From 5c5a1bb85927472f4354ef71353b2e246efad090 Mon Sep 17 00:00:00 2001 From: v0lp3 Date: Sat, 12 Jul 2025 14:08:55 +0200 Subject: [PATCH 1/6] Fix email-format module --- bbot/modules/emailformat.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/bbot/modules/emailformat.py b/bbot/modules/emailformat.py index 67e1a3806f..839c229757 100644 --- a/bbot/modules/emailformat.py +++ b/bbot/modules/emailformat.py @@ -21,7 +21,17 @@ async def handle_event(self, event): r = await self.api_request(url) if not r: return - for email in await self.helpers.re.extract_emails(r.text): + + encrypted_emails = await self.helpers.re.findall(r'data-cfemail="([0-9a-z]+)"', r.text) + + for enc in encrypted_emails: + if len(enc) < 2 or len(enc) % 2 != 0: + continue + + key = int(enc[:2], 16) + + email = "".join([chr(int(enc[i : i + 2], 16) ^ key) for i in range(0, len(enc), 2)]).lower() + if email.endswith(query): await self.emit_event( email, From b3275e81bebab257e4e3b2a802f233fdea58a65f Mon Sep 17 00:00:00 2001 From: v0lp3 Date: Sat, 12 Jul 2025 14:48:08 +0200 Subject: [PATCH 2/6] Compile cfemail regex --- bbot/modules/emailformat.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bbot/modules/emailformat.py b/bbot/modules/emailformat.py index 839c229757..add37465f3 100644 --- a/bbot/modules/emailformat.py +++ b/bbot/modules/emailformat.py @@ -22,7 +22,8 @@ async def handle_event(self, event): if not r: return - encrypted_emails = await self.helpers.re.findall(r'data-cfemail="([0-9a-z]+)"', r.text) + cfemail_regex = self.helpers.re.compile(r'data-cfemail="([0-9a-z]+)"') + encrypted_emails = await self.helpers.re.findall(cfemail_regex, r.text) for enc in encrypted_emails: if len(enc) < 2 or len(enc) % 2 != 0: From a11d4f9ca6d0a2dce3090fca05b345e19da8598b Mon Sep 17 00:00:00 2001 From: v0lp3 Date: Sat, 12 Jul 2025 14:56:12 +0200 Subject: [PATCH 3/6] Compile regex cfemail regex in setup --- bbot/modules/emailformat.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bbot/modules/emailformat.py b/bbot/modules/emailformat.py index add37465f3..bad10cffbe 100644 --- a/bbot/modules/emailformat.py +++ b/bbot/modules/emailformat.py @@ -15,6 +15,10 @@ class emailformat(BaseModule): base_url = "https://www.email-format.com" + async def setup(self): + self.cfemail_regex = self.helpers.re.compile(r'data-cfemail="([0-9a-z]+)"') + return True + async def handle_event(self, event): _, query = self.helpers.split_domain(event.data) url = f"{self.base_url}/d/{self.helpers.quote(query)}/" @@ -22,8 +26,7 @@ async def handle_event(self, event): if not r: return - cfemail_regex = self.helpers.re.compile(r'data-cfemail="([0-9a-z]+)"') - encrypted_emails = await self.helpers.re.findall(cfemail_regex, r.text) + encrypted_emails = await self.helpers.re.findall(self.cfemail_regex, r.text) for enc in encrypted_emails: if len(enc) < 2 or len(enc) % 2 != 0: From 5fba590fb0400f86d6a497d436ede65e4d551f86 Mon Sep 17 00:00:00 2001 From: v0lp3 Date: Sat, 12 Jul 2025 15:39:57 +0200 Subject: [PATCH 4/6] Fix test email format --- bbot/modules/emailformat.py | 2 +- bbot/test/test_step_2/module_tests/test_module_emailformat.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bbot/modules/emailformat.py b/bbot/modules/emailformat.py index bad10cffbe..0dc0336e76 100644 --- a/bbot/modules/emailformat.py +++ b/bbot/modules/emailformat.py @@ -34,7 +34,7 @@ async def handle_event(self, event): key = int(enc[:2], 16) - email = "".join([chr(int(enc[i : i + 2], 16) ^ key) for i in range(0, len(enc), 2)]).lower() + email = "".join([chr(int(enc[i : i + 2], 16) ^ key) for i in range(2, len(enc), 2)]).lower() if email.endswith(query): await self.emit_event( diff --git a/bbot/test/test_step_2/module_tests/test_module_emailformat.py b/bbot/test/test_step_2/module_tests/test_module_emailformat.py index fdac8cb42a..4f3189f516 100644 --- a/bbot/test/test_step_2/module_tests/test_module_emailformat.py +++ b/bbot/test/test_step_2/module_tests/test_module_emailformat.py @@ -5,7 +5,7 @@ class TestEmailFormat(ModuleTestBase): async def setup_before_prep(self, module_test): module_test.httpx_mock.add_response( url="https://www.email-format.com/d/blacklanternsecurity.com/", - text="

info@blacklanternsecurity.com", + text="""[email protected]""", ) def check(self, module_test, events): From d766d25574017683d9073c91f7835058245608fd Mon Sep 17 00:00:00 2001 From: v0lp3 Date: Sat, 12 Jul 2025 16:06:01 +0200 Subject: [PATCH 5/6] Fix test 2 email-format --- bbot/test/test_step_2/module_tests/test_module_emails.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bbot/test/test_step_2/module_tests/test_module_emails.py b/bbot/test/test_step_2/module_tests/test_module_emails.py index 44b9ab0787..820b5a15f1 100644 --- a/bbot/test/test_step_2/module_tests/test_module_emails.py +++ b/bbot/test/test_step_2/module_tests/test_module_emails.py @@ -1,13 +1,13 @@ from .base import ModuleTestBase -class TestEmais(ModuleTestBase): +class TestEmails(ModuleTestBase): modules_overrides = ["emails", "emailformat", "skymem"] async def setup_before_prep(self, module_test): module_test.httpx_mock.add_response( url="https://www.email-format.com/d/blacklanternsecurity.com/", - text="

info@blacklanternsecurity.com

", + text="""[email protected]""", ) module_test.httpx_mock.add_response( url="https://www.skymem.info/srch?q=blacklanternsecurity.com", From 236b5606faf4f2f01f2fe120a5e9454021c03d12 Mon Sep 17 00:00:00 2001 From: v0lp3 Date: Sat, 12 Jul 2025 17:51:54 +0200 Subject: [PATCH 6/6] Minor changes --- bbot/modules/emailformat.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/bbot/modules/emailformat.py b/bbot/modules/emailformat.py index 0dc0336e76..e1d7d74aff 100644 --- a/bbot/modules/emailformat.py +++ b/bbot/modules/emailformat.py @@ -29,12 +29,14 @@ async def handle_event(self, event): encrypted_emails = await self.helpers.re.findall(self.cfemail_regex, r.text) for enc in encrypted_emails: - if len(enc) < 2 or len(enc) % 2 != 0: + enc_len = len(enc) + + if enc_len < 2 or enc_len % 2 != 0: continue key = int(enc[:2], 16) - email = "".join([chr(int(enc[i : i + 2], 16) ^ key) for i in range(2, len(enc), 2)]).lower() + email = "".join([chr(int(enc[i : i + 2], 16) ^ key) for i in range(2, enc_len, 2)]).lower() if email.endswith(query): await self.emit_event(