-
Notifications
You must be signed in to change notification settings - Fork 1
/
stackscan.sh
executable file
·1278 lines (1060 loc) · 50.2 KB
/
stackscan.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/bash
scan_start_time=$(date +%s)
# Function to handle errors
handle_error() {
local exit_code=$?
local cmd="${BASH_COMMAND}"
local line_number="${BASH_LINENO[0]}"
log_message "ERROR" "An error occurred during the execution of the script."
log_message "ERROR" "Command: '${cmd}' failed with exit code ${exit_code}."
log_message "ERROR" "Error occurred on line ${line_number}."
echo "Cleaning up..."
# Delete temp files
rm -f ./*_output.txt
exit "$exit_code"
}
# Automatically trap errors and call the handle_error function
trap 'handle_error' ERR
# ANSI color codes
BOLD="\033[1m"
CYAN="\033[36m"
GREEN="\033[32m"
YELLOW="\033[33m"
RED="\033[31m"
RESET="\033[0m"
# Default log level (INFO)
LOG_LEVEL="INFO"
# Default log file (in case it's needed before configuration is loaded)
LOG_FILE=""
# Function to log messages with timestamps
log_message() {
local level="$1"
local message="$2"
local timestamp
timestamp=$(date +"%Y-%m-%d %H:%M:%S")
if [ "$level" = "ERROR" ]; then
echo -e "${RED}$message${RESET}"
if [ -n "$LOG_FILE" ]; then echo "[$timestamp] ERROR: $message" >> "$LOG_FILE"; fi
elif [ "$level" = "WARNING" ]; then
echo -e "${YELLOW}$message${RESET}"
if [ -n "$LOG_FILE" ]; then echo "[$timestamp] WARNING: $message" >> "$LOG_FILE"; fi
elif [ "$level" = "INFO" ]; then
if [ "$LOG_LEVEL" = "INFO" ] || [ "$LOG_LEVEL" = "VERBOSE" ]; then
echo -e "${GREEN}$message${RESET}"
if [ -n "$LOG_FILE" ]; then echo "[$timestamp] INFO: $message" >> "$LOG_FILE"; fi
fi
elif [ "$level" = "VERBOSE" ]; then
if [ "$LOG_LEVEL" = "VERBOSE" ]; then
echo -e "${CYAN}$message${RESET}"
if [ -n "$LOG_FILE" ]; then echo "[$timestamp] VERBOSE: $message" >> "$LOG_FILE"; fi
fi
fi
}
# Function to print status messages
print_status() {
log_message "INFO" "$1"
}
# Function to print verbose messages
print_verbose() {
log_message "VERBOSE" "$1"
}
# Function to print warnings
print_warning() {
log_message "WARNING" "$1"
}
# Function to print errors
print_error() {
log_message "ERROR" "$1"
}
# Ensure the script is run as root
if [ "$EUID" -ne 0 ]; then
log_message "ERROR" "This script must be run as root."
exit 1
fi
# Load the configuration file early in the script
load_config() {
local config_file="/home/$SUDO_USER/.stackscan.conf"
if [ -f "$config_file" ]; then
source "$config_file"
else
log_message "WARNING" "Configuration file not found."
create_default_config
fi
}
# Create a default configuration file if it doesn't exist
create_default_config() {
if [ -z "$SUDO_USER" ]; then
log_message "ERROR" "SUDO_USER is not set. Please run the script with sudo."
exit 1
fi
cat <<EOL > /home/"$SUDO_USER"/.stackscan.conf
# Default Nmap options
NMAP_OPTIONS="-Pn" # More general, no aggressive scanning options
# Group-specific Nmap scripts and their specific arguments
# Web Group
WEB_NMAP_OPTIONS="-sT" # TCP scan
WEB_NMAP_SCRIPTS=(
"http-enum"
"http-vuln*"
"http-wordpress*"
"http-phpmyadmin-dir-traversal"
"http-config-backup"
"http-vhosts"
"http-sql-injection"
"service-info"
)
WEB_NMAP_SCRIPT_ARGS=(
"http-wordpress-enum.threads=10"
"http-wordpress-brute.threads=10"
"" "" "" "" "" "" ""
)
WEB_PORTS="80,443,8080,8443,8000,8888,8181,9090,8081,9000,10000,3000,5000,7000,7001,4433,10443,16080,61000,61001"
# Auth Group
AUTH_NMAP_OPTIONS="-sS -sV" # Stealth and version detection
AUTH_NMAP_SCRIPTS=(
"ssh*"
"ftp*"
"auth*"
"ssh-auth-methods"
"mysql-brute"
"pgsql-brute"
"ms-sql-brute"
"oracle-brute"
"mysql-empty-password"
"ms-sql-empty-password"
)
AUTH_NMAP_SCRIPT_ARGS=(
"" "" "" "" "" "" "" "" "" ""
)
AUTH_PORTS="22,21,389,636"
# Database Group
DATABASE_NMAP_OPTIONS="-sT -sV" # TCP scan and version detection
DATABASE_NMAP_SCRIPTS=(
"mysql-audit"
"mysql-info"
"mysql-enum"
"pgsql-info"
"pgsql-databases"
"ms-sql-config"
"ms-sql-info"
"ms-sql-dump-hashes"
"ms-sql-query"
"ms-sql-tables"
"oracle-enum-users"
"oracle-query"
"oracle-tns-version"
"oracle-sid-brute"
)
DATABASE_NMAP_SCRIPT_ARGS=(
"" "" "" "" "" "" "" "" "" "" "" "" "" ""
)
DATABASE_PORTS="3306,5432,1433,1521,1522,1434,3050,3051"
# VULN Group-specific Nmap scripts and their specific arguments
VULN_NMAP_OPTIONS="-sS -A" # Aggressive scan with OS detection
VULN_NMAP_SCRIPTS=(
"vulners"
"http-vuln*"
"ssl-heartbleed"
"ftp-vsftpd-backdoor"
"smb-vuln*"
"http-csrf"
"dns-zone-transfer"
)
VULN_NMAP_SCRIPT_ARGS=(
"" "" "" "" "" "" ""
)
VULN_PORTS="21,22,25,53,80,110,443,445,1433,3306,3389"
# Common Group
COMMON_NMAP_OPTIONS="-sS -sV" # Stealth and version detection
COMMON_NMAP_SCRIPTS=(
"*apache*"
"dns*"
"smb*"
"firewall*"
"ssl-enum-ciphers"
"ssl-cert"
"service-info"
)
COMMON_NMAP_SCRIPT_ARGS=(
"" "" "" "" "" "" ""
)
COMMON_PORTS="22,21,53,445"
# Custom Group (User-defined)
CUSTOM_NMAP_OPTIONS=""
CUSTOM_NMAP_SCRIPTS=("")
CUSTOM_NMAP_SCRIPT_ARGS=("")
CUSTOM_PORTS=""
# Nikto scan options
NIKTO_OPTIONS="-timeout 10"
# Wapiti scan options
WAPITI_OPTIONS="--flush-session --scope domain -d 5 --max-links-per-page 100 --flush-attacks --max-scan-time 1800 --timeout 10 -m all --verify-ssl 1"
# WPScan options
WPSCAN_OPTIONS="--random-user-agent --disable-tls-checks --max-threads 10"
# SQLMap options
SQLMAP_OPTIONS="--batch --random-agent --level=3 --risk=2"
# Report generation
GENERATE_HTML_REPORT="true"
# Log level
LOG_LEVEL="INFO" # Change this to "VERBOSE" for more detailed logs
EOL
log_message "INFO" "Default configuration file created at /home/$SUDO_USER/.stackscan.conf"
sync
chown "$SUDO_USER":"$SUDO_USER" /home/"$SUDO_USER"/.stackscan.conf
chmod 600 /home/"$SUDO_USER"/.stackscan.conf
if [ -f "/home/$SUDO_USER/.stackscan.conf" ]; then
source /home/"$SUDO_USER"/.stackscan.conf
else
log_message "ERROR" "Failed to create and source the configuration file."
exit 1
fi
# Validate the config file was sourced properly
if [ -z "$NMAP_OPTIONS" ] || [ -z "$WEB_NMAP_OPTIONS" ] || [ -z "$DATABASE_NMAP_OPTIONS" ]; then
log_message "ERROR" "One or more required configuration options are missing after sourcing the config file."
exit 1
fi
}
# Now load the configuration
load_config
TARGET="$1"
# Initialize log file based on the target and current date/time
DATE_TIME=$(date +"%Y%m%d_%H%M%S")
LOG_FILE="${TARGET}_${DATE_TIME}_scan.log"
HTML_REPORT_FILE="${TARGET}_${DATE_TIME}_scan_report.html"
# Function to print the banner to console and log file
print_banner() {
local banner_text="
\e[1;31m ██████ \e[1;32m▄▄▄█████▓ \e[1;33m▄▄▄ \e[1;34m▄████▄ \e[1;35m ██ ▄█▀ \e[1;36m ██████ \e[1;31m▄████▄ \e[1;32m ▄▄▄ \e[1;33m ███▄ █
\e[1;31m▒██ ▒ \e[1;32m▓ ██▒ ▓▒\e[1;33m▒████▄ \e[1;34m▒██▀ ▀█ \e[1;35m ██▄█▒ \e[1;36m▒██ ▒ \e[1;31m▒██▀ ▀█ \e[1;32m▒████▄ \e[1;33m ██ ▀█ █
\e[1;31m░ ▓██▄ \e[1;32m▒ ▓██░ ▒░\e[1;33m▒██ ▀█▄ \e[1;34m▒▓█ ▄ \e[1;35m▓███▄░ \e[1;36m░ ▓██▄ \e[1;31m▒▓█ ▄ \e[1;32m▒██ ▀█▄ \e[1;33m▓██ ▀█ ██▒
\e[1;31m ▒ ██▒\e[1;32m░ ▓██▓ ░ \e[1;33m░██▄▄▄▄██ \e[1;34m▒▓▓▄ ▄██▒\e[1;35m▓██ █▄ \e[1;36m ▒ ██▒\e[1;31m▒▓▓▄ ▄██▒\e[1;32m░██▄▄▄▄██ \e[1;33m▓██▒ ▐▌██▒
\e[1;31m▒██████▒▒\e[1;32m ▒██▒ ░ \e[1;33m▓█ ▓██▒\e[1;34m▒ ▓███▀ ░\e[1;35m▒██▒ █▄ \e[1;36m▒██████▒▒\e[1;31m▒ ▓███▀ ░\e[1;32m ▓█ ▓██▒\e[1;33m▒██░ ▓██░
\e[1;31m▒ ▒▓▒ ▒ ░\e[1;32m ▒ ░░ \e[1;33m▒▒ ▓▒█░\e[1;34m░ ░▒ ▒ ░\e[1;35m▒ ▒▒ ▓▒\e[1;36m▒ ▒▓▒ ▒ ░\e[1;31m░ ░▒ ▒ ░\e[1;32m ▒▒ ▓▒█░\e[1;33m░ ▒░ ▒ ▒
\e[1;31m░ ░▒ ░ ░\e[1;32m ░ \e[1;33m▒ ▒▒ ░\e[1;34m ░ ▒ \e[1;35m░ ░▒ ▒░\e[1;36m░ ░▒ ░ ░ \e[1;31m ░ ▒ \e[1;32m ▒ ▒▒ ░\e[1;33m░ ░░ ░ ▒░
\e[1;31m░ ░ ░ \e[1;32m ░ \e[1;33m░ ▒ \e[1;34m ░ \e[1;35m░ ░░ ░ \e[1;36m░ ░ ░ \e[1;31m ░ \e[1;32m ░ ▒ \e[1;33m ░ ░ ░
\e[1;31m ░ \e[1;32m \e[1;33m ░ ░\e[1;34m░ ░ \e[1;35m░ ░ \e[1;36m ░ \e[1;31m░ ░ \e[1;32m ░ ░\e[1;33m ░
░ ░
\e[1;31m StackScan (c) 2024 Zayn Otley
\e[1;32m https://github.com/intuitionamiga/stackscan
\e[1;34m MIT License - Use at your own risk!
"
# Print with ANSI coloring to the console
echo -e "${BOLD}${CYAN}$banner_text${RESET}"
# If target not blank then log the banner to the log file
if [ -n "$TARGET" ] && [ -n "$TARGET_TYPE" ]; then
# Strip all ANSI escape codes from the banner and print to the log file
echo -e "$banner_text" | sed "s,\x1B\[[0-9;]*[a-zA-Z],,g" >> "$LOG_FILE"
fi
}
# Check if the user provided an argument
if [ -z "$1" ]; then
print_banner
echo "Usage: $0 [-v] <domain_or_ip>"
exit 1
fi
# Check for verbose flag
if [ "$1" == "-v" ]; then
LOG_LEVEL="VERBOSE"
shift # Remove the -v from the argument list
fi
# Function to validate the target domain, IPv4, or IPv6 address
validate_target() {
# Regex for valid domain name (simple check)
local domain_regex="^([a-zA-Z0-9](-*[a-zA-Z0-9])*\.)+[a-zA-Z]{2,}$"
# Regex for valid IPv4 address
local ipv4_regex="^([0-9]{1,3}\.){3}[0-9]{1,3}$"
# Regex for valid IPv6 address (including shorter notations)
local ipv6_regex="^(([0-9a-fA-F]{1,4}:){1,7}([0-9a-fA-F]{1,4})?|::([0-9a-fA-F]{1,4}:){0,7}([0-9a-fA-F]{1,4})?)$"
# Check if the target is a valid IPv4 address
if [[ $TARGET =~ $ipv4_regex ]]; then
TARGET_TYPE="IPv4"
# Check if the target is a valid IPv6 address
elif [[ $TARGET =~ $ipv6_regex ]]; then
TARGET_TYPE="IPv6"
# Check if the target is a valid domain name
elif [[ $TARGET =~ $domain_regex ]]; then
TARGET_TYPE="DOMAIN"
else
print_banner
print_error "Invalid target: $TARGET. Please provide a valid domain name, IPv4, or IPv6 address."
exit 1
fi
}
# Validate the target input
validate_target "$TARGET"
# Check required commands
check_required_commands() {
local cmds=("nmap" "dig" "ping6" "jq" "curl" "nikto" "wapiti")
for cmd in "${cmds[@]}"; do
if ! command -v "$cmd" &> /dev/null; then
print_error "$cmd could not be found. Please install it and try again."
exit 1
fi
done
}
check_ipv6_support() {
# Only check IPv6 support if the target is specifically identified as an IPv6 address
if [ "$TARGET_TYPE" = "IPv6" ]; then
if ping6 -c 1 -W 1 "$TARGET" &> /dev/null; then
IPV6_SUPPORTED=true
print_banner
log_message "INFO" "IPv6 is supported and reachable for $TARGET."
else
IPV6_SUPPORTED=false
print_banner
log_message "ERROR" "IPv6 is not supported or not reachable for $TARGET. Exiting."
exit 1
fi
else
IPV6_SUPPORTED=false
log_message "INFO" "IPv6 check skipped as the target is not an IPv6 address."
fi
}
# Check if the local machine supports IPv6
check_ipv6_support
# Check required commands
check_required_commands
# Print the banner
print_banner
log_message "INFO" "$(date '+[%Y-%m-%d %H:%M:%S]') Scan Date: $(date)"
# If -v parameter is provided, print message to console else print current log level
if [ "$LOG_LEVEL" = "VERBOSE" ]; then
log_message "VERBOSE" "$(date '+[%Y-%m-%d %H:%M:%S]') Verbose mode enabled. Detailed logs will be printed."
else
log_message "WARNING" "$(date '+[%Y-%m-%d %H:%M:%S]') Verbose mode disabled. Only important logs will be printed."
fi
# Spinner function
spinner() {
local delay
delay=0.1
local spinstr='|/-\'
local scan_name
scan_name="$1"
local start_time
start_time=$(date +%s) # Capture the start time
while kill -0 $! 2>/dev/null; do
# Calculate elapsed time
local current_time
current_time=$(date +%s)
local elapsed_time
elapsed_time=$((current_time - start_time))
# Format elapsed time as HH:MM:SS
local hours=$((elapsed_time / 3600))
local minutes=$(( (elapsed_time % 3600) / 60 ))
local seconds=$((elapsed_time % 60))
local formatted_time=$(printf "%02d:%02d:%02d" $hours $minutes $seconds)
# Create the spinner string
local temp=${spinstr#?}
local spinner_str=$(printf " [%c] %s (%s)" "$spinstr" "$scan_name" "$formatted_time")
spinstr=$temp${spinstr%"$temp"}
# Calculate the padding needed to right-align the spinner
local terminal_width=$(tput cols)
#local spinner_length=${#spinner_str}
#local padding=$((terminal_width - spinner_length))
# Display the right-justified spinner
printf "%*s\r" "$terminal_width" "$spinner_str"
sleep $delay
done
printf " \r" # Clear spinner after process is done
}
# Function to expand wildcard patterns to actual script names
expand_wildcard_scripts() {
local script_pattern="$1"
local expanded_scripts=()
# Expand wildcard pattern to actual script names
expanded_scripts=($(find /usr/share/nmap/scripts/ -name "${script_pattern}.nse" -exec basename {} .nse \;))
# Return the expanded script names as an array
echo "${expanded_scripts[@]}"
}
# Function to execute Nmap with scripts and their arguments
run_nmap_with_scripts() {
local scripts=("$1")
local script_args=("$2")
local ports="$3"
local target="$4"
local group_name="$5"
# Determine the Nmap options based on the group name
local nmap_options_var="${group_name^^}_NMAP_OPTIONS"
local nmap_options="${!nmap_options_var}"
# Initialize the base Nmap command
local nmap_command="nmap $nmap_options -p $ports $target"
# Check if there are any scripts to run
if [ ${#scripts[@]} -eq 0 ]; then
echo "No Nmap scripts defined for this group. Skipping script execution."
return
fi
# Loop through each script and apply its specific arguments
for i in "${!scripts[@]}"; do
script="${scripts[$i]}"
args="${script_args[$i]}"
if [ -n "$args" ]; then
nmap_command+=" --script=\"$script\" --script-args=\"$args\""
else
nmap_command+=" --script=\"$script\""
fi
done
# Execute the Nmap command
($nmap_command > /dev/null 2>&1) &
}
# Function to run a group scan
run_scan_group() {
local group_name="$1"
local group_scripts=("${!2}")
local group_script_args=("${!3}")
local group_ports="$4"
local ip_version="$5"
local target_ip="$6"
# Determine the Nmap options based on the group name
local nmap_options_var="${group_name^^}_NMAP_OPTIONS"
local nmap_options="${!nmap_options_var}"
if [ "$ip_version" == "IPv6" ]; then
nmap_options="$nmap_options -6"
fi
local output_file="${target_ip}_${group_name}_${ip_version}_scan_output.txt"
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') Starting Nmap $group_name scan on $target_ip ($ip_version)..."
# Loop through each script and apply its specific arguments
for i in "${!group_scripts[@]}"; do
local script="${group_scripts[$i]}"
local script_args="${group_script_args[$i]}"
# Expand wildcard patterns to actual script names
expanded_scripts=($(expand_wildcard_scripts "$script"))
# Loop through each expanded script name
for expanded_script in "${expanded_scripts[@]}"; do
local individual_nmap_command="nmap $nmap_options -p $group_ports $target_ip --min-rate=100 --randomize-hosts >> $output_file -vv"
if [ -n "$script_args" ]; then
individual_nmap_command+=" --script=\"$expanded_script\" --script-args=\"$script_args\""
else
individual_nmap_command+=" --script=\"$expanded_script\""
fi
# Execute the Nmap command and append the command and its output to the output file
echo "Executing Nmap Command: $individual_nmap_command" >> "$output_file"
eval $individual_nmap_command >> "$output_file" 2>&1
# Add a dividing line after each command's output
echo " " >> "$output_file"
echo "------------------------------------------------------------------" >> "$output_file"
echo " " >> "$output_file"
(spinner "Nmap $group_name scan - Script: $expanded_script") &
print_verbose "Nmap command executed for $group_name ($ip_version), Script: $expanded_script: $individual_nmap_command" >/dev/null 2>&1
done
done
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') Nmap $group_name scan on $target_ip ($ip_version) completed."
print_verbose "$(date '+[%Y-%m-%d %H:%M:%S]') Nmap $group_name scan on $target_ip ($ip_version) completed." >>/dev/null 2>&1
}
# Function to execute scans in parallel for IPv4 and IPv6
run_scans() {
local ip_version="$1"
local target_ip="$2"
# Run predefined scan groups and capture the PID for the web scan group
run_scan_group "web" WEB_NMAP_SCRIPTS[@] WEB_NMAP_SCRIPT_ARGS[@] "$WEB_PORTS" "$ip_version" "$target_ip" &
web_scan_pid=$!
# Run other scan groups in the background (no need to capture these PIDs for now)
run_scan_group "auth" AUTH_NMAP_SCRIPTS[@] AUTH_NMAP_SCRIPT_ARGS[@] "$AUTH_PORTS" "$ip_version" "$target_ip" &
run_scan_group "database" DATABASE_NMAP_SCRIPTS[@] DATABASE_NMAP_SCRIPT_ARGS[@] "$DATABASE_PORTS" "$ip_version" "$target_ip" &
database_scan_pid=$!
run_scan_group "common" COMMON_NMAP_SCRIPTS[@] COMMON_NMAP_SCRIPT_ARGS[@] "$COMMON_PORTS" "$ip_version" "$target_ip" &
run_scan_group "vuln" VULN_NMAP_SCRIPTS[@] VULN_NMAP_SCRIPT_ARGS[@] "$VULN_PORTS" "$ip_version" "$target_ip" &
# Run the custom group if defined
if [ -n "${CUSTOM_NMAP_SCRIPTS[0]}" ]; then
if ! nmap --script-help="${CUSTOM_NMAP_SCRIPTS[0]}" > /dev/null 2>&1; then
print_warning "Custom scripts not found or invalid: ${CUSTOM_NMAP_SCRIPTS[0]}"
else
run_scan_group "custom" CUSTOM_NMAP_SCRIPTS[@] CUSTOM_NMAP_SCRIPT_ARGS[@] "$CUSTOM_PORTS" "$ip_version" "$target_ip" &
fi
fi
}
# Extract any open web server ports and scan them with Wapiti, Nikto, WPScan and SQLMap
get_open_web_ports() {
local ipv4_file="${TARGET}_web_IPv4_scan_output.txt"
local ipv6_file="${TARGET}_web_IPv6_scan_output.txt"
local open_ports=""
local retry_count=0
local max_retries=3
while [ $retry_count -lt $max_retries ]; do
# Check and extract from the IPv4 scan output
if [ -f "$ipv4_file" ]; then
local ipv4_ports
ipv4_ports=$(awk '
/^[0-9]+\/tcp\s+open/ {
if ($3 ~ /^http/) {
split($1, port_info, "/")
print port_info[1]
}
}' "$ipv4_file")
open_ports+="$ipv4_ports "
fi
# Check and extract from the IPv6 scan output if available
if [ -f "$ipv6_file" ]; then
local ipv6_ports
ipv6_ports=$(awk '
/^[0-9]+\/tcp\s+open/ {
if ($3 ~ /^http/) {
split($1, port_info, "/")
print port_info[1]
}
}' "$ipv6_file")
open_ports+="$ipv6_ports "
fi
open_ports=$(echo "$open_ports" | xargs)
if [ -n "$open_ports" ]; then
break
fi
((retry_count++))
echo "Retrying to detect open web ports ($retry_count/$max_retries)..."
run_scans "IPv4" "$TARGET"
wait $web_scan_pid_v4
done
if [ $retry_count -eq $max_retries ]; then
echo "Failed to detect open web ports after $max_retries attempts."
return 1
else
echo "$open_ports"
fi
return 0
}
run_wapiti_scan() {
local target_ip="$1"
shift # Shift the arguments to get only ports
local ports=("$@") # Capture all ports into an array
local wapiti_pids=() # Array to hold the PIDs of background Wapiti processes
declare -A wapiti_scanned_ports # Declare associative array locally
local wapiti_scan_count=0 # Initialize a counter
trap '' PIPE # Ignore SIGPIPE to prevent script termination
for port in "${ports[@]}"; do
if [ "${wapiti_scanned_ports[$port]}" ]; then
continue
fi
local url="http://$target_ip:$port"
if [[ "$port" == "443" || "$port" == "8443" ]]; then
url="https://$target_ip:$port"
fi
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') Starting Wapiti scan on $target_ip:$port..."
local output_file="${target_ip}_${port}_wapiti_output.txt"
# Log the exact Wapiti command being executed
print_verbose "Executing Wapiti command: wapiti -u \"$url\" $WAPITI_OPTIONS -f txt -o \"$output_file\"" >>/dev/null 2>&1
(wapiti -u "$url" $WAPITI_OPTIONS -f txt -o "$output_file" > "${output_file}_log.txt" 2>&1) &
wapiti_pid=$! # Capture the PID of the Wapiti process
wapiti_pids+=($wapiti_pid)
wapiti_scanned_ports[$port]=1 # Mark this port as scanned
# Increment the counter
((wapiti_scan_count++))
# Start the spinner for this Wapiti process
(spinner "Wapiti on Port $port") &
spinner_pid=$!
# Wait for Wapiti to complete and kill the spinner
wait $wapiti_pid || true
kill $spinner_pid 2>/dev/null
done
# Add dividing line after each scan's output
echo " " >> "$output_file"
echo "------------------------------------------------------------------" >> "$output_file"
echo " " >> "$output_file"
# Wait for all Wapiti processes to complete
for pid in "${wapiti_pids[@]}"; do
wait $pid || true
done
# Store the number of Wapiti scans
echo "$wapiti_scan_count" > /tmp/wapiti_scan_count.txt
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') Wapiti scan on $target_ip:$port completed."
print_verbose "$(date '+[%Y-%m-%d %H:%M:%S]') Wapiti scan on $target_ip:$port completed." >>/dev/null 2>&1
}
run_nikto_scan() {
local target_ip="$1"
shift # Shift the arguments to get only ports
local ports=("$@") # Capture all ports into an array
local nikto_pids=() # Array to hold the PIDs of background Nikto processes
declare -A nikto_scanned_ports # Declare associative array locally
# Initialize or reset the scan count
local nikto_scan_count=0
trap '' PIPE # Ignore SIGPIPE to prevent script termination
for port in "${ports[@]}"; do
if [ "${nikto_scanned_ports[$port]}" ]; then
continue
fi
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') Starting Nikto scan on $target_ip:$port..."
# Define the output file
local output_file="${target_ip}_${port}_nikto_output.txt"
# Log the exact Nikto command being executed
print_verbose "Nikto command executed for $target_ip:$port: nikto -h $target_ip -p $port $NIKTO_OPTIONS -output ${output_file}" >/dev/null 2>&1
# Run Nikto in the background and immediately capture the PID
(nikto -h "$target_ip" -p "$port" $NIKTO_OPTIONS -output "$output_file" > "${output_file}_log.txt" 2>&1) &
# Add dividing line after each scan's output
echo " " >> "$output_file"
echo "------------------------------------------------------------------" >> "$output_file"
echo " " >> "$output_file"
local nikto_pid=$! # Store the PID for this particular Nikto process
nikto_pids+=($nikto_pid) # Append the PID to the array
nikto_scanned_ports[$port]=1 # Mark this port as scanned
# Increment the scan count
((nikto_scan_count++))
# Start the spinner for this Nikto process
(spinner "Nikto on Port $port") &
local spinner_pid=$!
# Wait for Nikto to complete and kill the spinner
wait $nikto_pid || true
kill $spinner_pid 2>/dev/null
print_verbose "Nikto command executed for $target_ip:$port: nikto -h $target_ip -p $port $NIKTO_OPTIONS -output ${target_ip}_${port}_nikto_output.txt" >/dev/null 2>&1
done
# Wait for all Nikto processes to complete
for pid in "${nikto_pids[@]}"; do
wait $pid
done
# Store the number of Nikto scans
echo "$nikto_scan_count" > /tmp/nikto_scan_count.txt
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') Nikto scan on $target_ip:$port completed."
print_verbose "$(date '+[%Y-%m-%d %H:%M:%S]') Nikto scan on $target_ip:$port completed." >>/dev/null 2>&1
}
run_wpscan_scan() {
local target_ip="$1"
shift # Shift the arguments to get only ports
local ports=("$@") # Capture all ports into an array
local wpscan_pids=() # Array to hold the PIDs of background WPScan processes
declare -A wpscan_scanned_ports # Declare associative array locally
local wpscan_scan_count=0 # Initialize a counter
for port in "${ports[@]}"; do
if [ "${wpscan_scanned_ports[$port]}" ]; then
continue # Skip if already scanned
fi
local url="http://$target_ip:$port"
if [[ "$port" == "443" || "$port" == "8443" ]]; then
url="https://$target_ip:$port"
fi
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') Starting WPScan on $url..."
local output_file="${target_ip}_${port}_wpscan_output.txt"
# Log the exact WPScan command being executed
print_verbose "WPScan command executed for $url: wpscan $WPSCAN_OPTIONS --url $url > $output_file" >/dev/null 2>&1
(sudo -u "$SUDO_USER" wpscan $WPSCAN_OPTIONS --url "$url" > "$output_file" 2>&1) &
wpscan_pid=$! # Capture the PID of the WPScan process
wpscan_pids+=($wpscan_pid)
wpscan_scanned_ports[$port]=1 # Mark this port as scanned
# Increment the counter
((wpscan_scan_count++))
# Start the spinner for this WPScan process
(spinner "WPScan on Port $port") &
spinner_pid=$!
# Wait for WPScan to complete and kill the spinner
wait $wpscan_pid || true
kill $spinner_pid 2>/dev/null
# Add dividing line after each scan's output
echo " " >> "$output_file"
echo "------------------------------------------------------------------" >> "$output_file"
echo " " >> "$output_file"
done
# Wait for all WPScan processes to complete
for pid in "${wpscan_pids[@]}"; do
wait $pid || true
done
# Store the number of WPScan scans
echo "$wpscan_scan_count" > /tmp/wpscan_scan_count.txt
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') WPScan scan on $target_ip:$port completed."
print_verbose "$(date '+[%Y-%m-%d %H:%M:%S]') WPScan scan on $target_ip:$port completed." >>/dev/null 2>&1
}
run_sqlmap_scan() {
local target_ip="$1"
shift # Shift the arguments to get only ports
local ports=("$@") # Capture all ports into an array
local sqlmap_pids=() # Array to hold the PIDs of background SQLMap processes
declare -A sqlmap_scanned_ports # Declare associative array locally
local sqlmap_scan_count=0 # Initialize a counter
for port in "${ports[@]}"; do
if [ "${sqlmap_scanned_ports[$port]}" ]; then
continue # Skip if already scanned
fi
local url="http://$target_ip:$port"
if [[ "$port" == "443" || "$port" == "8443" ]]; then
url="https://$target_ip:$port"
fi
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') Starting SQLMap on $url..."
local output_file="${target_ip}_${port}_sqlmap_output.txt"
# Log the exact SQLmap command being executed
print_verbose "SQLMap command executed for $url: sqlmap $SQLMAP_OPTIONS -u \"$url\" > $output_file" >/dev/null 2>&1
(sudo -u "$SUDO_USER" sqlmap $SQLMAP_OPTIONS -u "$url" > "$output_file" 2>&1) &
sqlmap_pid=$! # Capture the PID of the SQLMap process
sqlmap_pids+=($sqlmap_pid)
sqlmap_scanned_ports[$port]=1 # Mark this port as scanned
# Increment the counter
((sqlmap_scan_count++))
# Start the spinner for this SQLMap process
(spinner "SQLMap on Port $port") &
spinner_pid=$!
# Wait for SQLMap to complete and kill the spinner
wait $sqlmap_pid || true
kill $spinner_pid 2>/dev/null
# Add dividing line after each scan's output
echo " " >> "$output_file"
echo "------------------------------------------------------------------" >> "$output_file"
echo " " >> "$output_file"
done
# Wait for all SQLMap processes to complete
for pid in "${sqlmap_pids[@]}"; do
wait $pid || true
done
# Store the number of SQLMap scans
echo "$sqlmap_scan_count" > /tmp/sqlmap_scan_count.txt
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') SQLMap scan on $target_ip:$port completed."
print_verbose "$(date '+[%Y-%m-%d %H:%M:%S]') SQLMap scan on $target_ip:$port completed." >>/dev/null 2>&1
}
# Function to detect WordPress and SQL databases in both IPv4 and IPv6 outputs
detect_services() {
local target_ip="$1"
local wp_detected=false
local sql_detected=false
# Check the Nmap IPv4 output for web services (WordPress)
local nmap_web_output_v4="${target_ip}_web_IPv4_scan_output.txt"
if [ -f "$nmap_web_output_v4" ] && grep -qis "<meta name=\"generator\" content=\"WordPress\"" "$nmap_web_output_v4"; then
wp_detected=true
fi
# Check the Nmap IPv6 output for web services (WordPress)
local nmap_web_output_v6="${target_ip}_web_IPv6_scan_output.txt"
if [ -f "$nmap_web_output_v6" ] && grep -qis "<meta name=\"generator\" content=\"WordPress\"" "$nmap_web_output_v6"; then
wp_detected=true
fi
# Check the Nmap IPv4 output for all 35 SQL database services known to SQLMap
local nmap_db_output_v4="${target_ip}_database_IPv4_scan_output.txt"
if [ -f "$nmap_db_output_v4" ] && grep -qis -e "mysql" -e "postgresql" -e "mssql" -e "mariadb" -e "oracle" -e "sybase" -e "db2" -e "sqlite" -e "access" -e "firebird" -e "informix" -e "teradata" -e "memsql" -e "dynamodb" -e "arangodb" -e "couchdb" -e "mongodb" -e "monetdb" -e "mckoi" -e "presto" -e "altibase" -e "cubrid" -e "intersystems cache" -e "tibero" -e "columnstore" -e "vertica" -e "mimer" -e "hana" -e "redshift" -e "clickhouse" -e "cockroachdb" -e "greenplum" -e "nuodb" -e "oceanbase" "$nmap_db_output_v4"; then
sql_detected=true
fi
# Check the Nmap IPv6 output for all 35 SQL database services known to SQLMap
local nmap_db_output_v6="${target_ip}_database_IPv6_scan_output.txt"
if [ -f "$nmap_db_output_v6" ] && grep -qis -e "mysql" -e "postgresql" -e "mssql" -e "mariadb" -e "oracle" -e "sybase" -e "db2" -e "sqlite" -e "access" -e "firebird" -e "informix" -e "teradata" -e "memsql" -e "dynamodb" -e "arangodb" -e "couchdb" -e "mongodb" -e "monetdb" -e "mckoi" -e "presto" -e "altibase" -e "cubrid" -e "intersystems cache" -e "tibero" -e "columnstore" -e "vertica" -e "mimer" -e "hana" -e "redshift" -e "clickhouse" -e "cockroachdb" -e "greenplum" -e "nuodb" -e "oceanbase" "$nmap_db_output_v6"; then
sql_detected=true
fi
# Return the results
echo "$wp_detected $sql_detected"
}
# Run for IPv4 and capture the web and database scan PIDs
run_scans "IPv4" "$TARGET"
web_scan_pid_v4=$web_scan_pid
database_scan_pid_v4=$database_scan_pid
# Run for IPv6 only if supported and the target is not an IPv4 address, capture the web scan PID
if [ "$IPV6_SUPPORTED" = true ] && [ "$TARGET_TYPE" != "IPv4" ]; then
run_scans "IPv6" "$TARGET"
web_scan_pid_v6=$web_scan_pid
fi
# Wait for the web-related Nmap scans to finish so that we can extract the web server port numbers
wait $web_scan_pid_v4
if [ -n "$web_scan_pid_v6" ]; then
wait $web_scan_pid_v6
fi
# Extract any open web server ports and scan them with Wapiti and Nikto
# Initialize associative array
declare -A unique_ports
for port in $open_ports; do
unique_ports["$port"]=1
done
# Convert deduped associative array back to a list
open_ports="${!unique_ports[@]}"
# Initialize arrays to hold PIDs
wapiti_pids=()
nikto_pids=()
wpscan_pids=()
sqlmap_pids=()
# If no open ports found, skip all scans
if [ -n "$open_ports" ]; then
# Run Wapiti scans in parallel
run_wapiti_scan "$TARGET" $open_ports &
wapiti_pids+=($!) # Append the PID of the Wapiti process to the array
# Run Nikto scans in parallel
run_nikto_scan "$TARGET" $open_ports &
nikto_pids+=($!) # Append the PID of the Nikto process to the array
# Wait for the database-related Nmap scans to finish
wait $database_scan_pid_v4
if [ -n "$database_scan_pid_v6" ]; then
wait $database_scan_pid_v6
fi
# Detect services after database scan
services_detection=$(detect_services "$TARGET")
wp_detected=$(echo "$services_detection" | awk '{print $1}')
sql_detected=$(echo "$services_detection" | awk '{print $2}')
# Run WPScan only if WordPress was detected
if [ "$wp_detected" = "true" ]; then
run_wpscan_scan "$TARGET" $open_ports &
wpscan_pids+=($!) # Append the PID of the WPScan process to the array
fi
# Run SQLMap only if an SQL database was detected
if [ "$sql_detected" = true ]; then
run_sqlmap_scan "$TARGET" $open_ports &
sqlmap_pids+=($!) # Append the PID of the SQLMap process to the array
fi
fi
# Wait for all Wapiti processes to complete
for pid in "${wapiti_pids[@]}"; do
wait $pid || true
done
# Wait for all Nikto processes to complete
for pid in "${nikto_pids[@]}"; do
wait $pid || true
done
# Wait for all WPScan processes to complete
for pid in "${wpscan_pids[@]}"; do
wait $pid || true
done
# Wait for all SQLMap processes to complete
for pid in "${sqlmap_pids[@]}"; do
wait $pid || true
done
# Wait for other background processes if any
wait $nmap_pid
# Merge results
FINAL_OUTPUT_FILE="${TARGET}_${DATE_TIME}_final_scan_output.txt"
cat ./*_scan_output.txt > "$FINAL_OUTPUT_FILE"
# Print final status messages
print_status "$(date '+[%Y-%m-%d %H:%M:%S]') Scanning complete for $TARGET."
log_message "INFO" "$(date '+[%Y-%m-%d %H:%M:%S]') Log saved to: $LOG_FILE"
# Function to generate an HTML report with advanced features
function lookup_cve_details() {
local cve_id="$1"
local nvd_api_url="https://services.nvd.nist.gov/rest/json/cve/1.0/$cve_id"
# Fetch CVE details from NVD
local cve_details
cve_details=$(curl -s "$nvd_api_url" | jq '.result.CVE_Items[0].cve')
# Check if we got a valid response
if [[ -z "$cve_details" || "$cve_details" == "null" ]]; then
print_warning "CVE details for $cve_id could not be retrieved."
echo "N/A,N/A"
return
fi
# Extract relevant information from the JSON response
local cve_description
cve_description=$(echo "$cve_details" | jq -r '.description.description_data[0].value')
#local cve_published_date
#cve_published_date=$(echo "$cve_details" | jq -r '.publishedDate')
local cve_impact_score