mirror of https://github.com/1N3/Sn1per.git
Sn1per by 1N3@CrowdShield
This commit is contained in:
root
parent
50256691bf
commit
0dd5ce9056
|
|
@ -1,4 +1,6 @@
|
|||
## CHANGELOG:
|
||||
* v2.0a - Fixed issue with ssh-audit
|
||||
* v2.0a - Fixed issue with 'discover' mode
|
||||
* v2.0 - Updated sub-domain takeover list
|
||||
* v2.0 - Improved scan performance for stealth, airstrike and discover modes
|
||||
* v2.0 - Removed jexboss due to clear screen issue with output
|
||||
|
|
|
|||
54
sniper
54
sniper
|
|
@ -105,8 +105,6 @@ else
|
|||
SCAN_TYPE="DOMAIN"
|
||||
fi
|
||||
|
||||
#clear
|
||||
|
||||
if [ "$MODE" = "report" ]; then
|
||||
sniper $TARGET | tee $LOOT_DIR/sniper-$TARGET-`date +%Y%m%d%H%M`.txt 2>&1
|
||||
exit
|
||||
|
|
@ -138,7 +136,7 @@ if [ "$MODE" = "discover" ]; then
|
|||
echo -e "$OKGREEN + -- ----------------------------=[Checking ARP Cache]=---------------------- -- +$RESET"
|
||||
arp -a -n
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Running Port Discovery Scan]=------------- -- +$RESET"
|
||||
unicornscan $TARGET -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1433,1524,2049,2121,3306,3310,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152,U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 2>/dev/null | awk '{print $6}' | sort -u > $LOOT_DIR/domains/sniper-ips.txt
|
||||
unicornscan $TARGET -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1433,1524,2049,2121,3306,3310,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 2>/dev/null | awk '{print $6}' | sort -u > $LOOT_DIR/domains/sniper-ips.txt
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Current Targets]=------------------------- -- +$RESET"
|
||||
cat $LOOT_DIR/domains/sniper-ips.txt
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Launching Sn1per Scans]=------------------ -- +$RESET"
|
||||
|
|
@ -220,14 +218,14 @@ if [ "$MODE" = "stealth" ]; then
|
|||
echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Info]=---------------------- -- +$RESET"
|
||||
dig -x $TARGET
|
||||
dnsenum $TARGET
|
||||
mv -f *_ips.txt $LOOT_DIR/ 2>/dev/null
|
||||
mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Subdomains]=---------------- -- +$RESET"
|
||||
python Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null
|
||||
python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null
|
||||
dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Checking for Sub-Domain Hijacking]=------- -- +$RESET"
|
||||
for a in `cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null`; do dig $a CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign monitor|cargocollective|statuspage|tumblr|amazonaws|hubspot" 2>/dev/null; done;
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Checking Email Security]=----------------- -- +$RESET"
|
||||
python SimpleEmailSpoofer/spoofcheck.py $TARGET 2>/dev/null
|
||||
python $PLUGINS_DIR/SimpleEmailSpoofer/spoofcheck.py $TARGET 2>/dev/null
|
||||
fi
|
||||
echo ""
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Running TCP port scan]=------------------- -- +$RESET"
|
||||
|
|
@ -273,7 +271,21 @@ if [ "$MODE" = "stealth" ]; then
|
|||
fi
|
||||
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Done]=------------------------------------ -- +$RESET"
|
||||
loot
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
rm -f $INSTALL_DIR/.fuse_* 2> /dev/null
|
||||
exit
|
||||
fi
|
||||
|
|
@ -342,12 +354,12 @@ if [ "$MODE" = "airstrike" ]; then
|
|||
dnsenum $a
|
||||
mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Subdomains]=---------------- -- +$RESET"
|
||||
python Sublist3r/sublist3r.py -d $a -vvv -o $LOOT_DIR/domains/domains-$a.txt 2>/dev/null
|
||||
python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $a -vvv -o $LOOT_DIR/domains/domains-$a.txt 2>/dev/null
|
||||
dos2unix $LOOT_DIR/domains/domains-$a.txt 2>/dev/null
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Checking for Sub-Domain Hijacking]=------- -- +$RESET"
|
||||
for b in `cat $LOOT_DIR/domains/domains-$a.txt 2> /dev/null`; do dig $b CNAME | egrep -i 'wordpress|instapage|heroku|github|bitbucket|squarespace|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign monitor|cargocollective|statuspage|tumblr|amazonaws|hubspot' 2>/dev/null; done;
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Checking Email Security]=----------------- -- +$RESET"
|
||||
python SimpleEmailSpoofer/spoofcheck.py $a 2>/dev/null
|
||||
python $PLUGINS_DIR/SimpleEmailSpoofer/spoofcheck.py $a 2>/dev/null
|
||||
fi
|
||||
echo ""
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Running port scan]=------------------- -- +$RESET"
|
||||
|
|
@ -391,7 +403,6 @@ if [ "$MODE" = "airstrike" ]; then
|
|||
fi
|
||||
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Done!]=----------------------------------- -- +$RESET"
|
||||
loot
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
echo -e ""
|
||||
|
|
@ -483,14 +494,14 @@ then
|
|||
echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Info]=---------------------- -- +$RESET"
|
||||
dig -x $TARGET
|
||||
dnsenum $TARGET
|
||||
mv -f *_ips.txt $LOOT_DIR/ 2>/dev/null
|
||||
mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Subdomains]=---------------- -- +$RESET"
|
||||
python Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null
|
||||
python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null
|
||||
dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Checking for Sub-Domain Hijacking]=------- -- +$RESET"
|
||||
for a in `cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null`; do dig $a CNAME | egrep -i 'wordpress|instapage|heroku|github|bitbucket|squarespace|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign monitor|cargocollective|statuspage|tumblr|amazonaws|hubspot' 2>/dev/null; done;
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Checking Email Security]=----------------- -- +$RESET"
|
||||
python SimpleEmailSpoofer/spoofcheck.py $TARGET 2>/dev/null
|
||||
python $PLUGINS_DIR/SimpleEmailSpoofer/spoofcheck.py $TARGET 2>/dev/null
|
||||
fi
|
||||
echo ""
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Pinging host]=---------------------------- -- +$RESET"
|
||||
|
|
@ -569,9 +580,9 @@ then
|
|||
echo -e "$OKRED + -- --=[Port 22 closed... skipping.$RESET"
|
||||
else
|
||||
echo -e "$OKORANGE + -- --=[Port 22 opened... running tests...$RESET"
|
||||
cd ssh-audit
|
||||
cd $PLUGINS_DIR/ssh-audit
|
||||
python ssh-audit.py $TARGET:22
|
||||
cd ..
|
||||
cd $INSTALL_DIR
|
||||
nmap -A -sV -sC -T5 -p 22 --script=ssh-* $TARGET
|
||||
msfconsole -x "use scanner/ssh/ssh_enumusers; setg USER_FILE "$USER_FILE"; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use scanner/ssh/ssh_identify_pubkeys; run; use scanner/ssh/ssh_version; run; exit;"
|
||||
fi
|
||||
|
|
@ -1192,6 +1203,17 @@ else
|
|||
rm -f scan.log
|
||||
echo ""
|
||||
fi
|
||||
loot
|
||||
|
||||
cd $LOOT_DIR
|
||||
echo -e "$OKORANGE + -- --=[Sorting loot directory ($LOOT_DIR)"
|
||||
echo -e "$OKORANGE + -- --=[Generating reports..."
|
||||
for a in `ls sniper-*.txt 2>/dev/null`;
|
||||
do
|
||||
echo "$a" > $LOOT_DIR/reports/$a
|
||||
sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g" $a >> $LOOT_DIR/reports/$a
|
||||
mv $a $LOOT_DIR/output/
|
||||
done
|
||||
rm -f $LOOT_DIR/.fuse_* 2> /dev/null
|
||||
|
||||
echo -e "$OKGREEN + -- ----------------------------=[Done]=------------------------------------ -- +$RESET"
|
||||
exit 0
|
||||
|
|
|
|||
Loading…
Reference in New Issue