diff --git a/README.md b/README.md index 4b716ee..21f3d5e 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,7 @@ Sn1per is an automated scanner that can be used during a penetration test to enu * Automatically runs targeted Metasploit scan and exploit modules * Automatically scans all web applications for common vulnerabilities * Automatically brute forces all open services +* Performs high level enumeration of multiple hosts ## INSTALL: ``` @@ -21,15 +22,44 @@ Sn1per is an automated scanner that can be used during a penetration test to enu ## USAGE: ``` -./sn1per +# ./sniper report +# ./sniper stealth +# ./sniper port +# ./sniper nobrute +# ./sniper airstrike +# ./sniper nuke ``` +## REPORT MODE: +Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command. + +## STEALTH MODE: +Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking + +## PORT MODE: +Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. + +## NOBRUTE MODE: +Launches a full scan against a target host/domain without brute forcing services. + +## AIRSTRIKE: +Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IP's that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning. + +## NUKE: +Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke. + ## SAMPLE REPORT: ``` https://gist.github.com/1N3/8214ec2da2c91691bcbc ``` ## CHANGELOG: +* v1.6 - Added 4 new modes including: stealth, port, airstrike and nuke +* v1.6 - Added Java de-serialization scanner +* v1.6 - Added reporting option to output to console and text file for all scans +* v1.6 - Added option to set Sn1per full path for universal command line access +* v1.6 - Added in DirBuster for web file brute forcing +* v1.6 - Fixed issue with sderr errors in TheHarvester * v1.5e - Removed shodan command line tool due to issues * v1.5e - Fixed wafwoof installation in kali 2.0 * v1.5d - Fixed minor issues with port 513/tmp and 514/tcp checks @@ -63,8 +93,5 @@ https://gist.github.com/1N3/8214ec2da2c91691bcbc * v1.4 - Removed debug output from goohak from displaying on console ## FUTURE: -* Add in detection and auto exploitation for Tomcat, JBoss, PHPMyAdmin -* Add in Juniper backdoor password to password list -* Add auth bypass string to password list * Add in OpenVAS integration * Look into HTML reporting or text based output options to save scan data diff --git a/install.sh b/install.sh index 596e586..552ba62 100644 --- a/install.sh +++ b/install.sh @@ -24,7 +24,7 @@ echo -e "$OKGREEN + -- --=[This script will install or upgrade your Sn1per insta read answer echo -e "$OKORANGE + -- --=[Installing package dependencies...$RESET" -apt-get install waffit host whois arachni theHarvester dnsenum dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap +apt-get install unicornscan waffit host whois arachni theHarvester dnsenum dirb dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap echo -e "$OKORANGE + -- --=[Installing gem dependencies...$RESET" gem install rake @@ -42,6 +42,7 @@ git clone https://github.com/1N3/MassBleed.git git clone https://github.com/1N3/SuperMicro-Password-Scanner git clone https://github.com/Dionach/CMSmap.git git clone https://github.com/0xsauby/yasuo.git +git clone https://github.com/johndekroon/serializekiller.git echo -e "$OKORANGE + -- --=[Setting up environment...$RESET" mkdir loot 2> /dev/null @@ -69,6 +70,7 @@ ln -s $DIR/Findsploit/compilesploit /usr/bin/compilesploit ln -s $DIR/MassBleed/massbleed /usr/bin/massbleed ln -s $DIR/BruteX/brutex /usr/bin/brutex +echo -e "$OKORANGE + -- --=[For universal sniper access, be sure to edit sniper to include the full path for the SNIPER_DIR variable. $RESET" echo -e "$OKORANGE + -- --=[Done!$RESET" # REMOVED BUT STILL AVAILABLE IF NEEDED diff --git a/loot/README.md b/loot/README.md index e63ff0f..21f3d5e 100644 --- a/loot/README.md +++ b/loot/README.md @@ -13,6 +13,7 @@ Sn1per is an automated scanner that can be used during a penetration test to enu * Automatically runs targeted Metasploit scan and exploit modules * Automatically scans all web applications for common vulnerabilities * Automatically brute forces all open services +* Performs high level enumeration of multiple hosts ## INSTALL: ``` @@ -21,15 +22,51 @@ Sn1per is an automated scanner that can be used during a penetration test to enu ## USAGE: ``` -./sn1per +# ./sniper report +# ./sniper stealth +# ./sniper port +# ./sniper nobrute +# ./sniper airstrike +# ./sniper nuke ``` +## REPORT MODE: +Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command. + +## STEALTH MODE: +Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking + +## PORT MODE: +Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. + +## NOBRUTE MODE: +Launches a full scan against a target host/domain without brute forcing services. + +## AIRSTRIKE: +Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IP's that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning. + +## NUKE: +Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke. + ## SAMPLE REPORT: ``` https://gist.github.com/1N3/8214ec2da2c91691bcbc ``` ## CHANGELOG: +* v1.6 - Added 4 new modes including: stealth, port, airstrike and nuke +* v1.6 - Added Java de-serialization scanner +* v1.6 - Added reporting option to output to console and text file for all scans +* v1.6 - Added option to set Sn1per full path for universal command line access +* v1.6 - Added in DirBuster for web file brute forcing +* v1.6 - Fixed issue with sderr errors in TheHarvester +* v1.5e - Removed shodan command line tool due to issues +* v1.5e - Fixed wafwoof installation in kali 2.0 +* v1.5d - Fixed minor issues with port 513/tmp and 514/tcp checks +* v1.5c - Fixed issue which broke link to sniper directory +* v1.5b - Added Squid Proxy checks port 3128/tcp +* v1.5b - Fixed shodan setup options in install.sh +* v1.5b - Fixed syntax error with theHarvester in install.sh * v1.5a - Fixed syntax error with port 8081 checks * v1.5a - Added Arachni integration * v1.5a - Added vsftpd, proftpd, mysql, unrealircd auto exploits @@ -56,8 +93,5 @@ https://gist.github.com/1N3/8214ec2da2c91691bcbc * v1.4 - Removed debug output from goohak from displaying on console ## FUTURE: -* Add in detection and auto exploitation for Tomcat, JBoss, PHPMyAdmin -* Add in Juniper backdoor password to password list -* Add auth bypass string to password list * Add in OpenVAS integration * Look into HTML reporting or text based output options to save scan data diff --git a/sniper b/sniper index 5bd8ab2..904b95a 100644 --- a/sniper +++ b/sniper @@ -1,5 +1,5 @@ #!/bin/bash -# + -- --=[Sn1per v1.5 by 1N3 +# + -- --=[Sn1per v1.6 by 1N3 # + -- --=[http://crowdshield.com # # Sn1per - Automated Pentest Recon Tool @@ -13,15 +13,25 @@ # - Automatically scans all web applications # - Automatically brute forces all open services # - Automatically runs targeted metasploit scan and exploit modules +# - Automatically scan multiple hosts # # INSTALL: # ./install.sh - Installs all dependencies. Best run from Kali Linux. # # USAGE: -# ./sn1per +# ./sniper +# ./sniper stealth +# ./sniper port +# ./sniper nobrute +# ./sniper airstrike +# ./sniper nuke # +# UNCOMMENT AND SET TARGET DIR FOR UNIVERSAL ACCESS (ie. sniper ) +# cd /pentest/web/Sn1per/ TARGET="$1" +MODE="$2" +OPT1="$3" LOOT_DIR="loot" CMSMAP="CMSmap/cmsmap.py" SAMRDUMP="bin/samrdump.py" @@ -47,11 +57,161 @@ if [ -z $TARGET ]; then echo -e "$OKRED /_/ $RESET" echo -e "$RESET" echo -e "$OKORANGE + -- --=[http://crowdshield.com" - echo -e "$OKORANGE + -- --=[sn1per v1.5 by 1N3" + echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3" echo -e "$OKORANGE + -- --=[Usage: sn1per " exit fi +if [ "$MODE" = "report" ]; then + ./sniper $TARGET $MODE | tee ./loot/sniper-$TARGET-`date +%Y%m%d%H%M`.txt 2>&1 + exit +fi + +if [ "$MODE" = "stealth" ]; then + if [ "$OPT1" = "report" ]; then + ./sniper $TARGET $MODE | tee ./loot/sniper-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + exit + fi + echo -e "$OKRED ____ $RESET" + echo -e "$OKRED _________ / _/___ ___ _____$RESET" + echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" + echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" + echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" + echo -e "$OKRED /_/ $RESET" + echo -e "$RESET" + echo -e "$OKORANGE + -- --=[http://crowdshield.com" + echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3" + echo -e "$OKRED " + echo -e "$OKRED ./\." + echo -e "$OKRED ./ '\." + echo -e "$OKRED \. '\." + echo -e "$OKRED '\. '\." + echo -e "$OKRED '\. '\." + echo -e "$OKRED '\. '\." + echo -e "$OKRED ./ '\." + echo -e "$OKRED ./ ____'\." + echo -e "$OKRED ./ < '\." + echo -e "$OKRED \-------\ '> '\." + echo -e "$OKRED '\=====> ___< '\." + echo -e "$OKRED ./-----/ __________'\." + echo -e "$OKRED "' \.------\ _____ ___(_)(_\."\' + echo -e "$OKRED '\=====> < ./'" + echo -e "$OKRED ./-----/ '> ./" + echo -e "$OKRED \. ___< ./" + echo -e "$OKRED '\. ./" + echo -e "$OKRED '\. ./" + echo -e "$OKRED '\. ./" + echo -e "$OKRED ./ ./" + echo -e "$OKRED ./ ./ Carl Pilcher" + echo -e "$OKRED ./ ./" + echo -e "$OKRED ./ ./" + echo -e "$OKRED ./ ./" + echo -e "$OKRED \. ./" + echo -e "$OKRED '\. ./" + echo -e "$OKRED '\/" + echo -e "$RESET" + echo -e "$OKGREEN + -- --=[Launching stealth scan: $TARGET $RESET" + echo -e "$OKGREEN $RESET" + unicornscan $TARGET 2> /dev/null + wafw00f http://$TARGET + whatweb http://$TARGET + xsstracer $TARGET 80 + sslscan --no-failed $TARGET + exit +fi + +if [ "$MODE" = "airstrike" ]; then + if [ "$OPT1" = "report" ]; then + ./sniper $TARGET $MODE | tee ./loot/sniper-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + exit + fi + echo -e "$OKRED ____ $RESET" + echo -e "$OKRED _________ / _/___ ___ _____$RESET" + echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" + echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" + echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" + echo -e "$OKRED /_/ $RESET" + echo -e "$RESET" + echo -e "$OKORANGE + -- --=[http://crowdshield.com" + echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3" + echo -e "$OKRED |" + echo -e "$OKRED | |" + echo -e "$OKRED | -/_\-" + echo -e "$OKRED -/_\- ______________(/ . \)______________" + echo -e "$OKRED ____________(/ . \)_____________ \___/ <>" + echo -e "$OKRED <> \___/ <> <>" + echo -e "$OKRED " + echo -e "$OKRED ||" + echo -e "$OKRED <>" + echo -e "$OKRED ||" + echo -e "$OKRED <>" + echo -e "$OKRED ||" + echo -e "$OKRED || BIG" + echo -e "$OKRED _____ __ <> (^)))^ BOOM!" + echo -e "$OKRED BOOM!/(( )\ BOOM!(( ))) ( ( )" + echo -e "$OKRED ---- (__()__)) (() ) )) ( ( ( )" + echo -e "$OKRED || |||____|------ \ (/ ___ (__\ /__)" + echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||" + echo -e "$OKRED | ||. | | | ||| |||||" + echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||" + echo -e "$OKRED | ||. | | | ||| |||||" + echo -e "$OKRED __________________________________________________________" + echo -e "$OKRED Bomb raid (contributed by Michael aka SNOOPY@DRYCAS.CLUB.CC.CMU.EDU)" + echo -e "$RESET" + for a in `cat $TARGET`; + do + echo -e "$OKGREEN + -- --=[Launching airstrike: $a $RESET" + unicornscan $a 2> /dev/null + wafw00f http://$a + whatweb http://$a + xsstracer $a 80 + sslscan --no-failed $a + done; + exit +fi + +if [ "$MODE" = "port" ]; then + echo -e "$OKRED ____ $RESET" + echo -e "$OKRED _________ / _/___ ___ _____$RESET" + echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" + echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" + echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" + echo -e "$OKRED /_/ $RESET" + echo -e "$RESET" + echo -e "$OKORANGE + -- --=[http://crowdshield.com" + echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3" + echo -e "$RESET" + if [ -z "$OPT1" ]; then + echo -e "$OKRED + -- --=[Error: You need to enter a port number. $RESET" + exit + fi +fi + +if [ "$MODE" = "nuke" ]; then + if [ "$OPT1" = "report" ]; then + ./sniper $TARGET $MODE | tee ./loot/sniper-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + exit + fi + for a in `cat $TARGET`; do + echo -e "$OKRED " + echo -e "$OKRED ____" + echo -e "$OKRED __,-~~/~ \`---." + echo -e "$OKRED _/_,---( , )" + echo -e "$OKRED __ / < / ) \___" + echo -e "$OKRED - ------===;;;'====------------------===;;;===----- - -" + echo -e "$OKRED \/ ~'~'~'~'~'~\~'~)~'/" + echo -e "$OKRED (_ ( \ ( > \)" + echo -e "$OKRED \_( _ < >_>'" + echo -e "$OKRED ~ \`-i' ::>|--\"" + echo -e "$OKRED I;|.|.|" + echo -e "$OKRED <|i::|i|\`." + echo -e "$OKRED (\` ^''\`-' ')" + echo -e "$OKRED --------------------------------------------------------- $RESET" + echo -e "$OKGREEN + -- --=[WARNING! Nuking ALL target! $RESET" + ./sniper $a + done +fi + REGEX='^[0-9]+$' if [[ ${TARGET:0:1} =~ $REGEX ]]; then @@ -72,7 +232,7 @@ echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" echo -e "$OKRED /_/ $RESET" echo -e "$RESET" echo -e "$OKORANGE + -- --=[http://crowdshield.com" -echo -e "$OKORANGE + -- --=[sn1per v1.5 by 1N3" +echo -e "$OKORANGE + -- --=[sn1per v1.6 by 1N3" echo -e "$RESET" echo -e "$OKGREEN################################### Running recon #################################$RESET" nslookup $TARGET @@ -81,10 +241,10 @@ if [ $SCAN_TYPE == "DOMAIN" ]; then dig -x $TARGET whois $TARGET - theharvester -d $TARGET -b google - theharvester -d $TARGET -b bing - theharvester -d $TARGET -b linkedin - theharvester -d $TARGET -b people123 + theharvester -d $TARGET -b google 2> /dev/null + theharvester -d $TARGET -b bing 2> /dev/null + theharvester -d $TARGET -b linkedin 2> /dev/null + theharvester -d $TARGET -b people123 2> /dev/null dnsrecon -d $TARGET dnsrecon -d $TARGET -t zonewalk dnsrecon -d quora.com -t axfr @@ -96,8 +256,13 @@ echo -e "$OKGREEN################################### Pinging host ############## ping -c 1 $TARGET echo "" echo -e "$OKGREEN################################### Running port scan ##############################$RESET" -nmap -sS -sV -T4 -A -O -p 1-65535 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml -nmap -sU -sV -T4 -A -O -p U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 --open $TARGET +if [ -z "$OPT1" ]; then + nmap -sS -sV -T4 -A -O -p 1-65535 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml + nmap -sU -sV -T4 -A -O -p U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 --open $TARGET +else + nmap -sS -sV -T4 -A -O -p $OPT1 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml + nmap -sU -sV -T4 -A -O -p U:$OPT1 --open $TARGET +fi echo "" echo -e "$OKGREEN################################### Running Intrusive Scans ########################$RESET" port_21=`grep 'portid="21"' $LOOT_DIR/nmap-$TARGET.xml | grep open` @@ -265,6 +430,7 @@ else echo -e "$RESET" nikto -h http://$TARGET + dirb http://$TARGET wpscan --url http://$TARGET --batch python $CMSMAP -t http://$TARGET arachni http://$TARGET --output-only-positives --scope-include-subdomains @@ -399,6 +565,7 @@ else echo "" echo -e "$RESET" nikto -h https://$TARGET + dirb http://$TARGET wpscan --url https://$TARGET --batch python $CMSMAP -t https://$TARGET arachni https://$TARGET --output-only-positives --scope-include-subdomains @@ -648,15 +815,22 @@ else $SUPER_MICRO_SCAN $TARGET fi -echo -e "$OKGREEN################################### Running Brute Force #############################$RESET" -cd yasuo -ruby yasuo.rb -r $TARGET -b all -cd ../BruteX -./brutex $TARGET -rm -f hydra.restore -mv loot/* ../loot/ -cd .. -echo "" -rm -f scan.log +echo -e "$OKGREEN################################### Launching 3rd Party Modules ########################$RESET" +python serializekiller/serializekiller.py --url $TARGET + +if [ "$MODE" = "nobrute" ]; then + echo -e "$OKGREEN################################### Skipping Brute Force ############################$RESET" +else + echo -e "$OKGREEN################################### Running Brute Force #############################$RESET" + cd yasuo + ruby yasuo.rb -r $TARGET -b all + cd ../BruteX + ./brutex $TARGET + rm -f hydra.restore + mv loot/* ../loot/ + cd .. + echo "" + rm -f scan.log +fi echo -e "$OKGREEN################################### Done! ###########################################$RESET" exit 0