diff --git a/CHANGELOG.md b/CHANGELOG.md index 56cb7bc..08fc649 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,5 @@ ## CHANGELOG: +* v8.2 - Added Spyse sub-domain enumeration tool (https://github.com/zeropwn/spyse.py) * v8.2 - Fixed issue with Subjack (open /src/github.com/haccer/subjack/fingerprints.json: no such file or directory) * v8.1 - Added Citrix Gateway Arbitary Code Execution CVE-2019-19781 vulnerability detection * v8.1 - Added Pulse Secure VPN Arbitrary File Disclosure CVE-2019-11510 exploit diff --git a/install.sh b/install.sh index 40eeadf..3cd395f 100755 --- a/install.sh +++ b/install.sh @@ -90,17 +90,18 @@ mkdir -p $GO_DIR 2> /dev/null echo -e "$OKORANGE + -- --=[ Downloading extensions...$RESET" git clone https://github.com/1N3/BruteX.git -git clone https://github.com/1N3/Goohak.git +git clone https://github.com/1N3/Findsploit.git +git clone https://github.com/1N3/Goohak.git git clone https://github.com/1N3/BlackWidow -cp /usr/share/sniper/plugins/BlackWidow/blackwidow /usr/bin/blackwidow +cp /usr/share/sniper/plugins/BlackWidow/blackwidow /usr/bin/blackwidow cp /usr/share/sniper/plugins/BlackWidow/injectx.py /usr/bin/injectx.py pip install -r /usr/share/sniper/plugins/BlackWidow/requirements.txt -git clone https://github.com/Dionach/CMSmap.git -git clone https://github.com/0xsauby/yasuo.git -git clone https://github.com/aboul3la/Sublist3r.git -git clone https://github.com/nccgroup/shocker.git +git clone https://github.com/Dionach/CMSmap.git +git clone https://github.com/0xsauby/yasuo.git +git clone https://github.com/aboul3la/Sublist3r +git clone https://github.com/nccgroup/shocker.git git clone https://github.com/BishopFox/spoofcheck.git -git clone https://github.com/arthepsy/ssh-audit +git clone https://github.com/arthepsy/ssh-audit git clone https://github.com/1N3/jexboss.git git clone https://github.com/maurosoria/dirsearch.git git clone https://github.com/jekyc/wig.git @@ -108,11 +109,11 @@ git clone https://github.com/rbsec/dnscan.git git clone https://github.com/RUB-NDS/CORStest.git git clone https://github.com/christophetd/censys-subdomain-finder.git pip install -r $PLUGINS_DIR/censys-subdomain-finder/requirements.txt -pip3 install -r $PLUGINS_DIR/dnscan/requirements.txt -git clone https://github.com/infosec-au/altdns.git +pip3 install -r $PLUGINS_DIR/dnscan/requirements.txt +git clone https://github.com/infosec-au/altdns.git cd altdns -pip install -r requirements.txt -python2 setup.py install +pip install -r requirements.txt +python2 setup.py install pip install py-altdns cd .. git clone https://github.com/blechschmidt/massdns.git @@ -151,8 +152,8 @@ wget https://raw.githubusercontent.com/1N3/Exploits/master/defcon_webmin_unauth_ wget https://github.com/OJ/gobuster/releases/download/v3.0.1/gobuster-linux-amd64.7z -O /tmp/gobuster.7z cd /tmp/ 7z e gobuster.7z -chmod +rx gobuster -mv gobuster /usr/bin/gobuster +chmod +rx gobuster +mv gobuster /usr/bin/gobuster cd $PLUGINS_DIR wget https://github.com/laramies/theHarvester/archive/3.0.6.tar.gz tar -zxvf 3.0.6.tar.gz @@ -161,13 +162,15 @@ rm -f /usr/bin/theharvester ln -s /usr/share/sniper/plugins/theHarvester-3.0.6/theHarvester.py /usr/bin/theharvester git clone https://github.com/laramies/metagoofil.git git clone https://github.com/achillean/shodan-python -cd shodan-python +cd shodan-python python setup.py install cd .. +pip3 install spyse.py echo -e "$OKORANGE + -- --=[ Setting up environment...$RESET" mv ~/.sniper.conf ~/.sniper.conf.old 2> /dev/null cp $INSTALL_DIR/sniper.conf ~/.sniper.conf 2> /dev/null cd $PLUGINS_DIR/BruteX/ && bash install.sh 2> /dev/null +cd $PLUGINS_DIR/Findsploit/ && bash install.sh 2> /dev/null cd $PLUGINS_DIR/spoofcheck/ && pip install -r requirements.txt 2> /dev/null cd $PLUGINS_DIR/CMSmap/ && pip3 install . && python3 setup.py install cd $INSTALL_DIR diff --git a/modes/recon.sh b/modes/recon.sh index 5ed0975..05e791c 100644 --- a/modes/recon.sh +++ b/modes/recon.sh @@ -50,18 +50,27 @@ if [[ "$RECON" = "1" ]]; then echo "" echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-full.txt" fi + if [[ "$SPYSE" = "1" ]]; then + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKRED GATHERING SPYSE SUBDOMAINS $RESET" + echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" + echo -e "$OKBLUE" + spyse -target $TARGET --subdomains | grep $TARGET | tee $LOOT_DIR/domains/domains-$TARGET-spyse.txt + echo "" + echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-spyse.txt" + fi if [[ "$CENSYS_SUBDOMAINS" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING CENSYS SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - python $PLUGINS_DIR/censys-subdomain-finder/censys_subdomain_finder.py --censys-api-id $CENSYS_APP_ID --censys-api-secret $CENSYS_API_SECRET $TARGET | egrep "\-" | awk '{print $2}' | tee $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null + python $PLUGINS_DIR/censys-subdomain-finder/censys_subdomain_finder.py --censys-api-id $CENSYS_APP_ID --censys-api-secret $CENSYS_API_SECRET $TARGET | egrep "\-" | awk '{print $2}' | tee $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null fi if [[ "$SHODAN" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING SHODAN SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" shodan init $SHODAN_API_KEY - shodan search "hostname:*.$TARGET" > $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null + shodan search "hostname:*.$TARGET" > $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null awk '{print $3}' $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null | grep -v "\;" | tee $LOOT_DIR/domains/domains-$TARGET-shodan-sorted.txt 2> /dev/null awk '{print $1}' $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null >> $LOOT_DIR/ips/ips-all-unsorted.txt 2>/dev/null fi @@ -69,9 +78,10 @@ if [[ "$RECON" = "1" ]]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED GATHERING PROJECT SONAR SUBDOMAINS $RESET" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" - curl -fsSL "https://dns.bufferover.run/dns?q=.$TARGET" | sed 's/\"//g' | cut -f2 -d "," |sort -u | grep $TARGET | tee $LOOT_DIR/domains/domains-$TARGET-projectsonar.txt 2> /dev/null + curl -fsSL "https://dns.bufferover.run/dns?q=.$TARGET" | sed 's/\"//g' | cut -f2 -d "," | grep -v "
" | sort -u | grep $TARGET | tee $LOOT_DIR/domains/domains-$TARGET-projectsonar.txt 2> /dev/null fi cat $LOOT_DIR/domains/domains-$TARGET-crt.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null + cat $LOOT_DIR/domains/domains-$TARGET-spyse.txt /dev/null > $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null cat $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null cat $LOOT_DIR/domains/domains-$TARGET-subfinder.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null diff --git a/sniper.conf b/sniper.conf index e88287d..76f30bc 100644 --- a/sniper.conf +++ b/sniper.conf @@ -133,7 +133,7 @@ URLCRAZY="1" VHOSTS="1" # ACTIVE WEB PLUGINS -BURP_SCAN="1" +BURP_SCAN="0" ARACHNI_SCAN="1" DIRSEARCH="1" GOBUSTER="0" @@ -184,3 +184,4 @@ MASS_DNS="0" DNSGEN="0" SHODAN="0" ASN_CHECK="1" +SPYSE="1"