forked from ShivamRai2003/Reconky-Automated_Bash_Script
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathreconky.sh
146 lines (146 loc) · 6.3 KB
/
reconky.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
#!/usr/bin/bash
#Author:Shivam Rai/
#Date:18/06/2021
#Description:Automated Recon tool
echo "
--------- _______ _______ _______ _______ _ _
( ____ )( ____ \( ____ \( ___ )( ( /|| \ /\|\ /|
| ( )|| ( \/| ( \/| ( ) || \ ( || \ / /( \ / )
| (____)|| (__ | | | | | || \ | || (_/ / \ (_) /
| __)| __) | | | | | || (\ \) || _ ( \ /
| (\ ( | ( | | | | | || | \ || ( \ \ ) (
| ) \ \__| (____/\| (____/\| (___) || ) \ || / \ \ | |
|/ \__/(_______/(_______/(_______)|/ )_)|_/ \/ \_/
"
if [[ $(id -u) != 0 ]]; then
echo -e "\n[!] Install.sh requires root privileges"
exit 0
fi
target=$1
if [ ! -d "$target" ];then
mkdir $target
fi
if [ ! -d "$target/reconky" ];then
mkdir $target/reconky
fi
if [ ! -d '$target/reconky/sublist3r' ];then
mkdir $target/reconky/sublist3r
touch $target/reconky/sublist3r/subdomains.txt
fi
if [ ! -d '$tagget/reconky/httprobe' ]; then
mkdir $target/reconky/httprobe
fi
if [ ! -d '$target/reconky/assetfinder' ];then
mkdir $target/reconky/assetfinder
touch $target/reconky/assetfinder/subdomains1.txt
fi
if [ ! -d '$target/reconky/Subdomain_Takeover' ]; then
mkdir $target/reconky/Subdomain_Takeover
fi
if [ ! -d '$target/reconky/scans' ]; then
mkdir $target/reconky/scans
fi
if [ ! -d '$target/reconky/wayback_urls' ]; then
mkdir $target/reconky/wayback_urls
mkdir $target/reconky/wayback_urls/params
touch $target/reconky/wayback_urls/params/params.txt
mkdir $target/reconky/wayback_urls/extensions
fi
if [ ! -d '$target/reconky/amass' ]; then
mkdir $target/reconky/amass
touch $target/reconky/amass/subdomains2.txt
fi
if [ ! -d '$target/reconky/witness' ]; then
mkdir $target/reconky/eyewitness
fi
if [ ! -d '$target/reconky/knockpy' ]; then
mkdir $target/reconky/knockpy
touch $target/reconky/knockpy/subdomains3.txt
fi
if [ ! -f "$target/reconky/httprobe/alivee.txt" ];then
touch $target/reconky/httprobe/alivee.txt
fi
red=`tput setaf 1`
green=`tput setaf 2`
yellow=`tput setaf 3`
echo
echo ${yellow}"Welcome to the Reconky Script-An Excellent Automation Script For Bug Bounty/Pentesting"${yellow}
echo
echo ${red}"[+++] Gatherings subdomains with assetfinder and Sublist3r...[+++]"${red}
echo
echo ${red}"[+++] Duplex checking for subdomains with amass...[+++]"${red}
echo
echo ${red}"[+++] Enumerating subdomains on a target domain through dictionary attack...[+++]"${red}
echo
echo ${red}"[+++] Searching for alive domains using Httprobe...[+++]"${red}
echo
echo ${red}"[+++] Investigating for feasible subdomain takeover...[+++]"${red}
echo
echo ${green}"[+++] Scanning for open ports using nmap...[+++]"${green}
echo
echo ${green}"[+++] Pulling and Assembling all possible params found in wayback_url data...[+++]"${green}
echo
echo ${green}"[+++] Pulling and compiling json/js/php/aspx/ files from wayback output...[+++]"${green}
echo
echo ${green}"[+++] Running gowtiness(eyewitness) against all the compiled(alive) domains...[+++]"${green}
echo
echo ${yellow}"[+++]Recon is in Progress Take A Cofee or Tea ;)[+++]"${yellow}
echo
assetfinder $target >> $target/reconky/assetfinder/subdomains1.txt
cat $target/reconky/assetfinder/subdomains1.txt | grep $1 >> $target/reconky/Subdomain_final.txt
echo
sublist3r -d $target -v -t 100 -o $target/reconky/sublist3r/subdomains.txt
cat $target/reconky/sublist3r/subdomains.txt | grep $1 >> $target/reconky/Subdomain_final.txt
echo
amass enum -d $target -o $target/reconky/amass/subdomains2.txt
cat $target/reconky/amass/subdomains2.txt | grep $1 >> $target/reconky/Subdomain_final.txt
echo
knockpy $target >> $target/reconky/knockpy/subdomains3.txt
awk '/$target/ {print}' $target/reconky/knockpy/subdomains3.txt | cut -d " " -f 9 >> $target/reconky/Subdomain_final.txt
echo
cat $target/reconky/Subdomain_final.txt | sort -u | httprobe | sed -E 's/^\s*.*:\/\///g' >> $target/reconky/httprobe/alivee.txt
echo
if [ ! -f "$target/reconky/Subdomain_Takeover/Subdomain_Takeover.txt" ];then
touch $target/reconky/Subdomain_Takeover/Subdomain_Takeover.txt
fi
subjack -w $target/reconky/Subdomain_final.txt -t 70 -timeout 25 -ssl -c /root/go/src/github.com/haccer/subjack/fingerprints.json -v 3 -o $target/reconky/Subdomain_Takeover/Subdomain_Takeover.txt
echo
nmap -iL $target/reconky/httprobe/alivee.txt -T4 -oA $target/reconky/scans/scanned.txt
echo
if [ ! -f "$target/reconky/wayback_urls/wayback_output.txt" ];then
touch $target/reconky/wayback_urls/wayback_output.txt
fi
cat $target/reconky/Subdomain_final.txt | waybackurls >> $target/reconky/wayback_urls/wayback_output.txt
sort -u $target/reconky/wayback_urls/wayback_output.txt
cat $target/reconky/wayback_urls/wayback_output.txt | grep '?*=' | cut -d '=' -f 1 | sort -u >> $target/reconky/wayback_urls/params/params.txt
for i in $(cat $target/reconky/wayback_urls/params/params.txt);do echo $i'=';done
echo
for i in $(cat $target/reconky/wayback_urls/wayback_output.txt);do
ext="${i##*.}"
if [[ "ext"=="php" ]];then
echo $i >> $target/reconky/wayback_urls/extensions/php1.txt
sort -u $target/reconky/wayback_urls/extensions/php1.txt >> $target/reconky/wayback_urls/extensions/php.txt
rm $target/reconky/wayback_urls/extensions/php1.txt
fi
if [[ "ext"=="js" ]];then
echo $i >> $target/reconky/wayback_urls/extensions/js1.txt
sort -u $target/reconky/wayback_urls/extensions/js1.txt >> $target/reconky/wayback_urls/extensions/js.txt
rm $target/reconky/wayback_urls/extensions/js1.txt
fi
if [[ "ext"=="html" ]];then
echo $i >> $target/reconky/wayback_urls/extensions/html1.txt
sort -u $target/reconky/wayback_urls/extensions/html1.txt >> $target/reconky/wayback_urls/extensions/html.txt
rm $target/reconky/wayback_urls/extensions/html1.txt
fi
if [[ "ext"=="json" ]];then
echo $i >> $target/reconky/wayback_urls/extensions/json1.txt
sort -u $target/reconky/wayback_urls/extensions/json1.txt >> $target/reconky/wayback_urls/extensions/json.txt
rm $target/reconky/wayback_urls/extensions/json1.txt
fi
if [[ "ext"=="aspx" ]];then
echo $i >> $target/reconky/wayback_urls/extensions/aspx1.txt
sort -u $target/reconky/wayback_urls/extensions/aspx1.txt >> $target/reconky/wayback_urls/extensions/aspx.txt
rm $target/reconky/wayback_urls/extensions/aspx1.txt
fi
done
eyewitness -f $target/reconky/httprobe/alivee.txt --web -d $target/reconky/eyewitness --resolve