pentest.sh

#!/bin/bash

#This script is only for an Educational purpose. Any actions and or activities related to the material contained
#within this repo is solely your responsibility.The misuse of the information in this repo can result in criminal
#charges brought against the persons in question. The author Vishnu Nair will not be held responsible in the
#event any criminal charges be brought against any individuals misusing the information in this repo to break the law.

DOMAIN=""
printhelp() {

echo "
Usage: sh pentest.sh [OPTION]...
  -d, --domain   Provide your DOMAIN domain.
  -h, --help     Display help file
"

}
while [ "$1" != "" ]; do
  case "$1" in
    -d | --domain )       DOMAIN=$2; shift 2 ;;
    -h | --help )	        echo "$(printhelp)"; exit; shift; break ;;
  esac
done

echo "YOUR TARGET DOMAIN IS:" $DOMAIN
echo ""
echo ""
echo ""
echo "╔════════════════════════════════╗"
echo "║            DNS DETAILS         ║"
echo "╚════════════════════════════════╝"
echo ""
echo "whois started"
whois $DOMAIN > whois-report.txt
echo "╔══════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of whois saved in /src/whois-report.html/              ║"
echo "╚══════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "whois finished"
echo ""
echo "nslookup started"
nslookup $DOMAIN > nslookup-report.txt
echo "╔══════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of nslookup saved in /src/wnslookup-report.html        ║"
echo "╚══════════════════════════════════════════════════════════════════════════════╝"
echo "nslookup finished"
echo ""
echo "Nmap Scanning Started"
nmap -v -O $DOMAIN > nmap-report.txt
echo "╔══════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of Nmap saved in /src/nmap-report.html                 ║"
echo "╚══════════════════════════════════════════════════════════════════════════════╝"
echo "Nmap Scanning finished"
echo ""
echo "Uniscan  Started"
uniscan -u http://$DOMAIN/ -qwedsgj
mkdir -p /src/uniscan && cp -rvf /usr/share/uniscan/report/*  /src/uniscan
echo "╔══════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of Uniscan is saved in /src/uniscan/report/            ║"
echo "╚══════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "Uniscan finished"
echo ""
echo "Starting theharvester – A tool for gathering e-mail accounts and subdomain names from public sources"
theharvester -d $DOMAIN -l 50 -b all -f theharvester-report.txt
echo "╔════════════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of theharvester is saved in /src/theharvester-report.html    ║"
echo "╚════════════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "theharvester is finished"
echo ""
echo "Starting Dnsrecon -  A powerful DNS enumeration script"
dnsrecon -d $DOMAIN -t axfr > dnsrecon-report.txt
dnsrecon -D /usr/share/dnsrecon/namelist.txt -t brt -d $DOMAIN > dnsrecon-bruteforce.txt
dnsrecon -d $DOMAIN -a > dnsrecon-zone-transfer.txt
dnsrecon -d $DOMAIN -t tld > dnsrecon-tld.txt
echo "╔════════════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of dnsrecon is saved in /src/dnsrecon-*.html                 ║"
echo "╚════════════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "Dnsrecon is finished"
echo ""
echo "dnsmap started"
dnsmap $DOMAIN -r dnsmap-report.txt
echo "╔════════════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of dnsmap is saved in /src/dnsmap-report.html                ║"
echo "╚════════════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "dnsmap finished"
echo ""
echo "Starting dirb – A web content scanner"
dirb http://$DOMAIN -o dirb-report.txt
echo "╔════════════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of dirb is saved in /src/dirb-report.html                    ║"
echo "╚════════════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "Finished dirb"
echo ""
echo ""
echo ""
echo ""
echo ""
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║             Web Application Firewall Scanning Starting         ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo "scanning WAF with wafw00f"
wafw00f http://$DOMAIN > waf-report.txt
echo "╔════════════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of wafw00f is saved in /src/waf-report.html                  ║"
echo "╚════════════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "scanning WAF finished..."
echo ""
echo ""
echo "scanning with Nikto started"
nikto -host $DOMAIN -Plugins "apacheusers(enumerate,dictionary:users.txt);report_xml" -output nikto-report.txt
echo "╔════════════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of nikto is saved in /src/nikto-report.html                  ║"
echo "╚════════════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "scanning with Nikto finished"
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║             Web Application Firewall Scanning Finished         ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo ""
echo ""
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   XSS Scanning Starting                        ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo "XssPy started"
python /src/XssPy/XssPy.py -e -v -u $DOMAIN > xss-report.txt
echo "╔════════════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of XssPy is saved in /src/xss-report.html                    ║"
echo "╚════════════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "XssPy finished"
echo ""
echo ""
echo "XSStrike started"
python3 /src/XSStrike/xsstrike.py -u "https://$DOMAIN?q=query" --console-log-level DEBUG > xsstrike-report.txt
echo "==============start xsstrike crawl==============" >> xsstrike-report.html
python3 /src/XSStrike/xsstrike.py -u "https://$DOMAIN" --crawl --console-log-level DEBUG >> xsstrike-report.txt
echo "==============finished xsstrike crawl==============" >> xsstrike-report.html
echo "==============start xsstrike params==============" >> xsstrike-report.html
python3 /src/XSStrike/xsstrike.py -u "https://$DOMAIN" --params --console-log-level DEBUG >> xsstrike-report.txt
echo "==============finished xsstrike params==============" >> xsstrike-report.html
echo "==============start xsstrike fuzzer==============" >> xsstrike-report.html
python3 /src/XSStrike/xsstrike.py -u "https://$DOMAIN" --fuzzer --console-log-level DEBUG >> xsstrike-report.txt
echo "==============finished xsstrike fuzzer==============" >> xsstrike-report.html
echo "╔════════════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of XSStrike is saved in /src/xsstrike-report.html            ║"
echo "╚════════════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   XSS Scanning Finished                        ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo ""
echo ""
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║              Web / CMS Vulnerability Scanning Starting         ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo "starting WhatWeb - Next generation web scanner"
whatweb -v -a 3 $DOMAIN > whatweb-report.txt
echo "╔══════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of whatweb is saved in /src/whatweb-report.html        ║"
echo "╚══════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo ""
echo "Finished WhatWeb"
echo ""
echo ""
echo "starting Wapiti"
wapiti -u https://$DOMAIN/ -o wapiti_result -f html
echo "Finished Wapiti"
echo "╔══════════════════════════════════════════════════════════════════════════════╗"
echo "║            The output of Wapiti is saved in /src/wapiti_result/              ║"
echo "╚══════════════════════════════════════════════════════════════════════════════╝"
echo ""
echo ""
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   Scan Wordpress Starting                      ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo ""
echo "Starting wpscan - is a black box WordPress vulnerability scanner"
wpscan --url http://$DOMAIN --enumerate u > wpscan-report.txt
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   Scan Wordpress Finished                      ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   Scan Joomla Starting                         ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo "Starting Joomscan - joomla Vulnerability Scan"
joomscan -u http://$DOMAIN > joomscan-report.txt
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   Scan Joomla Finished                         ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   Scan Other CMS Starting                      ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo ""
echo "scan drupal cms"
droopescan scan drupal -u http://$DOMAIN > droopescan-drupal.txt
echo "scan dupal cms finished next...."
echo ""
echo "scan silverstripe cms"
droopescan scan silverstripe -u http://$DOMAIN > droopescan-silverstripe.txt
echo "scan silverstripe cms finished next..... "
echo ""
echo "scan moodle cms"
droopescan scan moodle -u http://$DOMAIN > droopescan-moodle.txt
echo "scan moodle cms finished next..... "
echo ""
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   Scan Other CMS Finished                      ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║               CMS Vulnerability Scanning Finished              ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   SSL Vulnerability Scanning Starting          ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo "starting sslscan"
sslscan $DOMAIN > sslscan-report.txt
echo "sslscan is finished"
echo ""
echo "starting sslyze - Fast and full-featured SSL scanner"
sslyze --regular $DOMAIN > sslyze-report.txt
echo "sslyze is finished"
echo ""
echo "A2SV Scanning started"
python /src/a2sv/a2sv.py -t $DOMAIN > a2sv-report.txt
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   SSL Vulnerability Scanning Finished          ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   Fuzz Scanning Starting                       ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo "starting fuzzing with wfuzz"
wfuzz -c -z file,/usr/share/wfuzz/wordlist/general/common.txt --hc 404 https://$DOMAIN/index.php?id=FUZZ > wfuzz-report.txt
echo "fuzzing finished"
echo ""
echo ""
#echo "starting .php web dir started"
#dirbuster -v -H -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -u https://$DOMAIN/index.php?url={dir}.php -e php -r /src/dirbuster-php -t 20
#echo "fuzzing .php web dir finished"
#echo ""
#echo ""
#echo "starting .html web dir started"
#dirbuster -v -H -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -u https://$DOMAIN/index.html?url={dir}.html -e html -r /src/dirbuster-html -t 20
#echo "fuzzing .html web dir finished"
#echo ""
#echo ""
#echo ""
#echo "starting .asp web dir started"
#dirbuster -v -H -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -u https://$DOMAIN/index.asp?url={dir}.net -e asp -r /src/dirbuster-asp -t 20
#echo "fuzzing .asp web dir finished"

echo "starting metagoofil – Tool designed for extracting metadata of public documents"
metagoofil -d $DOMAIN -t ALL -l 200 -n 50 -o /src -f -w
echo "metagoofil finished"
echo ""
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                   Fuzz  Scanning Finished                      ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""
echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                    Automated Pentest finished                  ║"
echo "╚════════════════════════════════════════════════════════════════╝"