DevSecOps+BugBounty.ipynb

{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "name": "DevSecOps+BugBounty",
      "provenance": [],
      "collapsed_sections": [],
      "include_colab_link": true
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    },
    "language_info": {
      "name": "python"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "view-in-github",
        "colab_type": "text"
      },
      "source": [
        "<a href=\"https://colab.research.google.com/github/brinhosa/awesome-pentest-tools-in-colab/blob/main/DevSecOps%2BBugBounty.ipynb\" target=\"_parent\"><img src=\"https://colab.research.google.com/assets/colab-badge.svg\" alt=\"Open In Colab\"/></a>"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "dn52BbxXalcv"
      },
      "source": [
        "**DevSecOps+BugBounty**\n",
        "\n",
        "This is a set of tools and processess to improve DevSecOps using Bug Bounty tools and techniques.\n",
        "\n",
        "*   Twitter: https://twitter.com/brinhosa\n",
        "*   GitHub: https://github.com/brinhosa/awesome-pentest-tools-in-colab\n",
        "*   LinkedIn: https://www.linkedin.com/in/brinhosa/\n",
        "*   Presentationd: https://github.com/brinhosa/presentations\n",
        "\n",
        "BHACK 2021 Talk: https://github.com/brinhosa/presentations/blob/main/2021_Bhack_RBB_HACKEANDO_SUAS_PROPRIAS_APLICACOES-COMO_UTILIZAR_TECNICAS_DE_BUG_BOUNTY_EM_SEU_DEVSECOPS.pdf\n",
        "\n",
        "⚡ Check other tools ported to Colab at: https://github.com/brinhosa/awesome-pentest-tools-in-colab\n",
        "\n",
        "📫 Send your comments and suggestions to: brinhosa@gmail.com"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "G30pxxi1Zjus"
      },
      "source": [
        "**Web Application Security Review**\n",
        "\n",
        "Go to:\n",
        "https://vsaq-demo.withgoogle.com/vsaq.html?qpath=questionnaires/webapp.json\n",
        "\n",
        "Answer the questions and download by clicking at \"Download answers\" at the end of the page.\n"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "CWdbEgPv1THk"
      },
      "source": [
        "**Infrastructure Security Review**\n",
        "\n",
        "Go to: https://vsaq-demo.withgoogle.com/vsaq.html?qpath=questionnaires/infrastructure.json\n",
        "\n",
        "Answer the questions and download by clicking at \"Download answers\" at the end of the page.\n",
        "\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "aCvELDzJaquv"
      },
      "source": [
        "#Execute this to install GO, Masscan and httprobe -- Required for the next steps\n",
        "%cd /content/\n",
        "!sudo apt install libpcap0.8-dev libuv1-dev\n",
        "!sudo apt-get --assume-yes install git make gcc\n",
        "!git clone https://github.com/robertdavidgraham/masscan\n",
        "%cd masscan\n",
        "%cd bin\n",
        "!make\n",
        "!rm -rf /usr/local/go\n",
        "!apt remove golang \n",
        "!wget https://dl.google.com/go/go1.16.4.linux-amd64.tar.gz \n",
        "!sudo tar -xvf go1.16.4.linux-amd64.tar.gz   \n",
        "!sudo mv go /usr/local  \n",
        "!export GOROOT=/usr/local/go \n",
        "!export GOPATH=$HOME/content\n",
        "!export PATH=$GOPATH/bin:$GOROOT/bin:$PATH \n",
        "!export GOBIN=/root/go/bin\n",
        "import os\n",
        "os.environ[\"PATH\"] += os.pathsep + os.pathsep.join([\"/usr/local/go/bin\"])\n",
        "os.environ[\"PATH\"] += os.pathsep + os.pathsep.join([\"/root/go/bin\"])\n",
        "os.environ['GOROOT'] = '/usr/local/go'\n",
        "os.environ['GOPATH'] = '/content'\n",
        "!go version \n",
        "os.environ['GOBIN'] = '/root/go/bin'\n",
        "!go get -u github.com/tomnomnom/httprobe\n",
        "%cd /content/"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "n4VFGqlTVWny"
      },
      "source": [
        "**Software Composition Analysis (SCA)**\n",
        "\n",
        "Software Composition Analysis (SCA) is a segment of the application security testing (AST) tool market that deals with managing open source component use. SCA tools perform automated scans of an application’s code base, to identify all open source components and any security vulnerabilities. \n",
        " "
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "TbvKJb0HJ7yD"
      },
      "source": [
        "*How to run dependency-check in Google Colab.*\n",
        "\n",
        "Dependency-Check is a Software Composition Analysis (SCA) tool that attempts to detect publicly disclosed vulnerabilities contained within a project's dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.\n",
        "\n",
        "*Running this tool against our web application projects can help to identify  vulnerabilities in the libraries.\n",
        "\n",
        "1.   Run the first code cell to install. \n",
        "2.   Run the second code cell to execute (the first run will take some time to update the vulnerability database).\n",
        "3.   In the output frame upload your application code as a .zip file or other accepted format (https://jeremylong.github.io/DependencyCheck/analyzers/) to analyse. *You can select multiple files or multiple applications (.jar,.war,.zip).\n",
        "4.   The generated reports will be compressed and automatically downloaded as dependency-check-report.html.\n",
        "\n",
        "Source: https://github.com/jeremylong/DependencyCheck"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "55ByfhmsRRNk"
      },
      "source": [
        "!wget  https://github.com/jeremylong/DependencyCheck/releases/download/v6.2.2/dependency-check-6.2.2-release.zip\n",
        "!unzip dependency-check-6.2.2-release.zip\n",
        "%cd dependency-check\n",
        "%cd bin"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "qzdYvPLqS2rr"
      },
      "source": [
        "!rm -rf reports.zip\n",
        "print(\"Upload your application code as a .zip file or other accepted format (https://jeremylong.github.io/DependencyCheck/analyzers/) to analyse.\")\n",
        "print(\"*You can select multiple files or multiple applications (.jar,.war,.zip).\")\n",
        "from google.colab import files\n",
        "uploaded = files.upload()\n",
        "for fn in uploaded.keys():\n",
        "  print('User uploaded file \"{name}\" with length {length} bytes'.format(\n",
        "      name=fn, length=len(uploaded[fn])))\n",
        "  filen='./dependency-check.sh -s \"'+fn+'\"'\n",
        "  get_ipython().system(filen)\n",
        "  get_ipython().system('rm -rf \"'+fn+'\"')\n",
        "  get_ipython().system(\"mv /content/dependency-check/bin/./dependency-check-report.html /content/dependency-check/bin/./dc_\"+fn+\".html\")\n",
        "  get_ipython().system(\"zip reports.zip *.html\")\n",
        "  get_ipython().system(\"rm -rf *.html\")\n",
        "print(\"The generated reports will be compressed and automatically downloaded as reports.zip\")\n",
        "from google.colab import files\n",
        "files.download('reports.zip') "
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "wyOIDjN9bEJ2"
      },
      "source": [
        "**SAST**\n",
        "\n",
        "Static Application Security Testing (SAST) Tools, are designed to analyze source code or compiled versions of code to help find security flaws.\n",
        "\n"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "65VVzBqaIuMf"
      },
      "source": [
        "*How to run Semgrep in Google Colab.*\n",
        "\n",
        "Semgrep is a fast, open-source, static analysis tool for finding bugs and enforcing code standards at editor, commit, and CI time.\n",
        "Semgrep analyzes code locally on your computer or in your build environment: code is never uploaded externally.\n",
        " \n",
        "*This will run 1,000+ rules covering security, correctness, and performance bugs.\n",
        "\n",
        "\n",
        "1.   Run the first code cell to install. \n",
        "3.   Run the second code cell to execute.\n",
        "5.   In the output frame upload the .zip file containing your application source-code.\n",
        "6.   The generated reports will be automatically downloaded.\n",
        "\n",
        "Source: \n",
        "*   https://github.com/returntocorp/semgrep"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "nBRJuzL3I25m"
      },
      "source": [
        "!python3 -m pip install semgrep\n",
        "!git clone https://github.com/returntocorp/semgrep-rules.git"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "IdsQiR18I5A3"
      },
      "source": [
        "!rm -rf reports.zip\n",
        "!rm -rf report.txt\n",
        "!rm -rf *.json \n",
        "!rm -rf files/\n",
        "print(\"Upload your application source-code compacted as a .ZIP file to analyse.\")\n",
        "print(\"*You can select multiple .zip files containing the application source-code(.java, .jsp, .php, .py...).\")\n",
        "from google.colab import files\n",
        "uploaded = files.upload()\n",
        "for fn in uploaded.keys():\n",
        "  print('User uploaded file \"{name}\" with length {length} bytes'.format(\n",
        "      name=fn, length=len(uploaded[fn])))\n",
        "  comm='unzip -d files/ \"'+fn+'\" '\n",
        "  get_ipython().system(comm)\n",
        "  filen='semgrep -c /content/semgrep-rules/ files/ --max-chars-per-line 5000 --max-lines-per-finding 100 -o  semgrep_\"'+fn+'\"_report.json | tee -a report.txt'\n",
        "  get_ipython().system(filen)\n",
        "  get_ipython().system(\"zip reports.zip *.json\")\n",
        "  get_ipython().system('rm -rf \"'+fn+'\"')\n",
        "get_ipython().system(\"zip reports.zip report.txt\")\n",
        "print(\"The generated reports will be compressed and automatically downloaded as reports.zip\")\n",
        "from google.colab import files\n",
        "files.download('reports.zip') "
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "5Aza5Zc2RXUk"
      },
      "source": [
        "*How to run Insider in Google Colab.*\n",
        "\n",
        "Insider is a Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. \n",
        " \n",
        "1.   Run the first code cell to install. \n",
        "3.   Run the second code cell to execute.\n",
        "5.   In the output frame upload the .zip file containing your application source-code.\n",
        "6.   The generated reports will be automatically downloaded.\n",
        "\n",
        "Source: \n",
        "*   https://github.com/insidersec/insider"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "ngvnjWV9RYzj"
      },
      "source": [
        "!wget \"https://github.com/insidersec/insider/releases/download/3.0.0/insider_3.0.0_linux_x86_64.tar.gz\"\n",
        "!tar -xf insider_3.0.0_linux_x86_64.tar.gz\n",
        "!chmod +x insider"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "zjDx4vhIRalE"
      },
      "source": [
        "!rm -rf reports.zip\n",
        "!rm -rf report.txt\n",
        "!rm -rf report.json\n",
        "!rm -rf report.html\n",
        "!rm -rf files/\n",
        "print(\"Upload your application source-code compacted as a .ZIP file to analyse.\")\n",
        "print(\"*You can select multiple .zip files containing the application source-code(.java, .jsp, .php, .py...).\")\n",
        "from google.colab import files\n",
        "uploaded = files.upload()\n",
        "for fn in uploaded.keys():\n",
        "  print('User uploaded file \"{name}\" with length {length} bytes'.format(\n",
        "      name=fn, length=len(uploaded[fn])))\n",
        "  comm='unzip -d files/ \"'+fn+'\" '\n",
        "  get_ipython().system(comm)\n",
        "  filen='./insider --tech java --target files/ | tee -a report.txt'\n",
        "  get_ipython().system(filen)\n",
        "  get_ipython().system(\"zip reports.zip report.json report.html\")\n",
        "  get_ipython().system('rm -rf \"'+fn+'\"')\n",
        "get_ipython().system(\"zip reports.zip report.txt\")\n",
        "print(\"The generated reports will be compressed and automatically downloaded as reports.zip\")\n",
        "!ls\n",
        "!ls files/\n",
        "from google.colab import files\n",
        "files.download('reports.zip')"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "JlfDxFN5IrDZ"
      },
      "source": [
        "*How to run graudit in Google Colab.*\n",
        "\n",
        "graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being very flexible.\n",
        "\n",
        "*Running this scanner against our code can help to identify vulnerabilities like XSS and SQL injections in the code, among others.\n",
        "\n",
        "1.   Run the first code cell bellow to install. \n",
        "2.   Run the second code cell bellow to execute (the first run will take some time to update the vulnerability database).\n",
        "3.   In the output frame upload your application code files to analyse. *You can select multiple files or multiple applications.\n",
        "4.   The generated reports will be compressed and automatically downloaded as dependency-check-report.html.\n",
        "\n",
        "Source: https://www.justanotherhacker.com/projects/graudit.html"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "25BoDi9Vbkzs"
      },
      "source": [
        "%cd /content/\n",
        "!git clone https://github.com/wireghoul/graudit\n",
        "!export GRDIR=/content/graudit/"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "vSfXQS9OdmKe"
      },
      "source": [
        "print(\"Upload your application code source files to analyse.\")\n",
        "print(\"*You can select multiple files or multiple source files.\")\n",
        "get_ipython().system(\"rm -rf reports.zip\")\n",
        "from google.colab import files\n",
        "uploaded = files.upload()\n",
        "for fn in uploaded.keys():\n",
        "  print('User uploaded file \"{name}\" with length {length} bytes'.format(\n",
        "      name=fn, length=len(uploaded[fn])))\n",
        "  filen='/content/graudit/graudit -A \"'+fn+'\" | tee -a \"'+fn+'grauditresults.txt\"'\n",
        "  print(filen)\n",
        "  get_ipython().system(filen)\n",
        "  get_ipython().system('rm -rf \"'+fn+'\"')\n",
        "  get_ipython().system('zip reports.zip \"'+fn+'grauditresults.txt\"')\n",
        "  get_ipython().system('rm -rf  \"'+fn+'\"grauditresults.txt')\n",
        "print(\"The generated reports will be compressed and automatically downloaded as reports.zip\")\n",
        "from google.colab import files\n",
        "files.download('reports.zip') "
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "a_askfJqhvB1"
      },
      "source": [
        "**DAST**\n",
        "\n",
        "Dynamic application security testing (DAST) technologies are designed to detect conditions indicative of a security vulnerability in an application in its running state. Most DAST solutions test only the exposed HTTP and HTML interfaces of Web-enabled applications; however, some solutions are designed specifically for non-Web protocol and data malformation (for example, remote procedure call, Session Initiation Protocol [SIP] and so on).\n",
        "\n"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "OrHGaCw4I_kP"
      },
      "source": [
        "*How to run Arachni in Google Colab.*\n",
        "\n",
        "Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.\n",
        "\n",
        "*Running Arachni against our web applications can help to identify  vulnerabilities like XSS and SQL injections, among others.\n",
        "\n",
        "\n",
        "1.   Run the first code cell to install. \n",
        "3.   Run the second code cell to execute.\n",
        "5.   In the output frame enter your site to analyse.\n",
        "6.   The generated report will be automatically downloaded.\n",
        "6.   After download, extract and open the index file in the extracted folder to check the results.\n",
        "\n",
        "Source: https://github.com/Arachni/arachni"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "5HUZHVNkixkQ"
      },
      "source": [
        "!wget https://github.com/Arachni/arachni/releases/download/v1.5.1/arachni-1.5.1-0.5.12-linux-x86_64.tar.gz\n",
        "!tar zxvf arachni-1.5.1-0.5.12-linux-x86_64.tar.gz\n",
        "%cd arachni-1.5.1-0.5.12\n",
        "%cd bin/"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "VTJEAIqUiyEr"
      },
      "source": [
        "print(\"Use this tool only use with permission in a segregated network, using this tool against applications without permission is illegal.\")\n",
        "user_response = input(\"Enter a url to analyze:\")\n",
        "#scan timeout is set to 5 minutes, change below according to your needs\n",
        "command=\"./arachni --output-verbose --scope-include-subdomains \"+user_response+\" --timeout 00:05:00 --report-save-path=report.afr\"\n",
        "#https://github.com/Arachni/arachni/wiki/Command-line-user-interface#timeout-suspend\n",
        "get_ipython().system(command)\n",
        "command=\"./arachni_reporter report.afr --reporter=html:outfile=my_report.html.zip\"\n",
        "get_ipython().system(command)\n",
        "from google.colab import files\n",
        "files.download('my_report.html.zip')"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "z7xg8jsojt2b"
      },
      "source": [
        "**OWASP ZAP**\n",
        "\n",
        "In addition to Arachini, include OWASP ZAP in the product pipeline and review your results.\n",
        "\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "dHA74svt4V8o"
      },
      "source": [
        "!pip install python-owasp-zap-v2.4\n",
        "!wget https://github.com/zaproxy/zaproxy/releases/download/v2.10.0/ZAP_2_10_0_unix.sh\n",
        "!chmod +x ZAP_2_10_0_unix.sh\n",
        "!./ZAP_2_10_0_unix.sh --help\n",
        "#Start API\n",
        "!nohup /opt/zaproxy/zap.sh -daemon -config api.addrs.addr.regex=true -config api.addrs.addr.name=.* -config api.disablekey=true -host 0.0.0.0 -port 9292 &"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "MBZr8yoy4y6O"
      },
      "source": [
        "#Execute quick test\n",
        "!nohup /opt/zaproxy/zap.sh -quickurl URL -quickout zapreport_APP_VERSION.html -cmd"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "7QXMGi_s7exF"
      },
      "source": [
        "**DirSearch**\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "MqddoNNd7Wwz"
      },
      "source": [
        "!pip3 install dirsearch"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "szCPnxBi7jT9"
      },
      "source": [
        "!dirsearch -x 302 -r --random-agent -u URL -o report.txt"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "JBYxoGgbKfuD"
      },
      "source": [
        "**XSStrike**"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "RRlKxU52KfFN"
      },
      "source": [
        "!git clone https://github.com/s0md3v/XSStrike\n",
        "%cd XSStrike\n",
        "!pip install -r requirements.txt"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "gzmpAjYuKmAh"
      },
      "source": [
        "!python xsstrike.py --params --path --fuzzer -u \"http://demo.testfire.net/search.jsp?query=s\""
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "yWVVh0FMEUJ3"
      },
      "source": [
        "**SQLMAP**\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "J2jFumdJEWXT"
      },
      "source": [
        "!pip install sqlmap"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "VCAtX5V1EW3J"
      },
      "source": [
        "!sqlmap -u \"http://demo.testfire.net\" --thread=5 --random-agent --level=5 --risk=3  --batch --crawl=3"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "d8jLI26nmfzM"
      },
      "source": [
        "**Vulnerability Assessment**\n",
        "\n",
        "*How to run pySSLScan in Google Colab.*\n",
        "\n",
        "pySSLScan is a framework to scan SSL enabled services, in order to determine the supported ciphers, preferred ciphers, certificate information and vulnerabilities. \n",
        "\n",
        "*Running this scan against our domains can help to identify unsecure certificates and vulnerabilities.\n",
        "\n",
        "1.   Run the first code cell to install. \n",
        "3.   Run the second code cell to execute.\n",
        "5.   In the output frame enter an IP or Domain to analyse.\n",
        "6.   The generated report will be presented in the output frame.\n",
        "\n",
        "Source: https://github.com/DinoTools/pysslscan"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "MbXY8RvZlaA0"
      },
      "source": [
        "!pip install sslscan\n",
        "#!pysslscan --help\n",
        "#!pysslscan scan --scan=server.ciphers --report=term --tls10 IP\n",
        "#!pysslscan scan --scan=protocol.http --scan=vuln.heartbleed --scan=server.preferred_ciphers --scan=server.ciphers --report=term:rating=ssllabs.2009e --ssl2 --ssl3 --tls10 --tls11 --tls12 IP\n"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "Rxy1UubEmaed"
      },
      "source": [
        "user_response = input(\"Enter an IP or domain to analyze:\")\n",
        "command=\"pysslscan scan --scan=server.ciphers --scan=vuln.heartbleed --report=term:rating=ssllabs.2009e --tls10 \"+user_response\n",
        "get_ipython().system(command)"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "TpuRpC5Sw-L9"
      },
      "source": [
        "*Evaluate your CSP headers*\n",
        "\n",
        "Go to https://csp-evaluator.withgoogle.com/ and paste the URL or the HTTP request headers to evaluate."
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "piDzSEpOyyJ5"
      },
      "source": [
        "*How to run nmap in Google Colab.*\n",
        "\n",
        "Nmap is a free and open source utility for network discovery and security auditing. \n",
        "\n",
        "*Running nmap with the \"vuln\" scripts argument against our applications and servers can help to identify unsecure certificates and vulnerabilities.\n",
        "\n",
        "1.   Run the first code cell to install. \n",
        "3.   Run the second code cell to execute.\n",
        "5.   In the output frame enter an IP or Domain to analyse.\n",
        "6.   The generated report will be presented in the output frame.\n",
        "\n",
        "Source: https://nmap.org/\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "-BfJFzLKyzfU"
      },
      "source": [
        "!apt install nmap\n",
        "!nmap --script-updatedb"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "ePodXHgV0sxz"
      },
      "source": [
        "!rm -rf nmap_*\n",
        "user_response = input(\"Enter a domain or IP to analyze:\")\n",
        "command='time nmap -n -Pn -p80,443 -T4 --script \"(vuln) and not dos\" '+user_response+' -oA nmap_'+user_response+' | tee -a nmap_'+user_response+'_screen_results.txt'\n",
        "get_ipython().system(command)\n",
        "commandzip=\"zip nmap_\"+user_response+\"_results.zip nmap_*\" \n",
        "get_ipython().system(commandzip)\n",
        "from google.colab import files\n",
        "files.download(\"nmap_\"+user_response+\"_results.zip\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "CGi1YSRKP1By"
      },
      "source": [
        "**How to run Nikto in Google Colab.**\n",
        "\n",
        "Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated.\n",
        "\n",
        "*Running Nikto against our servers can help to examine our web servers to find potential problems and security vulnerabilities, including:\n",
        "*   Server and software misconfigurations\n",
        "*   Default files and programs\n",
        "*   Insecure files and programs\n",
        "*   Outdated servers and programs\n",
        "*   Pointers to lead a human tester to better manual testing\n",
        "\n",
        "To use:\n",
        "1.   Run the first code cell to install. \n",
        "3.   Run the second code cell to execute.\n",
        "5.   In the output frame enter the domain or IP to analyse.\n",
        "6.   The generated reports will be automatically downloaded.\n",
        "\n",
        "Sources: \n",
        "*   https://github.com/sullo/nikto/wiki \n",
        "*   https://cirt.net/Nikto2"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "xJeJIAGnP1_4"
      },
      "source": [
        "!apt install nikto"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "b6xFy2BaP4pY"
      },
      "source": [
        "!rm -rf nikto_*\n",
        "user_response = input(\"Enter a domain to analyze:\")\n",
        "command=\"time nikto -h \"+user_response+\" -Format html -output nikto_\"+user_response+\".html | tee -a nikto_\"+user_response+\"_results.txt\"\n",
        "get_ipython().system(command)\n",
        "from google.colab import files\n",
        "files.download(\"nikto_\"+user_response+\".html\")\n",
        "from google.colab import files\n",
        "files.download(\"nikto_\"+user_response+\"_results.txt\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "IOArfSlk7K2L"
      },
      "source": [
        "**OWASP Nettattacker**"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "31v_0FlO7KaW"
      },
      "source": [
        "!git clone https://github.com/OWASP/Nettacker.git\n",
        "%cd Nettacker \n",
        "!pip install -r requirements.txt && python setup.py install"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "6MKF67dZ7RNl"
      },
      "source": [
        "%cd /content/Nettacker\n",
        "!rm -rf /content/Nettacker/.data/results/*\n",
        "!rm -rf results.zip\n",
        "#https://github.com/OWASP/Nettacker/wiki/Usage\n",
        "user_response = input(\"Enter a hostname to analyze: \")\n",
        "command=\"python nettacker.py -m all -i '\"+user_response+\"'\"\n",
        "get_ipython().system(command)\n",
        "!zip results.zip /content/Nettacker/.data/results/*\n",
        "from google.colab import files\n",
        "files.download(\"results.zip\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "cGqAijD49iU0"
      },
      "source": [
        "**Tsunami**\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "BEVNCMeI9hNH"
      },
      "source": [
        "!sudo apt remove nmap\n",
        "!apt install alien\n",
        "!wget https://nmap.org/dist/nmap-7.92-1.x86_64.rpm\n",
        "!alien nmap-7.92-1.x86_64.rpm\n",
        "!dpkg -i nmap_7.92-2_amd64.deb\n",
        "!nmap --version\n",
        "!apt remove ncrack\n",
        "!wget https://nmap.org/ncrack/dist/ncrack-0.7.tar.gz\n",
        "!tar -xzf ncrack-0.7.tar.gz\n",
        "%cd ncrack-0.7\n",
        "!./configure\n",
        "!make\n",
        "!sudo make install\n",
        "!ncrack --version\n",
        "%cd /content\n",
        "!bash -c \"$(curl -sfL https://raw.githubusercontent.com/google/tsunami-security-scanner/master/quick_start.sh)\"\n",
        "%cd /content"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "WyPKT9Nd9oou"
      },
      "source": [
        "%cd /root/tsunami\n",
        "!rm -rf /tmp/tsunami-output.json\n",
        "user_response = input(\"Enter a hostname to analyze: \")\n",
        "#update the command below with the new Tsunami version from the output above, for instance tsunami-main-XXXX-SNAPSHOT-cli.jar\n",
        "command='cd /root/tsunami && \\\n",
        "java -cp \"tsunami-main-0.0.7-SNAPSHOT-cli.jar:/root/tsunami/plugins/*\" \\\n",
        "  -Dtsunami-config.location=/root/tsunami/tsunami.yaml \\\n",
        "  com.google.tsunami.main.cli.TsunamiCli \\\n",
        "   --hostname-target=\"'+user_response+'\" \\\n",
        "  --scan-results-local-output-format=JSON \\\n",
        "  --scan-results-local-output-filename=/tmp/tsunami-output.json'\n",
        "get_ipython().system(command)\n",
        "from google.colab import files\n",
        "files.download(\"/tmp/tsunami-output.json\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "NFd03ZFchr4k"
      },
      "source": [
        "**Jaeles**\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "4ubEvSpHGrJQ"
      },
      "source": [
        "!GO111MODULE=on go get github.com/jaeles-project/jaeles\n",
        "!jaeles config init"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "5xge556VGrzh"
      },
      "source": [
        "!jaeles scan -c 100 -s \"cves,common,dns,fuzz,mics,probe,routines,sensitive\" -u \"demo.testfire.net\""
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "ykA7MjUquL2G"
      },
      "source": [
        "**OpenVAS**\n",
        "\n",
        "*OpenVAS docker:* \n",
        "\n",
        "https://github.com/brinhosa/tools/blob/main/openvas"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "lk3Di-tBhjEu"
      },
      "source": [
        "**Several Bug Bounty |Tools**"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "YRR8EahoOPZ7"
      },
      "source": [
        "!wget -O - https://raw.githubusercontent.com/KingOfBugbounty/DockerHunt/main/install_hacktools.sh | bash"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "QFcSLiyNhnXs"
      },
      "source": [
        "**URO**"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "48mfBo2dOVYT"
      },
      "source": [
        "!pip3 install uro"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "5ecLdfYwO1wV"
      },
      "source": [
        "**INFRA AS A CODE - SCANNING**\n",
        "\n",
        "Checkov\n",
        "\n",
        "docker run --tty --volume /projeto_iac:/tf bridgecrew/checkov --directory /tf\n"
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "**Cloud Security Pentesting**\n",
        "\n",
        "*Cloudsploit (Cloud Security Posture Management (CSPM))*\n",
        "\n",
        "Create a new user with the following policy (https://github.com/brinhosa/cloudsploit/blob/master/new_user)\n",
        "\n",
        "Execute:\n",
        "\n",
        "docker run -v $(pwd):/reports -e AWS_ACCESS_KEY_ID=INSERT_HERE -e AWS_SECRET_ACCESS_KEY=INSERT_HERE cloudsploit:0.0.1 --compliance=hipaa --compliance=pci --compliance=cis --compliance=cis1 --compliance=cis2 --csv=/reports/report.csv --json=/reports/report.json"
      ],
      "metadata": {
        "id": "80ADKaYv7vgO"
      }
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "crICgHKTPGaS"
      },
      "source": [
        "**MALWARE ANALYSIS**\n",
        "\n",
        "docker exec -it citoolkit_remnux_1 /bin/sh \n",
        "\n",
        "freshclam \n",
        "\n",
        "clamscan ."
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "sSOtGoKoPvA9"
      },
      "source": [
        "**NUCLEI**\n",
        "\n",
        "nuclei -u \" http://demo.testfire.net\" | tee -a ”output.txt”"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "Yh9wqsiwPFkr"
      },
      "source": [
        ""
      ],
      "execution_count": null,
      "outputs": []
    }
  ]
}