275 lines
8.5 KiB
Markdown
275 lines
8.5 KiB
Markdown
# I2P Red-Team Scanner
|
|
|
|
**A dedicated web application security assessment tool for I2P eepsites.**
|
|
|
|
Built for certified red teamers and threat hunters to identify vulnerabilities and anonymity leaks within the I2P network.
|
|
|
|
---
|
|
|
|
## Table of Contents
|
|
- [Overview](#overview)
|
|
- [Features](#features)
|
|
- [Requirements](#requirements)
|
|
- [Installation](#installation)
|
|
- [Configuration](#configuration)
|
|
- [Usage](#usage)
|
|
- [Understanding the Results](#understanding-the-results)
|
|
- [Modules Explained](#modules-explained)
|
|
- [Reporting Findings](#reporting-findings)
|
|
- [Security and Legal Notice](#security-and-legal-notice)
|
|
- [Contributing](#contributing)
|
|
- [License](#license)
|
|
|
|
---
|
|
|
|
## Overview
|
|
|
|
The I2P Red-Team Scanner is the first dedicated penetration testing tool specifically designed for the Invisible Internet Project (I2P) network. Unlike conventional web application scanners that operate on the clearnet, this tool routes all traffic through the I2P proxy, allowing it to accurately assess the security posture of `.i2p` hidden services while detecting anonymity-layer vulnerabilities that traditional scanners miss.
|
|
|
|
### Why This Matters
|
|
- Standard security scanners cannot properly interact with I2P sites
|
|
- The anonymity layer introduces unique attack vectors (DNS leaks, SSL/TLS misconfigurations, external resource loading)
|
|
- Red teams and threat hunters need specialized tools to assess hidden services
|
|
- I2P network security has historically lacked dedicated assessment tooling
|
|
|
|
---
|
|
|
|
## Features
|
|
|
|
### Core Assessment Modules
|
|
- **Security Headers Analysis** - Detects missing X-Frame-Options, CSP, X-Content-Type-Options, and other critical security headers
|
|
- **Version Fingerprinting** - Identifies server software versions and checks against a CVE database for known vulnerabilities
|
|
- **Data Leak Detection** - Scans for exposed sensitive files (.git, .env, backup archives, configuration files)
|
|
- **Form Vulnerability Fuzzing** - Tests for basic XSS and SQL injection vectors in web forms
|
|
- **SSL/TLS Leak Detection** - Identifies HTTPS links, external domain references, and HSTS headers that can deanonymize both the server and visitors
|
|
- **Admin Path Bruteforce** - Discovers hidden administrative panels and login portals
|
|
- **Anonymity Leak Testing** - Detects external resource loading, SSRF vectors, and server information disclosure
|
|
|
|
### Red-Team Focused
|
|
- All traffic routes through I2P HTTP proxy (127.0.0.1:4444)
|
|
- Color-coded terminal output for rapid vulnerability prioritization
|
|
- Modular architecture for easy extension
|
|
- CVE database covering nginx, Apache, Tomcat, lighttpd, and I2P-specific vulnerabilities
|
|
|
|
---
|
|
|
|
## Requirements
|
|
|
|
### System Requirements
|
|
- **Operating System**: Linux (recommended), macOS, or Windows with WSL2
|
|
- **Python**: Version 3.8 or higher
|
|
- **I2P Router**: Running locally with HTTP proxy enabled
|
|
|
|
### I2P Setup
|
|
Before using the scanner, you must have a functional I2P router:
|
|
|
|
```bash
|
|
# Verify I2P is running
|
|
~/i2p/i2prouter status
|
|
|
|
# If not running, start it
|
|
~/i2p/i2prouter start
|
|
```
|
|
|
|
The scanner expects the I2P HTTP proxy to be available at `127.0.0.1:4444`.
|
|
|
|
### Python Dependencies
|
|
Install the required packages:
|
|
|
|
```bash
|
|
pip install requests beautifulsoup4 colorama lxml
|
|
```
|
|
|
|
---
|
|
|
|
## Installation
|
|
|
|
### Clone the Repository
|
|
```bash
|
|
git clone https://git.churchofmalware.org/ek0mssavi0r/i2p_scanner.git
|
|
cd i2p_scanner
|
|
```
|
|
|
|
### Make the Script Executable
|
|
```bash
|
|
chmod +x i2p_scanner.py
|
|
```
|
|
|
|
### Verify Installation
|
|
```bash
|
|
python3 i2p_scanner.py
|
|
```
|
|
|
|
You should see the scanner banner and prompt for an I2P site URL.
|
|
|
|
<img width="896" height="310" alt="banner" src="https://github.com/user-attachments/assets/78d959c0-05c6-45b2-a2bf-7b0fcddfcd0e" />
|
|
|
|
|
|
---
|
|
|
|
## Configuration
|
|
|
|
### Setting Up the Callback Server (For Anonymity Testing)
|
|
|
|
To fully utilize the anonymity leak detection module, configure a callback server to catch external resource requests:
|
|
|
|
1. **Set up a listener** on a publicly accessible server:
|
|
```bash
|
|
# Using netcat
|
|
nc -lvnp 80
|
|
|
|
# Or using Python's HTTP server
|
|
python3 -m http.server 80
|
|
```
|
|
|
|
2. **Update the scanner** with your server's address:
|
|
```python
|
|
CALLBACK_SERVER = "your-server-domain.com" # Change this in i2p_scanner.py
|
|
```
|
|
|
|
The scanner will then inject test payloads that attempt to make the target site contact your callback server, revealing potential DNS leaks.
|
|
|
|
### Customizing Scan Parameters
|
|
The following variables can be adjusted at the top of `i2p_scanner.py`:
|
|
|
|
```python
|
|
MAX_PAGES = 15 # Maximum pages to crawl per site
|
|
TIMEOUT = 15 # Request timeout in seconds
|
|
USER_AGENT = "I2P-Scanner/1.0 (Red-Team)" # User agent string
|
|
```
|
|
|
|
---
|
|
|
|
## Usage
|
|
|
|
### Basic Usage
|
|
```bash
|
|
python3 i2p_scanner.py
|
|
```
|
|
|
|
### Interactive Session
|
|
1. The scanner will display a banner and warning message
|
|
2. Enter the I2P site when prompted:
|
|
```
|
|
Enter I2P site (or 'quit'): planet.i2p
|
|
```
|
|
3. The scanner will:
|
|
- Test the I2P connection
|
|
- Crawl the site (up to MAX_PAGES pages)
|
|
- Run all assessment modules
|
|
- Display a color-coded report
|
|
|
|
### Example Output
|
|
```
|
|
============================================================
|
|
RED-TEAM SCAN REPORT: http://planet.i2p
|
|
Scan Time: 2026-07-16 09:23:38
|
|
============================================================
|
|
|
|
[+] SECURITY HEADERS:
|
|
[!] Missing 'Content-Security-Policy' -> Mitigates XSS/data injection
|
|
[!] Missing 'X-Content-Type-Options' -> Prevents MIME sniffing
|
|
|
|
[+] VERSION FINGERPRINTING:
|
|
[!] No Server header found (information hiding)
|
|
|
|
[+] SSL/TLS LEAK DETECTION:
|
|
[!] HTTPS link detected: https://github.com/username/repo
|
|
[!] External domain referenced: http://external-site.com
|
|
```
|
|
|
|
---
|
|
|
|
## Understanding the Results
|
|
|
|
### Severity Levels
|
|
| Color | Meaning |
|
|
|-------|---------|
|
|
| Red | High severity vulnerability requiring immediate attention |
|
|
| Yellow | Medium severity issue or informational finding |
|
|
| Green | No issues detected in this category |
|
|
|
|
### Common Findings and Their Implications
|
|
|
|
#### Security Headers Missing
|
|
- **Impact**: Increased risk of XSS, clickjacking, and MIME-based attacks
|
|
- **Fix**: Add appropriate headers in server configuration
|
|
|
|
#### DNS Leaks (HTTPS/External Links)
|
|
- **Impact**: Deanonymization of server operators and visitors
|
|
- **Fix**: Replace all clearnet links with .i2p equivalents; remove external resource loading
|
|
|
|
#### Exposed Files
|
|
- **Impact**: Configuration files, credentials, and source code exposure
|
|
- **Fix**: Restrict access to sensitive files via .htaccess or server configuration
|
|
|
|
#### Admin Panel Discovery
|
|
- **Impact**: Increased attack surface; potential credential theft
|
|
- **Fix**: Restrict access via IP allowlisting or strong authentication
|
|
|
|
#### Version Disclosure
|
|
- **Impact**: Attackers can target known vulnerabilities
|
|
- **Fix**: Hide server headers or keep software updated
|
|
|
|
---
|
|
|
|
## Modules Explained
|
|
|
|
### 1. Security Headers (check_headers)
|
|
Checks for the presence of:
|
|
- X-Frame-Options
|
|
- Content-Security-Policy
|
|
- X-Content-Type-Options
|
|
- Referrer-Policy
|
|
- Strict-Transport-Security (flagged as a risk on I2P)
|
|
|
|
### 2. Version Fingerprinting (check_version_fingerprinting)
|
|
- Extracts server software and version from headers
|
|
- Compares against CVE database
|
|
- Flags known vulnerable versions
|
|
|
|
### 3. Data Leak (check_info_leak)
|
|
Scans for:
|
|
- Version control files (.git/HEAD, .git/config)
|
|
- Environment files (.env)
|
|
- Backup archives (backup.zip)
|
|
- Configuration files (config.ini, wp-config.php.bak)
|
|
- Debug logs (debug.log, error.log)
|
|
- PHP info files (phpinfo.php, info.php)
|
|
|
|
### 4. Form Vulnerabilities (check_form_vulns)
|
|
- Inject XSS payloads (`<script>alert(1)</script>`)
|
|
- Test SQL injection vectors (`' OR '1'='1`)
|
|
- Check for reflected payloads in responses
|
|
|
|
### 5. SSL/TLS Leak (check_ssl_leak)
|
|
- Detects HTTPS links in page content
|
|
- Identifies external domain references
|
|
- Flags meta refresh redirects to HTTPS
|
|
- Identifies HSTS headers (misconfigured for I2P)
|
|
|
|
### 6. Admin Path Bruteforce (check_admin_paths)
|
|
Checks common administrative paths:
|
|
- admin, administrator, admin.php
|
|
- login, wp-admin
|
|
- cpanel, webmail, phpmyadmin
|
|
- mysql, database, backup
|
|
|
|
### 7. Anonymity Leak (test_anonymity_leak)
|
|
- Detects external resources already loaded (images, scripts, CSS)
|
|
- Identifies forms targeting external URLs
|
|
- Discovers server information disclosure (PHP_SELF, SERVER_ADDR)
|
|
- Optionally injects callback test payloads
|
|
|
|
---
|
|
|
|
## Reporting Findings
|
|
|
|
### Generating a Report File
|
|
```bash
|
|
python3 i2p_scanner.py > scan_report_$(date +%Y%m%d_%H%M%S).txt
|
|
```
|
|
---
|
|
|
|
**Disclaimer**: This tool is provided for educational and authorized security testing purposes only. The maintainers are not responsible for any misuse or illegal activities performed with this software.
|