Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/bin/bash
- #Automatically run recon against a domain/list of domains.
- #
- # Current Features:
- # * DNS Recon
- # * Email Harvesting
- # * Meta Data Enumeration
- # * WhoIs
- #
- # Additional Features
- # * Pull domains from SSL Certificate
- #
- # Usage: ./automator.sh listofdomains.txt (disabled)
- # Usage: ./automator.sh domain.com
- #
- # By: Leon Teale (@leonteale)
- #
- ## Setting Coloured variables
- red=`echo -e "\033[31m"`
- lcyan=`echo -e "\033[36m"`
- yellow=`echo -e "\033[33m"`
- green=`echo -e "\033[32m"`
- blue=`echo -e "\033[34m"`
- purple=`echo -e "\033[35m"`
- normal=`echo -e "\033[m"`
- ## Variables
- version="2.0"
- domain="$1"
- tmpwdir="/tmp"
- wdir="~/Desktop/automator_results/$domain"
- ## Check for correct usage
- usage () {
- if [ -z "$domain" ];
- then
- #echo "$red Incorrect Usage!$normal"
- echo "Usage: ./automator.sh listofdomains.txt (disabled)"
- echo "Usage: ./automator.sh domain.com"
- echo ""
- exit 1
- fi
- }
- ## check environment is set up correctly before continueing
- prerequisits () {
- ##need to make checks that the programs are installed first##
- ## ##
- mkdir -p ~/Desktop/automator_results/
- mkdir -p ~/Desktop/automator_results/$domain
- mkdir -p ~/Desktop/automator_results/$domain/metagoofil
- which dnsrecon && dnsrecon_check="true" || dnsrecon_check="false";
- if ! echo $dnsrecon_check | grep -q "true";
- then
- echo "$red dnsrecon was not found in \$PATH";
- echo ""
- exit 1
- fi
- }
- ## Display script header
- header () {
- clear
- echo "$yellow _ _ "
- echo "$yellow /\ | | | | "
- echo "$yellow / \ _ _| |_ ___ _ __ ___ __ _| |_ ___ _ __ "
- echo "$yellow / /\ \| | | | __/ _ \| '_ \` _ \ / _\` | __/ _ \| '__|"
- echo "$yellow / ____ \ |_| | || (_) | | | | | | (_| | || (_) | | "
- echo "$yellow /_/ \_\__,_|\__\___/|_| |_| |_|\__,_|\__\___/|_|$normal$yellow (version $green$version$yellow)"
- echo "$lcyan -- by Leon Teale (@leonteale)"
- echo ""
- echo "$blue +-------------------------------------------+"
- echo "$blue | $red Current Features$normal $blue |$normal"
- echo "$blue | $yellow * DNS Recon$normal $blue |$normal"
- echo "$blue | $yellow * Email Harvesting$normal $blue |$normal"
- echo "$blue | $yellow * Meta DataEnumeration$normal $blue |$normal"
- echo "$blue | $yellow * WhoIs$normal $blue|$normal"
- echo "$blue | |"
- echo "$blue | $red Additional Features $normal $blue |$normal"
- echo "$blue | $yellow * Pull domains From SSL Cert$normal$blue |$normal"
- echo "$blue +-------------------------------------------+$normal"
- echo "$lcyan Target = '$green$domain$lcyan'"
- echo ""
- }
- DNSrecon () {
- #### DNS recon ####
- dig @8.8.8.8 ns $domain | grep NS | grep -vE 'flags:' | awk {'print $5'} |sort > $tmpwdir/$0_nameservers.txt
- nameservers="`cat $tmpwdir/$0_nameservers.txt | grep -vE '^$'`"
- nameserver="`cat $tmpwdir/$0_nameservers.txt | grep -vE '^$' | head -1`"
- mx="`dig @8.8.8.8 mx $domain | grep MX | grep -vE 'flags:' | awk {'print $6'} | grep -vE '^$' |sort`"
- dig @$nameserver $domain axfr > $tmpwdir/$0_axfr.txt
- if cat $tmpwdir/$0_axfr.txt | grep -q "Transfer failed"
- then
- axfr="$green False"
- else
- axfr="$red True"
- fi
- ip="`dig @8.8.8.8 +short $domain`"
- echo -e "IP Address : $yellow$ip$lcyan"
- echo -e "Mail Exchange : $yellow$mx$lcyan"
- echo -e "Zone TRansfer :$axfr$lcyan"
- echo -e "Nameservers : \n$yellow$nameservers$lcyan"
- echo -e "\n$purple -- DNS Recon --$lcyan"
- echo "Run intense scan? [y/N]"
- read intense
- if [[ $intense == y ]];
- then
- dnslist="dnslistlong"
- dnsscan_type="long"
- else
- dnslist="/usr/share/dnsrecon/namelist.txt"
- #dnslist="/root/Desktop/templist.txt"
- dnsscan_type="short"
- fi
- echo -e "$red Running $dnsscan_type scan, please wait...$yellow"
- dnsrecon_continue="true"
- if [ -f ~/Desktop/automator_results/$domain/dnsrecon_$dnsscan_type.txt ];
- then
- echo ""
- echo "$red You seem to have a dns recon file for this domain already"
- echo "$red Would you like to view this file instead? [y/N] $yellow"
- read dnsrecon_file_found
- if [[ $dnsrecon_file_found == "y" ]];
- then
- cat ~/Desktop/automator_results/$domain/dnsrecon_$dnsscan_type.txt > ~/Desktop/automator_results/$domain/dnsrecon_full.txt
- dnsrecon_brute="`cat ~/Desktop/automator_results/$domain/dnsrecon_$dnsscan_type.txt | wc -l`"
- echo "$lcyan DNS Bruteforce... $yellow$dnsrecon_brute$lcyan subdomains found"
- dnsrecon_continue="false"
- else
- dnsrecon_continue="true"
- fi
- fi
- if [[ $dnsrecon_continue == "true" ]]
- then
- dnsrecon -t brt,std,axfr -D $dnslist -d $domain > $tmpwdir/$0_dnsrecon.txt
- cat $tmpwdir/$0_dnsrecon.txt | grep "*" | awk {'print $3 "\t" $4'} | sort -u | grep '[^\.][0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}[^\.]' | grep "$domain" > ~/Desktop/automator_results/$domain/dnsrecon_$dnsscan_type.txt
- cat ~/Desktop/automator_results/$domain/dnsrecon_$dnsscan_type.txt > ~/Desktop/automator_results/$domain/dnsrecon_full.txt
- dnsrecon_brute="`cat ~/Desktop/automator_results/$domain/dnsrecon_$dnsscan_type.txt | wc -l`"
- echo "$lcyan DNS Bruteforce... $yellow$dnsrecon_brute$lcyan subdomains found"
- fi
- #### reverse ip lookups of ip blocks ####
- ip_base="`echo $ip | cut -d . -f -3`"
- dnsrecon -r $ip_base.0-$ip_base.254 | grep $domain > $tmpwdir/$0_dnsrecon_reverse.txt
- cat $tmpwdir/$0_dnsrecon_reverse.txt | grep "*" | awk {'print $3 "\t" $4'} | sort -u | grep '[^\.][0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}[^\.]' | grep "$domain" > ~/Desktop/automator_results/$domain/dnsrecon_reverse.txt
- diff ~/Desktop/automator_results/$domain/dnsrecon_$dnsscan_type.txt ~/Desktop/automator_results/$domain/dnsrecon_reverse.txt | grep ">" | awk {'print $2 "\t" $3'} >> ~/Desktop/automator_results/$domain/dnsrecon_full.txt
- dnsrecon_reverse="`cat ~/Desktop/automator_results/$domain/dnsrecon_reverse.txt | wc -l`"
- echo "$lcyan IP block reverse lookup... $yellow$dnsrecon_reverse$lcyan subdomains found"
- echo ""
- dnsrecon_all="`cat ~/Desktop/automator_results/$domain/dnsrecon_full.txt | wc -l`"
- echo "$lcyan Total subdomains found... $green$dnsrecon_all$yellow"
- echo ""
- cat ~/Desktop/automator_results/$domain/dnsrecon_full.txt
- }
- email_harvesting () {
- echo -e "\n$purple -- Email Harvesting --$lcyan"
- echo -e "$red Running Email scan, please wait...$yellow"
- echo ""
- harvester_count="`cat ~/Desktop/automator_results/$domain/harvester.txt | grep "@" | grep -vE'edge-security.com'| sort -u | wc -l`"
- theharvester -l 500 -b all -d $domain > ~/Desktop/automator_results/$domain/harvester.txt
- echo "$lcyan Total Emails found... $green$harvester_count$yellow"
- echo ""
- cat ~/Desktop/automator_results/$domain/harvester.txt | grep "@" | grep -vE'edge-security.com' | sort -u
- }
- User_enumeration () {
- echo -e "\n$purple -- User Enumeration --$lcyan"
- echo -e "$red Finding users, please wait...$yellow"
- echo ""
- user_count="`#`"
- ####### > ~/Desktop/automator_results/$domain/#######
- echo "$lcyan Total users found... $green$harvester_count$yellow"
- echo ""
- cat ~/Desktop/automator_results/$domain/##########
- }
- usage
- prerequisits
- header
- DNSrecon
- email_harvesting
- user_enumeration
Advertisement
Add Comment
Please, Sign In to add comment
