Modification of open source python tool

Hello!

We are small team of pentesters. We use one tool for checking vulns and weak passwords during in our pentest job. And we need someone who can improve it.

Link on the github:

[login to view URL]

Here technical task list below

-Adding additional configuration flags:

--nocookie - do not collect cookies

with this key, donpapi should work the same as the opensource version with the exception of

-data from chrome 80+ is collected and decrypted

-cookies are not collected from any browsers in any way

-cvs -output both csv and stdin

csv you need to make at least two files, one for cookies and one for everything else

the rest can also be split down, but it's up to you:

note: one for windows passwords, one for browser passwords, etc.)

--filter-file [somefilename] - do not load files if their names match your filename

--no-grab-files - no grabing files

--grab-catalog [[login to view URL]]

only collect files from directories which listed in [login to view URL]

Note - tool should be tested in case with using old and new keys together (it might have some problems, we will discuss it later)

--browsers-passes-only - gathering logins/passwords from browsers only. No collection of files/hashes/vnc/etc.

--use-crds-from-file

With this key the credentials dump function from the browser should work like this:

1. check for logged in users on the target machine (it's already implemented in the code on githab)

2. check for the credentials (logged in users) on the server where the software is running (read from the file)

3. Passes/cookie dump from the browser using the credentials of the logged in users.

-In the file collection function add a check for an empty file, and if the file is empty, the function should not pull it to the server.

-Write to the file \ variable environment \ etc current active IP (if the connection is broken it will remember where it failed and drop the remnants of the IP list as an output, not a finished process)

-implementation of cookies/passes extraction and decrypt from Chrome 80+ ( in open-source version its broken )

decrypt and extract should work with both auth-e by hash and auth-e by clear text passwords

-Collecting cookies/passes from Microsof IE \ Edge (IE already collects, but for some reason only if you give the .pvk key to the input)

-Collection of browser history Microsof IE \ Edge \ Chrome \ FF

-Collect Quick Access, recently used files from file-explore (output to stdin and csv)

Python Tietojen kaavinta verkosta Windows API

Projektin tunnus: #34240813

Tietoa projektista