From c19c9e015d084fd0280fe57578af0dee3120325e Mon Sep 17 00:00:00 2001 From: xer0dayz <1n3@hushmail.com> Date: Wed, 19 Feb 2020 19:12:02 -0700 Subject: [PATCH] Sn1per Community Edition by @xer0dayz - https://xerosecurity.com --- CHANGELOG.md | 6 +- modes/flyover.sh | 10 ++ modes/fullportonly.sh | 11 +- modes/fullportscan.sh | 9 +- modes/normal.sh | 52 +++++++- modes/osint.sh | 10 +- modes/recon.sh | 5 +- modes/web_autopwn.sh | 6 + sniper.conf | 2 + wordlists/web-brute-full.txt | 131 ++++++++++++++++++- wordlists/web-brute-stealth.txt | 165 ++++++++++++++++++------ wordlists/web-brute-vulnerabilities.txt | 131 ++++++++++++++++++- 12 files changed, 482 insertions(+), 56 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 61d1065..9dbb923 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,12 +1,12 @@ ## CHANGELOG: -* v8.2 - Fixed typos and spelling errors in README.md (Shoutz to @paralax) +* v8.2 - Added NMap port change notifications via Slack * v8.2 - Fixed issue with firefox not loading on Kali Linux 2020.1 * v8.2 - Fixed issue with Masswebscan mode not working * v8.2 - Added Rails file exposure exploit CVE-2019-5418 * v8.2 - Updated wordlist selections to fingerprint common vulnerable applications * v8.2 - Added h8mail compromised credentials check to OSINT (-o) mode -* v8.2 - Added Kali XFCE start menu app & icon -* v8.2 - Added check with insecure SSL/TLS connections +* v8.2 - Added Kali start menu app & icon for Sn1per +* v8.2 - Added check for insecure SSL/TLS connections * v8.2 - Added NMAP_OPTIONS setting in ~/.sniper.conf to configure optional NMap settings * v8.2 - Fixed issue with ManageEngine MSF exploit payload * v8.2 - Added Spyse sub-domain enumeration tool (https://github.com/zeropwn/spyse.py) diff --git a/modes/flyover.sh b/modes/flyover.sh index 5bdde76..101bee0 100644 --- a/modes/flyover.sh +++ b/modes/flyover.sh @@ -65,7 +65,17 @@ if [[ "$MODE" = "flyover" ]]; then webtech -u http://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-http.txt 2> /dev/null & webtech -u https://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-https.txt 2> /dev/null & + mv -f $LOOT_DIR/nmap/ports-$TARGET.txt $LOOT_DIR/nmap/ports-$TARGET.old 2> /dev/null nmap -sS --open -Pn $NMAP_OPTIONS -p $DEFAULT_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null & + diff $LOOT_DIR/nmap/ports-$TARGET.old $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null > $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null + + if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]] && [[ -s "$LOOT_DIR/nmap/ports-$TARGET.diff" ]]; then + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/ports-$TARGET.diff" + echo "[xerosecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + cat $LOOT_DIR/nmap/ports-$TARGET.diff | grep "<|>" >> $LOOT_DIR/scans/notifications.txt + fi + WEBHOST=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null | egrep "80|443" | grep open | wc -l 2> /dev/null) if [[ "$WEBHOST" -gt "0" ]]; then echo "$TARGET" >> $LOOT_DIR/web/webhosts-unsorted.txt 2> /dev/null diff --git a/modes/fullportonly.sh b/modes/fullportonly.sh index 32386b3..ec91b9c 100644 --- a/modes/fullportonly.sh +++ b/modes/fullportonly.sh @@ -71,15 +71,24 @@ if [[ "$MODE" = "fullportonly" ]]; then fi sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null - rm -f $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null + mv -f $LOOT_DIR/nmap/ports-$TARGET.txt $LOOT_DIR/nmap/ports-$TARGET.old 2> /dev/null for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt done + diff $LOOT_DIR/nmap/ports-$TARGET.old $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null > $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null + if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt" /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET-udp.txt" fi + + if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]] && [[ -s "$LOOT_DIR/nmap/ports-$TARGET.diff" ]]; then + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/ports-$TARGET.diff" + echo "[xerosecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + cat $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null | grep "<|>" >> $LOOT_DIR/scans/notifications.txt 2> /dev/null + fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" diff --git a/modes/fullportscan.sh b/modes/fullportscan.sh index 60b6eea..9d286a4 100644 --- a/modes/fullportscan.sh +++ b/modes/fullportscan.sh @@ -9,6 +9,7 @@ else if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per full portscan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi + mv -f $LOOT_DIR/nmap/ports-$TARGET.txt $LOOT_DIR/nmap/ports-$TARGET.old 2> /dev/null nmap -Pn -v -sV -A -O $NMAP_OPTIONS --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET cp -f $LOOT_DIR/nmap/nmap-$TARGET-fullport.xml $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null sed -r "s/ /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null @@ -28,14 +29,20 @@ else echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null fi sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null - rm -f $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt done + diff $LOOT_DIR/nmap/ports-$TARGET.old $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null > $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET-udp.txt" fi + if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]] && [[ -s "$LOOT_DIR/nmap/ports-$TARGET.diff" ]];; then + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/ports-$TARGET.diff" + echo "[xerosecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + cat $LOOT_DIR/nmap/ports-$TARGET.diff | grep "<|>" >> $LOOT_DIR/scans/notifications.txt + fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per full portscan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi diff --git a/modes/normal.sh b/modes/normal.sh index 83af886..97aac85 100644 --- a/modes/normal.sh +++ b/modes/normal.sh @@ -25,8 +25,8 @@ if [[ "$REPORT" = "1" ]]; then args="$args --noreport" echo "$TARGET normal `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-normal.txt - echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-normal.txt + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-normal.txt 2> /dev/null + echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running-$TARGET-normal.txt 2> /dev/null if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [normal] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi @@ -77,6 +77,13 @@ echo "" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + + + +mv -f $LOOT_DIR/nmap/ports-$TARGET.txt $LOOT_DIR/nmap/ports-$TARGET.old 2> /dev/null + + + if [[ "$MODE" == "web" ]]; then nmap -sV -Pn -p 80,443 $NMAP_OPTIONS --open $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | sed -r "s/ /dev/null +for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do + echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt +done + + + +HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null) +if [[ ${#HOST_UP} -ge 2 ]]; then + echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null +fi +sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null + + +diff $LOOT_DIR/nmap/ports-$TARGET.old $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null > $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null + + + if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt" fi + + +if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]] && [[ -s "$LOOT_DIR/nmap/ports-$TARGET.diff" ]]; then + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" + /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/ports-$TARGET.diff" + echo "[xerosecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + cat $LOOT_DIR/nmap/ports-$TARGET.diff >> $LOOT_DIR/scans/notifications.txt +fi + + + + echo "" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING INTRUSIVE SCANS $RESET" diff --git a/modes/osint.sh b/modes/osint.sh index 92fc4cc..0ed9c37 100644 --- a/modes/osint.sh +++ b/modes/osint.sh @@ -36,7 +36,7 @@ if [[ "$OSINT" = "1" ]]; then if [[ "$VERBOSE" == "1" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN python2.7 $THEHARVESTER_PATH -d $TARGET -l 100 -b all 2> /dev/null | tee $LOOT_DIR/osint/theharvester-$TARGET.txt 2> /dev/null $RESET" fi - theharvester -d $TARGET -l 100 -b all 2> /dev/null | tee $LOOT_DIR/osint/theharvester-$TARGET.txt 2> /dev/null + theharvester -d $TARGET -l 25 -b all 2> /dev/null | tee $LOOT_DIR/osint/theharvester-$TARGET.txt 2> /dev/null if [[ "$SLACK_NOTIFICATIONS_THEHARVESTER" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/theharvester-$TARGET.txt" @@ -66,7 +66,7 @@ if [[ "$OSINT" = "1" ]]; then echo -e "$OKRED COLLECTING OSINT FROM ONLINE DOCUMENTS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" cd $INSTALL_DIR/plugins/metagoofil/ - python metagoofil.py -d $TARGET -t doc,pdf,xls,csv,txt -l 100 -n 100 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html 2> /dev/null | tee $LOOT_DIR/osint/metagoofil-$TARGET.txt 2> /dev/null + python metagoofil.py -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html 2> /dev/null | tee $LOOT_DIR/osint/metagoofil-$TARGET.txt 2> /dev/null cd $INSTALL_DIR if [[ "$SLACK_NOTIFICATIONS_METAGOOFIL" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/metagoofil-$TARGET.txt" @@ -84,6 +84,12 @@ if [[ "$OSINT" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" msfconsole -x "use auxiliary/gather/search_email_collector; set DOMAIN $TARGET; run; exit y" | tee $LOOT_DIR/osint/msf-emails-$TARGET.txt 2> /dev/null fi + if [[ "$H8MAIL" == "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED CHECKING FOR COMPROMISED CREDENTIALS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + h8mail -q domain --target $TARGET -o $LOOT_DIR/osint/h8mail-$TARGET.csv 2> /dev/null + fi if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi diff --git a/modes/recon.sh b/modes/recon.sh index c85acb5..b536039 100644 --- a/modes/recon.sh +++ b/modes/recon.sh @@ -126,8 +126,11 @@ if [[ "$RECON" = "1" ]]; then cat $LOOT_DIR/domains/domains-$TARGET-full.txt >> $LOOT_DIR/scans/updated.txt 2> /dev/null #rm -f $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null diff $LOOT_DIR/domains/domains_old-$TARGET.txt $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/domains/domains_new-$TARGET.txt - if [[ "$SLACK_NOTIFICATIONS_DOMAINS_NEW" == "1" ]]; then + if [[ "$SLACK_NOTIFICATIONS_DOMAINS_NEW" == "1" ]] && [[ -s "$LOOT_DIR/domains/domains_new-$TARGET.txt" ]]; then + /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• New domains detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/domains/domains_new-$TARGET.txt" + echo "[xerosecurity.com] •?((¯°·._.• New domains detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt + cat $LOOT_DIR/domains/domains_new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications.txt 2> /dev/null fi echo -e "$RESET" if [[ "$SPOOF_CHECK" = "1" ]]; then diff --git a/modes/web_autopwn.sh b/modes/web_autopwn.sh index 7dec0f3..e11fb29 100644 --- a/modes/web_autopwn.sh +++ b/modes/web_autopwn.sh @@ -221,6 +221,12 @@ echo -e "$OKRED RUNNING CITRIX GATEWAY ARBITRARY CODE EXECUTION VULNERABILITY CVE-2019-19781 $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" curl -vk --path-as-is https://$TARGET/vpn/../vpns/ 2>&1 | grep "You don’t have permission to access /vpns/" >/dev/null && echo "VULNERABLE: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt || echo "MITIGATED: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED RUNNING RAILS FILE EXPOSURE EXPLOIT CVE-2019-5418 $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + msfconsole -q -x "use auxiliary/gather/rails_doubletap_file_read; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw + sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.txt 2> /dev/null + rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw 2> /dev/null if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• Finished Sn1per webpwn scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" fi diff --git a/sniper.conf b/sniper.conf index 9c94fdd..dc6dc7d 100644 --- a/sniper.conf +++ b/sniper.conf @@ -69,6 +69,7 @@ SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0" SLACK_NOTIFICATIONS_SPIDER_NEW="0" SLACK_NOTIFICATIONS_WHATWEB="0" SLACK_NOTIFICATIONS_NMAP="0" +SLACK_NOTIFICATIONS_NMAP_DIFF="0" SLACK_NOTIFICATIONS_BRUTEFORCE="0" SLACK_NOTIFICATIONS_WHOIS="0" SLACK_NOTIFICATIONS_METAGOOFIL="0" @@ -133,6 +134,7 @@ EMAILFORMAT="1" ULTRATOOLS="1" URLCRAZY="1" VHOSTS="1" +H8MAIL="1" # ACTIVE WEB PLUGINS BURP_SCAN="0" diff --git a/wordlists/web-brute-full.txt b/wordlists/web-brute-full.txt index 52a611d..eb161da 100644 --- a/wordlists/web-brute-full.txt +++ b/wordlists/web-brute-full.txt @@ -1,4 +1,133 @@ - +$defaultview?Readviewentries +actuator/env +actuator/health +AddressBookJ2WB +AddressBookJ2WE/services/AddressBook +admin +Admin +admin-console +AlbumCatalogWeb +api +AppManagementStatus +asynchPeople/ +.bak +.bashrc +blog +.bzr +CFIDE +CFIDE/administrator/aboutcf.cfm +CFIDE/administrator/enter.cfm +CFIDE/administrator/index.cfm +CFIDE/administrator/welcome.cfm +cgi-bin +clientaccesspolicy.xml +composer.json +computer/ +crossdomain.xml +css +.csv +data +Dockerfile +.DS_Store +elmah.axd +en-US/splunkd/__raw/services/server/info/server-info?output_mode=json +.env +env +errorlog.axd +.git +.git/config +.gitignore +global-protect/portal/css/login.css +gulpfile.js +heapdump +.hg +home +host-manager/html +.htaccess +.htaccess.bak +.htpasswd +images +img +index +index.asp +index.aspx +index.htm +index.html +index.jsp +index.php +invoker/EJBInvokerServlet +invoker/JMXInvokerServlet +jmx-console +jmx-console/HtmlAdaptor +js +Makefile +manager/html +package.json +phpinfo.php +phpmyadmin +phpMyAdmin +phpMyAdmin/scripts/setup.php +portal +portal/info.jsp +pview/ +readme.md +readme.txt +register/check/username?username=thisaccountdoesntexist +robots.txt +script +scripts +secure/ManageFilters.jspa +securityRealm/createAccount +server-info +server-manager/html +server-status +signup +sitemap.xml +.ssh +status +.svn +systemInfo +test +tomcat/manager/html +trace +Trace.axd +.travis.yml +upload +uploads +user +userContent/ +users +view/All/builds +view/All/newjob +_vti_bin/ +_vti_bin/sites.asmx?wsdl +_vti_bin/spsdisco.aspx +_vti_inf.html +_vti_pvt/service.cnf +web.config +web-console +web-console/Invoker +webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/ACreate +webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/com.sap.caf.eu.gp.example.timeoff.wd.create.ACreate +wls-wsat/CoordinatorPortType +wls-wsat/CoordinatorPortType11 +wls-wsat/ParticipantPortType +wls-wsat/ParticipantPortType11 +wls-wsat/RegistrationPortTypeRPC +wls-wsat/RegistrationPortTypeRPC11 +wls-wsat/RegistrationRequesterPortType +wls-wsat/RegistrationRequesterPortType11 +wordpress +wp +wp-admin +wp-config.php~ +wp-content/plugins/easy-wp-smtp/ +wp-content/plugins/easy-wp-smtp/css/style.css +wp-content/plugins/easy-wp-smtp/inc/ +wp-content/plugins/easy-wp-smtp/readme.txt +wp-json/wp/v2/users +wp-login.php?action=register +xmlrpc.php ! !! !-! diff --git a/wordlists/web-brute-stealth.txt b/wordlists/web-brute-stealth.txt index b66bc82..0a43d95 100644 --- a/wordlists/web-brute-stealth.txt +++ b/wordlists/web-brute-stealth.txt @@ -1,47 +1,130 @@ -index -index.asp -index.html -index.htm -index.jsp -index.aspx -index.php -sitemap.xml -robots.txt -cgi-bin -phpmyadmin -phpMyAdmin -.env -.git -.svn -.bashrc -.ssh -wordpress -wp -images -img -css -blog -upload -uploads -scripts -api -home -user -users +$defaultview?Readviewentries +actuator/env +actuator/health +AddressBookJ2WB +AddressBookJ2WE/services/AddressBook admin Admin -data -portal -js -.git/config -.travis.yml -Makefile -Dockerfile -package.json -gulpfile.js +admin-console +AlbumCatalogWeb +api +AppManagementStatus +asynchPeople/ +.bak +.bashrc +blog +.bzr +CFIDE +CFIDE/administrator/aboutcf.cfm +CFIDE/administrator/enter.cfm +CFIDE/administrator/index.cfm +CFIDE/administrator/welcome.cfm +cgi-bin +clientaccesspolicy.xml composer.json -web.config +computer/ +crossdomain.xml +css +.csv +data +Dockerfile .DS_Store +elmah.axd +en-US/splunkd/__raw/services/server/info/server-info?output_mode=json +.env +env +errorlog.axd +.git +.git/config +.gitignore +global-protect/portal/css/login.css +gulpfile.js +heapdump +.hg +home +host-manager/html +.htaccess +.htaccess.bak +.htpasswd +images +img +index +index.asp +index.aspx +index.htm +index.html +index.jsp +index.php +invoker/EJBInvokerServlet +invoker/JMXInvokerServlet +jmx-console +jmx-console/HtmlAdaptor +js +Makefile +manager/html +package.json +phpinfo.php +phpmyadmin +phpMyAdmin +phpMyAdmin/scripts/setup.php +portal +portal/info.jsp +pview/ readme.md readme.txt -.gitignore \ No newline at end of file +register/check/username?username=thisaccountdoesntexist +robots.txt +script +scripts +secure/ManageFilters.jspa +securityRealm/createAccount +server-info +server-manager/html +server-status +signup +sitemap.xml +.ssh +status +.svn +systemInfo +test +tomcat/manager/html +trace +Trace.axd +.travis.yml +upload +uploads +user +userContent/ +users +view/All/builds +view/All/newjob +_vti_bin/ +_vti_bin/sites.asmx?wsdl +_vti_bin/spsdisco.aspx +_vti_inf.html +_vti_pvt/service.cnf +web.config +web-console +web-console/Invoker +webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/ACreate +webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/com.sap.caf.eu.gp.example.timeoff.wd.create.ACreate +wls-wsat/CoordinatorPortType +wls-wsat/CoordinatorPortType11 +wls-wsat/ParticipantPortType +wls-wsat/ParticipantPortType11 +wls-wsat/RegistrationPortTypeRPC +wls-wsat/RegistrationPortTypeRPC11 +wls-wsat/RegistrationRequesterPortType +wls-wsat/RegistrationRequesterPortType11 +wordpress +wp +wp-admin +wp-config.php~ +wp-content/plugins/easy-wp-smtp/ +wp-content/plugins/easy-wp-smtp/css/style.css +wp-content/plugins/easy-wp-smtp/inc/ +wp-content/plugins/easy-wp-smtp/readme.txt +wp-json/wp/v2/users +wp-login.php?action=register +xmlrpc.php \ No newline at end of file diff --git a/wordlists/web-brute-vulnerabilities.txt b/wordlists/web-brute-vulnerabilities.txt index 3e0b865..ad3f9f5 100644 --- a/wordlists/web-brute-vulnerabilities.txt +++ b/wordlists/web-brute-vulnerabilities.txt @@ -1,4 +1,133 @@ - +$defaultview?Readviewentries +actuator/env +actuator/health +AddressBookJ2WB +AddressBookJ2WE/services/AddressBook +admin +Admin +admin-console +AlbumCatalogWeb +api +AppManagementStatus +asynchPeople/ +.bak +.bashrc +blog +.bzr +CFIDE +CFIDE/administrator/aboutcf.cfm +CFIDE/administrator/enter.cfm +CFIDE/administrator/index.cfm +CFIDE/administrator/welcome.cfm +cgi-bin +clientaccesspolicy.xml +composer.json +computer/ +crossdomain.xml +css +.csv +data +Dockerfile +.DS_Store +elmah.axd +en-US/splunkd/__raw/services/server/info/server-info?output_mode=json +.env +env +errorlog.axd +.git +.git/config +.gitignore +global-protect/portal/css/login.css +gulpfile.js +heapdump +.hg +home +host-manager/html +.htaccess +.htaccess.bak +.htpasswd +images +img +index +index.asp +index.aspx +index.htm +index.html +index.jsp +index.php +invoker/EJBInvokerServlet +invoker/JMXInvokerServlet +jmx-console +jmx-console/HtmlAdaptor +js +Makefile +manager/html +package.json +phpinfo.php +phpmyadmin +phpMyAdmin +phpMyAdmin/scripts/setup.php +portal +portal/info.jsp +pview/ +readme.md +readme.txt +register/check/username?username=thisaccountdoesntexist +robots.txt +script +scripts +secure/ManageFilters.jspa +securityRealm/createAccount +server-info +server-manager/html +server-status +signup +sitemap.xml +.ssh +status +.svn +systemInfo +test +tomcat/manager/html +trace +Trace.axd +.travis.yml +upload +uploads +user +userContent/ +users +view/All/builds +view/All/newjob +_vti_bin/ +_vti_bin/sites.asmx?wsdl +_vti_bin/spsdisco.aspx +_vti_inf.html +_vti_pvt/service.cnf +web.config +web-console +web-console/Invoker +webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/ACreate +webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/com.sap.caf.eu.gp.example.timeoff.wd.create.ACreate +wls-wsat/CoordinatorPortType +wls-wsat/CoordinatorPortType11 +wls-wsat/ParticipantPortType +wls-wsat/ParticipantPortType11 +wls-wsat/RegistrationPortTypeRPC +wls-wsat/RegistrationPortTypeRPC11 +wls-wsat/RegistrationRequesterPortType +wls-wsat/RegistrationRequesterPortType11 +wordpress +wp +wp-admin +wp-config.php~ +wp-content/plugins/easy-wp-smtp/ +wp-content/plugins/easy-wp-smtp/css/style.css +wp-content/plugins/easy-wp-smtp/inc/ +wp-content/plugins/easy-wp-smtp/readme.txt +wp-json/wp/v2/users +wp-login.php?action=register +xmlrpc.php %3Cinvalid%3Ehello.html %3Cscript%3Ealert%281%29%3C/script%3E.html ../../../../etc/passwd