The dumbpentester rocket script v0.07 'passwordy' (pre-release)

Purpose

Fire and forget script automating the finding of targets vulnerabilities.

Usage: ./thedumbpentester [domain.com/IP/companyname/maintenance] [targetmode:company/domain/ip] [scanmode] [*web*] [*user wordlist*] [*password wordlist*] [*openVASurl:port*] [*openVASuser*] [*openVASpassword*] [*debug*] [*noadditionalbrute*]

Concepts of the tool:

1. Everything should be automatic.
2. Only open source tools used.
3. Report contains only useful information for direct exploitation.

Results

As the report function is currently under development, you can inspect results of the script in folder /root/.dumbpentester/attackeddomain.com/

Organisation:

• ips.lst : main IPs list
• domains.csv : subdomains found
• userdir/ : users, emails and passwords found
• vulndir/ : vulnerabilities found
• outputdir/ : results of all the tools used

Install :

git clone ./thedumbpentester.sh maintenance

Usage:

Getting only reconnaissance data

./thedumbpentester.sh yourdomainz.xxx domain recononly

Fast scan and web pentest

./thedumbpentester.sh yourdomainz.xxx domain fast web

Default scan

./thedumbpentester.sh yourdomainz.xxx

Stealth scan

./thedumbpentester.sh yourdomain.xxx domain stealth

Tools used

Basically this script wraps and pipes around other various pentest tools if you feed it a target.

DNS

dig fierce dnsrecon subbrute

OSINT / DORKS

sublist3r harvester recon-ng

WEBSITES

crt.sh hackertarget netcraft viewdns

SCAN

masscan nmap traceroute

VULNERABILITY

nmapNSE searchsploit pompem

BRUTE

nmapNSE hydra SecLists

WEB SCAN

dirb whatweb arachni sqlmap

REPORT

grep zenmap firefox