Cmdline Whitelist Feature

lib/cmdline/cmd.py

@@ -67,6 +67,8 @@ def optparser():
                           help="pass the path to your framework if it is not in your ENV PATH")
         misc.add_argument("--ethics", action="store_true", dest="displayEthics",
                           help=argparse.SUPPRESS)  # easter egg!
+        misc.add_argument("--whitelist", metavar="PATH", dest="whitelist",
+                             help="only exploit hosts listed in the whitelist file")
         opts = parser.parse_args()
         return opts
 
@@ -160,10 +162,13 @@ def single_run_args(opt, keys, loaded_modules):
                 keys["censys"][1], keys["censys"][0], opt.searchQuery, proxy=headers[0], agent=headers[1]
             ).censys()
         if opt.startExploit:
+            hosts = open(lib.settings.HOST_FILE).readlines()
+            if opt.whitelist:
+                hosts = lib.exploitation.exploiter.whitelist_wash(hosts, whitelist_file=opt.whitelist)
             lib.exploitation.exploiter.AutoSploitExploiter(
                 opt.msfConfig,
                 loaded_modules,
-                open(lib.settings.HOST_FILE).readlines(),
+                hosts,
                 ruby_exec=opt.rubyExecutableNeeded,
                 msf_path=opt.pathToFramework
             ).start_exploit()

lib/exploitation/exploiter.py

@@ -1,6 +1,22 @@
 import lib.settings
 import lib.output
 
+def whitelist_wash(hosts, whitelist_file):
+    """
+    remove IPs from hosts list that do not appear in WHITELIST_FILE
+    """
+    whitelist_hosts = open(whitelist_file).readlines()
+    lib.output.info('Found {} entries in whitelist.txt, scrubbing'.format(str(len(whitelist_hosts))))
+    washed_hosts = []
+    #return supplied hosts if whitelist file is empty
+    if len(whitelist_hosts) == 0:
+        return hosts
+    else:
+        for host in hosts:
+            if host in whitelist_hosts:
+                washed_hosts.append(host)
+
+    return washed_hosts
 
 class AutoSploitExploiter(object):