#!usr/bin/env python
import requests
from termcolor import cprint
import socket
import os
import urllib2
# Author: Venkat Rajgor
# Credits: Sachit Bhatia
# Date: 31/03/2020
# Description: a tool to do a blackbox testing.

cprint("Enter the Domain Including http:// or https://", 'green')
url = raw_input("please enter the url to scan -->")
domain = url.split("//")
ip = socket.gethostbyname(domain[1])


def header():
    req = urllib2.Request(url)
    res = urllib2.urlopen(req)
    response = requests.get(url)
    headers = response.headers
    cprint("Http Headers found", 'green')
    cprint("====================================================", 'blue')

    header_list = []
    non_header_list = ['X-Frame-Options', 'Strict-Transport-Security', 'Content-Security-Policy', 'X-XSS-Protection',
                       'X-Content-Type-Options']
    for i in headers:
        header_list.append(i)
    print(res.info())
    res.close()
    cprint("\n\nMissing Http Security Headers", 'red')
    cprint("====================================================", 'blue')
    if non_header_list[0] not in header_list:
        print(non_header_list[0])
    if non_header_list[1] not in header_list:
        print(non_header_list[1])
    if non_header_list[2] not in header_list:
        print(non_header_list[2])
    if non_header_list[3] not in header_list:
        print(non_header_list[3])
    if non_header_list[4] not in header_list:
        print(non_header_list[4])


def banner():
    response = requests.get(url)
    result = response.headers['server']
    cprint("\n\nChecking for Server Banner Disclosure", 'green')
    cprint("=====================================================", 'blue')
    print(result)


def nmap_scan():
    cprint("\n\nStarting Nmap Scan", 'green')
    cprint("=====================================================", 'blue')
    cmd = "nmap -p- -T4 " + ip
    return os.system(cmd)


def nmap_ssl_scan():
    cprint("\n\nStarting Nmap ssl Scan", 'green')
    cprint("=====================================================", 'blue')
    cmd = "nmap -sV --script ssl-enum-ciphers -p 443 " + ip
    return os.system(cmd)


def directory_enum(uri):
    try:
        return requests.get(uri)
    except requests.exceptions.ConnectionError:
        pass


def directory_scan_result():
    cprint("\n\nStarting directory enumeration", 'green')
    cprint("=====================================================", 'blue')
    with open("/usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1mil-110000.txt", "r") as listfile:
        for i in listfile:
            word = i.strip()
            test_url = url + "/" + word
            response = directory_enum(test_url)
            if response:
                print("directory found -->" + test_url)


def main():
    try:
        header()
        banner()
        nmap_scan()
        nmap_ssl_scan()
        directory_scan_result()
    except Exception:
        pass


main()
