diff --git a/CHANGELOG.md b/CHANGELOG.md index 899e459..554f441 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,10 @@ ## CHANGELOG: +* v7.4 - Disabled crt.sh sub-domain retrieval since service is disabled +* v7.4 - Fixed issue with MassDNS installation +* v7.4 - Fixed issue with AMass not running +* v7.4 - Improved performance of AltDNS/DNSgen/MassDNS retrieval +* v7.4 - Changed webscreenshot.py setting to use chrome browser +* v7.4 - Fixed issue with missing xmlstarlet package for OpenVAS scans * v7.3 - Added CVE-2019-15107 Webmin <= 1.920 - Unauthenticated RCE MSF exploit * v7.3 - Added massdns plugin * v7.3 - Added altdns plugin diff --git a/install.sh b/install.sh index 574439d..8e4c7d3 100755 --- a/install.sh +++ b/install.sh @@ -45,6 +45,7 @@ apt-get install -y libssl-dev 2> /dev/null apt-get install -y python-pip apt-get remove -y python3-pip apt-get install -y python3-pip +apt-get install -y xmlstarlet pip install dnspython colorama tldextract urllib3 ipaddress requests curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.8/install.sh | bash @@ -85,6 +86,9 @@ pip install -r $PLUGINS_DIR/censys-subdomain-finder/requirements.txt pip3 install -r $PLUGINS_DIR/dnscan/requirements.txt git clone https://github.com/infosec-au/altdns.git git clone https://github.com/blechschmidt/massdns.git +cd massdns +make && make install +cd .. git clone https://github.com/ProjectAnte/dnsgen cd dnsgen pip3 install -r requirements.txt @@ -97,11 +101,12 @@ unzip slurp.zip rm -f slurp.zip cd ~/go/bin/;go get github.com/haccer/subjack cd ~/go/bin/;go get -u github.com/Ice3man543/SubOver; mv SubOver /usr/local/bin/subover -rm -Rf ~/go/src/amass_2.9.0_linux_amd64 2> /dev/null -wget https://github.com/OWASP/Amass/releases/download/2.9.0/amass_2.9.0_linux_amd64.zip -O ~/go/src/amass.zip +wget https://github.com/OWASP/Amass/releases/download/v3.1.10/amass_v3.1.10_linux_amd64.zip -O ~/go/src/amass.zip cd ~/go/src/ unzip ~/go/src/amass.zip -ln -s ~/go/src/amass_2.9.0_linux_amd64/amass /usr/local/bin/amass2.9 -f +mv amass_v3.1.10_linux_amd64 amass +cd amass +cp amass /usr/bin/amass -f rm -f ~/go/src/amass.zip cd ~/go/bin;go get -u github.com/subfinder/subfinder; mv subfinder /usr/local/bin/subfinder cd /usr/share/nmap/scripts/ diff --git a/modes/recon.sh b/modes/recon.sh index 378003b..87d9d49 100644 --- a/modes/recon.sh +++ b/modes/recon.sh @@ -13,9 +13,9 @@ if [ "$RECON" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA AMASS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - amass2.9 -ip -brute -active -o $LOOT_DIR/domains/domains-$TARGET-amass.txt -min-for-recursive 3 -d $TARGET 2>/dev/null - cut -d, -f1 $LOOT_DIR/domains/domains-$TARGET-amass.txt 2>/dev/null | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt - cut -d, -f2 $LOOT_DIR/domains/domains-$TARGET-amass.txt 2>/dev/null > $LOOT_DIR/domains/domains-$TARGET-amass-ips-sorted.txt + amass -ip -brute -o $LOOT_DIR/domains/domains-$TARGET-amass.txt -min-for-recursive 3 -d $TARGET 2>/dev/null + cut -d" " -f1 $LOOT_DIR/domains/domains-$TARGET-amass.txt 2>/dev/null | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt + cut -d" " -f2 $LOOT_DIR/domains/domains-$TARGET-amass.txt 2>/dev/null > $LOOT_DIR/domains/domains-$TARGET-amass-ips-sorted.txt fi if [ "$SUBFINDER" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" @@ -67,26 +67,27 @@ if [ "$RECON" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING ALTDNS SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - python2 "$INSTALL_DIR/plugins/altdns/altdns.py" -i /tmp/curl.out -w $INSTALL_DIR/wordlists/altdns.txt -o $LOOT_DIR/domains/domains-$TARGET-altdns.txt 2> /dev/null + python2 $INSTALL_DIR/plugins/altdns/altdns.py -i $LOOT_DIR/domains/domains-$TARGET.txt -w $INSTALL_DIR/wordlists/altdns.txt -o $LOOT_DIR/domains/domains-$TARGET-altdns.txt 2> /dev/null fi if [ "$DNSGEN" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING DNSGEN SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - python3 "$INSTALL_DIR/plugins/dnsgen/dnsgen.py" /tmp/curl.out > $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt 2> /dev/null + python3 $INSTALL_DIR/plugins/dnsgen/dnsgen.py $LOOT_DIR/domains/domains-$TARGET.txt > $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt 2> /dev/null fi if [ "$MASS_DNS" = "1" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING MASSDNS ON SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" sort -u $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt $LOOT_DIR/domains/domains-$TARGET-altdns.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-alldns.txt 2> /dev/null - /usr/share/sniper/plugins/massdns/bin/massdns -s 5000 -r /usr/share/sniper/plugins/massdns/lists/resolvers.txt $LOOT_DIR/domains/domains-$TARGET-alldns.txt -o S -t AAAA -q -w $LOOT_DIR/domains/domains-$TARGET-massdns.txt + massdns -s 5000 -r /usr/share/sniper/plugins/massdns/lists/resolvers.txt $LOOT_DIR/domains/domains-$TARGET-alldns.txt -q -o S -t A -w $LOOT_DIR/domains/domains-$TARGET-massdns.txt awk -F ". " '{print $1}' $LOOT_DIR/domains/domains-$TARGET-massdns.txt | grep -v "*" | sort -u | tee $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt cat $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null >> /tmp/curl.out 2> /dev/null - grep "CNAME" $LOOT_DIR/domains/domains-$TARGET-massdns.txt | awk '{print $3}' | grep -v "*" | sort -u | tee $LOOT_DIR/domains/domains-$TARGET-massdns-CNAME.txt + grep "IN CNAME" $LOOT_DIR/domains/domains-$TARGET-massdns.txt | awk '{print $3}' | grep -v "*" | sort -u | tee $LOOT_DIR/domains/domains-$TARGET-massdns-CNAME.txt grep "A " $LOOT_DIR/domains/domains-$TARGET-massdns.txt | awk '{print $3}' | grep -v "*" | sort -u | tee $LOOT_DIR/domains/domains-$TARGET-massdns-A-records.txt fi sort -u /tmp/curl.out 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-full.txt + cat $LOOT_DIR/domains/domains-$TARGET-full.txt >> $LOOT_DIR/scans/updated.txt 2> /dev/null rm -f /tmp/curl.out 2> /dev/null diff $LOOT_DIR/domains/domains_old-$TARGET.txt $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/domains/domains_new-$TARGET.txt if [ "$SLACK_NOTIFICATIONS_DOMAINS_NEW" == "1" ]; then diff --git a/sniper.conf b/sniper.conf index 673c490..f09f88f 100644 --- a/sniper.conf +++ b/sniper.conf @@ -159,7 +159,7 @@ SUBLIST3R="1" AMASS="1" SUBFINDER="1" DNSCAN="1" -CRTSH="1" +CRTSH="0" SUBOVER="1" PROJECT_SONAR="1" CENSYS_SUBDOMAINS="0"