diff --git a/CHANGELOG.md b/CHANGELOG.md index 4cc3e77..7206441 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,6 @@ ## CHANGELOG: +* v2.0a - Fixed issue with ssh-audit +* v2.0a - Fixed issue with 'discover' mode * v2.0 - Updated sub-domain takeover list * v2.0 - Improved scan performance for stealth, airstrike and discover modes * v2.0 - Removed jexboss due to clear screen issue with output diff --git a/sniper b/sniper index 60986b5..0818420 100644 --- a/sniper +++ b/sniper @@ -105,8 +105,6 @@ else SCAN_TYPE="DOMAIN" fi -#clear - if [ "$MODE" = "report" ]; then sniper $TARGET | tee $LOOT_DIR/sniper-$TARGET-`date +%Y%m%d%H%M`.txt 2>&1 exit @@ -138,7 +136,7 @@ if [ "$MODE" = "discover" ]; then echo -e "$OKGREEN + -- ----------------------------=[Checking ARP Cache]=---------------------- -- +$RESET" arp -a -n echo -e "$OKGREEN + -- ----------------------------=[Running Port Discovery Scan]=------------- -- +$RESET" - unicornscan $TARGET -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1433,1524,2049,2121,3306,3310,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152,U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 2>/dev/null | awk '{print $6}' | sort -u > $LOOT_DIR/domains/sniper-ips.txt + unicornscan $TARGET -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1433,1524,2049,2121,3306,3310,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 2>/dev/null | awk '{print $6}' | sort -u > $LOOT_DIR/domains/sniper-ips.txt echo -e "$OKGREEN + -- ----------------------------=[Current Targets]=------------------------- -- +$RESET" cat $LOOT_DIR/domains/sniper-ips.txt echo -e "$OKGREEN + -- ----------------------------=[Launching Sn1per Scans]=------------------ -- +$RESET" @@ -220,14 +218,14 @@ if [ "$MODE" = "stealth" ]; then echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Info]=---------------------- -- +$RESET" dig -x $TARGET dnsenum $TARGET - mv -f *_ips.txt $LOOT_DIR/ 2>/dev/null + mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Subdomains]=---------------- -- +$RESET" - python Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null + python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null echo -e "$OKGREEN + -- ----------------------------=[Checking for Sub-Domain Hijacking]=------- -- +$RESET" for a in `cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null`; do dig $a CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign monitor|cargocollective|statuspage|tumblr|amazonaws|hubspot" 2>/dev/null; done; echo -e "$OKGREEN + -- ----------------------------=[Checking Email Security]=----------------- -- +$RESET" - python SimpleEmailSpoofer/spoofcheck.py $TARGET 2>/dev/null + python $PLUGINS_DIR/SimpleEmailSpoofer/spoofcheck.py $TARGET 2>/dev/null fi echo "" echo -e "$OKGREEN + -- ----------------------------=[Running TCP port scan]=------------------- -- +$RESET" @@ -273,7 +271,21 @@ if [ "$MODE" = "stealth" ]; then fi echo -e "$OKGREEN + -- ----------------------------=[Done]=------------------------------------ -- +$RESET" - loot + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" rm -f $INSTALL_DIR/.fuse_* 2> /dev/null exit fi @@ -342,12 +354,12 @@ if [ "$MODE" = "airstrike" ]; then dnsenum $a mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Subdomains]=---------------- -- +$RESET" - python Sublist3r/sublist3r.py -d $a -vvv -o $LOOT_DIR/domains/domains-$a.txt 2>/dev/null + python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $a -vvv -o $LOOT_DIR/domains/domains-$a.txt 2>/dev/null dos2unix $LOOT_DIR/domains/domains-$a.txt 2>/dev/null echo -e "$OKGREEN + -- ----------------------------=[Checking for Sub-Domain Hijacking]=------- -- +$RESET" for b in `cat $LOOT_DIR/domains/domains-$a.txt 2> /dev/null`; do dig $b CNAME | egrep -i 'wordpress|instapage|heroku|github|bitbucket|squarespace|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign monitor|cargocollective|statuspage|tumblr|amazonaws|hubspot' 2>/dev/null; done; echo -e "$OKGREEN + -- ----------------------------=[Checking Email Security]=----------------- -- +$RESET" - python SimpleEmailSpoofer/spoofcheck.py $a 2>/dev/null + python $PLUGINS_DIR/SimpleEmailSpoofer/spoofcheck.py $a 2>/dev/null fi echo "" echo -e "$OKGREEN + -- ----------------------------=[Running port scan]=------------------- -- +$RESET" @@ -391,7 +403,6 @@ if [ "$MODE" = "airstrike" ]; then fi echo -e "$OKGREEN + -- ----------------------------=[Done!]=----------------------------------- -- +$RESET" - loot echo -e "" echo -e "" echo -e "" @@ -483,14 +494,14 @@ then echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Info]=---------------------- -- +$RESET" dig -x $TARGET dnsenum $TARGET - mv -f *_ips.txt $LOOT_DIR/ 2>/dev/null + mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null echo -e "$OKGREEN + -- ----------------------------=[Gathering DNS Subdomains]=---------------- -- +$RESET" - python Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null + python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null echo -e "$OKGREEN + -- ----------------------------=[Checking for Sub-Domain Hijacking]=------- -- +$RESET" for a in `cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null`; do dig $a CNAME | egrep -i 'wordpress|instapage|heroku|github|bitbucket|squarespace|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign monitor|cargocollective|statuspage|tumblr|amazonaws|hubspot' 2>/dev/null; done; echo -e "$OKGREEN + -- ----------------------------=[Checking Email Security]=----------------- -- +$RESET" - python SimpleEmailSpoofer/spoofcheck.py $TARGET 2>/dev/null + python $PLUGINS_DIR/SimpleEmailSpoofer/spoofcheck.py $TARGET 2>/dev/null fi echo "" echo -e "$OKGREEN + -- ----------------------------=[Pinging host]=---------------------------- -- +$RESET" @@ -569,9 +580,9 @@ then echo -e "$OKRED + -- --=[Port 22 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 22 opened... running tests...$RESET" - cd ssh-audit + cd $PLUGINS_DIR/ssh-audit python ssh-audit.py $TARGET:22 - cd .. + cd $INSTALL_DIR nmap -A -sV -sC -T5 -p 22 --script=ssh-* $TARGET msfconsole -x "use scanner/ssh/ssh_enumusers; setg USER_FILE "$USER_FILE"; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use scanner/ssh/ssh_identify_pubkeys; run; use scanner/ssh/ssh_version; run; exit;" fi @@ -1192,6 +1203,17 @@ else rm -f scan.log echo "" fi -loot + +cd $LOOT_DIR +echo -e "$OKORANGE + -- --=[Sorting loot directory ($LOOT_DIR)" +echo -e "$OKORANGE + -- --=[Generating reports..." +for a in `ls sniper-*.txt 2>/dev/null`; +do + echo "$a" > $LOOT_DIR/reports/$a + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g" $a >> $LOOT_DIR/reports/$a + mv $a $LOOT_DIR/output/ +done +rm -f $LOOT_DIR/.fuse_* 2> /dev/null + echo -e "$OKGREEN + -- ----------------------------=[Done]=------------------------------------ -- +$RESET" exit 0