diff --git a/README.md b/README.md index 5b29ddf..ea704cc 100644 --- a/README.md +++ b/README.md @@ -1,25 +1,37 @@ -+ -- --=[Sn1per v1.3 by 1N3 ++ -- --=[Sn1per v1.4 by 1N3 + -- --=[http://crowdshield.com -Sn1per - Automated Pentest Recon Scanner +# Sn1per - Automated Pentest Recon Scanner -ABOUT: +## ABOUT: Sn1per is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. -FEATURES: -- Automatically collects basic recon (ie. whois, ping, DNS, etc.) -- Automatically launches Google hacking queries against a target domain -- Automatically enumerates open ports -- Automatically brute forces sub-domains and DNS info -- Automatically runs targeted nmap scripts against open ports -- Automatically scans all web applications for common vulnerabilities -- Automatically brute forces all open services +## FEATURES: +* Automatically collects basic recon (ie. whois, ping, DNS, etc.) +* Automatically launches Google hacking queries against a target domain +* Automatically enumerates open ports +* Automatically brute forces sub-domains and DNS info +* Automatically runs targeted nmap scripts against open ports +* Automatically scans all web applications for common vulnerabilities +* Automatically brute forces all open services -INSTALL: +## INSTALL: +``` ./install.sh - Installs all dependencies. Best run from Kali Linux. +``` -USAGE: +## USAGE: +``` ./sn1per +``` + +## SAMPLE REPORT: +https://goo.gl/96LCAg + +## CHANGELOG: +* v1.4 - Added Yasou for automatic web form brute forcing +* v1.4 - Added MassBleed for SSL vulnerability detection +* v1.4 - Added Breach-Miner for detection of breached accounts +* v1.4 - Fixed minor errors with nmap +* v1.4 - Removed debug output from goohak from displaying on console -SAMPLE REPORT: -https://gist.githubusercontent.com/1N3/070d14c364e5f23bfe5e/raw/8e152e740ba50cd49bb3366ec91cf7d08ca02715/Sn1per%2520Sample%2520Report diff --git a/install.sh b/install.sh index b1115a8..ce56aee 100644 --- a/install.sh +++ b/install.sh @@ -2,13 +2,17 @@ # Install script for sn1per # echo "Installing sn1per dependencies..." -apt-get install host whois theharvester dnsenum curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester nmap dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap +apt-get install host whois theharvester dnsenum dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester nmap dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap git clone https://github.com/1N3/Findsploit.git git clone https://github.com/1N3/BruteX.git git clone https://github.com/1N3/Goohak.git +cp Goohak/goohak /usr/bin/ -f git clone https://github.com/1N3/XSSTracer.git +git clone https://github.com/1N3/MassBleed.git git clone https://github.com/1N3/SuperMicro-Password-Scanner git clone https://github.com/Dionach/CMSmap.git +git clone https://github.com/0xsauby/yasuo.git +git clone https://github.com/vishnuraju/Breach-Miner-automated-.git Breach-Miner mkdir loot chmod +rx sniper echo "Be sure to install the following packages manually and update the sniper script references: dig dnsdict6 cmsmap samrdump inurlbr wafw00f showmount samrdump rpcinfo snmpwalk" diff --git a/loot/.fuse_hidden0000c11500000002 b/loot/.fuse_hidden0000c11500000002 new file mode 100644 index 0000000..7620904 --- /dev/null +++ b/loot/.fuse_hidden0000c11500000002 @@ -0,0 +1,2 @@ + +Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-10-03 19:12 EDT diff --git a/loot/README b/loot/README deleted file mode 100644 index e69de29..0000000 diff --git a/loot/README.md b/loot/README.md new file mode 100644 index 0000000..ea704cc --- /dev/null +++ b/loot/README.md @@ -0,0 +1,37 @@ ++ -- --=[Sn1per v1.4 by 1N3 ++ -- --=[http://crowdshield.com + +# Sn1per - Automated Pentest Recon Scanner + +## ABOUT: +Sn1per is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. + +## FEATURES: +* Automatically collects basic recon (ie. whois, ping, DNS, etc.) +* Automatically launches Google hacking queries against a target domain +* Automatically enumerates open ports +* Automatically brute forces sub-domains and DNS info +* Automatically runs targeted nmap scripts against open ports +* Automatically scans all web applications for common vulnerabilities +* Automatically brute forces all open services + +## INSTALL: +``` +./install.sh - Installs all dependencies. Best run from Kali Linux. +``` + +## USAGE: +``` +./sn1per +``` + +## SAMPLE REPORT: +https://goo.gl/96LCAg + +## CHANGELOG: +* v1.4 - Added Yasou for automatic web form brute forcing +* v1.4 - Added MassBleed for SSL vulnerability detection +* v1.4 - Added Breach-Miner for detection of breached accounts +* v1.4 - Fixed minor errors with nmap +* v1.4 - Removed debug output from goohak from displaying on console + diff --git a/sniper b/sniper index e97ffee..3e76c27 100644 --- a/sniper +++ b/sniper @@ -1,5 +1,5 @@ #!/bin/bash -# + -- --=[Sn1per v1.3 by 1N3 v20150906 +# + -- --=[Sn1per v1.4 by 1N3 v20151130 # + -- --=[http://crowdshield.com # # Sn1per - Automated Pentest Recon Tool @@ -47,7 +47,7 @@ if [ -z $TARGET ]; then echo -e "$OKRED /_/ $RESET" echo -e "$RESET" echo -e "$OKORANGE + -- --=[http://crowdshield.com" - echo -e "$OKORANGE + -- --=[sn1per v1.3 by 1N3" + echo -e "$OKORANGE + -- --=[sn1per v1.4 by 1N3" echo -e "$OKORANGE + -- --=[Usage: sn1per " exit fi @@ -62,9 +62,8 @@ echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" echo -e "$OKRED /_/ $RESET" echo -e "$RESET" echo -e "$OKORANGE + -- --=[http://crowdshield.com" -echo -e "$OKORANGE + -- --=[sn1per v1.3 by 1N3" +echo -e "$OKORANGE + -- --=[sn1per v1.4 by 1N3" echo -e "$RESET" - echo -e "$OKGREEN################################### Running recon #################################$RESET" nslookup $TARGET host $TARGET @@ -74,18 +73,21 @@ theharvester -d $TARGET -b google theharvester -d $TARGET -b bing theharvester -d $TARGET -b linkedin theharvester -d $TARGET -b people123 -dnsenum $TARGET -dnsdict6 $TARGET $DNS_FILE -4 | awk '{print $1}' | sort -u | sed -r 's/.com./.com/g' > $LOOT_DIR/domains-$TARGET.txt -cat $LOOT_DIR/domains-$TARGET.txt -echo "" -echo -e "$OKBLUE+ -- --=[Checking for SPF records on $TARGET...$RESET $OKORANGE" -curl -s -X POST http://www.kitterman.com/getspf2.py --data 'serial=fred12&domain=$TARGET' | egrep spf1 --color +dnsrecon -d $TARGET +dnsrecon -d $TARGET -t zonewalk +dnsrecon -d quora.com -t axfr +dnsenum $TARGET -f BruteX/namelist.txt +cd Breach-Miner +python breachminer.py $TARGET +cd .. +mv -f *_ips.txt loot/ 2>/dev/null echo "" echo -e "$OKGREEN################################### Pinging host ###################################$RESET" ping -c 1 $TARGET echo "" echo -e "$OKGREEN################################### Running port scan ##############################$RESET" nmap -sS -sV -T4 -A -O --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml +nmap -sU -sV -T4 -A -O -p 53,67,68,88,161,162,137,138,139,389,520,521,2049 --open $TARGET -oX $LOOT_DIR/nmap-udp-$TARGET.xml echo "" echo -e "$OKGREEN################################### Running Intrusive Scans ########################$RESET" port_21=`grep 'portid="21"' $LOOT_DIR/nmap-$TARGET.xml | grep open` @@ -118,6 +120,7 @@ port_8000=`grep 'portid="8000"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_8009=`grep 'portid="8009"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_8080=`grep 'portid="8080"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_8180=`grep 'portid="8180"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_8443=`grep 'portid="8443"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_49152=`grep 'portid="49152"' $LOOT_DIR/nmap-$TARGET.xml | grep open` if [ -z "$port_21" ] @@ -169,63 +172,70 @@ then echo -e "$OKRED+ -- --=[Port 80 closed... skipping.$RESET" else echo -e "$OKGREEN+ -- --=[Port 80 opened... running tests...$RESET" - goohak $TARGET 2> /dev/null - php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt - rm -Rf output/ cookie.txt exploits.conf - nmap -sV -p 80 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-drupal-modules,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-email-harvest,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper $TARGET wafw00f http://$TARGET echo "" whatweb http://$TARGET xsstracer $TARGET 80 echo "" + goohak $TARGET > /dev/null + php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt + rm -Rf output/ cookie.txt exploits.conf + nmap -sV -p 80 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper $TARGET echo -e "$OKBLUE+ -- --=[Checking if X-Content options are enabled on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I http://$TARGET | egrep -i 'X-Content' + curl -s --insecure -I http://$TARGET | egrep -i 'X-Content' | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking if X-Frame options are enabled on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I http://$TARGET | egrep -i 'X-Frame' + curl -s --insecure -I http://$TARGET | egrep -i 'X-Frame' | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking if X-XSS-Protection header is enabled on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I http://$TARGET | egrep -i 'X-XSS' + curl -s --insecure -I http://$TARGET | egrep -i 'X-XSS' | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking HTTP methods on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I -X OPTIONS http://$TARGET | grep Allow + curl -s --insecure -I -X OPTIONS http://$TARGET | grep Allow | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking if TRACE method is enabled on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I -X TRACE http://$TARGET | grep TRACE + curl -s --insecure -I -X TRACE http://$TARGET | grep TRACE | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking for open proxy on $TARGET...$RESET $OKORANGE" - curl -s --insecure -x http://$TARGET:80 -L http://crowdshield.com/.testing/openproxy.txt + curl -s --insecure -x http://$TARGET:80 -L http://crowdshield.com/.testing/openproxy.txt | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Enumerating software on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I http://$TARGET | egrep -i "Server:|X-Powered|ASP|JSP|PHP|.NET" + curl -s --insecure -I http://$TARGET | egrep -i "Server:|X-Powered|ASP|JSP|PHP|.NET" | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking if Strict-Transport-Security is enabled on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I http://$TARGET/ | egrep -i "Strict-Transport-Security" + curl -s --insecure -I http://$TARGET/ | egrep -i "Strict-Transport-Security" | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking for Flash cross-domain policy on $TARGET...$RESET $OKORANGE" - curl -s --insecure http://$TARGET/crossdomain.xml + curl -s --insecure http://$TARGET/crossdomain.xml | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking for Silverlight cross-domain policy on $TARGET...$RESET $OKORANGE" - curl -s --insecure http://$TARGET/clientaccesspolicy.xml + curl -s --insecure http://$TARGET/clientaccesspolicy.xml | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking for HTML5 cross-origin resource sharing on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I http://$TARGET | egrep -i "Access-Control-Allow-Origin" + curl -s --insecure -I http://$TARGET | egrep -i "Access-Control-Allow-Origin" | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Retrieving robots.txt on $TARGET...$RESET $OKORANGE" - curl -s --insecure http://$TARGET/robots.txt + curl -s --insecure http://$TARGET/robots.txt | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Retrieving sitemap.xml on $TARGET...$RESET $OKORANGE" - curl -s --insecure http://$TARGET/sitemap.xml + curl -s --insecure http://$TARGET/sitemap.xml | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking cookie attributes on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I http://$TARGET | egrep -i "Cookie:" + curl -s --insecure -I http://$TARGET | egrep -i "Cookie:" | tail -n 10 + echo "" + echo -e "$OKBLUE+ -- --=[Checking for ASP.NET Detailed Errors on $TARGET...$RESET $OKORANGE" + curl -s --insecure http://$TARGET/%3f.jsp | egrep -i 'Error|Exception' | tail -n 10 + curl -s --insecure http://$TARGET/test.aspx -L | egrep -i 'Error|Exception|System.Web.' | tail -n 10 + echo "" + echo -e "$OKBLUE+ -- --=[Checking for Rom-0 Router Vulnerabilities on $TARGET...$RESET $OKORANGE" + curl -s --insecure http://$TARGET/rom-0 | grep 200 | tail -n 10 echo "" echo -e "$RESET" nikto -h http://$TARGET wpscan --url http://$TARGET --batch python $CMSMAP -t http://$TARGET - python /usr/share/sqlmap/sqlmap.py -u "http://$TARGET" --batch --crawl=5 -f + sqlmap -u "http://$TARGET" --batch --crawl=5 -f fi if [ -z "$port_110" ] @@ -280,22 +290,27 @@ then echo -e "$OKRED+ -- --=[Port 443 closed... skipping.$RESET" else echo -e "$OKGREEN+ -- --=[Port 443 opened... running tests...$RESET" - nmap -sV -p 443 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-drupal-modules,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-email-harvest,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper,tls-nextprotoneg,ssl* $TARGET - goohak $TARGET 2> /dev/null - php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt - rm -Rf output/ cookie.txt exploits.conf wafw00f https://$TARGET echo "" whatweb https://$TARGET echo "" + sslscan --no-failed $TARGET + echo "" + cd MassBleed + ./massbleed $TARGET port 443 + cd .. + nmap -sV -p 443 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper,tls-nextprotoneg,ssl* $TARGET + goohak $TARGET > /dev/null + php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt + rm -Rf output/ cookie.txt exploits.conf echo -e "$OKBLUE+ -- --=[Checking if X-Content options are enabled on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I https://$TARGET | egrep -i 'X-Content' + curl -s --insecure -I https://$TARGET | egrep -i 'X-Content' | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking if X-Frame options are enabled on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I https://$TARGET | egrep -i 'X-Frame' + curl -s --insecure -I https://$TARGET | egrep -i 'X-Frame' | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking if X-XSS-Protection header is enabled on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I https://$TARGET | egrep -i 'X-XSS' + curl -s --insecure -I https://$TARGET | egrep -i 'X-XSS' | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking HTTP methods on $TARGET...$RESET $OKORANGE" curl -s --insecure -I -X OPTIONS https://$TARGET | grep Allow @@ -304,38 +319,44 @@ else curl -s --insecure -I -X TRACE https://$TARGET | grep TRACE echo "" echo -e "$OKBLUE+ -- --=[Checking for open proxy on $TARGET...$RESET $OKORANGE" - curl -x https://$TARGET:443 -L https://crowdshield.com/.testing/openproxy.txt -s --insecure + curl -x https://$TARGET:443 -L https://crowdshield.com/.testing/openproxy.txt -s --insecure | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Enumerating software on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I https://$TARGET | egrep -i "Server:|X-Powered|ASP|JSP|PHP|.NET" + curl -s --insecure -I https://$TARGET | egrep -i "Server:|X-Powered|ASP|JSP|PHP|.NET" | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking if Strict-Transport-Security is enabled on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I https://$TARGET/ | egrep -i "Strict-Transport-Security" + curl -s --insecure -I https://$TARGET/ | egrep -i "Strict-Transport-Security" | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking for Flash cross-domain policy on $TARGET...$RESET $OKORANGE" - curl -s --insecure https://$TARGET/crossdomain.xml + curl -s --insecure https://$TARGET/crossdomain.xml | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking for Silverlight cross-domain policy on $TARGET...$RESET $OKORANGE" - curl -s --insecure https://$TARGET/clientaccesspolicy.xml + curl -s --insecure https://$TARGET/clientaccesspolicy.xml | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking for HTML5 cross-origin resource sharing on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I https://$TARGET | egrep -i "Access-Control-Allow-Origin" + curl -s --insecure -I https://$TARGET | egrep -i "Access-Control-Allow-Origin" | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Retrieving robots.txt on $TARGET...$RESET $OKORANGE" - curl -s --insecure https://$TARGET/robots.txt + curl -s --insecure https://$TARGET/robots.txt | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Retrieving sitemap.xml on $TARGET...$RESET $OKORANGE" - curl -s --insecure https://$TARGET/sitemap.xml + curl -s --insecure https://$TARGET/sitemap.xml | tail -n 10 echo "" echo -e "$OKBLUE+ -- --=[Checking cookie attributes on $TARGET...$RESET $OKORANGE" - curl -s --insecure -I https://$TARGET | egrep -i "Cookie:" - echo -e "$RESET" - sslscan --no-failed $TARGET + curl -s --insecure -I https://$TARGET | egrep -i "Cookie:" | tail -n 10 echo "" + echo -e "$OKBLUE+ -- --=[Checking for ASP.NET Detailed Errors on $TARGET...$RESET $OKORANGE" + curl -s --insecure https://$TARGET/%3f.jsp | egrep -i 'Error|Exception' | tail -n 10 + curl -s --insecure https://$TARGET/test.aspx -L | egrep -i 'Error|Exception|System.Web.' | tail -n 10 + echo "" + echo -e "$OKBLUE+ -- --=[Checking for Rom-0 Router Vulnerabilities on $TARGET...$RESET $OKORANGE" + curl -s --insecure https://$TARGET/rom-0 | grep 200 | tail -n 10 + echo "" + echo -e "$RESET" nikto -h https://$TARGET wpscan --url https://$TARGET --batch python $CMSMAP -t https://$TARGET - python /usr/share/sqlmap/sqlmap.py -u "https://$TARGET" --batch --crawl=5 -f + sqlmap -u "https://$TARGET" --batch --crawl=5 -f fi if [ -z "$port_445" ] @@ -455,6 +476,10 @@ else whatweb http://$TARGET:8000 echo "" xsstracer $TARGET 8000 + sslscan --no-failed $TARGET:8000 + cd MassBleed + ./massbleed $TARGET port 8000 + cd .. nikto -h http://$TARGET:8000 fi @@ -468,6 +493,10 @@ else whatweb http://$TARGET:8100 echo "" xsstracer $TARGET 8100 + sslscan --no-failed $TARGET:8100 + cd MassBleed + ./massbleed $TARGET port 8100 + cd .. nikto -h http://$TARGET:8100 fi @@ -481,8 +510,12 @@ else whatweb http://$TARGET:8080 echo "" xsstracer $TARGET 8080 + sslscan --no-failed $TARGET:8080 + cd MassBleed + ./massbleed $TARGET port 8080 + cd .. nikto -h http://$TARGET:8080 - nmap -p 8080 --script=proxy-* $TARGET + nmap -p 8080 --script=*proxy* $TARGET fi if [ -z "$port_8180" ] @@ -495,8 +528,30 @@ else whatweb http://$TARGET:8180 echo "" xsstracer $TARGET 8180 + sslscan --no-failed $TARGET:8180 + cd MassBleed + ./massbleed $TARGET port 8180 + cd .. nikto -h http://$TARGET:8180 - nmap -p 8180 --script=proxy-* $TARGET + nmap -p 8180 --script=*proxy* $TARGET +fi + +if [ -z "$port_8443" ] +then + echo -e "$OKRED+ -- --=[Port 8443 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 8443 opened... running tests...$RESET" + wafw00f http://$TARGET:8443 + echo "" + whatweb http://$TARGET:8443 + echo "" + xsstracer $TARGET 8443 + sslscan --no-failed $TARGET:8443 + cd MassBleed + ./massbleed $TARGET port 8443 + cd .. + nikto -h http://$TARGET:8443 + nmap -p 8443 --script=*proxy* $TARGET fi if [ -z "$port_49152" ] @@ -508,8 +563,10 @@ else fi echo -e "$OKGREEN################################### Running Brute Force #############################$RESET" -cd BruteX/ -brutex $TARGET +cd yasuo +ruby yasuo.rb -r $TARGET -b all +cd ../BruteX/ +./brutex $TARGET rm -f hydra.restore cd .. echo ""