n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial public portfolio release

Browse Source 
Sanitized version of red team infrastructure automation platform.
Operational content (implant pipelines, lures, credential capture)
replaced with documented stubs. Architecture and infrastructure
automation code intact.
This commit is contained in:
Operator
2026-06-23 16:12:14 -04:00
commit 0799bfbae8
239 changed files with 40012 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/webrunner/inputs/countries-format.md
+89
View File
@@ -0,0 +1,89 @@
# countries.yaml — Format Specification
## Purpose
Defines which countries to scan and optional per-country exclusions.
Used by all WEBRUNNER scan modes. The scanner resolves each country code
to its CIDR ranges using RIR delegated stats files (ARIN, RIPE, APNIC,
LACNIC, AFRINIC — cached 24h locally).
## Scope options
- **Targeted countries**: list specific ISO codes in this file
- **Single country**: just one entry
- **Global sweep**: include every country you want — WEBRUNNER distributes
CIDRs across nodes automatically regardless of count
## Relationship to scan_vars.yaml
`scan_profile.rate` in this file sets the masscan default, but it is
overridden by `masscan_rate` in `scan_vars.yaml` or the interactive tuning
prompt. Prefer `scan_vars.yaml` for operator-level tuning.
## Schema
```yaml
scan_profile:
name: string # Label for this profile (used in logs/reports)
rate: integer # masscan packets/sec (default: 1000, max: 100000)
max_hosts_per_country: integer|null # Cap IPs per country. null = no limit
countries:
- code: string # ISO 3166-1 alpha-2 (e.g. US, VE, NL, GB, NG)
priority: high|medium|low # Scan order. high = first
exclude_cidrs: # Optional CIDR blocks to skip within this country
- "x.x.x.x/xx"
notes: string # Optional context (not used by scanner)
```
## Rules
- `code` must be a valid ISO 3166-1 alpha-2 code
- GB is the correct code for United Kingdom (not UK)
- `rate` applies globally to the masscan run, not per-country
- `exclude_cidrs` entries must be valid CIDR notation
- Countries are scanned in priority order: high → medium → low
- Within same priority, order in the list is preserved
## Valid priority values
`high` | `medium` | `low`
## Common country codes
| Country | Code |
|---------|------|
| United States | US |
| United Kingdom | GB |
| Venezuela | VE |
| Netherlands | NL |
| Canada | CA |
| Nigeria | NG |
| Russia | RU |
| Germany | DE |
| China | CN |
| Brazil | BR |
| Iran | IR |
| India | IN |
| France | FR |
| Australia | AU |
## Example
```yaml
scan_profile:
name: "latam-europe-sweep"
rate: 2000
max_hosts_per_country: 100000
countries:
- code: VE
priority: high
exclude_cidrs: []
notes: "Primary target"
- code: US
priority: medium
exclude_cidrs:
- "10.0.0.0/8"
- "172.16.0.0/12"
- "192.168.0.0/16"
- code: NL
priority: low
```
modules/webrunner/inputs/countries.yaml
+51
View File
@@ -0,0 +1,51 @@
scan_profile:
name: "adversarial-nations-panos"
rate: 3000
max_hosts_per_country: null
countries:
# Largest internet footprint first — most likely to surface exposed devices
- code: RU
priority: high
exclude_cidrs: []
notes: "Russia"
- code: IR
priority: high
exclude_cidrs: []
notes: "Iran"
- code: BY
priority: medium
exclude_cidrs: []
notes: "Belarus"
- code: VE
priority: medium
exclude_cidrs: []
notes: "Venezuela"
- code: SY
priority: medium
exclude_cidrs: []
notes: "Syria"
- code: NI
priority: low
exclude_cidrs: []
notes: "Nicaragua"
- code: CU
priority: low
exclude_cidrs: []
notes: "Cuba"
- code: MM
priority: low
exclude_cidrs: []
notes: "Myanmar"
- code: KP
priority: low
exclude_cidrs: []
notes: "North Korea — minimal public internet, low yield expected"
modules/webrunner/inputs/scan_vars.yaml.example
+31
View File
@@ -0,0 +1,31 @@
# scan_vars.yaml — WEBRUNNER pre-configuration
# Copy this file, fill in values, and provide the path at the "Vars file" prompt.
# All fields are optional. Omit any field to be prompted interactively.
# ── masscan ───────────────────────────────────────────────────────────────────
masscan_rate: 5000 # packets/sec (default: mode-dependent, 3000–10000)
# Lower for clients with strict IPS/rate-limiting
# ── nmap (masscan+nmap and geo-scout modes) ───────────────────────────────────
nmap_timing: 3 # T1=sneaky T2=polite T3=normal T4=aggressive (default: 4)
nmap_timeout: 120 # per-host timeout in seconds (default: 60)
# Increase for slow/filtered networks
nmap_workers: 10 # parallel nmap threads per node (default: 10)
# ── nuclei (masscan+nuclei mode only) ─────────────────────────────────────────
nuclei_template: "/path/to/your/cve-template.yaml"
# Local path — copied to nodes at provision time
# Never fetched from the internet during scans
nuclei_rate: 150 # requests/sec rate limit (default: 150)
# Lower for clients with WAF/rate-limiting
nuclei_concurrency: 25 # concurrent goroutines (default: 25)
nuclei_timeout: 10 # per-request timeout in seconds (default: 10)
# ── example: conservative client profile ─────────────────────────────────────
# masscan_rate: 1000
# nmap_timing: 2
# nmap_timeout: 180
# nmap_workers: 5
# nuclei_rate: 50
# nuclei_concurrency: 10
# nuclei_timeout: 20
modules/webrunner/inputs/targets-format.md
+210
View File
@@ -0,0 +1,210 @@
# targets.yaml — Format Specification
## Purpose
Defines what to look for during **geo-scout** mode scans. Each target is a
fingerprint with one or more probes. The scanner runs masscan to find open
ports, then fires each probe against matching hosts, and applies
pattern/version matching.
For **masscan+nuclei** mode, use a nuclei template instead (see below).
targets.yaml is ignored in nuclei mode.
## Nuclei template mode (masscan+nuclei)
Provide a standard nuclei YAML template file. WEBRUNNER:
1. Runs masscan to find open `ip:port` pairs
2. Feeds those pairs as targets to nuclei with your template
3. Outputs per-host match results + per-country vulnerable host counts
**OPSEC note:** Templates are copied to nodes at provision time from your
local path. No live template fetches happen during scans.
**Template path:** Specify in `scan_vars.yaml` (`nuclei_template: /path/to/template.yaml`)
or enter the path at the interactive prompt.
### Minimal nuclei template structure
```yaml
id: cve-2024-example
info:
name: Example CVE
severity: critical
tags: [cve, rce]
http:
- method: GET
path:
- "{{BaseURL}}/vulnerable/endpoint"
matchers:
- type: word
words:
- "vulnerable_string"
```
---
## Schema
```yaml
targets:
- name: string # Human-readable label (appears in results)
tags: [string, ...] # Free-form tags for grouping/filtering results
ports: [integer, ...] # Ports masscan will scan for this target
probes:
- type: tcp_banner|http|https|rtsp|udp
# --- For http/https ---
path: string # URL path (e.g. "/", "/login.asp", "/api/version")
method: GET|POST # Default: GET
headers: # Optional extra request headers
Header-Name: value
body: string # POST body (optional)
match_in: body|headers|[body, headers] # Where to search for patterns
# --- For tcp_banner ---
# (no extra fields — reads the raw TCP banner on connect)
# --- For rtsp ---
# (sends OPTIONS * RTSP/1.0 and matches banner)
# --- Pattern matching (all probe types) ---
patterns: # At least one must match (OR logic)
- "regex or plain string"
all_patterns: # All must match (AND logic, optional)
- "regex or plain string"
# --- Version extraction (optional) ---
version_extract: "regex with one capture group"
version_compare: # Optional — filter by version
operator: "<="|">="|"=="|"!="|"<"|">"
value: "string or number"
# --- Confidence ---
confidence: high|medium|low # Default: medium
```
## Rules
- A target matches a host if ANY probe matches
- Within a probe, `patterns` uses OR logic (any one pattern is enough)
- `all_patterns` uses AND logic — use when you need multiple strings to co-occur
- `version_extract` must contain exactly one regex capture group `()`
- Version comparison is string-aware for dotted versions (e.g. "20.3" < "20.17")
- `match_in` defaults to `body` for http/https probes
- For `tcp_banner` type, the banner is the raw bytes received on connect
- Patterns are case-insensitive by default; prefix with `(?-i)` to force case-sensitive
- Tags are free-form strings — use them for filtering with `--tag` at runtime
## Probe types
| Type | Description |
|------|-------------|
| `tcp_banner` | Connect and read raw banner |
| `http` | HTTP GET/POST, match response |
| `https` | HTTPS GET/POST, match response (cert errors ignored) |
| `rtsp` | RTSP OPTIONS probe, match response |
| `udp` | Send empty UDP, match response |
## Common port reference
| Service | Ports |
|---------|-------|
| HTTP | 80, 8080, 8000, 8888 |
| HTTPS | 443, 8443 |
| SSH | 22 |
| Telnet | 23 |
| FTP | 21 |
| RTSP (cameras) | 554, 8554 |
| ONVIF (cameras) | 80, 8080 |
| DVR/NVR | 37777, 34567 |
| RDP | 3389 |
| SMB | 445 |
| Redis | 6379 |
| Elasticsearch | 9200 |
| MongoDB | 27017 |
| MySQL | 3306 |
| PostgreSQL | 5432 |
## Examples
### D-Link DIR-823X firmware 240126 or 240802
```yaml
- name: "D-Link DIR-823X fw 240126/240802"
tags: [router, d-link, cpe, iot]
ports: [80, 443, 8080]
probes:
- type: http
path: "/"
match_in: body
patterns: ["DIR-823X"]
all_patterns: []
- type: http
path: "/"
match_in: body
patterns: ["240126", "240802"]
confidence: high
```
### Exposed IP cameras (any brand)
```yaml
- name: "Exposed IP Camera"
tags: [camera, iot, surveillance]
ports: [80, 554, 8080, 8443, 37777, 34567]
probes:
- type: http
path: "/"
match_in: [body, headers]
patterns:
- "(?i)hikvision"
- "(?i)dahua"
- "(?i)ip camera"
- "(?i)ipcam"
- "(?i)webcam"
- "(?i)nvr"
- "(?i)dvr"
- "(?i)axis"
- "(?i)reolink"
- "(?i)amcrest"
- type: rtsp
patterns: ["RTSP/1.0 200"]
confidence: medium
```
### Cisco Catalyst SD-WAN Manager <= 20.17
```yaml
- name: "Cisco SD-WAN vManage <= 20.17"
tags: [cisco, sdwan, network, cve]
ports: [443, 8443]
probes:
- type: https
path: "/dataservice/client/server"
method: GET
match_in: body
patterns: ["vmanage", "platformVersion"]
version_extract: '"platformVersion":"([0-9.]+)"'
version_compare:
operator: "<="
value: "20.17"
confidence: high
- type: https
path: "/"
match_in: [body, headers]
patterns: ["vManage", "Cisco SD-WAN"]
confidence: low
```
### Ubuntu 24.04 SSH
```yaml
- name: "Ubuntu 24.04 SSH"
tags: [linux, ubuntu, ssh]
ports: [22]
probes:
- type: tcp_banner
patterns:
- "Ubuntu-24"
- "OpenSSH.*Ubuntu"
version_extract: "SSH-2.0-OpenSSH_([0-9p.]+)"
confidence: high
```
### Open Redis (unauthenticated)
```yaml
- name: "Open Redis"
tags: [database, redis, exposed]
ports: [6379]
probes:
- type: tcp_banner
patterns: ["redis_version"]
version_extract: "redis_version:([0-9.]+)"
confidence: high
```
modules/webrunner/inputs/targets.yaml
+103
View File
@@ -0,0 +1,103 @@
targets:
- name: "Palo Alto PAN-OS < 10.2.14"
tags: [panos, firewall, palo-alto, cve-2024-3400, network-device]
ports: [443, 4443, 8443]
probes:
- type: https
path: "/api/?type=version"
method: GET
match_in: body
patterns: ["sw-version"]
version_extract: "<sw-version>([0-9]+\\.[0-9]+\\.[0-9]+)"
version_compare:
operator: "<"
value: "10.2.14"
confidence: high
- type: https
path: "/php/login.php"
method: GET
match_in: [body, headers]
patterns:
- "Palo Alto Networks"
- "PAN-OS"
confidence: low
- type: https
path: "/global-protect/portal/gp-portal-esp.esp"
method: GET
match_in: body
patterns: ["globalprotect", "PAN-OS"]
confidence: low
- name: "Ubuntu 24.04 SSH"
tags: [linux, ubuntu, ssh]
ports: [22]
probes:
- type: tcp_banner
patterns:
- "Ubuntu-24"
- "OpenSSH.*Ubuntu"
version_extract: "SSH-2\\.0-OpenSSH_([0-9p.]+)"
confidence: high
- name: "D-Link DIR-823X fw 240126/240802"
tags: [router, d-link, cpe, iot]
ports: [80, 443, 8080]
probes:
- type: http
path: "/"
match_in: body
patterns: ["DIR-823X"]
confidence: medium
- type: http
path: "/"
match_in: body
all_patterns: ["DIR-823X"]
patterns: ["240126", "240802"]
confidence: high
- name: "Exposed IP Camera"
tags: [camera, iot, surveillance]
ports: [80, 554, 8080, 8443, 37777, 34567]
probes:
- type: http
path: "/"
match_in: [body, headers]
patterns:
- "(?i)hikvision"
- "(?i)dahua"
- "(?i)ip.?camera"
- "(?i)ipcam"
- "(?i)webcam"
- "(?i)reolink"
- "(?i)amcrest"
- "(?i)axis"
confidence: medium
- type: rtsp
patterns: ["RTSP/1.0 200"]
confidence: medium
- name: "Cisco SD-WAN vManage <= 20.17"
tags: [cisco, sdwan, network]
ports: [443, 8443]
probes:
- type: https
path: "/dataservice/client/server"
method: GET
match_in: body
patterns: ["platformVersion"]
version_extract: '"platformVersion":"([0-9.]+)"'
version_compare:
operator: "<="
value: "20.17"
confidence: high
- name: "Open Redis"
tags: [database, redis, exposed]
ports: [6379]
probes:
- type: tcp_banner
patterns: ["redis_version"]
version_extract: "redis_version:([0-9.]+)"
confidence: high