Sn1per v7.0 - Automated Pentest Framework For Offensive Security Experts

• Automatically collects basic recon (ie. whois, ping, DNS, etc.)
• Automatically launches Google hacking queries against a target domain
• Automatically enumerates open ports via NMap port scanning
• Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers
• Automatically checks for sub-domain hijacking
• Automatically runs targeted NMap scripts against open ports
• Automatically runs targeted Metasploit scan and exploit modules
• Automatically scans all web applications for common vulnerabilities
• Automatically brute forces ALL open services
• Automatically test for anonymous FTP access
• Automatically runs WPScan, Arachni and Nikto for all web services
• Automatically enumerates NFS shares
• Automatically test for anonymous LDAP access
• Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities
• Automatically enumerate SNMP community strings, services and users
• Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067
• Automatically exploit vulnerable JBoss, Java RMI and Tomcat servers
• Automatically tests for open X11 servers
• Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
• Performs high level enumeration of multiple hosts and subnets
• Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting
• Automatically gathers screenshots of all web sites
• Create individual workspaces to store all scan output

• Drupal RESTful Web Services unserialize() SA-CORE-2019-003
• Apache Struts: S2-057 (CVE-2018-11776): Security updates available for Apache Struts
• Drupal: CVE-2018-7600: Remote Code Execution - SA-CORE-2018-002
• GPON Routers - Authentication Bypass / Command Injection CVE-2018-10561
• MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
• Apache Tomcat: Remote Code Execution (CVE-2017-12617)
• Oracle WebLogic wls-wsat Component Deserialization Remote Code Execution CVE-2017-10271
• Apache Struts Content-Type arbitrary command execution (CVE-2017-5638)
• Apache Struts 2 Framework Checks - REST plugin with XStream handler (CVE-2017-9805)
• Apache Struts Content-Type arbitrary command execution (CVE-2017-5638)
• Microsoft IIS WebDav ScStoragePathFromUrl Overflow CVE-2017-7269
• ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability CVE-2015-8249
• Shellshock Bash Shell remote code execution CVE-2014-6271
• HeartBleed OpenSSL Detection CVE-2014-0160
• MS12-020: Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)
• Tomcat Application Manager Default Ovwebusr Password Vulnerability CVE-2009-3843
• MS08-067 Microsoft Server Service Relative Path Stack Corruption
• Webmin File Disclosure CVE-2006-3392
• VsFTPd 2.3.4 Backdoor
• ProFTPd 1.3.3C Backdoor
• MS03-026 Microsoft RPC DCOM Interface Overflow
• DistCC Daemon Command Execution
• JBoss Java De-Serialization
• HTTP Writable Path PUT/DELETE File Access
• Apache Tomcat User Enumeration
• Tomcat Application Manager Login Bruteforce
• Jenkins-CI Enumeration
• HTTP WebDAV Scanner
• Android Insecure ADB
• Anonymous FTP Access
• PHPMyAdmin Backdoor
• PHPMyAdmin Auth Bypass
• OpenSSH User Enumeration
• LibSSH Auth Bypass
• SMTP User Enumeration
• Public NFS Mounts

bash install.sh

bash install_debian_ubuntu.sh

docker build Dockerfile

[*] NORMAL MODE
sniper -t|--target <TARGET>

[*] NORMAL MODE + OSINT + RECON + FULL PORT SCAN + BRUTE FORCE
sniper -t|--target <TARGET> -o|--osint -re|--recon -fp|--fullportonly -b|--bruteforce

[*] STEALTH MODE + OSINT + RECON
sniper -t|--target <TARGET> -m|--mode stealth -o|--osint -re|--recon

[*] DISCOVER MODE
sniper -t|--target <CIDR> -m|--mode discover -w|--workspace <WORSPACE_ALIAS>

[*] FLYOVER MODE
sniper -t|--target <TARGET> -m|--mode flyover -w|--workspace <WORKSPACE_ALIAS>

[*] AIRSTRIKE MODE
sniper -f|--file /full/path/to/targets.txt -m|--mode airstrike

[*] NUKE MODE WITH TARGET LIST, BRUTEFORCE ENABLED, FULLPORTSCAN ENABLED, OSINT ENABLED, RECON ENABLED, WORKSPACE & LOOT ENABLED
sniper -f--file /full/path/to/targets.txt -m|--mode nuke -w|--workspace <WORKSPACE_ALIAS>

[*] SCAN ONLY SPECIFIC PORT
sniper -t|--target <TA   RGET> -m port -p|--port <portnum>

[*] FULLPORTONLY SCAN MODE
sniper -t|--target <TARGET> -fp|--fullportonly

[*] PORT SCAN MODE
sniper -t|--target <TARGET> -m|--mode port -p|--port <PORT_NUM>

[*] WEB MODE - PORT 80 + 443 ONLY!
sniper -t|--target <TARGET> -m|--mode web

[*] HTTP WEB PORT HTTP MODE
sniper -t|--target <TARGET> -m|--mode webporthttp -p|--port <port>

[*] HTTPS WEB PORT HTTPS MODE
sniper -t|--target <TARGET> -m|--mode webporthttps -p|--port <port>

[*] WEBSCAN MODE
sniper -t|--target <TARGET> -m|--mode webscan

[*] ENABLE BRUTEFORCE
sniper -t|--target <TARGET> -b|--bruteforce

[*] ENABLE LOOT IMPORTING INTO METASPLOIT
sniper -t|--target <TARGET>

[*] LOOT REIMPORT FUNCTION
sniper -w <WORKSPACE_ALIAS> --reimport

[*] LOOT REIMPORTALL FUNCTION
sniper -w <WORKSPACE_ALIAS&   gt; --reimportall

[*] DELETE WORKSPACE
sniper -w <WORKSPACE_ALIAS> -d

[*] DELETE HOST FROM WORKSPACE
sniper -w <WORKSPACE_ALIAS> -t <TARGET> -dh

[*] SCHEDULED SCANS'
sniper -w <WORKSPACE_ALIAS> -s daily|weekly|monthly'

[*] SCAN STATUS
sniper --status

[*] UPDATE SNIPER
sniper -u|--update

• NORMAL: Performs basic scan of targets and open ports using both active and passive checks for optimal performance.
• STEALTH: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking.
• FLYOVER: Fast multi-threaded high level scans of multiple targets (useful for collecting high level data on many hosts quickly).
• AIRSTRIKE: Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IPs that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.
• NUKE: Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke.
• DISCOVER: Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans.
• PORT: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode.
• FULLPORTONLY: Performs a full detailed port scan and saves results to XML.
• WEB: Adds full automatic web application scans to the results (port 80/tcp & 443/tcp only). Ideal for web applications but may increase scan time significantly.
• WEBPORTHTTP: Launches a full HTTP web application scan against a specific host and port.
• WEBPORTHTTPS: Launches a full HTTPS web application scan against a specific host and port.
• WEBSCAN: Launches a full HTTP & HTTPS web application scan against via Burpsuite and Arachni.