Cryptography Security Testing added

Author: Antu7

Framework/Built_In_Automation/Security/nmap_scan.py

@@ -8,6 +8,10 @@
 from pathlib import Path
 import shutil
 from datetime import datetime, timedelta
+import socket
+import ssl
+import urllib.request
+import urllib.parse
 
 def run_nmap(ip, output_dir=None):
     os.makedirs(output_dir, exist_ok=True)
@@ -160,7 +164,7 @@ def parse_nmap_output(xml_file):
 
     return vulnerabilities, scan_info
 
-def generate_html(vulnerabilities, scan_info, target_ip, output_dir=None):
+def generate_html(vulnerabilities, scan_info, target_ip, output_dir=None, crypto_data=None):
     """Generate HTML report for security vulnerabilities."""
 
     severity_counts = {
@@ -595,6 +599,8 @@ def generate_html(vulnerabilities, scan_info, target_ip, output_dir=None):
             </div>
             ''' if not is_clean else ''}
             
+            {get_crypto_html_snippets(crypto_data) if crypto_data else ''}
+            
             <footer>
                 <p>Generated by Zeuz Security Automation Framework &bull; {current_datetime}</p>
             </footer>
@@ -675,7 +681,11 @@ def generate_html(vulnerabilities, scan_info, target_ip, output_dir=None):
 
 def nmap_scan_run(url, security_report_dir=None):
     ip_address = url
-    security_report_dir.mkdir(parents=True, exist_ok=True)
+    if hasattr(security_report_dir, 'mkdir'):
+        security_report_dir.mkdir(parents=True, exist_ok=True)
+    elif security_report_dir:
+        os.makedirs(security_report_dir, exist_ok=True)
+        
     print(f"Saving all reports directly to: {security_report_dir}")
     print("Running Nmap scan. It may take a while...")
     xml_result, text_result = run_nmap(ip_address, security_report_dir)
@@ -686,11 +696,337 @@ def nmap_scan_run(url, security_report_dir=None):
     print("Parsing results...")
     vuln_data, scan_info = parse_nmap_output(xml_result)
 
+    print("Running Cryptography & Surface Level scan (Background)...")
+    crypto_data = get_cryptography_data(ip_address)
+    
     print("Generating HTML report...")
-    html_result = generate_html(vuln_data, scan_info, ip_address, security_report_dir)
+    html_result = generate_html(vuln_data, scan_info, ip_address, security_report_dir, crypto_data)
 
     return {
         "xml": xml_result,
         "txt": text_result,
+        "html": html_result,
+        "crypto": crypto_data
+    }
+
+def get_crypto_html_snippets(crypto_data):
+    ssl_info = crypto_data.get('ssl', {})
+    headers_info = crypto_data.get('headers', {})
+    banner_info = crypto_data.get('banner', {})
+    whois_info = crypto_data.get('whois', {})
+    geo_info = crypto_data.get('geo', {})
+    osint_info = crypto_data.get('osint', {})
+    
+    def badge(value, expected=None, good='Good', is_tls=False):
+        if is_tls:
+             if 'Good' in value: return f'<span class="badge" style="background:var(--success); color:white;">{value}</span>'
+             else: return f'<span class="badge" style="background:var(--danger); color:white;">{value}</span>'
+             
+        if isinstance(value, str) and value.lower() in ['missing', 'invalid', 'hidden', 'unknown', 'true', 'false']:
+            if value.lower() == 'true' and expected is False:
+                return f'<span class="badge" style="background:var(--danger); color:white;">Yes</span>'
+            elif value.lower() == 'false' and expected is False:
+                return f'<span class="badge" style="background:var(--success); color:white;">No</span>'
+            elif value.lower() == 'missing' or (value.lower() == 'true'):
+                return f'<span class="badge" style="background:var(--warning); color:white;">{value}</span>'
+            return f'<span class="badge badge-secondary" style="background:#e2e8f0; color:#475569;">{value}</span>'
+            
+        if expected is not None:
+            if value == expected:
+                return f'<span class="badge" style="background:var(--success); color:white;">{good}</span>'
+            else:
+                if ssl_info.get('blocked'):
+                     return f'<span class="badge" style="background:var(--warning); color:white;">Domain Blocked</span>'
+                return f'<span class="badge" style="background:var(--danger); color:white;">High Risk</span>'
+                
+        return f'<span class="badge" style="background:var(--primary); color:white;">{value}</span>'
+
+    tls_versions_html = ""
+    for tls_ver, strength in ssl_info.get("tls_versions", []):
+        tls_versions_html += f"<div>{tls_ver}: {badge(strength, is_tls=True)}</div>"
+    if not tls_versions_html:
+        tls_versions_html = "<div><span class='badge badge-secondary' style='background:#e2e8f0; color:#475569;'>Unknown - Detection failed</span></div>"
+        
+    ssl_error_html = f" <span style='color:var(--danger); font-size:13px; font-weight:500; margin-left:8px;'>({ssl_info.get('error', 'Validation Failed')})</span>" if not ssl_info.get('valid') and ssl_info.get('error') else ""
+
+    osint_html = ""
+    if osint_info.get('subdomains'):
+        osint_html = f"""
+            <div class="card">
+                <div class="section-title">OSINT & Web Footprint</div>
+                <table>
+                    <tbody>
+                        <tr><td width="30%">Public Subdomains (Top 15 via crt.sh & HackerTarget)</td><td>{'<br>'.join(f"<span>{s}</span>" for s in osint_info['subdomains'])}</td></tr>
+                    </tbody>
+                </table>
+            </div>"""
+
+    return f"""
+            <div class="card">
+                <div class="section-title">SSL / TLS Configuration</div>
+                <table>
+                    <tbody>
+                        <tr><td width="30%">Valid Certificate</td><td>{badge(ssl_info.get('valid', 'Unknown'), expected=True, good='Yes')}{ssl_error_html}</td></tr>
+                        <tr><td>Expired</td><td>{badge(str(ssl_info.get('expired', 'Unknown')), expected=False, good='No')}</td></tr>
+                        <tr><td>Self-Signed</td><td>{badge(str(ssl_info.get('self_signed', 'Unknown')), expected=False, good='No')}</td></tr>
+                        <tr><td>Wrong Hostname</td><td>{badge(str(ssl_info.get('wrong_hostname', 'Unknown')), expected=False, good='No')}</td></tr>
+                        <tr><td>Issuer</td><td><span class="badge badge-secondary" style="background:#e2e8f0; color:#475569;">{ssl_info.get('issuer', 'Unknown')}</span></td></tr>
+                        <tr><td>Expiry Date</td><td><span class="badge badge-secondary" style="background:#e2e8f0; color:#475569;">{ssl_info.get('not_after', 'Unknown')}</span></td></tr>
+                        <tr><td>Supported TLS Versions</td><td>{tls_versions_html}</td></tr>
+                    </tbody>
+                </table>
+            </div>
+
+            <div class="card">
+                <div class="section-title">Security Headers</div>
+                <table>
+                    <tbody>
+                        <tr><td width="30%">Strict-Transport-Security</td><td>{badge(headers_info.get('Strict-Transport-Security', 'Missing'))}</td></tr>
+                        <tr><td>Content-Security-Policy</td><td>{badge(headers_info.get('Content-Security-Policy', 'Missing'))}</td></tr>
+                        <tr><td>X-Content-Type-Options</td><td>{badge(headers_info.get('X-Content-Type-Options', 'Missing'))}</td></tr>
+                    </tbody>
+                </table>
+            </div>
+
+            <div class="card">
+                <div class="section-title">Server Banner Information</div>
+                <table>
+                    <tbody>
+                        <tr><td width="30%">Server</td><td><span class="badge" style="background:var(--primary); color:white;">{banner_info.get('Server', 'Hidden')}</span></td></tr>
+                        <tr><td>X-Powered-By</td><td><span class="badge" style="background:var(--warning); color:white;">{banner_info.get('X-Powered-By', 'Hidden')}</span></td></tr>
+                    </tbody>
+                </table>
+            </div>
+
+            <div class="card">
+                <div class="section-title">WHOIS Information</div>
+                <table>
+                    <tbody>
+                        <tr><td width="30%">Registrar</td><td><strong>{whois_info.get('Registrar', 'Unknown')}</strong></td></tr>
+                        <tr><td>Creation Date</td><td>{whois_info.get('Creation Date', 'Unknown')}</td></tr>
+                        <tr><td>Expiry Date</td><td>{whois_info.get('Expiry Date', 'Unknown')}</td></tr>
+                    </tbody>
+                </table>
+            </div>
+
+            <div class="card">
+                <div class="section-title">IP Geolocation</div>
+                <table>
+                    <tbody>
+                        <tr><td width="30%">IP Address</td><td><strong>{geo_info.get('IP', 'Unknown')}</strong></td></tr>
+                        <tr><td>Country</td><td>{geo_info.get('Country', 'Unknown')}</td></tr>
+                        <tr><td>Hosting Provider / ISP</td><td>{geo_info.get('Hosting Provider', 'Unknown')}</td></tr>
+                    </tbody>
+                </table>
+            </div>
+            {osint_html}
+"""
+
+def generate_crypto_html(report_data, target, output_dir=None):
+    current_datetime = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+    
+    domain = report_data.get('domain', target)
+
+    html_template = f"""
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        <title>Cryptography Scan Report - {domain}</title>
+        <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&display=swap" rel="stylesheet">
+        <style>
+            :root {{
+                --primary: #2563eb;
+                --secondary: #64748b;
+                --success: #10b981;
+                --warning: #f59e0b;
+                --danger: #ef4444;
+                --dark: #0f172a;
+                --light: #f8fafc;
+                --surface: #ffffff;
+                --border: #e2e8f0;
+            }}
+            body {{ font-family: 'Inter', sans-serif; margin: 0; padding: 0; background-color: #f1f5f9; color: #334155; line-height: 1.6; }}
+            .container {{ max-width: 1000px; margin: 0 auto; padding: 20px; }}
+            .header {{ background: linear-gradient(135deg, #1e293b 0%, #0f172a 100%); color: white; padding: 40px 0; margin-bottom: -60px; padding-bottom: 80px; }}
+            .header-content {{ max-width: 1000px; margin: 0 auto; padding: 0 20px; display: flex; justify-content: space-between; align-items: center; }}
+            .logo h1 {{ margin: 0; font-size: 24px; font-weight: 700; letter-spacing: -0.5px; }}
+            .logo p {{ margin: 5px 0 0; opacity: 0.8; font-size: 14px; }}
+            .card {{ background: white; border-radius: 12px; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1); padding: 24px; margin-bottom: 24px; border: 1px solid var(--border); }}
+            .section-title {{ font-size: 18px; font-weight: 600; color: var(--dark); margin-top: 0; margin-bottom: 20px; padding-bottom: 15px; border-bottom: 1px solid var(--border); }}
+            table {{ width: 100%; border-collapse: collapse; }}
+            th {{ text-align: left; padding: 12px 16px; font-size: 12px; font-weight: 600; text-transform: uppercase; color: var(--secondary); background: #f8fafc; border-bottom: 1px solid var(--border); }}
+            td {{ padding: 12px 16px; border-bottom: 1px solid var(--border); font-size: 14px; vertical-align: top; }}
+            tr:last-child td {{ border-bottom: none; }}
+            .badge {{ display: inline-block; padding: 4px 8px; border-radius: 4px; font-size: 12px; font-weight: 600; color: white;}}
+            .font-mono {{ font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace; }}
+            footer {{ text-align: center; padding: 40px; color: var(--secondary); font-size: 13px; }}
+        </style>
+    </head>
+    <body>
+        <div class="header">
+            <div class="header-content">
+                <div class="logo">
+                    <h1>Cryptography Scan Report</h1>
+                    <p>Target: {domain}</p>
+                </div>
+                <div class="scan-meta">
+                    <div>{current_datetime}</div>
+                </div>
+            </div>
+        </div>
+        <div class="container">
+            {get_crypto_html_snippets(report_data)}
+            <footer>
+                <p>Generated by Zeuz Security Automation Framework &bull; {current_datetime}</p>
+            </footer>
+        </div>
+    </body>
+    </html>
+    """
+    
+    if output_dir:
+        os.makedirs(output_dir, exist_ok=True)
+    else:
+        output_dir = '.'
+    out_path = os.path.join(output_dir, f"crypto_report_{domain.replace('.', '_')}.html")
+    with open(out_path, "w", encoding="utf-8") as f:
+         f.write(html_template)
+    print(f"Enhanced cryptography report saved: {out_path}")
+    return out_path
+
+
+def cryptography_scan_run(url, security_report_dir=None):
+    if hasattr(security_report_dir, 'mkdir'):
+        security_report_dir.mkdir(parents=True, exist_ok=True)
+    elif security_report_dir:
+        os.makedirs(security_report_dir, exist_ok=True)
+        
+    print(f"Running Cryptography scan for {url}...")
+    
+def get_cryptography_data(url):
+    if not url.startswith("http"):
+        url = "https://" + url
+
+    parsed = urllib.parse.urlparse(url)
+    domain = parsed.netloc.split(':')[0]
+    
+    report_data = {
+        "domain": domain,
+        "url": url,
+        "ssl": {"valid": False, "expired": False, "self_signed": False, "wrong_hostname": False, "tls_versions": []},
+        "headers": {},
+        "banner": {},
+        "whois": {},
+        "geo": {}
+    }
+    # 1. SSL Certificate Info
+    print(f"[{domain}] Fetching SSL/TLS Certificate information...", flush=True)
+    try:
+        context = ssl.create_default_context()
+        try:
+             with socket.create_connection((domain, 443), timeout=2) as sock:
+                 with context.wrap_socket(sock, server_hostname=domain) as ssock:
+                     cert = ssock.getpeercert()
+                     report_data['ssl']['expired'] = ssl.cert_time_to_seconds(cert['notAfter']) < time.time()
+                     
+                     issuer = dict(x[0] for x in cert.get('issuer', []))
+                     subject = dict(x[0] for x in cert.get('subject', []))
+                     report_data['ssl']['self_signed'] = issuer == subject
+                     
+                     report_data['ssl']['valid'] = True
+                     report_data['ssl']['not_after'] = cert['notAfter']
+                     report_data['ssl']['issuer'] = issuer.get('organizationName', issuer.get('commonName', 'Unknown'))
+                     
+                     # Check TLS Version while socket is open
+                     ver = ssock.version()
+                     if ver:
+                         strength = 'Good' if ver in ['TLSv1.2', 'TLSv1.3'] else 'Weak'
+                         report_data['ssl']['tls_versions'] = [(ver, strength)]
+                         
+        except ssl.CertificateError as e:
+            report_data['ssl']['wrong_hostname'] = True
+            report_data['ssl']['valid'] = False
+            report_data['ssl']['error'] = str(e)
+            
+            # Reconnect without verification to get cert info anyway
+            ctx_no_verify = ssl._create_unverified_context()
+            with socket.create_connection((domain, 443), timeout=2) as sock:
+                 with ctx_no_verify.wrap_socket(sock, server_hostname=domain) as ssock:
+                     cert = ssock.getpeercert()
+                     if cert:
+                         report_data['ssl']['expired'] = ssl.cert_time_to_seconds(cert['notAfter']) < time.time()
+                         issuer = dict(x[0] for x in cert.get('issuer', []))
+                         report_data['ssl']['not_after'] = cert['notAfter']
+                         report_data['ssl']['issuer'] = issuer.get('organizationName', issuer.get('commonName', 'Unknown'))
+                     ver = ssock.version()
+                     if ver:
+                         strength = 'Good' if ver in ['TLSv1.2', 'TLSv1.3'] else 'Weak'
+                         report_data['ssl']['tls_versions'] = [(ver, strength)]
+    except Exception as e:
+        report_data['ssl']['valid'] = 'Error'
+        report_data['ssl']['error'] = str(e)
+        if '[Errno 54]' in str(e) or 'timed out' in str(e).lower() or 'Connection refused' in str(e):
+            report_data['ssl']['blocked'] = True
+            print(f"[{domain}] WARNING: Access Blocked/Reset by Domain Firewall/WAF.", flush=True)
+
+    # 2. HTTP Headers & Server Banner
+    print(f"[{domain}] Fetching HTTP Security Headers...", flush=True)
+    try:
+        ctx = ssl._create_unverified_context()
+        req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'})
+        with urllib.request.urlopen(req, context=ctx, timeout=2) as resp:
+            headers = resp.headers
+    except urllib.error.HTTPError as e:
+        headers = e.headers
+    except Exception as e:
+        headers = {}
+        report_data['headers']['error'] = str(e)
+
+    if headers:
+        report_data['headers'] = {
+            "Strict-Transport-Security": headers.get("Strict-Transport-Security", "Missing"),
+            "Content-Security-Policy": headers.get("Content-Security-Policy", "Missing"),
+            "X-Content-Type-Options": headers.get("X-Content-Type-Options", "Missing")
+        }
+        report_data['banner'] = {
+            "Server": headers.get("Server", "Hidden"),
+            "X-Powered-By": headers.get("X-Powered-By", headers.get("X-Powered-By-Plesk", "Hidden"))
+        }
+
+    # 3. IP Geolocation ONLY
+    print(f"[{domain}] Fetching IP Geolocation...", flush=True)
+    try:
+        ip = socket.gethostbyname(domain)
+        geo_req = urllib.request.Request(f"http://ip-api.com/json/{ip}")
+        with urllib.request.urlopen(geo_req, timeout=2) as geo_resp:
+            geo_data = json.loads(geo_resp.read().decode())
+            report_data['geo'] = {
+                "IP": ip,
+                "Country": geo_data.get("country", "Unknown"),
+                "Hosting Provider": geo_data.get("isp", geo_data.get("org", "Unknown"))
+            }
+    except Exception as e:
+        report_data['geo'] = {"IP": socket.gethostbyname(domain) if 'domain' in locals() else 'Unknown'}
+
+    return report_data
+
+
+def cryptography_scan_run(url, security_report_dir=None):
+    if hasattr(security_report_dir, 'mkdir'):
+        security_report_dir.mkdir(parents=True, exist_ok=True)
+    elif security_report_dir:
+        os.makedirs(security_report_dir, exist_ok=True)
+        
+    print(f"Running Cryptography scan for {url}...")
+    
+    report_data = get_cryptography_data(url)
+    domain = report_data.get("domain", url)
+
+    html_result = generate_crypto_html(report_data, domain, security_report_dir)
+    print("Cryptography scan complete!")
+    return {
+        "report_data": report_data,
         "html": html_result
     }