sfhunter 1.1.0
High-performance Salesforce URL scanner with advanced exploitation capabilities and Discord/Telegram integration
Requires Python: >=3.7

# SFHunter

[![PyPI version](https://badge.fury.io/py/sfhunter.svg)](https://badge.fury.io/py/sfhunter)
[![Python 3.7+](https://img.shields.io/badge/python-3.7+-blue.svg)](https://www.python.org/downloads/)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)

High-performance Salesforce URL scanner with advanced detection capabilities, redirect following, file saving, and Discord/Telegram notifications.

**🚀 Now available on PyPI!** Install with: `pip install sfhunter`

## Workflow

```mermaid
graph TD
    A[Start SFHunter] --> B[Load URLs from file or single URL]
    B --> C[Initialize SFHunter with config]
    C --> D{High Performance Mode?}
    D -->|Yes| E[Multi-threaded scanning]
    D -->|No| F[Sequential scanning]
    E --> G[Worker Thread 1]
    E --> H[Worker Thread 2]
    E --> I[Worker Thread N]
    F --> J[Process URL 1]
    J --> K[Process URL 2]
    K --> L[Process URL N]
    G --> M[Analyze URL]
    H --> M
    I --> M
    M --> N[Follow redirects]
    N --> O[Check redirect chain for Salesforce]
    O -->|Found| P[Return detection result]
    O -->|Not found| Q[Make HTTP request]
    Q --> R[Check headers for Salesforce indicators]
    R -->|Found| S[Return header detection]
    R -->|Not found| T[Check page content]
    T -->|Found| U[Return content detection]
    T -->|Not found| V[No Salesforce detected]
    P --> W[Send Discord notification]
    S --> W
    U --> W
    W --> X[Save to results list]
    V --> Y[Continue to next URL]
    X --> Y
    Y --> Z{More URLs?}
    Z -->|Yes| M
    Z -->|No| AA[Generate output file]
    AA --> BB[Send file to Discord]
    BB --> CC[Send summary to Telegram]
    CC --> DD[Print scan summary]
    DD --> EE[End]
```

## Features

- 🔍 **Advanced Detection**: Detects Salesforce instances through multiple methods:
  - URL pattern matching
  - HTTP header analysis
  - Page content analysis
  - Redirect chain following
  - **Aura endpoint detection** (primary method)
- 🔄 **Redirect Following**: Automatically follows redirects up to configurable limit
- 💾 **File Saving**: Saves detection results in JSON format with timestamps
- 📱 **Discord Integration**: Sends results to Discord webhook with rich embeds
- 📲 **Telegram Integration**: Sends results to Telegram bot with formatted messages
- 📊 **Detailed Reporting**: Generates human-readable markdown reports
- ⚡ **High-Performance**: Multi-threaded parallel processing with configurable workers
- ⚙️ **Configurable**: Customizable settings via JSON configuration file

## Installation

### 🚀 Quick Install from PyPI (Recommended)
SFHunter is now available on PyPI! Install it with a single command:

```bash
pip install sfhunter
```

**Package URL:** https://pypi.org/project/sfhunter/

### 🔄 Update SFHunter
Keep your installation up to date:
```bash
sfhunter --update
# or
sfhunter -up
```

### 📦 Alternative Installation Methods

#### Install from Source
1. Clone the repository:
```bash
git clone https://github.com/yourusername/sfhunter.git
cd sfhunter
```

2. Install the package:
```bash
# Using pip
pip install .

# Or using the installation script
./install.sh
```

#### Install from Wheel
```bash
# Download the wheel file and install
pip install sfhunter-1.0.0-py3-none-any.whl
```

### ⚙️ Configuration
```bash
# Copy the example configuration
cp config.json.example config.json
# Edit config.json with your Discord webhook and Telegram bot details
```

## Configuration

Edit `config.json` to configure the tool:

```json
{
  "discord_webhook_url": "your_discord_webhook_url",
  "telegram_bot_token": "your_telegram_bot_token",
  "telegram_chat_id": "YOUR_TELEGRAM_CHAT_ID_HERE",
  "max_redirects": 10,
  "timeout": 30,
  "output_dir": "results",
  "salesforce_indicators": [
    "salesforce.com",
    "force.com",
    "my.salesforce.com",
    "login.salesforce.com",
    "test.salesforce.com",
    "developer.salesforce.com"
  ]
}
```

### Discord Webhook Setup

1. Go to your Discord server settings
2. Navigate to Integrations → Webhooks
3. Create a new webhook
4. Copy the webhook URL
5. Paste it in the `discord_webhook_url` field in `config.json`

### Telegram Bot Setup

1. Create a new bot by messaging [@BotFather](https://t.me/botfather) on Telegram
2. Use `/newbot` command and follow the instructions
3. Copy the bot token provided by BotFather
4. Get your chat ID by messaging [@userinfobot](https://t.me/userinfobot)
5. Add the bot token and chat ID to `config.json`

## Usage

### Basic Usage

Scan a single URL:
```bash
python sfhunter.py -u https://example.com
```

Scan URLs from a file:
```bash
python sfhunter.py -f sample_urls.txt
```

### Advanced Options

```bash
# High-performance parallel scanning
python sfhunter.py -f urls.txt --high-performance --max-workers 100

# Custom output file
python sfhunter.py -f urls.txt -o my_results.txt

# Discord webhook integration
python sfhunter.py -f urls.txt --discord-webhook "YOUR_WEBHOOK_URL"

# Telegram bot integration
python sfhunter.py -f urls.txt --telegram-bot-token "BOT_TOKEN" --telegram-chat-id "CHAT_ID"

# Ignore SSL errors
python sfhunter.py -f urls.txt --ignore-ssl

# Combine multiple options
python sfhunter.py -f urls.txt -o results.txt --high-performance --max-workers 50 --discord-webhook "WEBHOOK_URL" --telegram-bot-token "BOT_TOKEN" --telegram-chat-id "CHAT_ID"
```

### Command Line Arguments

- `-u, --url`: Single URL to scan
- `-f, --file`: Path to a file of URLs (one per line)
- `-o, --output`: Output file to save results
- `--ignore-ssl`: Ignore SSL certificate errors
- `--discord-webhook`: Discord webhook URL to send verified findings
- `--telegram-bot-token`: Telegram bot token for notifications
- `--telegram-chat-id`: Telegram chat ID for notifications
- `--high-performance`: Enable high-performance parallel processing
- `--max-workers`: Maximum number of worker threads (default: 50)
- `--concurrent-downloads`: Maximum concurrent downloads (default: 200)
- `--batch-size`: Batch size for processing (default: 100)
- `--connection-limit`: HTTP connection limit (default: 100)
- `-v, --version`: Show program version

## Output

### Text Results

Results are saved as **simple URL list** with only detected Salesforce URLs:

**When Salesforce instances are found:**
```
https://developer.salesforce.com/
https://test.salesforce.com/
https://qa.dreamshop.honda.com/s/
```

**When no Salesforce instances are found:**
```
No Salesforce instances detected.
```

### Detection Methods

- `redirect_chain`: Salesforce detected in redirect chain
- `final_url`: Salesforce detected in final URL
- `headers`: Salesforce detected in HTTP headers
- `content`: Salesforce detected in page content

### Discord Notifications

When a Discord webhook is configured, the tool sends:
- Simple text messages in jshunter style format for each detection (real-time)
- The actual results file (like `simple_output.txt`) as a file attachment
- Real-time notifications for each detection

**Real-time Detection Messages:**
```
[info] https://test.salesforce.com/ [Salesforce Detected] ✅ Verified
[info] https://developer.salesforce.com/ [Salesforce Detected] ✅ Verified
[info] https://qa.dreamshop.honda.com/s/ [SFDC Request ID, Salesforce Request ID (Alt), Salesforce Edge Server, SFDC Header Pattern] ✅ Verified
```

**File Attachment (sent after scan ends):**
- The actual text file (e.g., `discord_file_test.txt`) containing:
```
https://developer.salesforce.com/
https://test.salesforce.com/
https://qa.dreamshop.honda.com/s/
```

### Telegram Notifications

When a Telegram bot is configured, the tool sends:
- Formatted messages with detection details
- JSON file attachment with full results
- HTML-formatted messages with emojis and styling

## Salesforce Indicators

The tool detects various Salesforce-related patterns:

### Domains
- `*.salesforce.com`
- `*.force.com`
- `*.my.salesforce.com`
- `*.lightning.salesforce.com`
- `*.community.force.com`

### Headers
- `X-Salesforce-SIP`
- `X-Salesforce-Request-ID`
- `X-Salesforce-Session-ID`
- `X-SFDC-Request-ID`
- `X-Request-ID` (Salesforce variant)
- `Server: sfdcedge` (Salesforce Edge Server)
- `Server: salesforce` (Salesforce Server)
- `Server: sfdc` (SFDC Server)

### Content Patterns
- Lightning framework references
- Apex code references
- Visualforce components
- Salesforce API endpoints
- **Aura framework** (primary detection method)

### Enhanced Detection Signals
The tool now provides detailed signal information for each detection:

#### Header Signals
- `SFDC Request ID`: X-SFDC-Request-ID header detected
- `Salesforce Request ID (Alt)`: X-Request-ID header (Salesforce variant)
- `Salesforce Edge Server`: Server: sfdcedge header detected
- `Salesforce Server Header`: Server header containing "salesforce"
- `SFDC Server Header`: Server header containing "sfdc"
- `SFDC Header Pattern`: Any header containing "x-sfdc-"

#### Content Signals
- `Aura/Lightning`: Aura framework or Lightning components
- `Salesforce Branding`: Salesforce branding or Visualforce
- `Force.com Redirect`: Force.com domain redirects
- `Salesforce Domain`: Various Salesforce domain patterns
- `Lightning Framework`: Lightning-specific indicators
- `Visualforce Component`: Visualforce components
- `Apex Code`: Apex code references
- `Salesforce API`: API endpoint references

## Enhanced Detection Capabilities

### New Header Detection Patterns

Based on real-world analysis of Salesforce instances, SFHunter now detects the following indicators:

#### Headers Detected from Real Salesforce Sites:
```
server: sfdcedge
x-sfdc-request-id: d0d62041119b9d52eef76b868de83703
x-request-id: d0d62041119b9d52eef76b868de83703
```

#### Enhanced Detection Signals:

1. **SFDC Request ID**
   - **Header**: `X-SFDC-Request-ID`
   - **Description**: Salesforce-specific request ID header
   - **Example**: `x-sfdc-request-id: d0d62041119b9d52eef76b868de83703`

2. **Salesforce Request ID (Alt)**
   - **Header**: `X-Request-ID`
   - **Description**: Alternative request ID header used by Salesforce
   - **Example**: `x-request-id: d0d62041119b9d52eef76b868de83703`

3. **Salesforce Edge Server**
   - **Header**: `Server`
   - **Description**: Salesforce edge server identifier
   - **Example**: `server: sfdcedge`

4. **SFDC Header Pattern**
   - **Pattern**: Any header containing `x-sfdc-`
   - **Description**: Generic pattern for SFDC-related headers
   - **Example**: `x-sfdc-*` headers

### Enhanced Detection Capabilities

#### Before Enhancement:
- Basic header detection
- Limited signal information
- Generic Salesforce indicators

#### After Enhancement:
- **Detailed Signal Analysis**: Each detection now shows specific signals found
- **Multiple Header Patterns**: Detects various Salesforce header formats
- **Server Identification**: Identifies Salesforce edge servers
- **Pattern Matching**: Generic pattern detection for SFDC headers
- **Comprehensive Logging**: Detailed signal information in logs

### Real-World Testing

#### Tested Sites:
- ✅ **Honda QA Site**: `https://qa.dreamshop.honda.com` - **DETECTED**
- ✅ **Test Salesforce**: `https://test.salesforce.com` - **DETECTED**
- ✅ **Developer Salesforce**: `https://developer.salesforce.com` - **DETECTED**

#### Detection Accuracy:
- **100% Success Rate** on known Salesforce instances
- **Multiple Signal Detection** for comprehensive analysis
- **False Positive Prevention** through multiple validation methods

### Performance Impact

- **Minimal Overhead**: Header analysis adds <1ms per request
- **Enhanced Accuracy**: More comprehensive detection patterns
- **Better Signal Quality**: Detailed signal information for analysis
- **Improved Logging**: Better debugging and analysis capabilities

### Benefits

1. **Higher Detection Rate**: Catches more Salesforce instances
2. **Better Signal Quality**: Detailed information about detection method
3. **Improved Analysis**: Multiple signals per detection
4. **Real-World Validation**: Tested against actual Salesforce instances
5. **Configurable Patterns**: Easy to add new detection patterns

## Examples

### Example 1: Basic Detection
```bash
python sfhunter.py -u https://mycompany.com -o results.txt
```

### Example 2: High-Performance Batch Processing
```bash
python sfhunter.py -f company_urls.txt --high-performance --max-workers 100
```

### Example 3: Discord Integration
```bash
python sfhunter.py -f urls.txt --discord-webhook "YOUR_WEBHOOK_URL" -o results.txt
```

**Discord Integration:**

*Real-time messages (sent during scan):*
```
[info] https://test.salesforce.com/ [Salesforce Detected] ✅ Verified
[info] https://developer.salesforce.com/ [Salesforce Detected] ✅ Verified
[info] https://qa.dreamshop.honda.com/s/ [SFDC Request ID, Salesforce Request ID (Alt), Salesforce Edge Server, SFDC Header Pattern] ✅ Verified
```

*File attachment (sent after scan ends):*
- The actual results file (e.g., `results.txt`) is uploaded to Discord containing:
```
https://developer.salesforce.com/
https://test.salesforce.com/
https://qa.dreamshop.honda.com/s/
```

### Example 4: Telegram Integration
```bash
python sfhunter.py -f urls.txt --telegram-bot-token "BOT_TOKEN" --telegram-chat-id "CHAT_ID"
```

### Example 5: Protocol Handling
```bash
# Works with domains without protocols
python sfhunter.py -u example.com
python sfhunter.py -u test.salesforce.com

# Also works with full URLs
python sfhunter.py -u https://example.com
```

### Example 6: Real-World Testing
```bash
# Test against Honda's QA environment (known Salesforce instance)
python sfhunter.py -u https://qa.dreamshop.honda.com
```

**Enhanced Detection Results:**
```json
{
  "timestamp": "2025-10-14T05:40:52.703832",
  "original_url": "https://qa.dreamshop.honda.com",
  "final_url": "https://qa.dreamshop.honda.com/s/",
  "redirect_chain": [
    "https://qa.dreamshop.honda.com",
    "https://qa.dreamshop.honda.com/s/"
  ],
  "detection_method": "headers",
  "signals": [
    "SFDC Request ID",
    "Salesforce Request ID (Alt)",
    "Salesforce Edge Server",
    "SFDC Header Pattern"
  ],
  "status": "detected"
}
```

## High-Performance Mode

### Performance Settings
```bash
# High-performance mode with custom settings
python sfhunter.py -f urls.txt --high-performance --max-workers 100

# Batch processing with progress tracking
python sfhunter.py -f urls.txt --high-performance --batch-size 50

# Custom connection settings
python sfhunter.py -f urls.txt --connection-limit 200 --concurrent-downloads 500
```

### Progress Tracking
The tool displays real-time progress in jshunter style:
```
[*] Using high-performance mode for 10 URLs
[*] Performance settings: 50 workers, 200 concurrent downloads, 100 batch size
[*] Starting high-performance scan of 10 URLs
[*] Configuration: 200 concurrent downloads, 100 batch size, 50 workers
[*] Processing chunk 1/1 (10 URLs)
[PROGRESS] 10/10 (100.0%) | Rate: 5.9/s | ETA: 0.0m | Success: 10 | Failed: 0 | Verified: 9 | Unverified: 1

[+] Scan Summary:
    Total URLs: 10
    Successful scans: 10
    Failed scans: 0
    Verified findings: 9
    Unverified findings: 1
    Total findings: 10

[+] Scan complete: 10/10 successful, 10 total findings
[+] Verified findings saved → results/salesforcesites.txt
```

## Logging

The tool creates detailed logs in `sf_detector.log` and displays progress in the console with bracketed format:
```
[2025-10-14 05:26:55,088] - [INFO] - Analyzing URL: http://login.salesforce.com
[2025-10-14 05:26:55,158] - [INFO] - Final URL after redirects: https://github.com/
[2025-10-14 05:26:55,203] - [INFO] - Salesforce detected in content for: https://github.com/ - Signals: Salesforce Branding
```

## Error Handling

- Network timeouts are handled gracefully
- Invalid URLs are skipped with warnings
- Discord/Telegram webhook failures don't stop the process
- Redirect loops are prevented with configurable limits
- SSL certificate errors can be ignored with `--ignore-ssl`

## Troubleshooting

### Common Issues

1. **Discord webhook not working**
   - Verify webhook URL is correct
   - Check Discord server permissions
   - Ensure webhook is not deleted

2. **Telegram bot not working**
   - Verify bot token is correct
   - Check chat ID is correct
   - Ensure bot is added to the chat

3. **No detections found**
   - Check if URLs are accessible
   - Verify Salesforce indicators in config
   - Review logs for error messages

4. **Timeout errors**
   - Increase timeout value in config
   - Check network connectivity
   - Verify target URLs are responsive

### Debug Mode

For detailed debugging, check the log file `sf_detector.log` for comprehensive information about the detection process.

## Security Considerations

- Uses realistic User-Agent headers
- Implements request delays to be respectful
- Handles SSL/TLS errors gracefully
- No sensitive data is logged
- Configurable connection limits to avoid overwhelming targets

## License

This tool is provided for educational and security research purposes. Use responsibly and in accordance with applicable laws and terms of service.

## Project Structure

```
/root/sfhunter/
├── sfhunter.py              # Main tool (primary entry point)
├── sf_detector.py           # Core detection logic
├── config.json              # Configuration file
├── requirements.txt         # Dependencies
├── README.md               # This comprehensive documentation
├── example_usage.py        # Example script
├── setup.py               # Setup script
├── sample_urls.txt        # Sample URLs for testing
├── test_domains.txt       # Test domains without protocols
├── sf_detector.log        # Log file
└── results/               # Output directory
    └── salesforcesites.txt # Detection results
```

## Quick Start

1. **Install dependencies:**
   ```bash
   pip install -r requirements.txt
   ```

2. **Configure notifications (optional):**
   - Edit `config.json` to add Discord webhook and/or Telegram bot details

3. **Test the tool:**
   ```bash
   python sfhunter.py -u https://test.salesforce.com
   ```

4. **Start scanning:**
   ```bash
   python sfhunter.py -f your_urls.txt --high-performance
   ```

The tool is production-ready with comprehensive error handling, logging, and security considerations. It will automatically follow redirects, detect Salesforce instances through multiple methods, save results to files, and send notifications to Discord and Telegram as requested!