AI大模型红队渗透测试（附代码）

# ai_recon.py__author__ = "Omar Santos"__version__ = "0.1.0"__license__ = "BSD 3-Clause"__description__ = "AI-powered OSINT Analysis of hosts based on certificatetransparency logs"__usage__ = "python3 ai_recon.py secretcorp.org"# Import the necessary librariesfrom certspy import certspyfrom dotenv import load_dotenvfrom langchain.prompts import ChatPromptTemplatefrom langchain_openai import ChatOpenAIimport osimport argparseimport socketfrom ipwhois import IPWhoisimport dns.resolverdef load_environment():    load_dotenv()    return ChatOpenAI(model="gpt-4o-mini")def create_prompt_template(domain):    template = f"""You are an expert security researcher and OSINT investigatorspecializing in analyzing domain information for {domain}.    Given the following information about SSL/TLS certificates associated with{domain}, provide an analysis:    Domain: {domain}    Certificate Information:    {{cert_info}}    Please analyze this information and provide insights on:    1. The security posture of the domain    2. Any potential sensitive hosts    3. Additional reconnaissance steps that could be taken based on this information    4. Any other relevant observations    Your analysis:"""    return ChatPromptTemplate.from_template(template)def get_certificate_info(domain):    try:        api = certspy.certspy()        results = api.search(domain)        if results:            formatted_results = api.format_results(results, common_name_only=True)            return formatted_results        return None    except Exception as e:        print(f"Error retrieving certificate info: {e}")        return Nonedef resolve_dns(hostname):    try:        return socket.gethostbyname(hostname)    except socket.gaierror:        return Nonedef get_whois_info(ip):    try:        obj = IPWhois(ip)        results = obj.lookup_rdap(depth=1)        org = results.get('network', {}).get('name')        cidr = results.get('network', {}).get('cidr')        return org, cidr    except Exception:        return None, Nonedef analyze_hostnames(cert_info):    additional_info = []    for hostname in cert_info:        ip = resolve_dns(hostname)        if ip:            org, cidr = get_whois_info(ip)            additional_info.append(f"Hostname: {hostname}nIP:{ip}nOrganization: {org}nCIDR: {cidr}n")    return "n".join(additional_info)def analyze_domain(model, prompt_template, domain, cert_info):    prompt = prompt_template.invoke({"cert_info": cert_info})    return model.invoke(prompt)def parse_arguments():    parser = argparse.ArgumentParser(description="AI-powered OSINT Analysis ofhosts based on certificate transparency logs")    parser.add_argument("domain", help="The domain to analyze")    return parser.parse_args()def main():    args = parse_arguments()    domain = args.domain    print(f"-----OSINT Analysis of Domain {domain}-----")    model = load_environment()    prompt_template = create_prompt_template(domain)    cert_info = get_certificate_info(domain)    if cert_info:        print("n----- Raw Certificate Information -----")        print("Hostnames:")        for hostname in cert_info:            print(f"  {hostname}")        print("n----- DNS Resolution and WHOIS Information -----")        additional_info = []        for hostname in cert_info:            print(f"nHostname: {hostname}")            ip = resolve_dns(hostname)            if ip:                print(f"IP: {ip}")                org, cidr = get_whois_info(ip)                print(f"Organization: {org}")                print(f"CIDR: {cidr}")                additional_info.append(f"Hostname: {hostname}nIP:{ip}nOrganization: {org}nCIDR: {cidr}n")            else:                print("DNS resolution failed")        full_info = "n".join(cert_info) + "nnAdditional Information:n" + "n".join(additional_info)        print("n----- AI Analysis -----")        result = analyze_domain(model, prompt_template, domain, full_info)        print(result.content)    else:        print(f"No certificate information found for {domain}")if __name__ == "__main__":    main()

-----OSINT Analysis of Domain secretcorp.org-----### Analysis of SSL/TLS Certificates for secretcorp.org#### 1. Security Posture of the DomainThe domain secretcorp.org has multiple subdomains that are linked to differentIP addresses and organizations.- Organization: The majority of the subdomains (backdoor, mail, internal,secretcorp, app1, vpn, finance-app, cloud) are associated with 'US-GITHUB-20170413', suggesting a centralized control and potentially sharedresources. The presence of a subdomain named 'backdoor' is particularlyconcerning as it may imply a weak or intentionally lax security posture, whichcould facilitate unauthorized access or exploitation.- IP Addresses: The IP addresses associated with the subdomains fall within twodifferent CIDR blocks (185.199.108.0/22 and 198.49.23.0/24). The latter isassociated with Squarespace, which indicates that some services may be hosted on athird-party platform. This could introduce vulnerabilities if the hosting providerhas security issues.- SSL/TLS Certificates: The use of SSL/TLS is indicative of an attempt to securecommunications for these subdomains. However, the effectiveness of this securitylayer largely depends on proper certificate management, including ensuring thatcertificates are valid, up-to-date, and not using deprecated cryptographicalgorithms.#### 2. Potential Sensitive HostsThe following subdomains stand out as potentially sensitive:- backdoor.secretcorp.org: The name itself suggests that it may be a point of entryfor unauthorized access or a hidden service. This warrants immediate investigation.- mail.secretcorp.org: This subdomain likely handles email communications, makingit a target for phishing or data breaches.- internal.secretcorp.org: This suggests an internal network resource which shouldnot be exposed publicly. If exposed, this could be a significant security risk.- finance-app.secretcorp.org: This implies a financial application which could bea target for attackers looking to steal sensitive information or exploit financialtransactions.#### 3. Additional Reconnaissance StepsBased on the information provided, the following additional reconnaissance stepscould be taken.- DNS Enumeration: Use DNS enumeration tools to uncover other potential subdomainsassociated with secretcorp.org that may not be publicly listed.- Port Scanning: Conduct port scans on the IP addresses associated with thesensitive subdomains to identify open ports and services running on them.- Web Application Testing: Perform web application security testing, includingvulnerability scanning and penetration testing, particularly on sensitivesubdomains like 'finance-app' and 'mail'.- Social Engineering: Investigate any social engineering possibilities, such asresearching employees or public-facing personnel who may inadvertently exposesensitive information.- Threat Intelligence: Utilize threat intelligence platforms to check if any of thedomains or IPs have been reported in security incidents or breaches.#### 4. Other Relevant Observations- Concentration of IPs: Most of the subdomains share the same IP address(185.199.109.153), which could indicate that they are hosted on the same serveror service. If this server is compromised, multiple services could be affected.- Lack of Diversity in Hosting: The reliance on a single organization (US-GITHUB-20170413) for most of the subdomains may introduce a single point offailure in terms of security. If this organization's security is compromised, itcould impact all services under their control.- Potential for Misconfiguration: Given the presence of a subdomain named'backdoor', there may be misconfigurations in the domain's security posture thatneed to be addressed immediately to prevent exploitation.- Monitoring and Alerting: It would be prudent for secretcorp.org to implementmonitoring and alerting for unusual traffic patterns, especially targetingsensitive subdomains.### ConclusionThe analysis of the SSL/TLS certificates associated with secretcorp.org revealsa domain with potentially sensitive subdomains that could be at risk. Immediateattention should be given to the 'backdoor' subdomain, along with enhancedsecurity measures for email and internal resources. Further reconnaissanceand security testing are recommended to assess vulnerabilities and improve theoverall security posture of the domain.