IsraelTorres

prepintel.sh

Aug 17th, 2011
188
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/bin/bash
  2. # ./prepintel.sh
  3. # Israel Torres hakin9@israeltorres.org
  4. # Sun Aug  7 17:31:13 PDT 2011
  5. # "Forensic Improvisation"
  6. #
  7. # use in bash prompt: ./prepintel.sh for usage (-w|-f) [v0.1]
  8. # todo: Applescript drag and drop, batch processing, -s support
  9. #
  10. # batch example
  11. # ls *.bin > testcases.txt; for i in $(cat testcases.txt); do ./prepintel.sh -f $i; done
  12. #
  13. if [ ! $# -lt 2 ]; then
  14. PSTYPE=$1
  15. TARGET=$2
  16. # Generate timestamp prefix during processing
  17. TEMPHEAD=$(date +%s)
  18. TIMEDECO=$(date -r $TEMPHEAD)
  19. EXTENSON=.txt
  20. # For Web Server Information
  21. if [ $PSTYPE == "-w" ]; then
  22. WWWSITE="$2" # using -w switch
  23. # Output Filename Generation
  24. WHEADINFO="$TEMPHEAD-$WWWSITE-HEAD$EXTENSON"
  25. WGETCINFO="$TEMPHEAD-$WWWSITE-GET$EXTENSON"
  26. WGETTINFO="$TEMPHEAD-$WWWSITE-GET-TIDY$EXTENSON"
  27. WNMAPINFO="$TEMPHEAD-$WWWSITE-NMAPSRV$EXTENSON"
  28. WWHOIINFO="$TEMPHEAD-$WWWSITE-WHOISUR$EXTENSON"
  29. WNSLOINFO="$TEMPHEAD-$WWWSITE-NSLOOKU$EXTENSON"
  30. # Ouput
  31. CONNSTR=$(echo -ne "HEAD / HTTP/1.0\r\n\r\n")
  32. echo "###$WHEADINFO" > $WHEADINFO; echo "$CONNSTR" | nc $WWWSITE 80 >> $WHEADINFO
  33. CONNSTR=$(echo -ne "GET / HTTP/1.0\r\n\r\n")
  34. echo "###$WGETCINFO" > $WGETCINFO; echo "$CONNSTR" | nc $WWWSITE 80 >> $WGETCINFO
  35. CONNSTR=$(echo -ne "GET / HTTP/1.0\r\n\r\n")
  36. echo "###$WGETTINFO" > $WGETTINFO; echo "$CONNSTR" | nc $WWWSITE 80 | tidy -i >> $WGETTINFO
  37. # Run installed CLI Support Applications
  38. echo "###$WNMAPINFO" > $WNMAPINFO; sudo nmap -sS $WWWSITE >> $WNMAPINFO
  39. echo "###$WWHOIINFO" > $WWHOIINFO; whois $WWWSITE >> $WWHOIINFO
  40. echo "###$WNSLOINFO" > $WNSLOINFO; nslookup $WWWSITE >> $WNSLOINFO
  41. # Copy all Reports into a single searchable text file
  42. cat $TEMPHEAD-$WWWSITE-* > "_$TEMPHEAD-$WWWSITE-master.txt"
  43. # remove standalone artifacts and only keep master (per timestamp)
  44. #rm $TEMPHEAD-$WWWSITE-*
  45. fi
  46. # For File Information
  47. if [ -a $2 -a $PSTYPE == "-f" ]; then
  48. FILENAME=$2 # using -f switch
  49. FILETYPE=$(file -b $FILENAME)
  50. FILEHMD5=$(md5 -q $FILENAME)
  51. FILEHSH1=$(shasum -p $FILENAME | cut -d ' ' -f 1)
  52. FILEHEAD=$(xxd -p -l 30 $FILENAME)
  53. # Output Filename Generation
  54. FILEINFO="$TEMPHEAD-$FILENAME-STDINFO$EXTENSON"
  55. FILESTRG="$TEMPHEAD-$FILENAME-STRINGS$EXTENSON"
  56. FILEEXIF="$TEMPHEAD-$FILENAME-EXIFDAT$EXTENSON"
  57. FILEOTOL="$TEMPHEAD-$FILENAME-OTOOLDT$EXTENSON"
  58. FILEGDBO="$TEMPHEAD-$FILENAME-GDBDISA$EXTENSON"
  59. FILENDIS="$TEMPHEAD-$FILENAME-NDISASM$EXTENSON"
  60. FILEOTXO="$TEMPHEAD-$FILENAME-OTXOUTP$EXTENSON"
  61. FILEGFIN="$TEMPHEAD-$FILENAME-GETFILE$EXTENSON"
  62. FILEENTR="$TEMPHEAD-$FILENAME-ENTROPY$EXTENSON"
  63. FILEPGPD="$TEMPHEAD-$FILENAME-PGPDUMP$EXTENSON"
  64. # Format Initial Discovery Output
  65. echo "###$FILEINFO" > $FILEINFO
  66. echo -e "TIMESTMP:\t$TEMPHEAD $TIMEDECO" >> $FILEINFO
  67. echo -e "FILENAME:\t$FILENAME" >> $FILEINFO
  68. echo -e "FILETYPE:\t$FILETYPE" >> $FILEINFO
  69. echo -e "FILEHMD5:\t$FILEHMD5" >> $FILEINFO
  70. echo -e "FILEHSH1:\t$FILEHSH1" >> $FILEINFO
  71. echo -e "FILEHEAD:\t$FILEHEAD" >> $FILEINFO
  72. # Run installed CLI Support Applications
  73. echo "###$FILESTRG" > $FILESTRG; strings $FILENAME >> $FILESTRG
  74. echo "###$FILEEXIF" > $FILEEXIF; exiftool $FILENAME >> $FILEEXIF
  75. echo "###$FILEOTOL" > $FILEOTOL; otool -tV $FILENAME >> $FILEOTOL
  76. echo "###$FILEGDBO" > $FILEGDBO; echo "disassemble main" | gdb -silent $FILENAME >> $FILEGDBO
  77. echo "###$FILENDIS" > $FILENDIS; ndisasm $FILENAME >> $FILENDIS
  78. echo "###$FILEOTXO" > $FILEOTXO; otx -d $FILENAME >> $FILEOTXO
  79. echo "###$FILEGFIN" > $FILEGFIN; GetFileInfo $FILENAME >> $FILEGFIN
  80. echo "###$FILEENTR" > $FILEENTR; ent $FILENAME >> $FILEENTR
  81. echo "###$FILEPGPD" > $FILEPGPD; pgpdump $FILENAME >> $FILEPGPD
  82. # Copy all Reports into a single searchable text file
  83. cat $TEMPHEAD-$FILENAME-* > "_$TEMPHEAD-$FILENAME-master.txt"
  84. # remove standalone artifacts and only keep master (per timestamp)
  85. # rm $TEMPHEAD-$FILENAME-*
  86. fi
  87. # Usage Console Message
  88. else
  89. echo "usage: $0 '-w|-f' 'url|filename'"
  90. echo "example: $0 -w www.israeltorres.org > /dev/null 2>&1"
  91. echo "example: $0 -f test.bin > /dev/null 2>&1"
  92. fi
  93.  
  94. #EOF
RAW Paste Data