ = "Andres Tarantini" __email__ = "atarantini@gmail.com" __status__ = "Development" from faraday_plugins.plugins.plugin import PluginBase class PeepingTomPlugin(PluginBase): """ Handle PeepingTom (https://bitbucket.org/LaNMaSteR53/peepingtom) output """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "peepingtom" self.name = "PeepingTom" self.plugin_version = "0.0.1" self.version = "02.19.15" self._command_regex = re.compile( r'^(python peepingtom.py|\./peepingtom.py)\s+.*?') self._path = None def parseOutputString(self, output): # Find data path data_path_search = re.search(r"in '(.*)\/'", output) print(data_path_search) if not data_path_search: # No data path found return True # Parse "peepingtom.html" report and extract results data_path = data_path_search.groups()[0] html = open(path.join(self._path, data_path, "peepingtom.html")).read() for url in re.findall(r'href=[\'"]?([^\'" >]+)', html): if "://" in url: url_parsed = urlparse(url) address = self.resolve_hostname(url_parsed.netloc) host = self.createAndAddHost(address) service = self.createAndAddServiceToHost(host, "http", protocol="tcp", ports=[80]) self.createAndAddNoteToService( host, service, 'screenshot', path.join( self._path, data_path_search.groups()[0], "{}.png".format(url.replace( "://", "").replace("/", "").replace(".", "")) ) ) return True def processCommandString(self, username, current_path, command_string): super().processCommandString(username, current_path, command_string) self._path = current_path def createPlugin(*args, **kwargs): return PeepingTomPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pentera/000077500000000000000000000000001505357635700242245ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pentera/DTO.py000066400000000000000000000060061505357635700252260ustar00rootroot00000000000000from typing import List import re from faraday_plugins.plugins.plugins_utils import CVE_regex CVE_WITH_P_regex = re.compile(r'\(CVE-\d{4}-\d{4,7}\)') class Service: def __init__(self, node): self.node = node @property def name(self): return self.node.get("name", "") @property def port(self): return self.node.get("port", "") @property def protocol(self): return self.node.get("transport", "") @property def status(self) -> str: return self.node.get("status", "") class Host: def __init__(self, node): self.node = node @property def host_id(self) -> str: return self.node.get("id", "") @property def hostname(self) -> str: return self.node.get("hostname", "") @property def name(self) -> str: return self.node.get("ip", "") @property def os(self) -> str: return self.node.get("os_name", "") @property def services(self) -> List[Service]: return [Service(ser) for ser in self.node.get("services", "")] class Vulneravility: def __init__(self, node): self.node = node @property def external_id(self) -> str: return "Pentera-"+self.node.get("id", "") @property def name(self) -> str: return CVE_WITH_P_regex.sub("", self.node.get("name", "")).strip() @property def description(self) -> str: desc = self.node.get("summary", "") if not desc: desc = self.name return desc @property def found_on(self) -> str: return self.node.get("found_on", "") @property def host(self) -> str: return self.node.get("target", "") @property def host_id(self) -> str: return self.node.get("target_id", "") @property def port(self) -> str: return self.node.get("port", "") @property def protocol(self) -> str: return self.node.get("protocol", "") @property def severity(self) -> float: return float(self.node.get("severity", 0)) @property def data(self) -> str: return self.node.get("insight", "") @property def resolution(self) -> str: return self.node.get("remediation", "") @property def cve(self) -> str: return CVE_regex.sub("", self.node.get("name", "")).strip() class Achievment: def __init__(self, node): self.node = node class Meta: def __init__(self, node): self.node = node class PenteraJsonParser: def __init__(self, node): self.node = node @property def meta(self) -> Meta: return Meta(self.node.get('meta', {})) @property def achievements(self) -> List[Achievment]: return [Achievment(i) for i in self.node.get('Achievement', [])] @property def vulneravilities(self) -> List[Vulneravility]: return [Vulneravility(i) for i in self.node.get('vulnerabilities', [])] @property def hosts(self) -> List[Host]: return [Host(i) for i in self.node.get('hosts')] faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pentera/__init__.py000066400000000000000000000002341505357635700263340ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pentera/plugin.py000066400000000000000000000073261505357635700261040ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from json import loads from faraday_plugins.plugins.plugin import PluginJsonFormat from faraday_plugins.plugins.repo.pentera.DTO import PenteraJsonParser __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Gonzalo Martinez"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmartinez@infobytesec.com" __status__ = "Development" class PenteraJsonPlugin(PluginJsonFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Pentera_Json" self.name = "Pentera Json Output Plugin" self.plugin_version = "1.0.0" self.version = "2.11.1" self.framework_version = "1.0.0" self.options = None self._temp_file_extension = "json" self.json_keys = {'vulnerabilities', 'hosts'} @staticmethod def pentera_to_severity_level(pentera_score): pentera_ranges = [(0.0, 0.01, 'info'), (0.01, 2.5, 'low'), (2.5, 4.5, 'med'), (5, 7.49, 'high'), (7.5, 10.1, 'critical')] for (lower, upper, severity) in pentera_ranges: if lower <= pentera_score < upper: return severity def parseOutputString(self, output): """ This method will discard the output the shell sends, it will read it from the json where it expects it to be present. """ parser = PenteraJsonParser(loads(output)) host_dict = {} for host in parser.hosts: host_id = self.createAndAddHost( name=host.name, os=host.os, hostnames=[host.hostname] ) host_dict[host.host_id] = {} for service in host.services: service_id = self.createAndAddServiceToHost( host_id=host_id, name=service.name, protocol=service.protocol, ports=service.port, status=service.status ) host_dict[host.host_id][service.port] = [host_id, service_id] for vuln in parser.vulneravilities: try: self.createAndAddVulnToService( host_id=host_dict[vuln.host_id][vuln.port][0], service_id=host_dict[vuln.host_id][vuln.port][1], name=vuln.name, desc=vuln.description, severity=self.pentera_to_severity_level(vuln.severity), resolution=vuln.resolution, data=vuln.data, external_id=vuln.external_id, cve=vuln.cve ) except KeyError: if "host" in vuln.found_on.lower(): host = vuln.found_on.lower().replace("host:", "").strip().split(",")[0] else: host = "NOT-PROVIDED" host_id = self.createAndAddHost( name=host, ) self.createAndAddVulnToHost( host_id=host_id, name=vuln.name, desc=vuln.description, severity=self.pentera_to_severity_level(vuln.severity), resolution=vuln.resolution, data=vuln.data, external_id=vuln.external_id, cve=vuln.cve ) def createPlugin(*args, **kwargs): return PenteraJsonPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ping/000077500000000000000000000000001505357635700235235ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ping/__init__.py000077500000000000000000000002351505357635700256370ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/ping/plugin.py000066400000000000000000000027731505357635700254040ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re from faraday_plugins.plugins.plugin import PluginBase __author__ = "Facundo de Guzmán, Esteban Guillardoy" __copyright__ = "Copyright (c) 2013, Infobyte LLC" __credits__ = ["Facundo de Guzmán", "Esteban Guillardoy"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Francisco Amato" __email__ = "famato@infobytesec.com" __status__ = "Development" class CmdPingPlugin(PluginBase): """ This plugin handles ping command. Basically detects if user was able to connect to a device """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "ping" self.name = "Ping" self.plugin_version = "0.0.1" self.version = "1.0.0" self._command_regex = re.compile(r'^(sudo ping|ping|sudo ping6|ping6)\s+.*?') def parseOutputString(self, output): reg = re.search(r"PING ([\w\.-:]+)( |)\(([\w\.:]+)\)", output) if re.search("0 received|unknown host", output) is None and reg is not None: ip_address = reg.group(3) hostname = reg.group(1) self.createAndAddHost(ip_address, hostnames=[hostname]) return True def _isIPV4(self, ip): if len(ip.split(".")) == 4: return True else: return False def createPlugin(*args, **kwargs): return CmdPingPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pingcastle/000077500000000000000000000000001505357635700247175ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pingcastle/__init__.py000066400000000000000000000000001505357635700270160ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/pingcastle/plugin.py000066400000000000000000000036521505357635700265750ustar00rootroot00000000000000#!/usr/bin/env python """ Faraday Penetration Test IDE Copyright (C) 2016 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import xml.etree.ElementTree as ET from datetime import datetime from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = 'Gonzalo Martinez' __copyright__ = 'Copyright 2023, Faraday Project' __credits__ = ['Gonzalo Martinez'] __license__ = '' __version__ = '1.0.0' __status__ = 'Development' class PingCastlePlugin(PluginXMLFormat): def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.identifier_tag = ["HealthcheckData"] self.id = 'PingCastle' self.name = 'Ping Castle XML Output Plugin' self.plugin_version = '1.0.0' self.version = '1.0.0' self.framework_version = '1.0.0' @staticmethod def map_severity(score): if score == 0: return "low" elif score < 11: return "medium" elif score < 31: return "high" else: return "critical" def parseOutputString(self, output): tree = ET.fromstring(output) url = tree.find("DomainFQDN").text host_id = self.createAndAddHost(name=url) for risk in tree.find("RiskRules"): vuln = {} vuln["severity"] = self.map_severity(int(risk.find("Points").text)) name = risk.find("Rationale").text vuln["name"] = risk.find('Model').text desc = "" desc += f"Category: {risk.find('Category').text}\n" desc += f"Model: {risk.find('Model').text}\n" desc += f"RiskId: {risk.find('RiskId').text}\n" desc += f"Rationale: {risk.find('Rationale').text}" vuln["desc"] = desc self.createAndAddVulnToHost(host_id=host_id, **vuln) def createPlugin(*args, **kwargs): return PingCastlePlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/popeye/000077500000000000000000000000001505357635700240675ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/popeye/__init__.py000066400000000000000000000002351505357635700262000ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/popeye/plugin.py000066400000000000000000000037271505357635700257500ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import json from faraday_plugins.plugins.plugin import PluginJsonFormat __author__ = "Gonzalo Martinez" __copyright__ = "Copyright (c) 2013, Faradaysec LLC" __credits__ = ["Gonzalo Martinez"] __version__ = "1.0.0" __maintainer__ = "Gonzalo Martinez" __email__ = "gmartinez@faradaysec.com" __status__ = "Development" class PopeyeJsonPlugin(PluginJsonFormat): map_level = { '1': 'low', '2': 'med', '3': 'high' } def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "Popeye_Json" self.name = "Popeye JSON Output Plugin" self.plugin_version = "1" self.json_keys = {'popeye'} self.framework_version = "1.0.0" self._temp_file_extension = "json" def parseOutputString(self, output): data = json.loads(output) for test in data['popeye'].get('sanitizers'): path = test.get('gvr') sanitizer = test.get('sanitizer') h_id = False for issue in test.get('issues', []): for group in test['issues'][issue]: level = group.get('level', 0) if level == 0: continue if not h_id: h_id = self.createAndAddHost(issue) external_id = group.get("message").split(']')[0].replace('[', '') desc = f'{group.get("message").split("]")[1]}\nPATH: {path}' self.createAndAddVulnToHost( host_id=h_id, name=sanitizer, desc=desc, severity=self.map_level[str(level)], external_id=external_id ) def createPlugin(*args, **kwargs): return PopeyeJsonPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/propecia/000077500000000000000000000000001505357635700243705ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/propecia/__init__.py000077500000000000000000000002351505357635700265040ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/propecia/plugin.py000066400000000000000000000041271505357635700262440ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from faraday_plugins.plugins.plugin import PluginBase import re __author__ = "Federico Kirschbaum" __copyright__ = "Copyright 2011, Faraday Project" __credits__ = ["Federico Kirschbaum"] __license__ = "" __version__ = "1.0.0" __maintainer__ = "Federico Kirschbaum" __email__ = "fedek@infobytesec.com" __status__ = "Development" class CmdPropeciaPlugin(PluginBase): """ This plugin handles propecia command. Basically inserts into the tree the ouput of this tool """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "propecia" self.name = "propecia port scanner" self.plugin_version = "0.0.1" self.version = "1.0" self.framework_version = "1.0.0" self.options = None self._current_output = None self._command_regex = re.compile( r'^(sudo propecia|\.\/propecia|propecia)\s+.*?') self._host_ip = None self._port = "23" def parseOutputString(self, output): host_info = re.search( r"(\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)", output) if host_info is None: self.logger.info("No hosts detected") else: for host in output.splitlines(): if host != "": h_id = self.createAndAddHost(host) s_id = self.createAndAddServiceToHost(h_id, str(self._port), "tcp", ports=[self._port], status="open", version="", description="") return True def processCommandString(self, username, current_path, command_string): super().processCommandString(username, current_path, command_string) count_args = command_string.split() if count_args.__len__() == 3: self._port = count_args[2] def createPlugin(*args, **kwargs): return CmdPropeciaPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/prowler/000077500000000000000000000000001505357635700242605ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/prowler/__init__.py000066400000000000000000000002331505357635700263670ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """faraday_plugins-1.26.0/faraday_plugins/plugins/repo/prowler/plugin.py000066400000000000000000000134731505357635700261400ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2020 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from dateutil.parser import parse import json from datetime import datetime from dataclasses import dataclass from faraday_plugins.plugins.plugin import PluginJsonFormat __author__ = "Diego Nadares" __copyright__ = "Copyright (c) 2020, Infobyte LLC" __credits__ = ["Diego Nadares", "Nicolas Rebagliati"] __license__ = "" __version__ = "0.0.1" __maintainer__ = "Diego Nadares" __email__ = "dnadares@faradaysec.com" __status__ = "Development" @dataclass class Issue: region: str profile: str severity: str scored: str account: str description: str status: str status_extended: str check_title: str check_id: str timestamp: datetime compliance: str categories: str service: str risk: str doc_link: str remediation: str resource_arn: str resource_id: str class ProwlerJsonParser: def parse_issues(self, records): records = json.loads(records) for record in records: region = record.get("Region", "AWS_REGION") profile = record.get("Profile", "") severity = record.get("Severity", "info").lower() scored = record.get("Status", "") account = record.get("AccountId", "") description = record.get("Description", "") status = record.get("Status", "") status_extended = record.get("StatusExtended", "") check_title = record.get("CheckTitle", "") check_id = record.get("CheckID", "") timestamp = record.get("AssessmentStartTime", None) if timestamp: timestamp = parse(timestamp) compliance = record.get("Compliance", "") categories = record.get("Categories", "") service = record.get("ServiceName", "") risk = record.get("Risk", "") doc_link = record.get("RelatedUrl", "") remediation = record.get("Remediation", "") resource_arn = record.get("ResourceArn", "") resource_id = record.get("ResourceId", "") if status == "FAIL": self.issues.append(Issue(region=region, profile=profile, severity=severity, scored=scored, categories=categories, account=account, description=description, status=status, status_extended=status_extended, check_title=check_title, check_id=check_id, timestamp=timestamp, compliance=compliance, service=service, risk=risk, doc_link=doc_link, remediation=remediation, resource_id=resource_id, resource_arn=resource_arn) ) def __init__(self, json_output): self.issues = [] self.parse_issues(json_output) def parse_remediation(remediation): recommendation = remediation.get("Recommendation", None) if recommendation: resolution_text = recommendation.get("Text", "") resolution_url = recommendation.get("Url", "") code = remediation.get("Code", None) if code: NativeIaC = code.get("NativeIaC", "") Terraform = code.get("Terraform", "") CLI = code.get("CLI", "") Other = code.get("Other", "") resolution = f"{resolution_text}" if resolution_url: resolution = f"{resolution}\n{resolution_url}" if NativeIaC: resolution = f"{resolution}\n{NativeIaC}" if Terraform: resolution = f"{resolution}\n{Terraform}" if CLI: resolution = f"{resolution}\n{CLI}" if Other: resolution = f"{resolution}\n{Other}" return resolution def parse_compliance(compliance: dict) -> list: compliance_str_list = [] for key, value in compliance.items(): for item in value: compliance_str_list.append(f"{key}:{item}") return compliance_str_list class ProwlerPlugin(PluginJsonFormat): """ Handle the AWS Prowler tool. Detects the output of the tool and adds the information to Faraday. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "prowler" self.name = "Prowler" self.plugin_version = "0.1" self.version = "0.0.1" self.json_keys = {"Profile", "AccountId", "OrganizationsInfo", "Region"} def parseOutputString(self, output, debug=False): parser = ProwlerJsonParser(output) for issue in parser.issues: host_name = f"{issue.resource_id}" host_id = self.createAndAddHost(name=host_name, description=f"AWS Service: {issue.service} " f"- Account: {issue.account} " f"- Region: {issue.region}\n" f"ARN: {issue.resource_arn}") vuln_desc = f"{issue.description}\n{issue.risk}" resolution = parse_remediation(issue.remediation) self.createAndAddVulnToHost( host_id=host_id, name=issue.check_title, desc=vuln_desc, data=f"{issue.status_extended}", severity=self.normalize_severity(issue.severity), resolution=resolution, run_date=issue.timestamp, external_id=f"{self.name.upper()}-{issue.check_id}", ref=[issue.doc_link], policyviolations=parse_compliance(issue.compliance), tags=issue.categories, ) def createPlugin(*args, **kwargs): return ProwlerPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/prowler_legacy/000077500000000000000000000000001505357635700256045ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/prowler_legacy/__init__.py000066400000000000000000000002331505357635700277130ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """faraday_plugins-1.26.0/faraday_plugins/plugins/repo/prowler_legacy/plugin.py000066400000000000000000000107301505357635700274550ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2020 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ from dateutil.parser import parse import re import json from datetime import datetime from dataclasses import dataclass from faraday_plugins.plugins.plugin import PluginMultiLineJsonFormat __author__ = "Nicolas Rebagliati" __copyright__ = "Copyright (c) 2020, Infobyte LLC" __credits__ = ["Nicolas Rebagliati"] __license__ = "" __version__ = "0.0.1" __maintainer__ = "Nicolas Rebagliati" __email__ = "nrebagliati@faradaysec.com" __status__ = "Development" CHECK_NUMBER_REGEX = re.compile(r"^(\[check\d\])") @dataclass class Issue: region: str profile: str severity: str scored: str account: str message: str control: str status: str level: str control_id: str timestamp: datetime compliance: str service: str caf_epic: str risk: str doc_link: str remediation: str resource_id: str class ProwlerJsonParser: def parse_issues(self, records): for record in records: json_data = json.loads(record) region = json_data.get("Region", "AWS_REGION") profile = json_data.get("Profile", "") severity = json_data.get("Severity", "info").lower() scored = json_data.get("Status", "") account = json_data.get("Account Number", "") message = json_data.get("Message", "") control = CHECK_NUMBER_REGEX.sub("", json_data.get("Control", "")).strip() status = json_data.get("Status", "") level = json_data.get("Level", "") control_id = json_data.get("Control ID", "") timestamp = json_data.get("Timestamp", None) if timestamp: timestamp = parse(timestamp) compliance = json_data.get("Compliance", "") service = json_data.get("Service", "") caf_epic = [json_data.get("CAF Epic", "")] risk = json_data.get("Risk", "") doc_link = json_data.get("Doc link", "") remediation = json_data.get("Remediation", "") resource_id = json_data.get("Resource ID", "") if status == "FAIL": self.issues.append(Issue(region=region, profile=profile, severity=severity, scored=scored, account=account, message=message, control=control, status=status, level=level, control_id=control_id, timestamp=timestamp, compliance=compliance, service=service, caf_epic=caf_epic, risk=risk, doc_link=doc_link, remediation=remediation, resource_id=resource_id)) def __init__(self, json_output): self.issues = [] self.parse_issues(json_output.splitlines()) class ProwlerLegacyPlugin(PluginMultiLineJsonFormat): """ Handle the AWS Prowler tool. Detects the output of the tool and adds the information to Faraday. """ def __init__(self, *arg, **kwargs): super().__init__(*arg, **kwargs) self.id = "prowler_legacy" self.name = "Prowler" self.plugin_version = "0.1" self.version = "0.0.1" self.json_keys = {"Profile", "Account Number", "Region"} def parseOutputString(self, output, debug=False): parser = ProwlerJsonParser(output) for issue in parser.issues: host_name = f"{issue.service}-{issue.account}-{issue.region}" host_id = self.createAndAddHost(name=host_name, description=f"AWS Service: {issue.service} - Account: {issue.account}" f" - Region: {issue.region}") vuln_desc = f"{issue.risk}\nCompliance: {issue.compliance}\nMessage: {issue.message}" self.createAndAddVulnToHost(host_id=host_id, name=issue.control, desc=vuln_desc, data=f"Resource ID: {issue.resource_id}", severity=self.normalize_severity(issue.severity), resolution=issue.remediation, run_date=issue.timestamp, external_id=f"{self.name.upper()}-{issue.control_id}", ref=[issue.doc_link], policyviolations=issue.caf_epic) def createPlugin(*args, **kwargs): return ProwlerLegacyPlugin(*args, **kwargs) faraday_plugins-1.26.0/faraday_plugins/plugins/repo/qualysguard/000077500000000000000000000000001505357635700251275ustar00rootroot00000000000000faraday_plugins-1.26.0/faraday_plugins/plugins/repo/qualysguard/__init__.py000066400000000000000000000002351505357635700272400ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ faraday_plugins-1.26.0/faraday_plugins/plugins/repo/qualysguard/plugin.py000066400000000000000000000323311505357635700270010ustar00rootroot00000000000000""" Faraday Penetration Test IDE Copyright (C) 2013 Infobyte LLC (http://www.infobytesec.com/) See the file 'doc/LICENSE' for the license information """ import re import xml.etree.ElementTree as ET from faraday_plugins.plugins.plugin import PluginXMLFormat __author__ = 'Francisco Amato' __copyright__ = 'Copyright (c) 2013, Infobyte LLC' __credits__ = ['Francisco Amato'] __license__ = '' __version__ = '1.0.0' __maintainer__ = 'Francisco Amato' __email__ = 'famato@infobytesec.com' __status__ = 'Development' def cleaner_results(string): try: result = string.replace('

', '').replace('