API tools faq
paste
leonteale

Automator2.sh (Kali linux)

leonteale
Jul 18th, 2013
226
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 6.75 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2.  
  3. #Automatically run recon against a domain/list of domains.
  4. #Built for Backtrack
  5. #
  6. # Current Features:
  7. # * DNS Recon
  8. # * Email Harvesting
  9. # * Meta Data Enumeration
  10. # * WhoIs
  11. #
  12. # Additional Features
  13. # * Pull domains from SSL Certificate
  14. #
  15. # Usage: ./automator.sh listofdomains.txt
  16. # Usage: ./automator.sh domain.com
  17. #
  18. # By: Leon Teale (~leonteale)
  19. #
  20.  
  21. ## Setting Coloured variables
  22. red=`echo -e "\033[31m"`
  23. lcyan=`echo -e "\033[36m"`
  24. yellow=`echo -e "\033[33m"`
  25. green=`echo -e "\033[32m"`
  26. blue=`echo -e "\033[34m"`
  27. purple=`echo -e "\033[35m"`
  28. normal=`echo -e "\033[m"`
  29.  
  30. ## Check for correct usage
  31. if [ -z "$1" ];
  32. then
  33. echo ""
  34. echo "Usage: ./automator.sh listofdomains.txt"
  35. echo "Usage: ./automator.sh domain.com"
  36. echo ""
  37.  
  38. ## Run script on correct usage
  39. else
  40.  
  41. ##Set Variables
  42. domain="$1"
  43. output_dir="~/Desktop"
  44.  
  45. #Run scripts without arguments
  46. clear
  47. echo "$yellow                _                        _             "
  48. echo "$yellow     /\        | |                      | |            "
  49. echo "$yellow    /  \  _   _| |_ ___  _ __ ___   __ _| |_ ___  _ __ "
  50. echo "$yellow   / /\ \| | | | __/ _ \| '_ \` _ \ / _\` | __/ _ \| '__|"
  51. echo "$yellow  / ____ \ |_| | || (_) | | | | | | (_| | || (_) | | "
  52. echo "$yellow /_/    \_\__,_|\__\___/|_| |_| |_|\__,_|\__\___/|_|$normal"
  53. echo "$lcyan  -- by Leon Teale (@leonteale)"
  54. echo ""
  55. echo "$blue +-------------------------------------------+"
  56. echo "$blue | $red Current Features$normal                      $blue   |$normal"
  57. echo "$blue | $yellow * DNS Recon$normal                           $blue   |$normal"
  58. echo "$blue | $yellow * Email Harvesting$normal                     $blue  |$normal"
  59. echo "$blue | $yellow * Meta DataEnumeration$normal                 $blue  |$normal"
  60. echo "$blue | $yellow * WhoIs$normal                                  $blue|$normal"
  61. echo "$blue |                                           |"
  62. echo "$blue | $red Additional Features            $normal         $blue |$normal"
  63. echo "$blue | $yellow * Pull domains From SSL Cert$normal$blue             |$normal"
  64. echo "$blue +-------------------------------------------+$normal"
  65. echo "$lcyan Target = '$green$domain$lcyan'"
  66. echo ""
  67. mkdir -p ~/Desktop/$domain
  68. mkdir -p ~/Desktop/$domain/metagoofil
  69. sleep 1
  70.  
  71. ## Set Variables ##
  72. echo "Run intense scan? [y/N]"
  73. read intense
  74.  
  75.  
  76. ## Main Features: ##
  77.  
  78. ## Run the DNS Stage
  79. if
  80. [[ "$intense" == "y" ]]
  81. then
  82. echo "$yellow Running DNS Recon Stage..$normal (..Very Slow)"
  83. echo ""
  84. if
  85. dig @`dig ns $domain | grep -v '^;' | grep A | cut -f1 | head -1` $domain axfr | grep "XFR size"
  86. then
  87. echo "$lcyan Zone Transfer Vulnerability: ($red Yes $lcyan)$normal"
  88. else
  89. echo "$lcyan Zone Transfer Vulnerability: ($green No $lcyan)$normal"
  90. fi
  91. echo ""
  92. dnsrecon -t brt,std,axfr -D /root/Desktop/wordlists/dnsbruteforce.txt -d $domain > /tmp/$domain.dnsrecon.txt.tmp
  93. cat /tmp/$domain.dnsrecon.txt.tmp | grep '[^\.][0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}[^\.]' | grep -vE 'Trying|TCP|MX|NS|SOA|Has' | awk {'print $3 "\t" $4'} | sort -u  | sed '/^$/d' > ~/Desktop/$domain/dnsrecon.txt
  94. echo "$lcyan Subdomains found: ($yellow `cat ~/Desktop/$domain/dnsrecon.txt | wc -l` $lcyan)$normal"
  95. echo ""
  96. else
  97. echo "$yellow Running DNS Recon Stage..$normal"
  98. echo ""
  99. if
  100. dig @`dig ns $domain | grep -v '^;' | grep A | cut -f1 | head -1` $domain axfr | grep "XFR size"
  101. then
  102. echo "$lcyan Zone Transfer Vulnerability: ($red Yes $lcyan)$normal"
  103. else
  104. echo "$lcyan Zone Transfer Vulnerability: ($green No $lcyan)$normal"
  105. fi
  106. echo ""
  107. dnsrecon -t brt,std,axfr -D /usr/share/dnsrecon/namelist.txt -d $domain > /tmp/$domain.dnsrecon.txt.tmp
  108. cat /tmp/$domain.dnsrecon.txt.tmp | grep '[^\.][0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}[^\.]' | grep -vE 'Trying|TCP|spf1|SOA|Has' | awk {'print $3 "\t" $4'} | sort -u  | grep $domain | sed '/^$/d' > ~/Desktop/$domain/dnsrecon.txt
  109. echo "$lcyan Subdomains found: ($yellow `cat ~/Desktop/$domain/dnsrecon.txt | wc -l` $lcyan)$normal"
  110. echo ""
  111. fi
  112. rm -rf /tmp/$domain.dnsrecon.txt.tmp
  113. echo "" >> ~/Desktop/$domain/dnsrecon.txt
  114. echo "Name Servers" >> ~/Desktop/$domain/dnsrecon.txt
  115. dig ns $domain | grep -v '^;' | grep A | awk {'print $1 "\t" $5'} | sed '/^$/d' >> ~/Desktop/$domain/dnsrecon.txt
  116. echo "" >> ~/Desktop/$domain/dnsrecon.txt
  117. echo "MX Records" >> ~/Desktop/$domain/dnsrecon.txt
  118. dig mx $domain | grep -v '^;' | grep $domain | awk {'print $6'} | sed '/^$/d' >> ~/Desktop/$domain/dnsrecon.txt
  119. cat ~/Desktop/$domain/dnsrecon.txt
  120. echo ""
  121. echo "$green DNS Recon Stage Complete!$normal"
  122.  
  123. ## Run the Mail Harvesting Stage
  124. echo "+------------------------------------------------+"
  125. echo ""
  126. echo "$yellow Running Email Harvesting Stage..$normal"
  127. theharvester -l 500 -b all -d $domain > /tmp/$domain.emails.txt.tmp
  128. cat /tmp/$domain.emails.txt.tmp |  grep @ | grep -vE 'cmartore' > ~/Desktop/$domain/emails.txt
  129. rm -rf /tmp/$domain.emails.txt.tmp
  130. echo "$lcyan Email Addresses Found: ($yellow `cat ~/Desktop/$domain/emails.txt | wc -l` $lcyan)$normal"
  131. echo ""
  132. cat ~/Desktop/$domain/emails.txt | column -c 100
  133. echo ""
  134. echo "$green Email Harvesting Stage Complete!$normal"
  135.  
  136. ## Run the MetaGooFil Stage
  137. echo "+------------------------------------------------+"
  138. echo ""
  139. echo "$yellow Running Meta Data Gathering Stage..$normal"
  140. echo ""
  141. metagoofil -d $domain -t pdf,doc,xls,ppt,odp,ods,docx,xlsx,pptx -l 20 -n 20  -o ~/Desktop/$domain/metagoofil/ -f ~/Desktop/$domain/users_temp.txt > /dev/null
  142. cat ~/Desktop/$domain/users_temp.txt | sed 's/useritem/\n/g' | grep '">' | grep -vE 'head' | awk -F "<" {'print $1'} | cut -d">" -f2 | sed -e "s/^ \{1,\}//" > ~/Desktop/$domain/users.txt
  143. echo "$lcyan Users found: ($yellow `cat ~/Desktop/$domain/users.txt | wc -l` $lcyan)$normal"
  144. echo ""
  145. cat ~/Desktop/$domain/users.txt
  146. echo ""
  147. echo "$green Meta Data Stage Complete!$normal"
  148.  
  149. ## Run the WhoIs
  150. echo "+------------------------------------------------+"
  151. echo ""
  152. whois $domain > ~/Desktop/$domain/whois.txt
  153. echo "$yellow Running WhoIs..$normal"
  154. echo ""
  155. echo "$green WhoIs output saved to: $lcyan ~/Desktop/$domain/whois.txt$normal"
  156. ## Additional Features: ##
  157.  
  158. ## Pull domains from SSL Certificate
  159. echo "+------------------------------------------------+"
  160. echo ""
  161. echo "$yellow Pulling Domains from SSL Certificates $normal"
  162. echo ""
  163. sslscan --ssl2 $domain | grep DNS | sed 's/,/"\n"/g' | sed 's/"//g' | cut -d':' -f2 > ~/Desktop/$domain/sslcertdomains_temp.txt
  164. nmap -vv $domain -script=ssl-cert -p443 | grep commonName | grep -v 'Issuer' | cut -d '/' -f1 | cut -d '=' -f2 >> ~/Desktop/$domain/sslcertdomains_temp.txt
  165. cat ~/Desktop/$domain/sslcertdomains_temp.txt | sort -u > ~/Desktop/$domain/sslcertdomains.txt
  166. cat ~/Desktop/$domain/sslcertdomains.txt
  167. rm ~/Desktop/$domain/sslcertdomains_temp.txt
  168. echo ""
  169. echo "$green Finished Pulling Domains!$normal"
  170. echo ""
  171.  
  172.  
  173.  
  174. fi
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!