option to disable dirbuster.
This commit is contained in:
Eli McRae
parent
da7dc2c097
commit
8b29595f18
|
|
@ -0,0 +1,17 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class BruteforceFTP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Bruteforce FTP"
|
||||
self.tags = ['default', 'ftp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^ftp', '^ftp\-data'])
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_commands('Bruteforce logins:', [
|
||||
'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_ftp_hydra.txt" ftp://{addressv6}',
|
||||
'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_ftp_medusa.txt" -M ftp -h {addressv6}'
|
||||
])
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class BruteforceHTTP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Bruteforce HTTP"
|
||||
self.tags = ['default', 'http']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_commands('Credential bruteforcing commands (don\'t run these without modifying them):', [
|
||||
'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_{http_scheme}_auth_hydra.txt" {http_scheme}-get://{addressv6}/path/to/auth/area',
|
||||
'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_{http_scheme}_auth_medusa.txt" -M http -h {addressv6} -m DIR:/path/to/auth/area',
|
||||
'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_{http_scheme}_form_hydra.txt" {http_scheme}-post-form://{addressv6}/path/to/login.php:"username=^USER^&password=^PASS^":"invalid-login-message"',
|
||||
'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_{http_scheme}_form_medusa.txt" -M web-form -h {addressv6} -m FORM:/path/to/login.php -m FORM-DATA:"post?username=&password=" -m DENY-SIGNAL:"invalid login message"'
|
||||
])
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class BruteforceRDP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Bruteforce RDP"
|
||||
self.tags = ['default', 'rdp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^rdp', '^ms\-wbt\-server', '^ms\-term\-serv'])
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_commands('Bruteforce logins:', [
|
||||
'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_rdp_hydra.txt" rdp://{addressv6}',
|
||||
'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_rdp_medusa.txt" -M rdp -h {addressv6}'
|
||||
])
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class BruteforceSMB(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Bruteforce SMB'
|
||||
self.tags = ['default', 'safe', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service('tcp', 445, '^microsoft\-ds')
|
||||
self.match_service('tcp', 139, '^netbios')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_command('Bruteforce SMB', [
|
||||
'crackmapexec smb {address} --port={port} -u "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -p "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '"'
|
||||
])
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class BruteforceSSH(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Bruteforce SSH"
|
||||
self.tags = ['default', 'ssh']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('ssh')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_command('Bruteforce logins:', [
|
||||
'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_ssh_hydra.txt" ssh://{addressv6}',
|
||||
'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_ssh_medusa.txt" -M ssh -h {addressv6}'
|
||||
])
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from autorecon.io import fformat
|
||||
|
||||
class CurlKnownSecurity(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Known Security"
|
||||
self.tags = ['default', 'safe', 'http']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
|
||||
async def run(self, service):
|
||||
if service.protocol == 'tcp':
|
||||
process, stdout, _ = await service.execute('curl -sSikf {http_scheme}://{addressv6}:{port}/.well-known/security.txt', future_outfile='{protocol}_{port}_{http_scheme}_known-security.txt')
|
||||
|
||||
lines = await stdout.readlines()
|
||||
|
||||
if process.returncode == 0 and lines:
|
||||
filename = fformat('{scandir}/{protocol}_{port}_{http_scheme}_known-security.txt')
|
||||
with open(filename, mode='wt', encoding='utf8') as robots:
|
||||
robots.write('\n'.join(lines))
|
||||
else:
|
||||
service.info('{bblue}[' + fformat('{tag}') + ']{rst} There did not appear to be a .well-known/security.txt file in the webroot (/).')
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from autorecon.io import fformat
|
||||
|
||||
class CurlRobots(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Curl Robots"
|
||||
self.tags = ['default', 'safe', 'http']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
|
||||
async def run(self, service):
|
||||
if service.protocol == 'tcp':
|
||||
process, stdout, _ = await service.execute('curl -sSikf {http_scheme}://{addressv6}:{port}/robots.txt', future_outfile='{protocol}_{port}_{http_scheme}_curl-robots.txt')
|
||||
|
||||
lines = await stdout.readlines()
|
||||
|
||||
if process.returncode == 0 and lines:
|
||||
filename = fformat('{scandir}/{protocol}_{port}_{http_scheme}_curl-robots.txt')
|
||||
with open(filename, mode='wt', encoding='utf8') as robots:
|
||||
robots.write('\n'.join(lines))
|
||||
else:
|
||||
service.info('{bblue}[' + fformat('{tag}') + ']{rst} There did not appear to be a robots.txt file in the webroot (/).')
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class Curl(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Curl"
|
||||
self.tags = ['default', 'safe', 'http']
|
||||
|
||||
def configure(self):
|
||||
self.add_option("path", default="/", help="The path on the web server to curl. Default: %(default)s")
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
self.add_pattern('(?i)powered[ -]by[^\n]+')
|
||||
|
||||
async def run(self, service):
|
||||
if service.protocol == 'tcp':
|
||||
await service.execute('curl -sSik {http_scheme}://{addressv6}:{port}' + self.get_option('path'), outfile='{protocol}_{port}_{http_scheme}_curl.html')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class DNSReverseLookup(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'DNS Reverse Lookup'
|
||||
self.tags = ['default', 'safe', 'dns']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^domain')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('dig -p {port} -x {address} @{address}', outfile='{protocol}_{port}_dns_reverse-lookup.txt')
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class DNSZoneTransfer(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'DNS Zone Transfer'
|
||||
self.tags = ['default', 'safe', 'dns']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^domain')
|
||||
|
||||
async def run(self, service):
|
||||
if self.get_global('domain'):
|
||||
await service.execute('dig AXFR -p {port} @{address} ' + self.get_global('domain'), outfile='{protocol}_{port}_dns_zone-transfer-domain.txt')
|
||||
if service.target.type == 'hostname':
|
||||
await service.execute('dig AXFR -p {port} @{address} {address}', outfile='{protocol}_{port}_dns_zone-transfer-hostname.txt')
|
||||
await service.execute('dig AXFR -p {port} @{address}', outfile='{protocol}_{port}_dns_zone-transfer.txt')
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from shutil import which
|
||||
|
||||
class DnsReconSubdomainBruteforce(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "DnsRecon Bruteforce Subdomains"
|
||||
self.slug = 'dnsrecon-brute'
|
||||
self.priority = 0
|
||||
self.tags = ['default', 'safe', 'long', 'dns']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^domain')
|
||||
|
||||
def check(self):
|
||||
if which('dnsrecon') is None:
|
||||
self.error('The program dnsrecon could not be found. Make sure it is installed. (On Kali, run: sudo apt install dnsrecon)')
|
||||
return False
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
domain_name = '<DOMAIN-NAME>'
|
||||
if self.get_global('domain'):
|
||||
domain_name = self.get_global('domain')
|
||||
service.add_manual_command('Use dnsrecon to bruteforce subdomains of a DNS domain.', [
|
||||
'dnsrecon -n {address} -d ' + domain_name + ' -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t brt 2>&1 | tee {scandir}/{protocol}_{port}_dnsrecon_subdomain_bruteforce.txt',
|
||||
])
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from shutil import which
|
||||
|
||||
class DnsRecon(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "DnsRecon Default Scan"
|
||||
self.slug = 'dnsrecon'
|
||||
self.priority = 0
|
||||
self.tags = ['default', 'safe', 'dns']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^domain')
|
||||
|
||||
def check(self):
|
||||
if which('dnsrecon') is None:
|
||||
self.error('The program dnsrecon could not be found. Make sure it is installed. (On Kali, run: sudo apt install dnsrecon)')
|
||||
return False
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_command('Use dnsrecon to automatically query data from the DNS server. You must specify the target domain name.', [
|
||||
'dnsrecon -n {address} -d <DOMAIN-NAME> 2>&1 | tee {scandir}/{protocol}_{port}_dnsrecon_default_manual.txt'
|
||||
])
|
||||
|
||||
async def run(self, service):
|
||||
if self.get_global('domain'):
|
||||
await service.execute('dnsrecon -n {address} -d ' + self.get_global('domain') + ' 2>&1', outfile='{protocol}_{port}_dnsrecon_default.txt')
|
||||
else:
|
||||
service.error('A domain name was not specified in the command line options (--global.domain). If you know the domain name, look in the _manual_commands.txt file for the dnsrecon command.')
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from shutil import which
|
||||
|
||||
class Enum4Linux(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Enum4Linux"
|
||||
self.tags = ['default', 'safe', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.add_choice_option('tool', default=('enum4linux-ng' if which('enum4linux-ng') else 'enum4linux'), choices=['enum4linux-ng', 'enum4linux'], help='The tool to use for doing Windows and Samba enumeration. Default: %(default)s')
|
||||
self.match_service_name(['^ldap', '^smb', '^microsoft\-ds', '^netbios'])
|
||||
self.match_port('tcp', [139, 389, 445])
|
||||
self.match_port('udp', 137)
|
||||
self.run_once(True)
|
||||
|
||||
def check(self):
|
||||
tool = self.get_option('tool')
|
||||
if tool == 'enum4linux' and which('enum4linux') is None:
|
||||
self.error('The enum4linux program could not be found. Make sure it is installed. (On Kali, run: sudo apt install enum4linux)')
|
||||
return False
|
||||
elif tool == 'enum4linux-ng' and which('enum4linux-ng') is None:
|
||||
self.error('The enum4linux-ng program could not be found. Make sure it is installed. (https://github.com/cddmp/enum4linux-ng)')
|
||||
return False
|
||||
|
||||
async def run(self, service):
|
||||
if service.target.ipversion == 'IPv4':
|
||||
tool = self.get_option('tool')
|
||||
if tool is not None:
|
||||
if tool == 'enum4linux':
|
||||
await service.execute('enum4linux -a -M -l -d {address} 2>&1', outfile='enum4linux.txt')
|
||||
elif tool == 'enum4linux-ng':
|
||||
await service.execute('enum4linux-ng -A -d -v {address} 2>&1', outfile='enum4linux-ng.txt')
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class GetArch(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'get-arch'
|
||||
self.tags = ['default', 'safe', 'rpc']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^msrpc'])
|
||||
self.match_port('tcp', 135)
|
||||
self.add_pattern(' is ((32|64)-bit)', description='Identified Architecture: {match1}')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('impacket-getArch -target {address}', outfile='{protocol}_{port}_rpc_architecture.txt')
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class LDAPSearch(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'LDAP Search'
|
||||
self.tags = ['default', 'safe', 'ldap', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^ldap')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_command('ldapsearch command (modify before running):', [
|
||||
'ldapsearch -x -D "<username>" -w "<password>" -H ldap://{address}:{port} -b "dc=example,dc=com" -s sub "(objectclass=*)" 2>&1 | tee > "{scandir}/{protocol}_{port}_ldap_all-entries.txt"'
|
||||
])
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class LookupSID(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'lookupsid'
|
||||
self.tags = ['default', 'safe', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service('tcp', 445, '^microsoft\-ds')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_command('Lookup SIDs', [
|
||||
'impacket-lookupsid \'[username]:[password]@{address}\''
|
||||
])
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NBTScan(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'nbtscan'
|
||||
self.tags = ['default', 'safe', 'netbios', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^smb', '^microsoft\-ds', '^netbios'])
|
||||
self.match_port('udp', 137)
|
||||
self.run_once(True)
|
||||
|
||||
async def run(self, service):
|
||||
if service.target.ipversion == 'IPv4':
|
||||
await service.execute('nbtscan -rvh {ipaddress} 2>&1', outfile='nbtscan.txt')
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class Nikto(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'nikto'
|
||||
self.tags = ['default', 'safe', 'long', 'http']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
if service.target.ipversion == 'IPv4':
|
||||
service.add_manual_command('(nikto) old but generally reliable web server enumeration tool:', 'nikto -ask=no -h {http_scheme}://{address}:{port} 2>&1 | tee "{scandir}/{protocol}_{port}_{http_scheme}_nikto.txt"')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapAJP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap AJP'
|
||||
self.tags = ['default', 'safe', 'ajp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^ajp13'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ajp-* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_ajp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ajp_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapCassandra(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap Cassandra"
|
||||
self.tags = ['default', 'safe', 'cassandra']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^apani1')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(cassandra* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_cassandra_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_cassandra_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapCUPS(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap CUPS"
|
||||
self.tags = ['default', 'safe', 'cups']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^ipp')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(cups* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_cups_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_cups_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapDistccd(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap distccd"
|
||||
self.tags = ['default', 'safe', 'distccd']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^distccd')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,distcc-cve2004-2687" --script-args="distcc-cve2004-2687.cmd=id" -oN "{scandir}/{protocol}_{port}_distcc_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_distcc_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapDNS(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap DNS'
|
||||
self.tags = ['default', 'safe', 'dns']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^domain')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_dns_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_dns_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapFinger(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap finger"
|
||||
self.tags = ['default', 'safe', 'finger']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^finger')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,finger" -oN "{scandir}/{protocol}_{port}_finger_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_finger_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapFTP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap FTP'
|
||||
self.tags = ['default', 'safe', 'ftp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^ftp', '^ftp\-data'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ftp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_ftp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ftp_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapHTTP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap HTTP"
|
||||
self.tags = ['default', 'safe', 'http']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
self.add_pattern('Server: ([^\n]+)', description='Identified HTTP Server: {match1}')
|
||||
self.add_pattern('WebDAV is ENABLED', description='WebDAV is enabled')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN "{scandir}/{protocol}_{port}_{http_scheme}_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_{http_scheme}_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapIMAP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap IMAP"
|
||||
self.tags = ['default', 'safe', 'imap', 'email']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^imap')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(imap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_imap_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_imap_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapIrc(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap IRC'
|
||||
self.tags = ['default', 'safe', 'irc']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^irc')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -oN "{scandir}/{protocol}_{port}_irc_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_irc_nmap.xml" -p {port} {address}')
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapKerberos(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap Kerberos"
|
||||
self.tags = ['default', 'safe', 'kerberos', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^kerberos', '^kpasswd'])
|
||||
|
||||
async def run(self, service):
|
||||
if self.get_global('domain') and self.get_global('username-wordlist'):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,krb5-enum-users" --script-args krb5-enum-users.realm="' + self.get_global('domain') + '",userdb="' + self.get_global('username-wordlist') + '" -oN "{scandir}/{protocol}_{port}_kerberos_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_kerberos_nmap.xml" {address}')
|
||||
else:
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,krb5-enum-users" -oN "{scandir}/{protocol}_{port}_kerberos_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_kerberos_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapLDAP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap LDAP"
|
||||
self.tags = ['default', 'safe', 'ldap', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^ldap')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_ldap_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ldap_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapMongoDB(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap MongoDB"
|
||||
self.tags = ['default', 'safe', 'databases']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^mongod')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(mongodb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_mongodb_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_mongodb_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapMountd(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap Mountd"
|
||||
self.tags = ['default', 'safe', 'nfs']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^mountd')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,nfs* and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_mountd_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_mountd_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapRPC(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap MSRPC"
|
||||
self.tags = ['default', 'rpc']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^msrpc', '^rpcbind', '^erpc'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "{scandir}/{protocol}_{port}_rpc_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_rpc_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapMSSQL(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap MSSQL"
|
||||
self.tags = ['default', 'safe', 'databases']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^mssql', '^ms\-sql'])
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
if service.target.ipversion == 'IPv4':
|
||||
service.add_manual_command('(sqsh) interactive database shell:', 'sqsh -U <username> -P <password> -S {address}:{port}')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ms-sql* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" --script-args="mssql.instance-port={port},mssql.username=sa,mssql.password=sa" -oN "{scandir}/{protocol}_{port}_mssql_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_mssql_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapMulticastDNS(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap Multicast DNS'
|
||||
self.tags = ['default', 'safe', 'dns']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^mdns', '^zeroconf'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_multicastdns_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_multicastdns_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapMYSQL(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap MYSQL"
|
||||
self.tags = ['default', 'safe', 'databases']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^mysql')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
if service.target.ipversion == 'IPv4':
|
||||
service.add_manual_command('(sqsh) interactive database shell:', 'sqsh -U <username> -P <password> -S {address}:{port}')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(mysql* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_mysql_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_mysql_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapNFS(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap NFS"
|
||||
self.tags = ['default', 'safe', 'nfs']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^nfs', '^rpcbind'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(rpcinfo or nfs*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_nfs_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_nfs_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapNNTP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap NNTP"
|
||||
self.tags = ['default', 'safe', 'nntp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^nntp')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,nntp-ntlm-info" -oN "{scandir}/{protocol}_{port}_nntp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_nntp_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapNTP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap NTP"
|
||||
self.tags = ['default', 'safe', 'ntp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^ntp')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ntp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_ntp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ntp_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapOracle(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap Oracle"
|
||||
self.tags = ['default', 'safe', 'databases']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^oracle')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_command('Brute-force SIDs using Nmap:', 'nmap {nmap_extra} -sV -p {port} --script="banner,oracle-sid-brute" -oN "{scandir}/{protocol}_{port}_oracle_sid-brute_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_oracle_sid-brute_nmap.xml" {address}')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(oracle* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_oracle_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_oracle_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapPOP3(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap POP3"
|
||||
self.tags = ['default', 'safe', 'pop3', 'email']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^pop3')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(pop3* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_pop3_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_pop3_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapRDP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap RDP"
|
||||
self.tags = ['default', 'safe', 'rdp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^rdp', '^ms\-wbt\-server', '^ms\-term\-serv'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(rdp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_rdp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_rdp_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapRedis(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap Redis'
|
||||
self.tags = ['default', 'safe', 'redis']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^redis$')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,redis-info" -oN "{scandir}/{protocol}_{port}_redis_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_redis_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapRMI(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap RMI"
|
||||
self.tags = ['default', 'safe', 'rmi']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^java\-rmi', '^rmiregistry'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,rmi-vuln-classloader,rmi-dumpregistry" -oN "{scandir}/{protocol}_{port}_rmi_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_rmi_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapRsync(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap Rsync'
|
||||
self.tags = ['default', 'safe', 'rsync']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^rsync')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(rsync* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_rsync_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_rsync_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapSIP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap SIP"
|
||||
self.tags = ['default', 'safe', 'sip']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^asterisk', '^sip'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,sip-enum-users,sip-methods" -oN "{scandir}/{protocol}_{port}_sip_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_sip_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapSMB(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap SMB"
|
||||
self.tags = ['default', 'safe', 'smb', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^smb', '^microsoft\-ds', '^netbios'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_smb_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_smb_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapSMTP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap SMTP"
|
||||
self.tags = ['default', 'safe', 'smtp', 'email']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^smtp')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(smtp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_smtp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_smtp_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapSNMP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap SNMP"
|
||||
self.tags = ['default', 'safe', 'snmp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^snmp')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(snmp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_snmp-nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_snmp_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapSSH(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Nmap SSH"
|
||||
self.tags = ['default', 'safe', 'ssh']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^ssh')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,ssh2-enum-algos,ssh-hostkey,ssh-auth-methods" -oN "{scandir}/{protocol}_{port}_ssh_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ssh_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapTelnet(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap Telnet'
|
||||
self.tags = ['default', 'safe', 'telnet']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^telnet')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,telnet-encryption,telnet-ntlm-info" -oN "{scandir}/{protocol}_{port}_telnet-nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_telnet_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapTFTP(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap TFTP'
|
||||
self.tags = ['default', 'safe', 'tftp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^tftp')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,tftp-enum" -oN "{scandir}/{protocol}_{port}_tftp-nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_tftp_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class NmapVNC(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Nmap VNC'
|
||||
self.tags = ['default', 'safe', 'vnc']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^vnc')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(vnc* or realvnc* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" --script-args="unsafe=1" -oN "{scandir}/{protocol}_{port}_vnc_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_vnc_nmap.xml" {address}')
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class OneSixtyOne(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "OneSixtyOne"
|
||||
self.tags = ['default', 'safe', 'snmp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^snmp')
|
||||
self.match_port('udp', 161)
|
||||
self.run_once(True)
|
||||
self.add_option('community-strings', default='/usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt', help='The file containing a list of community strings to try. Default: %(default)s')
|
||||
|
||||
async def run(self, service):
|
||||
if service.target.ipversion == 'IPv4':
|
||||
await service.execute('onesixtyone -c ' + self.get_option('community-strings') + ' -dd {address} 2>&1', outfile='{protocol}_{port}_snmp_onesixtyone.txt')
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class OracleODAT(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Oracle ODAT"
|
||||
self.tags = ['default', 'safe', 'databases']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^oracle')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_commands('Install ODAT (https://github.com/quentinhardy/odat) and run the following commands:', [
|
||||
'python odat.py tnscmd -s {address} -p {port} --ping',
|
||||
'python odat.py tnscmd -s {address} -p {port} --version',
|
||||
'python odat.py tnscmd -s {address} -p {port} --status',
|
||||
'python odat.py sidguesser -s {address} -p {port}',
|
||||
'python odat.py passwordguesser -s {address} -p {port} -d <sid> --accounts-file accounts/accounts_multiple.txt',
|
||||
'python odat.py tnspoison -s {address} -p {port} -d <sid> --test-module'
|
||||
])
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class OraclePatator(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Oracle Patator"
|
||||
self.tags = ['default', 'databases']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^oracle')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_command('Install Oracle Instant Client (https://github.com/rapid7/metasploit-framework/wiki/How-to-get-Oracle-Support-working-with-Kali-Linux) and then bruteforce with patator:', 'patator oracle_login host={address} port={port} user=COMBO00 password=COMBO01 0=/usr/share/seclists/Passwords/Default-Credentials/oracle-betterdefaultpasslist.txt -x ignore:code=ORA-01017 -x ignore:code=ORA-28000')
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from shutil import which
|
||||
|
||||
class OracleScanner(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Oracle Scanner"
|
||||
self.tags = ['default', 'safe', 'databases']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^oracle')
|
||||
|
||||
def check(self):
|
||||
if which('oscanner') is None:
|
||||
self.error('The oscanner program could not be found. Make sure it is installed. (On Kali, run: sudo apt install oscanner)')
|
||||
return False
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('oscanner -v -s {address} -P {port} 2>&1', outfile='{protocol}_{port}_oracle_scanner.txt')
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from shutil import which
|
||||
|
||||
class OracleTNScmd(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Oracle TNScmd"
|
||||
self.tags = ['default', 'safe', 'databases']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^oracle')
|
||||
|
||||
def check(self):
|
||||
if which('tnscmd10g') is None:
|
||||
self.error('The tnscmd10g program could not be found. Make sure it is installed. (On Kali, run: sudo apt install tnscmd10g)')
|
||||
return False
|
||||
|
||||
async def run(self, service):
|
||||
if service.target.ipversion == 'IPv4':
|
||||
await service.execute('tnscmd10g ping -h {address} -p {port} 2>&1', outfile='{protocol}_{port}_oracle_tnscmd_ping.txt')
|
||||
await service.execute('tnscmd10g version -h {address} -p {port} 2>&1', outfile='{protocol}_{port}_oracle_tnscmd_version.txt')
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
from autorecon.plugins import PortScan
|
||||
from autorecon.config import config
|
||||
import re, requests
|
||||
|
||||
class AllTCPPortScan(PortScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'All TCP Ports'
|
||||
self.description = 'Performs an Nmap scan of all TCP ports.'
|
||||
self.type = 'tcp'
|
||||
self.specific_ports = True
|
||||
self.tags = ['default', 'default-port-scan', 'long']
|
||||
|
||||
async def run(self, target):
|
||||
if config['proxychains']:
|
||||
traceroute_os = ''
|
||||
else:
|
||||
traceroute_os = ' -A --osscan-guess'
|
||||
|
||||
if target.ports:
|
||||
if target.ports['tcp']:
|
||||
process, stdout, stderr = await target.execute('nmap {nmap_extra} -sV -sC --version-all' + traceroute_os + ' -p ' + target.ports['tcp'] + ' -oN "{scandir}/_full_tcp_nmap.txt" -oX "{scandir}/xml/_full_tcp_nmap.xml" {address}', blocking=False)
|
||||
else:
|
||||
return []
|
||||
else:
|
||||
process, stdout, stderr = await target.execute('nmap {nmap_extra} -sV -sC --version-all' + traceroute_os + ' -p- -oN "{scandir}/_full_tcp_nmap.txt" -oX "{scandir}/xml/_full_tcp_nmap.xml" {address}', blocking=False)
|
||||
services = []
|
||||
while True:
|
||||
line = await stdout.readline()
|
||||
if line is not None:
|
||||
match = re.search('^Discovered open port ([0-9]+)/tcp', line)
|
||||
if match:
|
||||
target.info('Discovered open port {bmagenta}tcp/' + match.group(1) + '{rst} on {byellow}' + target.address + '{rst}', verbosity=1)
|
||||
service = target.extract_service(line)
|
||||
|
||||
if service:
|
||||
# Check if HTTP service appears to be WinRM. If so, override service name as wsman.
|
||||
if service.name == 'http' and service.port in [5985, 5986]:
|
||||
wsman = requests.get(('https' if service.secure else 'http') + '://' + target.address + ':' + str(service.port) + '/wsman', verify=False)
|
||||
if wsman.status_code == 405:
|
||||
service.name = 'wsman'
|
||||
wsman = requests.post(('https' if service.secure else 'http') + '://' + target.address + ':' + str(service.port) + '/wsman', verify=False)
|
||||
else:
|
||||
if wsman.status_code == 401:
|
||||
service.name = 'wsman'
|
||||
|
||||
services.append(service)
|
||||
else:
|
||||
break
|
||||
await process.wait()
|
||||
return services
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
from autorecon.plugins import PortScan
|
||||
from autorecon.targets import Service
|
||||
import re
|
||||
|
||||
class GuessPortScan(PortScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Guess TCP Ports'
|
||||
self.type = 'tcp'
|
||||
self.description = 'Performs an Nmap scan of the all TCP ports but guesses services based off the port found. Can be quicker. Proper service matching is performed at the end of the scan.'
|
||||
self.tags = ['guess-port-scan', 'long']
|
||||
self.priority = 0
|
||||
|
||||
async def run(self, target):
|
||||
if target.ports:
|
||||
if target.ports['tcp']:
|
||||
process, stdout, stderr = await target.execute('nmap {nmap_extra} -A --osscan-guess --version-all -p ' + target.ports['tcp'] + ' -oN "{scandir}/_custom_ports_tcp_nmap.txt" -oX "{scandir}/xml/_custom_ports_tcp_nmap.xml" {address}', blocking=False)
|
||||
else:
|
||||
return []
|
||||
else:
|
||||
process, stdout, stderr = await target.execute('nmap {nmap_extra} -A --osscan-guess --version-all -p- -oN "{scandir}/_quick_tcp_nmap.txt" -oX "{scandir}/xml/_quick_tcp_nmap.xml" {address}', blocking=False)
|
||||
|
||||
insecure_ports = {
|
||||
'20':'ftp', '21':'ftp', '22':'ssh', '23':'telnet', '25':'smtp', '53':'domain', '69':'tftp', '79':'finger', '80':'http', '88':'kerberos', '109':'pop3', '110':'pop3', '111':'rpcbind', '119':'nntp', '135':'msrpc', '139':'netbios-ssn', '143':'imap', '161':'snmp', '220':'imap', '389':'ldap', '433':'nntp', '445':'smb', '587':'smtp', '631':'ipp', '873':'rsync', '1098':'java-rmi', '1099':'java-rmi', '1433':'mssql', '1521':'oracle', '2049':'nfs', '2483':'oracle', '3020':'smb', '3306':'mysql', '3389':'rdp', '3632':'distccd', '5060':'asterisk', '5500':'vnc', '5900':'vnc', '5985':'wsman', '6379':'redis', '8080':'http-proxy', '27017':'mongod', '27018':'mongod', '27019':'mongod'
|
||||
}
|
||||
secure_ports = {
|
||||
'443':'https', '465':'smtp', '563':'nntp', '585':'imaps', '593':'msrpc', '636':'ldap', '989':'ftp', '990':'ftp', '992':'telnet', '993':'imaps', '995':'pop3s', '2484':'oracle', '5061':'asterisk', '5986':'wsman'
|
||||
}
|
||||
|
||||
services = []
|
||||
while True:
|
||||
line = await stdout.readline()
|
||||
if line is not None:
|
||||
match = re.match('^Discovered open port ([0-9]+)/tcp', line)
|
||||
if match:
|
||||
if match.group(1) in insecure_ports.keys():
|
||||
await target.add_service(Service('tcp', match.group(1), insecure_ports[match.group(1)]))
|
||||
elif match.group(1) in secure_ports.keys():
|
||||
await target.add_service(Service('tcp', match.group(1), secure_ports[match.group(1)], True))
|
||||
service = target.extract_service(line)
|
||||
if service is not None:
|
||||
services.append(service)
|
||||
else:
|
||||
break
|
||||
|
||||
await process.wait()
|
||||
return services
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
from autorecon.plugins import PortScan
|
||||
from autorecon.config import config
|
||||
import os, re
|
||||
|
||||
class Top100UDPPortScan(PortScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Top 100 UDP Ports'
|
||||
self.description = 'Performs an Nmap scan of the top 100 UDP ports.'
|
||||
self.type = 'udp'
|
||||
self.specific_ports = True
|
||||
self.tags = ['default', 'default-port-scan', 'long']
|
||||
|
||||
async def run(self, target):
|
||||
# Only run UDP scan if user is root.
|
||||
if os.getuid() == 0 or config['disable_sanity_checks']:
|
||||
if target.ports:
|
||||
if target.ports['udp']:
|
||||
process, stdout, stderr = await target.execute('nmap {nmap_extra} -sU -A --osscan-guess -p ' + target.ports['udp'] + ' -oN "{scandir}/_custom_ports_udp_nmap.txt" -oX "{scandir}/xml/_custom_ports_udp_nmap.xml" {address}', blocking=False)
|
||||
else:
|
||||
return []
|
||||
else:
|
||||
process, stdout, stderr = await target.execute('nmap {nmap_extra} -sU -A --top-ports 100 -oN "{scandir}/_top_100_udp_nmap.txt" -oX "{scandir}/xml/_top_100_udp_nmap.xml" {address}', blocking=False)
|
||||
services = []
|
||||
while True:
|
||||
line = await stdout.readline()
|
||||
if line is not None:
|
||||
match = re.search('^Discovered open port ([0-9]+)/udp', line)
|
||||
if match:
|
||||
target.info('Discovered open port {bmagenta}udp/' + match.group(1) + '{rst} on {byellow}' + target.address + '{rst}', verbosity=1)
|
||||
service = target.extract_service(line)
|
||||
if service:
|
||||
services.append(service)
|
||||
else:
|
||||
break
|
||||
await process.wait()
|
||||
return services
|
||||
else:
|
||||
target.error('UDP scan requires AutoRecon be run with root privileges.')
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from shutil import which
|
||||
|
||||
class RedisCli(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Redis Cli'
|
||||
self.tags = ['default', 'safe', 'redis']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^redis$')
|
||||
|
||||
def check(self):
|
||||
if which('redis-cli') is None:
|
||||
self.error('The redis-cli program could not be found. Make sure it is installed. (On Kali, run: sudo apt install redis-tools)')
|
||||
return False
|
||||
|
||||
async def run(self, service):
|
||||
if which('redis-cli') is not None:
|
||||
_, stdout, _ = await service.execute('redis-cli -p {port} -h {address} INFO', outfile='{protocol}_{port}_redis_info.txt')
|
||||
if not (await stdout.readline()).startswith('NOAUTH Authentication required'):
|
||||
await service.execute('redis-cli -p {port} -h {address} CONFIG GET \'*\'', outfile='{protocol}_{port}_redis_config.txt')
|
||||
await service.execute('redis-cli -p {port} -h {address} CLIENT LIST', outfile='{protocol}_{port}_redis_client-list.txt')
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
from autorecon.plugins import Report
|
||||
from autorecon.config import config
|
||||
from xml.sax.saxutils import escape
|
||||
import os, glob
|
||||
|
||||
class CherryTree(Report):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'CherryTree'
|
||||
self.tags = []
|
||||
|
||||
async def run(self, targets):
|
||||
if len(targets) > 1:
|
||||
report = os.path.join(config['output'], 'report.xml.ctd')
|
||||
elif len(targets) == 1:
|
||||
report = os.path.join(targets[0].reportdir, 'report.xml.ctd')
|
||||
else:
|
||||
return
|
||||
|
||||
with open(report, 'w') as output:
|
||||
output.writelines('<?xml version="1.0" encoding="UTF-8"?>\n<cherrytree>\n')
|
||||
for target in targets:
|
||||
output.writelines('<node name="' + escape(target.address) + '" is_bold="1" custom_icon_id="1">\n')
|
||||
|
||||
files = [os.path.abspath(filename) for filename in glob.iglob(os.path.join(target.scandir, '**/*'), recursive=True) if os.path.isfile(filename) and filename.endswith(('.txt', '.html'))]
|
||||
|
||||
if target.scans['ports']:
|
||||
output.writelines('<node name="Port Scans" custom_icon_id="2">\n')
|
||||
for scan in target.scans['ports'].keys():
|
||||
if len(target.scans['ports'][scan]['commands']) > 0:
|
||||
output.writelines('<node name="PortScan: ' + escape(target.scans['ports'][scan]['plugin'].name) + '" custom_icon_id="21">\n')
|
||||
for command in target.scans['ports'][scan]['commands']:
|
||||
output.writelines('<rich_text>' + escape(command[0]))
|
||||
for filename in files:
|
||||
if filename in command[0] or (command[1] is not None and filename == command[1]) or (command[2] is not None and filename == command[2]):
|
||||
output.writelines('\n\n' + escape(filename) + ':\n\n')
|
||||
with open(filename, 'r') as file:
|
||||
output.writelines(escape(file.read()) + '\n')
|
||||
output.writelines('</rich_text>\n')
|
||||
output.writelines('</node>\n')
|
||||
output.writelines('</node>\n')
|
||||
if target.scans['services']:
|
||||
output.writelines('<node name="Services" custom_icon_id="2">\n')
|
||||
for service in target.scans['services'].keys():
|
||||
output.writelines('<node name="Service: ' + escape(service.tag()) + '" custom_icon_id="3">\n')
|
||||
for plugin in target.scans['services'][service].keys():
|
||||
if len(target.scans['services'][service][plugin]['commands']) > 0:
|
||||
output.writelines('<node name="' + escape(target.scans['services'][service][plugin]['plugin'].name) + '" custom_icon_id="21">\n')
|
||||
for command in target.scans['services'][service][plugin]['commands']:
|
||||
output.writelines('<rich_text>' + escape(command[0]))
|
||||
for filename in files:
|
||||
if filename in command[0] or (command[1] is not None and filename == command[1]) or (command[2] is not None and filename == command[2]):
|
||||
output.writelines('\n\n' + escape(filename) + ':\n\n')
|
||||
with open(filename, 'r') as file:
|
||||
output.writelines(escape(file.read()) + '\n')
|
||||
output.writelines('</rich_text>\n')
|
||||
output.writelines('</node>\n')
|
||||
output.writelines('</node>\n')
|
||||
output.writelines('</node>\n')
|
||||
|
||||
manual_commands = os.path.join(target.scandir, '_manual_commands.txt')
|
||||
if os.path.isfile(manual_commands):
|
||||
output.writelines('<node name="Manual Commands" custom_icon_id="22">\n')
|
||||
with open(manual_commands, 'r') as file:
|
||||
output.writelines('<rich_text>' + escape(file.read()) + '</rich_text>\n')
|
||||
output.writelines('</node>\n')
|
||||
|
||||
patterns = os.path.join(target.scandir, '_patterns.log')
|
||||
if os.path.isfile(patterns):
|
||||
output.writelines('<node name="Patterns" custom_icon_id="10">\n')
|
||||
with open(patterns, 'r') as file:
|
||||
output.writelines('<rich_text>' + escape(file.read()) + '</rich_text>\n')
|
||||
output.writelines('</node>\n')
|
||||
|
||||
commands = os.path.join(target.scandir, '_commands.log')
|
||||
if os.path.isfile(commands):
|
||||
output.writelines('<node name="Commands" custom_icon_id="21">\n')
|
||||
with open(commands, 'r') as file:
|
||||
output.writelines('<rich_text>' + escape(file.read()) + '</rich_text>\n')
|
||||
output.writelines('</node>\n')
|
||||
|
||||
errors = os.path.join(target.scandir, '_errors.log')
|
||||
if os.path.isfile(errors):
|
||||
output.writelines('<node name="Errors" custom_icon_id="57">\n')
|
||||
with open(errors, 'r') as file:
|
||||
output.writelines('<rich_text>' + escape(file.read()) + '</rich_text>\n')
|
||||
output.writelines('</node>\n')
|
||||
output.writelines('</node>\n')
|
||||
|
||||
output.writelines('</cherrytree>')
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
from autorecon.plugins import Report
|
||||
from autorecon.config import config
|
||||
import os, glob
|
||||
|
||||
class Markdown(Report):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Markdown'
|
||||
|
||||
async def run(self, targets):
|
||||
if len(targets) > 1:
|
||||
report = os.path.join(config['output'], 'report.md')
|
||||
elif len(targets) == 1:
|
||||
report = os.path.join(targets[0].reportdir, 'report.md')
|
||||
else:
|
||||
return
|
||||
|
||||
os.makedirs(report, exist_ok=True)
|
||||
|
||||
for target in targets:
|
||||
os.makedirs(os.path.join(report, target.address), exist_ok=True)
|
||||
|
||||
files = [os.path.abspath(filename) for filename in glob.iglob(os.path.join(target.scandir, '**/*'), recursive=True) if os.path.isfile(filename) and filename.endswith(('.txt', '.html'))]
|
||||
|
||||
if target.scans['ports']:
|
||||
os.makedirs(os.path.join(report, target.address, 'Port Scans'), exist_ok=True)
|
||||
for scan in target.scans['ports'].keys():
|
||||
if len(target.scans['ports'][scan]['commands']) > 0:
|
||||
with open(os.path.join(report, target.address, 'Port Scans', 'PortScan - ' + target.scans['ports'][scan]['plugin'].name + '.md'), 'w') as output:
|
||||
for command in target.scans['ports'][scan]['commands']:
|
||||
output.writelines('```bash\n' + command[0] + '\n```')
|
||||
for filename in files:
|
||||
if filename in command[0] or (command[1] is not None and filename == command[1]) or (command[2] is not None and filename == command[2]):
|
||||
output.writelines('\n\n[' + filename + '](file://' + filename + '):\n\n')
|
||||
with open(filename, 'r') as file:
|
||||
output.writelines('```\n' + file.read() + '\n```\n')
|
||||
if target.scans['services']:
|
||||
os.makedirs(os.path.join(report, target.address, 'Services'), exist_ok=True)
|
||||
for service in target.scans['services'].keys():
|
||||
os.makedirs(os.path.join(report, target.address, 'Services', 'Service - ' + service.tag().replace('/', '-')), exist_ok=True)
|
||||
for plugin in target.scans['services'][service].keys():
|
||||
if len(target.scans['services'][service][plugin]['commands']) > 0:
|
||||
with open(os.path.join(report, target.address, 'Services', 'Service - ' + service.tag().replace('/', '-'), target.scans['services'][service][plugin]['plugin'].name + '.md'), 'w') as output:
|
||||
for command in target.scans['services'][service][plugin]['commands']:
|
||||
output.writelines('```bash\n' + command[0] + '\n```')
|
||||
for filename in files:
|
||||
if filename in command[0] or (command[1] is not None and filename == command[1]) or (command[2] is not None and filename == command[2]):
|
||||
output.writelines('\n\n[' + filename + '](file://' + filename + '):\n\n')
|
||||
with open(filename, 'r') as file:
|
||||
output.writelines('```\n' + file.read() + '\n```\n')
|
||||
|
||||
manual_commands = os.path.join(target.scandir, '_manual_commands.txt')
|
||||
if os.path.isfile(manual_commands):
|
||||
with open(os.path.join(report, target.address, 'Manual Commands' + '.md'), 'w') as output:
|
||||
with open(manual_commands, 'r') as file:
|
||||
output.writelines('```bash\n' + file.read() + '\n```')
|
||||
|
||||
patterns = os.path.join(target.scandir, '_patterns.log')
|
||||
if os.path.isfile(patterns):
|
||||
with open(os.path.join(report, target.address, 'Patterns' + '.md'), 'w') as output:
|
||||
with open(patterns, 'r') as file:
|
||||
output.writelines(file.read())
|
||||
|
||||
commands = os.path.join(target.scandir, '_commands.log')
|
||||
if os.path.isfile(commands):
|
||||
with open(os.path.join(report, target.address, 'Commands' + '.md'), 'w') as output:
|
||||
with open(commands, 'r') as file:
|
||||
output.writelines('```bash\n' + file.read() + '\n```')
|
||||
|
||||
errors = os.path.join(target.scandir, '_errors.log')
|
||||
if os.path.isfile(errors):
|
||||
with open(os.path.join(report, target.address, 'Errors' + '.md'), 'w') as output:
|
||||
with open(errors, 'r') as file:
|
||||
output.writelines('```\n' + file.read() + '\n```')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class RPCClient(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "rpcclient"
|
||||
self.tags = ['default', 'safe', 'rpc']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^msrpc', '^rpcbind', '^erpc'])
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_command('RPC Client:', 'rpcclient -p {port} -U "" {address}')
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class RPCDump(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'rpcdump'
|
||||
self.tags = ['default', 'safe', 'rpc']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^msrpc', '^rpcbind', '^erpc', '^ncacn_http$'])
|
||||
self.match_port('tcp', [135, 139, 443, 445, 593])
|
||||
|
||||
async def run(self, service):
|
||||
if service.protocol == 'tcp':
|
||||
await service.execute('impacket-rpcdump -port {port} {address}', outfile='{protocol}_{port}_rpc_rpcdump.txt')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class RsyncList(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Rsync List Files'
|
||||
self.tags = ['default', 'safe', 'rsync']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^rsync')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('rsync -av --list-only rsync://{addressv6}:{port}', outfile='{protocol}_{port}_rsync_file_list.txt')
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class Showmount(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "showmount"
|
||||
self.tags = ['default', 'safe', 'nfs']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^nfs', '^rpcbind'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('showmount -e {address} 2>&1', outfile='{protocol}_{port}_showmount.txt')
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class SIPVicious(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "SIPVicious"
|
||||
self.tags = ['default', 'safe', 'sip']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^asterisk', '^sip'])
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
if service.target.ipversion == 'IPv4':
|
||||
service.add_manual_command('svwar:', 'svwar -D -m INVITE -p {port} {address}')
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class SMBVuln(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "SMB Vulnerabilities"
|
||||
self.tags = ['unsafe', 'smb', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^smb', '^microsoft\-ds', '^netbios'])
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('nmap {nmap_extra} -sV -p {port} --script="smb-vuln-*" --script-args="unsafe=1" -oN "{scandir}/{protocol}_{port}_smb_vulnerabilities.txt" -oX "{scandir}/xml/{protocol}_{port}_smb_vulnerabilities.xml" {address}')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
if not plugin_was_run: # Only suggest these if they weren't run.
|
||||
service.add_manual_commands('Nmap scans for SMB vulnerabilities that could potentially cause a DoS if scanned (according to Nmap). Be careful:', 'nmap {nmap_extra} -sV -p {port} --script="smb-vuln-* and dos" --script-args="unsafe=1" -oN "{scandir}/{protocol}_{port}_smb_vulnerabilities.txt" -oX "{scandir}/xml/{protocol}_{port}_smb_vulnerabilities.xml" {address}')
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class SMBClient(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "SMBClient"
|
||||
self.tags = ['default', 'safe', 'smb', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^smb', '^microsoft\-ds', '^netbios'])
|
||||
self.match_port('tcp', [139, 445])
|
||||
self.run_once(True)
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('smbclient -L //{address} -N -I {address} 2>&1', outfile='smbclient.txt')
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class SMBMap(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "SMBMap"
|
||||
self.tags = ['default', 'safe', 'smb', 'active-directory']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name(['^smb', '^microsoft\-ds', '^netbios'])
|
||||
|
||||
async def run(self, service):
|
||||
if service.target.ipversion == 'IPv4':
|
||||
await service.execute('smbmap -H {address} -P {port} 2>&1', outfile='smbmap-share-permissions.txt')
|
||||
await service.execute('smbmap -u null -p "" -H {address} -P {port} 2>&1', outfile='smbmap-share-permissions.txt')
|
||||
await service.execute('smbmap -H {address} -P {port} -R 2>&1', outfile='smbmap-list-contents.txt')
|
||||
await service.execute('smbmap -u null -p "" -H {address} -P {port} -R 2>&1', outfile='smbmap-list-contents.txt')
|
||||
await service.execute('smbmap -H {address} -P {port} -x "ipconfig /all" 2>&1', outfile='smbmap-execute-command.txt')
|
||||
await service.execute('smbmap -u null -p "" -H {address} -P {port} -x "ipconfig /all" 2>&1', outfile='smbmap-execute-command.txt')
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class SMTPUserEnum(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'SMTP-User-Enum'
|
||||
self.tags = ['default', 'safe', 'smtp', 'email']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^smtp')
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('hydra smtp-enum://{addressv6}:{port}/vrfy -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" 2>&1', outfile='{protocol}_{port}_smtp_user-enum_hydra_vrfy.txt')
|
||||
await service.execute('hydra smtp-enum://{addressv6}:{port}/expn -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" 2>&1', outfile='{protocol}_{port}_smtp_user-enum_hydra_expn.txt')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_command('Try User Enumeration using "RCPT TO". Replace <TARGET-DOMAIN> with the target\'s domain name:', [
|
||||
'hydra smtp-enum://{addressv6}:{port}/rcpt -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -o "{scandir}/{protocol}_{port}_smtp_user-enum_hydra_rcpt.txt" -p <TARGET-DOMAIN>'
|
||||
])
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class SNMPWalk(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "SNMPWalk"
|
||||
self.tags = ['default', 'safe', 'snmp']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^snmp')
|
||||
self.match_port('udp', 161)
|
||||
self.run_once(True)
|
||||
|
||||
async def run(self, service):
|
||||
await service.execute('snmpwalk -c public -v 1 {address} 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk.txt')
|
||||
await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.1.6.0 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_system_processes.txt')
|
||||
await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.4.2.1.2 2>&1', outfile='{scandir}/{protocol}_{port}_snmp_snmpwalk_running_processes.txt')
|
||||
await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.4.2.1.4 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_process_paths.txt')
|
||||
await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.2.3.1.4 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_storage_units.txt')
|
||||
await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.2.3.1.4 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_software_names.txt')
|
||||
await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.4.1.77.1.2.25 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_user_accounts.txt')
|
||||
await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.6.13.1.3 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_tcp_ports.txt')
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class SSLScan(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "SSL Scan"
|
||||
self.tags = ['default', 'safe', 'ssl', 'tls']
|
||||
|
||||
def configure(self):
|
||||
self.match_all_service_names(True)
|
||||
self.require_ssl(True)
|
||||
|
||||
async def run(self, service):
|
||||
if service.protocol == 'tcp' and service.secure:
|
||||
await service.execute('sslscan --show-certificate --no-colour {addressv6}:{port} 2>&1', outfile='{protocol}_{port}_sslscan.html')
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
import os
|
||||
|
||||
class SubdomainEnumeration(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "Subdomain Enumeration"
|
||||
self.slug = "subdomain-enum"
|
||||
self.tags = ['default', 'safe', 'long', 'dns']
|
||||
|
||||
def configure(self):
|
||||
self.add_option('domain', help='The domain to use as the base domain (e.g. example.com) for subdomain enumeration. Default: %(default)s')
|
||||
self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating subdomains. Separate multiple wordlists with spaces. Default: %(default)s')
|
||||
self.add_option('threads', default=10, help='The number of threads to use when enumerating subdomains. Default: %(default)s')
|
||||
self.match_service_name('^domain')
|
||||
|
||||
async def run(self, service):
|
||||
domains = []
|
||||
|
||||
if self.get_option('domain'):
|
||||
domains.append(self.get_option('domain'))
|
||||
if service.target.type == 'hostname' and service.target.address not in domains:
|
||||
domains.append(service.target.address)
|
||||
if self.get_global('domain') and self.get_global('domain') not in domains:
|
||||
domains.append(self.get_global('domain'))
|
||||
|
||||
if len(domains) > 0:
|
||||
for wordlist in self.get_option('wordlist'):
|
||||
name = os.path.splitext(os.path.basename(wordlist))[0]
|
||||
for domain in domains:
|
||||
await service.execute('gobuster dns -d ' + domain + ' -r {addressv6} -w ' + wordlist + ' -o "{scandir}/{protocol}_{port}_' + domain + '_subdomains_' + name + '.txt"')
|
||||
else:
|
||||
service.info('The target was not a domain, nor was a domain provided as an option. Skipping subdomain enumeration.')
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from shutil import which
|
||||
import os, random, string
|
||||
|
||||
class VirtualHost(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'Virtual Host Enumeration'
|
||||
self.slug = 'vhost-enum'
|
||||
self.tags = ['default', 'safe', 'http', 'long']
|
||||
|
||||
def configure(self):
|
||||
self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s')
|
||||
self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s')
|
||||
self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s')
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
|
||||
async def run(self, service):
|
||||
hostnames = []
|
||||
if self.get_option('hostname'):
|
||||
hostnames.append(self.get_option('hostname'))
|
||||
if service.target.type == 'hostname' and service.target.address not in hostnames:
|
||||
hostnames.append(service.target.address)
|
||||
if self.get_global('domain') and self.get_global('domain') not in hostnames:
|
||||
hostnames.append(self.get_global('domain'))
|
||||
|
||||
if len(hostnames) > 0:
|
||||
for wordlist in self.get_option('wordlist'):
|
||||
name = os.path.splitext(os.path.basename(wordlist))[0]
|
||||
for hostname in hostnames:
|
||||
_, stdout, _ = await service.execute('curl -sk -o /dev/null -H "Host: ' + ''.join(random.choice(string.ascii_letters) for i in range(20)) + '.' + hostname + '" {http_scheme}://' + hostname + ':{port}/ -w "%{{size_download}}"')
|
||||
|
||||
size = ''.join(await stdout.readlines())
|
||||
|
||||
await service.execute('ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) + ' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -fs ' + size + ' -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"')
|
||||
else:
|
||||
service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.')
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class WhatWeb(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "whatweb"
|
||||
self.tags = ['default', 'safe', 'http']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
|
||||
async def run(self, service):
|
||||
if service.protocol == 'tcp' and service.target.ipversion == 'IPv4':
|
||||
await service.execute('whatweb --color=never --no-errors -a 3 -v {http_scheme}://{address}:{port} 2>&1', outfile='{protocol}_{port}_{http_scheme}_whatweb.txt')
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from autorecon.io import fformat
|
||||
|
||||
class WinRMDetection(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'WinRM Detection'
|
||||
self.tags = ['default', 'safe', 'winrm']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^wsman')
|
||||
self.match_service('tcp', [5985, 5986], '^http')
|
||||
|
||||
async def run(self, service):
|
||||
filename = fformat('{scandir}/{protocol}_{port}_winrm-detection.txt')
|
||||
with open(filename, mode='wt', encoding='utf8') as winrm:
|
||||
winrm.write('WinRM was possibly detected running on ' + service.protocol + ' port ' + str(service.port) + '.\nCheck _manual_commands.txt for manual commands you can run against this service.')
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
service.add_manual_commands('Bruteforce logins:', [
|
||||
'crackmapexec winrm {address} -d \'' + self.get_global('domain', default='<domain>') + '\' -u \'' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '\' -p \'' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '\''
|
||||
])
|
||||
|
||||
service.add_manual_commands('Check login (requires credentials):', [
|
||||
'crackmapexec winrm {address} -d \'' + self.get_global('domain', default='<domain>') + '\' -u \'<username>\' -p \'<password>\''
|
||||
])
|
||||
|
||||
service.add_manual_commands('Evil WinRM (gem install evil-winrm):', [
|
||||
'evil-winrm -u \'<user>\' -p \'<password>\' -i {address}',
|
||||
'evil-winrm -u \'<user>\' -H \'<hash>\' -i {address}'
|
||||
])
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
from shutil import which
|
||||
|
||||
class WkHTMLToImage(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = "wkhtmltoimage"
|
||||
self.tags = ['default', 'safe', 'http']
|
||||
|
||||
def configure(self):
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
|
||||
def check(self):
|
||||
if which('wkhtmltoimage') is None:
|
||||
self.error('The wkhtmltoimage program could not be found. Make sure it is installed. (On Kali, run: sudo apt install wkhtmltopdf)')
|
||||
return False
|
||||
|
||||
async def run(self, service):
|
||||
if which('wkhtmltoimage') is not None:
|
||||
if service.protocol == 'tcp':
|
||||
await service.execute('wkhtmltoimage --format png {http_scheme}://{addressv6}:{port}/ {scandir}/{protocol}_{port}_{http_scheme}_screenshot.png')
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
from autorecon.plugins import ServiceScan
|
||||
|
||||
class WPScan(ServiceScan):
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.name = 'WPScan'
|
||||
self.tags = ['default', 'safe', 'http']
|
||||
|
||||
def configure(self):
|
||||
self.add_option('api-token', help='An API Token from wpvulndb.com to help search for more vulnerabilities.')
|
||||
self.match_service_name('^http')
|
||||
self.match_service_name('^nacn_http$', negative_match=True)
|
||||
|
||||
def manual(self, service, plugin_was_run):
|
||||
api_token = ''
|
||||
if self.get_option('api-token'):
|
||||
api_token = ' --api-token ' + self.get_option('api-token')
|
||||
|
||||
service.add_manual_command('(wpscan) WordPress Security Scanner (useful if WordPress is found):', 'wpscan --url {http_scheme}://{addressv6}:{port}/ --no-update -e vp,vt,tt,cb,dbe,u,m --plugins-detection aggressive --plugins-version-detection aggressive -f cli-no-color' + api_token + ' 2>&1 | tee "{scandir}/{protocol}_{port}_{http_scheme}_wpscan.txt"')
|
||||
Loading…
Reference in New Issue