Divinity is an ever-expanding HDN-Offensive Security Framework that can be used for multiple security research purposes. It can integrate with online search tools, but does not rely on them. An example of one of those services is Shodan for some of its features, with the main function of which is to test over HTTP/HTTPS and report IPs that are using default credentials.

Many people install basic and advanced services like NetScaler, SAP, Firewalls and Routers without changing default passwords, this fact makes all these implementations faulty and vulnerable to very simple attacks. Any scriptkiddie with a hacking GUI based tool or pentesting image can search known lists and break into your devices easily without any real knowledge. We wanted to level the playing field here as many critical infrastructure systems also have the same problems and this needs to stop (config errors, using standard credentials) because this is irresponsible and unsafe in this period of cyber warfare and espionage.

We hope that by making this public, we can help people to test thier own systems using this opensource framework, which we decided to release to the world in an effort to make it better and widely-used in order to increase security awareness, and hopefully security itself.

It is our hope that anyone who uses this tool also adds functionality and gives credit for the work we are investing into this project. If you would like to know more about Hakdefnet, then check out the site at https://hakdefnet.org.

Enjoy and contribute!

-- Your 1D10T / PHX / HDN Team

go get github.com/HDN-1D10T/divinity

• local JSON config file (specified by -config [FILE PATH])
• remote JSON config file (specified by -webconfig [URL])
• command line parameters (which will override any duplicate parameters if config is also specified)

If Shodan is used, you will need to set the environment variable SHODAN_API_KEY=[your shodan API key].
This can be exported on the command line or sourced in your ~/.bashrc, etc.

The following configurations can be referenced locally with the -config parameter or hosted remotely and referenced with the -webconfig parameter. Command line parameters will override any existing parameters included in the JSON configurations.

• The following configuration would search for "Device Manufacturer A" listening on port 80 at http://[IP ADDRESS]/login.html and would return 1 page of Shodan results containing 100 IPs.
• An HTTP GET request would be sent with basic authentication with the credentials admin:password to all 100 IPs from the results.
• If the string authenticated.html is found in the HTTP response, the alert *** DEFAULT CREDENTIALS *** will be displayed next to the IP address in the output.

{
    "query": "Device Manufacturer A port:80",
    "protocol": "http",
    "port": "80",
    "path": "/login.html",
    "method": "GET",
    "basic-auth": "admin:password",
    "success": "authenticated.html",
    "alert": "*** DEFAULT CREDENTIALS ***"
}

• The following configuration would search for "device manufacturer 2" listening on port 8443 at https://[IP ADDRESS]:8443/data/login and would return 1 page of results, containing 100 IPs.
• An HTTP POST request would be sent with the credentials admin:password as form data to all 100 IPs.
• If the string <authResult>0</authResult> is found in the HTTP response, the alert SUCCESS will be displayed next to the IP address in the output (since -alert has a default value of SUCCESS, it doesn't have to be explicitly specified in the configuration.

{
    "query": "Device Manufacturer B port:8443",
    "protocol": "https",
    "port": "8443",
    "path": "/data/login",
    "method": "POST",
    "basic-auth": "admin:password",
    "content": "application/x-www-form-url-encoded",
    "success": "<authResult>0</authResult>"
}

Let's say you wanted to get 500 individual IP results from Device Manufacturer B, and you have the config stored in a directory on the web along with additional configs you have created for finding different devices. You want to store these IPs for later use without increasing your Shodan API query credits.

You could use the following command to save a list of just the IP addresses to subsequently feed back into the application using the -list parameter, which would override the call to the Shodan API on the second run:

divinity -webconfig http://example.com/divinity_configs/device-manufacturer-b.json -pages 5 -passive -ips -out manufacturer_b_ips.txt

If you wanted to do everything in one go, just make sure to save your results with the -out parameter. Let's also say that you want to include the text *** DEFAULT *** next to the successful attempts. The output file will include only the IPs with successful default logins.

divinity -webconfig http://example.com/divinity_configs/device-manufacturer-b.json -pages 5 -alert "*** DEFAULT ***" -out manufacturer_b_default_creds.txt

Let's say you have a numerous applications running a specific framework for which you have created a configuration file. These applications are running in your DMZ on the 10.2.2.0/24 network. As long as you have access to these applications, you can run the following command to test for default credentials:

divinity -config /path/to/app.json -cidr 10.2.2.0/24 -out dmz_default_creds.txt

Note: masscan integration is not complete and is a work in progress. There are also plans to implement nmap integration. Both of these require spawning OS processes that require these utilities to be installed, and additionally require sudo or root-level permission.

That being said, there is a native golang portscanner implemented directly in this project, and it works quite well. Additionally, it doesn't require root-level permissions to do its thing, and it does its thing very efficiently.

When scanning for a single port, divinity can knock out a /24 in around 2 minutes. That's over the Internet. But of course, you would only use this tool on local networks...

Let's say you wanted to find a list of IPs on a local network that were running Telnet servers. You want to create a list of these IPs to feed back into divinity and test for default credentials admin:admin.

divinity -scan -cidr 192.168.1.0/24 -port 23 -out telnet.txt

divinity -list telnet.txt -protocol tcp -port 23 -out default_creds.txt

divinity -scan -cidr 192.168.1.0/24 -port 23 | divinity -protocol tcp -port 23 -creds admin:admin -list - -out default_creds.txt

divinity -cidr 192.168.1.0/24 -protocol tcp -port 23 -creds root:root