From 1dddc8686c7a43f9502b3163bd61ffde082b07a4 Mon Sep 17 00:00:00 2001 From: "@xer0dayz" <1n3@hushmail.com> Date: Wed, 1 Jul 2020 17:43:48 -0700 Subject: [PATCH] Merged several changes for v8.5 --- CHANGELOG.md | 7 ++ install.sh | 2 +- modes/airstrike.sh | 7 +- modes/bruteforce.sh | 5 ++ modes/flyover.sh | 19 ++++- modes/fullportonly.sh | 3 +- modes/javascript-analysis.sh | 12 ++- modes/massportscan.sh | 7 +- modes/massvulnscan.sh | 7 +- modes/massweb.sh | 7 +- modes/masswebscan.sh | 9 ++- modes/normal.sh | 38 +++++++--- modes/normal_webporthttp.sh | 13 +++- modes/normal_webporthttps.sh | 13 +++- modes/nuke.sh | 6 +- modes/osint_stage_2.sh | 48 ++++++------ modes/recon.sh | 4 +- modes/sc0pe-active-scan.sh | 10 ++- modes/sc0pe-passive-scan.sh | 19 ++++- modes/stealth.sh | 45 +++++------ modes/vulnscan.sh | 5 +- modes/webporthttp.sh | 26 ++++--- modes/webporthttps.sh | 26 ++++--- modes/webscan.sh | 12 ++- sniper | 75 ++++++++++--------- sniper.conf | 3 +- templates/active/Directory_Listing_Enabled.sh | 2 +- templates/active/Joomla_Version_Disclosure.sh | 2 +- templates/active/TeamQuest_Login_Found.sh | 2 +- .../active/Telerik_File_Upload_Web_UI.sh | 2 +- .../passive/Clear-text_Communications_HTTP.sh | 18 +++-- templates/passive/Clickjacking.sh | 31 ++++++-- .../passive/Insecure_SSL_TLS_Connection.sh | 18 +++-- ...Insecure_SSL_TLS_Connection_CN_Mismatch.sh | 19 +++-- 34 files changed, 321 insertions(+), 201 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ab9aa78..4036801 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,11 @@ ## CHANGELOG: +* v8.5 - Added sc0pe template to check for default credentials via BruteX +* v8.5 - Added fullportscans to all 'web' mode scans to ensure full port coverage +* v8.5 - Fixed issue with 2nd stage OSINT scans not running +* v8.5 - Added port values to sc0pe engine to define port numbers +* v8.5 - Fixed issue with LinkFinder not working +* v8.5 - Fixed issue with Javascript link parser +* v8.5 - Added phantomjs dependency to fix webscreenshots on Ubuntu * v8.5 - Added http-default-accounts NMap NSE to check for default web credentials * v8.5 - Fixed several issues with install.sh to resolve deps on Ubuntu and Kali 2020.2 * v8.5 - Removed larger wordlists to reduce install size of Sn1per diff --git a/install.sh b/install.sh index 6f3f1d6..8f345f8 100755 --- a/install.sh +++ b/install.sh @@ -66,7 +66,6 @@ if [[ $UBUNTU_CHECK == "DISTRIB_ID=Ubuntu" ]]; then curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > /tmp/msfinstall chmod 755 /tmp/msfinstall /tmp/msfinstall - fi echo -e "$OKBLUE[*]$RESET Installing package dependencies...$RESET" @@ -110,6 +109,7 @@ apt-get install -y xmlstarlet apt-get install -y net-tools apt-get install -y p7zip-full apt-get install -y jsbeautifier +apt-get install -y phantomjs apt-get install -y metasploit-framework 2> /dev/null pip3 install dnspython colorama tldextract urllib3 ipaddress requests diff --git a/modes/airstrike.sh b/modes/airstrike.sh index e99715c..03415d1 100644 --- a/modes/airstrike.sh +++ b/modes/airstrike.sh @@ -74,12 +74,13 @@ if [[ "$MODE" = "airstrike" ]]; then args="" done fi - if [[ "$LOOT" = "1" ]]; then - loot - fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + if [[ "$LOOT" = "1" ]]; then + loot + fi + exit fi diff --git a/modes/bruteforce.sh b/modes/bruteforce.sh index da7aece..45ab0f5 100644 --- a/modes/bruteforce.sh +++ b/modes/bruteforce.sh @@ -3,6 +3,8 @@ if [[ "$AUTOBRUTE" = "0" ]]; then echo -e "$OKRED SKIPPING BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" else + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-bruteforce.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -21,6 +23,9 @@ else echo "$CRACKED" > $LOOT_DIR/output/cracked-$TARGET.txt 2> /dev/null fi echo "" + mv $LOOT_DIR/scans/running-$TARGET-bruteforce.txt $LOOT_DIR/scans/finished-$TARGET-bruteforce.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + if [[ "$SLACK_NOTIFICATIONS_BRUTEFORCE" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/credentials/brutex-$TARGET.txt" fi diff --git a/modes/flyover.sh b/modes/flyover.sh index c42f2fd..7d4b808 100644 --- a/modes/flyover.sh +++ b/modes/flyover.sh @@ -49,6 +49,10 @@ if [[ "$MODE" = "flyover" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null touch $LOOT_DIR/scans/$TARGET-$MODE.txt 2> /dev/null echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + + echo "sniper -t $TARGET -m $MODE $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + echo -e "$OKRED=====================================================================================$RESET" echo -e "${OKBLUE}HOST:$RESET $TARGET" @@ -62,6 +66,9 @@ if [[ "$MODE" = "flyover" ]]; then curl --connect-timeout 5 -I -s -R --insecure http://$TARGET 2> /dev/null > $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null & curl --connect-timeout 5 -I -s -R --insecure https://$TARGET 2> /dev/null > $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null & + + curl --connect-timeout 5 -s -R -L --insecure http://$TARGET > $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null & + curl --connect-timeout 5 -s -R -L --insecure https://$TARGET > $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null & webtech -u http://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-http.txt 2> /dev/null & webtech -u https://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-https.txt 2> /dev/null & @@ -90,6 +97,11 @@ if [[ "$MODE" = "flyover" ]]; then fi echo "$TARGET" >> $LOOT_DIR/scans/updated.txt echo "$TARGET" >> $LOOT_DIR/domains/targets-all-presorted.txt + + mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt 2> /dev/null + RUNNING_TASKS=$(wc -l $LOOT_DIR/scans/tasks-running.txt 2> /dev/null) + i=$((i+1)) if [[ "$i" -gt "$FLYOVER_MAX_HOSTS" ]]; then i=1 @@ -137,13 +149,14 @@ if [[ "$MODE" = "flyover" ]]; then fi done echo -e "$OKRED=====================================================================================$RESET" - if [[ "$LOOT" = "1" ]]; then - loot - fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $FILE [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $FILE [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + if [[ "$LOOT" = "1" ]]; then + loot + fi + fi exit fi diff --git a/modes/fullportonly.sh b/modes/fullportonly.sh index 9c90b6e..51f0dc3 100644 --- a/modes/fullportonly.sh +++ b/modes/fullportonly.sh @@ -18,8 +18,8 @@ if [[ "$MODE" = "fullportonly" ]]; then fi args="$args --noreport -m fullportonly" echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-fullnmapscan.txt echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 exit fi @@ -65,6 +65,7 @@ if [[ "$MODE" = "fullportonly" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null) if [[ ${#HOST_UP} -ge 2 ]]; then diff --git a/modes/javascript-analysis.sh b/modes/javascript-analysis.sh index a89dc2a..c96c8e1 100644 --- a/modes/javascript-analysis.sh +++ b/modes/javascript-analysis.sh @@ -3,9 +3,10 @@ echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DOWNLOADING ALL JAVASCRIPT FILES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - for a in `grep "\.js" $LOOT_DIR/web/spider-$TARGET.txt | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; - for a in `grep "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -i 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; - for a in `grep "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -iv 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - https://$a" && FILENAME=$(echo "https://$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; + egrep --binary-files=text "\.js" /usr/share/sniper/loot/workspace/127.0.0.1/web/spider-127.0.0.1.txt | egrep -v '.json|.jsp' + for a in `egrep --binary-files=text "\.js" $LOOT_DIR/web/spider-$TARGET.txt | egrep -v '.json|.jsp' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; + for a in `egrep --binary-files=text "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -v '.json|.jsp' | egrep -i 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; + for a in `egrep --binary-files=text "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -v '.json|.jsp' | egrep -iv 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - https://$a" && FILENAME=$(echo "https://$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DISPLAYING ALL JAVASCRIPT COMMENTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -18,7 +19,7 @@ echo -e "$OKRED RUNNING LINKFINDER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cd $PLUGINS_DIR/LinkFinder/ - for a in `ls $LOOT_DIR/web/javascript/$TARGET/*.js 2> /dev/null`; do echo "Analyzing - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && python linkfinder.py -d -i $a -o cli | egrep -v "application\/|SSL error" > $LOOT_DIR/web/javascript-linkfinder-$TARGET-$FILENAME.txt 2> /dev/null; done; + for a in `ls $LOOT_DIR/web/javascript/$TARGET/*.js 2> /dev/null`; do echo "Analyzing - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && python3 linkfinder.py -d -i $a -o cli 2> /dev/null | egrep -v "application\/|SSL error" > $LOOT_DIR/web/javascript-linkfinder-$TARGET-$FILENAME.txt 2> /dev/null; done; echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DISPLAYING PATH RELATIVE LINKS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -33,6 +34,3 @@ echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" grep -h http $LOOT_DIR/web/javascript-linkfinder-$TARGET-*.txt 2> /dev/null | grep -v "Running " | awk '{print $1}' | egrep "http\:\/\/|https\:\/\/" | cut -d\/ -f3 | sort -u | tee $LOOT_DIR/web/javascript-$TARGET-domains.txt WEB_JAVASCRIPT_ANALYSIS="0" - - - diff --git a/modes/massportscan.sh b/modes/massportscan.sh index 3379b00..65872d2 100644 --- a/modes/massportscan.sh +++ b/modes/massportscan.sh @@ -62,12 +62,13 @@ if [[ "$MODE" = "massportscan" ]]; then args="" done fi - if [[ "$LOOT" = "1" ]]; then - loot - fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + if [[ "$LOOT" = "1" ]]; then + loot + fi + exit fi diff --git a/modes/massvulnscan.sh b/modes/massvulnscan.sh index e496da1..b8ce722 100644 --- a/modes/massvulnscan.sh +++ b/modes/massvulnscan.sh @@ -62,12 +62,13 @@ if [[ "$MODE" = "massvulnscan" ]]; then args="" done fi - if [[ "$LOOT" = "1" ]]; then - loot - fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + if [[ "$LOOT" = "1" ]]; then + loot + fi + exit fi diff --git a/modes/massweb.sh b/modes/massweb.sh index 5f5df61..5bcb873 100644 --- a/modes/massweb.sh +++ b/modes/massweb.sh @@ -62,12 +62,13 @@ if [[ "$MODE" = "massweb" ]]; then args="" done fi - if [[ "$LOOT" = "1" ]]; then - loot - fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + if [[ "$LOOT" = "1" ]]; then + loot + fi + exit fi diff --git a/modes/masswebscan.sh b/modes/masswebscan.sh index 70b571c..c0dad1c 100644 --- a/modes/masswebscan.sh +++ b/modes/masswebscan.sh @@ -62,12 +62,15 @@ if [[ "$MODE" = "masswebscan" ]]; then args="" done fi - if [[ "$LOOT" = "1" ]]; then - loot - fi + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + + if [[ "$LOOT" = "1" ]]; then + loot + fi + exit fi diff --git a/modes/normal.sh b/modes/normal.sh index 195921d..93aa157 100644 --- a/modes/normal.sh +++ b/modes/normal.sh @@ -23,14 +23,6 @@ if [[ "$REPORT" = "1" ]]; then args="$args -w $WORKSPACE" fi args="$args --noreport" - - echo "$TARGET normal `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-normal.txt 2> /dev/null - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-normal.txt 2> /dev/null - if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" - echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt - fi sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-`date +"%Y%m%d%H%M"`.txt 2>&1 exit fi @@ -52,6 +44,27 @@ fi echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + + + + +echo "$TARGET normal `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null +echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-normal.txt 2> /dev/null +echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-normal.txt 2> /dev/null +ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + + + +if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt +fi + + + + + + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -468,7 +481,7 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -Pn -p 80 -sV -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-bigip-cookie,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-jsonp-detection,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-trane-info,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port80 + nmap -Pn -p 80 -sV -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners,http-default-accounts --script-args http-default-accounts.fingerprintfile=/usr/share/sniper/bin/http-default-accounts-fingerprints-nndefaccts.lua $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port80 sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port80.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port80 2> /dev/null fi @@ -484,7 +497,7 @@ else fi if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR - python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:80 + python2 $INSTALL_DIR/bin/webscreenshot.py http://$TARGET:80 fi source $INSTALL_DIR/modes/normal_webporthttp.sh source $INSTALL_DIR/modes/osint_stage_2.sh @@ -764,7 +777,7 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -p 443 -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-bigip-cookie,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-jsonp-detection,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-trane-info,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port443 + nmap -sV -Pn -p 443 -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners,http-default-accounts --script-args http-default-accounts.fingerprintfile=/usr/share/sniper/bin/http-default-accounts-fingerprints-nndefaccts.lua $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port443 sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port443.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port443 2> /dev/null fi @@ -808,7 +821,7 @@ else if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR - python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:443 + python2 $INSTALL_DIR/bin/webscreenshot.py https://$TARGET:443 fi source $INSTALL_DIR/modes/normal_webporthttps.sh source $INSTALL_DIR/modes/osint_stage_2.sh @@ -1453,6 +1466,7 @@ echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt mv $LOOT_DIR/scans/running-$TARGET-normal.txt $LOOT_DIR/scans/finished-$TARGET-normal.txt 2> /dev/null +ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt diff --git a/modes/normal_webporthttp.sh b/modes/normal_webporthttp.sh index fb6204a..0701501 100644 --- a/modes/normal_webporthttp.sh +++ b/modes/normal_webporthttp.sh @@ -1,4 +1,7 @@ if [[ "$MODE" = "web" ]]; then + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt @@ -58,7 +61,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,500,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_COMMON -x $WEB_BRUTE_EXCLUDE_CODES -F -e $WEB_BRUTE_EXTENSIONS -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-common.txt @@ -69,7 +72,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_FULL -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_FULL -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-full.txt @@ -80,7 +83,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/webbrute-$TARGET-https-exploits.txt @@ -147,6 +150,10 @@ if [[ "$MODE" = "web" ]]; then rm -f $LOOT_DIR/web/jexboss-$TARGET-port80.raw 2> /dev/null cd $INSTALL_DIR fi + + mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt diff --git a/modes/normal_webporthttps.sh b/modes/normal_webporthttps.sh index bd93143..d224fa1 100644 --- a/modes/normal_webporthttps.sh +++ b/modes/normal_webporthttps.sh @@ -1,4 +1,7 @@ if [[ "$MODE" = "web" ]]; then + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt @@ -58,7 +61,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,500,502,503,504 -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_COMMON -x $WEB_BRUTE_EXCLUDE_CODES -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-common.txt @@ -69,7 +72,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_FULL -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_FULL -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-full.txt @@ -80,7 +83,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-exploits.txt @@ -146,6 +149,10 @@ if [[ "$MODE" = "web" ]]; then rm -f $LOOT_DIR/web/jexboss-$TARGET-port443.raw 2> /dev/null cd $INSTALL_DIR fi + + mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt diff --git a/modes/nuke.sh b/modes/nuke.sh index 40e9535..7cea809 100644 --- a/modes/nuke.sh +++ b/modes/nuke.sh @@ -57,12 +57,12 @@ if [[ "$MODE" = "nuke" ]]; then args="" done fi - if [[ "$LOOT" = "1" ]]; then - loot - fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + if [[ "$LOOT" = "1" ]]; then + loot + fi exit fi \ No newline at end of file diff --git a/modes/osint_stage_2.sh b/modes/osint_stage_2.sh index 288a9aa..7ce1dbe 100644 --- a/modes/osint_stage_2.sh +++ b/modes/osint_stage_2.sh @@ -1,32 +1,26 @@ if [[ $SCAN_TYPE == "DOMAIN" ]] && [[ $OSINT == "1" ]]; then - if [[ $OSINT == "0" ]]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + fi + if [[ $GOOHAK = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED SKIPPING OSINT $RESET" + echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - else - if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" - echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt - fi - if [[ $GOOHAK = "1" ]]; then - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - goohak $TARGET > /dev/null - fi - if [[ $INURLBR = "1" ]]; then - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - php /usr/share/sniper/bin/inurlbr.php --dork "site:$TARGET" -s inurlbr-$TARGET | tee $LOOT_DIR/osint/inurlbr-$TARGET - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/osint/inurlbr-$TARGET > $LOOT_DIR/osint/inurlbr-$TARGET.txt 2> /dev/null - rm -f $LOOT_DIR/osint/inurlbr-$TARGET - rm -Rf output/ cookie.txt exploits.conf - fi - GHDB="1" - if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" - echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt - fi + goohak $TARGET > /dev/null + fi + if [[ $INURLBR = "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + php /usr/share/sniper/bin/inurlbr.php --dork "site:$TARGET" -s inurlbr-$TARGET | tee $LOOT_DIR/osint/inurlbr-$TARGET + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/osint/inurlbr-$TARGET > $LOOT_DIR/osint/inurlbr-$TARGET.txt 2> /dev/null + rm -f $LOOT_DIR/osint/inurlbr-$TARGET + rm -Rf output/ cookie.txt exploits.conf + fi + GHDB="1" + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi fi diff --git a/modes/recon.sh b/modes/recon.sh index 3d646e0..86c97ed 100644 --- a/modes/recon.sh +++ b/modes/recon.sh @@ -193,8 +193,8 @@ if [[ "$RECON" = "1" ]]; then echo -e "$OKRED CHECKING FOR CNAME SUBDOMAIN HIJACKING $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" grep -h "CNAME" $LOOT_DIR/nmap/takeovers-* 2>/dev/null | sort -u 2> /dev/null > $LOOT_DIR/nmap/takeovers_old-all.txt - dig $TARGET CNAME | egrep -i "anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null - for a in `cat $LOOT_DIR/domains/domains-$TARGET-full.txt`; do dig $a CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$a.txt 2>/dev/null; done; + dig $TARGET CNAME | egrep -i "netlify|anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null + for a in `cat $LOOT_DIR/domains/domains-$TARGET-full.txt`; do dig $a CNAME | egrep -i "netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$a.txt 2>/dev/null; done; grep -h "CNAME" $LOOT_DIR/nmap/takeovers-* 2>/dev/null | sort -u 2> /dev/null | awk '{print $1 " " $4 " " $5}' | grep CNAME | sort -u > $LOOT_DIR/nmap/takeovers_new-all.txt diff $LOOT_DIR/nmap/takeovers_old-all.txt $LOOT_DIR/nmap/takeovers_new-all.txt 2> /dev/null | grep "> " | awk '{print $2 " " $3 " " $4}' | sort -u > $LOOT_DIR/nmap/takeovers_new-diff.txt 2> /dev/null if [[ "$SLACK_NOTIFICATIONS_TAKEOVERS_NEW" == "1" ]]; then diff --git a/modes/sc0pe-active-scan.sh b/modes/sc0pe-active-scan.sh index 8fe958a..48edb7f 100644 --- a/modes/sc0pe-active-scan.sh +++ b/modes/sc0pe-active-scan.sh @@ -3,9 +3,15 @@ OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g') #echo $file if [[ "$SSL" == "true" ]]; then - curl --connect-timeout 5 --max-time 10 -k -X $METHOD $CURL_OPTS "https://$TARGET:$PORT/$URI" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null + if [[ -z "$PORT" ]]; then + PORT="443" + fi + curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "https://$TARGET:$PORT/$URI" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$PORT-$OUTPUT_NAME.txt" 2> /dev/null else - curl --connect-timeout 5 --max-time 10 -k -X $METHOD $CURL_OPTS "http://$TARGET:$PORT/$URI" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null + if [[ -z "$PORT" ]]; then + PORT="80" + fi + curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "http://$TARGET:$PORT/$URI" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$PORT-$OUTPUT_NAME.txt" 2> /dev/null fi rm -f /tmp/match.out 2> /dev/null done \ No newline at end of file diff --git a/modes/sc0pe-passive-scan.sh b/modes/sc0pe-passive-scan.sh index 934957c..7ecb59e 100644 --- a/modes/sc0pe-passive-scan.sh +++ b/modes/sc0pe-passive-scan.sh @@ -1,18 +1,31 @@ for file in `ls $INSTALL_DIR/templates/passive/*.sh 2> /dev/null`; do + #echo $file source $file OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g') - #echo $file + if [[ "$SEARCH" == "negative" ]]; then if [[ "$SSL" == "true" ]]; then - cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null + if [[ -z "$PORT" ]]; then + PORT="443" + fi + cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null else + if [[ -z "$PORT" ]]; then + PORT="80" + fi cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null fi else #echo $file if [[ "$SSL" == "true" ]]; then - cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null + if [[ -z "$PORT" ]]; then + PORT="443" + fi + cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null else + if [[ -z "$PORT" ]]; then + PORT="80" + fi cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null fi fi diff --git a/modes/stealth.sh b/modes/stealth.sh index 9e97318..d3a5b9b 100644 --- a/modes/stealth.sh +++ b/modes/stealth.sh @@ -31,6 +31,8 @@ if [[ "$MODE" = "stealth" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-stealth.txt + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt @@ -286,12 +288,12 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$VERBOSE" == "1" ]]; then - echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,500,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" + echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x $WEB_BRUTE_EXCLUDE_CODES -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" fi if [[ "$DIRSEARCH" == "1" ]]; then touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null @@ -323,15 +325,7 @@ if [[ "$MODE" = "stealth" ]]; then fi if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR - python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:80 - fi - if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING SC0PE PASSIVE WEB VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - SSL="false" - source $INSTALL_DIR/modes/sc0pe-passive-scan.sh - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + python2 $INSTALL_DIR/bin/webscreenshot.py http://$TARGET:80 fi fi @@ -460,12 +454,12 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$VERBOSE" == "1" ]]; then - echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,500,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" + echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x $WEB_BRUTE_EXCLUDE_CODES -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" fi if [[ "$DIRSEARCH" == "1" ]]; then touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null @@ -517,17 +511,23 @@ if [[ "$MODE" = "stealth" ]]; then fi if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR - python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:443 + python2 $INSTALL_DIR/bin/webscreenshot.py https://$TARGET:443 fi echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port443.jpg" - if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING SC0PE PASSIVE WEB VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - SSL="false" - source $INSTALL_DIR/modes/sc0pe-passive-scan.sh - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - fi + fi + + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE PASSIVE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + SSL="false" + PORT="80" + echo "$INSTALL_DIR/modes/sc0pe-passive-scan.sh" + source $INSTALL_DIR/modes/sc0pe-passive-scan.sh + SSL="true" + PORT="443" + source $INSTALL_DIR/modes/sc0pe-passive-scan.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" fi source $INSTALL_DIR/modes/sc0pe.sh @@ -556,6 +556,7 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt mv $LOOT_DIR/scans/running-$TARGET-stealth.txt $LOOT_DIR/scans/finished-$TARGET-stealth.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt rm -f $INSTALL_DIR/.fuse_* 2> /dev/null sort -u $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null > $LOOT_DIR/ips/ips-all-sorted.txt 2> /dev/null diff --git a/modes/vulnscan.sh b/modes/vulnscan.sh index b178645..4fa2d23 100644 --- a/modes/vulnscan.sh +++ b/modes/vulnscan.sh @@ -34,6 +34,8 @@ if [[ "$MODE" = "vulnscan" ]]; then fi echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-vulnscan.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$OPENVAS" = "1" ]]; then sudo openvas-start 2> /dev/null > /dev/null @@ -97,6 +99,7 @@ if [[ "$MODE" = "vulnscan" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt mv $LOOT_DIR/scans/running-$TARGET-vulnscan.txt $LOOT_DIR/scans/finished-$TARGET-vulnscan.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt" /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET-udp.txt" @@ -108,5 +111,3 @@ if [[ "$MODE" = "vulnscan" ]]; then loot exit fi - - diff --git a/modes/webporthttp.sh b/modes/webporthttp.sh index afca765..2215c76 100644 --- a/modes/webporthttp.sh +++ b/modes/webporthttp.sh @@ -17,6 +17,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-webporthttp.txt + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt @@ -140,7 +141,7 @@ if [[ "$MODE" = "webporthttp" ]]; then fi if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR - python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:$PORT + python2 $INSTALL_DIR/bin/webscreenshot.py http://$TARGET:$PORT fi if [[ "$BURP_SCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -156,7 +157,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/vulners --script=http-vuln* $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT + nmap -Pn -p $PORT -sV -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners,http-default-accounts --script-args http-default-accounts.fingerprintfile=/usr/share/sniper/bin/http-default-accounts-fingerprints-nndefaccts.lua $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null fi @@ -215,7 +216,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,500,502,503,504 -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x $WEB_BRUTE_EXCLUDE_CODES -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-common.txt @@ -226,7 +227,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-full.txt @@ -237,7 +238,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-exploits.txt @@ -318,13 +319,17 @@ if [[ "$MODE" = "webporthttp" ]]; then fi - source $INSTALL_DIR/modes/sc0pe.sh + source $INSTALL_DIR/modes/sc0pe.sh + cd $INSTALL_DIR + FULLNMAPSCAN="1" + source $INSTALL_DIR/modes/fullportscan.sh echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt - mv $LOOT_DIR/scans/running-$TARGET-webporthttp.txt $LOOT_DIR/scans/finished-$TARGET-webporthttp.txt 2> /dev/null + mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt rm -f $INSTALL_DIR/.fuse_* 2> /dev/null VULNERABLE_METASPLOIT=$(egrep -h -i -s "may be vulnerable|is vulnerable|IKE response with leak|File saved in" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) if [[ ${#VULNERABLE_METASPLOIT} -ge 5 ]]; then @@ -338,12 +343,13 @@ if [[ "$MODE" = "webporthttp" ]]; then if [[ ${#SHELLED} -ge 5 ]]; then echo "$SHELLED" > $LOOT_DIR/output/shelled-$TARGET.txt 2> /dev/null fi - if [[ "$LOOT" = "1" ]]; then - loot - fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + if [[ "$LOOT" = "1" ]]; then + loot + fi + exit fi \ No newline at end of file diff --git a/modes/webporthttps.sh b/modes/webporthttps.sh index 5600cc1..07b2871 100644 --- a/modes/webporthttps.sh +++ b/modes/webporthttps.sh @@ -16,7 +16,8 @@ if [[ "$MODE" = "webporthttps" ]]; then fi echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-webporthttps.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt @@ -156,7 +157,7 @@ if [[ "$MODE" = "webporthttps" ]]; then fi if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR - python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:$PORT + python2 $INSTALL_DIR/bin/webscreenshot.py https://$TARGET:$PORT fi if [[ "$BURP_SCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -172,7 +173,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -Pn -T5 -p $PORT -sV --script=http-vuln*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT + nmap -Pn -p $PORT -sV -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners,http-default-accounts --script-args http-default-accounts.fingerprintfile=/usr/share/sniper/bin/http-default-accounts-fingerprints-nndefaccts.lua $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null fi @@ -231,7 +232,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,500,502,503,504 -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x $WEB_BRUTE_EXCLUDE_CODES -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_COMMON -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-common.txt -fw -r @@ -242,7 +243,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-full.txt -fw -r @@ -253,7 +254,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-exploits.txt -fw -r @@ -328,12 +329,16 @@ if [[ "$MODE" = "webporthttps" ]]; then fi source $INSTALL_DIR/modes/sc0pe.sh + cd $INSTALL_DIR + FULLNMAPSCAN="1" + source $INSTALL_DIR/modes/fullportscan.sh echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt - mv $LOOT_DIR/scans/running-$TARGET-webporthttps.txt $LOOT_DIR/scans/finished-$TARGET-webporthttps.txt 2> /dev/null + mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt rm -f $INSTALL_DIR/.fuse_* 2> /dev/null VULNERABLE_METASPLOIT=$(egrep -h -i -s "may be vulnerable|is vulnerable|IKE response with leak|File saved in" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) if [[ ${#VULNERABLE_METASPLOIT} -ge 5 ]]; then @@ -347,12 +352,13 @@ if [[ "$MODE" = "webporthttps" ]]; then if [[ ${#SHELLED} -ge 5 ]]; then echo "$SHELLED" > $LOOT_DIR/output/shelled-$TARGET.txt 2> /dev/null fi - if [[ "$LOOT" = "1" ]]; then - loot - fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + if [[ "$LOOT" = "1" ]]; then + loot + fi + exit fi \ No newline at end of file diff --git a/modes/webscan.sh b/modes/webscan.sh index cf9f693..b997169 100644 --- a/modes/webscan.sh +++ b/modes/webscan.sh @@ -46,6 +46,9 @@ if [[ "$MODE" = "webscan" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "$TARGET" >> $LOOT_DIR/domains/targets.txt touch $LOOT_DIR/scans/$TARGET-webscan.txt 2> /dev/null + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-webscan.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt @@ -140,10 +143,15 @@ if [[ "$MODE" = "webscan" ]]; then echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt - loot - if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then + + mv $LOOT_DIR/scans/running-$TARGET-webscan.txt $LOOT_DIR/scans/finished-$TARGET-webscan.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + + loot exit fi \ No newline at end of file diff --git a/sniper b/sniper index 34ae864..9c6fb99 100755 --- a/sniper +++ b/sniper @@ -14,7 +14,7 @@ LOOT_DIR="$INSTALL_DIR/loot/$TARGET" SNIPER_PRO=$INSTALL_DIR/pro.sh # INIT POSTGRESQL -service postgresql start +service postgresql start 2> /dev/null # LOAD SNIPER CONFIGURATION FILE if [[ -f ~/.sniper.conf ]]; then @@ -31,94 +31,94 @@ DISTRO=$(cat /etc/*-release | grep DISTRIB_ID= | cut -d'=' -f2) function help { logo echo "" - echo ' [*] NORMAL MODE' + echo -e "$OKBLUE[*]$RESET NORMAL MODE" echo ' sniper -t ' echo "" - echo ' [*] SPECIFY CUSTOM CONFIG FILE' + echo -e "$OKBLUE[*]$RESET SPECIFY CUSTOM CONFIG FILE" echo ' sniper -c /full/path/to/sniper.conf -t -m -w ' echo "" - echo ' [*] NORMAL MODE + OSINT + RECON' + echo -e "$OKBLUE[*]$RESET NORMAL MODE + OSINT + RECON" echo ' sniper -t -o -re' echo "" - echo ' [*] STEALTH MODE + OSINT + RECON' + echo -e "$OKBLUE[*]$RESET STEALTH MODE + OSINT + RECON" echo ' sniper -t -m stealth -o -re' echo "" - echo ' [*] DISCOVER MODE' + echo -e "$OKBLUE[*]$RESET DISCOVER MODE" echo ' sniper -t -m discover -w ' echo "" - echo ' [*] SCAN ONLY SPECIFIC PORT' + echo -e "$OKBLUE[*]$RESET SCAN ONLY SPECIFIC PORT" echo ' sniper -t -m port -p ' echo "" - echo ' [*] FULLPORTONLY SCAN MODE' + echo -e "$OKBLUE[*]$RESET FULLPORTONLY SCAN MODE" echo ' sniper -t -fp' echo "" - echo ' [*] WEB MODE - PORT 80 + 443 ONLY!' + echo -e "$OKBLUE[*]$RESET WEB MODE - PORT 80 + 443 ONLY!" echo ' sniper -t -m web' echo "" - echo ' [*] HTTP WEB PORT MODE' + echo -e "$OKBLUE[*]$RESET HTTP WEB PORT MODE" echo ' sniper -t -m webporthttp -p ' echo "" - echo ' [*] HTTPS WEB PORT MODE' + echo -e "$OKBLUE[*]$RESET HTTPS WEB PORT MODE" echo ' sniper -t -m webporthttps -p ' echo "" - echo ' [*] HTTP WEBSCAN MODE' + echo -e "$OKBLUE[*]$RESET HTTP WEBSCAN MODE" echo ' sniper -t -m webscan ' echo "" - echo ' [*] ENABLE BRUTEFORCE' + echo -e "$OKBLUE[*]$RESET ENABLE BRUTEFORCE" echo ' sniper -t -b' echo "" - echo ' [*] AIRSTRIKE MODE' + echo -e "$OKBLUE[*]$RESET AIRSTRIKE MODE" echo ' sniper -f targets.txt -m airstrike' echo "" - echo ' [*] NUKE MODE WITH TARGET LIST, BRUTEFORCE ENABLED, FULLPORTSCAN ENABLED, OSINT ENABLED, RECON ENABLED, WORKSPACE & LOOT ENABLED' + echo -e "$OKBLUE[*]$RESET NUKE MODE WITH TARGET LIST, BRUTEFORCE ENABLED, FULLPORTSCAN ENABLED, OSINT ENABLED, RECON ENABLED, WORKSPACE & LOOT ENABLED" echo ' sniper -f targets.txt -m nuke -w ' echo "" - echo ' [*] MASS PORT SCAN MODE' + echo -e "$OKBLUE[*]$RESET MASS PORT SCAN MODE" echo ' sniper -f targets.txt -m massportscan -w ' echo "" - echo ' [*] MASS WEB SCAN MODE' + echo -e "$OKBLUE[*]$RESET MASS WEB SCAN MODE" echo ' sniper -f targets.txt -m massweb -w ' echo "" - echo ' [*] MASS WEBSCAN SCAN MODE' + echo -e "$OKBLUE[*]$RESET MASS WEBSCAN SCAN MODE" echo ' sniper -f targets.txt -m masswebscan -w ' echo "" - echo ' [*] MASS VULN SCAN MODE' + echo -e "$OKBLUE[*]$RESET MASS VULN SCAN MODE" echo ' sniper -f targets.txt -m massvulnscan -w ' echo "" - echo ' [*] PORT SCAN MODE' + echo -e "$OKBLUE[*]$RESET PORT SCAN MODE" echo ' sniper -t -m port -p ' echo "" - echo ' [*] LIST WORKSPACES' + echo -e "$OKBLUE[*]$RESET LIST WORKSPACES" echo ' sniper --list' echo "" - echo ' [*] DELETE WORKSPACE' + echo -e "$OKBLUE[*]$RESET DELETE WORKSPACE" echo ' sniper -w -d' echo "" - echo ' [*] DELETE HOST FROM WORKSPACE' + echo -e "$OKBLUE[*]$RESET DELETE HOST FROM WORKSPACE" echo ' sniper -w -t -dh' echo "" - echo ' [*] GET SNIPER SCAN STATUS' + echo -e "$OKBLUE[*]$RESET GET SNIPER SCAN STATUS" echo ' sniper --status' echo "" - echo ' [*] LOOT REIMPORT FUNCTION' + echo -e "$OKBLUE[*]$RESET LOOT REIMPORT FUNCTION" echo ' sniper -w --reimport' echo "" - echo ' [*] LOOT REIMPORTALL FUNCTION' + echo -e "$OKBLUE[*]$RESET LOOT REIMPORTALL FUNCTION" echo ' sniper -w --reimportall' echo "" - echo ' [*] LOOT REIMPORT FUNCTION' + echo -e "$OKBLUE[*]$RESET LOOT REIMPORT FUNCTION" echo ' sniper -w --reload' echo "" - echo ' [*] LOOT EXPORT FUNCTION' + echo -e "$OKBLUE[*]$RESET LOOT EXPORT FUNCTION" echo ' sniper -w --export' echo "" - echo ' [*] SCHEDULED SCANS' + echo -e "$OKBLUE[*]$RESET SCHEDULED SCANS" echo ' sniper -w -s daily|weekly|monthly' echo "" - echo ' [*] USE A CUSTOM CONFIG' + echo -e "$OKBLUE[*]$RESET USE A CUSTOM CONFIG" echo ' sniper -c /path/to/sniper.conf -t -w ' echo "" - echo ' [*] UPDATE SNIPER' + echo -e "$OKBLUE[*]$RESET UPDATE SNIPER" echo ' sniper -u|--update' echo "" echo "" @@ -214,10 +214,10 @@ case $key in ;; -c|--config) CONFIG="$2" - echo -e "$OKBLUE[*]$RESET Creating backup of existing config to ~/.sniper.conf.bak...$OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - cp -f ~/.sniper.conf ~/.sniper.conf.bak + echo -e "$OKBLUE[*]$RESET Creating backup of existing config to /root/.sniper.conf.bak...$OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" + cp -f /root/.sniper.conf /root/.sniper.conf.bak echo -e "$OKBLUE[*]$RESET Copying $CONFIG to ~/.sniper.conf...$OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - cp -f $CONFIG ~/.sniper.conf + cp -f $CONFIG /root/.sniper.conf shift shift ;; @@ -480,7 +480,11 @@ function loot { done echo -en "$OKGREEN]$RESET" echo "" - rm -f sniper-*.txt 2>/dev/null + + + # DISABLED FOR CONTINUITY / ENABLE FOR SPEED + #rm -f sniper-*.txt 2>/dev/null + cd .. chmod 777 -Rf $LOOT_DIR #echo -e "$OKORANGE + -- --=[ Parsing NMap Ports... $RESET" @@ -585,7 +589,6 @@ fi if [[ ${TARGET:0:1} =~ $REGEX ]]; then SCAN_TYPE="IP" - else SCAN_TYPE="DOMAIN" fi diff --git a/sniper.conf b/sniper.conf index 004675b..2f968d2 100644 --- a/sniper.conf +++ b/sniper.conf @@ -85,6 +85,7 @@ WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,js" +WEB_BRUTE_EXCLUDE_CODES="400,403,404,405,406,429,500,502,503,504" # DOMAIN WORDLISTS DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" @@ -143,7 +144,7 @@ INTODNS="1" EMAILFORMAT="1" ULTRATOOLS="1" URLCRAZY="1" -VHOSTS="1" +VHOSTS="0" H8MAIL="0" GITHUB_SECRETS="0" diff --git a/templates/active/Directory_Listing_Enabled.sh b/templates/active/Directory_Listing_Enabled.sh index fd9614a..e8604ad 100644 --- a/templates/active/Directory_Listing_Enabled.sh +++ b/templates/active/Directory_Listing_Enabled.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Directory Listing Enabled' URI='/' METHOD='GET' -MATCH='To Parent Directory' +MATCH="Index\ of|To\ Parent\ Directory" SEVERITY='P4 - LOW' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/Joomla_Version_Disclosure.sh b/templates/active/Joomla_Version_Disclosure.sh index 6a32f2a..aa9c2f2 100644 --- a/templates/active/Joomla_Version_Disclosure.sh +++ b/templates/active/Joomla_Version_Disclosure.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Joomla Version Disclosure' URI='/administrator/manifests/files/joomla.xml' METHOD='GET' -MATCH='Joomla version ' +MATCH="Joomla\ version\ " SEVERITY='P4 - LOW' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/TeamQuest_Login_Found.sh b/templates/active/TeamQuest_Login_Found.sh index d2a5767..1a43ad1 100644 --- a/templates/active/TeamQuest_Login_Found.sh +++ b/templates/active/TeamQuest_Login_Found.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='TeamQuest Login Found' URI='/teamquest/cgi-bin/login' METHOD='GET' -MATCH='TeamQuest - Login' +MATCH="TeamQuest\ \-\ Login" SEVERITY='P5 - INFO' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/Telerik_File_Upload_Web_UI.sh b/templates/active/Telerik_File_Upload_Web_UI.sh index 9c92259..f74bc4d 100644 --- a/templates/active/Telerik_File_Upload_Web_UI.sh +++ b/templates/active/Telerik_File_Upload_Web_UI.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Telerik File Upload Web UI' URI='/Telerik.Web.UI.WebResource.axd?type=rau' METHOD='GET' -MATCH='RadAsyncUpload handler is registered succesfully' +MATCH="RadAsyncUpload\ handler\ is\ registered\ succesfully" SEVERITY='P2 - HIGH' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS='' diff --git a/templates/passive/Clear-text_Communications_HTTP.sh b/templates/passive/Clear-text_Communications_HTTP.sh index 3347b21..c7b0af9 100644 --- a/templates/passive/Clear-text_Communications_HTTP.sh +++ b/templates/passive/Clear-text_Communications_HTTP.sh @@ -1,8 +1,10 @@ -AUTHOR='@xer0dayz' -VULN_NAME='Clear-Text Protocol - HTTP' -FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt" -MATCH="200\ OK" -SEVERITY='P2 - HIGH' -GREP_OPTIONS='-i' -SEARCH='positive' -SECONDARY_COMMANDS='' \ No newline at end of file +if [ "$SSL" = "false" ]; then + AUTHOR='@xer0dayz' + VULN_NAME='Clear-Text Protocol - HTTP' + FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt" + MATCH="200\ OK" + SEVERITY='P2 - HIGH' + GREP_OPTIONS='-i' + SEARCH='positive' + SECONDARY_COMMANDS='' +fi \ No newline at end of file diff --git a/templates/passive/Clickjacking.sh b/templates/passive/Clickjacking.sh index 04ecaf4..f8b9046 100644 --- a/templates/passive/Clickjacking.sh +++ b/templates/passive/Clickjacking.sh @@ -1,8 +1,23 @@ -AUTHOR='@xer0dayz' -VULN_NAME='Clickjacking' -FILENAME="$LOOT_DIR/web/headers-htt*-$TARGET.txt" -MATCH='X-Frame-Options' -SEVERITY='P4 - LOW' -GREP_OPTIONS='-i' -SEARCH="negative" -SECONDARY_COMMANDS='' \ No newline at end of file +if [ -f $LOOT_DIR/web/headers-http-$TARGET.txt ]; then + if [ "$SSL" = "false" ]; then + AUTHOR='@xer0dayz' + VULN_NAME='Clickjacking HTTP' + FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt" + MATCH="x-frame-options" + SEVERITY='P4 - LOW' + GREP_OPTIONS='-i' + SEARCH='negative' + SECONDARY_COMMANDS='' + URI="/" + else + AUTHOR='@xer0dayz' + VULN_NAME='Clickjacking HTTPS' + FILENAME="$LOOT_DIR/web/headers-https-$TARGET.txt" + MATCH="x-frame-options" + SEVERITY='P4 - LOW' + GREP_OPTIONS='-i' + SEARCH='negative' + SECONDARY_COMMANDS='' + URI="/" + fi +fi \ No newline at end of file diff --git a/templates/passive/Insecure_SSL_TLS_Connection.sh b/templates/passive/Insecure_SSL_TLS_Connection.sh index fa0611e..fdaa66a 100644 --- a/templates/passive/Insecure_SSL_TLS_Connection.sh +++ b/templates/passive/Insecure_SSL_TLS_Connection.sh @@ -1,8 +1,10 @@ -AUTHOR='@xer0dayz' -VULN_NAME='Weak SSL TLS Protocols' -FILENAME="$LOOT_DIR/web/sslscan-$TARGET.txt" -MATCH=' SSLv' -SEVERITY='P2 - HIGH' -GREP_OPTIONS='-i' -SEARCH='positive' -SECONDARY_COMMANDS='' \ No newline at end of file +if [ "$SSL" = "true" ]; then + AUTHOR='@xer0dayz' + VULN_NAME='Weak SSL TLS Protocols' + FILENAME="$LOOT_DIR/web/sslscan-$TARGET.txt" + MATCH=' SSLv' + SEVERITY='P2 - HIGH' + GREP_OPTIONS='-i' + SEARCH='positive' + SECONDARY_COMMANDS='' +fi \ No newline at end of file diff --git a/templates/passive/Insecure_SSL_TLS_Connection_CN_Mismatch.sh b/templates/passive/Insecure_SSL_TLS_Connection_CN_Mismatch.sh index 821e669..2f25f6f 100644 --- a/templates/passive/Insecure_SSL_TLS_Connection_CN_Mismatch.sh +++ b/templates/passive/Insecure_SSL_TLS_Connection_CN_Mismatch.sh @@ -1,8 +1,11 @@ -AUTHOR='@xer0dayz' -VULN_NAME='Insecure SSL TLS Connection CN Mismatch' -FILENAME="$LOOT_DIR/web/curldebug-$TARGET.txt" -MATCH='failed to verify the legitimacy of the server' -SEVERITY='P3 - MEDIUM' -GREP_OPTIONS='-i' -SEARCH='positive' -SECONDARY_COMMANDS='' \ No newline at end of file +if [ "$SSL" = "true" ]; then + AUTHOR='@xer0dayz' + VULN_NAME='Insecure SSL TLS Connection CN Mismatch' + FILENAME="$LOOT_DIR/web/curldebug-$TARGET.txt" + MATCH='failed to verify the legitimacy of the server' + SEVERITY='P3 - MEDIUM' + GREP_OPTIONS='-i' + SEARCH='positive' + SECONDARY_COMMANDS='' + URI="/" +fi \ No newline at end of file