diff --git a/CHANGELOG.md b/CHANGELOG.md index 554f441..a8c1c13 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,10 @@ ## CHANGELOG: +* v7.4 - Added reverse whois DNS search via AMass +* v7.4 - Disabled MassDNS/DNSGen/AltDNS in default configuration (Can be enabled in ~/.sniper.conf) * v7.4 - Disabled crt.sh sub-domain retrieval since service is disabled +* v7.4 - Added MassDNS IP's to master sorted IP list * v7.4 - Fixed issue with MassDNS installation +* v7.4 - Fixed bad path with DNSGen * v7.4 - Fixed issue with AMass not running * v7.4 - Improved performance of AltDNS/DNSgen/MassDNS retrieval * v7.4 - Changed webscreenshot.py setting to use chrome browser diff --git a/modes/recon.sh b/modes/recon.sh index 87d9d49..ab9372f 100644 --- a/modes/recon.sh +++ b/modes/recon.sh @@ -13,9 +13,13 @@ if [ "$RECON" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA AMASS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - amass -ip -brute -o $LOOT_DIR/domains/domains-$TARGET-amass.txt -min-for-recursive 3 -d $TARGET 2>/dev/null + amass enum -ip -o $LOOT_DIR/domains/domains-$TARGET-amass.txt -rf /usr/share/sniper/plugins/massdns/lists/resolvers.txt -d $TARGET 2>/dev/null cut -d" " -f1 $LOOT_DIR/domains/domains-$TARGET-amass.txt 2>/dev/null | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt cut -d" " -f2 $LOOT_DIR/domains/domains-$TARGET-amass.txt 2>/dev/null > $LOOT_DIR/domains/domains-$TARGET-amass-ips-sorted.txt + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED GATHERING REVERSE WHOIS DNS SUBDOMAINS VIA AMASS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + amass intel -whois -d $TARGET | tee $LOOT_DIR/domains/domains-$TARGET-reverse-whois.txt 2> /dev/null fi if [ "$SUBFINDER" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -40,7 +44,7 @@ if [ "$RECON" = "1" ]; then echo -e "$OKRED GATHERING CERTIFICATE SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKBLUE" - curl -s https://crt.sh/?q=%25.$TARGET > /tmp/curl.out && cat /tmp/curl.out | grep $TARGET | grep TD | sed -e 's///g' | sed -e 's/TD//g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt && cat $LOOT_DIR/domains/domains-$TARGET-crt.txt + curl -s https://crt.sh/?q=%25.$TARGET > $LOOT_DIR/domains/domains-$TARGET-presorted.txt && cat $LOOT_DIR/domains/domains-$TARGET-presorted.txt | grep $TARGET | grep TD | sed -e 's///g' | sed -e 's/TD//g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt && cat $LOOT_DIR/domains/domains-$TARGET-crt.txt echo "" echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-full.txt" fi @@ -56,13 +60,13 @@ if [ "$RECON" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -fsSL "https://dns.bufferover.run/dns?q=.$TARGET" | sed 's/\"//g' | cut -f2 -d "," |sort -u | grep $TARGET | tee $LOOT_DIR/domains/domains-$TARGET-projectsonar.txt 2> /dev/null fi - cat $LOOT_DIR/domains/domains-$TARGET-crt.txt 2> /dev/null > /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt 2> /dev/null >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET-subfinder.txt 2> /dev/null >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET-projectsonar.txt 2> /dev/null >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null >> /tmp/curl.out 2> /dev/null - cat $LOOT_DIR/domains/targets.txt 2> /dev/null >> /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-crt.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-subfinder.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-projectsonar.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null + cat $LOOT_DIR/domains/targets.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null if [ "$ALT_DNS" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING ALTDNS SUBDOMAINS $RESET" @@ -73,22 +77,23 @@ if [ "$RECON" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNSGEN SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - python3 $INSTALL_DIR/plugins/dnsgen/dnsgen.py $LOOT_DIR/domains/domains-$TARGET.txt > $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt 2> /dev/null + dnsgen $LOOT_DIR/domains/domains-$TARGET.txt > $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt 2> /dev/null fi if [ "$MASS_DNS" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING MASSDNS ON SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - sort -u $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt $LOOT_DIR/domains/domains-$TARGET-altdns.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-alldns.txt 2> /dev/null - massdns -s 5000 -r /usr/share/sniper/plugins/massdns/lists/resolvers.txt $LOOT_DIR/domains/domains-$TARGET-alldns.txt -q -o S -t A -w $LOOT_DIR/domains/domains-$TARGET-massdns.txt + sort -u $LOOT_DIR/domains/domains-$TARGET-presorted.txt $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt $LOOT_DIR/domains/domains-$TARGET-altdns.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-alldns.txt 2> /dev/null + massdns -s 5000 -r /usr/share/sniper/plugins/massdns/lists/resolvers.txt $LOOT_DIR/domains/domains-$TARGET-alldns.txt -o S -t A -w $LOOT_DIR/domains/domains-$TARGET-massdns.txt awk -F ". " '{print $1}' $LOOT_DIR/domains/domains-$TARGET-massdns.txt | grep -v "*" | sort -u | tee $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt - cat $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null >> /tmp/curl.out 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null grep "IN CNAME" $LOOT_DIR/domains/domains-$TARGET-massdns.txt | awk '{print $3}' | grep -v "*" | sort -u | tee $LOOT_DIR/domains/domains-$TARGET-massdns-CNAME.txt grep "A " $LOOT_DIR/domains/domains-$TARGET-massdns.txt | awk '{print $3}' | grep -v "*" | sort -u | tee $LOOT_DIR/domains/domains-$TARGET-massdns-A-records.txt + cat $LOOT_DIR/domains/domains-$TARGET-massdns-A-records.txt >> $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null fi - sort -u /tmp/curl.out 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-full.txt + sort -u $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-full.txt cat $LOOT_DIR/domains/domains-$TARGET-full.txt >> $LOOT_DIR/scans/updated.txt 2> /dev/null - rm -f /tmp/curl.out 2> /dev/null + rm -f $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null diff $LOOT_DIR/domains/domains_old-$TARGET.txt $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/domains/domains_new-$TARGET.txt if [ "$SLACK_NOTIFICATIONS_DOMAINS_NEW" == "1" ]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/domains/domains_new-$TARGET.txt" diff --git a/sniper b/sniper index caaea9e..63be970 100755 --- a/sniper +++ b/sniper @@ -358,9 +358,13 @@ function init { touch $LOOT_DIR/scans/scheduled/daily.sh 2> /dev/null touch $LOOT_DIR/scans/scheduled/weekly.sh 2> /dev/null touch $LOOT_DIR/scans/scheduled/monthly.sh 2> /dev/null + chmod 775 -Rf $LOOT_DIR 2> /dev/null TARGET="$(echo $TARGET | sed 's/https:\/\///g' | sed 's/http:\/\///g')" service postgresql start msfdb start 2> /dev/null > /dev/null + UPDATED_TARGETS=$LOOT_DIR/scans/updated.txt + rm -f $UPDATED_TARGETS 2> /dev/null + touch $UPDATED_TARGETS 2> /dev/null if [ "$AUTOBRUTE" == "1" ]; then echo "$TARGET autobrute `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt @@ -453,7 +457,6 @@ function loot { sed -i -E 's/address//g' $LOOT_DIR/ips/ips-all-sorted.txt 2> /dev/null sort -u $LOOT_DIR/domains/domains-all-presorted2.txt $LOOT_DIR/domains/targets-all-sorted.txt 2> /dev/null > $LOOT_DIR/domains/domains-all-sorted.txt 2> /dev/null diff $LOOT_DIR/domains/targets-all-sorted.txt $LOOT_DIR/domains/domains-all-sorted.txt | grep \> | awk '{print $2}' > $LOOT_DIR/domains/targets-all-unscanned.txt - sort -u $LOOT_DIR/web/webhosts-unsorted.txt > $LOOT_DIR/web/webhosts-sorted.txt 2> /dev/null rm -f $LOOT_DIR/domains/targets-all-presorted.txt $LOOT_DIR/domains/targets-all-presorted2.txt 2> /dev/null rm -f $LOOT_DIR/domains/domains-all-presorted.txt $LOOT_DIR/domains/domains-all-presorted2.txt 2> /dev/null sort -u $LOOT_DIR/nmap/openports-unsorted.txt > $LOOT_DIR/nmap/openports-sorted.txt 2> /dev/null @@ -466,11 +469,11 @@ function loot { cd $LOOT_DIR/nmap/ 2> /dev/null split -d -l $MAX_HOSTS -e $LOOT_DIR/nmap/openports-sorted.txt openports-all-sorted- 2> /dev/null split -d -l $MAX_HOSTS -e $LOOT_DIR/nmap/livehosts-sorted.txt livehosts-all-sorted- 2> /dev/null - rm -f $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null - rm -f $LOOT_DIR/nmap/openports-unsorted.txt 2> /dev/null - echo -e "$OKORANGE + -- --=[ Removing blank screenshots...$RESET" + echo -e "$OKORANGE + -- --=[ Removing blank screenshots and files...$RESET" + chmod 775 -Rf $LOOT_DIR 2> /dev/null cd $LOOT_DIR/screenshots/ find $LOOT_DIR/screenshots/ -type f -size -9000c -exec rm -f {} \; + find $LOOT_DIR/nmap/ -type f -size -1c -exec rm -f {} \; cd $LOOT_DIR if [ -f $SNIPER_PRO ]; then if [ -f "$LOOT_DIR/notes/notepad.html" ]; then @@ -498,10 +501,6 @@ function loot { echo -e "$OKORANGE + -- --=[ Skipping report generation. $RESET" fi fi - echo -e "$OKORANGE + -- --=[ Checking scan updates...$RESET" - UPDATED_TARGETS=$LOOT_DIR/scans/updated.txt - rm -f $UPDATED_TARGETS 2> /dev/null - touch $UPDATED_TARGETS 2> /dev/null else echo -e "$OKRED + -- --=[ Sn1per Professional is not installed. To download Sn1per Professional, go to https://xerosecurity.com. $RESET" $BROWSER https://xerosecurity.com 2> /dev/null > /dev/null & diff --git a/sniper.conf b/sniper.conf index f09f88f..4d5299e 100644 --- a/sniper.conf +++ b/sniper.conf @@ -159,12 +159,12 @@ SUBLIST3R="1" AMASS="1" SUBFINDER="1" DNSCAN="1" -CRTSH="0" +CRTSH="1" SUBOVER="1" PROJECT_SONAR="1" CENSYS_SUBDOMAINS="0" SUBNET_RETRIEVAL="1" SUBJACK="1" -ALT_DNS="1" -MASS_DNS="1" -DNSGEN="1" \ No newline at end of file +ALT_DNS="0" +MASS_DNS="0" +DNSGEN="0" \ No newline at end of file