diff --git a/CHANGELOG.md b/CHANGELOG.md index 8010168..b083853 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,6 @@ ## CHANGELOG: +* v8.2 - Added check with insecure SSL/TLS connections +* v8.2 - Added NMAP_OPTIONS setting in ~/.sniper.conf to configure optional NMap settings * v8.2 - Fixed issue with ManageEngine MSF exploit payload * v8.2 - Added Spyse sub-domain enumeration tool (https://github.com/zeropwn/spyse.py) * v8.2 - Fixed issue with Subjack (open /src/github.com/haccer/subjack/fingerprints.json: no such file or directory) diff --git a/bin/slack.sh b/bin/slack.sh index 397bafb..53472a0 100644 --- a/bin/slack.sh +++ b/bin/slack.sh @@ -1,6 +1,6 @@ #!/bin/bash -SLACK_API_TOKEN="" +SLACK_API_TOKEN=$(grep SLACK_API_TOKEN ~/.sniper.conf | cut -d\" -f2) SLACK_CHANNEL="sn1per-professional" MESSAGE="$1" diff --git a/install.sh b/install.sh index 3cd395f..7186559 100755 --- a/install.sh +++ b/install.sh @@ -90,18 +90,18 @@ mkdir -p $GO_DIR 2> /dev/null echo -e "$OKORANGE + -- --=[ Downloading extensions...$RESET" git clone https://github.com/1N3/BruteX.git -git clone https://github.com/1N3/Findsploit.git -git clone https://github.com/1N3/Goohak.git +git clone https://github.com/1N3/Findsploit.git +git clone https://github.com/1N3/Goohak.git git clone https://github.com/1N3/BlackWidow -cp /usr/share/sniper/plugins/BlackWidow/blackwidow /usr/bin/blackwidow +cp /usr/share/sniper/plugins/BlackWidow/blackwidow /usr/bin/blackwidow cp /usr/share/sniper/plugins/BlackWidow/injectx.py /usr/bin/injectx.py pip install -r /usr/share/sniper/plugins/BlackWidow/requirements.txt -git clone https://github.com/Dionach/CMSmap.git -git clone https://github.com/0xsauby/yasuo.git -git clone https://github.com/aboul3la/Sublist3r -git clone https://github.com/nccgroup/shocker.git +git clone https://github.com/Dionach/CMSmap.git +git clone https://github.com/0xsauby/yasuo.git +git clone https://github.com/1N3/Sublist3r.git +git clone https://github.com/nccgroup/shocker.git git clone https://github.com/BishopFox/spoofcheck.git -git clone https://github.com/arthepsy/ssh-audit +git clone https://github.com/arthepsy/ssh-audit git clone https://github.com/1N3/jexboss.git git clone https://github.com/maurosoria/dirsearch.git git clone https://github.com/jekyc/wig.git @@ -109,11 +109,11 @@ git clone https://github.com/rbsec/dnscan.git git clone https://github.com/RUB-NDS/CORStest.git git clone https://github.com/christophetd/censys-subdomain-finder.git pip install -r $PLUGINS_DIR/censys-subdomain-finder/requirements.txt -pip3 install -r $PLUGINS_DIR/dnscan/requirements.txt -git clone https://github.com/infosec-au/altdns.git +pip3 install -r $PLUGINS_DIR/dnscan/requirements.txt +git clone https://github.com/infosec-au/altdns.git cd altdns -pip install -r requirements.txt -python2 setup.py install +pip install -r requirements.txt +python2 setup.py install pip install py-altdns cd .. git clone https://github.com/blechschmidt/massdns.git @@ -152,8 +152,8 @@ wget https://raw.githubusercontent.com/1N3/Exploits/master/defcon_webmin_unauth_ wget https://github.com/OJ/gobuster/releases/download/v3.0.1/gobuster-linux-amd64.7z -O /tmp/gobuster.7z cd /tmp/ 7z e gobuster.7z -chmod +rx gobuster -mv gobuster /usr/bin/gobuster +chmod +rx gobuster +mv gobuster /usr/bin/gobuster cd $PLUGINS_DIR wget https://github.com/laramies/theHarvester/archive/3.0.6.tar.gz tar -zxvf 3.0.6.tar.gz @@ -162,7 +162,7 @@ rm -f /usr/bin/theharvester ln -s /usr/share/sniper/plugins/theHarvester-3.0.6/theHarvester.py /usr/bin/theharvester git clone https://github.com/laramies/metagoofil.git git clone https://github.com/achillean/shodan-python -cd shodan-python +cd shodan-python python setup.py install cd .. pip3 install spyse.py diff --git a/modes/discover.sh b/modes/discover.sh index c44e8fc..c00acb0 100644 --- a/modes/discover.sh +++ b/modes/discover.sh @@ -48,12 +48,12 @@ if [[ "$MODE" = "discover" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -v -p $QUICK_PORTS --data-length=50 -sS $TARGET -Pn 2> /dev/null | grep "open port" | tee $LOOT_DIR/ips/sniper-$OUT_FILE-tcp.txt 2>/dev/null + nmap -v -p $QUICK_PORTS $NMAP_OPTIONS -sS $TARGET -Pn 2> /dev/null | grep "open port" | tee $LOOT_DIR/ips/sniper-$OUT_FILE-tcp.txt 2>/dev/null cat $LOOT_DIR/ips/sniper-$OUT_FILE-tcp.txt | grep open | grep on | awk '{print $6}' > $LOOT_DIR/ips/sniper-$OUT_FILE-tcpips.txt echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING UDP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -v -p $DEFAULT_UDP_PORTS --data-length=50 -sU -Pn $TARGET 2> /dev/null | grep "open port" | tee $LOOT_DIR/ips/sniper-$OUT_FILE-udp.txt 2>/dev/null + nmap -v -p $DEFAULT_UDP_PORTS $NMAP_OPTIONS -sU -Pn $TARGET 2> /dev/null | grep "open port" | tee $LOOT_DIR/ips/sniper-$OUT_FILE-udp.txt 2>/dev/null cat $LOOT_DIR/ips/sniper-$OUT_FILE-udp.txt | grep open | grep on | awk '{print $6}' > $LOOT_DIR/ips/sniper-$OUT_FILE-udpips.txt echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CURRENT TARGETS $RESET" diff --git a/modes/flyover.sh b/modes/flyover.sh index c04fbeb..5bdde76 100644 --- a/modes/flyover.sh +++ b/modes/flyover.sh @@ -65,7 +65,7 @@ if [[ "$MODE" = "flyover" ]]; then webtech -u http://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-http.txt 2> /dev/null & webtech -u https://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-https.txt 2> /dev/null & - nmap -sS --open -Pn --data-length=50 -p $DEFAULT_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null & + nmap -sS --open -Pn $NMAP_OPTIONS -p $DEFAULT_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null & WEBHOST=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null | egrep "80|443" | grep open | wc -l 2> /dev/null) if [[ "$WEBHOST" -gt "0" ]]; then echo "$TARGET" >> $LOOT_DIR/web/webhosts-unsorted.txt 2> /dev/null diff --git a/modes/fullportonly.sh b/modes/fullportonly.sh index b933d6e..32386b3 100644 --- a/modes/fullportonly.sh +++ b/modes/fullportonly.sh @@ -33,7 +33,7 @@ if [[ "$MODE" = "fullportonly" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -v -sV -A -O --data-length=50 --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET + nmap -Pn -v -sV -A -O $NMAP_OPTIONS --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET cp -f $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null @@ -41,21 +41,21 @@ if [[ "$MODE" = "fullportonly" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -sU -sV -A -v --data-length=50 --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport-udp.xml -p $DEFAULT_UDP_PORTS $TARGET + nmap -Pn -sU -sV -A -v $NMAP_OPTIONS --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport-udp.xml -p $DEFAULT_UDP_PORTS $TARGET sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET-udp.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET-udp 2> /dev/null else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -v -sV -A -O --data-length=50 --script=/usr/share/nmap/scripts/vulners -p $PORT -oX $LOOT_DIR/nmap/nmap-$TARGET-tcp-port$PORT.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET + nmap -Pn -v -sV -A -O $NMAP_OPTIONS --script=/usr/share/nmap/scripts/vulners -p $PORT -oX $LOOT_DIR/nmap/nmap-$TARGET-tcp-port$PORT.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null xsltproc $INSTALL_DIR/bin/nmap-bootstrap.xsl $LOOT_DIR/nmap/nmap-$TARGET.xml -o $LOOT_DIR/nmap/nmapreport-$TARGET.html 2> /dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -A -v -sV -sU --data-length=50 --script=/usr/share/nmap/scripts/vulners -p $PORT -Pn -oX $LOOT_DIR/nmap/nmap-$TARGET-udp-port$PORT.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET-udp + nmap -Pn -A -v -sV -sU $NMAP_OPTIONS --script=/usr/share/nmap/scripts/vulners -p $PORT -Pn -oX $LOOT_DIR/nmap/nmap-$TARGET-udp-port$PORT.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET-udp sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET-udp.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET-udp 2> /dev/null fi diff --git a/modes/fullportscan.sh b/modes/fullportscan.sh index 71be25c..60b6eea 100644 --- a/modes/fullportscan.sh +++ b/modes/fullportscan.sh @@ -9,7 +9,7 @@ else if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per full portscan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi - nmap -Pn -v -sV -A -O --data-length=50 --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET + nmap -Pn -v -sV -A -O $NMAP_OPTIONS --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET cp -f $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null @@ -20,7 +20,7 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -sU -sV -A -v --data-length=50 --script=/usr/share/nmap/scripts/vulners -p $DEFAULT_UDP_PORTS -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport-udp.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET-udp + nmap -Pn -sU -sV -A -v $NMAP_OPTIONS --script=/usr/share/nmap/scripts/vulners -p $DEFAULT_UDP_PORTS -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport-udp.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET-udp sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET-udp.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null) diff --git a/modes/normal.sh b/modes/normal.sh index 935806e..83af886 100644 --- a/modes/normal.sh +++ b/modes/normal.sh @@ -78,21 +78,21 @@ echo -e "${OKGREEN}============================================================= echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$MODE" == "web" ]]; then - nmap -sV -Pn -p 80,443 --data-length=50 --open $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | sed -r "s/ /dev/null echo "" fi + if [[ "$SSL_INSECURE" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED CHECKING FOR INSECURE SSL/TLS CONFIGURATIONS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + curl https://$TARGET 2> $LOOT_DIR/web/curldebug-$TARGET.txt > /dev/null + fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" diff --git a/modes/recon.sh b/modes/recon.sh index 05e791c..c85acb5 100644 --- a/modes/recon.sh +++ b/modes/recon.sh @@ -8,6 +8,8 @@ if [[ "$RECON" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$SUBLIST3R" = "1" ]]; then python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null + sed -ie 's/
/\n/g' domains-paypal.com-full.txt 2> /dev/null + mv -f $LOOT_DIR/domains/domains-$TARGET.txte $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null fi if [[ "$AMASS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -34,6 +36,8 @@ if [[ "$RECON" = "1" ]]; then python $PLUGINS_DIR/dnscan/dnscan.py -d $TARGET -w $DOMAINS_QUICK -o $LOOT_DIR/domains/domains-dnscan-$TARGET.txt -i $LOOT_DIR/domains/domains-ips-$TARGET.txt cat $LOOT_DIR/domains/domains-dnscan-$TARGET.txt 2>/dev/null | grep $TARGET| awk '{print $3}' | sort -u >> $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null + sed -ie 's/
/\n/g' $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null + mv -f $LOOT_DIR/domains/domains-$TARGET.txte $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null fi echo "" if [[ "$CRTSH" = "1" ]]; then @@ -48,7 +52,7 @@ if [[ "$RECON" = "1" ]]; then cat $LOOT_DIR/domains/domains-$TARGET-presorted.txt | grep $TARGET | grep TD | sed -e 's///g' | sed -e 's/TD//g' | sed -e 's/BR/\n/g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | grep -v "*" | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt cat $LOOT_DIR/domains/domains-$TARGET-crt.txt echo "" - echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-full.txt" + echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-crt.txt" fi if [[ "$SPYSE" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -63,14 +67,14 @@ if [[ "$RECON" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING CENSYS SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - python $PLUGINS_DIR/censys-subdomain-finder/censys_subdomain_finder.py --censys-api-id $CENSYS_APP_ID --censys-api-secret $CENSYS_API_SECRET $TARGET | egrep "\-" | awk '{print $2}' | tee $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null + python $PLUGINS_DIR/censys-subdomain-finder/censys_subdomain_finder.py --censys-api-id $CENSYS_APP_ID --censys-api-secret $CENSYS_API_SECRET $TARGET | egrep "\-" | awk '{print $2}' | tee $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null fi if [[ "$SHODAN" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SHODAN SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" shodan init $SHODAN_API_KEY - shodan search "hostname:*.$TARGET" > $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null + shodan search "hostname:*.$TARGET" > $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null awk '{print $3}' $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null | grep -v "\;" | tee $LOOT_DIR/domains/domains-$TARGET-shodan-sorted.txt 2> /dev/null awk '{print $1}' $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null >> $LOOT_DIR/ips/ips-all-unsorted.txt 2>/dev/null fi @@ -117,6 +121,8 @@ if [[ "$RECON" = "1" ]]; then cat $LOOT_DIR/ips/massdns-A-records-$TARGET.txt >> $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null fi cat $LOOT_DIR/domains/domains-$TARGET-presorted.txt $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null | sort -u 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-full.txt + sed -ie 's/
/\n/g' $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null + mv -f $LOOT_DIR/domains/domains-$TARGET-full.txte $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null cat $LOOT_DIR/domains/domains-$TARGET-full.txt >> $LOOT_DIR/scans/updated.txt 2> /dev/null #rm -f $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null diff $LOOT_DIR/domains/domains_old-$TARGET.txt $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/domains/domains_new-$TARGET.txt diff --git a/modes/stealth.sh b/modes/stealth.sh index c988a02..7233277 100644 --- a/modes/stealth.sh +++ b/modes/stealth.sh @@ -125,7 +125,7 @@ if [[ "$MODE" = "stealth" ]]; then if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN nmap -sS --open -Pn $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt$RESET" fi - nmap -sS --open --data-length=50 -Pn $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt + nmap -sS --open -Pn $NMAP_OPTIONS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt" fi @@ -440,6 +440,12 @@ if [[ "$MODE" = "stealth" ]]; then sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/sslscan-$TARGET.raw > $LOOT_DIR/web/sslscan-$TARGET.txt 2> /dev/null rm -f $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null fi + if [[ "$SSL_INSECURE" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED CHECKING FOR INSECURE SSL/TLS CONFIGURATIONS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + curl https://$TARGET 2> $LOOT_DIR/web/curldebug-$TARGET.txt > /dev/null + fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" diff --git a/modes/webporthttp.sh b/modes/webporthttp.sh index 92f3976..96d607f 100644 --- a/modes/webporthttp.sh +++ b/modes/webporthttp.sh @@ -71,7 +71,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -Pn --data-length=50 -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-http-$TARGET.xml + nmap -sV -Pn $NMAP_OPTIONS -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-http-$TARGET.xml port_http=`grep 'portid="'$PORT'"' $LOOT_DIR/nmap/nmap-http-$TARGET.xml | grep open` if [[ -z "$port_http" ]]; then echo -e "$OKRED + -- --=[Port $PORT closed... skipping.$RESET" @@ -155,7 +155,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse,/usr/share/nmap/scripts/vulners --script=http-vuln* $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT + nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/vulners --script=http-vuln* $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null fi diff --git a/modes/webporthttps.sh b/modes/webporthttps.sh index 8952fdd..3a9b800 100644 --- a/modes/webporthttps.sh +++ b/modes/webporthttps.sh @@ -71,7 +71,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -Pn --data-length=50 -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-https-$TARGET.xml + nmap -sV -Pn $NMAP_OPTIONS -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-https-$TARGET.xml port_https=`grep 'portid="'$PORT'"' $LOOT_DIR/nmap/nmap-https-$TARGET.xml | grep open` if [[ -z "$port_https" ]]; then @@ -137,6 +137,12 @@ if [[ "$MODE" = "webporthttps" ]]; then rm -f $LOOT_DIR/web/sslscan-$TARGET-$PORT.raw 2> /dev/null echo "" fi + if [[ "$SSL_INSECURE" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED CHECKING FOR INSECURE SSL/TLS CONFIGURATIONS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + curl https://$TARGET:$PORT 2> $LOOT_DIR/web/curldebug-$TARGET-$PORT.txt > /dev/null + fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -165,7 +171,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse --script=http-vuln*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT + nmap -A -Pn -T5 -p $PORT -sV --script=http-vuln*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null fi diff --git a/sniper.conf b/sniper.conf index 76f30bc..9c94fdd 100644 --- a/sniper.conf +++ b/sniper.conf @@ -55,6 +55,7 @@ CENSYS_API_SECRET="" HUNTERIO_KEY="" # SLACK API +SLACK_API_TOKEN="" SLACK_NOTIFICATIONS="0" SLACK_NOTIFICATIONS_THEHARVESTER="0" SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" @@ -107,6 +108,7 @@ THREADS="20" # NETWORK PLUGINS NMAP_SCRIPTS="1" +NMAP_OPTIONS="--data-length=50" METASPLOIT_EXPLOIT="1" SSH_AUDIT="1" SSH_ENUM="1" @@ -148,6 +150,7 @@ WIG="1" SHOCKER="1" JEXBOSS="1" WEBTECH="1" +SSL_INSECURE="1" # ACTIVE WEB BRUTE FORCE STAGES WEB_BRUTE_STEALTHSCAN="1"