zsh-pentest.plugin.zsh

#!/usr/bin/env zsh
#
# Aliases
#
alias me='echo $(ifconfig eth0 | grep "inet " | cut -b 9- | cut  -d" " -f2)'
alias e4l="enum4linux -a"
alias h2t="html2text -style pretty"
alias oso=onesixtyone
alias cme=crackmapexec
#
# Functions
#
create_scan_directory() {
    NAME=${1:-$(date +%Y%m%d-%T)}
    SCAN_DIRECTORY=$HOME/.scans/$NAME
    mkdir -p "$SCAN_DIRECTORY"
    echo "$SCAN_DIRECTORY"
}
enum_snmp() {
    STRINGS="/usr/share/seclists/Discovery/SNMP/snmp-onesixtyone.txt"
    WORDLIST=${2:-STRINGS}
    NETWORK=${3:-"10.11.1.0"}
    HOSTS=$(mktemp --suffix "-$0-hosts-$(date +%Y%m%d)")
    get_hosts "none" "$NETWORK" > "$HOSTS"
    onesixtyone -i "$HOSTS" -c "$STRINGS"
}
enum_web() {
    IP=${1:-$RHOST}
    PORT=${2:-80}
    # /usr/share/seclists/Discovery/Web_Content/Top1000-RobotsDisallowed.txt
    WORDLIST=${3:-"/usr/share/seclists/Discovery/Web-Content/common.txt"}
    SAVEPATH=$(create_scan_directory "$IP")
    GOBUSTER_OUTPUT="$SAVEPATH"/results_gobuster_$PORT
    NIKTO_OUTPUT="$SAVEPATH"/results_nikto_$PORT
    touch $GOBUSTER_OUTPUT
    touch $NIKTO_OUTPUT
    cd "$SAVEPATH" && whatweb -a 3 "$IP"
    gobuster dir -w "$WORDLIST" -u http://"$IP":"$PORT" -o "$SAVEPATH"/gobuster --output $GOBUSTER_OUTPUT
    nikto -host "$IP" -port "$PORT" -output $NIKTO_OUTPUT -Format txt
}
flush_iptables() {
    echo ""
    echo ">>> Before flush <<<"
    echo "" 
    iptables -L
    iptables -F
    iptables -X
    iptables -t nat -F
    iptables -t nat -X
    iptables -t mangle -F
    iptables -t mangle -X
    iptables -t raw -F
    iptables -t raw -X
    iptables -P INPUT ACCEPT
    iptables -P FORWARD ACCEPT
    iptables -P OUTPUT ACCEPT
    echo ""
    echo ""
    echo ">>> After flush <<<"
    echo "" 
    iptables -L
    echo ""
}
focus() {
    IP=${1:-"EMPTY"}
    PORT=${2:-"EMPTY"}
    [[ "$IP" != "EMPTY" ]] && RHOST="$IP"
    [[ "$PORT" != "EMPTY" ]] && RPORT="$PORT"
    echo -e "\$RHOST: ${RHOST:-"NOT SET"}\n\$RPORT: ${RPORT:-"NOT SET"}\n"
}
get_gateway() {
   INTERFACE=${1:-tap0}
   ip route | grep via | grep "$INTERFACE" | cut -d" " -f3 
}
get_hosts() {
    PORT=${1:-"none"}
    NETWORK=${2:-"10.11.1.0"}
    PATTERN="Nmap scan report for ${NETWORK:0:-1}"
    get_ip() {
        cut -d" " -f5 $1
    }
    if [[ $PORT == "none" ]]; then
        nmap "$NETWORK"/24 -sn | grep "$PATTERN" | get_ip
    else
        nmap "$NETWORK"/24 -p "$PORT" --open | grep "$PATTERN" | get_ip
    fi
}
get_hostnames() {
    DNS=$1
    NETWORK=${2:-"10.11.1.0"}
    PATTERN="Nmap scan report for "
    get_ip() {
        cut -d" " -f5- $1
    }
    if [[ ${#1} -gt 0 ]]; then
        nmap "$NETWORK"/24 --dns-server "$DNS" -sn | grep "$PATTERN" | get_ip
    else
        echo "DNS server address required"
    fi
}
htm() { curl -s "${1:-$RHOST}:${80:-$RPORT}" | html2text -style pretty; }
monitor_traffic() {
    IP=${1:-$RHOST}
    iptables -I INPUT 1 -s "$IP" -j ACCEPT
    iptables -I OUTPUT 1 -d "$IP" -j ACCEPT
    iptables -Z 
}
scan_tcp() {
    IP=${1:-$RHOST}
    INTERFACE=${2:-"tap0"}
    SAVEPATH=$(create_scan_directory "$IP")
    run() {
        masscan "$1" -e "$INTERFACE" --router-ip "$(get_gateway "$INTERFACE")" -p 0-65535 --rate 500 -oL "$SAVEPATH"/ports
    }
    run "$IP"
}
scan_udp() {
    IP=${1:-$RHOST}
    SAVEPATH=$(create_scan_directory "$IP")
    run() {
        nmap -sU -T4 --open --max-retries 1 "$1" -oX "$SAVEPATH"/ports-udp.xml
    }
    run "$IP"
}
serve() {
    PORT=${1:-80}
    DIR=${2:-$(pwd)}
    echo "Serving files from $DIR"
    if type python3 >/dev/null 2>&1; then
       python3 -m http.server "$PORT"
    else
       python -m SimpleHTTPServer "$PORT" 
    fi
}
sort_ips() {
    IPS=$1
    sort -t . -k 3,3n -k 4,4n "$IPS"
}