Skip to content

Commit 42da27e

Browse files
six2dezsix2dez
committed
Faraday integration
1 parent 432e6ba commit 42da27e

File tree

2 files changed

+79
-11
lines changed

2 files changed

+79
-11
lines changed

‎reconftw.cfg‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ NUCLEICHECK=true # Enable or disable nuclei
103103
NUCLEI_TEMPLATES_PATH="$HOME/nuclei-templates" # Set nuclei templates path
104104
NUCLEI_SEVERITY="info,low,medium,high,critical" # Set templates criticity
105105
NUCLEI_EXTRA_ARGS="" # Additional nuclei extra flags, don't set the severity here but the exclusions like " -etags openssh"
106+
#NUCLEI_EXTRA_ARGS="-etags openssh,ssl -eid node-express-dev-env,keycloak-xss,CVE-2023-24044,CVE-2021-20323,header-sql,header-reflection" # Additional nuclei extra flags, don't set the severity here but the exclusions like " -etags openssh"
106107
NUCLEI_FLAGS=" -silent -t ${NUCLEI_TEMPLATES_PATH}/ -retries 2" # Additional nuclei extra flags, don't set the severity here but the exclusions like " -etags openssh"
107108
NUCLEI_FLAGS_JS=" -silent -tags exposure,token -severity info,low,medium,high,critical" # Additional nuclei extra flags for js secrets
108109
URL_CHECK=true # Enable or disable URL collection
@@ -217,6 +218,13 @@ AXIOM_FLEET_SHUTDOWN=true # # Enable or disable delete the fleet after the execu
217218
AXIOM_EXTRA_ARGS="" # Leave empty if you don't want to add extra arguments
218219
#AXIOM_EXTRA_ARGS=" --rm-logs" # Example
219220

221+
# Faraday-Server
222+
FARADAY=false # Enable or disable Faraday integration
223+
FARADAY_SERVER="http://localhost:5985" # Faraday server address
224+
FARADAY_USER="faraday" # Faraday user
225+
FARADAY_PASS="FARADAY_PASSWORD" # Faraday password
226+
FARADAY_WORKSPACE="reconftw" # Faraday workspace
227+
220228
# TERM COLORS
221229
bred='\033[1;31m'
222230
bblue='\033[1;34m'

‎reconftw.sh‎

Lines changed: 71 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2232,16 +2232,21 @@ function subtakeover() {
22322232
fi
22332233
cat subdomains/subdomains.txt webs/webs_all.txt 2>/dev/null | nuclei -silent -nh -tags takeover \
22342234
-severity info,low,medium,high,critical -retries 3 -rl "$NUCLEI_RATELIMIT" \
2235-
-t "${NUCLEI_TEMPLATES_PATH}" -o .tmp/tko.txt
2235+
-t "${NUCLEI_TEMPLATES_PATH}" -j -o .tmp/tko_json.txt 2>>"$LOGFILE" >/dev/null
22362236
else
22372237
cat subdomains/subdomains.txt webs/webs_all.txt 2>>"$LOGFILE" | sed '/^$/d' | anew -q .tmp/webs_subs.txt
22382238
if [[ -s ".tmp/webs_subs.txt" ]]; then
22392239
axiom-scan .tmp/webs_subs.txt -m nuclei --nuclei-templates "${NUCLEI_TEMPLATES_PATH}" \
22402240
-tags takeover -nh -severity info,low,medium,high,critical -retries 3 -rl "$NUCLEI_RATELIMIT" \
2241-
-t "${NUCLEI_TEMPLATES_PATH}" -o .tmp/tko.txt $AXIOM_EXTRA_ARGS 2>>"$LOGFILE" >/dev/null
2241+
-t "${NUCLEI_TEMPLATES_PATH}" -j -o .tmp/tko_json.txt $AXIOM_EXTRA_ARGS 2>>"$LOGFILE" >/dev/null
22422242
fi
22432243
fi
22442244

2245+
# Convert JSON to text
2246+
if [[ -s ".tmp/tko_json.txt" ]]; then
2247+
jq -r '["[" + .["template-id"] + (if .["matcher-name"] != null then ":" + .["matcher-name"] else "" end) + "] [" + .["type"] + "] [" + .info.severity + "] " + (.["matched-at"] // .host) + (if .["extracted-results"] != null then " " + (.["extracted-results"] | @json) else "" end)] | .[]' .tmp/tko_json.txt > .tmp/tko.txt
2248+
fi
2249+
22452250
# DNS Takeover
22462251
cat .tmp/subs_no_resolved.txt .tmp/subdomains_dns.txt .tmp/scrap_subs.txt \
22472252
.tmp/analytics_subs_clean.txt .tmp/passive_recursive.txt 2>/dev/null | anew -q .tmp/subs_dns_tko.txt
@@ -2264,6 +2269,16 @@ function subtakeover() {
22642269
notification "${NUMOFLINES} new possible takeovers found" info
22652270
fi
22662271

2272+
if [[ $FARADAY == true ]]; then
2273+
if ! faraday-cli status 2>>"$LOGFILE" >/dev/null; then
2274+
printf "%b[!] Faraday server is not running. Skipping Faraday integration.%b\n" "$bred" "$reset"
2275+
else
2276+
if [[ -s ".tmp/tko_json.txt" ]]; then
2277+
faraday-cli tool report -w $FARADAY_WORKSPACE --plugin-id nuclei .tmp/tko_json.txt 2>>"$LOGFILE" >/dev/null
2278+
fi
2279+
fi
2280+
fi
2281+
22672282
end_func "Results are saved in $domain/webs/takeover.txt" "${FUNCNAME[0]}"
22682283

22692284
else
@@ -2864,9 +2879,10 @@ function virtualhosts() {
28642879
-u _target_ -of json -o _output_/_cleantarget_.json" \
28652880
-o .tmp/virtualhosts 2>>"$LOGFILE" >/dev/null
28662881
else
2867-
# Run axiom-scan with nuclei-screenshots module
2868-
axiom-scan webs/webs_all.txt -m nuclei-screenshots \
2869-
-o virtualhosts "$AXIOM_EXTRA_ARGS" 2>>"$LOGFILE" >/dev/null
2882+
# Run axiom-scan with ffuf module
2883+
axiom-scan webs/webs_all.txt -m ffuf -ac -t ${FFUF_THREADS} -rate ${FFUF_RATELIMIT} \
2884+
-H "${HEADER}" -H "Host: FUZZ._cleantarget_" -w ${fuzz_wordlist} -maxtime ${FFUF_MAXTIME} \
2885+
-o .tmp/virtualhosts "$AXIOM_EXTRA_ARGS" 2>>"$LOGFILE" >/dev/null
28702886
fi
28712887

28722888
# Process ffuf output
@@ -3076,6 +3092,19 @@ function portscan() {
30763092
nmapurls <hosts/portscan_active.xml 2>>"$LOGFILE" | anew -q hosts/webs.txt
30773093
fi
30783094

3095+
3096+
if [[ $FARADAY == true ]]; then
3097+
# Check if the Faraday server is running
3098+
if ! faraday-cli status 2>>"$LOGFILE" >/dev/null; then
3099+
printf "%b[!] Faraday server is not running. Skipping Faraday integration.%b\n" "$bred" "$reset"
3100+
else
3101+
if [[ -s "hosts/portscan_active.xml" ]]; then
3102+
faraday-cli tool report -w $FARADAY_WORKSPACE --plugin-id nmap hosts/portscan_active.xml 2>>"$LOGFILE" >/dev/null
3103+
fi
3104+
fi
3105+
fi
3106+
3107+
30793108
if [[ -s "hosts/webs.txt" ]]; then
30803109
if ! NUMOFLINES=$(wc -l <hosts/webs.txt); then
30813110
printf "%b[!] Failed to count lines in hosts/webs.txt.%b\n" "$bred" "$reset"
@@ -3261,7 +3290,7 @@ function nuclei_check() {
32613290
printf "${yellow}\n[$(date +'%Y-%m-%d %H:%M:%S')] Running: Nuclei Severity: $crit ${reset}\n\n"
32623291

32633292
# Run nuclei for each severity level
3264-
nuclei $NUCLEI_FLAGS -severity "$crit" -nh -rl "$NUCLEI_RATELIMIT" "$NUCLEI_EXTRA_ARGS" -o "nuclei_output/${crit}.txt" <.tmp/webs_nuclei.txt
3293+
nuclei $NUCLEI_FLAGS -severity "$crit" -nh -rl "$NUCLEI_RATELIMIT" "$NUCLEI_EXTRA_ARGS" -j -o "nuclei_output/${crit}_json.txt" <.tmp/webs_nuclei.txt
32653294
done
32663295
printf "\n\n"
32673296
else
@@ -3276,12 +3305,28 @@ function nuclei_check() {
32763305
axiom-scan .tmp/webs_nuclei.txt -m nuclei \
32773306
--nuclei-templates "$NUCLEI_TEMPLATES_PATH" \
32783307
-severity "$crit" -nh -rl "$NUCLEI_RATELIMIT" \
3279-
"$NUCLEI_EXTRA_ARGS" -o "nuclei_output/${crit}.txt" "$AXIOM_EXTRA_ARGS" 2>>"$LOGFILE" >/dev/null
3308+
"$NUCLEI_EXTRA_ARGS" -j -o "nuclei_output/${crit}_json.txt" "$AXIOM_EXTRA_ARGS" 2>>"$LOGFILE" >/dev/null
3309+
3310+
# Parse the JSON output and save the results to a text file
3311+
jq -r '["[" + .["template-id"] + (if .["matcher-name"] != null then ":" + .["matcher-name"] else "" end) + "] [" + .["type"] + "] [" + .info.severity + "] " + (.["matched-at"] // .host) + (if .["extracted-results"] != null then " " + (.["extracted-results"] | @json) else "" end)] | .[]' nuclei_output/${crit}_json.txt > nuclei_output/${crit}.txt
32803312

32813313
# Display the results if the output file exists and is not empty
32823314
if [[ -s "nuclei_output/${crit}.txt" ]]; then
32833315
cat "nuclei_output/${crit}.txt"
32843316
fi
3317+
3318+
# Faraday integration
3319+
if [[ $FARADAY == true ]]; then
3320+
# Check if the Faraday server is running
3321+
if ! faraday-cli status 2>>"$LOGFILE" >/dev/null; then
3322+
printf "%b[!] Faraday server is not running. Skipping Faraday integration.%b\n" "$bred" "$reset"
3323+
else
3324+
if [[ -s "nuclei_output/${crit}_json.txt" ]]; then
3325+
faraday-cli tool report -w $FARADAY_WORKSPACE --plugin-id nuclei nuclei_output/${crit}_json.txt 2>>"$LOGFILE" >/dev/null
3326+
fi
3327+
fi
3328+
fi
3329+
32853330
done
32863331
printf "\n\n"
32873332
fi
@@ -3305,7 +3350,7 @@ function nuclei_check() {
33053350
function fuzz() {
33063351

33073352
# Create necessary directories
3308-
mkdir -p .tmp/fuzzing webs fuzzing nuclei_output
3353+
mkdir -p .tmp/fuzzing webs fuzzing
33093354

33103355
# Check if the function should run
33113356
if { [[ ! -f "$called_fn_dir/.${FUNCNAME[0]}" ]] || [[ $DIFF == true ]]; } && [[ $FUZZ == true ]] &&
@@ -3368,7 +3413,7 @@ function fuzz() {
33683413
end_func "No $domain/web/webs.txts file found, fuzzing skipped " ${FUNCNAME[0]}
33693414
fi
33703415

3371-
end_func "Results are saved in $domain/nuclei_output folder" "${FUNCNAME[0]}"
3416+
end_func "Results are saved in $domain/fuzzing folder" "${FUNCNAME[0]}"
33723417
else
33733418
if [[ $FUZZ == false ]]; then
33743419
printf "\n${yellow}[$(date +'%Y-%m-%d %H:%M:%S')] ${FUNCNAME[0]} skipped in this mode or defined in reconftw.cfg ${reset}\n"
@@ -4979,7 +5024,7 @@ function fuzzparams() {
49795024
fi
49805025

49815026
# Execute Nuclei with the fuzzing templates
4982-
nuclei -silent -retries 3 -rl "$NUCLEI_RATELIMIT" -t ${NUCLEI_FUZZING_TEMPLATES_PATH} -dast -o ".tmp/fuzzparams.txt" <"webs/url_extract_nodupes.txt" 2>>"$LOGFILE"
5027+
nuclei -silent -retries 3 -rl "$NUCLEI_RATELIMIT" -t ${NUCLEI_FUZZING_TEMPLATES_PATH} -dast -j -o ".tmp/fuzzparams_json.txt" <"webs/url_extract_nodupes.txt" 2>>"$LOGFILE"
49835028

49845029
else
49855030
printf "${yellow}\n[$(date +'%Y-%m-%d %H:%M:%S')] Running: Axiom with Nuclei${reset}\n\n"
@@ -4990,14 +5035,29 @@ function fuzzparams() {
49905035
fi
49915036

49925037
# Execute Axiom scan with Nuclei
4993-
axiom-scan "webs/url_extract_nodupes.txt" -m nuclei -nh -retries 3 -w "/home/op/fuzzing-templates" -rl "$NUCLEI_RATELIMIT" -dast -o ".tmp/fuzzparams.txt" $AXIOM_EXTRA_ARGS 2>>"$LOGFILE" >/dev/null
5038+
axiom-scan "webs/url_extract_nodupes.txt" -m nuclei -nh -retries 3 -w "/home/op/fuzzing-templates" -rl "$NUCLEI_RATELIMIT" -dast -j -o ".tmp/fuzzparams_json.txt" $AXIOM_EXTRA_ARGS 2>>"$LOGFILE" >/dev/null
49945039
fi
49955040

5041+
# Convert JSON output to text
5042+
jq -r '["[" + .["template-id"] + (if .["matcher-name"] != null then ":" + .["matcher-name"] else "" end) + "] [" + .["type"] + "] [" + .info.severity + "] " + (.["matched-at"] // .host) + (if .["extracted-results"] != null then " " + (.["extracted-results"] | @json) else "" end)] | .[]' .tmp/fuzzparams_json.txt > .tmp/fuzzparams.txt
5043+
49965044
# Append unique results to vulns/fuzzparams.txt
49975045
if [[ -s ".tmp/fuzzparams.txt" ]]; then
49985046
cat ".tmp/fuzzparams.txt" | anew -q "vulns/fuzzparams.txt"
49995047
fi
50005048

5049+
# Faraday integration
5050+
if [[ $FARADAY == true ]]; then
5051+
# Check if the Faraday server is running
5052+
if ! faraday-cli status 2>>"$LOGFILE" >/dev/null; then
5053+
printf "%b[!] Faraday server is not running. Skipping Faraday integration.%b\n" "$bred" "$reset"
5054+
else
5055+
if [[ -s ".tmp/fuzzparams_json.txt" ]]; then
5056+
faraday-cli tool report -w $FARADAY_WORKSPACE --plugin-id nuclei .tmp/fuzzparams_json.txt 2>>"$LOGFILE" >/dev/null
5057+
fi
5058+
fi
5059+
fi
5060+
50015061
end_func "Results are saved in vulns/fuzzparams.txt" "${FUNCNAME[0]}"
50025062

50035063
else

0 commit comments

Comments
 (0)