enum.sh

#!/bin/bash
# Jeremy Laratro - Bash Network & Web Enumeration Automation Script 
# init variables

################################## SETUP & INITIALIZATION ##################################

ip=""
domain=""

RRED="\e[31m"
RED="31"
GREEN="32"
RGREEN="\e[32m"
BOLDGREEN="\e[1;${GREEN}m"
BOLDRED="\e[1;${RED}m"
ITALICRED="\e[3;${RED}m"
ENDCOLOR="\e[0m"

help() {
  cat << EOF
Usage: $(basename "$BASH_SOURCE") [OPTIONS]

Options:
  -i IP_ADDRESS   Specify the IP address for scanning.
  -d DOMAIN       Specify the domain for directory/DNS functions. ONLY domain (-d domain.com)
  -a              Perform all actions.
  -w		      Perform web enumeration.
  -s		      Perform subdomain enumeration.
  -n		      Perform network enumeration.
  -c          HTB mode (adds the box name from -d to /etc/hosts)
              Ex. $(basename "$BASH_SOURCE") -i ip_address -d box.htb -c -a (-c will add box.htb to /etc/hosts, then -a to perform all) 
  -h              Show this help message.
  Notice: 
          - Does NOT work with old httpx default on Kali. Use v1.3.x+
          - Ensure that wordlists and scripts directories are exported as env variables. Deploy script does this automatically. 
Example:
  $(basename "$BASH_SOURCE") -i ip_address -d example.com [SWITCHES]
EOF
}

opts='i:d:x:swnabhc'
while getopts $opts arg; do
  case $arg in
    i ) ip=$OPTARG;;
    d ) domain=$OPTARG;;
    s ) sub=1;;
    w ) web=1;;
    n ) network=1;;
    a ) all=1;;
    c ) htb=1;;
    h ) help=1;;
    * ) echo "unknown argument";;
  esac
done


argcheck() {
  # if both IP and domain are provided, use domain for DNS/directory and IP for scanning.
  if [ ! -z "$ip" ] && [ ! -z "$domain" ]; then
    echo "Both IP and domain have been provided."
    echo "IP for network scanning: $ip"
    echo "Domain for DNS/directory functions: $domain"
    export SCAN_TARGET=$ip
    export DNS_TARGET=$domain
    #echo "DEBUG: ARGCHECK - EXPORT_______________________________"

  # if only IP is provided, use it for both scanning and DNS/directory functions.
  elif [ ! -z "$ip" ]; then
    echo "Only IP has been provided."
    echo "Using IP for both scanning and DNS/directory functions: $ip"
    export SCAN_TARGET=$ip
    export DNS_TARGET=$ip
  elif [ ! -z "$domain" ]; then
    echo "Only domain has been provided."
    #resolve_domain "$domain"
    export SCAN_TARGET=$RESOLVED_IP
    export DNS_TARGET=$domain
  else
    echo "No IP or domain provided. Exiting."
    exit 1
  fi
}

resolve_domain() {
  RESOLVED_IP=$(host "$1" | awk '/has address/ { print $4 }')
  if [ -z "$RESOLVED_IP" ]; then
    RESOLVED_IP=$ip
  else
    echo "Domain $1 resolved to IP: $RESOLVED_IP"
  fi
}

initialize_file_struct(){
  if [[ -d  "$scripts" ]]; then
    echo ''
  else
    export scripts=$(pwd)
  fi
  echo $pwd
  mkdir $scripts/output
  mkdir $scripts/output/scan_$ip
  echo "Creating directory in $scripts/output/"
  if [ -d '$scripts/output/scan_$SCAN_TARGET' ]
  then
    echo 'Directory already exists, moving on.'
  else
    echo 'Creating output directory'
    mkdir $scripts/output/scan_$ip 
  fi
  touch $scripts/output/scan_$ip/web_scan_$ip.txt
  touch $scripts/output/scan_$ip/inital_$ip.txt
  touch $scripts/output/scan_$ip/open.txt
  touch $scripts/output/scan_$ip/rports_$ip.txt
  #output/scan_$ip/vulnchk_$ip.xml
  web_out=$scripts/output/scan_$ip/web_scan_$ip.txt
  LOGFILE=$scripts/output/scan_$ip/inital_$ip.txt
  LOG2=$scripts/output/scan_$ip/vulnchk_$ip.xml
  echo 'Created: '$(ls $scripts/output/scan_$ip)
  export rports=$scripts/output/scan_$ip/rports_$ip.txt
  export open=$scripts/output/scan_$ip/open.txt
  #echo "DEBUG: init file - _______________________________"

}

################################## NETWORK FUNCTIONS ##################################

network(){
  # perform a full TCP port scan using rustscan
  for i in $(seq 1 10); do echo -n "---"; sleep 0.05; done;
  echo -e '\n'
  echo " Starting full port scan.."
  rustscan -a $SCAN_TARGET --ulimit 5000 -g > $rports
  cat $rports | awk '/->/{print $3}' | tr -d '[]' | tr "," "\n" |tr -d "^ " > $open
  # take the findings from rustscan and then perform a targeted fingerprinting scan with nmap
  ropen=$(cat $rports | awk '/->/{print $3}' | tr -d '[]') 
  for i in $(seq 1 10); do echo -n "---"; sleep 0.05; done;
  echo -e '\n'
  echo -e "${BOLDGREEN} The following ports are open: $ropen ${ENDCOLOR}"
  sudo nmap -sS -sV -sC $SCAN_TARGET -p "$(echo $ropen)" -oX $LOG2 -oG $LOGFILE
  for i in $(seq 1 10); do echo -n "---"; sleep 0.05; done;
  #echo "DEBUG: network _____________________________"

}

smb_scan() {
  echo -e " \n"
  echo "Checking for standard SMB service to scan with enum4linux"
  #if grep -q -E '(^|, )139(,|$)|(^|, )445(,|$)' $rports; then
  #  echo "Found open SMB ports"
  #  echo " "
  #  enum4linux $SCAN_TARGET
  #else echo 'SMB not found'
  #echo -ne " " 
  #fi
  # New, hopefully improved functionality with nested loop to check for existence of both SMB and Windows
  # If SMB -> if Windows -> CME --users, else do enum4linux 
  # there are probably some edge cases on this that will break it or cause it to execute when it's not supposed to.
  if [[ ! -z "$( grep -lr smb )" ]] && [[ ! -z "$( grep -lr windows )" ]]; then
    echo 'Attempting user listing'
    crackmapexec smb $SCAN_TARGET --users
  else
    enum4linux $SCAN_TARGET
  fi
    
  
}


searchsploit_check() (
  echo -e ' \n'
  echo  "Checking for known exploits..."
  echo -e ' \n'
  for i in seq{1..10}; do
    echo -n "."
    sleep 0.15s
  done
  echo " "
  export srch.txt="$scripts/output/scan_$SCAN_TARGET/srch.txt"
  ssh_() {
    if (cat $LOG2 | grep -q 'ssh'); then
      rm $srch.txt
      touch $srch.txt
      cat $LOG2 | grep 'ssh' | grep -o 'product=".*"' | cut -d \" -f2 | grep -o '^\S*'  > srch.txt
      cat $LOG2 | grep 'ssh' | grep -oE 'version="[0-9]?.[0-9]?.' | grep -Eo '[0-9]?.[0.9]..' >> srch.txt
      vv=$(cat srch.txt)
      if [ ! -z srch.txt ]; then
        echo 'Searching exploitdb for' $vv
        searchsploit $vv
        # echo 'Analyzing ssh vulnerabilities'
        # nmap $ip --script=ssh-\* -v
        echo ' '
        
      else
        echo ' '
      fi
    else
      echo ' '
    fi
  }
  ssh_
  
  ftp_() {
    if (cat $LOG2 | grep -q 'ftp'); then
  	rm $srch.txt
  	touch $srch.txt
  	cat $LOG2 | grep 'ftp' | grep -o 'product=".*"' | cut -d \" -f2 | grep -o '^\S*'  > srch.txt
  	cat $LOG2 | grep 'ftp' | grep -oE 'version="[0-9]?.[0-9]?.' | grep -Eo '[0-9]?.[0.9]..' >> srch.txt
  	vv=$(cat srch.txt)
  	if [ ! -z srch.txt ]; then
  		echo 'Searching exploitdb for' $vv
  		searchsploit $vv
  		echo ' '
  		
  	else
  		echo ' '
  	fi
    else
      echo ' '
    fi
  }
  ftp_
  
  smb_() {
    if (cat $LOG2 | grep -q 'smb'); then
  	rm $srch.txt
  	touch $srch.txt
  	cat $LOG2 | grep 'smb' | grep -o 'product=".*"' | cut -d \" -f2 | grep -o '^\S*'  > srch.txt
  	cat $LOG2 | grep 'smb' | grep -oE 'version="[0-9]?.[0-9]?.' | grep -Eo '[0-9]?.[0.9].' >> srch.txt
  	vv=$(cat srch.txt)
  	if [ ! -z srch.txt ]; then
  		echo 'Searching exploitdb for' $vv
  		searchsploit $vv
  		echo ' '
  		echo 'Analyzing smb vulnerabilities'
          nmap $ip --script=smb-vuln\* -v
          echo ' '
  		
  	else
  		echo ' '
  	fi
    else
      echo ' '
    fi
  }
  smb_
  
  web_() {
    if (cat $LOG2 | grep -q 'http'); then
  	rm $srch.txt
  	touch $srch.txt
  	cat $LOG2 | grep 'http' | grep -o 'product=".*"' | cut -d \" -f2 | cut -d " " -f1,2  > srch.txt
  	cat $LOG2 | grep 'http' | grep -oE 'version="[0-9]?.[0-9]?.' | grep -Eo '[0-9]?.[0.9].' >> srch.txt
  	vv=$(cat srch.txt)
  	if [ ! -z srch.txt ]; then
  		echo 'Searching exploitdb for' $vv
  		searchsploit $vv
  		echo ' '
  		echo 'Analyzing http vulnerabilities'
          nmap $ip --script=http-vuln\* -v
          echo ' '
  		
  	else
  		echo ' '
  	fi
    else
      echo ' '
    fi
  }
  #web_
)

################################## WEB FUNCTIONS  ##################################
 
web_server_discovery() {
  echo -e '\n' ; echo -e "${BOLDGREEN} Starting web discovery ${ENDCOLOR} "
  port_input_file="$scripts/output/scan_$SCAN_TARGET/open.txt" 
  for i in $(seq 1 10); do echo -n "---";  sleep 0.05; done; echo -e ' '
  while IFS= read -r port <&3; do
    echo -e '\n' ; echo "Checking for webserver on $ip:$port"
    status=$(httpx -silent -status-code -no-color -target "http://$ip:$port" | grep -oP '\[\K\d+(?=\])')
    if [[ ! -z $status ]]; then
      echo -e "${BOLDGREEN}Webserver detected on port $port with status code: $status ${ENDCOLOR}"
      echo $port >> $scripts/output/scan_$SCAN_TARGET/websrv.txt
      if [ $DNS_TARGET ]; then 
        echo -e ' '; echo "Performing web server fingerprinting and information gathering: "
        whatweb $DNS_TARGET:$port
        #nikto -h $DNS_TARGET:$port
        echo -e ' ' ; echo 'Taking screenshots of web application:' 
        gowitness single http://$DNS_TARGET # need fix
      else
        echo -e ' '; echo "Performing web server fingerprinting and information gathering: "
        whatweb $SCAN_TARGET:$port
        #nikto -h $SCAN_TARGET:$port
      fi
    else
      echo -e "${RED} No webserver detected on port $port. ${ENDCOLOR}"
    fi
  done 3< "$port_input_file" 
  echo "Scan complete. Results saved to output/scan_$ip/websrv.txt"
}


directory_enumeration(){
  echo -e ' '
  for i in $(seq 1 10); do echo -n "---"; sleep 0.05; done;
  echo -e ' '
  echo "Starting web directory enumeration"
  websrv_input_file="$scripts/output/scan_$ip/websrv.txt"
  while IFS= read -r wport <&3; do
    if [ $DNS_TARGET ]; then 
      echo 'DNS'
      gospider -s $DNS_TARGET:$wport
      dirsearch -u $DNS_TARGET:$wport 
    else
      echo 'ip' 
      gospider -s $SCAN_TARGET:$wport
      dirsearch -u $SCAN_TARGET:$wport 
    fi
  done 3< "$websrv_input_file"    
}


dns_enum() {
  if [ $DNS_TARGET ]; then
    dig ANY $domain @$SCAN_TARGET
    dig ANY $domain
  else
    dig ANY $ip
  fi
  #  vhost subdomain enum
  websrv_input_file="$scripts/output/scan_$SCAN_TARGET/websrv.txt"
  while IFS= read -r wport <&3; do
    timeout 5 wfuzz -c -w $wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -H "Host: FUZZ.$DNS_TARGET" $DNS_TARGET:$wport > $scripts/output/scan_$SCAN_TARGET/initial_fuzz.txt
    hide=$(cat $scripts/output/scan_$SCAN_TARGET/initial_fuzz.txt | grep -oP '\b[0-9]{1,4}(?= L\b)' | uniq) # still buggy
    echo $hide
    echo "Performing VHOST fuzzing on $DNS_TARGET:$wport"
    wfuzz -w $wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt --hl $hide -H "Host: FUZZ.$DNS_TARGET" $DNS_TARGET:$wport 
    gobuster dns -d $DNS_TARGET -w $wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt
  done 3< "$websrv_input_file"   
}

################################## MAIN ################################## 

formatter() {
  #cat vulnchk_10.11.1.111.xml| grep -Po 'portid="*[0-9]+."' | tr -d 'portid="' | sed 's/$/,/' | tr -d '\n' >> report_$ip.txt
  echo 'Target: '$SCAN_TARGET 
  echo 'Hostname: '$DNS_TARGET
  echo 'TCP: ' && cat $rports |  awk '/->/{print $3}' | tr -d '[]' 
}


main() {
  initialize_file_struct
  argcheck
  if [ ! -z "$htb" ] 
  then
    echo "$domain" | sudo tee -a /etc/hosts
  fi
  # check if either ip or domain is provided
  if [ -z "$ip" ] && [ -z "$domain" ]; then
    echo "Please provide either -i or -d option"
    exit 1
  fi
  
  if [ ! -z "$network" ]
  then
    echo "Starting network scan.."
    echo " " 
    network
    smb_scan
    searchsploit_check 
  fi
  
  if [ ! -z "$help" ]
  then
    help
  fi
  if [ ! -z "$sub" ]
  then
    echo "Starting DNS discovery"
    dns_enum
  fi
  
  if [ ! -z "$smb" ]
  then
    smb_scan
  fi
  
  if [ ! -z "$web" ]
  then
    web_server_discovery
    directory_enumeration
    
  fi
  if [ ! -z "$all" ]
  then
    echo -e "${BOLDGREEN} All commands enabled ${ENDCOLOR}"
    network
    searchsploit_check
    web_server_discovery
    dns_enum
    smb_scan
    directory_enumeration
  fi
}

main

# CHANGELOG
# v1.02
#  - Added CTF / HTB mode to eliminate routing issues with CTF vms with no DNS routing
# v1.01
#	- Remade smb_scan function to check more widely for smb service and also check for windows, 
#     then attempt user listing with CME 
# v1.00  
#	- Major update. Complete refactoring. Started changelog. 
#	- Removed old, commented code 
#	- Removed unecessary switches and consolidated the choices
#	- Made network into one function, using both rustscan and nmap
#	- Greatly improved the method of parsing domain vs ip and handling of both
#	- Added better dns enum, added vhost fuzzing (especially useful for HTB!)
# 	- Cleaned up code and improved functions where possible 


#TO DO
# Add back SMB function with conditional statements - ie., if smb -> CME --users
# Fix the input logic - required vs optional, ip vs domain and vhost
# add more robust web scanning - bug bounty focused