myrecon.sh

#!/bin/bash


function usage() {
    echo "Usage: "$0" <domain>"
    if [ -n "$1" ] ; then
	echo "Error: "$1"!"
    fi
    exit
}

function unique_file() {
	f=$1
	f_tmp=/tmp/tmp.tmp
	cat $f | sort -fu > $f_tmp
	mv $f_tmp $f
}

function count_file() {
    f=$1
    w=$2
    if [ $# -eq 2 ] ; then
	cnt=`cat $f | egrep "$w" | wc -l | cut -d ' ' -f 1`
    else
	cnt=`wc -l $f | cut -d ' ' -f 1`
    fi
}


if ! [ $# -eq 1 ] ; then
    usage
fi

domain=$1
domdom=`echo $domain | cut -d '.' -f 1`
echo "Domain: $domain"
path="$HOME/aquatone/$domain"
screen_path="$HOME/aquatone/$domain/screens"
echo "Path: $path"



f_tmp="$path/tmp.txt"
f_host="$path/hosts.txt"
f_ip="$path/ips.txt"
f_ip_host="$path/ips_hosts.txt"
f_url="$path/urls.txt"
f_bucket="$path/buckets.txt"
f_techno="$path/technology.txt"
f_all="$path/all.txt"

if ! [ -d $path ] ; then
	mkdir -p $path
fi

if ! [ -d $screen_path ] ; then
	mkdir -p $screen_path
fi

rm $f_tmp 2>/dev/null
rm $f_host 2>/dev/null
rm $f_ip 2>/dev/null
rm $f_ip_host 2>/dev/null
rm $f_url 2>/dev/null
rm $f_bucket 2>/dev/null
rm $f_technology 2>/dev/null
rm $f_all 2>/dev/null
rm $screen_path/* 2>/dev/null



echo
echo "## Hosts recon"

#echo "Running subfinder..."
#tmp="$path/tmp_subfinder.txt"
#subfinder -d $domain > $tmp
#if [ -f $tmp ] ; then
#	cat $tmp | tr '[:upper:]' '[:lower:]' | egrep -o "[a-z0-9_\.\-]+\.$domain" > $f_host
#fi

echo "Running sublist3r..."
tmp="$path/tmp_sublist3r.txt"
sublist3r -d $domain -o $f_host 1>/dev/null



echo "Running amass..."
tmp="$path/tmp_amass.txt"
amass -active -d $domain > $tmp
if [ -f $tmp ] ; then
	cat $tmp | tr '[:upper:]' '[:lower:]' | egrep -o "[a-z0-9_\.\-]+\.$domain" > $f_host
fi

unique_file $f_host
count_file $f_host
echo $cnt hosts found

if [ $cnt -eq 0 ] ; then
	echo
	echo "Exiting!"
	echo
	exit
fi



echo 
echo "## IPs recon"

echo "Running host..."
tmp="$path/tmp_host.txt"
rm $tmp 2>/dev/null
for h in `cat $f_host` ; do
    hh=`host $h`
    echo "$hh" >> $tmp
    echo >> $tmp
    echo >> $tmp
    for ip in `echo $hh | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"` ; do
	echo "$ip;;$h" >> $f_ip_host
	echo $ip >> $f_ip
    done
done

unique_file $f_ip
count_file $f_ip
echo $cnt ips found

if [ $cnt -eq 0 ] ; then
	echo
	echo "Exiting!"
	echo
	exit
fi


cat $f_ip >> $f_all
cat $f_host >> $f_all

echo "Running masscan..."
tmp="$path/tmp_masscan.txt"
sudo masscan -p0-65535 -v --rate 50000 -iL $f_ip -oX $tmp 2>/dev/null
#cat $tmp | grep -v "#masscan" | grep -v "# end" > $f_tmp
#mv $f_tmp $tmp
count_file $tmp "</host>"
echo $cnt ports found

if [ $cnt -eq 0 ] ; then
	echo
	echo "Exiting!"
	echo
	exit
fi



echo "Creating urls..."
SAVEIFS=$IFS
IFS=$(echo -en "\n\b")

for l in `cat $tmp | grep "</host>"` ; do
	ip=`echo $l | awk '{print $3 $6}' | cut -d '"' -f 2`
	port=`echo $l | awk '{print $3 $6}' | cut -d '"' -f 4`
	#echo $ip":"$port
	
  	for ip_h in `grep "^$ip;;" $f_ip_host` ; do
		host=`echo $ip_h | awk -F ';;' '{print $2}'`
		if [ $port -eq 80 ]  ; then
			echo "http://$ip" >> $f_url
			echo "http://$host" >> $f_url
		else
			if [ $port -eq 443 ] ; then
				echo "https://$ip" >> $f_url
				echo "https://$host" >> $f_url
			else
				echo "http://$ip:$port" >> $f_url
				echo "https://$ip:$port" >> $f_url
				echo "http://$host:$port" >> $f_url
				echo "https://$host:$port" >> $f_url
			fi
		fi
	done
done

IFS=$SAVEIFS

count_file $f_url
echo $cnt urls found

if [ $cnt -eq 0 ] ; then
	echo
	echo "Exiting!"
	echo
	exit
fi



echo 
echo "## Technology recon"
echo "Running wappalyzer..."
for u in $(cat $f_url) ; do
    echo $u >> $f_techno
    echo >> $f_techno
    wappalyzer $u 2>/dev/null >> $f_techno
    echo >> $f_techno
    echo >> $f_techno
    echo >> $f_techno
done



echo 
echo "## Visual recon"
#cd $screen_path
#echo "Running httpscreenshot..."
#httpscreenshot -l $f_url --headless -w 10 > /dev/null
#rm *.html geckodriver.log ghostdriver.log 2>/dev/null
#EyeWitness -f $f_url --headless --no-prompt 2>&1 > /dev/null
#echo `find . -name "*.png" | wc -l` screenshots found
#cd $path

echo "Running aquatone..."
cat $f_url | aquatone -ports xlarge -out $path -screenshot-timeout 5000



echo 
echo "## Testing buckets"
tmp="$path/tmp_buckets.txt"
echo "Testing subdomains..."
s3-buckets-bruteforcer --no-color --detect-region --bucket $f_host --verbosity 1 >> $tmp
s3-buckets-bruteforcer --no-color --bucket $f_host --verbosity 1 --provider google >> $tmp
s3-buckets-bruteforcer --no-color --bucket $f_host --verbosity 1 --provider digitalocean >> $tmp

echo "Testing *.$domain..."
s3-buckets-bruteforcer --no-color --thread 50 --detect-region --bucket $domain --prefix /opt/SecLists/Discovery/Web_Content/common.txt --glue "." --verbosity 1 >> $tmp
echo "Testing $domdom-*..."
s3-buckets-bruteforcer --no-color --thread 50 --detect-region --bucket $domdom --suffix /opt/SecLists/Discovery/Web_Content/common.txt --glue "-" --verbosity 1 >> $tmp

cat $tmp | grep FOUND | awk '{print $2}' | sort -fu > $f_bucket



echo
echo "## Discovery"
echo "Running quick-hits..."
quick-hits -h $f_all -f /opt/SecLists/mine/myhardw.txt -c -e 200 -d $path -g -o -t 8-30 -s -k



echo 
echo "## The end."