Package: parsuite
ParsuiteSimple modular framework to support quick creation of file parsers in
Python. See the wiki page for information on creating modules.I threw this together because I got tired of repeatedly grepping out
the same content for common outputs produced when gunning through
vulnerability assessements and penetration tests. The interface is
extremely primitive but gets the job done, and was written with
a minimal understanding of argparse. I intend to go back and revisit
it in the future.Installation (Python Version >= 3.7)git clone https://github.com/arch4ngel/parsuite
cd parsuite
pip3 install -r requirements.txt...or...pip3 install parsuiteUsageListing ModulesIssue the--helpflag with no arguments. Example:parsuite --helpGetting Module HelpAfter supplying a module, issue the--helpflag and help for the specified
module will be returned. Example:parsuite xml_dumper --helpA Note on OutputOutput that is unrelated to the parsed content is written tostderr. This
allows users to easily redirect the desired content to a file or suppress
error messages.Current ModulesModuleDescriptionbloodhound_property_managerModify each BloodHound JSON file and add a property toeach objectbloodhound_property_manager_neo4jAccept a CSV file and upate a series of BloodHound nodes in a given Neo4j database.burp_info_extractorInput an XML file containing Burp items and dump each  transaction to a directory.burp_items_to_authmatrixParse an XML file containing Burp items and return a JSON statefile for AuthMatrix. Each item element of the input file must contain a "username" child element and one or more "role" child elements. WARNING: THE CHILD AND USERNAME ELEMENTS MUST BE ADDED TO EACH ITEM MANUALLY!!!burp_to_authmatrixParse cookies from the results table of a Burp Intruder attack and translate them to an Authmatrix state file for those users. Warning:  This tool assumes that the username is in Payload1. Also make sure that  invalid records are removed from the table file, otherwise they will  be translated and added to the JSON file.crt_shQuery crt.sh and dump output to diskcsharp_hexarray_parserParse C# shellcode from payload files generated by Metsploit or Cobalt Strike. Useful when embedding content in other formats.encoderEncode a series of values or contents of files. WARNING:  files are slurped and encoded as a whole.enum4linux_dumperDump groups and group memberships to disk, using the filesystem as as basic database for simple searching using grep and other mechanism.hash_linkerMap cleartext passwords recovered from password cracking back  to uncracked values.hc_kerberoast_dumperIterate over each cracked credential in an output file generated by HashCat that contains cracked Kerberos tickets and return each record in : formatip_expanderExpand a series of IPv4/6 ranges into addresses.ldap_dissection_xml_dumperDump LDAP objects from a file exported by Wireshark in PDML format.line_filterRemove lines found in bad files from lines found in good files and write the resultant set of good lines to an output file.moz_cookies_parserAccept an Firefox cookie file (SQLite3) and dump each record in CSV format. strLastAccessed and strCreationTime are added to each record to help find the freshest cookies. The final column contains the constructed cookie.nessus_api_host_dumperExtract affected hosts from the Nessus REST API. Useful in situations when running a large scan or you don't want to deal with exporting the .nessus file for use with thexml_dumpermodule.nessus_output_dumperParse a Nessus file and dump the contents to disk by: risk_factor > plugin_namenmap_smb_security_mode_dumperDump hosts to a file containing the security mode discovered by smb-security-mode.nmap_ssl_name_dumperAccept a XML file generated by Nmap and write SSL certificate information to stdoutnmap_to_sqliteConvert XML files generated by NMap to an SQLite database.nmap_top_port_dumperParse the Nmap services file and dump the most commonly open ports.nmap_xml_service_dumperAccept a XML file generated by Nmap and write the output to a local directory structure, organized by service, for easy browsing.ntlm_hasherNTLM hash a value.ntlmv2_dumperParse files containing NTLMv2 hashes in the common format produced by Responder and Impacket and dump them to stdout. Messages printed that are not hashes are dumped to stderr. Use the -du flag to disable uniquing of username/domain/password combinations.payload_inserterDefine an insertion point (signature) within a template file and replace the line with a payload from a distinct file. Useful in situations where an extremely long payload needs to be inserted, such as when working with hex shellcode for stageless payloads.prettyfi_jsonPretty print a JSON object to stdout.rdp_sec_check_dumperParse output from an rdp_sec_check scan and dump output to individual files relative to issue, such as "nla_not_enforced."recon_ng_contact_dumperParse an SQLite3 database generated by recon-ng and dump the contacts out in simple string formatsocket_dumperIPv4 ONLY! Accept a list of sockets and output three files:  unique list of IP addresses, unique list of ports, unique list of fqdnsstring_randomizerAccept a string as input and replace a template with random values.templatizerAccept a series of text templates and update their values. It ingests a CSV file, making the values of each field available to each template.urlcrazy_to_csvConvert URLCrazy output to CSVxml_dumperDump hosts and open ports from multiple masscan, nmap, or nessus files. A generalized abstraction layer is used to produce objects that align with the Nmap XML structure since it has the most comprehensive XSD file.