You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+23-13Lines changed: 23 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,14 +4,17 @@
4
4
Recon is an essential element of any penetration testing. This repository contain a powerful shell script to maximize the recon and data collection process of an objective. With this script you can easily find:
5
5
6
6
* Sensitive information disclosure.
7
-
* Missing HTTP headers
7
+
* Missing HTTP headers.
8
+
* Heartbleed Bug.
8
9
* Open S3 buckets.
9
10
* Subdomain takeovers.
11
+
* Bugs in TLS/SSL ciphers, protocols and cryptographic flaws.
10
12
* Open ports and services.
13
+
* Email spoofing.
11
14
* Endpoints.
12
15
* Directories.
13
-
* Javascript files with senstive info
14
-
* CORS missconfigurations
16
+
* Javascript files with senstive info.
17
+
* CORS missconfigurations.
15
18
* Other quick bugs.
16
19
17
20
@@ -22,40 +25,47 @@ Recon is an essential element of any penetration testing. This repository contai
### IMPORTANT: YOU NEED TO INSTALL ALL THE TOOLS IN YOUR HOME FOLDER AND INSERT YOUR GITHUB TOKEN IN THE SCRIPT CONFIGURATION TO USE Github-subdomains.py.
42
+
### IMPORTANT: YOU NEED TO INSTALL ALL THE TOOLS IN YOUR HOME FOLDER.
39
43
40
44
# How does it work?
41
45
The script has 5 phases:
42
46
43
-
1. Subdomain enumeration: Amass, Certsh.py, Github-subdomains.py, Gobuster DNS and Assetfinder tools are used to find the maximum possible number of subdomains. httprobe is used to probe for working http and https servers. Then Subjack is used to quickly check if it exists subdomains takeover. Corsy tool is used to find CORS missconfigurations. Finally, Aquatone takes screenshots of each subdomain.
47
+
1. Subdomain enumeration: Amass, Certsh.py, Gobuster DNS and Assetfinder tools are used to find the maximum possible number of subdomains. httprobe is used to probe for working http and https servers. Then Subjack is used to quickly check if it exists subdomains takeover. Corsy tool is used to find CORS missconfigurations. Finally, Aquatone takes screenshots of each subdomain.
44
48
45
-
2.Headers: curl is used to obtain the headers of each subdomain.
49
+
2.Scan for missing headers and bugs in SSL/TLS protocols: securityheaders is used to check quickly and easily the security of HTTP response headers and testssl.sh is used to check the TLS/SSL ciphers, protocols and cryptographic flaws.
46
50
47
-
3.Javascript: relative-url-extractor and Jsearch.py are used to inspect the javascript files of each subdomain for endpoints and sensitive information.
51
+
3.Scan if a domain can be spoofed: spoofcheck is used to check SPF and DMARC records for weak configurations that allow spoofing.
48
52
49
-
4.Directories and hidden files: Gobuster DIR is used to collect hidden files and directories through a dictionary. You can change the dictionary in the script configuration.
53
+
4.JavaScript files and hidden endpoints: LinkFinder is used to discover endpoints and their parameters in JavaScript files.
50
54
51
-
5. Nmap: Nmap is used to scan ports and services quiclky.
55
+
5. Find directories and hidden files: Gobuster DIR is used to collect hidden files and directories through a dictionary. You can change the dictionary in the script configuration.
56
+
57
+
6. Nmap: Nmap is used to scan ports and services quiclky.
52
58
53
59
### All the data generated in the different processes are saved in different files and directories in different formats.
* Special Thanks to Mohd Shibli for his great contributions in the article [Fasten your Recon process using Shell Scripting](https://medium.com/bugbountywriteup/fasten-your-recon-process-using-shell-scripting-359800905d2a#id_token=eyJhbGciOiJSUzI1NiIsImtpZCI6ImRiMDJhYjMwZTBiNzViOGVjZDRmODE2YmI5ZTE5NzhmNjI4NDk4OTQiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJuYmYiOjE1NzQxODIxNTUsImF1ZCI6IjIxNjI5NjAzNTgzNC1rMWs2cWUwNjBzMnRwMmEyamFtNGxqZGNtczAwc3R0Zy5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSIsInN1YiI6IjEwNjQzNTQ3NTE5MTA1NzIzOTYzOSIsImVtYWlsIjoicm9ib3RzaGVsbGRAZ21haWwuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImF6cCI6IjIxNjI5NjAzNTgzNC1rMWs2cWUwNjBzMnRwMmEyamFtNGxqZGNtczAwc3R0Zy5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSIsIm5hbWUiOiJSb2JvdCBTaGVsbCIsInBpY3R1cmUiOiJodHRwczovL2xoMy5nb29nbGV1c2VyY29udGVudC5jb20vYS0vQUF1RTdtQnhZZklJNndVLXQ5OVNxbzFlaElpc1E4dzY4a2VJbWZrbE4yOD1zOTYtYyIsImdpdmVuX25hbWUiOiJSb2JvdCIsImZhbWlseV9uYW1lIjoiU2hlbGwiLCJpYXQiOjE1NzQxODI0NTUsImV4cCI6MTU3NDE4NjA1NSwianRpIjoiODYzMTNhZTQ3YTQ5NjJiNTdhMTBlZDA0NGJhYWUyMGQwZWM2Y2FlNCJ9.obOev9FLt7DWW2NbSIbFwPoUC-vNFrf5nru--6uL6knW1S6CjjqXAP_D0sedfukNC0DcJnqQDz88Yh48ECppB4wEv0ozgunc9Yx24m5OiNaEKvWr0D2WJsMsV9yN7Vxt7gJxTeVIstCLvWDYCl_1JBrDvJ2eXF4V9yamk61KCqmwoAJMjXEpwaDuzITFPIZM9V-nTpIgnsBh-BCERYqAcUc7Si0IpRAlyM9YG78va7o0Pe_zYrt4NbV8Cl--BzAzrFOfhIOxvk3CYWRfc9lrSz09TJRCEn4q-rR9v7LVIboKJAedhbkr8ShClMru8xRsdfne3fRIzV1iZxNn4GuW6A)
echo -e "${DEFAULT}${NORMAL}Amass, Certsh.py, Gobuster DNS and Assetfinder tools are used to find the maximum possible number of subdomains. httprobe is used to probe for working http and https servers. Then Subjack is used to quickly check if it exists subdomains takeover. Corsy tool is used to find CORS missconfigurations. Finally, Aquatone takes screenshots of each subdomain."
27
+
echo -e "${NORMAL}${GREEN}[+] STEP 2: Scan for missing headers and bugs in SSL/TLS protocols"
28
+
echo -e "${DEFAULT}${NORMAL}securityheaders is used to check quickly and easily the security of HTTP response headers and testssl.sh is used to check the TLS/SSL ciphers, protocols and cryptographic flaws."
29
+
echo -e "${NORMAL}${GREEN}[+] STEP 3: Scan if a domain can be spoofed"
30
+
echo -e "${DEFAULT}${NORMAL}spoofcheck is used to check SPF and DMARC records for weak configurations that allow spoofing."
31
+
echo -e "${NORMAL}${GREEN}[+] STEP 4: JavaScript files and hidden endpoints"
32
+
echo -e "${DEFAULT}${NORMAL}LinkFinder is used to discover endpoints and their parameters in JavaScript files."
33
+
echo -e "${NORMAL}${GREEN}[+] STEP 5: Find directories and hidden files"
34
+
echo -e "${DEFAULT}${NORMAL}Gobuster DIR is used to collect hidden files and directories through a dictionary. You can change the dictionary in the script configuration."
35
+
echo -e "${NORMAL}${GREEN}[+] STEP 6: Port scan for alive domains"
36
+
echo -e "${DEFAULT}${NORMAL}Nmap is used to scan ports and services quiclky."
37
+
echo -e ""
38
+
echo -e "${BOLD}${GREEN}You have more information in https://github.com/robotshell/magicRecon"
39
+
echo -e ""
40
+
echo -e "${BOLD}${YELLOW}[+] DON'T FORGET -> If you found the tool useful please consider donating to support it's development. You can help me to develop more useful tools. THANKS :)"
0 commit comments