• Vulmap Linux - Python script for Linux systems

• Vulmap Windows - Powershell script for Windows systems

AutoSource is an automated source code review framework integrated with SonarQube which is capable of performing static code analysis/reviews. It can be used for effectively finding the vulnerabilities at very early stage of the SDLC(Software Development Life Cycle). The user can scan the code by just giving GIT repository link into the framework.

1. Download the AutoSource repository into your system.
2. Read the prerequisites.txt file and install the dependencies (mentioned for each platform)
3. Execute downloadSonar.py (python3 downloadSonar.py), this will download and setup the SonarQube framework which can be access from 'http://127.0.0.1:9000'
4. After that run executeScanner.py (python3 executeScanner.py), this will ask for your GIT repository that you want to scan.
5. Access the results on SonarQube Portal('http://127.0.0.1:9000')

• Malkit Singh
• Shubham Shubhankar Sharma

• bruteuser - Bruteforce a single user's password from a wordlist
• passwordspray - Test a single password against a list of users
• usernenum - Enumerate valid domain usernames via Kerberos

$ ./kerbrute

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: v1.0.0 (43f9ca1) - 03/06/19 - Ronnie Flathers @ropnop

This tool is designed to assist in quickly bruteforcing valid Active Directory accounts through Kerberos Pre-Authentication.
It is designed to be used on an internal Windows domain with access to one of the Domain Controllers.
Warning: failed Kerberos Pre-Auth counts as a failed login and WILL lock out accounts

Usage:
  kerbrute [command]

Available Commands:
  bruteuser     Bruteforce a single user's password from a wordlist
  help          Help about any command
  passwordspray Test a single password against a list of users
  userenum      Enumerate valid domain usernames via Kerberos
  version          Display version info and quit

Flags:
      --dc string       The location of the Domain Controller (KDC) to target. If blank, will lookup via DNS
  -d, --domain string   The full domain to use (e.g. contoso.com)
  -h, --help            help for kerbrute
  -o, --output string   File to write logs to. Optional.
      --safe            Safe mode. Will abort if any user comes back as locked out. Default: FALSE
  -t, --threads int     Threads to use (default 10)
  -v, --verbose         Log failures and errors

Use "kerbrute [command] --help" for more information about a command.

root@kali:~# ./kerbrute_linux_amd64 userenum -d lab.ropnop.com usernames.txt

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: dev (43f9ca1) - 03/06/19 - Ronnie Flathers @ropnop

2019/03/06 21:28:04 >  Using KDC(s):
2019/03/06 21:28:04 >   pdc01.lab.ropnop.com:88

2019/03/06 21:28:04 >  [+] VALID USERNAME:       amata@lab.ropnop.com
2019/03/06 21:28:04 >  [+] VALID USERNAME:       thoffman@lab.ropnop.com
2019/03/06 21:28:04 >  Done! Tested 1001 usernames (2 valid) in 0.425 seconds

root@kali:~# ./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: dev (43f9ca1) - 03/06/19 - Ronnie Flathers @ropnop

2019/03/06 21:37:29 >  Using KDC(s):
2019/03/06 21:37:29 >   pdc01.lab.ropnop.com:88

2019/03/06 21:37:35 >  [+] VALID LOGIN:  callen@lab.ropnop.com:Password123
2019/03/06 21:37:37 >  [+] VALID LOGIN:  eshort@lab.ropnop.com:Password123
2019/03/06 21:37:37 >  Done! Tested 2755 logins (2 successes) in 7.674 seconds

root@kali:~# ./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: dev (43f9ca1) - 03/06/19 - Ronnie Flathers @ropnop

2019/03/06 21:38:24 >  Using KDC(s):
2019/03/06 21:38:24 >   pdc01.lab.ropnop.com:88

2019/03/06 21:38:27 >  [+] VALID LOGIN:  thoffman@lab.ropnop.com:Summer2017
2019/03/06 21:38:27 >  Done! Tested 1001 logins (1 successes) in 2.711 seconds

$ go get github.com/ropnop/kerbrute

$ make help
help:            Show this help.
windows:  Make Windows x86 and x64 Binaries
linux:  Make Linux x86 and x64 Binaries
mac:  Make Darwin (Mac) x86 and x64 Binaries
clean:  Delete any binaries
all:  Make Windows, Linux and Mac x86/x64 Binaries

$ make all
Done.
Building for windows amd64..
Building for windows 386..
Done.
Building for linux amd64...
Building for linux 386...
Done.
Building for mac amd64...
Building for mac 386...
Done.

$ ls dist/
kerbrute_darwin_386        kerbrute_linux_386         kerbrute_windows_386.exe
kerbrute_darwin_amd64      kerbrute_linux_amd64       kerbrute_windows_amd64.exe

• Add IPv6 support to Joy and libjoy
• IPFix collection and export only support IPv4
• NFv9 only supports IPv4
• Anonymization only supports IPv4 addresses
• Subnet labeling only supports IPv4 addresses

• Re-write joy.c to use libjoy library
• Updated joy.c to utilize multi-threads for flow processing
• Updated unit tests and python tests to reflect new code changes
• Removed guts of the updater process to prepare for re-write
• Fixed bug in processing multiple files on the command line
• Other minor bug fixes

• Added support for make install for Centos

• Add support for fingerprinting

• Add additional API's for parent application processing of Flow Records and data features
• Fixed TCP retransmission and out of order detection
• Better identification of IDP packet
• Fixed some memory usage issues
• Fixed minor bugs
• Removed dead code

• Add support for building with autotools. ./configure;make clean;make

• Modified JOY infrastructure code to be thread safe.
  • Allowed support multiple work threads for packet processing.
  • Each worker thread uses own output file.
  • Removed global variables for Config.
  • Modified code infrastructure to use Config Structure.
• Modified the Makefile system to build the JOY infrastructure as a static and shared library.
• Implemented an API for utilizing the JOY Library (joy_api.[hc]).
• Implemented a Vector Packet Processing integration scheme to utilize VPP native infrastructure when building that integration.
• Created 2 API test programs, joy_api_test.c and joy_api_test2.c.
• Modified existing test programs to link against static JOY library instead of re-compiling the infrastructure code.
• Modified versioning to use Common Security Module (CSM) conventions.
• Modified build_pkg to accept package version on the command line.
• Cleaned up coverity errors and warnings.
• Various bug fixes.

• The JSON schema has been updated to be better organized, more readable, and more searchable (by putting searchable keywords as the JSON names),
• The new sleuth tool replaces query/joyq, and brings new functionality such as —fingerprint,
• Much improved documentation, which covers the joy and sleuth tools, examples, and the JSON schema (see using-joy)

Tested on Kali Linux 2018.2, Ubuntu 16.04 
sudo apt-get -y install python3-pip
pip3 install -r requirements.txt  


download latest version of Chromedriver and configure your driver-path
#sudo apt-get install unzip
#sudo unzip /tmp/chromedriver.zip chromedriver -d /usr/local/bin/


download latest version of Chrome
https://www.google.com/chrome/browser/desktop/
#dpkg -i google-chrome-stable_current_amd64.deb
#apt-get install -f
#dpkg -i google-chrome-stable_current_amd64.deb

• Read pcap files or sniff live interfaces (where tshark is permitted).
• Inspect each packet using familiar Wireshark-inspired views
• Filter pcaps or live captures using Wireshark's display filters
• Copy ranges of packets to the clipboard from the terminal
• Written in Golang, compiles to a single executable on each platform - downloads available for Linux (+termux), macOS, FreeBSD, and Windows

go get github.com/gcla/termshark/cmd/termshark

termshark -r test.pcap

termshark -i eth0 icmp

• tshark - command-line network protocol analyzer, part of Wireshark
• tcell - a cell based terminal handling package, inspired by termbox
• gowid - compositional terminal UI widgets, inspired by urwid, built on tcell

• The author - Graham Clark (grclark@gmail.com)

- git clone https://github.com/Viralmaniar/PeekABoo.git
- cd PeekABoo
- python peekaboo.py

• Press 1: This will set the PowerShell to unrestricted mode.
• Press 2: It enables the Remote Desktop on the targeted machine and shows the RDP port (3389) status.
• Press 3: It disables the Remote Desktop on the targeted machine.
• Press 4: To exit from the program.

• Download an exe from the release section of the Github along with PowerShell files available here or do it on your own using PyInstaller after reviewing the source code.
  
• Compile peekaboo.py into an executable using Pyinstaller
  
• PyInstaller is available on PyPI. You can install it through pip:
  

pip install pyinstaller

wget https://raw.githubusercontent.com/m4ll0k/10minutemail/master/10minutemail.py && python 10minutemail.py

python 10minutemail.py
python 10minutemail.py --save emails.txt

• SSH, FTP, Telnet, PostgreSQL, RDP, VNC with Hydra (recommended)
• SSH, FTP, Telnet, PostgreSQL, RDP, VNC with Medusa
• SSH, FTP, Telnet, PostgreSQL, RDP, VNC with Ncrack
• Scan victim's ports with Nmap

• Install Python 3 on Arch Linux and its distros: sudo pacman -S python3
• Install Python 3 on Debian and its distros: sudo apt install python3

• On Arch Linux and its distros: sudo pacman -S nmap hydra medusa ncrack
  
• On Debian and its distros: sudo apt install nmap hydra medusa ncrack
  

  git clone https://github.com/GitHackTools/BruteDum
  cd BruteDum
  python3 brutedum.py

• Scanning victim's ports with Nmap

• Ready to brute force

• Brute force has done

• Twitter: @SecureGF

• Get instant visibility to all entities in the internal environment: users, hosts, files, running processes and network traffic.
• Easily locate live attacks and determine their scope and impact.
• Remove malicious files, disable compromised users and block risky network connections with the click of a button.
• Automate threat discovery and removal processes.
• Leverage Cynet central management  to distribute other open source tools across the environment.
• Hunt for threats in real-time using IOC feeds.

• Download & Analyze Extensions From:
  • Chrome Web Store
  • Firefox Addons
• Analyze Installed Extensions of:
  • Google Chrome
  • Mozilla Firefox
  • Opera Browser (Coming Soon)
• Upload and Scan Extensions. Supported formats:
  • .crx
  • .xpi
  • .zip

• View Basic Informations:
  • Name, Author, Description and Version
• Manifest Viewer
• In depth permission information
• Extract Intels from files which include:
  • URLs and domains
  • IPv6 and IPv4 addresses
  • Bitcoin addresses
  • Email addresses
  • File comments
  • Base64 encoded strings
• View and Edit files. Supported file types:
  • html
  • json
  • JavaScript
  • css
• VirusTotal Scans For:
  • URLs
  • Domains
  • Files
• RetireJS Vulnerability scan for JavaScript files
• Network graph of all files and URLs
• Reconnaissance tools for extracted URLs:
  • Whois Scan
  • HTTP headers viewer
  • URL Source viewer
  • GEO-IP location
• Some Fun Stuffs that include:
  • Dark Mode
  • Inbuilt chiptune player (Jam on to some classic chiptune while ExtAnalysis does the work)

$ git clone https://github.com/Tuhinshubhra/ExtAnalysis
$ cd ExtAnalysis
$ pip3 install -r requirements.txt`

usage: extanalysis.py [-h HOST] [-p PORT] [-v] [-u] [-q] [--help]

optional arguments:
  -h HOST, --host HOST  Host to run ExtAnalysis on. Default host is 127.0.0.1
  -p PORT, --port PORT  Port to run ExtAnalysis on. Default port is 13337
  -v, --version         Shows version and quits
  -u, --update          Checks for update
  -q, --quiet           Quiet mode shows only errors on cli!
  --help                Shows this help menu and exits

• flask for the webserver
• python-whois for Whois lookup
• maxminddb for parsing the Geo-IP database
• requests for http headers and source code viewer

• python3
• qrcode
• Pillow
• argparse

• SQL Injection
• XSS
• Command Injection
• Format String
• XXE
• String Fuzzing
• SSI Injection
• LFI/Directory Traversal
• custom passed with -w/--wordlist

• Information Security Headers
• WAF Detector
• Banner Grabbing
  • Phone Number
  • Credit Card Number
  • Email
  • US Social Security Number
• Url Crawl
  • Dom Paramter Url
  • Internal Dynamic Paramter
  • External Dynamic Paramter
  • Internal Link
  • External Link
• Port Scanner
• Subdomain Enumeration

• click
• requests
• colorlog
• bs4
• tldextract

$ apt-get install python3 nmap
$ pip3 install -r requirements.txt
$ python3 reconT.py http://target.co.li

$ python reconT.py --help
Usage: reconT.py [OPTIONS] TARGET

Options:
  --timeout INTEGER  Seconds to wait before timeout connections
  --proxy TEXT       if Use a proxy ex: 0.0.0.0:8888if with auth
                     0.0.0.0:8888@user:password
  --cookies TEXT     if use cookie comma separated cookies to add the
                     requestex: PHPSESS:123,kontol=True
  --help             Show this message and exit.

1. Regularly purging existing configuration files from leaked credentials.
2. Blocking autosave/autofill on CUCM.
3. Enabling encryption of phone configuration files. Read more on that here. Note that this doesn't completely mitigate the issue, as the encryption password could be obtained from the phones' memory or through administrative access of CUCM.

git clone https://github.com/llt4l/iCULeak.py
cd iCULeak.py
pip install -r requirements.txt

python iCULeak.py -u domain\\llt4l -c 10.100.1.29 10.100.1.1

python iCULeak.py -l phones_hostnames -c 10.100.1.29 10.100.1.1

• View the help page with -h or --help
• Pass the username of the user that will authenticate to ADIDNS with the -u or --user flags. The user should be preceded by the user's domain, so it should look something like this: domain\\llt4l. This flag is optional if a list is passed instead.
• Pass the password to the program with the -p or --password flag. If you do not pass it as an argument, but do pass a username, then the program will prompt for a password when run .
• The IP address or hostname of the CUCM server should be passed to the program with either the -c or --cucm-server flag. If, for any reason, the TFTP server being used by CUCM to store phone configuration files is found on another host, please provide that address.
• Provide a file that contains a list of phone hostnames with the -l or --list flag. The file should just be a list of phone hostnames, such that each line would look something like SEP112233445566.
• If you'd like to save the results to a CSV file, pass the -s or --save flag along with the filename to be saved to.
• By default iCULeak.py checks credentials leaked for validity in the AD. To disable authentication attempts being made to verify the leaked credentials, pass the -nA or --no-authentication flag.
• To save all the phone configuration files dumped to a directory, pass the -O or --out-dir flag, along with the name of the folder you want to save it to.
• For increased verbosity, you can pass the -v or --verbose flag.
• If the DNS entries for the phones are in a different DNS zone to the default zone of the domain you are authenticating against, you can pass the zone along with the -z or --zone flag.

 

• Kali Linux 2019.1
• BlackArch Linux

git clone https://github.com/thewhiteh4t/FinalRecon.git
cd FinalRecon
pip3 install -r requirements.txt

python3 finalrecon.py -h
usage: finalrecon.py [-h] [--headers] [--sslinfo] [--whois] [--crawl] [--full]
                     url

FinalRecon - OSINT Tool for All-In-One Web Recon | v1.0.0

positional arguments:
  url         Target URL

optional arguments:
  -h, --help  show this help message and exit
  --headers   Get Header Information
  --sslinfo   Get SSL Certificate Information
  --whois     Get Whois Lookup
  --crawl     Crawl Target Website
  --full      Get Full Analysis, Test All Available Options

# Check headers

python3 finalrecon.py --headers <url>

# Check ssl Certificate

python3 finalrecon.py --sslinfo <url>

# Check whois Information

python3 finalrecon.py --whois <url>

# Crawl Target

python3 finalrecon.py --crawl <url>

# full scan

python3 finalrecon.py --full <url>

• Automatically collects basic recon (ie. whois, ping, DNS, etc.)
• Automatically launches Google hacking queries against a target domain
• Automatically enumerates open ports via NMap port scanning
• Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers
• Automatically checks for sub-domain hijacking
• Automatically runs targeted NMap scripts against open ports
• Automatically runs targeted Metasploit scan and exploit modules
• Automatically scans all web applications for common vulnerabilities
• Automatically brute forces ALL open services
• Automatically test for anonymous FTP access
• Automatically runs WPScan, Arachni and Nikto for all web services
• Automatically enumerates NFS shares
• Automatically test for anonymous LDAP access
• Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities
• Automatically enumerate SNMP community strings, services and users
• Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067
• Automatically exploit vulnerable JBoss, Java RMI and Tomcat servers
• Automatically tests for open X11 servers
• Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
• Performs high level enumeration of multiple hosts and subnets
• Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting
• Automatically gathers screenshots of all web sites
• Create individual workspaces to store all scan output

• Drupal RESTful Web Services unserialize() SA-CORE-2019-003
• Apache Struts: S2-057 (CVE-2018-11776): Security updates available for Apache Struts
• Drupal: CVE-2018-7600: Remote Code Execution - SA-CORE-2018-002
• GPON Routers - Authentication Bypass / Command Injection CVE-2018-10561
• MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
• Apache Tomcat: Remote Code Execution (CVE-2017-12617)
• Oracle WebLogic wls-wsat Component Deserialization Remote Code Execution CVE-2017-10271
• Apache Struts Content-Type arbitrary command execution (CVE-2017-5638)
• Apache Struts 2 Framework Checks - REST plugin with XStream handler (CVE-2017-9805)
• Apache Struts Content-Type arbitrary command execution (CVE-2017-5638)
• Microsoft IIS WebDav ScStoragePathFromUrl Overflow CVE-2017-7269
• ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability CVE-2015-8249
• Shellshock Bash Shell remote code execution CVE-2014-6271
• HeartBleed OpenSSL Detection CVE-2014-0160
• MS12-020: Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)
• Tomcat Application Manager Default Ovwebusr Password Vulnerability CVE-2009-3843
• MS08-067 Microsoft Server Service Relative Path Stack Corruption
• Webmin File Disclosure CVE-2006-3392
• VsFTPd 2.3.4 Backdoor
• ProFTPd 1.3.3C Backdoor
• MS03-026 Microsoft RPC DCOM Interface Overflow
• DistCC Daemon Command Execution
• JBoss Java De-Serialization
• HTTP Writable Path PUT/DELETE File Access
• Apache Tomcat User Enumeration
• Tomcat Application Manager Login Bruteforce
• Jenkins-CI Enumeration
• HTTP WebDAV Scanner
• Android Insecure ADB
• Anonymous FTP Access
• PHPMyAdmin Backdoor
• PHPMyAdmin Auth Bypass
• OpenSSH User Enumeration
• LibSSH Auth Bypass
• SMTP User Enumeration
• Public NFS Mounts

bash install.sh

bash install_debian_ubuntu.sh

docker build Dockerfile

[*] NORMAL MODE
sniper -t|--target <TARGET>

[*] NORMAL MODE + OSINT + RECON + FULL PORT SCAN + BRUTE FORCE
sniper -t|--target <TARGET> -o|--osint -re|--recon -fp|--fullportonly -b|--bruteforce

[*] STEALTH MODE + OSINT + RECON
sniper -t|--target <TARGET> -m|--mode stealth -o|--osint -re|--recon

[*] DISCOVER MODE
sniper -t|--target <CIDR> -m|--mode discover -w|--workspace <WORSPACE_ALIAS>

[*] FLYOVER MODE
sniper -t|--target <TARGET> -m|--mode flyover -w|--workspace <WORKSPACE_ALIAS>

[*] AIRSTRIKE MODE
sniper -f|--file /full/path/to/targets.txt -m|--mode airstrike

[*] NUKE MODE WITH TARGET LIST, BRUTEFORCE ENABLED, FULLPORTSCAN ENABLED, OSINT ENABLED, RECON ENABLED, WORKSPACE & LOOT ENABLED
sniper -f--file /full/path/to/targets.txt -m|--mode nuke -w|--workspace <WORKSPACE_ALIAS>

[*] SCAN ONLY SPECIFIC PORT
sniper -t|--target <TA   RGET> -m port -p|--port <portnum>

[*] FULLPORTONLY SCAN MODE
sniper -t|--target <TARGET> -fp|--fullportonly

[*] PORT SCAN MODE
sniper -t|--target <TARGET> -m|--mode port -p|--port <PORT_NUM>

[*] WEB MODE - PORT 80 + 443 ONLY!
sniper -t|--target <TARGET> -m|--mode web

[*] HTTP WEB PORT HTTP MODE
sniper -t|--target <TARGET> -m|--mode webporthttp -p|--port <port>

[*] HTTPS WEB PORT HTTPS MODE
sniper -t|--target <TARGET> -m|--mode webporthttps -p|--port <port>

[*] WEBSCAN MODE
sniper -t|--target <TARGET> -m|--mode webscan

[*] ENABLE BRUTEFORCE
sniper -t|--target <TARGET> -b|--bruteforce

[*] ENABLE LOOT IMPORTING INTO METASPLOIT
sniper -t|--target <TARGET>

[*] LOOT REIMPORT FUNCTION
sniper -w <WORKSPACE_ALIAS> --reimport

[*] LOOT REIMPORTALL FUNCTION
sniper -w <WORKSPACE_ALIAS&   gt; --reimportall

[*] DELETE WORKSPACE
sniper -w <WORKSPACE_ALIAS> -d

[*] DELETE HOST FROM WORKSPACE
sniper -w <WORKSPACE_ALIAS> -t <TARGET> -dh

[*] SCHEDULED SCANS'
sniper -w <WORKSPACE_ALIAS> -s daily|weekly|monthly'

[*] SCAN STATUS
sniper --status

[*] UPDATE SNIPER
sniper -u|--update

• NORMAL: Performs basic scan of targets and open ports using both active and passive checks for optimal performance.
• STEALTH: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking.
• FLYOVER: Fast multi-threaded high level scans of multiple targets (useful for collecting high level data on many hosts quickly).
• AIRSTRIKE: Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IPs that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.
• NUKE: Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke.
• DISCOVER: Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans.
• PORT: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode.
• FULLPORTONLY: Performs a full detailed port scan and saves results to XML.
• WEB: Adds full automatic web application scans to the results (port 80/tcp & 443/tcp only). Ideal for web applications but may increase scan time significantly.
• WEBPORTHTTP: Launches a full HTTP web application scan against a specific host and port.
• WEBPORTHTTPS: Launches a full HTTPS web application scan against a specific host and port.
• WEBSCAN: Launches a full HTTP & HTTPS web application scan against via Burpsuite and Arachni.

$ git clone https://github.com/Edu4rdSHL/findomain.git
$ cd findomain
$ cargo build --release
$ sudo cp target/release/findomain /usr/bin/
$ findomain

$ git clone https://github.com/Edu4rdSHL/findomain.git
$ sudo cp findomain/bin/findomain /usr/bin
$ findomain

$ sudo pacman -S findomain

findomain 0.1.3
Eduard Tolosa <tolosaeduard@gmail.com>
A tool that use Certificates Transparency logs to find subdomains.

USAGE:
    findomain [FLAGS] [OPTIONS]

FLAGS:
    -h, --help       Prints help information
    -i, --get-ip     Return the subdomain list with IP address if resolved.
    -V, --version    Prints version information

OPTIONS:
    -f, --file <file>        Sets the input file to use.
    -o, --output <output>    Write data to output file in the specified format. [possible values: txt, csv, json]
    -t, --target <target>    Target host

• Discover subdomains without brute-force, it tool uses Certificate Transparency Logs.
• Discover subdomains with or without IP address according to user arguments.
• Read target from user argument (-t).
• Read a list of targets from file and discover their subdomains with or without IP and also write to output files per-domain if specified by the user, recursively.
• Write output to TXT file.
• Write output to CSV file.
• Write output to JSON file.
• Cross platform support: Linux, Windows, MacOS.