Package: faraday-agent-dispatcher
Faraday Agents Dispatcher helps user develop integrations withFaradaywritten in any language.InstallationJust runpip3 install faraday_agent_dispatcherand you should see thefaraday-dispatchercommand in your system.To setup a development environment (this is, to change code of the dispatcher
itself, not to write your own integrations), you should clone this repo and runpip install -e ..Running Faraday Agent Dispatcher for first timeGenerate a configuration file runningfaraday-dispatcher config-wizard.Run the agent withfaraday-dispatcher runcommand. The config file
that it creates will be located in~/.faraday/config/dispatcher.iniif you do not pass a custom path.You should complete the agent configuration with your registration
token, located athttp://localhost:5985/#/admin/agents. Check that the
server section has the correct information about your Faraday
Server instance. Then, complete the agent section with the desired name
of your agent. Finally,add the executorsExecutorsCreating your own executorsAn executor is a script that prints outsingle-lineJSON data to
stdout. Remember that if you print any other data to stdout, the
dispatcher will trigger an error. If you want to print debugging or
logging information you should use stderr for that.Every line written to stdout by the executor will be decoded by the
dispatcher and sent to Faraday using the Bulk Create endpoint.
Therefore, the JSON you print must have the schema that the endpoint
requires (this schema is detailedbelow).
Otherwise, the dispatcher will complain because you supplied invalid
data to it.If you want to debug your executor, the simplest way to do it is by
running it directly instead of running with the Dispatcher. Since the executor
just prints JSON data to stdout, you will be able to see all
information it wants to send to Faraday, but without actually sending
it.Configuring a executorAfter writing your executor, you have to add it with thefaraday-dispatcher config-wizardwithin the executor section, adding
its name, command to execute and the max size of the JSON to send to
Faraday Server. Additionally, you can configure the Environment
variables and Arguments in their proper section.Running a executorTo run an executor use thefaraday-dispatcher config-wizardcommand,
and play it from the Faraday Server. The executor will use the
environment variables set and ask for the arguments.Bulk Create JSON formatThe data published tofaradaymust correspond to thebulk_createendpoint of theFaraday's REST APIRunning multiple dispatchersIf you want to have more than one dispatcher, each one runninng its own
executors, the preferred of doing this is to create different
configuration files for each one (for example,~/.faraday/config/dispatcher-1.iniand~/.faraday/config/dispatcher-2.ini). Then, you can run two different
Dispatcher instances withfaraday-dispatcher --config-file PATH_TO_A_CONFIG_FILE.ExecutorsInside theexecutorsdirectory you can find the already
created executors.OfficialTheofficial executorsare the collection of ready-to-go
executors (with minimum configuration with the wizard). They have a manifest
JSON file, which gives details about the uses of the executor and helps with
the configuration of them.The current official executors are:ArachniBurpCrackMapExecNessusNiktoNmapNucleiOpenvasReport processor: Consumes a local report where the dispatcher is with thefaraday plugins[QualysGuard]qualysSonar Qube APISublist3rW3afWpscanZapDevelopmentThedevelopment executorsare the collection of executors we
donotfully maintain, we have examples of use, conceptual, and in
development executors. The most important of them are:basic_example.py: The Hello World of Faraday executors. It will
create a host with an associeted vulnerability to itheroku_discovery_agent.py: Load host and service information from
your Heroku accountprowlerSample.py: Run theprowlercommand and send
its output to Faradaybrainfuck.sh: A proof-of-concept to demonstrate you can create
an executor in any programming language, includingBrainfuck!RoadmapWe are currently working on new executors, apart from improving the
experience using the agents.We would like to give some agents read access to their workspace,
so they can benefit of the existing data in order to find more valuable
information.DocumentationFor more info you can check ourdocumentation3.2.0 [Feb 8th, 2024]:[ADD] Add dependabot agent. #2063.0.1 [Dec 22th, 2023]:[FIX] Fix on_diconnect method and limit python-socketio to 5.8.0 #1993.0.0 [Dec 13th, 2023]:[MOD] Now faraday-dispatcher works with socketio. #1952.6.3 [Aug 24th, 2023]:[FIX] Check the code response for burp executor #1942.6.2 [Aug 3rd, 2023]:[MOD] Now you can download a existing report in tenableio #1922.6.1 [July 20th, 2023]:[FIX] Now nuclei executor use -j flag instead of -json. #1872.6.0 [July 7th, 2023]:[ADD] Add HCL Appscan executer #1862.5.1 [Jan 3rd, 2023]:[DEL] Now nuclei doesn't check if the target is an ip[MOD] Add a fixes for bandit vuln:Replace assert return code with a ifRemove default x_token in nessus executor2.5.0 [Nov 30th, 2022]:[ADD] Add new Sonar Qube executor[ADD] Add tenableio executor[FIX] Make gvm executor compatible with new version of python-gvm[FIX] Now if a venv is int or float it will convert to string2.4.0 [Oct 26th. 2022]:Add Qualys executor[MOD] Change pgrep for psutil in zap executor2.3.0 [Sep 5th, 2022]:Now InsighVM's executer will executa a scan if a site_id is providedAdd tags for pluginsAdd installation in docker file for nmap script: vulnersNow the api-key from zap is a enviroment variable[FIX] Change AGENT_CONFIG_HOSTNAME_RESOLUTION por AGENT_CONFIG_RESOLVE_HOSTNAMEUpdate docs2.2.0 [Jul 25th, 2022]:Add timeout parameter to arachni's executorAdd python2.7, w3af and its dependencies to docker imageAdd ignore_info and hostname_resolution options for most executors.Nessus now list in the logs the available templates and uses posixpath.join instead of concat strings.
Nikto now uses only requieres TARGET_URL argument.Fix logs and change .format to fstringsRemove ws from dispatcher.yaml.Now faraday-dispatcher send the parameters of the executors when it
connects to faraday server. Also it checks if there are new enviroment
variables defined in the manifest file and warn the user.2.1.3 [Dec 13th, 2021]:Add --api-token --random-user-agent to wpscanMove shodan executor to official and change logic to work with plugins2.1.2 [Oct 19th, 2021]:ADD script to nmap logic2.1.1 [Aug 18th, 2021]:ADD option via configuration YAML file to ignore ssl errorsMOD Wizard connection ports defaults vary if SSL value has changed in the previous configurationFaradayversions: 3.16.0, 3.16.1, 3.16.2, 3.17.0, 3.17.1, 3.17.22.1.0 [Aug 9th, 2021]:ADD Reminder message to run --token command after wizardFIXstart_dateandend_dateto be sent as UTCFIX Receiving API error when faraday license is expiredADD Executor for insightvmREMOVE Host and api from burp executor parametersFaradayversions: 3.16.0, 3.16.1, 3.16.2, 3.17.0, 3.17.1, 3.17.22.0.0 [Jun 29th, 2021]:ADD Executor parameter typingADD versioning for manifests from typing packageFIX typo in wizardFaradayversions: 3.16.0, 3.16.1, 3.16.2, 3.17.0, 3.17.1, 3.17.21.5.1 [May 6th, 2021]:FIX Burp executor parse the IPFaradayversions: 3.14.3, 3.15.0, 3.15.11.5.0 [Mar 30th, 2021]:ADD having at least a executor is mandatory, if not it will not save the configurationUPD executor pagination, now each executor have a "unique" idMOD Update all reference tofaradaytoAPI v3MOD Connectivity endpoint is now/_api/v3/infoMOD Now registration token is needed within the run command. Only needed the first timeMOD setting host in the wizard now accepts full urls, such ashttps://my.server.com:12345ADD new plugin to support newer OpenVas/gvm versions (gvm_openvas). The old openvas executor was renamed to
"openvas_legacy"Faradayversions: 3.14.3, 3.15.0, 3.15.11.4.2 [Feb 26th, 2021]:MOD Update faraday-plugins version, improving nessus plugin processFaradayversions: 3.14.0, 3.14.1, 3.14.21.4.1 [Feb 17th, 2021]:MOD Various UX improves in wizard:ADD special character control in name executorADD More verbose infoIt is possible to exit wizard if its misconfigurated (will not be saved)FIX Not choosing executor (Using Q) generates correct config fileMOD max data sent to server option is a manual edit configurationMOD more extensive default list of official executorsMOD change color for options "next page" "don't choose"ADD new WPScan executor that does not need docker anymoreFIX in nuclei_exclude parameter for nuclei executorFaradayversions: 3.14.0, 3.14.1, 3.14.21.4.0 [Dec 23rd, 2020]:A base_route can be added before the root of the server (e.g:https://my.company.com/faraday/as / of faraday)Add duration to bulk_create to be set correctlyThe new official executors are:nucleireports: local report consumed by faraday-pluginsAdd new flags for nmap executor:-sC,-sV,-Pn,--script-timeout,--host-timeout,--top-portsFix bug nmap and nessus executors to execute with the dispatcher environmentFix nmap executor when http(s) scheme passed as targetFaradayversions: 3.14.0, 3.14.1, 3.14.21.3.1 [Sep 7th, 2020]:Add proxy setup by HTTP_PROXY or HTTPS_PROXY environment variablesFix default report name with the nessus executorFaradayversions: 3.12.01.3.0 [Sep 3rd, 2020]:An Agent can post data to multiples workspacesTheruncommand tries to migrate the configuration to the latest version from
others as theconfig-wizarddoesImprove agent signal management and server disconnection, affecting the exit codeThe wizard page size can be customized (See:faraday-dispatcher config-wizard --help)The new official executors are:burpcrackmapexecArachni executor generates reports in /tmp nowNmap executor updates use of nmap plugin (byte-string to string response)Faradayversions: 3.12.01.2.1 [Jun 22nd, 2020]:Now the dispatcher runs the check commands before running an executorFix error when connects with faraday fails when trying to access with SSL to not SSL serverFix error when connects with faraday fails when server does not respondFix error when connects with faraday fails when SSL verification failsFix error attempting to create an executor with a comma in the nameNow the wizard ask if you want use the default SSL behaviorStarted the process ofdocumentationThe new official executors are:arachniopenvaszapNmap executor now acepted multi targetFix W3af executor now uses python2Escape user-controlled executor parameters in order to prevent OS argument injection (not command injection)Faradayversions: 3.11, 3.11.1, 3.11.21.2 [May 27th, 2020]:Now we have official executors, packaged with the dispatcherFix error when killed by signalFix error when server close connectionFix error when ssl certificate does not existsFix error when folder~/.faradaydoes not exists, creating itThe new official executors are:nessusniktonmapsublist3rwpscanw3afFaradayversions: 3.11, 3.11.1, 3.11.21.1 [Apr 22th, 2020]:The dispatcher now runs with afaraday-dispatcher runcommandfaraday-dispatcher wizardcommand added which generates configuration .ini fileManage execution_id within WS and API communicationThe route ofFaradayws comunication change from / to /websocketsBetter error management, now shows error and exceptions depending on log levelsBetter management of invalid token errorsAdd ssl supportFaradayversions: 3.11, 3.11.1, 3.11.21.0 [Dec 17th, 2019]:You can add fixed parameters than shouldn't came by the web (e.g. passwords) are set in the dispatcher.iniNow its possible to manage multiple executors within one agentNow is possible to receive params from theFaradayserverFaradayversions: 3.10, 3.10.1, 3.10.20.1 [Oct 31th, 2019]:First beta version publishedBasic structure implemented, with executor with fixed valuesFaradayversions: 3.9.2, 3.9.3