EyeWitness
"; 23 | 24 | html += "
| " + (string)entry.Value.ElementAt(0) + 30 | " | " + (int)entry.Value.ElementAt(1) + " |
| " + "Total Pages Screenshotted" + " | " + totalPages + " |
36 | 37 | "; 38 | } 39 | 40 | else 41 | { 42 | html += @" 43 | 44 |
"; 49 | html += "
";
59 | tempHtmlOutput += "" + incomingServer.remoteSystem + "\n
"; 60 | tempHtmlOutput += "
Page Title: " + incomingServer.webpageTitle + "
\n\n"; 61 | tempHtmlOutput += "
Headers: \n\n"; 62 | 63 | // Split the header string into lines and make the variable bold 64 | foreach (string line in incomingServer.headers.Split(new[] { Environment.NewLine }, StringSplitOptions.None)) 65 | { 66 | if (line.Contains(":")) 67 | { 68 | string[] element = line.Split(new[] { ':' }, 2, StringSplitOptions.None); 69 | //Escape any bad chars passed as a header 70 | tempHtmlOutput += "
" + SecurityElement.Escape(element[0]) + ": " + SecurityElement.Escape(element[1]); 71 | } 72 | } 73 | 74 | if (incomingServer.defaultCreds != null) 75 | { 76 | tempHtmlOutput += "
" + incomingServer.defaultCreds; 77 | } 78 | 79 | tempHtmlOutput += "
Source Code
"; 60 | tempHtmlOutput += "
Page Title: " + incomingServer.webpageTitle + "
\n\n"; 61 | tempHtmlOutput += "
Headers: \n\n"; 62 | 63 | // Split the header string into lines and make the variable bold 64 | foreach (string line in incomingServer.headers.Split(new[] { Environment.NewLine }, StringSplitOptions.None)) 65 | { 66 | if (line.Contains(":")) 67 | { 68 | string[] element = line.Split(new[] { ':' }, 2, StringSplitOptions.None); 69 | //Escape any bad chars passed as a header 70 | tempHtmlOutput += "
" + SecurityElement.Escape(element[0]) + ": " + SecurityElement.Escape(element[1]); 71 | } 72 | } 73 | 74 | if (incomingServer.defaultCreds != null) 75 | { 76 | tempHtmlOutput += "
" + incomingServer.defaultCreds; 77 | } 78 | 79 | tempHtmlOutput += "
Source Code
\n"; 81 | tempHtmlOutput += "
" + category + " |
|---|
| Web Request Info | 99 |Web Screenshot |
|---|---|
"; //close out the category table and the screenshot/source table 111 | 112 | if (pageNumber != 0) 113 | html += BuildPages(pageNumbersTotal); 114 | 115 | File.WriteAllText(witnessDir + "\\report_page" + pageNumber + ".html", html); 116 | } 117 | 118 | public string BuildPages(int totalPageNumbers) 119 | { 120 | string htmlForPages = ""; 121 | int pageNumbers = (int)Math.Ceiling((double)totalPageNumbers / 25); 122 | 123 | htmlForPages += "
Page 1"; 124 | 125 | for (int page = 2; page <= pageNumbers; page++) 126 | htmlForPages += " Page " + page + " "; 127 | 128 | htmlForPages += "\n
Potential Default Creds: " + 46 | SecurityElement.Escape(sigDict[entry.Key]); 47 | } 48 | // If the line in signatures.txt only has one check (no simicolons) 49 | else 50 | { 51 | if (_sourceCode.Contains(entry.Key)) 52 | defaultCreds += "
Potential Default Creds: " + 53 | SecurityElement.Escape(sigDict[entry.Key]); 54 | } 55 | } 56 | 57 | foreach (KeyValuePair
| Web Request Info | 366 |Web Screenshot | 367 |
|---|
") 396 | pages.append(html) 397 | html = u"" + table_head 398 | counter += 1 399 | 400 | if html != u"": 401 | html = (web_index_head + html + "
") 402 | pages.append(html) 403 | 404 | if len(pages) == 1: 405 | with open(os.path.join(cli_parsed.d, 'search.html'), 'a') as f: 406 | f.write(pages[0].replace('EW_REPLACEME', '')) 407 | f.write("\n") 408 | else: 409 | num_pages = len(pages) + 1 410 | bottom_text = "\n
" 411 | bottom_text += (" Page 1") 412 | # Generate our header/footer data here 413 | for i in range(2, num_pages): 414 | bottom_text += (" Page {0}").format( 415 | str(i)) 416 | bottom_text += "
' + headfoot + '' 443 | 444 | # Write out our report to disk! 445 | if len(pages) == 0: 446 | return 447 | with open(os.path.join(cli_parsed.d, 'search.html'), 'a') as f: 448 | try: 449 | f.write(pages[0]) 450 | except UnicodeEncodeError: 451 | f.write(pages[0].encode('utf-8')) 452 | for i in range(2, len(pages) + 1): 453 | with open(os.path.join(cli_parsed.d, 'search_page{0}.html'.format(str(i))), 'w') as f: 454 | try: 455 | f.write(pages[i - 1]) 456 | except UnicodeEncodeError: 457 | f.write(pages[i - 1].encode('utf-8')) 458 | -------------------------------------------------------------------------------- /Python/modules/selenium_module.py: -------------------------------------------------------------------------------- 1 | import http.client 2 | import os 3 | import socket 4 | import sys 5 | import urllib.request 6 | import urllib.error 7 | import ssl 8 | 9 | try: 10 | from ssl import CertificateError as sslerr 11 | except: 12 | from ssl import SSLError as sslerr 13 | 14 | try: 15 | from selenium import webdriver 16 | from selenium.webdriver.firefox.options import Options 17 | from selenium.common.exceptions import NoAlertPresentException 18 | from selenium.common.exceptions import TimeoutException 19 | from selenium.common.exceptions import UnexpectedAlertPresentException 20 | from selenium.common.exceptions import WebDriverException 21 | from selenium.webdriver.common.desired_capabilities import DesiredCapabilities 22 | except ImportError: 23 | print('[*] Selenium not found.') 24 | print('[*] Please run the script in the setup directory!') 25 | sys.exit() 26 | 27 | from modules.helpers import do_delay 28 | 29 | def create_driver(cli_parsed, user_agent=None): 30 | """Creates a selenium FirefoxDriver 31 | 32 | Args: 33 | cli_parsed (ArgumentParser): Command Line Object 34 | user_agent (String, optional): Optional user-agent string 35 | 36 | Returns: 37 | FirefoxDriver: Selenium Firefox Webdriver 38 | """ 39 | profile = webdriver.FirefoxProfile() 40 | # Load our custom firefox addon to handle basic auth. 41 | extension_path = os.path.join( 42 | os.path.dirname(os.path.realpath(__file__)), 43 | '..', 'bin', 'dismissauth.xpi') 44 | profile.add_extension(extension_path) 45 | profile.accept_untrusted_certs = True 46 | 47 | # This user agent case covers a user provided one 48 | if cli_parsed.user_agent is not None: 49 | profile.set_preference( 50 | 'general.useragent.override', cli_parsed.user_agent) 51 | 52 | # This user agent case should only be hit when cycling 53 | if user_agent is not None: 54 | profile.set_preference('general.useragent.override', user_agent) 55 | 56 | # Set up our proxy information directly in the firefox profile 57 | if cli_parsed.proxy_ip is not None and cli_parsed.proxy_port is not None: 58 | profile.set_preference('network.proxy.type', 1) 59 | if "socks" in cli_parsed.proxy_type: 60 | profile.set_preference('network.proxy.socks', cli_parsed.proxy_ip) 61 | profile.set_preference('network.proxy.socks_port', cli_parsed.proxy_port) 62 | else: 63 | profile.set_preference('network.proxy.http', cli_parsed.proxy_ip) 64 | profile.set_preference( 65 | 'network.proxy.http_port', cli_parsed.proxy_port) 66 | profile.set_preference('network.proxy.ssl', cli_parsed.proxy_ip) 67 | profile.set_preference('network.proxy.ssl_port', cli_parsed.proxy_port) 68 | 69 | profile.set_preference('app.update.enabled', False) 70 | profile.set_preference('browser.search.update', False) 71 | profile.set_preference('extensions.update.enabled', False) 72 | 73 | try: 74 | capabilities = DesiredCapabilities.FIREFOX.copy() 75 | capabilities.update({'acceptInsecureCerts': True}) 76 | options = Options() 77 | options.add_argument("--headless") 78 | profile.update_preferences() 79 | driver = webdriver.Firefox(profile, capabilities=capabilities, options=options, service_log_path=cli_parsed.selenium_log_path) 80 | driver.set_page_load_timeout(cli_parsed.timeout) 81 | driver.set_window_size(cli_parsed.width,cli_parsed.height) 82 | return driver 83 | except Exception as e: 84 | if 'Failed to find firefox binary' in str(e): 85 | print('Firefox not found!') 86 | print('You can fix this by installing Firefox/Iceweasel\ 87 | or using phantomjs/ghost') 88 | else: 89 | print(e) 90 | sys.exit() 91 | 92 | 93 | def capture_host(cli_parsed, http_object, driver, ua=None): 94 | """Screenshots a single host, saves information, and returns 95 | a complete HTTP Object 96 | 97 | Args: 98 | cli_parsed (ArgumentParser): Command Line Object 99 | http_object (HTTPTableObject): Object containing data relating to current URL 100 | driver (FirefoxDriver): webdriver instance 101 | ua (String, optional): Optional user agent string 102 | 103 | Returns: 104 | HTTPTableObject: Complete http_object 105 | """ 106 | 107 | # Attempt to take the screenshot 108 | try: 109 | # If cookie is presented we need to avoid cookie-averse error. To do so, we need to get the page twice. 110 | driver.get(http_object.remote_system) 111 | if cli_parsed.cookies is not None: 112 | for cookie in cli_parsed.cookies: 113 | driver.add_cookie(cookie) 114 | driver.get(http_object.remote_system) 115 | except KeyboardInterrupt: 116 | print('[*] Skipping: {0}'.format(http_object.remote_system)) 117 | http_object.error_state = 'Skipped' 118 | http_object.page_title = 'Page Skipped by User' 119 | except TimeoutException: 120 | print('[*] Hit timeout limit when connecting to {0}, retrying'.format(http_object.remote_system)) 121 | driver.quit() 122 | driver = create_driver(cli_parsed, ua) 123 | http_object.error_state = 'Timeout' 124 | except http.client.BadStatusLine: 125 | print('[*] Bad status line when connecting to {0}'.format(http_object.remote_system)) 126 | http_object.error_state = 'BadStatus' 127 | return http_object, driver 128 | except WebDriverException: 129 | print('[*] WebDriverError when connecting to {0}'.format(http_object.remote_system)) 130 | http_object.error_state = 'BadStatus' 131 | return http_object, driver 132 | 133 | # Dismiss any alerts present on the page 134 | # Will not work for basic auth dialogs! 135 | try: 136 | alert = driver.switch_to.alert 137 | alert.dismiss() 138 | except Exception as e: 139 | pass 140 | 141 | # If we hit a timeout earlier, retry once 142 | if http_object.error_state == 'Timeout': 143 | retry_counter = 0 144 | return_status = False 145 | while retry_counter < cli_parsed.max_retries: 146 | http_object.error_state = None 147 | try: 148 | driver.get(http_object.remote_system) 149 | if cli_parsed.cookies is not None: 150 | for cookie in cli_parsed.cookies: 151 | driver.add_cookie(cookie) 152 | driver.get(http_object.remote_system) 153 | break 154 | except TimeoutException: 155 | # Another timeout results in an error state and a return 156 | print('[*] Hit timeout limit when connecting to {0}'.format(http_object.remote_system)) 157 | http_object.error_state = 'Timeout' 158 | http_object.page_title = 'Timeout Limit Reached' 159 | http_object.headers = {} 160 | driver.quit() 161 | driver = create_driver(cli_parsed, ua) 162 | return_status = True 163 | except KeyboardInterrupt: 164 | print('[*] Skipping: {0}'.format(http_object.remote_system)) 165 | http_object.error_state = 'Skipped' 166 | http_object.page_title = 'Page Skipped by User' 167 | break 168 | except http.client.BadStatusLine: 169 | print('[*] Bad status line when connecting to {0}'.format(http_object.remote_system)) 170 | http_object.error_state = 'BadStatus' 171 | return_status = True 172 | break 173 | except WebDriverException: 174 | print('[*] WebDriverError when connecting to {0}'.format(http_object.remote_system)) 175 | http_object.error_state = 'BadStatus' 176 | return_status = True 177 | break 178 | retry_counter += 1 179 | 180 | # Determine if I need to return the objects 181 | if return_status: 182 | return http_object, driver 183 | 184 | try: 185 | alert = driver.switch_to.alert 186 | alert.dismiss() 187 | except Exception as e: 188 | pass 189 | 190 | do_delay(cli_parsed) 191 | 192 | # Save our screenshot to the specified directory 193 | try: 194 | driver.save_screenshot(http_object.screenshot_path) 195 | except WebDriverException as e: 196 | print('[*] Error saving web page screenshot' 197 | ' for ' + http_object.remote_system) 198 | 199 | # Get our headers using urllib 200 | context = None 201 | try: 202 | context = ssl.create_default_context() 203 | context.check_hostname = False 204 | context.verify_mode = ssl.CERT_NONE 205 | except: 206 | context = None 207 | pass 208 | 209 | if cli_parsed.user_agent: 210 | tempua = cli_parsed.user_agent 211 | else: 212 | try: 213 | tempua = driver.execute_script("return navigator.userAgent") 214 | except: 215 | tempua = '' 216 | try: 217 | req = urllib.request.Request(http_object.remote_system, headers={'User-Agent': tempua}) 218 | if cli_parsed.proxy_ip is not None: 219 | req.set_proxy(str(cli_parsed.proxy_ip) + ':' + str(cli_parsed.proxy_port), 'http') 220 | req.set_proxy(str(cli_parsed.proxy_ip) + ':' + str(cli_parsed.proxy_port), 'https') 221 | if context is None: 222 | opened = urllib.request.urlopen(req, timeout=cli_parsed.timeout) 223 | else: 224 | opened = urllib.request.urlopen(req,timeout=cli_parsed.timeout, context=context) 225 | headers = dict(opened.info()) 226 | headers['Response Code'] = str(opened.getcode()) 227 | except urllib.error.HTTPError as e: 228 | responsecode = e.code 229 | if responsecode == 404: 230 | http_object.category = 'notfound' 231 | elif responsecode == 403 or responsecode == 401: 232 | http_object.category = 'unauth' 233 | elif responsecode == 500: 234 | http_object.category = 'inerror' 235 | elif responsecode == 400: 236 | http_object.category = 'badreq' 237 | headers = dict(e.headers) 238 | headers['Response Code'] = str(e.code) 239 | except urllib.error.URLError as e: 240 | if '104' in str(e.reason): 241 | headers = {'Error': 'Connection Reset'} 242 | http_object.error_state = 'ConnReset' 243 | return http_object, driver 244 | elif '111' in str(e.reason): 245 | headers = {'Error': 'Connection Refused'} 246 | http_object.error_state = 'ConnRefuse' 247 | return http_object, driver 248 | elif 'Errno 1' in str(e.reason) and 'SSL23' in str(e.reason): 249 | headers = {'Error': 'SSL Handshake Error'} 250 | http_object.error_state = 'SSLHandshake' 251 | return http_object, driver 252 | elif 'Errno 8' in str(e.reason) and 'EOF occurred' in str(e.reason): 253 | headers = {'Error': 'SSL Handshake Error'} 254 | http_object.error_state = 'SSLHandshake' 255 | return http_object, driver 256 | else: 257 | headers = {'Error': 'HTTP Error...'} 258 | http_object.error_state = 'BadStatus' 259 | return http_object, driver 260 | except socket.error as e: 261 | if e.errno == 104: 262 | headers = {'Error': 'Connection Reset'} 263 | http_object.error_state = 'ConnReset' 264 | return http_object, driver 265 | elif e.errno == 10054: 266 | headers = {'Error': 'Connection Reset'} 267 | http_object.error_state = 'ConnReset' 268 | return http_object, driver 269 | elif 'timed out' in str(e): 270 | headers = {'Error': 'Timed Out'} 271 | http_object.error_state = 'Timeout' 272 | print('[*] Socket Timeout when connecting to {0}'.format(http_object.remote_system)) 273 | return http_object, driver 274 | else: 275 | http_object.error_state = 'BadStatus' 276 | return http_object, driver 277 | except http.client.BadStatusLine: 278 | http_object.error_state = 'BadStatus' 279 | return http_object, driver 280 | except sslerr: 281 | headers = {'Error': 'Invalid SSL Certificate'} 282 | http_object.ssl_error = True 283 | except TypeError: 284 | headers = {'Error': 'Communication Error'} 285 | http_object.error_state = 'BadStatus' 286 | return http_object, driver 287 | except Exception: 288 | headers = {'Error': 'Communication Error'} 289 | http_object.error_state = 'BadStatus' 290 | return http_object, driver 291 | 292 | try: 293 | http_object.page_title = 'Unknown' if driver.title == '' else driver.title.encode( 294 | 'utf-8') 295 | except Exception: 296 | http_object.page_title = 'Unable to Display' 297 | # Save page source to the object and to a file. Also set the title in the object 298 | try: 299 | http_object.headers = headers 300 | http_object.source_code = driver.page_source.encode('utf-8') 301 | with open(http_object.source_path, 'w') as f: 302 | f.write(http_object.source_code.decode()) 303 | except UnexpectedAlertPresentException: 304 | with open(http_object.source_path, 'w') as f: 305 | f.write('Cannot render webpage') 306 | http_object.headers = {'Cannot Render Web Page': 'n/a'} 307 | except IOError: 308 | print("[*] ERROR: URL too long, surpasses max file length.") 309 | print("[*] ERROR: Skipping: " + http_object.remote_system) 310 | except WebDriverException: 311 | print("[*] ERROR: Skipping source code capture for: " + http_object.remote_system) 312 | except Exception: 313 | print("[*] ERROR: Skipping source code capture for: " + http_object.remote_system) 314 | 315 | return http_object, driver 316 | -------------------------------------------------------------------------------- /Python/setup/requirements.txt: -------------------------------------------------------------------------------- 1 | fuzzywuzzy 2 | selenium==4.9.1 3 | python-Levenshtein 4 | pyvirtualdisplay 5 | netaddr 6 | -------------------------------------------------------------------------------- /Python/setup/setup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Original script by @themightyshiv 3 | # Rewritten by moth@bhis (@0x6d6f7468) 4 | 5 | # Function for downloading latest geckodriver for the correct CPU architecture 6 | get_gecko() { 7 | echo 8 | echo "[*] Getting latest Gecko driver..." 9 | 10 | # Get download links for latest geckodriver via GitHub API 11 | local latest_geckos=$(curl -s https://api.github.com/repos/mozilla/geckodriver/releases/latest \ 12 | | jq '.assets[].browser_download_url' | tr -d \") 13 | 14 | # Construct appropriate download URL (or exit if unsupported arch) 15 | local gecko_url=""; 16 | case ${mach_type} in 17 | x86_64) 18 | gecko_url=$(echo "$latest_geckos" | grep "linux64.tar.gz$");; 19 | i386|i686) 20 | gecko_url=$(echo "$latest_geckos" | grep "linux32.tar.gz$");; 21 | aarch64) 22 | gecko_url=$(echo "$latest_geckos" | grep "linux-aarch64.tar.gz$");; 23 | *) 24 | echo "[-] Error: Unsupported architecture: ${mach_type}" 25 | popd >/dev/null 26 | exit 1 27 | ;; 28 | esac 29 | 30 | # Download, extract, and clean up latest driver tarball 31 | wget "$gecko_url" -O geckodriver.tar.gz 32 | tar -xvf geckodriver.tar.gz -C /usr/bin 33 | rm geckodriver.tar.gz 34 | } 35 | 36 | # Function to install Linux and Python dependencies 37 | install_deps() { 38 | echo 39 | echo "[*] Installing system dependencies..." 40 | 41 | case ${os_id} in 42 | debian|kali) 43 | apt-get update 44 | apt-get install -y wget curl jq cmake python3 xvfb python3-pip python3-netaddr python3-dev firefox-esr tar 45 | ;; 46 | ubuntu|linuxmint) 47 | apt-get update 48 | apt-get install -y wget curl jq cmake python3 xvfb python3-pip python3-netaddr python3-dev firefox x11-utils tar 49 | ;; 50 | arch|manjaro) 51 | pacman -Syu 52 | pacman -S --noconfirm wget curl jq cmake python3 python-xvfbwrapper python-pip python-netaddr firefox tar 53 | ;; 54 | alpine) 55 | apk update 56 | apk add wget curl jq cmake python3 xvfb py-pip py-netaddr python3-dev firefox tar 57 | 58 | # from https://stackoverflow.com/questions/58738920/running-geckodriver-in-an-alpine-docker-container 59 | # Get all the prereqs 60 | wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub 61 | wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.30-r0/glibc-2.30-r0.apk 62 | wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.30-r0/glibc-bin-2.30-r0.apk 63 | apk add glibc-2.30-r0.apk 64 | apk add glibc-bin-2.30-r0.apk 65 | 66 | # And of course we need Firefox if we actually want to *use* GeckoDriver 67 | apk add firefox-esr=60.9.0-r0 68 | ;; 69 | centos|rocky|fedora) 70 | yum install -y wget curl jq python3 xorg-x11-server-Xvfb python3-pip firefox gcc cmake python3-devel gcc cmake python3-devel tar 71 | ;; 72 | *) 73 | echo "[-] Error: Unsupported Operating System ID: ${os_id}" 74 | popd >/dev/null 75 | exit 1 76 | ;; 77 | esac 78 | 79 | echo 80 | echo "[*] Installing Python dependencies..." 81 | pip3 install --upgrade pip 82 | python3 -m pip install -r requirements.txt 83 | } 84 | 85 | # Make sure we're in the setup directory 86 | pushd "$(dirname "$0")" >/dev/null 87 | 88 | # Make sure we're running as root 89 | echo 90 | echo "[*] Checking if running as root..." 91 | if [ "$EUID" -ne 0 ]; then 92 | echo "[-] Error: You must run this setup script with root privileges." 93 | echo 94 | popd >/dev/null 95 | exit 1 96 | else 97 | echo "[+] Running as root." 98 | fi 99 | 100 | # Get some system information 101 | echo 102 | echo "[*] Getting system information..." 103 | os_id=$(grep ^ID= /etc/os-release | cut -d'=' -f2 | tr -d '"') 104 | mach_type=$(uname -m) 105 | 106 | # Install dependencies 107 | install_deps 108 | 109 | # Get the gecko 110 | get_gecko 111 | 112 | # Get out of there! 113 | popd >/dev/null 114 | 115 | # Print success message 116 | echo 117 | echo "[+] Setup script completed successfully. Enjoy EyeWitness! ^_^" 118 | echo "[*] Be sure to check out Red Siege!" 119 | echo "[*] https://www.redsiege.com" 120 | echo 121 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | EyeWitness 2 | ====== 3 | 4 | EyeWitness is designed to take screenshots of websites provide some server header info, and identify default credentials if known. 5 | 6 | EyeWitness is designed to run on Kali Linux. It will auto detect the file you give it with the -f flag as either being a text file with URLs on each new line, nmap xml output, or nessus xml output. The --timeout flag is completely optional, and lets you provide the max time to wait when trying to render and screenshot a web page. 7 | 8 | A complete usage guide which documents EyeWitness features and its typical use cases is available here - https://www.christophertruncer.com/eyewitness-2-0-release-and-user-guide/ 9 | 10 | ## Windows 11 | Red Siege has created a Windows client (thanks to the massive help of Matt Grandy (@Matt_Grandy_) with the stability fixes). All you need to do is build it locally (or check the releases), and then provide a path to a file containing the URLs you want scanned! EyeWitness will generate the report within your "AppData\Roaming" directory. The latest version of the C# EyeWitness supports parsing and taking screenshots of Internet Explorer and Chrome bookmarks without having to supply a list of URLs. This version is also small enough to be delivered through Cobalt Strike's execute-assembly. 12 | 13 | ### Setup: 14 | 1. Navigate into the CS directory 15 | 2. Load EyeWitness.sln into Visual Studio 16 | 3. Go to Build at the top and then Build Solution if no modifications are wanted 17 | 18 | ### Usage: 19 | ```bash 20 | EyeWitness.exe --help 21 | EyeWitness.exe --bookmarks 22 | EyeWitness.exe -f C:\Path\to\urls.txt 23 | EyeWitness.exe --file C:\Path\to\urls.txt --delay [timeout in seconds] --compress 24 | ``` 25 | 26 | ## Linux 27 | 28 | ###### Supported Linux Distros: 29 | * Kali Linux 30 | * Debian 7+ (at least stable, looking into testing) (Thanks to @themightyshiv) 31 | * CentOS 7 32 | * Rocky Linux 8 33 | 34 | **E-Mail:** GetOffensive [@] redsiege [dot] com 35 | 36 | ### Setup: 37 | 1. Navigate into the Python/setup directory 38 | 2. Run the setup.sh script 39 | 40 | ### Usage: 41 | ```bash 42 | ./EyeWitness.py -f filename --timeout optionaltimeout 43 | ``` 44 | 45 | ### Examples: 46 | ```bash 47 | ./EyeWitness -f urls.txt --web 48 | 49 | ./EyeWitness -x urls.xml --timeout 8 50 | 51 | ./EyeWitness.py -f urls.txt --web --proxy-ip 127.0.0.1 --proxy-port 8080 --proxy-type socks5 --timeout 120 52 | ``` 53 | 54 | ### Proxy Usage 55 | The best guide for proxying EyeWitness through a socks proxy was made by @raikia and is available here - https://github.com/RedSiege/EyeWitness/issues/458 56 | 57 | To install EyeWitness from a system while needing to go through a proxy, the following commands (thanks to @digininja) can be used. 58 | 59 | ```bash 60 | APT 61 | ------- 62 | /etc/apt/apt.conf.d/70proxy 63 | 64 | $ cat /etc/apt/apt.conf.d/70proxy 65 | Acquire::http::proxy "http://localhost:3128"; 66 | Acquire::https::proxy "https://localhost:3128"; 67 | 68 | Git 69 | ----------------- 70 | $ cat ~/.gitconfig 71 | [http] 72 | proxy = http://localhost:3128 73 | 74 | Wget 75 | --------------------- 76 | $ cat ~/.wgetrc or /etc/wgetrc 77 | 78 | use_proxy=yes 79 | http_proxy=127.0.0.1:3128 80 | https_proxy=127.0.0.1:3128 81 | 82 | General system proxy 83 | -------------------------------- 84 | 85 | export HTTP_PROXY=http://localhost:3128 86 | export HTTPS_PROXY=http://localhost:3128 87 | ``` 88 | 89 | ### Docker 90 | Now you can execute EyeWitness in a docker container and prevent you from install unnecessary dependencies in your host machine. 91 | 92 | **Note:** execute *docker run* with the folder path in the host which hold your results (**/path/to/results**) 93 | **Note2:** in case you want to scan urls from a file, make sure you put it in the volume folder (if you put *urls.txt* in */path/to/results*, then the argument should be *-f /tmp/EyeWitness/urls.txt*) 94 | 95 | ##### Usage 96 | ```bash 97 | sudo docker build -t eyewitness 98 | ``` 99 | 100 | ##### Example #1 - 101 | ```bash 102 | sudo docker run --rm \ 103 | -v /tmp:/Eyewitness/Python/ \ 104 | eyewitness --web \ 105 | -f /Eyewitness/Python/dns.txt \ 106 | --no-prompt \ 107 | -d /Eyewitness/Python/report-$(date +'%d-%m-%Y-%H-%M-%S' | sed 's/[-:]/-/g') 108 | ``` 109 | And then on your host : 110 | 111 | ```bash 112 | cd /tmp && ls 113 | cd report* 114 | firefox-esr report.html & 115 | ``` 116 | ###### Call to Action: 117 | I'd love for EyeWitness to identify more default credentials of various web applications. 118 | As you find a device which utilizes default credentials, please e-mail me the source code of the index page and the default creds so I can add it in to EyeWitness! 119 | -------------------------------------------------------------------------------- /Security.md: -------------------------------------------------------------------------------- 1 | # Security 2 | 3 | In the event that you find a security issue with EyeWitness please create a Github issue or, potentially due to the severity, or you just want to privately report it, please contact us via the web form at https://redsiege.com 4 | 5 | --------------------------------------------------------------------------------