RomanNum3ral
/
Sn1per
mirror of https://github.com/1N3/Sn1per.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* v9.0 - Added RabbitMQ Management Interface Detected sc0pe template 

* v9.0 - Added CVE-2020-29583 Zyxel SSH Hardcoded Credentials via BruteX
* v9.0 - Removed vulnscan NMap CSV updates/downloads to save space/bandwidth
* v9.0 - Added Nuclei sc0pe parser
* v9.0 - Added Nuclei vulnerability scanner
* v9.0 - Added Wordpress WPScan sc0pe vulnerability parser
* v9.0 - Fixed issue with wrong WPscan API key command
* v9.0 - Added CVE-2020-11738 - WordPress Duplicator plugin Directory Traversal sc0pe template
This commit is contained in:
@xer0dayz 2021-01-04 09:15:06 -07:00 committed by xer0dayz
parent 3aac6ec64e
commit 95fc0361b0
7 changed files with 80 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
CHANGELOG.md
View File

@ -1,9 +1,18 @@
## CHANGELOG: ## CHANGELOG:
* v9.0 - Added RabbitMQ Management Interface Detected sc0pe template
* v9.0 - Added CVE-2020-29583 Zyxel SSH Hardcoded Credentials via BruteX
* v9.0 - Removed vulnscan NMap CSV updates/downloads to save space/bandwidth
* v9.0 - Added Nuclei sc0pe parser
* v9.0 - Added Nuclei vulnerability scanner
* v9.0 - Added Wordpress WPScan sc0pe vulnerability parser
* v9.0 - Fixed issue with wrong WPscan API key command
* v9.0 - Added CVE-2020-11738 - WordPress Duplicator plugin Directory Traversal sc0pe template
* v8.9 - Tuned sniper.conf around performance for all scans and recon modes * v8.9 - Tuned sniper.conf around performance for all scans and recon modes
* v8.9 - Added out of scope options to config * v8.9 - Added out of scope options to config
* v8.9 - Added automatic HTTP/HTTPS web scans and vulnerability scans to 'normal' mode * v8.9 - Added automatic HTTP/HTTPS web scans and vulnerability scans to 'normal' mode
* v8.9 - Added SolarWinds Orion Panel Default Credentials sc0pe template * v8.9 - Added SolarWinds Orion Panel Default Credentials sc0pe template
* v8.9 - Added SolarWinds Orion Panel sc0pe template * v8.9 - Added SolarWinds Orion Panel sc0pe template
* v8.9 - Fixed issue with UDP port scans not working
* v8.9 - Fixed issue with theHarvester not running on Kali 2020.4 * v8.9 - Fixed issue with theHarvester not running on Kali 2020.4
* v8.9 - Added WPScan API support * v8.9 - Added WPScan API support
* v8.9 - Added CVE-2020-8209 - XenMobile-Citrix Endpoint Management Config Password Disclosure sc0pe template * v8.9 - Added CVE-2020-8209 - XenMobile-Citrix Endpoint Management Config Password Disclosure sc0pe template

19
install.sh
View File

@ -60,8 +60,8 @@ if [[ $UBUNTU_CHECK == "DISTRIB_ID=Ubuntu" ]]; then
cp /root/.Xauthority /root/.Xauthority.bak 2> /dev/null cp /root/.Xauthority /root/.Xauthority.bak 2> /dev/null
cp -a /run/user/1000/gdm/Xauthority /root/.Xauthority 2> /dev/null cp -a /run/user/1000/gdm/Xauthority /root/.Xauthority 2> /dev/null
cp -a /home/user/.Xauthority /root/.Xauthority 2> /dev/null cp -a /home/user/.Xauthority /root/.Xauthority 2> /dev/null
chown root /root/.Xauthority chown root /root/.Xauthority 2> /dev/null
XAUTHORITY=/root/.Xauthority XAUTHORITY=/root/.Xauthority 2> /dev/null
snap install chromium 2> /dev/null snap install chromium 2> /dev/null
ln -s /snap/bin/chromium /usr/bin/chromium 2> /dev/null ln -s /snap/bin/chromium /usr/bin/chromium 2> /dev/null
xhost + 2> /dev/null xhost + 2> /dev/null
@ -170,6 +170,7 @@ git clone https://github.com/achillean/shodan-python
git clone https://github.com/Dionach/CMSmap.git git clone https://github.com/Dionach/CMSmap.git
git clone https://github.com/defparam/smuggler.git git clone https://github.com/defparam/smuggler.git
cd $PLUGINS_DIR
cd LinkFinder cd LinkFinder
python setup.py install python setup.py install
cd .. cd ..
@ -188,6 +189,9 @@ cd dnsgen
pip3 install -r requirements.txt pip3 install -r requirements.txt
python3 setup.py install python3 setup.py install
cd .. cd ..
GO111MODULE=on go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei
ln -s /root/go/bin/nuclei /usr/local/bin/nuclei 2> /dev/null
nuclei -update-directory /usr/share/sniper/plugins/ -update-templates
pip3 install -U webtech pip3 install -U webtech
cd ~/go/bin/;go get github.com/haccer/subjack cd ~/go/bin/;go get github.com/haccer/subjack
cd ~/go/bin/;go get -u github.com/Ice3man543/SubOver; mv SubOver /usr/local/bin/subover cd ~/go/bin/;go get -u github.com/Ice3man543/SubOver; mv SubOver /usr/local/bin/subover
@ -210,17 +214,6 @@ cd ~/go/bin; wget https://github.com/projectdiscovery/subfinder/releases/downloa
cd /usr/share/nmap/scripts/ cd /usr/share/nmap/scripts/
rm -f /usr/share/nmap/scripts/vulners.nse rm -f /usr/share/nmap/scripts/vulners.nse
wget https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/vulners.nse wget https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/vulners.nse
mkdir -p /usr/share/nmap/vulscan/ 2> /dev/null
cd /usr/share/nmap/vulscan/ 2> /dev/null
rm -f *.csv 2> /dev/null
wget https://www.computec.ch/projekte/vulscan/download/cve.csv
wget https://www.computec.ch/projekte/vulscan/download/exploitdb.csv
wget https://www.computec.ch/projekte/vulscan/download/openvas.csv
wget https://www.computec.ch/projekte/vulscan/download/osvdb.csv
wget https://www.computec.ch/projekte/vulscan/download/scipvuldb.csv
wget https://www.computec.ch/projekte/vulscan/download/securityfocus.csv
wget https://www.computec.ch/projekte/vulscan/download/securitytracker.csv
wget https://www.computec.ch/projekte/vulscan/download/xforce.csv
mkdir -p ~/.msf4/modules/exploits/web mkdir -p ~/.msf4/modules/exploits/web
wget https://raw.githubusercontent.com/1N3/Exploits/master/defcon_webmin_unauth_rce.rb -O ~/.msf4/modules/exploits/web/defcon_webmin_unauth_rce.rb wget https://raw.githubusercontent.com/1N3/Exploits/master/defcon_webmin_unauth_rce.rb -O ~/.msf4/modules/exploits/web/defcon_webmin_unauth_rce.rb
wget https://github.com/OJ/gobuster/releases/download/v3.0.1/gobuster-linux-amd64.7z -O /tmp/gobuster.7z wget https://github.com/OJ/gobuster/releases/download/v3.0.1/gobuster-linux-amd64.7z -O /tmp/gobuster.7z

19
modes/normal_webporthttp.sh
View File

@ -1,4 +1,4 @@
if [[ "$MODE" = "web" ]]; then wpif [[ "$MODE" = "web" ]]; then
echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
@ -140,16 +140,19 @@ if [[ "$MODE" = "web" ]]; then
echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET"
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
if [[ "$WP_API_KEY" ]]; then if [[ "$WP_API_KEY" ]]; then
wpscan --url http://$TARGET --no-update --disable-tls-checks --api-key $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-httpa.txt wpscan --url http://$TARGET --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port80a.raw
echo "" echo ""
wpscan --url http://$TARGET/wordpress/ --no-update --disable-tls-checks --api-key $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-httpb.txt wpscan --url http://$TARGET/wordpress/ --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port80b.raw
echo "" echo ""
else else
wpscan --url http://$TARGET --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-httpa.txt wpscan --url http://$TARGET --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port80a.raw
echo "" echo ""
wpscan --url http://$TARGET/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-httpb.txt wpscan --url http://$TARGET/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port80b.raw
echo "" echo ""
fi fi
sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-http-port80a.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-http-port80a.txt
sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-http-port80b.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-http-port80b.txt
rm -f $LOOT_DIR/web/wpscan-$TARGET-http*.raw 2> /dev/null
fi fi
if [[ "$NIKTO" == "1" ]]; then if [[ "$NIKTO" == "1" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
@ -181,6 +184,12 @@ if [[ "$MODE" = "web" ]]; then
python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u http://$TARGET | tee $LOOT_DIR/web/smuggler-$TARGET-port80.txt python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u http://$TARGET | tee $LOOT_DIR/web/smuggler-$TARGET-port80.txt
fi fi
if [[ "$NUCLEI" = "1" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
echo -e "$OKRED RUNNING NUCLEI SCAN $RESET"
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
nuclei -silent -t /usr/share/sniper/plugins/nuclei-templates/ -c $THREADS -target http://$TARGET -o $LOOT_DIR/web/nuclei-http-10.0.0.19-port80.txt
fi
rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt

17
modes/normal_webporthttps.sh
View File

@ -137,16 +137,19 @@ if [[ "$MODE" = "web" ]]; then
echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET"
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
if [[ "$WP_API_KEY" ]]; then if [[ "$WP_API_KEY" ]]; then
wpscan --url https://$TARGET --no-update --disable-tls-checks --api-key $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-httpsa.txt wpscan --url https://$TARGET --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port443a.txt
echo "" echo ""
wpscan --url https://$TARGET/wordpress/ --no-update --disable-tls-checks --api-key $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-httpsb.txt wpscan --url https://$TARGET/wordpress/ --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port443b.txt
echo "" echo ""
else else
wpscan --url https://$TARGET --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-httpsa.txt wpscan --url https://$TARGET --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port443a.txt
echo "" echo ""
wpscan --url https://$TARGET/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-httpsb.txt wpscan --url https://$TARGET/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port443b.txt
echo "" echo ""
fi fi
sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-https-port443a.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-https-port443a.txt
sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-https-port443b.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-https-port443b.txt
rm -f $LOOT_DIR/web/wpscan-$TARGET-http*.raw 2> /dev/null
fi fi
if [[ "$NIKTO" == "1" ]]; then if [[ "$NIKTO" == "1" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
@ -177,6 +180,12 @@ if [[ "$MODE" = "web" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u https://$TARGET | tee $LOOT_DIR/web/smuggler-$TARGET-port443.txt python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u https://$TARGET | tee $LOOT_DIR/web/smuggler-$TARGET-port443.txt
fi fi
if [[ "$NUCLEI" = "1" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
echo -e "$OKRED RUNNING NUCLEI SCAN $RESET"
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
nuclei -silent -t /usr/share/sniper/plugins/nuclei-templates/ -c $THREADS -target https://$TARGET -o $LOOT_DIR/web/nuclei-https-10.0.0.19-port443.txt
fi
rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt

19
modes/webporthttp.sh
View File

@ -293,15 +293,18 @@ if [[ "$MODE" = "webporthttp" ]]; then
echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET"
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
if [[ "$WP_API_KEY" ]]; then if [[ "$WP_API_KEY" ]]; then
wpscan --url http://$TARGET:$PORT --no-update --disable-tls-checks --api-key $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTa.txt wpscan --url http://$TARGET:$PORT --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTa.raw
echo "" echo ""
wpscan --url http://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks --api-key $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTb.txt wpscan --url http://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTb.raw
echo "" echo ""
else else
wpscan --url http://$TARGET:$PORT --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTa.txt wpscan --url http://$TARGET:$PORT --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTa.raw
echo "" echo ""
wpscan --url http://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTb.txt wpscan --url http://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTb.raw
fi fi
sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTa.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTa.txt
sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTb.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTb.txt
rm -f $LOOT_DIR/web/wpscan-$TARGET-http*.raw 2> /dev/null
fi fi
if [[ "$NIKTO" == "1" ]]; then if [[ "$NIKTO" == "1" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
@ -338,7 +341,13 @@ if [[ "$MODE" = "webporthttp" ]]; then
echo -e "$OKRED RUNNING HTTP REQUEST SMUGGLING DETECTION $RESET" echo -e "$OKRED RUNNING HTTP REQUEST SMUGGLING DETECTION $RESET"
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u http://$TARGET:$PORT | tee $LOOT_DIR/web/smuggler-$TARGET-port${PORT}.txt python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u http://$TARGET:$PORT | tee $LOOT_DIR/web/smuggler-$TARGET-port${PORT}.txt
fi fi
if [[ "$NUCLEI" = "1" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
echo -e "$OKRED RUNNING NUCLEI SCAN $RESET"
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
nuclei -silent -t /usr/share/sniper/plugins/nuclei-templates/ -c $THREADS -target http://$TARGET:$PORT -o $LOOT_DIR/web/nuclei-http-${TARGET}-port${PORT}.txt
fi
SSL="false" SSL="false"
source $INSTALL_DIR/modes/web_autopwn.sh source $INSTALL_DIR/modes/web_autopwn.sh
source $INSTALL_DIR/modes/osint_stage_2.sh source $INSTALL_DIR/modes/osint_stage_2.sh

17
modes/webporthttps.sh
View File

@ -309,15 +309,18 @@ if [[ "$MODE" = "webporthttps" ]]; then
echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET"
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
if [[ "$WP_API_KEY" ]]; then if [[ "$WP_API_KEY" ]]; then
wpscan --url https://$TARGET:$PORT --no-update --disable-tls-checks --api-key $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTa.txt wpscan --url https://$TARGET:$PORT --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTa.raw
echo "" echo ""
wpscan --url https://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks --api-key $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTb.txt wpscan --url https://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTb.raw
echo "" echo ""
else else
wpscan --url https://$TARGET:$PORT --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTa.txt wpscan --url https://$TARGET:$PORT --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTa.raw
echo "" echo ""
wpscan --url https://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTb.txt wpscan --url https://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTb.raw
fi fi
sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTa.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTa.txt
sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTb.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-https-port$PORTb.txt
rm -f $LOOT_DIR/web/wpscan-$TARGET-http*.raw 2> /dev/null
fi fi
if [[ "$NIKTO" == "1" ]]; then if [[ "$NIKTO" == "1" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
@ -348,6 +351,12 @@ if [[ "$MODE" = "webporthttps" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u https://$TARGET:$PORT | tee $LOOT_DIR/web/smuggler-$TARGET-port${PORT}.txt python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u https://$TARGET:$PORT | tee $LOOT_DIR/web/smuggler-$TARGET-port${PORT}.txt
fi fi
if [[ "$NUCLEI" = "1" ]]; then
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
echo -e "$OKRED RUNNING NUCLEI SCAN $RESET"
echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
nuclei -silent -t /usr/share/sniper/plugins/nuclei-templates/ -c $THREADS -target https://$TARGET:$PORT -o $LOOT_DIR/web/nuclei-https-${TARGET}-port${PORT}.txt
fi
cd $INSTALL_DIR cd $INSTALL_DIR
SSL="true" SSL="true"
source $INSTALL_DIR/modes/web_autopwn.sh source $INSTALL_DIR/modes/web_autopwn.sh

22
sniper
View File

@ -17,7 +17,7 @@ SNIPER_PRO=$INSTALL_DIR/pro.sh
service postgresql start 2> /dev/null service postgresql start 2> /dev/null
# LOAD DEFAULT SNIPER CONFIGURATION FILE # LOAD DEFAULT SNIPER CONFIGURATION FILE
source $INSTALL_DIR/sniper.conf source $INSTALL_DIR/sniper.conf
echo -e "$OKBLUE[*]$RESET Loaded configuration file from $INSTALL_DIR/sniper.conf $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" echo -e "$OKBLUE[*]$RESET Loaded configuration file from $INSTALL_DIR/sniper.conf $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
if [[ -f /root/.sniper.conf ]]; then if [[ -f /root/.sniper.conf ]]; then
@ -31,7 +31,7 @@ if [[ -f /root/.sniper.conf ]]; then
source /root/.sniper_api_keys.conf source /root/.sniper_api_keys.conf
echo -e "$OKBLUE[*]$RESET Loaded API keys from /root/.sniper_api_keys.conf $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" echo -e "$OKBLUE[*]$RESET Loaded API keys from /root/.sniper_api_keys.conf $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
fi fi
else else
# IF NO USER CONFIG PRESENT, CREATE IT FROM THE DEFAULT TEMPLATE # IF NO USER CONFIG PRESENT, CREATE IT FROM THE DEFAULT TEMPLATE
cp $INSTALL_DIR/sniper.conf /root/.sniper.conf 2> /dev/null cp $INSTALL_DIR/sniper.conf /root/.sniper.conf 2> /dev/null
@ -168,7 +168,7 @@ function check_update {
LATEST_VER=$(curl --connect-timeout 5 -s https://api.github.com/repos/1N3/Sn1per/tags | grep -Po '"name":.*?[^\\]",'| head -1 | cut -c11-13) LATEST_VER=$(curl --connect-timeout 5 -s https://api.github.com/repos/1N3/Sn1per/tags | grep -Po '"name":.*?[^\\]",'| head -1 | cut -c11-13)
if [[ "$LATEST_VER" != "$VER" ]]; then if [[ "$LATEST_VER" != "$VER" ]]; then
echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE] sniper v$LATEST_VER is available to download... To update, type$OKRED \"sniper -u\" $RESET" echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE] sniper v$LATEST_VER is available to download... To update, type$OKRED \"sniper -u\" $RESET"
fi fi
fi fi
touch /tmp/update-check.txt 2> /dev/null touch /tmp/update-check.txt 2> /dev/null
} }
@ -246,7 +246,7 @@ case $key in
echo -e "$OKBLUE[*]$RESET Creating backup of existing config to /root/.sniper.conf.bak...$OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" echo -e "$OKBLUE[*]$RESET Creating backup of existing config to /root/.sniper.conf.bak...$OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
cp -f /root/.sniper.conf /root/.sniper.conf.bak cp -f /root/.sniper.conf /root/.sniper.conf.bak
echo -e "$OKBLUE[*]$RESET Copying $CONFIG to /root/.sniper.conf...$OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" echo -e "$OKBLUE[*]$RESET Copying $CONFIG to /root/.sniper.conf...$OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
cp -f $CONFIG /root/.sniper.conf cp -f $CONFIG /root/.sniper.conf
dos2unix /root/.sniper.conf 2> /dev/null > /dev/null dos2unix /root/.sniper.conf 2> /dev/null > /dev/null
source /root/.sniper.conf source /root/.sniper.conf
sleep 1 sleep 1
@ -365,7 +365,7 @@ case $key in
rm -vf $WORKSPACE_DIR/scans/running_$TARGET_*.txt rm -vf $WORKSPACE_DIR/scans/running_$TARGET_*.txt
ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $WORKSPACE_DIR/scans/tasks-running.txt 2> /dev/null ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $WORKSPACE_DIR/scans/tasks-running.txt 2> /dev/null
ps -ef | egrep "$TARGET|sniper" ps -ef | egrep "$TARGET|sniper"
ps -ef | egrep "sniper" | awk '{print $2}' | xargs -i sudo kill -9 {} ps -ef | egrep "sniper" | awk '{print $2}' | xargs -i sudo kill -9 {}
exit exit
shift # past argument shift # past argument
;; ;;
@ -391,7 +391,7 @@ case $key in
exit exit
fi fi
echo "Archiving $WORKSPACE to $INSTALL_DIR/loot/$WORKSPACE.tar" echo "Archiving $WORKSPACE to $INSTALL_DIR/loot/$WORKSPACE.tar"
cd $INSTALL_DIR/loot/workspace/ && tar -cvf ../$WORKSPACE.tar $WORKSPACE cd $INSTALL_DIR/loot/workspace/ && tar -cvf ../$WORKSPACE.tar $WORKSPACE
cp -Rf $WORKSPACE ${WORKSPACE}_`date +"%Y-%m-%d"` cp -Rf $WORKSPACE ${WORKSPACE}_`date +"%Y-%m-%d"`
echo "Done!" echo "Done!"
exit exit
@ -574,11 +574,11 @@ function loot {
wc -l $LOOT_DIR/scans/notifications.txt 2> /dev/null | awk '{print $1}' > $LOOT_DIR/scans/notifications_total.txt 2> /dev/null wc -l $LOOT_DIR/scans/notifications.txt 2> /dev/null | awk '{print $1}' > $LOOT_DIR/scans/notifications_total.txt 2> /dev/null
wc -l $LOOT_DIR/scans/notifications_new.txt 2> /dev/null | awk '{print $1}' > $LOOT_DIR/scans/notifications_new_total.txt 2> /dev/null wc -l $LOOT_DIR/scans/notifications_new.txt 2> /dev/null | awk '{print $1}' > $LOOT_DIR/scans/notifications_new_total.txt 2> /dev/null
cat $LOOT_DIR/scans/tasks-running.txt 2> /dev/null > $LOOT_DIR/scans/tasks-running_total.txt 2> /dev/null cat $LOOT_DIR/scans/tasks-running.txt 2> /dev/null > $LOOT_DIR/scans/tasks-running_total.txt 2> /dev/null
wc -l $LOOT_DIR/scans/tasks.txt 2> /dev/null | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/tasks_total.txt 2> /dev/null wc -l $LOOT_DIR/scans/tasks.txt 2> /dev/null | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/tasks_total.txt 2> /dev/null
wc -l $LOOT_DIR/scans/scheduled/*.sh 2> /dev/null | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/scheduled_tasks_total.txt 2> /dev/null wc -l $LOOT_DIR/scans/scheduled/*.sh 2> /dev/null | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/scheduled_tasks_total.txt 2> /dev/null
grep "Host\ status" $LOOT_DIR/scans/notifications.txt 2> /dev/null | wc -l | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/host_status_changes_total.txt 2> /dev/null grep "Host\ status" $LOOT_DIR/scans/notifications.txt 2> /dev/null | wc -l | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/host_status_changes_total.txt 2> /dev/null
grep "Port\ change" $LOOT_DIR/scans/notifications.txt 2> /dev/null | wc -l | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/port_changes_total.txt 2> /dev/null grep "Port\ change" $LOOT_DIR/scans/notifications.txt 2> /dev/null | wc -l | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/port_changes_total.txt 2> /dev/null
wc -l $LOOT_DIR/domains/domains_new-*.txt 2> /dev/null | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/domain_changes_total.txt 2> /dev/null wc -l $LOOT_DIR/domains/domains_new-*.txt 2> /dev/null | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/domain_changes_total.txt 2> /dev/null
cat $LOOT_DIR/web/dirsearch-new-*.txt $LOOT_DIR/web/spider-new-*.txt 2> /dev/null | wc -l | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/url_changes_total.txt 2> /dev/null cat $LOOT_DIR/web/dirsearch-new-*.txt $LOOT_DIR/web/spider-new-*.txt 2> /dev/null | wc -l | awk '{print $1}' 2> /dev/null > $LOOT_DIR/scans/url_changes_total.txt 2> /dev/null
if [[ -f "$LOOT_DIR/notes/notepad.html" ]]; then if [[ -f "$LOOT_DIR/notes/notepad.html" ]]; then
echo -n "" 2>/dev/null echo -n "" 2>/dev/null