Git Product home page Git Product logo

spartan's Introduction

SPartan

by Keiran Dennie

Requirements

The requests_ntlm and beautifulsoup4 libraries are required. Use the following command to install these with pip:

pip install -r requirements.txt

Overview

SPartan is a Frontpage and Sharepoint fingerprinting and attack tool. Features:

  • Sharepoint and Frontpage fingerprinting
  • Management of Friendly 404s
  • Default Sharepoint and Frontpage file and folder enumeration
  • Active Directory account enumeration
  • Download interesting files and documents, including detection of uninterpreted ASP and ASPX
  • Search for keywords in identified pages
  • Saves state from previous scans
  • Site crawling
  • Accepts NTLM creds and session cookies for authenticated scans

Usage

Some information needed for SPartan Usage:

python SPartan.py -u http://127.0.0.1 -f -c Note: You need to add 'http(s)://' to the URL

  • -u: host URL to scan including HTTP/HTTPS
  • -c: crawl the site for links (CTRL-C to stop crawling)
  • -f: perform frontpage scans
  • -k: scrape identified pages for keywords (works well with crawl)
  • -s: perform sharepoint scans
  • --sps: discover sharepoint SOAP services
  • --users: List users using Search Principals
  • -r: (COMING SOON)execute a specified Frontpage RPC query
  • -t: set maximum amount of threads (10 default)
  • -p: (COMING SOON)find putable directories)
  • --cookie: "use a cookie for authenticated scans
  • -d: download pdf, doc, docx, txt, config, xml, xls, xlsx, webpart, config, conf, stp, csv and asp/aspx(uninterpreted)
  • -l: provide credentials for authentication to Sharepoint e.g., domain\user:password
  • -v: Render verbose output. By default SPartan will only render found resources.
  • -i: Don't attempt to verify SSL

License

SPartan by SensePost is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License (http://creativecommons.org/licenses/by-sa/4.0/) Permissions beyond the scope of this license may be available at http://sensepost.com/contact us/.

spartan's People

Contributors

ahmedsherif avatar singe avatar testingpens avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

spartan's Issues

Error when installing requirements

Hey, when i'm doing:

pip install -r requirements.txt

I have this error:

Collecting beautifulsoup4==4.4.1 (from -r requirements.txt (line 1)) Using cached https://files.pythonhosted.org/packages/33/62/f3e97eaa87fc4de0cb9b8c51d253cf0df621c6de6b25164dcbab203e5ff7/beautifulsoup4-4.4.1-py2-none-any.whl Requirement already satisfied: python-ntlm3==1.0.2 in /usr/local/lib/python2.7/dist-packages (from -r requirements.txt (line 2)) (1.0.2) Collecting requests==2.20.1 (from -r requirements.txt (line 3)) Could not find a version that satisfies the requirement requests==2.20.1 (from -r requirements.txt (line 3)) (from versions: 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.4.0, 0.4.1, 0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.6, 0.10.7, 0.10.8, 0.11.1, 0.11.2, 0.12.0, 0.12.1, 0.13.0, 0.13.1, 0.13.2, 0.13.3, 0.13.4, 0.13.5, 0.13.6, 0.13.7, 0.13.8, 0.13.9, 0.14.0, 0.14.1, 0.14.2, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.8.0, 2.8.1, 2.9.0, 2.9.1, 2.9.2, 2.10.0, 2.11.0, 2.11.1, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.12.4, 2.12.5, 2.13.0, 2.14.0, 2.14.1, 2.14.2, 2.15.1, 2.16.0, 2.16.1, 2.16.2, 2.16.3, 2.16.4, 2.16.5, 2.17.0, 2.17.1, 2.17.2, 2.17.3, 2.18.0, 2.18.1, 2.18.2, 2.18.3, 2.18.4, 2.19.0, 2.19.1, 2.20.0) No matching distribution found for requests==2.20.1 (from -r requirements.txt (line 3))

That version of requests doesn't exist I think on Pypi right now (https://pypi.org/project/requests/#history).

BTW, the framework is working good with requests 2.20.0.

Kali error - SyntaxWarning

i'm getting the following error. After the error it goes back to a command prompt and SPartan isn't launched.

SPartan.py:733: SyntaxWarning: name 'authed' is assigned to before global declaration
global authed

██████ ██▓███ ▄▄▄ ██▀███ ▄▄▄█████▓▄▄▄ ███▄ █
▒██ ▒▓██░ ██▒████▄ ▓██ ▒ ██▓ ██▒ ▓▒████▄ ██ ▀█ █
░ ▓██▄ ▓██░ ██▓▒██ ▀█▄ ▓██ ░▄█ ▒ ▓██░ ▒▒██ ▀█▄ ▓██ ▀█ ██▒
▒ ██▒██▄█▓▒ ░██▄▄▄▄██▒██▀▀█▄ ░ ▓██▓ ░░██▄▄▄▄██▓██▒ ▐▌██▒
▒██████▒▒██▒ ░ ░▓█ ▓██░██▓ ▒██▒ ▒██▒ ░ ▓█ ▓██▒██░ ▓██░
▒ ▒▓▒ ▒ ▒▓▒░ ░ ░▒▒ ▓▒█░ ▒▓ ░▒▓░ ▒ ░░ ▒▒ ▓▒█░ ▒░ ▒ ▒
░ ░▒ ░ ░▒ ░ ▒ ▒▒ ░ ░▒ ░ ▒░ ░ ▒ ▒▒ ░ ░░ ░ ▒░
░ ░ ░ ░░ ░ ▒ ░░ ░ ░ ░ ▒ ░ ░ ░
░ ░ ░ ░ ░ ░ ░
Sharepoint & Frontpage Scanner

Printing issue on Windows

I know there's been a while from the last commit, but need to mention that on Windows, the printing is not good. It prints the color code instead of change the color (not the same terminal as unix).

Error when running in Kali

Hello,

I'm trying to run Spartan in Kali 2018.4 and i get the following error :
SPartan.py:733: SyntaxWarning: name 'authed' is assigned to before global declaration
global authed
Traceback (most recent call last):
File "SPartan.py", line 25, in
import argparse,requests,sys,os,threading,bs4,warnings,random
File "/usr/local/lib/python2.7/dist-packages/bs4/init.py", line 30, in
from .builder import builder_registry, ParserRejectedMarkup
File "/usr/local/lib/python2.7/dist-packages/bs4/builder/init.py", line 314, in
from . import _html5lib
File "/usr/local/lib/python2.7/dist-packages/bs4/builder/_html5lib.py", line 70, in
class TreeBuilderForHtml5lib(html5lib.treebuilders._base.TreeBuilder):
AttributeError: 'module' object has no attribute '_base'

Please advise

Error when running an authenticated scan

global name 'ignore_ssl' is not defined
Verbosity is set to HIGH. Spartan will print all resources found.
Exception in thread Thread-1:
Traceback (most recent call last):
File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner
self.run()
File "SPartan.py", line 496, in run
self.urlProcessor(self.url)
File "SPartan.py", line 523, in urlProcessor
if authed:

NameError: global name 'authed' is not defined

I am setting the credentials using the -l option (-l domain.com\username:test)
Uncredentialed scan runs just fine.

Getting this Error

while running the command, i got this on linux:

File "SPartan.py", line 79
    print accountElement.rsplit('|', 1)[1]
                       ^
SyntaxError: invalid syntax

Error when running

root:~/enum/SPartan]# python SPartan.py -u http://10.10.10.59:80 -s (master✱)
Traceback (most recent call last):
File "SPartan.py", line 25, in
import argparse,requests,sys,os,threading,bs4,warnings,random
File "/usr/local/lib/python2.7/dist-packages/bs4/init.py", line 30, in
from .builder import builder_registry, ParserRejectedMarkup
File "/usr/local/lib/python2.7/dist-packages/bs4/builder/init.py", line 314, in
from . import _html5lib
File "/usr/local/lib/python2.7/dist-packages/bs4/builder/_html5lib.py", line 70, in
class TreeBuilderForHtml5lib(html5lib.treebuilders._base.TreeBuilder):
AttributeError: 'module' object has no attribute '_base'

Running on Kali 2017.2

Ability to cross an HTTP proxy

Hello there,

As a lot of corporate networks require crossing an HTTP proxy to reach global resources such as SharePoint sites, it would be cool to implement thru-proxy connection in your tool.
You can do it painlessly with the imported requests module.

Cheers.

error when running

Hi please see the error message below; need your help in this

root@kali:~/Downloads/SPartan# python SPartan.py --help
SPartan.py:733: SyntaxWarning: name 'authed' is assigned to before global declaration
global authed
Traceback (most recent call last):
File "SPartan.py", line 27, in
from requests_ntlm import HttpNtlmAuth
ImportError: No module named requests_ntlm

Kerberos support

That one is not easy but Kerberos support would also be great :)
Take a look a the python impacket module ;)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.