#!/bin/bash # Automated Reconnaissance Script for Attack Box # Usage: ./recon_automation.sh set -e if [ $# -eq 0 ]; then echo "Usage: $0 " echo "Example: $0 example.com" exit 1 fi TARGET="$1" WORKSPACE="/root/operator/scans/reachability/$TARGET" DATE=$(date +%Y%m%d_%H%M%S) # Colors for output RED='\033[0;31m' GREEN='\033[0;32m' YELLOW='\033[1;33m' BLUE='\033[0;34m' NC='\033[0m' # No Color echo -e "${GREEN}[+] Starting reconnaissance for: $TARGET${NC}" echo -e "${BLUE}[*] Creating workspace directory: $WORKSPACE${NC}" # Create workspace mkdir -p "$WORKSPACE" cd "$WORKSPACE" # Create log file LOG_FILE="recon_$DATE.log" echo "Reconnaissance started at $(date)" > "$LOG_FILE" # Function to log and execute log_and_run() { echo -e "${YELLOW}[*] $1${NC}" echo "[$(date)] $1" >> "$LOG_FILE" eval "$2" 2>&1 | tee -a "$LOG_FILE" } # Subdomain enumeration echo -e "${GREEN}[+] Phase 1: Subdomain Enumeration${NC}" log_and_run "Running Subfinder" "subfinder -d $TARGET -o subdomains_subfinder.txt" log_and_run "Running Assetfinder" "assetfinder --subs-only $TARGET > subdomains_assetfinder.txt" log_and_run "Running Amass" "amass enum -passive -d $TARGET -o subdomains_amass.txt" # Combine and deduplicate subdomains log_and_run "Combining subdomain lists" "cat subdomains_*.txt | sort -u > all_subdomains.txt" # Check which subdomains are alive echo -e "${GREEN}[+] Phase 2: Checking Live Subdomains${NC}" log_and_run "Checking live subdomains with httprobe" "cat all_subdomains.txt | httprobe -c 50 > live_subdomains.txt" # Port scanning on live subdomains echo -e "${GREEN}[+] Phase 3: Port Scanning${NC}" log_and_run "Running Nmap on live subdomains" "nmap -T4 -iL live_subdomains.txt -oA nmap_scan" # Web technology detection echo -e "${GREEN}[+] Phase 4: Web Technology Detection${NC}" log_and_run "Running whatweb" "whatweb -i live_subdomains.txt -a 3 > whatweb_results.txt" # Screenshot and visual recon echo -e "${GREEN}[+] Phase 5: Visual Reconnaissance${NC}" if command -v aquatone &> /dev/null; then log_and_run "Taking screenshots with Aquatone" "cat live_subdomains.txt | aquatone -out aquatone_report" fi # Directory bruteforcing echo -e "${GREEN}[+] Phase 6: Directory Enumeration${NC}" mkdir -p directory_enum while IFS= read -r url; do if [[ $url == http* ]]; then clean_url=$(echo "$url" | sed 's|http://||g' | sed 's|https://||g' | tr '/' '_') log_and_run "Running gobuster on $url" "gobuster dir -u $url -w /usr/share/wordlists/dirb/common.txt -o directory_enum/gobuster_$clean_url.txt -q" fi done < live_subdomains.txt # Vulnerability scanning with Nuclei echo -e "${GREEN}[+] Phase 7: Vulnerability Scanning${NC}" log_and_run "Running Nuclei" "nuclei -l live_subdomains.txt -t ~/nuclei-templates/ -o nuclei_results.txt" # Summary echo -e "${GREEN}[+] Reconnaissance Complete!${NC}" echo -e "${BLUE}[*] Results saved in: $WORKSPACE${NC}" echo -e "${BLUE}[*] Total subdomains found: $(wc -l < all_subdomains.txt)${NC}" echo -e "${BLUE}[*] Live subdomains: $(wc -l < live_subdomains.txt)${NC}" echo -e "${BLUE}[*] Log file: $LOG_FILE${NC}" # Generate simple HTML report cat > "recon_report.html" << EOF Reconnaissance Report - $TARGET

Reconnaissance Report for $TARGET

Statistics

Total Subdomains Found: $(wc -l < all_subdomains.txt)

Live Subdomains: $(wc -l < live_subdomains.txt)

Scan Date: $(date)

Live Subdomains

$(cat live_subdomains.txt)

Port Scan Results

$(cat nmap_scan.nmap 2>/dev/null || echo "Nmap results not available")

EOF echo -e "${GREEN}[+] HTML report generated: recon_report.html${NC}" echo "Reconnaissance completed at $(date)" >> "$LOG_FILE"