Grinder Framework

🔎 Internet-connected Devices Census Python Framework

Description
Grinder Workflow
Grinder Map
Requirements
Current Features
Setup and Configure Environment
Build in Docker
Usage
Examples
Add Your Own Queries

Description

The Grinder framework was created to automatically enumerate and fingerprint different hosts on the Internet using different back-end systems: search engines, such as Shodan or Censys, for discovering hosts and NMAP engine for fingerprinting and specific checks. The Grinder framework can be used in many different areas of researches, as a connected Python module in your own project or as an independent ready-to-use from the box tool.

Grinder Workflow

Grinder Map

Information

Grinder Framework can easily build an interactive map with found hosts in your browser: Also, Grinder can show you some basic information:

Requirements

Python 3.6+
Shodan and Censys accounts
Required to collect hosts, both free and full accounts are suitable. Also, it's possible to use only one account (Censys or Shodan, Shodan is preferable).
Vulners account
Required to make additional reports on vulnerabilities and exploits. If this feature is not required for you, you can use Grinder without Vulners account.
Nmap Security Scanner 7.60+
Version 7.60 and newer has been tested with currently used in Grinder scripts (ssl-cert.nse, vulners.nse, etc.).
TLS-Attacker
Required only for TLS scanning. Version 3.0 has been tested.
TLS-Scanner
Required only for TLS scanning.

Current Features

Already Implemented

Collecting hosts and additional information using Shodan and Censys search engines
Scanning ports and services with boosted multiprocessed Nmap Scanner wrapper
Scanning vulnerabilities and additional information about them with Vulners database and Shodan CVEs database
Retrieving information about SSL certificates
Scanning for SSL/TLS configuration and supported ciphersuites
Scanning for SSL/TLS bugs, vulnerabilities and attacks
Building an interactive map with information about the hosts found
Creating plots and tables based on the collected results
Custom scanning scripts support (in LUA or Python3)
Confidence filtering system support
Special vendors scanning and filtering support
Searching for documents, security bulletins, public exploits and many more things based on detected by Grinder vulnerabilities and software

Development and Future Updates

Grinder Development Project

The Grinder framework is still in progress and got features to improve, so all the tasks and other features will always be described in this project. If you got some awesome ideas or any other interesting things for Grinder, you can always open a pull request or some issues in this repository.

Setup and Configure Environment

Grinder Installing

Install Nmap Security Scanner, if not installed.
Clone the repository

git clone https://github.com/sdnewhop/grinder

Clone and install TLS-Attacker (if you want to use TLS scanning features with Grinder).
Clone TLS-Scanner in directory with Grinder and install it (if you want to use TLS scanning features with Grinder.
Create virtual environment

cd grinder
python3 -m venv grindervenv
source grindervenv/bin/activate

Check if virtual environment successfully loaded

which python
which pip

Install project requirements in virtual environment

pip3 install -r requirements.txt

Run the script

./grinder.py -h

Set your Shodan, Censys and Vulners keys via a command line arguments on every run

./grinder.py -sk YOUR_SHODAN_KEY -ci YOUR_CENSYS_ID -cs YOUR_CENSYS_SECRET -vk YOUR_VULNERS_KEY

or via an environment variable permanently

export SHODAN_API_KEY=YOUR_SHODAN_API_KEY_HERE
export CENSYS_API_ID=YOUR_CENSYS_API_ID_HERE
export CENSYS_API_SECRET=YOUR_CENSYS_API_SECRET_HERE
export VULNERS_API_KEY=YOUR_VULNERS_API_KEY_HERE

Deactivate virtual environment after use and restore default python interpreter

deactivate

Run Local Grinder Map Server

First, complete all steps from the "Setup and Configure Environment/Grinder Installing" section.
After the scan is completed, go to the "map" folder

cd map/

Run Flask (use --help key for more information)

flask run

Open in your browser

http://localhost:5000/

Also, Grinder map server provides simple API methods such as /api/viewall/, /api/viewraw/<host_id>, you can learn more from list of application routes

flask routes

Build in Docker

To build the basic lightweight Grinder framework version (without TLS-Attacker and TLS-Scanner) as a docker image you can use the script docker-build.sh, and to run this image you can use the script docker-run.sh:

docker run -it --rm --volume $(pwd)/results:/code/results --volume $(pwd)/map:/code/map grinder-framework -h

Usage

Help on Command Line Arguments

usage: grinder.py [-h] [-r] [-u] [-q QUERIES_FILE] [-sk SHODAN_KEY]
                  [-vk VULNERS_KEY] [-cu] [-cp] [-ci CENSYS_ID]
                  [-cs CENSYS_SECRET] [-cm CENSYS_MAX] [-sm SHODAN_MAX] [-nm]
                  [-nw NMAP_WORKERS] [-vs] [-vw VULNERS_WORKERS]
                  [-ht HOST_TIMEOUT] [-tp TOP_PORTS] [-sc]
                  [-vc VENDOR_CONFIDENCE] [-qc QUERY_CONFIDENCE]
                  [-v [VENDORS [VENDORS ...]]] [-ml MAX_LIMIT] [-d] [-ts]
                  [-tsp TLS_SCAN_PATH] [-vr]

The Grinder framework was created to automatically enumerate and fingerprint
different hosts on the Internet using different back-end systems

optional arguments:
  -h, --help            show this help message and exit
  -r, --run             Run scanning
  -u, --update-markers  Update map markers
  -q QUERIES_FILE, --queries-file QUERIES_FILE
                        JSON File with Shodan queries
  -sk SHODAN_KEY, --shodan-key SHODAN_KEY
                        Shodan API key
  -vk VULNERS_KEY, --vulners-key VULNERS_KEY
                        Vulners API key
  -cu, --count-unique   Count unique entities
  -cp, --create-plots   Create graphic plots
  -ci CENSYS_ID, --censys-id CENSYS_ID
                        Censys API ID key
  -cs CENSYS_SECRET, --censys-secret CENSYS_SECRET
                        Censys API SECRET key
  -cm CENSYS_MAX, --censys-max CENSYS_MAX
                        Censys default maximum results quantity
  -sm SHODAN_MAX, --shodan-max SHODAN_MAX
                        Shodan default maximum results quantity.
  -nm, --nmap-scan      Initiate Nmap scanning
  -nw NMAP_WORKERS, --nmap-workers NMAP_WORKERS
                        Number of Nmap workers to scan
  -vs, --vulners-scan   Initiate Vulners API scanning
  -vw VULNERS_WORKERS, --vulners-workers VULNERS_WORKERS
                        Number of Vulners workers to scan
  -ht HOST_TIMEOUT, --host-timeout HOST_TIMEOUT
                        Default host timeout in seconds for scanning with
                        Vulners and Nmap core
  -tp TOP_PORTS, --top-ports TOP_PORTS
                        Quantity of popular top-ports in addition to Shodan
                        ports
  -sc, --script-check   Initiate custom scripts additional checks
  -vc VENDOR_CONFIDENCE, --vendor-confidence VENDOR_CONFIDENCE
                        Set confidence level for vendors
  -qc QUERY_CONFIDENCE, --query-confidence QUERY_CONFIDENCE
                        Set confidence level for queries
  -v [VENDORS [VENDORS ...]], --vendors [VENDORS [VENDORS ...]]
                        Set list of vendors to search from queries file
  -ml MAX_LIMIT, --max-limit MAX_LIMIT
                        Maximum number of unique entities in plots and results
  -d, --debug           Show more information
  -ts, --tls-scan       Check for possible TLS attacks and bugs (require TLS-
                        Scanner)
  -tsp TLS_SCAN_PATH, --tls-scan-path TLS_SCAN_PATH
                        Path to TLS-Scanner.jar (if TLS-Scanner directory not
                        in Grinder root, else not required)
  -vr, --vulners-report
                        Make additional vulners reports

Examples

Run the most basic enumeration with Shodan and Censys engines without map markers and plots (results will be saved in database and output JSON):

./grinder.py -sk YOUR_SHODAN_API_KEY_HERE -ci YOUR_CENSYS_ID -cs YOUR_CENSYS_SECRET -q FILE_WITH_QUERIES.json -r

Run an enumeration with 10 Nmap scanning workers, where maximum Censys results is 555 hosts per query and maximum Shodan results is 1337 hosts per query, update map markers, count unique entities and create plots:

./grinder.py -sk YOUR_SHODAN_API_KEY_HERE -ci YOUR_CENSYS_ID -cs YOUR_CENSYS_SECRET -u -q FILE_WITH_QUERIES.json -cu -cp -cm 555 -sm 1337 -nm -nw 10 -r

Run an enumeration with Nmap scanning, Vulners scanning and Vulners additional reports:

./grinder.py -sk YOUR_SHODAN_API_KEY_HERE -ci YOUR_CENSYS_ID -cs YOUR_CENSYS_SECRET -q FILE_WITH_QUERIES.json -cu -cp -nm -nw 10 -vs -vw 10 -vr -vk YOUR_VULNERS_API_KEY_HERE -r

Run an enumeration with TLS scanning features:

./grinder.py -sk YOUR_SHODAN_API_KEY_HERE -ci YOUR_CENSYS_ID -cs YOUR_CENSYS_SECRET -q FILE_WITH_QUERIES.json -ts -r

Run an enumeration with filtering by vendors (only Nginx and Apache, for example) and confidence levels (only "Certain" level, for example) for queries and vendor:

./grinder.py -sk YOUR_SHODAN_API_KEY_HERE -ci YOUR_CENSYS_ID -cs YOUR_CENSYS_SECRET -u -q FILE_WITH_QUERIES.json -v nginx apache -qc Certain -vc Certain -r

Run an enumeration with 10 workers of Nmap Vulners API scanning:

./grinder.py -sk YOUR_SHODAN_API_KEY_HERE -ci YOUR_CENSYS_ID -cs YOUR_CENSYS_SECRET -u -q FILE_WITH_QUERIES.json -vs -vw 10 -r

Run an enumeration with custom scripts which are described in .json file with queries:

./grinder.py -sc -sk YOUR_SHODAN_API_KEY_HERE -ci YOUR_CENSYS_ID -cs YOUR_CENSYS_SECRET -q FILE_WITH_QUERIES.json -r

Run Grinder with debug information about scanning:

./grinder.py -d -sk YOUR_SHODAN_API_KEY_HERE -ci YOUR_CENSYS_ID -cs YOUR_CENSYS_SECRET -q FILE_WITH_QUERIES.json -r

For more options and help use

./grinder.py -h

Add Your Own Queries

To add your own vendors and products with queries you can simply create a new .json file in the directory with queries and choose it while running Grinder in the "run" scan mode.

Format of file with queries:

[
    {
        "vendor": "YOUR OWN VENDOR HERE",
        "product": "YOUR OWN PRODUCT HERE",
        "shodan_queries": [
            {
                "query": "YOUR SHODAN QUERY HERE",
                "query_confidence": "QUERY CONFIDENCE LEVEL {tentative|firm|certain}"
            }
        ],
        "censys_queries": [
            {
                "query": "YOUR CENSYS QUERY HERE",
                "query_confidence": "QUERY CONFIDENCE LEVEL {tentative|firm|certain}"
            }
        ],
        "scripts": {
            "py_script": "NAME OF PYTHON SCRIPT FROM /custom_scripts/py_scripts",
            "nse_script": "NAME OF NSE SCRIPT FROM /custom_scripts/nse_scripts"
        },
        "vendor_confidence": "VENDOR CONFIDENCE LEVEL {tentative|firm|certain}"
    },
    {
    
    }
]

shohrukh92 / grinder Goto Github PK

grinder's Introduction