RomanNum3ral
/
Sn1per
mirror of https://github.com/1N3/Sn1per.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Sn1per v1.6 by 1N3@CrowdShield

This commit is contained in:
root 2016-01-25 08:34:35 -05:00
parent c8a4002fa0
commit 0f3947cc9d
4 changed files with 266 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
README.md
View File

@ -13,6 +13,7 @@ Sn1per is an automated scanner that can be used during a penetration test to enu
* Automatically runs targeted Metasploit scan and exploit modules
* Automatically scans all web applications for common vulnerabilities
* Automatically brute forces all open services
* Performs high level enumeration of multiple hosts
## INSTALL:
```
@ -21,15 +22,44 @@ Sn1per is an automated scanner that can be used during a penetration test to enu
## USAGE:
```
./sn1per <target>
# ./sniper <target> report
# ./sniper <target> stealth <report>
# ./sniper <target> port <portnum>
# ./sniper <target> nobrute <report>
# ./sniper <targets.txt> airstrike <report>
# ./sniper <targets.txt> nuke <report>
```
## REPORT MODE:
Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command.
## STEALTH MODE:
Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking
## PORT MODE:
Scans a specific port for vulnerabilities. Reporting is not currently available in this mode.
## NOBRUTE MODE:
Launches a full scan against a target host/domain without brute forcing services.
## AIRSTRIKE:
Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IP's that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.
## NUKE:
Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke.
## SAMPLE REPORT:
```
https://gist.github.com/1N3/8214ec2da2c91691bcbc
```
## CHANGELOG:
* v1.6 - Added 4 new modes including: stealth, port, airstrike and nuke
* v1.6 - Added Java de-serialization scanner
* v1.6 - Added reporting option to output to console and text file for all scans
* v1.6 - Added option to set Sn1per full path for universal command line access
* v1.6 - Added in DirBuster for web file brute forcing
* v1.6 - Fixed issue with sderr errors in TheHarvester
* v1.5e - Removed shodan command line tool due to issues
* v1.5e - Fixed wafwoof installation in kali 2.0
* v1.5d - Fixed minor issues with port 513/tmp and 514/tcp checks
@ -63,8 +93,5 @@ https://gist.github.com/1N3/8214ec2da2c91691bcbc
* v1.4 - Removed debug output from goohak from displaying on console
## FUTURE:
* Add in detection and auto exploitation for Tomcat, JBoss, PHPMyAdmin
* Add in Juniper backdoor password to password list
* Add auth bypass string to password list
* Add in OpenVAS integration
* Look into HTML reporting or text based output options to save scan data

4
install.sh
View File

@ -24,7 +24,7 @@ echo -e "$OKGREEN + -- --=[This script will install or upgrade your Sn1per insta
read answer
echo -e "$OKORANGE + -- --=[Installing package dependencies...$RESET"
apt-get install waffit host whois arachni theHarvester dnsenum dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap
apt-get install unicornscan waffit host whois arachni theHarvester dnsenum dirb dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap
echo -e "$OKORANGE + -- --=[Installing gem dependencies...$RESET"
gem install rake
@ -42,6 +42,7 @@ git clone https://github.com/1N3/MassBleed.git
git clone https://github.com/1N3/SuperMicro-Password-Scanner
git clone https://github.com/Dionach/CMSmap.git
git clone https://github.com/0xsauby/yasuo.git
git clone https://github.com/johndekroon/serializekiller.git
echo -e "$OKORANGE + -- --=[Setting up environment...$RESET"
mkdir loot 2> /dev/null
@ -69,6 +70,7 @@ ln -s $DIR/Findsploit/compilesploit /usr/bin/compilesploit
ln -s $DIR/MassBleed/massbleed /usr/bin/massbleed
ln -s $DIR/BruteX/brutex /usr/bin/brutex
echo -e "$OKORANGE + -- --=[For universal sniper access, be sure to edit sniper to include the full path for the SNIPER_DIR variable. $RESET"
echo -e "$OKORANGE + -- --=[Done!$RESET"
# REMOVED BUT STILL AVAILABLE IF NEEDED

42
loot/README.md
View File

@ -13,6 +13,7 @@ Sn1per is an automated scanner that can be used during a penetration test to enu
* Automatically runs targeted Metasploit scan and exploit modules
* Automatically scans all web applications for common vulnerabilities
* Automatically brute forces all open services
* Performs high level enumeration of multiple hosts
## INSTALL:
```
@ -21,15 +22,51 @@ Sn1per is an automated scanner that can be used during a penetration test to enu
## USAGE:
```
./sn1per <target>
# ./sniper <target> report
# ./sniper <target> stealth <report>
# ./sniper <target> port <portnum>
# ./sniper <target> nobrute <report>
# ./sniper <targets.txt> airstrike <report>
# ./sniper <targets.txt> nuke <report>
```
## REPORT MODE:
Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command.
## STEALTH MODE:
Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking
## PORT MODE:
Scans a specific port for vulnerabilities. Reporting is not currently available in this mode.
## NOBRUTE MODE:
Launches a full scan against a target host/domain without brute forcing services.
## AIRSTRIKE:
Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IP's that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.
## NUKE:
Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke.
## SAMPLE REPORT:
```
https://gist.github.com/1N3/8214ec2da2c91691bcbc
```
## CHANGELOG:
* v1.6 - Added 4 new modes including: stealth, port, airstrike and nuke
* v1.6 - Added Java de-serialization scanner
* v1.6 - Added reporting option to output to console and text file for all scans
* v1.6 - Added option to set Sn1per full path for universal command line access
* v1.6 - Added in DirBuster for web file brute forcing
* v1.6 - Fixed issue with sderr errors in TheHarvester
* v1.5e - Removed shodan command line tool due to issues
* v1.5e - Fixed wafwoof installation in kali 2.0
* v1.5d - Fixed minor issues with port 513/tmp and 514/tcp checks
* v1.5c - Fixed issue which broke link to sniper directory
* v1.5b - Added Squid Proxy checks port 3128/tcp
* v1.5b - Fixed shodan setup options in install.sh
* v1.5b - Fixed syntax error with theHarvester in install.sh
* v1.5a - Fixed syntax error with port 8081 checks
* v1.5a - Added Arachni integration
* v1.5a - Added vsftpd, proftpd, mysql, unrealircd auto exploits
@ -56,8 +93,5 @@ https://gist.github.com/1N3/8214ec2da2c91691bcbc
* v1.4 - Removed debug output from goohak from displaying on console
## FUTURE:
* Add in detection and auto exploitation for Tomcat, JBoss, PHPMyAdmin
* Add in Juniper backdoor password to password list
* Add auth bypass string to password list
* Add in OpenVAS integration
* Look into HTML reporting or text based output options to save scan data

214
sniper
View File

@ -1,5 +1,5 @@
#!/bin/bash
# + -- --=[Sn1per v1.5 by 1N3
# + -- --=[Sn1per v1.6 by 1N3
# + -- --=[http://crowdshield.com
#
# Sn1per - Automated Pentest Recon Tool
@ -13,15 +13,25 @@
# - Automatically scans all web applications
# - Automatically brute forces all open services
# - Automatically runs targeted metasploit scan and exploit modules
# - Automatically scan multiple hosts
#
# INSTALL:
# ./install.sh - Installs all dependencies. Best run from Kali Linux.
#
# USAGE:
# ./sn1per <target>
# ./sniper <target>
# ./sniper <target> stealth <report>
# ./sniper <target> port <portnum>
# ./sniper <target> nobrute <report>
# ./sniper <targets.txt> airstrike <report>
# ./sniper <targets.txt> nuke <report>
#
# UNCOMMENT AND SET TARGET DIR FOR UNIVERSAL ACCESS (ie. sniper <target>)
# cd /pentest/web/Sn1per/
TARGET="$1"
MODE="$2"
OPT1="$3"
LOOT_DIR="loot"
CMSMAP="CMSmap/cmsmap.py"
SAMRDUMP="bin/samrdump.py"
@ -47,11 +57,161 @@ if [ -z $TARGET ]; then
echo -e "$OKRED /_/ $RESET"
echo -e "$RESET"
echo -e "$OKORANGE + -- --=[http://crowdshield.com"
echo -e "$OKORANGE + -- --=[sn1per v1.5 by 1N3"
echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3"
echo -e "$OKORANGE + -- --=[Usage: sn1per <target>"
exit
fi
if [ "$MODE" = "report" ]; then
./sniper $TARGET $MODE | tee ./loot/sniper-$TARGET-`date +%Y%m%d%H%M`.txt 2>&1
exit
fi
if [ "$MODE" = "stealth" ]; then
if [ "$OPT1" = "report" ]; then
./sniper $TARGET $MODE | tee ./loot/sniper-$MODE-`date +%Y%m%d%H%M`.txt 2>&1
exit
fi
echo -e "$OKRED ____ $RESET"
echo -e "$OKRED _________ / _/___ ___ _____$RESET"
echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET"
echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET"
echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET"
echo -e "$OKRED /_/ $RESET"
echo -e "$RESET"
echo -e "$OKORANGE + -- --=[http://crowdshield.com"
echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3"
echo -e "$OKRED "
echo -e "$OKRED ./\."
echo -e "$OKRED ./ '\."
echo -e "$OKRED \. '\."
echo -e "$OKRED '\. '\."
echo -e "$OKRED '\. '\."
echo -e "$OKRED '\. '\."
echo -e "$OKRED ./ '\."
echo -e "$OKRED ./ ____'\."
echo -e "$OKRED ./ < '\."
echo -e "$OKRED \-------\ '> '\."
echo -e "$OKRED '\=====> ___< '\."
echo -e "$OKRED ./-----/ __________'\."
echo -e "$OKRED "' \.------\ _____ ___(_)(_\."\'
echo -e "$OKRED '\=====> < ./'"
echo -e "$OKRED ./-----/ '> ./"
echo -e "$OKRED \. ___< ./"
echo -e "$OKRED '\. ./"
echo -e "$OKRED '\. ./"
echo -e "$OKRED '\. ./"
echo -e "$OKRED ./ ./"
echo -e "$OKRED ./ ./ Carl Pilcher"
echo -e "$OKRED ./ ./"
echo -e "$OKRED ./ ./"
echo -e "$OKRED ./ ./"
echo -e "$OKRED \. ./"
echo -e "$OKRED '\. ./"
echo -e "$OKRED '\/"
echo -e "$RESET"
echo -e "$OKGREEN + -- --=[Launching stealth scan: $TARGET $RESET"
echo -e "$OKGREEN $RESET"
unicornscan $TARGET 2> /dev/null
wafw00f http://$TARGET
whatweb http://$TARGET
xsstracer $TARGET 80
sslscan --no-failed $TARGET
exit
fi
if [ "$MODE" = "airstrike" ]; then
if [ "$OPT1" = "report" ]; then
./sniper $TARGET $MODE | tee ./loot/sniper-$MODE-`date +%Y%m%d%H%M`.txt 2>&1
exit
fi
echo -e "$OKRED ____ $RESET"
echo -e "$OKRED _________ / _/___ ___ _____$RESET"
echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET"
echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET"
echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET"
echo -e "$OKRED /_/ $RESET"
echo -e "$RESET"
echo -e "$OKORANGE + -- --=[http://crowdshield.com"
echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3"
echo -e "$OKRED |"
echo -e "$OKRED | |"
echo -e "$OKRED | -/_\-"
echo -e "$OKRED -/_\- ______________(/ . \)______________"
echo -e "$OKRED ____________(/ . \)_____________ \___/ <>"
echo -e "$OKRED <> \___/ <> <>"
echo -e "$OKRED "
echo -e "$OKRED ||"
echo -e "$OKRED <>"
echo -e "$OKRED ||"
echo -e "$OKRED <>"
echo -e "$OKRED ||"
echo -e "$OKRED || BIG"
echo -e "$OKRED _____ __ <> (^)))^ BOOM!"
echo -e "$OKRED BOOM!/(( )\ BOOM!(( ))) ( ( )"
echo -e "$OKRED ---- (__()__)) (() ) )) ( ( ( )"
echo -e "$OKRED || |||____|------ \ (/ ___ (__\ /__)"
echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||"
echo -e "$OKRED | ||. | | | ||| |||||"
echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||"
echo -e "$OKRED | ||. | | | ||| |||||"
echo -e "$OKRED __________________________________________________________"
echo -e "$OKRED Bomb raid (contributed by Michael aka SNOOPY@DRYCAS.CLUB.CC.CMU.EDU)"
echo -e "$RESET"
for a in `cat $TARGET`;
do
echo -e "$OKGREEN + -- --=[Launching airstrike: $a $RESET"
unicornscan $a 2> /dev/null
wafw00f http://$a
whatweb http://$a
xsstracer $a 80
sslscan --no-failed $a
done;
exit
fi
if [ "$MODE" = "port" ]; then
echo -e "$OKRED ____ $RESET"
echo -e "$OKRED _________ / _/___ ___ _____$RESET"
echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET"
echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET"
echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET"
echo -e "$OKRED /_/ $RESET"
echo -e "$RESET"
echo -e "$OKORANGE + -- --=[http://crowdshield.com"
echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3"
echo -e "$RESET"
if [ -z "$OPT1" ]; then
echo -e "$OKRED + -- --=[Error: You need to enter a port number. $RESET"
exit
fi
fi
if [ "$MODE" = "nuke" ]; then
if [ "$OPT1" = "report" ]; then
./sniper $TARGET $MODE | tee ./loot/sniper-$MODE-`date +%Y%m%d%H%M`.txt 2>&1
exit
fi
for a in `cat $TARGET`; do
echo -e "$OKRED "
echo -e "$OKRED ____"
echo -e "$OKRED __,-~~/~ \`---."
echo -e "$OKRED _/_,---( , )"
echo -e "$OKRED __ / < / ) \___"
echo -e "$OKRED - ------===;;;'====------------------===;;;===----- - -"
echo -e "$OKRED \/ ~'~'~'~'~'~\~'~)~'/"
echo -e "$OKRED (_ ( \ ( > \)"
echo -e "$OKRED \_( _ < >_>'"
echo -e "$OKRED ~ \`-i' ::>|--\""
echo -e "$OKRED I;|.|.|"
echo -e "$OKRED <|i::|i|\`."
echo -e "$OKRED (\` ^''\`-' ')"
echo -e "$OKRED --------------------------------------------------------- $RESET"
echo -e "$OKGREEN + -- --=[WARNING! Nuking ALL target! $RESET"
./sniper $a
done
fi
REGEX='^[0-9]+$'
if [[ ${TARGET:0:1} =~ $REGEX ]];
then
@ -72,7 +232,7 @@ echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET"
echo -e "$OKRED /_/ $RESET"
echo -e "$RESET"
echo -e "$OKORANGE + -- --=[http://crowdshield.com"
echo -e "$OKORANGE + -- --=[sn1per v1.5 by 1N3"
echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3"
echo -e "$RESET"
echo -e "$OKGREEN################################### Running recon #################################$RESET"
nslookup $TARGET
@ -81,10 +241,10 @@ if [ $SCAN_TYPE == "DOMAIN" ];
then
dig -x $TARGET
whois $TARGET
theharvester -d $TARGET -b google
theharvester -d $TARGET -b bing
theharvester -d $TARGET -b linkedin
theharvester -d $TARGET -b people123
theharvester -d $TARGET -b google 2> /dev/null
theharvester -d $TARGET -b bing 2> /dev/null
theharvester -d $TARGET -b linkedin 2> /dev/null
theharvester -d $TARGET -b people123 2> /dev/null
dnsrecon -d $TARGET
dnsrecon -d $TARGET -t zonewalk
dnsrecon -d quora.com -t axfr
@ -96,8 +256,13 @@ echo -e "$OKGREEN################################### Pinging host ##############
ping -c 1 $TARGET
echo ""
echo -e "$OKGREEN################################### Running port scan ##############################$RESET"
nmap -sS -sV -T4 -A -O -p 1-65535 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml
nmap -sU -sV -T4 -A -O -p U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 --open $TARGET
if [ -z "$OPT1" ]; then
nmap -sS -sV -T4 -A -O -p 1-65535 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml
nmap -sU -sV -T4 -A -O -p U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 --open $TARGET
else
nmap -sS -sV -T4 -A -O -p $OPT1 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml
nmap -sU -sV -T4 -A -O -p U:$OPT1 --open $TARGET
fi
echo ""
echo -e "$OKGREEN################################### Running Intrusive Scans ########################$RESET"
port_21=`grep 'portid="21"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
@ -265,6 +430,7 @@ else
echo -e "$RESET"
nikto -h http://$TARGET
dirb http://$TARGET
wpscan --url http://$TARGET --batch
python $CMSMAP -t http://$TARGET
arachni http://$TARGET --output-only-positives --scope-include-subdomains
@ -399,6 +565,7 @@ else
echo ""
echo -e "$RESET"
nikto -h https://$TARGET
dirb http://$TARGET
wpscan --url https://$TARGET --batch
python $CMSMAP -t https://$TARGET
arachni https://$TARGET --output-only-positives --scope-include-subdomains
@ -648,15 +815,22 @@ else
$SUPER_MICRO_SCAN $TARGET
fi
echo -e "$OKGREEN################################### Running Brute Force #############################$RESET"
cd yasuo
ruby yasuo.rb -r $TARGET -b all
cd ../BruteX
./brutex $TARGET
rm -f hydra.restore
mv loot/* ../loot/
cd ..
echo ""
rm -f scan.log
echo -e "$OKGREEN################################### Launching 3rd Party Modules ########################$RESET"
python serializekiller/serializekiller.py --url $TARGET
if [ "$MODE" = "nobrute" ]; then
echo -e "$OKGREEN################################### Skipping Brute Force ############################$RESET"
else
echo -e "$OKGREEN################################### Running Brute Force #############################$RESET"
cd yasuo
ruby yasuo.rb -r $TARGET -b all
cd ../BruteX
./brutex $TARGET
rm -f hydra.restore
mv loot/* ../loot/
cd ..
echo ""
rm -f scan.log
fi
echo -e "$OKGREEN################################### Done! ###########################################$RESET"
exit 0