@@ -189,6 +189,10 @@ function tools_installed() {
189189 printf " ${bred} [*] misconfig-mapper [NO]${reset} \n"
190190 allinstalled=false
191191 }
192+ [ -f " ${tools} /Spoofy/spoofy.py" || {
193+ printf " ${bred} [*] spoofy [NO]${reset} \n"
194+ allinstalled=false
195+ }
192196 [ -f " ${tools} /SwaggerSpy/swaggerspy.py" || {
193197 printf " ${bred} [*] swaggerspy [NO]${reset} \n"
194198 allinstalled=false
@@ -413,6 +417,14 @@ function tools_installed() {
413417 printf " ${bred} [*] sns [NO]${reset} \n"
414418 allinstalled=false
415419 }
420+ command -v sourcemapper & > /dev/null || {
421+ printf " ${bred} [*] sourcemapper [NO]${reset} \n"
422+ allinstalled=false
423+ }
424+ command -v jsluice & > /dev/null || {
425+ printf " ${bred} [*] jsluice [NO]${reset} \n"
426+ allinstalled=false
427+ }
416428 if [[ ${allinstalled} == true ]]; then
417429 printf " ${bgreen} Good! All installed! ${reset} \n\n"
418430 else
@@ -652,21 +664,21 @@ function domain_info() {
652664
653665function third_party_misconfigs() {
654666
655- mkdir -p 3rdparties
667+ mkdir -p osint
656668 if { [[ ! -f " $called_fn_dir /.${FUNCNAME[0]} " || [[ $DIFF == true ]]; } && [[ $THIRD_PARTIES == true ]] && [[ $OSINT == true ]] && ! [[ $domain =~ ^[0-9]+\. [0-9]+\. [0-9]+\. [0-9] ]]; then
657669 start_func ${FUNCNAME[0]} " Searching for third parties misconfigurations"
658670 company_name=$( echo $domain | unfurl format %r)
659671
660672 pushd " ${tools} /misconfig-mapper" > /dev/null || {
661673 echo " Failed to cd directory in ${FUNCNAME[0]} @ line ${LINENO} "
662674 }
663- ./misconfig-mapper -target $company_name -service " *" | grep " \[-\]" > ${dir} /3rdparties/visma_misconfigurations .txt
675+ ./misconfig-mapper -target $company_name -service " *" | grep -v " \[-\]" > ${dir} /osint/3rdparts_misconfigurations .txt
664676
665677 popd > /dev/null || {
666678 echo " Failed to popd in ${FUNCNAME[0]} @ line ${LINENO} "
667679 }
668680
669- end_func " Results are saved in $domain /3rdparties " ${FUNCNAME[0]}
681+ end_func " Results are saved in $domain /osint/3rdparts_misconfigurations.txt " ${FUNCNAME[0]}
670682
671683 else
672684 if [[ $THIRD_PARTIES == false ]] || [[ $OSINT == false ]]; then
@@ -684,6 +696,39 @@ function third_party_misconfigs() {
684696
685697}
686698
699+ function spoof() {
700+
701+ mkdir -p osint
702+ if { [[ ! -f " $called_fn_dir /.${FUNCNAME[0]} " || [[ $DIFF == true ]]; } && [[ $SPOOF == true ]] && [[ $OSINT == true ]] && ! [[ $domain =~ ^[0-9]+\. [0-9]+\. [0-9]+\. [0-9] ]]; then
703+ start_func ${FUNCNAME[0]} " Searching for spoofable domains"
704+
705+ pushd " ${tools} /Spoofy" > /dev/null || {
706+ echo " Failed to cd directory in ${FUNCNAME[0]} @ line ${LINENO} "
707+ }
708+ ./spoofy.py -d $domain > ${dir} /osint/spoof.txt
709+
710+ popd > /dev/null || {
711+ echo " Failed to popd in ${FUNCNAME[0]} @ line ${LINENO} "
712+ }
713+
714+ end_func " Results are saved in $domain /osint/spoof.txt" ${FUNCNAME[0]}
715+
716+ else
717+ if [[ $SPOOF == false ]] || [[ $OSINT == false ]]; then
718+ printf " \n${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${FUNCNAME[0]} skipped in this mode or defined in reconftw.cfg ${reset} \n"
719+ elif [[ $domain =~ ^[0-9]+\. [0-9]+\. [0-9]+\. [0-9] ]]; then
720+ return
721+ else
722+ if [[ $SPOOF == false ]] || [[ $OSINT == false ]]; then
723+ printf " \n${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${FUNCNAME[0]} skipped in this mode or defined in reconftw.cfg ${reset} \n"
724+ else
725+ printf " ${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${FUNCNAME[0]} is already processed, to force executing ${FUNCNAME[0]} delete\n $called_fn_dir /.${FUNCNAME[0]} ${reset} \n\n"
726+ fi
727+ fi
728+ fi
729+
730+ }
731+
687732function ip_info() {
688733
689734 mkdir -p osint
@@ -1365,7 +1410,13 @@ function geo_info() {
13651410 start_func ${FUNCNAME[0]} " Running: ipinfo and geoinfo"
13661411 ips_file=" ${dir} /hosts/ips.txt"
13671412 if [ ! -f $ips_file ]; then
1368- echo " File ${dir} /hosts/ips.txt does not exist."
1413+ if ! [[ $domain =~ ^[0-9]+\. [0-9]+\. [0-9]+\. [0-9] ]]; then
1414+ [ -s " subdomains/subdomains_dnsregs.json" && cat subdomains/subdomains_dnsregs.json | jq -r ' try . | "\(.host) \(.a[0])"' | anew -q .tmp/subs_ips.txt
1415+ [ -s " .tmp/subs_ips.txt" && awk ' { print $2 " " $1}' | sort -k2 -n | anew -q hosts/subs_ips_vhosts.txt
1416+ [ -s " hosts/subs_ips_vhosts.txt" && cat hosts/subs_ips_vhosts.txt | cut -d ' ' | grep -aEiv " ^(127|10|169\.154|172\.1[6789]|172\.2[0-9]|172\.3[01]|192\.168)\." | grep -oE " \b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | anew -q hosts/ips.txt
1417+ else
1418+ echo $domain | grep -aEiv " ^(127|10|169\.154|172\.1[6789]|172\.2[0-9]|172\.3[01]|192\.168)\." | grep -oE " \b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | anew -q hosts/ips.txt
1419+ fi
13691420 else
13701421 for ip in $( cat " $ips_file " ) ; do
13711422 json_output=$( curl -s https://ipapi.co/$ip /json)
@@ -1932,6 +1983,7 @@ function urlchecks() {
19321983 [ -s " .tmp/katana.txt" && sed -i ' /^.\{2048\}./d'
19331984 [ -s " .tmp/katana.txt" && cat .tmp/katana.txt | anew -q .tmp/url_extract_tmp.txt
19341985 [ -s " .tmp/url_extract_tmp.txt" && cat .tmp/url_extract_tmp.txt | grep " ${domain} " | grep -E ' ^((http|https):\/\/)?([a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{1,}(\/.*)?$' | grep -aEi " \.(js)" | anew -q .tmp/url_extract_js.txt
1986+ [ -s " .tmp/url_extract_tmp.txt" && cat .tmp/url_extract_tmp.txt | grep " ${domain} " | grep -E ' ^((http|https):\/\/)?([a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{1,}(\/.*)?$' | grep -aEi " \.(js\.map)" | anew -q .tmp/url_extract_jsmap.txt
19351987 if [[ $DEEP == true ]]; then
19361988 [ -s " .tmp/url_extract_js.txt" && interlace -tL .tmp/url_extract_js.txt -threads 10 -c " python3 ${tools} /JSA/jsa.py -f target | anew -q .tmp/url_extract_tmp.txt" & > /dev/null
19371989 fi
@@ -2017,7 +2069,8 @@ function jschecks() {
20172069 if { [[ ! -f " $called_fn_dir /.${FUNCNAME[0]} " || [[ $DIFF == true ]]; } && [[ $JSCHECKS == true ]]; then
20182070 start_func ${FUNCNAME[0]} " Javascript Scan"
20192071 if [[ -s " .tmp/url_extract_js.txt" ; then
2020- printf " ${yellow} Running : Fetching Urls 1/5${reset} \n"
2072+
2073+ printf " ${yellow} Running : Fetching Urls 1/6${reset} \n"
20212074 if [[ $AXIOM != true ]]; then
20222075 cat .tmp/url_extract_js.txt | subjs -ua " Mozilla/5.0 (X11; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0" | grep " $domain " | grep -E ' ^((http|https):\/\/)?([a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{1,}(\/.*)?$' | anew -q .tmp/subjslinks.txt
20232076 else
@@ -2026,31 +2079,36 @@ function jschecks() {
20262079 [ -s " .tmp/subjslinks.txt" && cat .tmp/subjslinks.txt | egrep -iv " \.(eot|jpg|jpeg|gif|css|tif|tiff|png|ttf|otf|woff|woff2|ico|pdf|svg|txt|js)" | anew -q js/nojs_links.txt
20272080 [ -s " .tmp/subjslinks.txt" && cat .tmp/subjslinks.txt | grep -iE " \.js($|\?)" | anew -q .tmp/url_extract_js.txt
20282081 cat .tmp/url_extract_js.txt | python3 ${tools} /urless/urless/urless.py | anew -q js/url_extract_js.txt 2>> " $LOGFILE " > /dev/null
2029- printf " ${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${reset} \n"
2082+
2083+ printf " ${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${reset} \n"
20302084 if [[ $AXIOM != true ]]; then
20312085 [ -s " js/url_extract_js.txt" && cat js/url_extract_js.txt | httpx -follow-redirects -random-agent -silent -timeout $HTTPX_TIMEOUT -threads $HTTPX_THREADS -rl $HTTPX_RATELIMIT -status-code -content-type -retries 2 -no-color | grep " [200]" | grep " javascript" | cut -d ' ' | anew -q js/js_livelinks.txt
20322086 else
20332087 [ -s " js/url_extract_js.txt" && axiom-scan js/url_extract_js.txt -m httpx -follow-host-redirects -H \" ${HEADER} \" -status-code -threads $HTTPX_THREADS -rl $HTTPX_RATELIMIT -timeout $HTTPX_TIMEOUT -silent -content-type -retries 2 -no-color -o .tmp/js_livelinks.txt $AXIOM_EXTRA_ARGS 2>> " $LOGFILE " > /dev/null
20342088 [ -s " .tmp/js_livelinks.txt" && cat .tmp/js_livelinks.txt | anew .tmp/web_full_info.txt | grep " [200]" | grep " javascript" | cut -d ' ' | anew -q js/js_livelinks.txt
20352089 fi
2036- printf " ${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${reset} \n"
2090+
2091+ printf " ${yellow} Running : Extracting JS from sourcemaps 3/6${reset} \n"
2092+ mkdir -p .tmp/sourcemapper
2093+ [ -s " js/js_livelinks.txt" && interlace -tL js/js_livelinks.txt -threads ${INTERLACE_THREADS} -c " sourcemapper -jsurl '_target_' -output _output_/_cleantarget_" 2>> " $LOGFILE " > /dev/null
2094+ [ -s " .tmp/url_extract_jsmap.txt" && interlace -tL js/js_livelinks.txt -threads ${INTERLACE_THREADS} -c " sourcemapper -url '_target_' -output _output_/_cleantarget_" 2>> " $LOGFILE " > /dev/null
2095+
2096+ printf " ${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${reset} \n"
20372097 [ -s " js/js_livelinks.txt" && xnLinkFinder -i js/js_livelinks.txt -sf subdomains/subdomains.txt -d $XNLINKFINDER_DEPTH -o .tmp/js_endpoints.txt 2>> " $LOGFILE " > /dev/null
2098+ find .tmp/sourcemapper/ \( -name " *.js" " *.ts" \) -type f | jsluice urls | jq -r .url | anew -q .tmp/js_endpoints.txt
20382099 [ -s " parameters.txt" && rm -f parameters.txt 2>> " $LOGFILE " > /dev/null
20392100 if [[ -s " .tmp/js_endpoints.txt" ; then
20402101 sed -i ' /^\//!d'
20412102 cat .tmp/js_endpoints.txt | anew -q js/js_endpoints.txt
20422103 fi
2043- printf " ${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${reset} \n"
20442104
2045- if [[ $AXIOM != true ]]; then
2046- [ -s " js/js_livelinks.txt" && cat js/js_livelinks.txt | mantra -ua ${HEADER} -s | anew -q js/js_secrets.txt
2047- [ -s " js/js_secrets.txt" && trufflehog filesystem js/js_secrets.txt --only-verified -j 2> /dev/null | jq -c | anew -q js/js_secrets_trufflehog.txt
2048- else
2049- [ -s " js/js_livelinks.txt" && axiom-scan js/js_livelinks.txt -m mantra -ua \" ${HEADER} \" -s -o js/js_secrets.txt $AXIOM_EXTRA_ARGS & > /dev/null
2050- [ -s " js/js_secrets.txt" && trufflehog filesystem js/js_secrets.txt --only-verified -j 2> /dev/null | jq -c | anew -q js/js_secrets_trufflehog.txt
2051- fi
2105+ printf " ${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${reset} \n"
2106+ [ -s " js/js_livelinks.txt" && axiom-scan js/js_livelinks.txt -m mantra -ua \" ${HEADER} \" -s -o js/js_secrets.txt $AXIOM_EXTRA_ARGS & > /dev/null
2107+ [ -s " js/js_secrets.txt" && trufflehog filesystem js/js_secrets.txt -j 2> /dev/null | jq -c | anew -q js/js_secrets_trufflehog.txt
2108+ [ -s " js/js_secrets.txt" && trufflehog filesystem .tmp/sourcemapper/ -j 2> /dev/null | jq -c | anew -q js/js_secrets_trufflehog.txt
20522109 [ -s " js/js_secrets.txt" && sed -r " s/\x1B\[([0-9]{1,3}(;[0-9]{1,2};?)?)?[mGK]//g"
2053- printf " ${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${reset} \n"
2110+
2111+ printf " ${yellow} [$( date +' %Y-%m-%d %H:%M:%S' ) ${reset} \n"
20542112 [ -s " js/js_livelinks.txt" && interlace -tL js/js_livelinks.txt -threads ${INTERLACE_THREADS} -c " python3 ${tools} /getjswords.py '_target_' | anew -q webs/dict_words.txt" 2>> " $LOGFILE " > /dev/null
20552113 end_func " Results are saved in $domain /js folder" ${FUNCNAME[0]}
20562114 else
0 commit comments