📄 Advanced JUNG Smart Visu Security Scanner

=============================================================================================================================================
    | # Title     : Advanced JUNG Smart Visu Security Scanner                                                                                   |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
    | # Vendor    : https://www.jung-group.com                                                                                                  |
    =============================================================================================================================================
    
    [+] Summary    :  A multithreaded security scanner for JUNG Smart Visu servers that detects reflected XSS, header injection, open redirects, and JSON injection. 
                      It tests predefined endpoints with custom payloads, analyzes HTTP responses for vulnerabilities, and generates a detailed report of findings for authorized security testing purposes only.
    
    [+] POC   : 
    
    
    #!/usr/bin/env python3
    
    import requests
    import threading
    import queue
    import time
    import re
    import json
    import urllib.parse
    import warnings
    from colorama import init, Fore, Style
    from typing import Dict, List, Optional
    from dataclasses import dataclass
    from enum import Enum
    
    warnings.filterwarnings("ignore", message="Unverified HTTPS request")
    
    init(autoreset=True)
    
    class VulnerabilityType(Enum):
        XSS_REFLECTED = "Reflected XSS"
        XSS_DOM_BASED = "DOM-based XSS"
        OPEN_REDIRECT = "Open Redirect"
        HEADER_INJECTION = "Header Injection"
        JSON_INJECTION = "JSON Injection"
    
    @dataclass
    class Finding:
        endpoint: str
        vuln_type: VulnerabilityType
        payload: str
        context: str
        severity: str
        evidence: str
        exploitation_steps: List[str]
        remediation: str
    
    class AdvancedJUNGScanner:
    
        def __init__(self, target: str, threads: int = 5, timeout: int = 5):
            self.target = target.rstrip('/')
            self.threads = threads
            self.timeout = timeout
            self.findings = []
            self.lock = threading.Lock()
    
            self.session = requests.Session()
            self.session.headers.update({
                'User-Agent': 'Mozilla/5.0 (Security Research)'
            })
    
            self.endpoints = self.load_endpoints()
            self.payloads = self.load_payloads()
    
        def load_endpoints(self) -> List[str]:
            return [
                "/rest/items",
                "/rest/status",
                "/api/v1/status",
                "/jsonrpc",
                "/ui/dashboard",
                "/index.html",
                "/debug",
                "/console"
            ]
    
        def load_payloads(self) -> List[str]:
            return [
                "attacker.test",
                "evil.local",
                f"x{int(time.time())}.local"
            ]
    
        def analyze_response(self, response: requests.Response, payload: str, endpoint: str) -> Optional[Finding]:
    
            location = response.headers.get("Location", "")
            if payload in location:
                return Finding(
                    endpoint,
                    VulnerabilityType.OPEN_REDIRECT,
                    payload,
                    "Location Header",
                    "HIGH",
                    f"Location: {location}",
                    ["Value reflected inside Location header"],
                    "Do not use user input in redirection"
                )
            cookie = response.headers.get("Set-Cookie", "")
            if payload in cookie:
                return Finding(
                    endpoint,
                    VulnerabilityType.HEADER_INJECTION,
                    payload,
                    "Set-Cookie",
                    "MEDIUM",
                    f"Set-Cookie: {cookie}",
                    ["Value reflected inside cookie"],
                    "Filter input and enable HttpOnly flag"
                )
    
            if payload in response.text:
                return Finding(
                    endpoint,
                    VulnerabilityType.XSS_REFLECTED,
                    payload,
                    "Body Reflection",
                    "MEDIUM",
                    "Payload reflected in response body",
                    ["Direct reflection of the value"],
                    "Filter and encode inputs"
                )
    
            return None
    
        def worker(self, work_queue: queue.Queue):
    
            while True:
                try:
                    endpoint, payload = work_queue.get(timeout=1)
                    url = f"{self.target}{endpoint}"
    
                    headers = {
                        "X-Forwarded-Host": payload
                    }
    
                    try:
                        response = self.session.get(
                            url,
                            headers=headers,
                            timeout=self.timeout,
                            verify=False,
                            allow_redirects=False
                        )
    
                        finding = self.analyze_response(response, payload, endpoint)
    
                        if finding:
                            with self.lock:
                                self.findings.append(finding)
    
                            print(f"{Fore.RED}[DISCOVERY]{Style.RESET_ALL} {endpoint}")
    
                    except Exception:
                        pass
    
                    work_queue.task_done()
    
                except queue.Empty:
                    break
    
        def scan(self) -> List[Finding]:
    
            print(f"\n{Fore.CYAN}{'='*60}")
            print(" JUNG Smart Visu Scanner - Stable Version ")
            print(f"{'='*60}{Style.RESET_ALL}")
            print(f"Target: {self.target}")
            print(f"Number of Endpoints: {len(self.endpoints)}")
            print(f"{'='*60}\n")
    
            work_queue = queue.Queue()
    
            for endpoint in self.endpoints:
                for payload in self.payloads:
                    work_queue.put((endpoint, payload))
    
            threads = []
    
            for _ in range(self.threads):
                t = threading.Thread(target=self.worker, args=(work_queue,))
                t.start()
                threads.append(t)
    
            for t in threads:
                t.join()
    
            return self.findings
    
    def generate_report(findings: List[Finding], target: str) -> str:
    
        report = f"""
    ========================================
    Security Scan Report
    ========================================
    Target: {target}
    Date: {time.strftime('%Y-%m-%d %H:%M:%S')}
    Total Findings: {len(findings)}
    
    """
    
        for i, f in enumerate(findings, 1):
            report += f"""
    {i}. {f.vuln_type.value}
       Path: {f.endpoint}
       Severity: {f.severity}
       Evidence: {f.evidence}
    """
    
        return report
    
    def main():
    
        import sys
    
        if len(sys.argv) < 2:
            print(f"Usage: python3 {sys.argv[0]} <target>")
            sys.exit(1)
    
        target = sys.argv[1]
    
        scanner = AdvancedJUNGScanner(target)
        findings = scanner.scan()
    
        report = generate_report(findings, target)
    
        file_name = f"scan_report_{int(time.time())}.txt"
    
        with open(file_name, "w", encoding="utf-8") as f:
            f.write(report)
    
        print(f"\n{Fore.GREEN}Report saved to: {file_name}{Style.RESET_ALL}")
    
        if findings:
            print(f"{Fore.RED}Found {len(findings)} result(s){Style.RESET_ALL}")
        else:
            print(f"{Fore.GREEN}No results found{Style.RESET_ALL}")
    
    
    if __name__ == "__main__":
        main()
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================