extended scan and some improvements to pentest_functions.zsh

profile_files/.zsh/pentest_functions.zsh

@@ -1,4 +1,11 @@
 # Experimental version!
+# Any commit can highly modify anything currently!
+#
+# This is the main file of PTZ.
+#
+# Logic
+# Provided IP -> vhost enum -> scan everything connected-> Identify services -> Vuln scan -> Add to queryable db
+# Provided domain name -> ip enum -> scan everything connected -> Identify services -> Vuln scan -> Add to queryable db
 
 debug=1
 
@@ -28,25 +35,25 @@ function n {
 
 function ptzdepchk {
     # check if dependencies are met or not
-    type john >/dev/null 2>&1 || { echo >&2 "john is missing."; }
+    type python >/dev/null 2>&1 || { echo >&2 "python is missing."; }
-    type zip >/dev/null 2>&1 || { echo >&2 "zip is missing."; }
-    type rar >/dev/null 2>&1 || { echo >&2 "rar is missing."; }
     type wget >/dev/null 2>&1 || { echo >&2 "wget is missing."; }
     type openssl >/dev/null 2>&1 || { echo >&2 "openssl is missing."; }
-    type torsocks >/dev/null 2>&1 || { echo >&2 "torsocks is missing."; }
+    type john >/dev/null 2>&1 || { echo >&2 "john is missing."; }
+    type rar >/dev/null 2>&1 || { echo >&2 "rar is missing."; }
+    type zip >/dev/null 2>&1 || { echo >&2 "zip is missing."; }
+    type unzip >/dev/null 2>&1 || { echo >&2 "unzip is missing."; }
     type tor >/dev/null 2>&1 || { echo >&2 "tor is missing."; }
+    type torsocks >/dev/null 2>&1 || { echo >&2 "torsocks is missing."; }
     type traceroute >/dev/null 2>&1 || { echo >&2 "traceroute is missing."; }
     type theharvester >/dev/null 2>&1 || { echo >&2 "theharvester is missing."; }
     type dnsenum >/dev/null 2>&1 || { echo >&2 "dnsenum is missing."; }
     type fierce >/dev/null 2>&1 || { echo >&2 "fierce is missing."; }
     type nmap >/dev/null 2>&1 || { echo >&2 "nmap is missing."; }
     type searchsploit >/dev/null 2>&1 || { echo >&2 "searchsploit is missing."; }
-    type unzip >/dev/null 2>&1 || { echo >&2 "unzip is missing."; }
     #type dig >/dev/null 2>&1 || { echo >&2 "dig is missing."; }
     #type curl  >/dev/null 2>&1 || { echo >&2 "curl is missing."; }
     #type arachni >/dev/null 2>&1 || { echo >&2 "arachni is missing."; }
     #type hydra >/dev/null 2>&1 || { echo >&2 "hydra is missing."; }
-    type  python >/dev/null 2>&1 || { echo >&2 "python is missing."; }
     #type dirb >/dev/null 2>&1 || { echo >&2 "dirb is missing."; }
      
 }
@@ -211,6 +218,7 @@ function dns_enum_tof {
 
     # vhost enumeration missing yet
     while read ipv ; do dig +short -x $ipv >> 7_vhosts_enumerated.txt ; done < 5_ip_list_of_target.txt 
+   
     cd
 }
 
@@ -267,6 +275,16 @@ function scan_enum_tof {
     searchsploit -v --nmap 8_nmap_for_searchsploit.xml > 9_searchslpoit_results.txt
     rm 8_nmap_for_searchsploit.nmap 8_nmap_for_searchsploit.gnmap
     echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished the searchsploit queries. Outputs are in the relevant files." >> scan_history.txt
+
+
+    # single nmap for all ports. thinking about this.. this is long, but more torough + replaces the others!
+    echo $(date +"%Y-%m-%d-%H-%M-%S") " Started all TCP ports / extended UDP scan for automatic searchsploit." >> scan_history.txt
+    nmap -sSU -p T:1-65535,U:7,9,11,13,17,19,20,37,39,42,49,52-54,65-71,81,111,161,123,136-170,514-518,630,631,636-640,650,653,921,1023-1030,1900,2048-2050,27900,27960,32767-32780,32831 -sV -O --script="(default or vuln or auth or brute or discovery) and not (broadcast or dos)" --script-args="unsafe=1,userdb=admin,passwd=admin" --host-timeout=180m --max-hostgroup=1 -Pn -oA 99_nmap_for_searchsploit $targetx
+    searchsploit -v --nmap 99_nmap_for_searchsploit.xml > 99_allports_searchslpoit_results.txt
+    rm 99_nmap_for_searchsploit.nmap 99_nmap_for_searchsploit.gnmap
+    echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished the extended ports scan and searchsploit queries. Outputs are in the relevant files." >> scan_history.txt
+
+ 
     cd
 }