package main

import (

"bufio"

"encoding/json"

"errors"

"fmt"

"os"

"path/filepath"

"sort"

"strings"

"syscall"

)

type Cred struct {

Username string `json:"username"`

Password string `json:"password"`

URL string `json:"url,omitempty"`

}

type DB struct {

Creds []Cred `json:"creds"`

Usernames []string `json:"usernames"`

Passwords []string `json:"passwords"`

URLs []string `json:"urls"`

Domains []string `json:"domains"`

IPs []string `json:"ips"`

Hashes []string `json:"hashes"`

}

func main() {

if err := run(os.Args[1:]); err != nil {

fmt.Fprintln(os.Stderr, "error:", err)

os.Exit(1)

}

}

func run(args []string) error {

if len(args) == 0 {

return usageError()

}

switch args[0] {

case "init":

if len(args) != 1 {

return errors.New("usage: loot init")

}

return initDB()

case "save":

if len(args) != 2 {

return errors.New("usage: loot save <path>")

}

return saveDB(args[1])

case "load":

if len(args) != 2 {

return errors.New("usage: loot load <path>")

}

return loadDB(args[1])

case "import":

if len(args) != 3 {

return errors.New("usage: loot import <creds|usernames|passwords|urls|domains|ips|hashes> <file>")

}

return importFromFile(args[1], args[2])

case "cred":

if len(args) != 2 {

return errors.New("usage: loot cred <user:pass> or loot cred <user:pass:url>")

}

return addCred(args[1])

case "creds":

if len(args) != 1 {

return errors.New("usage: loot creds")

}

return listCreds()

case "dump":

if len(args) != 1 {

return errors.New("usage: loot dump")

}

return dumpDB()

case "username":

if len(args) != 2 {

return errors.New("usage: loot username <value>")

}

return addUsername(args[1])

case "usernames":

if len(args) != 1 {

return errors.New("usage: loot usernames")

}

return listUsernames()

case "pass":

if len(args) != 2 {

return errors.New("usage: loot pass <value>")

}

return addPassword(args[1])

case "passwords":

if len(args) != 1 {

return errors.New("usage: loot passwords")

}

return listPasswords()

case "domain":

if len(args) != 2 {

return errors.New("usage: loot domain <value>")

}

return addDomain(args[1])

case "domains":

if len(args) != 1 {

return errors.New("usage: loot domains")

}

return listDomains()

case "ip":

if len(args) != 2 {

return errors.New("usage: loot ip <value>")

}

return addIP(args[1])

case "ips":

if len(args) != 1 {

return errors.New("usage: loot ips")

}

return listIPs()

case "hash":

if len(args) != 2 {

return errors.New("usage: loot hash <value>")

}

return addHash(args[1])

case "hashes":

if len(args) != 1 {

return errors.New("usage: loot hashes")

}

return listHashes()

case "stats":

if len(args) != 1 {

return errors.New("usage: loot stats")

}

return printStats()

case "url":

if len(args) == 2 {

return addURL(args[1])

}

return errors.New("usage: loot url <value>")

case "urls":

if len(args) != 1 {

return errors.New("usage: loot urls")

}

return listURLs()

default:

return usageError()

}

}

func usageError() error {

return errors.New(`usage:

loot init

loot save <path>

loot load <path>

loot import <creds|usernames|passwords|urls|domains|ips|hashes> <file>

loot cred <user:pass>

loot cred <user:pass:url>

loot creds

loot dump

loot username <value>

loot usernames

loot pass <value>

loot passwords

loot domain <value>

loot domains

loot ip <value>

loot ips

loot hash <value>

loot hashes

loot stats

loot url <value>

loot urls`)

}

func initDB() error {

path, err := defaultDBPath()

if err != nil {

return err

}

return withDBLock(path, func() error {

return writeDB(path, &DB{})

})

}

func defaultDBPath() (string, error) {

home, err := os.UserHomeDir()

if err != nil {

return "", err

}

return filepath.Join(home, ".loot", "loot.db.json"), nil

}

func expandPath(path string) (string, error) {

if path == "" {

return "", errors.New("empty path")

}

if path == "~" {

return os.UserHomeDir()

}

if strings.HasPrefix(path, "~/") {

home, err := os.UserHomeDir()

if err != nil {

return "", err

}

return filepath.Join(home, path[2:]), nil

}

return filepath.Abs(path)

}

func readDB() (*DB, string, error) {

path, err := defaultDBPath()

if err != nil {

return nil, "", err

}

if _, err := os.Stat(path); errors.Is(err, os.ErrNotExist) {

return nil, "", errors.New("database not initialized, run: loot init")

} else if err != nil {

return nil, "", err

}

data, err := os.ReadFile(path)

if err != nil {

return nil, "", err

}

var db DB

if len(data) == 0 {

return &DB{}, path, nil

}

if err := json.Unmarshal(data, &db); err != nil {

return nil, "", err

}

return &db, path, nil

}

func writeDB(path string, db *DB) error {

if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {

return err

}

data, err := json.MarshalIndent(db, "", " ")

if err != nil {

return err

}

data = append(data, '\n')

tempFile, err := os.CreateTemp(filepath.Dir(path), ".loot-*.tmp")

if err != nil {

return err

}

tempPath := tempFile.Name()

defer os.Remove(tempPath)

if _, err := tempFile.Write(data); err != nil {

tempFile.Close()

return err

}

if err := tempFile.Chmod(0o600); err != nil {

tempFile.Close()

return err

}

if err := tempFile.Close(); err != nil {

return err

}

return os.Rename(tempPath, path)

}

func addCred(spec string) error {

username, password, url, err := parseCred(spec)

if err != nil {

return err

}

return mutateDB(func(db *DB) {

cred := Cred{

Username: username,

Password: password,

URL: url,

}

if containsCred(db.Creds, cred) {

return

}

db.Creds = append(db.Creds, cred)

})

}

func parseCred(spec string) (string, string, string, error) {

first := strings.Index(spec, ":")

if first <= 0 {

return "", "", "", errors.New("invalid cred, expected user:pass or user:pass:url")

}

second := strings.Index(spec[first+1:], ":")

username := spec[:first]

if second == -1 {

password := spec[first+1:]

if password == "" {

return "", "", "", errors.New("password cannot be empty")

}

return username, password, "", nil

}

second += first + 1

password := spec[first+1 : second]

url := spec[second+1:]

if password == "" {

return "", "", "", errors.New("password cannot be empty")

}

if url == "" {

return "", "", "", errors.New("url cannot be empty")

}

return username, password, url, nil

}

func addUsername(value string) error {

return mutateDB(func(db *DB) {

if contains(db.Usernames, value) {

return

}

db.Usernames = append(db.Usernames, value)

})

}

func addPassword(value string) error {

return mutateDB(func(db *DB) {

if contains(db.Passwords, value) {

return

}

db.Passwords = append(db.Passwords, value)

})

}

func addURL(value string) error {

return mutateDB(func(db *DB) {

if contains(db.URLs, value) {

return

}

db.URLs = append(db.URLs, value)

})

}

func addDomain(value string) error {

return mutateDB(func(db *DB) {

if contains(db.Domains, value) {

return

}

db.Domains = append(db.Domains, value)

})

}

func addIP(value string) error {

return mutateDB(func(db *DB) {

if contains(db.IPs, value) {

return

}

db.IPs = append(db.IPs, value)

})

}

func addHash(value string) error {

return mutateDB(func(db *DB) {

if contains(db.Hashes, value) {

return

}

db.Hashes = append(db.Hashes, value)

})

}

func mutateDB(fn func(*DB)) error {

path, err := defaultDBPath()

if err != nil {

return err

}

return withDBLock(path, func() error {

db, _, err := readDB()

if err != nil {

return err

}

fn(db)

return writeDB(path, db)

})

}

func saveDB(target string) error {

db, _, err := readDB()

if err != nil {

return err

}

resolved, err := expandPath(target)

if err != nil {

return err

}

return writeDB(resolved, db)

}

func loadDB(source string) error {

resolved, err := expandPath(source)

if err != nil {

return err

}

src, err := os.Open(resolved)

if err != nil {

return err

}

defer src.Close()

var db DB

if err := json.NewDecoder(src).Decode(&db); err != nil {

return fmt.Errorf("invalid database file: %w", err)

}

target, err := defaultDBPath()

if err != nil {

return err

}

return withDBLock(target, func() error {

return writeDB(target, &db)

})

}

func importFromFile(kind string, source string) error {

resolved, err := expandPath(source)

if err != nil {

return err

}

file, err := os.Open(resolved)

if err != nil {

return err

}

defer file.Close()

scanner := bufio.NewScanner(file)

lineNo := 0

for scanner.Scan() {

lineNo++

line := strings.TrimSpace(scanner.Text())

if line == "" || strings.HasPrefix(line, "#") {

continue

}

switch kind {

case "creds":

err = addCred(line)

case "usernames":

err = addUsername(line)

case "passwords":

err = addPassword(line)

case "urls":

err = addURL(line)

case "domains":

err = addDomain(line)

case "ips":

err = addIP(line)

case "hashes":

err = addHash(line)

default:

return errors.New("usage: loot import <creds|usernames|passwords|urls|domains|ips|hashes> <file>")

}

if err != nil {

return fmt.Errorf("import %s failed at line %d: %w", kind, lineNo, err)

}

}

if err := scanner.Err(); err != nil {

return err

}

return nil

}

func listCreds() error {

db, _, err := readDB()

if err != nil {

return err

}

for _, cred := range db.Creds {

if cred.URL != "" {

fmt.Printf("%s:%s:%s\n", cred.Username, cred.Password, cred.URL)

continue

}

fmt.Printf("%s:%s\n", cred.Username, cred.Password)

}

return nil

}

func listURLs() error {

db, _, err := readDB()

if err != nil {

return err

}

for _, url := range db.URLs {

fmt.Println(url)

}

return nil

}

func listDomains() error {

db, _, err := readDB()

if err != nil {

return err

}

for _, value := range db.Domains {

fmt.Println(value)

}

return nil

}

func listIPs() error {

db, _, err := readDB()

if err != nil {

return err

}

for _, value := range db.IPs {

fmt.Println(value)

}

return nil

}

func listHashes() error {

db, _, err := readDB()

if err != nil {

return err

}

for _, value := range db.Hashes {

fmt.Println(value)

}

return nil

}

func listUsernames() error {

db, _, err := readDB()

if err != nil {

return err

}

values := make([]string, 0, len(db.Usernames)+len(db.Creds))

values = append(values, db.Usernames...)

for _, cred := range db.Creds {

values = append(values, cred.Username)

}

for _, value := range uniqueSorted(values) {

fmt.Println(value)

}

return nil

}

func listPasswords() error {

db, _, err := readDB()

if err != nil {

return err

}

values := make([]string, 0, len(db.Passwords)+len(db.Creds))

values = append(values, db.Passwords...)

for _, cred := range db.Creds {

values = append(values, cred.Password)

}

for _, value := range uniqueSorted(values) {

fmt.Println(value)

}

return nil

}

func printStats() error {

db, _, err := readDB()

if err != nil {

return err

}

fmt.Printf("creds: %d\n", len(db.Creds))

fmt.Printf("usernames: %d\n", len(uniqueSorted(append(sliceCopy(db.Usernames), extractCredUsernames(db.Creds)...))))

fmt.Printf("passwords: %d\n", len(uniqueSorted(append(sliceCopy(db.Passwords), extractCredPasswords(db.Creds)...))))

fmt.Printf("urls: %d\n", len(db.URLs))

fmt.Printf("domains: %d\n", len(db.Domains))

fmt.Printf("ips: %d\n", len(db.IPs))

fmt.Printf("hashes: %d\n", len(db.Hashes))

return nil

}

func dumpDB() error {

db, _, err := readDB()

if err != nil {

return err

}

const (

reset = "\033[0m"

bold = "\033[1m"

cyan = "\033[36m"

green = "\033[32m"

yellow = "\033[33m"

blue = "\033[34m"

)

printHeader := func(icon, title string, count int) {

fmt.Printf("%s%s %s%s (%d)%s\n", bold, icon, title, cyan, count, reset)

}

printHeader("🔐", "Creds", len(db.Creds))

if len(db.Creds) == 0 {

fmt.Printf(" %s-%s empty\n", yellow, reset)

} else {

for _, cred := range db.Creds {

if cred.URL != "" {

fmt.Printf(" %s•%s %s:%s %s@ %s%s%s\n", green, reset, cred.Username, cred.Password, blue, cred.URL, reset, "")

} else {

fmt.Printf(" %s•%s %s:%s\n", green, reset, cred.Username, cred.Password)

}

}

}

usernames := uniqueSorted(append(sliceCopy(db.Usernames), extractCredUsernames(db.Creds)...))

printHeader("👤", "Usernames", len(usernames))

if len(usernames) == 0 {

fmt.Printf(" %s-%s empty\n", yellow, reset)

} else {

for _, value := range usernames {

fmt.Printf(" %s•%s %s\n", green, reset, value)

}

}

passwords := uniqueSorted(append(sliceCopy(db.Passwords), extractCredPasswords(db.Creds)...))

printHeader("🔑", "Passwords", len(passwords))

if len(passwords) == 0 {

fmt.Printf(" %s-%s empty\n", yellow, reset)

} else {

for _, value := range passwords {

fmt.Printf(" %s•%s %s\n", green, reset, value)

}

}

printHeader("🌐", "URLs", len(db.URLs))

if len(db.URLs) == 0 {

fmt.Printf(" %s-%s empty\n", yellow, reset)

} else {

for _, value := range db.URLs {

fmt.Printf(" %s•%s %s\n", green, reset, value)

}

}

printHeader("🏷️", "Domains", len(db.Domains))

if len(db.Domains) == 0 {

fmt.Printf(" %s-%s empty\n", yellow, reset)

} else {

for _, value := range db.Domains {

fmt.Printf(" %s•%s %s\n", green, reset, value)

}

}

printHeader("📡", "IPs", len(db.IPs))

if len(db.IPs) == 0 {

fmt.Printf(" %s-%s empty\n", yellow, reset)

} else {

for _, value := range db.IPs {

fmt.Printf(" %s•%s %s\n", green, reset, value)

}

}

printHeader("#️⃣", "Hashes", len(db.Hashes))

if len(db.Hashes) == 0 {

fmt.Printf(" %s-%s empty\n", yellow, reset)

} else {

for _, value := range db.Hashes {

fmt.Printf(" %s•%s %s\n", green, reset, value)

}

}

return nil

}

func contains(values []string, target string) bool {

for _, value := range values {

if value == target {

return true

}

}

return false

}

func containsCred(creds []Cred, target Cred) bool {

for _, cred := range creds {

if cred == target {

return true

}

}

return false

}

func uniqueSorted(values []string) []string {

seen := make(map[string]struct{}, len(values))

out := make([]string, 0, len(values))

for _, value := range values {

if value == "" {

continue

}

if _, ok := seen[value]; ok {

continue

}

seen[value] = struct{}{}

out = append(out, value)

}

sort.Strings(out)

return out

}

func extractCredUsernames(creds []Cred) []string {

out := make([]string, 0, len(creds))

for _, cred := range creds {

out = append(out, cred.Username)

}

return out

}

func extractCredPasswords(creds []Cred) []string {

out := make([]string, 0, len(creds))

for _, cred := range creds {

out = append(out, cred.Password)

}

return out

}

func sliceCopy(values []string) []string {

out := make([]string, len(values))

copy(out, values)

return out

}

func withDBLock(path string, fn func() error) error {

if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {

return err

}

lockPath := path + ".lock"

lockFile, err := os.OpenFile(lockPath, os.O_CREATE|os.O_RDWR, 0o600)

if err != nil {

return err

}

defer lockFile.Close()

if err := syscall.Flock(int(lockFile.Fd()), syscall.LOCK_EX); err != nil {

return err

}

defer syscall.Flock(int(lockFile.Fd()), syscall.LOCK_UN)

return fn()

}