six
/
PTZ
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

extended scan and some improvements to pentest_functions.zsh

master
51x 2017-01-16 21:06:37 +01:00
parent 85d6e65b5d
commit e9d9ee2941
1 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
profile_files/.zsh/pentest_functions.zsh
View File

@ -1,4 +1,11 @@
# Experimental version!
# Any commit can highly modify anything currently!
#
# This is the main file of PTZ.
#
# Logic
# Provided IP -> vhost enum -> scan everything connected-> Identify services -> Vuln scan -> Add to queryable db
# Provided domain name -> ip enum -> scan everything connected -> Identify services -> Vuln scan -> Add to queryable db
debug=1
@ -28,25 +35,25 @@ function n {
function ptzdepchk {
# check if dependencies are met or not
type john >/dev/null 2>&1 || { echo >&2 "john is missing."; }
type zip >/dev/null 2>&1 || { echo >&2 "zip is missing."; }
type rar >/dev/null 2>&1 || { echo >&2 "rar is missing."; }
type python >/dev/null 2>&1 || { echo >&2 "python is missing."; }
type wget >/dev/null 2>&1 || { echo >&2 "wget is missing."; }
type openssl >/dev/null 2>&1 || { echo >&2 "openssl is missing."; }
type torsocks >/dev/null 2>&1 || { echo >&2 "torsocks is missing."; }
type john >/dev/null 2>&1 || { echo >&2 "john is missing."; }
type rar >/dev/null 2>&1 || { echo >&2 "rar is missing."; }
type zip >/dev/null 2>&1 || { echo >&2 "zip is missing."; }
type unzip >/dev/null 2>&1 || { echo >&2 "unzip is missing."; }
type tor >/dev/null 2>&1 || { echo >&2 "tor is missing."; }
type torsocks >/dev/null 2>&1 || { echo >&2 "torsocks is missing."; }
type traceroute >/dev/null 2>&1 || { echo >&2 "traceroute is missing."; }
type theharvester >/dev/null 2>&1 || { echo >&2 "theharvester is missing."; }
type dnsenum >/dev/null 2>&1 || { echo >&2 "dnsenum is missing."; }
type fierce >/dev/null 2>&1 || { echo >&2 "fierce is missing."; }
type nmap >/dev/null 2>&1 || { echo >&2 "nmap is missing."; }
type searchsploit >/dev/null 2>&1 || { echo >&2 "searchsploit is missing."; }
type unzip >/dev/null 2>&1 || { echo >&2 "unzip is missing."; }
#type dig >/dev/null 2>&1 || { echo >&2 "dig is missing."; }
#type curl >/dev/null 2>&1 || { echo >&2 "curl is missing."; }
#type arachni >/dev/null 2>&1 || { echo >&2 "arachni is missing."; }
#type hydra >/dev/null 2>&1 || { echo >&2 "hydra is missing."; }
type python >/dev/null 2>&1 || { echo >&2 "python is missing."; }
#type dirb >/dev/null 2>&1 || { echo >&2 "dirb is missing."; }
}
@ -211,6 +218,7 @@ function dns_enum_tof {
# vhost enumeration missing yet
while read ipv ; do dig +short -x $ipv >> 7_vhosts_enumerated.txt ; done < 5_ip_list_of_target.txt
cd
}
@ -267,6 +275,16 @@ function scan_enum_tof {
searchsploit -v --nmap 8_nmap_for_searchsploit.xml > 9_searchslpoit_results.txt
rm 8_nmap_for_searchsploit.nmap 8_nmap_for_searchsploit.gnmap
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished the searchsploit queries. Outputs are in the relevant files." >> scan_history.txt
# single nmap for all ports. thinking about this.. this is long, but more torough + replaces the others!
echo $(date +"%Y-%m-%d-%H-%M-%S") " Started all TCP ports / extended UDP scan for automatic searchsploit." >> scan_history.txt
nmap -sSU -p T:1-65535,U:7,9,11,13,17,19,20,37,39,42,49,52-54,65-71,81,111,161,123,136-170,514-518,630,631,636-640,650,653,921,1023-1030,1900,2048-2050,27900,27960,32767-32780,32831 -sV -O --script="(default or vuln or auth or brute or discovery) and not (broadcast or dos)" --script-args="unsafe=1,userdb=admin,passwd=admin" --host-timeout=180m --max-hostgroup=1 -Pn -oA 99_nmap_for_searchsploit $targetx
searchsploit -v --nmap 99_nmap_for_searchsploit.xml > 99_allports_searchslpoit_results.txt
rm 99_nmap_for_searchsploit.nmap 99_nmap_for_searchsploit.gnmap
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished the extended ports scan and searchsploit queries. Outputs are in the relevant files." >> scan_history.txt
cd
}